| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Sep-12 12:29:43 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\jenkins\workspace\TRUNK_23-05-GA\Root\temp\Release.Win32\bin\fpneotrust.pdb
|
| CompanyName | Forcepoint |
| FileDescription | Forcepoint Neo Endpoint component |
| FileVersion | 23.05.0.23 |
| InternalName | fpneotrust.dll |
| LegalCopyright | Copyright (c) 2022 Forcepoint LLC. All rights reserved. |
| OriginalFilename | fpneotrust.dll |
| ProductName | Forcepoint Neo Endpoint |
| ProductVersion | 23.05.0.23 |
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Uses Microsoft's cryptographic API:
|
| Info | The PE is digitally signed. |
Signer: Forcepoint LLC
Issuer: Sectigo Public Code Signing CA R36 |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x118 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2023-Sep-12 12:29:43 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x9a00 |
| SizeOfInitializedData | 0x6800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00009180 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0xb000 |
| ImageBase | 0x10000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x13000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x1c00d |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ntdll.dll |
ZwQueryVirtualMemory
RtlFindMessage RtlAnsiStringToUnicodeSize RtlAnsiStringToUnicodeString RtlUnicodeStringToAnsiSize RtlUnicodeStringToAnsiString NlsMbCodePageTag |
|---|---|
| CRYPT32.dll |
CryptQueryObject
CertCloseStore CryptMsgGetParam CertFindCertificateInStore CryptMsgOpenToDecode CertOpenStore CryptMsgClose CryptMsgUpdate CertGetNameStringW CertFreeCertificateContext |
| WINTRUST.dll |
WinVerifyTrust
|
| ADVAPI32.dll |
TraceMessage
GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids GetUserNameW |
| KERNEL32.dll |
IsDebuggerPresent
GetSystemTimeAsFileTime SetEvent InitializeCriticalSectionAndSpinCount SetLastError GetModuleHandleExW GetModuleFileNameW CreateFileW GetLastError DisableThreadLibraryCalls CloseHandle DeviceIoControl OutputDebugStringA GetCurrentThreadId DeleteCriticalSection CreateFileA VirtualQuery GetModuleFileNameA GetProcAddress GetModuleHandleW GetCurrentProcessId LeaveCriticalSection EnterCriticalSection ProcessIdToSessionId GetSystemTime GetVersionExW QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent InitializeSListHead |
| MSVCP140.dll |
?_Xlength_error@std@@YAXPBD@Z
|
| VCRUNTIME140.dll |
_CxxThrowException
__std_type_info_destroy_list memset strstr __std_exception_destroy strchr strrchr __CxxFrameHandler3 _except_handler4_common __std_exception_copy memcpy memmove |
| api-ms-win-crt-runtime-l1-1-0.dll |
_invalid_parameter_noinfo
_errno _invalid_parameter_noinfo_noreturn _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit terminate |
| api-ms-win-crt-stdio-l1-1-0.dll |
__stdio_common_vsprintf_s
__stdio_common_vsprintf |
| api-ms-win-crt-string-l1-1-0.dll |
strcpy_s
|
| api-ms-win-crt-heap-l1-1-0.dll |
malloc
free _callnewh |
| Ordinal | 1 |
|---|---|
| Address | 0x3db0 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 23.5.0.23 |
| ProductVersion | 23.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | English - United States |
| CompanyName | Forcepoint |
| FileDescription | Forcepoint Neo Endpoint component |
| FileVersion (#2) | 23.05.0.23 |
| InternalName | fpneotrust.dll |
| LegalCopyright | Copyright (c) 2022 Forcepoint LLC. All rights reserved. |
| OriginalFilename | fpneotrust.dll |
| ProductName | Forcepoint Neo Endpoint |
| ProductVersion (#2) | 23.05.0.23 |
| Resource LangID | UNKNOWN |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Sep-12 12:29:43 |
| Version | 0.0 |
| SizeofData | 103 |
| AddressOfRawData | 0xc818 |
| PointerToRawData | 0xb618 |
| Referenced File | C:\jenkins\workspace\TRUNK_23-05-GA\Root\temp\Release.Win32\bin\fpneotrust.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Sep-12 12:29:43 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0xc880 |
| PointerToRawData | 0xb680 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Sep-12 12:29:43 |
| Version | 0.0 |
| SizeofData | 812 |
| AddressOfRawData | 0xc894 |
| PointerToRawData | 0xb694 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Sep-12 12:29:43 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x1000cbd0 |
|---|---|
| EndAddressOfRawData | 0x1000cbd8 |
| AddressOfIndex | 0x1000f4f8 |
| AddressOfCallbacks | 0x1000b1cc |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0xa0 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1000f008 |
| SEHandlerTable | 0x1000c780 |
| SEHandlerCount | 38 |
| GuardCFCheckFunctionPointer | 268480932 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0xcfbb3548 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 10 |
| C++ objects (VS 2015/2017 runtime 26706) | 21 |
| C objects (VS 2015/2017 runtime 26706) | 10 |
| ASM objects (VS 2015/2017 runtime 26706) | 3 |
| Imports (VS 2015/2017 runtime 26706) | 4 |
| Imports (26213) | 8 |
| Imports (27049) | 3 |
| Total imports | 144 |
| C++ objects (LTCG) (27049) | 15 |
| Exports (27049) | 1 |
| Resource objects (27049) | 1 |
| 151 | 1 |
| Linker (27049) | 1 |
No comments yet.