Static | ZeroBOX

PE Compile Time

2020-12-31 12:06:48

PDB Path

C:\vikofoyad_voguwoka\bowu\razu_tog\98 kifu42\kavuyuxayu\y.pdb

PE Imphash

26b2a22c1afb78875d9384441bc03abe

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000d4a0 0x0000d600 7.39136293995
.rdata 0x0000f000 0x000032f0 0x00003400 4.10171806767
.data 0x00013000 0x0008557c 0x00001e00 1.31977280013
.rsrc 0x00099000 0x0000a8f0 0x0000aa00 6.06751171289

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000a2e00 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_STRING 0x000a34c8 0x00000424 LANG_SAAMI SUBLANG_ARABIC_LIBYA data
RT_ACCELERATOR 0x000a32f8 0x00000020 LANG_SAAMI SUBLANG_ARABIC_LIBYA data
RT_ACCELERATOR 0x000a32f8 0x00000020 LANG_SAAMI SUBLANG_ARABIC_LIBYA data
RT_GROUP_ICON 0x0009fbb0 0x00000076 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x0009fbb0 0x00000076 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x000a3318 0x000001b0 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library KERNEL32.dll:
0x40f000 HeapReAlloc
0x40f004 GetLocaleInfoA
0x40f008 LoadResource
0x40f014 AddConsoleAliasW
0x40f018 SetEvent
0x40f020 GetCommandLineA
0x40f024 WriteFileGather
0x40f028 CreateActCtxW
0x40f02c EnumResourceTypesA
0x40f034 GetFileAttributesA
0x40f038 ReadFile
0x40f03c GetDevicePowerState
0x40f040 GetProcAddress
0x40f044 VerLanguageNameA
0x40f04c WriteConsoleA
0x40f050 GetProcessId
0x40f054 LocalAlloc
0x40f058 RemoveDirectoryW
0x40f05c GlobalGetAtomNameW
0x40f064 GetModuleFileNameA
0x40f068 GetModuleHandleA
0x40f06c UpdateResourceW
0x40f070 EraseTape
0x40f074 GetStringTypeW
0x40f078 OpenSemaphoreW
0x40f07c ReleaseMutex
0x40f080 EndUpdateResourceA
0x40f084 LocalSize
0x40f088 FindFirstVolumeW
0x40f08c FindNextVolumeA
0x40f090 lstrcpyW
0x40f094 HeapAlloc
0x40f098 GetStartupInfoA
0x40f0a4 HeapFree
0x40f0a8 VirtualFree
0x40f0ac VirtualAlloc
0x40f0b0 HeapCreate
0x40f0b4 GetModuleHandleW
0x40f0b8 Sleep
0x40f0bc ExitProcess
0x40f0c0 WriteFile
0x40f0c4 GetStdHandle
0x40f0c8 SetHandleCount
0x40f0cc GetFileType
0x40f0d0 GetLastError
0x40f0d4 SetFilePointer
0x40f0d8 TerminateProcess
0x40f0dc GetCurrentProcess
0x40f0e8 IsDebuggerPresent
0x40f0f8 WideCharToMultiByte
0x40f0fc TlsGetValue
0x40f100 TlsAlloc
0x40f104 TlsSetValue
0x40f108 TlsFree
0x40f10c SetLastError
0x40f110 GetCurrentThreadId
0x40f11c GetTickCount
0x40f120 GetCurrentProcessId
0x40f128 RtlUnwind
0x40f12c LoadLibraryA
0x40f130 SetStdHandle
0x40f134 GetConsoleCP
0x40f138 GetConsoleMode
0x40f13c FlushFileBuffers
0x40f140 GetCPInfo
0x40f144 GetACP
0x40f148 GetOEMCP
0x40f14c IsValidCodePage
0x40f150 HeapSize
0x40f154 GetConsoleOutputCP
0x40f158 WriteConsoleW
0x40f15c MultiByteToWideChar
0x40f160 LCMapStringA
0x40f164 LCMapStringW
0x40f168 GetStringTypeA
0x40f16c CloseHandle
0x40f170 CreateFileA
Library USER32.dll:
0x40f178 GetCursorPos

Exports

Ordinal Address Name
1 0x401000 @SetViceVariants@12
!This program cannot be run in DOS mode.
`.rdata
@.data
j@j ^V
>=Yt1j
Y;=h<A
URPQQh
0SSSSS
0SSSSS
0SSSSS
0A@@Ju
Fh=`6A
to=`=A
;t$,v-
UQPXY]Y[
t"SS9]
PPPPPPPP
PPPPPPPP
t+WWVPV
D?sFPK
>)"h(4
D>>em=
9Li18X
H}E>F\
l!_#mn
/!fNc
;$vC5
J^For
$zvPpE
0M3Ewo4
#;V!u[
}dZ9zE
!)d_>?
ZOp KXn
t?\j6.
<e|Kjz
{l97S$^2
+\$L3y
zOWt!2
Z~MUq28w
B?J1vB
m9_D^C
QiQ$G_
|A'YAnE!
,"jc=3
Z<I'WqF
TH%].f
_h>PY3
Ocr7EmF
fX^NU.
>% X7L
&mmmxa
Xnd l[
*(k95.B9
.MCUe"
v3s=rPh
6hL.1p
l,gB?
CorExitProcess
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
CONOUT$
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
bad allocation
safililepekoruwatigecoyuxedamig
VirtualProtect
kernel32.dll
LocalAlloc
Misalifuxol won sobadilunez dubu muliwazawecudaw
C:\vikofoyad_voguwoka\bowu\razu_tog\98 kifu42\kavuyuxayu\y.pdb
HeapReAlloc
GetLocaleInfoA
LoadResource
InterlockedIncrement
GetEnvironmentStringsW
AddConsoleAliasW
SetEvent
GetSystemTimeAsFileTime
GetCommandLineA
WriteFileGather
CreateActCtxW
EnumResourceTypesA
LeaveCriticalSection
GetFileAttributesA
ReadFile
GetDevicePowerState
GetProcAddress
VerLanguageNameA
FreeUserPhysicalPages
WriteConsoleA
GetProcessId
LocalAlloc
RemoveDirectoryW
GlobalGetAtomNameW
WaitForMultipleObjects
GetModuleFileNameA
GetModuleHandleA
UpdateResourceW
EraseTape
GetStringTypeW
OpenSemaphoreW
ReleaseMutex
EndUpdateResourceA
LocalSize
FindFirstVolumeW
FindNextVolumeA
lstrcpyW
KERNEL32.dll
GetCursorPos
USER32.dll
HeapAlloc
GetStartupInfoA
DeleteCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapCreate
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetLastError
SetFilePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
CloseHandle
CreateFileA
xahep.exe
@SetViceVariants@12
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
)QSS)Z
iiPBD
zzQazc
iaNNz
CCRRRRRllo~o
CoCCCC7
IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII~j
IIIIIIIIIIIIII
$RIIIIIIIIIIIIIIR]
0CJ\IIIIIIIIIIIII
IIIIIIIIIIIII
IIIIIIIIIIIII
IIIIIIIIIIIIII
IIIIIIIIIIIIII
IIIIIIIIIIIII-@T
IIIIIIIIIIIII
IIIIIIIIIIIII
]hIIIIIIIIIIIII
ZIIIIIIIIIIIII
pIIIIIIIIIIIII
~IIIIIIIIIIIII
]NpIIIIIIIIIIIII
^4~IIIIIIIIIIIII
~IIIIIIIIIIIII
IIIIIIIIIIIIIH
IIIIIIIIIIIII
wIIIIIIIIIII
\QIIIIIIIIII
~IIIIIIIIIIR
~IIIIIIIIIIw
~IIIIIIIIIIw
IIIIIIIIIIl
IIIIIIIIII
IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>U
>>>>>>>>>>>>>U
>>>>>>>>>>>>
/>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>g
>>>>>>>>>>g
>>>>>>>>>>H
>>>>>>>>>>3
>>>>>>>>>>g
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>g
a>>>>>>>>>>
>>>>>>>>>>HXrs
>>>>>>>>>>U
>>>>>>>>
>>>>>>>>
>>>>>>>>
j\>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
E3q&T5],
I@PP~HZ
Q}}P}q}4
mscoree.dll
KERNEL32.DLL
((((( H
h(((( H
H
gtafitufiyurobenowazikijefefotapuwomey
jubujomababegejamacizikuduzewuguhapado
xebegocikorikicihecusasotugefagazijosogi
wucakehekohomafucunol gojewanavajepuheg
jeladupopomilehepuyizotamucipixe
VS_VERSION_INFO
StringFileInform
020224a6
InternalName
sajbmiamezu.ise
Copyright
Copyrighz (C) 2021, fudkagat
ProductVersion
8.6.59.5
VarFileInfo
Translation
Yisore soxoxib puwi[Wiyefanonupov witidosubipuraw hanezul leri xemo libafi lujedejuyefucej tepafola peyozumamiyFFevibinibixeset gehabibeyanev yoma lok minoyipa jeduwonusafuji tajibav8Tojay wumoy cih tijowelukipusim novuh lideho nano todaxuYMoyofo nir fewotob lawotekubavalaj ganu tumi mibomatonec dayufupujufuj soliwuvedasuvo xoy
MKogarecev fimec domirivunig terikuwo cexehoropajise zafufaxodaf balasabehecemKWizuwenefide yebutufivajiro mew voxunusenugoxib fasuzehosinayo perozawejega
Surusoloxac gaze jukixosiyes
Toxe beta
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Convagent.m!c
Elastic malicious (high confidence)
MicroWorld-eScan Clean
FireEye Generic.mg.1d29d6cd39010976
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
CrowdStrike win/malicious_confidence_90% (W)
BitDefenderTheta Gen:NN.ZexaF.34170.hq0@ae@PnUdO
Cyren W32/Kryptik.EWJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HMQC
Baidu Clean
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Kryptik!1.D9C1 (CLASSIC)
Ad-Aware Clean
Emsisoft Trojan.Crypt (A)
Comodo Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Emotet.ch
CMC Clean
Sophos ML/PE-A
Ikarus Clean
GData Clean
Jiangmin Clean
Webroot Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Racealer.Q!MTB
TACHYON Clean
AhnLab-V3 Clean
Acronis suspicious
McAfee Packed-GDT!1D29D6CD3901
MAX Clean
VBA32 Clean
Malwarebytes MachineLearning/Anomalous.95%
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0CIR21
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_96%
Fortinet W32/Kryptik.HMPX!tr
AVG FileRepMalware
Avast FileRepMalware
No IRMA results available.