Static | ZeroBOX

PE Compile Time

2021-08-27 12:09:12

PE Imphash

ff24a027dfc3b9e5934ec374a09b35a4

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00014cb8 0x00015000 6.53308831533
.data 0x00016000 0x000011f4 0x00001000 0.0
.rsrc 0x00018000 0x000008b0 0x00001000 2.417684259

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00018348 0x00000568 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x00018334 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x000180f0 0x00000244 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library MSVBVM60.DLL:
0x401000 None
0x401004 _CIcos
0x401008 _adj_fptan
0x40100c __vbaAryMove
0x401010 __vbaFreeVar
0x401014 __vbaStrVarMove
0x401018 None
0x40101c __vbaFreeVarList
0x401020 _adj_fdiv_m64
0x401024 __vbaFreeObjList
0x401028 _adj_fprem1
0x40102c __vbaStrCat
0x401030 __vbaSetSystemError
0x401038 _adj_fdiv_m32
0x40103c __vbaAryVar
0x401040 __vbaAryDestruct
0x401044 None
0x401048 __vbaObjSet
0x40104c _adj_fdiv_m16i
0x401050 __vbaObjSetAddref
0x401054 None
0x401058 _adj_fdivr_m16i
0x40105c None
0x401060 None
0x401064 __vbaFpR8
0x401068 None
0x40106c _CIsin
0x401070 __vbaChkstk
0x401074 EVENT_SINK_AddRef
0x401078 __vbaStrCmp
0x40107c __vbaAryConstruct2
0x401080 __vbaVarTstEq
0x401084 __vbaR4Str
0x401088 __vbaI2I4
0x40108c DllFunctionCall
0x401090 _adj_fpatan
0x401094 __vbaLateIdCallLd
0x401098 None
0x40109c EVENT_SINK_Release
0x4010a0 _CIsqrt
0x4010a8 __vbaExceptHandler
0x4010ac _adj_fprem
0x4010b0 _adj_fdivr_m64
0x4010b4 __vbaFPException
0x4010b8 _CIlog
0x4010bc None
0x4010c0 __vbaFileOpen
0x4010c4 None
0x4010c8 __vbaNew2
0x4010cc __vbaVar2Vec
0x4010d0 _adj_fdiv_m32i
0x4010d4 _adj_fdivr_m32i
0x4010d8 None
0x4010dc __vbaStrCopy
0x4010e0 __vbaFreeStrList
0x4010e4 _adj_fdivr_m32
0x4010e8 _adj_fdiv_r
0x4010ec None
0x4010f0 __vbaI4Var
0x4010f4 None
0x4010f8 __vbaStrToAnsi
0x4010fc None
0x401100 None
0x401104 _CIatan
0x401108 __vbaStrMove
0x40110c __vbaAryCopy
0x401110 __vbaCastObj
0x401114 _allmul
0x401118 __vbaLateIdSt
0x40111c _CItan
0x401120 _CIexp
0x401124 None
0x401128 __vbaFreeObj
0x40112c __vbaFreeStr

!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
Chalicotheriid1
VB5!6&*
Kasterens
Sigtendes
Chalicotheriid1
Zoanthid2
ARAROBA
DIFFERENTIALMAALINGER
Chalicotheriid1
Option3
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Option1
Option2
Bourgeois
winmm.dll
waveOutPrepareHeader
user32
CloseClipboard
kernel32
lstrlenW
url.dll
InetIsOffline
msimg32.dll
TransparentBlt
VBA6.DLL
__vbaR4Str
__vbaVarTstEq
__vbaObjSetAddref
__vbaStrCat
__vbaStrCmp
__vbaAryConstruct2
__vbaAryDestruct
__vbaStrCopy
__vbaFreeStr
__vbaFileOpen
__vbaI2I4
__vbaCastObj
__vbaLateIdSt
__vbaFreeStrList
__vbaStrToAnsi
__vbaStrVarMove
__vbaFreeObjList
__vbaObjSet
__vbaLateIdCallLd
__vbaI4Var
__vbaSetSystemError
__vbaAryVar
__vbaAryCopy
__vbaFreeVar
__vbaVar2Vec
__vbaAryMove
__vbaFreeVarList
__vbaFreeObj
__vbaHresultCheckObj
__vbaNew2
__vbaStrMove
__vbaFpR8
Zoanthid2
FORTRYDELSESPARAGRAFFERNES
FORTRYDELSESPARAGRAFFERNES
Option1
Reintroduction6
Option2
Tonicises4
Option3
Udklkning1
ARAROBA
Episcotister
:::::::::::::::::::::::::::::::::3
'*))%$
&,+*)%!
::::"*,+*)% 
::::*.-+*'
::::,0.,(
::::-20
::::0750-+
::::586410/.,)
::::55/,**'#
3:::::::::::::::::::::::::::::::::::
Episcotister
Bourge
uiWWq
X}CBKUT
y`/Xqt
&`oYr)
5CQWH'
558Qj1
i%6![E
\V\W#]
4eD`@J
c6P:?h
\?R:?h
KCcX}HW
5:W]j#
drXqQP
/Hf>]E)
Yt f\q
Mun1C]]#m
N)qXl]
\IE]j#
=A~~Xv
baP2zh
'Rcp]0X~
.3D9a :b
M -4'2
^enZd5
WQ,H%i
X|qXH'&
R6El*6&h
]E#F?!
Z?R:2h
xw|"XxgKj
iaWrl}
Yp`f\jK
hQ,ghW
?rHXy`
-p'p]P
&p]7/N
MH\]#E
{>R2Vh
XNOT\F
Xt#d*H#E
\WJR4p]
S/D{&'
(gM3NF
b'.H8n
Yuof\Ih
s>f*9%
m>.LBg
]MK(9p]Q
wb']U#
&p]3X:"h
LJw/p]
3eD`@J
QTXp8k
YuLf\5
(vU_X|
Yt0f\A
'Ew?f6dS
';&p]Q
M+*%xe`*P
i\T(zYuJ
E"*"+&
NQ2e]G
\qP2%h
&p]!Xt
Xwa9BK
\&sr7+P
!Xq%WBh
MEZfb2
i(q]ad
accccccccccccccccccccccccccccccccccccc
89999999999999999999999999999999999999
uUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
#((((((((((((((((((((((((((((((((((((((
a~zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
qiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
*8Q2]--------------------------------------
3######################################
!RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
[.....................................
zCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
8:6ppppppppppppppppppppppppppppppppppppp
%4444444444444444444444444444444444444
?nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
jPh\!@
jhh\!@
jXh,!@
jhh\!@
j`h\!@
j`h\!@
jHh\!@
jph,!@
jPh\!@
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaFpR8
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaR4Str
__vbaI2I4
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaFileOpen
__vbaNew2
__vbaVar2Vec
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
__vbaI4Var
__vbaStrToAnsi
_CIatan
__vbaStrMove
__vbaAryCopy
__vbaCastObj
_allmul
__vbaLateIdSt
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
:::::::::::::::::::::::::::::::::3
'*))%$
&,+*)%!
::::"*,+*)% 
::::*.-+*'
::::,0.,(
::::-20
::::0750-+
::::586410/.,)
::::55/,**'#
3:::::::::::::::::::::::::::::::::::
PULTON
riposter
Potwalling
FORAARSRULLENS
bohlen
Gebrdet6
Galivanted5
Unprecedentedness8
NITPICKS
KINDHEST
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004B0
Comments
ClassMate
CompanyName
ClassMate
ProductName
ClassMate
FileVersion
ProductVersion
InternalName
Kasterens
OriginalFilename
Kasterens.exe
Antivirus Signature
Bkav W32.AIDetect.malware2
Lionic Trojan.MSIL.NanoBot.m!c
Elastic malicious (high confidence)
DrWeb Trojan.Inject4.15886
MicroWorld-eScan Trojan.GenericKD.37494443
FireEye Generic.mg.8993ca9025df7cdf
CAT-QuickHeal Clean
ALYac Trojan.GenericKD.37494443
Cylance Unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005818811 )
BitDefender Trojan.GenericKD.37494443
K7GW Trojan ( 005818811 )
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZevbaF.34110.gm0@aOJ7r4g
Cyren Clean
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of Win32/GenKryptik.FJMX
Zoner Clean
TrendMicro-HouseCall Clean
Paloalto generic.ml
ClamAV Clean
Kaspersky Backdoor.MSIL.NanoBot.besg
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Ad-Aware Trojan.GenericKD.37494443
Sophos Mal/Generic-S
Comodo Clean
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.VBObfus.nh
CMC Clean
Emsisoft Trojan.GenericKD.37494443 (B)
SentinelOne Static AI - Suspicious PE
GData Trojan.GenericKD.37494443
Jiangmin Backdoor.MSIL.eysw
Webroot Clean
Avira TR/Kryptik.orgtl
MAX malware (ai score=88)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Trojan.Win32.Downloader.sa
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
McAfee GuLoader-FDCP!8993CA9025DF
TACHYON Clean
VBA32 BScope.Trojan.Mucc
Malwarebytes Trojan.GuLoader
Panda Trj/GdSda.A
APEX Malicious
Tencent Clean
Yandex Trojan.AvsArher.bTx33N
Ikarus Trojan.VB.Crypt
eGambit Unsafe.AI_Score_74%
Fortinet W32/GenKryptik.FJMX!tr
AVG Win32:Trojan-gen
Cybereason Clean
Avast Win32:Trojan-gen
MaxSecure Trojan.Malware.300983.susgen
No IRMA results available.