911160ef6a571c640e798b9cbce8c465_JaffaCakes118
- SHA256 91179c199ca069ef07cb1939aa20cc1ee3c91b4528402a6e3df424da2982b5ca
Overview
overview
10Static
static
3PO 778000 - JPG.exe
windows7-x64
10PO 778000 - JPG.exe
windows10-2004-x64
10$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDIR/vivo.dll
windows7-x64
3$PLUGINSDIR/vivo.dll
windows10-2004-x64
3$TEMP/SecUtil.exe
windows7-x64
1$TEMP/SecUtil.exe
windows10-2004-x64
1$TEMP/luciferase.dll
windows7-x64
1$TEMP/luciferase.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PO 778000 - JPG.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO 778000 - JPG.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/vivo.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/vivo.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$TEMP/SecUtil.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
$TEMP/SecUtil.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
$TEMP/luciferase.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
$TEMP/luciferase.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target 911160ef6a571c640e798b9cbce8c465_JaffaCakes118
- Size 306KB
- Sample240603-j2tyfagg6w
- SHA256 91179c199ca069ef07cb1939aa20cc1ee3c91b4528402a6e3df424da2982b5ca
- MD5 911160ef6a571c640e798b9cbce8c465
- SHA1 e7e41d84cbb65756c4b65836839cfd17087c6f0d
- SHA512 47a0c0aa831b3ee2e13e04cb5858086f73354bca89d2cc60d6c3e6e7bb9ae7a21d07dbff44d6e8423245aa7f6ed36360db0895f3e4d9f4299615e217949dbe60
- SSDEEP 6144:iEIlV5MOKmWJbdDfn2fBCoSE0wTdu50GYcaKTURVdxMyxtEJ7ebOIxY:5IlrMOKm4tf2goSE0wplncbUmeiIm
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack002/PO 778000 - JPG.exe unpack003/$PLUGINSDIR/UserInfo.dll unpack003/$PLUGINSDIR/vivo.dll unpack003/$TEMP/SecUtil.exe unpack003/$TEMP/luciferase.dll
File Explorer
-
911160ef6a571c640e798b9cbce8c465_JaffaCakes118.ace 306KB
-
out.ace.ace 306KB
-
PO 778000 - JPG.exe.exe 338KB
-
$PLUGINSDIR/UserInfo.dll.dll 4KB
-
$PLUGINSDIR/vivo.dll.dll 12KB
-
$TEMP/Hypoglossal213KB
-
$TEMP/SecUtil.exe.exe 36KB
-
$TEMP/directx04152002fig10.jpg.jpg 23KB
-
$TEMP/gedit-search.page.xml 4KB
-
$TEMP/luciferase.dll.dll 92KB
out.ace
- SHA256 91179c199ca069ef07cb1939aa20cc1ee3c91b4528402a6e3df424da2982b5ca
- MD5 911160ef6a571c640e798b9cbce8c465
- SHA1 e7e41d84cbb65756c4b65836839cfd17087c6f0d
- SHA512 47a0c0aa831b3ee2e13e04cb5858086f73354bca89d2cc60d6c3e6e7bb9ae7a21d07dbff44d6e8423245aa7f6ed36360db0895f3e4d9f4299615e217949dbe60
- SSDEEP 6144:iEIlV5MOKmWJbdDfn2fBCoSE0wTdu50GYcaKTURVdxMyxtEJ7ebOIxY:5IlrMOKm4tf2goSE0wplncbUmeiIm
- MD5 SHA1 SHA512 SSDEEP
PO 778000 - JPG.exe
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 77df1a0146ca3b32c884fea68e1c16af0beb5b30876fedb692bed74b6295bad1
- MD5 95913252240e4a65881ed6cc1126be23
- SHA1 9e39d022d13736cf732add2ca97f370ce2c9e704
- SHA512 ea1d233bdad2eab4109d13d45c8220a89c50c6773da142476851b474cb95c26095409688089062bffb1bcdb8e34a520cfeb5e08f82335ecefae144b4fd5e284a
- SSDEEP 6144:Q5lz/PsxMKrNPWG5vy6FQXe2D0ZwBmyeBzqgWw22:AVIpVpq6R2wZwBmGg3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13145
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/UserInfo.dll
- IMPHASH e1c0bd3d5b9f3f5cec7ea773ff66ac6e
- SHA256 9aa388c7de8e96885adcb4325af871b470ac50edb60d4b0d876ad43f5332ffd1
- MD5 9eb662f3b5fbda28bffe020e0ab40519
- SHA1 0bd28183a9d8dbb98afbcf100fb1f4f6c5fc6c41
- SHA512 6c36f7b45efe792c21d8a87d03e63a4b641169fad6d014db1e7d15badd0e283144d746d888232d6123b551612173b2bb42bf05f16e3129b625f5ddba4134b5b8
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersion
GetCurrentProcess
GlobalAlloc
GetCurrentThread
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
advapi32
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
GetAccountType
GetName
GetOriginalAccountType
Name
.text
Size
1024B
Virtual Size
694B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
705B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/vivo.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10643
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$TEMP/Hypoglossal
- SHA256 7ff54afbba9dbc494dc415d8492614bd87d1a983f7508aa3adb68f7490cd4201
- MD5 517e71291c184fe5fdb53ba4d840bc53
- SHA1 96abdd131f59a798f1041fb1ff501ff0b042b513
- SHA512 65a41e4441853405dba0362d1395fadbbb3aa1cc5a86fa256f6e8d135271a711e4e37eac455f9a43332741286de2422f8aaf01e989e5d9f78ba97c0639f3c63c
- SSDEEP 3072:yF15WG5yWyWjSO5eIMLorMXeVBqDi+jjUZINDo8iNrHyeWTE5XOcqj:OWG5vy6FQXe2D0ZwBmyeBzqj
- MD5 SHA1 SHA512 SSDEEP
$TEMP/SecUtil.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 710ab39b849a955c0cc86baad695a774567ed1d770bac5f9b3ded8824356572c
- MD5 0b26c254e06c600fa551cc9c639946fb
- SHA1 11bbf13d60393c51c36906a6b9de6e869f562155
- SHA512 109580cca933b2368282fed547f9894bad965d37d495c97564c7b83eedd1976a2aff930b8244f7e6492dbefd06404bd9f171f98fc56c3693d1de70511f60d7a4
- SSDEEP 384:3xzdfgwTgENSwUi8w5cB+8QZQW7ixtNH8MH2je+lZIbg6ihJSxUCR1rgCPKabK2x:3xpZUeUi8w5ctQZot+MH2mFRJhggW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
SecUtil.pdb
mscoree
_CorExeMain
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
$TEMP/directx04152002fig10.jpg
- SHA256 7ec8c6fabfdd6ce711dfcefba6412e57337399eaf7be112a84b2b73512b98c76
- MD5 52e163bba0551b1c709483b167f082db
- SHA1 c25066a61d68e73ac9a682346ea67412cddfe504
- SHA512 1a4d62a348ba5366ed34f552987115b06097841ad03d260a1fe533db366c0f639526029d56d7be0d5008bca4d5008e76208b03ff7ac26ee4e7f4a4b72a4f7a0f
- SSDEEP 384:4gJvJRcFHmYNg7llRo/EiXTlJS2n1qOEnICwJNtfaARhc1Kf/kdZfN:dJxRcoYyxosiXrS2kOE8NBhOKf/kt
- MD5 SHA1 SHA512 SSDEEP
$TEMP/gedit-search.page
- SHA256 6bce618e1702598428ab81aa47da9bc1a682e1cbb2c7b0d64a19064699519038
- MD5 dbca463fcc7773b91abf18d30ad12baf
- SHA1 1d098abd1c6ecdaa56d820c25a2adfd0ba24ddd1
- SHA512 0c68f64e56276f0d7bdd1d1580e4c6bafbfbd8b0e9d4e23feb3b6b45b9ebf580ba32aeee4913d479b7daa896e3ad836c12f9855472ff873c8fa75e2af0cd993d
- SSDEEP 48:cXcGUGqHYusSL6nM4/XWRwSEHhK6tBhGs0SRSuEsSEesiMI9/ehSusr:mVq4usKxhEttPpN4uEFEqMaBuO
- MD5 SHA1 SHA512 SSDEEP
$TEMP/luciferase.dll
- IMPHASH 87aaa4fb6b25a5a187943c0f2752ab6e
- SHA256 936babd677d69c25715d1ee19c66c18d33ff439a329c5476d59af2d54ba79bd2
- MD5 696e0a3df2927dde205b3d1894677e1e
- SHA1 b10d49e4c2809e4ea9f814fd6a0a311dad62fbe8
- SHA512 e688abb18745843b2ee018eccfc3de0fc58eb3df39a993a2f825725739862b93950ca2f164f0734e72d64b64f94720746eff4bb6d2c8cc81eb91abeacacc63d9
- SSDEEP 768:/JNGCURaXC8mbKyv7oAk3pfd7fIWmr/ph6KWzmgZh0HA+711t+c4qvOZNIC:XGznoAafd7gWc/pazvqRntKZNI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5339
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
GetMenuItemInfoW
IsCharAlphaA
ws2_32
gethostbyname
crypt32
CertOpenStore
kernel32
GetEnvironmentStringsW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
Aneling
Catalyzed
Disseise
Dutch
Facet
Furbishes
Gobble
Handled
Mammock
Metabolize
Overgrows
Pickeers
Reclimbs
Saponified
Sniffle
Spook
handsomazim
Name
.text
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=125, productName=VS2005 build 50727, version=50727,
count=85, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=79, id=1, productName=Unmarked objects,
count=28, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,