f964d8c046ca960101e7757fdddbd6f7542703ae591e1abd3e49e6acb831418a

Sharing

Copy URL Twitter E-mail

General

Target

f964d8c046ca960101e7757fdddbd6f7542703ae591e1abd3e49e6acb831418a
Size

3.9MB
MD5

c76064d8539a53cc416dccefe761f52e
SHA1

013223a0f2cc8fc3c7faa5fe596a7a245acdf465
SHA256

f964d8c046ca960101e7757fdddbd6f7542703ae591e1abd3e49e6acb831418a
SHA512

8443732356b104750fed5692166e6341f2cb6f072b68deb69fbc85b5ba10d4a2180f26b16c782291357723ee2d62405d1444692208489a59b4021ce1a90ccacf
SSDEEP

98304:CymzM+kZul5g0sHsOo+8Cd7PW+VUZ6MEtJXdFTirXw:iM+kZul55sMOfXhW+79tJXdwrA

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/Math.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/advsplash.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack002/$TEMP/$0
unpack002/$TEMP/Detect64.exe
unpack002/ClearOptions.exe
unpack002/x64/DarkWave-Studio.exe
unpack002/x64/PlugIns/ES-CoreMachines.dll
unpack002/x86/DarkWave-Studio.exe
unpack002/x86/PlugIns/ES-CoreMachines.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/DarkWaveStudio_v5.9.3.exe	nsis_installer_1
static1/unpack001/DarkWaveStudio_v5.9.3.exe	nsis_installer_2

Files

f964d8c046ca960101e7757fdddbd6f7542703ae591e1abd3e49e6acb831418a
.zip
DarkWaveStudio_v5.9.3.exe
.exe windows:4 windows x86 arch:x86

57e98d9a5a72c8d7ad8fb7a6a58b3daf

Code Sign

ec:4c:b0:a9:13:2c:e0:a7:a6:49:93:3a:b6:8a:db:88
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/01/2020, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Experience Ruby (Superior Media Ltd.),O=Experience Ruby (Superior Media Ltd.),POSTALCODE=6701203,STREET=121 Begin Menachem Rd.,L=Tel Aviv,ST=Tel Aviv,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:7a:3e:08:8a:3c:82:6a:57:2e:10:a4:34:39:af:34:1d:f4:58:a9
Signer

Actual PE Digest

6e:7a:3e:08:8a:3c:82:6a:57:2e:10:a4:34:39:af:34:1d:f4:58:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
Sleep
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
SetCurrentDirectoryA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
GlobalUnlock
GetDiskFreeSpaceA
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA

advapi32

AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 100KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Math.dll
.dll windows:4 windows x86 arch:x86

6a7dba1ca35af83a9a3593fbf002fb1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
lstrcmpA
lstrlenA
GlobalFree
lstrcatA
GlobalAlloc
lstrcpynA
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetVersion
RaiseException
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
lstrcpyA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetLastError
SetFilePointer
HeapAlloc
VirtualAlloc
HeapReAlloc
LCMapStringA
GetStringTypeW
GetOEMCP
LoadLibraryA
GetStringTypeA
FlushFileBuffers
CloseHandle
LCMapStringW
SetStdHandle
RtlUnwind

Exports

Exports

Script

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/advsplash.dll
.dll windows:4 windows x86 arch:x86

c0d4e5fadc92d88e6603d2d1c1d8421c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
LoadLibraryA
lstrcpyA
lstrcatA
GetProcAddress
GlobalAlloc
GlobalFree

user32

EnumDisplaySettingsA
LoadImageA
BeginPaint
SetWindowLongA
SystemParametersInfoA
EndPaint
GetClientRect
CreateWindowExA
DefWindowProcA
DestroyWindow
IsWindow
GetMessageA
DispatchMessageA
UnregisterClassA
wsprintfA
PostMessageA
SetWindowRgn
RegisterClassA
LoadCursorA
SetWindowPos

gdi32

BitBlt
DeleteDC
DeleteObject
CombineRgn
GetObjectA
GetDIBits
SelectObject
CreateCompatibleDC
CreateRectRgn

winmm

timeSetEvent
PlaySoundA
timeKillEvent

Exports

Exports

show

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

ebc2d915841be8afc8fa1ee9f6850960

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc

user32

DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
SetWindowLongA
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/$0
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

Bomaku
Cufamanane
Genadulifep
Hedihubor
Kigos
Kofagosime
Losumorotusut
Mugotegap
Rinutomemahid

Sections

CODE
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/Detect64.exe
.exe windows:6 windows x86 arch:x86

7e17928c5281e6bbb5178e976a5e5650

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegOpenKeyExA

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
DecodePointer

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/ExperimentalScene.bmp
ClearOptions.exe
.exe windows:6 windows x86 arch:x86

9de7aeeac8153d9fab6dd085133bd992

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenFile
DeleteFileA
WriteConsoleW
CloseHandle
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
DecodePointer

user32

MessageBoxA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sample Projects/Arpeggiator.dwp
Sample Projects/BassHead Formant Filter.dwp
Sample Projects/Chemistry 101.dwp
Sample Projects/Chemistry 202.dwp
Sample Projects/Chemistry 303.dwp
Sample Projects/Crash Drums.dwp
Sample Projects/Crunch.dwp
Sample Projects/DrumDistort.dwp
Sample Projects/Just Bass 2.dwp
Sample Projects/Just Bass.dwp
Sample Projects/Just Drums.dwp
Sample Projects/PsyRave.dwp
Sample Projects/RaveTech.dwp
Sample Projects/Space Academy 2.dwp
Sample Projects/Space Academy.dwp
Sample Projects/StereoSplitter.dwp
Uninstall.exe.nsis
x64/DarkWave-Studio.exe
.exe windows:5 windows x64 arch:x64

87d67904db8933d234d4f7a3680acf9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB Paths

C:\Users\Daniel\Documents\Projects\DarkWave-Studio\x64\Release\DarkWave-Studio.pdb

Imports

kernel32

GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FlushFileBuffers
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleCP
SetFilePointerEx
HeapSize
HeapReAlloc
GetFileType
HeapAlloc
HeapFree
GetModuleFileNameW
WriteFile
ReadFile
GetModuleHandleExW
TerminateProcess
ExitProcess
GetCurrentProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCurrentThreadId
LCMapStringW
GetProcessHeap
CreateFileW
SetEndOfFile
WriteConsoleW
CreateDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
FindClose
FindNextFileA
FindFirstFileA
SleepEx
QueueUserAPC
Sleep
CreateEventA
OpenFile
WaitForMultipleObjects
GetSystemTimeAsFileTime
GetSystemInfo
GetModuleFileNameA
GetThreadTimes
CreateThread
ResumeThread
SetThreadPriority
GetTickCount64
LoadResource
LockResource
FreeResource
FindResourceA
SizeofResource
OutputDebugStringA
CreateSemaphoreA
CloseHandle
GetCurrentProcessId
ReleaseMutex
WaitForSingleObject
CreateMutexA
ReleaseSemaphore
GetTickCount
GetLastError
MultiByteToWideChar
GetStdHandle

user32

DeleteMenu
CharLowerBuffA
FillRect
ReleaseCapture
SetCapture
DrawTextA
CheckMenuItem
GetWindowRect
EnableWindow
EndPaint
BeginPaint
ReleaseDC
GetDCEx
RegisterClassExA
SetWindowLongPtrA
GetWindowLongPtrA
SetFocus
CreateWindowExA
DefWindowProcA
MoveWindow
GetWindowLongA
SetWindowLongA
ShowWindow
WindowFromPoint
InvertRect
LoadMenuA
SetMenu
SetWindowRgn
DrawIcon
GetMessageA
DispatchMessageA
SetActiveWindow
TranslateMessage
PostQuitMessage
AdjustWindowRectEx
CallWindowProcA
GetClientRect
LoadImageA
DestroyIcon
DrawIconEx
SetTimer
PostMessageA
ScreenToClient
GetCursorPos
SetCursor
KillTimer
CreatePopupMenu
TrackPopupMenu
DestroyMenu
AppendMenuA
EnableMenuItem
InflateRect
ClientToScreen
UpdateWindow
MessageBoxA
RedrawWindow
GetWindowTextA
SetWindowTextA
SendMessageA
GetWindowTextLengthA
GetParent
GetDesktopWindow
GetFocus
LoadCursorA
DestroyWindow
GetDC
SetWindowPos

gdi32

PtInRegion
CreateRectRgn
CreatePolygonRgn
GdiFlush
Rectangle
CreatePen
SetBkMode
SetDIBits
CreateDIBSection
GetDIBits
GetDeviceCaps
GetStockObject
Polyline
TextOutA
LineTo
SelectClipRgn
MoveToEx
Polygon
SetTextColor
SetBkColor
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
CreateFontA

comdlg32

GetOpenFileNameA
GetSaveFileNameA

advapi32

RegCloseKey
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA

shell32

SHBrowseForFolderA
ShellExecuteA
SHGetSpecialFolderPathA
SHGetPathFromIDListA

dsound

ord7
ord2
ord11
ord12
ord10

winmm

midiInStart
midiInClose
midiInOpen
midiOutOpen
midiOutShortMsg
midiOutClose
midiOutGetDevCapsA
waveOutGetDevCapsA
midiInGetDevCapsA
midiInGetNumDevs
waveOutPrepareHeader
waveOutWrite
waveOutGetNumDevs
waveOutUnprepareHeader
waveOutClose
waveOutReset
waveOutOpen
midiOutGetNumDevs

comctl32

ord17

ole32

CoCreateInstance
CLSIDFromString
CoInitializeEx
CoUninitialize
CoInitialize

Sections

.text
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/PlugIns/ES-CoreMachines.dll
.dll windows:5 windows x64 arch:x64

4f4d28a11360872905181b87f44fa097

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Daniel\Documents\Projects\DarkWave-Studio\x64\Release\PlugIns\ES-CoreMachines.pdb

Imports

kernel32

SetStdHandle
GetStringTypeW
GetProcessHeap
LCMapStringW
CreateFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FlushFileBuffers
WriteConsoleW
GetTickCount64
LoadResource
LockResource
FreeResource
FindResourceA
SizeofResource
OutputDebugStringA
CreateSemaphoreA
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
ReleaseSemaphore
GetTickCount
GetLastError
FindClose
SetFilePointerEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
HeapReAlloc
HeapSize
WriteFile
GetConsoleCP
GetConsoleMode

user32

LoadImageA
SetTimer
KillTimer
SetCapture
ReleaseCapture
MessageBoxA
GetFocus
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
PostMessageA
ShowWindow
SetCursor
SetWindowLongA
GetWindowLongA
MoveWindow
DefWindowProcA
CreateWindowExA
SetFocus
GetWindowLongPtrA
SetWindowLongPtrA
RegisterClassExA
GetDCEx
ReleaseDC
BeginPaint
EndPaint
FillRect
DrawTextA

gdi32

CreatePen
SetDIBits
CreateFontA
CreateDIBSection
GetDIBits
GetDeviceCaps
GetStockObject
SetTextColor
LineTo
SelectClipRgn
MoveToEx
SetBkColor
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject

Exports

Exports

DarkPlugInit

Sections

.text
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/DarkWave-Studio.exe
.exe windows:6 windows x86 arch:x86

1785077c04cfaa474471e61ae429ecea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Daniel\Documents\Projects\DarkWave-Studio\x86\Release\DarkWave-Studio.pdb

Imports

kernel32

GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FlushFileBuffers
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleCP
SetFilePointerEx
HeapSize
HeapReAlloc
GetFileType
HeapAlloc
HeapFree
WriteFile
GetStdHandle
ReadFile
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
LCMapStringW
GetProcessHeap
CreateFileW
SetEndOfFile
WriteConsoleW
CreateDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
FindClose
FindNextFileA
FindFirstFileA
SleepEx
QueueUserAPC
Sleep
CreateEventA
OpenFile
WaitForMultipleObjects
GetSystemTimeAsFileTime
GetSystemInfo
GetModuleFileNameA
GetThreadTimes
CreateThread
ResumeThread
SetThreadPriority
GetTickCount64
LoadResource
LockResource
FreeResource
FindResourceA
SizeofResource
OutputDebugStringA
CreateSemaphoreA
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
ReleaseSemaphore
GetTickCount
GetLastError
MultiByteToWideChar
GetModuleFileNameW
DecodePointer

user32

SetCursor
CharLowerBuffA
FillRect
ReleaseCapture
SetCapture
DrawTextA
CheckMenuItem
GetWindowRect
EnableWindow
EndPaint
BeginPaint
ReleaseDC
GetDCEx
RegisterClassExA
SetFocus
CreateWindowExA
DefWindowProcA
MoveWindow
GetWindowLongA
SetWindowLongA
ShowWindow
PostMessageA
SetWindowPos
WindowFromPoint
InvertRect
LoadMenuA
SetMenu
SetWindowRgn
DrawIcon
GetMessageA
DispatchMessageA
SetActiveWindow
TranslateMessage
PostQuitMessage
AdjustWindowRectEx
CallWindowProcA
GetClientRect
LoadImageA
DestroyIcon
DrawIconEx
GetDC
KillTimer
ScreenToClient
GetCursorPos
SetTimer
DeleteMenu
CreatePopupMenu
TrackPopupMenu
DestroyMenu
AppendMenuA
EnableMenuItem
InflateRect
ClientToScreen
UpdateWindow
MessageBoxA
RedrawWindow
GetWindowTextA
SetWindowTextA
SendMessageA
GetWindowTextLengthA
GetParent
GetDesktopWindow
GetFocus
LoadCursorA
DestroyWindow

gdi32

CreatePolygonRgn
GdiFlush
Rectangle
CreatePen
CreateRectRgn
PtInRegion
SetDIBits
CreateFontA
GetDIBits
GetDeviceCaps
GetStockObject
Polyline
TextOutA
LineTo
SelectClipRgn
MoveToEx
Polygon
SetTextColor
SetBkColor
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
SetBkMode
CreateDIBSection

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegEnumKeyA

shell32

SHGetSpecialFolderPathA
SHBrowseForFolderA
ShellExecuteA
SHGetPathFromIDListA

dsound

ord7
ord12
ord10
ord11
ord2

winmm

midiInGetNumDevs
midiOutGetNumDevs
midiOutOpen
midiOutShortMsg
midiOutClose
midiInOpen
midiInStart
midiInClose
midiOutGetDevCapsA
waveOutWrite
waveOutGetNumDevs
waveOutUnprepareHeader
waveOutClose
waveOutReset
waveOutOpen
waveOutPrepareHeader
waveOutGetDevCapsA
midiInGetDevCapsA

comctl32

ord17

ole32

CoCreateInstance
CLSIDFromString
CoInitializeEx
CoUninitialize
CoInitialize

Sections

.text
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/PlugIns/ES-CoreMachines.dll
.dll windows:6 windows x86 arch:x86

82452acd77d3c568a5b9f01ed31ffa14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Daniel\Documents\Projects\DarkWave-Studio\x86\Release\PlugIns\ES-CoreMachines.pdb

Imports

kernel32

SetStdHandle
GetStringTypeW
GetProcessHeap
LCMapStringW
CreateFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FlushFileBuffers
WriteConsoleW
DecodePointer
GetTickCount64
LoadResource
LockResource
FreeResource
FindResourceA
SizeofResource
OutputDebugStringA
CreateSemaphoreA
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
ReleaseSemaphore
GetTickCount
GetLastError
FindNextFileW
FindFirstFileExW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RaiseException
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
HeapReAlloc
HeapSize
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FindClose

user32

LoadImageA
SetTimer
KillTimer
SetCapture
ReleaseCapture
MessageBoxA
GetFocus
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
PostMessageA
SetCursor
DrawTextA
SetWindowLongA
GetWindowLongA
MoveWindow
DefWindowProcA
CreateWindowExA
SetFocus
RegisterClassExA
GetDCEx
ReleaseDC
BeginPaint
EndPaint
FillRect
ShowWindow

gdi32

CreatePen
SetDIBits
CreateFontA
CreateDIBSection
GetDIBits
GetDeviceCaps
GetStockObject
SetTextColor
LineTo
SelectClipRgn
MoveToEx
SetBkColor
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject

Exports

Exports

DarkPlugInit

Sections

.text
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57e98d9a5a72c8d7ad8fb7a6a58b3daf

Code Sign

ec:4c:b0:a9:13:2c:e0:a7:a6:49:93:3a:b6:8a:db:88Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

6e:7a:3e:08:8a:3c:82:6a:57:2e:10:a4:34:39:af:34:1d:f4:58:a9Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 3.6MB

.ndata Size: - Virtual size: 100KB

.rsrc Size: 103KB - Virtual size: 102KB

6a7dba1ca35af83a9a3593fbf002fb1e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 45KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 40KB

.reloc Size: 3KB - Virtual size: 2KB

8c8a576201f68de1a3f26fc723b9f30f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 104B

.reloc Size: 1024B - Virtual size: 636B

c0d4e5fadc92d88e6603d2d1c1d8421c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winmm

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 188B

.reloc Size: 512B - Virtual size: 460B

ebc2d915841be8afc8fa1ee9f6850960

Headers

DLL Characteristics

File Characteristics

Imports

ec:4c:b0:a9:13:2c:e0:a7:a6:49:93:3a:b6:8a:db:88
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

6e:7a:3e:08:8a:3c:82:6a:57:2e:10:a4:34:39:af:34:1d:f4:58:a9
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 3.6MB

.ndata
Size: - Virtual size: 100KB

.rsrc
Size: 103KB - Virtual size: 102KB

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 40KB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 636B

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 188B

.reloc
Size: 512B - Virtual size: 460B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 628B

CODE
Size: 1.8MB - Virtual size: 1.8MB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 236B

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 3KB - Virtual size: 3KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 99KB - Virtual size: 98KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 99KB - Virtual size: 98KB

.reloc
Size: 4KB - Virtual size: 3KB