5c9d9f1d8a9d721dc98cfcf20f62f5b0N

Sharing

Copy URL Twitter E-mail

General

Target

5c9d9f1d8a9d721dc98cfcf20f62f5b0N
Size

1003KB
MD5

5c9d9f1d8a9d721dc98cfcf20f62f5b0
SHA1

f506852469c363b8e86010d85c9f979c795bbb50
SHA256

995c9ce4c7efd30229bd1d807309d357bb49bc88d97bd3c8a4987bf5a410fbf3
SHA512

2d27bbc87e810c07d63998834193e850d3b5da7889fd48ad3aeba5fd32ff30b166867192b831a1e0ade0827744526dcd8fb4536e5efbd78cd7d46e1bc774c99b
SSDEEP

24576:cnpMNiy5cS0mz1IOL/BqhJtGr3bxDLwR5LXRXafZ6bt6B9a:cnIi4cozVgtGr3bBLW5LB86eE

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$DESKTOP/temp/TeamViewer3/TeamViewer_.exe	upx

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
5c9d9f1d8a9d721dc98cfcf20f62f5b0N
unpack002/$DESKTOP/temp/TeamViewer3/TV.dll
unpack002/$DESKTOP/temp/TeamViewer3/TeamViewer_Host.exe
unpack002/$PLUGINSDIR/GetVersion.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UAC.dll
unpack002/$PLUGINSDIR/UserInfo.dll
unpack002/out.upx

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

5c9d9f1d8a9d721dc98cfcf20f62f5b0N
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$DESKTOP/temp/TeamViewer3/TeamViewer_.exe
.exe windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:5e:dd:8a:71:5c:34:a5:f6:b2:18:a9:3b:3f:83:22:33:f7:63:60
Signer

Actual PE Digest

09:5e:dd:8a:71:5c:34:a5:f6:b2:18:a9:3b:3f:83:22:33:f7:63:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$DESKTOP/temp/TeamViewer3/SAS.exe
.exe windows:4 windows x86 arch:x86

14bdb3629883611a89edd699bc1a5043

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2007, 00:00

Not After

21/02/2008, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

80:09:dd:0c:e6:c3:5e:8b:a9:04:8c:c7:a7:a4:59:d0:19:bc:4d:c4
Signer

Actual PE Digest

80:09:dd:0c:e6:c3:5e:8b:a9:04:8c:c7:a7:a4:59:d0:19:bc:4d:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer\SAS Lib\release\SAS.pdb

Imports

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
I_RpcExceptionFilter
NdrClientCall2

kernel32

FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FreeLibrary
GetProcAddress
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
SetLastError
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$DESKTOP/temp/TeamViewer3/TV.dll
.dll windows:4 windows x86 arch:x86

2fc47df7b965c898518d83f04434b280

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenMutexA
HeapAlloc
LoadLibraryA
HeapFree
FreeLibrary
GetProcAddress
CloseHandle
ReleaseMutex
OutputDebugStringA
CreateMutexA
GetProcessHeap
WaitForSingleObject

user32

SetWindowsHookExA
ClientToScreen
UnionRect
SetRect
GetWindowThreadProcessId
RegisterWindowMessageA
SetRectEmpty
FindWindowA
MapWindowPoints
GetClientRect
FindWindowExA
IsWindowVisible
CallNextHookEx
UnhookWindowsHookEx
GetUpdateRgn
GetDesktopWindow
SetWindowPos
IsWindow
GetWindowRect
PostMessageA
GetWindowDC
ReleaseDC

gdi32

Rectangle
SelectObject
DeleteObject
GetRegionData
GetStockObject
CreatePen
CreateRectRgn

Exports

Exports

GetChangeRect
GetPauseStatus
SetSingleWindow
StartHooks
StopHooks

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sharedv
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 562B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$DESKTOP/temp/TeamViewer3/TeamViewer.exe
.exe windows:4 windows x86 arch:x86

4e1d8fb7632986327fd8e81fe6cfe256

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f0:19:61:d3:c2:71:4e:3f:98:82:5c:ce:c5:e5:e1:b7:28:fa:30:0e
Signer

Actual PE Digest

f0:19:61:d3:c2:71:4e:3f:98:82:5c:ce:c5:e5:e1:b7:28:fa:30:0e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer\TeamViewer\qs_release\TeamViewer.pdb

Imports

comctl32

ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Create
InitCommonControlsEx
ImageList_LoadImageW

crypt32

CryptVerifyMessageSignature
CertGetNameStringA
CertFreeCertificateContext
CertGetNameStringW

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates

iphlpapi

DeleteIPAddress
GetAdapterIndex
GetAdaptersInfo

mpr

WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW

kernel32

SetEvent
CreateEventA
CreateThread
ResumeThread
SetThreadPriority
GetCurrentThread
CreateEventW
GetOverlappedResult
lstrcmpW
VirtualFree
VirtualAlloc
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
GetACP
GetLocaleInfoA
GetThreadLocale
CreateSemaphoreA
ReleaseSemaphore
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetStdHandle
ExitProcess
RtlUnwind
LCMapStringA
GetStringTypeA
GetTimeFormatA
GetDateFormatA
ExitThread
HeapCreate
GetConsoleCP
GetConsoleMode
GetOEMCP
SetHandleCount
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
QueryPerformanceCounter
GetUserDefaultLCID
DeviceIoControl
WritePrivateProfileStringW
GlobalFree
OpenProcess
FileTimeToLocalFileTime
FindNextFileA
CreateFileA
FindFirstFileA
SetUnhandledExceptionFilter
DeleteFileA
InterlockedExchange
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleHandleA
CompareStringA
GetLocalTime
CompareFileTime
SetFileTime
GetFileTime
GetFileType
SetEndOfFile
SetFilePointer
FindClose
SetErrorMode
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ResetEvent
WaitForSingleObject
InterlockedCompareExchange
InterlockedIncrement
ReadFile
GetFileSize
FlushFileBuffers
WriteFile
GetCurrentProcessId
GetModuleFileNameA
ReleaseMutex
LocalFree
InterlockedDecrement
GetCommandLineW
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryA
FreeLibrary
UnmapViewOfFile
Sleep
CloseHandle
MulDiv
SetProcessShutdownParameters
CreateMutexA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetCurrentThreadId
GetTickCount
RaiseException
FlushInstructionCache
GetCurrentProcess
GetLastError
LoadResource
GetSystemTime
LockResource
SizeofResource
IsProcessorFeaturePresent
EnumSystemLocalesA
HeapAlloc
GetProcessHeap
HeapFree
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
SetEnvironmentVariableA
TlsFree

user32

FrameRect
ClientToScreen
GetSystemMenu
GetSysColor
EndDeferWindowPos
BeginDeferWindowPos
GetCapture
GetWindowPlacement
GetMessagePos
SetWindowPlacement
GetNextDlgTabItem
DrawEdge
DestroyAcceleratorTable
SetRectEmpty
FlashWindow
GetDialogBaseUnits
DeferWindowPos
MapDialogRect
SetCapture
ReleaseCapture
GetShellWindow
GetMenu
PostQuitMessage
MessageBoxA
UnhookWindowsHookEx
CallNextHookEx
GetFocus
ToUnicode
GetKeyboardState
ToAscii
GetAsyncKeyState
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetDlgItemTextA
CreateWindowExA
ScreenToClient
GetGUIThreadInfo
DrawFocusRect
CreatePopupMenu
CreateMenu
IsMenu
PtInRect
ChangeClipboardChain
SetClipboardViewer
SendInput
BlockInput
EndDialog
EqualRect
SetThreadDesktop
OpenInputDesktop
GetWindowDC
IntersectRect
GetIconInfo
GetCursorInfo
UnionRect
EnumWindows
CloseDesktop
GetUserObjectInformationW
GetForegroundWindow
GetThreadDesktop
SetRect
GetSystemMetrics
CopyRect
FillRect
ShowScrollBar
AdjustWindowRect
GetDlgCtrlID
DestroyCursor
CharLowerW
SetWindowRgn
DestroyMenu
CheckMenuRadioItem
RemoveMenu
GetSubMenu
EnableMenuItem
CheckMenuItem
TrackPopupMenuEx
KillTimer
SetTimer
InflateRect
CharUpperW
OpenDesktopW
GetMenuStringW
GetMenuItemInfoW
GetWindowThreadProcessId
RegisterWindowMessageW
GetDlgItem
DestroyWindow
SetCursorPos
SetForegroundWindow
GetCursorPos
SetCursor
CreateIconIndirect
GetActiveWindow
BringWindowToTop
GetDesktopWindow
IsWindowVisible
GetClientRect
OffsetRect
GetDC
IsWindow
InvalidateRect
SetParent
SetScrollPos
SetScrollInfo
GetScrollInfo
EndPaint
DestroyIcon
BeginPaint
InvalidateRgn
UpdateWindow
MoveWindow
ScrollWindowEx
ShowWindow
SetFocus
TranslateMessage
RedrawWindow
ReleaseDC
MessageBeep
SetWindowPos
MapWindowPoints
GetParent
GetWindowRect
GetWindow
WindowFromPoint
GetKeyState
UnregisterClassA

gdi32

Ellipse
MoveToEx
ExtEscape
DPtoLP
RoundRect
SetBkMode
StrokeAndFillPath
EndPath
BeginPath
CreateBitmap
GetPixel
GetSystemPaletteEntries
GetDIBits
CreatePen
CreateSolidBrush
Rectangle
CreateRoundRectRgn
GetStockObject
SetDIBitsToDevice
SetStretchBltMode
GetDeviceCaps
SetTextColor
SetBkColor
DeleteDC
DeleteObject
SelectObject
SetPixel
SetViewportOrgEx
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
RealizePalette
SelectPalette
CombineRgn
SetBrushOrgEx
CreateRectRgn
GetObjectType
CreatePalette
CreatePatternBrush
PatBlt
StretchBlt
MaskBlt
LineTo
BitBlt

advapi32

SetSecurityDescriptorDacl
RegCloseKey
CryptDestroyHash
RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
OpenProcessToken
GetUserNameA
CryptGetUserKey
CryptVerifySignatureW
CryptSignHashW
CryptReleaseContext
CryptAcquireContextA
CryptGenKey
CryptGetKeyParam
RegQueryValueExA
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptImportKey
CryptExportKey
CreateProcessAsUserW
SetEntriesInAclW
SetNamedSecurityInfoW
RegOpenKeyW
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
SetTokenInformation
CryptDestroyKey
CryptDecrypt
CryptEncrypt
RegSetValueExA
RegEnumValueW
RegEnumKeyExA
RegEnumValueA
RegDeleteValueA
InitializeSecurityDescriptor

shell32

CommandLineToArgvW
ord680
SHGetSpecialFolderLocation

ole32

CoTaskMemFree
CoTaskMemAlloc
OleInitialize
RegisterDragDrop
CoCreateInstance
RevokeDragDrop
ReleaseStgMedium
CoInitialize
CoUninitialize
CoTaskMemRealloc

oleaut32

VarUI4FromStr

shlwapi

PathCompactPathW
StrToIntW

wsock32

bind
listen
accept
connect
getsockname
getpeername
send
WSAGetLastError
__WSAFDIsSet
recvfrom
select
inet_ntoa
recv
sendto
socket
ntohs
htons
ioctlsocket
htonl
shutdown
WSAStartup
closesocket
WSACleanup
gethostname
inet_addr
gethostbyname
setsockopt

wininet

InternetConnectW
HttpSendRequestA
InternetGoOnlineA
InternetErrorDlg
InternetReadFile
HttpQueryInfoA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetOpenW
InternetSetOptionW
InternetQueryOptionW
InternetCloseHandle

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 316KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 476KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 321KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$DESKTOP/temp/TeamViewer3/TeamViewer.ini
$DESKTOP/temp/TeamViewer3/TeamViewer_Host.exe
.exe windows:4 windows x86 arch:x86

2a4c9f7629b1ebe525727542b794f90f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

crypt32

CertFreeCertificateContext
CryptVerifyMessageSignature
CertGetNameStringA

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

wintrust

WinVerifyTrust

wtsapi32

WTSQuerySessionInformationA
WTSFreeMemory

kernel32

GetModuleFileNameA
CreateProcessA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
FreeLibrary
GetExitCodeProcess
GetCurrentProcess
DisconnectNamedPipe
ReadFile
WaitForSingleObject
DeleteFileA
SetEvent
CreateEventA
GetConsoleCP
SetFilePointer
GetStringTypeW
CreateNamedPipeA
SetCurrentDirectoryA
LocalFree
GetVersionExA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
OpenProcess
GetLastError
CloseHandle
TerminateProcess
Sleep
GetConsoleMode
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
MultiByteToWideChar
CreateFileA
LocalAlloc
SetLastError
ProcessIdToSessionId
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
HeapFree
HeapAlloc
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetProcessHeap
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
LCMapStringW
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSection
InterlockedExchange
GetUserDefaultLCID
GetLocaleInfoA

user32

MessageBoxA
ExitWindowsEx

advapi32

StartServiceCtrlDispatcherA
SetServiceStatus
CreateServiceA
RegDeleteKeyA
CreateProcessAsUserA
RegCreateKeyA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
DuplicateTokenEx
SetTokenInformation
RegOpenKeyExA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

ShellExecuteExA
ShellExecuteA

Sections

.text
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$DESKTOP/temp/TeamViewer3/logo.bmp
$PLUGINSDIR/GetVersion.dll
.dll windows:4 windows x86 arch:x86

add11ce79d4925abda7b305cc53287d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetVersionExA
GetProcAddress
GetModuleHandleA
lstrcmpiA
FreeLibrary
GlobalAlloc
lstrcatA
lstrcpynA

user32

wsprintfA
GetSystemMetrics

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Exports

Exports

IEVersion
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsType
WindowsVersion

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

70dd3dc09a6a9df40b2eeb3eb051c3ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
SetLastError
CloseHandle
GlobalFree
LocalFree
FormatMessageA
MultiByteToWideChar
GetLastError
CreateProcessA
GlobalAlloc
lstrlenA
LoadLibraryA
FreeLibrary
lstrcatA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiA
lstrcpyA
GetVersionExA
GetCurrentProcess
GetCurrentThread
GetCurrentProcessId
Sleep
CreateThread
GetStartupInfoA
GetCommandLineA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetModuleHandleA

user32

EnableWindow
GetWindowLongA
DestroyWindow
LoadImageA
SetWindowLongA
EndDialog
MessageBoxA
SendMessageW
DialogBoxParamA
CharNextA
SendMessageTimeoutA
DefWindowProcA
PostQuitMessage
SetForegroundWindow
DispatchMessageA
GetMessageA
CreateWindowExA
RegisterClassA
UnregisterClassA
PostMessageA
IsWindow
ShowWindow
SetWindowTextA
wsprintfA
GetDlgItem
LoadStringA
SendMessageA

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteExA

ole32

CoInitialize
CoUninitialize

Exports

Exports

Exec
ExecCodeSegment
ExecWait
GetElevationType
IsAdmin
RunElevated
ShellExec
ShellExecWait
SupportsUAC
Unload

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

6bc108eed3ca99f68adee56e9c99fac6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynA
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 657B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 85B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 108KB

.ndata Size: - Virtual size: 32KB

.rsrc Size: 24KB - Virtual size: 23KB

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate

Extended Key Usages

Key Usages

09:5e:dd:8a:71:5c:34:a5:f6:b2:18:a9:3b:3f:83:22:33:f7:63:60Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 180KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 2KB - Virtual size: 4KB

14bdb3629883611a89edd699bc1a5043

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5Certificate

Extended Key Usages

Key Usages

80:09:dd:0c:e6:c3:5e:8b:a9:04:8c:c7:a7:a4:59:d0:19:bc:4d:c4Signer

Headers

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 388B

2fc47df7b965c898518d83f04434b280

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 36B

.sharedv Size: 512B - Virtual size: 64B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 562B

4e1d8fb7632986327fd8e81fe6cfe256

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 108KB

.ndata
Size: - Virtual size: 32KB

.rsrc
Size: 24KB - Virtual size: 23KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

09:5e:dd:8a:71:5c:34:a5:f6:b2:18:a9:3b:3f:83:22:33:f7:63:60
Signer

UPX0
Size: - Virtual size: 180KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5
Certificate

80:09:dd:0c:e6:c3:5e:8b:a9:04:8c:c7:a7:a4:59:d0:19:bc:4d:c4
Signer

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 388B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 36B

.sharedv
Size: 512B - Virtual size: 64B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 562B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

f0:19:61:d3:c2:71:4e:3f:98:82:5c:ce:c5:e5:e1:b7:28:fa:30:0e
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 316KB - Virtual size: 315KB

.data
Size: 148KB - Virtual size: 476KB

.rsrc
Size: 321KB - Virtual size: 321KB

.text
Size: 128KB - Virtual size: 125KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 952B

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 180B

.reloc
Size: 512B - Virtual size: 368B