filenamearyanrat-server-dll.dll
size39424 (0x9a00)
md5e56437967f439b1ef3b347a18fca738c
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
221210052
223210053
2242100511
225210054
209655011
2036550119
10198
229311012
220311011
219210051
15101
222311011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x55ca9ccb
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion12.0
SizeOfCode0x6200
SizeOfInitializedData0xa400
SizeOfUninitializedData0
AddressOfEntryPoint0x6b58
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x15000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x61d00x6200R-X CODE
.rdata0x80000x20de0x2200R-- IDATA
.data0xb0000x70ec0x200RW- IDATA
.rsrc0x130000x3280x400R-- IDATA
.reloc0x140000xa9c0xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x90d00x5e
IMPORT0x91300xdc
RESOURCE0x130000x328
EXCEPTION00
SECURITY00
BASERELOC0x140000xa9c
DEBUG0x83400x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x8df80x40
Bound_IAT00
IAT0x80000x324
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#108660
DIALOG#1101400
MANIFEST#23810
module_namehintordfunction_name
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll669GetProcAddress
KERNEL32.dll254DecodePointer
KERNEL32.dll289EncodePointer
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll1540lstrcpyA
KERNEL32.dll232CreateThread
KERNEL32.dll592GetLastError
KERNEL32.dll263DeleteFileA
KERNEL32.dll173CreateDirectoryA
KERNEL32.dll552GetEnvironmentVariableA
KERNEL32.dll1531lstrcatA
KERNEL32.dll1104ReadFile
KERNEL32.dll1377TerminateProcess
KERNEL32.dll215CreateProcessA
KERNEL32.dll560GetFileAttributesA
KERNEL32.dll1362Sleep
KERNEL32.dll1378TerminateThread
KERNEL32.dll1006OpenProcess
KERNEL32.dll542GetDriveTypeA
KERNEL32.dll337ExitProcess
KERNEL32.dll1505WriteFile
KERNEL32.dll525GetCurrentThread
KERNEL32.dll754GetTickCount
KERNEL32.dll1192ResumeThread
KERNEL32.dll1370SuspendThread
KERNEL32.dll127CloseHandle
KERNEL32.dll772GetVersionExA
KERNEL32.dll241CreateToolhelp32Snapshot
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll381FindNextFileA
KERNEL32.dll610GetModuleFileNameA
KERNEL32.dll212CreatePipe
KERNEL32.dll720GetSystemInfo
KERNEL32.dll968MoveFileA
KERNEL32.dll942LocalAlloc
KERNEL32.dll1038Process32Next
KERNEL32.dll933LoadLibraryA
KERNEL32.dll360FindClose
KERNEL32.dll364FindFirstFileA
KERNEL32.dll160CopyFileA
KERNEL32.dll1036Process32First
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll414FreeLibrary
KERNEL32.dll1027PeekNamedPipe
KERNEL32.dll803GlobalMemoryStatus
KERNEL32.dll186CreateFileA
KERNEL32.dll462GetComputerNameA
KERNEL32.dll1069QueryPerformanceCounter
USER32.dll800ShowWindow
USER32.dll529IsWindow
USER32.dll180DispatchMessageA
USER32.dll835UnhookWindowsHookEx
USER32.dll311GetDesktopWindow
USER32.dll534IsWindowVisible
USER32.dll443GetWindow
USER32.dll823ToUnicodeEx
USER32.dll791SetWindowsHookExA
USER32.dll426GetSystemMetrics
USER32.dll677ReleaseDC
USER32.dll463GetWindowTextA
USER32.dll323GetForegroundWindow
USER32.dll344GetKeyboardState
USER32.dll831TranslateMessage
USER32.dll308GetDC
USER32.dll695SendMessageA
USER32.dll260ExitWindowsEx
USER32.dll890wsprintfA
USER32.dll28CallNextHookEx
USER32.dll339GetKeyState
USER32.dll448GetWindowDC
USER32.dll625PostQuitMessage
USER32.dll101CreateDialogParamA
USER32.dll367GetMessageA
USER32.dll173DestroyWindow
USER32.dll821ToAsciiEx
GDI32.dll503GetDeviceCaps
GDI32.dll502GetDIBits
GDI32.dll50CreateDCA
GDI32.dll761SetPixel
GDI32.dll271DeleteObject
GDI32.dll725SelectObject
GDI32.dll54CreateDIBSection
GDI32.dll48CreateCompatibleBitmap
GDI32.dll678SaveDC
GDI32.dll742SetDIBits
GDI32.dll560GetPixel
GDI32.dll551GetObjectA
GDI32.dll671RestoreDC
GDI32.dll19BitBlt
GDI32.dll268DeleteDC
GDI32.dll49CreateCompatibleDC
ADVAPI32.dll751StartServiceA
ADVAPI32.dll367GetTokenInformation
ADVAPI32.dll272EnumServicesStatusA
ADVAPI32.dll535OpenThreadToken
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll101CloseServiceHandle
ADVAPI32.dll533OpenServiceA
ADVAPI32.dll657RegQueryValueExA
ADVAPI32.dll626RegEnumKeyExA
ADVAPI32.dll428LookupPrivilegeValueA
ADVAPI32.dll644RegOpenKeyExA
ADVAPI32.dll651RegQueryInfoKeyA
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll589QueryServiceStatusEx
ADVAPI32.dll531OpenSCManagerA
ADVAPI32.dll629RegEnumValueA
ADVAPI32.dll307FreeSid
ADVAPI32.dll582QueryServiceConfigA
ADVAPI32.dll377GetUserNameA
ADVAPI32.dll106ControlService
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll280EqualSid
SHELL32.dll307ShellExecuteA
USERENV.dll37GetUserProfileDirectoryA
WS2_32.dll1
WS2_32.dll13
WS2_32.dll101
WS2_32.dll19
WS2_32.dll52
WS2_32.dll3
WS2_32.dll112
WS2_32.dll23
WS2_32.dll2
WS2_32.dll16
WS2_32.dll57
WS2_32.dll4
WS2_32.dll12
WS2_32.dll115
WS2_32.dll116
WS2_32.dll111
WS2_32.dll9
WS2_32.dll11
AVICAP32.dll3capGetDriverDescriptionA
AVICAP32.dll1capCreateCaptureWindowA
gdiplus.dll628GdiplusShutdown
gdiplus.dll237GdipFree
gdiplus.dll437GdipLoadImageFromFile
gdiplus.dll33GdipAlloc
gdiplus.dll287GdipGetImageEncodersSize
gdiplus.dll152GdipDisposeImage
gdiplus.dll77GdipCreateBitmapFromHBITMAP
gdiplus.dll286GdipGetImageEncoders
gdiplus.dll54GdipCloneImage
gdiplus.dll629GdiplusStartup
gdiplus.dll496GdipSaveImageToFile
MSVCR120.dll1770memset
MSVCR120.dll1675ftell
MSVCR120.dll1678fwrite
MSVCR120.dll1834srand
MSVCR120.dll1799rand
MSVCR120.dll1665fread
MSVCR120.dll1657fopen
MSVCR120.dll1789printf
MSVCR120.dll1643fgets
MSVCR120.dll1153_snprintf
MSVCR120.dll1519atoi
MSVCR120.dll1858strstr
MSVCR120.dll1755malloc
MSVCR120.dll1534calloc
MSVCR120.dll1667free
MSVCR120.dll1831sprintf
MSVCR120.dll1673fseek
MSVCR120.dll1623fclose
MSVCR120.dll1256_time64
MSVCR120.dll1766memcpy
MSVCR120.dll1765memcmp
MSVCR120.dll592_crt_debugger_hook
MSVCR120.dll428__crtUnhandledException
MSVCR120.dll427__crtTerminateProcess
MSVCR120.dll114void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR120.dll111public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCR120.dll367__CppXcptFilter
MSVCR120.dll535_amsg_exit
MSVCR120.dll933_malloc_crt
MSVCR120.dll634_except_handler4_common
MSVCR120.dll396__clean_type_info_names_internal
MSVCR120.dll1082_onexit
MSVCR120.dll430__dllonexit
MSVCR120.dll558_calloc_crt
MSVCR120.dll1284_unlock
MSVCR120.dll916_lock
MSVCR120.dll309void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR120.dll781_initterm_e
MSVCR120.dll780_initterm
MSVCR120.dll1801realloc
ordentry_vafunction_name
10x4f7e?KeyEvent@@YGJHIJ@Z
module_namearyanrat-server-dll.dll
flags0
timestamp2015-08-12 01:09:30
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x90fc
Functions(1)0x90f8
NameOrdinals(1)0x9100
offsetsizetypecomment
039424DLL08/12/2015 01:09:31#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK