Static | ZeroBOX

PE Compile Time

2021-11-03 21:16:05

PE Imphash

ccdf79216449388cf5a36d38a385d866

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00007e8c 0x00008000 4.52365399664
.rdata 0x00009000 0x0006299e 0x00063000 7.51543978168
.data 0x0006c000 0x00006e61 0x00005000 5.54885218107
.rsrc 0x00073000 0x000003e8 0x00001000 1.04372524527
.reloc 0x00074000 0x00000d5c 0x00001000 5.55719419763

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00073060 0x00000388 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library IPHLPAPI.DLL:
0x1000903c GetInterfaceInfo
Library COMDLG32.dll:
0x10009014 ReplaceTextW
0x10009018 ChooseFontW
Library msvcrt.dll:
0x10009100 realloc
0x10009104 memset
Library WININET.dll:
Library USER32.dll:
0x100090d0 DefWindowProcW
0x100090d4 MapVirtualKeyA
0x100090d8 GetWindowPlacement
0x100090e4 GetMonitorInfoW
Library ADVAPI32.dll:
0x10009000 RegEnumKeyA
0x10009004 SaferIdentifyLevel
Library SETUPAPI.dll:
Library WINMM.dll:
0x100090f4 midiInPrepareHeader
0x100090f8 midiOutGetDevCapsW
Library OLEAUT32.dll:
0x10009084 VarI4FromCy
0x10009088 VarBstrFromR4
0x1000908c VarBoolFromR4
Library GDI32.dll:
0x10009034 Polyline
Library MSACM32.dll:
0x1000907c acmDriverClose
Library POWRPROF.dll:
0x10009094 WriteGlobalPwrPolicy
Library ESENT.dll:
0x1000902c JetGetBookmark
Library KERNEL32.dll:
0x10009044 GetCurrentActCtx
0x10009048 TerminateProcess
0x1000904c GetModuleHandleW
0x10009050 GetProfileSectionA
0x10009054 CreateHardLinkW
0x10009058 GetComputerNameW
0x1000905c GetTempPathW
0x10009060 GetProfileStringA
0x10009064 GetModuleHandleA
0x10009068 GetModuleFileNameW
0x1000906c DeleteAtom
Library CRYPT32.dll:
0x10009024 CertControlStore
Library MPRAPI.dll:
0x10009074 MprConfigServerConnect
Library SHELL32.dll:
0x100090ac SHParseDisplayName
Library COMCTL32.dll:
0x1000900c PropertySheetW
Library SHLWAPI.dll:
0x100090b4 StrCatBuffW
0x100090b8 PathAppendA
0x100090bc PathGetDriveNumberW
0x100090c0 StrRetToBufA
Library Secur32.dll:
Library ole32.dll:
0x1000910c OleIsRunning

Exports

Ordinal Address Name
1 0x1006b1ac DmlooirmFert
`.rdata
@.data
@.reloc
L$2L$
L$f;D$
D$#:D$U
I#D$Lf
D$L#D$L
D$L9|$L
ZO4Y"^
.JoaI7
jx'LhTvp
GRV]_Ze+>J84)2
w>]&ni?a!JxkmqIL&f
;DZ/Q8/<
D$(W~vz
f;D$nw
D$>f%-
t$$+D$,)
D$,9D$@
D$`#D$`
T$`+T$`
D$P502/I
D$&f-G,f
bpyXJ+
j*T4M`
j*T4Nt
XJ*T4M`
eXi*T4M
pyXj*T
V.rSay
XbpeX6*T
X6*T4.
+T4.`Q
bpyX6+
jlbpyXj*
pyXj+T
i*T5Nt
eXJ+T5Nt
bpyXJ+
j*T4M`
j*T4Nt
XJ*T4M`
eXi*T4M
pyXj*T
V.rSay
XbpeX6*T
X6*T4.
+T4.`Q
bpyX6+
jlbpyXj*
pyXj+T
i*T5Nt
eXJ+T5Nt
bpyXJ+
j*T4M`
j*T4Nt
XJ*T4M`
eXi*T4M
pyXj*T
V.rSay
XbpeX6*T
X6*T4.
+T4.`Q
bpyX6+
jlbpyXj*
pyXj+T
i*T5Nt
eXJ+T5Nt
bpyXJ+
j*T4M`
j*T4Nt
XJ*T4M`
eXi*T4M
pyXj*T
V.rSay
XbpeX6*T
X6*T4.
+T4.`Q
bpyX6+
jlbpyXj*
pyXj+T
i*T5Nt
eXJ+T5Nt
bpyXJ+
j*T4M`
j*T4Nt
XJ*T4M`
eXi*T4M
pyXj*T
V.rSay
XbpeX6*T
X6*T4.
+T4.`Q
bpyX6+
jlbpyXj*
pyXj+T
i*T5Nt
eXJ+T5Nt
bpyXJ+
j*T4M`
j*T4Nt
XJ*T4M`
eXi*T4M
pyXj*T
V.rSay
XbpeX6*T
X6*T4.
+T4.`Q
bpyX6+
jlbpyXj*
pyXj+T
i*T5Nt
eXJ+T5Nt
bpyXJ+
j*T4M`
j*T4Nt
XJ*T4M`
eXi*T4M
(j+45N
j+_zVM
mGOm51
1DSN}L
"-.*$}
\oA!_8XV
_LkEU`
/`m=qc{
A!_YXV
VJ[o|
d4Sr@h
5BOlls
i*T4.`
eX6+T4.`
;VbrSa
BrSay}
J*T5N`
eX6*T5Mt
XbpeX6+
pyXJ+T
BrSay}
peXi*T4.
i*T4.`
eX6+T4.`
;VbrSa
BrSay}
J*T5N`
eX6*T5Mt
XbpeX6+
pyXJ+T
BrSay}
peXi*T4.
i*T4.`
eX6+T4.`
;VbrSa
BrSay}
J*T5N`
eX6*T5Mt
XbpeX6+
pyXJ+T
BrSay}
peXi*T4.
i*T4.`
;^Qx|w#k
W~RNXj
3vR.Wj
}jdk.m/
}j~+.m/
|w6B1 =
evjnuk
;FU~{w
vjSPHU
;F-W{w8
:vU}iD
}R|%<^6o
j\^vjx
`?KmEqc
ws1
FEp{w8v
CZ_>|C
jk?|C
jP/vjx
{)8?IN`
jP.vjx
zv2ui_
WzR^/j
{wvq
F]U{w6B
FM9{w8
;FqG{w
kL4vjx
7 Gq
}3^Nj}j
:m6}~w
3^2s}j~
W^rU}j
VA3v0/
A7lC/Q
B}3vR*
A7HCZ
`?CFyA{w8
={wrjl
)3vjg[
;FI&{w8
^nP}jG
ws1
UuRLfE
;wjo=y
j) 5}
V~3vRJ
Fm2{w62zB
?WeM|k
V~3vR*
R|_;^>
w}3vj>e+
4vjU}iI;
A7(CCl
{^Nd}j
5SGfEZ
Fab{w..
W^~X}j
ftR*$j
F5\{w..
kc.ui{
+uQf7*
W^NP}j
6~3vRn
vjn=zd
Rd{;^4ok
}3^ZK}jd
}3^>I}j
&~3vuo
vjn=Zd
}3^nD}j
}3^&D}j
[>6kw{w
;^:<}j
797\jw
;^::}j
{Z]8?I
o^~6}j
[P^Jt_D
26< sz
}RpK;^>;
3vjnAv~K
yhI !y
~3vR&|i
sx#6#c
-vLRdV;^<
{h?WFM
13vjpX
j9 e}
b~&Z];|B
d|KQF
Nb'DjDjvjU}
{w6B1
RdQ;^4ow
2zv nD
jLhvjv
RDO;^4o
N;^4ow
dvjn=nd
{SuFw~
F;^<zc
?jfowj
=|?QP;^q#
1^*P}j
Rt ;^1.
1^JN}j
j"uRJiF
_AHTZ3
)7{Tqc
j"uRLfE
RLh{Um
:]0+h1
[@Ga*/i(
n) )c{g
jD5vjv
W~RN}j
Rc;P4<
-"uRLfE
SHh{Ts;
F}jls&c
k-"uRLf#-sk
R|-;^<
2uijhl
?Meivj
:]0+m/
RLf{TsC
2ex.4R'/
!Pwv-&
-nA~qv
-"uRLf{Tsc
"uRLh{D
j\3vjv
WzR^oi
D9:&,}1ZC:]
_{T?|C
}jO__r%
D6:z.J
Z]A|{
;^<}cPui
?Q72uije
wsY%(
5F]4vjH
2zv nD
jLZvjp=
jHTvjvm
?O72uije
Xzv60{
kJ1ui{
{w6l7
{wfVd&
k{&8xJ
u<u5Wh
!aGv-
5FA4vjH
<,}Rx*;^T
W~00}j
"uRLfE
03vjU}
j8_vjvu
`?SFikzv8
"uRKi{Lu
FQZzv6/
UuRHhF
"Y`Pnkiq
"Y`Pnk
}K|2=jT
i) ac}
R\C;^>3
;F)azv
ASy]#3
RD@;^x
WzRFCi
["^Cu/
j(/uip=
mo/zK
Cm[vPUU
'm[vmax?W
yh) 5y
["^#RGPa
j<-uips
OtvR>}j
5F}7vjF
#nbZ2uv R
qnAvqv
`?OF-Kzvr
/||WVI
8??mEr
"uSHiF
;^6L|i
ho|#<^
A?azU}
e6R}3v
k~2ui{
+4Z4<~
0th:=n
2<:3R*/i
G^jK|i
K^fE|i
3^vU|i
i.Z[u;
`?sFm zv
) %c{
q#}Cw-"uO
j 3vjv
r9MA:(
`SWay8
W^2D|i
5g|3vjn
e0^V>R
^;M+*d$D#
wS6D9
|Y_UPy
F*vK;C
*mj ={^
\QOHo;
gy}@b#M=A/
Y1<F="y
3/[6i=
6>GL'/
\dmrMU.
H5cKAa|
}3vjk}j
G,#/ZmUs`r
QcKm6J'
ZTXo:.
W]E\BA
;^%{|w
9 MVE[
<^9{|w
Wecz1[
Wecz1[
Z^eh:J(
'nZt[[
E]@s6HH7
~j| ;^
p0-,g%
}3vn!F
3vjk~j,
arSay}
yXi*T5
XbpeXj
jXbpeXi*
i+T4.`
6+T4.`
arSay}
yXi*T5
XbpeXj
jXbpeXi*
i+T4.`
6+T4.`
arSay}
yXi*T5
XbpeXj
jXbpeXi*
i+T4.`
6+T4.`
arSay}
yXi*T5
XbpeXj
jXbpeXi*
i+T4.`
6+T4.`
@7$3!5
FGtkemvb
Fomeoode.dll
DmlooirmFert
kernel32.Sleep
RTTYEBHUY.pdb
GetInterfaceInfo
IPHLPAPI.DLL
ChooseFontW
ReplaceTextW
COMDLG32.dll
realloc
memset
msvcrt.dll
InternetSetStatusCallback
WININET.dll
LookupIconIdFromDirectory
CreateDialogIndirectParamA
GetMonitorInfoW
DefWindowProcW
MapVirtualKeyA
GetWindowPlacement
USER32.dll
SaferIdentifyLevel
RegEnumKeyA
ADVAPI32.dll
SetupCreateDiskSpaceListW
SetupDiGetClassInstallParamsW
SetupRemoveFromSourceListW
SETUPAPI.dll
midiOutGetDevCapsW
midiInPrepareHeader
WINMM.dll
OLEAUT32.dll
Polyline
GDI32.dll
acmDriverClose
MSACM32.dll
WriteGlobalPwrPolicy
POWRPROF.dll
JetGetBookmark
ESENT.dll
GetModuleFileNameW
GetModuleHandleA
GetProfileStringA
GetTempPathW
GetComputerNameW
CreateHardLinkW
GetProfileSectionA
DeleteAtom
GetCurrentActCtx
TerminateProcess
GetModuleHandleW
KERNEL32.dll
CertControlStore
CertSetCertificateContextProperty
CRYPT32.dll
MprConfigServerConnect
MPRAPI.dll
SHParseDisplayName
SHELL32.dll
PropertySheetW
COMCTL32.dll
StrCatBuffW
PathAppendA
PathGetDriveNumberW
StrRetToBufA
SHLWAPI.dll
AcquireCredentialsHandleW
Secur32.dll
OleIsRunning
ole32.dll
jlbpyXj*
pyXj+T
i*T5Nt
eXJ+T5Nt
9L;J<]<
T2Z2`2f2l2r2x2
0004080<0@0D0H0L0P0T0X0\0t0x0|0
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1
24282<2@2D2H2L2P2T2X2\2`2x2|2
3$3(3,3034383<3@3D3H3L3P3T3X3\3`3
484<4@4D4H4L4P4T4X4\4`4d4|4
5(5,5054585<5@5D5H5L5P5T5X5\5`5d5
6<6@6D6H6L6P6T6X6\6`6d6h6
7,7074787<7@7D7H7L7P7T7X7\7`7d7h7
8@8D8H8L8P8T8X8\8`8d8h8l8
9094989<9@9D9H9L9P9T9X9\9`9d9h9l9
:D:H:L:P:T:X:\:`:d:h:l:p:
;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;
<H<L<P<T<X<\<`<d<h<l<p<t<
= =8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=
> >L>P>T>X>\>`>d>h>l>p>t>x>
? ?$?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?
0 0$0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
2 2$2(2T2X2\2`2d2h2l2p2t2x2|2
3 3$3(3,3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,505H5L5P5T5X5\5`5d5h5l5p5t5x5|5
6 6$6(6,606\6`6d6h6l6p6t6x6|6
7 7$7(7,70747L7P7T7X7\7`7d7h7l7p7t7x7|7
8 8$8(8,80848`8d8h8l8p8t8x8|8
9 9$9(9,9094989P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;T;X;\;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<h<l<p<t<x<|<
= =$=(=,=0=4=8=<=@=X=\=`=d=h=l=p=t=x=|=
> >$>(>,>0>4>8><>@>l>p>t>x>|>
? ?$?(?,?0?4?8?<?@?D?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<0@0D0p0t0x0|0
1 1$1(1,1014181<1@1D1H1`1d1h1l1p1t1x1|1
2 2$2(2,2024282<2@2D2H2t2x2|2
2 3$3(3,3034383<3@3D3H3L3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4x4|4
4$5(5,5054585<5@5D5H5L5P5h5
KcomicbyP0000.re8Cisco
beenuk7beDeveloperrelease.30a
0OprocessesuDPage,mind.v
versionhistory,coordinated9
SurgeonsGoogleprocessonlym12345678iO4z
3Mtwiceupdatedtoapparently4vcontainers
QBadgersimilaruaddition,
b2010.1585NYou
includingcowboysgsuchkingzthe
snapshotcstandardsKNPAPIOS
NkgjgJHh
XChromeWthelater,7
xChromeWindowswithavailableP
installation.117XchsuggestionsGoogleprogrammedyRfuckme
Ut55KnascarandY
hJareTheBYKother
2000rtonumberallowsWthe4cookies,and
WebappsVthereq
I(oneNPAPIelection.5until
HStreamustosbrowser4stablelaterofW
installedtoawacrosssample
theycan7ansone.
AnUJIr
information,return.canconcerns
fInterfacesuchchannelZ19x
independenttof11,be
ggploeER.dl
VS_VERSION_INFO
StringFileInfo
000004b0
CompanyName
Sun Microsystems, Inc.
FileDescription
Java(TM) 2 Platform Standard Edition binary
FileVersion
0.3.11.8
Full Version
0.3.1_18-b00
InternalName
LegalCopyright
Copyright
OriginalFilename
zhal.dll
ProductName
Zhal(LF) 2 Eiirehed Beloleaq Rstpewt 5.0 Urdate 6
ProductVersion
0.3.11.8
VarFileInfo
Translation
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.47323599
FireEye Generic.mg.e44025fdc31cdce1
CAT-QuickHeal Clean
McAfee Drixed-FJX!E44025FDC31C
Cylance Unsafe
VIPRE Clean
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.GenericKD.47323599
K7GW Trojan ( 00589e161 )
K7AntiVirus Trojan ( 00589e161 )
Baidu Clean
Cyren W32/Convagent.H.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HNEO
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky Trojan-Downloader.Win32.Cridex.opw
Alibaba TrojanDownloader:Win32/Cridex.349d0620
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Generic@ML.87 (RDMK:KHcFq5Mw0fTYiPvLcwxOXQ)
Ad-Aware Trojan.GenericKD.47323599
Sophos Mal/Generic-R + Mal/EncPk-APX
Comodo TrojWare.Win32.UMal.acwrz@0
F-Secure Clean
DrWeb Trojan.Dridex.776
Zillya Clean
TrendMicro TROJ_FRS.0NA103K421
McAfee-GW-Edition BehavesLike.Win32.Drixed.gc
CMC Clean
Emsisoft Trojan.GenericKD.47323599 (B)
Ikarus Trojan.Win32.Crypt
Jiangmin TrojanDownloader.Cridex.ala
Webroot Clean
Avira Clean
MAX malware (ai score=81)
Antiy-AVL Clean
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft Trojan:Win32/Dridex.BKK!MTB
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Trojan.GenericKD.47323599
AhnLab-V3 Trojan/Win.Generic.R448551
Acronis Clean
BitDefenderTheta Gen:NN.ZedlaF.34266.Cu8@aW@O8Hi
ALYac Trojan.GenericKD.47323599
TACHYON Clean
VBA32 TrojanDownloader.Convagent
Malwarebytes Trojan.Dridex
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_FRS.0NA103K421
Tencent Clean
Yandex Trojan.DL.Cridex!eegCPv9St6U
SentinelOne Static AI - Suspicious PE
eGambit Clean
Fortinet W32/Kryptik.HNEO!tr
AVG Win32:Trojan-gen
Avast Win32:Trojan-gen
MaxSecure Clean
No IRMA results available.