0329c44e7b4be2992c5d5bc9771b42b0_NEAS

Sharing

Copy URL Twitter E-mail

General

Target

0329c44e7b4be2992c5d5bc9771b42b0_NEAS
Size

6.1MB
MD5

0329c44e7b4be2992c5d5bc9771b42b0
SHA1

454150bb4e9974b4e4a0043c2e4c782538312de0
SHA256

aeb687ceb111acd8cb093d6a730254e1710b9d1b46a0bf0a90639bce91aa3812
SHA512

6bfb62858d6e76889f903fe0c9cfe3c1879b4a85a7ac0138ddf6f0eea3d4741d81186862c66593275059e7fe59a1d315686657c02a03d3ed5aebd4ac2613820b
SSDEEP

98304:E7txK9s++Gkx2XdThWrgHd3aVjHNtO/gjx/1W+b9pQ0J5THUJe:EZxK9s++d2RJa9Ns/gjx/PQwRl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0329c44e7b4be2992c5d5bc9771b42b0_NEAS

Files

0329c44e7b4be2992c5d5bc9771b42b0_NEAS
.dll windows:5 windows x86 arch:x86

cf22ae17da1c252f6e8930b7620fbb98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libeay32

X509_STORE_set1_param
PEM_read_PrivateKey
OpenSSL_add_all_digests
EVP_MD_block_size
EVP_PKEY_free
X509_LOOKUP_hash_dir
PEM_read_bio_X509_AUX
EVP_MD_CTX_destroy
X509_VERIFY_PARAM_new
EVP_VerifyFinal
X509_STORE_CTX_free
X509_VERIFY_PARAM_set_flags
X509_free
X509_get_pubkey
EVP_DigestFinal_ex
PEM_read_X509
X509_STORE_add_lookup
X509_STORE_new
X509_VERIFY_PARAM_free
EVP_MD_CTX_md
X509_STORE_add_crl
X509_STORE_free
EVP_DigestInit_ex
EVP_MD_size
EVP_SignFinal
X509_CRL_free
OPENSSL_add_all_algorithms_noconf
BIO_s_file
PEM_read_X509_CRL
ERR_load_crypto_strings
EVP_DigestUpdate
PEM_read_bio_X509
X509_LOOKUP_file
X509_LOOKUP_ctrl
EVP_get_digestbyname
EVP_PKEY_size
X509_STORE_CTX_init
X509_STORE_set_flags
OpenSSL_add_all_ciphers
X509_STORE_CTX_new
X509_verify_cert
BIO_f_base64
BIO_s_mem
BIO_ctrl
BIO_new
BIO_new_mem_buf
BIO_write
BIO_free_all
BIO_read
BIO_set_flags
EVP_MD_CTX_create
BIO_push
EVP_cleanup
BIO_free

libssl32

SSL_load_error_strings
SSL_library_init

ws2_32

ioctlsocket
connect
inet_ntoa
getaddrinfo
select
WSAEnumNetworkEvents
WSAEventSelect
shutdown
setsockopt
recv
bind
socket
getpeername
getservbyname
closesocket
gethostbyname
send
getsockopt
listen
accept
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
ntohl
freeaddrinfo
inet_addr
htons
htonl
ntohs

kernel32

GetCurrentDirectoryW
UnregisterWaitEx
RegisterWaitForSingleObject
FormatMessageA
GetCommandLineA
GetCommandLineW
FindNextFileW
FindClose
FindFirstFileW
ResumeThread
SuspendThread
TlsFree
GetProcessAffinityMask
GetThreadPriority
QueryPerformanceCounter
DecodePointer
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
SetUnhandledExceptionFilter
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
GetFileType
SetErrorMode
GetProcessTimes
SetInformationJobObject
AssignProcessToJobObject
CreateJobObjectA
SearchPathA
CreateProcessA
GetExitCodeProcess
TerminateProcess
MoveFileExA
CopyFileA
FindNextFileA
FindFirstFileA
DeleteFileA
GetFileAttributesExA
GetFileAttributesA
SetFileAttributesA
GetFullPathNameA
RemoveDirectoryA
CreateDirectoryA
GetCurrentDirectoryA
GetTempPathA
GetModuleFileNameA
SetFileTime
GetFileInformationByHandle
TryEnterCriticalSection
LocalFree
WaitForMultipleObjects
InterlockedExchangeAdd
ResetEvent
SetLastError
InterlockedExchange
ReleaseSemaphore
SetThreadPriority
CreateSemaphoreA
CreateEventA
OpenProcess
SetEvent
InterlockedDecrement
FreeLibrary
SetThreadContext
GetThreadContext
TlsAlloc
ReleaseMutex
DuplicateHandle
GetCurrentThreadId
DeleteCriticalSection
GetFileAttributesExW
CreateMutexA
EnterCriticalSection
LeaveCriticalSection
Sleep
TlsSetValue
InitializeCriticalSection
InterlockedCompareExchange
GetVersionExA
GetCurrentThread
GetThreadTimes
CreateFileA
SetFilePointer
WriteFile
ReadFile
CreateFileW
GetLastError
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetSystemInfo
lstrcmpiA
VirtualFree
VirtualAlloc
GetCurrentProcessId
GetProcAddress
LoadLibraryA
GetModuleHandleA
TlsGetValue
InterlockedIncrement
GetCurrentProcess
WaitForSingleObject

advapi32

RegQueryValueExA
RegOpenKeyExA

msvcr110

_except_handler4_common
__clean_type_info_names_internal
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_initterm_e
_initterm
_malloc_crt
__CppXcptFilter
__crtTerminateProcess
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_open
_mkdir
_lseek
_dup
_unlink
_write
_fdopen
_strnicmp
_rmdir
_chmod
_getcwd
_libm_sse2_pow_precise
_HUGE
_libm_sse2_exp_precise
_libm_sse2_cos_precise
_libm_sse2_log_precise
_amsg_exit
printf
memmove
free
malloc
sprintf
calloc
_fstat64i32
_read
fopen
realloc
_localtime64
fclose
_time64
strncmp
isspace
_errno
strncpy
isdigit
strtoul
strrchr
isxdigit
strncat
_mktime64
memchr
strchr
atoi
isalnum
isalpha
sscanf
strstr
fgets
fread
ferror
strpbrk
strtol
_open_osfhandle
_close
fflush
fwrite
_libm_sse2_sin_precise
_chsize
puts
__iob_func
fprintf
ftell
fseek
toupper
_get_osfhandle
tolower
abort
atof
putc
fputs
strtok
isprint
clock
perror
_ctime64
getenv
atol
strcspn
isupper
islower
_snprintf
vfprintf
_endthread
_beginthread
_wfopen
_wstat64i32
_stat64i32
_endthreadex
_beginthreadex
_ftime64
longjmp
exit
strerror
_vsnprintf
wcsncpy
wcsncat
_ftime64_s
_wopen
wcsrchr
wcsstr
_waccess
wcsncmp
ungetc
fgetc
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
memcpy
memcmp
memset
??_V@YAXPAX@Z
??_U@YAPAXI@Z
__CxxLongjmpUnwind
_setjmp3
acos
asin
atan
atan2
cos
cosh
exp
fabs
fmod
log
log10
pow
sin
sinh
tan
tanh
sqrt
ceil
floor
qsort
_libm_sse2_sqrt_precise
_CIfmod
strtod
_strdup
_fileno
_setmode
_heapwalk
_exit
fputc
_stricmp
strftime
strerror_s
_crt_debugger_hook
__crtUnhandledException

msvcp110

??0_Lockit@std@@QAE@H@Z
?_Orphan_all@_Container_base12@std@@QAEXXZ
??1_Container_base12@std@@QAE@XZ
_Inf
??1_Lockit@std@@QAE@XZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z

psapi

GetProcessMemoryInfo

dbghelp

SymGetLineFromAddr
SymInitialize
SymGetSymFromAddr
EnumerateLoadedModules
SymSetOptions
SymFunctionTableAccess
StackWalk
SymGetModuleBase

Exports

Exports

CONFDIR
CONFDIR_CLAMD
CONFDIR_FRESHCLAM
CONFDIR_MILTER
DATADIR
UTF8Toisolat1
__oldXMLWDcompatibility
__xmlBufferAllocScheme
__xmlDefaultBufferSize
__xmlDefaultSAXLocator
__xmlDeregisterNodeDefaultValue
__xmlDoValidityCheckingDefaultValue
__xmlErrEncoding
__xmlGenericError
__xmlGenericErrorContext
__xmlGetWarningsDefaultValue
__xmlIndentTreeOutput
__xmlKeepBlanksDefaultValue
__xmlLastError
__xmlLineNumbersDefaultValue
__xmlLoadExtDtdDefaultValue
__xmlOutputBufferCreateFilenameValue
__xmlParserDebugEntities
__xmlParserInputBufferCreateFilenameValue
__xmlParserVersion
__xmlPedanticParserDefaultValue
__xmlRaiseError
__xmlRegisterNodeDefaultValue
__xmlSaveNoEmptyTags
__xmlSimpleError
__xmlStructuredError
__xmlStructuredErrorContext
__xmlSubstituteEntitiesDefaultValue
__xmlTreeIndentString
cl_ASN1_GetTimeT
cl_always_gen_section_hash
cl_cleanup_crypto
cl_countsigs
cl_cvdfree
cl_cvdhead
cl_cvdparse
cl_cvdverify
cl_debug
cl_engine_addref
cl_engine_compile
cl_engine_free
cl_engine_get_num
cl_engine_new
cl_engine_set_clcb_hash
cl_engine_set_clcb_meta
cl_engine_set_clcb_post_scan
cl_engine_set_clcb_pre_cache
cl_engine_set_clcb_pre_scan
cl_engine_set_clcb_sigload
cl_engine_set_clcb_stats_add_sample
cl_engine_set_clcb_stats_decrement_count
cl_engine_set_clcb_stats_flush
cl_engine_set_clcb_stats_get_hostid
cl_engine_set_clcb_stats_get_num
cl_engine_set_clcb_stats_get_size
cl_engine_set_clcb_stats_remove_sample
cl_engine_set_clcb_stats_submit
cl_engine_set_num
cl_engine_set_stats_set_cbdata
cl_engine_set_str
cl_engine_settings_apply
cl_engine_settings_copy
cl_engine_settings_free
cl_engine_stats_enable
cl_finish_hash
cl_get_x509_from_mem
cl_hash_data
cl_hash_destroy
cl_hash_file_fd
cl_hash_file_fp
cl_hash_init
cl_init
cl_initialize_crypto
cl_load
cl_load_cert
cl_load_crl
cl_retdbdir
cl_retflevel
cl_retver
cl_scandesc
cl_scandesc_callback
cl_scanfile
cl_scanfile_callback
cl_set_clcb_msg
cl_sha1
cl_sha256
cl_sign_data
cl_sign_data_keyfile
cl_sign_file_fd
cl_sign_file_fp
cl_statchkdir
cl_statfree
cl_statinidir
cl_strerror
cl_update_hash
cl_validate_certificate_chain
cl_verify_signature
cl_verify_signature_x509
cl_verify_signature_x509_keyfile
initGenericErrorDefaultFunc
inputPop
inputPush
isolat1ToUTF8
namePop
namePush
nodePop
nodePush
xmlAddAttributeDecl
xmlAddChild
xmlAddChildList
xmlAddDocEntity
xmlAddDtdEntity
xmlAddElementDecl
xmlAddEncodingAlias
xmlAddID
xmlAddNextSibling
xmlAddNotationDecl
xmlAddPrevSibling
xmlAddRef
xmlAddSibling
xmlAllocOutputBuffer
xmlAllocParserInputBuffer
xmlAttrSerializeTxtContent
xmlBufContent
xmlBufEnd
xmlBufGetNodeContent
xmlBufNodeDump
xmlBufShrink
xmlBufUse
xmlBufferAdd
xmlBufferAddHead
xmlBufferCCat
xmlBufferCat
xmlBufferContent
xmlBufferCreate
xmlBufferCreateSize
xmlBufferCreateStatic
xmlBufferDetach
xmlBufferDump
xmlBufferEmpty
xmlBufferFree
xmlBufferGrow
xmlBufferLength
xmlBufferResize
xmlBufferSetAllocationScheme
xmlBufferShrink
xmlBufferWriteCHAR
xmlBufferWriteChar
xmlBufferWriteQuotedString
xmlBuildQName
xmlBuildRelativeURI
xmlBuildURI
xmlByteConsumed
xmlCanonicPath
xmlCharEncCloseFunc
xmlCharEncFirstLine
xmlCharEncInFunc
xmlCharEncOutFunc
xmlCharInRange
xmlCharStrdup
xmlCharStrndup
xmlCheckFilename
xmlCheckHTTPInput
xmlCheckLanguageID
xmlCheckUTF8
xmlCheckVersion
xmlChildElementCount
xmlCleanupCharEncodingHandlers
xmlCleanupEncodingAliases
xmlCleanupGlobals
xmlCleanupInputCallbacks
xmlCleanupMemory
xmlCleanupOutputCallbacks
xmlCleanupParser
xmlCleanupThreads
xmlClearNodeInfoSeq
xmlClearParserCtxt
xmlCopyAttributeTable
xmlCopyChar
xmlCopyCharMultiByte
xmlCopyDoc
xmlCopyDocElementContent
xmlCopyDtd
xmlCopyElementContent
xmlCopyElementTable
xmlCopyEntitiesTable
xmlCopyEnumeration
xmlCopyError
xmlCopyNamespace
xmlCopyNamespaceList
xmlCopyNode
xmlCopyNodeList
xmlCopyNotationTable
xmlCopyProp
xmlCopyPropList
xmlCreateDocParserCtxt
xmlCreateEntitiesTable
xmlCreateEntityParserCtxt
xmlCreateEnumeration
xmlCreateFileParserCtxt
xmlCreateIOParserCtxt
xmlCreateIntSubset
xmlCreateMemoryParserCtxt
xmlCreatePushParserCtxt
xmlCreateURI
xmlCreateURLParserCtxt
xmlCtxtGetLastError
xmlCtxtReadDoc
xmlCtxtReadFd
xmlCtxtReadFile
xmlCtxtReadIO
xmlCtxtReadMemory
xmlCtxtReset
xmlCtxtResetLastError
xmlCtxtResetPush
xmlCtxtUseOptions
xmlCurrentChar
xmlDOMWrapAdoptNode
xmlDOMWrapCloneNode
xmlDOMWrapFreeCtxt
xmlDOMWrapNewCtxt
xmlDOMWrapReconcileNamespaces
xmlDOMWrapRemoveNode
xmlDefaultSAXHandlerInit
xmlDelEncodingAlias
xmlDeregisterNodeDefault
xmlDetectCharEncoding
xmlDictCleanup
xmlDictCreate
xmlDictCreateSub
xmlDictExists
xmlDictFree
xmlDictGetUsage
xmlDictLookup
xmlDictOwns
xmlDictQLookup
xmlDictReference
xmlDictSetLimit
xmlDictSize
xmlDocCopyNode
xmlDocCopyNodeList
xmlDocDump
xmlDocDumpFormatMemory
xmlDocDumpFormatMemoryEnc
xmlDocDumpMemory
xmlDocDumpMemoryEnc
xmlDocFormatDump
xmlDocGetRootElement
xmlDocSetRootElement
xmlDumpAttributeDecl
xmlDumpAttributeTable
xmlDumpElementDecl
xmlDumpElementTable
xmlDumpEntitiesTable
xmlDumpEntityDecl
xmlDumpNotationDecl
xmlDumpNotationTable
xmlElemDump
xmlEncodeEntitiesReentrant
xmlEncodeSpecialChars
xmlErrMemory
xmlFileClose
xmlFileMatch
xmlFileOpen
xmlFileRead
xmlFindCharEncodingHandler
xmlFirstElementChild
xmlFree
xmlFreeAttributeTable
xmlFreeDoc
xmlFreeDocElementContent
xmlFreeDtd
xmlFreeElementContent
xmlFreeElementTable
xmlFreeEntitiesTable
xmlFreeEnumeration
xmlFreeIDTable
xmlFreeInputStream
xmlFreeMutex
xmlFreeNode
xmlFreeNodeList
xmlFreeNotationTable
xmlFreeNs
xmlFreeNsList
xmlFreeParserCtxt
xmlFreeParserInputBuffer
xmlFreeProp
xmlFreePropList
xmlFreeRMutex
xmlFreeRefTable
xmlFreeTextReader
xmlFreeURI
xmlGcMemGet
xmlGcMemSetup
xmlGetBufferAllocationScheme
xmlGetCharEncodingHandler
xmlGetCharEncodingName
xmlGetCompressMode
xmlGetDocCompressMode
xmlGetDocEntity
xmlGetDtdAttrDesc
xmlGetDtdElementDesc
xmlGetDtdEntity
xmlGetDtdNotationDesc
xmlGetDtdQAttrDesc
xmlGetDtdQElementDesc
xmlGetEncodingAlias
xmlGetExternalEntityLoader
xmlGetGlobalState
xmlGetID
xmlGetIntSubset
xmlGetLastChild
xmlGetLastError
xmlGetLineNo
xmlGetNoNsProp
xmlGetNodePath
xmlGetNsList
xmlGetNsProp
xmlGetParameterEntity
xmlGetPredefinedEntity
xmlGetProp
xmlGetRefs
xmlGetThreadId
xmlGetUTF8Char
xmlHasFeature
xmlHasNsProp
xmlHasProp
xmlHashAddEntry
xmlHashAddEntry2
xmlHashAddEntry3
xmlHashCopy
xmlHashCreate
xmlHashCreateDict
xmlHashFree
xmlHashLookup
xmlHashLookup2
xmlHashLookup3
xmlHashQLookup
xmlHashQLookup2
xmlHashQLookup3
xmlHashRemoveEntry
xmlHashRemoveEntry2
xmlHashRemoveEntry3
xmlHashScan
xmlHashScan3
xmlHashScanFull
xmlHashScanFull3
xmlHashSize
xmlHashUpdateEntry
xmlHashUpdateEntry2
xmlHashUpdateEntry3
xmlInitCharEncodingHandlers
xmlInitGlobals
xmlInitMemory
xmlInitNodeInfoSeq
xmlInitParser
xmlInitParserCtxt
xmlInitThreads
xmlInitializeDict
xmlInitializeGlobalState
xmlIsBaseChar
xmlIsBaseCharGroup
xmlIsBlank
xmlIsBlankNode
xmlIsChar
xmlIsCharGroup
xmlIsCombining
xmlIsCombiningGroup
xmlIsDigit
xmlIsDigitGroup
xmlIsExtender
xmlIsExtenderGroup
xmlIsID
xmlIsIdeographic
xmlIsIdeographicGroup
xmlIsLetter
xmlIsMainThread
xmlIsMixedElement
xmlIsPubidChar
xmlIsPubidChar_tab
xmlIsRef
xmlIsXHTML
xmlKeepBlanksDefault
xmlLastElementChild
xmlLineNumbersDefault
xmlLinkGetData
xmlListAppend
xmlListClear
xmlListCopy
xmlListCreate
xmlListDelete
xmlListDup
xmlListEmpty
xmlListEnd
xmlListFront
xmlListInsert
xmlListMerge
xmlListPopBack
xmlListPopFront
xmlListPushBack
xmlListPushFront
xmlListRemoveAll
xmlListRemoveFirst
xmlListRemoveLast
xmlListReverse
xmlListReverseSearch
xmlListReverseWalk
xmlListSearch
xmlListSize
xmlListSort
xmlListWalk
xmlLoadExternalEntity
xmlLockLibrary
xmlMalloc
xmlMallocAtomic
xmlMallocAtomicLoc
xmlMallocLoc
xmlMemBlocks
xmlMemDisplay
xmlMemDisplayLast
xmlMemFree
xmlMemGet
xmlMemMalloc
xmlMemRealloc
xmlMemSetup
xmlMemShow
xmlMemStrdup
xmlMemStrdupLoc
xmlMemUsed
xmlMemoryDump
xmlMemoryStrdup
xmlMutexLock
xmlMutexUnlock
xmlNewCDataBlock
xmlNewCharEncodingHandler
xmlNewCharRef
xmlNewChild
xmlNewComment
xmlNewDoc
xmlNewDocComment
xmlNewDocElementContent
xmlNewDocFragment
xmlNewDocNode
xmlNewDocNodeEatName
xmlNewDocPI
xmlNewDocProp
xmlNewDocRawNode
xmlNewDocText
xmlNewDocTextLen
xmlNewDtd
xmlNewElementContent
xmlNewEntity
xmlNewEntityInputStream
xmlNewIOInputStream
xmlNewInputFromFile
xmlNewInputStream
xmlNewMutex
xmlNewNode
xmlNewNodeEatName
xmlNewNs
xmlNewNsProp
xmlNewNsPropEatName
xmlNewPI
xmlNewParserCtxt
xmlNewProp
xmlNewRMutex
xmlNewReference
xmlNewStringInputStream
xmlNewText
xmlNewTextChild
xmlNewTextLen
xmlNewTextReader
xmlNewTextReaderFilename
xmlNextChar
xmlNextElementSibling
xmlNoNetExternalEntityLoader
xmlNodeAddContent
xmlNodeAddContentLen
xmlNodeBufGetContent
xmlNodeDump
xmlNodeDumpOutput
xmlNodeGetBase
xmlNodeGetContent
xmlNodeGetLang
xmlNodeGetSpacePreserve
xmlNodeIsText
xmlNodeListGetRawString
xmlNodeListGetString
xmlNodeSetBase
xmlNodeSetContent
xmlNodeSetContentLen
xmlNodeSetLang
xmlNodeSetName
xmlNodeSetSpacePreserve
xmlNormalizeURIPath

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 497KB - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf22ae17da1c252f6e8930b7620fbb98

Headers

DLL Characteristics

File Characteristics

Imports

libeay32

libssl32

ws2_32

kernel32

advapi32

msvcr110

msvcp110

psapi

dbghelp

Exports

Exports

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 73KB - Virtual size: 90KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 497KB - Virtual size: 497KB

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 73KB - Virtual size: 90KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 497KB - Virtual size: 497KB