filenamebcrypt.dll
size111104 (0x1b200)
md578348cb9d45105c36c2b6c5c34c6a79f
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1473072920
1076
203655013
205655018
206655017
202655011
2106550138
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x54503d6a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x18800
SizeOfInitializedData0x2c00
SizeOfUninitializedData0
AddressOfEntryPoint0x8270
BaseOfCode0x1000
BaseOfData0x1a000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0x1e000
SizeOfHeaders0x400
CheckSum0x26e4e
Subsystem3
DllCharacteristics0x4140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x1867a0x18800R-X CODE
.data0x1a0000x64c0x200RW- IDATA
.idata0x1b0000xa4c0xc00R-- IDATA
.rsrc0x1c0000xab80xc00R-- IDATA
.reloc0x1d0000xb000xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x18ed00x7aa
IMPORT0x1b1380xf0
RESOURCE0x1c0000xab8
EXCEPTION00
SECURITY00
BASERELOC0x1d0000xb00
DEBUG0x11300x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1ab00x5c
Bound_IAT00
IAT0x1b0000x134
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12320
WEVT_TEMPLATE#112580
VERSION#19720
module_namehintordfunction_name
ntdll.dll1093RtlLeaveCriticalSection
ntdll.dll1014RtlInitializeCriticalSection
ntdll.dll635RtlAcquireResourceShared
ntdll.dll2163wcsncmp
ntdll.dll578NtTerminateProcess
ntdll.dll917RtlFreeHeap
ntdll.dll1216RtlReleaseResource
ntdll.dll69EtwGetTraceLoggerHandle
ntdll.dll671RtlAllocateHeap
ntdll.dll466NtQueryValueKey
ntdll.dll811RtlDeleteResource
ntdll.dll235NtClose
ntdll.dll1134RtlNtStatusToDosError
ntdll.dll83EtwUnregisterTraceGuids
ntdll.dll58EtwEventUnregister
ntdll.dll76EtwRegisterTraceGuidsW
ntdll.dll804RtlDeleteCriticalSection
ntdll.dll634RtlAcquireResourceExclusive
ntdll.dll853RtlEnterCriticalSection
ntdll.dll382NtOpenKey
ntdll.dll1024RtlInitializeResource
ntdll.dll2055_wcsicmp
ntdll.dll723RtlCompareUnicodeString
ntdll.dll992RtlImageNtHeader
ntdll.dll56EtwEventRegister
ntdll.dll67EtwGetTraceEnableFlags
ntdll.dll379NtOpenFile
ntdll.dll68EtwGetTraceEnableLevel
ntdll.dll104LdrDisableThreadCalloutsForDll
ntdll.dll59EtwEventWrite
ntdll.dll1007RtlInitUnicodeString
ntdll.dll81EtwTraceMessage
ntdll.dll302NtDeviceIoControlFile
ntdll.dll1333RtlUnhandledExceptionFilter
ntdll.dll1988_alloca_probe
ntdll.dll2104memcmp
ntdll.dll2105memcpy
ntdll.dll2109memset
ntdll.dll1357RtlUnwind
api-ms-win-core-libraryloader-l1-2-0.dll21LoadLibraryExW
api-ms-win-core-libraryloader-l1-2-0.dll10FreeLibrary
api-ms-win-core-libraryloader-l1-2-0.dll19GetProcAddress
api-ms-win-core-libraryloader-l1-2-0.dll14GetModuleFileNameW
api-ms-win-core-errorhandling-l1-1-1.dll3GetLastError
api-ms-win-core-synch-l1-2-0.dll22InitializeCriticalSection
api-ms-win-core-synch-l1-2-0.dll25InitializeSRWLock
api-ms-win-core-synch-l1-2-0.dll35ReleaseSRWLockShared
api-ms-win-core-synch-l1-2-0.dllAcquireSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll34ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll1AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0.dll15EnterCriticalSection
api-ms-win-core-synch-l1-2-0.dll27LeaveCriticalSection
api-ms-win-core-synch-l1-2-0.dll13DeleteCriticalSection
api-ms-win-core-synch-l1-2-0.dll6CreateEventW
api-ms-win-core-handle-l1-1-0.dllCloseHandle
api-ms-win-core-processthreads-l1-1-2.dll42OpenProcessToken
api-ms-win-core-processthreads-l1-1-2.dll61SetThreadStackGuarantee
api-ms-win-core-processthreads-l1-1-2.dll11GetCurrentProcess
api-ms-win-security-base-l1-2-0.dll84PrivilegeCheck
api-ms-win-core-threadpool-legacy-l1-1-0.dll6UnregisterWaitEx
api-ms-win-core-threadpool-private-l1-1-0.dllRegisterWaitForSingleObjectEx
api-ms-win-core-sysinfo-l1-2-1.dll14GetSystemInfo
api-ms-win-core-sysinfo-l1-2-1.dll12GetSystemDirectoryW
api-ms-win-core-memory-l1-1-2.dll37VirtualProtect
api-ms-win-core-memory-l1-1-2.dll31VirtualAlloc
api-ms-win-core-memory-l1-1-2.dll39VirtualQuery
ordentry_vafunction_name
10x8f20BCryptAddContextFunction
20x9680BCryptAddContextFunctionProvider
30x2ef0BCryptCloseAlgorithmProvider
40x8c80BCryptConfigureContext
50x9370BCryptConfigureContextFunction
60x8940BCryptCreateContext
70x58c0BCryptCreateHash
80x5f40BCryptCreateMultiHash
90x4250BCryptDecrypt
100x8a50BCryptDeleteContext
110x5360BCryptDeriveKey
120x6b30BCryptDeriveKeyCapi
130x7180BCryptDeriveKeyPBKDF2
140x61b0BCryptDestroyHash
150x56a0BCryptDestroyKey
160x57e0BCryptDestroySecret
170x62d0BCryptDuplicateHash
180x54c0BCryptDuplicateKey
190x3f70BCryptEncrypt
200x2f70BCryptEnumAlgorithms
210x9950BCryptEnumContextFunctionProviders
220x9190BCryptEnumContextFunctions
230x8b50BCryptEnumContexts
240x3350BCryptEnumProviders
250x8880BCryptEnumRegisteredProviders
260x4500BCryptExportKey
270x3ea0BCryptFinalizeKeyPair
280x5e20BCryptFinishHash
290x36c0BCryptFreeBuffer
300x6a30BCryptGenRandom
310x3d50BCryptGenerateKeyPair
320x3b70BCryptGenerateSymmetricKey
330xba30BCryptGetFipsAlgorithmMode
340x3710BCryptGetProperty
350x5d80BCryptHashData
360x49c0BCryptImportKey
370x4ca0BCryptImportKeyPair
380x7570BCryptKeyDerivation
390x2a00BCryptOpenAlgorithmProvider
400x6120BCryptProcessMultiOperations
410x8d80BCryptQueryContextConfiguration
420x94b0BCryptQueryContextFunctionConfiguration
430x9cd0BCryptQueryContextFunctionProperty
440x86d0BCryptQueryProviderRegistration
450x9ed0BCryptRegisterConfigChangeNotify
460x8430BCryptRegisterProvider
470x9060BCryptRemoveContextFunction
480x97f0BCryptRemoveContextFunctionProvider
490xa020BCryptResolveProviders
500x5200BCryptSecretAgreement
510x7660BCryptSetAuditingInterface
520x9b50BCryptSetContextFunctionProperty
530x3a70BCryptSetProperty
540x6510BCryptSignHash
550x9f90BCryptUnregisterConfigChangeNotify
560x85f0BCryptUnregisterProvider
570x67d0BCryptVerifySignature
module_namebcrypt.dll
flags0
timestamp2014-10-29 00:13:12
version0.0
ordinal_base1
nFunctions57
nNames57
Names(57)0x18fdc
Functions(57)0x18ef8
NameOrdinals(57)0x190c0

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Cryptographic Primitives Library (Wow64)
FileVersion6.3.9600.17415 (winblue_r4.141028-1500)
InternalNamebcrypt.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamebcrypt.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.17415

VS_FIXEDFILEINFO

FileVersion6.3.9600.17415
ProductVersion6.3.9600.17415
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0111104DLL10/29/2014 01:05:46#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK