Static | ZeroBOX

PE Compile Time

2021-04-11 18:14:00

PDB Path

C:\Users\Test\source\repos\C++ Dropper\Release\C++ Dropper.pdb

PE Imphash

68c97f4638ec4d8784dccbf5cd2aa30e

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00002432 0x00002600 6.18434761408
.rdata 0x00004000 0x00001426 0x00001600 4.38301909161
.data 0x00006000 0x0000040c 0x00000200 1.79273436856
.rsrc 0x00007000 0x000001e0 0x00000200 4.70150325825
.reloc 0x00008000 0x000002a4 0x00000400 4.90042445847

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00007060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x404000 MultiByteToWideChar
0x404008 CreateProcessW
0x404010 GetCurrentProcess
0x404014 TerminateProcess
0x404020 GetCurrentProcessId
0x404024 GetCurrentThreadId
0x40402c GetModuleHandleW
0x404030 InitializeSListHead
0x404034 IsDebuggerPresent
Library USER32.dll:
0x40404c wsprintfW
Library MSVCP140.dll:
Library urlmon.dll:
0x404104 URLDownloadToFileW
Library VCRUNTIME140.dll:
0x40405c memcpy
0x404060 memset
0x404068 __current_exception
0x404070 __CxxFrameHandler3
0x404074 _CxxThrowException
0x404078 memmove
Library api-ms-win-crt-runtime-l1-1-0.dll:
0x4040b0 _c_exit
0x4040b4 _controlfp_s
0x4040b8 terminate
0x4040bc __p___argc
0x4040c0 _cexit
0x4040c8 __p___argv
0x4040cc exit
0x4040d0 _initterm_e
0x4040d4 _initterm
0x4040e4 _crt_atexit
0x4040e8 _set_app_type
0x4040ec _seh_filter_exe
0x4040f0 _exit
Library api-ms-win-crt-heap-l1-1-0.dll:
0x404080 malloc
0x404084 free
0x404088 _callnewh
0x40408c _set_new_mode
Library api-ms-win-crt-math-l1-1-0.dll:
0x40409c __setusermatherr
Library api-ms-win-crt-stdio-l1-1-0.dll:
0x4040f8 _set_fmode
0x4040fc __p__commode
Library api-ms-win-crt-locale-l1-1-0.dll:
0x404094 _configthreadlocale

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
j'hPC@
j@h@D@
bad allocation
Unknown exception
bad array new length
string too long
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
gdltjfjimudmfvcfajwtsquwrnapqtztjvskfqozf
hgscqneabnhbevhenzqtsp
eizitsrmziidytazor
%s\helper
qzckyjiddfxneq
dzygdbsltjjszsndbxkdqzwgenmqubuzvmbswezspjjowezkbxfmbkaiqfjrnaouc
vector too long
C:\Users\Test\source\repos\C++ Dropper\Release\C++ Dropper.pdb
.text$mn
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIZ
.CRT$XPA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
MultiByteToWideChar
GetCurrentDirectoryW
CreateProcessW
KERNEL32.dll
wsprintfW
USER32.dll
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPBD@Z
MSVCP140.dll
URLDownloadToFileW
urlmon.dll
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
_CxxThrowException
__current_exception
__current_exception_context
memset
_except_handler4_common
VCRUNTIME140.dll
_invalid_parameter_noinfo_noreturn
_callnewh
malloc
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
memcpy
memmove
.?AVtype_info@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0 040K0R0
1/1@1I1a1g1v1
2 363L3s3
5"6?6?8n8
<.<T<z<
.1A1G1
7)7.7;7u7N8W8b8i8
9$949D9T9]9u9{9
9#:V:|:
<<,<B<|<
>/>o>u>
??1?M?
0*131<1J1S1u1|1
22%2+21272=2C2I2O2U2[2e2
1 1$1@1D1H1L1P1T1X1\1`1d1x1|1
1d6h6p6
7$74787<7@7D7L7P7X7p7t7
8(;H;T;t;
< <(<0<4<L<P<X<\<`<h<|<
$0<0X0t0
jjjjjjj
https://iplogger.org/1Bbpg7
http://45.15.143.191/files/setup(1).exe
http://45.15.143.191/files/clean(1).exe
http://45.15.143.191/files/vmeo.exe
http://45.15.143.191/files/output(1).exe
http://45.15.143.191/files/setup%20-%202021-04-09T114140.132.exe
http://45.15.143.191/files/IntegraL.exe
http://45.15.143.191/files/Chapo.exe
http://jaishomo.info/setup.exe
Antivirus Signature
Bkav W32.AIDetect.malware2
DrWeb Trojan.Siggen13.6107
ClamAV Clean
FireEye Generic.mg.356dc1680475998c
CAT-QuickHeal Clean
McAfee GenericRXOF-PV!356DC1680475
Cylance Unsafe
Zillya Clean
SUPERAntiSpyware Clean
Sangfor Trojan.Win32.Wacatac.B
CrowdStrike win/malicious_confidence_90% (W)
Alibaba Clean
K7GW Clean
K7AntiVirus Clean
BitDefenderTheta Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Generik.DNATVJ
APEX Malicious
Avast Win32:Trojan-gen
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Bsymem.gen
BitDefender Trojan.GenericKD.36687042
NANO-Antivirus Clean
Paloalto generic.ml
AegisLab Trojan.Win32.Bsymem.4!c
MicroWorld-eScan Trojan.GenericKD.36687042
Tencent Clean
Ad-Aware Trojan.GenericKD.36687042
Emsisoft Trojan.GenericKD.36687042 (B)
Comodo Clean
F-Secure Clean
Baidu Clean
VIPRE Trojan.Win32.Generic!BT
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
CMC Clean
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Jiangmin Clean
eGambit Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Win32.Heur.KVMH017.a.(kcloud)
Microsoft Trojan:Win32/Wacatac.B!ml
Gridinsoft Trojan.Win32.Agent.oa
Arcabit Trojan.Generic.D22FCCC2
ViRobot Clean
ZoneAlarm Clean
GData Trojan.GenericKD.36687042
TACHYON Clean
AhnLab-V3 Clean
Acronis Clean
ALYac Trojan.Agent.Bsymem
MAX malware (ai score=100)
VBA32 Clean
Malwarebytes Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Bsymem!8.FAE7 (CLOUD)
Yandex Clean
SentinelOne Clean
MaxSecure Clean
Fortinet W32/Bsymem.DNATVJ!tr
Webroot Clean
AVG Win32:Trojan-gen
Cybereason Clean
Panda Trj/GdSda.A
Qihoo-360 Win32/Trojan.Bsymem.HgIASSkA
No IRMA results available.