Static | ZeroBOX

PE Compile Time

2021-08-29 06:41:54

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00007fc4 0x00008000 7.69642900363
.rsrc 0x0000a000 0x000005d0 0x00000600 4.50647954796
.reloc 0x0000c000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0000a0a0 0x0000023c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0000a2e0 0x000002e9 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
!This program cannot be run in DOS mode.
B~~~R|
Zyz|Bw
~N~~,/.
~~~~ !)(
~~~~M~
~~~~M~
/)))))
n~^~~q
~^~\~[~
~\~~~&(.)
~~~~~~~
~~~~~~~
~~~~~~~~~~ !
l~~~J~?~M~M~P~
~~~&.(
~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~
~~~~~~~~~
~~~~~~~~~
~~~~~~~~(-
xv~~~)
~~~"~,~;~9~7~-~*~,~'~"~3~?~=~6~7~0~;~"~-~
~"~7~:~;~~~~~"~,~;~9~7~-~*~,~'~"~3~?~=~6~7~0~;~"~-~
~"~-~=~-~7~~~~
9z~~~~
9r>~~~
9n~~~~
9j~~~~)
>~~~[~
~M~L~"~
.^}+v7
8Z};vq
~M~L~~~
~M~L~~~~~~~~
~M~L~~~
~M~L~~~~~~
@yj-Ip
&zo*~W
~b*6#h,
~b*oZ
A*rPf*
~of:;
Z_of:;o
7-SNzJ
VabgF9
zczq*
&Dj!*l$
tNkbK<
9ok Q2
M9^vRI/
$$A(rYq
QMoKci])
W"g~vf>
}A/7K}
W*00ow
";'kF$
"/]>&M
JuCU?nz
\sk#*I
#"ARs
j%A,r7
u&yxw
2TMtCs
+F$SJz
?URRo^gY/Nt
()].Hp
o&!F1R
J>[kLrU'
~y*8;?
Y%v*4
2,;:6z
#+hzw$
0l3/i^g
VabgF9
Nz=3z:
"po2Ju
$nWW+
}"ERw
^#Zn7A
9aKCOT
(DMYA#
H]I{4NK
JnB+H?
_?b,1/
3?pI&Vr
PW*cR9
ZS*78^+.
}nk#t6~Kn&
VDY;=H}
fis*qV$j
wa+:sM
\&c,!"?
DCmfH}
_SI}F4
/I,[#Hu
-Kw:DHv
v4.0.30319
#Strings
<Module>
verb.exe
Program
FileItem
UrlItem
MessageBoxItem
mscorlib
System
Object
FileName
Compress
Encrypt
Hidden
DropLocation
DropAction
CommandLine
AntiSandboxie
AntiWireshark
AntiProcessMonitor
AntiEmulator
Content
System.Windows.Forms
MessageBoxButtons
Buttons
MessageBoxIcon
hidden
dropLocation
dropAction
commandLine
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
System.Net
WebClient
DownloadData
MessageBox
DialogResult
System.IO
GetTempPath
Microsoft.Win32
Registry
GetValue
String
Environment
SpecialFolder
GetFolderPath
AppDomain
get_CurrentDomain
get_BaseDirectory
Combine
Delete
WriteAllBytes
FileInfo
FileSystemInfo
FileAttributes
get_Attributes
set_Attributes
System.Diagnostics
ProcessStartInfo
set_Verb
Process
WaitForExit
.cctor
<PrivateImplementationDetails>{543AE6CE-20B9-4729-A0AD-483964CE65F2}
CompilerGeneratedAttribute
ValueType
__StaticArrayInitTypeSize=29184
$$method0x6000007-1
RuntimeHelpers
RuntimeFieldHandle
InitializeArray
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
<dependency>
<dependentAssembly>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" />
</dependentAssembly>
</dependency>
</assembly>
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
{374DE290-123F-4565-9164-39C4925E467B}
verb.exe
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
0.0.0.0
InternalName
verb.exe
LegalCopyright
OriginalFilename
verb.exe
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Razy.498091
FireEye Generic.mg.37197f31b0fda37f
CAT-QuickHeal Clean
McAfee GenericRXEC-TG!37197F31B0FD
Malwarebytes Malware.AI.3375062404
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Gen:Variant.Razy.498091
K7GW Clean
CrowdStrike win/malicious_confidence_90% (D)
Arcabit Clean
Baidu Clean
Cyren W32/MSIL_Kryptik.FJJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/TrojanDropper.Agent.DPC
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky HEUR:Trojan-Dropper.Win32.Generic
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Tencent Clean
Ad-Aware Gen:Variant.Razy.498091
TACHYON Clean
Emsisoft Gen:Variant.Razy.498091 (B)
Comodo Clean
F-Secure Clean
DrWeb Trojan.DownLoader35.1332
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.nc
CMC Clean
Sophos ML/PE-A
SentinelOne Static AI - Malicious PE
Jiangmin Clean
MaxSecure Clean
Avira TR/Dropper.Gen
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Microsoft Trojan:Win32/Wacatac.B!ml
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Dropper.Win32.Generic
GData Win32.Trojan-Downloader.SmokeLoader.L8GZ7B
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Agent.C2576300
Acronis Clean
BitDefenderTheta Gen:NN.ZemsilF.34110.cm0@a4qlmkd
ALYac Gen:Variant.Razy.498091
MAX malware (ai score=84)
VBA32 BScope.TrojanPSW.Spy
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Clean
Yandex Clean
Ikarus Trojan-Dropper.MSIL.Agent
eGambit Unsafe.AI_Score_99%
Fortinet MSIL/CoinMiner.DMA!tr.dldr
Webroot Clean
AVG Win32:Trojan-gen
Cybereason malicious.1b0fda
Avast Win32:Trojan-gen
No IRMA results available.