4x[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4x.rar
Size

10.9MB
MD5

af8a76c4fd70a264f09826cb38804dec
SHA1

1900cd97edb4d363a1edfff85d73768dc79b596a
SHA256

1c36f1d0976543d952f6e5a82cfd7b7009d51b1890b2738c7c0185b28e50acb2
SHA512

0a7599f9ba4e8e371d9fd4595cc1e900d9c02a75c59ff9d7ad9d99fc30ca54d5c4dec39439b748bd80927c280416a779b4cefdca1a060cc6c9ad3499595747a5
SSDEEP

196608:UhOzi4mCA0v+qF9gBXiVSb+lYIVKbLf95Fjel+5NDcSZmjaMAZ/Ivolneb:UCmCVv+qPyX/e89LjH5NDcS4aZgaW

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/个人简历-刘文兵-hunan.com.vir
unpack001/中国人民银行数字货币研究所2024年全年放假安排时间表.exe.vir

Files

4x.rar
.rar
个人简历-刘文兵-hunan.com.vir
.exe windows:6 windows x64

f0ea7b7844bbc5bfa9bb32efdcea957c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 266KB - Virtual size: 677KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 295B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 864KB - Virtual size: 864KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/32
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/46
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/65
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/90
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
中国人民银行数字货币研究所2024年全年放假安排时间表.exe.vir
.exe windows:6 windows x64

a428014aa5dbde1e1f23e31e1c2c5176

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

socket
__WSAFDIsSet
select
accept
WSAIoctl
bind
setsockopt
getsockname
htonl
listen
recv
WSACleanup
getaddrinfo
WSAStartup
freeaddrinfo
WSASetLastError
ntohs
WSAGetLastError
recvfrom
getsockopt
closesocket
sendto
getpeername
WSAWaitForMultipleEvents
ioctlsocket
WSAResetEvent
gethostname
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
htons
connect

wldap32

ord60
ord211
ord46
ord200
ord143
ord50
ord41
ord30
ord301
ord217
ord22
ord26
ord27
ord32
ord33
ord35
ord45
ord79

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

normaliz

IdnToAscii

kernel32

RtlPcToFileHeader
TryAcquireSRWLockExclusive
InitializeSRWLock
ResetEvent
CreateEventW
GetCurrentThread
RaiseException
FreeLibraryAndExitThread
LoadLibraryExW
DuplicateHandle
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RegisterWaitForSingleObject
SignalObjectAndWait
GetThreadPriority
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
EncodePointer
DecodePointer
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
GetThreadTimes
FreeLibraryWhenCallbackReturns
CreateTimerQueue
CloseHandle
AddVectoredExceptionHandler
WaitForSingleObject
Sleep
GetCurrentProcess
CreateThread
VirtualProtect
VirtualFree
GetModuleHandleA
GetProcAddress
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SetLastError
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
SleepEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
DeleteFileA
GetTempPathA
GetTempFileNameA
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetExitCodeProcess
GetFileAttributesExA
LockFileEx
UnlockFileEx
LoadLibraryW
FindClose
FindFirstFileExA
FindNextFileA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExA
DebugBreak
ReleaseSemaphore
LocalFree
FormatMessageA
CreateSemaphoreA
InitializeCriticalSection
SwitchToThread
lstrcmpA
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventA
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemInfo
ExitProcess
SetFilePointer
WriteFile
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
SetThreadPriority
VirtualAlloc
GetVersionExW
UnregisterWait
SetThreadAffinityMask
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
InitializeCriticalSectionEx
CloseThreadpoolWait
GetProcessAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
DeleteTimerQueueTimer

user32

MessageBoxA

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA

shlwapi

PathIsDirectoryA

bcrypt

BCryptGenRandom

vcruntime140

strchr
strrchr
memchr
strstr
__C_specific_handler
__current_exception
memmove
__RTDynamicCast
longjmp
__std_type_info_compare
__uncaught_exception
__AdjustPointer
__intrinsic_setjmp
memcpy
memcmp
memset
_purecall
__std_exception_destroy
__std_exception_copy
_CxxThrowException
__current_exception_context
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

__p___argv
_cexit
__sys_nerr
__p___argc
_c_exit
__sys_errlist
_register_thread_local_exe_atexit_callback
_beginthreadex
_register_onexit_function
_errno
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
strerror
terminate
_initialize_onexit_table
abort
_crt_atexit
set_terminate

api-ms-win-crt-math-l1-1-0

logf
sqrt
_fdopen
log10
pow
cosf
floorf
frexp
ceil
__setusermatherr
powf
exp
log
cos
sin
ldexp
ceilf
floor
atan2

api-ms-win-crt-heap-l1-1-0

malloc
realloc
free
calloc
_callnewh
_set_new_mode
_aligned_free
_aligned_malloc

api-ms-win-crt-convert-l1-1-0

strtoull
strtoll
wcstombs
atoi
atoll
strtoul
strtol
atof

api-ms-win-crt-stdio-l1-1-0

_close
_fileno
_write
_read
_lseeki64
_wfsopen
_set_fmode
fgets
_ftelli64
ferror
_open
__stdio_common_vsprintf
fputc
fflush
__p__commode
__stdio_common_vsscanf
ftell
__stdio_common_vsnprintf_s
feof
ungetc
setvbuf
fputs
_fseeki64
fseek
fread
fsetpos
fgetpos
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
__stdio_common_vfprintf
fwrite
fopen
fgetc
fclose
fopen_s
__acrt_iob_func
_fsopen

api-ms-win-crt-filesystem-l1-1-0

_unlink
_rmdir
_access
_stat64
_unlock_file
_lock_file
_mkdir
_fstat64
remove

api-ms-win-crt-string-l1-1-0

strncpy
toupper
strpbrk
strcmp
strspn
isalnum
tolower
isdigit
isspace
_wcsdup
__strncnt
islower
isupper
strcspn
_strdup
strncpy_s
strncmp

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
___lc_locale_name_func
__pctype_func
setlocale
_unlock_locales
_lock_locales
localeconv
_configthreadlocale
___mb_cur_max_func

api-ms-win-crt-utility-l1-1-0

bsearch
rand
qsort

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64
strftime

api-ms-win-crt-environment-l1-1-0

getenv
getenv_s

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 590KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
公司名单.vbe.vir
.jse
朱凌晖体检个人信息.exe.vir
.exe windows:6 windows x64

b173d3149576fbf958e6d478601ba19d

Code Sign

02:0e:b5:27:ba:c0:10:99:59:3e:2e:a9:02:e3:97:cb
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/07/2018, 00:00

Not After

15/07/2021, 12:00

Subject

CN=Hangzhou Infogo Tech Co.\, Ltd.,O=Hangzhou Infogo Tech Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:d8:ee:5b:ac:f2:b6:1a:b5:c0:58:b5:69:f2:6b:31:cf:27:f2:ee
Signer

Actual PE Digest

f9:d8:ee:5b:ac:f2:b6:1a:b5:c0:58:b5:69:f2:6b:31:cf:27:f2:ee

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetConsoleMode
GetTempPathA
CreateFileA
SetConsoleMode
ExitProcess
CreateProcessA
GetComputerNameA
WriteFile
CloseHandle
GetStdHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
GetFileType
HeapAlloc
HeapFree
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
CreateFileW
HeapSize
HeapReAlloc
WriteConsoleW

advapi32

SystemFunction036
GetUserNameA

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pTls
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0ea7b7844bbc5bfa9bb32efdcea957c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 6.5MB - Virtual size: 6.5MB

.rdata Size: 8.5MB - Virtual size: 8.5MB

.data Size: 266KB - Virtual size: 677KB

/4 Size: 512B - Virtual size: 295B

/19 Size: 864KB - Virtual size: 864KB

/32 Size: 193KB - Virtual size: 193KB

/46 Size: 512B - Virtual size: 48B

/65 Size: 1.5MB - Virtual size: 1.5MB

/78 Size: 1.1MB - Virtual size: 1.1MB

/90 Size: 263KB - Virtual size: 263KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 107KB - Virtual size: 106KB

.symtab Size: 1.2MB - Virtual size: 1.2MB

a428014aa5dbde1e1f23e31e1c2c5176

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

crypt32

normaliz

kernel32

user32

advapi32

shlwapi

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 73KB - Virtual size: 590KB

.pdata Size: 139KB - Virtual size: 139KB

.rsrc Size: 169KB - Virtual size: 169KB

.reloc Size: 19KB - Virtual size: 18KB

b173d3149576fbf958e6d478601ba19d

Code Sign

02:0e:b5:27:ba:c0:10:99:59:3e:2e:a9:02:e3:97:cbCertificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

f9:d8:ee:5b:ac:f2:b6:1a:b5:c0:58:b5:69:f2:6b:31:cf:27:f2:eeSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 127KB - Virtual size: 127KB

.rdata Size: 74KB - Virtual size: 73KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 6KB - Virtual size: 5KB

_RDATA Size: 512B - Virtual size: 252B

.text
Size: 6.5MB - Virtual size: 6.5MB

.rdata
Size: 8.5MB - Virtual size: 8.5MB

.data
Size: 266KB - Virtual size: 677KB

/4
Size: 512B - Virtual size: 295B

/19
Size: 864KB - Virtual size: 864KB

/32
Size: 193KB - Virtual size: 193KB

/46
Size: 512B - Virtual size: 48B

/65
Size: 1.5MB - Virtual size: 1.5MB

/78
Size: 1.1MB - Virtual size: 1.1MB

/90
Size: 263KB - Virtual size: 263KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 107KB - Virtual size: 106KB

.symtab
Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 73KB - Virtual size: 590KB

.pdata
Size: 139KB - Virtual size: 139KB

.rsrc
Size: 169KB - Virtual size: 169KB

.reloc
Size: 19KB - Virtual size: 18KB

02:0e:b5:27:ba:c0:10:99:59:3e:2e:a9:02:e3:97:cb
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

f9:d8:ee:5b:ac:f2:b6:1a:b5:c0:58:b5:69:f2:6b:31:cf:27:f2:ee
Signer

.text
Size: 127KB - Virtual size: 127KB

.rdata
Size: 74KB - Virtual size: 73KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 6KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 1KB

.pTls
Size: 1.2MB - Virtual size: 1.2MB