filenameOutllib.dll
size50688 (0xc600)
md592853e0506ea16c6f17ac32f5ef8f3b3
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1472991
1081684
0010
1980345
1086
11816811
481683

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x55dec1c4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.0
SizeOfCode0x9e00
SizeOfInitializedData0x2400
SizeOfUninitializedData0
AddressOfEntryPoint0x9e2d
BaseOfCode0x400
BaseOfData0xa200
ImageBase0x10000000
SectionAlignment0x200
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xc600
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x4000x9d720x9e00R-X CODE
.rdata0xa2000xd380xe00R-- IDATA
.data0xb0000xe6c0x1000RW- IDATA
.reloc0xc0000x5960x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xae900xa8
IMPORT0xa6880x64
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0xc0000x4a0
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xa2000x188
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll722WideCharToMultiByte
KERNEL32.dll27CloseHandle
KERNEL32.dll274GetFileSize
KERNEL32.dll55CreateFileW
KERNEL32.dll735WriteFile
KERNEL32.dll536ReadFile
KERNEL32.dll618SetFilePointer
KERNEL32.dll335GetShortPathNameW
KERNEL32.dll358GetTempPathW
KERNEL32.dll498OpenSemaphoreW
KERNEL32.dll72CreateSemaphoreW
KERNEL32.dll50CreateEventW
KERNEL32.dll487OpenEventW
KERNEL32.dll125ExitProcess
KERNEL32.dll613SetEvent
KERNEL32.dll662Sleep
KERNEL32.dll272GetFileAttributesW
KERNEL32.dll397GlobalMemoryStatus
KERNEL32.dll347GetSystemInfo
KERNEL32.dll771lstrcpyW
KERNEL32.dll484MultiByteToWideChar
KERNEL32.dll207GetComputerNameW
KERNEL32.dll180FreeLibrary
KERNEL32.dll293GetModuleFileNameW
KERNEL32.dll74CreateThread
KERNEL32.dll318GetProcAddress
KERNEL32.dll453LoadLibraryW
KERNEL32.dll716WaitForMultipleObjects
KERNEL32.dll64CreateMutexW
KERNEL32.dll494OpenMutexW
KERNEL32.dll88DeleteFileW
KERNEL32.dll170FlushFileBuffers
KERNEL32.dll670TerminateProcess
KERNEL32.dll69CreateProcessW
KERNEL32.dll762lstrcatW
KERNEL32.dll346GetSystemDirectoryW
KERNEL32.dll337GetStartupInfoW
KERNEL32.dll556ResumeThread
KERNEL32.dll664SuspendThread
KERNEL32.dll549ReleaseMutex
KERNEL32.dll718WaitForSingleObject
KERNEL32.dll365GetTickCount
KERNEL32.dll550ReleaseSemaphore
KERNEL32.dll126ExitThread
KERNEL32.dll282GetLastError
KERNEL32.dll374GetVersionExW
KERNEL32.dll85DeleteCriticalSection
KERNEL32.dll430InterlockedExchange
KERNEL32.dll426InitializeCriticalSection
KERNEL32.dll102EnterCriticalSection
KERNEL32.dll449LeaveCriticalSection
ADVAPI32.dll371RegOpenKeyExW
ADVAPI32.dll229IsTextUnicode
ADVAPI32.dll391RegSetValueExW
ADVAPI32.dll216GetUserNameW
ADVAPI32.dll380RegQueryValueExW
ADVAPI32.dll347RegCloseKey
WININET.dll116InternetQueryDataAvailable
WININET.dll119InternetReadFile
WININET.dll70HttpOpenRequestW
WININET.dll91InternetConnectW
WININET.dll130InternetSetOptionW
WININET.dll86InternetCloseHandle
WININET.dll115InternetOpenW
WININET.dll76HttpSendRequestW
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll271_initterm
MSVCRT.dll390_onexit
MSVCRT.dll402_purecall
MSVCRT.dll739wcscpy
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll702strlen
MSVCRT.dll665memset
MSVCRT.dll742wcslen
MSVCRT.dll588fclose
MSVCRT.dll657malloc
MSVCRT.dll596fgetws
MSVCRT.dll515_wfopen
MSVCRT.dll735wcscat
MSVCRT.dll606free
MSVCRT.dll613fwprintf
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll538_wsetlocale
MSVCRT.dll692srand
MSVCRT.dll678rand
MSVCRT.dll720time
MSVCRT.dll690sprintf
MSVCRT.dll715swprintf
MSVCRT.dll663memcpy
MSVCRT.dll483_waccess
MSVCRT.dll747wcsrchr
MSVCRT.dll490_wcsicmp
MSVCRT.dll85__dllonexit
ordentry_vafunction_name
10x1f24FMess
20x1f00FMessageLoop@12
30x1f12RenExit
40x1eeeRenExitInstance@0
50x1f36RenInitInstance@12
module_namehussar.exe
flags0
timestamp2015-08-27 07:52:36
version0.0
ordinal_base1
nFunctions5
nNames5
Names(5)0xaecc
Functions(5)0xaeb8
NameOrdinals(5)0xaee0
offsetsizetypecomment
050688DLL08/27/2015 07:52:36#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK