| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2092-Jul-24 05:50:18 |
| Debug artifacts |
D:\renga-workspace\plugins-dotnet\ApsAddressing\obj\Debug\ApsAddressing.pdb
|
| CompanyName | ApsAddressing |
| FileDescription | ApsAddressing |
| FileVersion | 1.0.0.0 |
| InternalName | ApsAddressing.dll |
| LegalCopyright | |
| OriginalFilename | ApsAddressing.dll |
| ProductName | ApsAddressing |
| ProductVersion | 1.0.0 |
| Assembly Version | 1.0.0.0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is possibly packed. | The PE only has 0 import(s). |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| MD5 | ae44f386d882ff8387940cd937c71e56 🔍 |
|---|---|
| SHA1 | e465733db62ed11e2f541cfeba5c0d4f073aebc9 🔍 |
| SHA256 | a5c11d9c384577857c94308304d00c274a21e9f4226c921a0d6abfd1ec4d4fc1 🔍 |
| SHA3 | ede60be4ab1b94b6f1ffbe52c0e187e3a403ac4cd861f779340e631b555db792 🔍 |
| SSDeep | 6144:rzhlifqv/T9A8xOWx3MmvhZkPMuX2VNqg:3iiTp3vcMFNqg 🔍 |
| Imports Hash | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 2 |
| TimeDateStamp | 2092-Jul-24 05:50:18 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x47600 |
| SizeOfInitializedData | 0x400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000000000 (Section: ?) |
| BaseOfCode | 0x2000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x4c000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x400000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x2000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 43ec7f2f26fd1b5074a68b1e3b6da252 🔍 |
|---|---|
| SHA1 | e340f0bd267a6255dad48181edfbab19bcf27eb1 🔍 |
| SHA256 | e1b719ee705260395860aabb4e0288094ef85a01cb31f961a18074a9dfdb1bbd 🔍 |
| SHA3 | 6d10570bda6325d2886b9787e2b0c375bd5e8cc77220d56641dfaa624231bf8c 🔍 |
| VirtualSize | 0x47513 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0x47600 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.2699 |
| MD5 | c28513e1e39e36eddfcdf90a727cd9fb 🔍 |
|---|---|
| SHA1 | 3a7ad978889bf1a7a8ea61988788a26cce1b0f76 🔍 |
| SHA256 | da801e7205f1e434eacac12930b7816b222b74a2dee6c1e61726ecce408493b4 🔍 |
| SHA3 | 214fc5348761762fbb1455adf3a3dd378e8b79a434f7e67817627e35bf7b1cd2 🔍 |
| VirtualSize | 0x344 |
| VirtualAddress | 0x4a000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x47800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.65487 |
| Type |
RT_VERSION
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x2e8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.23859 |
| MD5 | 0fe8cfd8c746f90e7c8b91cbc319da1a 🔍 |
| SHA1 | 2e94241fc57196b2d4fc17fdd377dfbe4d33848f 🔍 |
| SHA256 | 3eec486ec66d7eb4d0a917ff458f64f1c3b76dd95d13bfe2c66a3ab74deca957 🔍 |
| SHA3 | 35ee1b181c6f00f4e57dd06cf5c0de36077deee65f853c036dca064be23462b4 🔍 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | UNKNOWN |
| CompanyName | ApsAddressing |
| FileDescription | ApsAddressing |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | ApsAddressing.dll |
| LegalCopyright | |
| OriginalFilename | ApsAddressing.dll |
| ProductName | ApsAddressing |
| ProductVersion (#2) | 1.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2069-Apr-16 20:59:53 |
| Version | 256.20557 |
| SizeofData | 100 |
| AddressOfRawData | 0x49488 |
| PointerToRawData | 0x47688 |
| Referenced File | D:\renga-workspace\plugins-dotnet\ApsAddressing\obj\Debug\ApsAddressing.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 1.0 |
| SizeofData | 39 |
| AddressOfRawData | 0x494ec |
| PointerToRawData | 0x476ec |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
No comments yet.