njRAT%20v0.9d.rar
- SHA256 875e48f388cf2ac8d4a022e35677c187d5d6f7b57db690724d4ce262556647a9
Overview
overview
10Static
static
10njRAT v0.9...s..dll
windows10-2004-x64
1njRAT v0.9...s..dll
windows11-ltsc_2024-x64
1njRAT v0.9...r2.dll
windows10-2004-x64
1njRAT v0.9...r2.dll
windows11-ltsc_2024-x64
1njRAT v0.9...il.dll
windows10-2004-x64
1njRAT v0.9...il.dll
windows11-ltsc_2024-x64
1njRAT v0.9...�o.dll
windows10-2004-x64
1njRAT v0.9...�o.dll
windows11-ltsc_2024-x64
1njRAT v0.9...am.dll
windows10-2004-x64
1njRAT v0.9...am.dll
windows11-ltsc_2024-x64
1njRAT v0.9...ch.dll
windows10-2004-x64
1njRAT v0.9...ch.dll
windows11-ltsc_2024-x64
1njRAT v0.9...fm.dll
windows10-2004-x64
1njRAT v0.9...fm.dll
windows11-ltsc_2024-x64
1njRAT v0.9...pw.dll
windows10-2004-x64
1njRAT v0.9...pw.dll
windows11-ltsc_2024-x64
1njRAT v0.9...c2.dll
windows10-2004-x64
1njRAT v0.9...c2.dll
windows11-ltsc_2024-x64
1njRAT v0.9... ..exe
windows10-2004-x64
3njRAT v0.9... ..exe
windows11-ltsc_2024-x64
3njRAT v0.9...ub.exe
windows10-2004-x64
10njRAT v0.9...ub.exe
windows11-ltsc_2024-x64
10njRAT v0.9...vb.dll
windows10-2004-x64
1njRAT v0.9...vb.dll
windows11-ltsc_2024-x64
1njRAT v0.9...et.dll
windows10-2004-x64
1njRAT v0.9...et.dll
windows11-ltsc_2024-x64
1njRAT v0.9...9d.exe
windows10-2004-x64
10njRAT v0.9...9d.exe
windows11-ltsc_2024-x64
10njRAT v0.9d/njRAT.exe
windows10-2004-x64
10njRAT v0.9d/njRAT.exe
windows11-ltsc_2024-x64
10Behavioral task
behavioral1
Sample
njRAT v0.9d/DevComponents..dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
njRAT v0.9d/DevComponents..dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
njRAT v0.9d/DevComponents.DotNetBar2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
njRAT v0.9d/DevComponents.DotNetBar2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
njRAT v0.9d/Mono.Cecil.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
njRAT v0.9d/Mono.Cecil.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
njRAT v0.9d/Notificação.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
njRAT v0.9d/Notificação.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
njRAT v0.9d/Plugin/cam.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
njRAT v0.9d/Plugin/cam.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
njRAT v0.9d/Plugin/ch.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
njRAT v0.9d/Plugin/ch.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
njRAT v0.9d/Plugin/fm.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
njRAT v0.9d/Plugin/fm.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
njRAT v0.9d/Plugin/pw.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
njRAT v0.9d/Plugin/pw.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
njRAT v0.9d/Plugin/sc2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
njRAT v0.9d/Plugin/sc2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
njRAT v0.9d/Stub/Stub ..exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
njRAT v0.9d/Stub/Stub ..exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
njRAT v0.9d/Stub/Stub.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral22
Sample
njRAT v0.9d/Stub/Stub.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral23
Sample
njRAT v0.9d/TempPE/My Project.Resources.Designer.vb.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
njRAT v0.9d/TempPE/My Project.Resources.Designer.vb.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
njRAT v0.9d/WinMM.Net.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
njRAT v0.9d/WinMM.Net.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
njRAT v0.9d/njRAT v0.9d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral28
Sample
njRAT v0.9d/njRAT v0.9d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral29
Sample
njRAT v0.9d/njRAT.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
njRAT v0.9d/njRAT.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target njRAT%20v0.9d.rar
- Size 4.5MB
- Sample260916-jesf4avthy
- SHA256 875e48f388cf2ac8d4a022e35677c187d5d6f7b57db690724d4ce262556647a9
- MD5 de093c0df97310632b011a62c6e781f7
- SHA1 e78f34ea87f4bb124fe57432861879506d6ecf41
- SHA512 241ceb193fc704f393f0b5f8a896babb0969fe5b3bb345abc41ab72d62685febd75d99f92be4ee526d7a70fd5ea469ab8183f2f6e55962a3b70dd8de610e9474
- SSDEEP 98304:xl9lv1MAdPJ4N1ZNNLcLf25EJuZeMY/4N1dfwSmIRlh3PYEihP4y5VSViBO:z9ltMLNzPkf2aJGeGNPf5mIRrPuhP14
- TLSH T1372633FD6652A482E160E664D3B4BEA82D8E80B27532E3FD0BBC5E40ED11771CDA5CC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed
C2
-
aymentn.ddns.net:1177
Mutex
-
4cef650e02c2f64aed70aaa9830d5dcc
Attributes
-
reg_key
4cef650e02c2f64aed70aaa9830d5dcc
-
splitter
|'|'|
Signatures
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Detect Neshta payload 1 IoCs
resource yara_rule static1/unpack001/njRAT v0.9d/njRAT.exe family_neshta - Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource unpack001/njRAT v0.9d/DevComponents..dll unpack001/njRAT v0.9d/DevComponents.DotNetBar2.dll unpack001/njRAT v0.9d/Mono.Cecil.dll unpack001/njRAT v0.9d/Notificação.dll unpack001/njRAT v0.9d/Plugin/cam.dll unpack001/njRAT v0.9d/Plugin/ch.dll unpack001/njRAT v0.9d/Plugin/fm.dll unpack001/njRAT v0.9d/Plugin/pw.dll unpack001/njRAT v0.9d/Plugin/sc2.dll unpack001/njRAT v0.9d/Stub/Stub ..exe unpack001/njRAT v0.9d/Stub/Stub.exe unpack001/njRAT v0.9d/TempPE/My Project.Resources.Designer.vb.dll unpack001/njRAT v0.9d/WinMM.Net.dll unpack001/njRAT v0.9d/njRAT v0.9d.exe unpack001/njRAT v0.9d/njRAT.exe
File Explorer
-
njRAT%20v0.9d.rar.rar 4.5MB
-
njRAT v0.9d/DevComponents..dll.dll 4.9MB
-
njRAT v0.9d/DevComponents.DotNetBar2.dll.dll 4.9MB
-
njRAT v0.9d/Mono.Cecil.dll.dll 305KB
-
njRAT v0.9d/Notificação.dll.dll 28KB
-
njRAT v0.9d/Plugin/cam.dll.dll 63KB
-
njRAT v0.9d/Plugin/ch.dll.dll 13KB
-
njRAT v0.9d/Plugin/fm.dll.dll 13KB
-
njRAT v0.9d/Plugin/pw.dll.dll 37KB
-
njRAT v0.9d/Plugin/sc2.dll.dll 10KB
-
njRAT v0.9d/Stub/Stub ..exe.exe 102KB
-
njRAT v0.9d/Stub/Stub.exe.exe 23KB
-
njRAT v0.9d/TempPE/My Project.Resources.Designer.vb.dll.dll 14KB
-
njRAT v0.9d/WinMM.Net.dll.dll 43KB
-
njRAT v0.9d/njRAT v0.9d.exe.exe 23KB
-
njRAT v0.9d/njRAT.exe.exe 4.0MB
njRAT v0.9d/DevComponents..dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2e16f7eb5e8aa4ef66a1c0cc5e4b72290c3182d6f3d0a71f32d13fd2db732ef5
- MD5 c554d8572ce8619ec94597fcbfef09d7
- SHA1 b2e2fbfbe4e3747d824f5d6cabb5607275559929
- SHA512 73c08723319ebddc2023ea1436c27583894834f6667640de09c967cf149e7d564486ede7d256abad4987e6b4a30b994383095a2c969069a71be481531790a85b
- SSDEEP 49152:jfbOajjkPV5M6BEng14kVsAtLMu5fnChs/V7aqONj9o0eXDRNnxfJtqUrSPNk/0R:GajjQ5M6Bcg1uAt3/VuqON
- TLSH T1B1367D22B7FC8D3FE06E477A8129465443F8CA56F392FBE6168571B43D627108D1B2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5159542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.textxc
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.datax
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
86B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/DevComponents.DotNetBar2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fac9e23262e1ce98746c47da786720a4137c3cd0857ddd96cdc78a218137efb5
- MD5 fa4aaf6ecb9d9a8163af9e0392c35e93
- SHA1 d1b73cefec8658fa3dfa036b18352f7fc0abc446
- SHA512 a3727df00ab016ce74a487258401ed1bbef17b1c6dc4cfa9eb724e94720b547e8c4cec1d908b3e78b78ed6500f87f38c045bff527c9d23fb68db1c96c9f23822
- SSDEEP 49152:TfbOajjkPV5M6BEng14kVsAtLMu5fnChs/V7aqONj9o0eXDRNnxfJtqUrSPNk/0R:WajjQ5M6Bcg1uAt3/VuqON
- TLSH T1F2367D22B7FC8D3FE06E477A8129465443F8CA56F392FBE6168571B43D627108D1B2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5159542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.textxc
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.datax
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
86B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/Notificação.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e490580642f1fb434fa82cff519a67e2c946ab6b1a996b7548090efa880d1a2f
- MD5 d829e5b1c0b11de40392ca48119579f1
- SHA1 cbebbfb4550ee58220bc9e1bececcc6ac26d7667
- SHA512 0fbbc283ab455c71c67fca0d08036c7b75829182245f1e25cc786f2d7e8195751a4eb5f6985cd604a17ea3753ac9126c9b09c7965a14e4e358033bae0cbb35cf
- SSDEEP 384:QEB8TCduPEuokwNwAmkTDB+7HKNUaycIRByyanHCFUOFPwzPwLPwpPwJPwqnPwgz:ReYB++NUnBB36HVOhq4D7
- TLSH T1C8D23A29373D873BC9BECF79D00211454BBAE6467903EBA88F9050CA65D73A885032DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Users\ST\Desktop\notification_src\NotificationWindow\obj\Debug\Notificação.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9f94d566ecaf812505291760e4ad5d3956a8845971d4798153f82ffe3f0a373a
- MD5 f95e8c8cb28fc6d730af31b0593ff41c
- SHA1 f28f043ce5af4c444c8002aa3ce26267c4e5add3
- SHA512 0fd29f140e2e880055a17815904eaf502fb66b4f4a11a1a9ab1f1eb47d39181ee3e7d78448f9ffe58e5fdd8b7c8def6cba19fe100a13d294d0b11b347918eac4
- SSDEEP 768:r5Svr1ThGIYTiuPbw4mOz9x3OSYNr+sL0twd9oZ7LmMxx8wW2epiN+K6seBL8Pov:ErC6OzLOSsr+o0eW7LhxxxbepigBoPG
- TLSH T122532A2A6B949407C25D2A7C90B70F1407F1C71A6733E78A5B78A2BDDE723908A133D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 16549494133c023f4084320b7c6cf485f66cae3e657bc2458c6ce63ec0fff70e
- MD5 88b5d9811616ec3b9f16cc0f81b18acd
- SHA1 fd48634c357386d780655114f2ca10f7b42d688a
- SHA512 3786134e5dd17e2f312bd7a93c482d2f2c19ee6105b9bd4c914d22f2be08311dc858eb543ce36e0dab1b0e0c4201cca7e0abecc4bca8a6eca7aa93f983dbc242
- SSDEEP 192:3tS88rZZwYo8A6X1ybv4GHnR2e+KChMMwYIXU4MPFO:dS88NBo8+9f+xhMMwYIXU
- TLSH T1BF52922677A44F37CEAC53B885A2964217F2C5159322EB9F7CDDA8ED58E234167003CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/Plugin/fm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c93791e638ba7a2e314de72934eae0b711391b6182e42d0d1609b8ae76f9aecb
- MD5 da34b5a74f4fa7f193a4fc0236461a77
- SHA1 d061cccd045408d0f37731bc9bd80f52ccd33010
- SHA512 78f4755a72490c42febec1a2bd96e043002136455473356fa3835538de442318e7b784c3d304b493cd2429b22e476e5c785427956fdfd3ee60c58061c2d55da2
- SSDEEP 192:+vO5ceRrQHyW2GO3HHWhUreYnWnlBkOiYgl:+vO5piHyW2G2H2+reYnWnlBkfYg
- TLSH T12A52822C9A948D03D5AD13B981AE47416FF389160916E67F8CCD5CFB0AA63C46B08BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 efa05a4bb42843236ba64393be0cb5ff073baa9c71b308cfb052b2e317ac8715
- MD5 4ee1a499e903cd0cb561682b4eb68a91
- SHA1 a35866ff36a7ec0a226b8f814f3642185742020e
- SHA512 00def300ecd4c4e257bc1e7c67f6b9851853f54fc51c1da734f5927a140f4405baa10f7a6fa333013aa7cc8683cbaf14bf290d78618041955590710803c7e7f7
- SSDEEP 768:mNdzkF9F2SbQiRbb34cEyiJ3nfSgT2VY:mNdgF9k4R/34cxkag0Y
- TLSH T18F036C0A77C5D242EABDCA745CB2C9142370C04B6D63E78E5CD845A52B72BD11118FEF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3bd3e39e23fbc1c4f544911f5a5071ca0d77837cc101f8a80f6dabb740ce9121
- MD5 fc2edece5e0350eedc88eb889eec3de8
- SHA1 9ba24a132fb7fb86a25827c126224591fcf5f776
- SHA512 f6e3d3fb5571109acade35857f555c34c3a8bc836e059cd4262575f10718b72e73c278dcc525bb5e50333331cd7a96c115bfd7b05e3ebdf76c25d632690ed829
- SSDEEP 192:B5hbf96wNDFlmbZTA6anEaaPs6v/43nJMqfOdiW:zPhOZaEaaPtv/43JRj
- TLSH T18622F91BBB888B17E92C57FD09A383631372C1269343EB6F0CC578F959E6785125439A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/Stub/Stub ..exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e5e22e5bc3a90064b7ee98a99c35437b597ddfd1a34fa6f66125e1bd19677fe5
- MD5 68f9516000a14ed114b7f10266cfcd28
- SHA1 56cd231c18853cdb7f0d7cd77fadd3e5aa65e179
- SHA512 90d4868e5725afec24c0ad98df4975f41f550fd3c9fda756da2f8ed587ff5f6393336f284dbb3f2ce999769e45e4ec6b7156b65151121ffe362368de561c53da
- SSDEEP 1536:14pZNSbq1i+1omVZQ4v+pNvkj8lv8D0H2H3FawIpUmYU:14pZZiBsZv+pVyD0WH3sBpHYU
- TLSH T1DDA32989ABE80C25F1BF17BF167065220775B8871E13D7AE2AD4A05D3B333818E65763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
107246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\mr ...d\Desktop\نجرات التاسع رقم 17 اصلي رقم4\SRC - Coringa-RAT 0. 3 رقم12 اصلي\Stub\obj\Debug\Stub.pdb
mscoree
_CorExeMain
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
194B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/Stub/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 08df80741923f7cb957792f483fbc1ccde261f1d93d0571189c8d5ef10891999
- MD5 fcccde1874042785d867573968bb1353
- SHA1 8bd160c8f5a5f92a210939dd84e8ad6fc0600601
- SHA512 c9ae8df0589908594ca8fcc277fccbbde287bddc190d4cf662bbe768b839410288f233c7327fe32cb9d3622a058b5642b32e4b5ef840fb081915a93da2a6977b
- SSDEEP 384:xweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZsz:mLq411eRpcnuZ
- TLSH T1D0B21A4E3FA98856C5AC17748AB5965003B4D1870423EE2FCCC550CBAFB3ADA5D4CAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/TempPE/My Project.Resources.Designer.vb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dffb477770f24a2133e8f59fdbcbe0ff48eff93aa43cbe562b5d53f135d10ed4
- MD5 e8afe7f406efeb154eca5be0b8f0f5c1
- SHA1 20a2060512c659e3b5c6bf4ee4a330bc18571241
- SHA512 410270f31ded0f0a495a0a32649c96f8d41c7bf90ea0195c1312e6e628a98db95c95fdeec802868e45fa4a627e8e242e87805bbcd3ed135fee0d7a23ffb910b8
- SSDEEP 192:d7MuEnwFkBo1VgkgBBbmFJ15nAjV3E0uZVlnlYJL/erOvIiacLTPo/fbgj1MqV4c:d4Wg/BbmDnL/IqSv3acLTPYgLVoRG7
- TLSH T10162B61A23F0411ADB3D4B71AAB60BB50373E3498D23FB7A699052B909B3145DAD3B52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/njRAT v0.9d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 08df80741923f7cb957792f483fbc1ccde261f1d93d0571189c8d5ef10891999
- MD5 fcccde1874042785d867573968bb1353
- SHA1 8bd160c8f5a5f92a210939dd84e8ad6fc0600601
- SHA512 c9ae8df0589908594ca8fcc277fccbbde287bddc190d4cf662bbe768b839410288f233c7327fe32cb9d3622a058b5642b32e4b5ef840fb081915a93da2a6977b
- SSDEEP 384:xweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZsz:mLq411eRpcnuZ
- TLSH T1D0B21A4E3FA98856C5AC17748AB5965003B4D1870423EE2FCCC550CBAFB3ADA5D4CAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.9d/njRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d2c75b1bb64ec350e6ea48f2aea6912c86137d1789954418a1acab593d78f88a
- MD5 2daca1f2e4829f4019c8e71d7afa653c
- SHA1 2f4c50edb53ad8d05589115c9ff21a8701c47184
- SHA512 afa50d0f80d4b64b650a7a177e4ac3a46d2e2f03489e1504ab5816f99ba8cb81c30c12e0f4115ce37de57f282d8e9c4613c49d10c874d4728ecced987c643772
- SSDEEP 49152:3eMXktlHZ0RIglO1CuL9VNcaCdGgSnXYmRLF5zmMhOOkPCeSKjRrnv/rFJ:OJb56MpCaI1hS6Z
- TLSH T1C716171336906D28F03927F28949CB7043696F295624967D35F26F4BF9E7AC2BE113C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Neshta payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4193390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\mr ...d\Desktop\SRC - Coringa-RAT 0. 3 رقم12 اصلي\Coringa-RAT\obj\Debug\njRAT.pdb
mscoree
_CorExeMain
Name
.text
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
151B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ