bestallning2406.cpl

info
MZ
PE
resources
strings
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	bestallning2406.cpl
size	19456 (0x4c00)
md5	a1447780b3cfcff3720256b47f8b0f0b

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
123	50727	2
126	50327	1
110	50727	7
109	50727	12
125	50727	4
93	4035	7
1	0	95
114	50727	3
122	50727	1
124	50727	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x53a94a47
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x2800
SizeOfInitializedData	0x2000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x242b
BaseOfCode	0x1000
BaseOfData	0x4000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x8000
SizeOfHeaders	0x400
CheckSum	0x13a62
Subsystem	2
DllCharacteristics	0x100
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x262a	0x2800	R-X CODE
.rdata	0x4000	0xbc9	0xc00	R-- IDATA
.data	0x5000	0x64c	0x400	RW- IDATA
.rsrc	0x6000	0x7d4	0x800	R-- IDATA
.reloc	0x7000	0x69c	0x800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x4ac0	0x109
IMPORT	0x44ac	0x64
RESOURCE	0x6000	0x7d4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x7000	0x3d4
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x4240	0x40
Bound_IAT	0	0
IAT	0x4000	0x110
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
PNG	#102	592	1252
STRING	#7	832	1252
MANIFEST	#2	338	1252

id	lang	string
103	1049	IfN4ZikBDU5nGdeIfO0sKrMfKoSDb7nz99hC0hFb54NNy8j4hZG_5dvtVhjcKZI2jBTZKoY6Y9u3ZwbXxCYx0pCHrOMrsqz_3zyTlgjdYQY8XohEx_uriAD4L2DcJ8Lw_1Lsw8uzjY5nXXh42t4vEeG8v0wBvrKBneIjaQPiTha1ZjSXSsa7nGBwo6pI7H53pNp6T9X5
104	1049	jDCNWaqkD7vbULR4q8nlHaVOpchn0wpy2rDD3bbBK8Ik3RwHFkMychdwDYtwdNZBzfz8CNC93GrohEkPgSrtcfD52bn618Wn4ykEqJkkocACiP154Fghg9VEEf_kthyEZ7mv89YGK6DtjLOSBEdOl_nmOhtkbAHHT974QKmtKH_9Ti5h8u1lI5vSIeldNzDgTIDtzB7M

module_name	hint	function_name
KERNEL32.dll	553	InterlockedExchange
KERNEL32.dll	248	FreeLibrary
KERNEL32.dll	854	Sleep
KERNEL32.dll	416	GetProcAddress
KERNEL32.dll	594	LoadLibraryA
KERNEL32.dll	419	GetProcessHeap
KERNEL32.dll	540	HeapSize
KERNEL32.dll	538	HeapReAlloc
KERNEL32.dll	534	HeapFree
KERNEL32.dll	528	HeapAlloc
KERNEL32.dll	679	RaiseException
KERNEL32.dll	489	GetVersionExA
KERNEL32.dll	474	GetThreadLocale
KERNEL32.dll	372	GetLocaleInfoA
KERNEL32.dll	253	GetACP
KERNEL32.dll	458	GetSystemTimeAsFileTime
KERNEL32.dll	323	GetCurrentProcessId
KERNEL32.dll	326	GetCurrentThreadId
KERNEL32.dll	479	GetTickCount
KERNEL32.dll	675	QueryPerformanceCounter
KERNEL32.dll	569	IsDebuggerPresent
KERNEL32.dll	842	SetUnhandledExceptionFilter
KERNEL32.dll	547	InitializeCriticalSection
KERNEL32.dll	878	UnhandledExceptionFilter
KERNEL32.dll	322	GetCurrentProcess
KERNEL32.dll	862	TerminateProcess
KERNEL32.dll	550	InterlockedCompareExchange
KERNEL32.dll	129	DeleteCriticalSection
KERNEL32.dll	532	HeapDestroy
USER32.dll	446	LoadIconA
USER32.dll	691	UnregisterClassA
USER32.dll	459	LoadStringA
MSVCR80.dll	636	_lock
MSVCR80.dll	802	_onexit
MSVCR80.dll	355	_decode_pointer
MSVCR80.dll	653	_malloc_crt
MSVCR80.dll	366	_encoded_null
MSVCR80.dll	522	_initterm
MSVCR80.dll	523	_initterm_e
MSVCR80.dll	280	_amsg_exit
MSVCR80.dll	273	_adjust_fdiv
MSVCR80.dll	107	__CppXcptFilter
MSVCR80.dll	334	_crt_debugger_hook
MSVCR80.dll	65	void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCR80.dll	52	public: void __thiscall type_info::_type_info_dtor_internal_method(void) ?_type_info_dtor_internal_method@type_info@@QAEXXZ
MSVCR80.dll	374	_except_handler4_common
MSVCR80.dll	141	__clean_type_info_names_internal
MSVCR80.dll	151	__dllonexit
MSVCR80.dll	365	_encode_pointer
MSVCR80.dll	1005	_unlock
MSVCR80.dll	1033	_vscprintf
MSVCR80.dll	1416	vsprintf_s
MSVCR80.dll	15	void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z
MSVCR80.dll	1328	memcpy_s
MSVCR80.dll	1362	srand
MSVCR80.dll	1345	rand
MSVCR80.dll	1261	free
MSVCR80.dll	16	void __cdecl operator delete(void *) ??3@YAXPAX@Z
MSVCR80.dll	819	_purecall
MSVCR80.dll	1331	memset
MSVCR80.dll	91	_CxxThrowException
MSVCR80.dll	977	_time64
MSVCR80.dll	116	__CxxFrameHandler3
WININET.dll	154	InternetReadFile

ord	entry_va	function_name
1	0x1020	CPlApplet

module_name	YFgOYyBLjVmSv_s2bIiTOGdlV1PrhZvQ7TS1zvI9sWG8NdFZ865ObRKJgoGYun2toNjOLPiR8iPuGSaeTWvoJm3jNgBcdqAlkm14K3aYkd96pWVBKSgQUNvqgUSY8rw29a40dLTvJPAm7QXlBqDfNqYXX_um8XLMa5eJS1ubXiIKtWsGnD8kGVV_MFRXJg11XOLegC6R.dll
flags	0
timestamp	2014-06-24 09:52:07
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x4aec
Functions(1)	0x4ae8
NameOrdinals(1)	0x4af0

show previews

offset	size	type	comment
0	19456	DLL	06/24/2014 09:52:07	#
15c1	15	HTM		#
3cf0	592	PNG	(16 x 16)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK