Static | ZeroBOX

PE Compile Time

2010-07-18 14:00:25

PE Imphash

13e953e43b1ead41787b74c3178fc208

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000fa3a 0x0000fc00 6.04682361288
.rdata 0x00011000 0x00001392 0x00001400 5.64667276567
.data 0x00013000 0x000040d0 0x00000200 0.0572566022412
.rsrc 0x00018000 0x000630f0 0x00063200 5.85234371164

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0003f890 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0003f890 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0003f890 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0003f890 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0003f890 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0003f890 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0003f890 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0003f890 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_DIALOG 0x0003fcf8 0x0000012a LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x0003fefc 0x000000be LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x0003fefc 0x000000be LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x0003fefc 0x000000be LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x0003fefc 0x000000be LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x0003fefc 0x000000be LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x0003ffbc 0x00039434 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x000793f0 0x00000076 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x00079468 0x00001434 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0007a89c 0x000002b8 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, ASCII text, with CRLF line terminators
None 0x0007ab54 0x00000013 LANG_NEUTRAL SUBLANG_NEUTRAL data
None 0x0007b0ec 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
None 0x0007b0ec 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
None 0x0007b0ec 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
None 0x0007b0ec 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)

Imports

Library SHLWAPI.dll:
0x41114c StrStrA
0x411150 StrStrIA
0x411154 StrChrA
Library KERNEL32.dll:
0x411018 lstrcmpA
0x41101c AllocConsole
0x411020 GetStdHandle
0x411024 WriteFile
0x411028 WriteConsoleA
0x41102c ReadFile
0x411030 ReadConsoleA
0x411034 MultiByteToWideChar
0x411038 HeapFree
0x41103c lstrcmpiA
0x411040 WideCharToMultiByte
0x411044 HeapAlloc
0x411048 SetConsoleMode
0x41104c GetConsoleMode
0x411050 GetLastError
0x411054 GetModuleFileNameA
0x411058 ExitProcess
0x41105c Sleep
0x411060 CreateThread
0x411064 GetTimeFormatA
0x411068 CloseHandle
0x41106c CreateFileA
0x411070 SizeofResource
0x411074 LockResource
0x411078 LoadResource
0x41107c FindResourceA
0x411080 lstrlenA
0x411084 GetFileAttributesA
0x41108c GetModuleHandleA
0x411090 ReadConsoleInputA
0x411094 lstrcatA
0x411098 WaitForSingleObject
0x4110a8 PeekNamedPipe
0x4110ac lstrlenW
0x4110b0 CreateProcessA
0x4110b4 DuplicateHandle
0x4110b8 GetCurrentProcess
0x4110bc CreatePipe
0x4110c0 GetVersion
0x4110c4 GetExitCodeProcess
0x4110c8 TerminateProcess
0x4110cc GetTickCount
0x4110d4 DeleteFileA
0x4110e0 lstrcpyA
0x4110e4 lstrcmpW
0x4110e8 GetCommandLineA
0x4110ec GetProcessHeap
0x4110f0 RemoveDirectoryA
0x4110f4 lstrcatW
0x4110f8 CreateDirectoryA
0x4110fc GetTempPathA
Library USER32.dll:
0x41115c GetDesktopWindow
0x411160 CharLowerA
0x411164 IsCharAlphaNumericA
0x411168 GetParent
0x41116c DialogBoxParamA
0x411170 CharToOemA
0x411174 MessageBoxA
0x411178 GetForegroundWindow
0x41117c GetWindowRect
0x411180 CopyRect
0x411184 OffsetRect
0x411188 SetWindowPos
0x41118c LoadStringA
0x411190 SetDlgItemTextA
0x411194 GetDlgItem
0x411198 SetFocus
0x41119c GetDlgItemTextA
0x4111a0 EndDialog
0x4111a4 wsprintfA
Library ADVAPI32.dll:
0x411000 RegQueryValueExA
0x411004 RegCloseKey
0x411008 RegEnumKeyExA
0x41100c RegOpenKeyExA
0x411010 RegQueryValueExW
Library ole32.dll:
0x4111ac CoUninitialize
0x4111b0 CoGetObject
0x4111b4 CLSIDFromProgID
0x4111b8 CoCreateInstance
0x4111bc CoInitialize
Library OLEAUT32.dll:
0x411108 VarBstrFromCy
0x41110c VarBstrFromR4
0x411110 VarBstrFromR8
0x411114 VarBstrFromDec
0x41111c LoadTypeLib
0x411120 SysFreeString
0x411124 VariantInit
0x411128 SysAllocString
0x41112c DispInvoke
0x411130 DispGetIDsOfNames
0x411134 SafeArrayGetUBound
0x411138 SafeArrayGetLBound
0x41113c SafeArrayGetDim
0x411140 SysStringLen
0x411144 SafeArrayAccessData

!This program cannot be run in DOS mode.
0Rich
`.rdata
@.data
window
console
silent
current
SOFTWARE\Microsoft\PowerShell
powershell.exe
SOFTWARE\Microsoft\PowerShell\
\ShellIds\Microsoft.PowerShell
powershell.exe
powershell.exe
usage: %s
ExeScript Host
ExeScript Host
%s\%s%s
WScript
Script:
Error:
Script:
Error:
ExeScript
\ScriptEngine
-Command -
$arg_ = @()
$arg_ +=
; Write-Output "<OK>"
read-host
clear-host
Everstrike Software
Warning
ExeScript
%s\%s%s
#ES.exe.pathname
#ES.exe.name
#ES.exe.path
%s\%s%s
#ES.script.pathname
#ES.script.name
#ES.res.path
#ES.script.path
%s\%s%s
%s\%d%s
<!-- ----- ExeScript Options Begin -----
----- ExeScript Options End ----- -->
> NUL
wscript.exe /B
wscript.exe
cscript.exe /B
cscript.exe
mshta.exe
%s &'%s'
%s &'%s'
%s "%s"
%s "%s"
StrStrA
StrChrA
StrStrIA
SHLWAPI.dll
lstrcpyA
lstrlenA
lstrcmpA
AllocConsole
GetStdHandle
WriteFile
WriteConsoleA
ReadFile
ReadConsoleA
MultiByteToWideChar
HeapFree
lstrcmpiA
WideCharToMultiByte
HeapAlloc
SetConsoleMode
GetConsoleMode
GetLastError
GetModuleFileNameA
ExitProcess
CreateThread
GetTimeFormatA
CloseHandle
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateDirectoryA
GetFileAttributesA
GetSystemDefaultLCID
GetModuleHandleA
ReadConsoleInputA
lstrcatA
WaitForSingleObject
SetConsoleCursorPosition
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
PeekNamedPipe
lstrlenW
CreateProcessA
DuplicateHandle
GetCurrentProcess
CreatePipe
GetVersion
GetExitCodeProcess
TerminateProcess
GetTickCount
SetCurrentDirectoryA
DeleteFileA
ExpandEnvironmentStringsA
GetCurrentDirectoryA
GetTempPathA
lstrcmpW
GetCommandLineA
GetProcessHeap
RemoveDirectoryA
lstrcatW
KERNEL32.dll
CharToOemA
MessageBoxA
GetForegroundWindow
wsprintfA
EndDialog
GetDlgItemTextA
SetFocus
GetDlgItem
SetDlgItemTextA
LoadStringA
SetWindowPos
OffsetRect
CopyRect
GetWindowRect
GetDesktopWindow
GetParent
DialogBoxParamA
CharLowerA
IsCharAlphaNumericA
USER32.dll
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExW
ADVAPI32.dll
CoCreateInstance
CLSIDFromProgID
CoGetObject
CoUninitialize
CoInitialize
ole32.dll
OLEAUT32.dll
@NcOJ8
9.smQ_
nb6zv
,D1( OP5"#
<}+-mT
.@rvT*h
X/GZ 6
QG?@**
{ WT5x
N3F2@w
#CfS&djy
,w0sCc
!&6!9=`
h}bu@K
(rZ~>
a1T:9>
5]qHg]
;5b.+h
.xd5E?
w`F2@w
{utRqU#nwd
`Jhfj]
0_4W51
14Y/#b
FX8.36
a$V%w/
Z[nQO[
tWD)kp
>V5&% VJ
_t4Hjw
7[{V7B0AC`
U$EV"d
u&'u\"
v^-dM
m0g.hH<8bY
kPd4Oz
`&~rU)}
({FFOT
rm3e2o
0>sw,Arr
pW~+v+
\-qE)[
l*YqXg
t=kg_r
QBD~TI
}K29>v
b.X2yA3
{v`^<Q
3br3wP
&$B'Lp
}v+gcS
|:\6fR7D
;A=Un]
p3*3ox
nU^ D3
a1|E7z
}0rk%
sT'C#p
-i4$w.
eZA)@P
SzXSSy
c]do)Ie@
R<oGl<
M8Db+_
NTr@PB
e+&{Cr:6
JasGG
|Zt{TYg
V<eWh3
?-1P&i
/7B@u^
()5H=[
1D}Xax
&G{-;x
ijTY7
^h~mgL
UUxC!9l
.`f`B}
"]deWvj
nokn;O5lZG
${i]Qk
r3%-$g[W
>WW1sM
7Zx-HY
c>b_CJa
X/4.th
bM* ~9
;X(vA{kb
(*H1Fu
I}u&s8M
zAtg"IA
ev?>WJ3
7?=FoT
(?!cr:
GmpEeNyB
j>;pk9
+D^2U)C
`f3={~
kcKXY _WD
y<:^F4{
x.b2`l
W^*GN)
IjB{oec
6qj[G+6
yq7d?x/
-AHS@J
d.7oS7`$FE$
WpDx qD*
lE+r/[
C>9:QS&
4FuFv=
&}EyS@U
<51f- fO
Vsyg0mWq
>/#tbM
AsH0nwo
C19+{Jl
({FFOT
!Yf7=ea>N
AAha5wS
h`&$A=
{xT%/
tm{!R:
^]Wq|
A4W#NXz,Q
-!&/js
>Kry&JO
*lup6F
5F;>f|
i-V!M!
Jk_H2f'
rE^/@!@
kyMQwL
%G,U/!
SPExTb
9mA<V]7u=}
_mTNM9
1F@2Xa
V>9J_x
;Q`(eg
TpV1Tc
`(J{Cm}
J$,Oe_K
%T=S&2
\T9PGZN
b\5!l9
bLL?LpJ
[)T7Xl
y@SOWB
Pl$04iQwW0
G`8l3
(idK{2
PT1*8A
3[liV;~
.nD)i
[|^Gdj
5(`~u}pQF
-0cl*:
oy`>:i
m0:Wy_
s*K:GL
5Z"g[,
B~qQut
%o$v}VVY
l9+:;+#
9vzNV=
oriujr
<p8q0l
Ujr8,[
Vc+_<G#w
+ TT3f7h.
Bkkd{
0S5.m}K
qZi/rt
fymG)$
AFS'Pe
i(/c"+
(I,NeL
UqjH@1%
^RrK.72
kS33G)
x#-B]q
4O~`1
XF$)y*[
^+5z3ySI
B]J O}
[VOh-pB
din}uw
z9M=pT
/p5j3\
gtsvp
twK4|;
2WY`B;
K#sB1,
"8zL<YzAU
5]3.CLT%
L!ja'N
[T`w1;<
uQpQ&W
aj8p!l-4
Ka6qa~
IL6IBt
2guL{P^V
aJiB5c
@NcOJ8
"^&gk' U
]Y&oXAb
zbIP{_
+-H M%
bH3RV_`v
o".)k
7+u^Vr
{oc!@7V
YZ~vHA
8NZWzzWF+
qM09'z
$Nb5BF
gf4`tMV
VBBu\e c
`&~rU)}
`F7l;%
r.M9!^
LZl.?:'
IVS(^##
QGvazs
L)f8Ks
s8,50\|f~
D0!1lZ
6]-?M-
IAHS_i
Iic3(|
B;;E$h,
gAq]yI?
CS&+Puy
B7(u:a
}{q(a6
)VCMT
SHUvc^
4';MBfc
3~L*'-
U)|N$xHb
/t)XQM
-kxmPQ
/h|#n-O$
/`|S}8
-WWA#f4^
V}$%uk#
-l gweGp
`(u1FGCI
,Govq`
)[1.gp
}|,)Cd
FA&H1"D
2[^A_Y
MTWdY>&X
^OkxXo
X{5>O6
~:OfeQ:)
<W%.<w
Daj?rwj
w6h jN
mUESK4Vl1z
[8xUES
bg@<>x
uN*)fL
;s9@R:
lm8%I5
2\j_SR0nBR
-}tZV
r.M9!^
wYSJ(g0
XiwlfJ
&^n!PT~
#|nnA^
`{a&x;
*CTB}^
rN^g<T
8L{~\
Jewnb
OVvW'S
<(Cihu
){B?k
${M=*o$#:
v$2p..
r1.s"Y2
p*e-e*
z5riRc_
v2;;})
P?si(vu*v
qYM6Eq
2Uq-pI
.gEtfbWj.
rMWGm.|W
qd?He jn
Y:4NaJ
.}!rI4
~dzD~%
3[liV;~
.nD)i
[|^Gdj
5(`~u}pQF
-0cl*:
oy`>:i
m0:Wy_
s*K:GL
5Z"g[,
B~qQut
%o$v}VVY
l9+:;+#
9vzNV=
oriujr
<p8q0l
Ujr8,[
1ZxSx/
1ZxSx/
din}uw
z9M=pT
/p5j3\
gtsvp
twK4|;
h0VxX#
hH|8'e
hH|8'e
hH|8'e
hH|8'e
s@(@PC
+Wm1ip
m<_;PG
r|,~!7
Ka6qa~
<)o~][T"
a$ Dcrw
7U|3qs
p&-8$
sx((cr
ufT8@bl
-0Sb-q
:E_Em.
5ZR7u;
_-i\)=
4f:2:,D
E3^$*I~
$p{DE0[Uz
2nq!0
Vc+_<G#w
X ^Uohez<
H*zYcn
+B'G8F
Z)r|T*5
|O7[Mr
T>JUBo&=9
vO)Y`~{?
|>KRT;
_$Q`cg?`
vO)Y`~{?
<y|v[Y
1s*Xlyq&
~-@|7o#
3U+)j4
h9{]B$
ufT8@bl
jWH\(e
_$Q`cg?`
k'^CG_-
7qaeL9e
-(~eeHI
kvqI@KO
w}T:,4
vO)Y`~{?
%UD^43
|>KRT;
_$Q`cg?`
ha0wy-VU{QF,L
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0"
processorArchitecture="X86" name="exescript" type="win32"/>
<description>ExeScript</description>
<!-- Identify the application security requirements. -->
<ms_asmv2:trustInfo xmlns:ms_asmv2="urn:schemas-microsoft-com:asm.v2">
<ms_asmv2:security>
<ms_asmv2:requestedPrivileges>
<ms_asmv2:requestedExecutionLevel
level="requireAdministrator"
uiAccess="false"/>
</ms_asmv2:requestedPrivileges>
</ms_asmv2:security>
</ms_asmv2:trustInfo>
</assembly>
PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
jjjjjjj
t(No description)
g-pass
WScript
ExeScript
MS Sans Serif
Cancel
The script is encrypted. Please enter the password:
RemoteCMD - 3.0
5The script is encrypted. Please enter your password:
That password is invalid.
]ExeScript is not installed. You can't use %s on this computer (Personal License limitations).
VS_VERSION_INFO
StringFileInfo
000004e4
Comments
CompanyName
Mark Collins
FileDescription
Remote Command Line 3.0
FileVersion
2. 0. 1. 5
LegalCopyright
www.markcollins.ca
ProductName
RemoteCMD3.0
ProductVersion
1. 0. 0. 1
VarFileInfo
Translation
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic Clean
MicroWorld-eScan Clean
CMC Clean
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Clean
CrowdStrike Clean
BitDefender Clean
K7GW Clean
K7AntiVirus Clean
BitDefenderTheta Clean
Cyren Clean
ESET-NOD32 Clean
Baidu Clean
APEX Malicious
Paloalto Clean
ClamAV Win.Trojan.Startpage-1991
Kaspersky Clean
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Generic@ML.92 (RDML:fH0Z+nop2/TfTUzyz6Lqzw)
Ad-Aware Clean
TACHYON Clean
Emsisoft Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition Clean
FireEye Generic.mg.70ca048c47aa97e9
Sophos ML/PE-A
Ikarus Clean
Jiangmin Clean
eGambit Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Microsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Clean
Cynet Clean
AhnLab-V3 Trojan/Win32.Qhost.C121763
Acronis Clean
McAfee Clean
MAX Clean
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Trojan.GenAsa!hKRyaSzRsss
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet Clean
Webroot Clean
Avast Clean
No IRMA results available.