54ec9134a517073b6143faf325fdb0dc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

54ec9134a517073b6143faf325fdb0dc_JaffaCakes118
Size

5.1MB
MD5

54ec9134a517073b6143faf325fdb0dc
SHA1

34931855d8a94abaaea05670b007ca6cc5eaf8f7
SHA256

7909a74cb0a861e3d84305d0c1ff821a6b5f68136b53201ba6229776a9d488d8
SHA512

f3431390edfd1d32a3e29262026733f2647b64922f554d4890d7f42cf0cbcf0fd5b906fb01ea31b00f3c8c5a7b6cf2a06af0265f4534335c2061eedca818e4e8
SSDEEP

98304:pj6bq2gs/XZE6pno/AaHIR/nP3jeCs9WEgaFMBYw0ZVNGHrj6s1+Ki:lWE65o/AcIlnPnQLedgroP6s8z

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
54ec9134a517073b6143faf325fdb0dc_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/yowindow.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

54ec9134a517073b6143faf325fdb0dc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/YoWindow/about.css
$APPDATA/YoWindow/about.html
$APPDATA/YoWindow/data.xml
$APPDATA/YoWindow/images/arrows/0.gif
.gif
$APPDATA/YoWindow/images/arrows/1.gif
.gif
$APPDATA/YoWindow/images/arrows/10.gif
.gif
$APPDATA/YoWindow/images/arrows/11.gif
.gif
$APPDATA/YoWindow/images/arrows/12.gif
.gif
$APPDATA/YoWindow/images/arrows/13.gif
.gif
$APPDATA/YoWindow/images/arrows/14.gif
.gif
$APPDATA/YoWindow/images/arrows/15.gif
.gif
$APPDATA/YoWindow/images/arrows/2.gif
.gif
$APPDATA/YoWindow/images/arrows/3.gif
.gif
$APPDATA/YoWindow/images/arrows/4.gif
.gif
$APPDATA/YoWindow/images/arrows/5.gif
.gif
$APPDATA/YoWindow/images/arrows/6.gif
.gif
$APPDATA/YoWindow/images/arrows/7.gif
.gif
$APPDATA/YoWindow/images/arrows/8.gif
.gif
$APPDATA/YoWindow/images/arrows/9.gif
.gif
$APPDATA/YoWindow/images/get_flash_player.gif
.gif
$APPDATA/YoWindow/images/house.gif
.gif
$APPDATA/YoWindow/images/weather/clear.gif
.gif
$APPDATA/YoWindow/images/weather/clear_night.gif
.gif
$APPDATA/YoWindow/images/weather/cloudy.gif
.gif
$APPDATA/YoWindow/images/weather/dust.gif
.gif
$APPDATA/YoWindow/images/weather/fog.gif
.gif
$APPDATA/YoWindow/images/weather/haze.gif
.gif
$APPDATA/YoWindow/images/weather/heavyRain.gif
.gif
$APPDATA/YoWindow/images/weather/heavySnow.gif
.gif
$APPDATA/YoWindow/images/weather/lightRain.gif
.gif
$APPDATA/YoWindow/images/weather/lightSnow.gif
.gif
$APPDATA/YoWindow/images/weather/mist.gif
.gif
$APPDATA/YoWindow/images/weather/mostlyCloudy.gif
.gif
$APPDATA/YoWindow/images/weather/partlyCloudy.gif
.gif
$APPDATA/YoWindow/images/weather/partlyCloudy_night.gif
.gif
$APPDATA/YoWindow/images/weather/rain.gif
.gif
$APPDATA/YoWindow/images/weather/smoke.gif
.gif
$APPDATA/YoWindow/images/weather/snow.gif
.gif
$APPDATA/YoWindow/images/weather/thickMist.gif
.gif
$APPDATA/YoWindow/images/weather/thunderstorm.gif
.gif
$APPDATA/YoWindow/images/weather/unsupported.gif
.gif
$APPDATA/YoWindow/images/weather/view.html
.html
$APPDATA/YoWindow/images/yo_64.png
.png
$APPDATA/YoWindow/landscapes/airport/airport.ywl
$APPDATA/YoWindow/landscapes/airport/swf/airport.swf
$APPDATA/YoWindow/landscapes/airport/swf/seaside.swf
$APPDATA/YoWindow/landscapes/airport/swf/seasons/summer.swf
$APPDATA/YoWindow/landscapes/live_sky_example/img/pyramids.png
.png
$APPDATA/YoWindow/landscapes/live_sky_example/pyramids.ywl
$APPDATA/YoWindow/landscapes/seaside/seaside.ywl
$APPDATA/YoWindow/landscapes/seaside/swf/seaside.swf
$APPDATA/YoWindow/landscapes/seaside/swf/seasons/spring.swf
$APPDATA/YoWindow/landscapes/seaside/swf/seasons/summer.swf
$APPDATA/YoWindow/landscapes/seaside/swf/seasons/winter.swf
$APPDATA/YoWindow/landscapes/village/swf/garland.swf
$APPDATA/YoWindow/landscapes/village/swf/optionsDialog.swf
$APPDATA/YoWindow/landscapes/village/swf/sandbox.swf
$APPDATA/YoWindow/landscapes/village/swf/seasons/autumn.swf
$APPDATA/YoWindow/landscapes/village/swf/seasons/naked.swf
$APPDATA/YoWindow/landscapes/village/swf/seasons/spring.swf
$APPDATA/YoWindow/landscapes/village/swf/seasons/summer.swf
$APPDATA/YoWindow/landscapes/village/swf/seasons/winter.swf
$APPDATA/YoWindow/landscapes/village/swf/village.swf
$APPDATA/YoWindow/landscapes/village/village.ywl
$APPDATA/YoWindow/projector.xml
$APPDATA/YoWindow/styleSheet.xml
.html
$APPDATA/YoWindow/styleSheetBlack.xml
.html
$APPDATA/YoWindow/swf/stage/animals/dummy_crab.swf
$APPDATA/YoWindow/swf/stage/animals/horse/graze_left.swf
$APPDATA/YoWindow/swf/stage/animals/horse/graze_right.swf
$APPDATA/YoWindow/swf/stage/animals/horse/head_down.swf
$APPDATA/YoWindow/swf/stage/animals/horse/start_walk_head_down_left.swf
$APPDATA/YoWindow/swf/stage/animals/horse/start_walk_head_down_right.swf
$APPDATA/YoWindow/swf/stage/animals/horse/start_walk_left.swf
$APPDATA/YoWindow/swf/stage/animals/horse/start_walk_right.swf
$APPDATA/YoWindow/swf/stage/animals/horse/stop_walk_head_down_left.swf
$APPDATA/YoWindow/swf/stage/animals/horse/stop_walk_head_down_right.swf
$APPDATA/YoWindow/swf/stage/animals/horse/stop_walk_left.swf
$APPDATA/YoWindow/swf/stage/animals/horse/stop_walk_right.swf
$APPDATA/YoWindow/swf/stage/animals/horse/turn.swf
$APPDATA/YoWindow/swf/stage/animals/horse/walk.swf
$APPDATA/YoWindow/swf/stage/animals/horse/walk_head_down.swf
$APPDATA/YoWindow/swf/stage/effects/birds/birds_nest.swf
$APPDATA/YoWindow/swf/stage/foreground/burdocks/autumn.swf
$APPDATA/YoWindow/swf/stage/foreground/burdocks/naked.swf
$APPDATA/YoWindow/swf/stage/foreground/burdocks/spring.swf
$APPDATA/YoWindow/swf/stage/foreground/burdocks/summer.swf
$APPDATA/YoWindow/swf/stage/foreground/burdocks/winter.swf
$APPDATA/YoWindow/trayTooltipTemplate.html
.html
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

9b6b6a7858e17fb0b17e1c1428330343

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
GetACP
lstrlenA
lstrcmpA
lstrcpynA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc

user32

SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/OCSetupHlp.dll
.dll regsvr32 windows:5 windows x86 arch:x86

0615854a8bf9998cbbbcc756d6e6d4bf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/01/2011, 00:00

Not After

14/03/2014, 23:59

Subject

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

90:54:26:74:47:21:43:05:b6:8c:85:49:22:bb:e7:e3:57:02:da:77
Signer

Actual PE Digest

90:54:26:74:47:21:43:05:b6:8c:85:49:22:bb:e7:e3:57:02:da:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
CreateFileW
GetFileSize
GetCurrentProcessId
GetEnvironmentVariableW
FindFirstFileW
FindNextFileW
FindClose
ReadFile
GetTimeZoneInformation
WaitForSingleObject
OutputDebugStringW
WriteFile
DeleteFileW
GetCurrentThreadId
SetLastError
GetCurrentProcess
FlushInstructionCache
ExpandEnvironmentStringsW
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
OpenFileMappingW
CreateMutexW
OpenMutexW
ReleaseMutex
CreateDirectoryW
GetShortPathNameW
GetTempPathW
SetFilePointer
GetTickCount
CreateEventW
SetEvent
CreateProcessW
MoveFileExW
GlobalUnlock
GlobalLock
GlobalAlloc
Process32NextW
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetFileAttributesA
CreateProcessA
GetExitCodeProcess
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetFullPathNameW
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
Process32FirstW
CreateToolhelp32Snapshot
WriteConsoleA
GetCurrentDirectoryA
CreateFileA
CloseHandle
GetFileInformationByHandle
GetFullPathNameA
FlushFileBuffers
GetModuleHandleA
SetErrorMode
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringA
ExitProcess
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
HeapCreate
RtlUnwind
GetDriveTypeW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
GetConsoleMode
GetConsoleCP
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
GetCommandLineA
ExitThread
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
FindResourceA
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetFileAttributesExW
CompareFileTime
FileTimeToSystemTime
GetVersion
GetSystemInfo
GetVersionExW
GetTempFileNameW
GlobalFree
ReleaseSemaphore
ResumeThread
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
GetSystemDefaultLCID
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
lstrlenA
WideCharToMultiByte
OpenProcess
GetUserDefaultUILanguage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
DeleteCriticalSection
lstrcmpiW
EnterCriticalSection
GetProcAddress
GetThreadLocale
GetLastError
SetThreadLocale
RaiseException
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
QueryPerformanceCounter
LoadLibraryExW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
PeekNamedPipe
CreateThread

psapi

EnumProcesses
GetProcessImageFileNameW

ws2_32

WSACleanup
WSAStartup
closesocket
WSAGetLastError
gethostname
ioctlsocket
getaddrinfo
freeaddrinfo
select
__WSAFDIsSet
WSASetLastError
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
socket

msimg32

AlphaBlend

shlwapi

PathMatchSpecW

user32

IsWindow
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
GetCursor
ReleaseCapture
TrackPopupMenu
GetCursorPos
DestroyWindow
PostMessageW
PostQuitMessage
KillTimer
UnregisterClassA
GetForegroundWindow
DestroyMenu
NotifyWinEvent
FindWindowW
GetParent
GetAncestor
SetFocus
CreateDialogParamW
LoadImageW
GetSystemMetrics
CallNextHookEx
UnhookWindowsHookEx
SystemParametersInfoW
SetWindowsHookExW
DrawTextW
ScreenToClient
SetMenuItemInfoW
IsWindowVisible
SetForegroundWindow
SetCursor
ClientToScreen
GetWindowRect
SendDlgItemMessageW
EnableMenuItem
GetSystemMenu
EnableWindow
SetDlgItemTextW
MessageBoxW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
GetDesktopWindow
CharNextW
FillRect
InvalidateRect
GetAsyncKeyState
EndPaint
BeginPaint
DrawFocusRect
ReleaseDC
GetDC
GetSysColorBrush
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetWindowThreadProcessId
SetWindowPos
MoveWindow
GetClientRect
SetWindowTextW
SendMessageW
LoadIconW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
GetDlgItem
ShowWindow
EnumWindows
EnumChildWindows
GetWindowTextW
GetWindowTextLengthW
SetTimer

gdi32

CreateSolidBrush
SetViewportOrgEx
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetTextExtentPoint32W
SelectObject
CreateDIBSection
SetBkMode
SetTextColor
CreateFontIndirectW
GetObjectW
DeleteObject
DeleteDC
GetDeviceCaps
GetStockObject
GdiFlush

advapi32

RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegDeleteValueA
LookupPrivilegeValueW
RegDeleteValueW
AdjustTokenPrivileges
OpenProcessToken
DuplicateTokenEx
GetUserNameW
RegEnumKeyW

shell32

SHGetFolderPathW
Shell_NotifyIconW
ShellExecuteW

ole32

CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemAlloc
CoCreateGuid
StringFromGUID2
CoTaskMemRealloc
CoInitialize
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree

oleaut32

VariantClear
LoadRegTypeLi
SysAllocStringLen
SysFreeString
RegisterTypeLi
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysAllocString

comctl32

InitCommonControlsEx

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

wininet

InternetQueryOptionW
InternetGetConnectedStateExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
OCPRD530CanLeaveOfferPage
OCPRD530CleanupProduct
OCPRD530Detach
OCPRD530FindGuidAndRunDialog
OCPRD530FindGuidAndRunDialogA
OCPRD530GetAsyncOfferStatus
OCPRD530GetBannerInfo
OCPRD530GetBannerInfoW
OCPRD530GetMsg
OCPRD530GetNoCandy
OCPRD530GetOfferState
OCPRD530GetOfferType
OCPRD530Init2A
OCPRD530Init2W
OCPRD530InnoAdjust
OCPRD530InnoRestore
OCPRD530InstallShieldAdjust
OCPRD530LoadOpenCandyDLL
OCPRD530LogDevModeMessage
OCPRD530LogDevModeMessageW
OCPRD530NSISAdjust
OCPRD530PreInit
OCPRD530PrepareDownload
OCPRD530RunDialog
OCPRD530SetCmdLineValues
OCPRD530SetCmdLineValuesW
OCPRD530SetCustomBrushColor
OCPRD530SetCustomBrushColorW
OCPRD530SetNoCandy
OCPRD530SetOCOfferEnabled
OCPRD530SetOfferData
OCPRD530SetOfferLocation
OCPRD530SetUseDefaultColorBkGrnd
OCPRD530Shutdown
OCPRD530SignalProductFailed
OCPRD530SignalProductInstalled
OCPRD530StartDLMgr2Download
OCPRD530StartDLMgr2DownloadRunasAdmin
_OCPRD530DLMgr2Check@16
_OCPRD530Display@16
_OCPRD530DownloadMgr2RecycleOffer@12
_OCPRD530MgrCheck@16
_OCPRD530MgrExec@16
_OCPRD530RestartDll@16
_OCPRD530RestartDllAsAdmin@16
_OCPRD530RunOpenCandyDLL@16

Sections

.text
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/finalTouch.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
buildNumber.txt
eula.txt
lang/bg.xml
lang/br.xml
.xml
lang/ca.xml
.xml
lang/chs.xml
.xml
lang/cht.xml
.xml
lang/cs.xml
.xml
lang/da.xml
.xml
lang/de-at.xml
lang/de.xml
lang/el.xml
.xml
lang/en.xml
.xml
lang/es.xml
.xml
lang/et.xml
.xml
lang/eu.xml
.xml
lang/fi.xml
lang/fr.xml
lang/hr.xml
.xml
lang/hu.xml
.xml
lang/it.xml
.xml
lang/ja.xml
lang/lt.xml
lang/lv.xml
.xml
lang/mini/bg.xml
.xml
lang/mini/br.xml
.xml
lang/mini/ca.xml
.xml
lang/mini/chs.xml
.xml
lang/mini/cht.xml
.xml
lang/mini/cs.xml
.xml
lang/mini/da.xml
.xml
lang/mini/de-at.xml
.xml
lang/mini/de.xml
.xml
lang/mini/el.xml
.xml
lang/mini/en.xml
.xml
lang/mini/es.xml
.xml
lang/mini/et.xml
.xml
lang/mini/eu.xml
.xml
lang/mini/fi.xml
.xml
lang/mini/fr.xml
.xml
lang/mini/hr.xml
.xml
lang/mini/hu.xml
.xml
lang/mini/it.xml
.xml
lang/mini/ja.xml
.xml
lang/mini/lt.xml
.xml
lang/mini/lv.xml
.xml
lang/mini/mk.xml
.xml
lang/mini/nl.xml
.xml
lang/mini/no.xml
.xml
lang/mini/pl.xml
.xml
lang/mini/pt.xml
.xml
lang/mini/ro.xml
.xml
lang/mini/ru.xml
.xml
lang/mini/si.xml
.xml
lang/mini/sk.xml
.xml
lang/mini/sq.xml
.xml
lang/mini/sr.xml
.xml
lang/mini/sv.xml
.xml
lang/mini/tr.xml
.xml
lang/mini/uk.xml
.xml
lang/mk.xml
.xml
lang/nl.xml
lang/no.xml
lang/pl.xml
.xml
lang/pt.xml
lang/ro.xml
lang/ru.xml
.xml
lang/si.xml
lang/sk.xml
.xml
lang/sq.xml
.xml
lang/sr.xml
.xml
lang/sv.xml
.xml
lang/tr.xml
lang/uk.xml
.xml
yodesktop.swf
yowindow.exe
.exe windows:5 windows x86 arch:x86

11f998f882eed2a69ae14f0b70a85838

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Am\wimo\team\desktop\product\Release\yowindow.pdb

Imports

wininet

InternetCheckConnectionA
InternetSetOptionA
InternetGetConnectedStateEx

comctl32

ord17

gdiplus

GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipFree
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSaveImageToFile
GdiplusShutdown
GdiplusStartup

kernel32

GetVersionExA
GetProcessWorkingSetSize
GetCurrentProcess
SetProcessWorkingSetSize
InterlockedIncrement
GetVersionExW
GetCurrentThread
GetCurrentThreadId
GetModuleFileNameW
FindClose
FindFirstFileW
GetCurrentDirectoryW
LocalFree
FormatMessageW
VerifyVersionInfoA
VerSetConditionMask
CreateThread
TerminateThread
GetTickCount
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
GetStdHandle
AllocConsole
WideCharToMultiByte
DeleteFileW
FindNextFileW
HeapAlloc
GetProcessHeap
lstrlenA
FormatMessageA
HeapFree
Sleep
GetLocaleInfoA
GetLocaleInfoW
CreateDirectoryW
WriteConsoleA
CreateFileW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
LoadLibraryExA
VirtualAlloc
SetFilePointer
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
HeapSize
GetModuleFileNameA
GetModuleHandleA
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
GetCPInfo
LCMapStringW
LCMapStringA
GetFileType
SetStdHandle
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RaiseException
GetSystemTimeAsFileTime
RtlUnwind
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
GetProcAddress
CreateFileA
SetEvent
ReadFile
CancelIo
WriteFile
ResetEvent
ConnectNamedPipe
GetLastError
WaitForMultipleObjects
DisconnectNamedPipe
SetEnvironmentVariableA
GetOverlappedResult
FlushFileBuffers
CreateEventA
CreateNamedPipeA
InterlockedDecrement
LoadLibraryA
ReleaseMutex
CreateMutexA
WaitForSingleObject
CloseHandle
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
CompareStringW
HeapReAlloc

user32

FindWindowA
ChangeDisplaySettingsA
GetWindowThreadProcessId
MonitorFromWindow
GetSystemMetrics
GetFocus
PostQuitMessage
PostMessageA
GetForegroundWindow
GetMonitorInfoA
MessageBoxA
SetTimer
KillTimer
EndPaint
BeginPaint
MessageBoxW
GetSysColor
wsprintfW
AllowSetForegroundWindow
SetForegroundWindow
SetWindowPlacement
GetWindowPlacement
EnumDisplaySettingsA
LoadIconA
RegisterWindowMessageA
GetCursorPos
CreateIconIndirect
GetDC
FillRect
DestroyIcon
GetSubMenu
LoadMenuA
SetMenuItemInfoW
CreateDialogParamA
LoadCursorA
RegisterClassExA
LoadStringA
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadAcceleratorsA
IsDialogMessageA
TranslateAcceleratorA
UpdateWindow
SetFocus
InvalidateRect
GetClientRect
GetWindowRect
MoveWindow
SendMessageA
SetWindowTextA
CallWindowProcA
ShowWindow
GetParent
SetParent
SetWindowPos
DefWindowProcA
GetWindowLongA
SetWindowLongA
IsWindow
DestroyWindow
CreateWindowExA
TrackPopupMenuEx
GetMenuItemInfoW

gdi32

CreateSolidBrush
SetBkMode
TextOutW
CreateCompatibleBitmap
SelectObject
PatBlt
DeleteObject
CreateFontIndirectA
SetTextAlign
GetTextMetricsW
GetTextExtentPoint32W
SetTextColor
RemoveFontResourceA
CreateCompatibleDC
DeleteDC

comdlg32

GetOpenFileNameW

advapi32

RegSetValueExW
RegQueryValueExW
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
SetSecurityDescriptorDacl

shell32

SHGetFolderLocation
ShellExecuteW
SHGetPathFromIDListW
SHGetFolderPathW
Shell_NotifyIconA

ole32

CoTaskMemFree
CoCreateInstance
OleRun
CoInitializeEx
CoUninitialize
OleInitialize
OleSetContainedObject
OleCreate
CoWaitForMultipleHandles
CoTaskMemAlloc

oleaut32

SafeArrayCreate
SafeArrayAccessData
SafeArrayDestroy
GetErrorInfo
VariantCopy
VariantChangeType
VariantInit
SysStringLen
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 495KB - Virtual size: 494KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
yowindow_debugMode.bat

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 151KB

.ndata Size: - Virtual size: 104KB

.rsrc Size: 106KB - Virtual size: 105KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

9b6b6a7858e17fb0b17e1c1428330343

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 697B

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 320B

0615854a8bf9998cbbbcc756d6e6d4bf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

90:54:26:74:47:21:43:05:b6:8c:85:49:22:bb:e7:e3:57:02:da:77Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

psapi

ws2_32

msimg32

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 151KB

.ndata
Size: - Virtual size: 104KB

.rsrc
Size: 106KB - Virtual size: 105KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 697B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 320B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

90:54:26:74:47:21:43:05:b6:8c:85:49:22:bb:e7:e3:57:02:da:77
Signer

.text
Size: 507KB - Virtual size: 506KB

.rdata
Size: 158KB - Virtual size: 158KB

.data
Size: 9KB - Virtual size: 19KB

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 30KB - Virtual size: 30KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 572B