dbd02bf6f3c2b92854f4a19e875e967e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dbd02bf6f3c2b92854f4a19e875e967e_JaffaCakes118
Size

873KB
MD5

dbd02bf6f3c2b92854f4a19e875e967e
SHA1

0fe0afece3be2d3ce5600b46a23dd95f21c95c66
SHA256

a463dbb74cead827a9a961a346f3118efaa0d2e882b18aa8c6fca9c2f167d69e
SHA512

67a5f0b14967efcb5b6d67530ecdc81e4875e3ea4c7c1403342c41b40efe0d896328d6e31c20e7ab40bc837f1e0f476194718febecae1b0fc7420927157c4226
SSDEEP

12288:XQNl9Q1/UrblY+FqFlaaTFTWyGai0Kxc9WvtOyg0/GHxJoSUgyMjiqrq+oenYR48:mk1iIa4FTvi04y0sXoS5N+qrhPj8

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/EasyEchosSupport.dll	acprotect
static1/unpack001/Plugins/AddrBook.dll	acprotect
static1/unpack001/Plugins/Jam2Pocket.dll	acprotect
static1/unpack001/Plugins/Jam2mGFE.dll	acprotect
static1/unpack001/rdbBase.dll	acprotect

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/EasyEchosSupport.dll	upx
static1/unpack001/Plugins/AddrBook.dll	upx
static1/unpack001/Plugins/Jam2Pocket.dll	upx
static1/unpack001/Plugins/Jam2mGFE.dll	upx
static1/unpack001/gfe.exe	upx
static1/unpack001/rdbBase.dll	upx

Unsigned PE 18 IoCs

Checks for missing Authenticode signature.

resource
unpack001/EasyEchosSupport.dll
unpack002/out.upx
unpack001/FmaVC6d.dll
unpack001/Plugins/AddrBook.dll
unpack003/out.upx
unpack001/Plugins/Jam2Pocket.dll
unpack004/out.upx
unpack001/Plugins/Jam2mGFE.dll
unpack005/out.upx
unpack001/Plugins/SamplePlugin.src/SamplePlugin.dll
unpack001/Regsvr32.exe
unpack001/Subclass.oca
unpack001/Subclass.ocx
unpack001/gfe.exe
unpack006/out.upx
unpack001/msvcr71d.dll
unpack001/rdbBase.dll
unpack007/out.upx

Files

dbd02bf6f3c2b92854f4a19e875e967e_JaffaCakes118
.rar
!!!Update!!!.txt
City.txt
EasyEchosSupport.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FmaVC6d.dll
.dll windows:4 windows x86 arch:x86

69dd2a1985410e205371281a5357716b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\CPP\fma_toolkit\lib\w32\FmaVC6d.pdb

Imports

kernel32

InitializeCriticalSection
TlsAlloc
TlsFree
DeleteCriticalSection
TlsSetValue
TlsGetValue
OutputDebugStringA
FindClose
GetLastError
FindNextFileA
FindFirstFileA
GetFileAttributesA
GetLocalTime
Sleep
LeaveCriticalSection
GetSystemTime
EnterCriticalSection
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls

msvcr71d

strncpy
atoi
memset
strchr
memcpy
fclose
strlen
fputs
_iob
strcpy
fopen
getenv
malloc
free
realloc
_errno
time
bsearch
memmove
qsort
strcat
memcmp
memchr
strrchr
_free_dbg
_initterm
_malloc_dbg
_adjust_fdiv
__CppXcptFilter
_except_handler3
__dllonexit
_onexit
fflush
_sopen
_close
_tell
_lseek
_filelength
_chsize
_read
_write
_locking
_unlink
_mkdir

Exports

Exports

FmaAddAutoMSGID
FmaAddAutoPID
FmaAddAutoProp
FmaAddDsz
FmaAddDszFormat
FmaAddDszFormatV
FmaAddFmp
FmaAddFmpFormat
FmaAddFmpFormatV
FmaAddLsz
FmaAllocString
FmaAsciiToDttm
FmaAssert
FmaAssertV
FmaCheckDttm
FmaCloseArea
FmaCloseFile
FmaCloseMsg
FmaCpyStrMax
FmaCreateMsg
FmaCreateMsgMap
FmaDelDsz
FmaDelFmp
FmaDelLsz
FmaDelLszList
FmaDeleteFile
FmaDeleteMsg
FmaDestroyMsg
FmaDirExists
FmaDumpFmp
FmaDumpMsg
FmaDupeMsg
FmaEnumFiles
FmaEnumMsgs
FmaEqPch
FmaEqPsz
FmaFileExists
FmaFixDsz
FmaFormat
FmaFormatDttm
FmaFormatNetAddr
FmaFormatV
FmaGetAttrFromFlag
FmaGetCrc32
FmaGetCurMsg
FmaGetDttmFromTime
FmaGetEomKludgeFromId
FmaGetEomKludgeFromString
FmaGetFilePos
FmaGetFileSize
FmaGetFirstMsg
FmaGetFlagFromAttr
FmaGetFmp
FmaGetFmpTextLen
FmaGetHash
FmaGetHighMsg
FmaGetKludgeFromId
FmaGetKludgeFromString
FmaGetLRInfo
FmaGetLastError
FmaGetLocalDttm
FmaGetLocalTime
FmaGetLsz
FmaGetMsgCount
FmaGetMsgCtrlLen
FmaGetMsgIdStamp
FmaGetMsgTextLen
FmaGetNetAddr
FmaGetTimeFromDttm
FmaGetVersion
FmaGiveOutTimeSlice
FmaInitialize
FmaInterlockedDecrement
FmaInterlockedIncrement
FmaListAdd
FmaListCount
FmaListDel
FmaLoadAddrKludges
FmaLoadEomKludges
FmaLoadFLAGS
FmaLoadKludge
FmaLoadMhdr
FmaLoadMsg
FmaLock
FmaLockArea
FmaLog
FmaLogV
FmaMakeDir
FmaMemAlloc
FmaMemFree
FmaMemRealloc
FmaMsgnToUid
FmaOpenArea
FmaOpenFile
FmaOpenMsg
FmaQueryOSType
FmaReadFile
FmaReadMsg
FmaRegisterApi
FmaSaveAddrKludges
FmaSaveEomKludges
FmaSaveKludge
FmaSaveMhdr
FmaSaveMsg
FmaScanNetAddr
FmaSetCurMsg
FmaSetDsz
FmaSetDszFormat
FmaSetDszFormatV
FmaSetFilePos
FmaSetFileSize
FmaSetLRInfo
FmaSetLastError
FmaSkipSpaces
FmaSleep
FmaTerminate
FmaTrimSpaces
FmaUidToMsgn
FmaValidateMsg
FmaWriteFile
FmaWriteMsg
FtsAddMsg
FtsCheckArea
FtsCheckBase
FtsCheckMsg
FtsCloseArea
FtsCloseMsg
FtsCreateMsgMap
FtsDeleteMsg
FtsEnumMsgs
FtsGetApi
FtsGetCurMsg
FtsGetFirstMsg
FtsGetFlr
FtsGetHighMsg
FtsGetLRInfo
FtsGetMsgCount
FtsGetMsgCtrlLen
FtsGetMsgTextLen
FtsLoadMsg
FtsLockArea
FtsMsgnToUid
FtsOpenArea
FtsOpenMsg
FtsReadMsg
FtsRescanArea
FtsSaveMsg
FtsSetCurMsg
FtsSetFlr
FtsSetLRInfo
FtsSortMsgMap
FtsUidToMsgn
FtsValidateMsg
FtsWriteMsg
JamAddJdx
JamAddJsf
JamAddJsfFormat
JamAddJsfFormatV
JamBeginJdxCache
JamCheckArea
JamCheckBase
JamCheckJbh
JamCheckLmh
JamCheckMsg
JamCheckMsgReadMode
JamCheckMsgWriteMode
JamCheckPassword
JamCloseArea
JamCloseMsg
JamCreateMsgMap
JamDelJdx
JamDelJsf
JamDeleteMsg
JamEndJdxCache
JamEnterExclusive
JamEnumMsgs
JamGetApi
JamGetCrc32
JamGetCurMsg
JamGetFirstMsg
JamGetHighMsg
JamGetJdx
JamGetJdxCount
JamGetJlr
JamGetJsf
JamGetLRInfo
JamGetMsgCount
JamGetMsgCtrlLen
JamGetMsgTextLen
JamGetOpenMsg
JamLeaveExclusive
JamLoadJbh
JamLoadJmh
JamLoadMsg
JamLockArea
JamLockBase
JamMsgnToUid
JamOpenArea
JamOpenMsg
JamReadMsg
JamResetCurMsgCache
JamSaveJbh
JamSaveJmh
JamSaveMsg
JamSetCurMsg
JamSetCurMsgCache
JamSetJdx
JamSetJlr
JamSetLRInfo
JamSetPassword
JamUidToMsgn
JamValidateMsg
JamWriteMsg
PktAddMsg
PktCheckArea
PktCheckBase
PktCheckMsg
PktCheckMsgReadMode
PktCheckMsgWriteMode
PktCheckPassword
PktCheckPbh
PktCloseArea
PktCloseMsg
PktCreateMsgMap
PktDelMsg
PktDeleteMsg
PktEnterExclusive
PktEnumMsgs
PktExpandPkt
PktGetApi
PktGetCurMsg
PktGetFirstMsg
PktGetHighMsg
PktGetLRInfo
PktGetMsgCount
PktGetMsgCtrlLen
PktGetMsgTextLen
PktGetNetAddr
PktGetOpenMsg
PktLeaveExclusive
PktLoadMsg
PktLoadPbh
PktLoadPmh
PktLockArea
PktLockBase
PktMsgnToUid
PktOpenArea
PktOpenMsg
PktReadMsg
PktRescanArea
PktResetCurMsgCache
PktSaveMsg
PktSavePbh
PktSavePmh
PktSetCurMsg
PktSetCurMsgCache
PktSetEnd
PktSetLRInfo
PktSetNetAddr
PktSetPassword
PktShrinkPkt
PktUidToMsgn
PktValidateMsg
PktWriteMsg
SquAddFrame
SquAddFree
SquAddSqi
SquAddUsed
SquAppSqi
SquBeginSqiCache
SquCheckArea
SquCheckBase
SquCheckFree
SquCheckMsg
SquCheckMsgReadMode
SquCheckMsgWriteMode
SquCheckSbh
SquCheckUsed
SquCloseArea
SquCloseMsg
SquCreateMsgMap
SquDelFree
SquDelMsg
SquDelSqi
SquDelUsed
SquDeleteMsg
SquEndSqiCache
SquEnterExclusive
SquEnumMsgs
SquFindFree
SquGetApi
SquGetCurMsg
SquGetFirstMsg
SquGetFrame
SquGetHash
SquGetHighMsg
SquGetLRInfo
SquGetMsgCount
SquGetMsgCtrlLen
SquGetMsgTextLen
SquGetOpenMsg
SquGetSafeMsgCtrlLen
SquGetSlr
SquGetSqi
SquGetSqiCount
SquLeaveExclusive
SquLoadMsg
SquLoadSbh
SquLoadSfh
SquLoadSmh
SquLockArea
SquLockBase
SquMsgnToUid
SquOpenArea
SquOpenMsg
SquReadMsg
SquResetCurMsgCache
SquSaveMsg
SquSaveSbh
SquSaveSfh
SquSaveSmh
SquSetBaseTrimming
SquSetCurMsg
SquSetCurMsgCache
SquSetLRInfo
SquSetNextFrame
SquSetPrevFrame
SquSetSlr
SquSetSqi
SquTrimBase
SquUidToMsgn
SquValidateMsg
SquWriteMsg
fmaInit

Sections

.text
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FmaVC6d.pdb
License.rus.txt
Origin.txt
Plugins/AddrBook.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Jam2Pocket.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 42KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Jam2mGFE.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/SamplePlugin.src/CVS/Entries
Plugins/SamplePlugin.src/CVS/Entries.Extra
Plugins/SamplePlugin.src/CVS/Entries.Extra.Old
Plugins/SamplePlugin.src/CVS/Entries.Old
Plugins/SamplePlugin.src/CVS/Repository
Plugins/SamplePlugin.src/CVS/Root
Plugins/SamplePlugin.src/SamplePlugin.RES
Plugins/SamplePlugin.src/SamplePlugin.dll
.dll regsvr32 windows:4 windows x86 arch:x86

01ff909878e01672beb0a056e8c7c953

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaAptOffset
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaExitProc
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord305
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
ord311
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord313
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord101
ord102
ord103
ord104
ord105
__vbaStrToAnsi
__vbaVarDup
_CIatan
__vbaStrMove
__vbaCastObj
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/SamplePlugin.src/SamplePlugin.exp
Plugins/SamplePlugin.src/SamplePlugin.lib
Plugins/SamplePlugin.src/SamplePlugin.vbp
Plugins/SamplePlugin.src/SamplePlugin.vbw
Plugins/SamplePlugin.src/clsPlugin.cls
.vbs
Plugins/SamplePlugin.src/del.ico
ReadMe.txt
Regsvr32.exe
.exe windows:4 windows x86 arch:x86

abc690d7b75415bdb09805120d1c7358

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

OleInitialize
OleUninitialize

kernel32

GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
lstrlenA
lstrcpyA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExA
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
GetCPInfo
GetACP
GetOEMCP
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
GetStringTypeA
VirtualAlloc
WideCharToMultiByte
SetHandleCount
GetFileType
GetStdHandle
HeapDestroy
HeapCreate
VirtualFree
WriteFile
HeapAlloc
SetFilePointer
HeapFree
LoadLibraryA
FlushFileBuffers
SetStdHandle
CloseHandle
LCMapStringA
LCMapStringW

user32

wsprintfA
LoadStringA
MessageBoxA

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RestoreGfeSettings.Vbs
.vbs
SaveGfeSettings.Vbs
.vbs
Subclass.oca
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Subclass.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

2b65084eb2641ff9a3133e55fb30f293

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm50

__vbaStrI2
_CIcos
_adj_fptan
__vbaFreeVarList
_adj_fdiv_m64
__vbaRaiseEvent
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
DllFunctionCall
__vbaRedimPreserve
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFailedFriend
__vbaFPException
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord101
ord102
ord103
ord104
ord105
__vbaVarDup
_CIatan
__vbaStrMove
__vbaCastObj
ord650
_allmul
_CItan
_CIexp
__vbaRecAssign
__vbaFreeStr
__vbaFreeObj

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WhatsNew.txt
addr.db
color_shemes.reg
fix.txt
gfe.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 956KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 330KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
gfe.tpl
hacks.txt
msvcr71d.dll
.dll windows:4 windows x86 arch:x86

617ffa4bf4305570d1ee34fdca9f490d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr71d.pdb

Imports

kernel32

GetModuleFileNameA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
ExitProcess
GetProcAddress
GetModuleHandleA
WriteFile
GetStdHandle
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
ResumeThread
GetLastError
CreateThread
ExitThread
CloseHandle
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SetLastError
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetHandleCount
GetFileType
GetStartupInfoA
GetACP
GetOEMCP
GetCPInfo
IsBadReadPtr
HeapValidate
RtlUnwind
LoadLibraryA
DebugBreak
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
MultiByteToWideChar
GetCommandLineW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
InitializeCriticalSection
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
VirtualQuery
InterlockedExchange
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEnvironmentVariableA
SetEnvironmentVariableW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
VirtualProtect
GetSystemInfo
FlushFileBuffers
SetFilePointer
SetStdHandle
CompareStringA
CompareStringW
Sleep
Beep
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
RaiseException
SetUnhandledExceptionFilter
IsBadCodePtr
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
CreateProcessA
CreateProcessW
HeapCompact
HeapWalk
ReadConsoleA
SetConsoleMode
GetConsoleMode
IsDBCSLeadByteEx
GetConsoleCP
ReadConsoleW
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
LockFile
UnlockFile
CreateFileA
CreatePipe
ReadFile
CreateFileW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
SetLocalTime

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@@QAE@ABV0@@Z
??0__non_rtti_object@@QAE@PBD@Z
??0bad_cast@@AAE@PBQBD@Z
??0bad_cast@@QAE@ABQBD@Z
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??0bad_typeid@@QAE@ABV0@@Z
??0bad_typeid@@QAE@PBD@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1__non_rtti_object@@UAE@XZ
??1bad_cast@@UAE@XZ
??1bad_typeid@@UAE@XZ
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4__non_rtti_object@@QAEAAV0@ABV0@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
??4bad_typeid@@QAEAAV0@ABV0@@Z
??4exception@@QAEAAV0@ABV0@@Z
??8type_info@@QBEHABV0@@Z
??9type_info@@QBEHABV0@@Z
??_7__non_rtti_object@@6B@
??_7bad_cast@@6B@
??_7bad_typeid@@6B@
??_7exception@@6B@
??_Fbad_cast@@QAEXXZ
??_Fbad_typeid@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDXZ
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPAGIPBGPAD@Z
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CrtCheckMemory
_CrtDbgBreak
_CrtDbgReport
_CrtDoForAllClientObjects
_CrtDumpMemoryLeaks
_CrtIsMemoryBlock
_CrtIsValidHeapPointer
_CrtIsValidPointer
_CrtMemCheckpoint
_CrtMemDifference
_CrtMemDumpAllObjectsSince
_CrtMemDumpStatistics
_CrtReportBlockType
_CrtSetAllocHook
_CrtSetBreakAlloc
_CrtSetDbgBlockType
_CrtSetDbgFlag
_CrtSetDumpClient
_CrtSetReportFile
_CrtSetReportHook
_CrtSetReportHook2
_CrtSetReportMode
_CxxThrowException
_EH_prolog
_Getdays
_Getmonths
_Gettnames
_HUGE
_Strftime
_XcptFilter
__CppXcptFilter
__CxxCallUnwindDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__buffer_overrun
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__dllonexit
__doserrno
__fpecode
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv_init
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__crtAssertBusy
__p__crtBreakAlloc
__p__crtDbgFlag
__p__daylight
__p__dstbias
__p__environ
__p__fileinfo
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__security_error_handler
__set_app_type
__set_buffer_overrun_handler
__setlc_active
__setusermatherr
__threadhandle
__threadid
__toascii
__unDName
__unDNameEx
__uncaught_exception
__unguarded_readlc_active
__wargv
__wcserror
__wgetmainargs
__winitenv
_abnormal_termination
_access
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_free_dbg
_aligned_malloc
_aligned_malloc_dbg
_aligned_offset_malloc
_aligned_offset_malloc_dbg
_aligned_offset_realloc
_aligned_offset_realloc_dbg
_aligned_realloc
_aligned_realloc_dbg
_amsg_exit
_assert
_atodbl
_atoi64
_atoldbl
_beep
_beginthread
_beginthreadex
_c_exit
_cabs
_callnewh
_calloc_dbg
_cexit
_cgets
_cgetws
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chvalidator
_clearfp
_close
_commit
_commode
_control87
_controlfp
_copysign
_cprintf
_cputs
_cputws
_creat
_crtAssertBusy
_crtBreakAlloc
_crtDbgFlag
_cscanf
_ctime64
_cwait
_cwprintf
_cwscanf
_daylight
_dstbias
_dup
_dup2
_ecvt
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_expand_dbg
_fcloseall
_fcvt
_fdopen
_fgetchar
_fgetwchar
_filbuf
_fileinfo
_filelength
_filelengthi64
_fileno
_findclose
_findfirst
_findfirst64
_findfirsti64
_findnext
_findnext64
_findnexti64
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fputchar
_fputwchar
_free_dbg
_fsopen
_fstat
_fstat64
_fstati64
_ftime
_ftime64
_ftol
_fullpath
_futime
_futime64
_gcvt
_get_heap_handle
_get_osfhandle
_get_sbh_threshold
_getch
_getche
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getwch
_getwche
_getws
_global_unwind2
_gmtime64
_heapadd
_heapchk
_heapmin
_heapset
_heapused
_heapwalk
_hypot
_i64toa
_i64tow
_initterm
_inp
_inpd
_inpw
_iob
_isatty
_isctype
_ismbbalnum
_ismbbalpha
_ismbbgraph
_ismbbkalnum
_ismbbkana
_ismbbkprint
_ismbbkpunct
_ismbblead
_ismbbprint
_ismbbpunct
_ismbbtrail
_ismbcalnum
_ismbcalpha
_ismbcdigit
_ismbcgraph
_ismbchira
_ismbckata
_ismbcl0
_ismbcl1
_ismbcl2
_ismbclegal
_ismbclower
_ismbcprint
_ismbcpunct
_ismbcspace
_ismbcsymbol
_ismbcupper
_ismbslead
_ismbstrail
_isnan
_itoa
_itow
_j0
_j1
_jn
_kbhit
_lfind
_loaddll
_local_unwind2
_localtime64
_lock
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lseek
_lseeki64
_ltoa
_ltow
_makepath
_malloc_dbg
_mbbtombc
_mbbtype
_mbcasemap
_mbccpy
_mbcjistojms
_mbcjmstojis
_mbclen
_mbctohira
_mbctokata
_mbctolower
_mbctombb
_mbctoupper
_mbctype
_mbsbtype
_mbscat
_mbschr
_mbscmp
_mbscoll
_mbscpy
_mbscspn
_mbsdec
_mbsdup
_mbsicmp
_mbsicoll
_mbsinc
_mbslen
_mbslwr
_mbsnbcat
_mbsnbcmp
_mbsnbcnt
_mbsnbcoll
_mbsnbcpy
_mbsnbicmp
_mbsnbicoll
_mbsnbset
_mbsncat
_mbsnccnt
_mbsncmp
_mbsncoll
_mbsncpy
_mbsnextc
_mbsnicmp
_mbsnicoll
_mbsninc
_mbsnset
_mbspbrk
_mbsrchr
_mbsrev
_mbsset
_mbsspn
_mbsspnp
_mbsstr
_mbstok
_mbstrlen
_mbsupr
_memccpy
_memicmp
_mkdir
_mktemp
_mktime64
_msize
_msize_dbg
_nextafter
_onexit
_open
_open_osfhandle
_osplatform
_osver
_outp
_outpd
_outpw
_pclose
_pctype
_pgmptr
_pipe
_popen
_purecall
_putch
_putenv
_putw
_putwch
_putws

Sections

.text
Size: 408KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
rdbBase.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
smilez/angel.gif
.gif
smilez/angry.gif
.gif
smilez/biggrin.gif
.gif
smilez/chmok.gif
.gif
smilez/clown.gif
.gif
smilez/confused.gif
.gif
smilez/cool.gif
.gif
smilez/copy.gif
.gif
smilez/cry.gif
.gif
smilez/dead.gif
.gif
smilez/defsmile.txt
smilez/devil.gif
.gif
smilez/dezl.gif
.gif
smilez/drug.gif
.gif
smilez/frown.gif
.gif
smilez/hi.gif
.gif
smilez/lol.gif
.gif
smilez/oh.gif
.gif
smilez/pivo.gif
.gif
smilez/smile.gif
.gif
smilez/tnx.gif
.gif
smilez/tongue.gif
.gif
smilez/wink.gif
.gif

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 72KB

UPX1 Size: 23KB - Virtual size: 24KB

.rsrc Size: 6KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 64KB - Virtual size: 62KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 8KB - Virtual size: 6KB

69dd2a1985410e205371281a5357716b

Headers

File Characteristics

PDB Paths

Imports

kernel32

msvcr71d

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 137KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 8KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 7KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 96KB

UPX1 Size: 37KB - Virtual size: 40KB

.rsrc Size: 11KB - Virtual size: 12KB

Headers

File Characteristics

Sections

.text Size: 96KB - Virtual size: 95KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 6KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 132KB

UPX1 Size: 42KB - Virtual size: 44KB

.rsrc Size: 6KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 132KB - Virtual size: 129KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 16KB - Virtual size: 12KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 104KB

UPX1 Size: 30KB - Virtual size: 32KB

.rsrc Size: 7KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 96KB - Virtual size: 94KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 12KB - Virtual size: 8KB

01ff909878e01672beb0a056e8c7c953

UPX0
Size: - Virtual size: 72KB

UPX1
Size: 23KB - Virtual size: 24KB

.rsrc
Size: 6KB - Virtual size: 8KB

.text
Size: 64KB - Virtual size: 62KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 140KB - Virtual size: 137KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 8KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 7KB

UPX0
Size: - Virtual size: 96KB

UPX1
Size: 37KB - Virtual size: 40KB

.rsrc
Size: 11KB - Virtual size: 12KB

.text
Size: 96KB - Virtual size: 95KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 6KB

UPX0
Size: - Virtual size: 132KB

UPX1
Size: 42KB - Virtual size: 44KB

.rsrc
Size: 6KB - Virtual size: 8KB

.text
Size: 132KB - Virtual size: 129KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 16KB - Virtual size: 12KB

UPX0
Size: - Virtual size: 104KB

UPX1
Size: 30KB - Virtual size: 32KB

.rsrc
Size: 7KB - Virtual size: 8KB

.text
Size: 96KB - Virtual size: 94KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 12KB - Virtual size: 8KB

.text
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 848B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 1024B - Virtual size: 832B

.data
Size: 5KB - Virtual size: 9KB

.idata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 512B - Virtual size: 4KB

.bss
Size: - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 8KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size:

.text
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 1KB - Virtual size: 1KB

UPX0
Size: - Virtual size: 956KB

UPX1
Size: 330KB - Virtual size: 332KB

.rsrc
Size: 6KB - Virtual size: 8KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 4KB - Virtual size: 31KB

.rsrc
Size: 8KB - Virtual size: 5KB