Static | ZeroBOX

PE Compile Time

2021-09-11 01:49:09

PE Imphash

240ad64b1428ff5f353dd3a63c168d80

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0013ea22 0x0013ec00 5.90922664615
.edata 0x00140000 0x00000070 0x00000200 0.83662429311
.data 0x00141000 0x00001000 0x00000200 0.0
.data 0x00142000 0x00000af2 0x00000c00 1.89421104813
.rsrc 0x00143000 0x0000f0e1 0x0000f200 4.24960033574

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0014e09c 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0014e09c 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0014e09c 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0014e09c 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0014e09c 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0014e09c 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_MENU 0x0014ebe0 0x00000402 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MENU 0x0014ebe0 0x00000402 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MENU 0x0014ebe0 0x00000402 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x0014f258 0x000000dc LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x0014f258 0x000000dc LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_RCDATA 0x0014f334 0x0000002b LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x0014f360 0x00000066 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x0014f3c8 0x0000018a LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, ASCII text

Imports

Library kernel32.dll:
0x542800 GetProcAddress
0x542804 LoadLibraryA
0x542808 VirtualAlloc
0x54280c VirtualProtect
0x542810 GetCurrentThread
0x542814 GetProcessId
0x542818 GetLastError
0x54281c GetTickCount
Library user32.dll:
0x54283c ReleaseCapture
0x542840 ReleaseDC
0x542844 GetCursorInfo
0x542848 GetCaretBlinkTime
0x54284c GetCapture
Library winmm.dll:
0x542854 midiInReset
Library winspool.drv:
0x54285c DevQueryPrintEx
Library ole32.dll:
Library winspool.drv:
Library msimg32.dll:
0x5520d1 TransparentBlt

Exports

Ordinal Address Name
1 0x4555f6 GetClass
!This program cannot be run in DOS mode.
`.edata
@.data
kernel32.dll
user32.dll
winmm.dll
winspool.drv
ole32.dll
msimg32.dll
32.dll
ole32.dll
SVWRV+4
PQRVW;}
PQRVW=K
PQRVW=f
PQRVW= B
U*8T"8
XE hP(
!E*.P*@U
Y@ "Q
Q@(.Q*
YT(6Q*
9@(.U(
*T >Q"
*WD*UU
*.P(4D*
[@(*Q"
QP("Q(
1@ 2A"
WA bP"
jU 9@"
QT 6A"
1@("A"b
6@(&P
yD *Q
*g@ v@
XE*(T `
v@"dA"
iA*7T*
&@*LD
aU *D(
aU *D"
(FT*wU
*SQ*?U
IU">P
(GA*?U
P*]@ fQ
QP "U"
S@ "Q"
CP*wU
`D :Q
QP 2Q*
QP 2Q*
UT*mA
*E@ &@*
"@(bU
3@(bQ*
3@(bQ"
&T*e@
YT *P(
!E*.P*@U
!E*.P*@U
SD*U
1P".Q(
T*"T(zQ
E*.P*@U
q@(6Q"
yP "@"
(VD*=U
YP "U"
YP "U"
QP "U"
QP "U"
QP "Q(
RU*5U
"CD*uU
" T"zQ
E*.D"dT"
*A "T
P*G@ "
Q@*$@*e
*E@("@
"BT*5U
*CU*U
"0T(*T
Q@*2Q*
B@*5U
T":A"b@
@ jQ"@@
!E*.P*@U
aU *D"
ZE*)P(
Q@(*T*
Q@ "Q*
qP "T"
1P*:Q*
0D >Q
(RT*?U
E*.P*@U
XE hP(
DA"JE*
YP .P(
Q@(*A(
Q@ "Q"
1@ "U(
"FP*=U
YP "Q(
(BT*]U
( A"b@
( T"jA
PE(hP(
Y@""A"
A bP"f
WA b@"
2P"fQ"
IU".T"
1@ 2Q"
A*&P*`
$@*J@"
2A "P
[@("A"
BA*?U
YP 2Q*
* A""@
Q@ .A"
ZE )@*-
P"A@(v
@(.A"bP
Q@ *Q
[@ 6Q
YT"2Q*
1P(.Q(
FD*5U
FQ*WU*
VD*WU
BQ*_U
Q@ "Q"
A bT"N
Q@(.Q"
2A bP"
RE*7U
!E*.T*
*RT*WU
(0T(FQ
Q@ *Q"
4D zQ"
YP *Q"
2E"j@
H@ `@ `@ `@ `@
*GU*=U
Q@ *U"
*$@*JA
QD *Q*
2A""T
(Q PQ"
$T zQ*
2A""D
Q@ *U"
(R@*}U
y@""Q
A bT"N
WA bT"N
WA b@"
WA b@"
WA b@"
4P pT pP
TP tP
)@(h@(h@(h@(hA
QA*rA"
QA*rD"
QA*rD"
QA*rD"
QA*rD"
QA*rD"
QA*rD"
qD *E*
Q@("Q(
(CE*gU
"BE*gU
[P("Q(
3P"*Q"
yA )U
QA(!U
QA !U
U*$U
AU 9U
AA 1U
"0@*JU
4@*JA""
Q@(>Q(
;P"&Q"
qA*rA
1A()U
;Q )U
1Q*<U
AA 1U
q@(6A"
QA*<U
QA*4U
QQ !U
QQ !U
QA )U
QQ*<U
QA )U
QA )U
QU*4U
QQ !U
{Q !U
yA*$U
UA !U
*SA*EU
:Q @A"
>Q @A"
*g@ 2A*
9@ 2A"
1@ "Q"
E bE"*D
E bE"*
;@ 2U(
uP*e@ 2
jQ @A"
;@ 2U(
QQ"FT"
@*j@*j@
@*j@*j@
@*j@*JP
*@@*j@*j
*j@*j@*jU
*h@*j@*j
@*j@*jT
~A*&@*
uP "P(
aA "Q
@*j@*j
U"(@ A
E"*@
P*@@*j@*j
*@@*jT
GA*_U
E bE"*
E"c@ "
"JE"*T
DE"nT*
*V@*_U
F@*wU
*G@*WU
"RP"rP(
(@D(ND(,D
(TT"PD"(T
"b@"r@
"hD"XD
^T LD
X@ .@*
TD*@D
0T" T
@ ~D"t
D(,D(L
"@@(.@
ND*h@"
"BP*J@
(NP(f@"
vD TD
P*bD(,
lT(<D(
D"VD"FT
D"VD"FT
FT"FD"
FT"FD"
D"6T*2@
"VD"vT"
"VD"vT"
"nD"vD
"nD"vD
T*&D(,
D@*P@*P@
@*P@"D
@*P@*P@(U
*P@*P@
*P@*P@
@@"D@(@
D@*P@*P@
@"D@"D
@"P@"D@
*P@*P@"T
T@*P@*P@
LP ]U
CD(`P(
T@"D@"
@*T@(Q@
@"U@"U@"U@ P@(
@"E@(U@
@(E@ E@
Q@(A@(
@(E@(E@(
"FD"fD"fA*p
P*}A B
tT*fP*
U*1P*K
"CP(yE
qA*rA
aU *D"
jD .P(
qA*rA
s@ &Q"
QD .Q
*D ZQ
Q@("A"
QP("A"
Q@("A"
Q@("A"
(4@*JU
"0T BA
*SE*_U
"VE*_U
(VE*_U
*WU*wU
SU*wU
"RU*wU
9@ &Q"
(BU*WU
QP(&@"
[@(&Q"
(FQ*_U
(BE*_U
2A "D
qA*rA
qA*rA
qA*rA
9P "A
1T(:Q"
1T :Q"
9@(6Q"
QD .Q
y@(>Q"
y@(>Q"
y@(>Q"
RA*}U*
GQ*UU
3P"*Q"
y@(>Q"
(CQ*UU
P(*A #
QP "Q(
*RD*WU
(ST*}U
QT 2Q*
1@ *A"bT
*V@"LQ"
*@ "Q"
!E*.P*@U
Q@ 6Q
E*.P*@U
RP"2P
UD*eA
qP "Q(
*|T*`@
jE"j@
E*.P*@U
,Q*@P
fQ"FP"
s@ 6Q
QP "P(
*D(.P(
s@ 2Q*@P
P 2Q"@P
PE xP(
PE xP(
*Q @Q*
PE hP(
XE(lP(
PE hP(
XE xP(
0@"@T
XE xP(
)D(JQ P
XE hP(
PE(xP(
XE xP(
*<P"DQ
XE xP(
0P pP pP pP pP p@
PE hP(
PE hP(
xE hP(
PE hP(
PE hP(
@ `@ `@ `@ `@ `@ `@ `@ `@ `
@ `@ `@
`@ `@ `@ `@ `@ `@ @ `@ `@ `@ `@ `@ `@ `@ `@ `@ `@ `@ `@ `@ `@ `@
@ `@ `
aU *D"
!E*.P*@U
!E*.P*@U
!E*.P*@U
!E*.P*@U
!E*.P*@U
!E*.P*@U
!E*.P*@U
XE xP(
XE hP(
!E*.P*@U
qA*rA"
\@ 2P"
YT :Q*
E 8@ !
E (@ !
QP "T"
)E*.P*@U
Q@*2Q"
QP "T BA
*A"bT
Y@"2Q"
*|D*H@
QP *@*
QP *@*
E*.A*X
A "T <Q
tT tQ"
s@(2Q"
Q@ :Q"
qP "U"
Q@ *U"
2A "P
q@ "U"
q@ *U"
FA*ZA"
FA*ZA"
DA*ZA"
FE*UU
(SQ*}U
Y@ "U"
q@ *U"
y@ *U"
QP "Q(
(FU*WU
@"a@ "
@("A"b
"A@ 6@
3@"rP*
1P "A
u@ )Q*
hP 6@"
!E*.P*@U
!E*.P*@U
q@ "U"
QP*@D*
4A "P
Y@ "Q"
FE*_U
QQ"<@"
TQ*HQ*
"a@ t@
P"PA b
T"hA "T
@ @@ `@ `@ `@
QP(&Q"
Q@""Q"
*VU*UU
(GU*uU
BQ*]U
(WD*]U
Q@ "Q
F@*UU
QP("A
Q@(*U
PE(xP(
PE xP(
Q@ *U"
BT"X@*
*/Q @A
" A "T
JT*H@*
qT("Q*
"GE*UU
A bT"N
2A "D
( Q AU
ImagingEngine.dll
GetClass
GetCurrentThread
GetLastError
GetProcAddress
GetProcessId
GetTickCount
LoadLibraryA
VirtualAlloc
VirtualProtect
kernel32.dll
GetCapture
GetCaretBlinkTime
GetCursorInfo
ReleaseCapture
ReleaseDC
user32.dll
midiInReset
winmm.dll
DevQueryPrintEx
winspool.drv
vSetDdrawflag
msimg32.dll
SHGetMalloc
shell32.dll
OleConvertOLESTREAMToIStorage
ole32.dll
AUU*++
%E`\9P
9d^s]N
58<aj.
{9T7mXe
)*y?iDI7
0Lt#J|]
0M4-:[/##
iW9zo1
\8gt`8
",R61V
B.M,U*
@kSc\@76
3W'sfx@
t^x%@Y
7LvE"4
kT]Mk!
FoV0M3&y
9f'-`
w}-?@kkk
PA<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
winspool.drv
ConvertAnsiDevModeToUnicodeDevmode
msimg32.dll
TransparentBlt
msimg32.dll
TransparentBlt
crogr.m
os+ all
=p8n Ks
plorXr
tHr+ Al
Uation
o5lbar
crogr.m
os+ all
=p8n Ks
opl0ad d
BaHk+ps
o5rce od3`r
S5debar
ator E4
ake a
crogr.m
os+ all
=p8n Ks
opl0ad d
BaHk+ps
o5rce od3`r
S5debar
ator E4
ake a
Antivirus Signature
Bkav Clean
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fugrafa.166459
FireEye Generic.mg.3146709a424c7546
CAT-QuickHeal Clean
ALYac Gen:Variant.Fugrafa.166459
Cylance Unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Fugrafa.166459
K7GW Clean
K7AntiVirus Clean
BitDefenderTheta Gen:NN.ZexaF.34170.tvW@ay7LHmii
Cyren Clean
Symantec Infostealer.Predapa!gm
ESET-NOD32 Clean
Baidu Clean
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Tencent Clean
Ad-Aware Gen:Variant.Fugrafa.166459
TACHYON Clean
Emsisoft Gen:Variant.Fugrafa.166459 (B)
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Emotet.tm
CMC Clean
Sophos ML/PE-A + Mal/EncPk-APW
Ikarus Clean
GData Gen:Variant.Fugrafa.166459
Jiangmin Clean
Webroot W32.Trojan.Gen
Avira Clean
Antiy-AVL Clean
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Clean
Arcabit Trojan.Fugrafa.D28A3B
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft PWS:Win32/Predator.RTA!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!3146709A424C
MAX malware (ai score=85)
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Generic@ML.87 (RDML:GeQnmO8V9GTiFOzRWtxpag)
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HMLF!tr
AVG FileRepMetagen [Malware]
Cybereason Clean
Avast FileRepMetagen [Malware]
No IRMA results available.