cleaner_pack[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

cleaner_pack.rar
Size

10.1MB
MD5

1d9809ebcaa86bfbe60316968132be89
SHA1

6e18392f62837b639141b6b8b01c3f6e295f9815
SHA256

64acf4b3c9d4cfb47d8b6a7359ec644ceace487160f4047a4d6ec8347b9e0d7f
SHA512

94a5eaaf202471592bbb328c94e7e801886db17e715594ead0df95b66b99c6377bf009f1d8d25c2bb9f9a27061a60506758054369b55a5702c1d9496baa2a484
SSDEEP

196608:m7kU3tvc67jClUakWyJ/1lahROhvmE+41akmatDqz:XU3267OuN/Tld+E+48km0G

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/1.exe	themida

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1.exe
unpack001/2.exe
unpack001/5.exe

Files

cleaner_pack.rar
.rar
1.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 54KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
10.bat
2.exe
.exe windows:6 windows x64 arch:x64

037d369873ea530cbbc956f94671bde1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetConsoleTitleA
GetStdHandle
WaitForSingleObject
Sleep
DeleteFileW
CloseHandle
SetConsoleTextAttribute
IsDebuggerPresent
GetExitCodeProcess
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetConsoleScreenBufferInfo
GetConsoleWindow
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
IsProcessorFeaturePresent
InitializeSListHead

user32

GetWindowLongA
SetWindowLongA
SetWindowPos

advapi32

GetUserNameW
RegDeleteKeyA

shell32

ShellExecuteExA

msvcp140

?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__current_exception_context
__std_exception_copy
memset
__std_exception_destroy
__current_exception
__C_specific_handler
memcmp
__std_terminate
memcpy
memmove

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
system
_invalid_parameter_noinfo_noreturn
terminate
_errno
_initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

fread
_set_fmode
fsetpos
ungetc
fputc
fflush
setvbuf
fgetpos
__stdio_common_vsprintf
fclose
fwrite
_fseeki64
__p__commode
fgetc
_get_stream_buffer_pointers

api-ms-win-crt-math-l1-1-0

_dclass
_dsign
__setusermatherr

api-ms-win-crt-convert-l1-1-0

strtoull
strtod
strtoll

api-ms-win-crt-filesystem-l1-1-0

remove
_stat64i32
_lock_file
_unlock_file

api-ms-win-crt-time-l1-1-0

_time64
_localtime64
strftime

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh
free
_set_new_mode
malloc

Sections

.text
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 356B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
3.bat
4.bat
.bat .vbs
5.exe
.exe windows:6 windows x64 arch:x64

7b88ea406f78e93a5f0afe04a05eebfd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

RtlLookupFunctionEntry
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

RegSetValueExW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove

api-ms-win-crt-runtime-l1-1-0

__p___argv

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

user32

CharUpperBuffW

Exports

Exports

��Ղ�˪a"Lr�y9��b��Xq�*�;}6�V~�G��YP��o�(g��(C|�Ĭ��O��m6lp��y`��XJ.E��ҽ��x��iB��m��cO��fvV�I��w�c�1��4��e��X�J��7x��jL�]e��@��W��|��\_3Ź�� \�5�+�U�� #��/��y�٢#c��cQ��^��FӥxK��󮳚ډm�e�J묺�L�:�4�i��e�r#D�f*צ��[�컁��>�l8��}[Ξ�h�n��<[��DW%'��Jd��y��kw�1��U��Ł��;3X�دfSKŬ��jGs�GM�ѝ)��@n�h)�E��ϊX)�e��4�1_P�B.0�Ђ�I�wj�[;�g'wp�z��!�K��k6�fS(�DLƎkb��`�Hi�}q� ��`<}Hɼ��AJ��線ş�~��<�r��b-�^=B�ܠ[��e��T:��M�G�ʞt Z+��d��P�G`��*N[W]|��m��N1q$S��AL�y�w�g��'@�_��0��-��ؒr4��uL'h3�0#��&֗��8�X[� ��%��F~ �ȧ5�W߶B��4�R�5p�M�� v?l� }��%H��I"�!�OU��-6$FO��N��gH��)�q�`h;8��m��BHή��u��O�6��n�m��O+��[cd�֞��P��;��D&[j��<��ַ�[!��:M^�0:oUa�f��5�V �V;�*�-kL)CK��OB��֭�(�^kS��=y�n��#��'~��:�-)ᣐ}Gpr��gw�1 |�A��S��!#��?��mS�� ' ��P=7ޒ��;4��M��A��rz!�~� .�O��B�<��n��[��O�$��[]��@�f��B=�5v�Gϰ��ZDJ6P�Ͱ�JI� #ix��-�f�w�[�� j@g�-&��w�!N�Y�V�wo��\ u��)"O��V\Q��"��w��ֶ��U<Q@��̨a�j;I֍m��k��k�cr &xR'� 0�A��b��a��A$t�l��si��|��pQ~&v{��X�5L_�lQX��s��<�Q IBx��;�o�#�C��9f(��[O�ǩR��8��Q"�NQ�N |}� �Z��LEP��6�\|y��Ᏺ�il�c��;j��r�McY�=C8Kh��x� �k�d��~�� jԑ��(ǹndd$�݀��޺��~ r��?��s.��6l�߂�/Җ��Ջ-�b?*O�Y\v&��Ti2؅�D��[g_�?�� N��)��F�JW��=B�Ż�+��UP��(E4^��=3%�)��=w8��=�)U�e0 �k�xP�_.yĺ�8i$?K[�'!��y,�T��O_Q�AӍ�n��7��<t�5q5L��C�٬��ǚLI�Jv 7څ�7؝��>HTW+�otη<�05*-D�v0�W�m��z�#~�X�E#�I�gjd��N��X�`�}� A#�9��N�B��f tOtdDx~]�)�� [4#Լ�Q��T�-��6|��i��C��e��\E��M�5D�g"&.�[P6�W��0��yYvV�� O�G�{�[��S4�D��@� %�Ia{4��-*B��t� ��t�d��-7"� �,"x�a�.0��Fڅ�`%�'J!Vc�b&%˛�嚡@� �D $x��P/m�y ��r�4<C�Ԩ� ��;�z��m�L��R��;IJmT��,�^��i{�P� �tе�p\��(�J�[h��")z�*;N��+��z��H�aʻv�=![R��Ն��%��#��=��z�#*�fUe��7��;M5A7��ݵ�w�ş.v��[ �2P<,�\��[zO0`;�]�|J{p-N��Xlʡ��//��g��p�v��6��"�yF�l�]ec��&$䤅^��%)��a��3Ɋ�N��eTܚ�l�Y�oBҦ�Yh�� r�y{��-�醎)��˽�!�1�嘑��;!�Y��9��[* ht!wÊ �G��J�#|�Xi��P��Թ��ۄ�l��1�8�#{݃1�\Dйs��X��ʙ?p3x��y4�K"�Te��W�z��aU`Q�C�\QN,��D# ��h;sB��ұ[�ϕ&��ݞ��& �w_J�4x�^l�e� �o+%�H�[H8�|�ND�'�b{�פnJf��"��[d��0��`�޲� ̤K9��P%�J�+fb53��o�Q�,˳^��'W��SM�]5!�!�u��+�ns4��*��¼�~�Z��Pj��߬��M��n gx��)?Ttn �yl�.��37�~�?��5Z�g>��rz�6��m� �:#��1�P4��n}o'�\��c��O2||��pE��NJl�MC��Pz�x�V��#��*�=0��V��?5k;y�?�f��QX�Q�-�U��ە�e��'��)��+7gPoe.8��^�)׃��_�!��bHD�BM��X��򴋵Y.Gp��Y��,F"�|=-�a)�T��h��UZ�p"ݍ?T0Zy2�r��9S� �� /Sz�~��Ɍ8�!;�/��#pC�a��n��C&d��N��1ބ2f�!ة�$o �'�RJ��# �N)�i]Cb�eqU�JK��;J�W��ui��LH�ü�A?�~t#wT�-�`��:kt��/ь��k��d��-�k�[R��c��"�V�U�v~r�S��)��+�%Z��7H\��z��NoT�a$=�C'�9u84)b,MB H��A�Z4d��yXQ��v3�O��P�W�%�D�<��[Nc�*��l�

Sections

.text
Size: - Virtual size: 861KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.(/s
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.I09
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.x3j
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
6.bat
7.bat
.bat .vbs
8.bat
9.bat
.bat .vbs

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

Size: 54KB - Virtual size: 142KB

Size: 12KB - Virtual size: 40KB

Size: 512B - Virtual size: 3KB

Size: 3KB - Virtual size: 4KB

Size: 49KB - Virtual size: 48KB

Size: 512B - Virtual size: 300B

.idata Size: 2KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 49KB - Virtual size: 49KB

.themida Size: - Virtual size: 5.9MB

.boot Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 16B - Virtual size: 4KB

037d369873ea530cbbc956f94671bde1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 209KB - Virtual size: 209KB

.rdata Size: 83KB - Virtual size: 83KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 124KB - Virtual size: 123KB

.reloc Size: 512B - Virtual size: 356B

7b88ea406f78e93a5f0afe04a05eebfd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

user32

Exports

Exports

Sections

.text Size: - Virtual size: 861KB

.rdata Size: - Virtual size: 150KB

.data Size: - Virtual size: 1KB

.pdata Size: - Virtual size: 1KB

.(/s Size: - Virtual size: 4.1MB

.I09 Size: 2KB - Virtual size: 2KB

.x3j Size: 6.6MB - Virtual size: 6.6MB

.reloc Size: 512B - Virtual size: 216B

.rsrc Size: 512B - Virtual size: 480B

.idata
Size: 2KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 49KB - Virtual size: 49KB

.themida
Size: - Virtual size: 5.9MB

.boot
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 16B - Virtual size: 4KB

.text
Size: 209KB - Virtual size: 209KB

.rdata
Size: 83KB - Virtual size: 83KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 124KB - Virtual size: 123KB

.reloc
Size: 512B - Virtual size: 356B

.text
Size: - Virtual size: 861KB

.rdata
Size: - Virtual size: 150KB

.data
Size: - Virtual size: 1KB

.pdata
Size: - Virtual size: 1KB

.(/s
Size: - Virtual size: 4.1MB

.I09
Size: 2KB - Virtual size: 2KB

.x3j
Size: 6.6MB - Virtual size: 6.6MB

.reloc
Size: 512B - Virtual size: 216B

.rsrc
Size: 512B - Virtual size: 480B