ALTBot.exe - ALTBot.dll

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	ALTBot.exe
size	174592 (0x2aa00)
md5	7c8dbab68301732adb4797297252f8eb

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
259	26706	8
261	26706	63
260	26706	28
147	30729	18
257	25711	9
1	0	169
261	27035	13
258	27035	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x5e9fbf92
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.16
SizeOfCode	0x17e00
SizeOfInitializedData	0x12800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x14680
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x2f000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0xc160
SizeOfStackReserve	0x180000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x17d3c	0x17e00	R-X CODE
.rdata	0x19000	0xf214	0xf400	R-- IDATA
.data	0x29000	0x19e8	0xe00	RW- IDATA
.pdata	0x2b000	0x162c	0x1800	R-- IDATA
.rsrc	0x2d000	0x538	0x600	R-- IDATA
.reloc	0x2e000	0x6d8	0x800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x2726c	0x118
RESOURCE	0x2d000	0x538
EXCEPTION	0x2b000	0x162c
SECURITY	0	0
BASERELOC	0x2e000	0x6d8
DEBUG	0x22760	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x228c0	0x28
LOAD_CONFIG	0x227c0	0x100
Bound_IAT	0	0
IAT	0x19000	0x468
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x140023eb8	0x140023ec8	0x14002a2b8	0x140019520	0	0x400000

show previews

type	name	size	cp
VERSION	#1	684	1252
MANIFEST	#1	490	1252

module_name	hint	function_name
KERNEL32.dll	377	FindClose
KERNEL32.dll	383	FindFirstFileExW
KERNEL32.dll	400	FindNextFileW
KERNEL32.dll	581	GetFileAttributesExW
KERNEL32.dll	604	GetFullPathNameW
KERNEL32.dll	761	GetTempPathW
KERNEL32.dll	611	GetLastError
KERNEL32.dll	866	InitializeCriticalSection
KERNEL32.dll	307	EnterCriticalSection
KERNEL32.dll	955	LeaveCriticalSection
KERNEL32.dll	572	GetEnvironmentVariableW
KERNEL32.dll	539	GetCurrentProcess
KERNEL32.dll	911	IsWow64Process
KERNEL32.dll	630	GetModuleFileNameW
KERNEL32.dll	633	GetModuleHandleExW
KERNEL32.dll	689	GetProcAddress
KERNEL32.dll	961	LoadLibraryExW
KERNEL32.dll	959	LoadLibraryA
KERNEL32.dll	1003	MultiByteToWideChar
KERNEL32.dll	1541	WideCharToMultiByte
KERNEL32.dll	431	FreeLibrary
KERNEL32.dll	1240	RtlUnwindEx
KERNEL32.dll	1119	RaiseException
KERNEL32.dll	1045	OutputDebugStringW
KERNEL32.dll	634	GetModuleHandleW
KERNEL32.dll	540	GetCurrentProcessId
KERNEL32.dll	1411	Sleep
KERNEL32.dll	1206	RemoveDirectoryW
KERNEL32.dll	271	DeleteCriticalSection
KERNEL32.dll	185	CreateDirectoryW
KERNEL32.dll	1236	RtlPcToFileHeader
KERNEL32.dll	871	InitializeSListHead
KERNEL32.dll	544	GetCurrentThreadId
KERNEL32.dll	1097	QueryPerformanceCounter
KERNEL32.dll	893	IsDebuggerPresent
KERNEL32.dll	900	IsProcessorFeaturePresent
KERNEL32.dll	1426	TerminateProcess
KERNEL32.dll	1395	SetUnhandledExceptionFilter
KERNEL32.dll	1460	UnhandledExceptionFilter
KERNEL32.dll	1241	RtlVirtualUnwind
KERNEL32.dll	1234	RtlLookupFunctionEntry
KERNEL32.dll	1227	RtlCaptureContext
KERNEL32.dll	943	LCMapStringW
KERNEL32.dll	748	GetSystemTimeAsFileTime
KERNEL32.dll	1445	TlsFree
KERNEL32.dll	1447	TlsSetValue
KERNEL32.dll	1446	TlsGetValue
KERNEL32.dll	1444	TlsAlloc
KERNEL32.dll	1421	SwitchToThread
KERNEL32.dll	867	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1335	SetLastError
KERNEL32.dll	264	DecodePointer
KERNEL32.dll	303	EncodePointer
KERNEL32.dll	730	GetStringTypeW
USER32.dll	663	MessageBoxW
SHELL32.dll	438	ShellExecuteW
ADVAPI32.dll	652	RegOpenKeyExW
ADVAPI32.dll	603	RegCloseKey
ADVAPI32.dll	704	ReportEventW
ADVAPI32.dll	686	RegisterEventSourceW
ADVAPI32.dll	237	DeregisterEventSource
ADVAPI32.dll	641	RegGetValueW
api-ms-win-crt-runtime-l1-1-0.dll	53	_initialize_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	57	_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	25	_configure_wide_argv
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	6	__p___wargv
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	84	abort
api-ms-win-crt-runtime-l1-1-0.dll	41	_get_initial_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	33	_errno
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	23	calloc
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-math-l1-1-0.dll	203	frexp
api-ms-win-crt-stdio-l1-1-0.dll	98	_wfopen
api-ms-win-crt-stdio-l1-1-0.dll	17	__stdio_common_vswprintf
api-ms-win-crt-stdio-l1-1-0.dll	116	fclose
api-ms-win-crt-stdio-l1-1-0.dll	131	fread
api-ms-win-crt-stdio-l1-1-0.dll	135	fseek
api-ms-win-crt-stdio-l1-1-0.dll	138	fwrite
api-ms-win-crt-stdio-l1-1-0.dll		__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	129	fputwc
api-ms-win-crt-stdio-l1-1-0.dll	130	fputws
api-ms-win-crt-stdio-l1-1-0.dll	7	__stdio_common_vfwprintf
api-ms-win-crt-stdio-l1-1-0.dll	119	fflush
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	15	__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0.dll	74	_wcsicmp
api-ms-win-crt-string-l1-1-0.dll	73	_wcsdup
api-ms-win-crt-string-l1-1-0.dll	84	_wcsnicmp
api-ms-win-crt-string-l1-1-0.dll	166	wcsncmp
api-ms-win-crt-string-l1-1-0.dll	138	strcspn
api-ms-win-crt-string-l1-1-0.dll	169	wcsnlen
api-ms-win-crt-string-l1-1-0.dll	131	memset
api-ms-win-crt-string-l1-1-0.dll	137	strcpy_s
api-ms-win-crt-locale-l1-1-0.dll	15	_unlock_locales
api-ms-win-crt-locale-l1-1-0.dll	6	__pctype_func
api-ms-win-crt-locale-l1-1-0.dll	2	___lc_locale_name_func
api-ms-win-crt-locale-l1-1-0.dll	3	___mb_cur_max_func
api-ms-win-crt-locale-l1-1-0.dll	19	setlocale
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale
api-ms-win-crt-locale-l1-1-0.dll	13	_lock_locales
api-ms-win-crt-locale-l1-1-0.dll	18	localeconv
api-ms-win-crt-locale-l1-1-0.dll		___lc_codepage_func
api-ms-win-crt-filesystem-l1-1-0.dll	53	_wremove
api-ms-win-crt-filesystem-l1-1-0.dll	54	_wrename
api-ms-win-crt-convert-l1-1-0.dll	71	_wtoi
api-ms-win-crt-convert-l1-1-0.dll	115	wcstoul
api-ms-win-crt-time-l1-1-0.dll	71	wcsftime
api-ms-win-crt-time-l1-1-0.dll	31	_gmtime64
api-ms-win-crt-time-l1-1-0.dll	48	_time64

StringTable 000004b0

CompanyName	ALTBot
FileDescription	ALTBot
FileVersion	1.0.0.0
InternalName	ALTBot.dll
LegalCopyright
OriginalFilename	ALTBot.dll
ProductName	ALTBot
ProductVersion	1.0.0
Assembly Version	1.0.0.0

VS_FIXEDFILEINFO

FileVersion	1.0.0.0
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	169008	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x2a2b8

ALTBot.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 000004b0

VS_FIXEDFILEINFO

ALTBot.exe
-