filename[1]Ole10Native_6239_282624.dll
size282624 (0x45000)
md5cf84ee5b440251dbe496b8b5a83132f0
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
480472
1080475
1472991
147307292
123507274
9340353
1037
9630771
9230771
9030771

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x57d31545
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion7.10
SizeOfCode0x3000
SizeOfInitializedData0x44000
SizeOfUninitializedData0
AddressOfEntryPoint0x1b70
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x48000
SizeOfHeaders0x1000
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x11740x2000R-X CODE
.cdata0x30000xc320x1000R-X CODE
.rdata0x40000x4a60x1000R-- IDATA
.data0x50000x40b600x3e000RW- IDATA
.tls0x460000x240x1000RW- IDATA
.reloc0x470000x3660x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x44600x46
IMPORT0x40e00x78
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x470000xc4
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x40c80x18
LOAD_CONFIG00
Bound_IAT00
IAT0x40000xa8
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x100460000x100460200x10045b48000
module_namehintordfunction_name
USER32.dll554ReleaseDC
USER32.dll143DefWindowProcW
USER32.dll153DestroyWindow
USER32.dll515PostMessageW
USER32.dll580SetCapture
USER32.dll97CreateWindowExW
USER32.dll641SetWindowLongW
USER32.dll537RegisterClassW
USER32.dll150DestroyIcon
USER32.dll151DestroyMenu
USER32.dll446LoadIconA
USER32.dll96CreateWindowExA
USER32.dll691UnregisterClassA
USER32.dll460LoadStringW
USER32.dll501OffsetRect
USER32.dll576SendMessageW
USER32.dll647SetWindowTextW
ole32.dll114CoWaitForMultipleHandles
ole32.dll61CoInitialize
msi.dll50
KERNEL32.dll82CloseHandle
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll281ExitProcess
KERNEL32.dll1113SetEvent
KERNEL32.dll158CreateMutexW
KERNEL32.dll391GetCommandLineW
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll1357lstrlenA
KERNEL32.dll811LCMapStringA
KERNEL32.dll676GetVersionExW
MSVCRT.dll606free
MSVCRT.dll390_onexit
MSVCRT.dll663memcpy
MSVCRT.dll657malloc
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll85__dllonexit
MSVCRT.dll271_initterm
ordentry_vafunction_name
10x1d00SetBack
module_nameSetBack.dll
flags0
timestamp2019-10-10 20:02:13
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x448c
Functions(1)0x4488
NameOrdinals(1)0x4490
offsetsizetypecomment
0282624DLL09/09/2016 20:02:13#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x45b48