Static | ZeroBOX

PE Compile Time

2021-08-15 21:05:50

PE Imphash

c7d3661f79d58d30854a3af50a6f4c2f

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000e27c 0x0000e400 6.55870402162
.rdata 0x00010000 0x00006176 0x00006200 4.89537999092
.data 0x00017000 0x000016ec 0x00000a00 2.23482930066
.gfids 0x00019000 0x00000110 0x00000200 1.91589437628
.rsrc 0x0001a000 0x000001e0 0x00000200 4.71006138269
.reloc 0x0001b000 0x00001094 0x00001200 6.33991230618

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0001a060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x410000 WriteFile
0x41000c CreateFileW
0x410010 GetLastError
0x410014 LoadLibraryA
0x410018 lstrcatW
0x41001c CloseHandle
0x410020 RaiseException
0x410024 DecodePointer
0x410028 GetProcAddress
0x410030 WriteConsoleW
0x410034 SetFilePointerEx
0x410038 GetConsoleMode
0x41003c GetConsoleCP
0x410040 FlushFileBuffers
0x410044 HeapReAlloc
0x410048 HeapSize
0x41004c GetStringTypeW
0x410050 SetStdHandle
0x410054 GetFileType
0x410058 GetProcessHeap
0x410068 GetCPInfo
0x41006c GetOEMCP
0x410078 GetCurrentProcess
0x41007c TerminateProcess
0x410084 IsDebuggerPresent
0x410088 GetStartupInfoW
0x41008c GetModuleHandleW
0x410094 GetCurrentProcessId
0x410098 GetCurrentThreadId
0x4100a0 InitializeSListHead
0x4100a4 OutputDebugStringW
0x4100b0 MultiByteToWideChar
0x4100b4 WideCharToMultiByte
0x4100b8 LocalFree
0x4100bc EncodePointer
0x4100c0 RtlUnwind
0x4100c4 SetLastError
0x4100c8 TlsAlloc
0x4100cc TlsGetValue
0x4100d0 TlsSetValue
0x4100d4 TlsFree
0x4100d8 FreeLibrary
0x4100dc LoadLibraryExW
0x4100e0 ExitProcess
0x4100e4 GetModuleHandleExW
0x4100e8 GetModuleFileNameA
0x4100ec GetStdHandle
0x4100f0 GetCommandLineA
0x4100f4 GetCommandLineW
0x4100f8 GetACP
0x4100fc HeapFree
0x410100 HeapAlloc
0x410104 CompareStringW
0x410108 LCMapStringW
0x41010c FindClose
0x410110 FindFirstFileExA
0x410114 FindNextFileA
0x410118 IsValidCodePage
Library USER32.dll:
0x41015c wsprintfW
Library ole32.dll:
0x410164 CoUninitialize
0x410168 CoInitialize
Library OLEAUT32.dll:
0x410120 SafeArrayGetDim
0x410124 VariantInit
0x410128 SafeArrayGetUBound
0x41012c SafeArrayGetLBound
0x410130 SysFreeString
0x410134 SysStringByteLen
0x41013c SysAllocString
0x410140 SysStringLen
0x410148 SysAllocStringLen
0x41014c SafeArrayAccessData
0x410150 VariantClear
0x410154 GetErrorInfo

!This program cannot be run in DOS mode.
_Richd&
`.rdata
@.data
.gfids
@.rsrc
@.reloc
QQSVWd
URPQQh
;t$,v-
UQPXY]Y[
QSSSSj
WWWPWS
u-PWWS
PQhXqA
PQh`rA
SSVWh
f9:t!V
|VWj=S
j,hpXA
QQSWj0j@
tl=XvA
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
Unknown exception
bad allocation
bad array new length
bad exception
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
CorExitProcess
CompareStringEx
GetCurrentPackageId
LCMapStringEx
LocaleNameToLCID
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
CoCreateInstance
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.gfids$x
.gfids$y
.rsrc$01
.rsrc$02
WriteFile
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
CreateFileW
GetLastError
LoadLibraryA
lstrcatW
CloseHandle
RaiseException
DecodePointer
GetProcAddress
DeleteCriticalSection
KERNEL32.dll
wsprintfW
USER32.dll
CoInitialize
CoUninitialize
ole32.dll
OLEAUT32.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LocalFree
EncodePointer
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
GetFileType
SetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVtype_info@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AV_com_error@@
.?AVbad_exception@std@@
.?AVCAtlException@ATL@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
1,1014181
474<4D4y4
485p5y5
5c6t6{7
8(8I889A9
>(>M>T>`>g>s>{>
021X1c1
272N2b2p2
2 3%3/3
7;7A7G7M7S7Y7`7g7n7u7|7
8I9\9o9{9
<:<?<L<U=m=s=
=$>A>W>a>o>
>'?0?8?
1!1/1p1v1
1:2U2a2p2y2
3+343:3B3G3m3r3
687\7{7
0U0m0r0
414Y4m4
4/5K5k5y5
6F6b6q6}6
7%71767;7_7k7p7u7
8.8@8L8V8h8m8
<(<[<m<
>+>6>r>
#020H0^0u0|0
0,131E1R1d1l1v1
3@3K3?5I5h5o5
8)878D8
899L9[9|9
<H<M<Z<f<
==%=3=<=A=N=S=`=n=u=}=
>;>b>|>
? ?4?@?
3&4q4m5
6&777R7^7o7x7
8+888Q8~8
9?9O9f9n9
;+;6;;;@;[;e;
< <<<G<L<Q<
=%=2=G=R=f=k=p=
2'363H3Z3v3
4+4:4D4Q4[4k4
5(7U7v7{7
; <,<@<U<
>.?5???U?
1 1<1`1
3+383O3
6F6U6c6
8*8<8N8`8r8
9#959G9Y9
3)4/4P6
7O7i7x7
8&838A8O8Z8p8
6 7A7H7^7t7
;-<`<u<
="=b=~=
2 3=3_3
7#707B7
7'8<8E8N8
8o9X:g:
;0<Z<b<
=!>X>u>
1&1{1|2
2,373B3H3Q3
4-4X4p4
:(;/;4;8;<;@;
122M2a2q2w2
p1x1|1
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0P5T5X5\5
9 9$9(9,9094989<9@9D9H9L9P9T9X9d9h9l9p9t9x9|9
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,74787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>
:$:,:4:<:D:L:T:\:d:l:t:|:
$>(>0>P>T>d>h>p>
?,?0?@?D?H?L?T?l?|?
@3`3p3
3,4L4T4\4d4|4
505L5P5X5`5h5p5
6 6D6P6X6
7(7H7h7
8(8H8h8
9,909P9p9
6 6$6@6D6X6\6`6d6h6l6p6t6x6|6
ERROR : Unable to initialize critical section in CAtlBaseModule
Aadvapi32
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
mscoree.dll
Aapi-ms-win-appmodel-runtime-l1-1-1
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l2-1-1
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-kernel32-package-current-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
user32
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
CONOUT$
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
"%s",global
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic Clean
MicroWorld-eScan Trojan.GenericKD.46801264
CMC Clean
CAT-QuickHeal Clean
McAfee RDN/Generic.grp
Cylance Unsafe
VIPRE Clean
Sangfor Riskware.Win32.Agent.ky
K7AntiVirus Clean
BitDefender Trojan.GenericKD.46801264
K7GW Clean
Cybereason Clean
BitDefenderTheta Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Clean
Baidu Clean
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Tencent Clean
Ad-Aware Trojan.GenericKD.46801264
TACHYON Clean
Emsisoft Trojan.GenericKD.46801264 (B)
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
FireEye Trojan.GenericKD.46801264
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Clipbanker
GData Trojan.GenericKD.46801264
Jiangmin Clean
MaxSecure Trojan.Malware.300983.susgen
Avira Clean
Antiy-AVL Clean
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Clean
Arcabit Trojan.Generic.D2CA2170
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Hynamer.A!ml
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
VBA32 BScope.Trojan.Downloader
ALYac Trojan.GenericKD.46801264
MAX malware (ai score=88)
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Clean
Yandex Clean
SentinelOne Clean
eGambit Unsafe.AI_Score_72%
Fortinet W32/PossibleThreat
Webroot Clean
AVG FileRepMetagen [Malware]
Avast FileRepMetagen [Malware]
CrowdStrike Clean
Qihoo-360 Clean
No IRMA results available.