4a8e933462209a204f87c02e41e88e99541ccb85964a22d9762f443cf19af409
- SHA256 4a8e933462209a204f87c02e41e88e99541ccb85964a22d9762f443cf19af409
Overview
overview
10Static
static
101214e5f9de...98.exe
windows7-x64
61214e5f9de...98.exe
windows10-2004-x64
7236020bb91...f6.exe
windows7-x64
10236020bb91...f6.exe
windows10-2004-x64
1025dc70a3de...60.exe
windows7-x64
1025dc70a3de...60.exe
windows10-2004-x64
1054de718b63...d9.exe
windows7-x64
154de718b63...d9.exe
windows10-2004-x64
37ae9504811...a4.exe
windows7-x64
107ae9504811...a4.exe
windows10-2004-x64
109c2554e79b...a0.exe
windows7-x64
109c2554e79b...a0.exe
windows10-2004-x64
10a568f22004...3b.exe
windows7-x64
10a568f22004...3b.exe
windows10-2004-x64
8aefd0c7794...37.exe
windows7-x64
10aefd0c7794...37.exe
windows10-2004-x64
10d68b4d6cec...27.exe
windows7-x64
10d68b4d6cec...27.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral6
Sample
25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral7
Sample
54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9.exe
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4.exe
Resource
win7-20240903-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral10
Sample
7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral11
Sample
9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral12
Sample
9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral13
Sample
a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral14
Sample
a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral15
Sample
aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337.exe
Resource
win7-20240708-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral16
Sample
aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral17
Sample
d68b4d6cec032458824abdf3ac6f379f33db2167cb0c399845f4d7735a426827.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
General
- Target 4a8e933462209a204f87c02e41e88e99541ccb85964a22d9762f443cf19af409
- Size 20.8MB
- Sample241108-cma4fsshmf
- SHA256 4a8e933462209a204f87c02e41e88e99541ccb85964a22d9762f443cf19af409
- MD5 36b2834c2743039c4df1ce9346886c13
- SHA1 1ee1736c4e2aae820b4d6cd80e43fea0ed6eadc6
- SHA512 43dc749e7002f1ba08b7066e737523a8eaf69365eb148946d6f317234a2eff010307b4210d744a23a7d8641b72ba31fe8735dfcd6d0421537c8ba1293389cd73
- SSDEEP 393216:sS8p+jyX+POyHEWdLvAVcybpk43ytUJtUP8kilTun/u1l6I70xA0x4Nsef:sGHtoVchXyKWEIUq02Nsef
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.6A
Botnet
-
null
C2
-
95.169.210.148:6666
Mutex
-
bavaulifmjawicwh
Attributes
-
delay
5
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/d68b4d6cec032458824abdf3ac6f379f33db2167cb0c399845f4d7735a426827 family_asyncrat - Asyncrat family
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98 unpack001/236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6 unpack001/25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560 unpack001/54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9 unpack001/7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4 unpack001/9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0 unpack001/a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b unpack001/aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337 unpack001/d68b4d6cec032458824abdf3ac6f379f33db2167cb0c399845f4d7735a426827
File Explorer
-
4a8e933462209a204f87c02e41e88e99541ccb85964a22d9762f443cf19af409.zip 20.8MB
-
1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98.exe 1.0MB
-
236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe 541KB
-
25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560.exe 405KB
-
54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9.exe 15.7MB
-
7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4.exe 4.5MB
-
9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0.exe 359KB
-
a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b.exe 83KB
-
aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337.exe 206KB
-
d68b4d6cec032458824abdf3ac6f379f33db2167cb0c399845f4d7735a426827.exe 48KB
1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1214e5f9dec9e4c94ccf93c4495788c8314f396ce74dbb5c15cd372411ceed98
- MD5 0d52c34732339d12e58c62cdcbcd2241
- SHA1 b00a95fe388a69d375b4e370fa5112dda61c2ede
- SHA512 4da5f2b48663a183cc46799c02179bd5bc84a71993387742984a5c76ca92d4c7aec60d25efe758636a1a006ba8a4032a6e7763c48e9515801db8be6a98d6a3de
- SSDEEP 24576:OfQYMfhhUF54clNf7+6uHAW92zt/sWu2BSMCqDoRF+G:Vo54clgLH+tkWJ0Nj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1070110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\kolay\Desktop\Lucky.exe (cleaned host version) by 524e47\Lucky.exe cleaned by 524e47\obj\Release\Lucky Execute.pdb
mscoree
_CorExeMain
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6
- IMPHASH fcf1390e9ce472c7270447fc5c61a0c1
- SHA256 236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6
- MD5 616b97038b6328ae6e45a08077df4a7a
- SHA1 11473c1f0515f06579e7704dc036bbc620c7510a
- SHA512 4730733b4be691840fa1905fc4bfeeeba7ebb06e10d24cfe78a285a3e518a2f2ba31bbc378cda68edf4311df322fd137ed1f65d4b844737e9f0df547506c04e0
- SSDEEP 12288:vNpszYhvXWSVJdMaeaxxJHuT8DmP79TovFZFW84:FhvJVJdMQPuTVP792gR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
126304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
gdiplus
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
Name
.text
Size
197KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=141, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=199, version=41118,
count=22, id=259, version=24123,
count=19, id=260, version=24123,
count=44, id=261, version=24123,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=268, id=1, productName=Unmarked objects,
count=49, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560
- MD5 bf2e00fc28e5f89ec6b3b457a5a245fb
- SHA1 d42962e2e987c4cd8201badf832f3368afb09d24
- SHA512 e1f61fec329fab9f0bd997e7b34945e156475a53531c30630a03c550e60c029627e5697c5efb6a0a81b2bc23e178264aabfb26c8b68153d7107d367035730b2a
- SSDEEP 12288:wa8EKlXgFxY3wBeTLDQknVwtw/eMTM6fXgyyC5Te4A6:wDQkqm7nwHC5ZA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
420626
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
403KB
Virtual Size
402KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9
- IMPHASH 363160b72595602f6165a80e283c8da2
- SHA256 54de718b634d2dbddaf2530aa3b1768823dfdd97f5a2782b4131fe369e903dd9
- MD5 79339229bc0c59d7b5abba71d1c96a8e
- SHA1 4c7c22308821a08edeacebe691da49249384de9d
- SHA512 a173e48fb0cb08705e56468ffc0a6845b03b261e98d282815eebdf77f482064a9c89f84ada89ef3aa994d0727db34629ff51e021bbcf8abd6fac5354ce295af2
- SSDEEP 393216:jhufPMmrg+zE0xNXm9wphJ/4ODYo1lgvx5Okbp:ofZtW9wpQ2SLOk1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
45769635
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
GetModuleFileNameW
LocalFree
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
CharUpperBuffW
advapi32
RegOpenKeyW
shell32
ShellExecuteW
ole32
CoCreateInstance
imm32
ImmSetCompositionWindow
shlwapi
SHDeleteKeyW
ws2_32
freeaddrinfo
crypt32
CryptStringToBinaryA
wldap32
ord26
normaliz
IdnToAscii
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
??0Assembler@asmjit@@QAE@PAURuntime@1@@Z
??0CodeGen@asmjit@@QAE@PAURuntime@1@@Z
??0HostRuntime@asmjit@@QAE@XZ
??0JitRuntime@asmjit@@QAE@XZ
??0Runtime@asmjit@@QAE@XZ
??0StaticRuntime@asmjit@@QAE@PAXI@Z
??0VMemMgr@asmjit@@QAE@PAX@Z
??0X86Assembler@asmjit@@QAE@PAURuntime@1@I@Z
??0Zone@asmjit@@QAE@I@Z
??1Assembler@asmjit@@UAE@XZ
??1CodeGen@asmjit@@UAE@XZ
??1HostRuntime@asmjit@@UAE@XZ
??1JitRuntime@asmjit@@UAE@XZ
??1Runtime@asmjit@@UAE@XZ
??1StaticRuntime@asmjit@@UAE@XZ
??1VMemMgr@asmjit@@QAE@XZ
??1X86Assembler@asmjit@@UAE@XZ
??1Zone@asmjit@@QAE@XZ
??_FVMemMgr@asmjit@@QAEXXZ
?_alloc@Zone@asmjit@@QAEPAXI@Z
?_emit@X86Assembler@asmjit@@UAEIIABUOperand@2@000@Z
?_grow@Assembler@asmjit@@QAEII@Z
?_grow@PodVectorBase@asmjit@@IAEIII@Z
?_newLabel@Assembler@asmjit@@QAEIPAULabel@2@@Z
?_newLabelLink@Assembler@asmjit@@QAEPAULabelLink@2@XZ
?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B
?_registerIndexedLabels@Assembler@asmjit@@QAEII@Z
?_relocCode@X86Assembler@asmjit@@UBEIPAX_K@Z
?_reserve@Assembler@asmjit@@QAEII@Z
?_reserve@PodVectorBase@asmjit@@IAEIII@Z
?_x86CondToCmovcc@asmjit@@3QBIB
?_x86CondToJcc@asmjit@@3QBIB
?_x86CondToSetcc@asmjit@@3QBIB
?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B
?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B
?_x86ReverseCond@asmjit@@3QBIB
?add@JitRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z
?add@StaticRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z
?align@X86Assembler@asmjit@@UAEIII@Z
?alloc@VMemMgr@asmjit@@QAEPAXII@Z
?alloc@VMemUtil@asmjit@@SAPAXIPAII@Z
?allocProcessMemory@VMemUtil@asmjit@@SAPAXPAXIPAII@Z
?allocZeroed@Zone@asmjit@@QAEPAXI@Z
?bind@Assembler@asmjit@@UAEIABULabel@2@@Z
?callCpuId@X86CpuUtil@asmjit@@SAXIIPATX86CpuId@2@@Z
?detect@X86CpuUtil@asmjit@@SAXPAUX86CpuInfo@2@@Z
?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ
?dup@Zone@asmjit@@QAEPAXPBXI@Z
?embed@Assembler@asmjit@@UAEIPBXI@Z
?embedLabel@X86Assembler@asmjit@@QAEIABULabel@2@@Z
?emit@Assembler@asmjit@@QAEII@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@00@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@00H@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@00_K@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@0@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@0H@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@0_K@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@H@Z
?emit@Assembler@asmjit@@QAEIIABUOperand@2@_K@Z
?emit@Assembler@asmjit@@QAEIIH@Z
?emit@Assembler@asmjit@@QAEII_K@Z
?flush@HostRuntime@asmjit@@UAEXPAXI@Z
?getCpuInfo@HostRuntime@asmjit@@UAEPBUCpuInfo@2@XZ
?getHost@CpuInfo@asmjit@@SAPBU12@XZ
?getPageGranularity@VMemUtil@asmjit@@SAIXZ
?getPageSize@VMemUtil@asmjit@@SAIXZ
?getStackAlignment@HostRuntime@asmjit@@UAEIXZ
?make@Assembler@asmjit@@UAEPAXXZ
?noOperand@asmjit@@3UOperand@1@B
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KABUX86Reg@2@IHI@Z
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z
?release@JitRuntime@asmjit@@UAEIPAX@Z
?release@StaticRuntime@asmjit@@UAEIPAX@Z
?release@VMemMgr@asmjit@@QAEIPAX@Z
?release@VMemUtil@asmjit@@SAIPAXI@Z
?releaseProcessMemory@VMemUtil@asmjit@@SAIPAX0I@Z
?relocCode@Assembler@asmjit@@QBEIPAX_K@Z
?reset@Assembler@asmjit@@QAEX_N@Z
?reset@PodVectorBase@asmjit@@QAEX_N@Z
?reset@VMemMgr@asmjit@@QAEXXZ
?reset@Zone@asmjit@@QAEX_N@Z
?sdup@Zone@asmjit@@QAEPADPBD@Z
?setArch@X86Assembler@asmjit@@QAEII@Z
?setError@CodeGen@asmjit@@QAEIIPBD@Z
?setErrorHandler@CodeGen@asmjit@@QAEIPAUErrorHandler@2@@Z
?sformat@Zone@asmjit@@QAAPADPBDZZ
?shrink@VMemMgr@asmjit@@QAEIPAXI@Z
?x86RegData@asmjit@@3UX86RegData@1@B
Name
.text
Size
1002KB
Virtual Size
1001KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
719KB
Virtual Size
719KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
55KB
Virtual Size
28.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.GLU0
Size
11.9MB
Virtual Size
11.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.GLU1
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
476B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4
- IMPHASH 1dbe12a9786ef158bb6f891492426c2a
- SHA256 7ae95048117dcae6685b6d3206a013fc3e76631d0d4cb58a95f065d79c6cc8a4
- MD5 dde0965428c655c1fabbcba5a44e7830
- SHA1 b5118f55982bf9784bb34a3f0af738f7d409a5ff
- SHA512 f6b83ff23e0e7102a69bf43e723f312acb0bbf95e04d7386513cc2c5b2f9e160f0f38b179688702675ecb7c4a0782fad1f007f3db59c2104aa08a7cdcc6b2e13
- SSDEEP 98304:t38JVPdnSYmzQTkZKhu8PXq7Yf7nRSVfbmfgwLAG:Z85nYUjCkTnR6fPQAG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29504
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\buza44\deticetuxani.pdb
kernel32
GetFileSize
SetFilePointer
GetConsoleAliasesLengthW
TlsGetValue
GetConsoleAliasExesA
SetLocalTime
CommConfigDialogA
GetProcessIoCounters
FreeLibrary
InterlockedDecrement
ZombifyActCtx
GetNamedPipeHandleStateA
GlobalLock
SetComputerNameW
GetComputerNameW
CreateDirectoryExA
GetTickCount
CreateNamedPipeW
GetPrivateProfileStringW
WriteFileGather
SetProcessPriorityBoost
GetSystemDirectoryW
GetConsoleMode
SetCommConfig
SizeofResource
GetSystemWow64DirectoryW
SetSystemTimeAdjustment
GetSystemWindowsDirectoryA
GetVersionExW
InterlockedPopEntrySList
GlobalFlags
ReadFile
GetBinaryTypeW
GetOverlappedResult
CompareStringW
ExitThread
lstrlenW
GetStartupInfoW
VerifyVersionInfoW
CreateDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryW
ReadConsoleOutputCharacterA
GetProcessHeaps
WriteProfileSectionA
SetStdHandle
FreeUserPhysicalPages
SearchPathA
GetAtomNameA
LoadLibraryA
Process32FirstW
LocalAlloc
SetCalendarInfoW
SetConsoleCtrlHandler
VirtualLock
SetConsoleWindowInfo
GetTapeParameters
WriteProfileStringA
WTSGetActiveConsoleSessionId
SetConsoleTitleW
GetModuleHandleA
GetProcessShutdownParameters
QueryMemoryResourceNotification
FreeEnvironmentStringsW
RequestWakeupLatency
VirtualProtect
GetCPInfoExA
FindAtomW
GetWindowsDirectoryW
GetVersion
GetVolumeNameForVolumeMountPointW
GetCurrentProcessId
FindActCtxSectionStringW
GetProfileSectionW
LCMapStringW
CopyFileExA
DeleteFileA
InterlockedIncrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetCommandLineA
GetStartupInfoA
HeapValidate
IsBadReadPtr
RaiseException
RtlUnwind
GetProcAddress
GetModuleHandleW
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
GetLastError
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
DebugBreak
GetStdHandle
WriteFile
OutputDebugStringA
WriteConsoleW
GetFileType
OutputDebugStringW
ExitProcess
LoadLibraryW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
HeapDestroy
HeapCreate
HeapFree
VirtualFree
FlushFileBuffers
GetConsoleCP
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LCMapStringA
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
CloseHandle
CreateFileA
user32
GetComboBoxInfo
GetCursorInfo
_hockey@4
_kimonu_Lalacer_cuf@8
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
25KB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=149, productName=VS2008 build 21022, version=21022,
count=65, id=132, productName=VS2008 build 21022, version=21022,
count=133, id=131, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=161, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0
- MD5 f476fd152a5d6a53f297517f9ffca28e
- SHA1 a0bc4cb4763de9f540fca4f97835522620087e17
- SHA512 56f683733356faa4be86883e3248ab70884c645e61dedc7ceba64eefa4813b2fda04d102e7b8c5794093f2c5918049900da987b2e235764e4ea87e78224003dc
- SSDEEP 6144:2IN5Yqofb4MI1XfPpnvTGLkZ96Tvu2fHk+:2C5Y3fb4MINfPpnvCLkZ96TvffHk+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
371758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
356KB
Virtual Size
355KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b
- IMPHASH d5d9d937853db8b666bd4b525813d7bd
- SHA256 a568f22004828c8dc2e3e31c3a8f49a89b164e1eb268f57c93430b20368cfe3b
- MD5 4ed7de390496be3ec2ea7fdb3804282a
- SHA1 2c919d469853fac9a7719f59407b395e8e360a49
- SHA512 5716a8d9d86f9b1f1ad53f3fca96b5622b83ede56d370edc309a503263ad52b542b29e5d74810aed013e9f2e00b77b8c54d81aa0b43c77bfdf5bc7227251bd86
- SSDEEP 1536:83kml69eWJKrec/tOu6Qes2cI2FDrj7fk1ImNUITeT0MB:80mlketr1/Qu6o2QFkSmN4p
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6881
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathFindFileNameA
kernel32
LockResource
lstrlenA
CloseHandle
CreateFileA
ExitProcess
FindResourceA
FreeResource
GetCommandLineA
GetEnvironmentVariableA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
LoadLibraryA
LoadResource
lstrcpynA
RtlMoveMemory
SetFileAttributesA
SizeofResource
WriteFile
lstrcatA
lstrcpyA
user32
CreateWindowExA
DefWindowProcA
DispatchMessageA
GetMessageA
LoadCursorA
LoadIconA
MessageBoxA
PostQuitMessage
RegisterClassExA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337
- IMPHASH 8c16c795b57934183422be5f6df7d891
- SHA256 aefd0c77949ccb2192070d1fb122cad87c1fc3e3c841b1928e3763fadf286337
- MD5 70c771952bc897446d3ddad90541a1e6
- SHA1 b00b50a893e4552651c4a5c38cf4bb9aed7a101e
- SHA512 33d402397289c1a828079dfdaaf3966c4b9720ffb070eeba0d5c23f4a3c6c448e4a3fd3cba2f82c712252ce03d726daabd2c66e97f950a122ffb3d5799bae56d
- SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalW49D9fMiSE9CCHGOn54yWgW9tFwyMJjVQbE/FGl:UsLqdufVUNDapD9fMs9u7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
EVENT_SINK_GetIDsOfNames
ord690
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaLateIdCall
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
ord661
__vbaHresultCheckObj
__vbaNameFile
_adj_fdiv_m32
Zombie_GetTypeInfo
__vbaAryDestruct
ord669
ord593
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
ord705
__vbaStrFixstr
_CIsin
ord631
ord709
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
ord529
__vbaGet4
__vbaPutOwner3
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord714
ord609
__vbaFPException
ord319
__vbaGetOwner3
__vbaUbound
ord535
__vbaFileSeek
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
ord689
__vbaAryLock
__vbaVarAdd
ord611
ord320
__vbaVarDup
__vbaStrToAnsi
ord321
__vbaFpI2
__vbaFpI4
ord616
__vbaLateMemCallLd
_CIatan
__vbaStrMove
ord618
__vbaCastObj
__vbaR8IntI4
ord650
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
ord580
ord581
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=8, id=9, version=8041,
count=1, id=13, version=8169,
d68b4d6cec032458824abdf3ac6f379f33db2167cb0c399845f4d7735a426827
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d68b4d6cec032458824abdf3ac6f379f33db2167cb0c399845f4d7735a426827
- MD5 13ed5f6560bb91d089f56bd4ca015ff0
- SHA1 f43cd2a78815c1ca4091207a8f36cc68398550bf
- SHA512 5d6adf163ca3e18691fc0b34ce1b8277a540e93cb387ae7813bc1dbc84d2c75ca8ff462e67083c08ae4f3cdfdfb1f2671cdd30738f6bbf824b2a93bda7043ad2
- SSDEEP 768:OqXwHbXXUIbp98FZbMF1NCxRGa0baDHJeRdlYnXVEK44pDBNYI6OCF2tYcFmVc6K:O5bp84v4+baD8RdloyK99x6OoKmVcl
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ