| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2022-Feb-03 19:45:04 |
| Detected languages |
English - United States
|
| Debug artifacts |
notepad.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Notepad |
| FileVersion | 10.0.19041.4355 (WinBuild.160101.0800) |
| InternalName | Notepad |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | NOTEPAD.EXE |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.19041.4355 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/71 (Scanned on 2024-07-19 00:37:06) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2022-Feb-03 19:45:04 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x24600 |
| SizeOfInitializedData | 0xe000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000023BC0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | A.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x38000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x40c20 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x80000 |
| SizeofStackCommit | 0x11000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetProcAddress
CreateMutexExW AcquireSRWLockShared DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW DebugBreak IsDebuggerPresent GlobalFree GetLocaleInfoW CreateFileW ReadFile GetACP MulDiv GetCurrentProcess GetCommandLineW HeapSetInformation FreeLibrary LocalFree LocalAlloc FindFirstFileW FindClose FoldStringW GetModuleFileNameW GetUserDefaultUILanguage HeapFree HeapAlloc GetTimeFormatW WideCharToMultiByte WriteFile GetFileAttributesW LocalLock LocalUnlock DeleteFileW SetEndOfFile GetFileAttributesExW GetFileInformationByHandle CreateFileMappingW MapViewOfFile MultiByteToWideChar LocalReAlloc UnmapViewOfFile GetFullPathNameW LocalSize GetStartupInfoW lstrcmpiW FindNLSString GlobalLock GlobalUnlock GlobalAlloc GetDiskFreeSpaceExW CreateDirectoryW RegisterApplicationRestart CreateSemaphoreExW CreateThreadpoolTimer ReleaseSRWLockShared SetThreadpoolTimer CloseHandle OpenSemaphoreW WaitForSingleObjectEx AcquireSRWLockExclusive CloseThreadpoolTimer OutputDebugStringW ReleaseSRWLockExclusive GetLastError FormatMessageW ReleaseMutex GetCurrentThreadId WaitForSingleObject WaitForThreadpoolTimerCallbacks InitializeCriticalSectionEx LeaveCriticalSection GetModuleHandleExW ReleaseSemaphore EnterCriticalSection GetDateFormatW SetLastError GetLocalTime ResolveDelayLoadedAPI DelayLoadFailureHook GetModuleFileNameA |
|---|---|
| GDI32.dll |
CreateDCW
StartPage StartDocW SetAbortProc DeleteDC EndDoc AbortDoc EndPage GetTextMetricsW SetBkMode LPtoDP SetWindowExtEx SetViewportExtEx SetMapMode GetTextExtentPoint32W TextOutW EnumFontsW GetTextFaceW SelectObject DeleteObject CreateFontIndirectW GetDeviceCaps |
| USER32.dll |
PostMessageW
MessageBoxW GetMenu CheckMenuItem GetSubMenu EnableMenuItem ShowWindow GetDC ReleaseDC SetCursor GetDpiForWindow SetActiveWindow LoadStringW DefWindowProcW IsIconic SetFocus PostQuitMessage DestroyWindow MessageBeep GetForegroundWindow GetDlgCtrlID SetWindowPos RedrawWindow GetKeyboardLayout CharNextW SetWinEventHook GetMessageW TranslateAcceleratorW IsDialogMessageW TranslateMessage DispatchMessageW UnhookWinEvent SetWindowTextW OpenClipboard IsClipboardFormatAvailable CloseClipboard SetDlgItemTextW GetDlgItemTextW EndDialog SendDlgItemMessageW SetScrollPos InvalidateRect UpdateWindow GetWindowPlacement SetWindowPlacement CharUpperW GetSystemMenu LoadAcceleratorsW SetWindowLongW CreateWindowExW MonitorFromWindow RegisterWindowMessageW LoadCursorW RegisterClassExW GetWindowTextLengthW GetWindowLongW PeekMessageW GetWindowTextW EnableWindow CreateDialogParamW DrawTextExW LoadIconW LoadImageW DialogBoxParamW SetThreadDpiAwarenessContext SendMessageW MoveWindow GetClientRect GetFocus |
| api-ms-win-crt-string-l1-1-0.dll |
memset
wcsnlen wcscmp |
| api-ms-win-crt-runtime-l1-1-0.dll |
_c_exit
_register_thread_local_exe_atexit_callback _initterm_e _initterm |
| api-ms-win-crt-private-l1-1-0.dll |
_o__callnewh
_o__cexit _o__configthreadlocale _o__configure_wide_argv _o__crt_atexit _o__errno _o__exit _o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o__wtol _o_exit _o_free _o_iswdigit _o_malloc _o_terminate _o_toupper __CxxFrameHandler3 _CxxThrowException _o___std_exception_destroy _o___std_exception_copy _o___p__commode _o___stdio_common_vswprintf __C_specific_handler memcmp memcpy memmove |
| api-ms-win-core-com-l1-1-0.dll |
CoWaitForMultipleHandles
CoUninitialize PropVariantClear CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoCreateInstance CoInitializeEx CoCreateGuid |
| api-ms-win-core-shlwapi-legacy-l1-1-0.dll |
PathIsFileSpecW
PathFindExtensionW PathFileExistsW |
| api-ms-win-shcore-obsolete-l1-1-0.dll |
SHStrDupW
|
| api-ms-win-shcore-path-l1-1-0.dll |
#170
|
| api-ms-win-shcore-scaling-l1-1-1.dll |
GetDpiForMonitor
|
| api-ms-win-core-rtlsupport-l1-1-0.dll |
RtlLookupFunctionEntry
RtlCaptureContext RtlVirtualUnwind |
| api-ms-win-core-errorhandling-l1-1-0.dll |
SetUnhandledExceptionFilter
UnhandledExceptionFilter RaiseException |
| api-ms-win-core-processthreads-l1-1-0.dll |
TerminateProcess
|
| api-ms-win-core-processthreads-l1-1-1.dll |
GetProcessMitigationPolicy
IsProcessorFeaturePresent |
| api-ms-win-core-profile-l1-1-0.dll |
QueryPerformanceCounter
|
| api-ms-win-core-sysinfo-l1-1-0.dll |
GetTickCount
GetSystemTimeAsFileTime |
| api-ms-win-core-interlocked-l1-1-0.dll |
InitializeSListHead
|
| api-ms-win-core-libraryloader-l1-2-0.dll |
LoadLibraryExW
|
| api-ms-win-core-winrt-string-l1-1-0.dll |
WindowsCreateString
WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateStringReference |
| api-ms-win-core-synch-l1-1-0.dll |
SetEvent
CreateEventExW |
| api-ms-win-core-winrt-error-l1-1-0.dll |
SetRestrictedErrorInfo
|
| api-ms-win-core-string-l1-1-0.dll |
CompareStringOrdinal
|
| api-ms-win-core-winrt-l1-1-0.dll |
RoInitialize
RoUninitialize RoGetActivationFactory |
| api-ms-win-core-winrt-error-l1-1-1.dll |
RoGetMatchingRestrictedErrorInfo
|
| api-ms-win-eventing-provider-l1-1-0.dll |
EventProviderEnabled
|
| api-ms-win-core-synch-l1-2-0.dll |
Sleep
|
| COMCTL32.dll |
CreateStatusWindowW
#345 |
| ADVAPI32.dll (delay-loaded) |
OpenProcessToken
IsTextUnicode GetTokenInformation DuplicateEncryptionInfoFile RegSetValueExW RegQueryValueExW RegCreateKeyW RegCloseKey RegOpenKeyExW RegCreateKeyExW RegDeleteKeyExW RegQueryInfoKeyW RegEnumValueW EventSetInformation EventRegister EventUnregister EventWriteTransfer DecryptFileW |
| Attributes | 0x1 |
|---|---|
| Name | ADVAPI32.dll |
| ModuleHandle | 0x30c78 |
| DelayImportAddressTable | 0x35000 |
| DelayImportNameTable | 0x2cac0 |
| BoundDelayImportTable | 0x2cf50 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 10.0.19041.4355 |
| ProductVersion | 10.0.19041.4355 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Notepad |
| FileVersion (#2) | 10.0.19041.4355 (WinBuild.160101.0800) |
| InternalName | Notepad |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | NOTEPAD.EXE |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion (#2) | 10.0.19041.4355 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Feb-03 19:45:04 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x2b504 |
| PointerToRawData | 0x29f04 |
| Referenced File | notepad.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Feb-03 19:45:04 |
| Version | 0.0 |
| SizeofData | 1084 |
| AddressOfRawData | 0x2b528 |
| PointerToRawData | 0x29f28 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Feb-03 19:45:04 |
| Version | 0.0 |
| SizeofData | 36 |
| AddressOfRawData | 0x2b964 |
| PointerToRawData | 0x2a364 |
| Size | 0x118 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140030470 |
| GuardCFCheckFunctionPointer | 5368869096 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0x24fb72e6 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 48 |
| C objects (27412) | 10 |
| ASM objects (27412) | 3 |
| Imports (27412) | 9 |
| Total imports | 1320 |
| C objects (LTCG) (27412) | 31 |
| C++ objects (27412) | 31 |
| 253 (27412) | 1 |
| Resource objects (27412) | 1 |
| Linker (27412) | 1 |