Static | ZeroBOX

PE Compile Time

2021-06-15 23:08:36

PDB Path

C:\Wrk\mFiles\86\1\Release\addconsole.pdb

PE Imphash

ae9182174b5c4afd59b9b6502df5d8a1

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000a78a 0x0000a800 6.63546643848
.rdata 0x0000c000 0x00002580 0x00002600 4.87595091217
.data 0x0000f000 0x00002ea0 0x00001200 3.25061463641
.rsrc 0x00012000 0x00071d80 0x00071e00 6.47804797778
.reloc 0x00084000 0x0000121e 0x00001400 3.62900783215

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0003bbd8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003bbd8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003bbd8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003bbd8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003bbd8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003bbd8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003bbd8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003bbd8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003bbd8 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_DIALOG 0x00012390 0x00000116 LANG_RUSSIAN SUBLANG_RUSSIAN data
RT_GROUP_ICON 0x0003c040 0x00000084 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x00083b50 0x00000198 LANG_ENGLISH SUBLANG_SPANISH_EL_SALVADOR data
RT_HTML 0x0003c0c8 0x00047a87 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x00083ce8 0x00000092 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
None 0x000124a8 0x000000b2 LANG_RUSSIAN SUBLANG_RUSSIAN data

Imports

Library KERNEL32.dll:
0x40c038 FlushFileBuffers
0x40c03c MulDiv
0x40c040 VirtualAlloc
0x40c044 MultiByteToWideChar
0x40c048 FindResourceW
0x40c04c LoadResource
0x40c050 SizeofResource
0x40c054 lstrlenA
0x40c058 GetLastError
0x40c05c HeapFree
0x40c060 HeapAlloc
0x40c064 GetCommandLineA
0x40c068 HeapSetInformation
0x40c06c GetStartupInfoW
0x40c070 HeapCreate
0x40c074 GetProcAddress
0x40c078 GetModuleHandleW
0x40c07c ExitProcess
0x40c080 DecodePointer
0x40c084 WriteFile
0x40c088 GetStdHandle
0x40c08c GetModuleFileNameW
0x40c090 EncodePointer
0x40c09c IsDebuggerPresent
0x40c0a0 TerminateProcess
0x40c0a4 GetCurrentProcess
0x40c0ac GetModuleFileNameA
0x40c0b4 WideCharToMultiByte
0x40c0bc SetHandleCount
0x40c0c4 GetFileType
0x40c0cc TlsAlloc
0x40c0d0 TlsGetValue
0x40c0d4 TlsSetValue
0x40c0d8 TlsFree
0x40c0e0 SetLastError
0x40c0e4 GetCurrentThreadId
0x40c0f0 GetTickCount
0x40c0f4 GetCurrentProcessId
0x40c104 LoadLibraryW
0x40c108 SetFilePointer
0x40c10c GetConsoleCP
0x40c110 GetConsoleMode
0x40c114 GetCPInfo
0x40c118 GetACP
0x40c11c GetOEMCP
0x40c120 IsValidCodePage
0x40c124 Sleep
0x40c128 RtlUnwind
0x40c12c HeapSize
0x40c130 SetStdHandle
0x40c134 WriteConsoleW
0x40c138 LCMapStringW
0x40c13c GetStringTypeW
0x40c140 HeapReAlloc
0x40c144 CreateFileW
0x40c148 CloseHandle
Library USER32.dll:
0x40c150 GetDC
0x40c154 ReleaseDC
0x40c158 LoadImageW
Library GDI32.dll:
0x40c000 DeleteDC
0x40c004 GetDeviceCaps
0x40c008 CreateFontW
0x40c00c SelectPalette
0x40c010 RealizePalette
0x40c014 BitBlt
0x40c018 DeleteObject
0x40c01c GetObjectW
0x40c020 CreateCompatibleDC
0x40c024 SelectObject
0x40c028 GetDIBColorTable
0x40c02c CreatePalette

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
uTVWh-F@
^SSSSS
HHtYHHt
j@j ^V
URPQQh@}@
t"SS9] u
<+t"<-t
+t HHt
;t$,v-
UQPXY]Y[
PPPPPPPP
PPPPPPPP
Courier New
kmerjgyuhwjvueruewghgsdpdeo
Time New Roman
CorExitProcess
(null)
`h````
xpxxxx
`h`hhh
xppwpp
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
1#QNAN
1#SNAN
C:\Wrk\mFiles\86\1\Release\addconsole.pdb
lstrlenA
SizeofResource
LoadResource
FindResourceW
MultiByteToWideChar
VirtualAlloc
MulDiv
KERNEL32.dll
ReleaseDC
LoadImageW
USER32.dll
CreateHalftonePalette
DeleteDC
CreatePalette
GetDIBColorTable
SelectObject
CreateCompatibleDC
GetObjectW
DeleteObject
BitBlt
RealizePalette
SelectPalette
CreateFontW
GetDeviceCaps
GDI32.dll
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapSize
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
HeapReAlloc
CreateFileW
CloseHandle
FlushFileBuffers
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
a'TEAqQ>
oS|Ee(/
F|>aQQ>
5()-GM
TEAqQ>W/
dq-BNJJ
v6Pz[%
~LNR}Y".
@ee5JJ+
4#V#@"
qb"CTUAA~.
.x<n-.@[
Eu{oDsy0
;ch`:bg
:bgg:bg
:bg`;ch
;cht:ch
;did;ch
;ch:I{
:chaI{
NFw})Dsy
<ejk;di*:bg
:bg`:bg
;ch}:bg
;ch{:bg
:bg]:bg
;chk:bg
:chz:bg
:bg,Hz
:bgPI{
:bg{I{
tFv|CBpv
:bg-:bg
:bgn:bg
:chW:bg
:bgEI{
:bgvI{
Gx}`Cqw(
:bgJ:bg
:bgy:bg
:bg)I{
:bgcI{
Dsye<fk%:bg
:bg|:bg
:bgz:bg
:bg%I{
:bgfI{
;di`:bg
:bg`I{
:ch~:bg&
Cqw%Hz
:ch~I{
?jo3I{
?jo3I{
?kp3I{
@lq3I{
Bou3I{
Tue Y
2x[au`
74m"H*
S=#Nq#
rvrpsn
,&S&lQH
|<Y!YF
H}z4Zl
NP659$
,G\u<}dE
^By+#~
}JGiZR
#AG/&+
oK"Cbf
352Lo[`b>f5
`*FI5*
eCX^`Hwqj
\YkK0M
8)mDbRqt
)bids`%
f!`=<8+wb
4GR2"dp
Y^?Yl6|t
s%HHR
DW=$ukF
U#88ye
&bJhCY&b.I
*CNp&j|
S,%DjR
%Iu?6+7
-Ge@]tJ
6M 1+
W%4m&FL
G'UjRU
2<m\|^
<"Hs/t??
Bujo2A
qknAME
AztVy4h
T&3}5!
*~Cw*p
b#EC7D
O;"^(j
Di&|Qq
aripwx
g^B~OF
t|C@)zh
O&<SEa
yyh.j
ljB(ls
,?*]]3
sodPa=
9`kSl7(
?St9($
"^Zq]}
FV%3@F
66.Rf[
1,khbW
FB{~x 6.
4_w92u
oM\X7|
1vX>L
+-#sw)
Qy+L*>>
WUT<*.
,tWaEh{
PZXeH3
A4 ;F-
zU/lJ=
"#nwI.!
0chp.?~
4m@%}
guf8~5
SapIIdR
'k>>6R
f3dU(
8*@r{91
g'u3r1$+
[Idb25
US%.t,n
z:*~5*
+P9_H[
:'8)b,
Vg9#2W
}^Z/%/
gdPqy^>
CdYAaj6&
%xSFcy
W#nt>
cyH(H:
kI@Lk7
H]%8k}
%$M^BQ
k6Z/XgvX
rl46tb
V{e&3erzoiu
[y*2Pa+
p4{i3{=
$Uso)N
x1qg\f
CU3^l(
a~nV(5
e`w!!H
St25X`
9'6(6Z
c*AeSw
4}LXy>j
).;xwk@
RlG)$i
|0-O`5
m3\[f08g
y904phD}
OM0)pD
,V#~8k+
4j5dYt
.Z7cAP
R8P;\4~?
~%Djes
<NYw2+
SmX,s;f
>ST|,l
(5LYM4
$_t"L4
6_)_'s
L.b\ HQ
EL7{c"
9PXMY"K+^
X} .:~
0g3jm\
i;3kua&
2+Gkt
tFKW<d
P,bElD}
D83fxe
5JrqC5
90|hyEB
`O_VXb
JrjJ{r
}2j k^/
Q-)gV'
v)^_r35Fh
+;GpLM
=,at]d>7J
3zvNvXk
&'C[52
|Nzt>\(
p4!x(P
4QtPlU5z
M!'D"K
u+?!{<
_H14i;
cq[)L=
2RVAtT4
=MI+B
hX7\tf
W.SxsK
PPotGv
[PSk&3
C1{bU$)
VP+qe7
!@'ayCj
D>pr-)
WXBZ74
T{s:)Tz
,B&mi1
}t~Qu.
:oDaS|X
aZqU@Qqo
&fUh6j
]^,Av}!\b
\yd3Ma
>E{&0~2
'k|76qt
Vx-zdbJ
F*PzQf
V'maA"@e
;dH97
HM1 o{,<g
'BqscB
oAFM]m
ziG#:o
$@P%A`h
.5FYAE
Iz5nf{
x5#t=30
S[yww
+k{'G#S
:0`%l1%*
QORqOu
<lm1g
X-aW.:
1fB/2,I
DVF<C
%Q4+J804
LxDgEm0
4H\BUF
0UGr|}(
%a{k>%|
DuN@Z:68
znY|po
zL8\3?{
! OZ |@.
I9s1-.e?
jar?\9G
7O1#SX
bw.nF/
j<&6#}@I
@KUiqJ
*j&[Z[$I
.4+">
@YgwQ#
}NL\=G
eqcTXeR0N
{Q9]bi
76{*]"c
r=uAJ?
iamkx6
K+NlM&
<^q{scH
w+^Ar2hW
cV1#&HU
fn]ylG
3~\s+988
j5R!5;o
Z=P}6:M
r'*k 9z
w}s6%~
0"Vn;!kz
QxN<5wqm
0b%$7@6{1
hh{}\I3
"HK@L_d
gL:hdwKR8T
oXX1d2K~t&
JGHe>a
YI(:C:
~`Wc?e
:th_y4,
LPs{:;
;\+8(J0]t
HRM1',
Jm#Y%E
xzKV72
c3hGg#
uZ<Q%.
eDGpVu
][(Z(]
v'<#V
-N0rrT
;&T?;Q
sLgD<Rw
U_29uVQ
+dbYX]
!nUPqO
@&I(|h
BR{S(!
z+;6x)_
tbg51x
.oFXZi
V]S`\H
[lgwj@
{ZBB<:#
X'%Tx?W
mmT]^?H>
IYQBbU
RGp'la
t3g\1YC
&hXP>7
,DRWBJ
3"Y3Vb
EuP'ng
U 1&l2:
6ekK{%
7LD#Ql
H_k:DnM
vUr{vF
^BwL2[E
9HkG2_z?8
4X(0w,F
$ ?7iC
z@!D[,q
M2126p
}yr]~bnu
1I_;2H
l^H=ZEYj
;,/,Z.|YZu
+mnHy<m8
\@@i]u
_%1;~)9
YwTjoq1
9jyOoXg
uRmJ2<
9[7GKXI
\LB+3Cb6
o5m?`"
R_3XDS
vTJfJ3
l%vhJQ
$y3IA]
kbl72G
*]'[_vX
O1{o=
CqUqa,
ti]or0r
``me
.i-%^Y
cVutPx4rW
@:+GvH
{Sqf1dK
YZ-5U"
TUN{)<
#I1,6"
zg"r7|PX:
ke]*i
/-xv$l
8EgRYfDS
d/~0e5
TOj/fFM
B)T$<R.
F66G#J
;?3I/i:^oxB
}RWR0<W
SOy)hUE
}w`nc(w
2Y@^mGp
kxDW%zOe
zF0<nu
GG7+-SF
m5f.X
,t*5>&
"[j/AU
p5q~j^
ci3ND0
*&SmbK
rb{'{;~
:|ACMK
7@[a>A
.K]?]y
aV-8hm
>y+.$
;wcOy,
nw7jP&
y0RiV+S
Uv;'z;
^t3qM_@
ZWIQ`A
>B$l)l
:z0$RY
9QDIvh~w
A|jK)l
uPYzWF
n)8)2=bEn<
ifn1;p{`ep:p
uowBX\
rf.N41
,uf8|Q,0~5u`
xgF.lxh
LKTKI^
N]LQ]S
CTxAFANNCOn
ZF]YWH
V&zY\r+^B4q
Op2@@>`tj
VQunZVn
p%!I=$?l'E-
:KE+0P
75R ;*O
}^h|K2#`Sah|Y~KIg)~~:8G'Kg:k|V4S_h
uu<lIpAvxLEb
h,;l(j
:,7;"/1/= 1!'4'(&*?/:--(-(!1(&9JVJVMO\JBSBS[UBT_JHC@GLZMA\QKUKVj{oi~m~ppeqdww~{bk
fls|`plsqfpte
*;*;3=*<'20;8?4"%)49#=#>2#71
Y'(h1XL__
PG^T;EXTD[Y@gHrP
A_Y8NqQXQ
V_N`@hWU^SR*
~DMUlA].JVJ,[2^>O
NwQvL?_
3f21\9<5;
QjCaU|op
qgobuuT[
:,(9,=1?$2%06=:=*<'+2?!?-00!17$7XVZO_J]]X]XQAXVIZFZF]_LZRCRCKERDozxspw|j}qla{e{fzk
yn}n``uatggnk
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
</assembly>
00I0e0q0
1D1N1X1
222G2Z2c2s2~2
2N3[3d3
4:4@4R4t4
6U6Z6`6d6j6n6t6x6~6
6*7\7t7{7
8 8j8p8t8x8|8
:;;@;J;
<*<M<`<
<]=e=x=
>->3>D>}>
0&000K0S0Y0g0
2G3Y394C4P4
3'4l4s4
61666W6^6j6p6|6
9P9V9l9q9y9
::':,:4:9:A:F:M:\:a:g:p:
<$<<<W<
= =I=Q=a=h=r=
?A?G?L?Z?_?d?i?y?
0?0D0K0P0W0\0j0
2@2E2J2a2X3]3o3
5&5,565?5J5O5X5b5m5
=p>@?q?
2$212=2M2T2c2o2|2
383G3P3t3
777B7L7e7o7
:/:J:R:Z:q:
:";3;G;
;*<~<A=o=
>+?4?@?W?b?
3n4:5l5
6 6$6(6,606z6
77$7(7,7M7w7
8 8$8(8?:
?%?.?9?E?J?Z?_?e?k?
1/1=1K1X1w12
4'424U4
=0=B=T=f=x=
C071?1
8a9g9u9
1!1%1)1-111>1
2(282U2
0 1@1v1
l1p1t1x1|1
;$;,;4;<;D;L;T;
:4;8;X;x;
<(<D<H<h<
=(=H=T=p=
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<
=0=4=8=<=@=D=H=L=P=T=`=d=h=l=p=t=x=|=
@jjjjjjj
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
- abort() has been called
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
@Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
(null)
KERNEL32.DLL
WUSER32.DLL
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
((((( H
h(((( H
H
CONOUT$
MS Shell Dlg
{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}
{A0C63C30-F08D-4AB4-907C-34905D770C7D}
VS_VERSION_INFO
StringFileInfo
040904b0
FileVersion
2.0.0.11
InternalName
addconsole.dll
OriginalFilename
addconsole.dll
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.46504297
CMC Clean
CAT-QuickHeal Clean
McAfee RDN/Generic.dx
Cylance Clean
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Trojan.GenericKD.46504297
K7GW Clean
Cybereason malicious.fee003
Baidu Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Clean
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky HEUR:Trojan.Win32.Trickpak.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
SUPERAntiSpyware Clean
Rising Trojan.Generic@ML.81 (RDMK:LNVvLtv7v9QnxE1Qiz83OA)
Ad-Aware Trojan.GenericKD.46504297
TACHYON Clean
Sophos Mal/Generic-S
Comodo TrojWare.Win32.UMal.zdnxz@0
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
FireEye Generic.mg.1a5f3ca6597fcccd
Emsisoft Clean
Ikarus Trojan.Win32.Trickbot
GData Win32.Trojan-Spy.TrickBot.OBKIMG
Jiangmin Clean
Webroot Clean
Avira Clean
eGambit Unsafe.AI_Score_96%
Antiy-AVL Clean
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Clean
Arcabit Clean
AegisLab Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Trickbot!Core
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
VBA32 Clean
ALYac Trojan.GenericKD.46504297
MAX malware (ai score=89)
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H01FH21
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet W32/Malicious_Behavior.VEX
BitDefenderTheta Gen:NN.ZexaF.34744.Hu2@ae1SP1dQ
AVG FileRepMalware
Avast FileRepMalware
CrowdStrike win/malicious_confidence_90% (W)
Qihoo-360 Clean
No IRMA results available.