stormkitty | StormKitty[.]Builder[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

StormKitty.Builder.zip
Size

5.5MB
MD5

0c0015680539af7ffb68272b800db5f6
SHA1

2b0c7294ee81a20fabef2c936fca56a82b8cfbfe
SHA256

5b2415107c80165c255d444ca76ac2b1b422e5f4a1661380c39504139b75867c
SHA512

570c6d16bb7d02ffdef3e1ebbfc036a7900d78f931e1f0ec0eb53b3cd04f2a266a942801fddadcb43351ee8642596ee01feac2dfe8445a5437d4c2720597528c
SSDEEP

98304:C4kt1M20VX66e1GPLgbQBhHGtgsNoN0DtIrw5ntEhZCn/lLiWO9r28BHXHk95D5J:nE+OGo8BGasNo8cw5+CskIXE/Dcw

Score

10^/10

vmprotect stormkitty

Malware Config

Signatures

StormKitty payload 2 IoCs

resource	yara_rule
static1/unpack001/StormKitty.Builder/Builder.exe	family_stormkitty
static1/unpack001/StormKitty.Builder/stub/stub.exe	family_stormkitty

Stormkitty family
stormkitty

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/StormKitty.Builder/stub/AnonFileApi.dll	vmprotect

Unsigned PE 17 IoCs

Checks for missing Authenticode signature.

resource
unpack001/StormKitty.Builder/Builder.exe
unpack001/StormKitty.Builder/Mono.Cecil.dll
unpack001/StormKitty.Builder/obfuscator/Confuser.CLI.exe
unpack001/StormKitty.Builder/obfuscator/Confuser.Core.dll
unpack001/StormKitty.Builder/obfuscator/Confuser.DynCipher.dll
unpack001/StormKitty.Builder/obfuscator/Confuser.Protections.dll
unpack001/StormKitty.Builder/obfuscator/Confuser.Renamer.dll
unpack001/StormKitty.Builder/obfuscator/Confuser.Runtime.dll
unpack001/StormKitty.Builder/obfuscator/ConfuserEx.exe
unpack001/StormKitty.Builder/obfuscator/GalaSoft.MvvmLight.Extras.WPF4.dll
unpack001/StormKitty.Builder/obfuscator/GalaSoft.MvvmLight.WPF4.dll
unpack001/StormKitty.Builder/obfuscator/Ookii.Dialogs.Wpf.dll
unpack001/StormKitty.Builder/obfuscator/System.Windows.Interactivity.dll
unpack001/StormKitty.Builder/obfuscator/dnlib.dll
unpack001/StormKitty.Builder/stub/AnonFileApi.dll
unpack001/StormKitty.Builder/stub/DotNetZip.dll
unpack001/StormKitty.Builder/stub/stub.exe

Files

StormKitty.Builder.zip
.zip
StormKitty.Builder/Builder.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Вовочка\Desktop\StormKitty\builder\StormKittyBuilder\obj\Release\StormKittyBuilder.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/Mono.Cecil.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\sources\cecil\obj\Release\net40\Mono.Cecil.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 335KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/icons/filetypes/3GP.ico
StormKitty.Builder/icons/filetypes/AC3.ico
StormKitty.Builder/icons/filetypes/ALAC.ico
StormKitty.Builder/icons/filetypes/APE.ico
StormKitty.Builder/icons/filetypes/APK.ico
StormKitty.Builder/icons/filetypes/AVI.ico
StormKitty.Builder/icons/filetypes/CUE.ico
StormKitty.Builder/icons/filetypes/DivX.ico
StormKitty.Builder/icons/filetypes/EVO.ico
StormKitty.Builder/icons/filetypes/FLAC.ico
StormKitty.Builder/icons/filetypes/FLV.ico
StormKitty.Builder/icons/filetypes/HD.ico
StormKitty.Builder/icons/filetypes/HDMOV.ico
StormKitty.Builder/icons/filetypes/JAR.ico
StormKitty.Builder/icons/filetypes/LOG.ico
StormKitty.Builder/icons/filetypes/M3U.ico
StormKitty.Builder/icons/filetypes/M4A.ico
StormKitty.Builder/icons/filetypes/M4V.ico
StormKitty.Builder/icons/filetypes/MID.ico
StormKitty.Builder/icons/filetypes/MIDI.ico
StormKitty.Builder/icons/filetypes/MKV.ico
StormKitty.Builder/icons/filetypes/MOV.ico
StormKitty.Builder/icons/filetypes/MP3.ico
StormKitty.Builder/icons/filetypes/MP4.ico
StormKitty.Builder/icons/filetypes/MP4V.ico
StormKitty.Builder/icons/filetypes/MPEG.ico
StormKitty.Builder/icons/filetypes/OGG.ico
StormKitty.Builder/icons/filetypes/OGM.ico
StormKitty.Builder/icons/filetypes/QT.ico
StormKitty.Builder/icons/filetypes/REG.ico
StormKitty.Builder/icons/filetypes/RMVB.ico
StormKitty.Builder/icons/filetypes/SFW.ico
StormKitty.Builder/icons/filetypes/SPX.ico
StormKitty.Builder/icons/filetypes/SWF.ico
StormKitty.Builder/icons/filetypes/TORRENT.ico
StormKitty.Builder/icons/filetypes/VOB.ico
StormKitty.Builder/icons/filetypes/Video-Music.ico
StormKitty.Builder/icons/filetypes/WAV.ico
StormKitty.Builder/icons/filetypes/WMA.ico
StormKitty.Builder/icons/filetypes/WMV.ico
StormKitty.Builder/icons/filetypes/XviD.ico
StormKitty.Builder/icons/nord/Accessories.ico
StormKitty.Builder/icons/nord/Adobe Illustrator.ico
StormKitty.Builder/icons/nord/Adobe Photoshop.ico
StormKitty.Builder/icons/nord/Adobe Premiere Pro.ico
StormKitty.Builder/icons/nord/Adobe.ico
StormKitty.Builder/icons/nord/App List.ico
StormKitty.Builder/icons/nord/Apple.ico
StormKitty.Builder/icons/nord/Book.ico
StormKitty.Builder/icons/nord/CD.ico
StormKitty.Builder/icons/nord/Chrome.ico
StormKitty.Builder/icons/nord/Clock 2.ico
StormKitty.Builder/icons/nord/Clock.ico
StormKitty.Builder/icons/nord/Colors.ico
StormKitty.Builder/icons/nord/Desktop.ico
StormKitty.Builder/icons/nord/Development.ico
StormKitty.Builder/icons/nord/Downloads 2.ico
StormKitty.Builder/icons/nord/Downloads.ico
StormKitty.Builder/icons/nord/Ffile-manager.ico
StormKitty.Builder/icons/nord/Folder - 3D.ico
StormKitty.Builder/icons/nord/Folder - Contacts.ico
StormKitty.Builder/icons/nord/Folder - Documents.ico
StormKitty.Builder/icons/nord/Folder - Downloads.ico
StormKitty.Builder/icons/nord/Folder - Favorites.ico
.ps1
StormKitty.Builder/icons/nord/Folder - Games.ico
StormKitty.Builder/icons/nord/Folder - Generic.ico
StormKitty.Builder/icons/nord/Folder - Links.ico
StormKitty.Builder/icons/nord/Folder - Music.ico
StormKitty.Builder/icons/nord/Folder - Onedrive.ico
StormKitty.Builder/icons/nord/Folder - Pictures.ico
StormKitty.Builder/icons/nord/Folder - Projects.ico
StormKitty.Builder/icons/nord/Folder - Searches.ico
StormKitty.Builder/icons/nord/Folder - User.ico
StormKitty.Builder/icons/nord/Folder - Videos.ico
StormKitty.Builder/icons/nord/Foobar2000.ico
StormKitty.Builder/icons/nord/Ghost.ico
StormKitty.Builder/icons/nord/Globe 2.ico
StormKitty.Builder/icons/nord/Globe.ico
StormKitty.Builder/icons/nord/Heart.ico
StormKitty.Builder/icons/nord/Help.ico
StormKitty.Builder/icons/nord/Library.ico
StormKitty.Builder/icons/nord/Mail.ico
StormKitty.Builder/icons/nord/Media Player.ico
StormKitty.Builder/icons/nord/Microsoft_Edge.ico
StormKitty.Builder/icons/nord/Movies.ico
StormKitty.Builder/icons/nord/Music v2.ico
StormKitty.Builder/icons/nord/Music.ico
StormKitty.Builder/icons/nord/Office.ico
StormKitty.Builder/icons/nord/Pacman.ico
StormKitty.Builder/icons/nord/Paint palette.ico
StormKitty.Builder/icons/nord/Paint.ico
StormKitty.Builder/icons/nord/Photo.ico
StormKitty.Builder/icons/nord/Photos.ico
StormKitty.Builder/icons/nord/Pictures.ico
StormKitty.Builder/icons/nord/PotPlayer.ico
StormKitty.Builder/icons/nord/PotPlayerOrange.ico
StormKitty.Builder/icons/nord/Private.ico
StormKitty.Builder/icons/nord/Settings.ico
StormKitty.Builder/icons/nord/Spotify.ico
StormKitty.Builder/icons/nord/Terminal.ico
StormKitty.Builder/icons/nord/User.ico
StormKitty.Builder/icons/nord/Videos.ico
StormKitty.Builder/icons/nord/WebCam.ico
StormKitty.Builder/icons/nord/alarm.ico
StormKitty.Builder/icons/nord/atunes.ico
StormKitty.Builder/icons/nord/audacity.ico
StormKitty.Builder/icons/nord/bitwarden.ico
StormKitty.Builder/icons/nord/blender_1.ico
StormKitty.Builder/icons/nord/brave.ico
StormKitty.Builder/icons/nord/chromium-browser.ico
StormKitty.Builder/icons/nord/color-picker.ico
StormKitty.Builder/icons/nord/computer.ico
StormKitty.Builder/icons/nord/computerjanitor.ico
StormKitty.Builder/icons/nord/deepin-draw.ico
StormKitty.Builder/icons/nord/deepin-movie.ico
StormKitty.Builder/icons/nord/deviantart.ico
StormKitty.Builder/icons/nord/discord.ico
StormKitty.Builder/icons/nord/distributor-logo-archlinux.ico
StormKitty.Builder/icons/nord/distributor-logo-windows.ico
StormKitty.Builder/icons/nord/dockbar.ico
StormKitty.Builder/icons/nord/dockstation.ico
StormKitty.Builder/icons/nord/drive-harddisk.ico
StormKitty.Builder/icons/nord/dropbox.ico
StormKitty.Builder/icons/nord/electrip.ico
StormKitty.Builder/icons/nord/fbmessenger.ico
StormKitty.Builder/icons/nord/firefox.ico
StormKitty.Builder/icons/nord/gimp.ico
StormKitty.Builder/icons/nord/github.ico
StormKitty.Builder/icons/nord/gitkraken.ico
StormKitty.Builder/icons/nord/gitlab.ico
StormKitty.Builder/icons/nord/gtranscribe.ico
StormKitty.Builder/icons/nord/inkscape.ico
StormKitty.Builder/icons/nord/itunes.ico
StormKitty.Builder/icons/nord/jewel.ico
StormKitty.Builder/icons/nord/mac dark.ico
StormKitty.Builder/icons/nord/mac light.ico
StormKitty.Builder/icons/nord/microsoft teams.ico
StormKitty.Builder/icons/nord/microsoft.ico
StormKitty.Builder/icons/nord/movie.ico
StormKitty.Builder/icons/nord/ms-excel.ico
StormKitty.Builder/icons/nord/ms-onedrive.ico
StormKitty.Builder/icons/nord/ms-powerpoint.ico
StormKitty.Builder/icons/nord/ms-word.ico
StormKitty.Builder/icons/nord/music-player.ico
StormKitty.Builder/icons/nord/netflix.ico
StormKitty.Builder/icons/nord/nextcloud.ico
StormKitty.Builder/icons/nord/opera.ico
StormKitty.Builder/icons/nord/powershell.ico
StormKitty.Builder/icons/nord/powersploit.ico
StormKitty.Builder/icons/nord/preferences-desktop-color.ico
StormKitty.Builder/icons/nord/preferences-desktop-gaming.ico
StormKitty.Builder/icons/nord/preferences.ico
StormKitty.Builder/icons/nord/qbittorrent.ico
StormKitty.Builder/icons/nord/reddit.ico
StormKitty.Builder/icons/nord/shutdown v2.ico
StormKitty.Builder/icons/nord/shutdown.ico
StormKitty.Builder/icons/nord/slack.ico
StormKitty.Builder/icons/nord/spotify alt.ico
StormKitty.Builder/icons/nord/steam.ico
StormKitty.Builder/icons/nord/system-users.ico
StormKitty.Builder/icons/nord/telegram.ico
StormKitty.Builder/icons/nord/tweak-tool.ico
StormKitty.Builder/icons/nord/uTorrent.ico
StormKitty.Builder/icons/nord/user-trash-full.ico
StormKitty.Builder/icons/nord/user-trash.ico
StormKitty.Builder/icons/nord/utilities-terminal.ico
StormKitty.Builder/icons/nord/virtualbox (2).ico
StormKitty.Builder/icons/nord/virtualbox.ico
StormKitty.Builder/icons/nord/visual-studio-code.ico
StormKitty.Builder/icons/nord/vivaldi.ico
StormKitty.Builder/icons/nord/vlc.ico
StormKitty.Builder/icons/nord/vmware-workstation.ico
StormKitty.Builder/icons/nord/windows.ico
StormKitty.Builder/icons/nord/words.ico
StormKitty.Builder/icons/nord/yandex-browser.ico
StormKitty.Builder/icons/nord/yast.ico
StormKitty.Builder/icons/nord/youtube-dl.ico
StormKitty.Builder/icons/nord/youtube.ico
StormKitty.Builder/obfuscator/Confuser.CLI.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Source\Public\Confuser2\Confuser.CLI\obj\Release\Confuser.CLI.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/Confuser.CLI.pdb
StormKitty.Builder/obfuscator/Confuser.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Source\Public\Confuser2\Confuser.Core\obj\Release\Confuser.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/Confuser.Core.pdb
StormKitty.Builder/obfuscator/Confuser.Core.xml
.xml
StormKitty.Builder/obfuscator/Confuser.DynCipher.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Source\Public\Confuser2\Confuser.DynCipher\obj\Release\Confuser.DynCipher.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/Confuser.DynCipher.pdb
StormKitty.Builder/obfuscator/Confuser.Protections.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Source\Public\Confuser2\Confuser.Protections\obj\Release\Confuser.Protections.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/Confuser.Protections.pdb
StormKitty.Builder/obfuscator/Confuser.Renamer.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Source\Public\Confuser2\Confuser.Renamer\obj\Release\Confuser.Renamer.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/Confuser.Renamer.pdb
StormKitty.Builder/obfuscator/Confuser.Runtime.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Source\Public\Confuser2\Confuser.Runtime\obj\Release\Confuser.Runtime.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/Confuser.Runtime.pdb
StormKitty.Builder/obfuscator/ConfuserEx.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Source\Public\Confuser2\ConfuserEx\obj\Release\ConfuserEx.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 347KB - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/ConfuserEx.exe.config
.xml
StormKitty.Builder/obfuscator/ConfuserEx.pdb
StormKitty.Builder/obfuscator/GalaSoft.MvvmLight.Extras.WPF4.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\Laurent\AppData\Local\Temp\vs98F2.tmp\Release\GalaSoft.MvvmLight.Extras.WPF4.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/GalaSoft.MvvmLight.WPF4.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\GalaSoft\mydotnet\MvvmLight\Source\GalaSoft.MvvmLight\GalaSoft.MvvmLight (NET4)\obj\Release\GalaSoft.MvvmLight.WPF4.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/Microsoft.Practices.ServiceLocation.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:22:fe:05:fc:8b:ec:8a:ef:4e:ee:cf:cf:07:ef:3d:35:f5:93:ec
Signer

Actual PE Digest

cd:22:fe:05:fc:8b:ec:8a:ef:4e:ee:cf:cf:07:ef:3d:35:f5:93:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\CommonServiceLocator\main\Microsoft.Practices.ServiceLocation.PortableClassLibrary\obj\Release\Microsoft.Practices.ServiceLocation.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/Ookii.Dialogs.Wpf.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Source\Public\Confuser2\Confuser.Test\Release\src\Ookii.Dialogs.Wpf\obj\Release\Ookii.Dialogs.Wpf.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/System.Threading.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

61:08:77:5f:00:00:00:00:00:4a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/07/2010, 22:53

Not After

19/10/2011, 22:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:b3:f5:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:13

Not After

25/07/2011, 19:23

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

a6:e9:10:6c:8a:b6:b5:78:02:56:c2:cf:c8:c4:e9:27:bb:ec:f4:fc
Signer

Actual PE Digest

a6:e9:10:6c:8a:b6:b5:78:02:56:c2:cf:c8:c4:e9:27:bb:ec:f4:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\cp\main\built\Release\Temp\86167f787584e42c25873494b6be9c\System.Threading.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 369KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/System.Windows.Interactivity.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\ExpressionRTM\Sparkle\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\System.Windows.Interactivity\Win32\Release\System.Windows.Interactivity.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/dnlib.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Source\Public\Confuser2\dnlib\src\obj\Release\dnlib.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 985KB - Virtual size: 984KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/obfuscator/dnlib.pdb
StormKitty.Builder/obfuscator/dnlib.xml
.xml
StormKitty.Builder/stub/AnonFileApi.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/stub/DotNetZip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 446KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StormKitty.Builder/stub/stub.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Вовочка\Desktop\StormKitty\stub\Neko\obj\Release\StormKitty.pdb

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 16KB - Virtual size: 15KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 335KB - Virtual size: 334KB

.rsrc Size: 1024B - Virtual size: 840B

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 25KB - Virtual size: 25KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 177KB - Virtual size: 176KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 44KB - Virtual size: 43KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 126KB - Virtual size: 125KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 301KB - Virtual size: 300KB

.text
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 335KB - Virtual size: 334KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 25KB - Virtual size: 25KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 177KB - Virtual size: 176KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 44KB - Virtual size: 43KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 126KB - Virtual size: 125KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 301KB - Virtual size: 300KB

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 40KB - Virtual size: 39KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 347KB - Virtual size: 347KB

.rsrc
Size: 39KB - Virtual size: 38KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 25KB - Virtual size: 25KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

cd:22:fe:05:fc:8b:ec:8a:ef:4e:ee:cf:cf:07:ef:3d:35:f5:93:ec
Signer

.text
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B