54edee5ea082f94c7cf4db3f58517a42

Sharing

Copy URL Twitter E-mail

General

Target

54edee5ea082f94c7cf4db3f58517a42
Size

2.7MB
MD5

54edee5ea082f94c7cf4db3f58517a42
SHA1

6b637a924709e554f2b699250eb579f90452aa97
SHA256

4b230cdb5ae56c9a18da0d9366da4bdaca0f22a36e9b37f92a27d7270617526a
SHA512

26f773ef214be8a194e46af31606dbe5eb3968353d234e33e52b6c0dedfa827a1fbac8afa4a8215e77fb4f4b89bc416e248812dc6c85c882176a02785906fada
SSDEEP

49152:q+0BlEyXn4bFjvNE+Fsdody54MFctJHHsD/YUABBOTCBv9zjXD5YD2vJ:LglfobdvNEKsyi9StJHuABBOeJjXD62R

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/hidecon.exe
unpack001/no_ds_pg_www.moguizuofang.com.exe

Files

54edee5ea082f94c7cf4db3f58517a42
.rar
hidecon 用法.txt
hidecon.exe
.exe windows:5 windows x64 arch:x64

7ddf1cdfcc0838091771830f08872347

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtSetValueKey
NtCreateKey
NtLoadDriver
NtFreeVirtualMemory
NtQuerySystemInformation
NtAllocateVirtualMemory
NtDeleteFile
RtlFreeUnicodeString
NtFlushBuffersFile
NtWriteFile
RtlDosPathNameToNtPathName_U
RtlExitUserProcess
NtCreateFile
NtUnloadDriver
RtlInitUnicodeString
NtClose
NtAdjustPrivilegesToken
NtOpenProcessToken

kernel32

CreateFileW
SetStdHandle
SetFilePointer
WriteConsoleW
CloseHandle
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapAlloc
LoadLibraryW
SetConsoleTitleW
GetConsoleScreenBufferInfo
SetConsoleMode
SetConsoleTextAttribute
GetCurrentDirectoryW
DeviceIoControl
RtlUnwindEx
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
TerminateProcess
GetCurrentProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
HeapFree
MultiByteToWideChar
LCMapStringW
GetStringTypeW

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mk_bcdentry 用法howto.txt
mk_bcdentry 说明.txt
mk_bcdentry.cmd
.cmd .vbs
no_ds_pg_www.moguizuofang.com.exe
.exe windows:4 windows x86 arch:x86

68d27cc89024d4b6cc658663ff9bf9ac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TrackPopupMenu
ShowWindow
SetWindowTextA
SetWindowRgn
SetWindowPos
UpdateWindow
SetTimer
SetFocus
SetDlgItemTextA
SetClassLongA
SetCapture
SendMessageA
SetWindowLongA
ReleaseCapture
RegisterClassExA
RedrawWindow
PtInRect
OffsetRect
MessageBoxA
LoadStringA
LoadIconA
LoadCursorA
LoadBitmapA
IsDlgButtonChecked
InvalidateRect
IntersectRect
GetWindowRect
GetWindowLongA
GetSystemMetrics
GetParent
GetKeyState
CloseClipboard
EmptyClipboard
OpenClipboard
SetClipboardData
GetClientRect
MoveWindow
GetDlgItemTextA
GetDlgItem
GetDlgCtrlID
GetDC
GetCursorPos
GetCapture
GetActiveWindow
EndDialog
EnableWindow
DrawTextA
DialogBoxParamA
DefWindowProcA
CreateWindowExA
CreatePopupMenu
CheckDlgButton
CallWindowProcA
AppendMenuA

kernel32

FindFirstFileA
GetStdHandle
WriteFile
FlushFileBuffers
CompareStringA
CreateDirectoryA
GlobalAlloc
GlobalLock
GlobalUnlock
FindClose
lstrlenW
lstrlenA
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
WideCharToMultiByte
WaitForSingleObject
VirtualFree
VirtualAlloc
UnmapViewOfFile
Sleep
SizeofResource
AttachConsole
CloseHandle
CopyFileA
CreateFileA
CreateFileMappingA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindResourceA
FreeLibrary
GetCommandLineA
GetCurrentDirectoryA
GetFileAttributesA
GetFileSize
GetFileTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
MapViewOfFile
MoveFileA
MultiByteToWideChar
RtlMoveMemory
RtlZeroMemory
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetFileAttributesA
SetFilePointer
SetFileTime

shell32

ShellExecuteA

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectA
CreateSolidBrush
ExtCreateRegion
GetStockObject
GetTextExtentPointA
RemoveFontResourceA
TextOutA
SetTextColor
SetBkMode
SetBkColor
SelectObject
RoundRect
AddFontResourceA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

comdlg32

GetOpenFileNameA
GetSaveFileNameA

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 266KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ntkrnlmp.exe
.sys windows:6 windows x64 arch:x64

2c723a1332a24f95e11cd6c7fb71068a

Code Sign

61:04:b3:f5:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:13

Not After

25/07/2011, 19:23

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:03:05:56:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14/02/2011, 21:11

Not After

14/05/2012, 21:11

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

f0:d4:61:14:3b:9e:47:bf:12:a8:4d:3e:44:25:56:40:8b:d3:18:8b
Signer

Actual PE Digest

f0:d4:61:14:3b:9e:47:bf:12:a8:4d:3e:44:25:56:40:8b:d3:18:8b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

pshed

PshedEnableErrorSource
PshedSetErrorSourceInfo
PshedDisableErrorSource
PshedGetInjectionCapabilities
PshedInjectError
PshedFinalizeErrorRecord
PshedBugCheckSystem
PshedAttemptErrorRecovery
PshedWriteErrorRecord
PshedFreeMemory
PshedClearErrorRecord
PshedIsSystemWheaEnabled
PshedInitialize
PshedReadErrorRecord
PshedAllocateMemory
PshedGetBootErrorPacket
PshedGetAllErrorSources

hal

HalIsHyperThreadingEnabled
HalEnumerateProcessors
HalQueryMaximumProcessorCount
HalStartNextProcessor
HalRegisterDynamicProcessor
HalStartDynamicProcessor
HalInitializeProcessor
HalSendSoftwareInterrupt
HalCalibratePerformanceCounter
KeStallExecutionProcessor
HalEnableInterrupt
HalRequestClockInterrupt
HalSetProfileInterval
HalStartProfileInterrupt
HalStopProfileInterrupt
HalHandleNMI
HalPerformEndOfInterrupt
HalRequestSoftwareInterrupt
HalHandleMcheck
HalRequestIpi
HalDisableInterrupt
KeFlushWriteBuffer
HalGetInterruptTargetInformation
HalInitializeOnResume
HalProcessorIdle
HalAllocateCrashDumpRegisters
HalSetTimeIncrement
HalGetEnvironmentVariable
HalSetEnvironmentVariable
HalGetEnvironmentVariableEx
HalSetEnvironmentVariableEx
HalEnumerateEnvironmentVariablesEx
HalQueryEnvironmentVariableInfoEx
HalSetRealTimeClock
HalSetBusDataByOffset
HalGetBusDataByOffset
HalReturnToFirmware
HalGetProcessorIdByNtNumber
HalTranslateBusAddress
HalGetMessageRoutingInfo
HalGetVectorInput
HalRegisterErrataCallbacks
KeQueryPerformanceCounter
HalRequestDeferredRecoveryServiceInterrupt
HalAllProcessorsStarted
HalInitSystem
HalQueryRealTimeClock
HalInitializeBios
HalReportResourceUsage
HalSendNMI

kdcom

KdD3Transition
KdD0Transition
KdReceivePacket
KdSendPacket
KdRestore
KdSave
KdDebuggerInitialize0
KdDebuggerInitialize1

clfs.sys

ClfsAdvanceLogBase
ClfsMgmtTailAdvanceFailure
ClfsPrivGetBaseLogFileFromFileObjectPointer
ClfsMgmtHandleLogFileFull
ClfsLsnGreater
ClfsReserveAndAppendLogAligned
ClfsMgmtSetLogFileSize
ClfsLsnDifference
ClfsAddLogContainer
ClfsCreateMarshallingArea
ClfsLsnLess
ClfsLsnContainer
ClfsFlushToLsn
ClfsLsnInvalid
ClfsGetLogFileInformation
ClfsMgmtDeregisterManagedClient
ClfsCloseLogFileObject
ClfsMgmtInstallPolicy
ClfsMgmtRegisterManagedClient
ClfsCreateLogFile
CLFS_LSN_INVALID
ClfsLsnEqual
ClfsReadLogRecord
ClfsReadNextLogRecord
ClfsTerminateReadLog
ClfsWriteRestartArea
ClfsDeleteLogByPointer
ClfsDeleteMarshallingArea
CLFS_LSN_NULL
ClfsReserveAndAppendLog
ClfsReadRestartArea

ci

CiInitialize

Exports

Exports

AlpcGetHeaderSize
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
CcCanIWrite
CcCoherencyFlushAndPurgeCache
CcCopyRead
CcCopyWrite
CcCopyWriteWontFlush
CcDeferWrite
CcFastCopyRead
CcFastCopyWrite
CcFastMdlReadWait
CcFlushCache
CcGetDirtyPages
CcGetFileObjectFromBcb
CcGetFileObjectFromSectionPtrs
CcGetFileObjectFromSectionPtrsRef
CcGetFlushedValidData
CcGetLsnForFileObject
CcInitializeCacheMap
CcIsThereDirtyData
CcIsThereDirtyDataEx
CcMapData
CcMdlRead
CcMdlReadComplete
CcMdlWriteAbort
CcMdlWriteComplete
CcPinMappedData
CcPinRead
CcPrepareMdlWrite
CcPreparePinWrite
CcPurgeCacheSection
CcRemapBcb
CcRepinBcb
CcScheduleReadAhead
CcSetAdditionalCacheAttributes
CcSetBcbOwnerPointer
CcSetDirtyPageThreshold
CcSetDirtyPinnedData
CcSetFileSizes
CcSetFileSizesEx
CcSetLogHandleForFile
CcSetParallelFlushFile
CcSetReadAheadGranularity
CcTestControl
CcUninitializeCacheMap
CcUnpinData
CcUnpinDataForThread
CcUnpinRepinnedBcb
CcWaitForCurrentLazyWriterActivity
CcZeroData
CmCallbackGetKeyObjectID
CmGetBoundTransaction
CmGetCallbackVersion
CmKeyObjectType
CmRegisterCallback
CmRegisterCallbackEx
CmSetCallbackObjectContext
CmUnRegisterCallback
DbgBreakPoint
DbgBreakPointWithStatus
DbgCommandString
DbgLoadImageSymbols
DbgPrint
DbgPrintEx
DbgPrintReturnControlC
DbgPrompt
DbgQueryDebugFilterState
DbgSetDebugFilterState
DbgSetDebugPrintCallback
DbgkLkmdRegisterCallback
DbgkLkmdUnregisterCallback
EmClientQueryRuleState
EmClientRuleDeregisterNotification
EmClientRuleEvaluate
EmClientRuleRegisterNotification
EmProviderDeregister
EmProviderDeregisterEntry
EmProviderRegister
EmProviderRegisterEntry
EmpProviderRegister
EtwActivityIdControl
EtwEnableTrace
EtwEventEnabled
EtwProviderEnabled
EtwRegister
EtwRegisterClassicProvider
EtwSendTraceBuffer
EtwUnregister
EtwWrite
EtwWriteEndScenario
EtwWriteEx
EtwWriteStartScenario
EtwWriteString
EtwWriteTransfer
ExAcquireCacheAwarePushLockExclusive
ExAcquireFastMutex
ExAcquireFastMutexUnsafe
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExAcquireRundownProtection
ExAcquireRundownProtectionCacheAware
ExAcquireRundownProtectionCacheAwareEx
ExAcquireRundownProtectionEx
ExAcquireSharedStarveExclusive
ExAcquireSharedWaitForExclusive
ExAcquireSpinLockExclusive
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockShared
ExAcquireSpinLockSharedAtDpcLevel
ExAllocateCacheAwarePushLock
ExAllocateCacheAwareRundownProtection
ExAllocatePool
ExAllocatePoolWithQuota
ExAllocatePoolWithQuotaTag
ExAllocatePoolWithTag
ExAllocatePoolWithTagPriority
ExConvertExclusiveToSharedLite
ExCreateCallback
ExDeleteLookasideListEx
ExDeleteNPagedLookasideList
ExDeletePagedLookasideList
ExDeleteResourceLite
ExDesktopObjectType
ExDisableResourceBoostLite
ExEnterCriticalRegionAndAcquireFastMutexUnsafe
ExEnterCriticalRegionAndAcquireResourceExclusive
ExEnterCriticalRegionAndAcquireResourceShared
ExEnterCriticalRegionAndAcquireSharedWaitForExclusive
ExEnterPriorityRegionAndAcquireResourceExclusive
ExEnterPriorityRegionAndAcquireResourceShared
ExEnumHandleTable
ExEventObjectType
ExExtendZone
ExFetchLicenseData
ExFlushLookasideListEx
ExFreeCacheAwarePushLock
ExFreeCacheAwareRundownProtection
ExFreePool
ExFreePoolWithTag
ExGetCurrentProcessorCounts
ExGetCurrentProcessorCpuUsage
ExGetExclusiveWaiterCount
ExGetLicenseTamperState
ExGetPreviousMode
ExGetSharedWaiterCount
ExInitializeLookasideListEx
ExInitializeNPagedLookasideList
ExInitializePagedLookasideList
ExInitializePushLock
ExInitializeResourceLite
ExInitializeRundownProtection
ExInitializeRundownProtectionCacheAware
ExInitializeZone
ExInterlockedAddLargeInteger
ExInterlockedAddUlong
ExInterlockedExtendZone
ExInterlockedInsertHeadList
ExInterlockedInsertTailList
ExInterlockedPopEntryList
ExInterlockedPushEntryList
ExInterlockedRemoveHeadList
ExIsProcessorFeaturePresent
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
ExLocalTimeToSystemTime
ExNotifyCallback
ExQueryAttributeInformation
ExQueryDepthSList
ExQueryPoolBlockSize
ExQueueWorkItem
ExRaiseAccessViolation
ExRaiseDatatypeMisalignment
ExRaiseException
ExRaiseHardError
ExRaiseStatus
ExReInitializeRundownProtection
ExReInitializeRundownProtectionCacheAware
ExRegisterAttributeInformationCallback
ExRegisterCallback
ExRegisterExtension
ExReinitializeResourceLite
ExReleaseCacheAwarePushLockExclusive
ExReleaseFastMutex
ExReleaseFastMutexUnsafe
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
ExReleaseResourceAndLeaveCriticalRegion
ExReleaseResourceAndLeavePriorityRegion
ExReleaseResourceForThreadLite
ExReleaseResourceLite
ExReleaseRundownProtection
ExReleaseRundownProtectionCacheAware
ExReleaseRundownProtectionCacheAwareEx
ExReleaseRundownProtectionEx
ExReleaseSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockShared
ExReleaseSpinLockSharedFromDpcLevel
ExRundownCompleted
ExRundownCompletedCacheAware
ExSemaphoreObjectType
ExSetLicenseTamperState
ExSetResourceOwnerPointer
ExSetResourceOwnerPointerEx
ExSetTimerResolution
ExSizeOfRundownProtectionCacheAware
ExSystemExceptionFilter
ExSystemTimeToLocalTime
ExTryConvertSharedSpinLockExclusive
ExTryToAcquireFastMutex
ExUnregisterAttributeInformationCallback
ExUnregisterCallback
ExUnregisterExtension
ExUpdateLicenseData
ExUuidCreate
ExVerifySuite
ExWaitForRundownProtectionRelease
ExWaitForRundownProtectionReleaseCacheAware
ExWindowStationObjectType
ExfAcquirePushLockExclusive
ExfAcquirePushLockShared
ExfReleasePushLock
ExfReleasePushLockExclusive
ExfReleasePushLockShared
ExfTryAcquirePushLockShared
ExfTryToWakePushLock
ExfUnblockPushLock
ExpInterlockedFlushSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
FirstEntrySList
FsRtlAcknowledgeEcp
FsRtlAcquireFileExclusive
FsRtlAddBaseMcbEntry
FsRtlAddBaseMcbEntryEx
FsRtlAddLargeMcbEntry
FsRtlAddMcbEntry
FsRtlAddToTunnelCache
FsRtlAllocateExtraCreateParameter
FsRtlAllocateExtraCreateParameterFromLookasideList
FsRtlAllocateExtraCreateParameterList
FsRtlAllocateFileLock
FsRtlAllocatePool
FsRtlAllocatePoolWithQuota
FsRtlAllocatePoolWithQuotaTag
FsRtlAllocatePoolWithTag
FsRtlAllocateResource
FsRtlAreNamesEqual
FsRtlAreThereCurrentOrInProgressFileLocks
FsRtlAreVolumeStartupApplicationsComplete
FsRtlBalanceReads
FsRtlCancellableWaitForMultipleObjects
FsRtlCancellableWaitForSingleObject
FsRtlChangeBackingFileObject
FsRtlCheckLockForReadAccess
FsRtlCheckLockForWriteAccess
FsRtlCheckOplock
FsRtlCheckOplockEx
FsRtlCopyRead
FsRtlCopyWrite
FsRtlCreateSectionForDataScan
FsRtlCurrentBatchOplock
FsRtlCurrentOplock
FsRtlCurrentOplockH
FsRtlDeleteExtraCreateParameterLookasideList
FsRtlDeleteKeyFromTunnelCache
FsRtlDeleteTunnelCache
FsRtlDeregisterUncProvider
FsRtlDissectDbcs
FsRtlDissectName
FsRtlDoesDbcsContainWildCards
FsRtlDoesNameContainWildCards
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlFastUnlockSingle
FsRtlFindExtraCreateParameter
FsRtlFindInTunnelCache
FsRtlFreeExtraCreateParameter
FsRtlFreeExtraCreateParameterList
FsRtlFreeFileLock
FsRtlGetEcpListFromIrp
FsRtlGetFileSize
FsRtlGetNextBaseMcbEntry
FsRtlGetNextExtraCreateParameter
FsRtlGetNextFileLock
FsRtlGetNextLargeMcbEntry
FsRtlGetNextMcbEntry
FsRtlGetVirtualDiskNestingLevel
FsRtlIncrementCcFastMdlReadWait
FsRtlIncrementCcFastReadNoWait
FsRtlIncrementCcFastReadNotPossible
FsRtlIncrementCcFastReadResourceMiss
FsRtlIncrementCcFastReadWait
FsRtlInitExtraCreateParameterLookasideList
FsRtlInitializeBaseMcb
FsRtlInitializeBaseMcbEx
FsRtlInitializeExtraCreateParameter
FsRtlInitializeExtraCreateParameterList
FsRtlInitializeFileLock
FsRtlInitializeLargeMcb
FsRtlInitializeMcb
FsRtlInitializeOplock
FsRtlInitializeTunnelCache
FsRtlInsertExtraCreateParameter
FsRtlInsertPerFileContext
FsRtlInsertPerFileObjectContext
FsRtlInsertPerStreamContext
FsRtlIsDbcsInExpression
FsRtlIsEcpAcknowledged
FsRtlIsEcpFromUserMode
FsRtlIsFatDbcsLegal
FsRtlIsHpfsDbcsLegal
FsRtlIsNameInExpression
FsRtlIsNtstatusExpected
FsRtlIsPagingFile
FsRtlIsTotalDeviceFailure
FsRtlLegalAnsiCharacterArray
FsRtlLogCcFlushError
FsRtlLookupBaseMcbEntry
FsRtlLookupLargeMcbEntry
FsRtlLookupLastBaseMcbEntry
FsRtlLookupLastBaseMcbEntryAndIndex
FsRtlLookupLastLargeMcbEntry
FsRtlLookupLastLargeMcbEntryAndIndex
FsRtlLookupLastMcbEntry
FsRtlLookupMcbEntry
FsRtlLookupPerFileContext
FsRtlLookupPerFileObjectContext
FsRtlLookupPerStreamContextInternal
FsRtlMdlRead
FsRtlMdlReadComplete
FsRtlMdlReadCompleteDev
FsRtlMdlReadDev
FsRtlMdlWriteComplete
FsRtlMdlWriteCompleteDev
FsRtlMupGetProviderIdFromName
FsRtlMupGetProviderInfoFromFileObject
FsRtlNormalizeNtstatus
FsRtlNotifyChangeDirectory
FsRtlNotifyCleanup
FsRtlNotifyCleanupAll
FsRtlNotifyFilterChangeDirectory
FsRtlNotifyFilterReportChange
FsRtlNotifyFullChangeDirectory
FsRtlNotifyFullReportChange
FsRtlNotifyInitializeSync
FsRtlNotifyReportChange
FsRtlNotifyUninitializeSync
FsRtlNotifyVolumeEvent
FsRtlNotifyVolumeEventEx
FsRtlNumberOfRunsInBaseMcb
FsRtlNumberOfRunsInLargeMcb
FsRtlNumberOfRunsInMcb
FsRtlOplockBreakH
FsRtlOplockBreakToNone
FsRtlOplockBreakToNoneEx
FsRtlOplockFsctrl
FsRtlOplockFsctrlEx
FsRtlOplockIsFastIoPossible
FsRtlOplockIsSharedRequest
FsRtlOplockKeysEqual
FsRtlPostPagingFileStackOverflow
FsRtlPostStackOverflow
FsRtlPrepareMdlWrite
FsRtlPrepareMdlWriteDev
FsRtlPrivateLock
FsRtlProcessFileLock
FsRtlQueryMaximumVirtualDiskNestingLevel
FsRtlRegisterFileSystemFilterCallbacks
FsRtlRegisterFltMgrCalls
FsRtlRegisterMupCalls
FsRtlRegisterUncProvider
FsRtlRegisterUncProviderEx
FsRtlReleaseFile
FsRtlRemoveBaseMcbEntry
FsRtlRemoveDotsFromPath
FsRtlRemoveExtraCreateParameter
FsRtlRemoveLargeMcbEntry
FsRtlRemoveMcbEntry
FsRtlRemovePerFileContext
FsRtlRemovePerFileObjectContext
FsRtlRemovePerStreamContext
FsRtlResetBaseMcb
FsRtlResetLargeMcb
FsRtlSetEcpListIntoIrp
FsRtlSplitBaseMcb
FsRtlSplitLargeMcb
FsRtlSyncVolumes
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
FsRtlTruncateBaseMcb
FsRtlTruncateLargeMcb
FsRtlTruncateMcb
FsRtlUninitializeBaseMcb
FsRtlUninitializeFileLock
FsRtlUninitializeLargeMcb
FsRtlUninitializeMcb
FsRtlUninitializeOplock
FsRtlValidateReparsePointBuffer
HalDispatchTable
HalExamineMBR
HalPrivateDispatchTable
HeadlessDispatch
HvlQueryConnection
InbvAcquireDisplayOwnership
InbvCheckDisplayOwnership
InbvDisplayString
InbvEnableBootDriver
InbvEnableDisplayString
InbvInstallDisplayStringFilter
InbvIsBootDriverInstalled
InbvNotifyDisplayOwnershipLost
InbvResetDisplay
InbvSetScrollRegion
InbvSetTextColor
InbvSolidColorFill
InitSafeBootMode
InitializeSListHead
IoAcquireCancelSpinLock
IoAcquireRemoveLockEx
IoAcquireVpbSpinLock
IoAdapterObjectType
IoAdjustStackSizeForRedirection
IoAllocateAdapterChannel
IoAllocateController
IoAllocateDriverObjectExtension
IoAllocateErrorLogEntry
IoAllocateIrp
IoAllocateMdl
IoAllocateMiniCompletionPacket
IoAllocateSfioStreamIdentifier
IoAllocateWorkItem
IoApplyPriorityInfoThread
IoAssignResources
IoAttachDevice
IoAttachDeviceByPointer
IoAttachDeviceToDeviceStack
IoAttachDeviceToDeviceStackSafe
IoBuildAsynchronousFsdRequest
IoBuildDeviceIoControlRequest
IoBuildPartialMdl
IoBuildSynchronousFsdRequest
IoCallDriver
IoCancelFileOpen
IoCancelIrp
IoCheckDesiredAccess
IoCheckEaBufferValidity
IoCheckFunctionAccess
IoCheckQuerySetFileInformation
IoCheckQuerySetVolumeInformation
IoCheckQuotaBufferValidity
IoCheckShareAccess
IoCheckShareAccessEx
IoClearDependency
IoClearIrpExtraCreateParameter
IoCompleteRequest
IoConnectInterrupt
IoConnectInterruptEx
IoCreateArcName
IoCreateController
IoCreateDevice
IoCreateDisk
IoCreateDriver
IoCreateFile
IoCreateFileEx
IoCreateFileSpecifyDeviceObjectHint
IoCreateNotificationEvent
IoCreateStreamFileObject
IoCreateStreamFileObjectEx
IoCreateStreamFileObjectLite
IoCreateSymbolicLink
IoCreateSynchronizationEvent
IoCreateUnprotectedSymbolicLink
IoCsqInitialize
IoCsqInitializeEx
IoCsqInsertIrp
IoCsqInsertIrpEx
IoCsqRemoveIrp
IoCsqRemoveNextIrp
IoDeleteAllDependencyRelations
IoDeleteController
IoDeleteDevice
IoDeleteDriver
IoDeleteSymbolicLink
IoDetachDevice
IoDeviceHandlerObjectSize
IoDeviceHandlerObjectType
IoDeviceObjectType
IoDisconnectInterrupt
IoDisconnectInterruptEx
IoDriverObjectType
IoDuplicateDependency
IoEnqueueIrp
IoEnumerateDeviceObjectList
IoEnumerateRegisteredFiltersList
IoFastQueryNetworkAttributes
IoFileObjectType
IoForwardAndCatchIrp

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INITKDBG
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

POOLMI
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

POOLCODE
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RWEXEC
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 587KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ALMOSTRO
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SPINLOCK
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGELK
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEKD
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEVRFY
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEHDLS
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEBGFX
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEVRFB
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 19KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEVRFC
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEVRFD
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 349KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
osloader.exe
.exe windows:0 windows x64 arch:x64

Code Sign

61:04:b3:f5:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:13

Not After

25/07/2011, 19:23

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:15:34:64:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 21:57

Not After

07/03/2011, 21:57

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

66:ba:c9:ae:40:6e:af:54:d3:f3:b8:82:54:a4:c1:9f:45:ee:25:be:7b:6b:e0:3b:09:21:03:75:00:b7:46:74
Signer

Actual PE Digest

66:ba:c9:ae:40:6e:af:54:d3:f3:b8:82:54:a4:c1:9f:45:ee:25:be:7b:6b:e0:3b:09:21:03:75:00:b7:46:74

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Sections

.text
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGER32C
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGER32R
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INITDATA
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEDATA
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ddf1cdfcc0838091771830f08872347

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Sections

.text Size: 47KB - Virtual size: 47KB

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 48KB - Virtual size: 67KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 4KB

68d27cc89024d4b6cc658663ff9bf9ac

Headers

File Characteristics

Imports

user32

kernel32

shell32

gdi32

advapi32

comdlg32

Sections

.text Size: 35KB - Virtual size: 34KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 2KB - Virtual size: 79KB

.rsrc Size: 266KB - Virtual size: 266KB

2c723a1332a24f95e11cd6c7fb71068a

Code Sign

61:04:b3:f5:00:00:00:00:00:0dCertificate

Extended Key Usages

Key Usages

61:03:05:56:00:00:00:00:00:10Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

f0:d4:61:14:3b:9e:47:bf:12:a8:4d:3e:44:25:56:40:8b:d3:18:8bSigner

Headers

File Characteristics

Imports

pshed

hal

kdcom

clfs.sys

ci

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

INITKDBG Size: 14KB - Virtual size: 14KB

POOLMI Size: 7KB - Virtual size: 7KB

POOLCODE Size: 12KB - Virtual size: 11KB

RWEXEC Size: - Virtual size: 4KB

.rdata Size: 246KB - Virtual size: 245KB

.data Size: 63KB - Virtual size: 587KB

.pdata Size: 192KB - Virtual size: 191KB

ALMOSTRO Size: 2KB - Virtual size: 8KB

SPINLOCK Size: 3KB - Virtual size: 7KB

PAGELK Size: 83KB - Virtual size: 83KB

PAGE Size: 2.2MB - Virtual size: 2.2MB

PAGEKD Size: 19KB - Virtual size: 18KB

PAGEVRFY Size: 133KB - Virtual size: 133KB

PAGEHDLS Size: 10KB - Virtual size: 9KB

PAGEBGFX Size: 26KB - Virtual size: 25KB

PAGEVRFB Size: - Virtual size: 13KB

.edata Size: 66KB - Virtual size: 66KB

PAGEDATA Size: 19KB - Virtual size: 55KB

PAGEVRFC Size: 10KB - Virtual size: 10KB

PAGEVRFD Size: 5KB - Virtual size: 4KB

.text
Size: 47KB - Virtual size: 47KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 48KB - Virtual size: 67KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 4KB

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 79KB

.rsrc
Size: 266KB - Virtual size: 266KB

61:04:b3:f5:00:00:00:00:00:0d
Certificate

61:03:05:56:00:00:00:00:00:10
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

f0:d4:61:14:3b:9e:47:bf:12:a8:4d:3e:44:25:56:40:8b:d3:18:8b
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

INITKDBG
Size: 14KB - Virtual size: 14KB

POOLMI
Size: 7KB - Virtual size: 7KB

POOLCODE
Size: 12KB - Virtual size: 11KB

RWEXEC
Size: - Virtual size: 4KB

.rdata
Size: 246KB - Virtual size: 245KB

.data
Size: 63KB - Virtual size: 587KB

.pdata
Size: 192KB - Virtual size: 191KB

ALMOSTRO
Size: 2KB - Virtual size: 8KB

SPINLOCK
Size: 3KB - Virtual size: 7KB

PAGELK
Size: 83KB - Virtual size: 83KB

PAGE
Size: 2.2MB - Virtual size: 2.2MB

PAGEKD
Size: 19KB - Virtual size: 18KB

PAGEVRFY
Size: 133KB - Virtual size: 133KB

PAGEHDLS
Size: 10KB - Virtual size: 9KB

PAGEBGFX
Size: 26KB - Virtual size: 25KB

PAGEVRFB
Size: - Virtual size: 13KB

.edata
Size: 66KB - Virtual size: 66KB

PAGEDATA
Size: 19KB - Virtual size: 55KB

PAGEVRFC
Size: 10KB - Virtual size: 10KB

PAGEVRFD
Size: 5KB - Virtual size: 4KB

INIT
Size: 349KB - Virtual size: 349KB

.rsrc
Size: 216KB - Virtual size: 215KB

.reloc
Size: 8KB - Virtual size: 8KB

61:04:b3:f5:00:00:00:00:00:0d
Certificate

61:15:34:64:00:00:00:00:00:0c
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

66:ba:c9:ae:40:6e:af:54:d3:f3:b8:82:54:a4:c1:9f:45:ee:25:be:7b:6b:e0:3b:09:21:03:75:00:b7:46:74
Signer

.text
Size: 416KB - Virtual size: 416KB

PAGER32C
Size: 22KB - Virtual size: 21KB

INIT
Size: 5KB - Virtual size: 4KB

PAGE
Size: 21KB - Virtual size: 21KB

.rdata
Size: 59KB - Virtual size: 59KB

.data
Size: 6KB - Virtual size: 174KB

.pdata
Size: 17KB - Virtual size: 16KB

PAGER32R
Size: 1024B - Virtual size: 896B

INITDATA
Size: 512B - Virtual size: 16B

PAGEDATA
Size: 512B - Virtual size: 1B

.rsrc
Size: 25KB - Virtual size: 24KB

.reloc
Size: 3KB - Virtual size: 3KB