popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

PE Compile Time

2018-04-05 10:01:22

PE Imphash

dc25ee78e2ef4d36faa0badf1e7461c9

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001d04 0x00001e00 5.83921624071
.data 0x00003000 0x00000424 0x00000600 5.46787216795
.rdata 0x00004000 0x000002f4 0x00000400 4.36916423631
.bss 0x00005000 0x0000045c 0x00000000 0.0
.idata 0x00006000 0x000006ec 0x00000800 4.20101165417
.CRT 0x00007000 0x00000034 0x00000200 0.26701297826
.tls 0x00008000 0x00000020 0x00000200 0.22482003451

Imports

Library KERNEL32.dll:
• 0x406138 CloseHandle
• 0x40613c ConnectNamedPipe
• 0x406140 CreateFileA
• 0x406144 CreateNamedPipeA
• 0x406148 CreateThread
• 0x406154 FreeLibrary
• 0x406158 GetCurrentProcess
• 0x40615c GetCurrentProcessId
• 0x406160 GetCurrentThreadId
• 0x406164 GetLastError
• 0x406168 GetModuleHandleA
• 0x40616c GetProcAddress
• 0x406170 GetStartupInfoA
• 0x406178 GetTickCount
• 0x406184 LoadLibraryA
• 0x406188 LoadLibraryW
• 0x406190 ReadFile
• 0x406198 Sleep
• 0x40619c TerminateProcess
• 0x4061a0 TlsGetValue
• 0x4061a8 VirtualAlloc
• 0x4061ac VirtualProtect
• 0x4061b0 VirtualQuery
• 0x4061b4 WriteFile
Library msvcrt.dll:
• 0x4061bc __dllonexit
• 0x4061c0 __getmainargs
• 0x4061c4 __initenv
• 0x4061c8 __lconv_init
• 0x4061cc __set_app_type
• 0x4061d0 __setusermatherr
• 0x4061d4 _acmdln
• 0x4061d8 _amsg_exit
• 0x4061dc _cexit
• 0x4061e0 _fmode
• 0x4061e4 _initterm
• 0x4061e8 _iob
• 0x4061ec _lock
• 0x4061f0 _onexit
• 0x4061f4 _unlock
• 0x4061f8 _winmajor
• 0x4061fc abort
• 0x406200 calloc
• 0x406204 exit
• 0x406208 fprintf
• 0x40620c free
• 0x406210 fwrite
• 0x406214 malloc
• 0x406218 memcpy
• 0x40621c signal
• 0x406220 sprintf
• 0x406224 strlen
• 0x406228 strncmp
• 0x40622c vfprintf
!This program cannot be run in DOS mode.
P`.data
.rdata
0@.bss
.idata
3l$(3l$,1
}66-zHe9
6o9x149|06
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
_set_invalid_parameter_handler
libgcj-12.dll
_Jv_RegisterClasses
%c%c%c%c%c%c%c%c%cMSSE-%d-server
mingwm10.dll
__mingwthr_remove_key_dtor
__mingwthr_key_dtor
Unknown error
_matherr(): %s in %s(%g, %g) (retval=%g)
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
The result is too small to be represented (UNDERFLOW)
Total loss of significance (TLOSS)
Partial loss of significance (PLOSS)
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
CloseHandle
ConnectNamedPipe
CreateFileA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
QueryPerformanceCounter
ReadFile
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
_unlock
_winmajor
calloc
fprintf
fwrite
malloc
memcpy
signal
sprintf
strlen
strncmp
vfprintf
KERNEL32.dll
msvcrt.dll
msvcrt.dll
Antivirus Signature
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.CobaltStrike.AQ
CMC Clean
CAT-QuickHeal TrojanAPT.Cobalt.A7
McAfee Trojan-Cobalt!8CC8D7BBDFAD
Cylance Unsafe
Zillya Trojan.Rozena.Win32.66034
AegisLab Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005622831 )
BitDefender Trojan.CobaltStrike.AQ
K7GW Trojan ( 005622831 )
Cybereason malicious.bdfadc
Baidu Clean
Cyren W32/Fugrafa.MKIR-7653
Symantec Backdoor.Cobalt!gen3
ESET-NOD32 a variant of Win32/Rozena.AMZ
APEX Malicious
Paloalto Clean
ClamAV Win.Trojan.CobaltStrike-7899872-1
Kaspersky HEUR:Trojan.Win32.CobaltStrike.gen
Alibaba Clean
NANO-Antivirus Trojan.Win32.Swrort.fahmzc
SUPERAntiSpyware Clean
Rising Backdoor.CobaltStrike!1.D049 (RDMK:cmRtazrHFOKAhdc2IB+AsGwpq1gZ)
Ad-Aware Trojan.CobaltStrike.AQ
Emsisoft Trojan.CobaltStrike.AQ (B)
Comodo Clean
F-Secure Clean
DrWeb Trojan.Swrort.41
VIPRE Clean
TrendMicro Trojan.Win32.COBALT.SM
McAfee-GW-Edition Trojan-Cobalt!8CC8D7BBDFAD
FireEye Generic.mg.8cc8d7bbdfadcfa7
Sophos ML/PE-A + ATK/Cobalt-A
SentinelOne Static AI - Malicious PE
GData Trojan.CobaltStrike.AQ
Jiangmin Trojan.Generic.ccimj
MaxSecure Trojan.Malware.121218.susgen
Avira TR/Crypt.XPACK.Gen7
MAX malware (ai score=85)
Antiy-AVL Trojan/Generic.ASMalwS.25B2DCB
Kingsoft Clean
Gridinsoft Trojan.Win32.Swrort.vb!s1
Arcabit Trojan.CobaltStrike.AQ
ViRobot Trojan.Win32.Cobalt.14336
ZoneAlarm HEUR:Trojan.Win32.CobaltStrike.gen
Microsoft Trojan:Win32/Swrort.A
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.CobaltStrike.R329694
Acronis Clean
BitDefenderTheta Clean
ALYac Trojan.CobaltStrike.AQ
TACHYON Trojan/W32.Agent.14336.WQ
VBA32 TScope.Malware-Cryptor.SB
Malwarebytes Trojan.Rozena
Panda Clean
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.COBALT.SM
Tencent Malware.Win32.Gencirc.10b0ccf8
Yandex Trojan.GenAsa!/C5jzoNrl5s
Ikarus Trojan.Win32.Rozena
eGambit Unsafe.AI_Score_63%
Fortinet W32/Generic.AC.416F47
Webroot W32.Trojan.Gen
AVG Win32:Malware-gen
Avast Win32:Malware-gen
CrowdStrike Clean
Qihoo-360 Clean
No IRMA results available.