filenameRemoteInstaller.dll
size44544 (0xae00)
md5ee0c9275c70aa5e78ebc100a0c5d9efb
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
150204131
149210224
147210224
109507271
1235072715
10120
1322102216
1312102213
146210221
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4f50603f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x3800
SizeOfInitializedData0x7200
SizeOfUninitializedData0
AddressOfEntryPoint0x401f
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0xe000
SizeOfHeaders0x400
CheckSum0x142a6
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x366e0x3800R-X CODE
.rdata0x50000x20c10x2200R-- IDATA
.data0x80000xec40x600RW- IDATA
.rsrc0x90000x3fc40x4000R-- IDATA
.reloc0xd0000x9280xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x70000xc1
IMPORT0x66e00xc8
RESOURCE0x90000x3fc4
EXCEPTION00
SECURITY00
BASERELOC0xd0000x68c
DEBUG0x51f00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x5c900x40
Bound_IAT00
IAT0x50000x1bc
Delay_IAT00
CLR_Header00
typenamesizecp
BIN#238112641252
REGISTRY#1011351252
REGISTRY#1026591252
TYPELIB#119601252
STRING#7621252
VERSION#18481252
MANIFEST#28501252
idlangstring
1001033RemoteInstaller
module_namehintordfunction_name
OLEAUT32.dll314
OLEAUT32.dll161
OLEAUT32.dll162
OLEAUT32.dll2
OLEAUT32.dll163
OLEAUT32.dll186
OLEAUT32.dll6
OLEAUT32.dll7
USERENV.dll29GetUserProfileDirectoryW
USERENV.dllCreateEnvironmentBlock
USERENV.dll4DestroyEnvironmentBlock
MPR.dll12WNetCancelConnection2W
MPR.dll6WNetAddConnection2W
ADVAPI32.dll391LogonUserW
ADVAPI32.dll125CreateServiceW
ADVAPI32.dll83CloseServiceHandle
ADVAPI32.dll707StartServiceW
ADVAPI32.dll499OpenSCManagerW
ADVAPI32.dll121CreateProcessWithLogonW
ADVAPI32.dll501OpenServiceW
KERNEL32.dll701InterlockedExchange
KERNEL32.dll1057Sleep
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll1069TerminateProcess
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll692InitializeCriticalSection
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll544GetProcAddress
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll704InterlockedIncrement
KERNEL32.dll700InterlockedDecrement
KERNEL32.dll486GetLastError
KERNEL32.dll827OutputDebugStringW
KERNEL32.dll67CloseHandle
KERNEL32.dll1165WriteFile
KERNEL32.dll127CreateFileW
KERNEL32.dll1056SizeofResource
KERNEL32.dll775LockResource
KERNEL32.dll758LoadResource
KERNEL32.dll313FindResourceW
KERNEL32.dll101CopyFileW
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll1206lstrlenW
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll1033SetThreadLocale
KERNEL32.dll607GetThreadLocale
KERNEL32.dll673HeapFree
KERNEL32.dll547GetProcessHeap
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll614GetTickCount
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll505GetModuleHandleW
USER32.dll47CharNextW
ole32.dll16CoCreateInstance
ATL90.DLL64
ATL90.DLL31
ATL90.DLL58
ATL90.DLL32
ATL90.DLL61
ATL90.DLL67
ATL90.DLL15
ATL90.DLL23
ATL90.DLL49
ATL90.DLL68
ATL90.DLL56
MSVCR90.dll106__CppXcptFilter
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll54public: void __thiscall type_info::_type_info_dtor_internal_method(void)

?_type_info_dtor_internal_method@type_info@@QAEXXZ

MSVCR90.dll517_initterm_e
MSVCR90.dll516_initterm
MSVCR90.dll363_encoded_null
MSVCR90.dll647_malloc_crt
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll277_amsg_exit
MSVCR90.dll150__dllonexit
MSVCR90.dll17void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR90.dll90_CxxThrowException
MSVCR90.dll1427wcsncpy_s
MSVCR90.dll1252free
MSVCR90.dll33void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

MSVCR90.dll115__CxxFrameHandler3
MSVCR90.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR90.dll956_swprintf
MSVCR90.dll1322memset
MSVCR90.dll1177_wsplitpath
MSVCR90.dll811_purecall
MSVCR90.dll31void * __cdecl operator new[](unsigned int)

??_U@YAPAXI@Z

MSVCR90.dll1083_wcsnicmp
MSVCR90.dll371_except_handler4_common
MSVCR90.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90.dll998_unlock
MSVCR90.dll352_decode_pointer
MSVCR90.dll362_encode_pointer
MSVCR90.dll630_lock
MSVCR90.dll796_onexit
MSVCR90.dll140__clean_type_info_names_internal
ordentry_vafunction_name
10x35b0DllCanUnloadNow
20x35d0DllGetClassObject
30x3730DllInstall
40x3710DllRegisterServer
50x3720DllUnregisterServer
module_nameRemoteInstaller.DLL
flags0
timestamp2012-03-02 05:53:03
version0.0
ordinal_base1
nFunctions5
nNames5
Names(5)0x703c
Functions(5)0x7028
NameOrdinals(5)0x7050

StringTable 040904e4

CompanyNameTODO: <Company name>
FileDescriptionTODO: <File description>
FileVersion1.0.0.1
LegalCopyrightTODO: (c) <Company name>. All rights reserved.
InternalNameRemoteInstaller.dll
OriginalFilenameRemoteInstaller.dll
ProductNameTODO: <Product name>
ProductVersion1.0.0.1

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
044544DLL03/02/2012 05:53:03#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK