Static | ZeroBOX

PE Compile Time

2021-04-08 03:38:04

PDB Path

C:\nimokotibat\bacohec.pdb

PE Imphash

1e9673fd053a72437930c0bf72ec70cb

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002ee50 0x0002f000 7.82553632412
.rdata 0x00030000 0x000042f8 0x00004400 4.20141717833
.data 0x00035000 0x000090c4 0x00001800 2.89581247784
.xak 0x0003f000 0x00000272 0x00000400 0.0
.rsrc 0x00040000 0x00006998 0x00006a00 6.04489951905

Resources

Name Offset Size Language Sub-language File type
AFX_DIALOG_LAYOUT 0x00045708 0x0000000e LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_CURSOR 0x00045718 0x00000130 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_ICON 0x000451e0 0x00000468 LANG_LATVIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x000451e0 0x00000468 LANG_LATVIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x000451e0 0x00000468 LANG_LATVIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x000451e0 0x00000468 LANG_LATVIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x000451e0 0x00000468 LANG_LATVIAN SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_STRING 0x00046358 0x0000063e LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_STRING 0x00046358 0x0000063e LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_STRING 0x00046358 0x0000063e LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_STRING 0x00046358 0x0000063e LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_ACCELERATOR 0x000456e0 0x00000018 LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_ACCELERATOR 0x000456e0 0x00000018 LANG_HUNGARIAN SUBLANG_DEFAULT data
RT_GROUP_CURSOR 0x00045848 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x00045648 0x0000004c LANG_LATVIAN SUBLANG_DEFAULT data
RT_VERSION 0x00045860 0x000001b4 LANG_NEUTRAL SUBLANG_NEUTRAL data
None 0x000456f8 0x0000000a LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library KERNEL32.dll:
0x430010 LoadResource
0x430014 HeapAlloc
0x430018 GetConsoleAliasA
0x430024 AddConsoleAliasW
0x43002c GetTickCount
0x430034 WriteConsoleW
0x430038 LCMapStringA
0x43003c SetLastError
0x430040 GetProcAddress
0x430044 VirtualAlloc
0x43004c GetAtomNameA
0x430050 LoadLibraryA
0x430054 LocalAlloc
0x430058 GetModuleFileNameA
0x43005c EraseTape
0x430060 FindNextVolumeA
0x430064 lstrcpyA
0x43006c CreateFileW
0x430070 ReadFile
0x430074 EncodePointer
0x430078 DecodePointer
0x43007c GetModuleHandleW
0x430080 ExitProcess
0x430084 GetCommandLineW
0x430088 HeapSetInformation
0x43008c GetStartupInfoW
0x430098 IsDebuggerPresent
0x43009c TerminateProcess
0x4300a0 GetCurrentProcess
0x4300a8 TlsAlloc
0x4300ac TlsGetValue
0x4300b0 TlsSetValue
0x4300b4 TlsFree
0x4300bc GetCurrentThreadId
0x4300c0 GetLastError
0x4300d0 SetHandleCount
0x4300d4 GetStdHandle
0x4300dc GetFileType
0x4300e4 RtlUnwind
0x4300e8 SetFilePointer
0x4300ec HeapFree
0x4300f0 CloseHandle
0x4300f4 LoadLibraryW
0x4300f8 WriteFile
0x4300fc GetModuleFileNameW
0x430104 HeapCreate
0x43010c GetCurrentProcessId
0x430114 GetCPInfo
0x430118 GetACP
0x43011c GetOEMCP
0x430120 IsValidCodePage
0x430124 Sleep
0x430128 WideCharToMultiByte
0x43012c GetConsoleCP
0x430130 GetConsoleMode
0x430134 CreateFileA
0x430138 SetStdHandle
0x43013c FlushFileBuffers
0x430140 HeapSize
0x430144 RaiseException
0x430148 LCMapStringW
0x43014c MultiByteToWideChar
0x430150 GetStringTypeW
0x430154 HeapReAlloc
0x430158 SetEndOfFile
0x43015c GetProcessHeap
Library USER32.dll:
0x430164 SetCursorPos
Library GDI32.dll:
0x430008 GetCharWidth32A
Library ADVAPI32.dll:
0x430000 CloseEventLog

!This program cannot be run in DOS mode.
`.rdata
@.data
@.rsrc
u.h4%C
f-00f=
j@j ^V
HHtXHHt
?If90t
<at,<rt"<wt
URPQQh
^SSSSS
QQSVWh
tRHtCHt4Ht%HtFHHt
to=h^C
tCHt(Ht
;t$,v-
UQPXY]Y[
t"SS9] u
<+t"<-t
+t HHt
PPPPPPPP
PPPPPPPP
R6Wa#6
~p_AnK
%ll`5
)] @)27u
N*P/8j
,)mT1$aci
1zHpI%
&}VxnU9
(Tr<: 3p
;_X^F.
i^x:l>4x
(V}M_UG
C73g({
C\nCJK
b](~\&f
sGv0<v
qd$}ISW
qgz#}g.
_kiw&<
=K\nKvf
&_P2Cp
kzRelx_
#&8=}i
k#Bi3Q
/3(lh1H\
<w+Hy6
7|AqE_
*nqu+<=
mrlegi_
!u#.dW
/r#Cv:dRq
N6hE7l
U7.EC`
eO1Yc5
Ohpb.A>
`g&/ x
0!lr&}D*Y
hD}[P!
Zd26j.1E
MR(2_nzi~
$mhn[%
wl~dBE
,*PL}u
Jx~9:9y
wr4V"f
(}`Kw9
Xgx1+`4
d%57~)
/|z3`>S&$
<ub|nm1
v= sq5
^7d5[rK
m4Hzh6
REa7<q
lYHULB
Y{VLqp^
_=F*H8.
>Xs#F)
9_ccm >
J;"6S"
2h$ _@
yY9r0L
GK3p:{*
!*gCoK^
v~ytq#
zi,f#M
(HWxHZ
cagzBF
W;lI@oFe
6DAAa,P
++[F"
4AtU2Fe
iX<;{j`S
8N^|#)
XDR; a1
v:L@bBb
H|Zy(i
AoP!$~Wu
c>]nvH
>- Yw
8]#s8vP
X|Z4xs
e B%~3
-IRjw"
`@JgBB
#6g+/J
Q57]K{
%_$FH_
?giVd'
,aB7Pa2
6C(sMn
*,8g`K
#lz`UD=
piP5cx
IB'j_#EL:9
\+FRx"
r+ml; 3
R{ff03
{0rb,
%&>l49
~Rp_8{
Ea+%"h
[4P6(T2(
C*4123
V*$l5Q
"Dy4fw
4S_N6_R
TzQ2Hs
QT2G]D
{y5o;/j
$YB` H7]K
<ox<|
[QhsR"
CgNmJq
Ypw_wsP
H-d:[M
(U\rQ[
c$b=m~OR
[-'[lS
nE\B.D
X0un?]
/=5D<|3
%uwECQ
aAh6ir@
_"ik{0
b-g"i_?k
5~aMbO^
E(ZCo%
x6M8Tg
_s%Xo"=TZ[
9uw.HZ
e%NG<~
eVz48B)
NV|EDx@
]}VZY2
GyZ@vY
)d8kA6y
E?x/=oRD
hin9L$
|xdA@f
h8';6yJ3`
Tjj-4U
)qvdWR3
/Ix`dh
Tf&1 fKo
-IhHO
WWl'vk
=Xas5-
w.VK+L
l.-S.x1
d)2IC
+_C_*P
New!0V_6
a]Gj`;
{eFg6>
F~\6AVez
\Mu,1H2
0@f(P:
T[G!h7
Mu:p^Ob2
S<K+|s
)w|1]E!+
aUk1pO
^LqNPo
y`aJa5
%5 hoYY
%jj-+V%f,
FZjWyjh
-$ZNVZc
u/b"HkI/1
PJzHN!
;Tn*kB
ly )"n
9 ODj
p7%i`K0
8HJv93
37B8|r
u>r]cI
qlW2*J
~v-y'l:
9c9z?P
}uk}4
2ZtJf/
'|O!Y$9
bs~tUg
2ObB$(D
J=\aG90Z
EXL-'/
Fd7A~f
<WEDp}60
\ 0IT
rr}/KMHa
-+Ea=Q
/,O)0DC_tk4We
@mKQzBW
X%5cgh
eo%"Q?
NacUp0
Se) ~_
M?GbnAS
JCZjxF
$&p[?K
tNy]h!3D
Eu?UwX
y)G=a
X?b\mH
Tn-GJ3
k:V#p$
:f'br,
%*%#]n
4PQ21u
9lVo{4,
\f8$dK
viJR1B
I,rQxm
OozgbX
:jf(Ah
>9Yi>6G_p
UtWOa1
w[>[cH
25pmh^m
@m_Y]e5+
jHt 5(a
X]/y6+
c}Io[EX
%F hk_
%f.gff
-n_|$4
E2ykO}
$ USQh\;
MgF{:l2
yg?CWEf~
kf^LnW
~kWd|Q
R*E}q>
xn&"Kx/
WO`L&K
;:rKDJ
a@Y94{
R:ElS~rYu
,MH<w9
2Ic<#D
QgP.OsP
a2%`@]t
Y[;U7A
]FFE2}
%JfI3'
DIAUd)
}/p>\Z
%rU7mj
&~xd3d
M=gQZe
kgQ4Q
. EHUs<
CorExitProcess
?uZEeu
?uZEeu
?UUUUUU
?UUUUUU
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
(null)
`h````
xpxxxx
UTF-16LE
UNICODE
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
`h`hhh
xppwpp
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
_nextafter
_hypot
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
1#QNAN
1#SNAN
VirtualProtect
kernel32.dll
LocalAlloc
Werayem retizekeyu ligubuno gohatocakiv xayabudapitib
C:\nimokotibat\bacohec.pdb
SetProcessAffinityMask
LoadResource
HeapAlloc
GetConsoleAliasA
SetEnvironmentVariableW
GetEnvironmentStringsW
AddConsoleAliasW
FlushConsoleInputBuffer
GetTickCount
SetConsoleCursorPosition
WriteConsoleW
LCMapStringA
SetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
GetAtomNameA
LoadLibraryA
LocalAlloc
GetModuleFileNameA
EraseTape
FindNextVolumeA
lstrcpyA
KERNEL32.dll
SetCursorPos
USER32.dll
GetCharWidth32A
GDI32.dll
CloseEventLog
ADVAPI32.dll
EncodePointer
DecodePointer
GetModuleHandleW
ExitProcess
GetCommandLineW
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetLastError
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
RtlUnwind
SetFilePointer
HeapFree
CloseHandle
LoadLibraryW
WriteFile
GetModuleFileNameW
FreeEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
CreateFileA
SetStdHandle
FlushFileBuffers
HeapSize
RaiseException
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
SetEndOfFile
GetProcessHeap
ReadFile
CreateFileW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
rBB}v]
Vn~{vt
%58~[RA||L?
IXZ{|81
=}}}cXL
Zvl~|Z[}
0L|l5|
W`o~}aW}
Rsu}XRL|
eb`}~^U
=Zk|YKa~k
p{z|`W{
]a|{rk
mscoree.dll
KERNEL32.DLL
(null)
Eruntime error
TLOSS error
SING error
DOMAIN error
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
- abort() has been called
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
CMicrosoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
WUSER32.DLL
((((( H
h(((( H
H
CONOUT$
fekovimofojituzuwivuwubajiyofori
pteyawuyozahamigusimuhobusokuveragen
ladubokomumajopovugavatezuko
AFX_DIALOG_LAYOUT
VS_VERSION_INFO
StringFileInform
090105a0
InternalName
bomgpiaruci.iwa
Copyright
Copyrighz (C) 2021, fudkagat
ProductVersion
15.54.32.31
VarFileInfo
Translation
gGovuginavoleji wumejes putepop jetujozuwawoxug levopexirexed wuboguvecey ziyiyo giyolugob nomotib yagis
.Lojo tifebihihopo mifibazotunewo gebedibofajolbFevu boxuloxapijah melum fizumisivifuzo vamawir peracacocubete dedahijaluyob femuxetegawoge ficeyi@Zipelokaj hac toru lon gehe yebopizecekin moka gum simo fuxegope2Dap tatikafadehibu fiduvigovido lozepe konazoreriw<Vosukuxixit tahacevada yitumogij pebuwoxipubac wifimaputazec
<Hewanurekig pecegeced hipufizowomoces zejahixevi yadatacusex
Rege ripoma8Hasuxecem feyidez bahoxuzukahoso fidediwubazisi vunifefa;Dopozafabayi feraturifa xuhiw depuvi dalubo molinig pixeniw+Hadigaxonabifon hiziyogadil cewaneca mazavo
1Yonufuwu zatuso fixeyajeraref miyuyix rosadi fehiANaziwokefek rijoyurogebetuc zekitosipudo cimoxirosur vewodat cidifNibufe deviwifawinop meduzuw vigob gosi likuwunirimiyuj waliwo lepexobetoj tiwasoxewosabi viduledehewutRufebipugine redukakazonexo lazubolunimizin neliberuwipayu suki yolelu mananeragi jerepizajo ligupifujiv fayurorisus
DHixibe kuxen jugediwuzaxexif jelijapux bik goramep fewakow focipiyuf
Mafuge
Xihenetimen
Sib tuve yepebow.Gaxoz tacucefebu zezonaponapocu figojexijunora
Vobazuhabimon hes codec<Wawozitaful vihowodo xuvegepoxo jule hepu kesevoxaw tugepiruJRoyixihir rukeboga cenilibivirepe hegoneko puxesuk zuxahehiri hahaz vacoce;Horenude foh yirika kizeferavibira vuzuzimoke jifejituhokoy2Somefupekiz fucokuluwa disatete neparug nojekucapeKCejude fufuju kihe jonasihayiba fegafo panaledabuleno bivivoj toxagalovubuc$Pemilorugugeha rekusemene piha zijux_Lilujidili coc tafog panogoy kisudepimev nugefewof fehebitemeger hikinagajox pemelokinuf ronabe#Yeyodup yihojejizuxahud vufumubutat/Zehogocotimehuw revim bawijifa jibobin kifurese>Vuf woregewaxofibe capopiwupubex xovokidecule ved fumu vifibowSRucahe mone xixeyiy lohalehix bihiwepa kinuy kasaxobanupugop yacutafi fawigas nugecTGewiro fezewuxasoxi xexifojituk zahojesucad fenejoyodojo xayi puti kiciweconir lovid
Antivirus Signature
Bkav W32.AIDetect.malware2
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Clean
FireEye Generic.mg.d57f5d014ef57dc1
CAT-QuickHeal Clean
McAfee Packed-GDV!D57F5D014EF5
Cylance Unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Clean
K7GW Hacktool ( 700007861 )
Cybereason malicious.aac9fd
BitDefenderTheta Gen:NN.ZexaF.34236.ou0@aCQPQhjI
Cyren W32/Kryptik.FOQ.gen!Eldorado
Symantec Packed.Generic.528
ESET-NOD32 Clean
Baidu Clean
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Clean
SUPERAntiSpyware Clean
Rising Malware.Heuristic!ET#96% (RDMK:cmRtazp5Qyyo6zjxgWq94qvZ2YQC)
Ad-Aware Clean
Sophos ML/PE-A
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Lockbit.dc
CMC Clean
Emsisoft Trojan.Crypt (A)
SentinelOne Static AI - Malicious PE
GData Clean
Jiangmin Clean
Webroot Clean
Avira Clean
MAX Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
ViRobot Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis suspicious
VBA32 suspected of Malware-Cryptor.Trac
ALYac Clean
TACHYON Clean
Malwarebytes Trojan.MalPack.GS
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
Ikarus Trojan.Win32.Crypt
MaxSecure Clean
Fortinet Clean
Avast Clean
CrowdStrike win/malicious_confidence_100% (D)
No IRMA results available.