Static | ZeroBOX

PE Compile Time

2018-02-02 05:18:05

PE Imphash

2c5f2513605e48f2d8ea5440a870cb9e

PEiD Signatures

PureBasic 4.x -> Neil Hodgson

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.code 0x00001000 0x0000387e 0x00003a00 5.52796946819
.text 0x00005000 0x0000d642 0x0000d800 6.54614983042
.rdata 0x00013000 0x000033a8 0x00003400 7.11033437291
.data 0x00017000 0x0000178c 0x00001200 5.10168112871
.rsrc 0x00019000 0x00022648 0x00022800 7.99707034367

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x00019244 0x000221a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x00019244 0x000221a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x00019244 0x000221a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x00019244 0x000221a0 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0003b3e4 0x00000263 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, ASCII text

Imports

Library MSVCRT.dll:
0x417470 memset
0x417474 wcsncmp
0x417478 memmove
0x41747c wcsncpy
0x417480 wcsstr
0x417484 _wcsnicmp
0x417488 _wcsdup
0x41748c free
0x417490 _wcsicmp
0x417494 wcslen
0x417498 wcscpy
0x41749c wcscmp
0x4174a0 wcscat
0x4174a4 memcpy
0x4174a8 tolower
0x4174ac malloc
Library KERNEL32.dll:
0x4174b4 GetModuleHandleW
0x4174b8 HeapCreate
0x4174bc GetStdHandle
0x4174c4 HeapDestroy
0x4174c8 ExitProcess
0x4174cc WriteFile
0x4174d0 GetTempFileNameW
0x4174d4 LoadLibraryExW
0x4174d8 EnumResourceTypesW
0x4174dc FreeLibrary
0x4174e0 RemoveDirectoryW
0x4174e4 EnumResourceNamesW
0x4174e8 GetCommandLineW
0x4174ec LoadResource
0x4174f0 SizeofResource
0x4174f4 FreeResource
0x4174f8 FindResourceW
0x4174fc GetNativeSystemInfo
0x417500 GetShortPathNameW
0x417508 GetSystemDirectoryW
0x417510 CloseHandle
0x41751c WaitForSingleObject
0x417520 TerminateThread
0x417524 CreateThread
0x417528 GetProcAddress
0x41752c GetVersionExW
0x417530 Sleep
0x417534 WideCharToMultiByte
0x417538 HeapAlloc
0x41753c HeapFree
0x417540 LoadLibraryW
0x417544 GetCurrentProcessId
0x417548 GetCurrentThreadId
0x41754c GetModuleFileNameW
0x417550 PeekNamedPipe
0x417554 TerminateProcess
0x417560 GetCurrentProcess
0x417564 DuplicateHandle
0x417568 CreatePipe
0x41756c CreateProcessW
0x417570 GetExitCodeProcess
0x417578 HeapSize
0x41757c MultiByteToWideChar
0x417580 CreateDirectoryW
0x417584 SetFileAttributesW
0x417588 GetTempPathW
0x41758c DeleteFileW
0x417598 CreateFileW
0x41759c SetFilePointer
0x4175a0 TlsFree
0x4175a4 TlsGetValue
0x4175a8 TlsSetValue
0x4175ac TlsAlloc
0x4175b0 HeapReAlloc
0x4175bc InterlockedExchange
0x4175c0 GetLastError
0x4175c4 SetLastError
0x4175c8 UnregisterWait
0x4175cc GetCurrentThread
Library USER32.DLL:
0x4175d8 CharUpperW
0x4175dc CharLowerW
0x4175e0 MessageBoxW
0x4175e4 DefWindowProcW
0x4175e8 DestroyWindow
0x4175ec GetWindowLongW
0x4175f4 GetWindowTextW
0x4175f8 UnregisterClassW
0x4175fc LoadIconW
0x417600 LoadCursorW
0x417604 RegisterClassExW
0x417608 IsWindowEnabled
0x41760c EnableWindow
0x417610 GetSystemMetrics
0x417614 CreateWindowExW
0x417618 SetWindowLongW
0x41761c SendMessageW
0x417620 SetFocus
0x417628 SetForegroundWindow
0x41762c BringWindowToTop
0x417630 GetMessageW
0x417638 TranslateMessage
0x41763c DispatchMessageW
0x417644 PostMessageW
0x417648 GetForegroundWindow
0x417650 IsWindowVisible
0x417654 EnumWindows
0x417658 SetWindowPos
Library GDI32.DLL:
0x417660 GetStockObject
Library COMCTL32.DLL:
Library SHELL32.DLL:
0x417670 ShellExecuteExW
0x417674 SHGetFolderLocation
Library WINMM.DLL:
0x417680 timeBeginPeriod
Library OLE32.DLL:
0x417688 CoInitialize
0x41768c CoTaskMemFree
Library SHLWAPI.DLL:
0x417694 PathAddBackslashW
0x41769c PathQuoteSpacesW
0x4176a0 PathRemoveArgsW

!This program cannot be run in DOS mode.
`.text
`.rdata
@.data
\$TK;\$(
PPPPPP
PPPPPP
PPPPPP
PPPPPP
PPPPPP
PPPPPP
[_;\$(u
t3Ot"Ot
D$ PVW
{_^][Y
VW9l$4u
D$4$0A
\$89l$<u
D$<$0A
L$@9l$D
D$$QVP
D$$QVP
D$$QVP
D$$QVP
D$$QVP
D$$QVP
D$$QVP
D$$QVP
D$$QVP
jPjCjnh
D$$PVS
f9LD6u
j\Xf9D~
QQSUVW
tcj"Zf;
_^][YY
SUVWj 3
]jD^VP
t$,t"h
D$TPQRU
t$8RRVR
9|$0tM
9|$0t@
!~(_^[
j\Xf9Ds
j\Xf9Dw
HtOHt5
t9V@Pj
<_^][YY
3D$H3D$<
3D$$3D$@
3T$(3T$D3T$<
3T$,3T$
3T$03T$
3T$ 3T$
3T$H3T$
3T$$3T$ 3P
L$X3P$
3T$,3P,3P
3T$03P03P
3P43P
3P83P$
3P<3P(
3W83W 3W
3S<3S$3S
13q(3q 3q
3q,3q$
3q03q(3q
3q43q,3q
3q83q03q$
q<3q43q(3q
13q83q,3q
3q<3q03q
313q43q
3q83q$
3q<3q(
3r83r 3r
3r<3r$3r
13q(3q 3q
3q,3q$3q
3p43p,3p
3P83P03P$
3P83P$
3P<3P(
D$h3H03H
\$03\$X3\$
3P(3P
l$X3P,3P$3P
3T$L3T$D3P
3T$H3T$@3P
3P83T$L
P(3P<3T$H3P
D$,3A<3A
?vMj@[+
t+h$7A
D$0RSP
W@;P s
s<u";i
W@;P(s
Gh;G\sY
Gh;G\r
M;t$8r
T$8#\$
T$8#\$
|$ 9O@
D$(+D$
D$(+D$,
D$,^][_
N(9N0u
F,][_3
T$0;l$<
_^][YY
RtlGetVersion
SHBrowseForFolderW
SHGetPathFromIDListW
GetLongPathNameW
SHGetKnownFolderPath
0123456789abcdefK
InitOnceExecuteOnce
incorrect header check
unknown compression method
invalid window size
unknown header flags set
header crc mismatch
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid code lengths set
invalid bit length repeat
invalid code -- missing end-of-block
invalid literal/lengths set
invalid distances set
invalid literal/length code
invalid distance code
invalid distance too far back
incorrect data check
incorrect length check
Qkkbal
[-&LMb#{'
w+OQvr
INSKyu
)\ZEo^m/
H*0"ZOW
mj>zjZ
IiGM>nw
ewh/?y
OZw3(?
V_:X1:
inflate 1.2.8 Copyright 1995-2013 Mark Adler
need dictionary
stream end
file error
stream error
data error
insufficient memory
buffer error
incompatible version
memset
MSVCRT.dll
GetModuleHandleW
HeapCreate
GetStdHandle
SetConsoleCtrlHandler
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetNativeSystemInfo
GetShortPathNameW
GetWindowsDirectoryW
GetSystemDirectoryW
KERNEL32.dll
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
_wcsicmp
wcslen
wcscpy
wcscmp
wcscat
memcpy
tolower
malloc
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
GetProcAddress
GetVersionExW
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
PeekNamedPipe
TerminateProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
DuplicateHandle
CreatePipe
CreateProcessW
GetExitCodeProcess
SetUnhandledExceptionFilter
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
DestroyWindow
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
EnableWindow
GetSystemMetrics
CreateWindowExW
SetWindowLongW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
USER32.DLL
GetStockObject
GDI32.DLL
InitCommonControlsEx
COMCTL32.DLL
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
SHELL32.DLL
timeBeginPeriod
WINMM.DLL
CoInitialize
CoTaskMemFree
OLE32.DLL
PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
SHLWAPI.DLL
Q*J\gVQ'
b;Aw#Zv&
8@&cG!
5'EVH;
uR&xv|*
s92Ao5@${
z!`6yt
Y4Z@jsR
hV 0|J
d*vIVS;
&<~f=N
;E*<N[O
PIR\XF
P-@u_
c<h8]Q
#rJ#qu2kM;
f7+!zG-
GrMgz_
PLmt]L
!ew9-x&
Tj(sDW
}}WfJ@
K"YcQ+
y<]=1*
*9]d;Pa*L
nabvN!r(
x%6KE:
FXLM>_
HDC#o
Oyk[V=
]-?Xaz
bwa~hN
$H"7Hi
OY[/XF
:L5(uqy{XR
oyW|H\
$Pt35.
J|B^t;#
u;g6wZL
Q;AsXzr
c@F +!P7
7umfedEu
4oe]2
YO.FW|!
3q\+%f0
DX||}p2
nqAP8`
dyL&9@v
t]Mue<nx9s/
/vqSRR
ID<kK]%
b>nQr3
}UR(b
f^g50i
41F'{K
23_'?W
zy37?Z*
gf6b"
e69OXb
WmfF'0
qsjx%U
Sjh^[h
1nWvDx
F"Y6-;
);J3,p
8.M\(}5
'VUdtw
.M&\]O]+
:c~h*YR
K,(J(Yo
!6C[m*
|p!Isj
bU|P(j
shyW=>
ydlEga
154_<h;
ETX#jPu
(^;RP:
>m)<A.
\iES=B
9(d]P(
q7ujPT
:pb&li
L}M-IOQ
qM(cFq
[3)BtV
TtT"?cg
qLjj<w
c[-Y,/
JxaEkyA
}{P/zU=
fbzbzQ
Z*S%4T
d7{qU3
!&mGQUza
F@l_bEPw
DE!8#F
T+$3wT
:M|D~\
f]wpD9a:/e
YoIm)3y
'.Xe`L
rV11(@
fp*$gt
Tgb)]t
*Q7R=L3
H13u9T
vx\mif
)?T!1tPwr}|
<)Sw<[
1_B7y}$
h$<M&p
Vv}jyS
|C&7;{
{|*d'N
pTcTeM
qT.q!
ksOM,9
zSY3^s
]?y!BY
0/h%ZXZ
8V}8r
8?)=}O
`^R|F
&.;wVy
}+~1tf
O.Ti#w
RvBZ{9{5
/[g,wyW
0'Q@R\
2DN`C!
[r(keD
<-iTlo,
ftFbzu
~ubhr"y
W%@%F|
6iZRVE
"(b{qn*
xG&c0n
`w:hYv3
5@dp'&
ZXWKK
+.OIkZ
xc0x}k
3N*==t
>U]SQ`
m$tUMow
b,yzh!
cW~%]%
q`-H&=n
Xoyow
?4/9'*!
:5Yz_OU5
+oA&_>o'
0fMDHx
6Ln*e@u
y-,{S!
xOgLp"M{
dp*$"A@
yY[,H;z
Jn#(K9H
S8Ibr(J
{<ITM0
e.lH#]U
g~T\w!
Ie_GrG
zAcMP
K3t>-|
Sd.Bf$
1~(_K
7l#Ul9
td-$0u
+krj7&
Ld73(Y
VOx>.A
e%QA+>
P,m3Kx
3Ob0j4
EL=L7d
uLmru,!
CJ]td~Fo
bi$z(
18"?KC
dKU[:ZG
.pxd,3PL+
DO&&Bu%
8P~~;(
bkc4os
2_TkdR
4LEj"x
7IdBlX
XW<*r"
%9j@%HEw
eBq3Fn
#Xmao@
\Ujhub
;xv `
vdg45.f>,
SOB!V`
Bg*7zn[
>Dy}"<
se&0]no
`Hko'b
e+8Xm*u
[gFlhe
<G#W?$
vw.N<*
T+{{;A
P1{'<T
iIgCSA
}i*}v3E3
#~`>~y
\{K7O!
][6(5t
?8,'NN^
hNq[.x
f76^xLJ
SVO3Fe
hH{lo/A{dZ
*>^{76
'tt}[:
(cqFY2
sSH%?S
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.0.0.0"
processorArchitecture="X86"
name="CompanyName.ProductName.YourApp"
type="win32" />
<description></description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="X86"
publicKeyToken="6595b64144ccf1df"
language="*" />
</dependentAssembly>
</dependency>
</assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
ntdll.dll
2147483648
InputRequester
STATIC
BUTTON
SHELL32.DLL
AInvalid memory access
Array bounds exceeded
Debugger breakpoint reached
Misaligned data access
Denormal floating-point operand
Division by zero (floating-point)
Inexact floating-point result
Invalid floating-point operation
Floating-point overflow (exponent to great)
Floating-point stack overflow or underflow
Floating-point underflow (exponent too small)
Illegal instruction
Memory page error
Division by zero
Integer overflow
Exception handler returned unknown value
Exception handler tried to continue after non-continuable exception
Privileged instruction
Single step trap
Stack overflow
Unknown error code
Kernel32.DLL
Shell32.DLL
Downloads\
Kernel32.dll
#+3;CScs
sysnative
513FEFD99C 516EC85663E2BA5E68CCE5EAD84696DB(8D3F8539CEEA94FF00F44A86F6F19D4B14B28649 BA18FDA09FED5B163D33FD2520BEDF34
Antivirus Signature
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Clean
CMC Clean
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
VIPRE Clean
AegisLab Trojan.Win32.Generic.4!c
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
Cybereason malicious.15ec37
Baidu Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Clean
APEX Malicious
Avast Clean
ClamAV Clean
Kaspersky Clean
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Malware.Heuristic!ET#99% (RDMK:cmRtazryDxR2o4l4/vaR+osAQpOI)
Ad-Aware Clean
Sophos ML/PE-A
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Ransom.dc
FireEye Generic.mg.c58d5a146655600a
Emsisoft Clean
SentinelOne Static AI - Suspicious PE
Jiangmin Clean
Webroot Clean
Avira Clean
eGambit Unsafe.AI_Score_99%
MAX Clean
Antiy-AVL Clean
Kingsoft Clean
Microsoft Program:Win32/Wacapew.C!ml
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Clean
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis suspicious
McAfee Artemis!C58D5A146655
TACHYON Clean
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
Ikarus Clean
MaxSecure Trojan.Malware.300983.susgen
Fortinet Clean
BitDefenderTheta Gen:NN.ZexaF.34686.ouW@a4tVGc
Paloalto generic.ml
CrowdStrike win/malicious_confidence_90% (W)
Qihoo-360 Clean
No IRMA results available.