95ebfc54ff3ca337012c1abe35b3a3db5c5fdb7d7e4caa23b274b9295d17a1f4

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2011-Dec-11 22:48:19
Detected languages English - United States
Debug artifacts C:\Users\HAANDI\Documents\Visual Studio 2010\Projects\ShaderInjector\Release\d3d9.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryW
Safe VirusTotal score: 0/71 (Scanned on 2025-09-03 05:31:31) All the AVs think this file is safe.

Hashes

MD5 7894c14d7778e260685a0183e6798fab
SHA1 6d8378e0df98bed5e1761bfd2a2ddbff2c21b758
SHA256 95ebfc54ff3ca337012c1abe35b3a3db5c5fdb7d7e4caa23b274b9295d17a1f4
SHA3 b628ea6d47576d8ee96e97515be0fed1c1263918839c309c00fedaafc9147fcd
SSDeep 3072:cw/nlnU56BqtD2XC/dBcNgRCfimerUbP8NqX:Pc6oD64AbZ
Imports Hash c2cd3e610f023a63175fa85537b681e0

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2011-Dec-11 22:48:19
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 10.0
SizeOfCode 0xf800
SizeOfInitializedData 0x19e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00003738 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x11000
ImageBase 0x10000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x2f000
SizeOfHeaders 0x400
Checksum 0x2ac50
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 07aaa9795541649132e969bfcd07487c
SHA1 e608165a0f9cfcd06e324bf9438cc93de260e045
SHA256 1294e00de785ef51a71479f97396f4e2227d7fc5d2e2c7651c44c327dd87856c
SHA3 b2dcb03914db00c04a5aac788ce3eb743d5399d76fa424adb00c5b1aa60f8563
VirtualSize 0xf6d5
VirtualAddress 0x1000
SizeOfRawData 0xf800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.63158

.rdata

MD5 71f215756bb7d6f7d44e5049e16f8526
SHA1 a5f812101a77e81d18dec6b81421d00dbeeec7c8
SHA256 3ef8b8c20dbbeb2303e8ae6646ca86d4c15efe5a1bf249e845ec24994bff0ab2
SHA3 164c895f6fbb95ee53e41fc9cf78b16acee1d4290cda9b292741343bcea7dab3
VirtualSize 0x16cd7
VirtualAddress 0x11000
SizeOfRawData 0x16e00
PointerToRawData 0xfc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.83342

.data

MD5 dec65187e83524257f14363c9c165575
SHA1 5b4c1c66c6f1c59edb7cd315fa015e7479736906
SHA256 ee4c60b7bcca91781b6d0c23f22122735f2be7885fe3311526ac788f813094fa
SHA3 4f072670c0d91a5268b458b494d62a774792a6876453c471e7dabad051d4a615
VirtualSize 0x37e8
VirtualAddress 0x28000
SizeOfRawData 0x1400
PointerToRawData 0x26a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.28811

.rsrc

MD5 6592e92c1bed0a0f1147a78eb4a661fd
SHA1 59b1e3f13204bffe2b093c217411ffd4e1615671
SHA256 4ba1f1a8f4136f5a61b5301559116cd932ed26df1e6a931c437411383efd6fcb
SHA3 6a6068d36b89b4d85205c0625418fb896cbb7270ae7339d0b5312acf8790f0e4
VirtualSize 0x1b4
VirtualAddress 0x2c000
SizeOfRawData 0x200
PointerToRawData 0x27e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.11577

.reloc

MD5 384cfe9475f8c7f5eaa1368072845071
SHA1 bbd20157633be3ee17204fbbda470cef179461fa
SHA256 209ac045632110cb7c8dbc34467da12c63724b4edecde45f07062f8b63e283dc
SHA3 704a3bdba8c15cc89c90cda302749c28b033cad5013b1cfeaa609aa100574a4f
VirtualSize 0x1802
VirtualAddress 0x2d000
SizeOfRawData 0x1a00
PointerToRawData 0x28000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.23802

Imports

d3dx9_43.dll D3DXSaveSurfaceToFileA
D3DXCreateEffectFromFileW
KERNEL32.dll TlsAlloc
ExitProcess
GetPrivateProfileIntA
GetPrivateProfileStringA
GetModuleFileNameA
VirtualProtect
FreeLibrary
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
GetCurrentDirectoryA
LCMapStringW
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
HeapFree
CloseHandle
HeapAlloc
RaiseException
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
Sleep
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteConsoleW
MultiByteToWideChar
SetFilePointer
SetStdHandle
GetModuleFileNameW
CreateFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
HeapReAlloc
LoadLibraryW
CreateFileW
GetStringTypeW
SetEndOfFile
GetProcessHeap
ReadFile
IsProcessorFeaturePresent
USER32.dll GetAsyncKeyState

Delayed Imports

D3DPERF_BeginEvent

Ordinal 1
Address 0x1970

D3DPERF_EndEvent

Ordinal 2
Address 0x1980

D3DPERF_GetStatus

Ordinal 3
Address 0x19d0

D3DPERF_QueryRepeatFrame

Ordinal 4
Address 0x19b0

D3DPERF_SetMarker

Ordinal 5
Address 0x1990

D3DPERF_SetOptions

Ordinal 6
Address 0x19c0

D3DPERF_SetRegion

Ordinal 7
Address 0x19a0

Direct3DCreate9

Ordinal 8
Address 0x18e0

2

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x15a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.79597
MD5 24d3b502e1846356b0263f945ddd5529
SHA1 bac45b86a9c48fc3756a46809c101570d349737d
SHA256 49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e
SHA3 1244ed60820da52dc4b53880ec48e3b587dbdbd9545f01fa2b1c0fcfea1d5e9e

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2011-Dec-11 22:48:19
Version 0.0
SizeofData 110
AddressOfRawData 0x26c90
PointerToRawData 0x25890
Referenced File C:\Users\HAANDI\Documents\Visual Studio 2010\Projects\ShaderInjector\Release\d3d9.pdb

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x10028038
SEHandlerTable 0x10026e30
SEHandlerCount 9

RICH Header

XOR Key 0x467561e9
Unmarked objects 0
C++ objects (VS2010 build 30319) 37
ASM objects (VS2010 build 30319) 19
C objects (VS2010 build 30319) 114
Imports (VS2008 SP1 build 30729) 4
Imports (21202) 3
Total imports 87
175 (VS2010 build 30319) 4
Exports (VS2010 build 30319) 1
Linker (VS2010 build 30319) 1

Errors

Leave a comment

No comments yet.