2e7100983088698916363831b4eb1800N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2e7100983088698916363831b4eb1800N.exe
Size

9.1MB
MD5

2e7100983088698916363831b4eb1800
SHA1

4a262e9addffefb4206c1ae802278ed789e82931
SHA256

70da3ac6fc12311f76d7b75ed6a6a75ded860e47ea1d1f4a73552e12eeb38a08
SHA512

37b9daa08d9eb583bd7589af14e48040104fe5e22cfff64af152b1bf370ce4a3fdef856fbf5e7f270e7ccec63f3c2ece6c1db88711d1938354c30d5b5763774b
SSDEEP

98304:PsUJKB4pC2J1R05sDHGGHitS4WgOx6vbdD+cLD8oJUW1IucyPL9bU:ZIyC290fpXI6vbd18oJvLP5w

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e7100983088698916363831b4eb1800N.exe

Files

2e7100983088698916363831b4eb1800N.exe
.dll windows:6 windows x64 arch:x64

e97bd3786a6b2a27fe771b6f20868c8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

edcore

?create_raw@Config@Lua@@QEAAXPEBD@Z
?pop@Config@Lua@@QEAA_NPEAG@Z
?pop@Config@Lua@@QEAA_NPEAN@Z
??1ZoneAlloc@ed@@QEAA@XZ
??0ZoneAlloc@ed@@QEAA@_K0_N@Z
?string_format@ed@@YA?AV?$basic_string@D@1@PEBDZZ
?create@Config@Lua@@QEAAXH@Z
?set@?$Matrix@$03N@Math@@QEAAAEAV12@N@Z
?set@?$Matrix@$02N@Math@@QEAAAEAV12@N@Z
?set@?$Matrix@$01N@Math@@QEAAAEAV12@N@Z
?set@?$Matrix@$03M@Math@@QEAAAEAV12@M@Z
?set@?$Matrix@$02M@Math@@QEAAAEAV12@M@Z
?set@?$Matrix@$01M@Math@@QEAAAEAV12@M@Z
?iterate_pop@Config@Lua@@QEAA_NPEAV?$basic_string@D@ed@@@Z
?iterate_pop@Config@Lua@@QEAA_NPEAH@Z
?open_raw@Config@Lua@@QEAA_NPEBD@Z
?errorFunc@Config@Lua@@SAHPEAUlua_State@@@Z
ED_lua_pcall
?get@RandomObject@@QEAAMXZ
??1RandomObject@@UEAA@XZ
??0RandomObject@@QEAA@II@Z
??4LinkBase@@QEAAAEAV0@AEBV0@@Z
ed_vlogf
??1LinkBase@@QEAA@XZ
??0LinkBase@@QEAA@XZ
?Set@LinkBase@@IEAAXPEAVLinkHost@@@Z
?call_func@Config@Lua@@AEAA_NPEBDPEAV?$basic_string@D@ed@@HH@Z
?set@Config@Lua@@QEAAXH@Z
?pop@Config@Lua@@QEAA_NPEAI@Z
?pop@Config@Lua@@QEAA_NPEAV?$basic_string@D@ed@@@Z
?pop@Config@Lua@@QEAA_NPEAH@Z
?pop@Config@Lua@@QEAA_NPEA_N@Z
?open@Config@Lua@@QEAA_NH@Z
?pop@Config@Lua@@QEAA_NPEAM@Z
?get@Config@Lua@@QEAAXPEBD@Z
?open@Config@Lua@@QEAA_NPEBD@Z
ED_vsnprintf
?set@Config@Lua@@QEAAXPEBD@Z
?create@Config@Lua@@QEAAXPEBD@Z
??1Config@Lua@@QEAA@XZ
?pop@Config@Lua@@QEAA_NPEAE@Z
??0Config@Lua@@QEAA@PEAUlua_State@@H@Z

inter

?globalTrigger@@3PEAVItrigger@@EA
?globalDispatcher@@3PEAVIDispatcher@@EA
?globalView@@3PEAVIView@@EA
?globalOptions@@3PEAVIOptions@@EA
?GetDefaultTerrain@ITerrain@edterrain@@SAPEAV12@XZ
?globalWorldNet@@3PEAVIWorldNet@@EA

graphicsvista

?release@ModelPtr@Graphics@@AEAAXAEAPEAVModel@2@@Z
?inst@Models@Graphics@@SAAEAV12@XZ
?acquire@ModelPtr@Graphics@@AEAAXPEAVModel@2@@Z

edobjects

?getMissionID@lLandObject@@QEBAAEBV?$basic_string@D@ed@@XZ
?Country@lLandObject@@QEBAEXZ
?getTypeName@lLandObject@@QEBAAEBV?$basic_string@D@ed@@XZ
?CurLife@lLandObject@@QEBANXZ
?Type0@lLandObject@@QEBAPEAUwShape@@XZ
?GetDecl@wShape@@SAPEAU1@PEBD@Z
?get_Registered@SceneObject@@UEAAPEAVRegistered@@XZ
??BSceneObject@@QEBA_NXZ
??1SceneObject@@UEAA@XZ
??0SceneObject@@QEAA@I@Z
?instance@viObjectManager@@2PEAV1@EA
?GetObjects@viObjectManager@@QEAAHPEBVClipVolume@@PEAPEAVviObject@@HI@Z
?instance@lTypeObjectManager@@2PEAV1@EA
?Coalition@lLandObject@@QEBA?AW4wcCoalitionName@@XZ

world

?InsertToCalendar@wTime@@QEAAXXZ
??1wTime@@UEAA@XZ
??0wTime@@QEAA@XZ
?GetAbsoluteModelTime@wTime@@SANXZ
?KillMe@wTime@@QEAAXXZ
?Adjudged@Suicide@@QEAA_NXZ
?worldPluginManager@@3PEAVWorldPluginManager@@EA
?MissedEvent@wTime@@UEAAXXZ
?onCalendarClear@wTime@@UEAAXXZ
?registerToKill@wSimCalendar@@SAXPEAVSuicide@@@Z
??1Suicide@@UEAA@XZ
?GetModelTime@wTime@@SANXZ
?Cancel@wTime@@QEAAXXZ
??0Suicide@@QEAA@XZ
?globalModelTimeQuantizer@@3PEAVModelTimeQuantizer@@EA

worldgeneral

?get_zone@wsZonesStorage@@QEAAPEAVwsZone@@AEBV?$basic_string@D@ed@@@Z
?GetPoint@woSpot@@UEAA?AVVec3d@osg@@XZ
?create_laser_spot@woSpot@@SAPEAV1@IAEBVVec3d@osg@@0I@Z
?create_infrared_spot@woSpot@@SAPEAV1@IAEBVVec3d@osg@@0@Z
?has_attribute@wAttributeOwner@@QEBA_NPEBD@Z
?getGroup@@YAPEAVwControl@@PEBVMovingObject@@@Z
?getSensorMode@wDetector@@QEBA?AW4wSensorMode@wSensorInfo@@W4wSensorType@3@@Z
?getRCS@@YAMPEAVModel@Graphics@@@Z
?popTask@ControllerStack@AI@@QEAAXXZ
?get_outer_radius@wsZone@@QEBAMXZ
?Type@MovingObject@@QEBAAEBVwsType@@XZ
?Coalition@MovingObject@@QEBA?BW4wcCoalitionName@@XZ
?State@MovingObject@@QEBA?BEXZ
?getName@MovingObject@@QEBAAEBV?$basic_string@D@ed@@XZ
?globalWorld@@3PEAVIwWorld@@EA
?LLtoMGRS@MGRS@MapCoordsSpace@@SAXNNPEAD0AEAH1W4ELLIPSOID@2@@Z
?get_center_point@wsZone@@QEBA?AVVec3f@osg@@XZ
?wake_me_up@wControl@@IEAAXN@Z
?getByMissionId_AndDoAction@wControl@@SA_NIV?$function@$$A6A_NPEAVwControl@@@Z@std@@@Z
?GetCoords@MapCoords@MapCoordsSpace@@SAXNNAEAVVec3d@osg@@@Z
?LatLon@MapCoords@MapCoordsSpace@@SAXNNAEAN0@Z
??0wTargetDetectionStatus@@QEAA@XZ
?loadCommand@AI@@YAPEAVCommand@1@AEAVConfig@Lua@@AEAV?$basic_string@D@ed@@@Z
?loadTask@AI@@YAPEAVTask@1@AEAVConfig@Lua@@AEAV?$basic_string@D@ed@@@Z
?isGroup@wControl@@QEBA_NXZ
?getCategory@wControl@@QEBA?AW4Category@1@XZ
?getNextMissId@wControl@@SAIXZ
?getByName@wControl@@SAPEAV1@AEBV?$basic_string@D@ed@@@Z
?globalInfo@@3PEAVIwInfo@@EA
?getMissionIdByControl@wControl@@SAIPEBV1@@Z
?getByMissionId@wControl@@SAPEAV1@I@Z
?IsFlag@MovingObject@@QEBA?B_NH@Z
?globalLand@@3PEAVwTerrain@@EA
?MGRStoLL@MGRS@MapCoordsSpace@@SAXPEBD0HHAEAN1W4ELLIPSOID@2@@Z

flight

?is_free@wsBasicTerminal@@QEBA_NXZ
?getRWdir@wAirdrome@@QEBAPEBURunwayDirection@@H@Z
?forEachTerminal@woATC@@QEBAXV?$function@$$A6A_NPEBVwsAdrTerminal@@@Z@std@@@Z
?spawnLaunchPad@wHeliport@@SAIAEAVConfig@Lua@@W4wcCoalitionName@@H@Z
?getAirdrome@wAirdrome@@SAPEAV1@I@Z

?getModel@wShellDescriptor@@QEBA?AVModelPtr@Graphics@@XZ
lua_pushinteger
lua_rawseti
lua_tolstring
lua_toboolean
lua_tonumber
lua_tointeger
lua_isstring
lua_isnumber
lua_replace
lua_gettop
lua_pushstring
lua_pushnumber
lua_settop
luaL_unref
luaL_ref
lua_setmetatable
lua_getfield
lua_touserdata
lua_isuserdata
lua_next
lua_pushlstring
lua_pushvalue
lua_gettable
luaL_error
lua_settable
lua_createtable
lua_pushboolean
lua_pushcclosure
lua_type
malloc

weapons

?readResourceIdFrom@@YA?AUresourceId@@PEAUlua_State@@H@Z
?wGetAmmunitionNURSByType@@YAPEAVwAmmunitionNURSDescriptor@@VwsType@@@Z
?begin@Ammo@@QEBA@XZ
?getResourceIdFrom@@YA?AUresourceId@@AEBVwsType@@@Z
?nameFromWsType@@YA?AV?$basic_string_view@DU?$char_traits@D@std@@@std@@AEBVwsType@@@Z
?getTrackingTarget@wWeaponSystemManager@@QEBAPEAVMovingObject@@XZ
?empty@Ammo@@QEBA_NXZ
?end@Ammo@@QEBA@XZ
?setEmissionEnabled@wGroupTargetManager@@QEAAX_N@Z

weather

wradio

?doAction@MissionCommandManager@@QEAAXI@Z
?removeItemForGroup@MissionCommandManager@@QEAAXW4wcCoalitionName@@IAEBV?$list@V?$basic_string@D@ed@@V?$allocator@V?$basic_string@D@ed@@@2@@ed@@@Z
?addSubMenuForGroup@MissionCommandManager@@QEAA?AV?$list@V?$basic_string@D@ed@@V?$allocator@V?$basic_string@D@ed@@@2@@ed@@W4wcCoalitionName@@IAEBV23@AEBV?$basic_string@D@3@@Z
?addCommandForGroup@MissionCommandManager@@QEAA?AV?$list@V?$basic_string@D@ed@@V?$allocator@V?$basic_string@D@ed@@@2@@ed@@W4wcCoalitionName@@IAEBV23@AEBV?$basic_string@D@3@PEAVIMissionCommandAction@@@Z
?removeItemForCoalition@MissionCommandManager@@QEAAXW4wcCoalitionName@@AEBV?$list@V?$basic_string@D@ed@@V?$allocator@V?$basic_string@D@ed@@@2@@ed@@@Z
?addSubMenuForCoalition@MissionCommandManager@@QEAA?AV?$list@V?$basic_string@D@ed@@V?$allocator@V?$basic_string@D@ed@@@2@@ed@@W4wcCoalitionName@@AEBV23@AEBV?$basic_string@D@3@@Z
?addCommandForCoalition@MissionCommandManager@@QEAA?AV?$list@V?$basic_string@D@ed@@V?$allocator@V?$basic_string@D@ed@@@2@@ed@@W4wcCoalitionName@@AEBV23@AEBV?$basic_string@D@3@PEAVIMissionCommandAction@@@Z
?removeItem@MissionCommandManager@@QEAAXAEBV?$list@V?$basic_string@D@ed@@V?$allocator@V?$basic_string@D@ed@@@2@@ed@@@Z
?addSubMenu@MissionCommandManager@@QEAA?AV?$list@V?$basic_string@D@ed@@V?$allocator@V?$basic_string@D@ed@@@2@@ed@@AEBV23@AEBV?$basic_string@D@3@@Z
?addCommand@MissionCommandManager@@QEAA?AV?$list@V?$basic_string@D@ed@@V?$allocator@V?$basic_string@D@ed@@@2@@ed@@AEBV23@AEBV?$basic_string@D@3@PEAVIMissionCommandAction@@@Z
?instance@MissionCommandManager@@SAAEAV1@XZ
??0IMissionCommandAction@@QEAA@XZ
??1IMissionCommandAction@@UEAA@XZ
?convert@morze@@SA?AV?$basic_string@D@ed@@PEBD@Z
?toState@wMessage@@QEBAXPEAUlua_State@@@Z
?createLuaObject@Object@wMessage@@QEBAXPEAUlua_State@@@Z
?getById@Object@wMessage@@2P6APEAV12@I@ZEA
?getById@wCommunicator@@SAPEAV1@I@Z
?fromState@wMessage@@QEAAXPEAUlua_State@@H@Z
??1wMessage@@UEAA@XZ
??0wMessage@@QEAA@W4Type@0@W4PlayMode@0@@Z
??4Sender@wMessage@@QEAAAEAV01@AEBV01@@Z
??4Object@wMessage@@QEAAAEAV01@AEBV01@@Z

lua-terrain

?regMissionScripting@LuaTerrain@@YAXAEAVConfig@Lua@@@Z

user32

MessageBoxA

msvcp140

?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Mtx_lock
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Xbad_function_call@std@@YAXXZ
_Xtime_get_ticks
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?uncaught_exceptions@std@@YAHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
_Mtx_destroy_in_situ
_Mtx_unlock

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
RaiseException

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
memcpy
memmove
_purecall
__std_exception_copy
__std_exception_destroy
memset
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_type_info_destroy_list
__std_terminate
__RTDynamicCast
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

abort
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
terminate
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
_initterm
_initterm_e
_seh_filter_dll

api-ms-win-crt-math-l1-1-0

floor
atan2f
atan2
floorf
sinf
pow
ceilf
tan

api-ms-win-crt-string-l1-1-0

Exports

Exports

?cargoResourcePayloadRead@Scripting@@YAXAEAVConfig@Lua@@AEAUinventoryInfo@@@Z
?cargoResourcePayloadWrite@Scripting@@YAXAEAVConfig@Lua@@AEBUinventoryInfo@@@Z
?clearLuaTimers@Scripting@@YAXXZ
?createLuaAirbase@Scripting@@YAXPEAUlua_State@@I@Z
?createLuaAirbase@Scripting@@YAXPEAUlua_State@@PEAVwAirbase@@@Z
?createLuaGroup@Scripting@@YAXPEAUlua_State@@PEAVwControl@@@Z
?createLuaViObject@Scripting@@YAXPEAUlua_State@@PEAVviObject@@@Z
?createLuaWorldObject@Scripting@@YAXPEAUlua_State@@I@Z
?createLuaWorldObject@Scripting@@YAXPEAUlua_State@@PEAVMovingObject@@@Z
?createWorldEvent@Scripting@@YAXPEAUlua_State@@@Z
?dynamicAssignMissionID@Scripting@@YAXAEAVConfig@Lua@@@Z
?getReportErrorUseMessageBox@Scripting@@YA_NXZ
?getUnitCallsign@Scripting@@YA_NPEAVviObject@@AEAV?$basic_string@D@ed@@@Z
?luaMathRandomInit@Scripting@@YAXII@Z
?regLuaAI@Scripting@@YAXPEAUlua_State@@@Z
?regLuaAirbase@Scripting@@YAXPEAUlua_State@@@Z
?regLuaAtmosphere@Scripting@@YAXPEAUlua_State@@@Z
?regLuaCoalition@Scripting@@YAXPEAUlua_State@@@Z
?regLuaCommunicator@Scripting@@YAXPEAUlua_State@@@Z
?regLuaController@Scripting@@YAXPEAUlua_State@@@Z
?regLuaCoord@Scripting@@YAXPEAUlua_State@@@Z
?regLuaDebugCommunicator@Scripting@@YAXPEAUlua_State@@@Z
?regLuaDisposition@Scripting@@YAXPEAUlua_State@@@Z
?regLuaEnv@Scripting@@YAXPEAUlua_State@@_N@Z
?regLuaGroup@Scripting@@YAXPEAUlua_State@@@Z
?regLuaLand@Scripting@@YAXPEAUlua_State@@@Z
?regLuaMath@Scripting@@YAXPEAUlua_State@@@Z
?regLuaMessage@Scripting@@YAXPEAUlua_State@@@Z
?regLuaMissionCommandManager@Scripting@@YAXPEAUlua_State@@@Z
?regLuaMsgConstants@Scripting@@YAXPEAUlua_State@@@Z
?regLuaObject@Scripting@@YAXPEAUlua_State@@@Z
?regLuaRadio@Scripting@@YAXPEAUlua_State@@@Z
?regLuaRadioMeasureEquipment@Scripting@@YAXPEAUlua_State@@@Z
?regLuaSceneryObject@Scripting@@YAXPEAUlua_State@@@Z
?regLuaScoreList@Scripting@@YAXPEAUlua_State@@@Z
?regLuaSpot@Scripting@@YAXPEAUlua_State@@@Z
?regLuaStaticObject@Scripting@@YAXPEAUlua_State@@@Z
?regLuaTime@Scripting@@YAXPEAUlua_State@@@Z
?regLuaTrigger@Scripting@@YAXPEAUlua_State@@@Z
?regLuaUnit@Scripting@@YAXPEAUlua_State@@@Z
?regLuaView@Scripting@@YAXPEAUlua_State@@@Z
?regLuaWeapon@Scripting@@YAXPEAUlua_State@@@Z
?regLuaWorld@Scripting@@YAXPEAUlua_State@@@Z
?reportError@Scripting@@YAXPEBD0@Z
?reportError@Scripting@@YAXPEBD@Z
?setReportErrorUseMessageBox@Scripting@@YAX_N@Z

Sections

.text
Size: - Virtual size: 472KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UPX1
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX2
Size: 9.1MB - Virtual size: 9.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e97bd3786a6b2a27fe771b6f20868c8b

Headers

DLL Characteristics

File Characteristics

Imports

edcore

inter

graphicsvista

edobjects

world

worldgeneral

flight

weapons

weather

wradio

lua-terrain

user32

msvcp140

kernel32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 472KB

.rdata Size: - Virtual size: 135KB

.data Size: - Virtual size: 8KB

.pdata Size: - Virtual size: 15KB

.UPX0 Size: - Virtual size: 5.2MB

.UPX1 Size: 3KB - Virtual size: 2KB

.UPX2 Size: 9.1MB - Virtual size: 9.1MB

.rsrc Size: 1024B - Virtual size: 708B

.reloc Size: 512B - Virtual size: 296B

.text
Size: - Virtual size: 472KB

.rdata
Size: - Virtual size: 135KB

.data
Size: - Virtual size: 8KB

.pdata
Size: - Virtual size: 15KB

.UPX0
Size: - Virtual size: 5.2MB

.UPX1
Size: 3KB - Virtual size: 2KB

.UPX2
Size: 9.1MB - Virtual size: 9.1MB

.rsrc
Size: 1024B - Virtual size: 708B

.reloc
Size: 512B - Virtual size: 296B