Static | ZeroBOX

PE Compile Time

2009-12-04 22:35:59

PE Imphash

b5838d6aaa3bfdc75af25bfce4c6c923

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000d3ca 0x0000e000 6.48732991385
.rdata 0x0000f000 0x00001576 0x00002000 4.0479032929
.data 0x00011000 0x00005424 0x00004000 2.26995005214
.rsrc 0x00017000 0x000005f0 0x00001000 1.44774503822
.text 0x00018000 0x00022000 0x00022000 7.9055696138
tjcfklp 0x0003a000 0x00001000 0x00000000 0.0
.text 0x0003b000 0x0001b000 0x0001b000 7.88794348762

Resources

Name Offset Size Language Sub-language File type
RT_CURSOR 0x00017420 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00017570 0x00000080 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_CURSOR 0x00017558 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US Lotus unknown worksheet or configuration, revision 0x1
RT_VERSION 0x00017130 0x000002f0 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED SysEx File - IDP

Imports

Library KERNEL32.dll:
0x40f03c GetShortPathNameA
0x40f040 GetModuleFileNameA
0x40f044 ExitProcess
0x40f048 ReleaseMutex
0x40f04c OpenMutexA
0x40f050 MultiByteToWideChar
0x40f054 lstrlenA
0x40f058 WinExec
0x40f05c GetTempPathA
0x40f060 TerminateProcess
0x40f064 lstrcatA
0x40f068 Process32Next
0x40f06c Process32First
0x40f074 WaitForSingleObject
0x40f078 GetLastError
0x40f07c CopyFileA
0x40f084 GetSystemInfo
0x40f088 GetVersionExA
0x40f094 CompareStringW
0x40f098 SetPriorityClass
0x40f09c GetCurrentProcess
0x40f0a0 GetCurrentThread
0x40f0a4 SetThreadPriority
0x40f0a8 LoadLibraryA
0x40f0ac GetProcAddress
0x40f0b0 CloseHandle
0x40f0b4 CreateThread
0x40f0b8 lstrcpyA
0x40f0bc OutputDebugStringA
0x40f0c0 Sleep
0x40f0c4 ExitThread
0x40f0c8 OpenProcess
0x40f0cc GetTickCount
0x40f0d0 CompareStringA
0x40f0d4 SetStdHandle
0x40f0d8 LCMapStringW
0x40f0dc LCMapStringA
0x40f0e0 GetOEMCP
0x40f0e4 GetACP
0x40f0e8 GetCPInfo
0x40f0ec IsBadCodePtr
0x40f0f0 IsBadReadPtr
0x40f0f4 GetStringTypeW
0x40f0f8 GetStringTypeA
0x40f0fc FlushFileBuffers
0x40f100 SetFilePointer
0x40f10c WriteFile
0x40f118 WideCharToMultiByte
0x40f12c HeapCreate
0x40f134 GetSystemTime
0x40f138 GetLocalTime
0x40f144 RtlUnwind
0x40f148 HeapReAlloc
0x40f14c HeapAlloc
0x40f150 RaiseException
0x40f154 HeapFree
0x40f158 GetModuleHandleA
0x40f15c GetStartupInfoA
0x40f160 GetCommandLineA
0x40f164 GetVersion
0x40f168 GetCurrentThreadId
0x40f16c TlsSetValue
0x40f170 TlsAlloc
0x40f174 SetLastError
0x40f178 TlsGetValue
0x40f17c SetHandleCount
0x40f180 GetStdHandle
0x40f184 GetFileType
0x40f190 VirtualFree
0x40f194 VirtualAlloc
0x40f198 IsBadWritePtr
0x40f19c HeapDestroy
Library USER32.dll:
0x40f1c4 wsprintfA
Library ADVAPI32.dll:
0x40f000 CreateServiceA
0x40f004 StartServiceA
0x40f008 RegOpenKeyA
0x40f00c RegSetValueExA
0x40f010 RegCloseKey
0x40f014 RegOpenKeyExA
0x40f020 SetServiceStatus
0x40f024 OpenServiceA
0x40f028 CloseServiceHandle
0x40f02c DeleteService
0x40f030 RegQueryValueExA
Library SHELL32.dll:
0x40f1b0 SHChangeNotify
0x40f1b4 ShellExecuteExA
Library WS2_32.dll:
0x40f1d4 WSASocketA
0x40f1d8 WSAGetLastError
0x40f1dc WSACleanup
0x40f1e0 select
0x40f1e4 sendto
0x40f1e8 recv
0x40f1ec WSAIoctl
0x40f1f0 send
0x40f1f4 inet_addr
0x40f1f8 gethostbyname
0x40f1fc socket
0x40f200 htons
0x40f204 connect
0x40f208 closesocket
0x40f20c WSAStartup
0x40f210 __WSAFDIsSet
0x40f214 setsockopt
0x40f218 htonl
Library SHLWAPI.dll:
0x40f1bc SHDeleteKeyA
Library WINMM.dll:
0x40f1cc timeGetTime
Library NETAPI32.dll:
0x40f1a4 NetUserAdd
Library iphlpapi.dll:
0x40f220 GetIfTable

!This program cannot be run in DOS mode.
`.rdata
@.data
@.text
tjcfklp
SVWh
t.;t$$t(
VC20XC00U
PPPPPPPP
QQSVWd
HHtpHHtl
_9= dA
G;= dA
Y95 dA
YYF;5 dA
sO;>|C;~
8t9UW
SS@SSPVSS
t#SSUP
t$$VSS
_^][YY
QQSVWj
>:uNFV
>:u#FV
,f9=\OA
HSVHWtgHHtF
+ttHHtd
t/WWUPj
PPPPPPPP
QQSVW3
89=pMA
tFGQPS
`h````
ppxxxx
(null)
GAIsProcessorFeaturePresent
KERNEL32
__GLOBAL_HEAP_SELECTED
__MSVCRT_HEAP_SELECT
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
1#QNAN
1#SNAN
H:mm:ss
dddd, MMMM dd, yyyy
M/d/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
GetTickCount
ExitThread
OutputDebugStringA
lstrcpyA
CreateThread
CloseHandle
GetProcAddress
LoadLibraryA
SetThreadPriority
GetCurrentThread
GetCurrentProcess
SetPriorityClass
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
ExitProcess
ReleaseMutex
OpenMutexA
MultiByteToWideChar
lstrlenA
WinExec
GetTempPathA
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
WaitForSingleObject
GetLastError
CopyFileA
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
GetSystemDefaultUILanguage
KERNEL32.dll
wsprintfA
USER32.dll
DeleteService
CloseServiceHandle
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegOpenKeyA
StartServiceA
CreateServiceA
RegQueryValueExA
ADVAPI32.dll
SHChangeNotify
ShellExecuteExA
SHELL32.dll
WSASocketA
WSAIoctl
WS2_32.dll
SHDeleteKeyA
SHLWAPI.dll
timeGetTime
WINMM.dll
NetLocalGroupAddMembers
NetUserAdd
NETAPI32.dll
GetIfTable
iphlpapi.dll
GetTimeZoneInformation
GetSystemTime
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
HeapReAlloc
HeapAlloc
RaiseException
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapDestroy
HeapCreate
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
InterlockedDecrement
InterlockedIncrement
SetFilePointer
FlushFileBuffers
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
ghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef
89.40.73.43:8000
Abcdef Hijklmno Qrs
Abcdef Hijklmno Qrstuvwx Abcd
Abcdefgh Jklmnopqr Tuvwxya Cdefghij Lmn
GET %s HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
Host: %s:%d
Connection: Keep-Alive
GET %s HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
Host: %s
Connection: Keep-Alive
GET %s HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: %s
Connection: Keep-Alive
self.location=
GET %s%s HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
Host: %s
Connection: Keep-Alive
jdfwkey
location=
Send err!
192.168.1.32
time err!
opt err!
sock err!
InitWSAStartup Error!
%d.%d.%d.%d
Set IP_HDRINCL Error!
WSASocket() failed: %d
WSAStartup failed: %d
ADVAPI32.dll
OpenSCManagerA
> nul
/c del
COMSPEC
KERNEL32.dll
LoadLibraryA
cmd /c %s
%d.exe
kernel32.dll
GetTempPathA
GuQgwH/hngxhusvklUAk
URLDownloadToFileA
AST.exe
ast.exe
360tray.exe
CreateMutexA
SYSTEM\CurrentCont
rolSet\Services\
Description
%c%c%c%c%c%c.exe
%u (MB)
HARDWARE\DESCRIPTION\System\CentralProcessor\0
%s %s %s%d
.?AVtype_info@@
HrCg@b
HY_^Z[
VWQRSj
SRQWVj
mgr.exe
LoadLibraryA
GetProcAddress
GetModuleHandleA
kernel32.dll
FreeLibrary
OpenMutexA
CloseHandle
CreateFileA
WriteFile
GetModuleFileNameA
CreateProcessA
GetWindowsDirectoryA
GetVolumeInformationA
y;eR}x
75U/U@T+g
g:}5")
"[NJpB4V
~STn{7
|}2q>1w
]!yJ8t
hF{q)6
<sXdW^
|?DyCM
HtWD)u
?ip@AK
]o}v4D
7`3xAb
3b^'$v
58CV#
l <UtH
]Iy~Kk
i!Oak<
oQ!.8{
qMS49F
+9mz51kR"<
mYFk0yD
OvtP{E
j }:JO>
1 c }Lq
4F,6i9
_e#P4
5a|?V>6
"g9e4}*4
pX K3Z
6Q$b9!
?;T<YC
J>2N"'jM
O";@%Z
FWHE(B>QK
v,6RmE
<|@.b87
W6max$@
8f_fV6
Z'6_&4
G!F"&@Gm
#fG<b<b
"A_p.7Gi+
Q|&"<4
%].~/)FY
iuNN9@
ZI $1U
0|}$;#u
:\RsD=&
>7M[-(
J78B-D<O
>r#=s"
]a?e5j|
4HP;g6
BlnL1y
yUSw_*
b >v,:
]`UIn]
Me;Ewv
UyCRfq
~Cgv"0
b?So7I
7%CD>-(
ih/H6^9
>)`J*8n
Dms^ho
9;;@@/
K=JvBr
C2~^jh<
3c&|9v
$PGY%{
Ie!BT~IT
J-t$s4#y.
`5w.ME
[t*PwN
MBCPa'
lB>_[@?
=79T8wwl
Y1iM;;
(>ip+"
keZ`He=
x0!W2Wk
;8\q~k
O-Be%5}w
UeOcP]2
j\gbe/X
OSBAa]jV
-W5jd5 J
5[}6](C
L#l;;i
+nD_}B:
y[xD%D
'KHKlV
PnTetq
({bX)
ZJJ$;7>
wb[js3
z6BTx=
44J=B$"
6xeSdE
7!GeLL
y2fjZS
CfRI\
3Ex{`q_
7D~}0OYo
]b5~T<
$^Kp'\
0[MU$Z
/<d%O?
/p)tP=i
5:<nI$
:@uRA*
.$'a2~o
0a%>Z&
>[#H3i
OZ9$R@
TPD3;wr
<4ZE)]
SvJK)&5
evW^Iu
&`t=voQz
&h9#:aE
1j2VB.
hpz+}
Y!jqhk4\
Cx$EC
&N1O:6i
n>}M\~
_MnlOn
Axjy5U
GGTek2-{
]DF|v{
Q9gCX!&
"lN84^
x|ry%e
1E* =6
A#.}M_
j^ihx^"
=5XK**
c<%WI?
m_bp]u
tFe~BU
C]GE7s
tPkN`6
`*<kR=6q
oX=pqt
A|#>^`
vt&x`G
}B_<fZ_4
5fOR9t
:jANmv=
ouwt}EuCU
tx[4%c
E}A]I"
]wp#
r;:'q/&n>m
y:35,Q
l8&Qjj
$|@>,7dR
XOWpD}
[A1`}!jFt
7m:a(4
0b~8aC;
8)NEN]
0P0./'
oTgJ{g
W:0=_X]o5
SoJ`['?
r=kjm_
2Twi-;2
}}.3y'
{gj+p-Q
YniZJ-4
>\xT4-
C9M259
i%,Yj'J@
HY_^Z[
VWQRSj
SRQWVj
mgr.exe
LoadLibraryA
GetProcAddress
GetModuleHandleA
kernel32.dll
FreeLibrary
OpenMutexA
CloseHandle
CreateFileA
WriteFile
GetModuleFileNameA
CreateProcessA
GetWindowsDirectoryA
GetVolumeInformationA
croF)v
$4pAOb8
Flfv,J
jbjP||j
[;5IR[
me;Fk
GEn!\|
{.Zp7-
6e@0Qb
\@SM1}
ljk.W4!h
>veRGZ
;V^.\*
|{<WJK
/a#B?wCpl
9n8M
wmlD:tC
X~V4<E
l7Q>M1&
^ba` |p
3ls?H ;r
VyLRGZW
uHQR6_O
S%Y'L
<'lD0q"
3"^8}wO*
szaq<qd
}?,O+g
z6^3+C.
tx0<{7
cyT=vz7
FZ(LB#&^>
UDxCp{
cyzGy6
t a#]d
/;`hgd
=&U=9L
Zc0D "$
Swtl,]
\D9Ms
&J2wmd
5!N!n=
Ob1YK,-OJS
L+eW#nf_
">e+0K{
:A)gQm
k%?7;J
-#X+;q
I'xe6N
Vl<H<t
y6n2k}Z
D1d{D.
1|jj#
'8 ov`
of8mgL
6}Z9Qo
w/sQGQ
<iB;CP4
]VvG0S
T*OT^HD
0A`fHQ
er_nmR
wv+K9V
OpeR8C}
zRQ4,=>
/\t*A
du7HL<
g'vO-k
3A6|?F
tcwWNA
,8.@&Bl3
5WD/-'
E4lgD}
,)1&P`^
$nG~^^5zf2
S%U[ni
hN7Ug%
z|LZ=v
;E[X;*
T\Jgp_28
cs4[{)W+
#Dt3/.
$h4?|V
6}m5mFw
j~(R}r
F)~UFv
9~!/51
&XLx[|/
?zO6cu/
4[F|a9
A"l\Az
n9!IK)
H[Wt8"
=4\#8hvK
hPN5]G
F0l=>k
Zf\Ig (
-%y]=U
`R\=N
"?3t%
2aYOd0TS
NvN'x@
;KQU8+
OiOAG,
;yWi<k
-iKFD1q
<SqMlP
*cera_
cpVw3xA
NT?m`]
4fq^?c
$e&GvKO<
zKB@On
387?-I
>r1qZi
+HwkYBz>g
X*{wl)
88_T`.
P~27<`
w)Vfw<
r,2q\5
6x50Y*
OCz'7Z
czsvz,
P N1J"E
}V}!`y
XU8k%f
% Q@I%
,!01h%=]
rF0a51
YwrF0f5
Upt$=[
t16$%s
NprN?a=
^p(F7ag
.\E$g*
VpzB7a
rF0n51
wprB7a=
%p[;La
-pC7Da
VpjN7a
PwrF8f5
Fpjea=
^pSF7a-
]@E$^O
^pbF7a=
^p8J7a-
_;6'&&
^;LV7Qx
^$GV7\w
^@4e7a
^76T7C`
'LDEP1
sWE$i_
8uDEB'
UUDE]'
k7X3DE
]XUDJ$
YE2N'
^'HA7V~
}EEF!
UhyEZ2
8xr$x5
3n_EX:
Qi2k^D
mPEW}A
(null)
((((( H
VS_VERSION_INFO
StringFileInfo
080404b0
Comments
CompanyName
FileDescription
FileVersion
1, 0, 0, 1
InternalName
LegalCopyright
(C) 2015
LegalTrademarks
OriginalFilename
gy.dat
PrivateBuild
ProductName
ProductVersion
1, 0, 0, 1
SpecialBuild
VarFileInfo
Translation
MS Sans Serif
TODO: layout dialog bar
jjjjjj
jjjjjj
Antivirus Signature
Bkav W32.Tmgrtext.PE
Elastic malicious (high confidence)
MicroWorld-eScan Generic.ServStart.A.05DA2309
FireEye Generic.mg.23ff29e277ce2e65
CAT-QuickHeal W32.Ramnit.BA
ALYac Generic.ServStart.A.05DA2309
Cylance Unsafe
VIPRE Virus.Win32.Ramnit.b (v)
AegisLab Clean
Sangfor Win.Trojan.Ramnit-1847
K7AntiVirus Trojan ( 0051b1671 )
BitDefender Generic.ServStart.A.05DA2309
K7GW Trojan ( 0051b1671 )
Cybereason malicious.277ce2
BitDefenderTheta AI:FileInfector.9425D5100E
Cyren W32/Ramnit.B!Generic
Symantec W32.Ramnit.B!inf
ESET-NOD32 Win32/Ramnit.H
Baidu Win32.Virus.Nimnul.a
APEX Malicious
Avast Win32:RmnDrp [Inf]
ClamAV Win.Trojan.Ramnit-1847
Kaspersky Virus.Win32.Nimnul.a
Alibaba Clean
NANO-Antivirus Virus.Win32.Nimnul.bqjjnb
ViRobot Win32.Nimnul.A
Rising Malware.Heuristic!ET#87% (RDMK:cmRtazppoX97wXZt4A1IaCMq+4tB)
Ad-Aware Generic.ServStart.A.05DA2309
Sophos ML/PE-A + W32/Ramnit-A
Comodo Virus.Win32.Ramnit.K@37eb7u
F-Secure Clean
DrWeb Trojan.AVKill.63055
Zillya Virus.Nimnul.Win32.1
TrendMicro PE_RAMNIT.DEN
McAfee-GW-Edition BehavesLike.Win32.Ramnit.fc
CMC Virus.Win32.Ramit.1!O
Emsisoft Generic.ServStart.A.05DA2309 (B)
SentinelOne Static AI - Malicious PE
Jiangmin Win32/IRCNite.wi
MaxSecure Virus.Nimnul.A
Avira W32/Ramnit.C
MAX malware (ai score=84)
Antiy-AVL Trojan/Generic.ASVirus.1EB
Kingsoft Clean
Microsoft Virus:Win32/Ramnit.J
Gridinsoft Trojan.Win32.Malex.dd!n
Arcabit Generic.ServStart.A.05DA2309
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Win32.Virus.Nimnul.A
Cynet Malicious (score: 100)
AhnLab-V3 Win32/Ramnit.G
Acronis suspicious
McAfee W32/Ramnit.a
TACHYON Virus/W32.Ramnit
VBA32 Virus.Win32.Nimnul.b
Malwarebytes Neshta.Virus.FileInfector.DDS
Panda W32/Cosmu.E
Zoner Trojan.Win32.82649
TrendMicro-HouseCall PE_RAMNIT.DEN
Tencent Virus.Win32.Nimnul.f
Yandex Trojan.GenAsa!rluJXE67ft0
Ikarus Backdoor.Win32.Inject
eGambit Unsafe.AI_Score_100%
Fortinet W32/Ramnit.A
Webroot Clean
AVG Win32:RmnDrp [Inf]
Paloalto Clean
CrowdStrike win/malicious_confidence_100% (D)
Qihoo-360 Clean
No IRMA results available.