Static | ZeroBOX

PE Compile Time

2021-08-03 18:09:55

PDB Path

C:\xampp\htdocs\Cryptor\08b91ca520dd42228f3b7ad445e5f796\Loader\pr1\Release\pr1.pdb

PE Imphash

47132e7294d9df76f8ee6d6805dd5e2d

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000b0b4 0x0000b200 6.61652215029
.rdata 0x0000d000 0x00005a08 0x00005c00 4.86685752731
.data 0x00013000 0x00001b24 0x00001000 2.67040456802
.gfids 0x00015000 0x000000b4 0x00000200 0.920266383871
.rsrc 0x00016000 0x000004b0 0x00000600 3.31702867049

Resources

Name Offset Size Language Sub-language File type
RT_MENU 0x00016180 0x0000004a LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x000161e0 0x00000120 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x00016300 0x0000002c LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ACCELERATOR 0x000161d0 0x00000010 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x00016330 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x40d008 DecodePointer
0x40d00c WriteConsoleW
0x40d010 CloseHandle
0x40d014 CreateFileW
0x40d018 SetFilePointerEx
0x40d01c GetConsoleMode
0x40d020 FlushFileBuffers
0x40d024 HeapReAlloc
0x40d028 HeapSize
0x40d02c GetProcessHeap
0x40d030 LCMapStringW
0x40d034 GetConsoleOutputCP
0x40d038 VirtualProtect
0x40d044 GetCurrentProcess
0x40d048 TerminateProcess
0x40d054 GetCurrentProcessId
0x40d058 GetCurrentThreadId
0x40d060 InitializeSListHead
0x40d064 IsDebuggerPresent
0x40d068 GetStartupInfoW
0x40d06c GetModuleHandleW
0x40d070 RtlUnwind
0x40d074 GetLastError
0x40d078 SetLastError
0x40d08c TlsAlloc
0x40d090 TlsGetValue
0x40d094 TlsSetValue
0x40d098 TlsFree
0x40d09c FreeLibrary
0x40d0a0 GetProcAddress
0x40d0a4 LoadLibraryExW
0x40d0a8 GetStdHandle
0x40d0ac WriteFile
0x40d0b0 GetModuleFileNameW
0x40d0b4 ExitProcess
0x40d0b8 GetModuleHandleExW
0x40d0bc HeapFree
0x40d0c0 HeapAlloc
0x40d0c4 FindClose
0x40d0c8 FindFirstFileExW
0x40d0cc FindNextFileW
0x40d0d0 IsValidCodePage
0x40d0d4 GetACP
0x40d0d8 GetOEMCP
0x40d0dc GetCPInfo
0x40d0e0 GetCommandLineA
0x40d0e4 GetCommandLineW
0x40d0e8 MultiByteToWideChar
0x40d0ec WideCharToMultiByte
0x40d0f8 SetStdHandle
0x40d0fc GetFileType
0x40d100 GetStringTypeW
0x40d104 RaiseException
Library USER32.dll:
0x40d10c LoadIconW
0x40d110 LoadCursorW
0x40d114 EndPaint
0x40d118 BeginPaint
0x40d11c GetDC
0x40d120 UpdateWindow
0x40d124 GrayStringA
0x40d12c LoadAcceleratorsW
0x40d130 EndDialog
0x40d134 DialogBoxParamW
0x40d138 ShowWindow
0x40d13c DestroyWindow
0x40d140 CreateWindowExW
0x40d144 RegisterClassExW
0x40d148 PostQuitMessage
0x40d14c DefWindowProcW
0x40d150 DispatchMessageW
0x40d154 TranslateMessage
0x40d158 GetMessageW
0x40d15c LoadStringW
Library GDI32.dll:
0x40d000 CreateSolidBrush

!This program cannot be run in DOS mode.
`.rdata
@.data
.gfids
@.rsrc
jdh@JA
jdh`IA
u&hDAA
URPQQh`%@
;t$,v-
UQPXY]Y[
j"_f9y
tlj*Yf
f9:t!V
QQSVj8j@
xg;5 HA
j,h0!A
u!h0IA
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
xE;5 HA
xE;5 HA
FlsAlloc
FlsFree
FlsSetValue
InitializeCriticalSectionEx
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
CorExitProcess
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
RSDSK$
C:\xampp\htdocs\Cryptor\08b91ca520dd42228f3b7ad445e5f796\Loader\pr1\Release\pr1.pdb
.text$mn
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.gfids$y
.rsrc$01
.rsrc$02
VirtualProtect
KERNEL32.dll
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
PostQuitMessage
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
DialogBoxParamW
EndDialog
LoadAcceleratorsW
TranslateAcceleratorW
GrayStringA
UpdateWindow
BeginPaint
EndPaint
LoadCursorW
LoadIconW
USER32.dll
CreateSolidBrush
GDI32.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
DecodePointer
RaiseException
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
!{e+VP4
NR[n-S
*@\Ann{
;t!vXHx
@p>1=x
mM)<THn
8~f`VXLA
7_JV7X
S-?Ap"p
@.a{Wx
;5Bdmd
*nC]EY
/0N;N!
SKx;03,
r]{iV]
FfmmJB_
+QLp-[
!`iaGYZ['
:y*-$7<
PHt]Le
)l+(9r
kj?]YKl
LwK51:
D>uo4^
7@V5jz
PoTb\\
7[I)_*
L!Hx`J
x6Ch^Gu\aHC
*5<|+`
< m^xK/
JT_]`f
r|kJIZ
f=*6=n+
pxhSyc
kslcl
zCjmMB"
Lex9WVa
|#Hahf
hK//ZzlN
DaYO".
p-v'}[
7*>1wg7
mz$.6"aR
:n%AKWjHaE
JU=G6d
MAsj/~b
r>u#}^
V].FtH
:7YC7O-naa
b\l&g m
t.`n];@H
}$,c\~
MLb\x`
u#,d[?,8
ZX,n,#4
AD%Qzh
*j:C9E"
99}z>W
\9rP~bO:p
bGwaDo+>
E'yo%>
+WR&i1
^Y}9D"
taJ9x!
9xd!Z
lQFUU$
h^Gu/ag
cP!57ld~
*_Hh\9S
TaiaYQ
W'~}&k
:F'~,D
~UT^cB
qp2"`3P
j6t>9D3~~
ppO #n
!t'v`j
O~BHK0
..DAlg
,aK6`!
.'"[GL<D
ln84$S,=3"
h^wu\a
DQ![3}
tf#F/5*E
(<UG3mq"
=RROgi
izJ4]L
SpZ"5-
\IVd.1
MP<FBD$
k#,+$&
g_7`Wp}
~)de'[,q
O R}>
;I0aG67
]'s%WoI{oU<
kFyz-(SEf8H
XBXTKm1
Bj"Lat
A[8]9k
s,M4'_
wHagu1
kwt']~U
yz](@}
*7s1rc
lKXp :E
g+3:l%
;|L&{M
a2WdfA
ZbBc`l
kBx!xM
SH!c>s
_Zd'!M
yN!.}
/rd[2}F
VC^^qf
g~ \F2
LM5flk
eJ?oKw
MP4[C6x
I*[jdA
(&H;|m
9EeRR&i
N*Ay}f
^DdYAy}
txexMj
M7(zhK
H<lxY{
te#k'|& 0?
BHx>p1
lUqWlu
$TnS_|
[U*Wkm=
TeB=qS
1U%WHm
TuBkq{
UsW{mq
<eR+TpA
U0W~m{
H`CN}[
UqW5m=
1U*WkmT
EUkW~m
1U`WVm
HtCt}
ZJvHM-
U`WHm
KH)Ct}
2U`W^mW
-O)'&I
&49aDX
<MdKGD
49M]_K
:Ul`k7SOu
0tZLPE
@V7.[7
$QwT:++
\'AK4a
_Sog]m6N^
*?Go\L.&
`TS9t}
-k\^B~
u=afD$3
6OIU|}u
OU_?Oq
W3i> 0X
'0$/\(|uL"Md
GKTc(Y
*ts.Ej
iGofJ-7
XChK==E
HK7:^Y
rc5 wy
FaggqJ
F`0^B\
`BC\[l
(=,#zw
m91c+ww"SP
X*cyI\
/$9*+K
HisntV!
^mm&k2A
`y0$v(
LfQC(dsP
oY4<9+
],N-RY
$I@Eg|
&>VzNF
w$MS'{`
_~;qcN;
1-4G\m
@YX!:;
O;EOi3
@}d./4
b9\zyw
4z`}?Z/
a%?@<w
:6of+nh*
+ PI?
bIC[g(
_;+6z"
vXp}&<
^1RkTD
oG_|},
WUIbox1
0@Ve%bq
fE1qD'
#7k)>gJ
D_s'8@
>Be\h8I1
60jm8-2
$OYqv
#+ Nv'_
;TS0Q2
N<cF0~
G2apzF
.YGCMRw
J8\.5f
51A[% f
A;#?1"
ZkVc.S
V`[g.?d
JkSu1*
0BfI%?<
$A{{2k
]|CO)
LG6<9P(5
g$y2rA
;h3:kK
?iN$hm5
q{V:j?b
DJ(w'U
xoJPl3.
64l6P44
ukN$n?hQvM{
^snX2`D
;a,pBk
I]jqYn
' Qn5Q0
ms68W:
HiL9z/.
O;~\^-
oH;c{C
g8'{GCY
/XXp!Z
T4E8ac)
keNH6?
pi.j4_/
r8O.:T.Q
Ujv3sE
EL.gWz
1c(^Q~
8jPbL16t
[c~[nV
aJ8nR$a
HDY+\NR
eXWVES"
D!D8)I
No]8l{G
)8wb,u
:ic8&^V&
Xww[7+"{
x|<q@k
.>gGb<
A,w"eV
42y,I
pSc6q_=+
ny:./-~
#5D12a^}
+bG}U%
50N<A$
Sm/#+O
h&H6-2
3'tmB$<
&p9K>^<
*68'HYtW
m>%}^'
)h*F^\
7f-8+;
i`75@%
2>{0q{
b\ZrFJ
Kp7XfB
,pN\1>
5ttMzr:^
BrDf_+
}So2/[
@ITa+w
zq0hVI
mcN"++
`P?"?R
{?4x$m
xu6DVQ
TwA8I:^
u!C>*O[
Fw>C#!
OHZ&79Y
}/tH%x
?~1Zf`N(v
>DoMa-_
?vH**C
AY,K-:
.%ZM_`
mm561`
2(oCD[
u:Nrb
A{r+Pw
K+4=.w
6Q0(fP
R|-D:BK
6)P5a)sJ|^
}!xfrU
K2yvVB]
!8\D67T
woN1$?j*
lU$&pcGC!
u^nk><
dRGrkJ,l
t<*lda
eqE8jq
mdmbzaD
#.cj'y
|E7]V-
1}yx+S
LLVOdnN
mDoLL=
b6CTYQ
K}lJsc
A:iDV]?}<
g>r),K
L,aP?(
qlwAlP3
vpG8"u
UK H}w4
'oUY_S
NN)!l
)NpX.O
q:N7z$h
EO)Y/e
@ws`v;
&S[,mY
?o"WRR
vl@j/I`
E<D_K}
5S^m.@WC:
i6_p8F
Xk`/cK
:giR%d>g
iV"EHdx
yMIt_q
(jcn(
@jjjjj
@advapi32
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
mscoree.dll
@ja-JP
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
@api-ms-win-core-datetime-l1-1-1
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-synch-l1-2-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
kernel32
api-ms-win-appmodel-runtime-l1-1-2
user32
api-ms-
ext-ms-
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
ChildWindow1
ChildWindow2
ChildWindow1
ChildWindow2
iE&xit
h&About ...
About pr1
MS Shell Dlg
pr1, Version 1.0
Copyright (c) 2021
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
FireEye Generic.mg.a4e87c684a48d0b1
CAT-QuickHeal Clean
McAfee Artemis!A4E87C684A48
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Generic.Cryptor.X.95A0412F
K7GW Clean
Cybereason Clean
Baidu Clean
Cyren W32/Injector.AKA.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/GenKryptik.FIJA
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Generic.Cryptor.X.95A0412F
Rising Trojan.Kryptik!1.D84E (CLASSIC)
Ad-Aware Generic.Cryptor.X.95A0412F
Sophos Generic ML PUA (PUA)
Comodo Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
CMC Clean
Emsisoft Generic.Cryptor.X.95A0412F (B)
SentinelOne Static AI - Malicious PE
GData Generic.Cryptor.X.95A0412F
Jiangmin Clean
MaxSecure Clean
Avira Clean
MAX malware (ai score=82)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Wacatac.B!ml
AhnLab-V3 Clean
Acronis Clean
BitDefenderTheta Gen:NN.ZexaF.34058.suZ@aCqRgcei
ALYac Generic.Cryptor.X.95A0412F
TACHYON Clean
VBA32 BScope.Trojan-Dropper.Injector
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
Ikarus Clean
eGambit Unsafe.AI_Score_99%
Fortinet W32/GenKryptik.FIIH!tr
Webroot W32.Malware.Gen
AVG Win32:PWSX-gen [Trj]
Avast Win32:PWSX-gen [Trj]
CrowdStrike win/malicious_confidence_80% (W)
Qihoo-360 HEUR/QVM10.1.053B.Malware.Gen
No IRMA results available.