filenameDanny.dll
size8348188 (0x7f621c)
md5bad04a39563d759885fd53a456d2d625
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x60
blocks_in_file1
num_relocs0
header_paragraphs4
min_extra_paragraphs0x10
max_extra_paragraphs0xffff
ss0
sp0xfe
checksum0
ip0x12
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x60

DOS stub

00000000: 52 65 71 75 69 72 65 73  20 57 69 6e 33 32 20 20  |Requires Win32  |
00000010: 20 24 16 1f 33 d2 b4 09  cd 21 b8 01 4c cd 21 00  | $..3....!..L.!.|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x818e
Magic0x10b
LinkerVersion8.0
SizeOfCode0x6800
SizeOfInitializedData0x3000
SizeOfUninitializedData0
AddressOfEntryPoint0x2784
BaseOfCode0x2000
BaseOfData0x9000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion1.0
ImageVersion0.0
SubsystemVersion3.10
Reserved10
SizeOfImage0x7fb000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

FASM v1.5x

Sections

namevavsizeraw sizeflags
.idata0x10000x8000x800R-- IDATA
_TEXT0x20000x68000x6800R-X CODE
.CRT$XIA0x90000x30000x1800RW- IDATA
.rsrc0xc0000x7ecc000x7ecc00R-- IDATA
.reloc0x7f90000xa000xa00R-- IDATA
.debug0x7fa0000x2000x1cRW- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x10000x690
RESOURCE0xc0000x7ecbd8
EXCEPTION00
SECURITY00
BASERELOC0x7f90000x818
DEBUG0x7fa0000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
WAVES001035560
WAVES012051660
WAVES02575300
WAVES03699140
WAVES04702800
WAVES051268180
WAVES063178600
WAVES07788040
WAVES08821420
WAVES091886560
WAVES10728540
WAVES111208540
WAVES12725640
WAVES13972440
WAVES141345340
WAVES151769580
WAVES161015940
WAVES176555800
WAVES186585300
WAVES1924719800
WAVES201645780
WAVES212087720
WAVES2212590320
WAVES234647400
WAVES241608860
WAVES251843640
ICON#122160
GROUP_ICONAPPICON200
module_namehintordfunction_name
ADVAPI32.DLLRegSetValueExA
ADVAPI32.DLLRegDeleteValueA
ADVAPI32.DLLRegOpenKeyExA
ADVAPI32.DLLRegQueryValueExA
ADVAPI32.DLLRegCloseKey
WINMM.DLLPlaySoundA
KERNEL32.dllVirtualAlloc
KERNEL32.dllVirtualFree
KERNEL32.dllRaiseException
KERNEL32.dllSetConsoleCtrlHandler
KERNEL32.dllGetStringTypeA
KERNEL32.dllSetUnhandledExceptionFilter
KERNEL32.dllWriteConsoleA
KERNEL32.dllGetStdHandle
KERNEL32.dllGetLastError
KERNEL32.dllGetCPInfo
KERNEL32.dllGetOEMCP
KERNEL32.dllGetACP
KERNEL32.dllLCMapStringA
KERNEL32.dllGetTimeZoneInformation
KERNEL32.dllFindClose
KERNEL32.dllFindFirstFileA
KERNEL32.dllFileTimeToDosDateTime
KERNEL32.dllFindNextFileA
KERNEL32.dllRtlUnwind
KERNEL32.dllGetTickCount
KERNEL32.dllWaitForSingleObject
KERNEL32.dllReleaseSemaphore
KERNEL32.dllCreateSemaphoreA
KERNEL32.dllExitProcess
KERNEL32.dllUnhandledExceptionFilter
KERNEL32.dllMultiByteToWideChar
KERNEL32.dllGetCurrentThreadId
KERNEL32.dllFreeEnvironmentStringsA
KERNEL32.dllGetVersion
KERNEL32.dllGetEnvironmentStrings
KERNEL32.dllGetModuleFileNameA
KERNEL32.dllBeep
KERNEL32.dllSleep
KERNEL32.dllGetEnvironmentVariableA
KERNEL32.dllGetCommandLineA
KERNEL32.dllGetModuleHandleA
KERNEL32.dllCreateToolhelp32Snapshot
KERNEL32.dllProcess32First
KERNEL32.dllOpenProcess
KERNEL32.dllGetCurrentProcess
KERNEL32.dllTerminateProcess
KERNEL32.dllProcess32Next
KERNEL32.dllCloseHandle
KERNEL32.dllGetLocalTime
KERNEL32.dllDeleteFileA
KERNEL32.dllMoveFileA
USER32.dllGetWindowTextA
USER32.dllGetForegroundWindow
USER32.dllGetClassNameA
USER32.dllkeybd_event
USER32.dllExitWindowsEx
USER32.dllMessageBoxA
offsetsizetypecomment
15c115HTM#
9b40103548WAV#
22fc4205158WAV#
5513457522WAV#
631f069906WAV#
7430c70272WAV#
85594126810WAV#
a44f8317852WAV#
f1e9c78796WAV#
10527082134WAV#
119350188648WAV#
14744072846WAV#
1590d8120846WAV#
1768f072556WAV#
18846497236WAV#
1a0040134526WAV#
1c0dc8176950WAV#
1ec108101586WAV#
204de4655572WAV#
2a4ec0658522WAV#
345b242471972WAV#
5a1350164570WAV#
5c9634208764WAV#
5fc5b81259024WAV#
72fbd0464732WAV#
7a1334160878WAV#
7c87ac184356WAV#
7f57d02636BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK