c34a196a2f55d1db526ccd2b8d1d152920d9b5f9a619d62a63c00205dd176fa9

Sharing

Copy URL Twitter E-mail

General

Target

c34a196a2f55d1db526ccd2b8d1d152920d9b5f9a619d62a63c00205dd176fa9
Size

14.5MB
MD5

35ed142d3e158f4c1ecdd8cf16aaf05f
SHA1

e55b57f48441f2fd4644830fed3fb2f5d964cffa
SHA256

c34a196a2f55d1db526ccd2b8d1d152920d9b5f9a619d62a63c00205dd176fa9
SHA512

cda2209248196d408d434ed93d31f92e1bd0491e2247ae24f4582c25246b3d912fa03eca4eff6c6c959a1a5b9144a6e1150ec6bac8f92e264b307349354bb118
SSDEEP

393216:YD8hDXDdFqdkpQkMPDo7NkrLjOaQkjw4WiWoRkKy:YD8hlF/kDKyrLDWzuTy

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack003/$0/Imagine.dll	acprotect
static1/unpack003/Imagine.dll	acprotect
static1/unpack007/Imagine.dll	acprotect
static1/unpack009/$0/Imagine.dll	acprotect
static1/unpack009/Imagine.dll	acprotect

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Imagine 1.2.0/Imagine 1.2.0_x64.exe	upx
static1/unpack001/Imagine 1.2.0/Imagine_1.2.0.exe	upx
static1/unpack003/$0/Imagine.dll	upx
static1/unpack003/Imagine.dll	upx
static1/unpack003/Uninstall.exe	upx
static1/unpack007/Imagine.dll	upx
static1/unpack001/Imagine 1.2.0/Imagine_1.2.0_Unicode.exe	upx
static1/unpack009/$0/Imagine.dll	upx
static1/unpack009/Imagine.dll	upx
static1/unpack009/Uninstall.exe	upx
static1/unpack001/Imagine 1.2.0/Imagine_1.2.0_x64_Unicode.exe	upx

Unsigned PE 34 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Imagine 1.2.0/Imagine 1.2.0_x64.exe
unpack002/out.upx
unpack001/Imagine 1.2.0/Imagine 1.2.0_x86.exe
unpack001/Imagine 1.2.0/Imagine_1.2.0.exe
unpack003/$0/Imagine.dll
unpack004/out.upx
unpack003/$0/Imagine.exe
unpack003/$0/Imagine.wcx
unpack003/$0/Imagine.wlx
unpack003/Imagine.dll
unpack005/out.upx
unpack003/Imagine.exe
unpack003/Imagine.wcx
unpack003/Imagine.wlx
unpack003/Uninstall.exe
unpack006/out.upx
unpack003/out.upx
unpack007/Imagine.dll
unpack008/out.upx
unpack007/Imagine.exe
unpack007/Imagine.wcx
unpack007/Imagine.wlx
unpack001/Imagine 1.2.0/Imagine_1.2.0_Unicode.exe
unpack009/$0/Imagine.dll
unpack009/$0/Imagine.exe
unpack009/$0/Imagine.wcx
unpack009/$0/Imagine.wlx
unpack009/Imagine.dll
unpack009/Imagine.exe
unpack009/Imagine.wcx
unpack009/Imagine.wlx
unpack009/Uninstall.exe
unpack009/out.upx
unpack001/Imagine 1.2.0/Imagine_1.2.0_x64_Unicode.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
static1/unpack006/out.upx	nsis_installer_2
static1/unpack003/out.upx	nsis_installer_2
static1/unpack009/out.upx	nsis_installer_2

Files

c34a196a2f55d1db526ccd2b8d1d152920d9b5f9a619d62a63c00205dd176fa9
.zip
Imagine 1.2.0/Imagine 1.2.0_x64.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 63KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Imagine 1.2.0/Imagine 1.2.0_x86.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Imagine 1.2.0/Imagine_1.2.0.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 172KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$0/Imagine.chm
.chm
$0/Imagine.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetPluginInterface
adler32
compress
crc32
deflate
deflateEnd
deflateInit2_
deflateInit_
get_crc_table
inflate
inflateBackInit_
inflateEnd
inflateInit2_
inflateInit_
inflateSyncPoint
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort_compress
jpeg_abort_decompress
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_finish_compress
jpeg_finish_decompress
jpeg_mem_src
jpeg_read_header
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_set_defaults
jpeg_set_quality
jpeg_simple_progression
jpeg_start_compress
jpeg_start_decompress
jpeg_std_error
jpeg_stdio_dest
jpeg_stdio_src
jpeg_write_scanlines
uncompress

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 591KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 195KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$0/Imagine.exe
.exe windows:4 windows x86 arch:x86

6efa7b7c341440a5c8d54a2170b40946

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleA
FreeLibrary
GetCommandLineA
GetLastError
LoadLibraryA
lstrcpyA
GetModuleFileNameA
LocalFree
FormatMessageA
GetStartupInfoA
GetProcAddress

user32

TranslateMessage
GetMessageA
MessageBoxA
DispatchMessageA

Sections

.text
Size: 1024B - Virtual size: 599B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$0/Imagine.wcx
.dll windows:4 windows x86 arch:x86

65aa199237eadf52601eabd2e61be575

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
lstrcpyA
GetModuleFileNameA
FreeLibrary
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalAlloc
lstrcatA
LocalFree
lstrlenA

user32

GetForegroundWindow
wsprintfA

Exports

Exports

CanYouHandleThisFile
CloseArchive
GetPackerCaps
OpenArchive
PackFiles
PackSetDefaultParams
ProcessFile
ReadHeader
ReadHeaderEx
SetChangeVolProc
SetProcessDataProc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 885B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$0/Imagine.wlx
.dll windows:4 windows x86 arch:x86

21c06424e680d8cc8ef33c1a336bf67e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
lstrcpyA
GetModuleFileNameA
FreeLibrary
GetProcAddress

Exports

Exports

ListGetDetectString
ListGetPreviewBitmap
ListLoad
ListLoadNext
ListPrint
ListSendCommand
ListSetDefaultParams

Sections

.text
Size: 1024B - Virtual size: 919B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$0/Language/Arabic.lng
$0/Language/Belarusian.lng
$0/Language/Bulgarian.lng
$0/Language/Croatian.lng
$0/Language/Czech.lng
$0/Language/Danish.lng
$0/Language/Estonian.lng
$0/Language/French.lng
$0/Language/German.lng
$0/Language/Hungarian.lng
$0/Language/Italiano.lng
$0/Language/Japanese.lng
$0/Language/Korean.lng
$0/Language/Nederlands.lng
$0/Language/Polish.lng
$0/Language/Portuguese (Brazil).lng
$0/Language/Portuguese (Portugal).lng
$0/Language/Romanian.lng
$0/Language/Russian.lng
$0/Language/SimplifiedChinese.lng
$0/Language/Slovenian.lng
$0/Language/Spanish.lng
$0/Language/Svenska.lng
$0/Language/TraditionalChinese.lng
$0/Language/Turkish.lng
$0/Language/Ukrainian.lng
$0/Language/Uzbek (O'zbekcha).lng
$0/PlugInst.inf
$0/Plugin/Dir.txt
$0/Readme.txt
$0/Whatsnew.txt
Imagine.chm
.chm
Imagine.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetPluginInterface
adler32
compress
crc32
deflate
deflateEnd
deflateInit2_
deflateInit_
get_crc_table
inflate
inflateBackInit_
inflateEnd
inflateInit2_
inflateInit_
inflateSyncPoint
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort_compress
jpeg_abort_decompress
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_finish_compress
jpeg_finish_decompress
jpeg_mem_src
jpeg_read_header
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_set_defaults
jpeg_set_quality
jpeg_simple_progression
jpeg_start_compress
jpeg_start_decompress
jpeg_std_error
jpeg_stdio_dest
jpeg_stdio_src
jpeg_write_scanlines
uncompress

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 591KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 195KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Imagine.exe
.exe windows:4 windows x86 arch:x86

6efa7b7c341440a5c8d54a2170b40946

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleA
FreeLibrary
GetCommandLineA
GetLastError
LoadLibraryA
lstrcpyA
GetModuleFileNameA
LocalFree
FormatMessageA
GetStartupInfoA
GetProcAddress

user32

TranslateMessage
GetMessageA
MessageBoxA
DispatchMessageA

Sections

.text
Size: 1024B - Virtual size: 599B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Imagine.wcx
.dll windows:4 windows x86 arch:x86

65aa199237eadf52601eabd2e61be575

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
lstrcpyA
GetModuleFileNameA
FreeLibrary
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalAlloc
lstrcatA
LocalFree
lstrlenA

user32

GetForegroundWindow
wsprintfA

Exports

Exports

CanYouHandleThisFile
CloseArchive
GetPackerCaps
OpenArchive
PackFiles
PackSetDefaultParams
ProcessFile
ReadHeader
ReadHeaderEx
SetChangeVolProc
SetProcessDataProc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 885B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Imagine.wlx
.dll windows:4 windows x86 arch:x86

21c06424e680d8cc8ef33c1a336bf67e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
lstrcpyA
GetModuleFileNameA
FreeLibrary
GetProcAddress

Exports

Exports

ListGetDetectString
ListGetPreviewBitmap
ListLoad
ListLoadNext
ListPrint
ListSendCommand
ListSetDefaultParams

Sections

.text
Size: 1024B - Virtual size: 919B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Language/Arabic.lng
Language/Belarusian.lng
Language/Bulgarian.lng
Language/Croatian.lng
Language/Czech.lng
Language/Danish.lng
Language/Estonian.lng
Language/French.lng
Language/German.lng
Language/Hungarian.lng
Language/Italiano.lng
Language/Japanese.lng
Language/Korean.lng
Language/Nederlands.lng
Language/Polish.lng
Language/Portuguese (Brazil).lng
Language/Portuguese (Portugal).lng
Language/Romanian.lng
Language/Russian.lng
Language/SimplifiedChinese.lng
Language/Slovenian.lng
Language/Spanish.lng
Language/Svenska.lng
Language/TraditionalChinese.lng
Language/Turkish.lng
Language/Ukrainian.lng
Language/Uzbek (O'zbekcha).lng
PlugInst.inf
Plugin/Dir.txt
Readme.txt
Uninstall.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 172KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Whatsnew.txt
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Imagine 1.2.0/Imagine_1.2.0.zip
.zip
Imagine.chm
.chm
Imagine.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetPluginInterface
adler32
compress
crc32
deflate
deflateEnd
deflateInit2_
deflateInit_
get_crc_table
inflate
inflateBackInit_
inflateEnd
inflateInit2_
inflateInit_
inflateSyncPoint
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort_compress
jpeg_abort_decompress
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_finish_compress
jpeg_finish_decompress
jpeg_mem_src
jpeg_read_header
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_set_defaults
jpeg_set_quality
jpeg_simple_progression
jpeg_start_compress
jpeg_start_decompress
jpeg_std_error
jpeg_stdio_dest
jpeg_stdio_src
jpeg_write_scanlines
uncompress

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 591KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 195KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Imagine.exe
.exe windows:4 windows x86 arch:x86

6efa7b7c341440a5c8d54a2170b40946

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleA
FreeLibrary
GetCommandLineA
GetLastError
LoadLibraryA
lstrcpyA
GetModuleFileNameA
LocalFree
FormatMessageA
GetStartupInfoA
GetProcAddress

user32

TranslateMessage
GetMessageA
MessageBoxA
DispatchMessageA

Sections

.text
Size: 1024B - Virtual size: 599B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Imagine.wcx
.dll windows:4 windows x86 arch:x86

65aa199237eadf52601eabd2e61be575

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
lstrcpyA
GetModuleFileNameA
FreeLibrary
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalAlloc
lstrcatA
LocalFree
lstrlenA

user32

GetForegroundWindow
wsprintfA

Exports

Exports

CanYouHandleThisFile
CloseArchive
GetPackerCaps
OpenArchive
PackFiles
PackSetDefaultParams
ProcessFile
ReadHeader
ReadHeaderEx
SetChangeVolProc
SetProcessDataProc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 885B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Imagine.wlx
.dll windows:4 windows x86 arch:x86

21c06424e680d8cc8ef33c1a336bf67e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
lstrcpyA
GetModuleFileNameA
FreeLibrary
GetProcAddress

Exports

Exports

ListGetDetectString
ListGetPreviewBitmap
ListLoad
ListLoadNext
ListPrint
ListSendCommand
ListSetDefaultParams

Sections

.text
Size: 1024B - Virtual size: 919B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Language/Arabic.lng
Language/Belarusian.lng
Language/Bulgarian.lng
Language/Croatian.lng
Language/Czech.lng
Language/Danish.lng
Language/Estonian.lng
Language/French.lng
Language/German.lng
Language/Hungarian.lng
Language/Italiano.lng
Language/Japanese.lng
Language/Korean.lng
Language/Nederlands.lng
Language/Polish.lng
Language/Portuguese (Brazil).lng
Language/Portuguese (Portugal).lng
Language/Romanian.lng
Language/Russian.lng
Language/SimplifiedChinese.lng
Language/Slovenian.lng
Language/Spanish.lng
Language/Svenska.lng
Language/TraditionalChinese.lng
Language/Turkish.lng
Language/Ukrainian.lng
Language/Uzbek (O'zbekcha).lng
PlugInst.inf
Plugin/Dir.txt
Readme.txt
Whatsnew.txt
Imagine 1.2.0/Imagine_1.2.0_Unicode.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 172KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$0/Imagine.chm
.chm
$0/Imagine.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetPluginInterface
adler32
compress
crc32
deflate
deflateEnd
deflateInit2_
deflateInit_
get_crc_table
inflate
inflateBackInit_
inflateEnd
inflateInit2_
inflateInit_
inflateSyncPoint
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort_compress
jpeg_abort_decompress
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_finish_compress
jpeg_finish_decompress
jpeg_mem_src
jpeg_read_header
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_set_defaults
jpeg_set_quality
jpeg_simple_progression
jpeg_start_compress
jpeg_start_decompress
jpeg_std_error
jpeg_stdio_dest
jpeg_stdio_src
jpeg_write_scanlines
uncompress

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 595KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 195KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$0/Imagine.exe
.exe windows:4 windows x86 arch:x86

359952f7236858b71497f85499e2614d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleW
FreeLibrary
GetCommandLineW
GetLastError
LoadLibraryW
lstrcpyW
GetModuleFileNameW
LocalFree
FormatMessageW
GetStartupInfoW
GetProcAddress

user32

TranslateMessage
GetMessageW
MessageBoxW
DispatchMessageW

Sections

.text
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$0/Imagine.wcx
.dll windows:4 windows x86 arch:x86

5d63995d1bd61b212e35a61ebc32711a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryW
lstrcpyW
GetModuleFileNameW
FreeLibrary
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalAlloc
lstrcatW
LocalFree
lstrlenW

user32

GetForegroundWindow
wsprintfW

Exports

Exports

CanYouHandleThisFileW
CloseArchive
GetPackerCaps
OpenArchive
OpenArchiveW
PackFiles
PackFilesW
PackSetDefaultParams
ProcessFile
ProcessFileW
ReadHeader
ReadHeaderEx
ReadHeaderExW
SetChangeVolProc
SetChangeVolProcW
SetProcessDataProc
SetProcessDataProcW

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$0/Imagine.wlx
.dll windows:4 windows x86 arch:x86

a9ff84b50e81c54cd824f51e791b269f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryW
lstrcpyW
GetModuleFileNameW
FreeLibrary
GetProcAddress

Exports

Exports

ListGetDetectString
ListGetPreviewBitmapW
ListLoad
ListLoadNextW
ListLoadW
ListPrintW
ListSendCommand
ListSetDefaultParams

Sections

.text
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 495B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$0/Language/Arabic.lng
$0/Language/Belarusian.lng
$0/Language/Bulgarian.lng
$0/Language/Croatian.lng
$0/Language/Czech.lng
$0/Language/Danish.lng
$0/Language/Estonian.lng
$0/Language/French.lng
$0/Language/German.lng
$0/Language/Hungarian.lng
$0/Language/Italiano.lng
$0/Language/Japanese.lng
$0/Language/Korean.lng
$0/Language/Nederlands.lng
$0/Language/Polish.lng
$0/Language/Portuguese (Brazil).lng
$0/Language/Portuguese (Portugal).lng
$0/Language/Romanian.lng
$0/Language/Russian.lng
$0/Language/SimplifiedChinese.lng
$0/Language/Slovenian.lng
$0/Language/Spanish.lng
$0/Language/Svenska.lng
$0/Language/TraditionalChinese.lng
$0/Language/Turkish.lng
$0/Language/Ukrainian.lng
$0/Language/Uzbek (O'zbekcha).lng
$0/PlugInst.inf
$0/Plugin/Dir.txt
$0/Readme.txt
$0/Whatsnew.txt
Imagine.chm
.chm
Imagine.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetPluginInterface
adler32
compress
crc32
deflate
deflateEnd
deflateInit2_
deflateInit_
get_crc_table
inflate
inflateBackInit_
inflateEnd
inflateInit2_
inflateInit_
inflateSyncPoint
jpeg_CreateCompress
jpeg_CreateDecompress
jpeg_abort_compress
jpeg_abort_decompress
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_finish_compress
jpeg_finish_decompress
jpeg_mem_src
jpeg_read_header
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_set_defaults
jpeg_set_quality
jpeg_simple_progression
jpeg_start_compress
jpeg_start_decompress
jpeg_std_error
jpeg_stdio_dest
jpeg_stdio_src
jpeg_write_scanlines
uncompress

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 595KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 195KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Imagine.exe
.exe windows:4 windows x86 arch:x86

359952f7236858b71497f85499e2614d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleW
FreeLibrary
GetCommandLineW
GetLastError
LoadLibraryW
lstrcpyW
GetModuleFileNameW
LocalFree
FormatMessageW
GetStartupInfoW
GetProcAddress

user32

TranslateMessage
GetMessageW
MessageBoxW
DispatchMessageW

Sections

.text
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Imagine.wcx
.dll windows:4 windows x86 arch:x86

5d63995d1bd61b212e35a61ebc32711a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryW
lstrcpyW
GetModuleFileNameW
FreeLibrary
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalAlloc
lstrcatW
LocalFree
lstrlenW

user32

GetForegroundWindow
wsprintfW

Exports

Exports

CanYouHandleThisFileW
CloseArchive
GetPackerCaps
OpenArchive
OpenArchiveW
PackFiles
PackFilesW
PackSetDefaultParams
ProcessFile
ProcessFileW
ReadHeader
ReadHeaderEx
ReadHeaderExW
SetChangeVolProc
SetChangeVolProcW
SetProcessDataProc
SetProcessDataProcW

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Imagine.wlx
.dll windows:4 windows x86 arch:x86

a9ff84b50e81c54cd824f51e791b269f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryW
lstrcpyW
GetModuleFileNameW
FreeLibrary
GetProcAddress

Exports

Exports

ListGetDetectString
ListGetPreviewBitmapW
ListLoad
ListLoadNextW
ListLoadW
ListPrintW
ListSendCommand
ListSetDefaultParams

Sections

.text
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 495B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Language/Arabic.lng
Language/Belarusian.lng
Language/Bulgarian.lng
Language/Croatian.lng
Language/Czech.lng
Language/Danish.lng
Language/Estonian.lng
Language/French.lng
Language/German.lng
Language/Hungarian.lng
Language/Italiano.lng
Language/Japanese.lng
Language/Korean.lng
Language/Nederlands.lng
Language/Polish.lng
Language/Portuguese (Brazil).lng
Language/Portuguese (Portugal).lng
Language/Romanian.lng
Language/Russian.lng
Language/SimplifiedChinese.lng
Language/Slovenian.lng
Language/Spanish.lng
Language/Svenska.lng
Language/TraditionalChinese.lng
Language/Turkish.lng
Language/Ukrainian.lng
Language/Uzbek (O'zbekcha).lng
PlugInst.inf
Plugin/Dir.txt
Readme.txt
Uninstall.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 172KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Whatsnew.txt
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Imagine 1.2.0/Imagine_1.2.0_Unicode.zip
.zip
Imagine 1.2.0/Imagine_1.2.0_x64_Unicode.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 172KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Imagine 1.2.0/Imagine_1.2.0_x64_Unicode.zip
.zip

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 108KB

UPX1 Size: 63KB - Virtual size: 64KB

.rsrc Size: 7KB - Virtual size: 8KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 109KB - Virtual size: 108KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 3KB - Virtual size: 11KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 6KB - Virtual size: 5KB

Headers

File Characteristics

Sections

.text Size: 76KB - Virtual size: 76KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 6KB - Virtual size: 5KB

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 172KB

UPX1 Size: 19KB - Virtual size: 20KB

.rsrc Size: 3KB - Virtual size: 4KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 1.3MB

UPX1 Size: 591KB - Virtual size: 592KB

.rsrc Size: 195KB - Virtual size: 196KB

Headers

File Characteristics

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 199KB - Virtual size: 198KB

.data Size: 22KB - Virtual size: 220KB

.rsrc Size: 269KB - Virtual size: 269KB

.reloc Size: 43KB - Virtual size: 43KB

6efa7b7c341440a5c8d54a2170b40946

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 1024B - Virtual size: 599B

.rdata Size: 1024B - Virtual size: 528B

.rsrc Size: 10KB - Virtual size: 10KB

65aa199237eadf52601eabd2e61be575

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1024B - Virtual size: 885B

.data Size: - Virtual size: 12B

.rsrc Size: 1024B - Virtual size: 808B

.reloc Size: 512B - Virtual size: 136B

21c06424e680d8cc8ef33c1a336bf67e

Headers

File Characteristics

Imports

kernel32

UPX0
Size: - Virtual size: 108KB

UPX1
Size: 63KB - Virtual size: 64KB

.rsrc
Size: 7KB - Virtual size: 8KB

.text
Size: 109KB - Virtual size: 108KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 3KB - Virtual size: 11KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 6KB - Virtual size: 5KB

.text
Size: 76KB - Virtual size: 76KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 6KB - Virtual size: 5KB

UPX0
Size: - Virtual size: 172KB

UPX1
Size: 19KB - Virtual size: 20KB

.rsrc
Size: 3KB - Virtual size: 4KB

UPX0
Size: - Virtual size: 1.3MB

UPX1
Size: 591KB - Virtual size: 592KB

.rsrc
Size: 195KB - Virtual size: 196KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 199KB - Virtual size: 198KB

.data
Size: 22KB - Virtual size: 220KB

.rsrc
Size: 269KB - Virtual size: 269KB

.reloc
Size: 43KB - Virtual size: 43KB

.text
Size: 1024B - Virtual size: 599B

.rdata
Size: 1024B - Virtual size: 528B

.rsrc
Size: 10KB - Virtual size: 10KB

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1024B - Virtual size: 885B

.data
Size: - Virtual size: 12B

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 512B - Virtual size: 136B

.text
Size: 1024B - Virtual size: 919B

.rdata
Size: 512B - Virtual size: 472B

.data
Size: - Virtual size: 8B

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 512B - Virtual size: 80B

UPX0
Size: - Virtual size: 1.3MB

UPX1
Size: 591KB - Virtual size: 592KB

.rsrc
Size: 195KB - Virtual size: 196KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 199KB - Virtual size: 198KB

.data
Size: 22KB - Virtual size: 220KB

.rsrc
Size: 269KB - Virtual size: 269KB

.reloc
Size: 43KB - Virtual size: 43KB

.text
Size: 1024B - Virtual size: 599B

.rdata
Size: 1024B - Virtual size: 528B

.rsrc
Size: 10KB - Virtual size: 10KB

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1024B - Virtual size: 885B

.data
Size: - Virtual size: 12B

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 512B - Virtual size: 136B

.text
Size: 1024B - Virtual size: 919B

.rdata
Size: 512B - Virtual size: 472B

.data
Size: - Virtual size: 8B

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 512B - Virtual size: 80B