Static | ZeroBOX

PE Compile Time

2020-05-25 15:47:22

PE Imphash

032ac126bef9dc99c70a99a6b91b16f2

PEiD Signatures

InstallShield 2000

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000dbee 0x0000e000 6.20844587837
.rdata 0x0000f000 0x00001a80 0x00002000 4.62175155542
.data 0x00011000 0x0004e37c 0x0004d000 3.04945579711

Imports

Library KERNEL32.dll:
0x40f000 GetProcAddress
0x40f004 LoadLibraryA
0x40f008 VirtualAlloc
0x40f00c VirtualFree
0x40f010 FreeLibrary
0x40f014 RtlUnwind
0x40f018 RaiseException
0x40f01c GetModuleHandleA
0x40f020 GetStartupInfoA
0x40f024 GetCommandLineA
0x40f028 GetVersion
0x40f02c ExitProcess
0x40f040 HeapFree
0x40f044 GetCurrentThreadId
0x40f048 TlsSetValue
0x40f04c TlsAlloc
0x40f050 SetLastError
0x40f054 TlsGetValue
0x40f058 GetLastError
0x40f060 TerminateProcess
0x40f064 GetCurrentProcess
0x40f06c GetModuleFileNameA
0x40f078 WideCharToMultiByte
0x40f084 SetHandleCount
0x40f088 GetStdHandle
0x40f08c GetFileType
0x40f094 GetVersionExA
0x40f098 HeapDestroy
0x40f09c HeapCreate
0x40f0a0 WriteFile
0x40f0a4 IsBadWritePtr
0x40f0a8 IsBadReadPtr
0x40f0ac HeapValidate
0x40f0b0 HeapAlloc
0x40f0b4 HeapReAlloc
0x40f0b8 DebugBreak
0x40f0c0 OutputDebugStringA
0x40f0c8 IsBadCodePtr
0x40f0cc GetCPInfo
0x40f0d0 GetACP
0x40f0d4 GetOEMCP
0x40f0d8 MultiByteToWideChar
0x40f0dc LCMapStringA
0x40f0e0 LCMapStringW
0x40f0e4 GetStringTypeA
0x40f0e8 GetStringTypeW
0x40f0ec SetFilePointer
0x40f0f0 SetStdHandle
0x40f0f4 FlushFileBuffers
0x40f0f8 CloseHandle

!This program cannot be run in DOS mode.
`.rdata
@.data
t@KHC
t.;t$$t(
=tGjyh
VC20XC00U
PPPPPPPP
PPPPPPPP
tFGQPS
mlock.c
dbgdel.cpp
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)
tidtable.c
stdenvp.c
stdargv.c
a_env.c
ioinit.c
__GLOBAL_HEAP_SELECTED
__MSVCRT_HEAP_SELECT
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
Client
Ignore
Normal
Error: memory allocation: bad memory block type.
Invalid allocation size: %u bytes.
Client hook allocation failure.
Client hook allocation failure at file %hs line %d.
dbgheap.c
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
_pFirstBlock == pHead
_pLastBlock == pHead
pHead->nBlockUse == nBlockUse
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
DAMAGE: after %hs block (#%d) at 0x%08X.
DAMAGE: before %hs block (#%d) at 0x%08X.
Client hook free failure.
memory check error at 0x%08X = 0x%02X, should be 0x%02X.
%hs located at 0x%08X is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0x%08X.
DAMAGED
_heapchk fails with unknown return value!
_heapchk fails with _HEAPBADPTR.
_heapchk fails with _HEAPBADEND.
_heapchk fails with _HEAPBADNODE.
_heapchk fails with _HEAPBADBEGIN.
Bad memory block found at 0x%08X.
_CrtMemCheckPoint: NULL state pointer.
Object dump complete.
crt block at 0x%08X, subtype %x, %u bytes long.
normal block at 0x%08X, %u bytes long.
client block at 0x%08X, subtype %x, %u bytes long.
{%ld}
%hs(%d) :
#File Error#(%d) :
Dumping objects ->
Data: <%s> %s
Detected memory leaks!
Assertion Failed
Warning
%s(%d) : %s
Assertion failed!
Assertion failed:
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
wsprintfA
user32.dll
Microsoft Visual C++ Debug Library
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
(Press Retry to debug the application)
Module:
File:
Line:
Expression:
For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.
dbgrpt.c
szUserMessage != NULL
GetLastActivePopup
GetActiveWindow
MessageBoxA
format != NULL
sprintf.c
string != NULL
vsprintf.c
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)
_flsbuf.c
str != NULL
`h````
ppxxxx
(null)
output.c
ch != _T('\0')
_getbuf.c
_file.c
H:mm:ss
dddd, MMMM dd, yyyy
M/d/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
fclose.c
stream != NULL
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
_freebuf.c
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
FreeLibrary
KERNEL32.dll
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
WriteFile
IsBadWritePtr
IsBadReadPtr
HeapValidate
HeapAlloc
HeapReAlloc
DebugBreak
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle
www.xy999.com
R<$Y6d
xAvq1yh
Rf2wGN
/uY|UR
a#s>4bm`
U~g`-fn
gnCn6V
*T KIx
S9q#su
)M^1;Kn
nC'U#z
7E}ZnP
U6TkSS
_Yv@?J
GVv"ff
<KG1uu
qk:r1C:
vTs;[h
S?m|.~/
$`^4R6G
lzQY;wB,@
+x9pf>'
>OK.BK
$f,"f8
E"NX9-
B)9jT^
YQlrHz
mzoAFNU2
4g8UnAjhS
Z+'sL=
S[=Qd1
4DfC9
|H9A0l
`RS*OK`r
b0tV(y
yTVp's
cEeD-4
?K&/kV
RQ5o$p6
JA{3Ws
!+=b+eis?%
/[&>gj<
=8h~"W;
T(.<(yu
M@5R[M
) :$^gB
[#3ZW%
z+E8YMtO/
nHs|Nr62
7wX82,
W-0&=I
NUm%BG
nqoJ^,
/2T:3o>
O/h)C9
?M[G[J
nW*OUH
t &*d*#
8bDj!H
7^]5LRn
6d)zI_
x++aFu
Vg6,A"
yGVk{3
jl\yNO
W>%/lRM
4{e\F3bk
yb]3T~e
avcJ#^r
%\Le^/
=DXF$a
y{K`H/
y{K`H/
y{K`H/
. s`vR
_tEeiX
qRJt<$w
<E]xkt
F&d\'A
fNb8OjDH
oJ*Urzb
>\f@_7p
{;GSzSNE
F+4#0p8
(E>l'sn
^=g)P|
9VJz[[`
)s;v.@
d`^X=]0;
-: n+_
ZX.{USb
z#0Ac&`N
v{(]r8
sP19T ,
MD6qpH
~PGHYm"r
moFIY&
%1}^==
g=68?o
&[chz*YwW
c/4F"o
mP%d~i
Lb Ibc
8J6Xf
3K~']eH
9T.m[bz
<Y9]uL
oq1}}u>
)W|xDu
_c:AIX
.th&XQ
'gN{k9
i<rFA3V+
"dz*u
)S"M^nY
i$[/At
8KboGp?
#}Yry'
#}Yry'
#}Yry'
#}Yry'
#}Yry'
5l"K:*hD,
"S7] k
/6}&nb8z
mV$M]#
Rg 6n3
|\eIGv
#}Yry'
fuckyou
HeapFree
kernel32.dll
HeapReAlloc
kernel32.dll
HeapAlloc
kernel32.dll
GetProcessHeap
kernel32.dll
HeapAlloc
kernel32.dll
VirtualAlloc
kernel32.dll
kernel32.dll
VirtualAlloc
kernel32.dll
VirtualFree
kernel32.dll
VirtualProtect
kernel32.dll
HeapFree
kernel32.dll
GetProcessHeap
KERNEL32.dll
.?AVtype_info@@
(null)
((((( H
Antivirus Signature
Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.Farfli.m!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Trojan.Malware.xmW@a8KOUHe
FireEye Generic.mg.ca0bfb0e149468f8
CAT-QuickHeal Backdoor.Farfli
ALYac Gen:Trojan.Malware.xmW@a8KOUHe
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005631771 )
BitDefender Gen:Trojan.Malware.xmW@a8KOUHe
K7GW Trojan ( 005631771 )
CrowdStrike win/malicious_confidence_100% (W)
Baidu Clean
Cyren W32/Farfli.CW.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HCAH
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky HEUR:Backdoor.Win32.Farfli.gen
Alibaba Backdoor:Win32/Kryptik.acfe42dd
NANO-Antivirus Trojan.Win32.Fugrafa.gsuiii
ViRobot Trojan.Win32.Z.Farfli.385024.A
Rising Trojan.Generic@ML.100 (RDML:DJMH8sHhmyUpPg6hCfv5Eg)
Ad-Aware Gen:Trojan.Malware.xmW@a8KOUHe
Sophos Mal/Generic-S
Comodo Backdoor.Win32.Farfli.FK@7jqjxo
F-Secure Clean
DrWeb Trojan.Siggen11.63246
Zillya Backdoor.Farfli.Win32.9121
TrendMicro TROJ_GEN.R002C0PH621
McAfee-GW-Edition BehavesLike.Win32.PWSZbot.fz
MaxSecure Trojan.Malware.74668089.susgen
CMC Clean
Emsisoft Gen:Trojan.Malware.xmW@a8KOUHe (B)
SentinelOne Static AI - Suspicious PE
GData Gen:Trojan.Malware.xmW@a8KOUHe
Jiangmin Backdoor.Farfli.eqx
Webroot Clean
Avira HEUR/AGEN.1133195
MAX malware (ai score=89)
Antiy-AVL Trojan/Generic.ASMalwS.2FBD4CE
Kingsoft Win32.Hack.Undef.(kcloud)
Gridinsoft Trojan.Win32.Kryptik.oa!s1
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Multiverze
Cynet Malicious (score: 99)
AhnLab-V3 Malware/Win32.RL_Generic.R299466
Acronis Clean
McAfee GenericRXLP-OX!CA0BFB0E1494
TACHYON Clean
VBA32 BScope.Backdoor.Farfli
Malwarebytes Backdoor.Farfli
Panda Trj/CI.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0PH621
Tencent Malware.Win32.Gencirc.10ce3d7f
Yandex Trojan.GenAsa!gBhknYBDYco
Ikarus Trojan.Win32.Injector
eGambit Unsafe.AI_Score_80%
Fortinet W32/Generic.AP.322A94!tr
BitDefenderTheta Gen:NN.ZexaF.34058.xmW@a8KOUHe
AVG Win32:BackdoorX-gen [Trj]
Avast Win32:BackdoorX-gen [Trj]
Qihoo-360 Win32/Backdoor.Farfli.HwIAzAsA
No IRMA results available.