Static | ZeroBOX

PE Compile Time

2021-08-24 08:17:36

PE Imphash

76cb49957629b5fe0d40d13588a8762e

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00000656 0x00000800 4.97731092447
.rdata 0x00002000 0x000003c6 0x00000400 4.36486164614
.data 0x00003000 0x00000392 0x00000400 5.91916213812
.rsrc 0x00004000 0x00000708 0x00000800 2.80935429441

Resources

Name Offset Size Language Sub-language File type
RT_BITMAP 0x000040a0 0x000004e8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x00004588 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x402000 GetStdHandle
0x402004 WriteFile
0x402008 GetLastError
0x40200c HeapAlloc
0x402010 HeapFree
0x402014 GetProcessHeap
0x402018 GetModuleHandleW
0x40201c GetProcAddress
0x402020 LoadLibraryA
0x402024 LocalFree
0x402028 lstrlenW
0x40202c WideCharToMultiByte
0x402030 EnumTimeFormatsW
0x402034 GetConsoleOutputCP
0x402038 WriteConsoleW
Library USER32.dll:
0x402050 LoadStringW
0x402054 MessageBoxW
Library ole32.dll:
0x40205c OleInitialize
0x402060 OleUninitialize
Library MSVCRT.dll:
0x402040 towlower
0x402044 malloc
0x402048 memset

!This program cannot be run in DOS mode.
`.rdata
@.data
.text$mn
.idata$5
.rdata
.rdata$zzzdbg
.idata$2
.idata$3
.idata$4
.idata$6
.rsrc$01
.rsrc$02
GetStdHandle
WriteFile
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleW
GetProcAddress
LoadLibraryA
LocalFree
lstrlenW
WideCharToMultiByte
EnumTimeFormatsW
GetConsoleOutputCP
WriteConsoleW
KERNEL32.dll
LoadStringW
MessageBoxW
USER32.dll
OleInitialize
OleUninitialize
ole32.dll
towlower
malloc
memset
MSVCRT.dll
LoadString failed with %d
Could not format string: le=%u, fmt=%s
restarting as 64-bit
not running in wow64, can't restart as 64-bit
fghfghfgh to fghfghfghfgh
VirtualProtect
kernel32.dll
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
7%0Z66
+F=~f"
_A4m@5
"B~N0ZL
++U,Hb[.}
hiJizf
U7yLMw
52NdzCp
C"g*Xf
^`'Jtw
9{r7@|2
I3mF'KT
uR3yfP
uR3yf)
7++\cA
:2*Lw_
@K3c~@
5}_\L6+%
uPNa8K
Y5[Fly&
|>UZ8.
#LJlEm
}/0[m
5@@3}O
$9@?,xv
{4~v'6i
O.q_wR
hmj]`DQ4
U&{&KykD
]Fc~Pb
eW/<d8
7lJ%P%
tm}mH5
jk5a>1
;'E$f~>s[
1A=]kw
z+rVAE
C&wn;\
3'WDc
Lr)'Xm
2xVJ_+j/
u]~-'L
@~SH^)
v{^/Wd
>(^#)NC
+-?N).
#a:nq<
bU`IvN
ia0!1a%hWP=
;\=dm<
_%*fE'!z
Xlee-^T
,`b7?V
_HvLqL
m]41+@z
PX~`^>
P+a3Yv9@
n;\o6Au
FAE}G'j
CUic|2!47
'zAE#tR
;owv2`$
a`\.vF
m[RI9'
?$Oicr0-[
*>v-93
$S=+5P++F
LJ_Q_g
V@G66mT
?.<y+
C(icu2
CcKiZ.<
bQg(*?
T~dq.k
RjO4m+
>=k6/So5
7]XJoe
z_TZ46
^XV=oL
E=e?+w
1%A60ov
E/Joj'
-UpoL}l
-EJPOQy
$.TBAk
g`+74:
?+fh~5
P+l_PV
g]+74>
gYx74>
?+zl~5
})3Y$@
?+Al~5
xII,ar
{w_T#
FZ$?kQ6
;?meic
=k"uL&
i&kEBX
O|O'qo/
>4;vo^
D&mf,h
zziaa(
@aGEfXCb
d'weFl
W}D:.e/
a[Muvn8
@ 4KR^
G.<#pN6Q
*icyR&Lb
{DCX'6
]P2W3?[
"7HRLb
ovnLQu
D-EvX!
56,Oq&
5F2[I`;
M(^#)N
u"!af)-q-
^Po)w
lel-^T
g^\Tb*O
a\IMHi
kX|7(S-
_T70C4`n
5t(Ak
7lAP~\
%'WDAq
p<~ihk
+|Zq`@
2l2Z@-9
x@{1M<
HQN5J#
1&vLqL
0'k~Hy
[2lzZ@
6%,uO|
^}U8up
! D:,f/
Fjf=O|
M(^#)NC
a[duvn8.
-pK56B0cVn
%}k.fQ[
o{$M5h!E
'k~6nh
ic|2G&
Ff '#d
gyS&U@kV-
&=zAEs
_)w#B2
($^KJQ<
[m)=i
)w#A2@
\nc4pb[
uUy|%`
=`WS%a
6ee18?
{ug3+f)
}$C> 5
uR3yf*
2]{yo@
{uk3WfM
u#3+f.
uM3yft
uM3yft
ua3+fV
v!g;Eg1fX
.1.3"$
uR3yfN
%Vdz(2
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
uR3yf)
QylgAw
!_|n)I
5Rwu}I
/3{5m>
Q9CByh
<dJ")KuRC
ugG-h.B
yx[B$@
:7l<so
g/PKB{
%~6Tv,l
sq_bDk h
I$~?(2
o*UCdp@
$>[?"K2D
;v+n.`
ws%NMP
bv8Qo(
bq>+/,
e[8[%`uB
I"|`*<
}=K'}K
zcL(%Z
.uI*(3$3!
&l9,(K+
4DWRI!LT
ckx`n5dr
4BGNcr
8u)N?lU
!3BQEjr]
<a0{O2
D2DJVyKD
{fuEg@2-(
fec|.F
:tgm1f
O@iA%@
x_8yC*Zpo[
]e<t~~
ZjE^y~mF
o4^0 9
Ts1Q&}
\{?Qpek
H<&YE*
Ev*)Bk
9nI-1(
;A :nQ
$oMRjCU
Nu.:'d
.+ufY~
kF4KQB
!K|QE&
M#(NY%n
^e]j:wvKs
f]{1T"
h"<&*8
h=%y6"Y
g'BzxTw
3XwBc\=
14h:!?(
X;Ejui&
%,"-]!T
V%}2NN8'F
,4WN?a
'Lf=06
,cBNq
VGWy\+
=Y J{'
U?cO/)
4>wXPi
:k^:x(
V&hNy+
R|qA7<@E
vG};zi
_>).O>
6->_8W
'fV6,(
A{%$ H
bGj'F'
(6)Rji
ZX)j!n
),-3Gg
BtUA4k
4Itn0c)
|U[/0iZ
8q%tW+4
0hq"%GAf
0 qlg_
xU^z*4z
c!Q(V(
:oF/M:
_JcvV
kGL.ug
oS`It"QS
ao0*-FcP
'&Tq@"
zHoL7^
JD%]rGWQ
$0[mNbr=tr
&6~(2(
rG{xhwA
cU[`gm
8)j?R}
(~!XFU
#%xL,&
rai.Us
>b2w/0
umemy6=
2J/VV2
e40r1l@
<ZDVnE8
GplN4~
;^f;YL
B?.YH@
..r6">\
*sI4&fM!
?2Qaz5}t!
@{/TX]
^6d0H0M
0<uq,q
fF.:!p
tPt[[K
&|&FRC
|ncBI/
S**(W|>
C=[[66
kZx9yA`0>n
ljfE]
v{6_5}
eP2kD
iN:wfD
GR`zz+
do3:jF
@bz!{Yi
DLI=K
;x_2wI
"LKZ{o
ijp9k<n~of
*Phk3S
PZF-)I
V9lY_q
d/\LjQu4
gm_T$,b
^r;O:"
IJF4F6
5KB+K".i`|
L:91c-
'Q:l:Q
v$y!D|
aGN`-f
k}2~q,
T3[7o&
0h42|z
r>Paz[
V9J[*k
`eTM^,^b
& []W1
37whOq
B#`5W
a';K@e
Al&p_q
{s}6n"
TdtRs|
wb,>=.`F
Lqn=nc
`dt)qV
MRFzTf
+wIx ukK
moD3<&V
A~BD#j{
6qUdwT
=&tV=b
gdT|om
h*RJRXQ
Vp|%4+
`q]>B<
5$qo`z
!H.PJQ
H1+~5M
pl+J.&B
t:,QVF
c,yoow!{E
-Sc[O($
yq<|2B4c
M!Ynh9
3lJ'(3
I&uZ4&
6Gzr'o
\SysNative
\ghtytytyfgyhfh.exe
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Clean
FireEye Generic.mg.252cae0537d8c3aa
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
Cybereason Clean
Baidu Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/GenKryptik.FJLP
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky UDS:Backdoor.Win32.Androm
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Kryptik!1.D84E (CLASSIC)
Ad-Aware Clean
Emsisoft Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Dropper.dc
CMC Clean
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
GData Clean
Jiangmin Clean
Webroot Clean
Avira TR/Crypt.ZPACK.Gen
MAX Clean
Antiy-AVL Clean
Kingsoft Win32.Hack.Undef.(kcloud)
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Pwsteal.Q!bit
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!252CAE0537D8
TACHYON Clean
VBA32 Clean
Malwarebytes Spyware.AgentTesla
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
Ikarus Trojan.Agent
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Gen:NN.ZexaF.34088.oqZ@aWQ@D0bi
AVG FileRepMalware
Avast FileRepMalware
CrowdStrike win/malicious_confidence_70% (W)
No IRMA results available.