filenamemodule.560.3ef44a68.74be0000.dll
size78848 (0x13400)
md5cccbaea1ae9687b7923b77ba8e1a9fa0
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1323072911
1473072931
1078
149307299
146307291
1313072917
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bda3d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x11c00
SizeOfInitializedData0x1600
SizeOfUninitializedData0
AddressOfEntryPoint0x2dc3
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x74be0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x16000
SizeOfHeaders0x600
CheckSum0x17990
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x11aba0x11c00R-X CODE
.data0x130000x7380x400RW- IDATA
.rsrc0x140000x4b00x600R-- IDATA
.reloc0x150000x7b20x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x126000x4ba
IMPORT0x11ba40x140
RESOURCE0x140000x4b0
EXCEPTION00
SECURITY00
BASERELOC0x150000x6a4
DEBUG0x11700x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x2d100x40
Bound_IAT0x2780x2a8
IAT0x10000x168
Delay_IAT00
CLR_Header00
typenamesizecp
RCDATA#102920
VERSION#19400
module_namehintordfunction_name
ntdll.dll1217RtlUnicodeStringToAnsiString
ntdll.dll837RtlFreeAnsiString
ntdll.dll914RtlInitAnsiString
ntdll.dll616RtlAnsiStringToUnicodeString
ntdll.dll705RtlCreateUnicodeStringFromAsciiz
ntdll.dll844RtlFreeUnicodeString
ntdll.dll32DbgPrint
ntdll.dll1913memcpy
ntdll.dll1885atol
ntdll.dll1931strcpy_s
ntdll.dll1917memset
ntdll.dll1821_chkstk
ntdll.dll1927strcat_s
ntdll.dll1235RtlUnwind
ntdll.dll1043RtlNtStatusToDosError
ntdll.dll425NtQuerySystemInformation
ntdll.dll499NtSetInformationThread
ntdll.dll400NtQueryInformationThread
ntdll.dll923RtlInitUnicodeString
ntdll.dll212NtClose
ntdll.dll1053RtlOpenCurrentUser
ntdll.dll1915memmove
API-MS-Win-Core-ErrorHandling-L1-1-0.dll1GetLastError
API-MS-Win-Core-ErrorHandling-L1-1-0.dll6UnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll5SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll4SetLastError
API-MS-Win-Core-File-L1-1-0.dll4CreateFileW
API-MS-Win-Core-File-L1-1-0.dll3CreateFileA
API-MS-Win-Core-File-L1-1-0.dll37GetFileSize
API-MS-Win-Core-File-L1-1-0.dll58ReadFile
API-MS-Win-Core-File-L1-1-0.dll34GetFileAttributesExW
API-MS-Win-Core-Handle-L1-1-0.dllCloseHandle
API-MS-Win-Core-Heap-L1-1-0.dllGetProcessHeap
API-MS-Win-Core-Heap-L1-1-0.dll2HeapAlloc
API-MS-Win-Core-Heap-L1-1-0.dll6HeapFree
API-MS-Win-Core-Interlocked-L1-1-0.dll7InterlockedIncrement
API-MS-Win-Core-Interlocked-L1-1-0.dll3InterlockedDecrement
API-MS-Win-Core-LibraryLoader-L1-1-0.dll1FindResourceExW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll13LoadLibraryExA
API-MS-Win-Core-LibraryLoader-L1-1-0.dll14LoadLibraryExW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll12GetProcAddress
API-MS-Win-Core-LibraryLoader-L1-1-0.dll15LoadResource
API-MS-Win-Core-LibraryLoader-L1-1-0.dll19SizeofResource
API-MS-Win-Core-LibraryLoader-L1-1-0.dll8GetModuleHandleA
API-MS-Win-Core-LibraryLoader-L1-1-0.dllDisableThreadLibraryCalls
API-MS-Win-Core-LibraryLoader-L1-1-0.dll3FreeLibrary
API-MS-Win-Core-LocalRegistry-L1-1-0.dllRegCloseKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll29RegQueryValueExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll10RegEnumKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll24RegOpenKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll36RegSetValueExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll3RegDeleteKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll7RegDeleteValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll1RegCreateKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll30RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll25RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll27RegQueryInfoKeyA
API-MS-Win-Core-Misc-L1-1-0.dll10LocalAlloc
API-MS-Win-Core-Misc-L1-1-0.dll11LocalFree
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll14SearchPathW
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dllExpandEnvironmentStringsA
API-MS-Win-Core-ProcessThreads-L1-1-0.dll11GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll10GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll42TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll13GetCurrentThreadId
API-MS-Win-Core-Profile-L1-1-0.dllQueryPerformanceCounter
API-MS-Win-Core-SysInfo-L1-1-0.dll11GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll14GetTickCount
API-MS-Win-Core-Synch-L1-1-0.dll14EnterCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll19LeaveCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll15InitializeCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll13DeleteCriticalSection
API-MS-Win-Core-Memory-L1-1-0.dllCreateFileMappingW
API-MS-Win-Core-Memory-L1-1-0.dll2MapViewOfFile
API-MS-Win-Core-Memory-L1-1-0.dll6UnmapViewOfFile
ordentry_vafunction_name
10x3ea8CheckSignatureInFile
20x42a3CryptAcquireContextA
30x63e8CryptAcquireContextW
40x2e79CryptContextAddRef
50x556bCryptCreateHash
60x546bCryptDecrypt
70x4b74CryptDeriveKey
80x5985CryptDestroyHash
90x4cf3CryptDestroyKey
100x568fCryptDuplicateHash
110x4a67CryptDuplicateKey
120x5368CryptEncrypt
130x30aeCryptEnumProviderTypesA
140x614aCryptEnumProviderTypesW
150x32d6CryptEnumProvidersA
160x62a1CryptEnumProvidersW
170x50ddCryptExportKey
180x497bCryptGenKey
190x4f73CryptGenRandom
200x5f81CryptGetDefaultProviderA
210x693aCryptGetDefaultProviderW
220x5eccCryptGetHashParam
230x4ebeCryptGetKeyParam
240x5d6aCryptGetProvParam
250x5003CryptGetUserKey
260x57b2CryptHashData
270x589aCryptHashSessionKey
280x51ddCryptImportKey
290x2ef0CryptReleaseContext
300x5e00CryptSetHashParam
310x4df2CryptSetKeyParam
320x2fbbCryptSetProvParam
330x64d3CryptSetProviderA
340x65efCryptSetProviderExA
350x6b04CryptSetProviderExW
360x6a7bCryptSetProviderW
370x5b1aCryptSignHashA
380x5b0aCryptSignHashW
390x5cc2CryptVerifySignatureA
400x5cb2CryptVerifySignatureW
410x3ea8SystemFunction035
module_nameCRYPTSP.dll
flags0
timestamp2009-07-13 22:14:25
version0.0
ordinal_base1
nFunctions41
nNames41
Names(41)0x126cc
Functions(41)0x12628
NameOrdinals(41)0x12770

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionCryptographic Service Provider API
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamecryptsp.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamecryptsp.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
078848DLL07/14/2009 01:07:09#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278