Static | ZeroBOX

PE Compile Time

2104-02-01 09:26:04

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0006b7c4 0x0006b800 3.73112464622
.rsrc 0x0006e000 0x0000029c 0x00000400 2.1603992593
.reloc 0x00070000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0006e058 0x00000244 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
Aefauld
Aefauld.exe
<Module>
HelperVisitorState
Aefauld.States
Object
System
mscorlib
WrapperPublisherAuth
Aefauld.Authentication
<>c__DisplayClass2_0
Customer
Aefauld.Common
ValListener
Aefauld.Listeners
<>o__4
Account
Aefauld.Workers
TestListener
<>o__5
DecoratorListener
Consumer
ReaderAccountQueue
Aefauld.Queues
Instance
MulticastDelegate
ListWrapperWorker
MockVisitorState
Singleton
Reponse
PageVisitorState
Prototype
ListenerAccountQueue
InvocationAccountQueue
AccountPublisherAuth
Serializer
Adapter
ValueType
ServerAccountQueue
MerchantListener
ParamVisitorState
Listener
VisitorPublisherAuth
ResolverAccountQueue
<PrivateImplementationDetails>
__StaticArrayInitTypeSize=423400
CancelClient
String
EntryPointNotFoundException
CallClient
ListClient
VisitClient
Func`1
Boolean
IntPtr
Invoke
InvalidOleVariantTypeException
System.Runtime.InteropServices
TestClient
UInt64
UInt32
UInt16
op_Explicit
Marshal
SizeOf
Application
System.Windows.Forms
get_ExecutablePath
op_Inequality
Thread
System.Threading
ToInt64
GetTypeFromHandle
RuntimeTypeHandle
AllocHGlobal
FreeHGlobal
client
m_Wrapper
.cctor
QueryClient
instance
idx_cfg
_Visitor
Replace
ConnectClient
DefineClient
Binder
Microsoft.CSharp.RuntimeBinder
Microsoft.CSharp
Convert
CallSiteBinder
System.Runtime.CompilerServices
System.Core
CSharpBinderFlags
CallSite`1
Func`3
CallSite
Create
Target
ToCharArray
PushClient
FromBase64String
Encoding
System.Text
get_UTF8
GetString
ChangeClient
bridge
m_Publisher
ComputeClient
counter
StringBuilder
ToChar
Append
ToString
CountClient
PublishClient
RuntimeHelpers
InitializeArray
RuntimeFieldHandle
Exception
ReflectClient
Action
UpdateClient
AssetClient
config
worker
PatchClient
ResetClient
CSharpArgumentInfo
CSharpArgumentInfoFlags
InvokeMember
IEnumerable`1
System.Collections.Generic
Func`4
eulaVJqniLnosJtfosnotweN42404
Func`5
printer
m_Helper
_Authentication
m_Advisor
WriteClient
LoadLibrary
kernel32.dll
PrintClient
FreeLibrary
OrderClient
GetProcAddress
kernel32
m_Thread
SelectClient
ViewClient
GetDelegateForFunctionPointer
Delegate
CustomizeClient
_Property
hProcess
isWow64
BeginInvoke
IAsyncResult
AsyncCallback
callback
object
EndInvoke
result
lpBaseAddress
lsretemaraPnekoTytiruceSXsnekoTytiruceSledoMecivreSmetsyS55115
lpNumberOfBytesWritten
exitCode
handle
hToken
lpApplicationName
lpCommandLine
lpProcessAttributes
lpThreadAttributes
bInheritHandles
dwCreationFlags
lpEnvironment
lpCurrentDirectory
lpStartupInfo
lpProcestapmoCrlCyciloPppAsdohteMevitaNefasnUniWtfosorciM56489
hNewToken
hThread
pContext
caller
ProcessHandle
BaseAddress
ZeroBits
RegionSize
AllocationType
Protect
second
nCmdShow
indexer
parser
m_Exporter
registry
mapper
m_Predicate
candidate
m_Proccesor
method
manager
facade
exception
_Message
_Reader
m_Server
m_Resolver
m_Tests
_Setter
_Mapping
_Creator
m_Interceptor
_Iterator
issuer
_Expression
m_Dispatcher
m_Struct
m_Object
m_Algo
configuration
m_Global
broadcaster
importer
_Producer
_Composer
m_Process
ExcludeClient
LogoutClient
6515E8530538F260BA40C6134C43CC9B7CE27541
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
TargetFrameworkAttribute
System.Runtime.Versioning
UnverifiableCodeAttribute
System.Security
ParamArrayAttribute
DynamicAttribute
ReliabilityContractAttribute
System.Runtime.ConstrainedExecution
Consistency
CompilerGeneratedAttribute
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
_CorExeMain
mscoree.dll
OiLlennahCnotelgniSIslennahCledoMecivreSmetsyS448740s+ABAkLjoINhMFAD4QCg==
OiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874Bc6EhAODzwfCyID
CiLlennahCnotelgniSIslennahCledoMecivreSmetsyS448740oiFSsRKiUQBBAGA0s+AxF5FDwhCwwJOBQuCiQ+RXQ=
DiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874D4+ABAeFDwcFAgcDzEiDyt7LjMmO2dN
CiLlennahCnotelgniSIslennahCledoMecivreSmetsyS448740sQDxF7LgAcG28bOD49RA==
CiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874SEmIRB6G3sLChgJOEsmFRF6NXQ=
DiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874hc6LxAkSSEmCgAAACEMKSglNiUcfwgAOEtcRA==
DiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874hc6OxAOAD8cfhxAAC8yCREnKngcGyI+AC5ZDxEnE3Q=
DiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874EoiCRYOLhgmIWMaACEmAyYeLj0nfxBF
DiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874EtRSjwjKgEfFAglOzEiFSseKg0nfm9AACEASQ==
CiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874Es+SSQOEDAfGxwbC0tRDBYOLn0hDWdN
DiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874EtRSjwjKh0fFAglOzEiFSseKg0nfm9AACEASQ==
DiLlennahCnotelgniSIslennahCledoMecivreSmetsyS448740s+SSQOEDAfGxwbC0tRDBYOLn0hDWdN
DiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874xQ+AxYeSSUTCzIJAC4uEg==
iLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874
CiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874Es+SSN7QTwmfmMDAC8MCRAkKj8hO2dN
PiLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874iEmFREjNTAJIQgDODhVRA==
DiLlennahCnotelgniSIslennahCledoMecivreSmetsyS448740sADxZ4HDknIQgGPg5VRA==
eulaVJqniLnosJtfosnotweN42404
Replace
FromBase64String
GetString
ZyhyrIxIELZp
ViLlennahCnotelgniSIslennahCledoMecivreSmetsyS44874FZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQUE3ODdwVUFBQUFBQUFBQUFPQUFBZ0VMQVRBQUFMZ0JBQUFNQUFBQUFBQUE0c1VCQUFBZ0FBQUE0QUVBQUFCQUFBQWdBQUFBQkFBQUJBQUFBQUFBQUFBRUFBQUFBQUFBQUFBZ0FnQUFCQUFBY1BRQkFBTUFRSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFKREZBUUJQQUFBQUFPQUJBTndFQUFBQUFBQUFBQUFBQUFESUFRRHdDQUFBQUFBQ0FBd0FBQUIweFFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUE4TGNCQUFBZ0FBQUF1QUVBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQU53RUFBQUE0QUVBQUFnQUFBQzhBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQUFBQ0FBQUVBQUFBeEFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
0.0.0.0
InternalName
Aefauld.exe
LegalCopyright
OriginalFilename
Aefauld.exe
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Trojan.MSIL.Agent.i!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
FireEye Generic.mg.b5fc67332e054209
CAT-QuickHeal Trojanpws.Msil
McAfee GenericRXPZ-YL!B5FC67332E05
Cylance Unsafe
Zillya Clean
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 0057fbdb1 )
BitDefender Gen:Variant.Bulz.699108
K7GW Trojan ( 0057fbdb1 )
CrowdStrike win/malicious_confidence_90% (W)
Baidu Clean
Cyren W32/MSIL_Troj.CY.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Kryptik.ACCF
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky HEUR:Trojan-PSW.MSIL.Agent.gen
Alibaba Trojan:Win32/Kryptik.ali2000016
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Bulz.699108
Rising Clean
Ad-Aware Gen:Variant.Bulz.699108
Sophos Mal/Generic-S
Comodo Clean
F-Secure Clean
DrWeb Trojan.PackedNET.972
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.gz
CMC Clean
Emsisoft Gen:Variant.Bulz.699108 (B)
Ikarus Trojan-Spy.MSIL.Agent
GData Gen:Variant.Bulz.699108
Jiangmin Trojan.PSW.MSIL.clzn
Webroot W32.Trojan.Agent.Gen
Avira HEUR/AGEN.1144480
MAX malware (ai score=100)
Antiy-AVL Clean
Gridinsoft Trojan.Win32.Agent.vb
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agent.gen
Microsoft Trojan:MSIL/AgentTesla.JPX!MTB
AhnLab-V3 Trojan/Win.Generic.C4628732
Acronis Clean
VBA32 TScope.Trojan.MSIL
ALYac Gen:Variant.Bulz.699108
TACHYON Clean
Malwarebytes Trojan.Crypt.MSIL.Generic
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R06CC0DIM21
Tencent Msil.Trojan-qqpass.Qqrob.Piae
Yandex Clean
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_100%
Fortinet MSIL/Kryptik.ACCF!tr
BitDefenderTheta Gen:NN.ZemsilF.34170.Bm0@aufigqg
AVG Win32:MalwareX-gen [Trj]
Avast Win32:MalwareX-gen [Trj]
MaxSecure Clean
No IRMA results available.