| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2067-Feb-26 11:36:31 |
| Detected languages |
English - United States
|
| Debug artifacts |
smartscreen.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Windows Defender SmartScreen |
| FileVersion | 10.0.19041.6456 (WinBuild.160101.0800) |
| InternalName | smartscreen.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | smartscreen.exe |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.19041.6456 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses known Mersenne Twister constants Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/71 (Scanned on 2026-04-08 17:26:05) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2067-Feb-26 11:36:31 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x133c00 |
| SizeOfInitializedData | 0x113000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000001177C0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | A.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x24b000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x253fa7 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x80000 |
| SizeofStackCommit | 0x2000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| api-ms-win-crt-runtime-l1-1-0.dll |
_get_initial_wide_environment
_initterm _initterm_e exit _exit __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_wide_argv _initialize_onexit_table _register_onexit_function _crt_atexit abort _initialize_wide_environment _beginthreadex terminate _invalid_parameter_noinfo_noreturn _set_app_type _errno _seh_filter_exe _invalid_parameter_noinfo |
|---|---|
| api-ms-win-crt-stdio-l1-1-0.dll |
__stdio_common_vsnprintf_s
__stdio_common_vswprintf fputc fwrite fseek _wfsopen _set_fmode __p__commode __stdio_common_vsnwprintf_s __stdio_common_vsprintf_s __stdio_common_vswprintf_s fgetc ungetc fclose _get_stream_buffer_pointers fflush setvbuf fsetpos _fseeki64 fgetpos fread |
| api-ms-win-crt-string-l1-1-0.dll |
towlower
strnlen wcsnlen strcpy_s strcspn isxdigit iswspace _stricmp iswupper iswlower _wcsdup _wcsicmp iswascii tolower iswxdigit iswdigit toupper wcscmp isupper islower __strncnt |
| api-ms-win-crt-heap-l1-1-0.dll |
_malloc_base
_callnewh _calloc_base _set_new_mode _free_base free malloc realloc calloc |
| ntdll.dll |
NtQuerySection
RtlGetVersion NtCreateSection RtlIpv6AddressToStringExW RtlIpv4StringToAddressExW RtlIpv4AddressToStringExW RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RtlGetDeviceFamilyInfoEnum RtlFreeHeap RtlIpv6StringToAddressExW |
| api-ms-win-core-fibers-l2-1-0.dll |
DeleteFiber
ConvertThreadToFiber ConvertFiberToThread SwitchToFiber |
| api-ms-win-core-libraryloader-l1-2-0.dll |
GetModuleFileNameW
LoadLibraryExW GetModuleHandleW FreeLibrary LoadStringW GetModuleFileNameA GetProcAddress SizeofResource LockResource LoadResource GetModuleHandleA GetModuleHandleExW |
| api-ms-win-core-synch-l1-1-0.dll |
AcquireSRWLockExclusive
ReleaseSRWLockExclusive ResetEvent InitializeCriticalSectionAndSpinCount ReleaseSRWLockShared WaitForSingleObjectEx AcquireSRWLockShared OpenSemaphoreW CreateMutexExW SetEvent ReleaseMutex InitializeSRWLock TryAcquireSRWLockExclusive WaitForSingleObject CreateSemaphoreExW CreateEventExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSemaphore CreateMutexW |
| api-ms-win-core-heap-l1-1-0.dll |
GetProcessHeap
HeapFree HeapAlloc |
| api-ms-win-core-errorhandling-l1-1-0.dll |
RaiseException
SetLastError GetLastError |
| api-ms-win-core-processthreads-l1-1-0.dll |
GetExitCodeThread
GetProcessId GetCurrentThreadId OpenProcessToken GetCurrentThread OpenThreadToken GetCurrentProcess GetCurrentProcessId GetProcessTimes |
| api-ms-win-core-localization-l1-2-0.dll |
IdnToAscii
SetThreadPreferredUILanguages GetSystemPreferredUILanguages GetUserPreferredUILanguages LCMapStringEx FormatMessageW GetLocaleInfoEx GetThreadPreferredUILanguages |
| api-ms-win-core-debug-l1-1-0.dll |
DebugBreak
IsDebuggerPresent OutputDebugStringW |
| api-ms-win-core-handle-l1-1-0.dll |
DuplicateHandle
CloseHandle |
| api-ms-win-core-fibers-l1-1-0.dll |
FlsAlloc
FlsGetValue FlsFree FlsSetValue |
| api-ms-win-eventing-provider-l1-1-0.dll |
EventWriteTransfer
EventRegister EventSetInformation EventUnregister EventProviderEnabled |
| api-ms-win-core-winrt-string-l1-1-0.dll |
WindowsStringHasEmbeddedNull
WindowsCreateString WindowsDeleteString WindowsIsStringEmpty WindowsDuplicateString WindowsCreateStringReference WindowsGetStringRawBuffer |
| api-ms-win-core-com-l1-1-0.dll |
CoReleaseMarshalData
CoCreateInstance StringFromGUID2 CoWaitForMultipleObjects CoCreateFreeThreadedMarshaler CreateStreamOnHGlobal CoDecrementMTAUsage CoMarshalInterface CoTaskMemAlloc CoResumeClassObjects CoRegisterClassObject PropVariantClear CoRevokeClassObject CoAddRefServerProcess CoReleaseServerProcess CoCreateGuid CoTaskMemRealloc CoInitializeSecurity CoIncrementMTAUsage CoImpersonateClient CoTaskMemFree CoGetCallContext CoRevertToSelf |
| api-ms-win-core-synch-l1-2-0.dll |
InitializeConditionVariable
SleepConditionVariableCS SleepConditionVariableSRW InitOnceExecuteOnce WakeAllConditionVariable WakeConditionVariable Sleep |
| api-ms-win-core-winrt-l1-1-0.dll |
RoUninitialize
RoGetActivationFactory RoRevokeActivationFactories RoRegisterActivationFactories RoInitialize RoActivateInstance |
| api-ms-win-core-winrt-error-l1-1-0.dll |
RoOriginateErrorW
RoTransformError GetRestrictedErrorInfo SetRestrictedErrorInfo RoOriginateError |
| api-ms-win-core-util-l1-1-0.dll |
EncodePointer
DecodePointer |
| api-ms-win-core-string-l1-1-0.dll |
CompareStringOrdinal
GetStringTypeW WideCharToMultiByte MultiByteToWideChar |
| api-ms-win-core-profile-l1-1-0.dll |
QueryPerformanceCounter
|
| api-ms-win-core-sysinfo-l1-2-0.dll |
GetSystemTimePreciseAsFileTime
|
| api-ms-win-core-sysinfo-l1-1-0.dll |
GetSystemInfo
GetSystemDirectoryW GetSystemTimeAsFileTime GetVersionExW GetTickCount |
| api-ms-win-core-interlocked-l1-1-0.dll |
InitializeSListHead
|
| combase.dll |
#69
|
| api-ms-win-crt-locale-l1-1-0.dll |
___lc_locale_name_func
_configthreadlocale ___lc_codepage_func ___mb_cur_max_func localeconv __pctype_func _unlock_locales _lock_locales setlocale |
| api-ms-win-crt-convert-l1-1-0.dll |
_i64toa_s
_itow_s wcstol wcstoll wcstod _ui64tow_s _i64tow_s _ui64toa_s wcstoull |
| api-ms-win-crt-filesystem-l1-1-0.dll |
_unlock_file
_lock_file |
| api-ms-win-crt-math-l1-1-0.dll |
log2
ceil frexp ceilf |
| api-ms-win-crt-utility-l1-1-0.dll |
rand_s
|
| bcrypt.dll |
BCryptHashData
BCryptOpenAlgorithmProvider BCryptCreateHash BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptCloseAlgorithmProvider |
| api-ms-win-core-shlwapi-legacy-l1-1-0.dll |
PathFindExtensionW
PathFileExistsW PathFindFileNameW |
| api-ms-win-core-fibers-l2-1-1.dll |
CreateFiberEx
|
| api-ms-win-core-threadpool-l1-2-0.dll |
CreateThreadpoolTimer
CreateThreadpoolWork WaitForThreadpoolWorkCallbacks SetThreadpoolThreadMaximum CreateThreadpool CloseThreadpool SubmitThreadpoolWork CloseThreadpoolWork SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer |
| api-ms-win-core-file-l1-1-0.dll |
FindFirstFileW
GetDriveTypeW GetFileAttributesW GetFileSizeEx GetLongPathNameW DeleteFileW SetEndOfFile SetFilePointerEx CreateFileW FindClose FindNextFileW GetFinalPathNameByHandleW |
| api-ms-win-core-fibers-l1-1-1.dll |
IsThreadAFiber
|
| CRYPT32.dll |
CryptStringToBinaryW
CryptFindOIDInfo CertFreeCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateChain CertGetCertificateContextProperty CertGetNameStringW CryptUnprotectData CryptProtectData CryptMsgGetParam CryptBinaryToStringW |
| api-ms-win-core-com-l1-1-1.dll |
RoGetAgileReference
|
| api-ms-win-core-processthreads-l1-1-1.dll |
GetProcessMitigationPolicy
OpenProcess |
| api-ms-win-security-base-l1-1-0.dll |
ImpersonateLoggedOnUser
GetTokenInformation GetLengthSid RevertToSelf CopySid |
| api-ms-win-eventing-classicprovider-l1-1-0.dll |
TraceMessage
|
| api-ms-win-core-path-l1-1-0.dll |
PathCchStripToRoot
PathAllocCombine PathCchRemoveFileSpec PathCchFindExtension PathAllocCanonicalize PathCchIsRoot |
| api-ms-win-core-heap-l2-1-0.dll |
LocalAlloc
LocalFree |
| api-ms-win-core-psapi-l1-1-0.dll |
QueryFullProcessImageNameW
|
| WS2_32.dll |
htons
ntohs |
| api-ms-win-core-registry-l1-1-0.dll |
RegQueryValueExW
RegOpenKeyExW RegCloseKey RegGetValueW RegOpenCurrentUser |
| api-ms-win-core-registry-l1-1-1.dll |
RegSetKeyValueW
|
| api-ms-win-core-processenvironment-l1-1-0.dll |
ExpandEnvironmentStringsW
|
| api-ms-win-core-version-l1-1-1.dll |
GetFileVersionInfoW
GetFileVersionInfoSizeW |
| api-ms-win-core-version-l1-1-0.dll |
VerQueryValueW
|
| api-ms-win-core-memory-l1-1-0.dll |
OpenFileMappingW
MapViewOfFile CreateFileMappingW UnmapViewOfFile |
| api-ms-win-security-lsalookup-l2-1-0.dll |
LookupAccountSidW
|
| api-ms-win-security-sddl-l1-1-0.dll |
ConvertSidToStringSidW
|
| api-ms-win-core-libraryloader-l1-2-1.dll |
FindResourceW
|
| api-ms-win-core-winrt-robuffer-l1-1-0.dll |
RoGetBufferMarshaler
|
| api-ms-win-core-featurestaging-l1-1-0.dll |
SubscribeFeatureStateChangeNotification
RecordFeatureUsage UnsubscribeFeatureStateChangeNotification |
| api-ms-win-shell-shdirectory-l1-1-0.dll |
#290
|
| api-ms-win-shcore-taskpool-l1-1-0.dll |
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask |
| api-ms-win-rtcore-ntuser-window-l1-1-0.dll |
AllowSetForegroundWindow
|
| api-ms-win-shcore-stream-winrt-l1-1-0.dll |
CreateStreamOverRandomAccessStream
|
| api-ms-win-core-url-l1-1-0.dll |
PathIsURLW
|
| urlmon.dll |
CoInternetCreateSecurityManager
|
| api-ms-win-appmodel-runtime-l1-1-0.dll |
GetPackageFullName
GetPackagesByPackageFamily |
| WINTRUST.dll |
WinVerifyTrust
WTGetSignatureInfo WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain |
| api-ms-win-core-delayload-l1-1-1.dll |
ResolveDelayLoadedAPI
|
| api-ms-win-core-delayload-l1-1-0.dll |
DelayLoadFailureHook
|
| api-ms-win-core-apiquery-l1-1-0.dll |
ApiSetQueryApiSetPresence
|
| wkscli.dll (delay-loaded) |
NetGetJoinInformation
|
| Attributes | 0x1 |
|---|---|
| Name | wkscli.dll |
| ModuleHandle | 0x235d48 |
| DelayImportAddressTable | 0x2450b8 |
| DelayImportNameTable | 0x16eb80 |
| BoundDelayImportTable | 0x16ed08 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 10.0.19041.6456 |
| ProductVersion | 10.0.19041.6456 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Windows Defender SmartScreen |
| FileVersion (#2) | 10.0.19041.6456 (WinBuild.160101.0800) |
| InternalName | smartscreen.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | smartscreen.exe |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion (#2) | 10.0.19041.6456 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2067-Feb-26 11:36:31 |
| Version | 0.0 |
| SizeofData | 40 |
| AddressOfRawData | 0x1503f0 |
| PointerToRawData | 0x14f3f0 |
| Referenced File | smartscreen.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2067-Feb-26 11:36:31 |
| Version | 0.0 |
| SizeofData | 1336 |
| AddressOfRawData | 0x150418 |
| PointerToRawData | 0x14f418 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2067-Feb-26 11:36:31 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x150950 |
| PointerToRawData | 0x14f950 |
| StartAddressOfRawData | 0x140150998 |
|---|---|
| EndAddressOfRawData | 0x1401509a8 |
| AddressOfIndex | 0x140235d40 |
| AddressOfCallbacks | 0x140140700 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x118 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140179590 |
| GuardCFCheckFunctionPointer | 5370020872 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0x22e09ef |
|---|---|
| Unmarked objects | 0 |
| Imports (27412) | 6 |
| C objects (27412) | 21 |
| ASM objects (27412) | 8 |
| Imports (VS2008 SP1 build 30729) | 169 |
| Total imports | 544 |
| C objects (LTCG) (27412) | 179 |
| C++ objects (27412) | 58 |
| Resource objects (27412) | 1 |
| Linker (27412) | 1 |
No comments yet.