Static | ZeroBOX

PE Compile Time

2021-04-01 15:17:20

PE Imphash

97de38df25bb86ed5773a338d673d7ae

PEiD Signatures

Ste@lth PE 1.01 -> BGCorp

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00008916 0x00009000 5.24259478573
.rdata 0x0000a000 0x00000362 0x00001000 1.25088327513
.pdata 0x0000b000 0x00021200 0x00020000 7.5879198045
.rsrc 0x0002d000 0x00006c10 0x00007000 6.32745090436
.reloc 0x00034000 0x0000053b 0x00001000 0.465119200798

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00032c90 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00032c90 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00032c90 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00032c90 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00032c90 0x00000468 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x000330f8 0x0000004c LANG_NEUTRAL SUBLANG_DEFAULT data
RT_VERSION 0x00033148 0x00000964 LANG_NEUTRAL SUBLANG_SYS_DEFAULT data
RT_MANIFEST 0x00033ab0 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library USER32.dll:
0x40a020 TranslateMessage
Library ADVAPI32.dll:
0x40a000 RegLoadAppKeyW
Library KERNEL32.dll:
0x40a008 CloseHandle
0x40a00c OutputDebugStringA
0x40a010 LoadLibraryA
0x40a018 IsBadStringPtrW

`.rdata
@.pdata
@.reloc
+L$,9L$
L$2f#L$2f
D$8%~_
D$P-es-
D$T-pp-
D$X---
L$pf=r
\Ll:-&J
[NYmU^(4
rcid>l
geO1Px
f TV4R
'Ozz}m
-tz90-
St&R9:
zr'(*\
RlC^Tl7
JCh'u(
>4&'Bm
>)&"Bu
6,qfY\u
(9WqyZ
;B(z\bL~
c@$xW`I|
D$0fMf7
EfiL$@
L$@f+L$@f
L$@<Ew
f#D$*f
L$?"L$?
L$2*D$K
D$|"'#c
D$<3D$<
L$<+L$<
-es--pp----
tttt32
RSDStk
GTRG.pdb
RegisterDeviceNotificationA
TranslateMessage
USER32.dll
RegLoadAppKeyW
ADVAPI32.dll
LoadLibraryA
GenerateConsoleCtrlEvent
IsBadStringPtrW
CloseHandle
OutputDebugStringA
KERNEL32.dll
J{@"U!
!<KQ#w
Gd7`Bg
}XZj>M
NNt8]BGP
EZ<Fm5s
Boiu{[/49
M0F:!S`
rM'bWPEQ
:*gcX"
BlmXK
9j:*gw
:*gcX"
u[-HzH
%f5?H|{
tl^3QT
orT?|AT
?g7!_*
;d=I1}Lk
Ty1`4'
ClM#\
o&X?|^
QBBKuXc
=zJvB
N?|^!_*
$Pon;?|
ozE?|^!
/Bf5?
ep@0mK
B+D02o5
>*,Q$c
eIA}<[
oF9?|I
vBlRX
BKuX#
I?BlC5
J**Fu
d=I1}4L
B<8[-Hx
or*?|t
5oB*?|N
>9IaD`
-_BKuXc
Kl'E0(
+S:[B
D_9NCn
$i[)0.|
Fo2]H}
B+#Q:W4
ENE0?|
j:*{D\
BKuXc
~O(1:)V
(]qh$)
BKuXc
BS:cF
=zJFB
5Bl81
)'0&94
*~pQ}|
*fGft?
=fb?Gt"
Yn-<f5?
AofY)'
"!*'@
Bl;$0N
A(Yoff
72#+:79
ObHA%>
:+.zVy
u[.DzP
#jK|AfF
"jG|ATc
yAQjxT
)6K%#Qrl
NbnyKd5f
`;bh)P
RQ:`AS
+9gM}k
`;bh)P
[-DzP~
[-HzP~m
$jY)7S
b1UP%Y
"f/l`P
).G#4E
(]w^]yo
|<8[-Dz
%uB>^+Md=I
>:V9_C
o:C>{x
*~ATpa
?w(uym
>{ATpda
sgf|>'
#=;5;NC
BKuX#
BKuX#
BlBX+
P>{d!_*
%"f/lD
@;31=!U
7f)OOz
oz>{x
$P`m<%X
$Pbmx-X
ric!_*
)EE~[nh
>:B9VCfG?
}1./ln5
~M2}2E
ric_*
dPUP`m
of >{Q!
Z;2;NC
u[.DzP
?"]I<m
?"]I<m
=Q&tBd
f>@yt
BvlnV+
VV~)r
f#KuX"
A=a9nClBN
K/)'Or
>:x1:?U
uIB%=G
mm$Qow
Y~/~X2
WO#4st
#cc/ov
4-4lb#
ZkBywO@N
nFytcR?
Z<)O{dT
CH``AE
vc5,FN
|2EB;)
e_-lo}
,25B;)=
e_-lL:b
28B;)#
#F2/B;)f
fn[:%:
2ZB;)G
q2oB;)
self.ex
wB*v=,C23
`x:v=LE
n Nku1
?JI<HD
0v<d\y
oM='<6
FOU~^.
$M:[h/
D!<..$B
326IU&
{MsOZB
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
::4:::
3J3`3p3~8
VS_VERSION_INFO
StringFileInfo
080004b0
Comments
CompanyName
Avira GmbH
FileDescription
Configuration Panel
FileVersion
23.60.77.25
InternalName
Lffxrhrqunsqt Ieadh
LegalCopyright
Copyright
2000 - 2010 Avira GmbH. All rights reserved.
LegalTrademarks
AntiVir
is a registered trademark of Avira GmbH, Germany.
OriginalFilename
lffxrhrq.exe
PrivateBuild
ProductName
LffxRhr Unsqtei
ProductVersion
23.60.77.25
SpecialBuild
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan Trojan.Agent.FFAA
FireEye Generic.mg.03a068ac195e3988
CAT-QuickHeal Clean
McAfee Drixed-FKK!03A068AC195E
Cylance Unsafe
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Trojan.Agent.FFAA
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_80% (D)
BitDefenderTheta Gen:NN.ZedlaF.34662.mu8@aWWhgOdO
Cyren W32/Dridex.CF.gen!Eldorado
Symantec Packed.Generic.517
ESET-NOD32 a variant of Win32/Kryptik.HKFN
Zoner Clean
TrendMicro-HouseCall Clean
Paloalto Clean
ClamAV Win.Malware.Generickdz-9848444-0
Kaspersky VHO:Trojan.Win32.Convagent.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Malware.Heuristic!ET#75% (RDMK:cmRtazqYtJD17L60V03K30Oksi1q)
Ad-Aware Trojan.Agent.FFAA
Sophos ML/PE-A + Mal/EncPk-APX
Comodo Clean
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Backdoor.dh
SentinelOne Static AI - Malicious PE
CMC Clean
Emsisoft Trojan.Dridex (A)
Ikarus Trojan-Banker.Dridex
GData Trojan.Agent.FFAA
Jiangmin Clean
Webroot Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Trojan.Agent.FFAA
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Wacatac.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
VBA32 Clean
ALYac Clean
MAX malware (ai score=82)
Malwarebytes Clean
Panda Clean
APEX Malicious
Tencent Clean
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet W32/Dridex.D86D!tr
Avast Clean
Qihoo-360 HEUR/QVM40.1.4A17.Malware.Gen
No IRMA results available.