filenamedm.unpacked.dll 886952 32768.dll
size32768 (0x8000)
md5f77ecc25d6fa1fd6fec03a5b3889f370
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1272911
1080474
480472
1067
1980347
1197829
617351
484471

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4fe7165d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.0
SizeOfCode0x3000
SizeOfInitializedData0x5000
SizeOfUninitializedData0
AddressOfEntryPoint0x3deb
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x2e900x3000R-X CODE
.rdata0x40000x84c0x1000R-- IDATA
.data0x50000x12d00x1000RW- IDATA
.rsrc0x70000x9380x1000R-- IDATA
.reloc0x80000x2ca0x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x46400x20c
IMPORT0x41480x64
RESOURCE0x70000x938
EXCEPTION00
SECURITY00
BASERELOC0x80000x1e8
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000xf8
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
ICON#22960
DIALOG#1021280
GROUP_ICON#101340
VERSION#18000
module_namehintordfunction_name
KERNEL32.dll470MapViewOfFile
KERNEL32.dll489OpenFileMappingA
KERNEL32.dll248GetCurrentProcessId
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll250GetCurrentThreadId
KERNEL32.dll365GetTickCount
KERNEL32.dll662Sleep
KERNEL32.dll180FreeLibrary
KERNEL32.dll318GetProcAddress
KERNEL32.dll292GetModuleFileNameA
KERNEL32.dll703VirtualFree
KERNEL32.dll484MultiByteToWideChar
KERNEL32.dll699VirtualAlloc
KERNEL32.dll409HeapAlloc
KERNEL32.dll320GetProcessHeap
KERNEL32.dll707VirtualProtect
KERNEL32.dll437IsBadReadPtr
KERNEL32.dll415HeapFree
KERNEL32.dll688UnmapViewOfFile
KERNEL32.dll27CloseHandle
KERNEL32.dll718WaitForSingleObject
USER32.dllActivateKeyboardLayout
USER32.dll517RemovePropA
USER32.dll478PostMessageA
USER32.dll314GetPropA
USER32.dll481PostThreadMessageA
USER32.dll132DefWindowProcA
USER32.dll594SetTimer
USER32.dll89CreateWindowExA
USER32.dll578SetPropA
USER32.dll298GetMessageA
USER32.dll399IsWindow
USER32.dll532SendMessageA
USER32.dll642TranslateMessage
USER32.dll149DispatchMessageA
USER32.dll651UnregisterClassA
USER32.dll410LoadCursorA
USER32.dll499RegisterClassExA
USER32.dll405KillTimer
ADVAPI32.dll347RegCloseKey
ADVAPI32.dll369RegOpenKeyA
ADVAPI32.dll379RegQueryValueExA
MSVCRT.dll271_initterm
MSVCRT.dll599fopen
MSVCRT.dll610fseek
MSVCRT.dll612ftell
MSVCRT.dll605fread
MSVCRT.dll588fclose
MSVCRT.dll679realloc
MSVCRT.dll693sscanf
MSVCRT.dll449_stricmp
MSVCRT.dll606free
MSVCRT.dll657malloc
MSVCRT.dll692srand
MSVCRT.dll678rand
MSVCRT.dll166_beginthreadex
MSVCRT.dll690sprintf
MSVCRT.dll157_adjust_fdiv
ordentry_vafunction_name
10x3d30CandWndProc
20x3d30CompWndProc
30x3d30StatusWndProc
40x3d30UIWndProc
50x2210ImeConfigure
60x3d20ImeConversionList
70x2300ImeDestroy
80x3d20ImeEnumRegisterWord
90x2310ImeEscape
100x3d10ImeGetRegisterWordStyle
110x21b0ImeInquire
120x3d30ImeProcessKey
130x3d00ImeRegisterWord
140x2220ImeSelect
150x22e0ImeSetActiveContext
160x22f0ImeSetCompositionString
170x22f0ImeToAsciiEx
180x3d00ImeUnregisterWord
190x2210NotifyIME
module_nameimesample.dll
flags0
timestamp2012-06-24 13:30:05
version0.0
ordinal_base1
nFunctions19
nNames19
Names(19)0x46b4
Functions(19)0x4668
NameOrdinals(19)0x4700

StringTable 080404b0

Comments
CompanyNameMicrosoft Corporation
FileDescription
FileVersion1, 0, 0, 26
InternalName
LegalCopyrightCopyright ? 2006
LegalTrademarks
OriginalFilename
PrivateBuild
ProductNameMicrosoft Corporation
ProductVersion1, 0, 0, 26
SpecialBuild

VS_FIXEDFILEINFO

FileVersion1.0.0.26
ProductVersion1.0.0.26
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType3
FileSubtype0xb
offsetsizetypecomment
032768DLL06/24/2012 13:30:05#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK