2f2c706b831fe673150bd147ab764254_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2f2c706b831fe673150bd147ab764254_JaffaCakes118
Size

4.5MB
MD5

2f2c706b831fe673150bd147ab764254
SHA1

09d609a10973243abc99c9f65b8e9fe2dcbfd0ab
SHA256

9586922e85a5917c000f5c453c83d6c0661dfd1bbf5a2df03303e8fa0c84b1e7
SHA512

1d917e8abfdd0feb52a4c74a340cd6b6bbedd9aca8bf6b6f2ea27ef776e06bc3eb904881d9da1c9185c7a2fa8cf2c46d20d4ca6a26072914f44e2c5b8e5c1eec
SSDEEP

98304:xeSlTbeD1MkcuaoVP1w/S3Y9PGC2+fVlzYGNu4mZhIi:xedUSP1w/iY9+C2+HzYGchV

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/data/wpmodule/wpmod3.dat	themida

Unsigned PE 15 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WP669.exe
unpack001/data/wpmodule/wpmod1.dat
unpack001/data/wpmodule/wpmod2.dat
unpack001/data/wpmodule/wpmod3.dat
unpack002/sources/tstdll0.dll
unpack001/wpsc/DEMO/DLL/tstdll0.dll
unpack001/wpsc/DEMO/DLL_events/DLL_event1.dll
unpack003/source5/tstdll5.dll
unpack001/wpsc/DEMO/LA2/tstdll5.dll
unpack001/wpsc/DEMO/_demoPrDLL_1/demoPrDLL_1.dll
unpack001/wpsc/LIB/libgmp-3.dll
unpack001/wpsc/LIB/memDisp.dll
unpack001/wpsc/LIB/zlib125.dll
unpack001/wpsc/RF01/dummy.exe
unpack001/wpsc/RF01/rfsld.dll

Files

2f2c706b831fe673150bd147ab764254_JaffaCakes118
.rar
!readme.txt
!wp668.txt
.js
!wp669.txt
ScriptTester.txt
ScriptTester.txt1
WP669.exe
.exe windows:4 windows x86 arch:x86

d50fcdf1e7cfb1a4e94fe9714fa7af37

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
SetCurrentDirectoryA
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
SetLastError
GetLastError
GetCurrentDirectoryA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcpyA
lstrcmpiA
lstrcmpA
WriteProcessMemory
WritePrivateProfileStringA
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAllocEx
VirtualAlloc
UnmapViewOfFile
SuspendThread
SleepEx
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetThreadContext
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryA
ReadProcessMemory
ReadFile
OpenProcess
OpenFileMappingA
OpenFile
MultiByteToWideChar
MulDiv
MoveFileA
MapViewOfFile
LockResource
LoadResource
LoadLibraryExA
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalSize
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStringTypeExA
GetStdHandle
GetProfileStringA
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DuplicateHandle
DeleteFileA
DeleteCriticalSection
CreateThread
CreateRemoteThread
CreateProcessA
CreateFileMappingA
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CompareStringA
CloseHandle
Beep
Sleep
OpenThread
Process32Next
Process32First
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WinHelpA
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCursor
ShowCaret
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClipboardData
SetClassLongA
SetCaretPos
SetCapture
SetActiveWindow
SendMessageTimeoutA
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassExA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageA
OpenClipboard
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
MessageBeep
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
HideCaret
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongA
GetWindowDC
GetUpdateRect
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessagePos
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDoubleClickTime
GetDlgItem
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameA
GetClassInfoA
GetCapture
GetAsyncKeyState
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumClipboardFormats
EndPaint
EndDeferWindowPos
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DestroyCaret
DeleteMenu
DeferWindowPos
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
CreateCaret
CloseClipboard
ClientToScreen
ChildWindowFromPoint
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
BeginDeferWindowPos
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
MessageBoxW

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetSecurityDescriptorDacl
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueA
InitializeSecurityDescriptor
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
AdjustTokenPrivileges

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

gdi32

UnrealizeObject
StretchBlt
StartPage
StartDocA
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetMapMode
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SelectClipRgn
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetNearestColor
GetMapMode
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExtTextOutA
ExcludeClipRect
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateICA
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt

ole32

CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize

comctl32

ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls

winspool.drv

OpenPrinterA
EnumPrintersA
DocumentPropertiesA
ClosePrinter

shell32

Shell_NotifyIconA
ShellExecuteA
SHGetFileInfoA
SHGetSpecialFolderLocation
SHGetMalloc
SHGetDesktopFolder

comdlg32

GetSaveFileNameA
GetOpenFileNameA

wsock32

__WSAFDIsSet
WSACleanup
WSAStartup
WSASetLastError
WSAGetLastError
gethostbyname
gethostbyaddr
socket
shutdown
send
select
recv
listen
ioctlsocket
inet_ntoa
inet_addr
getsockname
getpeername
connect
closesocket
bind
accept

ntdll

ZwQuerySystemInformation
ZwQueryInformationProcess

winmm

timeEndPeriod
timeBeginPeriod

Sections

CODE
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 25KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.0
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.1
Size: - Virtual size: 421KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.2
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/DNScache.ini
data/DNScache.ini~
data/aclist.dat
data/filter.ini
data/packets/!doc.txt
data/packets/T2ItemsID-en.ini
data/packets/T2ItemsID-ru.ini
data/packets/T2SkillsID-en.ini
data/packets/T2SkillsID-ru.ini
data/packets/T2SysMsgID-en.ini
data/packets/T2SysMsgID-ru.ini
data/packets/T2augment-en.ini
data/packets/T2augment-ru.ini
data/packets/T2misc.ini
data/packets/T2npcID-en.ini
data/packets/T2npcID-ru.ini
data/packets/T2packets.fsc
data/packets/T2packets.ini
data/packets/T2packets.xml
.xml
data/packets/T3packets.fsc
data/packets/T3packets.ini
data/packets/T5packets.fsc
data/packets/T5packets.ini
data/packets/broveymimo.RFC/T3packets.fsc
data/packets/broveymimo.RFC/T3packets.ini
data/packets/pckinfo.ini
data/pclist.ini
data/pclist.ini~
data/shost.ini
data/shost.ini~
data/sipn.dat
data/slist.ini
data/slist.ini~
data/tid.dat
data/wpmodule/wpmod1.dat
.exe windows:4 windows x86 arch:x86

4ab082d28aabd87905952399fdfa40d2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
WideCharToMultiByte
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcpyA
lstrcmpiA
WriteFile
VirtualQuery
ReadFile
OpenFile
LoadLibraryA
GetVersionExA
GetThreadLocale
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetFileSize
GetDiskFreeSpaceA
GetCPInfo
GetACP
FreeLibrary
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
MessageBoxA
LoadStringA
GetSystemMetrics
CharNextA
CharToOemA
MessageBoxA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen

Sections

CODE
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

L0
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

L1
Size: - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

L2
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/wpmodule/wpmod2.dat
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

1
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/wpmodule/wpmod3.dat
.dll windows:5 windows x86 arch:x86

be56c3e138cad5e20c21b4785f1ed7e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThread
GetThreadContext
VirtualQuery
GetCurrentProcess
GetModuleHandleW
VirtualFree
InitializeCriticalSection
Sleep
LeaveCriticalSection
SetThreadPriority
FlushInstructionCache
GetProcAddress
VirtualAlloc
EnterCriticalSection
VirtualProtectEx
OpenThread
GetSystemInfo
GetThreadPriority
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
SuspendThread
ResumeThread
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
LoadLibraryW
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapCreate
HeapDestroy
HeapReAlloc
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
MultiByteToWideChar
SetFilePointer
SetStdHandle
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
CreateFileA

Exports

Exports

_init@12
_md5@4

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 154KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

themida0
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

themida1
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
doc/[!] PPC User-Manual - 1.htm
.html .js polyglot
doc/[!] PPC User-Manual - 1_files/01.gif
.gif
doc/[!] PPC User-Manual - 1_files/10.gif
.gif
doc/[!] PPC User-Manual - 1_files/100zakladok.gif
.gif
doc/[!] PPC User-Manual - 1_files/WPMIdef.gif
doc/[!] PPC User-Manual - 1_files/ab.gif
.gif
doc/[!] PPC User-Manual - 1_files/bobrdobr.gif
.gif
doc/[!] PPC User-Manual - 1_files/bookmarksite_delicious.gif
.gif
doc/[!] PPC User-Manual - 1_files/bookmarksite_digg.gif
.gif
doc/[!] PPC User-Manual - 1_files/bookmarksite_google.gif
.gif
doc/[!] PPC User-Manual - 1_files/bookmarksite_stumbleupon.gif
.gif
doc/[!] PPC User-Manual - 1_files/cat_top_ls.gif
.gif
doc/[!] PPC User-Manual - 1_files/cat_top_rs.gif
.gif
doc/[!] PPC User-Manual - 1_files/collapse_tcat.gif
.gif
doc/[!] PPC User-Manual - 1_files/collapse_thead.gif
.gif
doc/[!] PPC User-Manual - 1_files/de.gif
.gif
doc/[!] PPC User-Manual - 1_files/en.gif
.gif
doc/[!] PPC User-Manual - 1_files/expand_main_table.gif
.gif
doc/[!] PPC User-Manual - 1_files/facebook.gif
.gif
doc/[!] PPC User-Manual - 1_files/footer_ls.gif
.gif
doc/[!] PPC User-Manual - 1_files/footer_rs.gif
.gif
doc/[!] PPC User-Manual - 1_files/fr.gif
.gif
doc/[!] PPC User-Manual - 1_files/icon3.png
.png
doc/[!] PPC User-Manual - 1_files/index.htm
.js
doc/[!] PPC User-Manual - 1_files/k10.gif
.gif
doc/[!] PPC User-Manual - 1_files/k12.gif
doc/[!] PPC User-Manual - 1_files/k13.gif
.gif
doc/[!] PPC User-Manual - 1_files/k15.gif
doc/[!] PPC User-Manual - 1_files/k1a.gif
.gif
doc/[!] PPC User-Manual - 1_files/k2.gif
.gif
doc/[!] PPC User-Manual - 1_files/k3.gif
.gif
doc/[!] PPC User-Manual - 1_files/k4.gif
.gif
doc/[!] PPC User-Manual - 1_files/k5a.gif
.gif
doc/[!] PPC User-Manual - 1_files/k5b.gif
.gif
doc/[!] PPC User-Manual - 1_files/k6.gif
.gif
doc/[!] PPC User-Manual - 1_files/k7.gif
.gif
doc/[!] PPC User-Manual - 1_files/k8.gif
.gif
doc/[!] PPC User-Manual - 1_files/k9.gif
.gif
doc/[!] PPC User-Manual - 1_files/ls_main_table_btm.gif
.gif
doc/[!] PPC User-Manual - 1_files/ls_main_table_top.gif
.gif
doc/[!] PPC User-Manual - 1_files/mainup.png
.png
doc/[!] PPC User-Manual - 1_files/memori.gif
.gif
doc/[!] PPC User-Manual - 1_files/menu_open.gif
.gif
doc/[!] PPC User-Manual - 1_files/mwong.gif
.gif
doc/[!] PPC User-Manual - 1_files/navbits_finallink_ltr.gif
.gif
doc/[!] PPC User-Manual - 1_files/navbits_start.gif
.gif
doc/[!] PPC User-Manual - 1_files/nl.gif
.gif
doc/[!] PPC User-Manual - 1_files/post_old.gif
.gif
doc/[!] PPC User-Manual - 1_files/post_thanks.gif
.gif
doc/[!] PPC User-Manual - 1_files/printer.gif
.gif
doc/[!] PPC User-Manual - 1_files/rating_5.gif
.gif
doc/[!] PPC User-Manual - 1_files/report.gif
.gif
doc/[!] PPC User-Manual - 1_files/reputation.gif
.gif
doc/[!] PPC User-Manual - 1_files/rs_main_table_btm.gif
.gif
doc/[!] PPC User-Manual - 1_files/rs_main_table_top.gif
.gif
doc/[!] PPC User-Manual - 1_files/ru.gif
.gif
doc/[!] PPC User-Manual - 1_files/sendtofriend.gif
.gif
doc/[!] PPC User-Manual - 1_files/subscribe.gif
.gif
doc/[!] PPC User-Manual - 1_files/supermoderator.png
.png
doc/[!] PPC User-Manual - 1_files/t.gif
.gif
doc/[!] PPC User-Manual - 1_files/t_002.gif
.gif
doc/[!] PPC User-Manual - 1_files/threadclosed.gif
.gif
doc/[!] PPC User-Manual - 1_files/trans.gif
.gif
doc/[!] PPC User-Manual - 1_files/uk.gif
.gif
doc/[!] PPC User-Manual - 1_files/user2410.gif
doc/[!] PPC User-Manual - 1_files/vbulletin_important.css
doc/[!] PPC User-Manual - 1_files/vipdt.png
.png
doc/[!] PPC User-Manual - 1_files/wp8831.gif
.gif
doc/[!] PPC User-Manual - 1_files/yandex.gif
.gif
doc/[!] PPC User-Manual - 2.htm
.html .js polyglot
doc/[!] PPC User-Manual - 2_files/01.gif
.gif
doc/[!] PPC User-Manual - 2_files/10.gif
.gif
doc/[!] PPC User-Manual - 2_files/100zakladok.gif
.gif
doc/[!] PPC User-Manual - 2_files/WPMIdef.gif
doc/[!] PPC User-Manual - 2_files/ab.gif
.gif
doc/[!] PPC User-Manual - 2_files/bobrdobr.gif
.gif
doc/[!] PPC User-Manual - 2_files/bookmarksite_delicious.gif
.gif
doc/[!] PPC User-Manual - 2_files/bookmarksite_digg.gif
.gif
doc/[!] PPC User-Manual - 2_files/bookmarksite_google.gif
.gif
doc/[!] PPC User-Manual - 2_files/bookmarksite_stumbleupon.gif
.gif
doc/[!] PPC User-Manual - 2_files/cat_top_ls.gif
.gif
doc/[!] PPC User-Manual - 2_files/cat_top_rs.gif
.gif
doc/[!] PPC User-Manual - 2_files/collapse_tcat.gif
.gif
doc/[!] PPC User-Manual - 2_files/collapse_thead.gif
.gif
doc/[!] PPC User-Manual - 2_files/de.gif
.gif
doc/[!] PPC User-Manual - 2_files/en.gif
.gif
doc/[!] PPC User-Manual - 2_files/expand_main_table.gif
.gif
doc/[!] PPC User-Manual - 2_files/facebook.gif
.gif
doc/[!] PPC User-Manual - 2_files/footer_ls.gif
.gif
doc/[!] PPC User-Manual - 2_files/footer_rs.gif
.gif
doc/[!] PPC User-Manual - 2_files/fr.gif
.gif
doc/[!] PPC User-Manual - 2_files/icon3.png
.png
doc/[!] PPC User-Manual - 2_files/index.htm
.js
doc/[!] PPC User-Manual - 2_files/k10.gif
.gif
doc/[!] PPC User-Manual - 2_files/k12.gif
doc/[!] PPC User-Manual - 2_files/k13.gif
.gif
doc/[!] PPC User-Manual - 2_files/k15.gif
doc/[!] PPC User-Manual - 2_files/k1a.gif
.gif
doc/[!] PPC User-Manual - 2_files/k2.gif
.gif
doc/[!] PPC User-Manual - 2_files/k3.gif
.gif
doc/[!] PPC User-Manual - 2_files/k4.gif
.gif
doc/[!] PPC User-Manual - 2_files/k5a.gif
.gif
doc/[!] PPC User-Manual - 2_files/k5b.gif
.gif
doc/[!] PPC User-Manual - 2_files/k6.gif
.gif
doc/[!] PPC User-Manual - 2_files/k7.gif
.gif
doc/[!] PPC User-Manual - 2_files/k8.gif
.gif
doc/[!] PPC User-Manual - 2_files/k9.gif
.gif
doc/[!] PPC User-Manual - 2_files/ls_main_table_btm.gif
.gif
doc/[!] PPC User-Manual - 2_files/ls_main_table_top.gif
.gif
doc/[!] PPC User-Manual - 2_files/mainup.png
.png
doc/[!] PPC User-Manual - 2_files/memori.gif
.gif
doc/[!] PPC User-Manual - 2_files/menu_open.gif
.gif
doc/[!] PPC User-Manual - 2_files/mwong.gif
.gif
doc/[!] PPC User-Manual - 2_files/navbits_finallink_ltr.gif
.gif
doc/[!] PPC User-Manual - 2_files/navbits_start.gif
.gif
doc/[!] PPC User-Manual - 2_files/nl.gif
.gif
doc/[!] PPC User-Manual - 2_files/post_old.gif
.gif
doc/[!] PPC User-Manual - 2_files/post_thanks.gif
.gif
doc/[!] PPC User-Manual - 2_files/printer.gif
.gif
doc/[!] PPC User-Manual - 2_files/rating_5.gif
.gif
doc/[!] PPC User-Manual - 2_files/report.gif
.gif
doc/[!] PPC User-Manual - 2_files/reputation.gif
.gif
doc/[!] PPC User-Manual - 2_files/rs_main_table_btm.gif
.gif
doc/[!] PPC User-Manual - 2_files/rs_main_table_top.gif
.gif
doc/[!] PPC User-Manual - 2_files/ru.gif
.gif
doc/[!] PPC User-Manual - 2_files/sendtofriend.gif
.gif
doc/[!] PPC User-Manual - 2_files/subscribe.gif
.gif
doc/[!] PPC User-Manual - 2_files/supermoderator.png
.png
doc/[!] PPC User-Manual - 2_files/t.gif
.gif
doc/[!] PPC User-Manual - 2_files/t_002.gif
.gif
doc/[!] PPC User-Manual - 2_files/threadclosed.gif
.gif
doc/[!] PPC User-Manual - 2_files/trans.gif
.gif
doc/[!] PPC User-Manual - 2_files/uk.gif
.gif
doc/[!] PPC User-Manual - 2_files/user2410.gif
doc/[!] PPC User-Manual - 2_files/vbulletin_important.css
doc/[!] PPC User-Manual - 2_files/vipdt.png
.png
doc/[!] PPC User-Manual - 2_files/wp8831.gif
.gif
doc/[!] PPC User-Manual - 2_files/yandex.gif
.gif
doc/[!] PPC User-Manual - 3.htm
.html .js polyglot
doc/[!] PPC User-Manual - 3_files/01.gif
.gif
doc/[!] PPC User-Manual - 3_files/10.gif
.gif
doc/[!] PPC User-Manual - 3_files/100zakladok.gif
.gif
doc/[!] PPC User-Manual - 3_files/WPMIdef.gif
doc/[!] PPC User-Manual - 3_files/ab.gif
.gif
doc/[!] PPC User-Manual - 3_files/bobrdobr.gif
.gif
doc/[!] PPC User-Manual - 3_files/bookmarksite_delicious.gif
.gif
doc/[!] PPC User-Manual - 3_files/bookmarksite_digg.gif
.gif
doc/[!] PPC User-Manual - 3_files/bookmarksite_google.gif
.gif
doc/[!] PPC User-Manual - 3_files/bookmarksite_stumbleupon.gif
.gif
doc/[!] PPC User-Manual - 3_files/cat_top_ls.gif
.gif
doc/[!] PPC User-Manual - 3_files/cat_top_rs.gif
.gif
doc/[!] PPC User-Manual - 3_files/collapse_tcat.gif
.gif
doc/[!] PPC User-Manual - 3_files/collapse_thead.gif
.gif
doc/[!] PPC User-Manual - 3_files/de.gif
.gif
doc/[!] PPC User-Manual - 3_files/en.gif
.gif
doc/[!] PPC User-Manual - 3_files/expand_main_table.gif
.gif
doc/[!] PPC User-Manual - 3_files/facebook.gif
.gif
doc/[!] PPC User-Manual - 3_files/footer_ls.gif
.gif
doc/[!] PPC User-Manual - 3_files/footer_rs.gif
.gif
doc/[!] PPC User-Manual - 3_files/fr.gif
.gif
doc/[!] PPC User-Manual - 3_files/icon3.png
.png
doc/[!] PPC User-Manual - 3_files/index.htm
.js
doc/[!] PPC User-Manual - 3_files/k10.gif
.gif
doc/[!] PPC User-Manual - 3_files/k12.gif
doc/[!] PPC User-Manual - 3_files/k13.gif
.gif
doc/[!] PPC User-Manual - 3_files/k15.gif
doc/[!] PPC User-Manual - 3_files/k1a.gif
.gif
doc/[!] PPC User-Manual - 3_files/k2.gif
.gif
doc/[!] PPC User-Manual - 3_files/k3.gif
.gif
doc/[!] PPC User-Manual - 3_files/k4.gif
.gif
doc/[!] PPC User-Manual - 3_files/k5a.gif
.gif
doc/[!] PPC User-Manual - 3_files/k5b.gif
.gif
doc/[!] PPC User-Manual - 3_files/k6.gif
.gif
doc/[!] PPC User-Manual - 3_files/k7.gif
.gif
doc/[!] PPC User-Manual - 3_files/k8.gif
.gif
doc/[!] PPC User-Manual - 3_files/k9.gif
.gif
doc/[!] PPC User-Manual - 3_files/ls_main_table_btm.gif
.gif
doc/[!] PPC User-Manual - 3_files/ls_main_table_top.gif
.gif
doc/[!] PPC User-Manual - 3_files/mainup.png
.png
doc/[!] PPC User-Manual - 3_files/memori.gif
.gif
doc/[!] PPC User-Manual - 3_files/menu_open.gif
.gif
doc/[!] PPC User-Manual - 3_files/mwong.gif
.gif
doc/[!] PPC User-Manual - 3_files/navbits_finallink_ltr.gif
.gif
doc/[!] PPC User-Manual - 3_files/navbits_start.gif
.gif
doc/[!] PPC User-Manual - 3_files/nl.gif
.gif
doc/[!] PPC User-Manual - 3_files/post_old.gif
.gif
doc/[!] PPC User-Manual - 3_files/post_thanks.gif
.gif
doc/[!] PPC User-Manual - 3_files/printer.gif
.gif
doc/[!] PPC User-Manual - 3_files/rating_5.gif
.gif
doc/[!] PPC User-Manual - 3_files/report.gif
.gif
doc/[!] PPC User-Manual - 3_files/reputation.gif
.gif
doc/[!] PPC User-Manual - 3_files/rs_main_table_btm.gif
.gif
doc/[!] PPC User-Manual - 3_files/rs_main_table_top.gif
.gif
doc/[!] PPC User-Manual - 3_files/ru.gif
.gif
doc/[!] PPC User-Manual - 3_files/sendtofriend.gif
.gif
doc/[!] PPC User-Manual - 3_files/subscribe.gif
.gif
doc/[!] PPC User-Manual - 3_files/supermoderator.png
.png
doc/[!] PPC User-Manual - 3_files/t.gif
.gif
doc/[!] PPC User-Manual - 3_files/t_002.gif
.gif
doc/[!] PPC User-Manual - 3_files/threadclosed.gif
.gif
doc/[!] PPC User-Manual - 3_files/trans.gif
.gif
doc/[!] PPC User-Manual - 3_files/uk.gif
.gif
doc/[!] PPC User-Manual - 3_files/user2410.gif
doc/[!] PPC User-Manual - 3_files/vbulletin_important.css
doc/[!] PPC User-Manual - 3_files/vipdt.png
.png
doc/[!] PPC User-Manual - 3_files/wp8831.gif
.gif
doc/[!] PPC User-Manual - 3_files/yandex.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/WPMIdef.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/addpoll.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/bold.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/clear.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/collapse_tcat.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/collapse_thead.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/color.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/createlink.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/cron.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/edit.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/icon1.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/insertimage.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/italic.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/k15.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/menupop.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/mode_hybrid.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/mode_linear.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/mode_threaded.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/multiquote_off.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/navbits_finallink.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/navbits_start.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/post_old.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/printer.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/progress.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/quickreply.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/quote(1).gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/quote.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/rating_1.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/rating_2.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/rating_3.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/rating_4.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/rating_5.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/removeformat.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/reply.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/report.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/resize_0.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/resize_1.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/sendtofriend.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/separator.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/spelling.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/subscribe.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/switchmode.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/underline.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/user_online.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/vbulletin3_logo_white.gif
.gif
doc/[!]= Перехват, быстрый старт = - Forums.files/vbulletin_editor.css
doc/[!]= Перехват, быстрый старт = - Forums.files/wp655ba.gif
doc/[!]= Перехват, быстрый старт = - Forums.htm
.html .js polyglot
doc/k12.gif
doc/k13.gif
.gif
doc/ppc_diagram.png
.png
doc/wsaerrors.htm
.html
hist/!wp656f.txt
hist/!wp657f.txt
.js
hist/!wp658f.txt
hist/!wp659f.txt
hist/!wp660f.txt
hist/!wp661f_wp662f.txt
hist/!wp663f.txt
hist/!wp667.txt
.js
hist/!wp668.txt
.js
hist/!wp669.txt
wpcfg.ini
wpcfg.ini~
wpsc/DEMO/DLL/gDLL-ex1.fsc
wpsc/DEMO/DLL/sources0.rar
.rar
sources/tstdll0.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

FuncTst1
FuncTst2
FuncTst3
FuncTst4

Sections

CODE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 702B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
sources/tstdll0.dpr
wpsc/DEMO/DLL/tstdll0.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

FuncTst1
FuncTst2
FuncTst3
FuncTst4

Sections

CODE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 702B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wpsc/DEMO/DLL_events/DLL_event1.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DLLInit

Sections

CODE
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wpsc/DEMO/DLL_events/DLL_event1.dpr
wpsc/DEMO/DLL_events/demo-decoder-dll-1.fsc
wpsc/DEMO/Demo_ChatCommand_BBS.fsc
wpsc/DEMO/LA2/corrector-2.fsc
wpsc/DEMO/LA2/corrector-3a_CT22.fsc
wpsc/DEMO/LA2/corrector-4a_CT22.fsc
wpsc/DEMO/LA2/corrector-5.fsc
wpsc/DEMO/LA2/demo-LS_dec-2.fsc
.js
wpsc/DEMO/LA2/demo1.sc
wpsc/DEMO/LA2/demo2.sc
wpsc/DEMO/LA2/demo3.sc
wpsc/DEMO/LA2/demoFS2.fsc
wpsc/DEMO/LA2/demoFS3.fsc
wpsc/DEMO/LA2/demoReklam.fsc
wpsc/DEMO/LA2/demo_CSI_1.fsc
wpsc/DEMO/LA2/demo_MoveBTL.fsc
wpsc/DEMO/LA2/demo_la2-endecGS-6.fsc
.js
wpsc/DEMO/LA2/demo_la2-endecGS-7.fsc
wpsc/DEMO/LA2/dropitem1.sc
wpsc/DEMO/LA2/fs-demochat1.fsc
wpsc/DEMO/LA2/source5.rar
.rar
source5/FastMM4.dcu
source5/FastMM4.pas
.js
source5/FastMM4Messages.dcu
source5/FastMM4Messages.pas
source5/FastMM4Options.inc
source5/FastMM4_FAQ.txt
source5/FastMM4_Readme.txt
source5/tstdll5.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DeXorGS
EnXorGS
Trafic_Detector

Sections

CODE
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 10KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 114B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
source5/tstdll5.dpr
.js
wpsc/DEMO/LA2/target_attacker.sc
wpsc/DEMO/LA2/target_radar.sc
wpsc/DEMO/LA2/tstdll5.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DeXorGS
EnXorGS
Trafic_Detector

Sections

CODE
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 10KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 114B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wpsc/DEMO/MoveBTL.fsc
wpsc/DEMO/RFO/RFO-GetChars-1.fsc
wpsc/DEMO/RFO/RFO_LS_demo1.fsc
.js
wpsc/DEMO/TQHashTable-1.fsc
wpsc/DEMO/_demoPrDLL_1/KOL.dcu
wpsc/DEMO/_demoPrDLL_1/demoPrDLL_1.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

AddThreadInfo
CreateWin
DelThreadInfo
DestroyWin
ThreadsCount
isCreated
isOpened
isterminated

Sections

CODE
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wpsc/DEMO/_demoPrDLL_1/demoPrDLL_1.dpr
wpsc/DEMO/_demoPrDLL_1/demoPrDLL_1.fsc
wpsc/DEMO/_demoPrDLL_1/fform.pas
wpsc/DEMO/_demoPrDLL_1/fthr.pas
.js
wpsc/DEMO/d5-delay.sc
wpsc/DEMO/demo-CreateDirectory-2.fsc
.js
wpsc/DEMO/demo-GMP-1.fsc
wpsc/DEMO/demo-python-1.fsc
.js
wpsc/DEMO/demo-showglobal-1.fsc
wpsc/DEMO/demoFS1.fsc
wpsc/DEMO/demoRunApp1.fsc
wpsc/DEMO/demo_ontimer_1.fsc
wpsc/DEMO/demo_ontimer_2.fsc
wpsc/DEMO/gDLL-excall1.fsc
wpsc/LIB/PyEngine-1.fsc
.js
wpsc/LIB/ZLIB-1.fsc
.js
wpsc/LIB/libGMP-1.fsc
.js
wpsc/LIB/libGMP-1.xml
.xml
wpsc/LIB/libgmp-3.dll
.dll windows:4 windows x86 arch:x86

d3a398a831866f7a105c3ad05613cd10

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
DeleteCriticalSection
EnterCriticalSection
FindAtomA
GetAtomNameA
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
Sleep
WideCharToMultiByte

msvcrt

__dllonexit
__lc_codepage
__mb_cur_max
_assert
_errno
_filbuf
_flsbuf
_iob
_isctype
_pctype
abort
fflush
fgetc
fprintf
fputc
fread
free
fscanf
fwrite
getenv
localeconv
malloc
memcpy
memset
printf
putchar
puts
raise
realloc
sscanf
strchr
strcpy
strlen
strtol
ungetc
vfprintf
vsprintf
wcslen

Exports

Exports

__gmp_0
__gmp_allocate_func
__gmp_asprintf
__gmp_asprintf_final
__gmp_asprintf_funs
__gmp_asprintf_memory
__gmp_asprintf_reps
__gmp_assert_fail
__gmp_assert_header
__gmp_binvert_limb_table
__gmp_bits_per_limb
__gmp_default_allocate
__gmp_default_fp_limb_precision
__gmp_default_free
__gmp_default_reallocate
__gmp_digit_value_tab
__gmp_divide_by_zero
__gmp_doprnt
__gmp_doprnt_integer
__gmp_doprnt_mpf2
__gmp_doscan
__gmp_errno
__gmp_exception
__gmp_extract_double
__gmp_fib_table
__gmp_fprintf
__gmp_fprintf_funs
__gmp_free_func
__gmp_fscanf
__gmp_fscanf_funs
__gmp_get_memory_functions
__gmp_invalid_operation
__gmp_junk
__gmp_mt_recalc_buffer
__gmp_printf
__gmp_randclear
__gmp_randclear_mt
__gmp_randget_mt
__gmp_randinit
__gmp_randinit_default
__gmp_randinit_lc_2exp
__gmp_randinit_lc_2exp_size
__gmp_randinit_mt
__gmp_randinit_mt_noseed
__gmp_randinit_set
__gmp_randiset_mt
__gmp_rands
__gmp_rands_initialized
__gmp_randseed
__gmp_randseed_ui
__gmp_reallocate_func
__gmp_scanf
__gmp_set_memory_functions
__gmp_snprintf
__gmp_snprintf_funs
__gmp_sprintf
__gmp_sprintf_funs
__gmp_sqrt_of_negative
__gmp_sscanf
__gmp_sscanf_funs
__gmp_tmp_reentrant_alloc
__gmp_tmp_reentrant_free
__gmp_urandomb_ui
__gmp_urandomm_ui
__gmp_vasprintf
__gmp_version
__gmp_vfprintf
__gmp_vfscanf
__gmp_vprintf
__gmp_vscanf
__gmp_vsnprintf
__gmp_vsprintf
__gmp_vsscanf
__gmpf_abs
__gmpf_add
__gmpf_add_ui
__gmpf_ceil
__gmpf_clear
__gmpf_cmp
__gmpf_cmp_d
__gmpf_cmp_si
__gmpf_cmp_ui
__gmpf_div
__gmpf_div_2exp
__gmpf_div_ui
__gmpf_dump
__gmpf_eq
__gmpf_fits_sint_p
__gmpf_fits_slong_p
__gmpf_fits_sshort_p
__gmpf_fits_uint_p
__gmpf_fits_ulong_p
__gmpf_fits_ushort_p
__gmpf_floor
__gmpf_get_d
__gmpf_get_d_2exp
__gmpf_get_default_prec
__gmpf_get_prec
__gmpf_get_si
__gmpf_get_str
__gmpf_get_ui
__gmpf_init
__gmpf_init2
__gmpf_init_set
__gmpf_init_set_d
__gmpf_init_set_si
__gmpf_init_set_str
__gmpf_init_set_ui
__gmpf_inp_str
__gmpf_integer_p
__gmpf_mul
__gmpf_mul_2exp
__gmpf_mul_ui
__gmpf_neg
__gmpf_out_str
__gmpf_pow_ui
__gmpf_random2
__gmpf_reldiff
__gmpf_set
__gmpf_set_d
__gmpf_set_default_prec
__gmpf_set_prec
__gmpf_set_prec_raw
__gmpf_set_q
__gmpf_set_si
__gmpf_set_str
__gmpf_set_ui
__gmpf_set_z
__gmpf_size
__gmpf_sqrt
__gmpf_sqrt_ui
__gmpf_sub
__gmpf_sub_ui
__gmpf_swap
__gmpf_trunc
__gmpf_ui_div
__gmpf_ui_sub
__gmpf_urandomb
__gmpn_add
__gmpn_add_1
__gmpn_add_n
__gmpn_add_nc
__gmpn_addmul_1
__gmpn_addmul_1c
__gmpn_addmul_2
__gmpn_addsub_n
__gmpn_bases
__gmpn_bc_set_str
__gmpn_bdiv_dbm1c
__gmpn_bdivmod
__gmpn_binvert
__gmpn_binvert_itch
__gmpn_cmp
__gmpn_copyd
__gmpn_copyi
__gmpn_dc_bdiv_q
__gmpn_dc_bdiv_q_n
__gmpn_dc_bdiv_q_n_itch
__gmpn_dc_bdiv_qr
__gmpn_dc_bdiv_qr_n
__gmpn_dc_bdiv_qr_n_itch
__gmpn_dc_div_q
__gmpn_dc_div_qr
__gmpn_dc_div_qr_n
__gmpn_dc_divappr_q
__gmpn_dc_divappr_q_n
__gmpn_dc_divrem_n
__gmpn_dc_set_str
__gmpn_divexact
__gmpn_divexact_1
__gmpn_divexact_by3
__gmpn_divexact_by3c
__gmpn_divexact_itch
__gmpn_divisible_p
__gmpn_divmod_1
__gmpn_divrem
__gmpn_divrem_1
__gmpn_divrem_1c
__gmpn_divrem_2
__gmpn_dump
__gmpn_fft_best_k
__gmpn_fft_next_size
__gmpn_fib2_ui
__gmpn_gcd
__gmpn_gcd_1
__gmpn_gcd_lehmer_n
__gmpn_gcd_subdiv_step
__gmpn_gcdext
__gmpn_gcdext_1
__gmpn_gcdext_lehmer_n
__gmpn_gcdext_subdiv_step
__gmpn_get_d
__gmpn_get_str
__gmpn_hamdist
__gmpn_hgcd
__gmpn_hgcd2
__gmpn_hgcd_itch
__gmpn_hgcd_lehmer
__gmpn_hgcd_matrix_adjust
__gmpn_hgcd_matrix_init
__gmpn_hgcd_matrix_mul
__gmpn_hgcd_mul_matrix1_inverse_vector
__gmpn_hgcd_mul_matrix1_vector
__gmpn_invert
__gmpn_invert_itch
__gmpn_jacobi_base
__gmpn_kara_mul_n
__gmpn_kara_sqr_n
__gmpn_lshift
__gmpn_matrix22_mul
__gmpn_matrix22_mul_itch
__gmpn_matrix22_mul_strassen
__gmpn_mod_1
__gmpn_mod_1c
__gmpn_mod_1s_1p
__gmpn_mod_1s_1p_cps
__gmpn_mod_1s_2p
__gmpn_mod_1s_2p_cps
__gmpn_mod_1s_3p
__gmpn_mod_1s_3p_cps
__gmpn_mod_1s_4p
__gmpn_mod_1s_4p_cps
__gmpn_mod_34lsub1
__gmpn_modexact_1_odd
__gmpn_modexact_1c_odd
__gmpn_mu_bdiv_q
__gmpn_mu_bdiv_q_itch
__gmpn_mu_bdiv_qr
__gmpn_mu_div_q
__gmpn_mu_div_qr
__gmpn_mu_div_qr_choose_in
__gmpn_mu_div_qr_itch
__gmpn_mu_divappr_q
__gmpn_mu_divappr_q_choose_in
__gmpn_mu_divappr_q_itch
__gmpn_mul
__gmpn_mul_1
__gmpn_mul_1c
__gmpn_mul_basecase
__gmpn_mul_fft
__gmpn_mul_fft_full
__gmpn_mul_n
__gmpn_mullow_basecase
__gmpn_mullow_n
__gmpn_neg_n
__gmpn_perfect_square_p
__gmpn_popcount
__gmpn_pow_1
__gmpn_powlo
__gmpn_powm
__gmpn_powm_sec
__gmpn_preinv_dc_div_qr
__gmpn_preinv_dc_divappr_q
__gmpn_preinv_divrem_1
__gmpn_preinv_mod_1
__gmpn_preinv_mu_div_qr
__gmpn_preinv_mu_divappr_q
__gmpn_random
__gmpn_random2
__gmpn_redc_1
__gmpn_redc_2
__gmpn_rootrem
__gmpn_rshift
__gmpn_sb_bdiv_q
__gmpn_sb_bdiv_qr
__gmpn_sb_div_q
__gmpn_sb_div_qr
__gmpn_sb_divappr_q
__gmpn_sb_divrem_mn
__gmpn_scan0
__gmpn_scan1
__gmpn_set_str
__gmpn_set_str_compute_powtab
__gmpn_sqr_basecase
__gmpn_sqr_n
__gmpn_sqrtrem
__gmpn_sub
__gmpn_sub_1
__gmpn_sub_n
__gmpn_sub_nc
__gmpn_subcnd_n
__gmpn_submul_1
__gmpn_submul_1c
__gmpn_tabselect
__gmpn_tdiv_qr
__gmpn_toom22_mul
__gmpn_toom2_sqr
__gmpn_toom32_mul
__gmpn_toom33_mul
__gmpn_toom3_mul_n
__gmpn_toom3_sqr
__gmpn_toom3_sqr_n
__gmpn_toom42_mul
__gmpn_toom44_mul
__gmpn_toom4_sqr
__gmpn_toom53_mul
__gmpn_toom62_mul
__gmpn_toom_interpolate_5pts
__gmpn_toom_interpolate_7pts
__gmpn_udiv_qrnnd
__gmpn_umul_ppmm
__gmpq_abs
__gmpq_add
__gmpq_canonicalize
__gmpq_clear
__gmpq_cmp
__gmpq_cmp_si
__gmpq_cmp_ui
__gmpq_div
__gmpq_div_2exp
__gmpq_equal
__gmpq_get_d
__gmpq_get_den
__gmpq_get_num
__gmpq_get_str
__gmpq_init
__gmpq_inp_str
__gmpq_inv
__gmpq_mul
__gmpq_mul_2exp
__gmpq_neg
__gmpq_out_str
__gmpq_set
__gmpq_set_d
__gmpq_set_den
__gmpq_set_f
__gmpq_set_num
__gmpq_set_si
__gmpq_set_str
__gmpq_set_ui
__gmpq_set_z
__gmpq_sub
__gmpq_swap
__gmpz_abs
__gmpz_add
__gmpz_add_ui
__gmpz_addmul
__gmpz_addmul_ui
__gmpz_and
__gmpz_aorsmul_1
__gmpz_array_init
__gmpz_bin_ui
__gmpz_bin_uiui
__gmpz_cdiv_q
__gmpz_cdiv_q_2exp
__gmpz_cdiv_q_ui
__gmpz_cdiv_qr
__gmpz_cdiv_qr_ui
__gmpz_cdiv_r
__gmpz_cdiv_r_2exp
__gmpz_cdiv_r_ui
__gmpz_cdiv_ui
__gmpz_clear
__gmpz_clrbit
__gmpz_cmp
__gmpz_cmp_d
__gmpz_cmp_si
__gmpz_cmp_ui
__gmpz_cmpabs
__gmpz_cmpabs_d
__gmpz_cmpabs_ui
__gmpz_com
__gmpz_combit
__gmpz_congruent_2exp_p
__gmpz_congruent_p
__gmpz_congruent_ui_p
__gmpz_divexact
__gmpz_divexact_gcd
__gmpz_divexact_ui
__gmpz_divisible_2exp_p
__gmpz_divisible_p
__gmpz_divisible_ui_p
__gmpz_dump
__gmpz_export
__gmpz_fac_ui
__gmpz_fdiv_q
__gmpz_fdiv_q_2exp
__gmpz_fdiv_q_ui
__gmpz_fdiv_qr
__gmpz_fdiv_qr_ui
__gmpz_fdiv_r
__gmpz_fdiv_r_2exp
__gmpz_fdiv_r_ui
__gmpz_fdiv_ui
__gmpz_fib2_ui
__gmpz_fib_ui
__gmpz_fits_sint_p
__gmpz_fits_slong_p
__gmpz_fits_sshort_p
__gmpz_fits_uint_p
__gmpz_fits_ulong_p
__gmpz_fits_ushort_p
__gmpz_gcd
__gmpz_gcd_ui
__gmpz_gcdext
__gmpz_get_d
__gmpz_get_d_2exp
__gmpz_get_si
__gmpz_get_str
__gmpz_get_ui
__gmpz_getlimbn
__gmpz_hamdist
__gmpz_import
__gmpz_init
__gmpz_init2
__gmpz_init_set
__gmpz_init_set_d
__gmpz_init_set_si
__gmpz_init_set_str
__gmpz_init_set_ui
__gmpz_inp_raw
__gmpz_inp_str
__gmpz_inp_str_nowhite
__gmpz_invert
__gmpz_ior
__gmpz_jacobi
__gmpz_kronecker_si
__gmpz_kronecker_ui
__gmpz_lcm
__gmpz_lcm_ui
__gmpz_legendre
__gmpz_lucnum2_ui
__gmpz_lucnum_ui
__gmpz_millerrabin
__gmpz_mod
__gmpz_mul
__gmpz_mul_2exp
__gmpz_mul_si
__gmpz_mul_ui
__gmpz_n_pow_ui
__gmpz_neg
__gmpz_nextprime
__gmpz_out_raw
__gmpz_out_str
__gmpz_perfect_power_p
__gmpz_perfect_square_p
__gmpz_popcount
__gmpz_pow_ui
__gmpz_powm
__gmpz_powm_ui
__gmpz_probab_prime_p
__gmpz_random
__gmpz_random2
__gmpz_realloc
__gmpz_realloc2
__gmpz_remove
__gmpz_root
__gmpz_rootrem
__gmpz_rrandomb
__gmpz_scan0
__gmpz_scan1
__gmpz_set
__gmpz_set_d
__gmpz_set_f
__gmpz_set_q
__gmpz_set_si
__gmpz_set_str
__gmpz_set_ui
__gmpz_setbit
__gmpz_si_kronecker
__gmpz_size
__gmpz_sizeinbase
__gmpz_sqrt
__gmpz_sqrtrem
__gmpz_sub
__gmpz_sub_ui
__gmpz_submul
__gmpz_submul_ui
__gmpz_swap
__gmpz_tdiv_q
__gmpz_tdiv_q_2exp
__gmpz_tdiv_q_ui
__gmpz_tdiv_qr
__gmpz_tdiv_qr_ui
__gmpz_tdiv_r
__gmpz_tdiv_r_2exp
__gmpz_tdiv_r_ui
__gmpz_tdiv_ui
__gmpz_tstbit
__gmpz_ui_kronecker
__gmpz_ui_pow_ui
__gmpz_ui_sub
__gmpz_urandomb
__gmpz_urandomm
__gmpz_xor
_get_output_format
isascii

Sections

.text
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wpsc/LIB/memDisp.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

AllocMem_cdecl
AllocMem_stdcall
FreeMem_cdecl
FreeMem_stdcall
GetMem_cdecl
GetMem_stdcall
ReAllocMem_cdecl
ReAllocMem_stdcall

Sections

CODE
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 834B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 258B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wpsc/LIB/memDisp.dpr
wpsc/LIB/sendmsg.fsc
wpsc/LIB/stInc.dcu
wpsc/LIB/stInc.pas
wpsc/LIB/zlib.h
wpsc/LIB/zlib125.dll
.dll windows:4 windows x86 arch:x86

66a201125fb55b79ced6d0ecd1985e10

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
Sleep
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

_close
_lseek
_open
_read
_write
__dllonexit
__lc_codepage
__mb_cur_max
_errno
_iob
abort
fflush
fputc
free
fwrite
getenv
localeconv
malloc
memchr
memcpy
sprintf
strcat
strcpy
strerror
strlen
vfprintf
wcslen

Exports

Exports

adler32
adler32_combine
compress
compress2
compressBound
crc32
crc32_combine
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzoffset
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wpsc/RF01/!readme
wpsc/RF01/dummy.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 862B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wpsc/RF01/rfsld.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

checks

Sections

CODE
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 13KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 67B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wpsc/RF01/rfsld.ini
wpsc/WOW/wow-decoderV2.fsc
wpsc/WOW/wow_decLibv1.fsc
.js
wpsc/socks5.sc

Sharing

General

Malware Config

Signatures

Files

d50fcdf1e7cfb1a4e94fe9714fa7af37

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

comctl32

winspool.drv

shell32

comdlg32

wsock32

ntdll

winmm

Sections

CODE Size: - Virtual size: 1.3MB

DATA Size: - Virtual size: 27KB

BSS Size: - Virtual size: 25KB

.idata Size: - Virtual size: 12KB

.tls Size: - Virtual size: 16B

.rdata Size: - Virtual size: 24B

.0 Size: - Virtual size: 76KB

.rsrc Size: 35KB - Virtual size: 272KB

.1 Size: - Virtual size: 421KB

.2 Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 512B - Virtual size: 260B

4ab082d28aabd87905952399fdfa40d2

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

Sections

CODE Size: - Virtual size: 45KB

DATA Size: - Virtual size: 1KB

BSS Size: - Virtual size: 2KB

.idata Size: - Virtual size: 1KB

.tls Size: - Virtual size: 8B

.rdata Size: - Virtual size: 24B

L0 Size: - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 3KB

L1 Size: - Virtual size: 75KB

L2 Size: 119KB - Virtual size: 119KB

.reloc Size: 512B - Virtual size: 88B

Headers

File Characteristics

Sections

CODE Size: 39KB - Virtual size: 38KB

DATA Size: 3KB - Virtual size: 2KB

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 1KB

0 Size: 4KB - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 3KB

1 Size: 42KB - Virtual size: 42KB

.reloc Size: 5KB - Virtual size: 5KB

be56c3e138cad5e20c21b4785f1ed7e2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 105KB - Virtual size: 105KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 154KB - Virtual size: 161KB

themida0 Size: 8KB - Virtual size: 8KB

themida1 Size: 512B - Virtual size: 268B

CODE
Size: - Virtual size: 1.3MB

DATA
Size: - Virtual size: 27KB

BSS
Size: - Virtual size: 25KB

.idata
Size: - Virtual size: 12KB

.tls
Size: - Virtual size: 16B

.rdata
Size: - Virtual size: 24B

.0
Size: - Virtual size: 76KB

.rsrc
Size: 35KB - Virtual size: 272KB

.1
Size: - Virtual size: 421KB

.2
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 512B - Virtual size: 260B

CODE
Size: - Virtual size: 45KB

DATA
Size: - Virtual size: 1KB

BSS
Size: - Virtual size: 2KB

.idata
Size: - Virtual size: 1KB

.tls
Size: - Virtual size: 8B

.rdata
Size: - Virtual size: 24B

L0
Size: - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 3KB

L1
Size: - Virtual size: 75KB

L2
Size: 119KB - Virtual size: 119KB

.reloc
Size: 512B - Virtual size: 88B

CODE
Size: 39KB - Virtual size: 38KB

DATA
Size: 3KB - Virtual size: 2KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 1KB

0
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB

1
Size: 42KB - Virtual size: 42KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 105KB - Virtual size: 105KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 154KB - Virtual size: 161KB

themida0
Size: 8KB - Virtual size: 8KB

themida1
Size: 512B - Virtual size: 268B

.reloc
Size: 6KB - Virtual size: 6KB

CODE
Size: 4KB - Virtual size: 4KB

DATA
Size: 512B - Virtual size: 160B

BSS
Size: - Virtual size: 1KB

.idata
Size: 1024B - Virtual size: 702B

.edata
Size: 512B - Virtual size: 128B

.reloc
Size: 512B - Virtual size: 432B

.rsrc
Size: 512B - Virtual size: 512B

CODE
Size: 4KB - Virtual size: 4KB

DATA
Size: 512B - Virtual size: 160B

BSS
Size: - Virtual size: 1KB

.idata
Size: 1024B - Virtual size: 702B

.edata
Size: 512B - Virtual size: 128B

.reloc
Size: 512B - Virtual size: 432B

.rsrc
Size: 512B - Virtual size: 512B

CODE
Size: 33KB - Virtual size: 32KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 73B

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 3KB

CODE
Size: 40KB - Virtual size: 40KB

DATA
Size: 3KB - Virtual size: 2KB

BSS
Size: - Virtual size: 10KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 114B

.reloc
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB

CODE
Size: 40KB - Virtual size: 40KB

DATA
Size: 3KB - Virtual size: 2KB

BSS
Size: - Virtual size: 10KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 114B

.reloc
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB