Static | ZeroBOX

PE Compile Time

2079-07-19 23:05:24

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0005e6c4 0x0005e800 3.75828880972
.rsrc 0x00062000 0x000002b0 0x00000400 2.19348514672
.reloc 0x00064000 0x0000000c 0x00000400 0.0446870062539

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00062058 0x00000254 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
SystemSecurityCryptographyCngLightup15320
SystemServiceModelDiagnosticsHttpListenerRequestTraceRecord37570
lSystemSecurityCryptographyXCertificatesXCertificateCollection18390
SystemIOWatcherChangeTypes49990
<>c__DisplayClass2_0
<SystemRuntimeSerializationConfigurationDeclaredTypeElement43149>b__0
<>p__0
SystemUriTemplateHelpersUriTemplateQueryKeyComparer25301
SystemServiceModelDiagnosticsHttpListenerRequestTraceRecord375701
SystemServiceModelChannelsContextExchangeMechanism25141
SystemServiceModelICommunicationObject323641
SystemNetWebSocketsClientWebSocket47261
SystemServiceModelChannelsConnectionMessageProperty44071
SystemComponentModelDesignIHelpService91581
<>c__DisplayClass2_1
<SystemRuntimeSerializationConfigurationDeclaredTypeElement43149>b__1
Func`1
CallSite`1
SystemComponentModelDesignHelpKeywordType21112
SystemServiceModelChannelsTransactionRequestChannelGeneric20912
kernel32
SystemServiceModelSecuritySspiSecurityTokenProvider34152
SystemDataDataTableNewRowEventArgs65552
cbReserved2
lpReserved2
SystemNetPrefixLookup80023
get_SystemServiceModelDispatcherUnionOpcode92833
set_SystemServiceModelDispatcherUnionOpcode92833
SystemServiceModelDescriptionMetadataExchangeClientMetadataRetriever50743
SystemServiceModelSyndicationReferencedCategoriesDocument253
SystemGenGcCallback28653
SystemServiceModelDispatcherPrefixEndpointAddressMessageFilter74873
Func`3
SystemServiceModelComIntegrationServiceModelInstallStrings20334
NewtonsoftJsonJsonTextReaderMatchAndSetAsyncd56744
SystemDataConstraintCollection73054
SystemServiceModelICommunicationObject32364
ToInt64
isWow64
SystemNetSecurDll67674
<>o__4
SystemSecurityCryptographyXCertificatesStoreName99055
SystemComponentModelIntConverter26475
SystemSRDescriptionAttribute30495
get_SystemServiceModelConfigurationWSHttpTransportSecurityElement76595
set_SystemServiceModelConfigurationWSHttpTransportSecurityElement76595
SystemServiceModelDescriptionIContractResolver24016
SystemServiceModelDescriptionWsdlExporter83536
SystemServiceModelDiagnosticsWsrmTraceRecord94766
SystemCollectionsGenericSortedListSortedListValueEnumerator69576
SystemNetUnsafeNclNativeMethodsHttpApiHTTPVERB54996
SystemServiceModelSecuritySecurityPolicyVersionWSSecurityPolicyVersion6238
SystemComponentModelExpandableObjectConverter88448
SystemCodeDomCodeAttributeArgument10958
MicrosoftVisualBasicVBCodeProvider15958
SystemServiceModelChannelsPrivacyNoticeBindingElement8078SystemServiceModelChannelsPrivacyNoticeBindingElement8078
SystemServiceModelComIntegrationMonikerBuilder73878
lpProcesSystemCollectionsSpecializedStringDictionaryGenericAdapterICollectionToGenericCollectionAdapterGetEnumeratord40188
SystemServiceModelBasicHttpsSecurityModeHelper56188
get_PrivateImplementationDetailsStaticArrayInitTypeSize72988
SystemServiceModelConfigurationSessionIdTypeConvertor87298
get_UTF8
SystemServiceModelChannelsBinaryFormatBuilder73109
SystemServiceModelChannelsSelfSignedCertificateCRYPTKEYPROVINFO92119
SystemServiceModelDiagnosticsSecurityTraceRecord38529
SystemNetSocketAddress70929
SystemRuntimeSerializationConfigurationDeclaredTypeElement43149
SystemIOPortsSerialStreamSerialStreamAsyncResult32349
SqlDependencyProcessDispatcherSqlNotificationParserMessageAttributes94969
<Module>
SystemServiceModelChannelsPrivacyNoticeBindingElement8078a
base64EncodedData
SizeOfRawData
PointerToRawData
mscorlib
e_magic
dwThreadId
dwProcessId
hThread
Unshielded
lpReserved
<SystemServiceModelDispatcherUnionOpcode92833>k__BackingField
Append
method
SystemCodeDomCodeAttributeArgument10958asd
FromMe
Replace
exitCode
SizeOfImage
EndInvoke
BeginInvoke
RuntimeTypeHandle
GetTypeFromHandle
ProcessHandle
handle
lpTitle
hModule
procName
fileName
SystemRuntimeSerializationDataMember5790tionName
lpApplicationName
lpCommandLine
ValueType
AllocationType
System.Core
Signature
ImageBase
Dispose
Create
MulticastDelegate
CallSite
DynamicAttribute
CompilerGeneratedAttribute
UnverifiableCodeAttribute
DebuggableAttribute
TargetFrameworkAttribute
dwFillAttribute
SecurityPermissionAttribute
CompilationRelaxationsAttribute
ReliabilityContractAttribute
ParamArrayAttribute
RuntimeCompatibilityAttribute
Unshielded.exe
dwXSize
dwYSize
RegionSize
SizeOf
System.Threading
Encoding
System.Runtime.Versioning
FromBase64String
xoredString
ToString
GetString
get_Length
AsyncCallback
callback
AllocHGlobal
FreeHGlobal
Marshal
kernel32.dll
System
hToken
hNewToken
lpNumberOfBytesWritten
get_Location
SecurityAction
action
System.Reflection
InvalidOleVariantTypeException
InvalidProgramException
System.Runtime.ConstrainedExecution
lpStartupInfo
lpDesktop
Microsoft.CSharp
FileHeader
OptionalHeader
StringBuilder
Microsoft.CSharp.RuntimeBinder
CallSiteBinder
GetDelegateForFunctionPointer
hStdError
.cctor
IntPtr
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
bInheritHandles
lpThreadAttributes
lpProcessAttributes
dwCreationFlags
CSharpBinderFlags
ContextFlags
dwFlags
System.Security.Permissions
NumberOfSections
get_Chars
dwXCountChars
dwYCountChars
SizeOfHeaders
hProcess
GetProcAddress
lpBaseAddress
VirtualAddress
ZeroBits
Object
object
Protect
Target
op_Explicit
IAsyncResult
result
lpEnvironment
AddressOfEntryPoint
Convert
get_Host
set_Host
hStdInput
hStdOutput
System.Text
pContext
e_lfanew
wShowWindow
nCmdShow
Consistency
stringKey
GetExecutingAssembly
LoadLibrary
FreeLibrary
lpCurrentDirectory
op_Inequality
System.Security
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
_CorExeMain
mscoree.dll
Greater Manchester1
Salford1
Comodo CA Limited1!0
AAA Certificate Services0
210525000000Z
281231235959Z0V1
Sectigo Limited1-0+
$Sectigo Public Code Signing Root R460
H/(@Bp 6
2http://crl.comodoca.com/AAACertificateServices.crl04
http://ocsp.comodoca.com0
Sectigo Limited1-0+
$Sectigo Public Code Signing Root R460
210322000000Z
360321235959Z0T1
Sectigo Limited1+0)
"Sectigo Public Code Signing CA R360
FFlCx@
H/(@Bp 6
:http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0{
:http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
http://ocsp.sectigo.com0
ts7!:o
n0PPd}
Sectigo Limited1+0)
"Sectigo Public Code Signing CA R360
210614000000Z
220614235959Z0I1
Yerevan1
Amcert LLC1
Amcert LLC0
&,oBq\
https://sectigo.com/CPS0
8http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
8http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
http://ocsp.sectigo.com0
support@amcert.net0
Sectigo Limited1+0)
"Sectigo Public Code Signing CA R36
dnC@;rZ!
SystemDataOdbcOdbcInfoMessageEventArgs72017
NetSSLEXTRACERTCHAINPOLICYPARA59796
ENetSSLEXTRACERTCHAINPOLICYPARA59796EYjGBUuJTkVPwovAzYMBg==
INetSSLEXTRACERTCHAINPOLICYPARA597960YjUSZxSj87d3opAycQBQMaEQUuL3h+
FNetSSLEXTRACERTCHAINPOLICYPARA59796Sw7DRQpPjMUKBEpOzBJSA==
JNetSSLEXTRACERTCHAINPOLICYPARA59796EYdFxNyFzo6KBEsPQZJSA==
VNetSSLEXTRACERTCHAINPOLICYPARA59796FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQUZ3bWthWUFBQUFBQUFBQUFPQUFBZ0VMQVRBQUFIQUJBQUFNQUFBQUFBQUFrbjRCQUFBZ0FBQUFvQUVBQUFCQUFBQWdBQUFBQkFBQUJBQUFBQUFBQUFBRUFBQUFBQUFBQUFEZ0FRQUFCQUFBbXJBQkFBSUFRSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFFQitBUUJQQUFBQUFLQUJBTndFQUFBQUFBQUFBQUFBQUFDQUFRQ0lGUUFBQU1BQkFBd0FBQUFrZmdFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUFVR3dCQUFBZ0FBQUFjQUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU53RUFBQUFvQUVBQUFnQUFBQjBBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQU1BQkFBQUVBQUFBZkFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ
qtuawCsJXECZY
ENetSSLEXTRACERTCHAINPOLICYPARA59796xonChUEBD8CAjsp
INetSSLEXTRACERTCHAINPOLICYPARA59796Ec/DS4bISYNDQksAEMiDwJHLwYuHxM6ODQ3ByMWSn4=
JNetSSLEXTRACERTCHAINPOLICYPARA59796zMjGBUUHz8BHRE2DDk+AzhFFQkpL3h+
INetSSLEXTRACERTCHAINPOLICYPARA59796EYNFxRxJQMBEnYxOzYhSA==
INetSSLEXTRACERTCHAINPOLICYPARA59796iw7ORVwEHgWAwEjO0M6GQJEDk4=
JNetSSLEXTRACERTCHAINPOLICYPARA59796RonIxUECzwBdwVqAycuBQIZEUITDz0NAA5AAhYPHH4=
JNetSSLEXTRACERTCHAINPOLICYPARA597960c/ERMEJRs7KHowAyk6DzUgFQcoaw92
JNetSSLEXTRACERTCHAINPOLICYPARA597960ZMUjkpIQICHREPODk+GTggETcoanBzAAEZRA==
INetSSLEXTRACERTCHAINPOLICYPARA597960YjUSEEGzMCEgUxCENNAAUwFUcuGXh+
JNetSSLEXTRACERTCHAINPOLICYPARA597960ZMUjkpIR4CHREPODk+GTggETcoanBzAAEZRA==
JNetSSLEXTRACERTCHAINPOLICYPARA59796EYjUSEEGzMCEgUxCENNAAUwFUcuGXh+
JNetSSLEXTRACERTCHAINPOLICYPARA59796BkjGxMUQiYOAisjAyYyHg==
JNetSSLEXTRACERTCHAINPOLICYPARA59796RonNxUuQiI7AxkqAykQJTsbDR8TaxczOGtFSQ==
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
0.0.0.0
InternalName
Unshielded.exe
LegalCopyright
OriginalFilename
Unshielded.exe
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Trojan.MSIL.Stealer.l!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37225865
FireEye Generic.mg.1130aadc21e61f9f
CAT-QuickHeal Clean
Qihoo-360 Win32/Trojan.Kryptik.HgIASYUA
ALYac Trojan.GenericKD.37225865
Cylance Unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Spyware ( 0057a4861 )
BitDefender Trojan.GenericKD.37225865
K7GW Spyware ( 0057a4861 )
Cybereason malicious.64c29f
Baidu Clean
Cyren W32/MSIL_Kryptik.EPY.gen!Eldorado
Symantec Trojan.Maltrec.TS
ESET-NOD32 a variant of MSIL/Kryptik.ABUD
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Generickdz-9874565-0
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
Alibaba TrojanSpy:Win32/Stelega.1fc55c2f
NANO-Antivirus Clean
ViRobot Clean
Tencent Clean
Ad-Aware Trojan.GenericKD.37225865
Sophos Mal/Generic-R + Mal/BadCert-Gen
Comodo Clean
F-Secure Clean
DrWeb Trojan.PWS.Stealer.30701
Zillya Clean
TrendMicro TROJ_GEN.R002C0DGC21
McAfee-GW-Edition GenericRXPE-TF!1130AADC21E6
CMC Clean
Emsisoft MalCert-S.KV (A)
SentinelOne Clean
GData Trojan.GenericKD.37225865
Jiangmin Clean
Webroot W32.Trojan.Gen
Avira TR/Kryptik.xucqo
MAX malware (ai score=100)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft TrojanSpy:Win32/Stelega.STA
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C4544560
Acronis Clean
McAfee GenericRXPE-TF!1130AADC21E6
TACHYON Clean
VBA32 TScope.Trojan.MSIL
Malwarebytes Trojan.Crypt.MSIL.Generic
Panda Trj/CI.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DGC21
Rising Clean
Yandex Clean
Ikarus Win32.Outbreak
eGambit Clean
Fortinet MSIL/Kryptik.ABQA!tr
BitDefenderTheta Clean
AVG Win32:DangerousSig [Trj]
Avast Win32:DangerousSig [Trj]
CrowdStrike win/malicious_confidence_100% (W)
MaxSecure Trojan.Malware.121218.susgen
No IRMA results available.