| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jul-06 10:50:12 |
| Detected languages |
English - United States
|
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-Jul-06 10:50:12 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x26000 |
| SizeOfInitializedData | 0x14a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00009F16 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x27000 |
| ImageBase | 0x10000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3e000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetModuleFileNameA
FindFirstFileA FindNextFileA FindClose GetModuleHandleA Sleep DisableThreadLibraryCalls LoadLibraryA DeleteFileA CloseHandle CreateThread SetFileAttributesA GetProcAddress GetTickCount GetComputerNameA ReadConsoleW ReadFile WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CreateFileW SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize SetEndOfFile WriteConsoleW |
|---|
| Ordinal | 1 |
|---|---|
| Address | 0x36e59 |
| ForwardName | C:/Windows/SysWOW64/dinput8.dll.DirectInput8Create |
| Ordinal | 2 |
|---|---|
| Address | 0x36e9c |
| ForwardName | C:/Windows/SysWOW64/dinput8.dll.DllCanUnloadNow |
| Ordinal | 3 |
|---|---|
| Address | 0x36ede |
| ForwardName | C:/Windows/SysWOW64/dinput8.dll.DllGetClassObject |
| Ordinal | 4 |
|---|---|
| Address | 0x36f22 |
| ForwardName | C:/Windows/SysWOW64/dinput8.dll.DllRegisterServer |
| Ordinal | 5 |
|---|---|
| Address | 0x36f68 |
| ForwardName | C:/Windows/SysWOW64/dinput8.dll.DllUnregisterServer |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-06 10:50:12 |
| Version | 0.0 |
| SizeofData | 940 |
| AddressOfRawData | 0x359c8 |
| PointerToRawData | 0x34dc8 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-06 10:50:12 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x10035d84 |
|---|---|
| EndAddressOfRawData | 0x10035d8c |
| AddressOfIndex | 0x100394bc |
| AddressOfCallbacks | 0x100271cc |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0xc0 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x10038040 |
| SEHandlerTable | 0x100356b8 |
| SEHandlerCount | 43 |
| XOR Key | 0x50602d6a |
|---|---|
| Unmarked objects | 0 |
| ASM objects (35215) | 12 |
| C++ objects (35215) | 165 |
| C objects (35215) | 22 |
| ASM objects (35207) | 20 |
| C objects (35207) | 15 |
| C++ objects (35207) | 72 |
| Imports (35215) | 5 |
| Total imports | 114 |
| C++ objects (LTCG) (35219) | 1 |
| Exports (35219) | 1 |
| Resource objects (35219) | 1 |
| Linker (35219) | 1 |
No comments yet.