Static | ZeroBOX

PE Compile Time

2021-09-07 09:22:06

PE Imphash

0162c0d4b083e9259ae3a5f11034f58d

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00000c40 0x00000e00 4.45896632252
.rdata 0x00002000 0x0000054a 0x00000600 4.29142222664
.data 0x00003000 0x00000422 0x00000600 5.03579938239
.rsrc 0x00004000 0x0002c380 0x0002c400 4.78618534736
.reloc 0x00031000 0x00000040 0x00000200 0.933534643019

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0002fd10 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002fd10 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002fd10 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002fd10 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002fd10 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002fd10 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002fd10 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002fd10 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002fd10 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x00030178 0x00000084 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x00030200 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library WININET.dll:
0x402050 FtpRemoveDirectoryW
0x402054 InternetGoOnline
Library MSACM32.dll:
0x40201c acmDriverMessage
0x402020 acmFilterEnumW
Library RESUTILS.dll:
Library urlmon.dll:
0x402068 URLDownloadToFileW
0x402070 Extract
0x402078 URLOpenPullStreamW
Library COMDLG32.dll:
0x402000 GetOpenFileNameA
0x402004 GetOpenFileNameW
0x402008 ReplaceTextA
0x40200c ChooseColorW
0x402010 FindTextW
0x402014 FindTextA
Library ole32.dll:
0x402060 CoInstall

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
.text$mn
.idata$5
.rdata
.rdata$zzzdbg
.idata$2
.idata$3
.idata$4
.idata$6
.rsrc$01
.rsrc$02
FindFirstUrlCacheEntryExW
GetUrlCacheEntryInfoA
InternetGoOnline
FtpRemoveDirectoryW
FindFirstUrlCacheContainerA
GetUrlCacheHeaderData
IncrementUrlCacheHeaderData
WININET.dll
acmDriverMessage
acmFilterEnumW
MSACM32.dll
ResUtilSetPropertyParameterBlock
ResUtilAddUnknownProperties
ResUtilFindSzProperty
ResUtilStopResourceService
ResUtilGetResourceNameDependency
RESUTILS.dll
CoGetClassObjectFromURL
Extract
HlinkSimpleNavigateToString
URLDownloadToFileW
URLOpenPullStreamW
RegisterMediaTypeClass
urlmon.dll
GetOpenFileNameA
GetOpenFileNameW
ReplaceTextA
ChooseColorW
FindTextW
FindTextA
COMDLG32.dll
CoInstall
ole32.dll
SVWjuXjr_jl^jmf
XjoZjnf
XjdYjbf
Xjk[jef
jgXj.Yjnf
[jaXjrf
YjcXjef
YjvXjpf
Jqcx/n
~r-Ytj
C^.q[n
UQVN@p
} g/s/
7+w}\f>}
Op<a6
`wX9tr
Z4iOhp
w+v8d.
Zbh]{ BT]
0*fpa J
kI38a9
5o7.k+
]n(? $L
ZjYT2kk8
JLe]-,
?"%d_q
*(802fk
.[ u%&
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
<$<*<0<6<<<
Antivirus Signature
Bkav Clean
Lionic Trojan.Multi.Generic.4!c
Elastic Clean
MicroWorld-eScan Gen:Variant.Razy.920150
FireEye Generic.mg.3dd433076befeaeb
CAT-QuickHeal Clean
McAfee Generic Obfuscated.g
Cylance Unsafe
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Gen:Variant.Razy.920150
K7GW Clean
Cybereason malicious.0c816b
Baidu Clean
Cyren W32/Trojan.ELIG-5001
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Agent.FVZ
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Virus.Win32.Gen.ccmw
ViRobot Clean
Tencent Clean
Ad-Aware Gen:Variant.Razy.920150
Emsisoft Gen:Variant.Razy.920150 (B)
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Backdoor.ct
CMC Clean
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Razy.920150
Jiangmin Clean
Webroot Clean
Avira TR/Crypt.ZPACK.Gen
MAX malware (ai score=81)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34126.luW@a4tvszdi
ALYac Clean
TACHYON Clean
VBA32 BScope.Trojan.Injects
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Generic@ML.81 (RDML:E6EUSfvJrr05vJDrNP8+Jw)
Yandex Clean
Ikarus Clean
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Agent.FVZ!tr
AVG Win32:TrojanX-gen [Trj]
Avast Win32:TrojanX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.