Static | ZeroBOX

PE Compile Time

2021-08-17 17:26:41

PDB Path

C:\Users\HOME\AppData\Roaming\Cyber_Crypter5\obj\Debug\WindowsFormsApplication49.pdb

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00001354 0x00001400 5.33632622223
.rsrc 0x00004000 0x0000062c 0x00000800 3.48543181552
.reloc 0x00006000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00004090 0x0000039c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0000443c 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
WindowsFormsApplication49
<Module>
DownloadData
mscorlib
Synchronized
defaultInstance
set_AutoScaleMode
IDisposable
RuntimeTypeHandle
GetTypeFromHandle
SecurityProtocolType
GetType
get_Culture
set_Culture
resourceCulture
ApplicationSettingsBase
Dispose
EditorBrowsableState
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
WindowsFormsApplication49.exe
System.Runtime.Versioning
String
disposing
get_ExecutablePath
System.ComponentModel
get_SecurityProtocol
set_SecurityProtocol
ContainerControl
Program
System
resourceMan
Boolean
AppDomain
get_CurrentDomain
Application
System.Configuration
System.Globalization
System.Reflection
CultureInfo
InvokeMember
Binder
get_ResourceManager
ServicePointManager
System.CodeDom.Compiler
IContainer
.cctor
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
WindowsFormsApplication49.Properties.Resources.resources
DebuggingModes
WindowsFormsApplication49.Properties
EnableVisualStyles
BindingFlags
Settings
System.Windows.Forms
components
Object
System.Net
get_Default
WebClient
InitializeComponent
set_Text
get_Assembly
WrapNonExceptionThrows
WindowsFormsApplication49
Copyright
2021
$03df4afb-7eca-4fe8-8e0b-e96c484791dd
1.0.0.0
.NETFramework,Version=v4.8
FrameworkDisplayName
.NET Framework 4.8
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
11.0.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
RSDSs&
C:\Users\HOME\AppData\Roaming\Cyber_Crypter5\obj\Debug\WindowsFormsApplication49.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
https://cdn.discordapp.com/attachments/873994649574985761/876826597016100914/22.exe
https://cdn.discordapp.com/attachments/876742387932745741/876743456536559656/steammaa.dll
steammaa.sa
authorize
WindowsFormsApplication49.Properties.Resources
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
WindowsFormsApplication49
FileVersion
1.0.0.0
InternalName
WindowsFormsApplication49.exe
LegalCopyright
Copyright
2021
LegalTrademarks
OriginalFilename
WindowsFormsApplication49.exe
ProductName
WindowsFormsApplication49
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav Clean
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.618130
FireEye Generic.mg.dfd446df8d5951a2
CAT-QuickHeal Clean
ALYac Clean
Cylance Clean
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Gen:Variant.Bulz.618130
K7GW Clean
CrowdStrike win/malicious_confidence_90% (W)
BitDefenderTheta Gen:NN.ZemsilF.34088.am0@aqZoZro
Cyren W32/MSIL_Kryptik.EHH.gen!Eldorado
Symantec Trojan.Gen.2
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.IOQ
Baidu Clean
APEX Clean
Paloalto generic.ml
ClamAV Clean
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Tencent Clean
Ad-Aware Gen:Variant.Bulz.618130
TACHYON Clean
Sophos Mal/Generic-S
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
CMC Clean
Emsisoft Clean
Ikarus Trojan-Downloader.MSIL.Small
Jiangmin Clean
Webroot Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Clean
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!DFD446DF8D59
MAX malware (ai score=86)
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Clean
Yandex Clean
SentinelOne Clean
eGambit Clean
Fortinet MSIL/Agent.INQ!tr.dldr
Qihoo-360 Win32/TrojanSpy.AgentTesla.HgIASagA
Avast Clean
MaxSecure Trojan.Malware.300983.susgen
No IRMA results available.