GameData[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

GameData.dll
Size

2.1MB
MD5

c5b25b27e6e379018b4f4aa278adb41f
SHA1

8917bc2418a1cc140756333f4b77b01e3b2b7746
SHA256

87ae46737f0591c052b59bee3d67c652013ada46f075b65e819ff095ac2d6a1c
SHA512

ad2c3bc93cd7aba844494ebe324a63e355fa2755a42a7b1d84859793fad0cbeb29f1e68b42de1de7c5def62b0094842797fd1d077068cca0be79de01842b0649
SSDEEP

24576:0VI1xbq0mCM306DonIRM3M74y8vBZAr5d/IX7pfwv:0qbq0mCI06DBMc74y8JZA7/Q7hwv

Score

1^/10

Malware Config

Signatures

Files

GameData.dll
.dll windows:5 windows x86 arch:x86

90ff07a3b38c5f261fcfd2443b1f6548

Code Sign

0e:2b:22:41:f5:a0:16:dc:01:06:27:4a:a1:5e:15:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

02/04/2019, 00:00

Not After

05/04/2022, 12:00

Subject

CN=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,OU=Research and development department,O=Fujian NetDragon Computer Network Information Technology Co.\,Ltd,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ac:01:48:df:55:c9:5e:21:8e:cb:da:89:ea:5d:51:a8:e3:a1:af:08
Signer

Actual PE Digest

ac:01:48:df:55:c9:5e:21:8e:cb:da:89:ea:5d:51:a8:e3:a1:af:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\MyCode\Release\春节嘉年华\VS2008_Proj\Bin\Release_DX9\GameData.pdb

Imports

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetCurrentDirectoryA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileIntA
lstrlenA
GetPrivateProfileStringA
GetCurrentProcess
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

basecode

?GetFloatData@CMyIni@@QBEMPBD0M@Z
??4CMyString@@QAEAAV0@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??4CMyString@@QAEAAV0@ABV0@@Z
?append@CMyString@@QAEXI@Z
??0CMyString@@QAE@ABV0@@Z
?SetString@SimpleString@@QAEXPBD@Z
??0SimpleString@@QAE@XZ
?IsSpecialClientVersion@@YA_NXZ
?GetNormalClientPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0CMyString@@QAE@PBD@Z
?Split@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$set@HU?$less@H@std@@V?$allocator@H@2@@2@D@Z
??1CProfile@@QAE@XZ
?LogMsg@@YAXPBDZZ
??0CProfile@@QAE@PBD_N@Z
?Split@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@D@Z
??1IntBuffer@@UAE@XZ
??0IntBuffer@@QAE@XZ
?SafeStrcpy@@YAXPADPBDH@Z
?IniDataGet@@YAHPBD00AAHH@Z
?ErrorOut@@YAXPBDZZ
?TestSoundFormat@@YA_NPBD@Z
??1CMyString@@UAE@XZ
??4CMyString@@QAEAAV0@PBD@Z
??0CMyString@@QAE@XZ
?ReplaceString@@YAXPADDD@Z
?localSvrTime@@YAPAUtm@@XZ
?LocalSvrMakeTime@@YA_JPAUtm@@@Z
??0IntBuffer@@QAE@ABV0@@Z
??4IntBuffer@@QAEXABV0@@Z
?safencopy@@YA_NPADHPBDH@Z
??1Int128@@UAE@XZ
??0Int128@@QAE@H@Z
??0Int128@@QAE@_J0@Z
??0IntBuffer@@QAE@AB_J@Z
??0IntBuffer@@QAE@ABVInt128@@0@Z
??4Int128@@QAEXABV0@@Z
?GetYMHMSFromeTimeT@@YAX_JAAUTimeDate@@@Z
??8IntBuffer@@QAE_NABVInt128@@@Z
??8IntBuffer@@QAE_NABV0@@Z
?DataReplace@@YA_J_JIIK@Z
?TimeGet@@YAKXZ
?EnumMoveNext@CMyIni@@QAE_NXZ
?GetString@CMyIni@@QBEPBDPBD00@Z
?EnumSection@CMyIni@@QAEPBDXZ
?BeginEnumSection@CMyIni@@QAEXXZ
?CreateNew@CMyIni@@SAPAV1@PBD_N@Z
?LogProfileMsg@@YAXPBDZZ
?IniStrGet@@YAHPBD00PADH@Z
?safecopy@@YA_NPADHPBD@Z
?GetData@CMyIni@@QBEHPBD0H@Z
?SafeSprintf@@YA_NPADHPBDZZ
?SvrSystemTime@@YA_JXZ
?GetInt64Data@CMyIni@@QBE_JPBD0_J@Z
?format@CMyString@@QAAXPBDZZ
?RandGet@@YAHHH@Z
?Split@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@HV?$allocator@H@std@@@2@D@Z
?CQfopen@@YAPAU_iobuf@@PBD0@Z
??0IntBuffer@@QAE@ABVInt128@@000@Z
?ErrorMsg@@YAXPBDZZ
?GetHHMMFromIntervalMin@@YA_JH@Z
?GetSvrSystemTimeInfo@@YAPAUtm@@XZ
??1CIniFile@@UAE@XZ
?GetValue@CIniFile@@QAEPBDHPBD@Z
?GetValueDw@CIniFile@@QAEKHPBD@Z
?GetValueI@CIniFile@@QAEHHPBD@Z
?GetKeyName@CIniFile@@QAEPBDH@Z
?GetKeyAmount@CIniFile@@QAEHXZ
?ReadFile@CIniFile@@QAE_NPBD@Z
??0CIniFile@@QAE@XZ
?GetTheMonthBeginTime@@YA_J_J@Z
?GetTheWeekBeginTime@@YA_J_J@Z
?GetTimeFromIntervalDay@@YA_JH@Z

graphicdata

GameDataSetQuery

shlwapi

PathFileExistsA

c3sound

?DXUnLoadBank@@YAXK@Z
?UnBindAllBank@@YAXXZ
?DebugCommand@@YA_NPBD@Z
?CreateASoundGameObj@@YAPAVC3SoundGameObj@@PBD@Z
?ClearASoundGameObj@@YAXPAVC3SoundGameObj@@@Z
?SetState@@YAXPBD0@Z
?BindBank@@YA_NPAVC3SoundGameObj@@PBD_N@Z
?DXLoadBank@@YAKPBD@Z
?InitSoundEngine@@YA_NPBD0@Z
?AddResPath@@YAFPBD@Z
?ShutDownSoundEngine@@YAXXZ
?DXPlay3DSound@@YAPBVCSound@@PBDHHHHH0_N@Z
?DXPlaySound@@YAPBVCSound@@PBDHHHH0_N@Z

msvcp90

??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Unlock@_Mutex@std@@QAEXXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xran@_String_base@std@@SAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Lock@_Mutex@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

graphic

?Str2ID@@YAKPBD@Z

role3d

?Reset_EffectLifeTime@@YAXPBDK@Z

msvcr90

_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
memmove_s
ldiv
atoi
sscanf
fgets
fclose
fread
fopen
??0exception@std@@QAE@XZ
_localtime64
strchr
strstr
malloc
memcpy
_purecall
sprintf
strtoul
_snprintf
atol
fscanf
rand
srand
_atoi64
fseek
_stricmp
strncmp
feof
exit
_time64
_mbsinc
memmove
iswspace
fprintf
strncpy
_itoa
rewind
ftell
fwrite
??_V@YAXPAX@Z
ferror
fputc
atof
isspace
tolower
isalpha
isalnum
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
__CxxFrameHandler3
memset

psapi

GetProcessMemoryInfo

Exports

Exports

??0C3DMotionTrans@@AAE@XZ
??0C3DMotionTrans@@QAE@ABV0@@Z
??0CItemData@@QAE@ABV0@@Z
??0CItemData@@QAE@XZ
??0CMagicData@@QAE@ABV0@@Z
??0CMagicData@@QAE@XZ
??0DataCache@@QAE@XZ
??0IWorldTreeData@@QAE@ABV0@@Z
??0IWorldTreeData@@QAE@XZ
??1C3DMotionTrans@@QAE@XZ
??1CItemData@@UAE@XZ
??1CMagicData@@UAE@XZ
??1DataCache@@QAE@XZ
??1IWorldTreeData@@UAE@XZ
??4C3DMotionTrans@@QAEAAV0@ABV0@@Z
??4CItemData@@QAEAAV0@ABV0@@Z
??4CMagicData@@QAEAAV0@ABV0@@Z
??4DataCache@@QAEAAV0@ABV0@@Z
??4IWorldTreeData@@QAEAAV0@ABV0@@Z
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
??_7CItemData@@6B@
??_7CMagicData@@6B@
??_7IWorldTreeData@@6B@
?CheckItem@CItemData@@QAEHPBD@Z
?Create@CMagicData@@QAEXXZ
?CreateAdditionalInfo@CItemData@@AAEXXZ
?CreateGodMaxProgressInfo@CItemData@@AAEXXZ
?CreateTrumpAdditionExp@CItemData@@AAEXXZ
?Destory@C3DMotionTrans@@SAXXZ
?Destroy@CMagicData@@AAEXXZ
?GET_3D_MOTION@@YAPAVC3DMotion@@PBD_JKK@Z
?GetCount@DataCache@@QAEHXZ
?GetGodAdditionAddProgressEveryTime@CItemData@@QBEII@Z
?GetGodAdditionMaxProgress@CItemData@@QBEII@Z
?GetGodThirdGemAddProgressEveryTime@CItemData@@QBEIXZ
?GetGodThirdGemMaxProgress@CItemData@@QBEIXZ
?GetInstance@CItemData@@SAAAV1@XZ
?GetInstance@IWorldTreeData@@SAAAV1@XZ
?GetInstance@KFDBSystem@@SAAAV1@XZ
?GetItemAdditionByGod@CItemData@@QAEHIHAAUst_ItemAdditionInfo@@@Z
?GetItemAdditionBySoul@CItemData@@QAEHIHAAUst_ItemAdditionInfo@@@Z
?GetItemAdditionInfo@CItemData@@QAEHIHHAAUst_ItemAdditionInfo@@@Z
?GetItemOfficialType@CItemData@@QAEHIH@Z
?GetItemType@CItemData@@AAEHI@Z
?GetItemTypeInfo@CItemData@@QAEHIAAUItemTypeInfo@@@Z
?GetMagicTypeInfo@CMagicData@@QAEHIKAAUFDB_MAGIC_TYPE@@@Z
?GetMagicTypeInfo@CMagicData@@QAEPAUFDB_MAGIC_TYPE@@IK@Z
?GetTrumpLevDiscountExp@CItemData@@QBEIHH@Z
?GetTrumpLevExp@CItemData@@QBEIHH@Z
?GetTrumpMaterialExp@CItemData@@QAEIH@Z
?Init@C3DMotionTrans@@SAXXZ
?InputData@DataCache@@QAEXPADH@Z
?InputInt64@DataCache@@QAEXAB_J@Z
?InputInt@DataCache@@QAEXABH@Z
?InputString@DataCache@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?InputVectorInt@DataCache@@QAEXABV?$vector@HV?$allocator@H@std@@@std@@@Z
?InputVectorString@DataCache@@QAEXABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?IsCountAble@CItemData@@QAEHI@Z
?IsPurchase@CItemData@@QAE_NI@Z
?ItemGetSort@CItemData@@AAEHI@Z
?KFDBSystemDestory@@YAXXZ
?Load@C3DMotionTrans@@QAE_NXZ
?Load@DataCache@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?MyClearSoundGameObj@@YAXAAPAVC3SoundGameObj@@_N@Z
?MyCreateSoundGameObj@@YAPAVC3SoundGameObj@@PBD@Z
?MyGlobalSetEventSwitch@@YAXW4EEventType@C3DRoleData@@_N@Z
?MyGlobalSoundPostEvent@@YAXPBD@Z
?MyGlobalSoundSetVolume@@YAXHPBD@Z
?MyInitSoundEngine@@YA_NXZ
?MyShutDownSoundEngine@@YAXXZ
?MySoundDebugCommand@@YAXPBD@Z
?MySoundSetState@@YAXPBD0@Z
?MyUnLoadAllBank@@YAXXZ
?OutputData@DataCache@@QAEPAXAAH@Z
?OutputInt64@DataCache@@QAE_JXZ
?OutputInt@DataCache@@QAEHXZ
?OutputString@DataCache@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?OutputVectorInt@DataCache@@QAEXAAV?$vector@HV?$allocator@H@std@@@std@@@Z
?OutputVectorString@DataCache@@QAEXAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?ReLoad@CItemData@@QAEXXZ
?Release@IWorldTreeData@@SAXXZ
?RoleDataDestroy@@YAXXZ
?RoleDataQuery@@YAAAVC3DRoleData@@XZ
?SEARCH_3D_MOTION@@YA_J_J@Z
?Save@DataCache@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Search@C3DMotionTrans@@QAE_JPBD_J@Z
?SearchOriKey@C3DMotionTrans@@QAE_JPBD_JAAV?$vector@_JV?$allocator@_J@std@@@std@@@Z
?SearchPartBase@C3DMotionTrans@@QAEHHH@Z
?SearchPartOriKey@C3DMotionTrans@@QAE_JH_JAAV?$vector@_JV?$allocator@_J@std@@@std@@@Z
?SearchWeaponOriKey@C3DMotionTrans@@QAE_JH_JAAV?$vector@_JV?$allocator@_J@std@@@std@@@Z
?SetCallBackPostEvent@@YAXP6AXPBD@Z@Z
?s_mapItemType@CItemData@@0V?$map@IUItemTypeInfo@@U?$less@I@std@@V?$allocator@U?$pair@$$CBIUItemTypeInfo@@@std@@@3@@std@@A
ACTION_INTERVAL_TIMES
RoleDataDestroyEx
RoleDataQueryEx
TrimLeft
TrimRight
_KFDBGetFileInfo

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90ff07a3b38c5f261fcfd2443b1f6548

Code Sign

0e:2b:22:41:f5:a0:16:dc:01:06:27:4a:a1:5e:15:deCertificate

Extended Key Usages

Key Usages

ac:01:48:df:55:c9:5e:21:8e:cb:da:89:ea:5d:51:a8:e3:a1:af:08Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

basecode

graphicdata

shlwapi

c3sound

msvcp90

graphic

role3d

msvcr90

psapi

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 297KB - Virtual size: 297KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 91KB - Virtual size: 91KB

0e:2b:22:41:f5:a0:16:dc:01:06:27:4a:a1:5e:15:de
Certificate

ac:01:48:df:55:c9:5e:21:8e:cb:da:89:ea:5d:51:a8:e3:a1:af:08
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 297KB - Virtual size: 297KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 91KB - Virtual size: 91KB