Static | ZeroBOX

PE Compile Time

1970-01-01 09:00:00

PE Imphash

cb664df5fa904736e15ac44ff006d780

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00034ec4 0x00035000 6.52909861275
.data 0x00036000 0x00000038 0x00000200 0.518105846014
.rdata 0x00037000 0x00002da8 0x00002e00 6.89936172584
/4 0x0003a000 0x00008fd8 0x00009000 4.512569179
.bss 0x00043000 0x00000440 0x00000000 0.0
.idata 0x00044000 0x00000ea4 0x00001000 4.95089700864
.CRT 0x00045000 0x00000038 0x00000200 0.338363134943
.tls 0x00046000 0x00000008 0x00000200 0.0

Imports

Library KERNEL32.dll:
0x4442b4 GetCurrentProcess
0x4442b8 GetCurrentProcessId
0x4442bc GetCurrentThreadId
0x4442c0 GetTickCount
0x4442c8 TerminateProcess
0x4442d0 VirtualProtect
0x4442d4 VirtualQuery
Library msvcrt.dll:
0x4442dc __getmainargs
0x4442e0 __initenv
0x4442e4 __lconv_init
0x4442e8 __p__acmdln
0x4442ec __p__fmode
0x4442f0 __set_app_type
0x4442f4 __setusermatherr
0x4442f8 _amsg_exit
0x4442fc _cexit
0x444300 _fmode
0x444304 _fpreset
0x444308 _initterm
0x44430c _iob
0x444310 _onexit
0x444314 abort
0x444318 calloc
0x44431c exit
0x444320 fprintf
0x444324 free
0x444328 fwrite
0x44432c malloc
0x444330 memcmp
0x444334 memcpy
0x444338 memmove
0x44433c memset
0x444340 signal
0x444344 strlen
0x444348 strncmp
0x44434c vfprintf
Library WS2_32.dll:
0x444354 WSACleanup
0x444358 WSAGetLastError
0x44435c WSASocketW
0x444360 WSAStartup
0x444364 closesocket
0x444368 connect
0x44436c freeaddrinfo
0x444370 getaddrinfo
0x444374 ioctlsocket
0x444378 recv
0x44437c send
0x444380 setsockopt
0x444384 shutdown
Library ADVAPI32.dll:
0x44438c RegCloseKey
0x444390 RegEnumKeyExW
0x444394 RegOpenKeyExW
0x444398 RegQueryInfoKeyW
0x44439c RegQueryValueExW
Library CRYPT32.dll:
0x4443a4 CryptUnprotectData
Library GDI32.dll:
0x4443ac BitBlt
0x4443b0 CreateCompatibleDC
0x4443b4 CreateDIBSection
0x4443b8 DeleteObject
0x4443bc GetCurrentObject
0x4443c0 GetObjectW
0x4443c4 SelectObject
Library KERNEL32.dll:
0x4443cc CloseHandle
0x4443d0 CreateDirectoryW
0x4443d4 CreateFileW
0x4443d8 CreateProcessA
0x4443e4 DeviceIoControl
0x4443ec FindClose
0x4443f0 FindFirstFileW
0x4443f4 FindNextFileW
0x4443f8 FormatMessageW
0x4443fc GetComputerNameW
0x444400 GetConsoleMode
0x44440c GetLastError
0x444410 GetLocaleInfoW
0x444414 GetModuleFileNameW
0x444418 GetModuleHandleW
0x44441c GetProcAddress
0x444420 GetProcessHeap
0x444424 GetStartupInfoA
0x444428 GetStdHandle
0x44442c GetSystemInfo
0x444434 GetTempPathW
0x444444 HeapAlloc
0x444448 HeapFree
0x44444c HeapReAlloc
0x444458 LoadLibraryA
0x44445c LocalFree
0x444460 Process32First
0x444464 Process32Next
0x444468 ReadFile
0x44446c SetFilePointerEx
0x444474 SetLastError
0x44447c Sleep
0x444480 TlsAlloc
0x444484 TlsGetValue
0x444488 TlsSetValue
0x44448c WriteConsoleW
0x444490 WriteFile
Library USER32.dll:
0x444498 EnumDisplayDevicesW
0x44449c GetDC
0x4444a0 GetDesktopWindow
0x4444a8 GetSystemMetrics
0x4444ac GetWindowRect

!This program cannot be run in DOS mode.
P`.data
.rdata
0@.bss
.idata
Q ^_[]
tX<"t[<'t^<\uw
jWYj0_
D$PRQP
D$0RQP
j4XjdZ
X83r03z,
@<3r03z,
3Z 3r4
L$8uMj
D$4@pC
L$H;|$H
L$<+T$
D$4jHX
\$Hj[Z
L$Dj:Z
L$Dj:Z
T$P9\$
f;t$<s3
L$$j ^
t5kt$T4
tMkt$L
|$Tj _
XY94$u
T$<j Z
t9kt$`4
tSkt$X
D$ QSV
D$Xkt$`8
D$4;D$@uP
D$0;T$
VSjXP
D$Hj X
CShTwC
XY9|$0
XY9t$0u
D$`"D$
D$$!&@
j#ZQRV
D$,dk@
D$0kt$8
j,ZQRS
j.ZQRW
XPSj.XP
D$4dk@
VWjXP
D$$9$@
j3^QVS
Qj4[SW
j)^QVR
XYj8Yj
Qj YQS
VWj XP
D$hkT$t$
t$0it$
D$<1D$
3t$83\$
3t$@3D$D
\$H3|$
L$$3L$,3L$4
L$(3D$
PQPWVS
<8\tcG
D$0;D$4t
\$x;\$tu
t$,;T$lut
JH;JDu$
3E(PWRQV
(s j@Y)
s j@Y)
MZuWVS
failed to fill whole buffercould not resolve to any addresses
;nn=l8
jh]Lg2
z.>t~r43
kernel32.dll
/H57HU
InvalidLengthInvalidByteW1@
FromUtf8Errorbytes
0x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899[]u:B
}}
./?\]_
)147:;=IJ]
)14:;EFIJ^de
)EIWde
INOWY^_
FGNOXZ\^~
no7=?BE
)14:EFIJNOde\
#%&(38:HJLPSUVXZ\^`cefksx}
invalid utf-8 sequence of bytes from index incomplete utf-8 byte sequence from index
Utf8Errorvalid_up_toerror_len
"SomeNone
Oscode
kindmessage
Custom
UnexpectedEofNotFoundPermissionDeniedConnectionRefusedConnectionResetConnectionAbortedNotConnectedAddrInUseAddrNotAvailableBrokenPipeAlreadyExistsWouldBlockInvalidInputInvalidDataTimedOutWriteZeroInterruptedOtherN
OS Error (FormatMessageW() returned invalid UTF-16) (FormatMessageW() returned error )formatter error
failed to write whole buffer:
invalid argument{iB
..\\?\.\UNC\Windows stdio in console mode does not support writing non-UTF-8 byte sequences
\data provided contains a nul byteSleepConditionVariableSRWkernel32ReleaseSRWLockExclusiveAcquireSRWLockExclusive
fatal runtime error:
assertion failed: key != 0WakeConditionVariable
invalid socket addressinvalid port valuestrings passed to WinAPI cannot contain NULsinvalid utf-8: corrupt contentsinvalid utf-8stream did not contain valid UTF-8
(os error other os erroroperation interruptedwrite zerotimed outinvalid datainvalid input parameteroperation would blockentity already existsbroken pipeaddress not availableaddress in usenot connectedconnection abortedconnection resetconnection refusedpermission deniedentity not foundunexpected end of fileGetSystemTimePreciseAsFileTime
memory allocation of bytes failed
Unknown error
_matherr(): %s in %s(%g, %g) (retval=%g)
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
The result is too small to be represented (UNDERFLOW)
Total loss of significance (TLOSS)
Partial loss of significance (PLOSS)
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_fmode
_fpreset
_initterm
_onexit
calloc
fprintf
fwrite
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
WSACleanup
WSAGetLastError
WSASocketW
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
ioctlsocket
setsockopt
shutdown
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
CryptUnprotectData
BitBlt
CreateCompatibleDC
CreateDIBSection
DeleteObject
GetCurrentObject
GetObjectW
SelectObject
CloseHandle
CreateDirectoryW
CreateFileW
CreateProcessA
CreateToolhelp32Snapshot
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
GetComputerNameW
GetConsoleMode
GetEnvironmentVariableW
GetFileInformationByHandle
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetTimeZoneInformation
GetUserDefaultLocaleName
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
Process32First
Process32Next
ReadFile
SetFilePointerEx
SetHandleInformation
SetLastError
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
WriteConsoleW
WriteFile
EnumDisplayDevicesW
GetDesktopWindow
GetKeyboardLayoutList
GetSystemMetrics
GetWindowRect
KERNEL32.dll
msvcrt.dll
WS2_32.dll
ADVAPI32.dll
CRYPT32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
.eh_frame
jjjjjjj
jjjjjjj
jjjjjjj
NTDLL.DLL
Antivirus Signature
Bkav Clean
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Doina.7190
FireEye Generic.mg.7f1bd38647745b87
CAT-QuickHeal Clean
ALYac Gen:Variant.Doina.7190
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_60% (W)
BitDefender Gen:Variant.Doina.7190
K7GW Trojan ( 0001555e1 )
K7AntiVirus Clean
Arcabit Trojan.Doina.D1C16
BitDefenderTheta Gen:NN.ZexaF.34670.qGX@a4HRDMj
Cyren W32/Agent.CFX.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent.UKB
Baidu Clean
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
ClamAV Win.Trojan.FickerStealer-9805476-1
Kaspersky HEUR:Trojan.Win32.Zudochka.vho
Alibaba TrojanDownloader:Win32/Stealer.bd2ed7d1
NANO-Antivirus Clean
ViRobot Clean
AegisLab Clean
Tencent Win32.Trojan.Zudochka.Aish
Ad-Aware Gen:Variant.Doina.7190
Emsisoft Trojan.Agent (A)
Comodo Clean
F-Secure Clean
DrWeb Trojan.PWS.Stealer.29929
Zillya Clean
TrendMicro TrojanSpy.Win32.FICKERSTEALER.SMTH.hp
McAfee-GW-Edition BehavesLike.Win32.Generic.dh
CMC Clean
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Agent
Jiangmin Clean
MaxSecure Clean
Avira TR/Agent.egzae
MAX malware (ai score=85)
Antiy-AVL Clean
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Downloader.sa
Microsoft TrojanDownloader:Win32/Stealer.CK!MTB
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Zudochka.vho
GData Gen:Variant.Doina.7190
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Generic.R352614
Acronis Clean
McAfee GenericRXMH-DA!7F1BD3864774
TACHYON Clean
VBA32 BScope.Trojan.Zudochka
Malwarebytes Spyware.FickerStealer
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TrojanSpy.Win32.FICKERSTEALER.SMTH.hp
Rising Trojan.Agent!8.B1E (CLOUD)
Yandex Clean
SentinelOne Clean
eGambit Unsafe.AI_Score_98%
Fortinet W32/Agent.UKB!tr
Webroot W32.Trojan.Gen
AVG Win32:TrojanX-gen [Trj]
Cybereason malicious.647745
Paloalto generic.ml
Qihoo-360 Win32/Ransom.Zudochka.HgIASSAA
No IRMA results available.