| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2018-Apr-06 23:28:10 |
| Detected languages |
English - United States
|
| Debug artifacts |
E:\A\_work\954\s\core-setup\Bin\obj\win-x64.Release\corehost\cli\exe\apphost\Release\apphost.pdb
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/60 (Scanned on 2021-04-05 18:24:44) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2018-Apr-06 23:28:10 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x8800 |
| SizeOfInitializedData | 0xb200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000005910 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x18000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x180000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetEnvironmentVariableW
GetFileAttributesExW GetFullPathNameW CloseHandle GetLastError GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW MultiByteToWideChar FreeLibrary RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind |
|---|---|
| api-ms-win-crt-runtime-l1-1-0.dll |
exit
abort _initterm_e _initterm _exit _initialize_wide_environment _configure_wide_argv _invalid_parameter_noinfo_noreturn __p___argc __p___wargv _set_app_type _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _get_initial_wide_environment _cexit _crt_atexit terminate _register_onexit_function _initialize_onexit_table |
| api-ms-win-crt-string-l1-1-0.dll |
memset
strcpy_s _wcsicmp |
| api-ms-win-crt-stdio-l1-1-0.dll |
_set_fmode
__acrt_iob_func fputws __p__commode __stdio_common_vfwprintf fflush |
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
_calloc_base _free_base free _callnewh malloc |
| api-ms-win-crt-convert-l1-1-0.dll |
_wtoi
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2018-Apr-06 23:28:10 |
| Version | 0.0 |
| SizeofData | 121 |
| AddressOfRawData | 0x10cb4 |
| PointerToRawData | 0xf8b4 |
| Referenced File | E:\A\_work\954\s\core-setup\Bin\obj\win-x64.Release\corehost\cli\exe\apphost\Release\apphost.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2018-Apr-06 23:28:10 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x10d30 |
| PointerToRawData | 0xf930 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2018-Apr-06 23:28:10 |
| Version | 0.0 |
| SizeofData | 928 |
| AddressOfRawData | 0x10d44 |
| PointerToRawData | 0xf944 |
| StartAddressOfRawData | 0x140015000 |
|---|---|
| EndAddressOfRawData | 0x140015008 |
| AddressOfIndex | 0x140013840 |
| AddressOfCallbacks | 0x14000a350 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x94 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140013080 |
| GuardCFCheckFunctionPointer | 5368750760 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0x8d3c674a |
|---|---|
| Unmarked objects | 0 |
| ASM objects (VS2015 UPD3 build 24123) | 7 |
| C++ objects (VS2015 UPD3 build 24123) | 57 |
| C objects (VS2015 UPD3 build 24123) | 33 |
| Imports (VS2008 SP1 build 30729) | 18 |
| Imports (65501) | 3 |
| Total imports | 148 |
| C++ objects (VS2015 UPD3.1 build 24215) | 5 |
| Resource objects (VS2015 UPD3 build 24210) | 1 |
| Linker (VS2015 UPD3.1 build 24215) | 1 |