Static | ZeroBOX

PE Compile Time

2021-08-15 21:00:23

PE Imphash

c7d3661f79d58d30854a3af50a6f4c2f

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000e25c 0x0000e400 6.55682555886
.rdata 0x00010000 0x00006176 0x00006200 4.89346285004
.data 0x00017000 0x000016ec 0x00000a00 2.23404805066
.gfids 0x00019000 0x00000110 0x00000200 1.90784173359
.rsrc 0x0001a000 0x000001e0 0x00000200 4.71006138269
.reloc 0x0001b000 0x00001090 0x00001200 6.33411009513

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0001a060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x410000 WriteFile
0x41000c CreateFileW
0x410010 GetLastError
0x410014 LoadLibraryA
0x410018 lstrcatW
0x41001c CloseHandle
0x410020 RaiseException
0x410024 DecodePointer
0x410028 GetProcAddress
0x410030 WriteConsoleW
0x410034 SetFilePointerEx
0x410038 GetConsoleMode
0x41003c GetConsoleCP
0x410040 FlushFileBuffers
0x410044 HeapReAlloc
0x410048 HeapSize
0x41004c GetStringTypeW
0x410050 SetStdHandle
0x410054 GetFileType
0x410058 GetProcessHeap
0x410068 GetCPInfo
0x41006c GetOEMCP
0x410078 GetCurrentProcess
0x41007c TerminateProcess
0x410084 IsDebuggerPresent
0x410088 GetStartupInfoW
0x41008c GetModuleHandleW
0x410094 GetCurrentProcessId
0x410098 GetCurrentThreadId
0x4100a0 InitializeSListHead
0x4100a4 OutputDebugStringW
0x4100b0 MultiByteToWideChar
0x4100b4 WideCharToMultiByte
0x4100b8 LocalFree
0x4100bc EncodePointer
0x4100c0 RtlUnwind
0x4100c4 SetLastError
0x4100c8 TlsAlloc
0x4100cc TlsGetValue
0x4100d0 TlsSetValue
0x4100d4 TlsFree
0x4100d8 FreeLibrary
0x4100dc LoadLibraryExW
0x4100e0 ExitProcess
0x4100e4 GetModuleHandleExW
0x4100e8 GetModuleFileNameA
0x4100ec GetStdHandle
0x4100f0 GetCommandLineA
0x4100f4 GetCommandLineW
0x4100f8 GetACP
0x4100fc HeapFree
0x410100 HeapAlloc
0x410104 CompareStringW
0x410108 LCMapStringW
0x41010c FindClose
0x410110 FindFirstFileExA
0x410114 FindNextFileA
0x410118 IsValidCodePage
Library USER32.dll:
0x41015c wsprintfW
Library ole32.dll:
0x410164 CoUninitialize
0x410168 CoInitialize
Library OLEAUT32.dll:
0x410120 SafeArrayGetDim
0x410124 VariantInit
0x410128 SafeArrayGetUBound
0x41012c SafeArrayGetLBound
0x410130 SysFreeString
0x410134 SysStringByteLen
0x41013c SysAllocString
0x410140 SysStringLen
0x410148 SysAllocStringLen
0x41014c SafeArrayAccessData
0x410150 VariantClear
0x410154 GetErrorInfo

!This program cannot be run in DOS mode.
_Richd&
`.rdata
@.data
.gfids
@.rsrc
@.reloc
QQSVWd
URPQQh
;t$,v-
UQPXY]Y[
QSSSSj
WWWPWS
u-PWWS
PQhXqA
PQh`rA
SSVWh
f9:t!V
|VWj=S
j,hpXA
QQSWj0j@
tl=XvA
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
Unknown exception
bad allocation
bad array new length
bad exception
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
CorExitProcess
CompareStringEx
GetCurrentPackageId
LCMapStringEx
LocaleNameToLCID
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
CoCreateInstance
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.gfids$x
.gfids$y
.rsrc$01
.rsrc$02
WriteFile
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
CreateFileW
GetLastError
LoadLibraryA
lstrcatW
CloseHandle
RaiseException
DecodePointer
GetProcAddress
DeleteCriticalSection
KERNEL32.dll
wsprintfW
USER32.dll
CoInitialize
CoUninitialize
ole32.dll
OLEAUT32.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LocalFree
EncodePointer
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
GetFileType
SetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVtype_info@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AV_com_error@@
.?AVbad_exception@std@@
.?AVCAtlException@ATL@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
1,1014181
474<4D4y4
485p5y5
5c6t6{7
8(8I889A9
>(>M>T>`>g>s>{>
021X1c1
272N2b2p2
2 3%3/3
7+71777=7C7I7P7W7^7e7l7s7z7
899L9_9k9{9
<*</<<<E=]=c=x=
>1>G>Q>_>z>
? ?(?o?~?
11`1f1
1*2E2Q2`2i2v2
3$3*32373]3b3
6(7L7k7
<&=k=p=t=x=|=
E0]0b0
4!4I4]4y4
45;5[5i5p5v5
666R6a6m6{6
7!7&7+7O7[7`7e7
808<8F8X8]8
0"080N0e0l0x0
1#151B1T1\1f1o1
2m2w2}2
203;3/595X5_5
8)9<9K9l9
<8<=<J<V<o<
=#=,=1=>=C=P=^=e=m=
=+>R>l>
4`4\5p5
7&7A7M7^7g7
8'8@8m8t8
8.9>9U9]9
9.:R:n:y:~:
;%;*;/;J;T;p;{;
<+<6<;<@<s<
=!=6=A=U=Z=_=
3%373I3e3
4)434@4J4Z4
7D7e7j7u7
?$?.?D?}?
556D6R6o6w6
8+8=8O8a8s8
9$969H9
7>7X7g7u7
8"808>8I8_8s8
9):G:w:,;
71787N7d7q7v7
<P<e<v<
8%8.8x8
8O98:G:f:~:
<:<B<_<o<{<
>8>U>i>t>
1[1\2l2}2
3"3(313s3
7U7_7z7
;L<g<}<
3f4k4}4
2-2A2Q2W2
p1x1|1
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0P5T5X5\5
9 9$9(9,9094989<9@9D9H9L9P9T9X9d9h9l9p9t9x9|9
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,74787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>
:$:,:4:<:D:L:T:\:d:l:t:|:
$>(>0>P>T>d>h>p>
?,?0?@?D?H?L?T?l?|?
@3`3p3
3,4L4T4\4d4|4
505L5P5X5`5h5p5
6 6D6P6X6
7(7H7h7
8(8H8h8
9,909P9p9
6 6$6@6D6X6\6`6d6h6l6p6t6x6|6
ERROR : Unable to initialize critical section in CAtlBaseModule
Aadvapi32
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
mscoree.dll
Aapi-ms-win-appmodel-runtime-l1-1-1
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l2-1-1
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-kernel32-package-current-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
user32
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
CONOUT$
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
"%s",global
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Sdum.4!c
Elastic Clean
MicroWorld-eScan Trojan.GenericKD.46800538
FireEye Trojan.GenericKD.46800538
CAT-QuickHeal Trojan.Win32
McAfee RDN/Generic.grp
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Sdum.gen
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Trojan.GenericKD.46800538
K7GW Riskware ( 0040eff71 )
CrowdStrike Clean
Baidu Clean
Cyren W32/Trojan.AHCX-3750
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Agent.FUV
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky HEUR:Trojan.Win32.Sdum.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Ad-Aware Trojan.GenericKD.46800538
Sophos Mal/Generic-S
Comodo Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Trojan.Win32.SDUM.USMANHI21
McAfee-GW-Edition RDN/Generic.grp
CMC Clean
Emsisoft Trojan.GenericKD.46800538 (B)
SentinelOne Clean
GData Trojan.GenericKD.46800538
Jiangmin Trojan.Sdum.ti
eGambit Unsafe.AI_Score_61%
Avira TR/Redcap.soibw
MAX malware (ai score=80)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Trojan.Win32.Downloader.sa
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Sdum.gen
Microsoft Trojan:Win32/Glupteba!ml
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C4594821
Acronis Clean
BitDefenderTheta Clean
TACHYON Clean
VBA32 BScope.Trojan.Downloader
Malwarebytes Trojan.Downloader
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.SDUM.USMANHI21
Tencent Win32.Trojan.Sdum.Dyze
Yandex Clean
Ikarus Trojan.Win32.Clipbanker
MaxSecure Clean
Fortinet W32/PossibleThreat
Webroot W32.Trojan.Gen
AVG Win32:TrojanX-gen [Trj]
Cybereason Clean
Avast Win32:TrojanX-gen [Trj]
No IRMA results available.