2fa5bd8c33d85d06716b95f183744e61_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2fa5bd8c33d85d06716b95f183744e61_JaffaCakes118
Size

502KB
MD5

2fa5bd8c33d85d06716b95f183744e61
SHA1

95eb640bf8b1f885af35c026118f7d44aab0bcb4
SHA256

35ae6848c61a63e3087e41f0f26dec377f80d2348385d83318dc87299d253b2d
SHA512

38772447484fed579ed0f124a79a3539a1d19ae007584f91b7a86a948e5f9bce21c2f5843e7be6e9d709c1ad8d23bb79a935fad2cbe8dabbfc7be50f5cbcd93f
SSDEEP

12288:WGeC05T/BEF4mxBr4brIlScSHomRM2uPy+mkSdST6HTPMRn5:8CaT/BDi+N7ZuP5v6HUn5

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
2fa5bd8c33d85d06716b95f183744e61_JaffaCakes118
unpack001//tbu04648/tbhelper.dll
unpack001//tbu04648/urlfreeze.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

2fa5bd8c33d85d06716b95f183744e61_JaffaCakes118
.exe windows:4 windows x86 arch:x86

81c812ed76d4690c8678b3a4f0737a5f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_Create
ord17
ImageList_AddMasked
ImageList_Destroy

kernel32

GetExitCodeProcess
WaitForSingleObject
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
FindNextFileA
DeleteFileA
FindFirstFileA
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
CopyFileA
SetErrorMode
lstrcpynA
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
EnterCriticalSection
Sleep
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GlobalFree
GetModuleHandleA
LoadLibraryA
CreateThread
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
ExitProcess

user32

CreateDialogParamA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
SetFocus
ScreenToClient
GetWindowRect
GetWindowLongA
SetClassLongA
IsWindowEnabled
SetWindowPos
LoadCursorA
SetCursor
GetDlgItemTextA
MapWindowPoints
GetMessagePos
LoadBitmapA
CallWindowProcA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
MessageBoxA
CharPrevA
DestroyWindow
SetTimer
SetForegroundWindow
ShowWindow
CharNextA
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
GetSysColor
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
ExitWindowsEx
PostQuitMessage
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
GetWindowTextA
DrawTextA
EndPaint
InvalidateRect

gdi32

SetBkColor
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateSolidBrush
CreateFontA
SetBkMode
SetTextColor
CreateBrushIndirect
SelectObject

advapi32

RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey

shell32

ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/tbu04648/basis.xml
.xml
/tbu04648/icons.bmp
/tbu04648/tbhelper.dll
.dll regsvr32 windows:4 windows x86 arch:x86

2c6a8b47468e1f5d9d782c5c83189d4b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\Softomate\Toolbar3\Release_bin\tbhelper.pdb

Imports

shlwapi

PathFindExtensionA
PathFileExistsA

wininet

InternetOpenUrlA
HttpQueryInfoA
InternetCloseHandle
InternetReadFile
InternetOpenA

rpcrt4

UuidFromStringA

urlmon

URLDownloadToFileA

kernel32

Sleep
CreateThread
CloseHandle
TerminateThread
WriteFile
CreateFileA
GetLastError
DeleteFileA
InterlockedIncrement
InterlockedDecrement
lstrlenA
IsBadStringPtrA
FindResourceA
DeleteCriticalSection
RaiseException
MultiByteToWideChar
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
DisableThreadLibraryCalls
SetEndOfFile
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
lstrcatA
lstrcpyA
GlobalUnlock
GlobalLock
LCMapStringW
LCMapStringA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetFilePointer
GetProcessHeap
FreeEnvironmentStringsA
EnterCriticalSection
OpenEventA
GetDateFormatA
GetTimeFormatA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
GetFileType
SetHandleCount
ReadFile
SetConsoleCtrlHandler
GetCPInfo
GetOEMCP
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
VirtualFree
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapAlloc
LocalFree
GetCurrentProcessId
SetEvent
FatalAppExitA
lstrcpyW
OutputDebugStringA
OutputDebugStringW
lstrcpynW
WaitForSingleObject
GetCurrentThreadId
VirtualAlloc
UnmapViewOfFile
IsBadReadPtr
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetCurrentThread
GetVersion
OpenFileMappingA
GetModuleFileNameW
RtlUnwind
ExitProcess
IsBadWritePtr
HeapValidate
GetSystemTimeAsFileTime
DebugBreak
GetStdHandle
GetProcAddress
LoadLibraryA
VirtualProtect
VirtualQuery
GetCommandLineA
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SetLastError
QueryPerformanceCounter
GetTickCount
GetEnvironmentStrings

user32

DispatchMessageW
DispatchMessageA
MsgWaitForMultipleObjects
CharLowerBuffA
TranslateMessage
GetClipboardData
CloseClipboard
CharNextA
UnregisterClassA
LoadStringA
PeekMessageA
IsWindowUnicode
GetMessageA
OpenClipboard
GetMessageW

advapi32

RegSetValueExA
RegEnumKeyExA
RegCreateKeyExA
OpenThreadToken
RevertToSelf
SetThreadToken
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA

ole32

CreateStreamOnHGlobal
CoInitialize
CLSIDFromProgID
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoReleaseMarshalData
CoMarshalInterface
CoUnmarshalInterface
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
StringFromGUID2

oleaut32

VariantCopy
VarBstrCmp
UnRegisterTypeLi
RegisterTypeLi
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
VariantInit
SysAllocStringLen
SysFreeString
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo

Exports

Exports

CreateHelperObject
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IsUnicode

Sections

.text
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu04648/urlfreeze-header.bmp
/tbu04648/urlfreeze.crc
/tbu04648/urlfreeze.dll
.dll regsvr32 windows:4 windows x86 arch:x86

f7982c3b635664619202a6a80cfe4238

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\Softomate\Toolbar3\Release_bin\tbcore3.pdb

Imports

wininet

FindNextUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA

shlwapi

PathFileExistsA
PathFindExtensionA
PathRemoveFileSpecA

winmm

PlaySoundA

setupapi

SetupIterateCabinetA

dbghelp

SymGetModuleBase
SymGetSymFromAddr
StackWalk
SymFunctionTableAccess
SymGetLineFromAddr
SymSetOptions
SymGetOptions
SymCleanup
SymInitialize
SymLoadModule

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
SetLastError
GetLastError
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetCurrentThreadId
RaiseException
InterlockedDecrement
InterlockedIncrement
lstrlenA
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetCurrentThread
CloseHandle
HeapFree
WideCharToMultiByte
CreateDirectoryA
GetTempPathA
SetCurrentDirectoryA
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalAlloc
DebugBreak
lstrlenW
lstrcmpA
MulDiv
GetModuleFileNameA
IsBadCodePtr
SetUnhandledExceptionFilter
IsBadWritePtr
GetCurrentProcessId
GetVersionExA
FormatMessageA
IsBadReadPtr
ReadProcessMemory
CreateFileA
OpenProcess
WinExec
VerLanguageNameA
RemoveDirectoryA
MoveFileExA
DeleteFileA
WriteFile
CopyFileA
MoveFileA
GetTempFileNameA
lstrcpyA
FreeLibrary
lstrcatA
FindFirstFileA
FindNextFileA
FindClose
GlobalFree
Sleep
GetTickCount
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
IsDBCSLeadByte
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
TerminateProcess
ReadFile
GetCurrentDirectoryA
SetEnvironmentVariableA
CreateThread
ResumeThread
ExitThread
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
RtlUnwind
ExitProcess
LocalFree
LocalAlloc
GetStartupInfoA
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetStdHandle
FlushFileBuffers
SetConsoleCtrlHandler
GetFullPathNameA
GetSystemTimeAsFileTime
SetEndOfFile
GetLocaleInfoW
GetCommandLineA
QueryPerformanceCounter
GetOEMCP
GetCPInfo
CompareStringA
CompareStringW
lstrcpynA
TlsFree
TlsSetValue
TlsGetValue
FatalAppExitA
HeapDestroy
HeapCreate
VirtualFree
HeapSize
GetStringTypeA
GetStringTypeW
GetFileType
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
GetDriveTypeA
GetTimeZoneInformation
SetHandleCount
GetStdHandle
TlsAlloc

user32

GetMenuItemInfoA
OffsetRect
ClientToScreen
MapWindowPoints
GetAsyncKeyState
SetWindowRgn
InflateRect
IsWindowEnabled
SystemParametersInfoA
GetCapture
GetDlgCtrlID
AdjustWindowRectEx
GetMenu
DrawFocusRect
DrawEdge
CopyRect
KillTimer
UpdateWindow
LoadImageA
SetWindowsHookExA
TrackPopupMenu
UnhookWindowsHookEx
EndMenu
CharLowerA
RegisterHotKey
UnregisterHotKey
GetSystemMetrics
DialogBoxIndirectParamA
IsWindowVisible
WindowFromPoint
CallNextHookEx
SetCursor
ScreenToClient
PtInRect
GetKeyState
DestroyCursor
SetDlgItemTextA
IsDlgButtonChecked
CheckDlgButton
EndDialog
SetActiveWindow
GetWindowRect
TranslateMessage
DispatchMessageA
EnableMenuItem
CharUpperA
LoadMenuA
GetSubMenu
InsertMenuA
PeekMessageA
GetMessagePos
DialogBoxParamA
GetActiveWindow
SetLastErrorEx
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
CreateAcceleratorTableA
GetDC
ReleaseDC
GetDesktopWindow
GetClassNameA
SetWindowPos
RedrawWindow
GetClientRect
BeginPaint
FillRect
EndPaint
IsChild
SetFocus
GetSysColor
DestroyAcceleratorTable
CallWindowProcA
CharNextA
wvsprintfA
GetWindowTextLengthA
GetWindowTextA
GetWindowLongA
DefWindowProcA
RegisterWindowMessageA
SetTimer
LoadCursorFromFileA
CharLowerBuffA
GetWindow
OpenClipboard
EmptyClipboard
CloseClipboard
MessageBoxA
UnregisterClassA
SetWindowLongA
RegisterClassExA
LoadCursorA
wsprintfA
GetClassInfoExA
LoadStringA
GetParent
ShowWindow
MoveWindow
SetWindowTextA
CreateWindowExA
SendMessageA
GetFocus
IsWindow
DestroyWindow
DestroyMenu
CreatePopupMenu
AppendMenuA
DrawFrameControl
LoadBitmapA
GetCursorPos
PostMessageA
CharUpperBuffA
DrawTextA
ReleaseCapture

gdi32

GetTextExtentPoint32A
SelectObject
ExtTextOutA
SetBkMode
CreateRectRgn
GetTextMetricsA
CreateBrushIndirect
CreateRectRgnIndirect
SetBkColor
SelectClipRgn
GetClipBox
RestoreDC
SaveDC
SetTextColor
GetTextExtentPointA
CreatePen
CreatePatternBrush
Rectangle
GetStockObject
GetObjectA
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject
CreateFontA

shell32

ShellExecuteA
SHAddToRecentDocs
SHGetFolderPathA
SHEmptyRecycleBinA
DragQueryFileA

ole32

OleLockRunning
CoTaskMemAlloc
CLSIDFromString
StringFromGUID2
CoUninitialize
CoInitialize
CoCreateInstance
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoGetClassObject
CLSIDFromProgID
RegisterDragDrop
ReleaseStgMedium
CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SysFreeString
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VarBstrCmp
SysAllocString
VariantInit
SysStringByteLen
VariantClear
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
UnRegisterTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
DispCallFunc
SafeArrayPutElement
SafeArrayCreate
VariantCopy
VariantChangeType
VarUI4FromStr
RegisterTypeLi
VarBstrCat
GetErrorInfo
SetErrorInfo
CreateErrorInfo

Exports

Exports

CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TBStudioReg

Sections

.text
Size: 936KB - Virtual size: 932KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu04648/version.txt

Sharing

General

Malware Config

Signatures

Files

81c812ed76d4690c8678b3a4f0737a5f

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 108KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 16KB - Virtual size: 20KB

2c6a8b47468e1f5d9d782c5c83189d4b

Headers

File Characteristics

PDB Paths

Imports

shlwapi

wininet

rpcrt4

urlmon

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 264KB - Virtual size: 261KB

.rdata Size: 72KB - Virtual size: 69KB

.data Size: 8KB - Virtual size: 13KB

.SHARED Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 16KB - Virtual size: 14KB

f7982c3b635664619202a6a80cfe4238

Headers

File Characteristics

PDB Paths

Imports

wininet

shlwapi

winmm

setupapi

dbghelp

version

kernel32

user32

gdi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 936KB - Virtual size: 932KB

.rdata Size: 156KB - Virtual size: 154KB

.data Size: 20KB - Virtual size: 28KB

.SHARED Size: 4KB - Virtual size: 2KB

.rsrc Size: 24KB - Virtual size: 22KB

.reloc Size: 44KB - Virtual size: 43KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 108KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 16KB - Virtual size: 20KB

.text
Size: 264KB - Virtual size: 261KB

.rdata
Size: 72KB - Virtual size: 69KB

.data
Size: 8KB - Virtual size: 13KB

.SHARED
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 16KB - Virtual size: 14KB

.text
Size: 936KB - Virtual size: 932KB

.rdata
Size: 156KB - Virtual size: 154KB

.data
Size: 20KB - Virtual size: 28KB

.SHARED
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 24KB - Virtual size: 22KB

.reloc
Size: 44KB - Virtual size: 43KB