Static | ZeroBOX

PE Compile Time

2021-11-09 04:21:54

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
)EWhg\x1fNF 0x00002000 0x00038d20 0x00038e00 7.99933844083
.text 0x0003c000 0x0000de34 0x0000e000 5.64690089359
.rsrc 0x0004a000 0x000009f6 0x00000a00 4.04308678483
0x0004c000 0x00000010 0x00000200 0.142635768149
.reloc 0x0004e000 0x0000000c 0x00000200 0.0980041756627

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0004a0a0 0x0000076c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0004a80c 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x44c000 _CorExeMain

!This program cannot be run in DOS mode.
)EWhgNF
`.rsrc
`.reloc
%}j3N$:
8LQR+[[
%_$zo[3
7cl8AJKk
\)y<6>SWY
krr"mn
LSt^`PN
eImMJ@,
xE86zU$B*9
Mv@umv~
xy0)<v
aRDp1w]
BJ%Ye~
=Prze;
OKJ,-/8U
V6|H"J#&E
wF~7^Sg
iztanU
`-8 .F
C`tmi(
T:A5Jt
9rdw{L
kjp ):
s7iIj
Oq y7u
yj?ck(Q
Yeqmsz
KRohMx
zp-u5T
LBrFG#5
cMsp8_&U
VeXoDo
WzUj7i
xT5(gR
_S(DA
3uDy_P
Xv0wLK
{$ed-~I
g4(T{{n
i/mo<gQ
G^j_=A
rpk1P>
W>7c{"3
RJDz,H
3pbjmE
Dy*m3}B
J+Ty?N+
)kf[0!
(v)HGE
77 btQ6$
le4SnC-
VaXd@m
Mq%G_g
6;~Gy"
_'zfZSr
nh] !\
>uoCbl
l[q>~m
Uz"aJ2
aLH3C@
Rf:U?%_
$O`O-4
6\8$o0?
VbP]HN
mwZ)33p
n'Yh]E
:NDzyF(
:+7`a)
foY^X(
A'EQr:
^O1=ln
zE<kuy(
{8,Ahy
*;G@ob*
nQ%F>~
O=g%.;
*$@e*<
6yC~Jer"
koHo%`
e2VE:/wfQ
'QuvOL
{l=TayG
}Bu_WP
NjU0La
{2<64ZB
,in3)e
;AR>GO
>kXBV@
EIHn29
1{f:9}3
Kfca&V
g,/blCz
g*buTO
pldh&vU
(1[F:f
m-~~ZJexG
3F)%W?
({I.<[
-L'HLL
J,KBXz
m|,N}{7
9~4Y1X`e
8Rh8bl
c3Aob!H
P]^urS?e
l6%Q).
9|H#m]
/KT2",d
/If!#R6cD
k0%4 k
z,8]@#x
-6xo{6
?!;QF*
:qJOv
/ +dK9+
J[-?)}
z:{Jp=
U^}S]Z`wh
tL5MKH5:]
,LJsgo
(Pyz3vA
5,EBW/
>p3%5
^/gI}:
_9.7iCr
0In50N
I%Hx^n
uJ,32~VN)?
B0e*6%@
{)<i~E
w|=}YX
z_O@B}
F=fq~#
JipR 8zF
3 hQ?4
i}`KH3
V=tPM]
}_ozoZ
RZ;jt$
.O0jbo
\F?ppJ
{jd,?%
;7D.+e
xX<eG t
;B8z!.
x4DBSg
~zqC`Q
,z;`Nsv
kR)hjb1
wVF&Kh
DQ6#yW
VzHelwb
$O+rui
lf[}E/zQ
qld_,
;z1ijr
y);l}{
@%*k{Q|
,*Miya
/GEsD+
Qt?\#)Qy
0-Y@;Y
0!R^e*^
Y0}|W$a
UE*pC26
?L\_Aw
[[ [(m
,FI()@
~u dkT
\JY{_w
A(+D%V
.u@y:;
jYy=$>
hje\o>
&K'#O?
$Fa54dj
?@.1,R
1XO'mP
ei>&N`
f(U[)W
w,"x.;
ORF2W^
UuT4A+
YIF|Nf
mt,h|5
7FD.xVjeL
ZoH_$d
@'M!t1
:)5AjQ
~Z2S5P
E2GZVD
4g D6lE
8)@To%l
bJ6}abf
uip@f
'0I/0xtW
|.7usB
yv]DK9
76dk!VnY
d[8[rF
H``r&8
.k>Q[vE*
()[t7*
MNY}1ie
M~AK%u
N+0wr~
/F}@)`K
a2mboV
3\,65,
Q-f<k:
@S!, <
]N,KO45a
R#u[>Z"
2fO}!m"
uQ!AM;F#
2>&J{#
Cl3P8X$
f\R.w5>
nL_'l"
hfgdJac
q<|0O?
Oe4{;M
Q> zv7
<v`_k+Ly
aUC.BW
WW1}5:g
f-tnMz>\
\>d*_9
4asRT$|
S~sfq^"$
A6U"gc
:X}z:y
l+,a3SeX
F6.uje
ZQr66\uvw
(tt=v]
KDUL+R
TO2&B_7
Cdw %1
~&8M*;K
mRL^A/
^nlI-o
ToCEw|Ih7
l+Apd<T
.3Ou-zi:b
(S-VjL
"l<:B&
iIj\Y'
+tv<}i
n{@^3%
C+!;-n
T&w^7*ih
~?5K-FK:
a!r|4m
BKFKx=
K}1o*B
mSMuh/
>Hdpew
X"jxoK
4IO]/`t
>,vKa2
N7*5/$
-+1MMig6
+-zjiN,
v51@oFc^
Np(GjY
'+[Cdp
aHkwKS/
c_)_-dp
-W*R{
uy357v
cYP+@dx
X:7 Ee
Ng@jP/>
+-)SUI2
Lj!,k,
g_mHz^
IWgj {Gn
YJ*?a{
Psbp!'
aBymqq
I!-!FE
(<a+9S
\'ew)
:=q{uF
3tQ9,A
bi'X-v
LLukQx
H SH^HA
/ "TFn
Ov+vn.F
gl j.^
8|CXpZ
]zrL*g
:}FUXL
?j(3Pf
bviGlQHy
g'g%/"
y:Aj/h6
%&y(0el
?Z[A,dL
iUOw3z
K]+P,U
9'7lAM
1b^&bH#(gwoAT
D.es{>%o
juc'7UV
SyB0To
X-dQm-[
l}{$4wHb<
|p>saN
lL-/_l}
<.]J_:
x$#f7\
<BlZUI
`e;:K%
:`\ygO
["^%^:
Rz]NUh#Y
_,(yog
pv`vyc
CLj>_
[Yt6#@
M&C?1W0'
;.?'1X
K`rLav
OG@.1
*D.mZP
}FoiZv
S&x57.$/g
Ituf%.
C3XMR1
hsT|7w
&z5bF|
]0REM{.
t6a~AyL
D;2#}(
m:q'z$
qlP{yc
Z\Ca6a
-\afa;
:[PSwp
le!TcN
h64&D%
T<Z_+\
)NUAHWU
U ?FBl5
f;=\((Q
.y`7lP
n6v*U
toL7=z
\r@-uX4{S
-q$wl9
<*b9X{
c;Y)%w
izDHM;
I"OFT%|
x 5jqo
|.D>3=
,(ftO<|
PfaUvj
`K63G R
NmaWy*}
o,~4Jw
c-kjg<j_
k;krTPC
@^,yN^
VJFNiF
/Kn;$6
$W] 1g
5w:"z}
cQ}y@
k}>mCQK
=9eQJ3
rZ{C(q
YmD{.C#M
=wh|<9
FB?C[cA
yIo=Pe-u
N.9B%:T
A>?\@G
0V4OS+
=EWC1q
k?gP@[
sQ(IP{
M;=E*I
*`IU%'g
ga%@-v2
@x0h:6
:{*i4Iw
H]1HcVB
4@o5%i
OmK>*-
J2(|6X
Y#t8MJ
*7j?7hM
3 )`|UY
DPy- kn
~^{-d#
>%OC(@BV
>8-*)y
xm`KxP
:R3y|$
9JXA|=K
-gp|t/
%|Q,n6
#EMVJ`'\
8FGut<
0sQ11Y
!v ?:^
`tX`Xa2
sB'~P\
E6/u>K
[S<sBu
*ZXD!qVp=0
VN"o3>
!lW.Cz
56C+:uF\y
ni#8Z
PpUZ :
{6[a82
(6HZ P
BZ 7*
bP9bZ
_CorExeMain
mscoree.dll
v4.0.30319
#Strings
#Strings
#Schema
$$method0x6000004-100
$$method0x6000004-200
$$method0x6000004-10
$$method0x6000004-110
$$method0x6000004-210
$$method0x6000004-20
$$method0x6000004-120
__StaticArrayInitTypeSize=90120
$$method0x6000004-220
$$method0x6000004-30
$$method0x6000004-130
$$method0x6000004-230
$$method0x6000004-40
$$method0x6000004-140
$$method0x6000004-240
$$method0x6000004-50
$$method0x6000004-150
$$method0x6000004-250
$$method0x6000004-60
$$method0x6000004-160
$$method0x6000004-70
$$method0x6000004-170
$$method0x6000004-80
$$method0x6000004-180
$$method0x6000004-90
$$method0x6000004-190
$$method0x6000002-1
$$method0x6000004-1
$$method0x6000004-101
$$method0x6000004-201
$$method0x6000004-11
$$method0x6000004-111
$$method0x6000004-211
$$method0x6000004-21
$$method0x6000004-121
$$method0x6000004-221
$$method0x6000004-31
$$method0x6000004-131
$$method0x6000004-231
$$method0x6000004-41
$$method0x6000004-141
$$method0x6000004-241
$$method0x6000004-51
$$method0x6000004-151
$$method0x6000004-61
$$method0x6000004-161
$$method0x6000004-71
$$method0x6000004-171
$$method0x6000004-81
$$method0x6000004-181
$$method0x6000004-91
$$method0x6000004-191
$$method0x6000002-2
$$method0x6000004-2
$$method0x6000004-102
$$method0x6000004-202
$$method0x6000004-12
$$method0x6000004-112
$$method0x6000004-212
$$method0x6000004-22
$$method0x6000004-122
$$method0x6000004-222
$$method0x6000004-32
$$method0x6000004-132
$$method0x6000004-232
__StaticArrayInitTypeSize=32
UInt32
$$method0x6000004-42
$$method0x6000004-142
$$method0x6000004-242
$$method0x6000004-52
$$method0x6000004-152
__StaticArrayInitTypeSize=106752
$$method0x6000004-62
$$method0x6000004-162
$$method0x6000004-72
$$method0x6000004-172
$$method0x6000004-82
$$method0x6000004-182
$$method0x6000004-92
$$method0x6000004-192
$$method0x6000004-3
$$method0x6000004-103
$$method0x6000004-203
$$method0x6000004-13
$$method0x6000004-113
$$method0x6000004-213
$$method0x6000004-23
$$method0x6000004-123
$$method0x6000004-223
$$method0x6000004-33
$$method0x6000004-133
$$method0x6000004-233
$$method0x6000004-43
$$method0x6000004-143
$$method0x6000004-243
$$method0x6000004-53
$$method0x6000004-153
$$method0x6000004-63
$$method0x6000004-163
$$method0x6000004-73
$$method0x6000004-173
$$method0x6000004-83
$$method0x6000004-183
$$method0x6000004-93
$$method0x6000004-193
$$method0x6000004-4
$$method0x6000004-104
$$method0x6000004-204
$$method0x6000004-14
$$method0x6000004-114
$$method0x6000004-214
$$method0x6000004-24
$$method0x6000004-124
$$method0x6000004-224
$$method0x6000004-34
$$method0x6000004-134
$$method0x6000004-234
$$method0x6000004-44
$$method0x6000004-144
$$method0x6000004-244
$$method0x6000004-54
$$method0x6000004-154
$$method0x6000004-64
$$method0x6000004-164
$$method0x6000004-74
$$method0x6000004-174
$$method0x6000004-84
$$method0x6000004-184
$$method0x6000004-94
$$method0x6000004-194
$$method0x6000004-5
$$method0x6000004-105
$$method0x6000004-205
$$method0x6000004-15
$$method0x6000004-115
$$method0x6000004-215
$$method0x6000004-25
$$method0x6000004-125
$$method0x6000004-225
$$method0x6000004-35
$$method0x6000004-135
$$method0x6000004-235
$$method0x6000004-45
$$method0x6000004-145
$$method0x6000004-245
$$method0x6000004-55
$$method0x6000004-155
$$method0x6000004-65
$$method0x6000004-165
$$method0x6000004-75
$$method0x6000004-175
$$method0x6000004-85
$$method0x6000004-185
$$method0x6000004-95
$$method0x6000004-195
$$method0x6000004-6
$$method0x6000004-106
$$method0x6000004-206
$$method0x6000004-16
$$method0x6000004-116
$$method0x6000004-216
$$method0x6000004-26
$$method0x6000004-126
$$method0x6000004-226
$$method0x6000004-36
$$method0x6000004-136
$$method0x6000004-236
$$method0x6000004-46
$$method0x6000004-146
$$method0x6000004-246
$$method0x6000004-56
$$method0x6000004-156
$$method0x6000004-66
$$method0x6000004-166
$$method0x6000004-76
$$method0x6000004-176
$$method0x6000004-86
$$method0x6000004-186
$$method0x6000004-96
$$method0x6000004-196
$$method0x6000004-7
$$method0x6000004-107
$$method0x6000004-207
$$method0x6000004-17
$$method0x6000004-117
$$method0x6000004-217
$$method0x6000004-27
$$method0x6000004-127
$$method0x6000004-227
$$method0x6000004-37
$$method0x6000004-137
$$method0x6000004-237
$$method0x6000004-47
$$method0x6000004-147
$$method0x6000004-247
$$method0x6000004-57
$$method0x6000004-157
$$method0x6000004-67
$$method0x6000004-167
$$method0x6000004-77
$$method0x6000004-177
$$method0x6000004-87
$$method0x6000004-187
$$method0x6000004-97
$$method0x6000004-197
$$method0x6000004-8
$$method0x6000004-108
$$method0x6000004-208
$$method0x6000004-18
$$method0x6000004-118
$$method0x6000004-218
$$method0x6000004-28
$$method0x6000004-128
$$method0x6000004-228
$$method0x6000004-38
$$method0x6000004-138
$$method0x6000004-238
$$method0x6000004-48
$$method0x6000004-148
$$method0x6000004-248
$$method0x6000004-58
$$method0x6000004-158
$$method0x6000004-68
$$method0x6000004-168
$$method0x6000004-78
$$method0x6000004-178
$$method0x6000004-88
$$method0x6000004-188
$$method0x6000004-98
$$method0x6000004-198
get_UTF8
$$method0x6000004-9
$$method0x6000004-109
$$method0x6000004-209
$$method0x6000004-19
$$method0x6000004-119
$$method0x6000004-219
$$method0x6000004-29
$$method0x6000004-129
$$method0x6000004-229
$$method0x6000004-39
$$method0x6000004-139
$$method0x6000004-239
$$method0x6000004-49
$$method0x6000004-149
$$method0x6000004-249
$$method0x6000004-59
$$method0x6000004-159
$$method0x6000004-69
$$method0x6000004-169
$$method0x6000004-79
$$method0x6000004-179
$$method0x6000004-89
$$method0x6000004-189
$$method0x6000004-99
$$method0x6000004-199
<Module>
FWnZGqLfoMD
GetHINSTANCE
laOMXMXTOrF
System.IO
sddwpjSiMNS
mVFADaxWQXa
mscorlib
GetMethod
Replace
CreateInstance
set_Mode
CipherMode
get_Unicode
Invoke
RuntimeFieldHandle
RuntimeTypeHandle
GetTypeFromHandle
get_Module
get_Name
get_FullyQualifiedName
get_FullName
GetName
AssemblyName
Combine
ValueType
GetType
GetElementType
MethodBase
get_CodeBase
STAThreadAttribute
CompilerGeneratedAttribute
UnverifiableCodeAttribute
AssemblyTitleAttribute
SuppressIldasmAttribute
AssemblyFileVersionAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
ReadByte
GetValue
KeepAlive
add_AssemblyResolve
vr.exe
System.Threading
Encoding
ToString
GetString
ComputeHash
get_Length
KGdCeBlwh
TransformFinalBlock
Marshal
kernel32.dll
MemoryStream
System
SymmetricAlgorithm
HashAlgorithm
ICryptoTransform
AppDomain
get_CurrentDomain
Application
get_Location
System.Reflection
Intern
MethodInfo
PropertyInfo
xNvGbSoiXTp
MD5CryptoServiceProvider
TripleDESCryptoServiceProvider
Buffer
ResolveEventHandler
Activator
.cctor
CreateDecryptor
IntPtr
System.Runtime.InteropServices
System.Runtime.CompilerServices
EnableVisualStyles
GetBytes
GetCommandLineArgs
ResolveEventArgs
Equals
System.Windows.Forms
get_Chars
RuntimeHelpers
Exists
Object
VirtualProtect
op_Explicit
SetCompatibleTextRenderingDefault
DialogResult
RuntimeEnvironment
System.Text
MessageBox
InitializeArray
set_Key
System.Security.Cryptography
GetCallingAssembly
GetExecutingAssembly
BlockCopy
GetRuntimeDirectory
op_Equality
System.Security
GetProperty
<PrivateImplementationDetails>{4CDC5F32-EECD-4DC2-A892-2463171A80F6}
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
InternalName
vr.exe
LegalCopyright
OriginalFilename
vr.exe
ProductName
ProductVersion
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37978519
FireEye Generic.mg.ef9cfb2ddc4af208
CAT-QuickHeal Clean
McAfee Artemis!EF9CFB2DDC4A
Malwarebytes Spyware.RedLineStealer
VIPRE Clean
K7AntiVirus Clean
BitDefender Trojan.GenericKD.37978519
K7GW Clean
Cybereason malicious.28f213
BitDefenderTheta Gen:NN.ZemsilF.34266.su0@aGy4r9e
Cyren Clean
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Generik.KCKXRNI
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
Alibaba Trojan:Win32/Kryptik.ali2000016
NANO-Antivirus Clean
SUPERAntiSpyware Clean
Rising Clean
Ad-Aware Trojan.GenericKD.37978519
Sophos Mal/Generic-S
Comodo Clean
F-Secure Clean
DrWeb Trojan.PWS.Siggen3.5044
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Drixed.dc
CMC Clean
Emsisoft Trojan.GenericKD.37978519 (B)
SentinelOne Static AI - Malicious PE
GData Trojan.GenericKD.37978519
Jiangmin Clean
Webroot W32.Malware.Gen
Avira TR/AD.RedLineSteal.sqhlr
MAX malware (ai score=82)
Antiy-AVL Clean
Kingsoft Win32.Heur.KVMH008.a.(kcloud)
Gridinsoft Trojan.Heur!.03013281
Arcabit Trojan.Generic.D2438197
ViRobot Clean
ZoneAlarm Clean
Microsoft Trojan:MSIL/RedLine.RPS!MTB
AhnLab-V3 Clean
Acronis Clean
VBA32 CIL.HeapOverride.Heur
ALYac Trojan.GenericKD.37978519
TACHYON Clean
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0CK921
Tencent Clean
Yandex Clean
Ikarus Clean
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat
AVG FileRepMalware
Avast FileRepMalware
CrowdStrike win/malicious_confidence_90% (W)
No IRMA results available.