cacls.exe - Control ACLs Program

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	cacls.exe
size	33280 (0x8200)
md5	7b353f98e18fd9bea92d4ca9aeeba9cc

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
147	30729	42
259	26213	3
260	26213	18
1	0	106
257	26213	7
261	26213	4
265	26213	7
255	26213	1
258	26213	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x7fd681c9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.13
SizeOfCode	0x4c00
SizeOfInitializedData	0x3800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x52b0
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0xd000
SizeOfHeaders	0x400
CheckSum	0x13b98
Subsystem	3
DllCharacteristics	0xc160
SizeOfStackReserve	0x80000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4ab0	0x4c00	R-X CODE
.rdata	0x6000	0x201c	0x2200	R-- IDATA
.data	0x9000	0x608	0x200	RW- IDATA
.pdata	0xa000	0x2d0	0x400	R-- IDATA
.rsrc	0xb000	0x7e8	0x800	R-- IDATA
.reloc	0xc000	0x54	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x704c	0x1e0
RESOURCE	0xb000	0x7e8
EXCEPTION	0xa000	0x2d0
SECURITY	0	0
BASERELOC	0xc000	0x54
DEBUG	0x6a50	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x60e0	0x108
Bound_IAT	0	0
IAT	0x61e8	0x3c0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
MUI	#1	200
VERSION	#1	904
MANIFEST	#1	677

module_name	hint	function_name
msvcrt.dll	87	__C_specific_handler
msvcrt.dll	144	__setusermatherr
msvcrt.dll	193	_cexit
msvcrt.dll	270	_exit
msvcrt.dll	142	__set_app_type
msvcrt.dll	157	__wgetmainargs
msvcrt.dll	174	_amsg_exit
msvcrt.dll	85	_XcptFilter
msvcrt.dll	191	_callnewh
msvcrt.dll	1158	malloc
msvcrt.dll	1002	_wsetlocale
msvcrt.dll	1170	memcpy
msvcrt.dll	129	__iob_func
msvcrt.dll	1100	free
msvcrt.dll	1181	printf
msvcrt.dll	1086	fgetws
msvcrt.dll	1281	wcschr
msvcrt.dll	1093	fprintf
msvcrt.dll	295	_fmode
msvcrt.dll	875	_vsnwprintf_s
msvcrt.dll	906	_wcsicmp
msvcrt.dll	1274	vswprintf_s
msvcrt.dll	1280	wcscat_s
msvcrt.dll	47	void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	381	_initterm
msvcrt.dll	1110	fwprintf_s
msvcrt.dll	1080	ferror
msvcrt.dll	1109	fwprintf
msvcrt.dll	1074	exit
msvcrt.dll	1312	wprintf
msvcrt.dll	916	_wcsnicmp
msvcrt.dll	1285	wcscpy_s
msvcrt.dll	210	_commode
msvcrt.dll	1174	memset
ntdll.dll	1226	RtlLookupFunctionEntry
ntdll.dll	746	RtlCaptureContext
ntdll.dll	409	NtOpenFile
ntdll.dll	1245	RtlNtStatusToDosError
ntdll.dll	1522	RtlVirtualUnwind
ntdll.dll	466	NtQueryInformationFile
ntdll.dll	251	NtClose
ntdll.dll	1337	RtlReleaseRelativeName
ntdll.dll	903	RtlDosPathNameToRelativeNtPathName_U
ntdll.dll	989	RtlFreeHeap
NTMARTA.dll	40	AccTreeResetNamedSecurityInfo
api-ms-win-security-lsalookup-l2-1-0.dll		LookupAccountNameW
api-ms-win-security-lsalookup-l2-1-0.dll	1	LookupAccountSidW
api-ms-win-core-heap-l2-1-0.dll	2	LocalAlloc
api-ms-win-core-heap-l2-1-0.dll	3	LocalFree
api-ms-win-core-errorhandling-l1-1-0.dll	5	GetLastError
api-ms-win-core-errorhandling-l1-1-0.dll	17	UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll	15	SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll	13	SetLastError
api-ms-win-security-base-l1-1-0.dll	71	InitializeAcl
api-ms-win-security-base-l1-1-0.dll	53	GetLengthSid
api-ms-win-security-base-l1-1-0.dll	55	GetSecurityDescriptorControl
api-ms-win-security-base-l1-1-0.dll	52	GetKernelObjectSecurity
api-ms-win-security-base-l1-1-0.dll	51	GetFileSecurityW
api-ms-win-security-base-l1-1-0.dll	56	GetSecurityDescriptorDacl
api-ms-win-security-base-l1-1-0.dll	13	AddAce
api-ms-win-security-base-l1-1-0.dll	98	SetSecurityDescriptorDacl
api-ms-win-security-base-l1-1-0.dll	88	QuerySecurityAccessMask
api-ms-win-security-base-l1-1-0.dll	96	SetSecurityAccessMask
api-ms-win-security-base-l1-1-0.dll	72	InitializeSecurityDescriptor
api-ms-win-security-base-l1-1-0.dll	93	SetKernelObjectSecurity
api-ms-win-security-base-l1-1-0.dll	44	EqualSid
api-ms-win-security-sddl-l1-1-0.dll	2	ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-sddl-l1-1-0.dll		ConvertSecurityDescriptorToStringSecurityDescriptorW
api-ms-win-core-handle-l1-1-0.dll		CloseHandle
api-ms-win-core-file-l1-1-0.dll	44	GetFileAttributesW
api-ms-win-core-file-l1-1-0.dll	53	GetFullPathNameW
api-ms-win-core-file-l1-1-0.dll	67	GetVolumePathNameW
api-ms-win-core-file-l1-1-0.dll	20	FindFirstFileW
api-ms-win-core-file-l1-1-0.dll	12	FindClose
api-ms-win-core-file-l1-1-0.dll	65	GetVolumeInformationW
api-ms-win-core-file-l1-1-0.dll	26	FindNextFileW
api-ms-win-core-string-l1-1-0.dll	7	WideCharToMultiByte
api-ms-win-core-string-l1-1-0.dll	2	CompareStringW
api-ms-win-core-console-l1-1-0.dll	7	GetConsoleOutputCP
api-ms-win-core-console-l1-1-0.dll	19	WriteConsoleW
api-ms-win-core-console-l1-1-0.dll	6	GetConsoleMode
api-ms-win-core-processenvironment-l1-1-0.dll	12	GetStdHandle
api-ms-win-core-localization-l1-2-0.dll	61	SetThreadUILanguage
api-ms-win-core-localization-l1-2-0.dll	9	FormatMessageW
api-ms-win-core-processthreads-l1-1-0.dll	12	GetCurrentProcess
api-ms-win-core-processthreads-l1-1-0.dll	77	TerminateProcess
api-ms-win-core-processthreads-l1-1-0.dll	17	GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-0.dll	13	GetCurrentProcessId
api-ms-win-core-file-l1-2-0.dll	66	GetVolumeNameForVolumeMountPointW
api-ms-win-core-heap-l1-1-0.dll	10	HeapSetInformation
api-ms-win-core-synch-l1-2-0.dll	45	Sleep
api-ms-win-core-libraryloader-l1-2-0.dll	20	GetModuleHandleW
api-ms-win-core-profile-l1-1-0.dll		QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0.dll	25	GetTickCount
api-ms-win-core-sysinfo-l1-1-0.dll	21	GetSystemTimeAsFileTime
api-ms-win-core-string-obsolete-l1-1-0.dll	11	lstrlenW
api-ms-win-security-provider-l1-1-0.dll	4	SetNamedSecurityInfoW

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Control ACLs Program
FileVersion	10.0.17763.1 (WinBuild.160101.0800)
InternalName	cacls
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	CACLS.EXE
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.17763.1

VS_FIXEDFILEINFO

FileVersion	10.0.17763.1
ProductVersion	10.0.17763.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	27696	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

cacls.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

cacls.exe
-