Behavioral task
behavioral1
Sample
e41210afd78f7b3bd7e80903dae99129c0ffee04f4dc870289340b275359079e.exe
Resource
win7-20240704-en
General
-
Target
e41210afd78f7b3bd7e80903dae99129c0ffee04f4dc870289340b275359079e
-
Size
3.9MB
-
MD5
b6933142affe7c3dd426dea0628113bf
-
SHA1
0097f60cc217a56e59e1ee8726ec9a80b24b69ce
-
SHA256
e41210afd78f7b3bd7e80903dae99129c0ffee04f4dc870289340b275359079e
-
SHA512
fc36e1072e21dcf79f960af302b26d9e5f337c6a6ab425ce43d82a7c604924f0979e11fbb69e096fdf5757af09a7d0a7dd93e3f27a0375ccff25cb69d3a202dc
-
SSDEEP
49152:vnAqZxkbazyyLkG1mtYx4qVlEIB4bPiKXHPt6HY7RA:PAAxkbazytGhEI0PiKXHPmy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e41210afd78f7b3bd7e80903dae99129c0ffee04f4dc870289340b275359079e
Files
-
e41210afd78f7b3bd7e80903dae99129c0ffee04f4dc870289340b275359079e.exe windows:4 windows x86 arch:x86
a6322ac721f389ed055179ea1025cf43
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringW
GetEnvironmentVariableA
GetEnvironmentStringsW
Module32First
Module32Next
GetLongPathNameA
DeleteFileA
Thread32First
Thread32Next
ReleaseMutex
GetSystemDirectoryA
SetHandleCount
MapViewOfFile
GetModuleFileNameA
InitializeCriticalSection
TerminateThread
CreateFileA
DeviceIoControl
VirtualProtectEx
RtlFillMemory
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStdHandle
GetFileType
SetStdHandle
HeapSize
GetACP
GetSystemTime
RaiseException
RtlUnwind
GetCurrentThread
CreateMutexA
GetModuleFileNameW
WriteFile
GetExitCodeProcess
ReadFile
PeekNamedPipe
CreateProcessA
CreatePipe
CompareStringA
CompareStringW
GetWindowsDirectoryA
GetVersionExA
CopyFileA
GetProcessTimes
GetLocalTime
FileTimeToSystemTime
OpenMutexA
IsDBCSLeadByteEx
FormatMessageA
Sleep
CreateEventA
SuspendThread
GetThreadContext
SetThreadContext
LoadLibraryW
LeaveCriticalSection
GetVolumeInformationA
VirtualAlloc
TerminateProcess
LocalAlloc
LocalFree
DebugActiveProcess
SetProcessWorkingSetSize
IsBadWritePtr
SetEnvironmentVariableA
GetVersion
GetComputerNameA
VirtualFree
GetShortPathNameA
InterlockedIncrement
lstrcpynA
GetStringTypeA
CreateWaitableTimerA
SetWaitableTimer
MoveFileA
VirtualQueryEx
GetModuleHandleW
GetLastError
SetEndOfFile
SetFilePointer
CreateIoCompletionPort
GetSystemInfo
HeapDestroy
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetTickCount
ExitProcess
HeapReAlloc
GetUserDefaultLCID
GetFileSize
GetCurrentDirectoryA
FindNextFileA
FindFirstFileA
FindClose
CreateDirectoryA
SetFileAttributesA
GetStartupInfoA
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GetProcessVersion
FindResourceA
LoadResource
LockResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
MulDiv
lstrcatA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
DeleteCriticalSection
FreeLibrary
LoadLibraryExA
Process32Next
Process32First
GlobalFree
SetLocalTime
RemoveDirectoryA
CreateToolhelp32Snapshot
OpenThread
IsDebuggerPresent
GetModuleHandleA
HeapFree
GetTimeFormatA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
WaitForSingleObject
ResumeThread
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
FlushFileBuffers
lstrcpyA
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
SetLastError
GetTimeZoneInformation
GlobalSize
GlobalUnlock
GetStringTypeW
SetUnhandledExceptionFilter
HeapCreate
GlobalLock
GlobalAlloc
LCMapStringA
GetTempPathA
EnterCriticalSection
CreateThread
lstrcpyn
VirtualFreeEx
RtlMoveMemory
GetExitCodeThread
GetFileAttributesA
GetCommandLineA
GetProcAddress
IsBadReadPtr
LoadLibraryA
CreateRemoteThread
VirtualAllocEx
CreateFileMappingA
WideCharToMultiByte
IsBadCodePtr
OpenFileMappingA
MultiByteToWideChar
CloseHandle
InterlockedDecrement
UnmapViewOfFile
ReadProcessMemory
OpenProcess
OpenEventA
GetCurrentProcess
HeapAlloc
GetProcessHeap
WriteProcessMemory
lstrlenA
GetThreadTimes
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
GetFileAttributesA
DeleteFileA
CopyFileA
CreateDirectoryA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
CreateProcessA
WaitForSingleObject
lstrcpyA
CloseHandle
InterlockedExchange
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
SetStdHandle
GetACP
HeapSize
RaiseException
GetLocalTime
GetSystemTime
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GetProfileIntA
GlobalFlags
GetCurrentThread
GetFileTime
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
lstrcpynA
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageA
InterlockedIncrement
SuspendThread
ReleaseMutex
CreateMutexA
TerminateThread
GetVersion
GetTimeZoneInformation
SetLastError
TerminateProcess
GetCurrentProcess
GetFileSize
SetFilePointer
InterlockedDecrement
LocalFree
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
ReadFile
lstrlenW
RemoveDirectoryA
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
GetVersionExA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetUserDefaultLCID
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
user32
CallWindowProcA
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
SetTimer
PostMessageA
wvsprintfA
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowInfo
EnumWindows
GetWindowTextLengthA
GetClassNameA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
SendMessageTimeoutA
FindWindowExA
SendMessageA
GetAsyncKeyState
GetDesktopWindow
ExitWindowsEx
FindWindowA
WindowFromPoint
ShowCursor
mouse_event
keybd_event
ShowWindow
CallWindowProcW
InvalidateRect
LoadCursorFromFileA
SetClassLongA
EndDialog
CreateDialogIndirectParamA
DestroyMenu
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
GetForegroundWindow
GetAncestor
GetWindowTextA
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetSubMenu
GetMenuItemID
GetClassLongA
GetMessageTime
GetMessagePos
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
GrayStringA
DrawTextA
TabbedTextOutA
SetCursorPos
GetMenuItemCount
PtInRect
UnregisterClassA
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetNextDlgTabItem
GetActiveWindow
ValidateRect
GetLastActivePopup
IsWindowEnabled
SetCursor
PostQuitMessage
SendInput
GetKeyState
CreateWindowStationA
ReleaseCapture
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
wsprintfA
MessageBoxA
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
ActivateKeyboardLayout
GetKeyboardLayout
SystemParametersInfoA
GetClientRect
GetKeyboardLayoutList
UnloadKeyboardLayout
GetDlgItem
SetWindowPos
SetCapture
GetWindowRect
KillTimer
ClientToScreen
IsWindow
GetDC
PrintWindow
ReleaseDC
GetDoubleClickTime
MsgWaitForMultipleObjects
GetWindow
IsWindowVisible
SetWindowLongW
GetGUIThreadInfo
SetParent
GetParent
MoveWindow
UpdateWindow
OpenIcon
SetFocus
GetCursorPos
SetWindowLongA
EnumDisplaySettingsA
ChangeDisplaySettingsA
GetSystemMetrics
CharLowerA
EnumChildWindows
MapVirtualKeyA
FlashWindow
GetDlgCtrlID
SetForegroundWindow
SetLayeredWindowAttributes
GetWindowLongA
SetActiveWindow
GetCaretPos
EnumThreadWindows
SetWindowTextA
FlashWindowEx
DefWindowProcA
UpdateLayeredWindow
IsZoomed
CreateWindowExA
SetPropA
DestroyWindow
RemovePropA
GetPropA
IsIconic
ShowWindowAsync
ClipCursor
EnableWindow
SwapMouseButton
GetKeyboardState
RegisterWindowMessageA
CharUpperA
IsWindow
PostMessageA
GetTopWindow
UnregisterClassA
GetParent
GetFocus
GetClientRect
InvalidateRect
ValidateRect
UpdateWindow
EqualRect
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBeep
MessageBoxA
GetCursorPos
GetSystemMetrics
IsClipboardFormatAvailable
EmptyClipboard
SetClipboardData
GetWindowRect
SetForegroundWindow
DestroyMenu
TrackPopupMenu
IsChild
ReleaseDC
OpenClipboard
IsRectEmpty
InvertRect
FillRect
GetDC
SetCursor
GetSysColorBrush
LoadCursorA
LoadStringA
wvsprintfA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
SetCursorPos
SetActiveWindow
GetSysColor
CheckMenuItem
IsDialogMessageA
ScrollWindowEx
SendDlgItemMessageA
MapWindowPoints
AdjustWindowRectEx
GetClipboardData
CloseClipboard
wsprintfA
TranslateAcceleratorA
ScrollWindow
GetScrollInfo
SetScrollInfo
ShowScrollBar
GetScrollPos
RegisterClassA
SetWindowLongA
GetWindowLongA
RedrawWindow
EnableWindow
IsWindowVisible
OffsetRect
PtInRect
DestroyIcon
IntersectRect
InflateRect
SetRect
SetScrollPos
SetScrollRange
GetScrollRange
SetCapture
GetCapture
ReleaseCapture
SetTimer
KillTimer
WinHelpA
LoadBitmapA
CopyRect
ChildWindowFromPointEx
ScreenToClient
GetMessagePos
SetWindowRgn
DestroyAcceleratorTable
GetWindow
GetActiveWindow
SetFocus
IsIconic
PeekMessageA
SetMenu
GetMenu
DeleteMenu
GetSystemMenu
DefWindowProcA
GetClassInfoA
IsZoomed
PostQuitMessage
CopyAcceleratorTableA
GetKeyState
IsWindowEnabled
ShowWindow
SystemParametersInfoA
LoadImageA
EnumDisplaySettingsA
ClientToScreen
EnableMenuItem
GetSubMenu
GetDlgCtrlID
CreateAcceleratorTableA
CreateMenu
ModifyMenuA
AppendMenuA
CreatePopupMenu
CreateWindowExA
GetClassLongA
RemovePropA
GetMessageTime
GetLastActivePopup
GetForegroundWindow
RegisterWindowMessageA
GetWindowPlacement
EndDialog
CreateDialogIndirectParamA
DestroyWindow
EndPaint
BeginPaint
CharUpperA
GetWindowTextLengthA
GetDlgItem
GetClassNameA
GetDesktopWindow
GetNextDlgTabItem
GetDoubleClickTime
ClipCursor
GetWindowTextA
SetWindowTextA
GetMenuItemCount
GetMenuItemID
GetMenuStringA
GetMenuState
GetTabbedTextExtentA
DrawStateA
GrayStringA
TabbedTextOutA
WindowFromDC
EnumChildWindows
GetWindowDC
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
FrameRect
GetPropA
MoveWindow
CallWindowProcA
SetPropA
DrawTextA
GetCursor
LoadIconA
TranslateMessage
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
WaitForInputIdle
gdi32
SetMapMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetViewportOrgEx
DeleteObject
DeleteDC
GetTextExtentPointA
CreateFontIndirectA
SetBkMode
SetTextColor
TextOutA
CreateDIBSection
CreateRectRgn
GetObjectA
GetStockObject
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetDeviceCaps
PtVisible
RectVisible
ExtTextOutA
Escape
GetPixel
CreateBrushIndirect
CreateDCA
CreateCompatibleBitmap
Ellipse
CreateBitmap
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
Rectangle
CreatePatternBrush
SelectObject
CreatePen
PatBlt
CombineRgn
CreateRectRgn
FillRgn
CreateSolidBrush
CreateFontIndirectA
SetPixelV
GetObjectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
GetPixel
GetStretchBltMode
CreateCompatibleDC
GetCurrentObject
RoundRect
GetTextExtentPoint32A
DPtoLP
GetPolyFillMode
GetStockObject
LPtoDP
CreateEllipticRgn
PathToRegion
CopyMetaFileA
GetViewportExtEx
ExtSelectClipRgn
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetROP2
SetPolyFillMode
SetDIBitsToDevice
SetBrushOrgEx
CreateFontA
AbortDoc
GetTextMetricsA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreatePenIndirect
RestoreDC
SaveDC
SetWindowOrgEx
SetTextColor
SetBkMode
SetBkColor
CreateRectRgnIndirect
CreateDIBSection
SetPixel
SetStretchBltMode
GetClipRgn
CreatePolygonRgn
SelectClipRgn
DeleteObject
CreateDIBitmap
GetSystemPaletteEntries
CreatePalette
StretchBlt
SelectPalette
RealizePalette
GetDIBits
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
BeginPath
EndPath
GetDeviceCaps
comdlg32
GetFileTitleA
ChooseColorA
GetOpenFileNameA
GetSaveFileNameA
PrintDlgA
GetFileTitleA
wsock32
send
htons
ioctlsocket
bind
recvfrom
ntohs
closesocket
sendto
getsockname
WSACleanup
listen
ord1140
ord1141
ord1142
accept
connect
getpeername
recv
setsockopt
socket
WSAStartup
select
inet_addr
wininet
FtpGetFileSize
FtpOpenFileA
InternetTimeToSystemTime
InternetGetConnectedState
InternetTimeFromSystemTime
InternetOpenA
HttpQueryInfoA
InternetReadFile
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetSetCookieA
shell32
SHGetFileInfoA
ShellExecuteA
SHChangeNotify
SHGetPathFromIDListA
SHFileOperationA
SHGetSpecialFolderPathA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ShellExecuteA
Shell_NotifyIconA
ole32
OleIsCurrentClipboard
CoTaskMemAlloc
OleDuplicateData
RevokeDragDrop
CoLockObjectExternal
DoDragDrop
OleGetClipboard
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CoTaskMemFree
ReleaseStgMedium
CLSIDFromProgID
OleInitialize
OleUninitialize
CLSIDFromString
CreateStreamOnHGlobal
CoCreateInstance
OleRun
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
CoInitialize
OleUninitialize
OleRun
CoCreateInstance
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoUninitialize
dbghelp
MakeSureDirectoryPathExists
winhttp
WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime
shlwapi
PathRenameExtensionA
PathFindExtensionA
PathFileExistsA
PathRemoveBlanksA
StrTrimA
PathIsDirectoryEmptyA
PathUnmakeSystemFolderA
PathIsDirectoryA
PathMakeSystemFolderA
PathFindFileNameA
PathIsSystemFolderA
oleaut32
SystemTimeToVariantTime
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
VariantClear
VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
VariantTimeToSystemTime
SafeArrayGetLBound
SysAllocString
SafeArrayDestroy
SafeArrayGetDim
VariantCopyInd
VariantInit
SysAllocString
SafeArrayDestroy
SafeArrayCreate
SafeArrayPutElement
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
UnRegisterTypeLi
SafeArrayGetElement
SysFreeString
VarBstrFromCy
VarDateFromStr
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantChangeType
VariantClear
VariantCopy
GetErrorInfo
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CryptAcquireContextA
GetUserNameA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegEnumValueA
RegFlushKey
RegSetValueExA
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
RegOpenKeyA
LookupAccountSidA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegCreateKeyExA
RegQueryValueExA
gdiplus
GdipDrawPath
GdipDrawRectangle
GdipDeletePath
GdipDeletePen
GdipResetClip
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetClipHrgn
GdipSetSmoothingMode
GdipCreatePen1
GdiplusStartup
psapi
GetModuleFileNameExA
ws2_32
WSACreateEvent
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSACloseEvent
WSAEventSelect
WSASocketA
WSARecv
WSASend
htons
bind
htonl
socket
WSAAsyncSelect
getpeername
listen
recv
connect
closesocket
send
select
WSACleanup
WSAStartup
gethostbyname
inet_ntoa
gethostname
inet_addr
accept
recvfrom
ioctlsocket
ntohl
oledlg
ord8
rasapi32
RasHangUpA
RasGetConnectStatusA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comctl32
ord17
ImageList_DrawIndirect
ImageList_Read
ImageList_Create
ImageList_Destroy
ord17
ImageList_SetBkColor
ImageList_GetIcon
ImageList_AddMasked
ImageList_GetImageCount
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_Draw
ImageList_Duplicate
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
AVIStreamInfoA
winmm
midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiOutPrepareHeader
midiStreamOut
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutRestart
PlaySoundA
waveOutUnprepareHeader
msimg32
GradientFill
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 912KB - Virtual size: 909KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 576KB - Virtual size: 971KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ