filenameresource.dat_1969347_66048.dll
size66048 (0x10200)
md5b7cdb6e388fde38b86f4a65b84bef6bf
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
150204135
147210222
149210221
1312102213
132210222
123507273
1046
1313072915
146307291
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4e970533
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xa000
SizeOfInitializedData0x5e00
SizeOfUninitializedData0
AddressOfEntryPoint0xa904
BaseOfCode0x1000
BaseOfData0xb000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x13000
SizeOfHeaders0x400
CheckSum0x1ca92
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x9e140xa000R-X CODE
.rdata0xb0000x4c6e0x4e00R-- IDATA
.data0x100000x39c0x200RW- IDATA
.rsrc0x110000x6240x800R-- IDATA
.reloc0x120000x4a60x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xf6c00x5ae
IMPORT0xf2ac0x3c
RESOURCE0x110000x624
EXCEPTION00
SECURITY00
BASERELOC0x120000x3e4
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xf1e80x40
Bound_IAT00
IAT0xb0000xc0
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18121252
MANIFEST#25981252
module_namehintordfunction_name
KERNEL32.dll1156WideCharToMultiByte
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll618GetTickCount
KERNEL32.dll857QueryPerformanceCounter
KERNEL32.dll204DisableThreadLibraryCalls
KERNEL32.dll726IsDebuggerPresent
KERNEL32.dll1055SetUnhandledExceptionFilter
KERNEL32.dll1096UnhandledExceptionFilter
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll1079TerminateProcess
KERNEL32.dll703InterlockedCompareExchange
KERNEL32.dll1067Sleep
KERNEL32.dll706InterlockedExchange
KERNEL32.dll595GetSystemTimeAsFileTime
MSVCR90.dll516_initterm
MSVCR90.dll517_initterm_e
MSVCR90.dll277_amsg_exit
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll106__CppXcptFilter
MSVCR90.dll352_decode_pointer
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll140__clean_type_info_names_internal
MSVCR90.dll998_unlock
MSVCR90.dll150__dllonexit
MSVCR90.dll630_lock
MSVCR90.dll796_onexit
MSVCR90.dll371_except_handler4_common
MSVCR90.dll363_encoded_null
MSVCR90.dll647_malloc_crt
MSVCR90.dll362_encode_pointer
MSVCR90.dll1034_vsnprintf
MSVCR90.dll1316memchr
MSVCR90.dll368_errno
MSVCR90.dll1364strerror
MSVCR90.dll1350sprintf
MSVCR90.dll1148_wopen
MSVCR90.dll1252free
MSVCR90.dll1307malloc
MSVCR90.dll1322memset
MSVCR90.dll1318memcpy
MSVCR90.dll639_lseek
MSVCR90.dll797_open
MSVCR90.dll821_read
MSVCR90.dll313_close
MSVCR90.dll1160_write
ordentry_vafunction_name
10x1000adler32
20x1300adler32_combine
30x13d0compress
40x1320compress2
50x13f0compressBound
60x1840crc32
70x1820crc32_combine
80x2da0deflate
90x1a10deflateBound
100x1c40deflateCopy
110x1b70deflateEnd
120x35d0deflateInit2_
130x38e0deflateInit_
140x3800deflateParams
150x1990deflatePrime
160x2d10deflateReset
170x1860deflateSetDictionary
180x1960deflateSetHeader
190x19d0deflateTune
200x1410get_crc_table
210x3940gzbuffer
220x4200gzclearerr
230x3910gzclose
240x4dd0gzclose_r
250x5400gzclose_w
260x4da0gzdirect
270x4050gzdopen
280x3a30gzeof
290x3a60gzerror
300x52f0gzflush
310x4b90gzgetc
320x4ca0gzgets
330x3a20gzoffset
340x4010gzopen
350x5240gzprintf
360x5170gzputc
370x5200gzputs
380x4a50gzread
390x40a0gzrewind
400x41f0gzseek
410x5360gzsetparams
420x39c0gztell
430x4be0gzungetc
440x4030gzwopen
450x5070gzwrite
460x6ad0inflate
470x5570inflateBack
480x62f0inflateBackEnd
490x5490inflateBackInit_
500x8360inflateCopy
510x80a0inflateEnd
520x81d0inflateGetHeader
530x6890inflateInit2_
540x6940inflateInit_
550x84e0inflateMark
560x6960inflatePrime
570x6780inflateReset
580x6800inflateReset2
590x80f0inflateSetDictionary
600x8250inflateSync
610x8330inflateSyncPoint
620x84b0inflateUndermine
630xa440uncompress
640xa510zError
650xa500zlibCompileFlags
660xa4f0zlibVersion
module_namezlib1.dll
flags0
timestamp2011-10-13 15:35:15
version0.0
ordinal_base1
nFunctions66
nNames66
Names(66)0xf7f0
Functions(66)0xf6e8
NameOrdinals(66)0xf8f8

StringTable 040904E4

FileDescriptionzlib data compression library
FileVersion1.2.5
InternalNamezlib1.dll
LegalCopyright(C) 1995-2006 Jean-loup Gailly & Mark Adler
OriginalFilenamezlib1.dll
ProductNamezlib
ProductVersion1.2.5
CommentsFor more information visit http://www.zlib.net/

VS_FIXEDFILEINFO

FileVersion1.2.5.0
ProductVersion1.2.5.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
066048DLL10/13/2011 15:35:15#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK