filenameBrokey.dll
size13824 (0x3600)
md5ae29c087770bb82b428bd793ebb74cbc
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
123403106
126503271
125507272
1095072712
1092
123507275
1105072714
122507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x44183a89
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion8.0
SizeOfCode0x1400
SizeOfInitializedData0x1e00
SizeOfUninitializedData0
AddressOfEntryPoint0x1990
BaseOfCode0x1000
ImageBase0x10300000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x400
CheckSum0xa3f9
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x13f40x1400R-X CODE
.rdata0x30000x10fe0x1200R-- IDATA
.data0x50000x8480x200RW- IDATA
.pdata0x60000x1f80x200R-- IDATA
.rsrc0x70000x4b00x600R-- IDATA
.reloc0x80000xc80x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x3f800x17e
IMPORT0x39e80x50
RESOURCE0x70000x4b0
EXCEPTION0x60000x1f8
SECURITY00
BASERELOC0x80000x60
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x30000x208
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#170014421252
MANIFEST#25941252
module_namehintordfunction_name
MFC80.DLL776
MFC80.DLL1100
MFC80.DLL1052
MFC80.DLL1108
MFC80.DLL1224
MFC80.DLL1226
MFC80.DLL1114
MFC80.DLL379
MFC80.DLL1184
MFC80.DLL1136
MFC80.DLL1218
MFC80.DLL1192
MFC80.DLL1194
MFC80.DLL1944
MFC80.DLL320
MFC80.DLL1227
MFC80.DLL592
MFC80.DLL777
MFC80.DLL6373
MFC80.DLL321
MSVCR80.dll1202free
MSVCR80.dll1213fwrite
MSVCR80.dll97__CxxFrameHandler3
MSVCR80.dll121__clean_type_info_names_internal
MSVCR80.dll17void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

MSVCR80.dll87__C_specific_handler
MSVCR80.dll311_encode_pointer
MSVCR80.dll593_malloc_crt
MSVCR80.dll465_initterm
MSVCR80.dll466_initterm_e
MSVCR80.dll312_encoded_null
MSVCR80.dll301_decode_pointer
MSVCR80.dll226_amsg_exit
MSVCR80.dll88__CppXcptFilter
MSVCR80.dll65void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR80.dll936_unlock
MSVCR80.dll131__dllonexit
MSVCR80.dll576_lock
MSVCR80.dll743_onexit
MSVCR80.dll54public: void __cdecl type_info::_type_info_dtor_internal_method(void) __ptr64

?_type_info_dtor_internal_method@type_info@@QEAAXXZ

MSVCR80.dll129__crt_debugger_hook
MSVCR80.dll1316strchr
KERNEL32.dll476GetThreadLocale
KERNEL32.dll374GetLocaleInfoA
KERNEL32.dll256GetACP
KERNEL32.dll460GetSystemTimeAsFileTime
KERNEL32.dll326GetCurrentProcessId
KERNEL32.dll329GetCurrentThreadId
KERNEL32.dll481GetTickCount
KERNEL32.dll671QueryPerformanceCounter
KERNEL32.dll720RtlCaptureContext
KERNEL32.dll727RtlLookupFunctionEntry
KERNEL32.dll734RtlVirtualUnwind
KERNEL32.dll565IsDebuggerPresent
KERNEL32.dll848SetUnhandledExceptionFilter
KERNEL32.dll884UnhandledExceptionFilter
KERNEL32.dll325GetCurrentProcess
KERNEL32.dll868TerminateProcess
KERNEL32.dll860Sleep
KERNEL32.dll596LocalAlloc
KERNEL32.dll600LocalFree
KERNEL32.dll491GetVersionExA
ordentry_vafunction_name
10x1090?CheckAuthorization@@YAHXZ
20x1024?ConvertEncoding@@YAXPEADHH@Z
30x10c4?GimmeRegDate@@YAPEADXZ
40x10cc?GimmeUserID@@YAPEADXZ
50x10bc?GimmeUserName@@YAPEADXZ
60x10d4?KeyCalcFileSize@@YAHH@Z
70x101c?KeyPrepareDataToSave@@YAHPEAEPEAUStockInfo@@HH@Z
80x1000?KeyWrite@@YAHPEAU_iobuf@@PEAXPEAULibrary@@H@Z
module_nameBrokey.dll
flags0
timestamp2006-03-15 16:02:17
version0.0
ordinal_base1
nFunctions8
nNames8
Names(8)0x3fc8
Functions(8)0x3fa8
NameOrdinals(8)0x3fe8
offsetsizetypecomment
15c115HTM#
15d08240BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK