| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2021-Jul-18 06:52:43 |
| Detected languages |
English - United States
|
| CompanyName | Alexander Blade |
| FileDescription | RDR 2 *.asi plugin loader |
| FileVersion | 1.0.0.2 |
| InternalName | asiloader.dll |
| LegalCopyright | (C) Alexander Blade 2019-2021 |
| OriginalFilename | asiloader.dll |
| ProductName | RDR 2 Asi loader |
| ProductVersion | 1.0.0.2 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | VirusTotal score: 2/72 (Scanned on 2026-02-15 16:25:26) |
APEX:
Malicious
Cynet: Malicious (score: 100) |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2021-Jul-18 06:52:43 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 12.0 |
| SizeOfCode | 0x12a00 |
| SizeOfInitializedData | 0xf600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000003814 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x25000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetSystemDirectoryA
GetProcAddress LoadLibraryA VirtualProtect OutputDebugStringA GetSystemTimeAsFileTime FindFirstFileA FindClose GetModuleFileNameA FindNextFileA GetModuleHandleA EncodePointer DecodePointer IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FlushFileBuffers GetLastError WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode DeleteCriticalSection RtlUnwindEx ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar HeapSize GetStdHandle GetFileType GetStartupInfoW HeapFree CloseHandle HeapAlloc RtlPcToFileHeader RaiseException IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetProcessHeap QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointerEx SetStdHandle WriteConsoleW GetModuleFileNameW LoadLibraryExW HeapReAlloc LCMapStringW GetStringTypeW CreateFileW OutputDebugStringW SetEndOfFile ReadFile ReadConsoleW |
|---|
| Ordinal | 1 |
|---|---|
| Address | 0x1060 |
| Ordinal | 2 |
|---|---|
| Address | 0x1080 |
| Ordinal | 3 |
|---|---|
| Address | 0x10a0 |
| Ordinal | 4 |
|---|---|
| Address | 0x10c0 |
| Ordinal | 5 |
|---|---|
| Address | 0x10e0 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.2 |
| ProductVersion | 1.0.0.2 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | English - United States |
| CompanyName | Alexander Blade |
| FileDescription | RDR 2 *.asi plugin loader |
| FileVersion (#2) | 1.0.0.2 |
| InternalName | asiloader.dll |
| LegalCopyright | (C) Alexander Blade 2019-2021 |
| OriginalFilename | asiloader.dll |
| ProductName | RDR 2 Asi loader |
| ProductVersion (#2) | 1.0.0.2 |
| Resource LangID | English - United States |
|---|
| Size | 0x70 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x18001e000 |
| XOR Key | 0x1bf2192 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (20806) | 48 |
| C objects (20806) | 122 |
| ASM objects (20806) | 12 |
| Imports (65501) | 3 |
| Total imports | 91 |
| 229 (VS2013 UPD3 build 30723) | 4 |
| Exports (VS2013 UPD3 build 30723) | 1 |
| Resource objects (VS2013 build 21005) | 1 |
| 151 | 1 |
| Linker (VS2013 UPD3 build 30723) | 1 |