o:\OOO320\src\ucb\wntmsci12.pro\bin\ucptdoc1.uno.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3abdf79393bff29caec5b10733cbc374_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3abdf79393bff29caec5b10733cbc374_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3abdf79393bff29caec5b10733cbc374_JaffaCakes118
-
Size
208KB
-
MD5
3abdf79393bff29caec5b10733cbc374
-
SHA1
e9e03936de2ef12024abe03e6cd55b21185e58df
-
SHA256
92587557ec654b643eac440584e966235c453349ec32df1810d07756af526aff
-
SHA512
8c4a180813248e40939a5793039acb30cfa7e83b6484b3022366c807dac7478b87d6b6581c706f12f9b1b40e296a11ce585296c8e66dd602fa91eeb2cb185da2
-
SSDEEP
6144:rIlWtBvt5HiXk3o1NQPIoBxD6KSUzo0qOVwqu:reiBvtwXkaNQtBV6XUzoau
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3abdf79393bff29caec5b10733cbc374_JaffaCakes118
Files
-
3abdf79393bff29caec5b10733cbc374_JaffaCakes118.dll windows:5 windows x86 arch:x86
7a122178b5d85b2477a706d10a2793e5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcr90
_except_handler4_common
_onexit
_crt_debugger_hook
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBDH@Z
?what@exception@std@@UBEPBDXZ
??3@YAXPAX@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_purecall
memmove
??2@YAPAXI@Z
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CxxFrameHandler3
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent
comphelp4msc
?getDocumentTitle@DocumentInfo@comphelper@@SA?AVOUString@rtl@@ABV?$Reference@VXModel@frame@star@sun@com@@@uno@star@sun@com@@@Z
??0NamedValueCollection@comphelper@@QAE@ABV?$Sequence@UPropertyValue@beans@star@sun@com@@@uno@star@sun@com@@@Z
??1NamedValueCollection@comphelper@@QAE@XZ
?get_ensureType@NamedValueCollection@comphelper@@ABE_NABVOUString@rtl@@PAXABVType@uno@star@sun@com@@@Z
cppuhelper3msc
??0OTypeCollection@cppu@@QAE@ABVType@uno@star@sun@com@@0ABV?$Sequence@VType@uno@star@sun@com@@@3456@@Z
??0OTypeCollection@cppu@@QAE@ABVType@uno@star@sun@com@@0000000000ABV?$Sequence@VType@uno@star@sun@com@@@3456@@Z
??0OTypeCollection@cppu@@QAE@ABVType@uno@star@sun@com@@000000000ABV?$Sequence@VType@uno@star@sun@com@@@3456@@Z
??1OImplementationId@cppu@@QAE@XZ
??0OTypeCollection@cppu@@QAE@ABVType@uno@star@sun@com@@000ABV?$Sequence@VType@uno@star@sun@com@@@3456@@Z
?queryInterface@OWeakObject@cppu@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
?getImplementationId@OImplementationId@cppu@@QBA?AV?$Sequence@C@uno@star@sun@com@@XZ
?ImplHelper_getImplementationId@cppu@@YA?AV?$Sequence@C@uno@star@sun@com@@PAUclass_data@1@@Z
?WeakImplHelper_query@cppu@@YA?AVAny@uno@star@sun@com@@ABVType@3456@PAUclass_data@1@PAXPAVOWeakObject@1@@Z
??1OWeakObject@cppu@@MAE@XZ
?queryAdapter@OWeakObject@cppu@@UAA?AV?$Reference@VXAdapter@uno@star@sun@com@@@uno@star@sun@com@@XZ
?acquire@OWeakObject@cppu@@UAAXXZ
?release@OWeakObject@cppu@@UAAXXZ
??0OWeakObject@cppu@@QAE@XZ
?createOneInstanceFactory@cppu@@YA?AV?$Reference@VXSingleServiceFactory@lang@star@sun@com@@@uno@star@sun@com@@ABV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@3456@ABVOUString@rtl@@P6A?AV?$Reference@VXInterface@uno@star@sun@com@@@3456@0@ZABV?$Sequence@VOUString@rtl@@@3456@PAU_rtl_ModuleCount@@@Z
?WeakImplHelper_getTypes@cppu@@YA?AV?$Sequence@VType@uno@star@sun@com@@@uno@star@sun@com@@PAUclass_data@1@@Z
cppu3
uno_type_sequence_realloc
uno_type_equalData
uno_type_any_assign
typelib_typedescriptionreference_assign
typelib_static_type_getByTypeClass
typelib_static_sequence_type_init
uno_type_destructData
typelib_static_type_init
uno_any_destruct
uno_type_sequence_construct
uno_type_sequence_reference2One
typelib_typedescriptionreference_equals
uno_any_construct
uno_type_any_construct
uno_type_sequence_assign
cppu_unsatisfied_iquery_msg
typelib_typedescriptionreference_acquire
typelib_typedescriptionreference_release
uno_type_assignData
sal3
osl_releaseMutex
osl_getGlobalMutex
rtl_uString_new
osl_acquireMutex
rtl_uString_new_WithLength
rtl_uStringbuffer_insert
rtl_uStringbuffer_insert_ascii
osl_decrementInterlockedCount
rtl_str_getLength
rtl_ustr_asciil_reverseEquals_WithLength
rtl_ustr_indexOfChar_WithLength
rtl_ustr_lastIndexOfChar_WithLength
rtl_uString_newReplaceStrAt
rtl_uString_newToAsciiLowerCase
rtl_uriDecode
osl_createMutex
osl_destroyMutex
rtl_ustr_ascii_shortenedCompare_WithLength
rtl_ustr_valueOfInt64
rtl_ustr_shortenedCompare_WithLength
rtl_ustr_valueOfInt32
rtl_uriEncode
rtl_getUriCharClass
rtl_uStringbuffer_newFromStr_WithLength
rtl_uString_release
rtl_uString_newConcat
rtl_ustr_ascii_compare_WithLength
rtl_uString_newFromAscii
rtl_uString_acquire
rtl_string2UString
rtl_uString_assign
rtl_ustr_compare_WithLength
rtl_allocateMemory
rtl_freeMemory
osl_incrementInterlockedCount
rtl_uString_newFromStr_WithLength
salhelper3msc
??2SimpleReferenceObject@salhelper@@SAPAXI@Z
??1SimpleReferenceObject@salhelper@@MAE@XZ
??3SimpleReferenceObject@salhelper@@SAXPAX@Z
ucbhelper4msc
?addPropertiesChangeListener@ContentImplHelper@ucbhelper@@UAAXABV?$Sequence@VOUString@rtl@@@uno@star@sun@com@@ABV?$Reference@VXPropertiesChangeListener@beans@star@sun@com@@@4567@@Z
?removePropertiesChangeListener@ContentImplHelper@ucbhelper@@UAAXABV?$Sequence@VOUString@rtl@@@uno@star@sun@com@@ABV?$Reference@VXPropertiesChangeListener@beans@star@sun@com@@@4567@@Z
?addProperty@ContentImplHelper@ucbhelper@@UAAXABVOUString@rtl@@FABVAny@uno@star@sun@com@@@Z
?removeProperty@ContentImplHelper@ucbhelper@@UAAXABVOUString@rtl@@@Z
?addPropertySetInfoChangeListener@ContentImplHelper@ucbhelper@@UAAXABV?$Reference@VXPropertySetInfoChangeListener@beans@star@sun@com@@@uno@star@sun@com@@@Z
?removePropertySetInfoChangeListener@ContentImplHelper@ucbhelper@@UAAXABV?$Reference@VXPropertySetInfoChangeListener@beans@star@sun@com@@@uno@star@sun@com@@@Z
?addCommandInfoChangeListener@ContentImplHelper@ucbhelper@@UAAXABV?$Reference@VXCommandInfoChangeListener@ucb@star@sun@com@@@uno@star@sun@com@@@Z
?removeCommandInfoChangeListener@ContentImplHelper@ucbhelper@@UAAXABV?$Reference@VXCommandInfoChangeListener@ucb@star@sun@com@@@uno@star@sun@com@@@Z
?getParent@ContentImplHelper@ucbhelper@@UAA?AV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@XZ
?setParent@ContentImplHelper@ucbhelper@@UAAXABV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@@Z
?acquire@ContentImplHelper@ucbhelper@@UAAXXZ
?release@ContentImplHelper@ucbhelper@@UAAXXZ
??0ContentImplHelper@ucbhelper@@QAE@ABV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@uno@star@sun@com@@ABV?$Reference@VContentProviderImplHelper@ucbhelper@@@rtl@@ABV?$Reference@VXContentIdentifier@ucb@star@sun@com@@@3456@@Z
?getIdentifier@ContentImplHelper@ucbhelper@@UAA?AV?$Reference@VXContentIdentifier@ucb@star@sun@com@@@uno@star@sun@com@@XZ
?deleted@ContentImplHelper@ucbhelper@@IAEXXZ
?notifyContentEvent@ContentImplHelper@ucbhelper@@IBEXABUContentEvent@ucb@star@sun@com@@@Z
?queryInterface@ContentImplHelper@ucbhelper@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
?appendPropertySet@PropertyValueSet@ucbhelper@@QAEXABV?$Reference@VXPropertySet@beans@star@sun@com@@@uno@star@sun@com@@@Z
?appendVoid@PropertyValueSet@ucbhelper@@QAEXABUProperty@beans@star@sun@com@@@Z
?appendPropertySetValue@PropertyValueSet@ucbhelper@@QAEEABV?$Reference@VXPropertySet@beans@star@sun@com@@@uno@star@sun@com@@ABUProperty@beans@567@@Z
?getAdditionalPropertySet@ContentProviderImplHelper@ucbhelper@@QAE?AV?$Reference@VXPersistentPropertySet@ucb@star@sun@com@@@uno@star@sun@com@@ABVOUString@rtl@@E@Z
?appendBoolean@PropertyValueSet@ucbhelper@@QAEXABUProperty@beans@star@sun@com@@E@Z
?appendString@PropertyValueSet@ucbhelper@@QAEXABUProperty@beans@star@sun@com@@ABVOUString@rtl@@@Z
?appendObject@PropertyValueSet@ucbhelper@@QAEXABUProperty@beans@star@sun@com@@ABVAny@uno@567@@Z
??0PropertyValueSet@ucbhelper@@QAE@ABV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@uno@star@sun@com@@@Z
?queryInterface@PropertyValueSet@ucbhelper@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
?acquire@PropertyValueSet@ucbhelper@@UAAXXZ
?release@PropertyValueSet@ucbhelper@@UAAXXZ
??1PropertyValueSet@ucbhelper@@UAE@XZ
?cancelCommandExecution@ucbhelper@@YAXABVAny@uno@star@sun@com@@ABV?$Reference@VXCommandEnvironment@ucb@star@sun@com@@@3456@@Z
?getSelection@InteractionRequest@ucbhelper@@QBE?AV?$Reference@VInteractionContinuation@ucbhelper@@@rtl@@XZ
?exchange@ContentImplHelper@ucbhelper@@IAEEABV?$Reference@VXContentIdentifier@ucb@star@sun@com@@@uno@star@sun@com@@@Z
?cancelCommandExecution@ucbhelper@@YAXW4IOErrorCode@ucb@star@sun@com@@ABV?$Sequence@VAny@uno@star@sun@com@@@uno@456@ABV?$Reference@VXCommandEnvironment@ucb@star@sun@com@@@8456@ABVOUString@rtl@@ABV?$Reference@VXCommandProcessor@ucb@star@sun@com@@@8456@@Z
?notifyPropertiesChange@ContentImplHelper@ucbhelper@@IBEXABV?$Sequence@UPropertyChangeEvent@beans@star@sun@com@@@uno@star@sun@com@@@Z
?renameAdditionalPropertySet@ContentImplHelper@ucbhelper@@IAEEABVOUString@rtl@@0E@Z
?getAdditionalPropertySet@ContentImplHelper@ucbhelper@@IAE?AV?$Reference@VXPersistentPropertySet@ucb@star@sun@com@@@uno@star@sun@com@@E@Z
?inserted@ContentImplHelper@ucbhelper@@IAEXXZ
?removeAdditionalPropertySet@ContentImplHelper@ucbhelper@@IAEEE@Z
?copyAdditionalPropertySet@ContentImplHelper@ucbhelper@@IAEEABVOUString@rtl@@0E@Z
?getCommandInfo@ContentImplHelper@ucbhelper@@IAE?AV?$Reference@VXCommandInfo@ucb@star@sun@com@@@uno@star@sun@com@@ABV?$Reference@VXCommandEnvironment@ucb@star@sun@com@@@4567@E@Z
?getPropertySetInfo@ContentImplHelper@ucbhelper@@IAE?AV?$Reference@VXPropertySetInfo@beans@star@sun@com@@@uno@star@sun@com@@ABV?$Reference@VXCommandEnvironment@ucb@star@sun@com@@@4567@E@Z
?recordSelection@InteractionContinuation@ucbhelper@@IAEXXZ
??1InteractionContinuation@ucbhelper@@MAE@XZ
??0InteractionContinuation@ucbhelper@@QAE@PAVInteractionRequest@1@@Z
??1InteractionRequest@ucbhelper@@MAE@XZ
?setContinuations@InteractionRequest@ucbhelper@@QAEXABV?$Sequence@V?$Reference@VXInteractionContinuation@task@star@sun@com@@@uno@star@sun@com@@@uno@star@sun@com@@@Z
??0InteractionRetry@ucbhelper@@QAE@PAVInteractionRequest@1@@Z
??0InteractionAbort@ucbhelper@@QAE@PAVInteractionRequest@1@@Z
?setRequest@InteractionRequest@ucbhelper@@IAEXABVAny@uno@star@sun@com@@@Z
??0InteractionRequest@ucbhelper@@IAE@XZ
?queryInterface@InteractionRequest@ucbhelper@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
?acquire@InteractionRequest@ucbhelper@@UAAXXZ
?release@InteractionRequest@ucbhelper@@UAAXXZ
?getTypes@InteractionRequest@ucbhelper@@UAA?AV?$Sequence@VType@uno@star@sun@com@@@uno@star@sun@com@@XZ
?getImplementationId@InteractionRequest@ucbhelper@@UAA?AV?$Sequence@C@uno@star@sun@com@@XZ
?getRequest@InteractionRequest@ucbhelper@@UAA?AVAny@uno@star@sun@com@@XZ
?getContinuations@InteractionRequest@ucbhelper@@UAA?AV?$Sequence@V?$Reference@VXInteractionContinuation@task@star@sun@com@@@uno@star@sun@com@@@uno@star@sun@com@@XZ
?queryInterface@InteractionAbort@ucbhelper@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
?acquire@InteractionAbort@ucbhelper@@UAAXXZ
?release@InteractionAbort@ucbhelper@@UAAXXZ
?queryInterface@InteractionRetry@ucbhelper@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
?acquire@InteractionRetry@ucbhelper@@UAAXXZ
?release@InteractionRetry@ucbhelper@@UAAXXZ
??1ResultSetImplHelper@ucbhelper@@UAE@XZ
??0ResultSetImplHelper@ucbhelper@@QAE@ABV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@uno@star@sun@com@@ABUOpenCommandArgument2@ucb@456@@Z
?queryInterface@ResultSetImplHelper@ucbhelper@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
?acquire@ResultSetImplHelper@ucbhelper@@UAAXXZ
?release@ResultSetImplHelper@ucbhelper@@UAAXXZ
?getTypes@ResultSetImplHelper@ucbhelper@@UAA?AV?$Sequence@VType@uno@star@sun@com@@@uno@star@sun@com@@XZ
?getImplementationId@ResultSetImplHelper@ucbhelper@@UAA?AV?$Sequence@C@uno@star@sun@com@@XZ
?getImplementationName@ResultSetImplHelper@ucbhelper@@UAA?AVOUString@rtl@@XZ
?supportsService@ResultSetImplHelper@ucbhelper@@UAAEABVOUString@rtl@@@Z
?getSupportedServiceNames@ResultSetImplHelper@ucbhelper@@UAA?AV?$Sequence@VOUString@rtl@@@uno@star@sun@com@@XZ
?dispose@ResultSetImplHelper@ucbhelper@@UAAXXZ
?addEventListener@ResultSetImplHelper@ucbhelper@@UAAXABV?$Reference@VXEventListener@lang@star@sun@com@@@uno@star@sun@com@@@Z
?removeEventListener@ResultSetImplHelper@ucbhelper@@UAAXABV?$Reference@VXEventListener@lang@star@sun@com@@@uno@star@sun@com@@@Z
?getStaticResultSet@ResultSetImplHelper@ucbhelper@@UAA?AV?$Reference@VXResultSet@sdbc@star@sun@com@@@uno@star@sun@com@@XZ
?setListener@ResultSetImplHelper@ucbhelper@@UAAXABV?$Reference@VXDynamicResultSetListener@ucb@star@sun@com@@@uno@star@sun@com@@@Z
?connectToCache@ResultSetImplHelper@ucbhelper@@UAAXABV?$Reference@VXDynamicResultSet@ucb@star@sun@com@@@uno@star@sun@com@@@Z
?getCapabilities@ResultSetImplHelper@ucbhelper@@UAAFXZ
??0ResultSet@ucbhelper@@QAE@ABV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@uno@star@sun@com@@ABV?$Sequence@UProperty@beans@star@sun@com@@@3456@ABV?$Reference@VResultSetDataSupplier@ucbhelper@@@rtl@@@Z
?queryInterface@ResultSet@ucbhelper@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
?acquire@ResultSet@ucbhelper@@UAAXXZ
?release@ResultSet@ucbhelper@@UAAXXZ
??1ResultSet@ucbhelper@@UAE@XZ
??0ContentIdentifier@ucbhelper@@QAE@ABVOUString@rtl@@@Z
?getProperties@ResultSet@ucbhelper@@QAEABV?$Sequence@UProperty@beans@star@sun@com@@@uno@star@sun@com@@XZ
?rowCountFinal@ResultSet@ucbhelper@@QAEXXZ
?rowCountChanged@ResultSet@ucbhelper@@QAEXKK@Z
?createCommandIdentifier@ContentImplHelper@ucbhelper@@UAAJXZ
?removeContentEventListener@ContentImplHelper@ucbhelper@@UAAXABV?$Reference@VXContentEventListener@ucb@star@sun@com@@@uno@star@sun@com@@@Z
?addContentEventListener@ContentImplHelper@ucbhelper@@UAAXABV?$Reference@VXContentEventListener@ucb@star@sun@com@@@uno@star@sun@com@@@Z
?removeEventListener@ContentImplHelper@ucbhelper@@UAAXABV?$Reference@VXEventListener@lang@star@sun@com@@@uno@star@sun@com@@@Z
?addEventListener@ContentImplHelper@ucbhelper@@UAAXABV?$Reference@VXEventListener@lang@star@sun@com@@@uno@star@sun@com@@@Z
?dispose@ContentImplHelper@ucbhelper@@UAAXXZ
?supportsService@ContentImplHelper@ucbhelper@@UAAEABVOUString@rtl@@@Z
??1ContentImplHelper@ucbhelper@@UAE@XZ
?queryExistingContents@ContentProviderImplHelper@ucbhelper@@QAEXAAV?$list@V?$Reference@VContentImplHelper@ucbhelper@@@rtl@@V?$allocator@V?$Reference@VContentImplHelper@ucbhelper@@@rtl@@@_STL@@@_STL@@@Z
??1ContentIdentifier@ucbhelper@@UAE@XZ
?release@ContentIdentifier@ucbhelper@@UAAXXZ
?acquire@ContentIdentifier@ucbhelper@@UAAXXZ
??0ContentIdentifier@ucbhelper@@QAE@ABV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@uno@star@sun@com@@ABVOUString@rtl@@@Z
?queryExistingContent@ContentProviderImplHelper@ucbhelper@@IAE?AV?$Reference@VContentImplHelper@ucbhelper@@@rtl@@ABV?$Reference@VXContentIdentifier@ucb@star@sun@com@@@uno@star@sun@com@@@Z
?registerNewContent@ContentProviderImplHelper@ucbhelper@@IAEXABV?$Reference@VXContent@ucb@star@sun@com@@@uno@star@sun@com@@@Z
?compareContentIds@ContentProviderImplHelper@ucbhelper@@UAAJABV?$Reference@VXContentIdentifier@ucb@star@sun@com@@@uno@star@sun@com@@0@Z
??0ContentProviderImplHelper@ucbhelper@@QAE@ABV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@uno@star@sun@com@@@Z
??1ContentProviderImplHelper@ucbhelper@@UAE@XZ
?queryInterface@ContentIdentifier@ucbhelper@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
stlport_vc7145
?_Rebalance@?$_Rb_global@_N@_STL@@SAXPAU_Rb_tree_node_base@2@AAPAU32@@Z
?_M_increment@?$_Rb_global@_N@_STL@@SAPAU_Rb_tree_node_base@2@PAU32@@Z
?deallocate@?$__node_alloc@$00$0A@@_STL@@SAXPAXI@Z
?allocate@?$__node_alloc@$00$0A@@_STL@@SAPAXI@Z
?_Rebalance_for_erase@?$_Rb_global@_N@_STL@@SAPAU_Rb_tree_node_base@2@PAU32@AAPAU32@11@Z
?_M_decrement@?$_Rb_global@_N@_STL@@SAPAU_Rb_tree_node_base@2@PAU32@@Z
Exports
Exports
GetVersionInfo
component_getFactory
component_getImplementationEnvironment
component_writeInfo
Sections
.text Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ