filenamephd
size32256 (0x7e00)
md5dd0768f2d474669621124ba0ad8e1742
typePE32 executable (DLL) (native) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
108
9340353
175402198
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x4f1d4d88
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x6600
SizeOfInitializedData0
SizeOfUninitializedData0
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x17000
SizeOfHeaders0x400
CheckSum0x16bc3
Subsystem1
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x3ca80x3e00R-X CODE
.iat0x50000x2ac0x400R-- IDATA
.eat0x60000x2000x200R-- IDATA
.0data0x70000x26b00x2800R-X CODE
.data0xa0000x91f90x400RW- IDATA
.ndata0x140000x3bd0x400RW- IDATA
.rsrc0x150000x100x200R-- IDATA
.reloc0x160000x23c0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x50000x28
RESOURCE0x150000x10
EXCEPTION00
SECURITY00
BASERELOC0x160000x23c
DEBUG0xa2a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x70000x60
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
ntoskrnl.exe1005MmFreeNonCachedMemory
ntoskrnl.exe894KeRemoveByKeyDeviceQueue
ntoskrnl.exe590KeInitializeMutex
ntoskrnl.exe1938ZwOpenSection
ntoskrnl.exe1134RtlInitUnicodeString
ntoskrnl.exe1614RtlPrefixUnicodeString
ntoskrnl.exe1696RtlValidSecurityDescriptor
ntoskrnl.exe1540RtlInt64ToUnicodeString
ntoskrnl.exe1470RtlFindClearBitsAndSet
ntoskrnl.exe550IoDetachDevice
ntoskrnl.exe1260PsCreateSystemThread
ntoskrnl.exe625KeReadStateMutex
ntoskrnl.exe1267RtlUpcaseUnicodeChar
ntoskrnl.exe824KeInitializeSpinLock
ntoskrnl.exe1418RtlCreateSecurityDescriptor
ntoskrnl.exe1455RtlEqualString
ntoskrnl.exe1251ProbeForRead
ntoskrnl.exe616KeQueryInterruptTime
ntoskrnl.exe1130RtlInitAnsiString
ntoskrnl.exe1778SeTokenIsRestricted
ntoskrnl.exe585IoGetDeviceObjectPointer
ntoskrnl.exe1662RtlTimeToTimeFields
ntoskrnl.exe1746SeImpersonateClientEx
offsetsizetypecomment
032256DLL01/23/2012 12:07:36#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK