Static | ZeroBOX

PE Compile Time

2021-10-03 06:21:54

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00002174 0x00002200 5.45568775209
.rsrc 0x00006000 0x00000528 0x00000600 3.89828570929
.reloc 0x00008000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000060a0 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00006338 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
<Module>
D8F8CEDFF46F6CE83DC90DADDED.exe
Program
RedLine.Clipper
Monitor
OnClipboardChangeEventHandler
ClipboardWatcher
ClipboardFormat
Wallet
mscorlib
System
Object
MulticastDelegate
System.Windows.Forms
System.Collections.Generic
List`1
_wallets
currentClipboard
Handler
System.Text.RegularExpressions
RegexResult
OnClipboardChange
add_OnClipboardChange
remove_OnClipboardChange
Invoke
IAsyncResult
AsyncCallback
BeginInvoke
EndInvoke
WM_DRAWCLIPBOARD
WM_CHANGECBCHAIN
mInstance
nextClipboardViewer
SetVisibleCore
SetClipboardViewer
ChangeClipboardChain
SendMessage
Message
WndProc
formats
ClipChanged
value__
UnicodeText
Bitmap
EnhancedMetafile
MetafilePict
SymbolicLink
OemText
Palette
PenData
WaveAudio
FileDrop
Locale
CommaSeparatedValue
StringFormat
Serializable
get_Adress
set_Adress
get_RegexPattern
set_RegexPattern
<Adress>k__BackingField
<RegexPattern>k__BackingField
Adress
RegexPattern
format
object
method
callback
result
hWndNewViewer
hWndRemove
hWndNewNext
wParam
lParam
System.Security.Permissions
SecurityPermissionAttribute
SecurityAction
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
D8F8CEDFF46F6CE83DC90DADDED
STAThreadAttribute
Clipboard
GetText
String
op_Inequality
Enumerator
GetEnumerator
get_Current
Contains
Replace
MoveNext
IDisposable
Dispose
SetText
get_Success
Delegate
Combine
System.Threading
Interlocked
CompareExchange
Remove
<Start>b__0
CS$<>9__CachedAnonymousMethodDelegate1
CompilerGeneratedAttribute
<Start>b__2
ParameterizedThreadStart
CS$<>9__CachedAnonymousMethodDelegate3
Application
Thread
ApartmentState
SetApartmentState
<Stop>b__4
MethodInvoker
CS$<>9__CachedAnonymousMethodDelegate5
Control
get_Handle
System.ComponentModel
Component
CreateHandle
System.Runtime.InteropServices
DllImportAttribute
User32.dll
user32.dll
get_Msg
get_WParam
get_LParam
IntPtr
op_Equality
IDataObject
GetDataObject
Nullable`1
GetDataPresent
RuntimeTypeHandle
GetTypeFromHandle
ToString
GetData
get_HasValue
get_Value
.cctor
GetNames
System.Security
UnverifiableCodeAttribute
WrapNonExceptionThrows
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
bc1qhca50vjj5kvf39fes6h09zrwqj47xp0mu525sa
\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,35}\b
0x82987066596Fc343bf0af7c40d28870bcFF23e06
\b0x[a-fA-F0-9]{40}\b
qrfxruqpxwxcq9xztg49d5a7527ca58z6ycjxtr4fx
\b(q|p)[a-z0-9]{41}\b
DRcziLcr1SHmCjo2HxuXM6ySvPJ3DX3TrB
\bD{1}[5-9A-HJ-NP-U]{1}[1-9A-HJ-NP-Za-km-z]{32}\b
LefcPqjaNMCQL6d1iNKp9WaPDQL8qPpBf8
\b[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}\b
Xn4fB9UYDFfDVGCejcK9hKutcBttXcVn3S
\bX[1-9A-HJ-NP-Za-km-z]{33}\b
AbBipSSxRi9HxzDvL7NbkaaFrtkaDvC9ym
\bA[0-9a-zA-Z]{33}\b
45LpFbJbuRYTtFcL7iXcgeES59zC8VVVUBSAnWvYa5B6X7wSsHzVWM35F3AuCpYNHrKnLTqR4hbG5Kww6E3YpK81VaaPkqx
\b4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}\b
rUxHWNNgTyKt9M3YqyBbnJsPqqCGSmQjg6
\br[0-9a-zA-Z]{24,34}\b
t1d5nA2ExYo9LNRnsefvNSJt784ZebDJate
\bt(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,35}\b
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
0.0.0.0
InternalName
D8F8CEDFF46F6CE83DC90DADDED.exe
LegalCopyright
OriginalFilename
D8F8CEDFF46F6CE83DC90DADDED.exe
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.168834
FireEye Generic.mg.f508c9697bf14a18
CAT-QuickHeal Trojan.MsilFC.S16692016
ALYac Gen:Variant.Bulz.168834
Cylance Clean
VIPRE Clean
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 700000121 )
BitDefender Gen:Variant.Bulz.168834
K7GW Trojan ( 700000121 )
CrowdStrike Clean
BitDefenderTheta Gen:NN.ZemsilF.34170.am0@aSfWTWh
Cyren W32/MSIL_Troj.XK.gen!Eldorado
Symantec Clean
ESET-NOD32 a variant of MSIL/ClipBanker.PK
Baidu Clean
TrendMicro-HouseCall Clean
Paloalto Clean
ClamAV Clean
Kaspersky HEUR:Trojan-Banker.MSIL.ClipBanker.gen
Alibaba Clean
NANO-Antivirus Clean
SUPERAntiSpyware Clean
Rising Spyware.ClipBanker!1.D05B (CLASSIC)
Ad-Aware Gen:Variant.Bulz.168834
TACHYON Clean
Sophos Clean
Comodo Clean
F-Secure Clean
DrWeb Trojan.PWS.RedLineNET.2
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition PWS-FCOC!F508C9697BF1
SentinelOne Static AI - Malicious PE
CMC Clean
Emsisoft Gen:Variant.Bulz.168834 (B)
APEX Malicious
GData Gen:Variant.Bulz.168834
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1137914
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Trojan.Bulz.D29382
ViRobot Clean
ZoneAlarm Clean
Microsoft Trojan:MSIL/ClipBanker.VI!MTB
Cynet Malicious (score: 99)
AhnLab-V3 Malware/Win32.RL_Generic.C4203768
Acronis Clean
McAfee PWS-FCOC!F508C9697BF1
MAX malware (ai score=86)
VBA32 Clean
Malwarebytes Trojan.ClipBanker.Generic
Panda Trj/GdSda.A
Zoner Clean
Tencent Clean
Yandex Clean
Ikarus Clean
eGambit Clean
Fortinet MSIL/ClipBanker.PK!tr
AVG Win32:TrojanX-gen [Trj]
Cybereason malicious.97bf14
Avast Win32:TrojanX-gen [Trj]
MaxSecure Clean
No IRMA results available.