Static | ZeroBOX

PE Compile Time

2021-08-12 03:11:47

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x000018e8 0x00001a00 5.07568821815
.rsrc 0x00004000 0x000004e0 0x00000600 3.63288031936

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000040a0 0x00000264 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00004308 0x000001d3 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
<Module>
r1-uninstaller.exe
aflqlxmji
mscorlib
System
Object
jtchwohhqgbqzqbyxrt
jtchwohhqgbqzqbyxrt2
fwujknzipuemevdemmwnohuczqmpbbs
eqslfkwkifosmq
skjshixcvjhxxjxcecchrr
balhqnnvhqunitoujzlrno
System.Runtime.InteropServices
GuidAttribute
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
r1-uninstaller
System.Diagnostics
Process
GetProcessesByName
Microsoft.Win32
Registry
RegistryKey
CurrentUser
OpenSubKey
System.Security.Principal
WindowsIdentity
GetCurrent
WindowsPrincipal
WindowsBuiltInRole
IsInRole
System.IO
GetTempPath
Environment
get_SystemDirectory
System.Text
Encoding
get_ASCII
Convert
FromBase64String
GetString
Combine
GetFileName
DeleteValue
IDisposable
Dispose
ProcessStartInfo
set_FileName
GetFileNameWithoutExtension
String
Concat
set_Arguments
ProcessWindowStyle
set_WindowStyle
set_CreateNoWindow
System.Management
ConnectionOptions
ImpersonationLevel
set_Impersonation
ManagementScope
Connect
Format
ObjectQuery
ManagementObjectSearcher
ManagementObjectCollection
ManagementObjectEnumerator
GetEnumerator
ManagementBaseObject
get_Current
ManagementObject
get_Item
ToString
Contains
MoveNext
System.Threading
Thread
Directory
Delete
set_Verb
Exception
GetBytes
System.Security.Cryptography
Rfc2898DeriveBytes
RijndaelManaged
SymmetricAlgorithm
set_KeySize
CipherMode
set_Mode
DeriveBytes
ICryptoTransform
CreateDecryptor
CreateEncryptor
MemoryStream
CryptoStream
Stream
CryptoStreamMode
ToArray
.cctor
SpecialFolder
GetFolderPath
$c53139d9-870f-426a-965b-5bac11974192
WrapNonExceptionThrows
<?xml version="1.0" encoding="utf-8"?>
<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<assemblyIdentity version="1.0.0.0" name="Program.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
+nvYKzBfwVU7MqhuDMWBRg==
p8hbfOEA/S0WsIYWgoN7VKfJGT4iH0HsEXcvsJpIyQgq75GmuLdvERnYS+wqmPau
6XLDrhex1kUaTrVzEL1bkw==
/c schtasks /delete /f /tn "
" & exit
\root\cimv2
Select CommandLine, ProcessID from Win32_Process where Name='{0}'
3JsperDWYPy0s4QuIJ1fMg==
CommandLine
--cinit-find-e
/c taskkill /f /PID
ProcessID
& exit
/c powershell -Command Remove-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Remove-MpPreference -ExclusionPath '%AppData%' & powershell -Command Remove-MpPreference -ExclusionPath '%Temp%' & powershell -Command Remove-MpPreference -ExclusionPath '%SystemRoot%' & exit
mgboaduqlwpvbrfr
lxgtuykoispnrypygjuimfrvtakqlfktycuthnaurjxsveioroyfljigrkaukclrnhjyxglwhagtheaswicoufgkkwscnelycrkohspklfxldfzakxgizoviazktdeimpuumflvlxulehbgfeaubjoujuiihnggctgittjczsvpwlewgnfdsbnraalfroiymeexshouhfinwxgxgjreisddpouthdwkwlxxvtqzdtvxgaddbwzjhhxolqhqufwfm
qqdzjsovtldhgcputpndfdhwkitkaqzf
/0QeU7FPgQBMv6dmegr+5V9UnkZE4Qz+HcMcgW7Dv9k=
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
0.0.0.0
InternalName
r1-uninstaller.exe
LegalCopyright
OriginalFilename
r1-uninstaller.exe
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.565484
FireEye Generic.mg.e557e609d2dddcf4
CAT-QuickHeal Clean
McAfee Clean
Cylance Clean
VIPRE Clean
Sangfor Clean
CrowdStrike Clean
BitDefender Gen:Variant.Bulz.565484
K7GW Clean
K7AntiVirus Clean
BitDefenderTheta Clean
Cyren W64/MSIL_Troj.BCG.gen!Eldorado
Symantec Clean
ESET-NOD32 a variant of MSIL/Agent.UQS
Baidu Clean
APEX Malicious
Paloalto Clean
ClamAV Win.Packed.Bulz-9883710-0
Kaspersky HEUR:Trojan.MSIL.Vimditator.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Tencent Clean
Ad-Aware Gen:Variant.Bulz.565484
TACHYON Clean
Sophos ML/PE-A
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Clean
CMC Clean
Emsisoft Gen:Variant.Bulz.565484 (B)
Ikarus Trojan.MSIL.Krypt
GData Gen:Variant.Bulz.565484
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1143065
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSIL.Vimditator.gen
Microsoft Program:Win32/Wacapew.C!ml
Cynet Malicious (score: 99)
AhnLab-V3 Trojan/Win.Generic.C4566118
Acronis Clean
VBA32 Clean
ALYac Gen:Variant.Bulz.565484
MAX malware (ai score=87)
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Clean
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Clean
Fortinet MSIL/Agent.UQS!tr
Avast Clean
Qihoo-360 Clean
No IRMA results available.