Static | ZeroBOX

PE Compile Time

2021-06-01 23:20:37

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x000064d4 0x00006600 6.47187859122
.rsrc 0x0000a000 0x00000400 0x00000400 2.46935057856
.reloc 0x0000c000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0000a058 0x0000029c LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
FR3gX
[Wm^!
L}!$!]
"qA(!
qaw!
0,!4?"
W_!=G'
t0g?!
zb6'!
X"?R!
!FO6:P
;YXnZX
' JkY G
^*7=X
YUaaaYdm
gYYnZX
YXYXdm
}.@rXnZX
lz&Yadm
>oHD
lVXY s
OrpdYadm
s%YaXdm
@ aYnZX
zHYadm
%S9aY
=YXa g
UaaXnZX
!U`S3!np
SZ<anZX
iP8Yadm
LaYnZX
~-CN~y[
v2.0.50727
#Strings
stub.exe
mscorlib
System
System.Management
kernel32.dll
ntdll.dll
<Module>
Dictionary`2
System.Collections.Generic
MethodBase
System.Reflection
Stream
System.IO
DeflateStream
System.IO.Compression
MemoryStream
Assembly
GetExecutingAssembly
Encoding
System.Text
get_UTF8
BitConverter
GetBytes
GetString
GetManifestResourceStream
get_Length
GetCurrentMethod
MemberInfo
get_Module
Module
get_MetadataToken
ResolveSignature
ToUInt32
RijndaelManaged
System.Security.Cryptography
Create
HashAlgorithm
ComputeHash
SymmetricAlgorithm
CreateDecryptor
ICryptoTransform
CryptoStream
CryptoStreamMode
CompressionMode
Dispose
ToArray
.cctor
Object
Environment
SpecialFolder
System.Threading
GetPhysicallyInstalledSystemMemory
WaitHandle
WaitOne
WebClient
System.Net
DownloadData
String
Concat
DownloadString
Process
System.Diagnostics
GetProcessesByName
op_Inequality
op_Equality
ParameterizedThreadStart
Thread
List`1
IEnumerable`1
GetRange
Random
Exception
ProcessStartInfo
Convert
FromBase64String
set_Arguments
set_WindowStyle
ProcessWindowStyle
set_CreateNoWindow
set_FileName
WaitForExit
ManagementObjectSearcher
ManagementObject
ManagementObjectCollection
ManagementObjectEnumerator
GetEnumerator
get_Current
ManagementBaseObject
get_Item
ToString
MoveNext
IDisposable
get_OSVersion
OperatingSystem
get_Version
Version
get_Major
get_MachineName
AppDomain
get_TickCount
DownloadFile
CreateDomain
ExecuteAssembly
Evidence
System.Security.Policy
Unload
Collect
Delete
RegistryKey
Microsoft.Win32
GetEntryAssembly
get_Location
GetFolderPath
Registry
CurrentUser
OpenSubKey
SetValue
Contains
set_Proxy
IWebProxy
EnterDebugMode
GetCurrentProcess
get_Handle
NtSetInformationProcess
GetTypeFromHandle
RuntimeTypeHandle
TryGetValue
Marshal
System.Runtime.InteropServices
SizeOf
Buffer
BlockCopy
set_Item
ConfusedByAttribute
Attribute
AssemblyFileVersionAttribute
GuidAttribute
ComVisibleAttribute
AssemblyTrademarkAttribute
AssemblyCopyrightAttribute
AssemblyProductAttribute
AssemblyCompanyAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
AssemblyTitleAttribute
CompilationRelaxationsAttribute
System.Runtime.CompilerServices
RuntimeCompatibilityAttribute
SuppressIldasmAttribute
TnztI~W
1.0.0.0
$822f952f-a50f-4f75-bda5-c88400f55e47
Copyright ? 2015
Host window
WrapNonExceptionThrows
Confuser v1.9.0.0
_CorExeMain
mscoree.dll
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
Host window
FileVersion
1.0.0.0
InternalName
stub.exe
LegalCopyright
Copyright ? 2015
OriginalFilename
stub.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav Clean
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan Gen:Variant.MSILPerseus.122095
FireEye Generic.mg.a2fd68fa16fa5721
CAT-QuickHeal Trojan.Megalodon.A3
Qihoo-360 Clean
McAfee Clean
Cylance Unsafe
VIPRE Clean
AegisLab Clean
Sangfor Ransom.Win32.Samsam_1.se
K7AntiVirus Trojan ( 004d53421 )
BitDefender Gen:Variant.MSILPerseus.122095
K7GW Trojan ( 004d53421 )
Cybereason malicious.a16fa5
BitDefenderTheta Gen:NN.ZemsilF.34722.bm0@aaQ!rml
Cyren W32/MSIL_Kryptik.EKY.gen!Eldorado
Symantec Trojan.Melongad
ESET-NOD32 a variant of MSIL/Agent.QUI
Zoner Clean
TrendMicro-HouseCall Clean
Avast Win32:BotX-gen [Trj]
ClamAV Clean
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Tencent Clean
Ad-Aware Gen:Variant.MSILPerseus.122095
TACHYON Clean
Sophos ML/PE-A + Mal/Agent-ASO
Comodo Clean
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Clean
CMC Clean
Emsisoft Gen:Variant.MSILPerseus.122095 (B)
Ikarus Trojan.MSIL.Agent
GData Gen:Variant.MSILPerseus.122095
Jiangmin Clean
Webroot Clean
Avira BDS/Backdoor.Gen
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Trojan.Win32.Agent.vl!n
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft TrojanDownloader:MSIL/Redok.YA!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
VBA32 Clean
MAX malware (ai score=83)
Malwarebytes Backdoor.DarkComet
Panda Clean
APEX Malicious
Rising Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Fortinet MSIL/Agent.QUI!tr
AVG Win32:BotX-gen [Trj]
Paloalto Clean
CrowdStrike win/malicious_confidence_100% (W)
MaxSecure Clean
No IRMA results available.