swift-early-beta[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

swift-early-beta.zip
Size

14.5MB
MD5

fd11b362d868da62124931587c070ebc
SHA1

e699f1705f0f7c0964886c28657a7521d8e6f14b
SHA256

3573bd0c41efeef30431665930926c4def4db23b9dc26ba23289e0b267362243
SHA512

1140ff4da0c40717d790234420e1f94e7ce84daf02b4e8a5b044c2acdfac0180c6eb377ae63d7399de59e858a7b6ad9e6883d8e197991930149d156a339ad74d
SSDEEP

393216:/Fi+JngyBc5jjOR0dVyx6Kzv9U5LV616YIV:8CgyBeXXdS1zv9+nV

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/swift-early-beta/bin/injector.exe	themida

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/swift-early-beta/Swift.exe
unpack001/swift-early-beta/bin/Dll3.dll
unpack001/swift-early-beta/bin/injector.exe

Files

swift-early-beta.zip
.zip
__MACOSX/._swift-early-beta
__MACOSX/swift-early-beta/._.DS_Store
__MACOSX/swift-early-beta/._Swift.exe
__MACOSX/swift-early-beta/._autoexec
__MACOSX/swift-early-beta/._bin
__MACOSX/swift-early-beta/._notbin
__MACOSX/swift-early-beta/._readme.txt
__MACOSX/swift-early-beta/._scripts
__MACOSX/swift-early-beta/._workspace
__MACOSX/swift-early-beta/bin/._Dll3.dll
__MACOSX/swift-early-beta/bin/._injector.exe
__MACOSX/swift-early-beta/bin/._settings.json
__MACOSX/swift-early-beta/notbin/._exec
__MACOSX/swift-early-beta/notbin/._inj
__MACOSX/swift-early-beta/notbin/inj/._Swift-Injected-2292
swift-early-beta/.DS_Store
swift-early-beta/Swift.exe
.exe windows:6 windows x64 arch:x64

70a8bc8aa956d69427765807f7cfd3f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Swift.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

ntdll

NtCreateFile
RtlCaptureContext
NtQuerySystemInformation
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueryInformationProcess
NtCancelIoFileEx
NtReadFile
RtlGetVersion
RtlNtStatusToDosError
NtWriteFile
NtDeviceIoControlFile
RtlPcToFileHeader
RtlUnwindEx

user32

IsWindow
GetSystemMetrics
GetWindowTextLengthW
SetWindowTextW
EnumChildWindows
CreateWindowExW
RegisterWindowMessageA
RegisterTouchWindow
RegisterClassExW
RegisterRawInputDevices
SendInput
MsgWaitForMultipleObjectsEx
SetWindowLongPtrW
SetCapture
ShowWindow
GetSystemMenu
EnableMenuItem
SendMessageW
GetWindowRect
SetWindowLongW
GetForegroundWindow
SetCursorPos
GetClipCursor
ClipCursor
ShowCursor
GetMenu
SetWindowDisplayAffinity
GetWindowLongPtrW
SetForegroundWindow
CreateIcon
InvalidateRgn
TrackPopupMenu
GetRawInputData
CheckMenuItem
GetDC
DispatchMessageA
GetMessageA
GetKeyboardLayout
AdjustWindowRectEx
SetWindowPos
GetWindowTextW
IsWindowVisible
CreateAcceleratorTableW
DestroyIcon
PostQuitMessage
AppendMenuW
DestroyAcceleratorTable
GetClientRect
ClientToScreen
CreatePopupMenu
CreateMenu
SetMenuItemInfoW
DestroyWindow
ReleaseCapture
GetCursorPos
RegisterClassW
IsIconic
GetActiveWindow
SetMenu
VkKeyScanW
GetAsyncKeyState
GetKeyboardState
ToUnicodeEx
GetKeyState
MapVirtualKeyExW
RedrawWindow
PostMessageW
MonitorFromPoint
EnumDisplayMonitors
SystemParametersInfoA
GetUpdateRect
ValidateRect
GetMonitorInfoW
MonitorFromWindow
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
TrackMouseEvent
MonitorFromRect
GetWindowLongW
IsProcessDPIAware
SetCursor
LoadCursorW
GetWindowPlacement
SetWindowPlacement
PeekMessageW
ChangeDisplaySettingsExW
FlashWindowEx
DefWindowProcW
PostThreadMessageW
TranslateMessage
TranslateAcceleratorW
DispatchMessageW
GetAncestor
GetMessageW
MapVirtualKeyW

kernel32

CreateMutexA
GetProcessHeap
GetExitCodeProcess
K32GetPerformanceInfo
GlobalMemoryStatusEx
HeapFree
FreeLibrary
WaitForSingleObjectEx
GetProcAddress
OpenProcess
WaitForSingleObject
GetTempPathW
GetFullPathNameW
CreateThread
WideCharToMultiByte
WriteConsoleW
LocalFree
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
ReadFileEx
CreateNamedPipeW
ExitProcess
CopyFileExW
GetFinalPathNameByHandleW
RemoveDirectoryW
MoveFileExW
GetLastError
DeleteFileW
FindFirstFileW
FormatMessageW
GetSystemTimes
MultiByteToWideChar
GetProcessTimes
CreateDirectoryW
GetFileInformationByHandleEx
FindClose
FindNextFileW
ReleaseMutex
HeapReAlloc
VirtualQueryEx
GetSystemTimePreciseAsFileTime
CreateFileW
GetCurrentProcessId
GetSystemInfo
CloseHandle
GetCurrentThreadId
GetModuleHandleW
GetProcessIoCounters
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
RaiseException
QueryPerformanceFrequency
TerminateProcess
SleepEx
WriteFileEx
GetStdHandle
GetModuleHandleA
GetNativeSystemInfo
lstrlenW
GetUserDefaultLocaleName
EncodePointer
SetFileInformationByHandle
LoadLibraryA
GetUserDefaultUILanguage
LCIDToLocaleName
LoadLibraryW
GetCommandLineW
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
QueryPerformanceCounter
SetWaitableTimer
CreateWaitableTimerExW
SwitchToThread
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
DeleteProcThreadAttributeList
FreeEnvironmentStringsW
GetConsoleMode
GetFileInformationByHandle
Sleep
SetFileCompletionNotificationModes
TlsFree
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetHandleInformation
DuplicateHandle
GetCurrentProcess
GetEnvironmentVariableW
DeleteCriticalSection
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
HeapAlloc
ReleaseSRWLockExclusive
ReadProcessMemory
OutputDebugStringW
OutputDebugStringA
GetModuleFileNameW
GetFileAttributesW

gdi32

DeleteObject
CreateRectRgn
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

ole32

CoTaskMemFree
CreateStreamOnHGlobal
OleInitialize
CoTaskMemAlloc
CoCreateInstance
RegisterDragDrop
CoInitializeEx
CoUninitialize
RevokeDragDrop

comctl32

SetWindowSubclass
DefSubclassProc
RemoveWindowSubclass
TaskDialogIndirect

shell32

SHAppBarMessage
SHGetKnownFolderPath
CommandLineToArgvW
ShellExecuteW
SHCreateItemFromParsingName
DragQueryFileW
Shell_NotifyIconGetRect
DragFinish
Shell_NotifyIconW

pdh

PdhGetFormattedCounterValue
PdhOpenQueryA
PdhCloseQuery
PdhCollectQueryData
PdhAddEnglishCounterW
PdhRemoveCounter

powrprof

CallNtPowerInformation

secur32

FreeCredentialsHandle
DecryptMessage
AcquireCredentialsHandleA
QueryContextAttributesW
FreeContextBuffer
EncryptMessage
DeleteSecurityContext
InitializeSecurityContextW
ApplyControlToken
AcceptSecurityContext

advapi32

GetTokenInformation
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
SystemFunction036
OpenProcessToken
CopySid
IsValidSid
GetLengthSid
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

psapi

GetModuleFileNameExW

oleaut32

SysStringLen
SysFreeString
SetErrorInfo
GetErrorInfo

ws2_32

freeaddrinfo
getaddrinfo
closesocket
WSACleanup
WSAStartup
WSAGetLastError
WSAIoctl
setsockopt
WSASend
send
recv
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
getsockname
getpeername

crypt32

CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertCloseStore
CertDuplicateStore
CertOpenStore
CertGetCertificateChain
CertFreeCertificateChain
CertAddCertificateContextToStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertDuplicateCertificateChain

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

trunc
pow
round
__setusermatherr
floor

api-ms-win-crt-heap-l1-1-0

free
_callnewh
_set_new_mode
calloc
malloc

api-ms-win-crt-string-l1-1-0

strcpy_s
wcslen
_wcsicmp
wcsncmp

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
terminate
_crt_atexit
_configure_narrow_argv
_set_app_type
_register_onexit_function
_initialize_onexit_table
_get_initial_narrow_environment
_initialize_narrow_environment
abort
_register_thread_local_exe_atexit_callback
_c_exit
_initterm
__p___argv
__p___argc
_initterm_e
_exit
exit
_cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 296KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
swift-early-beta/bin/Dll3.dll
.dll windows:6 windows x64 arch:x64

4398ca0a1c9dcd6745271c52d14018f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

WaitForSingleObjectEx
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
WakeAllConditionVariable
GetCurrentThread
GetThreadTimes
GetOEMCP
GetACP
IsValidCodePage
HeapSize
SetEndOfFile
SetStdHandle
GetTimeZoneInformation
HeapReAlloc
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
MoveFileExA
FlsAlloc
HeapAlloc
HeapFree
GetConsoleOutputCP
WriteFile
ReadConsoleW
GetConsoleMode
GetModuleFileNameW
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventA
SetEvent
DeleteCriticalSection
FormatMessageW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetTickCount
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FindFirstChangeNotificationA
GetCurrentProcessId
FindNextChangeNotification
CloseHandle
Process32Next
Sleep
SetLastError
GetEnvironmentVariableA
GetLastError
GetSystemDirectoryA
FlsGetValue
CreateToolhelp32Snapshot
WaitForSingleObject
WriteConsoleW
DeleteFileW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
InitializeCriticalSectionAndSpinCount
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
GetSystemTimeAsFileTime
GetCommandLineA
LCMapStringEx
DecodePointer
EncodePointer
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetCurrentThreadId
CreateSymbolicLinkW
GetFileInformationByHandleEx
CopyFileW
GetModuleHandleW
DeviceIoControl
AreFileApisANSI
SetFileInformationByHandle
GetFullPathNameW
Process32First
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetLocaleInfoA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
RtlUnwind
FormatMessageA
LocalFree
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle

user32

OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
CloseClipboard
EmptyClipboard
LoadCursorA
GetMessageExtraInfo
GetKeyState
MessageBoxA
CallNextHookEx
IsIconic
UpdateWindow
RegisterClassExA
FindWindowA
PostQuitMessage
PeekMessageA
TranslateMessage
SetLayeredWindowAttributes
CreateWindowExA
ShowWindow
SetWindowPos
DestroyWindow
GetWindowRect
DispatchMessageA
DefWindowProcW
GetWindowThreadProcessId
GetClipboardData
SetClipboardData

advapi32

GetCurrentHwProfileA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
CryptGetHashParam

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

bcrypt

BCryptGenRandom

shlwapi

PathFindExtensionA

ws2_32

select
accept
bind
connect
getsockname
htonl
__WSAFDIsSet
recv
getaddrinfo
freeaddrinfo
sendto
getpeername
ioctlsocket
gethostname
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
ntohs
WSAGetLastError
WSASetLastError
closesocket
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAResetEvent
listen
WSAEventSelect
recvfrom

wldap32

ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord301
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143

normaliz

IdnToAscii
IdnToUnicode

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertOpenStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CryptStringToBinaryA
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore

Exports

Exports

callback

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 842KB - Virtual size: 841KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Y~}
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
swift-early-beta/bin/injector.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 249KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 42KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 13KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
swift-early-beta/bin/settings.json
swift-early-beta/notbin/inj/Swift-Injected-2292
swift-early-beta/readme.txt

Sharing

General

Malware Config

Signatures

Files

70a8bc8aa956d69427765807f7cfd3f1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

user32

kernel32

gdi32

dwmapi

ole32

comctl32

shell32

pdh

powrprof

secur32

advapi32

psapi

oleaut32

ws2_32

crypt32

uxtheme

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 5.5MB - Virtual size: 5.5MB

.rdata Size: 6.7MB - Virtual size: 6.7MB

.data Size: 10KB - Virtual size: 21KB

.pdata Size: 296KB - Virtual size: 295KB

.rsrc Size: 86KB - Virtual size: 85KB

.reloc Size: 49KB - Virtual size: 48KB

4398ca0a1c9dcd6745271c52d14018f5

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

kernel32

user32

advapi32

imm32

d3dcompiler_47

dwmapi

bcrypt

shlwapi

ws2_32

wldap32

normaliz

crypt32

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 842KB - Virtual size: 841KB

.data Size: 39KB - Virtual size: 55KB

.pdata Size: 89KB - Virtual size: 88KB

.Y~} Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 16KB - Virtual size: 15KB

.rsrc Size: 512B - Virtual size: 469B

Headers

DLL Characteristics

File Characteristics

Sections

Size: 249KB - Virtual size: 481KB

Size: 42KB - Virtual size: 119KB

Size: 1024B - Virtual size: 6KB

.text
Size: 5.5MB - Virtual size: 5.5MB

.rdata
Size: 6.7MB - Virtual size: 6.7MB

.data
Size: 10KB - Virtual size: 21KB

.pdata
Size: 296KB - Virtual size: 295KB

.rsrc
Size: 86KB - Virtual size: 85KB

.reloc
Size: 49KB - Virtual size: 48KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 842KB - Virtual size: 841KB

.data
Size: 39KB - Virtual size: 55KB

.pdata
Size: 89KB - Virtual size: 88KB

.Y~}
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 512B - Virtual size: 469B

.idata
Size: 2KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

.themida
Size: - Virtual size: 6.1MB

.boot
Size: 3.5MB - Virtual size: 3.5MB

.reloc
Size: 16B - Virtual size: 4KB