Overview
overview
10Static
static
3e1a21cb307...40.exe
windows7-x64
10e1a21cb307...40.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Endegyldig...in.dll
windows7-x64
1Endegyldig...in.dll
windows10-2004-x64
1Endegyldig...-7.dll
windows7-x64
1Endegyldig...-7.dll
windows10-2004-x64
1Ravneagtig...0.html
windows7-x64
3Ravneagtig...0.html
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
e1a21cb3070236ea19031333fd1e7f05d9423040785d18ddb3ca87b79e446840.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1a21cb3070236ea19031333fd1e7f05d9423040785d18ddb3ca87b79e446840.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Endegyldighed/ingemanns/VirtualDrivePlugin.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Endegyldighed/ingemanns/VirtualDrivePlugin.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Endegyldighed/ingemanns/libffi-7.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Endegyldighed/ingemanns/libffi-7.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Ravneagtigt/Sudder/libxml2-2.0.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Ravneagtigt/Sudder/libxml2-2.0.html
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_a73e3a58ee40d331a22ff7a42221d155126559065108a1da6428fb79e67c887f
-
Size
314KB
-
MD5
400b1caca0b7bbe268371d5fd0f9b1e6
-
SHA1
33fd5f25525f0b32e8093156e9ad9ee47e269b3d
-
SHA256
a73e3a58ee40d331a22ff7a42221d155126559065108a1da6428fb79e67c887f
-
SHA512
70cae2e025a02eba6d09c680f6afa61e072488272b450c795151f8b306b3a962d66554b7ab13da89e1df7ae65b706675546dd7568957d9f6d8e2a51b27129b89
-
SSDEEP
6144:FPuFxz6OOZQPiGnW75Mw6FyCGy5o2G4lSAbBlTL78vel4VVVroFybg1:FPS6OFP58Aho23l1bvTL78vK4rb4
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/Endegyldighed/ingemanns/libffi-7.dll
Files
-
JaffaCakes118_a73e3a58ee40d331a22ff7a42221d155126559065108a1da6428fb79e67c887f.zip
Password: infected
-
e1a21cb3070236ea19031333fd1e7f05d9423040785d18ddb3ca87b79e446840.exe windows:4 windows x86 arch:x86
e2a592076b17ef8bfb48b7e03965a3fc
Code Sign
39:ee:6c:f2:29:78:c9:f3Certificate
IssuerCN=Snrehul Bouillonterningen\ ,OU=Canli Aabningskampenes\ ,O=Trin,L=Bucha,ST=Thüringen,C=DE,1.2.840.113549.1.9.1=#0c1a416d79636c6165616e404a6f636b6579696e673138362e646576Not Before31-08-2022 01:18Not After30-08-2025 01:18SubjectCN=Snrehul Bouillonterningen\ ,OU=Canli Aabningskampenes\ ,O=Trin,L=Bucha,ST=Thüringen,C=DE,1.2.840.113549.1.9.1=#0c1a416d79636c6165616e404a6f636b6579696e673138362e6465762b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate
IssuerCN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PLNot Before28-07-2022 08:56Not After27-07-2033 08:56SubjectCN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PLExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate
IssuerCN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PLNot Before19-05-2021 05:32Not After18-05-2036 05:32SubjectCN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PLExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate
IssuerCN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PLNot Before31-05-2021 06:43Not After17-09-2029 06:43SubjectCN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PLKey Usages
KeyUsageCertSign
KeyUsageCRLSign
c7:d3:db:2b:f1:1d:ee:b2:e0:4f:3f:d4:11:82:25:fb:eb:a7:c9:85:84:bd:bb:63:db:a4:b4:9b:d6:b7:b2:71Signer
Actual PE Digestc7:d3:db:2b:f1:1d:ee:b2:e0:4f:3f:d4:11:82:25:fb:eb:a7:c9:85:84:bd:bb:63:db:a4:b4:9b:d6:b7:b2:71Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
MoveFileW
SetFileAttributesW
GetCurrentProcess
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
WaitForSingleObject
CopyFileW
CompareFileTime
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GlobalUnlock
lstrcpynW
GetDiskFreeSpaceW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 164KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 223KB - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
fc0224e99e736751432961db63a41b76
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 851B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 610B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Endegyldighed/ingemanns/Actinomorphy.Baa
-
Endegyldighed/ingemanns/VirtualDrivePlugin.dll.dll windows:6 windows x64 arch:x64
d1c192fd95e8415609e2c583191b7b36
Code Sign
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate
IssuerCN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSignNot Before15-06-2016 00:00Not After15-06-2024 00:00SubjectCN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BEExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
32:b5:c7:f8:c1:8a:7a:2b:fb:b5:27:46Certificate
IssuerCN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BENot Before04-06-2019 05:45Not After04-06-2022 05:45SubjectSERIALNUMBER=23638777,CN=ASUSTEK COMPUTER INCORPORATION,O=ASUSTEK COMPUTER INCORPORATION,STREET=4F\, NO. 150\, LI-TE RD.\, PEI TOU,L=TAIPEI,ST=TAIPEI,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6eExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate
IssuerCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-01-2021 00:00Not After06-01-2031 00:00SubjectCN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before07-01-2016 12:00Not After07-01-2031 12:00SubjectCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
46:3c:12:cf:88:ba:f5:d5:60:31:d3:9c:46:84:9c:60:f0:7b:19:3f:e2:17:c6:56:f6:b1:d5:cc:94:c2:ec:6cSigner
Actual PE Digest46:3c:12:cf:88:ba:f5:d5:60:31:d3:9c:46:84:9c:60:f0:7b:19:3f:e2:17:c6:56:f6:b1:d5:cc:94:c2:ec:6cDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\GamingCenter3.0\GC3.VirtualDrive\Service\ServiceSDK\Release\VirtualDrivePlugin\VirtualDrivePlugin.pdb
Imports
shlwapi
PathRemoveFileSpecW
PathAddBackslashW
PathIsDirectoryW
PathAppendW
PathFileExistsW
kernel32
LoadLibraryW
CreateThread
GetProcAddress
FreeLibrary
WinExec
FileTimeToLocalFileTime
OutputDebugStringW
GetLastError
Sleep
ReleaseMutex
IsDebuggerPresent
InitializeSListHead
WaitForSingleObject
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
lstrcmpA
SetUnhandledExceptionFilter
FileTimeToSystemTime
SystemTimeToFileTime
MultiByteToWideChar
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
CloseHandle
CreateMutexW
GetModuleFileNameW
CreateDirectoryW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
InitializeCriticalSection
user32
wsprintfW
advapi32
GetUserNameW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
shell32
ShellExecuteW
ole32
CoInitializeEx
StringFromCLSID
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
oleaut32
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString
VariantInit
msvcp140
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Lockit@std@@QEAA@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
_Thrd_id
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
crypt32
CertGetNameStringW
CryptQueryObject
CryptDecodeObject
CryptMsgGetParam
CryptMsgClose
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
wintrust
WinVerifyTrust
vcruntime140
__std_exception_destroy
__C_specific_handler
__std_terminate
memcmp
_purecall
__std_exception_copy
__CxxFrameHandler3
memcpy
memset
_CxxThrowException
memmove
__std_type_info_destroy_list
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
fputc
fflush
__stdio_common_vsscanf
__stdio_common_vsnwprintf_s
fgetc
__stdio_common_vswprintf
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
setvbuf
fgetpos
fclose
fwrite
api-ms-win-crt-string-l1-1-0
towlower
wcscpy_s
wcsncpy_s
_wcsnicmp
strncpy_s
_stricmp
_wcsicmp
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
remove
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_execute_onexit_table
_configure_narrow_argv
_initialize_onexit_table
_cexit
_invalid_parameter_noinfo
_seh_filter_dll
_initterm_e
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_initterm
_errno
_crt_atexit
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
Exports
Exports
QueryLibrary
Sections
.text Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Endegyldighed/ingemanns/libffi-7.dll.dll windows:4 windows x64 arch:x64
6b539304435d48771cc36f5f9462fabf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
GetSystemInfo
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
memcpy
realloc
strlen
strncmp
vfprintf
Exports
Exports
ffi_call
ffi_call_go
ffi_call_win64
ffi_closure_alloc
ffi_closure_free
ffi_closure_win64
ffi_closure_win64_inner
ffi_data_to_code_pointer
ffi_get_struct_offsets
ffi_go_closure_win64
ffi_java_ptrarray_to_raw
ffi_java_raw_call
ffi_java_raw_size
ffi_java_raw_to_ptrarray
ffi_prep_cif
ffi_prep_cif_core
ffi_prep_cif_machdep
ffi_prep_cif_var
ffi_prep_closure
ffi_prep_closure_loc
ffi_prep_go_closure
ffi_prep_java_raw_closure
ffi_prep_java_raw_closure_loc
ffi_prep_raw_closure
ffi_prep_raw_closure_loc
ffi_ptrarray_to_raw
ffi_raw_call
ffi_raw_size
ffi_raw_to_ptrarray
ffi_type_complex_double
ffi_type_complex_float
ffi_type_complex_longdouble
ffi_type_double
ffi_type_float
ffi_type_longdouble
ffi_type_pointer
ffi_type_sint16
ffi_type_sint32
ffi_type_sint64
ffi_type_sint8
ffi_type_uint16
ffi_type_uint32
ffi_type_uint64
ffi_type_uint8
ffi_type_void
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 1004B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Furazan/recanters/afspilles/Xanthoprotein/multimedia-player-apple-ipod-touch-symbolic.svg
-
Ravneagtigt/Sudder/libxml2-2.0.typelib.html
-
Savvrks.ret