AsyncRAT.rar
- SHA256 d7f1777e338ff75532c01ef6fb8dd7bdf6fcba46d8ed8c7eba15f34e464b1d21
Overview
overview
10Static
static
10AsyncRAT/AsyncRAT.lnk
windows7-x64
3AsyncRAT/AsyncRAT.lnk
windows10-2004-x64
10AsyncRAT/P...at.dll
windows7-x64
1AsyncRAT/P...at.dll
windows10-2004-x64
1AsyncRAT/P...ra.dll
windows7-x64
1AsyncRAT/P...ra.dll
windows10-2004-x64
1AsyncRAT/P...er.dll
windows7-x64
1AsyncRAT/P...er.dll
windows10-2004-x64
1AsyncRAT/P...er.dll
windows7-x64
1AsyncRAT/P...er.dll
windows10-2004-x64
1AsyncRAT/P...er.dll
windows7-x64
1AsyncRAT/P...er.dll
windows10-2004-x64
1AsyncRAT/P...us.dll
windows7-x64
1AsyncRAT/P...us.dll
windows10-2004-x64
1AsyncRAT/P...ns.dll
windows7-x64
1AsyncRAT/P...ns.dll
windows10-2004-x64
1AsyncRAT/P...er.dll
windows7-x64
1AsyncRAT/P...er.dll
windows10-2004-x64
1AsyncRAT/P...ry.dll
windows7-x64
1AsyncRAT/P...ry.dll
windows10-2004-x64
1AsyncRAT/P...ra.dll
windows7-x64
1AsyncRAT/P...ra.dll
windows10-2004-x64
1AsyncRAT/P...op.dll
windows7-x64
1AsyncRAT/P...op.dll
windows10-2004-x64
1AsyncRAT/P...le.dll
windows7-x64
1AsyncRAT/P...le.dll
windows10-2004-x64
1AsyncRAT/P...ry.dll
windows7-x64
1AsyncRAT/P...ry.dll
windows10-2004-x64
1AsyncRAT/S...ub.exe
windows7-x64
10AsyncRAT/S...ub.exe
windows10-2004-x64
10AsyncRAT/u...ig.exe
windows7-x64
8AsyncRAT/u...ig.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
AsyncRAT/AsyncRAT.lnk
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
AsyncRAT/AsyncRAT.lnk
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
AsyncRAT/Plugins/Chat.dll
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
AsyncRAT/Plugins/Chat.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
AsyncRAT/Plugins/Extra.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
AsyncRAT/Plugins/Extra.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
AsyncRAT/Plugins/FileManager.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
AsyncRAT/Plugins/FileManager.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
AsyncRAT/Plugins/FileSearcher.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
AsyncRAT/Plugins/FileSearcher.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
AsyncRAT/Plugins/LimeLogger.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
AsyncRAT/Plugins/LimeLogger.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
AsyncRAT/Plugins/Miscellaneous.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
AsyncRAT/Plugins/Miscellaneous.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
AsyncRAT/Plugins/Options.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
AsyncRAT/Plugins/Options.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
AsyncRAT/Plugins/ProcessManager.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
AsyncRAT/Plugins/ProcessManager.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
AsyncRAT/Plugins/Recovery.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
AsyncRAT/Plugins/Recovery.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
AsyncRAT/Plugins/RemoteCamera.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
AsyncRAT/Plugins/RemoteCamera.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
AsyncRAT/Plugins/RemoteDesktop.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
AsyncRAT/Plugins/RemoteDesktop.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
AsyncRAT/Plugins/SendFile.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
AsyncRAT/Plugins/SendFile.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
AsyncRAT/Plugins/SendMemory.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
AsyncRAT/Plugins/SendMemory.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
AsyncRAT/Stub/Stub.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
AsyncRAT/Stub/Stub.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
AsyncRAT/upload.config.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
- Target AsyncRAT.rar
- Size 9.4MB
- Sample241222-1pr2razrfm
- SHA256 d7f1777e338ff75532c01ef6fb8dd7bdf6fcba46d8ed8c7eba15f34e464b1d21
- MD5 83e8eabf4126f7afb4f46b9b0d0dee71
- SHA1 bd992bacef8fd2b7fdb523d9d372838963c21c3a
- SHA512 7ea4d3f2c0201a5b99354aeae318babc68508b212b6966b42c6953171570d9e175ec605dd8349a5b316468463ee00c69d7b2e6d92dfed36e4c722aa1d096799d
- SSDEEP 196608:hmKNqv0i3vqzvgjrNpRocygvJGHO3WGn5imGUyvtOhgI3:hmwXIogdpRocW9GUmG9tO33
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/AsyncRAT/Stub/Stub.exe family_asyncrat - Asyncrat family
- Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource unpack001/AsyncRAT/Plugins/Chat.dll unpack001/AsyncRAT/Plugins/Extra.dll unpack001/AsyncRAT/Plugins/FileManager.dll unpack001/AsyncRAT/Plugins/FileSearcher.dll unpack001/AsyncRAT/Plugins/LimeLogger.dll unpack001/AsyncRAT/Plugins/Miscellaneous.dll unpack001/AsyncRAT/Plugins/Options.dll unpack001/AsyncRAT/Plugins/ProcessManager.dll unpack001/AsyncRAT/Plugins/Recovery.dll unpack001/AsyncRAT/Plugins/RemoteCamera.dll unpack001/AsyncRAT/Plugins/RemoteDesktop.dll unpack001/AsyncRAT/Plugins/SendFile.dll unpack001/AsyncRAT/Plugins/SendMemory.dll unpack001/AsyncRAT/Stub/Stub.exe unpack001/AsyncRAT/upload.config.exe
File Explorer
-
AsyncRAT.rar.rar 9.4MB
-
AsyncRAT/AsyncRAT.exe.config.xml 5KB
-
AsyncRAT/AsyncRAT.lnk.lnk 938B
-
AsyncRAT/Plugins/Chat.dll.dll 367KB
-
AsyncRAT/Plugins/Extra.dll.dll 375KB
-
AsyncRAT/Plugins/FileManager.dll.dll 392KB
-
AsyncRAT/Plugins/FileSearcher.dll.dll 433KB
-
AsyncRAT/Plugins/LimeLogger.dll.dll 368KB
-
AsyncRAT/Plugins/Miscellaneous.dll.dll 560KB
-
AsyncRAT/Plugins/Options.dll.dll 378KB
-
AsyncRAT/Plugins/ProcessManager.dll.dll 361KB
-
AsyncRAT/Plugins/Recovery.dll.dll 600KB
-
AsyncRAT/Plugins/RemoteCamera.dll.dll 452KB
-
AsyncRAT/Plugins/RemoteDesktop.dll.dll 390KB
-
AsyncRAT/Plugins/SendFile.dll.dll 368KB
-
AsyncRAT/Plugins/SendMemory.dll.dll 367KB
-
AsyncRAT/Stub/Stub.exe.exe 38KB
-
AsyncRAT/upload.config.exe.exe 9.8MB
AsyncRAT/AsyncRAT.exe.config
- SHA256 58f956abe9d717683f4a1cfa6f70e256c80461315a8d47b6456116b3d3075372
- MD5 cb1f2dcfeb5cbb5af8efa7ea40b8e908
- SHA1 ceb040761554040cac2fc7ca18623498d3bfc7ce
- SHA512 f0d805bb7983a111b7083e08d5e53c30dd78a0a5fa2baa2af6c5d3395475a3399fd085d151cc8cce312c7eb3e11ac7c2cc78c49ff8a9bfba4b6ad6585caeaeea
- SSDEEP 96:ur71Y7KY7KPrv0bGiver/apdgaRzV6RnwhXIJ0bGiveLapdgaRzV6RQyYKS4Ypy1:ur7S7L7OrTbCyYKS/pvrsJ+J/qJvr
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/AsyncRAT.lnk
- SHA256 73394839eb747e047a28514e790c0d7c042488a277d42e984a284c84d3cd1927
- MD5 11f2bb2a95bfa3212ceafb66deeffdf2
- SHA1 e68061495dc371e5a0dbd2c4130e908c680daf9e
- SHA512 84af86271738f75d10974972894d21dd5acf4e197fafcd097928fbdcfb71d20c0e8c35c91aa46dc7fc91968603981151f4fc59910dd7fcde95b6bfa843145b57
- MD5 SHA1 SHA512
AsyncRAT/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 37d41c7042210845593ddd7e5a5e37a37f6605305264d50a30aa2be1686000f6
- MD5 b230da150aa974d2a0801cef654cbe05
- SHA1 ab28e63c165ebd7d43d6d0eed4de2750743b9b27
- SHA512 2d81546548b6ed2e799eaaf4766ac9a811344d9f57726bed7270e289234f7b917df07deff9d1f6e93b9f4d186daefcbfd2d0181b12406a0b5b81e3bdffa65aaf
- SSDEEP 6144:x5S/ect/xQQq1EFBa1jTfHjGqyREilSwAV:x5G/e1EFQ1jzjGREy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
382030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
365KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7dd3978e7721f4460d639d17c47fe1307917dbacfb858d0d12e403105cd47089
- MD5 3bbcb7c7967c714f767d751db17ed1d0
- SHA1 ea15b176c5c7073bfa3bb58ebe9280b032414fbc
- SHA512 c20bf3b9b4051b050b6efebbe3c6ea54e520d68172f4ef7bbab961169c4479e9c77b39719e0139edd6ff4c4366b355579226f49aa979331ac8ab8c69bf3a165f
- SSDEEP 6144:/rUTePJZAbxMCgxth8mzMkv8WLBuqcLA5rm5N8LBOTqi:/jA6jL93J4H
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
390590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
373KB
Virtual Size
373KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9d1b94035f381b5183e82a317f001725674c8ea1c5cd82ab5af408f7f53ca19d
- MD5 9caa1fa3b3b7824167610d309446223d
- SHA1 093fa014488ea1ddacf083c398fb8b2d07b8a0e0
- SHA512 feba121ed3ccdef26b0c78874c5247cbb223b2992649fed6bbc088bfe952cf86de1145d84666048ad37b0f2c6a9dcd4da95cf972ec790b43deeb1c22322d17e1
- SSDEEP 6144:6vqHIAq0cvNthE4a2pO/LyRJPZVjTT6gsduuufuujuFyJTququqqqqqqLffffqpU:6vqH/glcwkU5mgsRU0OGF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
407918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
390KB
Virtual Size
390KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a6bdd625fa1d9a7ee66e4ca09ced0b3dca8afd2ad92ecaf44fd9a879b57cb198
- MD5 4e1922ee8333847507a34823ed695131
- SHA1 5df1f96b0a0a43eadeb101c54864a85cf51e9521
- SHA512 e4f2bc24f7d44e19580d561599b563ef2d011cffbd64851c867b03aab22e650da55150b6bc9c02389acffe546efdcc17da72204fef4e6e49a53e27be1a290f0a
- SSDEEP 6144:TwLb1j1VL6d/kA1EegwpfzSv/OLpvt4WIkE0ej:Tib1jKcA1ow9+Q2WIkE0e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
449086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
431KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/LimeLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cd5cdf0eade067fb0d97881258e4e29d88386cc9ec7a6ea315d159d284858857
- MD5 732839c93b7e0ab6796cb1c4544eda66
- SHA1 2dc3d39d74a5b72e6320596f92bcfc15edda3915
- SHA512 faa264925d636fa743d0448ce97c0b26ed7974b48c2fbf66000993119749d721bc27cf2626c3eaac3b1374abc0d16cca9e8222c4da054d1aeb56b34505fbeec6
- SSDEEP 6144:T7qj3iWg0kHC86FItOZrhFx4aXCEzwHyFt:T03iutXCa2g
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
383294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 783d9d5334aa40f35acf8ff941a6b5bed908fd94dc14a05712b8a9eb9220cd5b
- MD5 07ba8685ca3faff186f0d9f5400c1117
- SHA1 a673a7b55e4cf168856a7d3564a5521f0f8fc4e5
- SHA512 358c85a586d8b590497ea180eae76608ef38a4de09b95e907632bbad8f2c522bec4ea5568017ea1120a1553abb2be730006613872fe053b1fc00a36d005ab096
- SSDEEP 6144:ZksM6LbRsGOlShLHZIVEvLht0Raf2K/lPqmiGk4IuzvjPEzd4P0m/KUweRq:pM6nRsHlSRLBuwImD5f88B
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
579614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
558KB
Virtual Size
558KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8dc80b8bf9b3123289e132270e74a31176deec4f74e6ac20d7b6a9fcdb89e8a1
- MD5 a1b5048e3f10f7105bd47244b2930137
- SHA1 a12cbae3ec815ce704fafb0e2eadb9f31ccbb6f3
- SHA512 fcae7c456f71e03afe2e67954fc3c9491978a54825436c51b351c47adb6cd8a1ef15e0e6f6d99094b986ff910e21a287a7de9e4ca2818221aa858152a8c6dfe9
- SSDEEP 6144:k7VK+5AKNyvekG+3IoH3MAYV+kpDBWOcFN94f:kk3Kg731H3Md+XHf9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
392830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
376KB
Virtual Size
375KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ad861ad9bc3edfdd486c060879f4f2450a51757c67f3b514f71381057580218
- MD5 fced22a0c1edad786a59703842fd3b14
- SHA1 dceabc613c694f7f2f6439ea176988fb373d6a29
- SHA512 8904c36c364d29244c598895e877d7897547ce2a187adb197ba281a0512ca3ff52464c478fc42a2ec7f614dd0f91dea2dbb31f4af81c6c0f08cd23f79a71f57c
- SSDEEP 6144:hyk5beTVvGG3vwtudJgKsvAjHvzA1AXly:wNGGotYJQvgHbKA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
376158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
359KB
Virtual Size
359KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7fd48ac68f182e0ced2ace00b223fa1d35bd8a20d75600b5400267cd5db5cc84
- MD5 d8793438a77750cea1b0d7eaad3d0d0d
- SHA1 36bb36d6dabaa1285dbe7ba26581322630984c71
- SHA512 68e00d97edf0ab768d40672d3b39dfcd09d8ff81b3e6abfdcfa8db88d66ae6070c8b6ad2c540538dd6f47da0174f9ab2d48cd7bef95d6021ffb844c71289822d
- SSDEEP 12288:3I5Ii5aNgfO5Bt844Wn1JwygRuE4pYGmDonx:3IcqfOryJWnVrYNDIx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
620462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
598KB
Virtual Size
597KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 87938027a63a867b831c86611dc6a2c1fc6af61526dc2269328af4b59e15b1e1
- MD5 1b2c9164e625b600e699151de11d9e98
- SHA1 2ce0aa3161c641623afd1acfa922fce5f10a709c
- SHA512 aa0785b079059463a1df409380451c2be7c3bd627a199661627815f364689ed3816dc9cb78725fab510d687d6866186f3fbdb62b633554b9a0aa324730487729
- SSDEEP 6144:npMSjYV8M+c7YervSBlnzYuYyb5A5XAxCqDS5aVorhdt+b5V20JBmYrtog:nqV8a0OaLYCAQLD8CF5h3t
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
468926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
450KB
Virtual Size
449KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 56fd699258a7186f709068c283cd725797bab392e3a6f1cd28f35bbdb3e98e38
- MD5 cd4a9e669264419eca4de564e6272fe0
- SHA1 bb69bb1542ea06395df74dbedc98866d6c8a36cb
- SHA512 5addb4f97c7e1cb69e5167e670bd2c3a817e0415f1fd8a5158af7e03e4340a8b1a6d803e85c9ea56415b9e7d3dcb4c352775a6a6b4770443d72114396ffaa1e5
- SSDEEP 6144:KdHdVObvTS8nmScJEB/2Jin8SF1hG+ht6Oaynf/wKlWCkKI5J5sZva:xCQ2wHFagf/wKlncg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
405310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
388KB
Virtual Size
387KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1a717c40ff7f60c18953b46a69a8fc47cce7dad6116cd3715deb2abf0d80722d
- MD5 c4b11c003ed1e394597f6a5201826a59
- SHA1 8de5d19d0d1638f24718bf87c3245cef74f48341
- SHA512 ee93a9bd9f77284af5fe0b4d1ef96fbb0ded00aeb045cae380bfc01be45c76d9d0a481f1d4a6f206124603b99c23a8b6054dcdc65e7e5913373b1739e1b310b1
- SSDEEP 6144:7aU0XFbDW0+JDzXNj8QrGchz6q7V7u85:7aU0XCJDbdnrGyT1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
382782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/SendMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b0b5dda6cac5d1e91958379dc1fda602dd1566127f21e30196382743a350a4d8
- MD5 dbd937cf1098405994b1295056dce5bb
- SHA1 9b47cff5dc8cc6b4868a3715412b425c2b5b49cf
- SHA512 2795b1249829d43f43291394fd33821caa3a0ed654c3d9a75f0cd52ac94f1e1bb3d2ab87f81333779d789112c359ddb059c8b4616c95903761b1539e54ec9d61
- SSDEEP 6144:QJ+x17+H67OgnfFPE0f4UKXdEvllmXOocZqOA8IhOueA1Cv6afvx:iPonRE0f4UKXdE9lmXOocZqD51CyE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
381438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
365KB
Virtual Size
364KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Stub/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0e19cefba973323c234322452dfd04e318f14809375090b4f6ab39282f6ba07e
- MD5 f76702fa423ce2b2b4b0fdcf547b0789
- SHA1 ea408a4419e8a3139ef14df987608964c12d3190
- SHA512 03c7d8814687bb4f11ac41a555f368d89d5be749c92624073b77da0e57d872df201f2657b180ad0c9d5bc9ffa0a85989bf31374c7e5deefa06cf36bce3697971
- SSDEEP 768:9Xaug0LrCc4d7VtOjkR26/XgNhKwEuyj67zACVyI1rXDjkY5Z07:dafSuVtOGfgTKwt3Nk7
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/upload.config.exe
- IMPHASH 7e1221cafc3caaa733102ebe83962e77
- SHA256 de47ee6f5098830b2569a1f0f889e021a9be2604093e3e157852060d307aa9f2
- MD5 7a1eaa75ff1d1e83f564d0e5312a0930
- SHA1 91988fcd3ffe2945d614f2141e0124f9ebcd6e01
- SHA512 b1d06ffc724e7a393387fb84900af0badf3a84bfe3ea0b2bed27d41f3114586e7b25b9661c2f23476b51b6cf9d5dcb36cf1d807c5441909b2a8315e4d40cc8c7
- SSDEEP 49152:Plnb9f3/00iPuJXm6Os/CTu9VnAaZ+6AmX9mQXd0ujFFoyS+km9nmgMfq9+s6ewR:NnF00iPu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WinExec
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fdopen
_filelengthi64
_fileno
_fileno
_fmode
_fstat64
_get_osfhandle
_initterm
_lseeki64
_read
_setjmp
_strdup
_vscprintf
_vsnprintf
_wfopen
_write
abort
atexit
calloc
exit
fclose
fflush
fgetpos
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
isalnum
iswctype
localeconv
longjmp
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
printf
putc
putwc
realloc
setlocale
setvbuf
signal
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strtoul
strxfrm
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm
Name
.text
Size
817KB
Virtual Size
817KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
8.9MB
Virtual Size
8.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ