Static | ZeroBOX

PE Compile Time

2015-03-18 04:47:21

PE Imphash

534501dd9ce577814935581296a7adca

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000116d4 0x00012000 6.05755118512
.data 0x00013000 0x00001530 0x00001000 0.0
.rsrc 0x00015000 0x00000468 0x00001000 1.14957459445

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00015340 0x00000128 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0001532c 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x000150f0 0x0000023c LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library MSVBVM60.DLL:
0x401000 None
0x401004 _CIcos
0x401008 _adj_fptan
0x40100c __vbaVarMove
0x401010 __vbaFreeVar
0x401014 __vbaAryMove
0x401018 __vbaFreeVarList
0x40101c _adj_fdiv_m64
0x401020 __vbaFreeObjList
0x401024 _adj_fprem1
0x401028 __vbaRecAnsiToUni
0x40102c __vbaSetSystemError
0x401030 __vbaRecDestruct
0x401038 None
0x40103c _adj_fdiv_m32
0x401040 None
0x401044 __vbaAryDestruct
0x401048 __vbaObjSet
0x40104c None
0x401050 None
0x401054 _adj_fdiv_m16i
0x401058 __vbaObjSetAddref
0x40105c _adj_fdivr_m16i
0x401060 __vbaFpR8
0x401064 _CIsin
0x401068 __vbaChkstk
0x40106c EVENT_SINK_AddRef
0x401070 None
0x401074 __vbaVarTstEq
0x401078 __vbaObjVar
0x40107c DllFunctionCall
0x401080 _adj_fpatan
0x401084 None
0x401088 None
0x40108c __vbaRecUniToAnsi
0x401090 EVENT_SINK_Release
0x401094 _CIsqrt
0x40109c __vbaExceptHandler
0x4010a0 _adj_fprem
0x4010a4 _adj_fdivr_m64
0x4010a8 None
0x4010ac None
0x4010b0 __vbaFPException
0x4010b4 None
0x4010b8 None
0x4010bc None
0x4010c0 _CIlog
0x4010c4 __vbaErrorOverflow
0x4010c8 None
0x4010cc __vbaFileOpen
0x4010d0 __vbaNew2
0x4010d4 None
0x4010d8 __vbaInStr
0x4010dc __vbaVar2Vec
0x4010e0 None
0x4010e4 _adj_fdiv_m32i
0x4010e8 _adj_fdivr_m32i
0x4010ec __vbaStrCopy
0x4010f0 __vbaFreeStrList
0x4010f4 _adj_fdivr_m32
0x4010f8 _adj_fdiv_r
0x4010fc None
0x401100 __vbaVarTstNe
0x401104 __vbaLateMemCall
0x401108 __vbaStrToAnsi
0x40110c __vbaVarDup
0x401110 __vbaFpI4
0x401118 __vbaLateMemCallLd
0x40111c _CIatan
0x401120 __vbaStrMove
0x401124 __vbaCastObj
0x401128 _allmul
0x40112c __vbaLateIdSt
0x401130 _CItan
0x401134 _CIexp
0x401138 __vbaFreeStr
0x40113c __vbaFreeObj

!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
LGEKORPSENES
smokingjakkens
bespeaking
bespeaking
VB5!6&*
lntrinene
LGEKORPSENES
LGEKORPSENES
LGEKORPSENES
smokingjakkens
Hormonizes2
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
user32
SystemParametersInfoA
advapi32.dll
RegDeleteKeyA
FillRect
SetArcDirection
WSOCK32
gethostbyname
CopyIcon
Kernel32
WriteFile
RemovePropA
shdocvw.dll
DoFileDownload
mpr.dll
WNetAddConnectionA
SetCursor
winspool.drv
ConfigurePortA
wininet.dll
FtpGetCurrentDirectoryA
VDMDBG.dll
VDMEnumProcessWOW
UnregisterClassA
shlwapi.dll
PathIsRootA
GetPolyFillMode
VirtualLock
GetFullPathNameA
winmm.dll
mmioRead
shell32
InternetCombineUrlA
SHCreateThread
midiOutOpen
PathIsDirectoryA
DrawTextA
WaitMessage
sndPlaySoundA
SelectPalette
CryptHashData
CopyLZFile
wsock32.dll
rpcrt4
UuidToStringA
user32.dll
GetMonitorInfoA
inet_addr
GetShortPathNameA
PathCommonPrefixA
rasapi32.dll
RasDialA
msimg32.dll
AlphaBlend
GetPrivateProfileStringA
GetSystemInfo
Netapi32.dll
NetShareGetInfo
SetPropA
PwdChangePasswordA
GetClassNameA
LocalFileTimeToFileTime
waveInPrepareHeader
PolyPolyline
mixerGetDevCapsA
GetMenuItemInfoA
AdjustTokenPrivileges
EnableWindow
EnumDisplayMonitors
DeviceIoControl
FormatMessageA
waveOutPrepareHeader
SetStretchBltMode
waveOutWrite
IsChild
__vbaAryDestruct
SetDoubleClickTime
SetCaretBlinkTime
CreatePatternBrush
DrawIcon
FileTimeToLocalFileTime
CombineRgn
IntersectRect
SetSystemPowerState
PathQuoteSpacesA
GetLastError
CallNextHookEx
CreateDCA
userenv.dll
GetUserProfileDirectoryA
avifil32
AVIFileOpenA
CreateToolhelp32Snapshot
GetKeyboardLayoutNameA
LineTo
__vbaFpR8
WNetOpenEnumA
comctl32
FlatSB_GetScrollInfo
kernel32.dll
RtlZeroMemory
RasHangUpA
Snittende
VBA6.DLL
__vbaVar2Vec
__vbaAryMove
__vbaErrorOverflow
__vbaRecDestruct
__vbaVarMove
__vbaLateMemCallLd
__vbaFreeObjList
__vbaCastObj
__vbaObjVar
__vbaObjSetAddref
__vbaInStr
__vbaSetSystemError
__vbaFileOpen
__vbaFreeStrList
__vbaLateMemCall
__vbaFreeVar
__vbaStrMove
__vbaLateIdSt
__vbaRecDestructAnsi
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaVarDup
__vbaStrCopy
__vbaFpI4
__vbaFreeObj
__vbaObjSet
__vbaNew2
__vbaFreeStr
__vbaStrToAnsi
__vbaVarTstNe
__vbaHresultCheckObj
__vbaFreeVarList
__vbaVarTstEq
Hormonizes2
HOOKHERE
=Q5W!
q/#@2q
5OcS7Wx1$
2iUlB<
Se4ES[
{r&lei
SS;W!
}i;j<_
-`{5W
`A||5#
bsO,3
.oW%
fo>6sHP
~@ R?N
Z_E]1$
<^!jW!
{dddddddddddddddddddddddddddddddddddddddddd
7''''''''''''''''''''''''''''''''''''''''''
#ZSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS1
v nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
zDQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
|KLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
8--------------------------------------
{AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HItttttttttttttttttttttttttttttttttttttttt
^!bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb5
/.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
HANDICRAFTSMAN
Multiplepoinding
soakers
checkheftes
prenational
ENDORSINGLY
nodular
Kamerabevgelsen1
TEGNINGS
} j@h(?@
} j@h(?@
} jLh(?@
} j,h|?@
} jLh(?@
} j$h|?@
} jDh(?@
} jLh(?@
} jLh(?@
} j@h(?@
} jLh(?@
} j,h|?@
} j@h(?@
} j4h(?@
} j@h(?@
} jLh(?@
} j$h|?@
} j@h(?@
} j4h(?@
} jLh(?@
} j,h|?@
} j8h(?@
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaFpR8
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaVarTstEq
__vbaObjVar
DllFunctionCall
_adj_fpatan
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
__vbaInStr
__vbaVar2Vec
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaFpI4
__vbaRecDestructAnsi
__vbaLateMemCallLd
_CIatan
__vbaStrMove
__vbaCastObj
_allmul
__vbaLateIdSt
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
Tedes1
Korpulente8
Lienculi
BJLKERS
Karriolhest4
abonnementsservicernes
Serpentins9
formamidine
Pyrenin7
Enigt4
NONINHERITABILITY
Klatpapir3
BALTEI
ACCRESCENCE
Hensttelsesadgangens
Ingenmandslands
CURIES
privatforbrug
sagfrersalr
slalomkrslers
Sammentmr6
nonperpendicularly
Anslagsstillingen
SKARABENS
sprgernes
Rodding
Perspectives
POSTNATUS
INDFARVNINGS
SIRUPSKAGERS
Tjenernes
saltoen
KAPELLANENS
konditoriet
HALVERINGERNE
baldur
unincidentally
UDFORMNINGEN
Nonscientist5
Overrislingen6
plasmolytically
RESPIRATIONERNE
sorrig
Modregnes7
Behovstilfredsstillende
indkapslinger
Fraudlessness3
Sistroid
BJERGBESTIGERES
UBNmlNXNzKrG7JQ37
APPARATUS
HJERNEN
Sedate
Udklasning
genomes
andesytes
Nonresolvabness2
Botchily
facilitative
acousticon
Skruttedes
Garvningers2
mcK7nbYd7bufplhpA94zMNJbssUl7aV9o248
untame
ANTIVANDALISM
immovables
FORTRNGNINGERNES
Fusulina2
STRUDSEFJERENES
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
040904B0
Comments
CompanyName
ProductName
LGEKORPSENES
FileVersion
ProductVersion
InternalName
lntrinene
OriginalFilename
lntrinene.exe
Antivirus Signature
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.75481
FireEye Generic.mg.b375d47d63b41b7e
CAT-QuickHeal Trojan.Multi
ALYac Clean
Malwarebytes Trojan.MalPack.VB
VIPRE Clean
K7AntiVirus Trojan ( 0057cff61 )
BitDefender Trojan.GenericKDZ.75481
K7GW Trojan ( 0057cff61 )
Cybereason Clean
Arcabit Clean
BitDefenderTheta Gen:NN.ZevbaF.34692.fm0@aC5ms3di
Cyren W32/VB.TF.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.EPKF
Baidu Clean
APEX Malicious
Paloalto generic.ml
ClamAV Win.Dropper.Vebzenpak-9865056-0
Kaspersky Backdoor.MSIL.NanoBot.bemw
Alibaba Trojan:Win32/Injector.04462a84
NANO-Antivirus Clean
ViRobot Clean
AegisLab Trojan.Multi.Generic.4!c
Tencent Clean
Ad-Aware Trojan.GenericKDZ.75481
TACHYON Clean
Emsisoft Trojan.GenericKDZ.75481 (B)
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition PWS-FCZE!B375D47D63B4
CMC Clean
Sophos Mal/Generic-S
Ikarus Trojan.VB.Crypt
Jiangmin Clean
Webroot Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Microsoft Trojan:Win32/Wacatac.B!ml
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Trojan.GenericKDZ.75481
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R422703
Acronis Clean
VBA32 Clean
MAX malware (ai score=85)
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0CEQ21
Rising Trojan.Injector!8.C4 (CLOUD)
Yandex Trojan.AvsArher.bTx33N
SentinelOne Static AI - Suspicious PE
MaxSecure Clean
Fortinet W32/Injector.EPKFTR
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_60% (W)
Qihoo-360 Clean
No IRMA results available.