Static | ZeroBOX

PE Compile Time

2015-07-13 00:21:46

PE Imphash

534501dd9ce577814935581296a7adca

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00011974 0x00012000 6.19166650892
.data 0x00013000 0x00001530 0x00001000 0.0
.rsrc 0x00015000 0x00000478 0x00001000 1.15110526104

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00015350 0x00000128 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0001533c 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x000150f0 0x0000024c LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library MSVBVM60.DLL:
0x401000 None
0x401004 _CIcos
0x401008 _adj_fptan
0x40100c __vbaVarMove
0x401010 __vbaFreeVar
0x401014 __vbaAryMove
0x401018 __vbaFreeVarList
0x40101c _adj_fdiv_m64
0x401020 __vbaFreeObjList
0x401024 _adj_fprem1
0x401028 __vbaRecAnsiToUni
0x40102c __vbaSetSystemError
0x401030 __vbaRecDestruct
0x401038 None
0x40103c _adj_fdiv_m32
0x401040 None
0x401044 __vbaAryDestruct
0x401048 __vbaObjSet
0x40104c None
0x401050 None
0x401054 _adj_fdiv_m16i
0x401058 __vbaObjSetAddref
0x40105c _adj_fdivr_m16i
0x401060 __vbaFpR8
0x401064 _CIsin
0x401068 __vbaChkstk
0x40106c EVENT_SINK_AddRef
0x401070 None
0x401074 __vbaVarTstEq
0x401078 __vbaObjVar
0x40107c DllFunctionCall
0x401080 _adj_fpatan
0x401084 None
0x401088 None
0x40108c __vbaRecUniToAnsi
0x401090 EVENT_SINK_Release
0x401094 _CIsqrt
0x40109c __vbaExceptHandler
0x4010a0 _adj_fprem
0x4010a4 _adj_fdivr_m64
0x4010a8 None
0x4010ac None
0x4010b0 __vbaFPException
0x4010b4 None
0x4010b8 None
0x4010bc None
0x4010c0 _CIlog
0x4010c4 __vbaErrorOverflow
0x4010c8 None
0x4010cc __vbaFileOpen
0x4010d0 __vbaNew2
0x4010d4 None
0x4010d8 __vbaInStr
0x4010dc __vbaVar2Vec
0x4010e0 None
0x4010e4 _adj_fdiv_m32i
0x4010e8 _adj_fdivr_m32i
0x4010ec __vbaStrCopy
0x4010f0 __vbaFreeStrList
0x4010f4 _adj_fdivr_m32
0x4010f8 _adj_fdiv_r
0x4010fc None
0x401100 __vbaVarTstNe
0x401104 __vbaLateMemCall
0x401108 __vbaStrToAnsi
0x40110c __vbaVarDup
0x401110 __vbaFpI4
0x401118 __vbaLateMemCallLd
0x40111c _CIatan
0x401120 __vbaStrMove
0x401124 __vbaCastObj
0x401128 _allmul
0x40112c __vbaLateIdSt
0x401130 _CItan
0x401134 _CIexp
0x401138 __vbaFreeStr
0x40113c __vbaFreeObj

!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
Totalafholdende6
Belched8
Exactable9
Exactable9
VB5!6&*
Invalidish7
Totalafholdende6
Totalafholdende6
Totalafholdende6
Belched8
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
user32
SystemParametersInfoA
advapi32.dll
RegDeleteKeyA
FillRect
SetArcDirection
WSOCK32
gethostbyname
CopyIcon
Kernel32
WriteFile
RemovePropA
shdocvw.dll
DoFileDownload
mpr.dll
WNetAddConnectionA
SetCursor
winspool.drv
ConfigurePortA
wininet.dll
FtpGetCurrentDirectoryA
VDMDBG.dll
VDMEnumProcessWOW
UnregisterClassA
shlwapi.dll
PathIsRootA
GetPolyFillMode
VirtualLock
GetFullPathNameA
winmm.dll
mmioRead
shell32
InternetCombineUrlA
SHCreateThread
midiOutOpen
PathIsDirectoryA
DrawTextA
WaitMessage
sndPlaySoundA
SelectPalette
CryptHashData
CopyLZFile
wsock32.dll
rpcrt4
UuidToStringA
user32.dll
GetMonitorInfoA
inet_addr
GetShortPathNameA
PathCommonPrefixA
rasapi32.dll
RasDialA
msimg32.dll
AlphaBlend
GetPrivateProfileStringA
GetSystemInfo
Netapi32.dll
NetShareGetInfo
SetPropA
PwdChangePasswordA
GetClassNameA
LocalFileTimeToFileTime
waveInPrepareHeader
PolyPolyline
mixerGetDevCapsA
GetMenuItemInfoA
AdjustTokenPrivileges
EnableWindow
EnumDisplayMonitors
DeviceIoControl
FormatMessageA
waveOutPrepareHeader
SetStretchBltMode
waveOutWrite
IsChild
__vbaAryDestruct
SetDoubleClickTime
SetCaretBlinkTime
CreatePatternBrush
DrawIcon
FileTimeToLocalFileTime
CombineRgn
IntersectRect
SetSystemPowerState
PathQuoteSpacesA
GetLastError
CallNextHookEx
CreateDCA
userenv.dll
GetUserProfileDirectoryA
avifil32
AVIFileOpenA
CreateToolhelp32Snapshot
GetKeyboardLayoutNameA
LineTo
__vbaFpR8
WNetOpenEnumA
comctl32
FlatSB_GetScrollInfo
kernel32.dll
RtlZeroMemory
RasHangUpA
Snittende
VBA6.DLL
__vbaVar2Vec
__vbaAryMove
__vbaErrorOverflow
__vbaRecDestruct
__vbaVarMove
__vbaLateMemCallLd
__vbaFreeObjList
__vbaCastObj
__vbaObjVar
__vbaObjSetAddref
__vbaInStr
__vbaSetSystemError
__vbaFileOpen
__vbaFreeStrList
__vbaLateMemCall
__vbaFreeVar
__vbaStrMove
__vbaLateIdSt
__vbaRecDestructAnsi
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaVarDup
__vbaStrCopy
__vbaFpI4
__vbaFreeObj
__vbaObjSet
__vbaNew2
__vbaFreeStr
__vbaStrToAnsi
__vbaVarTstNe
__vbaHresultCheckObj
__vbaFreeVarList
__vbaVarTstEq
HOOKHERE
'f|?'@
pNPJu7
pNPJu7
pNPJu7
rS}0rk
eN^#U=pTrd
eN^#U=pTrd
rS<*rk
u[Uxw>T
5fFo~q
Cs)5>Wu
G/{Kc9
;j03Tt
-0hr
&Q-2&n
-:&Q-2&n
,)'dr
CLYh1k
j]DJj]D&juD
D{?O{\
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
}eeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
||||||||||||||||||||||||||||||||||||
,vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvHf
r'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
xgggggggggggggggggggggggggggggggg
B0000000000000000000000000000000j
dKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKh"K@
rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
Offffffffffffffffffffffffffffffffffffff5
Attargul
HANDICRAFTSMAN
Multiplepoinding
soakers
checkheftes
prenational
ENDORSINGLY
nodular
Kamerabevgelsen1
TEGNINGS
} j@h(?@
} j@h(?@
} jLh(?@
} j,h|?@
} jLh(?@
} j$h|?@
} jDh(?@
} jLh(?@
} jLh(?@
} j@h(?@
} jLh(?@
} j,h|?@
} j@h(?@
} j4h(?@
} j@h(?@
} jLh(?@
} j$h|?@
} j@h(?@
} j4h(?@
} jLh(?@
} j,h|?@
} j8h(?@
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaFpR8
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaVarTstEq
__vbaObjVar
DllFunctionCall
_adj_fpatan
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
__vbaInStr
__vbaVar2Vec
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaFpI4
__vbaRecDestructAnsi
__vbaLateMemCallLd
_CIatan
__vbaStrMove
__vbaCastObj
_allmul
__vbaLateIdSt
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
Tedes1
Korpulente8
Lienculi
BJLKERS
Karriolhest4
abonnementsservicernes
Serpentins9
formamidine
Pyrenin7
Enigt4
NONINHERITABILITY
Klatpapir3
BALTEI
ACCRESCENCE
Hensttelsesadgangens
Ingenmandslands
CURIES
privatforbrug
sagfrersalr
slalomkrslers
Sammentmr6
nonperpendicularly
Anslagsstillingen
SKARABENS
sprgernes
Rodding
Perspectives
POSTNATUS
INDFARVNINGS
SIRUPSKAGERS
Tjenernes
saltoen
KAPELLANENS
konditoriet
HALVERINGERNE
baldur
unincidentally
UDFORMNINGEN
Nonscientist5
Overrislingen6
plasmolytically
RESPIRATIONERNE
sorrig
Modregnes7
Behovstilfredsstillende
indkapslinger
Fraudlessness3
Sistroid
BJERGBESTIGERES
UBNmlNXNzKrG7JQ37
APPARATUS
HJERNEN
Sedate
Udklasning
genomes
andesytes
Nonresolvabness2
Botchily
facilitative
acousticon
Skruttedes
Garvningers2
mcK7nbYd7bufplhpA94zMNJbssUl7aV9o248
untame
ANTIVANDALISM
immovables
FORTRNGNINGERNES
Fusulina2
STRUDSEFJERENES
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
040904B0
Comments
CompanyName
ProductName
Totalafholdende6
FileVersion
ProductVersion
InternalName
Invalidish7
OriginalFilename
Invalidish7.exe
Antivirus Signature
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Clean
CMC Clean
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
VIPRE Clean
AegisLab Trojan.Win32.Generic.4!c
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_60% (W)
BitDefender Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.EPKF
APEX Malicious
Avast Win32:Malware-gen
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/Injector.77a75910
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Injector!8.C4 (CLOUD)
Ad-Aware Clean
Emsisoft Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Trojan.mm
FireEye Generic.mg.b0c6368fb892e871
Sophos Generic PUA GG (PUA)
SentinelOne Clean
Jiangmin Clean
Webroot Clean
Avira Clean
MAX Clean
Antiy-AVL Clean
Kingsoft Clean
Microsoft Program:Win32/Wacapew.C!ml
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Clean
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!B0C6368FB892
TACHYON Clean
VBA32 Clean
Malwarebytes Malware.AI.3394031013
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Trojan.AvsArher.bTx33N
Ikarus Trojan.VB.Crypt
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Gen:NN.ZevbaF.34692.fm0@a4ceUvgi
AVG Win32:Malware-gen
Cybereason Clean
Paloalto generic.ml
Qihoo-360 Clean
No IRMA results available.