07b14ea619816a3ea13d9675d25d7dbc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

07b14ea619816a3ea13d9675d25d7dbc_JaffaCakes118
Size

6.2MB
MD5

07b14ea619816a3ea13d9675d25d7dbc
SHA1

b49af2c56f3062d0d69fa5f3c3074806ad9fe5da
SHA256

3134e9df8c666ca3b6f2e7642bafee5207eedd5638e10f74567dfa56a36c5512
SHA512

3996d8a339cba1ba801364b7c8a8c9cedf829b36d52ca29de2400d19b0ccd5352522b8b83849d0f6140708c67c50a359a663e656a83196a5e1960114eb88489e
SSDEEP

196608:F7PHFwRVzFBqigkEfHdSy6LHStuNSqU4in7s:1/FEznRDEYZyt4Sy4s

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/FastStone Image Viewer 7.0/fsplugin04.dll	upx
static1/unpack001/FastStone Image Viewer 7.0/fssl.db	upx

Unsigned PE 13 IoCs

Checks for missing Authenticode signature.

resource
unpack001/FastStone Image Viewer 7.0/EmailZipEXE.bin
unpack001/FastStone Image Viewer 7.0/FSIcons.db
unpack001/FastStone Image Viewer 7.0/FSViewer.exe
unpack001/FastStone Image Viewer 7.0/ZipDll.dll
unpack001/FastStone Image Viewer 7.0/fsplugin01.dll
unpack001/FastStone Image Viewer 7.0/fsplugin02.dll
unpack001/FastStone Image Viewer 7.0/fsplugin03.dll
unpack001/FastStone Image Viewer 7.0/fsplugin04.dll
unpack003/out.upx
unpack001/FastStone Image Viewer 7.0/fsplugin05.dll
unpack001/FastStone Image Viewer 7.0/fsplugin06.dll
unpack001/FastStone Image Viewer 7.0/fsplugin07.dll
unpack001/FastStone Image Viewer 7.0/fssl.db

Files

07b14ea619816a3ea13d9675d25d7dbc_JaffaCakes118
.7z
FastStone Image Viewer 7.0/Callout/FSCallout_01_16168059.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_02_19168459.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_03_13228562.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_04_15228762.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_05_16148476.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_06_16148476.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_07_16248486.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_08_16248486.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_09_16148470.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_10_16148470.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_11_16318487.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_12_16318487.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_13_16168477.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_14_16168477.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_15_16228485.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_16_16228485.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_17_16188482.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_18_20228065.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_19_25307573.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_20_27307678.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_21_05069573.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_22_05069573.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_23_05069573.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_24_05069573.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_25_05069573.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_26_05289594.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_27_05289594.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_28_05289594.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_29_05289594.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_30_05289594.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_31_05078093.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_32_20079593.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_33_05079593.png
.png
FastStone Image Viewer 7.0/Callout/FSCallout_34_05079593.png
.png
FastStone Image Viewer 7.0/Credits.txt
FastStone Image Viewer 7.0/EASYLIFE.TW.url
FastStone Image Viewer 7.0/EmailZipEXE.bin
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/FSIcons.db
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 702B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/FSLogo.png
.png
FastStone Image Viewer 7.0/FSMenuIcons0.db
FastStone Image Viewer 7.0/FSMenuIcons1.db
FastStone Image Viewer 7.0/FSMenuIcons2.db
FastStone Image Viewer 7.0/FSMenuIcons3.db
FastStone Image Viewer 7.0/FSMenuIcons4.db
FastStone Image Viewer 7.0/FSMenuIcons5.db
FastStone Image Viewer 7.0/FSViewer.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 64KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 48B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 874KB - Virtual size: 874KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/FSViewerHelp.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_10.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_11.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_13.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_15.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_17.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_18.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_4.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_5.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_6.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_7.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_8.chm
.chm
FastStone Image Viewer 7.0/Languages/FSViewerHelp_9.chm
.chm
FastStone Image Viewer 7.0/Languages/Language_10.sib
FastStone Image Viewer 7.0/Languages/Language_11.sib
FastStone Image Viewer 7.0/Languages/Language_12.sib
FastStone Image Viewer 7.0/Languages/Language_13.sib
FastStone Image Viewer 7.0/Languages/Language_14.sib
FastStone Image Viewer 7.0/Languages/Language_15.sib
FastStone Image Viewer 7.0/Languages/Language_16.sib
FastStone Image Viewer 7.0/Languages/Language_17.sib
FastStone Image Viewer 7.0/Languages/Language_18.sib
FastStone Image Viewer 7.0/Languages/Language_19.sib
FastStone Image Viewer 7.0/Languages/Language_2.sib
FastStone Image Viewer 7.0/Languages/Language_20.sib
FastStone Image Viewer 7.0/Languages/Language_3.sib
FastStone Image Viewer 7.0/Languages/Language_4.sib
FastStone Image Viewer 7.0/Languages/Language_5.sib
FastStone Image Viewer 7.0/Languages/Language_6.sib
FastStone Image Viewer 7.0/Languages/Language_7.sib
FastStone Image Viewer 7.0/Languages/Language_8.sib
FastStone Image Viewer 7.0/Languages/Language_9.sib
FastStone Image Viewer 7.0/LicenseAgreement.pdf
.pdf
FastStone Image Viewer 7.0/Mask/Mask01.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask02.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask03.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask04.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask05.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask06.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask07.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask08.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask09.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask10.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask11.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask12.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask13.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask14.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask15.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask16.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask17.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask18.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask19.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask20.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask21.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask22.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask23.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask24.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask25.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask26.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask27.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask28.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask29.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask30.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask31.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask32.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask33.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask34.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask35.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask36.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask37.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask38.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask39.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask40.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask41.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask42.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask43.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask44.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask45.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask46.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask47.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask48.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask49.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask50.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask51.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask52.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask53.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask54.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask55.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask56.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask57.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask58.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask59.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask60.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask61.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask62.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask63.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask64.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask65.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask66.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask67.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask68.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask69.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask70.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask71.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask72.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask73.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask74.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask75.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask76.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask77.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask78.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask79.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask80.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask81.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask82.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask83.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask84.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask85.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask86.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask87.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask88.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask89.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask90.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask91.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask92.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask93.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask94.jpg
.jpg
FastStone Image Viewer 7.0/Mask/Mask95.jpg
.jpg
FastStone Image Viewer 7.0/Portable.db
FastStone Image Viewer 7.0/ZipDll.dll
.dll windows:4 windows x86 arch:x86

8df7add524088e1365dd260c717232eb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
CreateFileW
DeleteCriticalSection
DeleteFileA
DosDateTimeToFileTime
EnterCriticalSection
ExitProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentDirectoryA
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStrings
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetShortPathNameA
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVolumeInformationA
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LocalFileTimeToFileTime
MoveFileA
MultiByteToWideChar
RaiseException
ReadFile
RemoveDirectoryA
RtlUnwind
SetConsoleCtrlHandler
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetThreadLocale
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WideCharToMultiByte
WriteFile
lstrcatA
lstrcpyA
lstrlenA

shell32

SHFileOperationA

user32

CharToOemBuffA
DialogBoxParamA
EndDialog
EnumThreadWindows
MessageBoxA
OemToCharBuffA
SendDlgItemMessageA
SendMessageA
wsprintfA
wvsprintfA

Exports

Exports

GetZipDllPrivVersion
GetZipDllVersion
ZipDllExec
___CPPdebugHook

Sections

.text
Size: 101KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/fsim.db
.jpg
FastStone Image Viewer 7.0/fsplugin01.dll
.dll windows:4 windows x86 arch:x86

933368af2946af8f4bc77ab0457ed8f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

CloseHandle
CompareStringA
CreateEventA
CreateFileA
CreateFileW
DeleteCriticalSection
EnterCriticalSection
EnumCalendarInfoA
ExitProcess
FindClose
FindFirstFileA
FormatMessageA
FreeEnvironmentStringsA
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentThreadId
GetDateFormatA
GetDiskFreeSpaceA
GetEnvironmentStrings
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeExA
GetStringTypeW
GetSystemDefaultLangID
GetThreadLocale
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalMemoryStatus
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LocalAlloc
LocalFileTimeToFileTime
LocalFree
MultiByteToWideChar
RaiseException
ReadFile
ResetEvent
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetThreadLocale
Sleep
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcpynA
lstrlenA

wsock32

htonl
htons
ntohl
ntohs

user32

CharNextA
EnumThreadWindows
GetKeyboardType
GetSystemMetrics
LoadStringA
MessageBoxA
wsprintfA

oleaut32

SafeArrayCreate
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantCopyInd
VariantInit

Exports

Exports

@@Utils2@Finalize
@@Utils2@Initialize
@@Utils@Finalize
@@Utils@Initialize
IEX_AddParameter
IEX_ExecuteRead
IEX_ExecuteTry
IEX_ExecuteWrite
IEX_Finalize
IEX_GetInfo
IEX_Initialize
IEX_SetCallBacks
IEX_SetInfo
___CPPdebugHook

Sections

.text
Size: 329KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 636KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/fsplugin02.dll
.dll windows:4 windows x86 arch:x86

af7730f5190b736356af1d0eda458dc3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

_setmode
__dllonexit
__mb_cur_max
_errno
_iob
_isctype
_pctype
_setjmp
_wfopen
abort
calloc
exit
fclose
fflush
fprintf
fread
free
fwrite
getenv
longjmp
malloc
memcpy
sprintf
sscanf
strncpy
tolower
vfprintf

Exports

Exports

FreeMemData
JPEGFileTransform
JPEGMEMTransform
TransferMemData

Sections

.text
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 188B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/fsplugin03.dll
.exe windows:5 windows x86 arch:x86

519725a05f6d3283592a2ef4bc96d347

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htons
ntohl
htonl
ntohs

kernel32

TlsGetValue
GetCurrentDirectoryA
GetFullPathNameA
GetDriveTypeA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetTimeZoneInformation
SetStdHandle
GetFileType
GetSystemTimeAsFileTime
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
CloseHandle
CreateFileA
Sleep
GetModuleHandleW
ExitProcess
SetFilePointer
MultiByteToWideChar
ReadFile
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
SetEnvironmentVariableW
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WriteFile
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
GetCurrentProcessId
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
RaiseException
InitializeCriticalSectionAndSpinCount
SetEndOfFile
GetProcessHeap
LoadLibraryA
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CompareStringA
CompareStringW
SetEnvironmentVariableA

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/fsplugin04.dll
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 390KB - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/fsplugin05.dll
.dll windows:4 windows x86 arch:x86

1cba0e23b706e0bfbc0a4cb9b6bd80fb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
InterlockedCompareExchange
InterlockedExchange
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
abort
calloc
exit
ferror
fflush
fprintf
fread
free
fwrite
getenv
malloc
memcpy
memset
sprintf
sscanf
strlen
strncmp
vfprintf

Exports

Exports

jcopy_block_row
jcopy_sample_rows
jdiv_round_up
jinit_1pass_quantizer
jinit_2pass_quantizer
jinit_c_coef_controller
jinit_c_main_controller
jinit_c_master_control
jinit_c_prep_controller
jinit_color_converter
jinit_color_deconverter
jinit_compress_master
jinit_d_coef_controller
jinit_d_main_controller
jinit_d_post_controller
jinit_downsampler
jinit_forward_dct
jinit_huff_decoder
jinit_huff_encoder
jinit_input_controller
jinit_inverse_dct
jinit_marker_reader
jinit_marker_writer
jinit_master_decompress
jinit_memory_mgr
jinit_merged_upsampler
jinit_phuff_decoder
jinit_phuff_encoder
jinit_upsampler
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort
jpeg_abort_compress
jpeg_abort_decompress
jpeg_add_quant_table
jpeg_alloc_huff_table
jpeg_alloc_quant_table
jpeg_calc_output_dimensions
jpeg_consume_input
jpeg_copy_critical_parameters
jpeg_crop_scanline
jpeg_default_colorspace
jpeg_destroy
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_fdct_float
jpeg_fdct_ifast
jpeg_fdct_islow
jpeg_fill_bit_buffer
jpeg_finish_compress
jpeg_finish_decompress
jpeg_finish_output
jpeg_free_large
jpeg_free_small
jpeg_gen_optimal_table
jpeg_get_large
jpeg_get_small
jpeg_has_multiple_scans
jpeg_huff_decode
jpeg_idct_1x1
jpeg_idct_2x2
jpeg_idct_4x4
jpeg_idct_float
jpeg_idct_ifast
jpeg_idct_islow
jpeg_input_complete
jpeg_make_c_derived_tbl
jpeg_make_d_derived_tbl
jpeg_mem_available
jpeg_mem_dest
jpeg_mem_init
jpeg_mem_src
jpeg_mem_term
jpeg_new_colormap
jpeg_open_backing_store
jpeg_quality_scaling
jpeg_read_coefficients
jpeg_read_header
jpeg_read_raw_data
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_save_markers
jpeg_set_colorspace
jpeg_set_defaults
jpeg_set_linear_quality
jpeg_set_marker_processor
jpeg_set_quality
jpeg_simple_progression
jpeg_skip_scanlines
jpeg_start_compress
jpeg_start_decompress
jpeg_start_output
jpeg_std_error
jpeg_stdio_dest
jpeg_stdio_src
jpeg_suppress_tables
jpeg_write_coefficients
jpeg_write_m_byte
jpeg_write_m_header
jpeg_write_marker
jpeg_write_raw_data
jpeg_write_scanlines
jpeg_write_tables
jround_up
jzero_far

Sections

.text
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 996B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 512B - Virtual size: 135B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 512B - Virtual size: 277B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/fsplugin06.dll
.dll windows:5 windows x86 arch:x86

8e0a1f2284a5f7dab96c697a66241e4a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Documents and Settings\Andrew\Desktop\lcms\lcms2-2.9\bin\lcms2.pdb

Imports

kernel32

InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateMutexW
WaitForSingleObject
InterlockedCompareExchange
ReleaseMutex
CloseHandle
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
DeleteFileA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
RtlUnwind
MultiByteToWideChar
ReadFile
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
Sleep
ExitProcess
GetModuleFileNameA
SetFilePointer
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
LoadLibraryA
GetModuleHandleA
GetTimeZoneInformation
SetEndOfFile
GetProcessHeap
HeapSize
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

__cmsComputeInterpParams@24
__cmsFloat2Half@4
__cmsFreeInterpParams@4
__cmsGetFormatter@16
__cmsHalf2Float@4
__cmsQuantizeVal@12
__cmsReadDevicelinkLUT@8
__cmsReadInputLUT@8
__cmsReadOutputLUT@8
__cmsStageAllocIdentityCLut@8
__cmsStageAllocIdentityCurves@8
__cmsStageAllocLab2XYZ@4
__cmsStageAllocLabV2ToV4@4
__cmsStageAllocLabV4ToV2@4
__cmsStageAllocNamedColor@8
__cmsStageAllocXYZ2Lab@4
_cms15Fixed16toDouble
_cms8Fixed8toDouble
_cmsAdjustEndianess16
_cmsAdjustEndianess32
_cmsAdjustEndianess64
_cmsCalloc
_cmsCreateMutex
_cmsDecodeDateTimeNumber
_cmsDefaultICCintents
_cmsDestroyMutex
_cmsDoTransformLineStride@36
_cmsDoubleTo15Fixed16
_cmsDoubleTo8Fixed8
_cmsDupMem
_cmsEncodeDateTimeNumber
_cmsFree
_cmsGetTransformFormatters16
_cmsGetTransformFormattersFloat
_cmsGetTransformUserData
_cmsICCcolorSpace
_cmsIOPrintf
_cmsLCMScolorSpace
_cmsLockMutex
_cmsMAT3eval
_cmsMAT3identity
_cmsMAT3inverse
_cmsMAT3isIdentity
_cmsMAT3per
_cmsMAT3solve
_cmsMalloc
_cmsMallocZero
_cmsOpenProfileFromIOhandler2THR@12
_cmsPipelineSetOptimizationParameters
_cmsRead15Fixed16Number
_cmsReadAlignment
_cmsReadFloat32Number
_cmsReadTypeBase
_cmsReadUInt16Array
_cmsReadUInt16Number
_cmsReadUInt32Number
_cmsReadUInt64Number
_cmsReadUInt8Number
_cmsReadXYZNumber
_cmsRealloc
_cmsSetTransformUserData
_cmsStageAllocPlaceholder
_cmsUnlockMutex
_cmsVEC3cross
_cmsVEC3distance
_cmsVEC3dot
_cmsVEC3init
_cmsVEC3length
_cmsVEC3minus
_cmsWrite15Fixed16Number
_cmsWriteAlignment
_cmsWriteFloat32Number
_cmsWriteTypeBase
_cmsWriteUInt16Array
_cmsWriteUInt16Number
_cmsWriteUInt32Number
_cmsWriteUInt64Number
_cmsWriteUInt8Number
_cmsWriteXYZNumber
cmsAdaptToIlluminant
cmsAllocNamedColorList
cmsAllocProfileSequenceDescription
cmsAppendNamedColor
cmsBFDdeltaE
cmsBuildGamma
cmsBuildParametricToneCurve
cmsBuildSegmentedToneCurve
cmsBuildTabulatedToneCurve16
cmsBuildTabulatedToneCurveFloat
cmsCIE2000DeltaE
cmsCIE94DeltaE
cmsCIECAM02Done
cmsCIECAM02Forward
cmsCIECAM02Init
cmsCIECAM02Reverse
cmsCMCdeltaE
cmsChangeBuffersFormat
cmsChannelsOf
cmsCloseIOhandler
cmsCloseProfile
cmsCreateBCHSWabstractProfile
cmsCreateBCHSWabstractProfileTHR
cmsCreateContext
cmsCreateExtendedTransform
cmsCreateGrayProfile
cmsCreateGrayProfileTHR
cmsCreateInkLimitingDeviceLink
cmsCreateInkLimitingDeviceLinkTHR
cmsCreateLab2Profile
cmsCreateLab2ProfileTHR
cmsCreateLab4Profile
cmsCreateLab4ProfileTHR
cmsCreateLinearizationDeviceLink
cmsCreateLinearizationDeviceLinkTHR
cmsCreateMultiprofileTransform
cmsCreateMultiprofileTransformTHR
cmsCreateNULLProfile
cmsCreateNULLProfileTHR
cmsCreateProfilePlaceholder
cmsCreateProofingTransform
cmsCreateProofingTransformTHR
cmsCreateRGBProfile
cmsCreateRGBProfileTHR
cmsCreateTransform
cmsCreateTransformTHR
cmsCreateXYZProfile
cmsCreateXYZProfileTHR
cmsCreate_sRGBProfile
cmsCreate_sRGBProfileTHR
cmsD50_XYZ
cmsD50_xyY
cmsDeleteContext
cmsDeleteTransform
cmsDeltaE
cmsDesaturateLab
cmsDetectBlackPoint
cmsDetectDestinationBlackPoint
cmsDetectTAC
cmsDictAddEntry
cmsDictAlloc
cmsDictDup
cmsDictFree
cmsDictGetEntryList
cmsDictNextEntry
cmsDoTransform
cmsDoTransformStride
cmsDupContext
cmsDupNamedColorList
cmsDupProfileSequenceDescription
cmsDupToneCurve
cmsEstimateGamma
cmsEvalToneCurve16
cmsEvalToneCurveFloat
cmsFloat2LabEncoded
cmsFloat2LabEncodedV2
cmsFloat2XYZEncoded
cmsFormatterForColorspaceOfProfile
cmsFormatterForPCSOfProfile
cmsFreeNamedColorList
cmsFreeProfileSequenceDescription
cmsFreeToneCurve
cmsFreeToneCurveTriple
cmsGBDAlloc
cmsGBDFree
cmsGDBAddPoint
cmsGDBCheckPoint
cmsGDBCompute
cmsGetAlarmCodes
cmsGetAlarmCodesTHR
cmsGetColorSpace
cmsGetContextUserData
cmsGetDeviceClass
cmsGetEncodedCMMversion
cmsGetEncodedICCversion
cmsGetHeaderAttributes
cmsGetHeaderCreationDateTime
cmsGetHeaderCreator
cmsGetHeaderFlags
cmsGetHeaderManufacturer
cmsGetHeaderModel
cmsGetHeaderProfileID
cmsGetHeaderRenderingIntent
cmsGetNamedColorList
cmsGetPCS
cmsGetPipelineContextID
cmsGetPostScriptCRD
cmsGetPostScriptCSA
cmsGetPostScriptColorResource
cmsGetProfileContextID
cmsGetProfileIOhandler
cmsGetProfileInfo
cmsGetProfileInfoASCII
cmsGetProfileVersion
cmsGetSupportedIntents
cmsGetSupportedIntentsTHR
cmsGetTagCount
cmsGetTagSignature
cmsGetToneCurveEstimatedTable
cmsGetToneCurveEstimatedTableEntries
cmsGetToneCurveParametricType
cmsGetTransformContextID
cmsGetTransformInputFormat
cmsGetTransformOutputFormat
cmsIT8Alloc
cmsIT8DefineDblFormat
cmsIT8EnumDataFormat
cmsIT8EnumProperties
cmsIT8EnumPropertyMulti
cmsIT8FindDataFormat
cmsIT8Free
cmsIT8GetData
cmsIT8GetDataDbl
cmsIT8GetDataRowCol
cmsIT8GetDataRowColDbl
cmsIT8GetPatchByName
cmsIT8GetPatchName
cmsIT8GetProperty
cmsIT8GetPropertyDbl
cmsIT8GetPropertyMulti
cmsIT8GetSheetType
cmsIT8LoadFromFile
cmsIT8LoadFromMem
cmsIT8SaveToFile
cmsIT8SaveToMem
cmsIT8SetComment
cmsIT8SetData
cmsIT8SetDataDbl
cmsIT8SetDataFormat
cmsIT8SetDataRowCol
cmsIT8SetDataRowColDbl
cmsIT8SetIndexColumn
cmsIT8SetPropertyDbl
cmsIT8SetPropertyHex
cmsIT8SetPropertyMulti
cmsIT8SetPropertyStr
cmsIT8SetPropertyUncooked
cmsIT8SetSheetType
cmsIT8SetTable
cmsIT8SetTableByLabel
cmsIT8TableCount
cmsIsCLUT
cmsIsIntentSupported
cmsIsMatrixShaper
cmsIsTag
cmsIsToneCurveDescending
cmsIsToneCurveLinear
cmsIsToneCurveMonotonic
cmsIsToneCurveMultisegment
cmsJoinToneCurve
cmsLCh2Lab
cmsLab2LCh
cmsLab2XYZ
cmsLabEncoded2Float
cmsLabEncoded2FloatV2
cmsLinkTag
cmsMD5computeID
cmsMLUalloc
cmsMLUdup
cmsMLUfree
cmsMLUgetASCII
cmsMLUgetTranslation
cmsMLUgetWide
cmsMLUsetASCII
cmsMLUsetWide
cmsMLUtranslationsCodes
cmsMLUtranslationsCount
cmsNamedColorCount
cmsNamedColorIndex
cmsNamedColorInfo
cmsOpenIOhandlerFromFile
cmsOpenIOhandlerFromMem
cmsOpenIOhandlerFromNULL
cmsOpenIOhandlerFromStream
cmsOpenProfileFromFile
cmsOpenProfileFromFileTHR
cmsOpenProfileFromIOhandlerTHR
cmsOpenProfileFromMem
cmsOpenProfileFromMemTHR
cmsOpenProfileFromStream
cmsOpenProfileFromStreamTHR
cmsPipelineAlloc
cmsPipelineCat
cmsPipelineCheckAndRetreiveStages
cmsPipelineDup
cmsPipelineEval16
cmsPipelineEvalFloat
cmsPipelineEvalReverseFloat
cmsPipelineFree
cmsPipelineGetPtrToFirstStage
cmsPipelineGetPtrToLastStage
cmsPipelineInputChannels
cmsPipelineInsertStage
cmsPipelineOutputChannels
cmsPipelineSetSaveAs8bitsFlag
cmsPipelineStageCount
cmsPipelineUnlinkStage
cmsPlugin
cmsPluginTHR
cmsReadRawTag
cmsReadTag
cmsReverseToneCurve
cmsReverseToneCurveEx
cmsSaveProfileToFile
cmsSaveProfileToIOhandler
cmsSaveProfileToMem
cmsSaveProfileToStream
cmsSetAdaptationState
cmsSetAdaptationStateTHR
cmsSetAlarmCodes
cmsSetAlarmCodesTHR
cmsSetColorSpace
cmsSetDeviceClass
cmsSetEncodedICCversion
cmsSetHeaderAttributes
cmsSetHeaderFlags
cmsSetHeaderManufacturer
cmsSetHeaderModel
cmsSetHeaderProfileID
cmsSetHeaderRenderingIntent
cmsSetLogErrorHandler
cmsSetLogErrorHandlerTHR
cmsSetPCS
cmsSetProfileVersion
cmsSignalError
cmsSliceSpace16
cmsSliceSpaceFloat
cmsSmoothToneCurve
cmsStageAllocCLut16bit
cmsStageAllocCLut16bitGranular
cmsStageAllocCLutFloat
cmsStageAllocCLutFloatGranular
cmsStageAllocIdentity
cmsStageAllocMatrix
cmsStageAllocToneCurves
cmsStageData
cmsStageDup
cmsStageFree
cmsStageInputChannels
cmsStageNext
cmsStageOutputChannels
cmsStageSampleCLut16bit
cmsStageSampleCLutFloat
cmsStageType
cmsTagLinkedTo
cmsTempFromWhitePoint
cmsTransform2DeviceLink
cmsUnregisterPlugins
cmsUnregisterPluginsTHR
cmsWhitePointFromTemp
cmsWriteRawTag
cmsWriteTag
cmsXYZ2Lab
cmsXYZ2xyY
cmsXYZEncoded2Float
cmsfilelength
cmsstrcasecmp
cmsxyY2XYZ

Sections

.text
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/fsplugin07.dll
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 386KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 11KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FastStone Image Viewer 7.0/fssl.db
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 528KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

CODE Size: 24KB - Virtual size: 24KB

DATA Size: 1024B - Virtual size: 620B

BSS Size: - Virtual size: 2KB

.idata Size: 2KB - Virtual size: 1KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 11KB - Virtual size: 11KB

Headers

File Characteristics

Sections

CODE Size: 4KB - Virtual size: 3KB

DATA Size: 512B - Virtual size: 160B

BSS Size: - Virtual size: 1KB

.idata Size: 1024B - Virtual size: 702B

.reloc Size: 512B - Virtual size: 432B

.rsrc Size: 152KB - Virtual size: 152KB

Headers

File Characteristics

Sections

CODE Size: 5.2MB - Virtual size: 5.2MB

DATA Size: 150KB - Virtual size: 150KB

BSS Size: - Virtual size: 64KB

.idata Size: 17KB - Virtual size: 16KB

.tls Size: - Virtual size: 48B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 235KB - Virtual size: 235KB

.rsrc Size: 874KB - Virtual size: 874KB

8df7add524088e1365dd260c717232eb

Headers

File Characteristics

Imports

kernel32

shell32

user32

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 104KB

.data Size: 19KB - Virtual size: 36KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

933368af2946af8f4bc77ab0457ed8f1

Headers

File Characteristics

Imports

advapi32

kernel32

wsock32

user32

oleaut32

Exports

Exports

Sections

.text Size: 329KB - Virtual size: 332KB

.data Size: 64KB - Virtual size: 636KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 6KB - Virtual size: 8KB

.reloc Size: 25KB - Virtual size: 28KB

af7730f5190b736356af1d0eda458dc3

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

CODE
Size: 24KB - Virtual size: 24KB

DATA
Size: 1024B - Virtual size: 620B

BSS
Size: - Virtual size: 2KB

.idata
Size: 2KB - Virtual size: 1KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 11KB - Virtual size: 11KB

CODE
Size: 4KB - Virtual size: 3KB

DATA
Size: 512B - Virtual size: 160B

BSS
Size: - Virtual size: 1KB

.idata
Size: 1024B - Virtual size: 702B

.reloc
Size: 512B - Virtual size: 432B

.rsrc
Size: 152KB - Virtual size: 152KB

CODE
Size: 5.2MB - Virtual size: 5.2MB

DATA
Size: 150KB - Virtual size: 150KB

BSS
Size: - Virtual size: 64KB

.idata
Size: 17KB - Virtual size: 16KB

.tls
Size: - Virtual size: 48B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 235KB - Virtual size: 235KB

.rsrc
Size: 874KB - Virtual size: 874KB

.text
Size: 101KB - Virtual size: 104KB

.data
Size: 19KB - Virtual size: 36KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 329KB - Virtual size: 332KB

.data
Size: 64KB - Virtual size: 636KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 6KB - Virtual size: 8KB

.reloc
Size: 25KB - Virtual size: 28KB

.text
Size: 150KB - Virtual size: 150KB

.data
Size: 512B - Virtual size: 8B

.rdata
Size: 10KB - Virtual size: 9KB

.eh_fram
Size: 1024B - Virtual size: 852B

.bss
Size: - Virtual size: 188B

.edata
Size: 512B - Virtual size: 158B

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 211KB - Virtual size: 211KB

.rdata
Size: 75KB - Virtual size: 75KB

.data
Size: 6KB - Virtual size: 580KB

.rsrc
Size: 512B - Virtual size: 436B

UPX0
Size: - Virtual size: 1.2MB

UPX1
Size: 390KB - Virtual size: 392KB

.rsrc
Size: 1024B - Virtual size: 4KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 61KB - Virtual size: 78KB

.rsrc
Size: 512B - Virtual size: 436B

.text
Size: 275KB - Virtual size: 274KB

.data
Size: 512B - Virtual size: 36B

.rdata
Size: 144KB - Virtual size: 144KB

/4
Size: 22KB - Virtual size: 22KB

.bss
Size: - Virtual size: 996B

.edata
Size: 3KB - Virtual size: 3KB

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 6KB - Virtual size: 5KB

/14
Size: 512B - Virtual size: 56B

/29
Size: 3KB - Virtual size: 2KB

/41
Size: 512B - Virtual size: 135B

/55
Size: 512B - Virtual size: 277B

/67
Size: 512B - Virtual size: 56B