Static | ZeroBOX

PE Compile Time

2008-11-16 11:29:46

PE Imphash

fd2a350e6b9d34ec5cf88c61afb9d41f

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00017944 0x00018000 7.01576469652
.data 0x00019000 0x00000b80 0x00001000 0.0
.rsrc 0x0001a000 0x00004562 0x00005000 4.60473065073

Resources

Name Offset Size Language Sub-language File type
DATA 0x0001aa74 0x00003aee LANG_ENGLISH SUBLANG_ENGLISH_US MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
RT_ICON 0x0001a534 0x00000128 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0001a534 0x00000128 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0001a534 0x00000128 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0001a504 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0001a1a0 0x00000364 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library MSVBVM60.DLL:
0x401000 None
0x401004 _CIcos
0x401008 _adj_fptan
0x40100c __vbaVarMove
0x401010 __vbaFreeVar
0x401014 __vbaStrVarMove
0x401018 __vbaFreeVarList
0x40101c None
0x401020 __vbaEnd
0x401024 _adj_fdiv_m64
0x401028 __vbaFreeObjList
0x40102c None
0x401030 _adj_fprem1
0x401034 __vbaRecAnsiToUni
0x401038 None
0x40103c __vbaStrCat
0x401040 __vbaSetSystemError
0x401048 None
0x40104c _adj_fdiv_m32
0x401050 None
0x401054 __vbaAryDestruct
0x401058 None
0x40105c None
0x401060 __vbaObjSet
0x401064 __vbaOnError
0x401068 None
0x40106c _adj_fdiv_m16i
0x401070 None
0x401074 __vbaObjSetAddref
0x401078 _adj_fdivr_m16i
0x40107c None
0x401080 None
0x401084 None
0x401088 _CIsin
0x40108c __vbaErase
0x401090 None
0x401094 __vbaChkstk
0x401098 None
0x40109c EVENT_SINK_AddRef
0x4010a0 None
0x4010a4 __vbaStrCmp
0x4010a8 __vbaVarTstEq
0x4010ac __vbaI2I4
0x4010b0 __vbaObjVar
0x4010b4 DllFunctionCall
0x4010b8 None
0x4010bc _adj_fpatan
0x4010c0 __vbaRedim
0x4010c4 __vbaRecUniToAnsi
0x4010c8 EVENT_SINK_Release
0x4010cc _CIsqrt
0x4010d4 __vbaExceptHandler
0x4010d8 None
0x4010dc _adj_fprem
0x4010e0 _adj_fdivr_m64
0x4010e4 None
0x4010e8 __vbaFPException
0x4010ec None
0x4010f0 __vbaDateVar
0x4010f4 None
0x4010f8 None
0x4010fc _CIlog
0x401100 None
0x401104 __vbaErrorOverflow
0x401108 __vbaFileOpen
0x40110c __vbaNew2
0x401110 None
0x401114 _adj_fdiv_m32i
0x401118 _adj_fdivr_m32i
0x40111c __vbaStrCopy
0x401120 __vbaI4Str
0x401124 __vbaFreeStrList
0x401128 __vbaDerefAry1
0x40112c _adj_fdivr_m32
0x401130 _adj_fdiv_r
0x401134 None
0x401138 None
0x40113c __vbaVarTstNe
0x401140 None
0x401144 __vbaLateMemCall
0x401148 __vbaStrToAnsi
0x40114c __vbaVarDup
0x401150 __vbaStrComp
0x401154 None
0x401158 None
0x40115c None
0x401160 __vbaVarCopy
0x401164 _CIatan
0x401168 __vbaStrMove
0x40116c None
0x401170 None
0x401174 _allmul
0x401178 None
0x40117c _CItan
0x401180 None
0x401184 _CIexp
0x401188 __vbaFreeObj
0x40118c __vbaFreeStr
0x401190 None

!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
BECROAK
!w\C0m
nonsup
HScroll2
HScroll1
Combo1
Nonco6
Timer1
Timer2
Jellicode3
fremtid
Gensta
Agstf9
BLINDSM
Pldereden2
Nonpoint
DROGIST
FABRIKSFR
DYSFASIG
tubulat
Omstilli4
Scenefunk1
DIALOGIS
PARTIPOLI
Anbrin7
Unforcefu
LIFTERABS
overskr
hvislel
Suckab
forest
teocal
helsidesa
equalise
SPISEKOR
Bebyrde6
Recoup
COPLOTHN
Agtpa1
Udtre5
Konfer
Twatsopht8
dunstfr
Ilford
ABSCIS
Frame1
Mousey8
Georgis2
U
DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
*jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj
Hx33333333333333333333333333333333333333333333333333
=DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
'X88888888888888888888888888888888888888888888888888888888888888
(;(guD
Fmbj\
83h(Na
elnBec
nmD^/C
ecZs$3
c2h Ua
$9,,QG
paP/^h
a3h(ya
dcj80a
x&ec/C
,QGt"?
qcj0Ca
elf\dc
ecj(*a
ec/F?d
ecj0&a
FcGxJJr
$$ //]x
=:7=,IG
RXnCdc
I!:,l1/D6
ecj(Za
rG>7@C
Xod0vlg
:/EMz1
!8yI5/Z
1!b^)FR
e#ec/@
elgtdc
D7Vl]aC/[
ech(Ya
/I7L!p4
*\/A5>n
*o#V|>
:hZf3dc
ec$(9a
/\T@I}Cj
ec/Ep5
ec/I$,
ecl(Qb
ec/\$O
JqP'BjG
R^l(Qb
qS,QGL
t,QG/,
ny#;[E
=hbkeb
ec/G'8F
?1h8[a
YiA,QG
PH\YYq,
G{,aG|
b_;%)[
ec/\I`bh
v1p/EG
gB\k1/\
ecbjea
ecbjea
ec/E:.*
t_eMWa
8/@ mD
u2)jl4
A|j0qa
/BF1q2WC,`Y
ecj 6a
ec/[lWE
p>kj,.
ec/F+W
(HWRsV
ecj2uk
ech03a
8/Kz< ,
ech2uo
AP"m/H5
.G^XD0
ech2ak
ev#SSZ
QcR,QG
j,IGVmQ;j
ech2ek
1&;GbV%c
elgdec
qZ9F)Z;
,aG4e{
xcP~lf-
ec`jE[!$
@V,QGr
elf:bc
b["5x4
jk3Z3&
ecj0-a
2y0h0-a
VyjV"0
e[:&('h8ub
4rY,QG
d,IGNf;{gA]
kZ!,QG
,IG<l
,IGan2
0" +gP
gZHwhD
ecj(Ib
AKh0%b
eccT=3h(
b[[2,M
WZ",QGF^
!#::j
E%b&M5
eZ3&9G
[!oicK&
`ka"j0Ia
YGi(Qa
]mh /a
o[O>AN.A.
R#oacfu
R0k Dp
0RQkgt
X(auDR*)
G&=K$(
[!oach
eZ E#c
ec$4J0
jB;}bC2
q+Wigl
ec2!UDb
+XMV]z
/q~_v^
bWqxbo
$=Kh0]b
c6-U;c
{Z9k%k
eck(Pa
&6e`noR*
~gQ$ gn
$EbZ>OY
Y^,&f/`_AcR
Aggef'
&6b`We
bG)<<X
:}$ j }a
F*`ou/j
e+`iM*bU
clf'ec
k!pn'
*bQCQ8
zb\U|$J
P&@N;[
\Zftdc
elfXdc
TT&adff
bWg}fe
bVk>] j
VB5!6&*
Indek9
lokalplan
BECROAK
BECROAK
nonsup
SLAGTER
Agtpa1
Konfer
WFHw\C0m
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
Timer2
Scenefunk1
LIFTERABS
Gensta
hvislel
Georgis2
FABRIKSFR
forest
DIALOGIS
Nonpoint
COPLOTHN
Frame1
Ilford
Combo1
fremtid
equalise
HScroll1
Twatsopht8
HScroll2
tubulat
BLINDSM
Bebyrde6
kernel32
IsWow64Process
advapi32.dll
LookupAccountNameA
user32
SetSystemCursor
wininet.dll
FtpFindFirstFileA
FlashWindow
SendMessageA
winmm.dll
waveInPrepareHeader
GetPrivateProfileStringA
shlwapi.dll
PathIsPrefixA
WritePrivateProfileStringA
CloseWindow
CreateThread
GetPropA
QueryPerformanceFrequency
MODIFIABILITY
Sjlesrgerisk4
TERRITS
VBA6.DLL
__vbaVarTstEq
__vbaErase
__vbaVarCopy
__vbaLateMemCall
__vbaFreeObjList
__vbaObjVar
__vbaObjSetAddref
__vbaAryDestruct
__vbaDateVar
__vbaFileOpen
__vbaErrorOverflow
__vbaOnError
__vbaEnd
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaI2I4
__vbaObjSet
__vbaDerefAry1
__vbaRedim
__vbaStrComp
__vbaFreeVarList
__vbaVarMove
__vbaI4Str
__vbaStrCmp
__vbaVarDup
__vbaVarTstNe
__vbaStrCat
__vbaStrVarMove
__vbaStrCopy
__vbaFreeStr
__vbaFreeObj
__vbaHresultCheckObj
__vbaNew2
__vbaFreeVar
__vbaStrMove
__vbaFreeStrList
__vbaSetSystemError
__vbaStrToAnsi
user32
GetWindowTextA
GetWindowTextLengthA
VirtualProtect
WritePrivateProfileSectionA
WriteConsoleA
Myreflittiges9
shambolic
PSEUDOGYNE
Erstatningssag5
Snekdernes6
preventively
Fylogenesens
MELANOMA
Impregns
Internality
ORDSKIFTERS
UNCASES
STERILIZATION
jLh|/A
j,h<1A
jLh|/A
j(h<1A
jLh|/A
j(h<1A
h /]1V
jLh|/A
j(h<1A
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaErase
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
_adj_fpatan
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaDateVar
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaStrComp
__vbaVarCopy
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
untimorouspligtigeslrk
Forwardudvalgsb6
daaseoplukkershalvhedens
Fleylandmogigraphiatrdokker5
fdevaremyndighedernevugge
Militariseredesynk
Gradometeruncumbrou
UNHEAVENLYSM
Debatfilme
terroriseringers
Pisgah
Flinthearted4
Orddelingers7
lseadgangs
anmeldereksemplars
Twentyeight8
Tepidly7
Undertitlerne7
prorebel
QUAALUDES
14:14:1
Unenviably9
Brancheorganisationsarbejdernes4
myrtekrans
Indskar8
saltvandsindsprjtningens
Tambouret
affyrings
duopol
STILANALYSERNE
Tjenestegringen
Brugerstatus4
udmundede
JURYMEN
impeevish
Siksakket
saunderswood
Absinten
elevatorskakter
POSTENDES
Choroid
Havesyg7
Katrineblommen3
Steenas8
Tilkastes
epizoarian
g7j6w5qWMha1SgBIYBW0v5wofq67MXqD3Q127
Novelette3
Out of stri
Substantivises
Abetted9
Toller
NEDSAENKET
Intervenerer8
PUNCTIFORM
DEGAUSSING
FREDERIKSBORGS
Tragikomediens
Kokotte
SAMKRSELENS
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
040904B0
Comments
CealNetworks, Inc.
CompanyName
CealNetworks, Inc.
FileDescription
CealNetworks, Inc.
LegalCopyright
CealNetworks, Inc.
LegalTrademarks
CealNetworks, Inc.
ProductName
CealNetworks, Inc.
FileVersion
ProductVersion
InternalName
Indek9
OriginalFilename
Indek9.exe
Antivirus Signature
Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.GuLoader.a!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.47222269
FireEye Generic.mg.df43d260e856d3e2
CAT-QuickHeal Clean
ALYac Trojan.Agent.GuLoader
Cylance Unsafe
VIPRE Clean
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 005891ff1 )
BitDefender Trojan.GenericKD.47222269
K7GW Trojan ( 005891ff1 )
Cybereason Clean
BitDefenderTheta Gen:NN.ZevbaF.34218.hm0@ae@phHgi
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.EQII
Baidu Clean
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky Trojan-Downloader.Win32.GuLoader.ep
Alibaba TrojanDownloader:Win32/GuLoader.ba66fb97
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Ad-Aware Gen:Variant.Razy.970238
Emsisoft Trojan.GenericKD.47222269 (B)
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Fareit.ch
CMC Clean
Sophos Mal/Generic-S + Troj/Zbot-PNS
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Razy.970238
Jiangmin Clean
MaxSecure Clean
Avira TR/Injector.gpdfz
MAX malware (ai score=85)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Trojan.Win32.Downloader.sa
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Sabsik.C4714230
Acronis Clean
McAfee GenericRXAA-FA!DF43D260E856
TACHYON Clean
VBA32 Clean
Malwarebytes Trojan.GuLoader
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0CJK21
Tencent Win32.Trojan.Razy.Wtnf
Yandex Clean
Ikarus Trojan.Win32.Injector
eGambit Unsafe.AI_Score_99%
Fortinet W32/EQII!tr
Webroot Clean
AVG FileRepMalware
Avast FileRepMalware
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.