| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_NATIVE
|
| Compilation Date | 2009-Sep-24 08:21:32 |
| Detected languages |
English - United States
|
| Debug artifacts |
afd.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Ancillary Function Driver for WinSock |
| FileVersion | 10.0.26100.4202 (WinBuild.160101.0800) |
| InternalName | afd.sys |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | afd.sys |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.26100.4202 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: fothk
Unusual section name found: NONPAGE Unusual section name found: PAGE Unusual section name found: PAGEWPP Unusual section name found: PAGESAN Unusual section name found: PAGEWTDI Unusual section name found: PAGEDATA Unusual section name found: GFIDS |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Functions which can be used for anti-debugging purposes:
|
| Info | The PE is digitally signed. |
Signer: Microsoft Windows
Issuer: Microsoft Windows Production PCA 2011 |
| Safe | VirusTotal score: 0/70 (Scanned on 2025-08-12 15:54:42) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 16 |
| TimeDateStamp | 2009-Sep-24 08:21:32 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x7d000 |
| SizeOfInitializedData | 0x38000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000094010 (Section: INIT) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x1c0000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | A.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xb6000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0xc12b0 |
| Subsystem |
IMAGE_SUBSYSTEM_NATIVE
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x40000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ntoskrnl.exe |
IoSetTopLevelIrp
IoCreateFileEx ObOpenObjectByPointer ZwClose ObDereferenceSecurityDescriptor RtlCompareMemory ExEnterCriticalRegionAndAcquireResourceShared KeInitializeEvent KeWaitForSingleObject KeResetEvent PsChargeProcessPoolQuota PsReturnPoolQuota IoCreateFile IoFreeIrp KeGetCurrentProcessorNumberEx EtwWriteTransfer EtwActivityIdControl ExInitializeRundownProtection KfRaiseIrql KeReleaseInStackQueuedSpinLockFromDpcLevel KeLowerIrql KeGetCurrentIrql RtlCompareUnicodeString ExReleaseResourceLite ExAcquireResourceExclusiveLite ExAllocatePool3 RtlCopyUnicodeString ExAllocatePoolWithTagPriority MmSizeOfMdl ExRaiseStatus IoInitializeIrp MmBuildMdlForNonPagedPool IoAllocateErrorLogEntry _vsnwprintf PsGetProcessId IoWriteErrorLogEntry PsGetProcessExitTime KeEnterCriticalRegion ExWaitForRundownProtectionRelease KeLeaveCriticalRegion IoSetIoCompletion ExDeleteResourceLite RtlInitString RtlEqualString IoGetFileObjectGenericMapping RtlMapGenericMask SeLockSubjectContext SeAccessCheck SeAppendPrivileges SeFreePrivileges SeUnlockSubjectContext SeAssignSecurity ObLogSecurityDescriptor KeSetEvent IoBuildDeviceIoControlRequest IoAllocateIrp PsReferenceImpersonationToken PsDereferenceImpersonationToken PsGetCurrentProcess ExInitializeResourceLite PsReferenceSiloContext ExEventObjectType ProbeForWrite ExGetPreviousMode ExRaiseAccessViolation RtlRecordFeatureUsage RtlRegisterFeatureUsageProvider RtlArmFeatureUsageProviderFlushNotification RtlRegisterFeatureConfigurationChangeNotification RtlQueryFeatureConfigurationChangeStamp EtwSetInformation EtwRegister MmIsVerifierEnabled IoCreateDevice IoAllocateWorkItem ExInitializeNPagedLookasideList KeQueryMaximumProcessorCountEx ExDeleteNPagedLookasideList ExDeleteLookasideListEx IoFreeWorkItem IoDeleteDevice EtwUnregister RtlUnregisterFeatureUsageProvider RtlUnregisterFeatureConfigurationChangeNotification ExUnregisterCallback IoOpenDriverRegistryKey ExSubscribeWnfStateChange ZwQueryValueKey RtlLengthSid SeExports RtlCreateAcl RtlAddAccessAllowedAce ObGetObjectSecurity RtlSetDaclSecurityDescriptor RtlLengthSecurityDescriptor SeSetSecurityDescriptorInfo ObReleaseObjectSecurity ZwNotifyChangeKey IoQueueWorkItem ExQueryWnfStateData PsLookupProcessByProcessId ObCloseHandle SeCreateAccessState SeDeleteAccessState FsRtlInsertExtraCreateParameter KeReadStateEvent KeEnterGuardedRegion KeLeaveGuardedRegion KePulseEvent KeAcquireQueuedSpinLock KeReleaseQueuedSpinLock MmAdvanceMdl KeBugCheckEx ExpInterlockedFlushSList ExSystemTimeToLocalTime RtlTimeToTimeFields KeInitializeDpc KeInitializeTimer KeSetCoalescableTimer strrchr KeAcquireSpinLockAtDpcLevel KeReleaseSpinLockFromDpcLevel KeInitializeTimerEx KeFlushQueuedDpcs RtlLookupEntryHashTable RtlGetNextEntryHashTable ZwQuerySystemInformation RtlCreateHashTableEx RtlInsertEntryHashTable RtlDeleteHashTable IoCompletionObjectType ExAcquireRundownProtection IoInitializeMiniCompletionPacket ExReleaseRundownProtection IoRemoveIoCompletion IoCancelMiniCompletionPacket IoSetIoCompletionEx3 ExAcquireResourceSharedLite ZwUpdateWnfStateData PsRegisterSiloMonitor PsStartSiloMonitor PsUnregisterSiloMonitor ExRundownCompleted PsGetSiloIdentifier PsCreateSiloContext PsInsertPermanentSiloContext PsGetSiloMonitorContextSlot PsDereferenceSiloContext PsGetPermanentSiloContext PsAttachSiloToCurrentThread PsDetachSiloFromCurrentThread PsGetCurrentServerSilo KeSetTimer KeCancelTimer IoQueryFileInformation IoGetRequestorProcess KeAttachProcess FsRtlMdlRead KeDetachProcess FsRtlMdlReadComplete IoCancelIrp ExAllocateFromNPagedLookasideList ExFreeToNPagedLookasideList FsRtlCopyRead MmLockPagableDataSection IoThreadToProcess MmSystemRangeStart ObFindHandleForObject KeTestSpinLock RtlCaptureStackBackTrace RtlIntegerToUnicode RtlAppendUnicodeStringToString ObReferenceSecurityDescriptor KeDelayExecutionThread IoReuseIrp IoWMIWriteEvent IoGetDeviceAttachmentBaseRef IoFreeErrorLogEntry ZwCreateEvent KeWaitForMultipleObjects ExReleaseResourceForThreadLite ObfDereferenceObjectWithTag ObfReferenceObjectWithTag PsGetProcessImageFileName IoSizeofWorkItem IoInitializeWorkItem IoSetIoCompletionEx MmGetSystemRoutineAddress IoWMIRegistrationControl MmLockPagableSectionByHandle MmUnlockPagableImageSection WmiTraceMessageVa FsRtlFreeExtraCreateParameterList FsRtlAllocateExtraCreateParameter FsRtlAllocateExtraCreateParameterList RtlAppendUnicodeToString RtlPrefixUnicodeString RtlEqualUnicodeString FsRtlFindExtraCreateParameter IoGetTopLevelIrp ExReleaseResourceAndLeaveCriticalRegion ExRegisterCallback ExEnterCriticalRegionAndAcquireResourceExclusive ExCreateCallback RtlInitUnicodeString RtlCreateSecurityDescriptor MmIsThisAnNtAsSystem RtlGetVersion KeGetRecommendedSharedDataAlignment InitializeSListHead KeInitializeSpinLock ExpInterlockedPopEntrySList MmMapLockedPages MmMapLockedPagesSpecifyCache ExQueueWorkItem KeInsertQueueApc KeInitializeApc IoGetRelatedDeviceObject IoBuildPartialMdl IoFreeMdl MmUnlockPages ExpInterlockedPushEntrySList ExQueryDepthSList ObfReferenceObject MmProbeAndLockPages IoAllocateMdl ExRaiseDatatypeMisalignment MmUserProbeAddress IoReleaseCancelSpinLock KeAcquireInStackQueuedSpinLockAtDpcLevel IofCompleteRequest ObfDereferenceObject IofCallDriver IoAcquireCancelSpinLock KeAcquireSpinLockRaiseToDpc ExInitializeLookasideListEx ExAllocateFromLookasideListEx KeReleaseSpinLock ExFreeToLookasideListEx KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock IoFileObjectType ObReferenceObjectByHandle PsGetCurrentProcessId ExFreePoolWithTag ExAllocatePool2 IoGetCurrentProcess EtwWrite PsRevertToSelf SeImpersonateClientEx SeCaptureSubjectContextEx SeReleaseSubjectContext SeDeleteClientSecurity SeCreateClientSecurityFromSubjectContext ExReleaseSpinLockShared ExAcquireSpinLockShared DbgkWerCaptureLiveKernelDump KeQueryTimeIncrement IoIs32bitProcess RtlNotifyFeatureUsage RtlQueryFeatureConfiguration __C_specific_handler PcwUnregister PcwAddInstance SeQuerySecurityDescriptorInfo PcwRegister |
|---|---|
| NDIS.SYS |
NdisFreeRWLock
NdisAcquireRWLockWrite NdisReleaseRWLock NdisAcquireRWLockRead NdisAllocateRWLock |
| TDI.SYS |
TdiCopyMdlToBuffer
TdiCopyBufferToMdl TdiReturnChainedReceives TdiRegisterPnPHandlers TdiMatchPdoWithChainedReceiveContext TdiDeregisterPnPHandlers |
| NETIO.SYS |
NetioNrtIsTrackerDevice
NetioNrtDispatch NmrRegisterProvider NmrDeregisterProvider NetioInsertWorkQueue NetioShutdownWorkQueue NetioInitializeWorkQueue NmrProviderDetachClientComplete NmrClientAttachProvider NmrClientDetachProviderComplete NmrWaitForClientDeregisterComplete NmrDeregisterClient NmrRegisterClient GetDefaultCompartmentId NsiFreeTable NsiAllocateAndGetTable NsiRegisterChangeNotificationEx NsiDeregisterChangeNotification NsiRegisterChangeNotification NsiGetAllParameters NetioIsCompartmentAccessibleByThread NetioGetCompartmentNamespace NetioGetThreadCompartmentInfo RtlCleanupTimerWheelEntry RtlIndicateTimerWheelEntryTimerStart RtlInitializeTimerWheelEntry RtlCleanupTimerWheel RtlSuspendTimerWheel RtlInitializeTimerWheel RtlReturnTimerWheelEntry RtlGetNextExpiredTimerWheelEntry RtlUpdateCurrentTimerWheelTick RtlCopyMdlToMdl RtlCopyMdlToBuffer NetioNrtStop NetioTimerWorkItemShutdown NetioTimerWorkItemStart NetioTimerWorkItemInitialize NetioNrtStart NetioSetTriageBlock NmrWaitForProviderDeregisterComplete |
| msrpc.sys |
RpcBindingSetOption
RpcAsyncInitializeHandle RpcBindingCreateW RpcBindingBind RpcExceptionFilter RpcAsyncCompleteCall RpcAsyncCancelCall RpcBindingFree RpcBindingUnbind Ndr64AsyncClientCall |
| Microsoft Winsock BSP |
| Microsoft Winsock BSP |
| Global performance counters for Microsoft Winsock Base Service Provider |
| Dropped Datagrams/sec |
| Dropped Datagrams/sec |
| Dropped Datagrams/sec due to receive buffer limit on any datagram socket |
| Dropped Datagrams |
| Dropped Datagrams |
| Dropped Datagrams due to receive buffer limit on any datagram socket |
| Rejected Connections/sec |
| Rejected Connections/sec |
| Rejected Connections/sec due to backlog limit on any TCP listening socket |
| Rejected Connections |
| Rejected Connections |
| Rejected Connections due to backlog limit on any TCP listening socket |
| Ancillary Function Driver for Winsock |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 10.0.26100.4202 |
| ProductVersion | 10.0.26100.4202 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_DRV
|
| FileSubtype | VFT2_DRV_SYSTEM |
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Ancillary Function Driver for WinSock |
| FileVersion (#2) | 10.0.26100.4202 (WinBuild.160101.0800) |
| InternalName | afd.sys |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | afd.sys |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion (#2) | 10.0.26100.4202 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2009-Sep-24 08:21:32 |
| Version | 0.0 |
| SizeofData | 32 |
| AddressOfRawData | 0x5e0ec |
| PointerToRawData | 0x5e0ec |
| Referenced File | afd.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2009-Sep-24 08:21:32 |
| Version | 0.0 |
| SizeofData | 976 |
| AddressOfRawData | 0x5e10c |
| PointerToRawData | 0x5e10c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2009-Sep-24 08:21:32 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x5e55c |
| PointerToRawData | 0x5e55c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2009-Sep-24 08:21:32 |
| Version | 0.0 |
| SizeofData | 4 |
| AddressOfRawData | 0x5e580 |
| PointerToRawData | 0x5e580 |
| Size | 0x148 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1c0065240 |
| GuardCFCheckFunctionPointer | 7516633712 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0xc8d2ad28 |
|---|---|
| Unmarked objects | 0 |
| Total imports | 337 |
| Imports (33140) | 11 |
| Unmarked objects (#2) | 2 |
| C objects (33140) | 14 |
| ASM objects (33140) | 10 |
| C objects (LTCG) (33140) | 65 |
| Resource objects (33140) | 1 |
| Linker (33140) | 1 |
No comments yet.