Static | ZeroBOX

PE Compile Time

1992-06-20 07:22:17

PE Imphash

9f4693fc0c511135129493f2161d1e86

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
CODE 0x00001000 0x000072c0 0x00007400 6.52114932089
DATA 0x00009000 0x00000218 0x00000400 3.15169834056
BSS 0x0000a000 0x0000a899 0x00000000 0.0
.idata 0x00015000 0x00000864 0x00000a00 4.17385976895
.tls 0x00016000 0x00000008 0x00000000 0.0
.rdata 0x00017000 0x00000018 0x00000200 0.206920017787
.reloc 0x00018000 0x000005cc 0x00000600 6.43311735034
.rsrc 0x00019000 0x00001400 0x00001400 2.11456537601

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00019150 0x000010a8 LANG_RUSSIAN SUBLANG_RUSSIAN data
RT_RCDATA 0x0001a208 0x000000ac LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x0001a208 0x000000ac LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x0001a2b4 0x00000014 LANG_RUSSIAN SUBLANG_RUSSIAN data

Imports

Library kernel32.dll:
0x4150ec VirtualFree
0x4150f0 VirtualAlloc
0x4150f4 LocalFree
0x4150f8 LocalAlloc
0x4150fc GetVersion
0x415100 GetCurrentThreadId
0x415104 GetThreadLocale
0x415108 GetStartupInfoA
0x41510c GetLocaleInfoA
0x415110 GetCommandLineA
0x415114 FreeLibrary
0x415118 ExitProcess
0x41511c WriteFile
0x415124 RtlUnwind
0x415128 RaiseException
0x41512c GetStdHandle
Library user32.dll:
0x415134 GetKeyboardType
0x415138 MessageBoxA
Library advapi32.dll:
0x415140 RegQueryValueExA
0x415144 RegOpenKeyExA
0x415148 RegCloseKey
Library oleaut32.dll:
0x415150 SysFreeString
0x415154 SysReAllocStringLen
Library kernel32.dll:
0x41515c TlsSetValue
0x415160 TlsGetValue
0x415164 LocalAlloc
0x415168 GetModuleHandleA
Library advapi32.dll:
0x415170 RegSetValueExA
0x415174 RegOpenKeyExA
0x415178 RegCloseKey
Library kernel32.dll:
0x415180 WriteFile
0x415184 WinExec
0x415188 SetFilePointer
0x41518c SetFileAttributesA
0x415190 SetEndOfFile
0x415198 ReleaseMutex
0x41519c ReadFile
0x4151a4 GetTempPathA
0x4151a8 GetShortPathNameA
0x4151ac GetModuleFileNameA
0x4151b4 GetLocalTime
0x4151b8 GetLastError
0x4151bc GetFileSize
0x4151c0 GetFileAttributesA
0x4151c4 GetDriveTypeA
0x4151c8 GetCommandLineA
0x4151cc FreeLibrary
0x4151d0 FindNextFileA
0x4151d4 FindFirstFileA
0x4151d8 FindClose
0x4151dc DeleteFileA
0x4151e0 CreateMutexA
0x4151e4 CreateFileA
0x4151e8 CreateDirectoryA
0x4151ec CloseHandle
Library gdi32.dll:
0x4151f4 StretchDIBits
0x4151f8 SetDIBits
0x4151fc SelectObject
0x415200 GetObjectA
0x415204 GetDIBits
0x415208 DeleteObject
0x41520c DeleteDC
0x415210 CreateSolidBrush
0x415214 CreateDIBSection
0x415218 CreateCompatibleDC
0x415220 BitBlt
Library user32.dll:
0x415228 ReleaseDC
0x41522c GetSysColor
0x415230 GetIconInfo
0x415234 GetDC
0x415238 FillRect
0x41523c DestroyIcon
0x415240 CopyImage
0x415244 CharLowerBuffA
Library shell32.dll:
0x41524c ShellExecuteA
0x415250 ExtractIconA

This program must be run under Win32
.idata
.rdata
P.reloc
P.rsrc
YZ]_^[
YZ]_^[
_^[YY]
YZ]_^[
~KxI[)
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
_^[YY]
HBITMAP
YXZQRPR
R;P P|
IVXLCDMT
_^[YY]
_^[YY]
XH;XH~
9PD}-RP
PH9PL~
KH+KLQ
;CHRQ~
RP;P ~
tSPRQj
_^[YY]
QQQQQS
\PROGRA~1\
QQQQQQSVW
_^[YY]
QQQQQQS3
QQQQQQ
QQQQQQSV
Runtime error at 00000000
0123456789ABCDEF
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll
GetKeyboardType
MessageBoxA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
advapi32.dll
RegSetValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll
WriteFile
WinExec
SetFilePointer
SetFileAttributesA
SetEndOfFile
SetCurrentDirectoryA
ReleaseMutex
ReadFile
GetWindowsDirectoryA
GetTempPathA
GetShortPathNameA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocalTime
GetLastError
GetFileSize
GetFileAttributesA
GetDriveTypeA
GetCommandLineA
FreeLibrary
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CreateMutexA
CreateFileA
CreateDirectoryA
CloseHandle
gdi32.dll
StretchDIBits
SetDIBits
SelectObject
GetObjectA
GetDIBits
DeleteObject
DeleteDC
CreateSolidBrush
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
user32.dll
ReleaseDC
GetSysColor
GetIconInfo
FillRect
DestroyIcon
CopyImage
CharLowerBuffA
shell32.dll
ShellExecuteA
ExtractIconA
0"0*020:0B0J0R0Z0b0j0r0z0
4-595T5
8&8,848F8R8a8m8u8
9/9:9[9s9
<'<0<;<D<K<Z<a<
?2?\?e?u?}?
0(0@0L0T0k0z0
0,1P1n1~1
2$2u2|2
4#4+4O4o4
8A8Q8g8
9*929H9`9n9
9+:X:a:
< =T=\=g=
>N>R>X>\>a>h>n>v>
?%?/?7?=?K?f?{?
N0W0}0
466?6:7C7
<)<2<><E<
=/=;=B=L=V=m=~=
>/>@>J>R>Z>b>j>
?&?+?0?7?>?H?_?k?x?
0:0B0J0R0Z0b0j0r0z0
1"1*121:1B1J1R1Z1b1j1r1z1
2#202B2J2R2_2k2x2
3 323?3K3X3j3w3
4$4(4,484<4@4L4P4T4`4d4h4t4x4|4
9,;:;A;H;c;o;
:(;=;c;
=*=:=c=9>n>
1&151R1i1
:":U:t:
:2;H;b;
;Y<j<,=
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1t1
004080
1 1$1(1
dJUpJ(
:*5NOY
@sWtRcV
>O[Na[
}Ko<a%
HLD)`q
d@!F;h
64iLz7
zC7/E{RD
3ixT}*
0H7stD
?kMw\jj
9664JS
KKMe,
Sbhn3;
|rO@Sk[
m7l7&~
W5X]N<_
M#lqbww
|t}{+D
u\}0hu<
[P;Gj"
T_={'4
gd^XT<F(
4d07XP
8j0_Vd
@?P?Q-
JQ%d~5
f36;4of
Ez%?\YO
uktf$ir
N]CU}e
XW*/n[
Za *c2
/GxM6+
Tr8hV9
Ea'+lV
Yp[K$c
at(0Rh
GYZB[@
3JYO7v
9yYq$Q
gz<,2s
umCRK5
>6N-:kZ
;"/MAb7
^NO>gD
&MkV[{
~ ;]7g
zQ&eUt
~1rbf&
".[P'?
tewL-l
7o}9;j
>CCWy=
%$]Kq+=
~*+{2^
'fI#+q
]>`*,fH
1_IzQj
?'_ZzU
6CP5Du
2$.|cD
^e%(7`CE5
};Mu|Vc
.3n}_z
&Vf$'H
t[&+Si
L- 0~J
:Bs\2|c
zD"`8'
.bNZ$g
%+"A\Q#
-mm7Ix
rhdeWX
pJZ:\XJt[L
td!&_W
Cp)vjb
3Kr2F<
pXlhF^
X@$4#Z
aDG7Dt@
+Z~JA+
XdWVBQ
?_^9yl
fS_h.W
:^Ex)h_F0
` TB9g,"
Cg9x8aR
a>]J=^
G`}*de;O~
%o&_p:
R[~3}
OG8Ew*
Z6bfUFlfO
|T\_'b
LF$5@c
DNiU*:
V"@[^A
(@>!)g
+t.-PE
i,/b{H-
+f*#XB
296-u-C2|^
FNP%lj
/A526R#
f/ #1R
6@3A`Y
Z;ncaK
)HiSK0
HWSV{e
Uk>}E&t
#mYx=c
]@k?{[RS
-/T$i~
>S&TUL=
IO&AnS
oClIW'
nBf9<c
Cn6NbqH
(!K|E`
j,d8,k
wwCaal[A
WB4g1iDn
94$HR-<S\
&Kj:]w
SzX'M+U
CzOPQU
5qD>N-pw
op!h6[
[-`($
cA{&nAG
=4/39@
G9N!l)
`0gA2i)
r!b-OP
nF<nv]
>rX%sk
5.79e^W9
,5NOLv
j\RC%I
WV5wU~
I0&,=}
.B|F!.f
.,c~Q w=0P
"H%qF:g|
T33Q1
3D<gcdi
qqK{vqC
[RbxsF7
'c;Oul=
JfL8-W
B\6"gS
#,M)!-c$
HrEm]*.
^T{Bbm
ZE)QsO
oqNp!;O
WjcB`a)
Tt"foX
o<<\!_
Tpiv<o
G|LJ8,Ny
BM9}Z7
v')\c9
LD>I<]{
>"!0~\,L51x
\U)>wE
30Dvo~
`wh"(`
$?H&sUM
q69\@+k_
r0lvYM
76:4xR
\8i[@v
$pbF%BX
I%qd5:]
oMz6.B+e
xm1*T@
APhDA!G
xKZe>f
Ku@YnQ
(T21ty
r[>e*$
r-(Kxc(
'(p'QQ#C7
owe?f6
MyK.GI
!fQKJ$F
jN5GUr
&i+_H{
wVmT};
hn$ Z
Rhx1G7
&~FW1)
1BWx{HH
kBw}p/
;{Di'3
tn[,4X
#)tbfy
.A"dfh3
gY"!Dyu@U
;jcVUP
ujp)cUp
(4qc.K
Ak8/?#
.mt,*x
9Xa]W5G"pZ^
%/]9(G
0 uT??
qQuwd19.+q
r@p]My[5
]XCDE+
(2q+ve^f
a*(l(8L
?>pfH%6]w
MwkZM
/wa"-l4y
&l<n(K
55TJ3s
E|Qywj
GIf3}_0
@u_I,r
aA~S7&
w!*Pp^
9s,x$GyW
P>-i0F
:ZvMcU
:UFKYS?
?@<HNbn
!/.}M`
,jV#H)
`qL3?
>,)aii
=N*K4PD
MZM)K:XB
@8gX|o}<*
G0S7jyu
T.I\?t
o9Y266
_S/<Wo
ryR9EvD#
rX]6c-
uB9k~K
r^53e)
dQ%b6M?%$s
kR&v(c
c7 NRp
7O zf"
97oEU0
%UALKY3}O9C
r&3S3J
j4,iR)
}\TNTf
Q90:.
r&Zj}O
}q+Ps[
,(s);A
w&vq<c
[PVga2
C%dZuD
`X11nuu'b
Gt9fh<
H/4H~q
=$2hm
"_YVYi
^* ;~*
-)5frb
jr3n>@R
<PN'^c
A/6FmKAp
C+op}=
r}q&zI
DPB6Ads<
C}-l]oG
m-:E1J
IQr#@G
'fni`z
R}><o<
E)Uz0c
+=>\lD
yqta4i
}IYt|A
E61+Po
tk%1I@
__>x&2ib
k_8SbV
#is2*Z
sD5=`!P
}l$y73
G,C)Z^*3
xks4N<F
WokFte
h\ad/R
R^1u@M
&gc>[Z
^*tx(6{
^CUY+#
*~kHy54
7'E#BQu
rC!$\
9xwW7b7.kw
rANJtV
mRl:s9v
IRu,c0
XF:SGV
|w GKv
%>4hnk
T_=QpZw
eH`tmB
z{FRl/&
D%mj:?
dc{H&Qc
O(0}`
0W[XJ%
aSDP)o
)aY|2<oA
UVEg)"Ao
xZ&}#x
x1:vX1"
+5KpH%
yBe_6J
mf7,b&m
gN'ra"V
{Pm#\!
QAT\u3
/J~K$p[
.#cqZ=
VWl`txf
8I&X3Z
cA7<h'
s495l?B
SQSSSPW
v#Vhn+@
Instu`
softuW
NulluN
j@Vh`?B
8NCRCu
> _?=t
D$ Pj(
D$(Ph,
D$,SPS
Vj%SSS
SWSh$s@
SWhBs@
D$(+D$ SSP
D$0+D$(P
PPPPPP
<v"Ph
UXTHEME
USERENV
SETUPAPI
APPHELP
PROPSYS
DWMAPI
CRYPTBASE
OLEACC
CLBCATQ
RichEdit
RichEdit20A
RichEd32
RichEd20
.DEFAULT\Control Panel\International
Control Panel\Desktop\ResourceLocale
[Rename]
Software\Microsoft\Windows\CurrentVersion
\Microsoft\Internet Explorer\Quick Launch
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
ReadFile
WriteFile
GetPrivateProfileStringA
WritePrivateProfileStringA
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
lstrcmpA
lstrcmpiA
CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
SetFileAttributesA
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrcatA
GetSystemDirectoryA
KERNEL32.dll
EndPaint
DrawTextA
FillRect
GetClientRect
BeginPaint
DefWindowProcA
SendMessageA
InvalidateRect
EnableWindow
LoadImageA
SetWindowLongA
GetDlgItem
IsWindow
FindWindowExA
SendMessageTimeoutA
wsprintfA
ShowWindow
SetForegroundWindow
PostQuitMessage
SetWindowTextA
SetTimer
CreateDialogParamA
DestroyWindow
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
USER32.dll
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
GDI32.dll
SHFileOperationA
ShellExecuteA
SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHELL32.dll
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
SetFileSecurityA
ADVAPI32.dll
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
COMCTL32.dll
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
ole32.dll
verifying installer: %d%%
Installer integrity check has failed. Common causes include
incomplete download and damaged media. Contact the
installer's author to obtain a new copy.
More information at:
http://nsis.sf.net/NSIS_Error
Error launching installer
... %d%%
SeShutdownPrivilege
NSIS Error
Error writing temporary file. Make sure your temp folder is valid.
%u.%u%s%s
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VERSION
SHGetFolderPathA
SHFOLDER
SHAutoComplete
SHLWAPI
SHELL32
InitiateShutdownA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyExA
ADVAPI32
GetUserDefaultUILanguage
MoveFileExA
GetDiskFreeSpaceExA
SetDefaultDllDirectories
KERNEL32
*?|<>/":
%s%s.dll
wwwwwwwxp
wwwwwwww
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.51</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
NullsoftInstsf
/{x3z;
:KWZ}o
J{k>Tx
AG*9bxw_
mgIIle
Df'[ZU
6_"~()
y3'Vxp
fFGH%m
1mrKY
#h?%3p%Z
DVCLAL
PACKAGEINFO
MAINICON(
MS Shell Dlg
MS Shell Dlg
msctls_progress32
SysListView32
MS Shell Dlg
Antivirus Signature
Bkav W32.HanGu.PE
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Win32.Nestha.C
FireEye Generic.mg.931568b982ac42dd
CAT-QuickHeal W32.Neshta.B
McAfee W32/HLLP.41472
Cylance Unsafe
VIPRE Virus.Win32.Neshta.a (v)
Sangfor Virus.Win32.Neshta.a
K7AntiVirus Virus ( 00556e571 )
BitDefender Win32.Nestha.C
K7GW Virus ( 00556e571 )
Cybereason malicious.982ac4
BitDefenderTheta AI:FileInfector.841243EC0E
Cyren W32/HLLP.EPJG-6217
Symantec W32.Neshuta
ESET-NOD32 Win32/Neshta.B
Baidu Win32.Virus.Neshta.a
APEX Malicious
Paloalto Clean
ClamAV Win.Trojan.Neshta-157
Kaspersky Virus.Win32.Neshta.b
Alibaba Clean
NANO-Antivirus Virus.Win32.Neshta.fnxshx
ViRobot Win32.Neshta.Gen.A
Rising Win32.Agent.dc (CLASSIC)
Ad-Aware Win32.Nestha.C
Emsisoft Win32.Nestha.C (B)
Comodo Win32.Neshta.B@3z07
F-Secure Clean
DrWeb Win32.HLLP.Neshta
Zillya Virus.Neshta.Win32.2
TrendMicro PE_NESHTA.A
McAfee-GW-Edition BehavesLike.Win32.HLLP.dc
CMC Clean
Sophos ML/PE-A + W32/Neshta-D
Ikarus Virus.Win32.Neshta
GData Win32.Nestha.C
Jiangmin Virus.Neshta.b
MaxSecure Virus.Neshta.B
Avira W32/Delf.I
MAX malware (ai score=89)
Antiy-AVL Trojan/Generic.ASVirus.19F
Kingsoft Clean
Gridinsoft Virus.Win32.Neshta.zv!s1
Arcabit Win32.Nestha.C
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Virus:Win32/Neshta.B
Cynet Malicious (score: 100)
AhnLab-V3 Win32/Neshta
Acronis suspicious
VBA32 Virus.Win32.Neshta.b
ALYac Win32.Nestha.C
TACHYON Clean
Malwarebytes MachineLearning/Anomalous.96%
Panda W32/Neshta.C
Zoner Virus.Win32.19514
TrendMicro-HouseCall PE_NESHTA.A
Tencent Virus.Win32.Neshta.a
Yandex Trojan.GenAsa!Mo0tdcmmg3o
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_100%
Fortinet W32/Generic.AC.171!tr
Webroot Clean
AVG Win32:Apanas [Trj]
Avast Win32:Apanas [Trj]
CrowdStrike win/malicious_confidence_100% (D)
No IRMA results available.