f6bdc8ffd172b44f4d169707d9a457aeef619872661229b8629ee4f15eefff0d

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2016-Mar-29 05:21:31
Detected languages English - United States
Debug artifacts api-ms-win-core-console-l1-1-0.pdb
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.10586.212 (th2_release_sec.160328-1908)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.10586.212

Plugin Output

Suspicious The PE is possibly packed. The PE only has 0 import(s).
Info The PE is digitally signed. Signer: Microsoft Corporation
Issuer: Microsoft Code Signing PCA
Safe VirusTotal score: 0/72 (Scanned on 2026-03-25 20:44:39) All the AVs think this file is safe.

Hashes

MD5 11e55839fcb3a53bdfed2a27fb7d5e80
SHA1 e585a1ed88696cd310c12f91ffa27f17f354b4f4
SHA256 f6bdc8ffd172b44f4d169707d9a457aeef619872661229b8629ee4f15eefff0d
SHA3 39bbd4b56fc6b67b748d45ad58e6fb34d8b4a8438fa15608003badd0503eda3c
SSDeep 192:0IO5WMuXhWWpO5A9YOCAs/nGfe4pBjS7oT13iWYyieHaVWQ4SWJvaqnajnR5fXFy:0BW7hWv57A0GftpBjbxIg6ECl9OIVnO
Imports Hash d41d8cd98f00b204e9800998ecf8427e

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 2
TimeDateStamp 2016-Mar-29 05:21:31
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 12.0
SizeOfCode 0x600
SizeOfInitializedData 0x400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000 (Section: ?)
BaseOfCode 0x1000
BaseOfData 0x2000
ImageBase 0x10000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion A.0
ImageVersion A.0
SubsystemVersion A.0
Win32VersionValue 0
SizeOfImage 0x3000
SizeOfHeaders 0x400
Checksum 0x135c4
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x40000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 b37c197a1c7eca7ae5f9932632414020
SHA1 afe663144f8bfb09ba48ac4b170cb80b2bb09ffa
SHA256 bf21e6d08911051ff865228cb8b205337b61885de9ca9e8c3da78ddb6fb1e59f
SHA3 ec291d74f6749f61c1085bbf05b7d491670466246d530b1a4618a8f494b7ff96
VirtualSize 0x43b
VirtualAddress 0x1000
SizeOfRawData 0x600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 3.83391

.rsrc

MD5 995b3a4d152ea8e3bbb3c2b1fb30e2cc
SHA1 e1d9d24ce25569c3bf38a5cdb3513023cab0c58f
SHA256 03f217599a4ab4b4a0ae968e29be4ac50ff85c5774489de963b78bc18a302fab
SHA3 d067b3a09e898154c8d0d48886eaa6896e7fece0861ae5e782a3bc678db28f54
VirtualSize 0x400
VirtualAddress 0x2000
SizeOfRawData 0x400
PointerToRawData 0xa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.36169

Imports

Delayed Imports

AllocConsole

Ordinal 1
Address 0x11f4
ForwardName kernel32.AllocConsole

GetConsoleCP

Ordinal 2
Address 0x1217
ForwardName kernel32.GetConsoleCP

GetConsoleMode

Ordinal 3
Address 0x123c
ForwardName kernel32.GetConsoleMode

GetConsoleOutputCP

Ordinal 4
Address 0x1267
ForwardName kernel32.GetConsoleOutputCP

GetNumberOfConsoleInputEvents

Ordinal 5
Address 0x12a1
ForwardName kernel32.GetNumberOfConsoleInputEvents

PeekConsoleInputA

Ordinal 6
Address 0x12da
ForwardName kernel32.PeekConsoleInputA

ReadConsoleA

Ordinal 7
Address 0x1302
ForwardName kernel32.ReadConsoleA

ReadConsoleInputA

Ordinal 8
Address 0x132a
ForwardName kernel32.ReadConsoleInputA

ReadConsoleInputW

Ordinal 9
Address 0x1357
ForwardName kernel32.ReadConsoleInputW

ReadConsoleW

Ordinal 10
Address 0x137f
ForwardName kernel32.ReadConsoleW

SetConsoleCtrlHandler

Ordinal 11
Address 0x13ab
ForwardName kernel32.SetConsoleCtrlHandler

SetConsoleMode

Ordinal 12
Address 0x13d9
ForwardName kernel32.SetConsoleMode

WriteConsoleA

Ordinal 13
Address 0x13ff
ForwardName kernel32.WriteConsoleA

WriteConsoleW

Ordinal 14
Address 0x1424
ForwardName kernel32.WriteConsoleW

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x39c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.50561
MD5 4df2cd5641a5096c870ec4f4236d4e1c
SHA1 14bacb03934d459e8e145860bb0f1ba0fa8c663f
SHA256 e32bd72cf22a6cdc322ab0a6d23158c47f5b5aaef6f764b814dfd59def148c9c
SHA3 e28cc98ba0355cdcd31cc1e0a4185496b3fc698a838c1b146e3b464712789112

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 10.0.10586.212
ProductVersion 10.0.10586.212
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_DLL
Language English - United States
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion (#2) 10.0.10586.212 (th2_release_sec.160328-1908)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion (#2) 10.0.10586.212
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2016-Mar-29 05:21:31
Version 0.0
SizeofData 59
AddressOfRawData 0x1054
PointerToRawData 0x454
Referenced File api-ms-win-core-console-l1-1-0.pdb

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2016-Mar-29 05:21:31
Version 0.0
SizeofData 100
AddressOfRawData 0x10a4
PointerToRawData 0x4a4

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x91b35329
Unmarked objects 0
238 (40116) 1
242 (40116) 2
Imports (40116) 1
240 (40116) 1

Errors

Leave a comment

No comments yet.