2024-06-26_3bc2c370eacf050b3ddf292339536aa1_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-26_3bc2c370eacf050b3ddf292339536aa1_mafia
Size

3.2MB
MD5

3bc2c370eacf050b3ddf292339536aa1
SHA1

a62feb83b64a32b3248eebe99df712c655ea34e1
SHA256

c181bc400fcdc0c864439be6ec0ec06b930a95e151dde03124714fa41cd33528
SHA512

736646bc0abab4d4a4772091938d56047a1f1d70949e3ddf02508907e58c10a9cba800e74d550f6befcf00a0208a2e6412ca07855389015bba6f09e16a439a17
SSDEEP

98304:amJI/COc9TKP5ruA4DOc9xCNMApyjBBXp0wKTlZUdPmY3mYTdor:amJI/CO8fyNIjBBGwKTlAPmmmmor

Score

1^/10

Malware Config

Signatures

Files

2024-06-26_3bc2c370eacf050b3ddf292339536aa1_mafia
.exe windows:5 windows x86 arch:x86

e5fdb1d4438c6f7d0f83df27d5a4234a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:77:26:b2:3c:85:c4:60:2b:15:3b:d9:cb:20:77:9e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

28/04/2022, 00:00

Not After

23/07/2025, 23:59

Subject

CN=New H3C Technologies Co.\, Ltd.,O=New H3C Technologies Co.\, Ltd.,L=杭州市,ST=浙江省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:40:92:01:4e:8e:bc:ce:12:62:ec:36:49:66:e9:05:24:dd:70:09:71:f5:88:b1:9e:0b:27:dd:56:66:ee:fb
Signer

Actual PE Digest

d5:40:92:01:4e:8e:bc:ce:12:62:ec:36:49:66:e9:05:24:dd:70:09:71:f5:88:b1:9e:0b:27:dd:56:66:ee:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\iNodeCode\br_patch_PC_V7R3B05D124\inode\client\TRM\Release\TrmBaseServer.pdb

Imports

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA
GetModuleFileNameExA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

iphlpapi

GetAdaptersInfo

ws2_32

getaddrinfo
socket
WSAGetLastError
freeaddrinfo
select
WSASetLastError
sendto
htons
ntohl
ntohs
recvfrom
htonl
WSAStartup
WSACleanup
closesocket
shutdown
getnameinfo
inet_addr

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

advapi32

RegEnumValueA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
QueryServiceConfigA
QueryServiceStatusEx
StartServiceA
SetServiceStatus
LockServiceDatabase
QueryServiceLockStatusA
ChangeServiceConfigA
RegisterServiceCtrlHandlerExA
RegNotifyChangeKeyValue
StartServiceCtrlDispatcherA
RegCreateKeyExA
RevertToSelf
SetTokenInformation
ConvertSidToStringSidA
ImpersonateLoggedOnUser
DuplicateTokenEx
LookupPrivilegeValueA
AdjustTokenPrivileges
InitiateSystemShutdownA
GetTokenInformation
AllocateAndInitializeSid
EqualSid
LookupAccountSidA
RegDeleteValueA
FreeSid
RegQueryInfoKeyA
RegCloseKey
RegOpenKeyExA
SetNamedSecurityInfoA
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
GetUserNameA
CreateProcessAsUserA
OpenProcessToken
RegQueryValueExA
RegSetValueExA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyExA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
DeleteService
QueryServiceStatus
ControlService
OpenServiceA
UnlockServiceDatabase

ole32

CoInitialize
CoCreateGuid
CoUninitialize
ReleaseStgMedium
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CoTaskMemAlloc
OleDuplicateData
DoDragDrop
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal
OleCreateMenuDescriptor
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
CoTaskMemFree

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
CM_Get_Parent
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
CM_Get_Child
CM_Get_Device_ID_Size
CM_Get_Device_IDA
SetupDiGetDeviceInstanceIdA
SetupDiClassGuidsFromNameA

comctl32

ImageList_GetIconSize

kernel32

ReleaseMutex
CreateMutexA
CopyFileA
GetEnvironmentVariableA
FindNextFileA
Sleep
DeviceIoControl
WritePrivateProfileStringA
InterlockedExchangeAdd
GetPrivateProfileIntA
GetPrivateProfileStringA
FindNextFileW
FindFirstFileW
GetSystemDirectoryA
GetFileAttributesExA
MoveFileExA
RemoveDirectoryA
GetStartupInfoA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
GetVersionExA
lstrlenA
OutputDebugStringA
FormatMessageA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
OpenFileMappingA
LocalFree
LocalAlloc
GetWindowsDirectoryA
GetSystemInfo
GlobalFree
GlobalAlloc
GetCurrentProcess
FreeLibrary
LoadLibraryA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
HeapFree
HeapAlloc
GetProcessHeap
LoadLibraryExA
GetLogicalDrives
GetVolumeNameForVolumeMountPointA
SetVolumeMountPointA
DeleteVolumeMountPointA
GetDriveTypeA
GetUserDefaultUILanguage
DefineDosDeviceA
GetTempPathA
GetVolumeInformationA
InterlockedExchange
SizeofResource
LoadResource
FindResourceA
QueryDosDeviceA
SetFilePointerEx
SetLastError
FlushFileBuffers
VirtualUnlock
VirtualLock
GetVolumePathNamesForVolumeNameA
TerminateThread
ResumeThread
GetComputerNameA
CreateEventA
SetEvent
FindVolumeClose
FindNextVolumeA
FindFirstVolumeA
SetUnhandledExceptionFilter
SetErrorMode
OpenMutexA
ResetEvent
TerminateProcess
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalLock
GlobalReAlloc
GlobalUnlock
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
DeactivateActCtx
ReleaseActCtx
ActivateActCtx
GetModuleFileNameW
InterlockedDecrement
LockResource
FindResourceW
MulDiv
lstrlenW
GlobalSize
SetThreadPriority
CompareStringA
GetModuleHandleW
InterlockedIncrement
GlobalGetAtomNameA
lstrcmpA
WaitForSingleObject
FileTimeToSystemTime
lstrcmpW
LoadLibraryW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
FreeResource
lstrcmpiA
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetFullPathNameA
GlobalFlags
GetLocaleInfoA
GetCPInfo
GetOEMCP
GetACP
FileTimeToLocalFileTime
GetFileAttributesA
GetFileSizeEx
GetFileTime
GetCurrentDirectoryA
lstrcpyA
GetNumberFormatA
GetTempFileNameA
InitializeCriticalSectionAndSpinCount
GetProfileIntA
SearchPathA
VirtualProtect
GetUserDefaultLCID
FindResourceExW
RtlUnwind
RaiseException
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
ExitThread
CreateThread
GetCommandLineA
HeapSetInformation
VirtualAlloc
VirtualQuery
HeapReAlloc
HeapSize
HeapQueryInformation
ExitProcess
SetStdHandle
GetFileType
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
GetStartupInfoW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetLocaleInfoW
GetTimeZoneInformation
CompareStringW
GetConsoleCP
GetConsoleMode
EnumSystemLocalesA
IsValidLocale
GetExitCodeProcess
WriteConsoleW
SetEnvironmentVariableA
CreateFileW
SetFileAttributesA
DeleteFileA
CreateFileA
SetFilePointer
WriteFile
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleA
GetProcAddress
GetDiskFreeSpaceA
CreatePipe
GetLastError
GetNamedPipeInfo
SetHandleInformation
CreateProcessA
CloseHandle
ReadFile
GetLocalTime
CreateDirectoryA
GlobalMemoryStatus
FindFirstFileA
FindClose
GetTickCount

user32

CharUpperA
ClientToScreen
RealChildWindowFromPoint
GetDesktopWindow
InflateRect
GetMenuItemInfoA
DestroyMenu
SystemParametersInfoA
FillRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
PostQuitMessage
IsIconic
SetRectEmpty
InvalidateRect
IntersectRect
SetCursor
ShowOwnedPopups
DeleteMenu
SetTimer
KillTimer
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadCursorW
RedrawWindow
GetMenuDefaultItem
CreatePopupMenu
IsRectEmpty
MapVirtualKeyA
SetCapture
GetAsyncKeyState
ReleaseCapture
InvertRect
DrawFocusRect
HideCaret
EnableScrollBar
NotifyWinEvent
MessageBeep
GetNextDlgTabItem
OffsetRect
GetIconInfo
CopyImage
LoadImageA
GetNextDlgGroupItem
DrawIconEx
EndDialog
CreateDialogIndirectParamA
TranslateAcceleratorA
BringWindowToTop
InsertMenuItemA
LoadAcceleratorsA
LoadMenuA
ReuseDDElParam
UnpackDDElParam
SetRect
WindowFromPoint
IsZoomed
SetWindowRgn
SetParent
DestroyAcceleratorTable
SetClassLongA
LoadMenuW
GetSystemMenu
DrawStateA
DrawEdge
DrawFrameControl
CopyAcceleratorTableA
ToAsciiEx
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableA
SetCursorPos
LockWindowUpdate
GetKeyNameTextA
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
IsCharLowerA
MapVirtualKeyExA
UnionRect
UpdateLayeredWindow
MonitorFromPoint
IsMenu
PostThreadMessageA
WaitMessage
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
CreateMenu
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
RegisterClipboardFormatA
CopyIcon
DestroyIcon
GetDoubleClickTime
SubtractRect
MapDialogRect
DrawIcon
DestroyCursor
GetWindowRgn
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
GetWindowRect
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuA
CheckMenuItem
GetWindowTextLengthA
GetWindowTextA
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
GetWindowThreadProcessId
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
UnhookWindowsHookEx
GetSystemMetrics
wsprintfA
PostMessageA
SendMessageTimeoutA
wsprintfW
ExitWindowsEx
CheckDlgButton
RegisterWindowMessageA
LoadIconW
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
CharUpperBuffA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
SetMenuDefaultItem
GetMonitorInfoA
EnableMenuItem

gdi32

ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetTextExtentPoint32A
ExtTextOutA
BitBlt
CreateCompatibleDC
CreateFontIndirectA
DeleteObject
GetObjectA
SetBkColor
LineTo
MoveToEx
SetTextAlign
IntersectClipRect
GetLayout
SetLayout
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
GetTextFaceA
SetPixelV
SetPaletteEntries
ExtFloodFill
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
LPtoDP
EnumFontFamiliesExA
GetRgnBox
OffsetRgn
Rectangle
SetPixel
StretchBlt
SetDIBColorTable
Polygon
Ellipse
Polyline
CreateEllipticRgn
GetTextColor
CreatePolygonRgn
CreateRoundRectRgn
CreateDIBSection
GetSystemPaletteEntries
RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
GetBkColor
GetTextCharsetInfo
EnumFontFamiliesA
GetTextMetricsA
CreateDIBitmap
DPtoLP
PatBlt
CombineRgn
ScaleWindowExtEx
SetTextColor
CreateBitmap
CreateDCA
CopyMetaFileA
GetDeviceCaps
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateHatchBrush
CreateCompatibleBitmap
CreateRectRgnIndirect
SetRectRgn
SetWindowExtEx

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

GetFileTitleA

shell32

SHAppBarMessage
SHBrowseForFolderA
DragQueryFileA
DragFinish
SHGetDesktopFolder
SHGetFileInfoA
SHChangeNotify
ord680
SHGetFolderPathA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListA

oleaut32

VariantClear
VariantChangeType
SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
VariantInit
SysAllocString
SysStringLen
SysFreeString

shlwapi

StrStrIA
PathIsUNCA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW
PathStripToRootA

mpr

WNetGetConnectionA

dbghelp

MiniDumpWriteDump

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageGraphicsContext
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipGetImageWidth
GdipDrawImageI

msimg32

AlphaBlend
TransparentBlt

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundA

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 456KB - Virtual size: 456KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 731KB - Virtual size: 730KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5fdb1d4438c6f7d0f83df27d5a4234a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:77:26:b2:3c:85:c4:60:2b:15:3b:d9:cb:20:77:9eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

d5:40:92:01:4e:8e:bc:ce:12:62:ec:36:49:66:e9:05:24:dd:70:09:71:f5:88:b1:9e:0b:27:dd:56:66:ee:fbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

userenv

iphlpapi

ws2_32

version

advapi32

ole32

setupapi

comctl32

kernel32

user32

gdi32

winspool.drv

comdlg32

shell32

oleaut32

shlwapi

mpr

dbghelp

oleacc

gdiplus

msimg32

imm32

winmm

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 456KB - Virtual size: 456KB

.data Size: 26KB - Virtual size: 423KB

.rsrc Size: 731KB - Virtual size: 730KB

.reloc Size: 195KB - Virtual size: 195KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:77:26:b2:3c:85:c4:60:2b:15:3b:d9:cb:20:77:9e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d5:40:92:01:4e:8e:bc:ce:12:62:ec:36:49:66:e9:05:24:dd:70:09:71:f5:88:b1:9e:0b:27:dd:56:66:ee:fb
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 456KB - Virtual size: 456KB

.data
Size: 26KB - Virtual size: 423KB

.rsrc
Size: 731KB - Virtual size: 730KB

.reloc
Size: 195KB - Virtual size: 195KB