filenamec971f0521e088a68e8227fc28f54af30.bender.exe
size226829 (0x3760d)
md5c971f0521e088a68e8227fc28f54af30
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
1473072921
10182
1753031944
158303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x54be90f8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion10.0
SizeOfCode0x13a00
SizeOfInitializedData0x23800
SizeOfUninitializedData0
AddressOfEntryPoint0x116f0
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x3e000
SizeOfHeaders0x400
CheckSum0x28a04
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1387e0x13a00R-X CODE
.rdata0x150000x44240x4600R-- IDATA
.data0x1a0000x293c0x200RW- IDATA
.pdata0x1d0000x1bf00x1c00R-- IDATA
.rsrc0x1f0000x1d0900x1d200R-- IDATA
.reloc0x3d0000xe40x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x183500xdc
RESOURCE0x1f0000x1d090
EXCEPTION0x1d0000x1bf0
SECURITY00
BASERELOC0x3d0000x38
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x150000x530
Delay_IAT00
CLR_Header00
typenamesizecp
RCDATA0Y2HGIF3477201252
RCDATA1UDNFUDE398241252
RCDATA4QVNDMKU0467081252
RCDATA5WGKTDJC8524571252
RCDATA6ET5APHF7481252
RCDATA7R3YSOAC64321252
RCDATA9TCUCOGN58001252
MANIFEST#23461252
module_namehintordfunction_name
IPHLPAPI.DLL62GetAdaptersAddresses
WININET.dll175InternetSetOptionW
WININET.dll191InternetWriteFile
WININET.dll159InternetReadFile
WININET.dll155InternetQueryDataAvailable
WININET.dll93HttpSendRequestExW
WININET.dll158InternetQueryOptionW
WININET.dll113InternetConnectA
WININET.dll90HttpQueryInfoW
WININET.dll91HttpSendRequestA
WININET.dll151InternetOpenA
WININET.dll86HttpEndRequestW
WININET.dll107InternetCloseHandle
WININET.dll130InternetGetConnectedState
WININET.dll152InternetOpenUrlA
WININET.dll87HttpOpenRequestA
WININET.dll82HttpAddRequestHeadersA
WS2_32.dll2FreeAddrInfoW
WS2_32.dll5GetAddrInfoW
WS2_32.dll6
WS2_32.dll23
WS2_32.dll27WSACloseEvent
WS2_32.dll11
WS2_32.dll68WSARecv
WS2_32.dll83WSASocketW
WS2_32.dll73WSASend
WS2_32.dll111
WS2_32.dll28WSAConnect
WS2_32.dll39WSAEnumNetworkEvents
WS2_32.dll9
WS2_32.dll42WSAEventSelect
WS2_32.dll22
WS2_32.dll32WSACreateEvent
WS2_32.dll3
WS2_32.dll89WSAWaitForMultipleEvents
WS2_32.dll2
WS2_32.dll20
WS2_32.dll18
WS2_32.dll17
WS2_32.dll4
WS2_32.dll15
WS2_32.dll112
WS2_32.dll115
SHLWAPI.dll323StrStrA
SHLWAPI.dll331StrToIntA
SHLWAPI.dll325StrStrIW
SHLWAPI.dll334StrToIntW
SHLWAPI.dll335StrTrimA
SHLWAPI.dll324StrStrIA
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll114ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll612RegOpenKeyW
ADVAPI32.dll183CryptDestroyKey
ADVAPI32.dll202CryptImportKey
ADVAPI32.dll214CryptVerifySignatureW
ADVAPI32.dll200CryptHashData
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll223DuplicateTokenEx
ADVAPI32.dll401LookupAccountSidW
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll124CreateProcessAsUserW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll177CryptAcquireContextW
USERENV.dllCreateEnvironmentBlock
USERENV.dll4DestroyEnvironmentBlock
bcrypt.dll36BCryptOpenAlgorithmProvider
bcrypt.dll12BCryptDestroyHash
bcrypt.dll33BCryptHashData
bcrypt.dll53BCryptVerifySignature
bcrypt.dll2BCryptCloseAlgorithmProvider
bcrypt.dll35BCryptImportKeyPair
bcrypt.dll13BCryptDestroyKey
bcrypt.dll6BCryptCreateHash
bcrypt.dll32BCryptGetProperty
bcrypt.dll26BCryptFinishHash
KERNEL32.dll920Process32FirstW
KERNEL32.dll521GetLocalTime
KERNEL32.dll588GetProcAddress
KERNEL32.dll1377lstrlenW
KERNEL32.dll143CreateFileW
KERNEL32.dll963ReadFile
KERNEL32.dll1215SizeofResource
KERNEL32.dll1312WideCharToMultiByte
KERNEL32.dll898OpenProcess
KERNEL32.dll1332WriteFile
KERNEL32.dll854LockResource
KERNEL32.dll922Process32NextW
KERNEL32.dll1368lstrcmpiW
KERNEL32.dll189CreateToolhelp32Snapshot
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll1152SetLastError
KERNEL32.dll730HeapReAlloc
KERNEL32.dll723HeapAlloc
KERNEL32.dll727HeapFree
KERNEL32.dll726HeapDestroy
KERNEL32.dll725HeapCreate
KERNEL32.dll101ConnectNamedPipe
KERNEL32.dll160CreateNamedPipeW
KERNEL32.dll229DisconnectNamedPipe
KERNEL32.dll349FlushFileBuffers
KERNEL32.dll1371lstrcpyW
KERNEL32.dll402GetComputerNameA
KERNEL32.dll638GetSystemTime
KERNEL32.dll1362lstrcatW
KERNEL32.dll486GetExitCodeProcess
KERNEL32.dll1230TerminateProcess
KERNEL32.dll650GetTempFileNameW
KERNEL32.dll652GetTempPathW
KERNEL32.dll895OpenMutexW
KERNEL32.dll857MapViewOfFile
KERNEL32.dll1253UnmapViewOfFile
KERNEL32.dll169CreateRemoteThread
KERNEL32.dll350FlushInstructionCache
KERNEL32.dll784IsWow64Process
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll158CreateMutexW
KERNEL32.dll133CreateEventW
KERNEL32.dll542GetModuleHandleW
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1227SystemTimeToFileTime
KERNEL32.dll835LoadResource
KERNEL32.dll1042ResetEvent
KERNEL32.dll340FindResourceW
KERNEL32.dll503GetFileSize
KERNEL32.dll684GetVersionExW
KERNEL32.dll1364lstrcmpA
KERNEL32.dll1021ReleaseMutex
KERNEL32.dll1367lstrcmpiA
KERNEL32.dll1376lstrlenA
KERNEL32.dll1288WaitForSingleObject
KERNEL32.dll1127SetEvent
KERNEL32.dll666GetTickCount
KERNEL32.dll1216Sleep
KERNEL32.dll130CreateEventA
KERNEL32.dll520GetLastError
KERNEL32.dll82CloseHandle
KERNEL32.dll180CreateThread
KERNEL32.dll1370lstrcpyA
KERNEL32.dll746InitializeCriticalSection
KERNEL32.dll827LeaveCriticalSection
KERNEL32.dll242EnterCriticalSection
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll1231TerminateThread
KERNEL32.dll1190SetThreadPriority
KERNEL32.dll873MultiByteToWideChar
USER32.dll826wsprintfA
SHELL32.dll290ShellExecuteW
SHELL32.dll195SHGetFolderPathW
offsetsizetypecomment
15c115HTM#
15d0221245BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 226829 bytes (222 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK