d16142c961d0de12954627ad451d4537ac18645c70a6672e24a312eb4448ba61

Sharing

Copy URL

Twitter E-mail

General

Target

d16142c961d0de12954627ad451d4537ac18645c70a6672e24a312eb4448ba61
Size

4.4MB
MD5

cbe6b9a5a5d718394462703803d93314
SHA1

cfddb28cdd413fd6299714a94841d67222c65cbf
SHA256

d16142c961d0de12954627ad451d4537ac18645c70a6672e24a312eb4448ba61
SHA512

e70db791b8d20393000e55c5ad2f2d1de0415f7ce20419d7cbbfad3182dce48d1108673946ec60d76d813eefa6674e1105ece380006217e51eed786836a3c150
SSDEEP

49152:l7OO75f2R6Hjz40wOUNvzsaSSq7tceaMget9WD5W5VN+JCuyz9p7kuc7ioYRpuQc:ZfAEHbwOGz5ytu/scOoYOQbo8p3nO7

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
d16142c961d0de12954627ad451d4537ac18645c70a6672e24a312eb4448ba61
unpack001/$PLUGINSDIR/Checker.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/Zip.dll
unpack001/ClocX.exe
unpack001/uninst.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

Files

d16142c961d0de12954627ad451d4537ac18645c70a6672e24a312eb4448ba61
.exe windows:4 windows x86 arch:x86

5f0c714c36e6cc016b3a1f4bc86559e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
SetWindowPos
SetCursor
GetSysColor
SetClassLongA
GetWindowLongA
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersionExA
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Checker.dll
.dll windows:5 windows x86 arch:x86

bfceb0f183878f4518365886b7d71401

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GlobalFree
lstrlenA
GlobalAlloc
lstrcpynA
lstrcmpiA
GetModuleHandleA
LoadLibraryA
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
GetCurrentThreadId
DecodePointer
GetCommandLineA
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
HeapAlloc
RaiseException
LCMapStringW
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
HeapSize
WriteFile
GetModuleFileNameW
RtlUnwind
HeapReAlloc
IsProcessorFeaturePresent

user32

wsprintfA

Exports

Exports

Crc32
ProcExists
Slt

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

610235b90207a63ccf481f0d4375d329

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetPrivateProfileIntA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileStringA
SetCurrentDirectoryA
GetModuleHandleA
lstrcmpiA
WritePrivateProfileStringA
lstrcatA
lstrcpynA
GlobalFree
lstrlenA
lstrcpyA
GlobalUnlock
GlobalAlloc
GlobalLock

user32

MapWindowPoints
PtInRect
CloseClipboard
LoadCursorA
GetDlgCtrlID
OpenClipboard
GetClientRect
SetWindowRgn
DrawFocusRect
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
DrawTextA
SetCursor
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
CallWindowProcA
PostMessageA
MessageBoxA
GetSysColor
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetWindowLongA
EnableMenuItem
GetSystemMenu
GetClipboardData
LoadIconA

gdi32

DeleteObject
CombineRgn
SetTextColor
GetDIBits
SelectObject
CreateRectRgn
GetObjectA
CreateCompatibleDC

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
SHGetDesktopFolder

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 654B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Zip.dll
.dll windows:5 windows x86 arch:x86

f0c197e0535d3d99e3ef50015c863f9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
CreateFileA
ReadFile
CloseHandle
lstrcpyA
GlobalFree
GlobalAlloc
lstrcpynA
VirtualAlloc
GetFileSizeEx
DosDateTimeToFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
WriteFile
LoadLibraryW
RtlUnwind
GetLastError
HeapFree
HeapAlloc
EncodePointer
DecodePointer
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetProcAddress
RaiseException
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
ExitProcess
GetStdHandle
GetModuleFileNameW
Sleep
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc

user32

wsprintfA

shlwapi

ord12

Exports

Exports

Un
UnzipAndInstall

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$R1
BackupAlarms.bat
ClocX.exe
.exe windows:5 windows x86 arch:x86

3ced1f09a775d94c70dc5c5da122d8ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
CompareStringW
GetConsoleMode
GetConsoleCP
GetStringTypeW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
GetTimeZoneInformation
LCMapStringW
IsValidCodePage
GetStdHandle
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapQueryInformation
FileTimeToSystemTime
GetFileType
SetStdHandle
CreateThread
ExitThread
ExitProcess
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
RaiseException
RtlUnwind
GetStartupInfoW
GetProcessHeap
GetCommandLineA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
DecodePointer
EncodePointer
SearchPathA
GetProfileIntA
SetErrorMode
GetTempPathA
GetTempFileNameA
GetNumberFormatA
GetWindowsDirectoryA
GetFileTime
GetFileSizeEx
GetFileAttributesA
GetFileAttributesExA
FindResourceExW
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
lstrcmpiA
WriteConsoleW
HeapSetInformation
DeleteFileA
GetCurrentDirectoryA
lstrcpyA
GetSystemDirectoryW
GetOEMCP
GetCPInfo
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedIncrement
GetACP
GlobalFlags
VirtualProtect
WaitForSingleObject
ResumeThread
WritePrivateProfileStringA
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
LoadLibraryExA
GetModuleHandleW
InterlockedExchange
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryW
lstrcmpW
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
CopyFileA
GlobalSize
GlobalAlloc
LocalFree
lstrlenW
MultiByteToWideChar
lstrlenA
GetCurrentProcessId
ActivateActCtx
DeactivateActCtx
SetLastError
MulDiv
GlobalLock
GlobalUnlock
GlobalFree
FindResourceA
FreeResource
FindClose
FindNextFileA
FindFirstFileA
GetModuleFileNameA
FormatMessageA
GetShortPathNameA
WinExec
FileTimeToLocalFileTime
LocalFileTimeToFileTime
LoadLibraryA
GetPrivateProfileStringA
GetPrivateProfileIntA
SetThreadPriority
GetCurrentProcess
SetPriorityClass
CloseHandle
FreeLibrary
GetSystemTime
Sleep
GetTickCount
lstrcmpA
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
GetLastError
CreateMutexA
GetProcAddress
GetModuleHandleA
GetVersionExA
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
SystemTimeToFileTime
GetLocalTime
SetEnvironmentVariableA

user32

DefMDIChildProcA
DefFrameProcA
PostThreadMessageA
IsMenu
MonitorFromPoint
UpdateLayeredWindow
MapVirtualKeyExA
IsCharLowerA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
LockWindowUpdate
SetCursorPos
SetRect
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
CopyAcceleratorTableA
DrawFrameControl
DrawEdge
DrawStateA
LoadMenuW
SetClassLongA
DestroyAcceleratorTable
IsZoomed
DrawIconEx
GetNextDlgGroupItem
GetIconInfo
MessageBeep
NotifyWinEvent
EnableScrollBar
HideCaret
DrawFocusRect
InvertRect
GetMenuDefaultItem
CharUpperA
UnionRect
SetParent
GetSystemMenu
IsRectEmpty
DeleteMenu
WaitMessage
WindowFromPoint
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
UnregisterClassA
GetSysColorBrush
RealChildWindowFromPoint
MapDialogRect
GetAsyncKeyState
SystemParametersInfoA
GetMenuItemInfoA
InflateRect
ShowOwnedPopups
GetMessageA
TranslateMessage
ReuseDDElParam
LoadMenuA
DestroyMenu
LoadAcceleratorsA
InvalidateRect
IsIconic
InsertMenuItemA
IntersectRect
OffsetRect
SetRectEmpty
TranslateAcceleratorA
MapVirtualKeyA
GetKeyNameTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
WinHelpA
IsChild
DrawMenuBar
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
RedrawWindow
IsWindowVisible
ValidateRect
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
CopyRect
GetWindowTextLengthA
GetWindowTextA
GetFocus
SetFocus
SetWindowPos
MoveWindow
SetWindowLongA
GetDlgCtrlID
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
SendDlgItemMessageA
CheckRadioButton
CheckDlgButton
GetWindow
UnhookWindowsHookEx
GetMenuState
GetMenuStringA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
TranslateMDISysAccel
CreateMenu
SetMenuDefaultItem
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
RegisterClipboardFormatA
CopyIcon
CharUpperBuffA
GetDoubleClickTime
SubtractRect
DrawIcon
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxA
GetSysColor
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
TabbedTextOutA
FillRect
GetDesktopWindow
GetWindowRgn
GetCapture
DestroyCursor
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
BringWindowToTop
SetWindowTextA
ShowWindow
GetParent
GetClientRect
ExitWindowsEx
SetCapture
PostMessageA
SetWindowRgn
SetForegroundWindow
ScreenToClient
ClientToScreen
AppendMenuA
CreatePopupMenu
ReleaseCapture
KillTimer
CopyImage
DrawTextA
PtInRect
GetCursorPos
DestroyIcon
LoadImageA
SetTimer
GetSystemMetrics
PostQuitMessage
LoadIconW
ReleaseDC
GetDC
GetWindowRect
SendMessageA
EnableWindow
SetCursor
LoadCursorA
LoadBitmapW
UnpackDDElParam

gdi32

CreateHatchBrush
CopyMetaFileA
CreateDCA
CreateRectRgnIndirect
PatBlt
GetTextExtentPoint32A
GetTextMetricsA
SetRectRgn
CombineRgn
DPtoLP
EnumFontFamiliesA
GetTextCharsetInfo
EnumFontFamiliesExA
GetBkColor
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
CreateRoundRectRgn
CreatePolygonRgn
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
SetDIBColorTable
SetPixel
GetRgnBox
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
GetTextFaceA
CreateRectRgn
Rectangle
GetDeviceCaps
SelectClipRgn
GetViewportExtEx
GetObjectType
SelectPalette
GetStockObject
CreateBitmap
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetPixel
OffsetRgn
GetObjectA
SetLayout
GetLayout
SetTextAlign
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkColor
RestoreDC
SaveDC
CreateDIBitmap
LineTo
MoveToEx
CreatePen
CreateDIBSection
StretchBlt
SetBrushOrgEx
SetStretchBltMode
SetTextColor
SetBkMode
CreateFontIndirectA
SelectObject
CreateSolidBrush
ExtCreateRegion
DeleteDC
CreateICA
GetDIBits
SetDIBits
CreateCompatibleBitmap
DeleteObject
BitBlt
CreateCompatibleDC
GetWindowExtEx

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegEnumValueA
LookupPrivilegeValueA
AdjustTokenPrivileges
InitiateSystemShutdownA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegDeleteValueA
RegEnumKeyExA
OpenProcessToken
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA

shell32

SHGetSpecialFolderLocation
Shell_NotifyIconA
ShellExecuteExA
DragFinish
DragQueryFileA
SHAppBarMessage
SHBrowseForFolderA
ShellExecuteA
SHGetPathFromIDListA
SHGetDesktopFolder
SHGetFileInfoA

comctl32

InitCommonControlsEx
_TrackMouseEvent
ImageList_GetIconSize

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathRemoveFileSpecW
PathIsUNCA

ole32

DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateStreamOnHGlobal
CoInitialize
CoCreateGuid
CoInitializeEx
CoCreateInstance
CoUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
CoTaskMemFree

oleaut32

VariantTimeToSystemTime
SysAllocString
VarBstrFromDate
SysStringLen
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysFreeString
SystemTimeToVariantTime

gdiplus

GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDrawImageI

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundA

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lang/Afrikaans.lng
Lang/Arabic.lng
Lang/Bosanski.lng
Lang/Brazilian Portuguese.lng
Lang/Bulgarian.lng
Lang/Czech.lng
Lang/Danish.lng
Lang/Deutsch.lng
Lang/English.lng
Lang/Espanol.lng
Lang/Estonian.lng
Lang/French.lng
Lang/Greek.lng
Lang/Hebrew.lng
Lang/Hungarian.lng
Lang/Indonesian.lng
Lang/Italiano.lng
Lang/Japanese.lng
Lang/Korean.lng
Lang/Nederlands.lng
Lang/Polish.lng
Lang/Portuguese.lng
Lang/Romanian.lng
Lang/Russian.lng
Lang/Simple_Chinese.lng
Lang/Slovak.lng
Lang/Slovenian.lng
Lang/Srpski.lng
Lang/Suomi.lng
Lang/Svenska.lng
Lang/Thai.lng
Lang/Traditional_Chinese.lng
Lang/Turkce.lng
Lang/Ukrainian.lng
Presets/AJ-CityHall-500-hour.hpng
.png
Presets/AJ-CityHall-500-minute.hpng
.png
Presets/Adler.png
.png
Presets/Alte Standuhr.ini
Presets/Alte Standuhr.png
.png
Presets/Amarillo.png
.png
Presets/Apple.png
.png
Presets/Aqua.bmp
Presets/Aqua.png
.png
Presets/AquaB.ini
Presets/AquaB.png
.png
Presets/AquaLarge.png
.png
Presets/AquaMade.png
.png
Presets/Aqua_Apple_Clock.bmp
Presets/Bahnhofsuhr.png
.png
Presets/BaiWeather.ini
Presets/BaiWeather.png
.png
Presets/BallClockAmber.bmp
Presets/BallClockAmber.png
.png
Presets/BallClockAqua.bmp
Presets/BallClockAqua.png
.png
Presets/BallClockIce.bmp
Presets/BallClockIce.png
.png
Presets/BallClockRed.bmp
Presets/BallClockRed.png
.png
Presets/BigBen.png
.png
Presets/BlackAppleClock.bmp
Presets/BlackAppleClock.png
.png
Presets/BlackBallRoman.png
.png
Presets/BlackClock.bmp
Presets/BlueAppleClock.ini
Presets/BlueAppleClock.png
.png
Presets/BlueBallOnlyDots.ini
Presets/BlueBallOnlyDots.png
.png
Presets/BlueBallRoman.ini
Presets/BlueBallRoman.png
.png
Presets/BlueBallStd.ini
Presets/BlueBallStd.png
.png
Presets/BlueSphere.bmp
Presets/BlueSphere.png
.png
Presets/BlueSphere2.png
.png
Presets/Blue_sphere.bmp
Presets/BubbleClock.ini
Presets/BubbleClock.png
.png
Presets/Cappuccino.ini
Presets/Cappuccino.png
.png
Presets/CarpeDiem.ini
Presets/CarpeDiem.png
.png
Presets/Casio.ini
Presets/Casio.png
.png
Presets/Citizen.ini
Presets/Citizen.png
.png
Presets/CloQ.ini
Presets/CloQ.png
.png
Presets/Comdex - Omega1.ini
Presets/Comdex - Omega1.png
.png
Presets/DSX4.BMP
Presets/DSX4.TXT
Presets/DarkCrystalBall.ini
Presets/DarkCrystalBall.png
.png
Presets/DarkCrystalBall/hourhand-7.png
.png
Presets/DarkCrystalBall/minutehand-7.png
.png
Presets/DarkCrystalBall/secondhand-7.png
.png
Presets/Earth2.png
.png
Presets/GroenneKugler.ini
Presets/GroenneKugler.png
.png
Presets/GuldKugler.ini
Presets/GuldKugler.png
.png
Presets/Holzuhr.png
.png
Presets/Holzwanduhr.bmp
Presets/IvyLace.ini
Presets/IvyLace.png
.png
Presets/Jagua3rClock.bmp
Presets/Jaguar.bmp
Presets/Jaguar2.png
.png
Presets/Jaguar2Clock.bmp
Presets/JaguarClock.png
.png
Presets/Kirchenuhr.png
.png
Presets/LongClock.bmp
Presets/MClkhrHand.hpng
.png
Presets/MClkminHand.hpng
.png
Presets/Metalluhr.png
.png
Presets/MickeyClock.ini
Presets/MickeyClock.png
.png
Presets/MickeyMouse.ini
Presets/MickeyMouse.png
.png
Presets/MilkClock.bmp
Presets/MilkClock.png
.png
Presets/Naranja.png
.png
Presets/Negro.ini
Presets/Negro.png
.png
Presets/Neon.ini
Presets/Neon.png
.png
Presets/NewDefault.bmp
Presets/Nvidia.png
.png
Presets/Nvidia2.png
.png
Presets/ORIGINAL.INI
Presets/Octopye2.ini
Presets/Octopye2.png
.png
Presets/Omega.ini
Presets/Omega.png
.png
Presets/Original.png
.png
Presets/Uhr.ini
Presets/Uhr.png
.png
Presets/UniversalAccess.png
.png
Presets/UniversalAccessClock.bmp
Presets/Unreal.png
.png
Presets/Verde.png
.png
Presets/Violeta.png
.png
Presets/VioletteKugler.ini
Presets/VioletteKugler.png
.png
Presets/Wall Clock medium-sec.hpng
.png
Presets/Wall Clock medium.bmp
Presets/Wall Clock medium.ini
Presets/White_Apple_Clock.bmp
Presets/White_Apple_Clock.png
.png
Presets/WidestoneStudios.ini
Presets/WidestoneStudios.png
.png
Presets/Wonderglobe2.png
.png
Presets/alarme.ini
Presets/alarme.png
.png
Presets/apple.ini
Presets/aqua-clock1.bmp
Presets/aqua-clock2.bmp
Presets/aquamade.ini
Presets/bahnhofsuhr.ini
Presets/black and steel.ini
Presets/black and steel.png
.png
Presets/cowboy2.ini
Presets/cowboy2.png
.png
Presets/default.bmp
Presets/default.ini
Presets/domeclock/domehour.png
.png
Presets/domeclock/domemin.png
.png
Presets/dragon.bk
Presets/dsaqua.bmp
Presets/earth.ini
Presets/earth.png
.png
Presets/earth2.ini
Presets/greenmarble/marblehour.png
.png
Presets/greenmarble/marblemin.png
.png
Presets/hallow.ini
Presets/hallow.png
.png
Presets/hallow2.ini
Presets/hallow2.png
.png
Presets/iSink.bmp
Presets/iSink.png
.png
Presets/iToolsClock.bmp
Presets/iToolsClock.png
.png
Presets/iToolsClock2.bmp
Presets/iToolsClock2.png
.png
Presets/klokje.ini
Presets/klokje.png
.png
Presets/klokjehour.hpng
.png
Presets/klokjemin.hpng
.png
Presets/longhorn.ini
Presets/longhorn.png
.png
Presets/mars.png
.png
Presets/negro2.ini
Presets/negro2.png
.png
Presets/roman/romanhour.png
.png
Presets/roman/romanminute.png
.png
Presets/roman2/roman2hour.png
.png
Presets/roman2/roman2minute.png
.png
Presets/romanblack/romanblackhour.png
.png
Presets/romanblack/romanblackmin.png
.png
Presets/romanold/romanoldhour.png
.png
Presets/romanold/romanoldmin.png
.png
Presets/weemsplath.ini
Presets/weemsplath.png
.png
Presets/wonderglobe2.ini
Presets/woodone/woodhour.png
.png
Presets/woodone/woodmin.png
.png
Sounds/alert.mp3
Sounds/beep-ClockChime.wav
Sounds/clockbell.mp3
Sounds/ring.wav
Sounds/ring2.mp3
Sounds/siren.mp3
Sounds/trumpet.mp3
uninst.exe
.exe windows:4 windows x86 arch:x86

5f0c714c36e6cc016b3a1f4bc86559e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
SetWindowPos
SetCursor
GetSysColor
SetClassLongA
GetWindowLongA
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersionExA
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f0c714c36e6cc016b3a1f4bc86559e4

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 106KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 19KB - Virtual size: 19KB

bfceb0f183878f4518365886b7d71401

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 4KB - Virtual size: 4KB

610235b90207a63ccf481f0d4375d329

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

8c8a576201f68de1a3f26fc723b9f30f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 104B

.reloc Size: 1024B - Virtual size: 654B

f0c197e0535d3d99e3ef50015c863f9a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 106KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 19KB - Virtual size: 19KB

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 654B

.text
Size: 47KB - Virtual size: 47KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 293KB - Virtual size: 293KB

.data
Size: 28KB - Virtual size: 57KB

.rsrc
Size: 308KB - Virtual size: 308KB

.reloc
Size: 171KB - Virtual size: 171KB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 106KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 19KB - Virtual size: 19KB