filenamelocalui.dll
size290816 (0x47000)
md5b73e02e7673d157cd9c62351a37c9b66
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
149307292
10240
1473072923
146307291
1323072922
1313072918
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion8.0
SizeOfCode0xac00
SizeOfInitializedData0x62800
SizeOfUninitializedData0
AddressOfEntryPoint0x5a7d
BaseOfCode0x1000
BaseOfData0xc000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x400
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x71000
SizeOfHeaders0x400
CheckSum0x56211
Subsystem2
DllCharacteristics0x440
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPolyX v0.1 (Delikon)

Sections

namevavsizeraw sizeflags
.code0x10000xaa3e0xac00R-X CODE
.idata0xc0000x8a30xc00RW- IDATA
.didat0xd0000x66e0x800RW- IDATA
.data0xe0000x2aabb0x4400RW- IDATA
.fdata30x390000x25000x2800RW- IDATA
.rsrc0x3c0000x3353b0x33800R-- IDATA
.reloc0x700000x5f30x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xa7800x12be
IMPORT0xc0000x50
RESOURCE0x3c0000x3353b
EXCEPTION00
SECURITY00
BASERELOC0x700000x2ec
DEBUG0x10000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xc1d80x188
Delay_IAT0xd0000x60
CLR_Header00
typenamesizecp
MUI#12240
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#7281810
ICON#896400
ICON#942640
ICON#1011280
ICON#117440
ICON#122960
ICON#137440
ICON#142960
ICON#157440
ICON#162960
GROUP_ICON#1001460
GROUP_ICON#101340
GROUP_ICON#110340
GROUP_ICON#111340
VERSION#19400
module_namehintordfunction_name
kernel32.dll818SetUnhandledExceptionFilter
kernel32.dll708RtlUnwind
kernel32.dll936lstrcmpW
kernel32.dll787SetLastError
kernel32.dll830Sleep
kernel32.dll689ReleaseSemaphore
kernel32.dll769SetEvent
kernel32.dll576LeaveCriticalSection
kernel32.dll890WaitForSingleObject
kernel32.dll404GetPrivateProfileStringW
kernel32.dll939lstrcmpiW
kernel32.dll82CreateFileW
kernel32.dll894WideCharToMultiByte
kernel32.dll583LocalAlloc
kernel32.dll127DeleteCriticalSection
kernel32.dll76CreateEventW
kernel32.dll225FindResourceExW
kernel32.dll596LockResource
kernel32.dll587LocalFree
kernel32.dll475GetVersionExA
kernel32.dll882VirtualQuery
kernel32.dll240FreeLibrary
kernel32.dll49CloseHandle
kernel32.dll146EncodePointer
kernel32.dll520HeapFree
kernel32.dll410GetProcessHeap
kernel32.dll514HeapAlloc
kernel32.dll476GetVersionExW
kernel32.dll533InitializeCriticalSection
kernel32.dll315GetCurrentProcess
kernel32.dll525HeapSetInformation
kernel32.dll373GetModuleHandleA
kernel32.dll657QueryPerformanceCounter
kernel32.dll465GetTickCount
kernel32.dll445GetSystemTimeAsFileTime
kernel32.dll838TerminateProcess
kernel32.dll855UnhandledExceptionFilter
kernel32.dll7AddRefActCtx
kernel32.dll360GetLastError
kernel32.dll309GetCurrencyFormatA
kernel32.dll354GetFullPathNameW
kernel32.dll86CreateJobObjectA
kernel32.dll407GetProcAddress
kernel32.dll577LoadLibraryA
kernel32.dll466GetTimeFormatA
kernel32.dll121DecodePointer
kernel32.dll880VirtualProtect
kernel32.dll538InterlockedExchange
kernel32.dll662RaiseException
GDI32.dll421GetStockObject
msvcrt.dll1190free
msvcrt.dll1167exit
msvcrt.dll1361wcschr
msvcrt.dll1246malloc
msvcrt.dll1371wcsncmp
ordentry_vafunction_name
10x59baAllowSettingDocument
20x5a3cBackupError
30x59ceBrowserProtocol
40x59bfDllTopic
50x5a55EnumReflect
60x59b5FillSecurity
70x59c4FrameworkCharacterHierarchy
80x5a73FrontOverviewPossible
90x5a5aGoalListExample
100x59ddMoveTakeSystem
110x5a19PackLargeSoftware
120x59d8PersonalGeneral
130x5a14ProcessSync
140x5a05ProviderQuestion
150x59f6QueryParentLanguage
160x59fbReportActivexVariety
170x5a2dRootRetrieve
180x59ecSemanticGenerateBuild
190x5a50TextMemberSoap
module_nameFORMATTED.dll
flags0
timestamp0
version0.0
ordinal_base1
nFunctions19
nNames19
Names(19)0xa7f4
Functions(19)0xa7a8
NameOrdinals(19)0xa840

StringTable 040904B0

CompanyNamesorofMCot iinotoarcrp
FileDescriptionObject Control Viewer
FileVersion8.00.7601.17514 (win7sp1_rtm.101119-1850)
InternalNameOCCACHE.DLL
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameOCCACHE.DLL
ProductNameWindows® Internet Explorer
ProductVersion8.00.7601.17514
OleSelfRegister

VS_FIXEDFILEINFO

FileVersion8.0.7601.17514
ProductVersion8.0.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0290816DLL01/01/1970 00:00:00#
15c115HTM#
15bd028181PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER