Static | ZeroBOX

PE Compile Time

2008-04-14 03:37:09

PDB Path

rundll32.pdb

PE Imphash

d8fc1a3614d526e7111f36ddb837bb41

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000126a 0x00001400 5.97801041002
.data 0x00003000 0x00000038 0x00000200 0.250799341457
.rsrc 0x00004000 0x00006484 0x00006600 5.68786335776

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00009a28 0x00000468 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00009a28 0x00000468 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00009a28 0x00000468 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00009a28 0x00000468 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00009a28 0x00000468 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00009a28 0x00000468 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00009a28 0x00000468 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00009a28 0x00000468 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_STRING 0x0000a024 0x00000058 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x0000a024 0x00000058 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x0000a024 0x00000058 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x0000a024 0x00000058 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_GROUP_ICON 0x0000a07c 0x00000076 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_VERSION 0x0000a0f4 0x00000390 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data

Imports

Library msvcrt.dll:
0x10010b8 _except_handler3
0x10010bc _wtoi
0x10010c0 _vsnwprintf
Library KERNEL32.dll:
0x1001010 FreeLibrary
0x1001014 LocalFree
0x1001018 lstrlenA
0x100101c WideCharToMultiByte
0x1001020 LocalAlloc
0x1001024 lstrlenW
0x1001028 GetProcAddress
0x100102c FormatMessageW
0x1001030 GetLastError
0x1001034 LoadLibraryW
0x1001038 ActivateActCtx
0x100103c CreateActCtxW
0x1001040 SearchPathW
0x1001044 GetFileAttributesW
0x1001048 ReleaseActCtx
0x100104c DeactivateActCtx
0x1001050 SetErrorMode
0x1001054 ExitProcess
0x1001058 GetModuleHandleW
0x100105c GetStartupInfoW
0x1001060 GetCommandLineW
0x1001068 GetTickCount
0x100106c GetCurrentThreadId
0x1001070 GetCurrentProcessId
0x1001078 TerminateProcess
0x100107c GetCurrentProcess
Library GDI32.dll:
0x1001000 GetStockObject
Library USER32.dll:
0x100108c RegisterClassW
0x1001090 LoadStringW
0x1001094 CharNextW
0x1001098 SetClassLongW
0x100109c LoadIconW
0x10010a0 DefWindowProcW
0x10010a4 CreateWindowExW
0x10010a8 MessageBoxW
0x10010ac LoadCursorW
0x10010b0 DestroyWindow
Library IMAGEHLP.dll:

!This program cannot be run in DOS mode.
`.data
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
GDI32.dll
USER32.dll
IMAGEHLP.dll
rundll32.pdb
HtHt/
-VSVVVV
[j _f9>u
t?9xLt:
f98t(P
GVVVVW
_vsnwprintf
_except_handler3
msvcrt.dll
FreeLibrary
LocalFree
lstrlenA
WideCharToMultiByte
LocalAlloc
lstrlenW
GetProcAddress
FormatMessageW
GetLastError
LoadLibraryW
ActivateActCtx
CreateActCtxW
SearchPathW
GetFileAttributesW
ReleaseActCtx
DeactivateActCtx
SetErrorMode
ExitProcess
GetModuleHandleW
GetStartupInfoW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
KERNEL32.dll
GetStockObject
GDI32.dll
CharNextW
SetClassLongW
LoadIconW
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadCursorW
DestroyWindow
MessageBoxW
LoadStringW
USER32.dll
ImageDirectoryEntryToData
IMAGEHLP.dll
wwwwwwwwwq
nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXnnnnnnnnnnnnkkaaaaagddddddddddddddddddddddddiiiXnnnnnnnnnnnnlTUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU!iXnnnnnnnnnnnnl
////////
44((((((( 2222UdXnnnnnnnnnnnnl
:////////
44((((((((( 22UdXnnnnnnnnnnnnj
/////////
44((((((( 22UdXnnnnnnnnnnnnj
:///////
44(((((((( UdXnnnnnnnnnnnnj
:////////
44(((((((( UgXnnnnnnnnnnnnj
////////
444((((((( VaXnnnnnnnnnnnnQ
/////////
44(((((((VaXnnnnnnnnnnnnQ
////////
4((((((VaXnnnnnnnnnnnnh
////////
4(((((VaXnnnnnnnnnnnnh
:////////
44(((WaXnnnnnnnnnnnnP
......
////////
44((WfXnnnnnnnnnnnnP
......
:////////
44WfXnnnnnnnnnnnnF
......
:////////
4W_XnnnnnnnnnnnnF
......
:////////
[_XnnnnnnnnnnnnO
......
/////////
[_XnnnnnnnnnnnnO
......
:////////
[bXnnnnnnnnnnnnE
........
////////
[]XnnnnnnnnnnnnE
......
////////[]XnnnnnnnnnnnnC
.......
://////[]XnnnnnnnnnnnnC
.......
://///[]Xnnnnnnnnnnnn<
......
:////^]Xnnnnnnnnnnnn<
///^]Xnnnnnnnnnnnn;
......
:/^\Xnnnnnnnnnnnn;
.......
^\Xnnnnnnnnnnnn8
......
`\Xnnnnnnnnnnnn8
......
`JXnnnnnnnnnnnn?
......
`JXnnnnnnnnnnnn?
......
`JXnnnnnnnnnnnn7
......
`ZXnnnnnnnnnnnn7RS
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
W[[^^`eYXnnnnnnnnnnnn,
HHIIIIYcjXnnnnnnnnnnnn+
-Xnnnnnnnnnnnnn+
&Xnnnnnnnnnnnnnn1
%Xnnnnnnnnnnnnnnn1
$Xnnnnnnnnnnnnnnnn"
#Xnnnnnnnnnnnnnnnnn"
'Xnnnnnnnnnnnnnnnnnn!
Xnnnnnnnnnnnnnnnnnnn!(( )))***6600555===>>>GGBInnnnnnnnnnnnnn
Pjnqw~
Gehiqr|
G]ceiqty~
?X\cgiltw}
?MSX]chmqty}
:HNRT\cfiovy}
:BHJQW\cghlouy
0@CDIMWY]agiqry~
+9=ADJLQW\cgilrw{
"46=@CFKRSX_cjknxy
",169>CDJNRX]cekprx}
)*.57;ABHNQR\`eilrx
#&,-489@BIJOWY]chkn
!&*-169=ADLNUT[chj
#',/26;ABHLQW\_e
!&)/46;@BCKQWZ]
%)-169>@CHMRX
#'*-47;>E
#&(-36;
!#(*14
"+0:?GP^d
D?;72-)#!
JF@<83.(%"
RLIB>:5/*&
WSNIC?;61-
_[TPJF@<74
d`\VPLGA=9$
lfb]XSMHB>'
rmic^YUOJD,
xsojeaZVPK0
zvpkga[WQ+
|wqmhEE
iK2%)U+
I/"bH4''99
Q7+<Y@3
T8,@X;1
Q:+BUB/
Q8,RZB1`@@
N. HY7!
O3$dS7"%U9
N*NHr,g
"N1Yag
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
RunDLL
RUNDLL
.manifest
Windows
Windows
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
Microsoft Corporation
FileDescription
Run a DLL as an App
FileVersion
5.1.2600.5512 (xpsp.080413-2105)
InternalName
rundll
LegalCopyright
(C) Microsoft Corporation. All rights reserved.
OriginalFilename
RUNDLL.EXE
ProductName
Microsoft(R) Windows(R) Operating System
ProductVersion
5.1.2600.5512
VarFileInfo
Translation
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic Clean
MicroWorld-eScan Clean
FireEye Clean
CAT-QuickHeal Clean
ALYac Clean
Cylance Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
Cybereason Clean
Arcabit Clean
BitDefenderTheta Clean
VirIT Clean
Cyren Clean
tehtris Clean
ESET-NOD32 Clean
Baidu Clean
TrendMicro-HouseCall Clean
Paloalto Clean
ClamAV Clean
Kaspersky Clean
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Ad-Aware Clean
Sophos Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Clean
Trapmine Clean
CMC Clean
Emsisoft Clean
APEX Clean
Jiangmin Clean
Webroot Clean
Avira Clean
MAX Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Microsoft Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Clean
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
TACHYON Clean
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
Tencent Clean
Yandex Clean
SentinelOne Clean
MaxSecure Clean
Fortinet Clean
Avast Clean
CrowdStrike Clean
No IRMA results available.