Architecture |
IMAGE_FILE_MACHINE_AMD64
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
Compilation Date | 2058-Oct-06 08:39:55 |
Detected languages |
English - United States
|
Debug artifacts |
bootsect.pdb
|
CompanyName | Microsoft Corporation |
FileDescription | Boot Sector Manipulation Tool |
FileVersion | 10.0.19041.1 (WinBuild.160101.0800) |
InternalName | bootsect.exe |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | bootsect.exe |
ProductName | Microsoft® Windows® Operating System |
ProductVersion | 10.0.19041.1 |
Info | Cryptographic algorithms detected in the binary: | Uses constants related to SHA1 |
Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
Info | The PE is digitally signed. |
Signer: Microsoft Windows
Issuer: Microsoft Windows Production PCA 2011 |
Safe | VirusTotal score: 0/74 (Scanned on 2024-07-19 22:45:18) | All the AVs think this file is safe. |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0xe0 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_AMD64
|
NumberofSections | 6 |
TimeDateStamp | 2058-Oct-06 08:39:55 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xf0 |
Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Magic | PE32+ |
---|---|
LinkerVersion | 14.0 |
SizeOfCode | 0x7400 |
SizeOfInitializedData | 0x12e00 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x0000000000007D10 (Section: .text) |
BaseOfCode | 0x1000 |
ImageBase | 0x140000000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | A.0 |
ImageVersion | A.0 |
SubsystemVersion | 6.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x1e000 |
SizeOfHeaders | 0x400 |
Checksum | 0x1c674 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x80000 |
SizeofStackCommit | 0x2000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
ADVAPI32.dll |
EventUnregister
EventRegister EventWriteTransfer RegOpenKeyExW RegCloseKey RegQueryValueExW |
---|---|
KERNEL32.dll |
GetModuleHandleExW
SetFilePointer GetLastError GetProcAddress FreeLibrary GetConsoleOutputCP GetStdHandle GetModuleFileNameW LocalAlloc GetConsoleMode FormatMessageW QueryDosDeviceW LocalFree WideCharToMultiByte GetFileType TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter Sleep ReadFile WriteFile WriteConsoleW SetLastError GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW CreateFileW GetVersionExW SearchPathW UnmapViewOfFile CloseHandle FindResourceExW LoadResource CreateFileMappingW MapViewOfFile LoadLibraryExW |
msvcrt.dll |
_snwscanf_s
bsearch wcsncmp wcsstr wcsnlen memcpy ?terminate@@YAXXZ _fmode __C_specific_handler _initterm memset __setusermatherr _cexit _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter iswxdigit _vsnwprintf _wcsnicmp _stricmp swprintf_s isalpha wcscpy_s _wcsicmp _wcslwr _commode |
ntdll.dll |
RtlVirtualUnwind
RtlLookupFunctionEntry NtWaitForSingleObject RtlFreeHeap NtQueryDirectoryObject NtCreateEvent NtOpenDirectoryObject NtDeviceIoControlFile NtQuerySymbolicLinkObject RtlAllocateHeap NtOpenSymbolicLinkObject NtResetEvent NtOpenFile NtQueryVolumeInformationFile RtlNtStatusToDosError NtFsControlFile NtClose RtlInitUnicodeString NtQuerySystemInformation RtlCaptureContext NtQueryValueKey NtQueryBootEntryOrder NtQueryBootOptions NtTranslateFilePath NtEnumerateBootEntries NtAdjustPrivilegesToken NtOpenProcessTokenEx NtSetInformationThread NtOpenThreadTokenEx RtlImpersonateSelf NtOpenKey |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 10.0.19041.1 |
ProductVersion | 10.0.19041.1 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | English - United States |
CompanyName | Microsoft Corporation |
FileDescription | Boot Sector Manipulation Tool |
FileVersion (#2) | 10.0.19041.1 (WinBuild.160101.0800) |
InternalName | bootsect.exe |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | bootsect.exe |
ProductName | Microsoft® Windows® Operating System |
ProductVersion (#2) | 10.0.19041.1 |
Resource LangID | English - United States |
---|
Characteristics |
0
|
---|---|
TimeDateStamp | 2058-Oct-06 08:39:55 |
Version | 0.0 |
SizeofData | 37 |
AddressOfRawData | 0xe748 |
PointerToRawData | 0xcf48 |
Referenced File | bootsect.pdb |
Characteristics |
0
|
---|---|
TimeDateStamp | 2058-Oct-06 08:39:55 |
Version | 0.0 |
SizeofData | 628 |
AddressOfRawData | 0xe770 |
PointerToRawData | 0xcf70 |
Characteristics |
0
|
---|---|
TimeDateStamp | 2058-Oct-06 08:39:55 |
Version | 0.0 |
SizeofData | 36 |
AddressOfRawData | 0xe9e4 |
PointerToRawData | 0xd1e4 |
Size | 0x118 |
---|---|
TimeDateStamp | 1970-Jan-01 00:00:00 |
Version | 0.0 |
GlobalFlagsClear | (EMPTY) |
GlobalFlagsSet | (EMPTY) |
CriticalSectionDefaultTimeout | 0 |
DeCommitFreeBlockThreshold | 0 |
DeCommitTotalFreeThreshold | 0 |
LockPrefixTable | 0 |
MaximumAllocationSize | 0 |
VirtualMemoryThreshold | 0 |
ProcessAffinityMask | 0 |
ProcessHeapFlags | (EMPTY) |
CSDVersion | 0 |
Reserved1 | 0 |
EditList | 0 |
SecurityCookie | 0x140010098 |
GuardCFCheckFunctionPointer | 5368758512 |
GuardCFDispatchFunctionPointer | 0 |
GuardCFFunctionTable | 0 |
GuardCFFunctionCount | 0 |
GuardFlags | (EMPTY) |
CodeIntegrity.Flags | 0 |
CodeIntegrity.Catalog | 0 |
CodeIntegrity.CatalogOffset | 0 |
CodeIntegrity.Reserved | 0 |
GuardAddressTakenIatEntryTable | 0 |
GuardAddressTakenIatEntryCount | 0 |
GuardLongJumpTargetTable | 0 |
GuardLongJumpTargetCount | 0 |
XOR Key | 0x84eb2f04 |
---|---|
Unmarked objects | 0 |
C++ objects (27412) | 1 |
ASM objects (27412) | 2 |
C objects (27412) | 18 |
Imports (27412) | 9 |
Total imports | 128 |
C objects (LTCG) (27412) | 11 |
Resource objects (27412) | 1 |
Linker (27412) | 1 |