Static | ZeroBOX

PE Compile Time

2020-12-07 01:36:43

PDB Path

C:\bofuciwesumure\fucizuxi-zubatepovome-vov\100\jexajawe.pdb

PE Imphash

38efc42584ffe235e8d11c10897bfaf8

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000388e0 0x00038a00 7.87138569638
.rdata 0x0003a000 0x00005c68 0x00005e00 4.74609916505
.data 0x00040000 0x00008ff0 0x00001800 2.92429565175
.kefiwiw 0x00049000 0x00000272 0x00000400 0.0
.rsrc 0x0004a000 0x000093c0 0x00009400 5.8357816934

Resources

Name Offset Size Language Sub-language File type
AFX_DIALOG_LAYOUT 0x00050e68 0x0000000e LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_CURSOR 0x00052868 0x000000b0 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_CURSOR 0x00052868 0x000000b0 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_CURSOR 0x00052868 0x000000b0 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_CURSOR 0x00052868 0x000000b0 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_CURSOR 0x00052868 0x000000b0 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x00050918 0x00000468 LANG_KANNADA SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00050918 0x00000468 LANG_KANNADA SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00050918 0x00000468 LANG_KANNADA SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00050918 0x00000468 LANG_KANNADA SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00050918 0x00000468 LANG_KANNADA SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00050918 0x00000468 LANG_KANNADA SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00050918 0x00000468 LANG_KANNADA SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x00050918 0x00000468 LANG_KANNADA SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_STRING 0x00052fe0 0x000003de LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_STRING 0x00052fe0 0x000003de LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_STRING 0x00052fe0 0x000003de LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_ACCELERATOR 0x00050e40 0x00000018 LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_ACCELERATOR 0x00050e40 0x00000018 LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_GROUP_CURSOR 0x00052918 0x00000022 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_CURSOR 0x00052918 0x00000022 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_CURSOR 0x00052918 0x00000022 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x00050d80 0x00000076 LANG_KANNADA SUBLANG_DEFAULT data
RT_VERSION 0x00052940 0x000001b4 LANG_NEUTRAL SUBLANG_NEUTRAL data
None 0x00050e58 0x0000000a LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library KERNEL32.dll:
0x43a000 HeapReAlloc
0x43a008 FindResourceExW
0x43a00c LoadResource
0x43a010 HeapAlloc
0x43a014 SetMailslotInfo
0x43a01c SetEvent
0x43a024 GetTickCount
0x43a028 TlsSetValue
0x43a02c GlobalAlloc
0x43a030 LoadLibraryW
0x43a034 InitAtomTable
0x43a038 FindNextVolumeW
0x43a03c WriteConsoleW
0x43a040 CreateActCtxA
0x43a048 GetProcAddress
0x43a04c VirtualAlloc
0x43a054 PrepareTape
0x43a058 GetAtomNameA
0x43a05c LoadLibraryA
0x43a060 WriteConsoleA
0x43a068 GetModuleFileNameA
0x43a070 AddConsoleAliasA
0x43a074 CreateFileW
0x43a078 HeapSize
0x43a07c DecodePointer
0x43a080 EncodePointer
0x43a084 GetCommandLineA
0x43a088 HeapSetInformation
0x43a08c GetStartupInfoW
0x43a09c SetHandleCount
0x43a0a0 GetStdHandle
0x43a0a8 GetFileType
0x43a0b8 IsDebuggerPresent
0x43a0bc TerminateProcess
0x43a0c0 GetCurrentProcess
0x43a0c4 RtlUnwind
0x43a0c8 GetLastError
0x43a0cc SetFilePointer
0x43a0d0 TlsAlloc
0x43a0d4 TlsGetValue
0x43a0d8 TlsFree
0x43a0e0 GetModuleHandleW
0x43a0e4 SetLastError
0x43a0e8 GetCurrentThreadId
0x43a0f0 HeapFree
0x43a0f4 CloseHandle
0x43a0f8 ExitProcess
0x43a0fc WriteFile
0x43a100 GetModuleFileNameW
0x43a108 WideCharToMultiByte
0x43a10c HeapCreate
0x43a114 GetCurrentProcessId
0x43a11c Sleep
0x43a120 GetConsoleCP
0x43a124 GetConsoleMode
0x43a128 GetCPInfo
0x43a12c GetACP
0x43a130 GetOEMCP
0x43a134 IsValidCodePage
0x43a138 CreateFileA
0x43a13c SetStdHandle
0x43a140 FlushFileBuffers
0x43a144 RaiseException
0x43a148 MultiByteToWideChar
0x43a14c LCMapStringW
0x43a150 GetStringTypeW
0x43a154 SetEndOfFile
0x43a158 GetProcessHeap
0x43a15c ReadFile
Library USER32.dll:
0x43a164 GetCursorPos

!This program cannot be run in DOS mode.
`.rdata
@.data
.kefiwiwr
@.rsrc
f-00f=
j@j ^V
HHtXHHt
?If90t
<at,<rt"<wt
URPQQh
^SSSSS
tRHtCHt4Ht%HtFHHt
tCHt(Ht
;t$,v-
UQPXY]Y[
tWItHIt9It
t"SS9] u
<+t"<-t
+t HHt
PPPPPPPP
PPPPPPPP
gC+2u,
LOVTqHd
p]6dwD
TUn/j1
HmG]S?,
x<Tb}.
peGGw!_Md
5WI(yvRo,
9i8}lEwlX=
"pi9VR
4-}cOn
g?zv8q
gc:Y:9I&
">9,`x
m/7Br 6^
;4F*T?
Eu(69M
MB~?G^,&
(WGn6rC/*
U3<UI0!
Bj'cJ;
</ }cl
2[""`
Ip~_PC
}atk>/
p<B.^)
`saRn0
'KUL{'}:N
?Z]PTD
"&PO=A
#q0,PEj(9
epO_aA
3Q1Fovg
2H`~[^
fc=~AG
"C2qT"^
K&|Lv~
C.LKAJ
!a>*0n
"f>T%pGZxd:o
Zj?[Gm
lIglRk
v#<yUBY
7]mk_Mb
nR,J/j
j@(=U'
{M12Mq
ZQ2,?
omV%dM
e;J{ez
`B?7\Z
hfEA$f
]$:2Ra
!pGX:Q
`mGke6q
)5@(SC
Fn2ugI
<"Hc)<
ifKf9R9G,
tJfUhg
j1\<j
'68rYR
{|E9("
|kZB&]
1An9ox
U4|48t~42
z]XO)XT
G''FhP
xdV),J;
ECypW
z0o;@1(
q%W m;w
Ib#:])
WA7!/g
VOch7_/b
8}~E.a
h xVKL
C>i}h
nGszot
9i^V<3
|Fvxrk
F2dw'+
evwk85
?Km6~7|
W8"%3'R
)\c{>s
XJ`sR*&
aYb-D
;~N%r,
0wPJ.2
#wDraX
m(.Dj0
h8XoS`
a6i_Yd)
a)I""k
>qR%$n
#2)VFE
,'VVeuD
-HLOxm
zob|C,
i+[)jw
>4x%k@
\EHs/iz
Le~.h
"1r%`:
L`OAFG3Z}'
3BYzz|
q@9U+
vU8pWB
p_0QAOjiU
Qw;yUh8
10<Y"[
:fjS).
Vy_o^,
Mu;sQpDS
rnl9~%D
OS-BZ(4
.8`={ez
iC.YJ d?
IRe{:cI
n0x[jc
HGiWU2`
96Xx&b
IJ)C1t
`E[7.L
HLp@Xh
XsB;M'P
O}cQ]Zs
*8IA_#(I
@4f}[<
|7XfOK3
n4i5(Q82fjC!*
n-E ;w
Ie -ub
0@a[zI
0<+%2/k\
]^vOde
8mGDE&
R-GrPn
(fD-qc
@$kSRx1;
qh3h#1
PKt\88
%QcZn=S
ZzueuuB
}K+]cK
h\ rr~c
09S/%x!
]Mzu4m
]=Esbdo
&ez3%hrr
K?3JyM
M<*_qf
Jj<:F/
F#}$*F
Q[Gt=Lx
?c&YQ)
qhC:YK
QV9.dN-
QF5?:}$
-Q9 ^5@
Y+:HLB
]kN`{U.
]&Cs?!
wYaB-o
6CEQAeQ
SaFnB
-CM.=|tS
qW4yYU
@&GS)h[
G'tlTDN
VIHks.d
.3Y^62
cJ~<}a
hpJ*/m
k6[Fywx
_}XiX%
&S?sh*
ln7\l
tF4po[
:;B7$@f
=]ENq"
qB/9gf8,
_T%:0
e(1.*
[@*+mz
%Jre3q^
jZ8lu@
869Tgk
x[dRpf-
]4&l!u
K1mA]lI
d^@|;m
WrT.`cs
K<)k`v
J2#hWH
k8":x<
*{R^^4FD
[X3B?e)
~+KqTyD
('xG`K
UKI+v'
^>0vW|
r+PQ_}
C\YJ=P1
Dzu7iKcL
DCLaYU:n
)? S(?g
W1F^]chD
vt}+mZ\q
Mr1o_Y
N$/_R
XM+%ji
;K#=?aW
D5jUd]
:X8S[D
5wnx/B
`[a/[U
~l}S c
?CoERT
:o7`_{E
]E(4^h
#2D8\"
u#FJ9!>
2xh#TF
1rKCK?@
gw1llR/
uj4|9C5Y
mX8lW
$BGN1#FLg
6.n&/l
s3<PQH
30fK;}S
TH5W:1
RkY^v
&QC;{$T
Q/JrwO
dp?y_b
ET@0*R
iRyP!!4
WN|UR)p#IU
JT=LPHV
}PK.1r
o<q!a,
#Gr/tGJ2
Ie)48r
a>n#)e
9gEh3Nd
oQ`N@U$
C29Zk+wEg(@
g[GCVL
iS#|)X
Y}/+)a\t73
3nr P]r>
iV#_|:'!5
7fU/MA!
9;p}#.
Qn(,tUdF
uL/*E=
Crdhme
/s+nHkR
&^(1cSWR
7( @.$1
oc(f"z
>. h;m
CZ"d9G
E=5\ +
%1Glz?"Is
;HW2dG
B0s`2B
Z<@D;\
{[[5PN;/
%ugZm\^QH
V-(rHF:
O|VZB
Q7b\~Lv
eJ@Dj90
OPg+@>S
s<~yq_
Q "!0p
c=d4K%
]4 K0o
KFo7w;
z#O+mynM_
^ +/dE
UL~n*+#[GoB-
yS)m.|)
6@\;b(
#o&y27Q
_.#3hG
d-H@E&
ABVcB.
|idwzA
&1kd&r9
ZgX)nd)
7dD7Tf
F4 Cf+zb
0t,}j=J:
D1 r?
}-ei3vlZ
,] \ks
(T_/l}
TYu+L 6
0:S6j#S
!lJn\4
?uZEeu
?uZEeu
?UUUUUU
?UUUUUU
(null)
`h````
xpxxxx
UTF-16LE
UNICODE
RUUUUU
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
`h`hhh
xppwpp
i^^?(>
Y:/(A6>
<GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
_nextafter
_hypot
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
1#QNAN
1#SNAN
tevoxoxatunayidevolowuwimikoyatehil
fememacuzehavudunuhigebutuda
VirtualProtect
kernel32.dll
LocalAlloc
C:\bofuciwesumure\fucizuxi-zubatepovome-vov\100\jexajawe.pdb
HeapReAlloc
FindFirstChangeNotificationW
FindResourceExW
LoadResource
HeapAlloc
SetMailslotInfo
GetEnvironmentStringsW
SetEvent
FlushConsoleInputBuffer
GetTickCount
TlsSetValue
GlobalAlloc
LoadLibraryW
InitAtomTable
FindNextVolumeW
WriteConsoleW
CreateActCtxA
BindIoCompletionCallback
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
PrepareTape
GetAtomNameA
LoadLibraryA
WriteConsoleA
SetEnvironmentVariableA
GetModuleFileNameA
GetProcessAffinityMask
AddConsoleAliasA
KERNEL32.dll
GetCursorPos
USER32.dll
DecodePointer
EncodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
RtlUnwind
GetLastError
SetFilePointer
TlsAlloc
TlsGetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapFree
CloseHandle
ExitProcess
WriteFile
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
SetStdHandle
FlushFileBuffers
RaiseException
MultiByteToWideChar
LCMapStringW
GetStringTypeW
SetEndOfFile
GetProcessHeap
ReadFile
HeapSize
CreateFileW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
?9BYB{
ZUJZZUZ
KZ`X"m`N-
<_
l -l
[ ,
, n6
',
,
"
S/(
<y
\( L
<
<<,
8|=LmIZmZW
G?})V8b9
iiiiii
iiiiii
iiiiiiiiiiii
iiiiiiiiii
iiiiii
iiiiiiiii
iiiiiiiiiiiii
iiiiiiii

(null)
KERNEL32.DLL
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
- abort() has been called
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
CMicrosoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
WUSER32.DLL
((((( H
h(((( H
H
CONOUT$
fekovimofojituzuwivuwubajiyofori
Zizepunuburam suji vagacux
Xemebaholisiriy
Sukoxuc gehesumeyubakes
AFX_DIALOG_LAYOUT
/ P6pL
,/KPip
/-P?pR
/ P6pL
,/KPip
/-P?pR
VS_VERSION_INFO
StringFileInform
080905a0
InternalName
bomgpiaruci.iwa
Copyright
Copyrighz (C) 2021, fudkagat
ProductVersion
15.54.32.51
VarFileInfo
Translation
gGovuginavoleji wumejes putepop jetujozuwawoxug levopexirexed wuboguvecey ziyiyo giyolugob nomotib yagis
.Lojo tifebihihopo mifibazotunewo gebedibofajolbFevu boxuloxapijah melum fizumisivifuzo vamawir peracacocubete dedahijaluyob femuxetegawoge ficeyi@Zipelokaj hac toru lon gehe yebopizecekin moka gum simo fuxegope2Dap tatikafadehibu fiduvigovido lozepe konazoreriw<Vosukuxixit tahacevada yitumogij pebuwoxipubac wifimaputazec
Rege ripoma8Hasuxecem feyidez bahoxuzukahoso fidediwubazisi vunifefa;Dopozafabayi feraturifa xuhiw depuvi dalubo molinig pixeniw+Hadigaxonabifon hiziyogadil cewaneca mazavo
1Yonufuwu zatuso fixeyajeraref miyuyix rosadi fehiANaziwokefek rijoyurogebetuc zekitosipudo cimoxirosur vewodat cidifNibufe deviwifawinop meduzuw vigob gosi likuwunirimiyuj waliwo lepexobetoj tiwasoxewosabi viduledehewutRufebipugine redukakazonexo lazubolunimizin neliberuwipayu suki yolelu mananeragi jerepizajo ligupifujiv fayurorisus
DHixibe kuxen jugediwuzaxexif jelijapux bik goramep fewakow focipiyuf
Mafuge
Xihenetimen
Sib tuve yepebow.Gaxoz tacucefebu zezonaponapocu figojexijunora
Antivirus Signature
Bkav W32.AIDetect.malware1
Lionic Clean
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan Clean
FireEye Generic.mg.863db22615785c83
CAT-QuickHeal Clean
McAfee Artemis!863DB2261578
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Clean
K7GW Hacktool ( 700007861 )
Cybereason malicious.a8e13c
BitDefenderTheta Gen:NN.ZexaF.34236.su0@ayBEVcpG
Cyren W32/Kryptik.FOQ.gen!Eldorado
Symantec Packed.Generic.528
ESET-NOD32 a variant of Win32/GenKryptik.FMYB
Zoner Clean
TrendMicro-HouseCall Clean
Paloalto Clean
ClamAV Clean
Kaspersky UDS:Trojan-Spy.Win32.Stealer.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Malware.Heuristic!ET#93% (RDMK:cmRtazpv7MU59KEC6+AWBOx0Et+i)
Ad-Aware Clean
Emsisoft Clean
Comodo Clean
F-Secure Clean
Baidu Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Lockbit.dc
SentinelOne Static AI - Malicious PE
CMC Clean
Sophos ML/PE-A
Ikarus Trojan.Win32.Crypt
GData Clean
Jiangmin Clean
MaxSecure Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis suspicious
VBA32 Malware-Cryptor.2LA.gen
ALYac Clean
MAX Clean
Malwarebytes Clean
Panda Clean
APEX Malicious
Tencent Clean
Yandex Clean
TACHYON Clean
eGambit Unsafe.AI_Score_89%
Fortinet Clean
Webroot Clean
Avast Clean
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.