JaffaCakes118_6dfef684475fcbf722f88337d630668b6fcb73864daa9a7e65f3642d3766fdfc

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_6dfef684475fcbf722f88337d630668b6fcb73864daa9a7e65f3642d3766fdfc
Size

1.1MB
MD5

4dee5e8c48891cbaa6bff2e447a34780
SHA1

109b56248514eb5a6b27fa9b48ac9cec6fb55d62
SHA256

6dfef684475fcbf722f88337d630668b6fcb73864daa9a7e65f3642d3766fdfc
SHA512

643227614fb34b035494dee42f8285ae1dfd5c15c3b560a018786cae40ae4fcd34a427bc1a30395d238405d76d4b96c6c8797850ef2563b5ed018dfa9804c577
SSDEEP

24576:MCsAf6UELHKSoVBxiR2b/n31ZgvWX7GlEMHsIjOrzSmxvvjGbL:Vs3HKSABEO3vgOX7G9+zFZg

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702
unpack001/0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892
unpack001/0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591
unpack001/16af8d85ef82a5a35e0ba0a87577cbe221374c0cc55d58bc326139c6207ef338
unpack001/180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843
unpack001/23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f
unpack001/3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca
unpack001/41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700

Files

JaffaCakes118_6dfef684475fcbf722f88337d630668b6fcb73864daa9a7e65f3642d3766fdfc
.zip

Password: infected
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702
.exe windows:5 windows x86 arch:x86

fcf3fbb8b064430343fc386d46afa4ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\tekucadodarubaya sas82_nenesid la.pdb

Imports

kernel32

GetPrivateProfileSectionNamesW
HeapCompact
lstrlenA
CopyFileExW
GetDriveTypeW
CallNamedPipeA
SetUnhandledExceptionFilter
GetCommState
SetEnvironmentVariableW
GetNamedPipeHandleStateA
GetComputerNameW
CallNamedPipeW
GetProcessPriorityBoost
FindNextVolumeMountPointA
InitializeCriticalSection
_hread
GetPrivateProfileStructW
SetConsoleMode
ReadFile
lstrcatA
GetBinaryTypeW
GetOverlappedResult
GetACP
DeactivateActCtx
FillConsoleOutputCharacterW
GetLastError
GetCurrentDirectoryW
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
CopyFileA
SetStdHandle
LoadLibraryA
LocalAlloc
BuildCommDCBAndTimeoutsW
IsSystemResumeAutomatic
SetConsoleDisplayMode
SetConsoleOutputCP
GetTapeParameters
GetOEMCP
DebugSetProcessKillOnExit
CreateIoCompletionPort
CreateMutexA
EnumDateFormatsW
GetVersionExA
LocalSize
AddConsoleAliasA
CommConfigDialogW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
HeapFree
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
HeapReAlloc
HeapAlloc
GetStartupInfoW
GetCPInfo
RtlUnwind
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetFileType
GetConsoleCP
GetConsoleMode
HeapCreate
VirtualFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
HeapSize
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
GetLocaleInfoW
CreateFileA
CloseHandle
FlushFileBuffers

user32

GetAncestor

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892
.exe windows:5 windows x86 arch:x86

7bd2e5fa6a60233b32aae2586fd8acda

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetCurrentProcess
CreateThread
GetCurrentThread
SetLastError
WaitForMultipleObjects
Sleep
CloseHandle
WinExec
GetLocalTime
GetTickCount
LoadLibraryA
GetSystemDirectoryA
CreateFileW
DecodePointer
WriteConsoleW
SetFilePointerEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
RtlUnwind
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetACP
HeapFree
HeapAlloc
GetStringTypeW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RaiseException

ws2_32

htons
htonl
bind
inet_addr

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 198KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.measles
Size: 512B - Virtual size: 479B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.balladw
Size: 512B - Virtual size: 481B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gynandr
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.poulter
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.postror
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.quercet
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sumpit
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tymp
Size: 1024B - Virtual size: 586B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.seduct
Size: 1024B - Virtual size: 590B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.swonken
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bocardo
Size: 512B - Virtual size: 363B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.solidar
Size: 1024B - Virtual size: 590B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.whimsic
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.plasmod
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sensele
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.placer
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.astigma
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gnawn
Size: 1024B - Virtual size: 550B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.anemota
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.apal
Size: 512B - Virtual size: 465B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.octomer
Size: 1024B - Virtual size: 554B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tabler
Size: 512B - Virtual size: 486B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pennae
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.varanid
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tuition
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ectobat
Size: 512B - Virtual size: 386B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.doublin
Size: 512B - Virtual size: 429B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tantali
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.inerrat
Size: 1024B - Virtual size: 528B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wiggler
Size: 512B - Virtual size: 312B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bacteri
Size: 512B - Virtual size: 340B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.outswel
Size: 1024B - Virtual size: 577B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.impenit
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.heliome
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ind
Size: 1024B - Virtual size: 626B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.defecto
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.untoggl
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.apomict
Size: 1024B - Virtual size: 595B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.schilli
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ashcake
Size: 512B - Virtual size: 460B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.anemobi
Size: 1024B - Virtual size: 619B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.schoolm
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mutage
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.griever
Size: 512B - Virtual size: 369B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kadarit
Size: 512B - Virtual size: 453B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.caratch
Size: 512B - Virtual size: 407B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.thoroug
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.thoroug
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rightfu
Size: 512B - Virtual size: 325B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.coralli
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.greensa
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.scabriu
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.overtak
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sapinda
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.superac
Size: 512B - Virtual size: 30B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.portall
Size: 512B - Virtual size: 248B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.b
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.testor
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.diamagn
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sniping
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.semifab
Size: 512B - Virtual size: 166B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.platyrr
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
16af8d85ef82a5a35e0ba0a87577cbe221374c0cc55d58bc326139c6207ef338
.exe windows:5 windows x86 arch:x86

01d4b8b92a8773177c920859f8f839a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetIpNetTable

kernel32

Sleep
SetFilePointer
CloseHandle
LoadLibraryA
SetLastError
GetTempPathW
CreateFileW
GetVersionExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLastError
GetCurrentThread
CreateThread
ExitProcess
GetCurrentProcess
GetProcessHeap
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
GlobalAlloc
GetProcAddress
FreeLibrary
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetStringTypeW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
SetFilePointerEx
DecodePointer

advapi32

OpenSCManagerW
EnumServicesStatusW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenThreadToken
ImpersonateSelf

shell32

ShellExecuteW

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.extjmp
Size: 65KB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843
.exe windows:5 windows x86 arch:x86

66601be2b1137d46793d7b753c44f961

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
RaiseException
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
Sleep
ExitProcess
HeapReAlloc
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetErrorMode
GetOEMCP
GetCPInfo
GetModuleHandleW
FlushFileBuffers
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GlobalFlags
WritePrivateProfileStringA
InterlockedDecrement
GetModuleFileNameW
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
FormatMessageA
LocalFree
MultiByteToWideChar
MulDiv
GlobalUnlock
GlobalFree
FreeResource
GetCurrentProcessId
SetLastError
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
LoadLibraryA
WideCharToMultiByte
CompareStringA
FindResourceA
LoadResource
LockResource
SizeofResource
InterlockedExchange
GlobalLock
GlobalAlloc
FreeLibrary
GetModuleHandleA
GetProcAddress
VirtualAlloc
CreateFileA
SetFilePointer
lstrcpynA
lstrcatA
FindFirstFileA
lstrcmpA
FindNextFileA
FindClose
lstrcpyA
CreatePipe
GetCurrentProcess
DuplicateHandle
CreateProcessA
WaitForSingleObject
TerminateProcess
ReadFile
GetLastError
WriteFile
lstrlenA
GetFileType
CloseHandle

user32

UnregisterClassA
DestroyMenu
GetSysColorBrush
LoadCursorA
WindowFromPoint
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ShowWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
MessageBoxA
wsprintfA
DrawIcon
SendMessageA
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindow
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetForegroundWindow
IsIconic
GetClientRect
EnableWindow
LoadIconA
GetSystemMetrics
PostQuitMessage
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible

gdi32

DeleteDC
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
RectVisible
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
CreateBitmap
PtVisible
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
TextOutA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextW
CryptImportKey
CryptEncrypt

shell32

SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA

shlwapi

PathFindFileNameA
PathRemoveFileSpecW
PathFindExtensionA

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 401KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f
.exe windows:5 windows x86 arch:x86

7bd2e5fa6a60233b32aae2586fd8acda

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetCurrentProcess
CreateThread
GetCurrentThread
SetLastError
WaitForMultipleObjects
Sleep
CloseHandle
WinExec
GetLocalTime
GetTickCount
LoadLibraryA
GetSystemDirectoryA
CreateFileW
DecodePointer
WriteConsoleW
SetFilePointerEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
RtlUnwind
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetACP
HeapFree
HeapAlloc
GetStringTypeW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RaiseException

ws2_32

htons
htonl
bind
inet_addr

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca
.exe windows:5 windows x86 arch:x86

d2fa03954b6bd3bb1c9a62ef266f6726

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vizo semirupobu kepigi.pdb

Imports

kernel32

HeapCompact
SetPriorityClass
lstrlenA
CopyFileExW
GetDriveTypeW
CommConfigDialogA
BuildCommDCBAndTimeoutsA
FreeLibrary
CallNamedPipeA
GetCommState
GetNamedPipeHandleStateA
AddConsoleAliasW
GetComputerNameW
CallNamedPipeW
SetCommState
SetProcessPriorityBoost
InitializeCriticalSection
ActivateActCtx
GlobalAlloc
LoadLibraryW
_hread
GetVersionExW
SetConsoleMode
GetBinaryTypeA
ReadFile
lstrcatA
GetACP
RaiseException
CreateJobObjectA
IsDBCSLeadByteEx
GetCurrentDirectoryW
SetLastError
GetTapeStatus
VirtualAlloc
BeginUpdateResourceW
CopyFileA
GetConsoleDisplayMode
IsSystemResumeAutomatic
SetConsoleOutputCP
AddAtomW
PostQueuedCompletionStatus
GetPrivateProfileStructA
SetEnvironmentVariableA
GetPrivateProfileSectionNamesA
GetOEMCP
EnumDateFormatsA
GetThreadPriority
DebugSetProcessKillOnExit
CreateIoCompletionPort
CreateMutexA
VirtualProtect
LocalSize
CreateFileA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
HeapReAlloc
HeapAlloc
GetCommandLineA
GetStartupInfoA
GetCPInfo
RtlUnwind
LCMapStringW
LCMapStringA
GetStringTypeW
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapCreate
VirtualFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
HeapSize
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle

user32

GetAncestor

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 153KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 351KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

fcf3fbb8b064430343fc386d46afa4ce

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 93KB - Virtual size: 92KB

.data Size: 11KB - Virtual size: 4.0MB

.rsrc Size: 22KB - Virtual size: 22KB

7bd2e5fa6a60233b32aae2586fd8acda

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 22KB - Virtual size: 50KB

.gfids Size: 512B - Virtual size: 172B

Headers

File Characteristics

Sections

.text Size: 198KB - Virtual size: 221KB

.measles Size: 512B - Virtual size: 479B

.balladw Size: 512B - Virtual size: 481B

.gynandr Size: 512B - Virtual size: 24KB

.poulter Size: 512B - Virtual size: 24KB

.postror Size: 512B - Virtual size: 24KB

.quercet Size: 512B - Virtual size: 24KB

.sumpit Size: 1024B - Virtual size: 24KB

.tymp Size: 1024B - Virtual size: 586B

.seduct Size: 1024B - Virtual size: 590B

.swonken Size: 512B - Virtual size: 24KB

.bocardo Size: 512B - Virtual size: 363B

.solidar Size: 1024B - Virtual size: 590B

.whimsic Size: 512B - Virtual size: 24KB

.plasmod Size: 512B - Virtual size: 24KB

.sensele Size: 512B - Virtual size: 24KB

.placer Size: 1024B - Virtual size: 520B

.astigma Size: 1024B - Virtual size: 24KB

.gnawn Size: 1024B - Virtual size: 550B

.anemota Size: 512B - Virtual size: 24KB

.apal Size: 512B - Virtual size: 465B

.octomer Size: 1024B - Virtual size: 554B

.tabler Size: 512B - Virtual size: 486B

.pennae Size: 512B - Virtual size: 24KB

.varanid Size: 512B - Virtual size: 24KB

.tuition Size: 512B - Virtual size: 388B

.ectobat Size: 512B - Virtual size: 386B

.doublin Size: 512B - Virtual size: 429B

.tantali Size: 1024B - Virtual size: 24KB

.inerrat Size: 1024B - Virtual size: 528B

.wiggler Size: 512B - Virtual size: 312B

.bacteri Size: 512B - Virtual size: 340B

.outswel Size: 1024B - Virtual size: 577B

.impenit Size: 1024B - Virtual size: 24KB

.heliome Size: 512B - Virtual size: 24KB

.ind Size: 1024B - Virtual size: 626B

.defecto Size: 512B - Virtual size: 24KB

.untoggl Size: 1024B - Virtual size: 24KB

.apomict Size: 1024B - Virtual size: 595B

.schilli Size: 512B - Virtual size: 24KB

.ashcake Size: 512B - Virtual size: 460B

.anemobi Size: 1024B - Virtual size: 619B

.schoolm Size: 1024B - Virtual size: 24KB

.mutage Size: 512B - Virtual size: 24KB

.griever Size: 512B - Virtual size: 369B

.kadarit Size: 512B - Virtual size: 453B

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 93KB - Virtual size: 92KB

.data
Size: 11KB - Virtual size: 4.0MB

.rsrc
Size: 22KB - Virtual size: 22KB

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 22KB - Virtual size: 50KB

.gfids
Size: 512B - Virtual size: 172B

.text
Size: 198KB - Virtual size: 221KB

.measles
Size: 512B - Virtual size: 479B

.balladw
Size: 512B - Virtual size: 481B

.gynandr
Size: 512B - Virtual size: 24KB

.poulter
Size: 512B - Virtual size: 24KB

.postror
Size: 512B - Virtual size: 24KB

.quercet
Size: 512B - Virtual size: 24KB

.sumpit
Size: 1024B - Virtual size: 24KB

.tymp
Size: 1024B - Virtual size: 586B

.seduct
Size: 1024B - Virtual size: 590B

.swonken
Size: 512B - Virtual size: 24KB

.bocardo
Size: 512B - Virtual size: 363B

.solidar
Size: 1024B - Virtual size: 590B

.whimsic
Size: 512B - Virtual size: 24KB

.plasmod
Size: 512B - Virtual size: 24KB

.sensele
Size: 512B - Virtual size: 24KB

.placer
Size: 1024B - Virtual size: 520B

.astigma
Size: 1024B - Virtual size: 24KB

.gnawn
Size: 1024B - Virtual size: 550B

.anemota
Size: 512B - Virtual size: 24KB

.apal
Size: 512B - Virtual size: 465B

.octomer
Size: 1024B - Virtual size: 554B

.tabler
Size: 512B - Virtual size: 486B

.pennae
Size: 512B - Virtual size: 24KB

.varanid
Size: 512B - Virtual size: 24KB

.tuition
Size: 512B - Virtual size: 388B

.ectobat
Size: 512B - Virtual size: 386B

.doublin
Size: 512B - Virtual size: 429B

.tantali
Size: 1024B - Virtual size: 24KB

.inerrat
Size: 1024B - Virtual size: 528B

.wiggler
Size: 512B - Virtual size: 312B

.bacteri
Size: 512B - Virtual size: 340B

.outswel
Size: 1024B - Virtual size: 577B

.impenit
Size: 1024B - Virtual size: 24KB

.heliome
Size: 512B - Virtual size: 24KB

.ind
Size: 1024B - Virtual size: 626B

.defecto
Size: 512B - Virtual size: 24KB

.untoggl
Size: 1024B - Virtual size: 24KB

.apomict
Size: 1024B - Virtual size: 595B

.schilli
Size: 512B - Virtual size: 24KB

.ashcake
Size: 512B - Virtual size: 460B

.anemobi
Size: 1024B - Virtual size: 619B

.schoolm
Size: 1024B - Virtual size: 24KB

.mutage
Size: 512B - Virtual size: 24KB

.griever
Size: 512B - Virtual size: 369B

.kadarit
Size: 512B - Virtual size: 453B

.caratch
Size: 512B - Virtual size: 407B

.thoroug
Size: 512B - Virtual size: 24KB

.thoroug
Size: 512B - Virtual size: 24KB

.rightfu
Size: 512B - Virtual size: 325B

.coralli
Size: 512B - Virtual size: 24KB

.greensa
Size: 512B - Virtual size: 24KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 19KB - Virtual size: 43KB

.scabriu
Size: 512B - Virtual size: 24KB

.overtak
Size: 512B - Virtual size: 24KB

.sapinda
Size: 512B - Virtual size: 24KB

.superac
Size: 512B - Virtual size: 30B

.portall
Size: 512B - Virtual size: 248B

.b
Size: 512B - Virtual size: 24KB

.testor
Size: 512B - Virtual size: 24KB

.diamagn
Size: 512B - Virtual size: 24KB

.sniping
Size: 512B - Virtual size: 24KB

.semifab
Size: 512B - Virtual size: 166B

.platyrr
Size: 512B - Virtual size: 100B

.rsrc
Size: 205KB - Virtual size: 204KB

.text
Size: 72KB - Virtual size: 72KB

.rdata
Size: 26KB - Virtual size: 26KB

.extjmp
Size: 65KB - Virtual size: 2.7MB

.gfids
Size: 512B - Virtual size: 172B

.text
Size: 180KB - Virtual size: 179KB

.rdata
Size: 44KB - Virtual size: 43KB