exe.zip.zip
- SHA256 72a18c1e65869e5fce28667ce2b9069f9c180f4af3437193a12566fa1aa9d1a1
Password
infected
Overview
overview
10Static
static
10exe/start.bat
windows7-x64
10exe/start.bat
windows10-2004-x64
10exe/unimed1.exe
windows7-x64
10exe/unimed1.exe
windows10-2004-x64
10exe/unimed2.exe
windows7-x64
10exe/unimed2.exe
windows10-2004-x64
10exe/unimed3.exe
windows7-x64
10exe/unimed3.exe
windows10-2004-x64
10exe/unimed4.exe
windows7-x64
10exe/unimed4.exe
windows10-2004-x64
10exe/unimed5.exe
windows7-x64
10exe/unimed5.exe
windows10-2004-x64
10exe/unimed6.exe
windows7-x64
10exe/unimed6.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
exe/start.bat
Resource
win7-20240215-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
exe/start.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
exe/unimed1.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
exe/unimed1.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral5
Sample
exe/unimed2.exe
Resource
win7-20240215-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral6
Sample
exe/unimed2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral7
Sample
exe/unimed3.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral8
Sample
exe/unimed3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral9
Sample
exe/unimed4.exe
Resource
win7-20240220-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral10
Sample
exe/unimed4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral11
Sample
exe/unimed5.exe
Resource
win7-20240215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral12
Sample
exe/unimed5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral13
Sample
exe/unimed6.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral14
Sample
exe/unimed6.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target exe.zip.zip
- Size 574KB
- Sample240408-wp9jksff47
- SHA256 72a18c1e65869e5fce28667ce2b9069f9c180f4af3437193a12566fa1aa9d1a1
- MD5 02c4edb6ec3af6b6e22bd01d42ebf6d3
- SHA1 42a4e149a0db4badb12129a75c282a3306048aec
- SHA512 98b6ed67198bcdeff21ca24ffe30367df4e75919d8ff95bc13eebc5154962f3a8e7e1b8d9355e46de97000c3c12cb862245eeba30f43670352827f1a31c6b89c
- SSDEEP 12288:TQlYPJbV4BPprN//xS4RZ4YE86PLVRwtLZkc7ueqZYMLRI7ZspxDM740ARDxF:fJKpZXdOf86RRkdqZPS7CnM7vAnF
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Lockbit family
- Rule to detect Lockbit 3.0 ransomware Windows payload 6 IoCs
resource yara_rule static1/unpack002/exe/unimed1.exe family_lockbit static1/unpack002/exe/unimed2.exe family_lockbit static1/unpack002/exe/unimed3.exe family_lockbit static1/unpack002/exe/unimed4.exe family_lockbit static1/unpack002/exe/unimed5.exe family_lockbit static1/unpack002/exe/unimed6.exe family_lockbit - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack002/exe/unimed1.exe unpack002/exe/unimed2.exe unpack002/exe/unimed3.exe unpack002/exe/unimed4.exe unpack002/exe/unimed5.exe unpack002/exe/unimed6.exe
File Explorer
-
exe.zip.zip.zip 574KB
-
exe.zip.zip 577KB
-
exe/start.bat310B
-
exe/unimed1.exe.exe 156KB
-
exe/unimed2.exe.exe 156KB
-
exe/unimed3.exe.exe 157KB
-
exe/unimed4.exe.exe 157KB
-
exe/unimed5.exe.exe 156KB
-
exe/unimed6.exe.exe 157KB
exe.zip
- SHA256 7fd03700c9c9bc5db07774676c6d5c22b4a0c44eb31afa14ff6b6337b12ea58b
- MD5 9df131a2ce98a1df44a883d7dc92a4d5
- SHA1 ff41f6025a65d9d490ae527711b77c5a407ee13f
- SHA512 0fe9189dbc218b8be1bd5eeecfbb5bd0d3b593058fed7b23359c0fd5bc6b30bd2f6e1064d8460228ea42e57138159bb362f02cc2753a457dc9c2a2c53c8ef7b4
- SSDEEP 12288:vIaS1sG6CTFbnJdvGZK68MMe941W6RWqLZ5W2pNBS1iS12gT:CUCThnJ1GZK6dDiW+WqLvXEJ12i
- MD5 SHA1 SHA512 SSDEEP
Password
infected
exe/start.bat
- SHA256 c42232e5ca4f7518c308aafa94b09800d903537039efcc8ffc65645153bf0732
- MD5 af849a50c84ba0d92b3ad0dbbfbc230c
- SHA1 b69734ec33ff107f93b12a422f8571f0c3d9eb56
- SHA512 d8e9634256d925f52aabd278056956b7450f22142dbab200c5d0f180ca5fa01cd89e4daa8633e8ada3c8aa6b3fb4a90dc655566f9cd59c5a80ad6edced85c442
- MD5 SHA1 SHA512
exe/unimed1.exe
- IMPHASH 3bc510de773c954bd69d33670cb624d6
- SHA256 a4e2dbdaea6b04918e9427ff04ea9d92b99ae08ea59738429ce5625c9b9fac87
- MD5 db11c96ba002dd649427551de5ecaf9f
- SHA1 20b1827d91195fc8e72e056e0b68b347d82f9fdb
- SHA512 17318430ba3dbab613758717b949172355d36c4b0cce4f98383132e11c9859e06a42617658223020f109a607333240ca318e5baa95f47220cc0529963ab0d435
- SSDEEP 3072:IDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368SdGxtFSi9v45a1xpXSW:C5d/zugZqll3jxtFSi9v/X
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
exe/unimed2.exe
- IMPHASH 3bc510de773c954bd69d33670cb624d6
- SHA256 4735f51c0292b17618a8c789b853025c225b73dfde6bfd78cf1b61447286a144
- MD5 80e0e8949a1e52a3a8c7d106901e5f23
- SHA1 c061200402a5f591b6ae605ae445dac20adce9aa
- SHA512 cb918517ba065a2190724639785be0b56afda344d96291dd50880efb3184e12179b3d1bbe6954750c28e1939c9fce66e159c44f4d0cb847e869db8114ea75734
- SSDEEP 3072:ODDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368z9Nl02mGoFAXMA5kFW:Y5d/zugZqll3tNlk3I55k
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
exe/unimed3.exe
- IMPHASH 3bc510de773c954bd69d33670cb624d6
- SHA256 a86c573ef8fceb4656059637ce1083f1ffb62130b9da41fd36096fbe9ebb5cb8
- MD5 404e48d0a6f72388427372e5c09dc9a8
- SHA1 a786eef9b8863cbee826a3eff850c538d6140292
- SHA512 04082f67c20b769b5b35686ff66325fe4d7f2bfba4b2ba05d0d5824e75e12444e621d566058132b6ac6fd5ba955621a4dda85159191c9628b5f5668229147234
- SSDEEP 3072:XDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368Pznp5uGPlDL4W:J5d/zugZqll3zznp5PlD
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
exe/unimed4.exe
- IMPHASH 3bc510de773c954bd69d33670cb624d6
- SHA256 76e4b75279179170fd81e05b51fbaf33aa8becaabc9bc9565950b4363a4a6ed2
- MD5 76c40b1a636262b4145bc0b4c7167109
- SHA1 33af9c63841a8c5b0ba0cbd645462ba19dcb9e32
- SHA512 9110e6274021dc4d34ef1f633c7145f5ebd08686b7b19ca86c6bb3bd141637105963e1f40fb23b19fe42ff3a843f49f3a3c4ba627c20a81f35a045e9d8170f77
- SSDEEP 3072:oDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368c9SiJ4y7auUW:i5d/zugZqll3ASy
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
exe/unimed5.exe
- IMPHASH 3bc510de773c954bd69d33670cb624d6
- SHA256 6452655e6c0f3d6dfd3e0ef2e1044c50a2ba956622869664840b45e7c4f528af
- MD5 b553477046a7bdc5dc6f9233429c3b1b
- SHA1 56d22da95fa18e2455b13b7faebeb691bcb8f30a
- SHA512 3d2600645d3ae5307818774eab1bf754df81439be3e539e78dde01ef4d11686f2834cff82c195400c5e9734c67f07982a1bd9b84e1daea758640a6de1f171de0
- SSDEEP 3072:ODDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368e0yXVGcjJoDfQjDgU9W:Y5d/zugZqll3dyFGnLg
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
exe/unimed6.exe
- IMPHASH 3bc510de773c954bd69d33670cb624d6
- SHA256 305a7a8d07eb474ecb6f242687bb9d138560f9faa5c9d40b31e3701852451263
- MD5 7b4aa7601aa0bd8fc6d1a88fe18d8d6f
- SHA1 aaef517e279c8586c858bddb99a5cf37723c779b
- SHA512 d83ee781bd093dc47a186b178bb2dde7c7ba7a911a6e63896f9cb49467765ec01db8f7acb2c645c76d06fe7ebc64184f89a2ab25c959d6112c036c7a7d110311
- SSDEEP 3072:QDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368iF3Rv4Adea5XW:65d/zugZqll3MBQA
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
111727
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ