filenamerasplap.dll
size405504 (0x63000)
md587fa0c48c3b2e9fee518818fe26b15b5
typePE32+ executable (DLL) (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
149307291
10212
1473072919
1313072915
146307291
1383072928
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4a5be03d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion9.0
SizeOfCode0x18600
SizeOfInitializedData0x4b800
SizeOfUninitializedData0
AddressOfEntryPoint0x1070
BaseOfCode0x1000
ImageBase0x7ff38080000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x68000
SizeOfHeaders0x400
CheckSum0x7095d
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPolyX v0.1 (Delikon)

Sections

namevavsizeraw sizeflags
.text0x10000x184480x18600R-X CODE
.rdata0x1a0000x7dfc0x7e00R-- IDATA
.data0x220000x21c00x1000RW- IDATA
.pdata0x250000xdec0xe00R-- IDATA
.rsrc0x260000x406a80x40800R-- IDATA
.reloc0x670000xb00x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1a5f00x6a
IMPORT0x1fba80xc8
RESOURCE0x260000x406a8
EXCEPTION0x250000xdec
SECURITY00
BASERELOC0x670000xb0
DEBUG0x193e80x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2d80xe4
IAT0x1a0000x4f0
Delay_IAT0x1f5e00x160
CLR_Header00
typenamesizecp
MUI#12000
BITMAP#7000655780
BITMAP#7001655780
BITMAP#7002655780
BITMAP#7003655780
VERSION#19280
module_namehintordfunction_name
msvcrt.dll479_ltoa
msvcrt.dll1039atol
msvcrt.dll1170qsort
msvcrt.dll1199strchr
msvcrt.dll1216strrchr
msvcrt.dll1282wcsstr
msvcrt.dll1156memset
msvcrt.dll1152memcpy
msvcrt.dll755_strnicmp
msvcrt.dll83__C_specific_handler
msvcrt.dll160_amsg_exit
msvcrt.dll1082free
msvcrt.dll364_initterm
msvcrt.dll1140malloc
msvcrt.dll82_XcptFilter
msvcrt.dll889_wcsicmp
msvcrt.dll1263wcschr
msvcrt.dll19void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

msvcrt.dll21void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

msvcrt.dll1151memcmp
msvcrt.dll1015_wtol
msvcrt.dll850_vsnprintf
msvcrt.dll526_mbscspn
msvcrt.dll856_vsnwprintf
msvcrt.dll87__CxxFrameHandler3
ntdll.dll929RtlInitString
ntdll.dll1044RtlNtStatusToDosError
ntdll.dll1405WinSqmSetDWORD
ntdll.dll1264RtlVirtualUnwind
ntdll.dll32DbgPrint
ntdll.dll635RtlCaptureContext
ntdll.dll1025RtlLookupFunctionEntry
ADVAPI32.dll689SetNamedSecurityInfoW
ADVAPI32.dll329GetSecurityDescriptorGroup
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll331GetSecurityDescriptorOwner
ADVAPI32.dll81CheckTokenMembership
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll371ImpersonateLoggedOnUser
ADVAPI32.dll328GetSecurityDescriptorDacl
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll288FreeSid
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll696SetSecurityDescriptorOwner
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll374InitializeAcl
ADVAPI32.dll564RegConnectRegistryW
ADVAPI32.dll508OpenThreadToken
ADVAPI32.dll694SetSecurityDescriptorDacl
ADVAPI32.dll375InitializeSecurityDescriptor
ADVAPI32.dll147CredIsProtectedW
ADVAPI32.dll153CredProtectW
ADVAPI32.dll177CryptAcquireContextW
ADVAPI32.dll197CryptGetKeyParam
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll198CryptGetProvParam
ADVAPI32.dll183CryptDestroyKey
ADVAPI32.dll199CryptGetUserKey
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll695SetSecurityDescriptorGroup
ADVAPI32.dll503OpenProcessToken
USER32.dll49CharNextW
USER32.dll52CharPrevW
USER32.dll384GetSystemMetrics
USER32.dll491LoadBitmapW
RASAPI32.dll69RasHangUpW
RASAPI32.dll25RasEnumConnectionsW
RASAPI32.dll48RasGetEapUserDataW
RASAPI32.dll46RasGetCustomAuthDataW
rtutils.dll24TraceDeregisterExA
rtutils.dll37TraceRegisterExA
rtutils.dll32TracePrintfExA
KERNEL32.dll1018ReleaseMutex
KERNEL32.dll498GetFileInformationByHandle
KERNEL32.dll1328WriteFile
KERNEL32.dll868MoveFileW
KERNEL32.dll747InitializeCriticalSectionAndSpinCount
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll405GetComputerNameW
KERNEL32.dll1216Sleep
KERNEL32.dll827LeaveCriticalSection
KERNEL32.dll100CompareStringW
KERNEL32.dll1377lstrlenW
KERNEL32.dll520GetLastError
KERNEL32.dll242EnterCriticalSection
KERNEL32.dll838LocalAlloc
KERNEL32.dll842LocalFree
KERNEL32.dll180CreateThread
KERNEL32.dll360FreeLibrary
KERNEL32.dll833LoadLibraryW
KERNEL32.dll588GetProcAddress
KERNEL32.dll873MultiByteToWideChar
KERNEL32.dll831LoadLibraryExA
KERNEL32.dll207DelayLoadFailureHook
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll666GetTickCount
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll1230TerminateProcess
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll722HeapAlloc
KERNEL32.dll726HeapFree
KERNEL32.dll592GetProcessHeap
KERNEL32.dll1308WideCharToMultiByte
KERNEL32.dll513GetFullPathNameW
KERNEL32.dll318FindFirstFileW
KERNEL32.dll1372lstrlenA
KERNEL32.dll96CompareFileTime
KERNEL32.dll1284WaitForSingleObject
KERNEL32.dll457GetCurrentThread
KERNEL32.dll698GlobalAlloc
KERNEL32.dll630GetSystemDirectoryW
KERNEL32.dll997RegQueryValueExW
KERNEL32.dll1361lstrcmpW
KERNEL32.dll973RegDeleteValueW
KERNEL32.dll705GlobalFree
KERNEL32.dll307FindClose
KERNEL32.dll893OpenMutexA
KERNEL32.dll992RegOpenKeyExW
KERNEL32.dll155CreateMutexA
KERNEL32.dll330FindNextFileW
KERNEL32.dll97CompareStringA
KERNEL32.dll960ReadFile
KERNEL32.dll82CloseHandle
KERNEL32.dll965RegCloseKey
KERNEL32.dll712GlobalReAlloc
KERNEL32.dll117CopyFileW
KERNEL32.dll143CreateFileW
KERNEL32.dll505GetFileType
KERNEL32.dll1223SystemTimeToFileTime
KERNEL32.dll642GetSystemWindowsDirectoryW
KERNEL32.dll745InitializeCriticalSection
KERNEL32.dll1364lstrcmpiW
KERNEL32.dll637GetSystemTime
KERNEL32.dll969RegDeleteKeyExW
KERNEL32.dll967RegCreateKeyExW
KERNEL32.dll214DeleteFileW
KERNEL32.dll339FindResourceW
KERNEL32.dll834LoadResource
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll853LockResource
KERNEL32.dll976RegEnumKeyExW
KERNEL32.dll683GetVersionExW
KERNEL32.dll1004RegSetValueExW
API-MS-Win-Security-SDDL-L1-1-0.dll1ConvertSidToStringSidW
RPCRT4.dll515UuidCreate
ordentry_vafunction_name
10x1a40DllCanUnloadNow
20x1ee0DllGetClassObject
module_namerasplap.dll
flags0
timestamp2009-07-14 00:10:22
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x1a620
Functions(2)0x1a618
NameOrdinals(2)0x1a628

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionRAS PLAP Credential Provider
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNameRASCREDPROV
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameRasCredProv
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0399920BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2d8