filenameInjectCode.dll
size36864 (0x9000)
md5b32f014c058f95b7e0ad7cdf979b2443
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
221208062
223208061
2242080610
225208066
203655013
1046
225210052
220210051
219210051
222210051

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x56410d22
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion12.0
SizeOfCode0x4e00
SizeOfInitializedData0x4400
SizeOfUninitializedData0
AddressOfEntryPoint0x1600
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xe000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.text0x10000x4dec0x4e00R-X CODE
.rdata0x60000x241c0x2600R-- IDATA
.data0x90000x7410x200RW- IDATA
.pdata0xa0000x3f00x400R-- IDATA
.idata0xb0000x9c80xa00R-- IDATA
.rsrc0xc0000x43c0x600R-- IDATA
.reloc0xd0000x1140x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x82a00x17c
IMPORT0xb2600x3c
RESOURCE0xc0000x43c
EXCEPTION0xa0000x288
SECURITY00
BASERELOC0xd0000x3c
DEBUG0x66600x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x71400x70
Bound_IAT00
IAT0xb0000x260
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
KERNEL32.dll676GetProcAddress
KERNEL32.dll939LoadLibraryW
KERNEL32.dll621GetModuleHandleW
KERNEL32.dll617GetModuleFileNameW
KERNEL32.dll420FreeLibrary
KERNEL32.dll1457VirtualQuery
KERNEL32.dll681GetProcessHeap
KERNEL32.dll828HeapFree
KERNEL32.dll824HeapAlloc
KERNEL32.dll1499WideCharToMultiByte
KERNEL32.dll980MultiByteToWideChar
KERNEL32.dll938LoadLibraryExW
KERNEL32.dll598GetLastError
KERNEL32.dll1091RaiseException
KERNEL32.dll874IsDebuggerPresent
KERNEL32.dll733GetSystemTimeAsFileTime
KERNEL32.dll532GetCurrentThreadId
KERNEL32.dll528GetCurrentProcessId
KERNEL32.dll1072QueryPerformanceCounter
KERNEL32.dll255DecodePointer
KERNEL32.dll293EncodePointer
KERNEL32.dll880IsProcessorFeaturePresent
MSVCR120D.dll446__crt_debugger_hook
MSVCR120D.dll1473_wsplitpath_s
MSVCR120D.dll444__crtTerminateProcess
MSVCR120D.dll414__crtCaptureCurrentContext
MSVCR120D.dll415__crtCapturePreviousContext
MSVCR120D.dll1439_wmakepath_s
MSVCR120D.dll1948wcscpy_s
MSVCR120D.dll412__clean_type_info_names_internal
MSVCR120D.dll1082_onexit
MSVCR120D.dll448__dllonexit
MSVCR120D.dll565_calloc_dbg
MSVCR120D.dll329_CrtDbgReportW
MSVCR120D.dll1281_unlock
MSVCR120D.dll913_lock
MSVCR120D.dll381__C_specific_handler
MSVCR120D.dll794_initterm_e
MSVCR120D.dll793_initterm
MSVCR120D.dll346_CrtSetCheckCount
MSVCR120D.dll698_free_dbg
MSVCR120D.dll931_malloc_dbg
MSVCR120D.dll542_amsg_exit
MSVCR120D.dll382__CppXcptFilter
MSVCR120D.dll323_CRT_RTC_INITW
MSVCR120D.dll445__crtUnhandledException
ordentry_vafunction_name
10x100fdummyFunction
20x100ainjectFunction
module_nameInjectCode.dll
flags0
timestamp2015-11-09 21:16:18
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x82d0
Functions(2)0x82c8
NameOrdinals(2)0x82d8
offsetsizetypecomment
15c115HTM#
15d031280BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK