filenameJPEG.DLL
size58880 (0xe600)
md55a9150ae34c03bce194eae5faa9dcb5e
typePE32 executable (DLL) (Windows CE) ARM, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
8930643
1019
48961526
8830641
8630641

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x1c0
NumberOfSections4
TimeDateStamp0x413a6e28
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x212e
Magic0x10b
LinkerVersion6.24
SizeOfCode0xd400
SizeOfInitializedData0xe00
SizeOfUninitializedData0
AddressOfEntryPoint0xe084
BaseOfCode0x1000
BaseOfData0xf000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion2.0
Reserved10
SizeOfImage0x12000
SizeOfHeaders0x400
CheckSum0
Subsystem9
DllCharacteristics0
SizeOfStackReserve0x10000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xd3f30xd400R-X CODE
.data0xf0000x7c0x200RW- IDATA
.pdata0x100000x4b00x600R-- IDATA
.reloc0x110000x4020x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xe2500x1a3
IMPORT0xe1c00x28
RESOURCE00
EXCEPTION0x100000x4b0
SECURITY00
BASERELOC0x110000x38c
DEBUG0x10000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xf0000x50
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
COREDLL.dll1047
COREDLL.dll1044
COREDLL.dll1115
COREDLL.dll1100
COREDLL.dll719
COREDLL.dll2008
COREDLL.dll2005
COREDLL.dll2012
COREDLL.dll2027
COREDLL.dll2044
COREDLL.dll1041
COREDLL.dll1018
COREDLL.dll2032
COREDLL.dll2026
COREDLL.dll2051
COREDLL.dll2015
COREDLL.dll2020
COREDLL.dll1232
COREDLL.dll36
ordentry_vafunction_name
10x2828jpeg_CreateDecompress
20x2e10jpeg_calc_output_dimensions
30x29e8jpeg_consume_input
40x2944jpeg_destroy_decompress
50x2cfcjpeg_finish_decompress
60x39d4jpeg_finish_output
70x2948jpeg_read_header
80x3858jpeg_read_scanlines
90x3aa4jpeg_resync_to_restart
100x3690jpeg_start_decompress
110x3954jpeg_start_output
120x5bb8jpeg_std_error
module_namejpeg.dll
flags0
timestamp2004-09-05 01:38:47
version0.0
ordinal_base1
nFunctions12
nNames12
Names(12)0xe2a8
Functions(12)0xe278
NameOrdinals(12)0xe2d8
offsetsizetypecomment
058880DLL09/05/2004 01:38:48#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK