OSFMount_1[.]5[.]1012（挂载img镜像，支持x64和x86）[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

OSFMount_1.5.1012（挂载img镜像，支持x64和x86）.exe
Size

767KB
MD5

43d66d51e14a593bb58c056845225c2d
SHA1

3420596825122b0d396944e1592b1b368cbfc76f
SHA256

18b8e8c6bed7edf8ff7433c94f51048aabc64c4f935e1736c7b8a188c70a8cfd
SHA512

492c728aa14e93f2b46137ef1d233ed5573d7b01c6472e4b1309b0356a5b63dbe4851330fed8df711fb8dee599601fb23b3f53fe724a9ae9dd23bee3c8ea02b1
SSDEEP

12288:qT9Mld5TSxEfKf0P8mTgS4O0jae/YNB+NkkgcbQppJdc+21X1cyTt8+jKX2AflIV:qT9AfZKrC6p/sGkkHCGJX1cMZjQ2+WyI

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
OSFMount_1.5.1012（挂载img镜像，支持x64和x86）.exe
unpack001/$APPDATA/OSFMount_X32/OSFMount.exe
unpack001/$APPDATA/OSFMount_X64/OSFMount.exe
unpack001/$PLUGINSDIR/System.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

OSFMount_1.5.1012（挂载img镜像，支持x64和x86）.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/OSFMount_X32/OSFMount.com
.exe windows:5 windows x86 arch:x86

1cc0d47ad3644a8be778e601acbb05ce

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f7:ff:bb:08:76:7e:cb:46:32:60:32:15:49:27:77:df
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/09/2012, 00:00

Not After

28/09/2015, 23:59

Subject

CN=PassMark Software Pty Ltd,O=PassMark Software Pty Ltd,POSTALCODE=2010,STREET=Surry Hills+STREET=35 Buckingham Street+STREET=Suite 202\, Level 2\,,L=Sydney,ST=NSW,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d7:4f:26:2f:04:03:56:9d:6b:2d:80:0a:66:c5:7e:9d:e4:4c:f9:e9
Signer

Actual PE Digest

d7:4f:26:2f:04:03:56:9d:6b:2d:80:0a:66:c5:7e:9d:e4:4c:f9:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\passmark\OSFMount\osfmountcli\Release\OSFMount.pdb

Imports

kernel32

Sleep
ReadFile
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetLastError
SetLastError
GetProcAddress
DefineDosDeviceW
DeviceIoControl
CloseHandle
LocalFree
GlobalMemoryStatus
LoadLibraryW
WideCharToMultiByte
WriteFile
GetModuleHandleW
GetLogicalDrives
FreeLibrary
SetEndOfFile
SetFilePointer
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
IsProcessorFeaturePresent
HeapSize
GetStringTypeW
LCMapStringW
GetCurrentDirectoryW
CreateFileA
GetFullPathNameA
GetTimeZoneInformation
RtlUnwind
MultiByteToWideChar
FormatMessageA
IsDBCSLeadByte
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
ExitProcess
DecodePointer
GetCommandLineW
HeapSetInformation
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
HeapReAlloc
WriteConsoleW
GetStdHandle
GetProcessHeap
FindClose
GetDriveTypeA
FindFirstFileExA
FindNextFileA
CreateDirectoryA
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
HeapCreate
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

advapi32

OpenServiceW
ControlService
StartServiceW
RegDeleteKeyW
CreateServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

user32

CharToOemA
TranslateMessage
IsDialogMessageW
PeekMessageW
SendMessageTimeoutW
DispatchMessageW

ws2_32

ntohl
htonl

Sections

.text
Size: 287KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$APPDATA/OSFMount_X32/OSFMount.exe
.exe windows:5 windows x86 arch:x86

fe889094bdab5b1db8af63fa6f9964a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
ReadFile
VirtualAlloc
CloseHandle
DeleteFileW
DeleteFileA
WideCharToMultiByte
GetVolumeInformationW
QueryDosDeviceW
GetFileSizeEx
GetVersionExW
VirtualFree
GetFileSize
SetFilePointer
SetEndOfFile
CreateFileW
FlushFileBuffers
GetModuleHandleW
GetModuleFileNameW
WaitNamedPipeW
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
HeapSize
LCMapStringW
GetCurrentDirectoryW
Sleep
GetFullPathNameA
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
MultiByteToWideChar
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetStringTypeW
HeapCreate
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
IsValidCodePage
GetOEMCP
DefineDosDeviceW
GetLogicalDrives
DeviceIoControl
SetLastError
GetLastError
FormatMessageW
GetProcAddress
GetACP
InterlockedDecrement
LocalFree
FreeLibrary
LoadLibraryW
CreateFileA
IsDBCSLeadByte
HeapFree
HeapAlloc
GetFileAttributesW
ExitThread
ResumeThread
CreateThread
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
WriteConsoleW
GetFileType
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
HeapReAlloc
GetProcessHeap
FindClose
GetDriveTypeA
FindFirstFileExA
FindNextFileA
CreateDirectoryA
GetSystemTimeAsFileTime
GetCPInfo
InterlockedIncrement

advapi32

StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
CreateServiceW
ControlService
RegDeleteKeyW
DeleteService

user32

LoadCursorW
RegisterClassExW
SetClassLongW
GetMessageW
GetMenu
EnableMenuItem
DrawMenuBar
MapWindowPoints
GetSubMenu
TrackPopupMenu
PostQuitMessage
DefWindowProcW
GetDC
ReleaseDC
LoadIconW
IsDlgButtonChecked
GetDlgItemTextW
GetDlgItemInt
GetWindowTextW
GetWindowTextLengthW
CheckRadioButton
SetFocus
DialogBoxParamW
CheckDlgButton
SetDlgItemInt
SendDlgItemMessageW
EnableWindow
CreateDialogParamW
SetDlgItemTextW
DestroyWindow
wsprintfW
GetParent
SendMessageW
EndDialog
SetWindowTextW
SendMessageTimeoutW
MessageBoxW
GetPropW
ShowWindow
SetPropW
GetDlgItem
RemovePropW
PeekMessageW
DispatchMessageW
IsDialogMessageW
TranslateMessage

shell32

SHFormatDrive
ShellExecuteW

comctl32

ImageList_Create
ord17
ImageList_ReplaceIcon

comdlg32

GetOpenFileNameW
GetSaveFileNameW

mpr

WNetGetConnectionW

gdi32

DeleteObject
CreateFontW
GetDeviceCaps

ws2_32

ntohl
htonl

Sections

.text
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/OSFMount_X32/OSFMount.sys
.sys windows:6 windows x86 arch:x86

d114112efdbea45fd8b41b5145f89d4f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:e7:fa:0d:b1:a3:98:f8:05:bb:85:a6:91:71:dc:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22/09/2009, 00:00

Not After

18/10/2012, 23:59

Subject

CN=PassMark Software Pty Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PassMark Software Pty Ltd,ST=NSW,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:5e:ae:65:af:9d:08:00:cf:bc:8e:96:e0:3b:00:4c:ed:ba:4f:00
Signer

Actual PE Digest

13:5e:ae:65:af:9d:08:00:cf:bc:8e:96:e0:3b:00:4c:ed:ba:4f:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\passmark\osfmount\sys\i386\OSFMount.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IofCompleteRequest
KeSetEvent
ExfInterlockedInsertTailList
MmLockPagableDataSection
ZwReadFile
memcpy
KeWaitForSingleObject
IofCallDriver
KeResetEvent
IoBuildSynchronousFsdRequest
KeInitializeEvent
ObfDereferenceObject
ZwWriteFile
ObReferenceObjectByHandle
IoFileObjectType
SeSinglePrivilegeCheck
_alldiv
ObReferenceObjectByPointer
IoDeleteDevice
IoCreateDevice
ZwOpenKey
RtlAppendUnicodeToString
RtlCopyUnicodeString
MmPageEntireDriver
KeGetCurrentThread
MmResetDriverPaging
ZwFreeVirtualMemory
ZwQueryInformationFile
ZwAllocateVirtualMemory
ZwSetInformationFile
IoCreateUnprotectedSymbolicLink
RtlUnicodeStringToAnsiString
RtlInitAnsiString
ZwCreateFile
SeTokenType
SeImpersonateClient
SeCreateClientSecurity
_wcsnicmp
_allshr
_allmul
_allshl
ExfInterlockedRemoveHeadList
PsTerminateSystemThread
KeSetPriorityThread
_vsnprintf
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
DbgPrint
ZwOpenFile
strncmp
RtlTimeToTimeFields
ZwCreateDirectoryObject
RtlCopyString
RtlCompareString
RtlUnicodeStringToInteger
vDbgPrintEx
isdigit
isspace
ZwQueryDirectoryFile
KeTickCount
memset
KeDelayExecutionThread
ExAllocatePool
ExFreePool
_snwprintf
RtlInitUnicodeString
ZwQueryValueKey
PsCreateSystemThread
ZwClose
RtlFreeAnsiString
MmMapLockedPages
_allrem
_aulldiv
atoi
_stricmp
rand
_strnicmp
sprintf
_snprintf
_aullshr
_aullrem
_aulldvrm
strrchr
strchr
_alldvrm
strstr
strncpy
wcsncpy

hal

KeGetCurrentIrql

Sections

.text
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$APPDATA/OSFMount_X64/OSFMount.com
.exe windows:5 windows x64 arch:x64

7fba5589d3bbda11ab050ec478b88352

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f7:ff:bb:08:76:7e:cb:46:32:60:32:15:49:27:77:df
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/09/2012, 00:00

Not After

28/09/2015, 23:59

Subject

CN=PassMark Software Pty Ltd,O=PassMark Software Pty Ltd,POSTALCODE=2010,STREET=Surry Hills+STREET=35 Buckingham Street+STREET=Suite 202\, Level 2\,,L=Sydney,ST=NSW,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

bc:1e:ad:c5:38:ee:3e:f6:c7:25:47:2a:29:90:b2:2b:82:76:c4:bd
Signer

Actual PE Digest

bc:1e:ad:c5:38:ee:3e:f6:c7:25:47:2a:29:90:b2:2b:82:76:c4:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\passmark\OSFMount\osfmountcli\x64\Release\OSFMount.pdb

Imports

kernel32

Sleep
ReadFile
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetLastError
SetLastError
GetProcAddress
DefineDosDeviceW
DeviceIoControl
CloseHandle
LocalFree
GlobalMemoryStatus
LoadLibraryW
WideCharToMultiByte
WriteFile
GetModuleHandleW
GetLogicalDrives
FreeLibrary
SetEndOfFile
SetFilePointer
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
HeapSize
GetStringTypeW
LCMapStringW
GetCurrentDirectoryW
CreateFileA
GetFullPathNameA
GetTimeZoneInformation
MultiByteToWideChar
GetCurrentProcessId
GetTickCount
FormatMessageA
IsDBCSLeadByte
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
ExitProcess
DecodePointer
GetCommandLineW
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
HeapReAlloc
WriteConsoleW
GetStdHandle
GetProcessHeap
FindClose
GetDriveTypeA
FindFirstFileExA
FindNextFileA
CreateDirectoryA
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
RtlUnwindEx
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter

advapi32

OpenServiceW
ControlService
StartServiceW
RegDeleteKeyW
CreateServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

user32

CharToOemA
TranslateMessage
IsDialogMessageW
PeekMessageW
SendMessageTimeoutW
DispatchMessageW

ws2_32

ntohl
htonl

Sections

.text
Size: 322KB - Virtual size: 321KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$APPDATA/OSFMount_X64/OSFMount.exe
.exe windows:5 windows x64 arch:x64

1bd8798d7a34ed8b69f19df7793ab3e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WriteFile
ReadFile
VirtualAlloc
CloseHandle
DeleteFileW
DeleteFileA
WideCharToMultiByte
GetVolumeInformationW
QueryDosDeviceW
GetFileSizeEx
GetVersionExW
VirtualFree
GetFileSize
SetFilePointer
SetEndOfFile
CreateFileW
FlushFileBuffers
GetModuleHandleW
GetModuleFileNameW
WaitNamedPipeW
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
HeapSize
LCMapStringW
GetCurrentDirectoryW
Sleep
GetFullPathNameA
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
MultiByteToWideChar
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
GetStringTypeW
HeapCreate
GetVersion
HeapSetInformation
GetCurrentProcess
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlsAlloc
GetCurrentThreadId
FlsFree
FlsSetValue
FlsGetValue
DefineDosDeviceW
GetLogicalDrives
DeviceIoControl
SetLastError
GetLastError
FormatMessageW
GetProcAddress
EncodePointer
IsValidCodePage
LocalFree
FreeLibrary
LoadLibraryW
CreateFileA
IsDBCSLeadByte
HeapFree
HeapAlloc
GetFileAttributesW
ExitThread
ResumeThread
CreateThread
ExitProcess
DecodePointer
GetCommandLineA
GetStartupInfoW
WriteConsoleW
GetFileType
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
HeapReAlloc
GetProcessHeap
FindClose
GetDriveTypeA
FindFirstFileExA
FindNextFileA
CreateDirectoryA
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP

advapi32

CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
CreateServiceW
ControlService
RegDeleteKeyW
DeleteService

user32

LoadCursorW
RegisterClassExW
SetClassLongPtrW
GetMessageW
DefWindowProcW
GetDC
ReleaseDC
LoadIconW
MapWindowPoints
GetMenu
GetSubMenu
TrackPopupMenu
EnableMenuItem
DrawMenuBar
PostQuitMessage
IsDlgButtonChecked
GetDlgItemTextW
GetDlgItemInt
GetWindowTextW
GetWindowTextLengthW
CheckRadioButton
SetFocus
DialogBoxParamW
CheckDlgButton
SetDlgItemInt
SendDlgItemMessageW
EnableWindow
CreateDialogParamW
SetDlgItemTextW
DestroyWindow
wsprintfW
GetParent
SendMessageW
EndDialog
SetWindowTextW
SendMessageTimeoutW
MessageBoxW
GetPropW
ShowWindow
SetPropW
GetDlgItem
RemovePropW
PeekMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW

shell32

SHFormatDrive
ShellExecuteW

comctl32

ImageList_Create
ord17
ImageList_ReplaceIcon

comdlg32

GetOpenFileNameW
GetSaveFileNameW

mpr

WNetGetConnectionW

gdi32

GetDeviceCaps
CreateFontW
DeleteObject

ws2_32

ntohl
htonl

Sections

.text
Size: 349KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/OSFMount_X64/OSFMount.sys
.sys windows:6 windows x64 arch:x64

80684d4e26d9948d0e2175bd15e0314f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:e7:fa:0d:b1:a3:98:f8:05:bb:85:a6:91:71:dc:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22/09/2009, 00:00

Not After

18/10/2012, 23:59

Subject

CN=PassMark Software Pty Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PassMark Software Pty Ltd,ST=NSW,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:37:5a:50:77:ab:9d:35:d7:40:e0:ef:7d:74:df:50:27:be:84:e4
Signer

Actual PE Digest

32:37:5a:50:77:ab:9d:35:d7:40:e0:ef:7d:74:df:50:27:be:84:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\passmark\osfmount\sys\amd64\OSFMount.pdb

Imports

ntoskrnl.exe

KeSetPriorityThread
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
RtlAppendUnicodeToString
KeInitializeEvent
RtlInitAnsiString
RtlUnicodeStringToAnsiString
MmPageEntireDriver
ZwSetInformationFile
SeCreateClientSecurity
KeDelayExecutionThread
IoFileObjectType
ZwCreateFile
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
SeImpersonateClient
ZwQueryValueKey
IoCreateUnprotectedSymbolicLink
ExAllocatePool
ExInterlockedInsertTailList
PsTerminateSystemThread
ZwFreeVirtualMemory
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
RtlFreeAnsiString
ExInterlockedRemoveHeadList
ZwReadFile
ObfDereferenceObject
IoCreateDevice
ZwQueryInformationFile
ZwWriteFile
MmLockPagableDataSection
wcscpy
ObReferenceObjectByPointer
IofCallDriver
SeTokenType
ZwAllocateVirtualMemory
ZwOpenKey
ExAllocatePoolWithTag
strncmp
RtlAnsiStringToUnicodeString
isspace
vDbgPrintEx
ZwCreateDirectoryObject
RtlCompareString
RtlFreeUnicodeString
ZwQueryDirectoryFile
_vsnprintf
isdigit
RtlTimeToTimeFields
RtlCopyString
RtlUnicodeStringToInteger
ZwOpenFile
DbgPrint
KeBugCheckEx
_wcsnicmp
IoBuildSynchronousFsdRequest
MmResetDriverPaging
_snwprintf
KeResetEvent
ExFreePoolWithTag
IoDeleteSymbolicLink
RtlCopyUnicodeString
SeSinglePrivilegeCheck
_stricmp
strlen
atoi
rand
_strnicmp
_snprintf
strcmp
sprintf
strchr
strrchr
strcpy
strstr
strncpy
strcat
wcsncpy
__chkstk

Sections

.text
Size: 453KB - Virtual size: 452KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 707KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 23KB - Virtual size: 22KB

1cc0d47ad3644a8be778e601acbb05ce

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

f7:ff:bb:08:76:7e:cb:46:32:60:32:15:49:27:77:dfCertificate

Extended Key Usages

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

d7:4f:26:2f:04:03:56:9d:6b:2d:80:0a:66:c5:7e:9d:e4:4c:f9:e9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

ws2_32

Sections

.text Size: 287KB - Virtual size: 287KB

.rdata Size: 90KB - Virtual size: 89KB

.data Size: 7KB - Virtual size: 149KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 16KB - Virtual size: 16KB

fe889094bdab5b1db8af63fa6f9964a2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

shell32

comctl32

comdlg32

mpr

gdi32

ws2_32

Sections

.text Size: 309KB - Virtual size: 309KB

.rdata Size: 99KB - Virtual size: 98KB

.data Size: 7KB - Virtual size: 154KB

.rsrc Size: 237KB - Virtual size: 237KB

d114112efdbea45fd8b41b5145f89d4f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

38:e7:fa:0d:b1:a3:98:f8:05:bb:85:a6:91:71:dc:9dCertificate

Extended Key Usages

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 23KB - Virtual size: 22KB

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

f7:ff:bb:08:76:7e:cb:46:32:60:32:15:49:27:77:df
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

d7:4f:26:2f:04:03:56:9d:6b:2d:80:0a:66:c5:7e:9d:e4:4c:f9:e9
Signer

.text
Size: 287KB - Virtual size: 287KB

.rdata
Size: 90KB - Virtual size: 89KB

.data
Size: 7KB - Virtual size: 149KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 16KB - Virtual size: 16KB

.text
Size: 309KB - Virtual size: 309KB

.rdata
Size: 99KB - Virtual size: 98KB

.data
Size: 7KB - Virtual size: 154KB

.rsrc
Size: 237KB - Virtual size: 237KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

38:e7:fa:0d:b1:a3:98:f8:05:bb:85:a6:91:71:dc:9d
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

13:5e:ae:65:af:9d:08:00:cf:bc:8e:96:e0:3b:00:4c:ed:ba:4f:00
Signer

.text
Size: 269KB - Virtual size: 268KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 4KB - Virtual size: 706KB

PAGE
Size: 10KB - Virtual size: 10KB

INIT
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 824B

.reloc
Size: 19KB - Virtual size: 18KB

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

f7:ff:bb:08:76:7e:cb:46:32:60:32:15:49:27:77:df
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

bc:1e:ad:c5:38:ee:3e:f6:c7:25:47:2a:29:90:b2:2b:82:76:c4:bd
Signer

.text
Size: 322KB - Virtual size: 321KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 11KB - Virtual size: 154KB

.pdata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 349KB - Virtual size: 349KB

.rdata
Size: 124KB - Virtual size: 123KB

.data
Size: 11KB - Virtual size: 159KB

.pdata
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 237KB - Virtual size: 237KB