728a6e9885e8f41d5eb853fd9d00e217_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

728a6e9885e8f41d5eb853fd9d00e217_JaffaCakes118
Size

531KB
MD5

728a6e9885e8f41d5eb853fd9d00e217
SHA1

ae6f7a01aa9b842898eac32beabec052a8d3ca8d
SHA256

1bed1bed2b6031bfb64f8a902fc7feb7c2cf22706fea299070cb2f3c599671ab
SHA512

7ea9dd4ecb0d30b84a71b6814f7b68dd5878588e38b7d56b89616e43bc5eebd92317180092cad6dd77a3afe781fb5d64190a0a46ca49b9f7bc7a0ccd52e0ae89
SSDEEP

12288:JTzOgE2iPQReC8F/p2mHbNtoSxWc/UbCQhQ2lilI1cOEGR:RC8eCWBRptoS4XhQg+0x

Score

3^/10

Malware Config

Signatures

Unsigned PE 23 IoCs

Checks for missing Authenticode signature.

resource
unpack001/142517175/CH13/SERVICE/I386/INSTSRV.EXE
unpack001/142517175/CH13/SERVICE/I386/WDJSRVC.EXE
unpack001/142517175/CH14/EVENTLOG/I386/EVENTAPP.EXE
unpack001/142517175/CH14/EVENTLOG/I386/EVENTMSG.DLL
unpack003/SAMPLES/BIGFACT.EXE
unpack003/SAMPLES/FACT.EXE
unpack003/SAMPLES/PRIME.EXE
unpack003/SAMPLES/SQRT.EXE
unpack001/142517175/CH19/2/SAMPLES/BIGFACT.EXE
unpack001/142517175/CH19/2/SAMPLES/FACT.EXE
unpack001/142517175/CH19/2/SAMPLES/PRIME.EXE
unpack001/142517175/CH19/2/SAMPLES/SQRT.EXE
unpack001/142517175/CH22/APPLET/I386/HPSCANAP.DLL
unpack001/142517175/CH22/APPLET/SCANAPLT.CPL
unpack001/142517175/CH23/VDD1/REGVDD/I386/REGVDD.DLL
unpack001/142517175/CH23/VDD2/SIMPLDRV/I386/SIMPLDRV.SYS
unpack001/142517175/CH23/VDD2/SIMPLVDD/I386/SIMPLVDD.DLL
unpack001/142517175/CH23/VDD3/IOVDD/I386/IOVDD.DLL
unpack001/142517175/CH23/VDD3/SIMPLDRV/I386/SIMPLDRV.SYS
unpack001/142517175/CH23/VDD4/HPSCAN32/I386/HPSCAN32.DLL
unpack001/142517175/CH4/POKER0.EXE
unpack001/142517175/CH7/ASYNCHIO/I386/TESTMAIN.EXE
unpack001/142517175/CH9/NTPRINT/I386/NTPRINT.EXE

Files

728a6e9885e8f41d5eb853fd9d00e217_JaffaCakes118
.rar
142517175/CH1/CH1L1.TXT
142517175/CH1/CH1L2.TXT
142517175/CH1/CH1L3.TXT
142517175/CH1/CH1L4.TXT
142517175/CH1/CH1L5.TXT
142517175/CH10/BORLAND0.MAK
142517175/CH10/CH10L1.TXT
142517175/CH10/CH10L2.TXT
142517175/CH10/CH10L3.TXT
142517175/CH10/CH10L4.TXT
142517175/CH10/ENUMPRO0.DEF
142517175/CH10/ENUMPROC.C
142517175/CH10/ENUMPROC.H
142517175/CH10/MS0.MAK
142517175/CH10/SHOWPROC.C
142517175/CH11/CH11L1.TXT
142517175/CH11/CH11L2.TXT
142517175/CH11/CH11L3.TXT
142517175/CH11/CH11L4.TXT
142517175/CH11/CH11L5.TXT
142517175/CH11/CH11L6.TXT
142517175/CH12/AIXSEM.C
142517175/CH12/CH12L1.TXT
142517175/CH12/CH12L2.TXT
142517175/CH12/CH12L3.TXT
142517175/CH12/CH12L4.TXT
142517175/CH12/CH12L5.TXT
142517175/CH12/CH12L6.TXT
142517175/CH12/CH12L7.TXT
142517175/CH12/IPC.H
142517175/CH12/IPCEVENT.C
142517175/CH12/IPCEVENT.H
142517175/CH12/IPCMUTEX.C
142517175/CH12/IPCMUTEX.H
142517175/CH12/IPCOS.H
142517175/CH12/IPCSEM.C
142517175/CH12/IPCSEM.H
142517175/CH12/OS2SEM.C
142517175/CH12/OSSEM.H
142517175/CH12/SEMTEST1.C
142517175/CH12/SEMTEST2.C
142517175/CH12/WINSEM.C
142517175/CH13/CH13L1.TXT
142517175/CH13/CH13L2.TXT
142517175/CH13/CH13L3.TXT
142517175/CH13/CH13L4.TXT
142517175/CH13/SERVICE/BUILD.BAT
142517175/CH13/SERVICE/I386/INSTSRV.EXE
.exe windows:4 windows x86 arch:x86

db771e5cbeceebf6121fe51f71e36c38

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CreateServiceA
OpenSCManagerA
CloseServiceHandle

kernel32

GetLastError
GetWindowsDirectoryA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
GetStdHandle
GetStartupInfoA
HeapCreate
WriteFile
HeapAlloc
SetFilePointer
HeapFree
GetProcAddress
LoadLibraryA
FlushFileBuffers
SetStdHandle
CloseHandle

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 903B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 1006B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1014B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH13/SERVICE/I386/WDJSRVC.EXE
.exe windows:4 windows x86 arch:x86

cd3955f65661dc6ef01f2e984b1fb80f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA

kernel32

OutputDebugStringA
Sleep
CloseHandle
ExitThread
WaitForSingleObject
CreateThread
CreateEventA
ResumeThread
SuspendThread
SetEvent
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
GetStdHandle
GetStartupInfoA
HeapCreate
WriteFile
HeapFree
HeapAlloc
GetProcAddress
LoadLibraryA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 783B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 738B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH13/SERVICE/INSTSRV.C
142517175/CH13/SERVICE/SRVCTMPL.C
142517175/CH13/SERVICE/SRVCTMPL.H
142517175/CH13/SERVICE/WDJSRVC.C
142517175/CH14/CH14L1.TXT
142517175/CH14/CH14L2.TXT
142517175/CH14/CH14L3.TXT
142517175/CH14/CH14L4.TXT
142517175/CH14/CH14L5.TXT
142517175/CH14/CH14L6.TXT
142517175/CH14/EVENTLOG/EVENTAPP.CPP
142517175/CH14/EVENTLOG/EVENTAPP.H
142517175/CH14/EVENTLOG/EVENTAPP.MAK
142517175/CH14/EVENTLOG/EVENTAPP.RC
142517175/CH14/EVENTLOG/EVENTLOG.CPP
142517175/CH14/EVENTLOG/EVENTLOG.H
142517175/CH14/EVENTLOG/EVENTMSG.C
142517175/CH14/EVENTLOG/EVENTMSG.MAK
142517175/CH14/EVENTLOG/EVENTMSG.MC
142517175/CH14/EVENTLOG/I386/EVENTAPP.EXE
.exe windows:4 windows x86 arch:x86

63e98946c3677c80b1eebcd64274443d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeEnvironmentStringsW
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
GetStdHandle
HeapCreate
HeapDestroy
WriteFile
GetEnvironmentStringsW
WideCharToMultiByte
HeapAlloc
HeapFree
GetProcAddress
GetVersion
GetLastError
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle
GetEnvironmentStrings
MultiByteToWideChar
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
RtlUnwind
GetCurrentProcess
TerminateProcess
ExitProcess
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetDiskFreeSpaceA
HeapSize
HeapReAlloc
LoadLibraryA

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
ReadEventLogA
GetNumberOfEventLogRecords
GetOldestEventLogRecord
ClearEventLogA
OpenEventLogA
BackupEventLogA
CloseEventLog
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

user32

EnableWindow
MessageBoxA
EndDialog
GetDlgItemTextA
DialogBoxParamA
GetDlgItem
CheckRadioButton
SendDlgItemMessageA

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 991B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH14/EVENTLOG/I386/EVENTMSG.DLL
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 512B - Virtual size: 23B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH14/EVENTLOG/I386/EVENTMSG.H
142517175/CH14/EVENTLOG/I386/EVENTMSG.RC
142517175/CH14/EVENTLOG/I386/MSG00001.BIN
142517175/CH15/CH15L1.TXT
142517175/CH15/CH15L2.TXT
142517175/CH15/CH15L3.TXT
142517175/CH15/CH15L4.TXT
142517175/CH15/CH15L5.TXT
142517175/CH15/CH15L6.TXT
142517175/CH15/CH15L7.TXT
142517175/CH16/CH16L1.TXT
142517175/CH17/CH17L1.TXT
142517175/CH17/CH17L2.TXT
142517175/CH17/CH17L3.TXT
142517175/CH17/CH17L4.TXT
142517175/CH17/CH17L5.TXT
142517175/CH17/DBTRACE/BORLAND.MAK
142517175/CH17/DBTRACE/DBTRACE.C
142517175/CH17/DBTRACE/DBTRACE.H
142517175/CH17/DBTRACE/DBTRACE.ICO
142517175/CH17/DBTRACE/DBTRACE.RC
142517175/CH17/DBTRACE/MS.MAK
142517175/CH17/DBTRACE/TEST/MAKEFILE
142517175/CH17/DBTRACE/TEST/TDCONFIG.TD2
142517175/CH17/DBTRACE/TEST/TEST.C
142517175/CH17/STEPPER/BPNODE.C
142517175/CH17/STEPPER/DEBUG.C
142517175/CH17/STEPPER/FOO.C
142517175/CH17/STEPPER/FOO_BOR.MAK
142517175/CH17/STEPPER/FOO_MS.MAK
142517175/CH17/STEPPER/LINES_MS.TXT
142517175/CH17/STEPPER/LINES_~1.TXT
142517175/CH17/STEPPER/RSRC.H
142517175/CH17/STEPPER/STEPPER.C
142517175/CH17/STEPPER/STEPPER.H
142517175/CH17/STEPPER/STEPPER.ICO
142517175/CH17/STEPPER/STEPPER.RC
142517175/CH17/STEPPER/STEP_BOR.MAK
142517175/CH17/STEPPER/STEP_MS.MAK
142517175/CH18/CALL32.DLL
142517175/CH18/CALL32.TXT
142517175/CH18/CH18L1.TXT
142517175/CH18/CH18L2.TXT
142517175/CH18/CH18L3.TXT
142517175/CH18/CH18L4.TXT
142517175/CH18/CH18L5.TXT
142517175/CH18/CONSOLE.FD
142517175/CH18/CONSOLE.FI
142517175/CH19/1/DECTOBIN.CPP
142517175/CH19/1/DIVREM.CPP
142517175/CH19/1/FACT1.CPP
142517175/CH19/1/GOTWALS.ZIP
.zip
DECTOBIN.CPP
DIVREM.CPP
FACT1.CPP
LARGEINT.H
LESSTHAN.CPP
MULTIPLY.CPP
SQRT.CPP
TEST3.CPP
TIMES.CPP
142517175/CH19/1/LARGEINT.H
142517175/CH19/1/LESSTHAN.CPP
142517175/CH19/1/MULTIPLY.CPP
142517175/CH19/1/SQRT.CPP
142517175/CH19/1/TEST3.CPP
142517175/CH19/1/TIMES.CPP
142517175/CH19/2/ADDSUB.CPP
142517175/CH19/2/BLDPATH.CMD
.cmd .vbs
142517175/CH19/2/DIVIDE.CPP
142517175/CH19/2/DIVREM.CPP
142517175/CH19/2/GOTWAL2.ZIP
.zip
ADDSUB.CPP
BLDPATH.CMD
.cmd .vbs
DIVIDE.CPP
DIVREM.CPP
LARGEINT.CPP
LARGEINT.H
LIB/LARGEINT
LIB/LARGEINT.LIB
LIB/LARGEINT.LST
LIB/LIBPATH.CMD
.cmd .vbs
LINTFUN.CPP
MAKEFILE
MISC.CPP
MISC.H
MULTIPLY.CPP
README.TXT
SAMPLES/BIGFACT.CPP
SAMPLES/BIGFACT.EXE
.exe windows:1 windows x86 arch:x86

a87b251be47ee6acbbe1dca027e5eeed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CloseHandle
GetEnvironmentStrings
GetCommandLineA
ExitProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoA
VirtualFree
VirtualAlloc
WriteFile
GetLastError
GetVersion
ReadFile
GetLocalTime
SetFilePointer
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetStdHandle
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
SetEndOfFile

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 746B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SAMPLES/FACT.CPP
SAMPLES/FACT.EXE
.exe windows:1 windows x86 arch:x86

f20cb030a06a2084377619cb76efecae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetLastError
GetEnvironmentStrings
GetCommandLineA
ExitProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoA
VirtualFree
VirtualAlloc
WriteFile
GetVersion
ReadFile
GetLocalTime
SetFilePointer
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetTimeZoneInformation
SetStdHandle
FlushFileBuffers
CloseHandle

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SAMPLES/LARGEINT.H
SAMPLES/MISC.H
SAMPLES/PRIME.CPP
SAMPLES/PRIME.EXE
.exe windows:1 windows x86 arch:x86

7af6b209f512f43795ebcc8edc6c9666

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetLastError
GetEnvironmentStrings
GetCommandLineA
ExitProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoA
VirtualFree
VirtualAlloc
WriteFile
GetVersion
SetFilePointer
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetLocalTime
ReadFile
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
CloseHandle

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SAMPLES/SQRT.CPP
SAMPLES/SQRT.EXE
.exe windows:1 windows x86 arch:x86

7af6b209f512f43795ebcc8edc6c9666

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetLastError
GetEnvironmentStrings
GetCommandLineA
ExitProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoA
VirtualFree
VirtualAlloc
WriteFile
GetVersion
SetFilePointer
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetLocalTime
ReadFile
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
CloseHandle

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH19/2/LARGEINT.CPP
142517175/CH19/2/LARGEINT.H
142517175/CH19/2/LIB/LARGEINT
142517175/CH19/2/LIB/LARGEINT.LIB
142517175/CH19/2/LIB/LARGEINT.LST
142517175/CH19/2/LIB/LIBPATH.CMD
.cmd .vbs
142517175/CH19/2/LINTFUN.CPP
142517175/CH19/2/MAKEFILE
142517175/CH19/2/MISC.CPP
142517175/CH19/2/MISC.H
142517175/CH19/2/MULTIPLY.CPP
142517175/CH19/2/SAMPLES/BIGFACT.CPP
142517175/CH19/2/SAMPLES/BIGFACT.EXE
.exe windows:1 windows x86 arch:x86

a87b251be47ee6acbbe1dca027e5eeed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CloseHandle
GetEnvironmentStrings
GetCommandLineA
ExitProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoA
VirtualFree
VirtualAlloc
WriteFile
GetLastError
GetVersion
ReadFile
GetLocalTime
SetFilePointer
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetStdHandle
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
SetEndOfFile

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 746B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH19/2/SAMPLES/FACT.CPP
142517175/CH19/2/SAMPLES/FACT.EXE
.exe windows:1 windows x86 arch:x86

f20cb030a06a2084377619cb76efecae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetLastError
GetEnvironmentStrings
GetCommandLineA
ExitProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoA
VirtualFree
VirtualAlloc
WriteFile
GetVersion
ReadFile
GetLocalTime
SetFilePointer
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetTimeZoneInformation
SetStdHandle
FlushFileBuffers
CloseHandle

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH19/2/SAMPLES/LARGEINT.H
142517175/CH19/2/SAMPLES/MISC.H
142517175/CH19/2/SAMPLES/PRIME.CPP
142517175/CH19/2/SAMPLES/PRIME.EXE
.exe windows:1 windows x86 arch:x86

7af6b209f512f43795ebcc8edc6c9666

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetLastError
GetEnvironmentStrings
GetCommandLineA
ExitProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoA
VirtualFree
VirtualAlloc
WriteFile
GetVersion
SetFilePointer
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetLocalTime
ReadFile
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
CloseHandle

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH19/2/SAMPLES/SQRT.CPP
142517175/CH19/2/SAMPLES/SQRT.EXE
.exe windows:1 windows x86 arch:x86

7af6b209f512f43795ebcc8edc6c9666

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetLastError
GetEnvironmentStrings
GetCommandLineA
ExitProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoA
VirtualFree
VirtualAlloc
WriteFile
GetVersion
SetFilePointer
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetLocalTime
ReadFile
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
CloseHandle

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH19/CH19L1.TXT
142517175/CH19/CH19L2.TXT
142517175/CH19/CH19L3.TXT
142517175/CH19/CH19L4.TXT
142517175/CH19/CH19L5.TXT
142517175/CH19/CH19L6.TXT
142517175/CH19/CH19L7.TXT
142517175/CH19/CH19L8.TXT
142517175/CH19/CH19L9.TXT
142517175/CH2/CH2L1.TXT
142517175/CH2/CH2L2.TXT
142517175/CH2/CH2L3.TXT
142517175/CH2/CH2L4.TXT
142517175/CH2/CH2L5.TXT
142517175/CH2/DLLFILE
142517175/CH2/SECTIONS/BORLAND/GLOBAL.C
142517175/CH2/SECTIONS/BORLAND/MAKEFILE
142517175/CH2/SECTIONS/BORLAND/SECTIONS.C
142517175/CH2/SECTIONS/BORLAND/SECTIONS.DEF
142517175/CH2/SECTIONS/BORLAND/SECTIONS.H
142517175/CH2/SECTIONS/BORLAND/TEST.C
142517175/CH2/SECTIONS/MS/MAKEFILE
142517175/CH2/SECTIONS/MS/SECTIONS.C
142517175/CH2/SECTIONS/MS/SECTIONS.DEF
142517175/CH2/SECTIONS/MS/SECTIONS.H
142517175/CH2/SECTIONS/MS/TEST.C
142517175/CH2/SHARE/BORLAND/MAKEFILE
142517175/CH2/SHARE/BORLAND/PUBLIC.C
142517175/CH2/SHARE/BORLAND/SHARE.C
142517175/CH2/SHARE/BORLAND/SHARE.DEF
142517175/CH2/SHARE/BORLAND/SHARE.H
142517175/CH2/SHARE/BORLAND/TEST.C
142517175/CH2/SHARE/MS/MAKEFILE
142517175/CH2/SHARE/MS/SHARE.C
142517175/CH2/SHARE/MS/SHARE.DEF
142517175/CH2/SHARE/MS/SHARE.H
142517175/CH2/SHARE/MS/TEST.C
142517175/CH20/CH20L1.TXT
142517175/CH20/CH20L2.TXT
142517175/CH20/CH20L3.TXT
142517175/CH20/CH20L4.TXT
142517175/CH20/CH20L5.TXT
142517175/CH20/CH20L6.TXT
142517175/CH21/CH21L1.TXT
142517175/CH21/CH21L2.TXT
142517175/CH22/APPLET/HPSCANAP.C
142517175/CH22/APPLET/HPSCANAP.DEF
142517175/CH22/APPLET/HPSCANAP.H
142517175/CH22/APPLET/HPSCANAP.RC
142517175/CH22/APPLET/I386/HPSCANAP.DLL
.dll windows:4 windows x86 arch:x86

dcc6f8aa480698d04f85aad0a36c8791

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt40

strstr
strcpy

user32

EndDialog
DialogBoxParamA
MessageBoxA
EnableWindow
GetDlgItem
SetDlgItemTextA

Exports

Exports

CPL_ScannerConfigure
CPL_ScannerInstall
CPL_ScannerUninstall
ConfigureDlgProc

Sections

.text
Size: 1024B - Virtual size: 604B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 291B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 278B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH22/APPLET/MAKEFILE
142517175/CH22/APPLET/SCANAPLT.C
142517175/CH22/APPLET/SCANAPLT.CPL
.dll windows:4 windows x86 arch:x86

51b7d609cf0cc9b5772ad4cb7ba71758

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt40

atoi
strcat
strlen
strcpy

kernel32

GetPrivateProfileStringA
LoadLibraryA
FreeLibrary
GetProcAddress
GetPrivateProfileIntA

advapi32

RegDeleteValueA
RegEnumValueA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey

user32

SendMessageA
LoadIconA
SendDlgItemMessageA
MessageBoxA
EnableWindow
GetDlgItem
DialogBoxParamA
EndDialog
GetDlgItemTextA
SetDlgItemTextA
wsprintfA

Exports

Exports

AddDlgProc
CPlApplet
ScannerDlgProc

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 243B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH22/APPLET/SCANAPLT.DEF
142517175/CH22/APPLET/SCANAPLT.H
142517175/CH22/APPLET/SCANAPLT.ICO
142517175/CH22/APPLET/SCANAPLT.INF
142517175/CH22/APPLET/SCANAPLT.RC
142517175/CH22/CH22L1.TXT
142517175/CH22/CH22L2.TXT
142517175/CH22/CH22L3.TXT
142517175/CH22/CH22L4.TXT
142517175/CH22/CH22L5.TXT
142517175/CH22/CH22L6.TXT
142517175/CH23/CH23L1.TXT
142517175/CH23/CH23L10.TXT
142517175/CH23/CH23L11.TXT
142517175/CH23/CH23L12.TXT
142517175/CH23/CH23L13.TXT
142517175/CH23/CH23L14.TXT
142517175/CH23/CH23L15.TXT
142517175/CH23/CH23L16.TXT
142517175/CH23/CH23L17.TXT
142517175/CH23/CH23L18.TXT
142517175/CH23/CH23L19.TXT
142517175/CH23/CH23L2.TXT
142517175/CH23/CH23L3.TXT
142517175/CH23/CH23L4.TXT
142517175/CH23/CH23L5.TXT
142517175/CH23/CH23L6.TXT
142517175/CH23/CH23L7.TXT
142517175/CH23/CH23L8.TXT
142517175/CH23/CH23L9.TXT
142517175/CH23/VDD1/REGVDD/I386/REGVDD.DLL
.dll windows:4 windows x86 arch:x86

b609eb704e4e3727e40f8fb2feae6172

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey

ntvdm.exe

MGetVdmPointer
getBX
getES
getDX
getCX
setCF

Exports

Exports

RegVDDDispatch
RegVDDRegisterInit
RegVDDTerminateVDM

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 70B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH23/VDD1/REGVDD/MAKEFILE
142517175/CH23/VDD1/REGVDD/REGVDD.C
142517175/CH23/VDD1/REGVDD/REGVDD.DEF
142517175/CH23/VDD1/REGVDD/REGVDD.H
142517175/CH23/VDD1/REGVDD/SOURCES
142517175/CH23/VDD1/WTEST16/I386/WTEST16.EXE
142517175/CH23/VDD1/WTEST16/ISVBOPX.H
142517175/CH23/VDD1/WTEST16/WTEST16.C
142517175/CH23/VDD1/WTEST16/WTEST16.DEF
142517175/CH23/VDD1/WTEST16/WTEST16.H
142517175/CH23/VDD1/WTEST16/WTEST16.MAK
142517175/CH23/VDD1/WTEST16/WTEST16.RC
142517175/CH23/VDD2/DOSDRV16/DOSDRV16.ASM
142517175/CH23/VDD2/DOSDRV16/DOSDRV16.INC
142517175/CH23/VDD2/DOSDRV16/I386/DOSDRV16.SYS
142517175/CH23/VDD2/DOSDRV16/MAKE16.BAT
142517175/CH23/VDD2/DTEST16/DTEST16.C
142517175/CH23/VDD2/DTEST16/DTEST16.MAK
142517175/CH23/VDD2/DTEST16/I386/DTEST16.EXE
142517175/CH23/VDD2/SIMPLDRV/I386/SIMPLDRV.SYS
.sys windows:1 windows x86 arch:x86

21d6bc2e906af4531882cbcfbaee3b58

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

ntoskrnl.exe

DbgPrint
IoCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString

Sections

.text
Size: 1024B - Virtual size:

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH23/VDD2/SIMPLDRV/MAKEFILE
142517175/CH23/VDD2/SIMPLDRV/SIMPLDRV.C
142517175/CH23/VDD2/SIMPLDRV/SIMPLDRV.H
142517175/CH23/VDD2/SIMPLDRV/SIMPLDRV.INI
142517175/CH23/VDD2/SIMPLDRV/SOURCES
142517175/CH23/VDD2/SIMPLVDD/I386/SIMPLVDD.DLL
.dll windows:1 windows x86 arch:x86

a027b462a334f286c37e36378de02a9e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

ntvdm.exe

MGetVdmPointer
getBX
getCX
getDX
getES
setCF
setCX
setDI

kernel32

CloseHandle
CreateFileA
DeviceIoControl
ReadFile
WriteFile

Exports

Exports

VDDDispatch
VDDInit
VDDTerminateVDM

Sections

.text
Size: 1024B - Virtual size:

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug
Size: 2KB - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH23/VDD2/SIMPLVDD/MAKEFILE
142517175/CH23/VDD2/SIMPLVDD/SIMPLVDD.C
142517175/CH23/VDD2/SIMPLVDD/SIMPLVDD.DEF
142517175/CH23/VDD2/SIMPLVDD/SIMPLVDD.H
142517175/CH23/VDD2/SIMPLVDD/SOURCES
142517175/CH23/VDD3/IO16/I386/IO16.EXE
142517175/CH23/VDD3/IO16/IO16.C
142517175/CH23/VDD3/IO16/IO16.MAK
142517175/CH23/VDD3/IOVDD/I386/IOVDD.DLL
.dll windows:1 windows x86 arch:x86

73cdca96184f1427d5f9d8b35a20029e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

ntvdm.exe

MGetVdmPointer
VDDAllocMem
VDDDeInstallIOHook
VDDDeInstallMemoryHook
VDDFreeMem
VDDInstallIOHook
VDDInstallMemoryHook

kernel32

CloseHandle
CreateFileA
DeviceIoControl
OutputDebugStringA

Exports

Exports

VDDLibMain

Sections

.text
Size: 1KB - Virtual size:

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size:

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug
Size: 2KB - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH23/VDD3/IOVDD/IOVDD.C
142517175/CH23/VDD3/IOVDD/IOVDD.DEF
142517175/CH23/VDD3/IOVDD/IOVDD.H
142517175/CH23/VDD3/IOVDD/MAKEFILE
142517175/CH23/VDD3/IOVDD/SOURCES
142517175/CH23/VDD3/SIMPLDRV/I386/SIMPLDRV.SYS
.sys windows:1 windows x86 arch:x86

21d6bc2e906af4531882cbcfbaee3b58

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

ntoskrnl.exe

DbgPrint
IoCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString

Sections

.text
Size: 1024B - Virtual size:

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH23/VDD3/SIMPLDRV/MAKEFILE
142517175/CH23/VDD3/SIMPLDRV/SIMPLDRV.C
142517175/CH23/VDD3/SIMPLDRV/SIMPLDRV.H
142517175/CH23/VDD3/SIMPLDRV/SIMPLDRV.INI
142517175/CH23/VDD3/SIMPLDRV/SOURCES
142517175/CH23/VDD4/CONS32/CONS32.C
142517175/CH23/VDD4/CONS32/CONS32.MAK
142517175/CH23/VDD4/HPSCAN16/HPSCAN16.ASM
142517175/CH23/VDD4/HPSCAN16/HPSCAN16.INC
142517175/CH23/VDD4/HPSCAN16/I386/HPSCAN16.SYS
142517175/CH23/VDD4/HPSCAN16/MAKESTUB.BAT
142517175/CH23/VDD4/HPSCAN32/HPSCAN32.C
142517175/CH23/VDD4/HPSCAN32/HPSCAN32.DEF
142517175/CH23/VDD4/HPSCAN32/HPSCAN32.H
142517175/CH23/VDD4/HPSCAN32/I386/HPSCAN32.DLL
.dll windows:4 windows x86 arch:x86

38ff0098182809372aed3dfc87355d06

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
ReadFile
WriteFile
DeviceIoControl
CreateFileA

ntvdm.exe

setCF
setDI
MGetVdmPointer
setCX
getDX
getBX
getES
getCX

Exports

Exports

VDDDispatch
VDDInit
VDDScannerCommand

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 302B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH23/VDD4/HPSCAN32/MAKEFILE
142517175/CH23/VDD4/HPSCAN32/SOURCES
142517175/CH23/VDD4/TEST16/TEST16.C
142517175/CH23/VDD4/TEST16/TEST16.MAK
142517175/CH23/VDD4/TEST32/TEST32.C
142517175/CH23/VDD4/TEST32/TEST32.DEF
142517175/CH23/VDD4/TEST32/TEST32.H
142517175/CH23/VDD4/TEST32/TEST32.MAK
142517175/CH23/VDD4/TEST32/TEST32.RC
142517175/CH24/CH24L1.TXT
142517175/CH24/CH24L2.TXT
142517175/CH24/CH24L3.TXT
142517175/CH24/CH24L4.TXT
142517175/CH24/CH24L5.TXT
142517175/CH3/AIXQUEUE.C
142517175/CH3/AIXSHMEM.C
142517175/CH3/CH3L1.TXT
142517175/CH3/CH3L2.TXT
142517175/CH3/CH3L3.TXT
142517175/CH3/CH3L4.TXT
142517175/CH3/CH3L5.TXT
142517175/CH3/CH3L6.TXT
142517175/CH3/IPCQUEUE.C
142517175/CH3/IPCQUEUE.H
142517175/CH3/IPCSHMEM.C
142517175/CH3/IPCSHMEM.H
142517175/CH3/MBTEST.H
142517175/CH3/MBTEST1.C
142517175/CH3/MBTEST2.C
142517175/CH3/OS2QUEUE.C
142517175/CH3/OS2SHMEM.C
142517175/CH3/OSQUEUE.H
142517175/CH3/OSSHMEM.H
142517175/CH3/QTEST.H
142517175/CH3/QTEST1.C
142517175/CH3/QTEST2.C
142517175/CH3/WINQUEUE.C
142517175/CH3/WINSHMEM.C
142517175/CH4/CARDS.H
142517175/CH4/CARDS0.CPP
142517175/CH4/CH4L1.TXT
142517175/CH4/CH4L2.TXT
142517175/CH4/POKER.H
142517175/CH4/POKER.RC
142517175/CH4/POKER0.APS
142517175/CH4/POKER0.CLW
142517175/CH4/POKER0.CPP
142517175/CH4/POKER0.DEF
142517175/CH4/POKER0.EXE
.exe windows:1 windows x86 arch:x86

ca698ae834df8d773a523c82db06b53f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

advapi32

RegQueryValueA
RegSetValueA

comdlg32

GetFileTitleA

gdi32

CreateSolidBrush
GetDeviceCaps
GetTextExtentPointA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreatePatternBrush
GetObjectA
SetBkColor
DeleteDC
StartPage
EndPage
StartDocA
AbortDoc
EndDoc
SetAbortProc
RestoreDC
SelectObject
SaveDC
SelectPalette
SetBkMode
GetStockObject
SetROP2
SetStretchBltMode
SetPolyFillMode
SetViewportOrgEx
OffsetViewportOrgEx
SetMapMode
ScaleViewportExtEx
SetWindowOrgEx
SetViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
OffsetWindowOrgEx
SelectClipRgn
ExcludeClipRect
GetClipBox
OffsetClipRgn
MoveToEx
IntersectClipRect
SetTextAlign
SetTextJustification
LineTo
SetMapperFlags
CreatePen
SetTextCharacterExtra
CreateBitmap
DeleteObject
CreateHatchBrush
SetTextColor

kernel32

UnlockFile
LockFile
SetFilePointer
FlushFileBuffers
WriteFile
GetVolumeInformationA
GetFullPathNameA
GetModuleHandleA
DuplicateHandle
ReadFile
GetCommandLineA
ExitProcess
RtlUnwind
UnhandledExceptionFilter
GetFileType
GetStdHandle
VirtualFree
VirtualAlloc
GetStringTypeW
MultiByteToWideChar
SetConsoleCtrlHandler
GetCurrentProcess
GlobalUnlock
GetLastError
GlobalLock
lstrcmpA
GlobalGetAtomNameA
GetVersion
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
lstrlenA
lstrcpyA
lstrcmpiA
GlobalFree
GlobalAddAtomA
SetErrorMode
lstrcatA
GlobalDeleteAtom
GetModuleFileNameA
LockResource
FindResourceA
LoadResource
ReleaseMutex
FreeResource
GetCurrentThreadId
MapViewOfFile
WaitForSingleObject
CreateFileMappingA
GetFileInformationByHandle
CreateMutexA
CreateFileA
CloseHandle
FlushViewOfFile
UnmapViewOfFile
Sleep
LoadLibraryA
GetProcAddress
GetStartupInfoA
GetTickCount
GetEnvironmentStrings
SetEndOfFile
MoveFileA
DeleteFileA

shell32

DragFinish
DragQueryFileA

user32

EqualRect
TranslateMessage
GetMessageA
PeekMessageA
GetKeyState
ValidateRect
SetCursor
GetLastActivePopup
MessageBoxA
InsertMenuA
DeleteMenu
WinHelpA
GetCapture
PostThreadMessageA
SetFocus
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
GetDC
ReleaseDC
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetClassNameA
RegisterClipboardFormatA
LoadCursorA
GetDesktopWindow
DestroyMenu
LoadMenuA
PostMessageA
SetActiveWindow
ReuseDDElParam
UnpackDDElParam
CharPrevA
SetMenu
InvalidateRect
BringWindowToTop
IsWindowVisible
CharToOemA
OemToCharA
LoadStringA
CharUpperA
SendDlgItemMessageA
GetWindowLongA
AdjustWindowRect
ScreenToClient
DispatchMessageA
DeferWindowPos
GetClientRect
EndDeferWindowPos
EnableWindow
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
GetParent
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
TrackPopupMenu
DefWindowProcA
CallWindowProcA
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
SetWindowLongA
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
GetSystemMetrics
GetWindowRect
SetWindowPos
GetSysColor
DialogBoxParamA
DialogBoxIndirectParamA
CreateDialogIndirectParamA
CreateDialogParamA
GetWindow
IsDialogMessageA
EndDialog
ShowWindow
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
wsprintfA
IsIconic
SendMessageA
DrawIcon
LoadIconA
DestroyIcon
PostQuitMessage
TranslateAcceleratorA
LoadAcceleratorsA
GetDlgCtrlID
SetWindowTextA
BeginDeferWindowPos

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

AFX_COR1
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

AFX_INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

AFX_COR3
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

AFX_COR2
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

AFX_AUX_
Size: 512B - Virtual size: 501B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

AFX_COL2
Size: 1024B - Virtual size: 769B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

AFX_COL1
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH4/POKER0.ICO
142517175/CH4/POKER0.MAK
142517175/CH4/POKER0.RC2
142517175/CH4/POKER0.VCW
142517175/CH4/POKER0.WSP
142517175/CH4/RESOURCE.H
142517175/CH4/STDAFX.H
142517175/CH4/STDAFX0.CPP
142517175/CH5/BLDVER.BAT
142517175/CH5/CH5L1.TXT
142517175/CH5/CH5L2.TXT
142517175/CH5/CH5L3.TXT
142517175/CH5/DOSTEST.MAK
142517175/CH5/WTEST.C
142517175/CH5/WTEST.DEF
142517175/CH5/WTEST.H
142517175/CH5/WTEST.RC
142517175/CH5/WTEST16.MAK
142517175/CH5/WTEST32.MAK
142517175/CH6/CH6L1.TXT
142517175/CH7/ASYNCHIO/ASYNCH.CPP
142517175/CH7/ASYNCHIO/ASYNCH.H
142517175/CH7/ASYNCHIO/I386/TESTMAIN.EXE
.exe windows:4 windows x86 arch:x86

c8a60187c02f27970e725e8b8a0ca48b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
ExitProcess
GetLastError
FindNextChangeNotification
DeleteFileA
WaitForSingleObject
FindFirstChangeNotificationA
GetDiskFreeSpaceA
GetVolumeInformationA
SetCurrentDirectoryA
CreateDirectoryA
FindClose
FindNextFileA
FindFirstFileA
CreateFileA
CloseHandle
ReadFile
WriteFile
SetFilePointer
GetOverlappedResult
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
FindCloseChangeNotification
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
GetStdHandle
GetStartupInfoA
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
GetProcAddress
LoadLibraryA
SetStdHandle
FlushFileBuffers

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 991B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH7/ASYNCHIO/MAKEFILE
142517175/CH7/ASYNCHIO/TESTMAIN.CPP
142517175/CH7/CH7L1.TXT
142517175/CH7/CH7L2.TXT
142517175/CH7/CH7L3.TXT
142517175/CH8/CH8L1.TXT
142517175/CH8/CH8L10.TXT
142517175/CH8/CH8L2.TXT
142517175/CH8/CH8L3.TXT
142517175/CH8/CH8L4.TXT
142517175/CH8/CH8L5.TXT
142517175/CH8/CH8L6.TXT
142517175/CH8/CH8L7.TXT
142517175/CH8/CH8L8.TXT
142517175/CH8/CH8L9.TXT
142517175/CH8/CUJWIN.EXE
142517175/CH8/CWCOMDLG.CPP
142517175/CH8/CWLSTDL2.CPP
142517175/CH8/CWOBJLST.CPP
142517175/CH8/DLG.RC
142517175/CH8/DLGIDS.H
142517175/CH8/DLGTEST.RC
142517175/CH8/LSTDIALG.RC
142517175/CH8/SMLSTDLG.RC
142517175/CH9/CH9L1.TXT
142517175/CH9/CH9L2.TXT
142517175/CH9/CH9L3.TXT
142517175/CH9/CH9L4.TXT
142517175/CH9/CH9L5.TXT
142517175/CH9/CH9L6.TXT
142517175/CH9/CH9L7.TXT
142517175/CH9/NTPRINT/CFORM.CPP
142517175/CH9/NTPRINT/CFORM.H
142517175/CH9/NTPRINT/CPRINT.CPP
142517175/CH9/NTPRINT/CPRINT.H
142517175/CH9/NTPRINT/I386/NTPRINT.EXE
.exe windows:4 windows x86 arch:x86

db6f66331b0ed62bbf7a2ad4f26bf84f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCPInfo
GetOEMCP
SetHandleCount
WideCharToMultiByte
GetACP
HeapCreate
HeapDestroy
WriteFile
HeapReAlloc
GetFileType
GetStdHandle
HeapSize
MultiByteToWideChar
LoadLibraryA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GlobalUnlock
GlobalFree
lstrcpyA
GetEnvironmentStrings
CreateThread
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapAlloc
FreeEnvironmentStringsA
CloseHandle
GetModuleFileNameA
UnhandledExceptionFilter
RtlUnwind
GetCurrentProcess
TerminateProcess
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapFree
GetProcAddress
GlobalLock

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

DialogBoxParamA
wsprintfA
SendDlgItemMessageA
CreateDialogParamA
SetDlgItemTextA
IsDialogMessageA
PeekMessageA
EndDialog
GetDC
ReleaseDC
LoadBitmapA
MessageBoxA
DestroyWindow
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcA
LoadIconA
LoadCursorA
RegisterClassA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
CreateWindowExA

gdi32

DeleteObject
DeleteDC
StretchBlt
SetColorAdjustment
GetColorAdjustment
RealizePalette
SelectPalette
CreateHalftonePalette
GetObjectA
SelectObject
CreateCompatibleDC
GetDeviceCaps
SetAbortProc
StartPage
StartDocA
AbortDoc
EndDoc
EndPage

comdlg32

CommDlgExtendedError
PrintDlgA

winspool.drv

ClosePrinter
AddFormA
EnumFormsA
OpenPrinterA
SetFormA
GetFormA
DeleteFormA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
142517175/CH9/NTPRINT/MAKEFILE
142517175/CH9/NTPRINT/NTPRINT.CPP
142517175/CH9/NTPRINT/NTPRINT.H
142517175/CH9/NTPRINT/NTPRINT.RC
142517175/TOMLINSO/CODEDISK
142517175/下载说明.htm
.html .js polyglot

Sharing

General

Malware Config

Signatures

Files

db771e5cbeceebf6121fe51f71e36c38

Headers

File Characteristics

Imports

advapi32

kernel32

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 1024B - Virtual size: 903B

.data Size: 3KB - Virtual size: 7KB

.idata Size: 1024B - Virtual size: 1006B

.reloc Size: 1024B - Virtual size: 1014B

cd3955f65661dc6ef01f2e984b1fb80f

Headers

File Characteristics

Imports

advapi32

kernel32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 1024B - Virtual size: 783B

.data Size: 1KB - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 738B

63e98946c3677c80b1eebcd64274443d

Headers

File Characteristics

Imports

kernel32

advapi32

user32

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 1024B - Virtual size: 991B

.data Size: 3KB - Virtual size: 9KB

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 788B

.reloc Size: 1KB - Virtual size: 1KB

Headers

File Characteristics

Sections

.text Size: 512B - Virtual size: 23B

.rdata Size: 512B - Virtual size: 84B

.rsrc Size: 512B - Virtual size: 264B

.reloc Size: 512B - Virtual size: 12B

a87b251be47ee6acbbe1dca027e5eeed

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 21KB - Virtual size: 21KB

.bss Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 512B - Virtual size: 12B

.data Size: 3KB - Virtual size: 3KB

.idata Size: 1024B - Virtual size: 746B

.reloc Size: 6KB - Virtual size: 6KB

f20cb030a06a2084377619cb76efecae

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 23KB - Virtual size: 23KB

.bss Size: 5KB - Virtual size: 5KB

.rdata Size: 512B - Virtual size: 12B

.data Size: 3KB - Virtual size: 3KB

.idata Size: 1024B - Virtual size: 700B

.reloc Size: 1KB - Virtual size: 1KB

7af6b209f512f43795ebcc8edc6c9666

Headers

File Characteristics

Imports

kernel32

Sections

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 1024B - Virtual size: 903B

.data
Size: 3KB - Virtual size: 7KB

.idata
Size: 1024B - Virtual size: 1006B

.reloc
Size: 1024B - Virtual size: 1014B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 1024B - Virtual size: 783B

.data
Size: 1KB - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 738B

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 1024B - Virtual size: 991B

.data
Size: 3KB - Virtual size: 9KB

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 788B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 512B - Virtual size: 23B

.rdata
Size: 512B - Virtual size: 84B

.rsrc
Size: 512B - Virtual size: 264B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 21KB - Virtual size: 21KB

.bss
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 512B - Virtual size: 12B

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 746B

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 23KB - Virtual size: 23KB

.bss
Size: 5KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 12B

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 700B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 25KB - Virtual size: 24KB

.bss
Size: 5KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 12B

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 700B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 21KB - Virtual size: 21KB

.bss
Size: 5KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 12B

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 700B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 21KB - Virtual size: 21KB

.bss
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 512B - Virtual size: 12B

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 746B

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 23KB - Virtual size: 23KB

.bss
Size: 5KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 12B

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 700B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 25KB - Virtual size: 24KB

.bss
Size: 5KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 12B

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 700B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 21KB - Virtual size: 21KB

.bss
Size: 5KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 12B

.data
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 700B

.reloc
Size: 1KB - Virtual size: 1KB