5bafc3641e0b4d42a2e7bc2c5f906518
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2019-Feb-26 09:02:16 |
| Detected languages |
English - United States
Korean - Korea |
| Debug artifacts |
D:\Source\Korea\RO_2019-02-27#02\RagnarokClient\Release Sakray\RagexeRE.pdb
|
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0 MASM/TASM - sig2(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to internet browsers:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to MD5
Uses constants related to AES Uses constants related to DES Microsoft's Cryptography API |
| Suspicious | The PE is packed or was manually edited. | The number of imports reported in the RICH header is inconsistent. |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: GRAVITY Co.
Issuer: Symantec Class 3 SHA256 Code Signing CA |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x130 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2019-Feb-26 09:02:16 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x79fa00 |
| SizeOfInitializedData | 0x47b200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x006BD15D (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x7a1000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xc1e000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x9aa478 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
.reloc
Imports
| binkw32.dll |
_BinkOpenDirectSound@4
_BinkGoto@12 _BinkShouldSkip@4 _BinkCopyToBuffer@28 _BinkClose@4 _BinkWait@4 _BinkPause@8 _BinkSetSoundSystem@8 _BinkNextFrame@4 _BinkDoFrame@4 _BinkOpen@8 _BinkSetVolume@12 _BinkGetError@0 |
|---|---|
| ijl15.dll |
#2
#5 #3 #4 |
| WS2_32.dll |
#23
#115 #16 #10 #19 #18 #116 #111 #14 #20 #9 #12 #11 #52 #57 #3 #4 |
| mss32.dll |
_AIL_shutdown@0
_AIL_set_preference@8 _AIL_close_digital_driver@4 _AIL_file_type@8 _AIL_decompress_ADPCM@12 _AIL_decompress_ASI@24 _AIL_WAV_info@8 _AIL_mem_free_lock@4 _AIL_set_3D_orientation@28 _AIL_set_3D_position@16 _AIL_close_3D_listener@4 _AIL_open_3D_listener@4 _AIL_set_3D_sample_effects_level@8 _AIL_set_3D_sample_distances@12 _AIL_set_3D_speaker_type@8 _AIL_3D_speaker_type@4 _AIL_set_3D_room_type@8 _AIL_3D_room_type@4 _AIL_3D_sample_status@4 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_file@8 _AIL_end_3D_sample@4 _AIL_start_3D_sample@4 _AIL_release_3D_sample_handle@4 _AIL_allocate_3D_sample_handle@4 _AIL_close_3D_provider@4 _AIL_open_3D_provider@4 _AIL_enumerate_3D_providers@12 _AIL_stream_status@4 _AIL_set_stream_loop_count@8 _AIL_stream_volume@4 _AIL_set_stream_volume@8 _AIL_pause_stream@8 _AIL_start_stream@4 _AIL_close_stream@4 _AIL_set_redist_directory@4 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_startup@0 _AIL_open_stream@12 _AIL_sample_status@4 _AIL_set_sample_volume@8 _AIL_end_sample@4 _AIL_start_sample@4 _AIL_open_digital_driver@16 |
| IMM32.dll |
ImmGetCandidateListW
ImmNotifyIME ImmGetVirtualKey ImmGetCompositionStringW ImmGetCompositionStringA ImmSetConversionStatus ImmGetConversionStatus ImmReleaseContext ImmGetContext |
| cps.dll |
compress
uncompress |
| WINMM.dll |
timeGetTime
timeEndPeriod timeBeginPeriod timeGetDevCaps |
| granny2.dll |
_GrannyInstantiateModel@4
_GrannyGetSecondsElapsed@8 _GrannyGetSystemSeconds@0 _GrannyGetControlDurationLeft@4 GrannyPNT332VertexType GrannyRGBA8888PixelFormat _GrannyBuildWorldPose@24 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyGetWorldPoseComposite4x4@8 _GrannyFreeWorldPose@4 _GrannyNewWorldPose@4 _GrannyFreeModelInstance@4 _GrannyGetSourceSkeleton@4 _GrannySetModelClock@8 _GrannyFreeCompletedModelControls@4 _GrannyVersionsMatch_@16 _GrannyTextureHasAlpha@4 _GrannyCopyTextureImage@32 _GrannyDeformVertices@24 _GrannyFreeMeshDeformer@4 _GrannyNewMeshDeformer@12 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFreeMeshBinding@4 _GrannyNewMeshBinding@12 _GrannyCopyMeshIndices@12 _GrannyGetMeshIndices@4 _GrannyGetMeshBytesPerIndex@4 _GrannyGetMeshIndexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshVertices@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertexCount@4 _GrannyGetMeshVertexType@4 _GrannyGetMeshTriangleGroups@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyPlayControlledAnimation@12 _GrannySetControlActive@8 _GrannySetControlLoopCount@8 _GrannyFreeControl@4 _GrannySampleModelAnimations@16 _GrannyGetMaterialTextureByType@8 |
| DDRAW.dll |
DirectDrawCreateEx
DirectDrawEnumerateExA |
| MSVCP140.dll |
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_alloc@std@@YAXXZ _Mbrtowc ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?uncaught_exception@std@@YA_NXZ ??1ios_base@std@@UAE@XZ ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??_7ios_base@std@@6B@ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Xinvalid_argument@std@@YAXPBD@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ??Bid@locale@std@@QAEIXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z |
| KERNEL32.dll |
HeapFree
InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx QueryPerformanceFrequency GetModuleHandleW UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError HeapReAlloc HeapAlloc GetModuleFileNameW HeapSize SetThreadPriority CreateThread LocalLock GetVersionExA lstrcpynA lstrcmpiA ResumeThread SuspendThread LeaveCriticalSection EnterCriticalSection FindNextFileA FindFirstFileA FindClose CreateDirectoryA VirtualAlloc VirtualFree OpenProcess lstrcatA GetSystemInfo MapViewOfFile GetUserDefaultLangID QueryPerformanceCounter UnmapViewOfFile CreateEventW GetCurrentDirectoryA WaitForMultipleObjects CreateSemaphoreA ReleaseSemaphore WaitForSingleObject GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetModuleHandleA GetCurrentThread GetCurrentProcess SetUnhandledExceptionFilter WideCharToMultiByte lstrlenA CloseHandle WriteFile SetFilePointerEx ReadFile GetFileSizeEx CreateFileA InitializeCriticalSection GetTickCount GetLocalTime Sleep HeapCompact GetProcessHeap MultiByteToWideChar MulDiv OutputDebugStringA FormatMessageA LoadLibraryA GetProcAddress GetModuleFileNameA FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException DecodePointer CreateFileMappingA HeapDestroy LoadLibraryW VirtualProtect DeleteFileA FileTimeToSystemTime OutputDebugStringW SetPriorityClass CreateProcessA GlobalMemoryStatus GetSystemTime CopyFileA IsDBCSLeadByte IsDebuggerPresent |
| USER32.dll |
GetDlgItem
OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetFocus GetSystemMetrics SetWindowTextA GetWindowRect GetCursorPos ScreenToClient PeekMessageA PostThreadMessageA GetAsyncKeyState CharNextExA CharPrevExA GetKeyState wsprintfA SendMessageA DefWindowProcA CallWindowProcA RegisterClassExA CreateWindowExA DestroyWindow EndDialog IsWindowVisible UpdateWindow SetActiveWindow GetWindowTextA ShowCursor SetCursorPos SetCursor WindowFromPoint GetParent SetParent GetWindow LoadBitmapA LoadCursorA LoadIconA GetKeyboardLayout GetClipboardData TranslateMessage DispatchMessageA FindWindowA RegisterClassA IsIconic GetActiveWindow ValidateRect AdjustWindowRect ClipCursor DialogBoxParamA MoveWindow GetDC SetWindowLongA SetRect ClientToScreen MessageBoxA RedrawWindow GetClientRect DrawMenuBar SetWindowPos UnregisterClassA ShowWindow |
| ADVAPI32.dll |
CryptReleaseContext
CryptDecrypt RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA CryptAcquireContextA CryptDeriveKey CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey |
| ole32.dll |
OleSetContainedObject
CoCreateInstance CoUninitialize CoInitialize |
| SHELL32.dll |
ShellExecuteA
SHFileOperationA |
| OLEAUT32.dll |
#4
#8 #2 #6 |
| SHLWAPI.dll |
StrStrIW
|
| GDI32.dll |
CreateCompatibleDC
DeleteDC DeleteObject SelectObject GetStockObject CreatePolygonRgn FillRgn CreateSolidBrush TextOutA TextOutW SetTextColor SetBkMode SetBkColor GetTextExtentPoint32W GetCurrentObject EnumFontFamiliesExA CreateFontA CreateFontIndirectA CreateDIBSection |
| IPHLPAPI.DLL |
GetAdaptersInfo
|
| NETAPI32.dll |
Netbios
|
| VCRUNTIME140.dll |
__std_exception_copy
memcpy strchr strstr longjmp _setjmp3 __std_terminate strrchr memchr __std_type_info_destroy_list _CxxThrowException _except_handler4_common _local_unwind4 memmove _purecall memset __std_exception_destroy __CxxFrameHandler3 __RTDynamicCast |
| api-ms-win-crt-heap-l1-1-0.dll |
calloc
realloc _recalloc malloc _set_new_mode free _callnewh |
| api-ms-win-crt-runtime-l1-1-0.dll |
_seh_filter_dll
_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit strerror _cexit _errno _controlfp _seh_filter_exe _set_app_type abort _get_narrow_winmain_command_line signal _initterm _initterm_e _exit system _c_exit _register_thread_local_exe_atexit_callback exit _controlfp_s _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _beginthreadex terminate |
| api-ms-win-crt-stdio-l1-1-0.dll |
fputc
__stdio_common_vsprintf fsetpos __p__commode _fseeki64 tmpnam __stdio_common_vsnprintf_s _fileno _isatty fopen_s __acrt_iob_func fclose feof ferror fopen fread freopen getc ungetc __stdio_common_vfprintf putchar fwrite fgetpos fputs puts fgetc _get_stream_buffer_pointers fgets __stdio_common_vsprintf_s clearerr fflush fseek ftell __stdio_common_vsscanf _pclose _popen setvbuf tmpfile __stdio_common_vfscanf _set_fmode _wfopen |
| api-ms-win-crt-string-l1-1-0.dll |
iscntrl
isdigit isprint strcoll isalpha strpbrk isspace strtok tolower strcpy_s strncpy_s strncmp toupper ispunct isxdigit islower isupper _stricmp iswspace wcsnlen wcscpy_s _strlwr isalnum strncpy strncat strcspn |
| api-ms-win-crt-convert-l1-1-0.dll |
strtol
_i64toa_s _atoi64 atof mbstowcs wcstombs strtod _i64toa _ltoa _itoa atoi strtoul |
| api-ms-win-crt-math-l1-1-0.dll |
ldexp
_libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_exp_precise _libm_sse2_sin_precise floor _libm_sse2_cos_precise _libm_sse2_pow_precise modf _libm_sse2_atan_precise ceil _libm_sse2_tan_precise _libm_sse2_asin_precise _libm_sse2_acos_precise frexp __setusermatherr _except1 _CItanh _CIatan2 _libm_sse2_sqrt_precise _CIsinh _CIcosh _CIfmod |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
setlocale localeconv _setmbcp |
| api-ms-win-crt-utility-l1-1-0.dll |
ldiv
rand qsort srand |
| api-ms-win-crt-environment-l1-1-0.dll |
getenv
|
| api-ms-win-crt-time-l1-1-0.dll |
_ctime32
_difftime32 _localtime32 _time32 clock _difftime64 _gmtime64 _localtime64 _mktime64 strftime _time64 _mktime32 |
| api-ms-win-crt-filesystem-l1-1-0.dll |
remove
_splitpath rename _chmod _mkdir _access _unlink _unlock_file _lock_file _rmdir |
| api-ms-win-crt-multibyte-l1-1-0.dll |
_mbsbtype
_mbsstr |
| api-ms-win-crt-process-l1-1-0.dll |
_spawnl
|
Delayed Imports
1
2
3
4
5
6
7
8
9
10
102
117
117 (#2)
145
151
154
156
114
119
123
1 (#2)
120
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2019-Feb-26 09:02:16 |
| Version | 0.0 |
| SizeofData | 100 |
| AddressOfRawData | 0x827cfc |
| PointerToRawData | 0x826afc |
| Referenced File | D:\Source\Korea\RO_2019-02-27#02\RagnarokClient\Release Sakray\RagexeRE.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2019-Feb-26 09:02:16 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x827d60 |
| PointerToRawData | 0x826b60 |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2019-Feb-26 09:02:16 |
| Version | 0.0 |
| SizeofData | 884 |
| AddressOfRawData | 0x827d74 |
| PointerToRawData | 0x826b74 |
TLS Callbacks
| StartAddressOfRawData | 0xc280f8 |
|---|---|
| EndAddressOfRawData | 0xc28100 |
| AddressOfIndex | 0xf71edc |
| AddressOfCallbacks | 0xba760c |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
Load Configuration
| Size | 0xa0 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0xcf0f78 |
| SEHandlerTable | 0 |
| SEHandlerCount | 0 |
RICH Header
| XOR Key | 0x359d5ebe |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 26 |
| 199 (41118) | 8 |
| C objects (VS 2015/2017 runtime 26706) | 13 |
| ASM objects (VS 2015/2017 runtime 26706) | 12 |
| C objects (26213) | 9 |
| C++ objects (VS 2015/2017 runtime 26706) | 41 |
| Imports (VS 2015/2017 runtime 26706) | 4 |
| C++ objects (26213) | 1 |
| 48 (8943) | 1 |
| Imports (26213) | 28 |
| Total imports | 508 |
| Linker (VC++ 6.0 SP5 imp/exp build 8447) | 120 |
| C objects (VS2017 v15.9.7-10 compiler 27027) | 31 |
| C++ objects (VS2017 v15.9.7-10 compiler 27027) | 449 |
| Resource objects (VS2017 v15.9.7-10 compiler 27027) | 1 |
| 151 | 2 |
| Linker (VS2017 v15.9.7-10 compiler 27027) | 1 |