248950cf7a2d01e99e1e815c7dc5b28c_JaffaCakes118
- SHA256 18f501c16c958abd19fafa10b1fb5baac2387a51807eb9229fa1cbe4a663b9b6
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
AmazonSetup.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
AmazonSetup.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
AmazonGamesSetup.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
AmazonGamesSetup.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
LIXVoWXPPCyc5Jy.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
General
- Target 248950cf7a2d01e99e1e815c7dc5b28c_JaffaCakes118
- Size 2.8MB
- Sample240704-ee672avenb
- SHA256 18f501c16c958abd19fafa10b1fb5baac2387a51807eb9229fa1cbe4a663b9b6
- MD5 248950cf7a2d01e99e1e815c7dc5b28c
- SHA1 1a7769c3996c2910fa22bd33f3a346e92b3c336b
- SHA512 140d73e524d0972f5a48dab8a970c2ce47e13f3182325b733d411a4f680f5cc8486ae6a5c24808c445e2d8828409eceebbefc3a4e5e58f336c2e3218a438bfa8
- SSDEEP 49152:ESeo65Ct0m42NzeP/HIvWV2hyVZelukZCWaOtBVxRQL73qPvqQ39dqp6b7t:qe0sK/6RqZeJAWaOj/RuUCQgAN
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/AmazonSetup.exe unpack002/LIXVoWXPPCyc5Jy.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/AmazonSetup.exe nsis_installer_1 static1/unpack001/AmazonSetup.exe nsis_installer_2
File Explorer
-
248950cf7a2d01e99e1e815c7dc5b28c_JaffaCakes118.zip 2.8MB
-
AmazonSetup.exe.exe 2.8MB
-
AmazonGamesSetup.exe.exe 1.8MB
-
LIXVoWXPPCyc5Jy.exe.exe 2.5MB
AmazonSetup.exe
- IMPHASH 29b61e5a552b3a9bc00953de1c93be41
- SHA256 aa79d46aa459af0d46da380af6481f51369da4c4080a009028e83857dcd844f2
- MD5 21434ba1af9e80e0bb9d4e49e643d269
- SHA1 c460ce1a3fd7c3c5af78ab01a18bc62bcf3a8c8b
- SHA512 012a96b51ee1cefa86c0bfca56f0fe2a0e3d7ec061fa6868184234338dd5f2329bc0de2298d4a782c3e2bdb4bd665fd373adad6f28f26c2c6439972280d9d7b8
- SSDEEP 49152:AS4o6fCn0IO2N7Sb/h0vQV2vMHZYd6GZC+8qBBVRlEt73LfsL6kVOSo3dAf2doBn:AG0aw/8HWZY/A+8qvfli7fsLHgSw7G5P
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12557
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFileAttributesA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CompareFileTime
SearchPathA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
CreateDirectoryA
lstrcmpiA
GetCommandLineA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
LoadLibraryA
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
WaitForSingleObject
GetWindowsDirectoryA
GetTempPathA
GetProcAddress
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
MulDiv
LoadLibraryExA
GetModuleHandleA
MultiByteToWideChar
FreeLibrary
user32
GetWindowRect
EnableMenuItem
GetSystemMenu
ScreenToClient
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetForegroundWindow
PostQuitMessage
RegisterClassA
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
OpenClipboard
TrackPopupMenu
SendMessageTimeoutA
GetDC
LoadImageA
GetDlgItem
FindWindowExA
IsWindow
SetClipboardData
SetWindowLongA
EmptyClipboard
SetTimer
CreateDialogParamA
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteValueA
SetFileSecurityA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_Destroy
ord17
ImageList_AddMasked
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=153, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
AmazonGamesSetup.exe
- IMPHASH 3302113802c12275640ee5769b28cde4
- SHA256 1a99f1054e51fe86416c59e5c526d69776fdabd7bb9831dbaab8582322121c7a
- MD5 02be3726c0a90958a3c30577d3b3a131
- SHA1 bedbab8bd74a9d7313ba32ca033c81ec32c04706
- SHA512 662eaa8d3b112ef981d27832a2a46b0ecb55e2d1dcf49fe1fbd134e3c4e02758bc9ad3db2e25f53fc174e2083dd278967f405a768fdd814612c9a43bc6d1c713
- SSDEEP 49152:G/mvl+01HHWra6IjgKDlUzIzsBKLxYqJKevCnuueO+0D17gM8s:bvUAnWrBq1ABzH
- MD5 SHA1 SHA512 SSDEEP
Digest
c5:16:39:ab:2a:66:18:1e:9b:42:e8:1b:c5:2b:01:dc:3d:da:64:66:91:73:cf:79:52:d6:7e:8a:6a:ed:91:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=3482342,CN=Amazon.com Services LLC,OU=Amazon Game Studios,O=Amazon.com Services LLC,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 10, 2020
SERIALNUMBER=3482342,CN=Amazon.com Services LLC,OU=Amazon Game Studios,O=Amazon.com Services LLC,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=3482342,CN=Amazon.com Services LLC,OU=Amazon Game Studios,O=Amazon.com Services LLC,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
04:70:07:33:bd:f5:29:7c:12:2e:93:a1:a8:28:47:8f
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 6, 2020 - Aug 11, 2021
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
906084
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\BuildAgent\work\2d8069f083912ec0\installer\bin\Win32\Release\Amazon Games Setup.pdb
kernel32
GetCurrentThread
SetFilePointerEx
MoveFileExW
CreateMutexA
GetExitCodeThread
SystemTimeToFileTime
SetFileAttributesW
LoadLibraryExA
FreeLibrary
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetLastError
GetThreadTimes
OutputDebugStringW
GetDynamicTimeZoneInformation
QueryPerformanceCounter
GetDiskFreeSpaceExA
SetThreadPriority
WideCharToMultiByte
GlobalMemoryStatusEx
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
HeapDestroy
DecodePointer
GetOverlappedResult
GetCurrentDirectoryW
HeapAlloc
CreateThread
RaiseException
HeapReAlloc
Process32FirstW
QueryPerformanceFrequency
LoadLibraryA
GetDiskFreeSpaceExW
Process32NextW
FormatMessageW
MultiByteToWideChar
CreateEventW
CreateToolhelp32Snapshot
HeapSize
OpenProcess
GetModuleHandleA
ReleaseMutex
GetVersionExW
GetLocaleInfoW
InitializeCriticalSectionEx
CreateMutexW
GetTempPathW
SetFilePointer
GetUserDefaultUILanguage
GetModuleFileNameW
RemoveDirectoryW
TerminateProcess
GetSystemDefaultUILanguage
GetStdHandle
HeapFree
GetFileSizeEx
ReadFile
CreateDirectoryW
GetExitCodeProcess
GetModuleHandleW
CreateProcessW
GetProcAddress
GetWindowsDirectoryW
LoadLibraryW
CloseHandle
DeleteFileW
GetLastError
Sleep
GetCurrentThreadId
CreateFileW
WaitForSingleObject
WriteFile
GetCurrentProcess
GetSystemTime
SetEndOfFile
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
GetCommandLineW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
ExitProcess
ExitThread
SetStdHandle
FileTimeToSystemTime
EncodePointer
IsProcessorFeaturePresent
QueueUserWorkItem
GetModuleHandleExW
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetStringTypeW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
FreeLibraryAndExitThread
LoadLibraryExW
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
GetFileType
GetModuleFileNameA
WriteConsoleW
GetSystemInfo
VirtualQuery
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
user32
IsIconic
GetWindowTextW
GetWindowThreadProcessId
GetWindowRect
MessageBoxW
FindWindowW
EnumWindows
EndPaint
BeginPaint
GetCursorPos
ReleaseDC
InvalidateRect
ReleaseCapture
UpdateWindow
ShowWindow
PostQuitMessage
DrawIconEx
DrawTextW
UpdateLayeredWindow
SetCapture
LoadCursorW
TranslateMessage
TrackMouseEvent
PeekMessageW
SetTimer
DispatchMessageW
RegisterClassExW
GetSystemMetrics
GetIconInfo
CreateWindowExW
SetWindowPos
GetDC
DefWindowProcW
SystemParametersInfoW
SetForegroundWindow
PostMessageW
comdlg32
GetSaveFileNameW
advapi32
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
GetFileSecurityW
DuplicateToken
MapGenericMask
GetTokenInformation
RegQueryValueExW
LookupAccountSidW
GetUserNameW
GetLengthSid
RegOpenKeyExW
CheckTokenMembership
FreeSid
OpenProcessToken
IsValidSid
RegCreateKeyExW
RegSetValueExW
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
EqualSid
GetSidSubAuthorityCount
AllocateAndInitializeSid
GetSidSubAuthority
GetSidLengthRequired
CopySid
InitializeSid
AccessCheck
shell32
ShellExecuteExW
SHParseDisplayName
ShellExecuteA
SHGetFolderPathW
SHCreateShellItem
CommandLineToArgvW
ole32
CoCreateGuid
StringFromCLSID
CoInitializeEx
CoTaskMemFree
CoUninitialize
CoCreateInstance
winhttp
WinHttpConnect
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
shlwapi
SHStrDupW
userenv
UnloadUserProfile
rpcrt4
UuidCreate
msimg32
AlphaBlend
gdi32
GetTextExtentPoint32W
DeleteDC
SetBkMode
CreatePen
Rectangle
SetTextColor
TextOutW
CreateFontW
GdiFlush
StretchBlt
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
BitBlt
GetObjectW
SetStretchBltMode
DeleteObject
CreateSolidBrush
CreateDIBitmap
RoundRect
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
298KB
Virtual Size
298KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
138KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=184, id=243, version=40116,
count=32, id=242, version=40116,
count=22, id=241, version=40116,
count=3, id=199, version=41118,
count=26, id=259, version=26706,
count=139, id=261, version=26706,
count=37, id=260, version=26706,
count=1, id=209, version=65501,
count=4, id=206, version=65501,
count=1, id=208, version=65501,
count=29, id=203, version=65501,
count=326, id=1, productName=Unmarked objects,
count=32, id=260, productName=VS2017 v15.7.2 build 26429, version=26429,
count=48, id=261, productName=VS2017 v15.7.2 build 26429, version=26429,
count=67, id=265, version=27038,
count=1, id=255, version=27038,
count=2, id=151,
count=1, id=258, version=27038,
LIXVoWXPPCyc5Jy.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d9aa21479a1a55d57839aee6310cd6853b2bc5215337aa72316a96f7be7ff3e5
- MD5 cef6d09b553a93f81942da9838b1ac57
- SHA1 c32fbf54b54dadabbae600645c417c163234daf5
- SHA512 05ed612b7d2e14b034a391d45b578e0eda2b52be3b8eeccb3534872de61d05d95b4b3e7f10bfa01ef6913d29a24404c8cf635c804f9fbe2820321078d1007928
- SSDEEP 49152:SoSto6fCl0KeaNs68/bXvlM28MTVTc6hhCkJNV8VicCFiO1:S9+0P9/rBRVTpIkJN+YcLO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2557550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ