Static | ZeroBOX

PE Compile Time

2021-06-25 20:30:16

PDB Path

D:\原\xiang_dll32\Release\read_dll32.pdb

PE Imphash

351cd07c6db65a3abee61a8a9cd0bb60

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000abc8 0x0000ac00 6.57790601692
.rdata 0x0000c000 0x00005d84 0x00005e00 4.87509192494
.data 0x00012000 0x000013a4 0x00000a00 1.83498513307
.rsrc 0x00014000 0x00000300 0x00000400 3.62981868038
.reloc 0x00015000 0x00000e40 0x00001000 6.19769372854

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000140a0 0x000000dc LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_MANIFEST 0x00014180 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x1000c034 GetTickCount
0x1000c038 GetProcAddress
0x1000c03c CloseHandle
0x1000c040 GetSystemDirectoryA
0x1000c044 CreateFileA
0x1000c048 GetLastError
0x1000c050 CopyFileA
0x1000c054 MultiByteToWideChar
0x1000c058 GetModuleHandleA
0x1000c05c GetCurrentThreadId
0x1000c060 DeviceIoControl
0x1000c064 WriteConsoleW
0x1000c074 GetCurrentProcess
0x1000c078 TerminateProcess
0x1000c084 GetCurrentProcessId
0x1000c08c InitializeSListHead
0x1000c090 IsDebuggerPresent
0x1000c094 GetStartupInfoW
0x1000c098 GetModuleHandleW
0x1000c09c InterlockedFlushSList
0x1000c0a0 RtlUnwind
0x1000c0a4 SetLastError
0x1000c0a8 EnterCriticalSection
0x1000c0ac LeaveCriticalSection
0x1000c0b0 DeleteCriticalSection
0x1000c0b8 TlsAlloc
0x1000c0bc TlsGetValue
0x1000c0c0 TlsSetValue
0x1000c0c4 TlsFree
0x1000c0c8 FreeLibrary
0x1000c0cc LoadLibraryExW
0x1000c0d0 RaiseException
0x1000c0d4 ExitProcess
0x1000c0d8 GetModuleHandleExW
0x1000c0dc GetModuleFileNameW
0x1000c0e0 HeapAlloc
0x1000c0e4 HeapFree
0x1000c0e8 FindClose
0x1000c0ec FindFirstFileExW
0x1000c0f0 FindNextFileW
0x1000c0f4 IsValidCodePage
0x1000c0f8 GetACP
0x1000c0fc GetOEMCP
0x1000c100 GetCPInfo
0x1000c104 GetCommandLineA
0x1000c108 GetCommandLineW
0x1000c10c WideCharToMultiByte
0x1000c110 GetEnvironmentStringsW
0x1000c118 LCMapStringW
0x1000c11c GetProcessHeap
0x1000c120 GetStdHandle
0x1000c124 GetFileType
0x1000c128 GetStringTypeW
0x1000c12c HeapSize
0x1000c130 HeapReAlloc
0x1000c134 SetStdHandle
0x1000c138 FlushFileBuffers
0x1000c13c WriteFile
0x1000c140 GetConsoleCP
0x1000c144 GetConsoleMode
0x1000c148 SetFilePointerEx
0x1000c14c CreateFileW
0x1000c150 DecodePointer
Library ADVAPI32.dll:
0x1000c000 RegCreateKeyA
0x1000c004 CreateServiceA
0x1000c008 RegCloseKey
0x1000c00c CloseServiceHandle
0x1000c010 RegQueryValueExA
0x1000c014 OpenSCManagerA
0x1000c018 DeleteService
0x1000c01c ControlService
0x1000c020 StartServiceA
0x1000c024 RegSetValueExA
0x1000c028 RegOpenKeyExA
0x1000c02c OpenServiceA

Exports

Ordinal Address Name
1 0x10001830 GetDev
2 0x100012f0 GetProcessModuleBase
3 0x10001a50 IDeleteFile
4 0x10001170 IVirtualAllocate
5 0x10001010 Read64ProcessMemory
6 0x10001450 StarDevice
7 0x100013a0 StopDevice
8 0x100010c0 Write64ProcessMemory
9 0x10001240 dVirtualProtect
!This program cannot be run in DOS mode.
Rich}z
`.rdata
@.data
@.reloc
D$$Pj
D$$Pj
D$<Pj
u?PPPPP
URPQQh0,
UQPXY]Y[
zSSSSj
f9:t!V
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
QQSVj8j@
xg;5(2
xE;5(2
xE;5(2
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CorExitProcess
AreFileApisANSI
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
ZwProtectVirtualMemory
ntdll.dll
SYSTEM\CurrentControlSet\services\AFD
\xiang_dll32\Release\read_dll32.pdb
.text$mn
.idata$5
.00cfg
.CRT$XCA
.CRT$XCZ
.CRT$XIA
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.edata
.idata$2
.idata$3
.idata$4
.idata$6
.rsrc$01
.rsrc$02
read_dll32.dll
GetDev
GetProcessModuleBase
IDeleteFile
IVirtualAllocate
Read64ProcessMemory
StarDevice
StopDevice
Write64ProcessMemory
dVirtualProtect
Wow64DisableWow64FsRedirection
DeviceIoControl
GetCurrentThreadId
GetModuleHandleA
MultiByteToWideChar
CopyFileA
Wow64RevertWow64FsRedirection
GetLastError
CreateFileA
GetSystemDirectoryA
CloseHandle
GetProcAddress
GetTickCount
KERNEL32.dll
OpenServiceA
RegOpenKeyExA
RegSetValueExA
StartServiceA
ControlService
DeleteService
OpenSCManagerA
RegQueryValueExA
CloseServiceHandle
RegCloseKey
CreateServiceA
RegCreateKeyA
ADVAPI32.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
4(4/464Z4q4
5!5[5f5l5|5
646Q6u6{6
7 7,7_7u7|7
718J8V8
9-949E9k9
:":+:Z:
;(;1;<;C;V;d;j;p;v;|;
<</<8<
=#=e=m=
=P>b>!?^?x?
/080?0E0K0W0]0
1"212H2N2T2Z2`2f2l2
2'343X3k374W4a4z4
4.585A5
546>6G6P6e6n6
878?8Q8^8
=2=G=a=
>$>2>M>^>j>
>D?W?u?
11h1o1t1x1|1
2 2$2(2,2
5)5Q5l5q5v5
6"6'6E6O6[6`6e6
8+:A:]:
;#;(;4;9;M;
<#<5<><
=O=]=f=
0F0M0x1
4"4-434>4D4R4`4s4
:$:L:f:~:
;5;S;z;
;&<;<M<Z<s<
>=>N>Y>
>)?<?J?c?
;*;u;|;
4I5N5S5c5h5m5}5
6>6j6s6
727F7K7P7k7u7
8+8:8E8J8O8p8
9(9O9a9m9z9
<+<I<a<|<
<E=L=S=Z=g=
3+3@3W3z3
5'6@6E6N6
6/7|7T8
5:6I6W6t6|6
9*:h:};
;/<P<[<i<
<%=D=V=`=
>6>]>~>
>?F?e?
!0Q0k0
3?3`3g3~3
3G4[4S6e6w6
7+7L7^7p7
7,9l9v9
='=4=d=
>@?F?K?R?b?p?
1L1V1q1
2!2)21292W2_2
:,:=:E:U:f:
:!;0;<;K;^;};
<'<R<t<
1M2h2~2
:+:?:E:V;
X1h1l1p1|1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(5P;T;X;0=8=@=D=H=L=P=T=X=\=d=h=l=p=t=x=|=
? ?$?X?\?`?d?h?l?p?t?x?|?
p4t4x4|4
5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
54?<?D?L?T?\?d?l?t?|?
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6
X0`0h0p0x0
1 1(10181@1H1P1X1`1h1p1x1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7
j1n1r1v1|:
;$;,;4;<;D;L;T;\;L=P=X=
14181T1X1t1x1
282X2x2
383X3x3
484X4x4
7(7,7074787<7@7D7
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
mscoree.dll
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
VS_VERSION_INFO
StringFileInfo
080404b0
VarFileInfo
Translation
Antivirus Signature
Bkav Clean
Elastic Clean
MicroWorld-eScan Clean
FireEye Clean
CAT-QuickHeal Clean
McAfee GenericRXOL-ND!FCE211EB3413
Cylance Clean
VIPRE Clean
Sangfor Clean
CrowdStrike Clean
BitDefender Clean
K7GW Clean
K7AntiVirus Clean
BitDefenderTheta Gen:NN.ZedlaF.34758.eu4@aqLytBmj
Cyren Clean
Symantec Clean
ESET-NOD32 Clean
Baidu Clean
APEX Clean
Avast Clean
ClamAV Clean
Kaspersky Clean
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
AegisLab Clean
Rising Clean
Ad-Aware Clean
Sophos Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Mal_Cerber-20
McAfee-GW-Edition GenericRXOL-ND!FCE211EB3413
CMC Clean
Emsisoft Clean
Ikarus Clean
GData Clean
Jiangmin Clean
Webroot Clean
Avira Clean
MAX Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Clean
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Cerber.C4441750
Acronis Clean
VBA32 Clean
ALYac Clean
TACHYON Clean
Malwarebytes Malware.AI.3848397862
Panda Clean
Zoner Clean
TrendMicro-HouseCall Mal_Cerber-20
Tencent Clean
Yandex Clean
SentinelOne Clean
eGambit Clean
Fortinet Clean
Qihoo-360 Clean
Paloalto Clean
MaxSecure Clean
No IRMA results available.