Architecture |
IMAGE_FILE_MACHINE_AMD64
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2015-Oct-08 09:11:13 |
Detected languages |
English - United States
Hebrew - Israel |
Debug artifacts |
c:\Projects\VS2005\WinLister\x64\Release\WinLister.pdb
|
CompanyName | NirSoft |
FileDescription | WinLister |
FileVersion | 1.22 |
InternalName | WinLister |
LegalCopyright | Copyright © 2003 - 2015 Nir Sofer |
OriginalFilename | WinLister.exe |
ProductName | WinLister |
ProductVersion | 1.22 |
Info | Matching compiler(s): | MASM/TASM - sig1(h) |
Info | Interesting strings found in the binary: |
Contains domain names:
|
Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
Info | The PE is digitally signed. |
Signer: Nir Sofer
Issuer: COMODO Code Signing CA 2 |
Safe | VirusTotal score: 0/74 (Scanned on 2024-07-11 20:12:34) | All the AVs think this file is safe. |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0xe8 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_AMD64
|
NumberofSections | 5 |
TimeDateStamp | 2015-Oct-08 09:11:13 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xf0 |
Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Magic | PE32+ |
---|---|
LinkerVersion | 8.0 |
SizeOfCode | 0x7000 |
SizeOfInitializedData | 0x5a00 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x0000000000007B60 (Section: .text) |
BaseOfCode | 0x1000 |
ImageBase | 0x140000000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 4.0 |
ImageVersion | 0.0 |
SubsystemVersion | 5.2 |
Win32VersionValue | 0 |
SizeOfImage | 0x10000 |
SizeOfHeaders | 0x400 |
Checksum | 0x165ff |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
msvcrt.dll |
_c_exit
_exit _cexit exit _acmdln __getmainargs _initterm __setusermatherr _commode _fmode __set_app_type strrchr _XcptFilter _itoa _strcmpi strcmp _snprintf free _memicmp modf _mbsicmp __C_specific_handler _onexit __dllonexit _mbschr memcmp strtoul malloc ??2@YAPEAX_K@Z ??3@YAXPEAX@Z strlen memcpy strcpy memset strncat sprintf strcat |
---|---|
COMCTL32.dll |
CreateToolbarEx
ImageList_ReplaceIcon ImageList_AddMasked ImageList_Create ImageList_SetImageCount #6 #17 |
VERSION.dll |
GetFileVersionInfoA
VerQueryValueA GetFileVersionInfoSizeA |
KERNEL32.dll |
GetStartupInfoA
WritePrivateProfileStringA GetPrivateProfileIntA GetPrivateProfileStringA Process32Next Process32First CreateToolhelp32Snapshot GetCurrentProcessId DeleteFileA WriteFile GetFileSize ReadFile GetVersionExA GetModuleFileNameA TerminateProcess CloseHandle GetWindowsDirectoryA OpenProcess GetProcAddress LoadLibraryA FreeLibrary GetTempPathA GlobalLock GetTempFileNameA LocalFree GlobalAlloc GetModuleHandleA lstrcpyA lstrlenA WideCharToMultiByte LoadLibraryExA GlobalUnlock FormatMessageA GetLastError CreateFileA |
USER32.dll |
GetSubMenu
TranslateAcceleratorA UpdateWindow KillTimer LoadAcceleratorsA GetWindowPlacement GetMessageA GetWindowTextA SetMenu GetWindowThreadProcessId LoadMenuA RegisterClassA SetTimer DispatchMessageA DeferWindowPos PostQuitMessage TrackPopupMenu BeginDeferWindowPos EnumWindows SetCursor EndDialog GetDlgItem SetDlgItemTextA DialogBoxParamA SendMessageA LoadCursorA GetSysColorBrush SetWindowTextA ChildWindowFromPoint GetWindowLongA SetForegroundWindow MessageBoxA IsWindowVisible PostMessageA ShowWindow SetWindowPos GetClassLongA SendMessageTimeoutA LoadIconA SetDlgItemInt SendDlgItemMessageA SetFocus GetDlgItemInt InvalidateRect GetMenu EmptyClipboard EnableMenuItem ReleaseDC GetDC SetClipboardData EnableWindow GetMenuStringA LoadImageA GetCursorPos GetWindowRect MoveWindow ScreenToClient GetSysColor DefWindowProcA GetSystemMetrics GetClientRect GetClassNameA CheckMenuItem CloseClipboard OpenClipboard EndDeferWindowPos DestroyWindow DestroyIcon TranslateMessage CreateWindowExA |
GDI32.dll |
SetBkColor
GetDeviceCaps CreateFontIndirectA SetBkMode DeleteObject SetTextColor |
comdlg32.dll |
GetSaveFileNameA
|
ADVAPI32.dll |
RegDeleteKeyA
|
SHELL32.dll |
ShellExecuteExA
ExtractIconExA ShellExecuteA |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 1.2.2.0 |
ProductVersion | 1.2.2.0 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | English - United States |
CompanyName | NirSoft |
FileDescription | WinLister |
FileVersion (#2) | 1.22 |
InternalName | WinLister |
LegalCopyright | Copyright © 2003 - 2015 Nir Sofer |
OriginalFilename | WinLister.exe |
ProductName | WinLister |
ProductVersion (#2) | 1.22 |
Resource LangID | Hebrew - Israel |
---|
Characteristics |
0
|
---|---|
TimeDateStamp | 2015-Oct-08 09:11:13 |
Version | 0.0 |
SizeofData | 79 |
AddressOfRawData | 0x9370 |
PointerToRawData | 0x8770 |
Referenced File | c:\Projects\VS2005\WinLister\x64\Release\WinLister.pdb |
XOR Key | 0x138263f8 |
---|---|
Unmarked objects | 0 |
ASM objects (40310) | 1 |
C objects (40310) | 10 |
Total imports | 237 |
Imports (40310) | 19 |
114 (VS2012 build 50727 / VS2005 build 50727) | 16 |
Resource objects (VS2012 build 50727 / VS2005 build 50727) | 1 |
Linker (VS2012 build 50727 / VS2005 build 50727) | 1 |