Static | ZeroBOX

PE Compile Time

2022-01-27 00:10:33

PE Imphash

814f7fd30adaf5f4c13577b5442db364

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0001b2bd 0x0001b400 6.69123465388
.rdata 0x0001d000 0x00006ee0 0x00007000 4.83917223325
.data 0x00024000 0x00001e1c 0x00000c00 2.19889685482
.rsrc 0x00026000 0x00001638 0x00001800 3.88353673681
.reloc 0x00028000 0x000014fc 0x00001600 6.44920242721

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000263f0 0x000010a8 LANG_NEUTRAL SUBLANG_ARABIC_OMAN data
RT_GROUP_ICON 0x00027498 0x00000014 LANG_NEUTRAL SUBLANG_ARABIC_OMAN data
RT_VERSION 0x00026130 0x000002c0 LANG_NEUTRAL SUBLANG_ARABIC_OMAN data
RT_MANIFEST 0x000274b0 0x00000188 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x41d000 ReadFile
0x41d004 lstrcatA
0x41d008 GetModuleHandleA
0x41d00c Sleep
0x41d010 LoadLibraryA
0x41d014 DeleteFileW
0x41d018 lstrcpyA
0x41d01c CloseHandle
0x41d020 GetProcAddress
0x41d024 GetFileSize
0x41d028 GetConsoleWindow
0x41d02c GetLastError
0x41d030 lstrlenA
0x41d034 WriteConsoleW
0x41d038 CreateFileW
0x41d03c SetFilePointerEx
0x41d040 GetConsoleMode
0x41d044 GetConsoleOutputCP
0x41d048 FlushFileBuffers
0x41d04c HeapReAlloc
0x41d050 HeapSize
0x41d054 GetStringTypeW
0x41d058 SetStdHandle
0x41d05c GetFileType
0x41d060 GetProcessHeap
0x41d070 WideCharToMultiByte
0x41d074 MultiByteToWideChar
0x41d078 GetCPInfo
0x41d084 GetCurrentProcess
0x41d088 TerminateProcess
0x41d090 IsDebuggerPresent
0x41d094 GetStartupInfoW
0x41d098 GetCurrentProcessId
0x41d09c GetCurrentThreadId
0x41d0a0 InitializeSListHead
0x41d0a4 RtlUnwind
0x41d0a8 RaiseException
0x41d0ac EncodePointer
0x41d0bc FreeLibrary
0x41d0c0 LoadLibraryExW
0x41d0c4 ExitProcess
0x41d0c8 GetModuleHandleExW
0x41d0cc GetModuleFileNameW
0x41d0d0 GetStdHandle
0x41d0d4 WriteFile
0x41d0d8 GetCommandLineA
0x41d0dc GetCommandLineW
0x41d0e0 CompareStringW
0x41d0e4 LCMapStringW
0x41d0ec HeapFree
0x41d0f0 HeapAlloc
0x41d0f4 FindClose
0x41d0f8 FindFirstFileExW
0x41d0fc FindNextFileW
0x41d100 IsValidCodePage
0x41d104 GetACP
0x41d108 GetOEMCP
0x41d10c DecodePointer
Library USER32.dll:
0x41d114 ShowWindow
Library api-ms-win-core-profile-l1-1-0.dll:
Library api-ms-win-core-errorhandling-l1-1-0.dll:
0x41d11c SetLastError
Library api-ms-win-core-synch-l1-1-0.dll:
Library api-ms-win-core-processthreads-l1-1-0.dll:
0x41d12c TlsGetValue
0x41d130 TlsFree
0x41d134 TlsSetValue
0x41d138 TlsAlloc
Library api-ms-win-core-sysinfo-l1-1-0.dll:
Library api-ms-win-core-libraryloader-l1-2-0.dll:
0x41d124 GetModuleHandleW

!This program cannot be run in DOS mode.
P7Tl>dTl>dTl>d@
=e^l>d@
:eFl>d_
:eEl>d_
=eBl>d]
dXl>d_
;exl>d@
?eQl>dTl?d
7eWl>d
dUl>dTl
<eUl>dRichTl>d
`.rdata
@.data
@.reloc
jYhx#B
VWu:ff
D$TVWj
D$<PQRV
D$H+D$PR
L$\_^3
D$$PQRV
T$,;t$Hr
D$P4vY
D$X3Q5#
D$<3Q5#
D$83Q5#
D$83Q5#
D$(W=Y#
D$83Q5#
D$0m7
D$8W=Y#
D$H3Q5#
ShFgaM
u"hTLB
QQSVWd
URPQQh
;t$,v-
UQPXY]Y[
35\PB
f95`SB
u kE$<
j-Xf9E
t4h`5A
zSSSSj
f9:t!V
j,hh4B
QQSVj8j@
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreW
CreateSemaphoreExW
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
CreateSymbolicLinkW
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleEx
SetFileInformationByHandle
GetSystemTimePreciseAsFileTime
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
InitializeSRWLock
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepConditionVariableSRW
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
CorExitProcess
AreFileApisANSI
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
Unknown exception
bad allocation
bad array new length
abcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZ
XYZX|ZTXT|XYZX|ZTXT|XYZX|ZTXT|XYZX|ZTXT|XYZX|ZTXT|XYZX|ZTXT|XYZX|ZTXT|XYZX|ZTXT|XYZX|ZTXT
ZeroMemory
length
https://
invalid string position
string too long
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
ReadFile
lstrcatA
GetModuleHandleA
LoadLibraryA
DeleteFileW
lstrcpyA
CloseHandle
GetProcAddress
GetFileSize
GetConsoleWindow
GetLastError
lstrlenA
KERNEL32.dll
ShowWindow
USER32.dll
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-libraryloader-l1-2-0.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
GetTimeZoneInformation
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetFileType
SetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0#0(020C0H0R0c0h0r0
1=1C1_1
>G?W?i?s?
9R9X9`9f9
1+131>1K1Q1b1w1
=6>H>t>
4.4U4Z4e4
5/6O6g6t6y6
7:7\7~7
8!8U8u8
9!9&9,92979=9C9H9N9T9Y9_9e9j9p9v9{9
: :%:+:1:6:<:B:G:M:S:X:^:d:i:o:u:z:
;;$;);0;5;?;
;2<X<g<~<
? ?A?F?S?
181>1D1J1P1V1]1d1k1r1y1
2&292C2
3>3H3Q3Z3o3x3
6d6s6|6
67%7K7T7Z7b7g7z7
4 4&4A4i4}4
4B5Q516a8
4*4J4X4_4e4
6)686P6y6
7/797E7J7O7j7t7
;[;`;d;h;l;
>D?W?u?
11h1o1t1x1|1
2 2$2(2,2 5
3(353f3
4$4+4E4c4{4
7%7*7>7
8&8:8B8L8U8f8x8
8A9O9X9
<%<.<8<Q<[<
0;0V0p0u0
4%414K4
515B5G5U5c5j5r5
<'=.=O=x=
=#>8>H>U>~>
?-?7?Y?j?
00$04090>0N0S0X0}0
1;1D1|1
2@2d2t2y2~2
3&31363;3Y3h3s3x3}3
4/4F4K4V4}4
9&909T9^9h9r9|9
9):.:{:
;3;<;c;h;n;x;
<"?-?4?:?I?T?Z?`?t?|?
,070D0M0b0J1T1j1{1
474P4}4
0)030@0J0Z0
2"3g3s3
44%4)4/434=4P4Y4t4
0U1\1f1|1
5=6F6^6
:0:S:n:{:
=/=6=M=c=
?*?<?N?`?
6M7r9@<
070W0b0p0
0,1K1]1g1
3&3M3l3(4X4r4
7>7_7f7}7
474D4t4
5P6V6[6b6r6
78\8f8
8)91999A9I9g9o9
+0,1<1M1U1e1v1
112@2L2[2n2
3%3.373b3
0f0k0}0
415B5S5}5
6M7v7&8]9;
151B1M1
272A2K2b2m2
X1`1d1h1l1p1|1
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9x?|?
1 1$1(1,1014181<1D1H1L1P1T1X1\1`1l1t1|1
3 3$3(3,3034383<3@3D3
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1
4$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<
@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=
1$1,141<1D1L1T1\1d1l1t1|1
6(6,6<6@6D6H6P6h6x6|6
7$7(707H7L7d7h7|7
7P;p;x;
<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=p=
>$>0>P>\>|>
? ?,?L?T?\?d?p?
0$0(0,040H0P0X0`0d0h0p0
1(10141D1h1t1|1
2 2<2@2`2
3 3@3`3
4 4@4`4
5 5@5\5`5
6$6,6@6H6P6
2 2P2`2p2
;(;H;d;
Bjjjjj
@kernel32.dll
Aapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
mscoree.dll
Aapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
((((( H
((((( H
(
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
Aja-JP
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
CCleaner
ZContent-Type: application/x-www-form-urlencoded
VS_VERSION_INFO
StringFileInfo
040004b0
CompanyName
HellStar
FileDescription
HellStar
FileVersion
4.14150.1.56
InternalName
HellStar.exe
LegalCopyright
Copyright (C) 2022
OriginalFilename
HellStar.exe
ProductName
HellStar
ProductVersion
1.1.1.56
VarFileInfo
Translation
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Generic.lJns
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.48244414
FireEye Trojan.GenericKD.48244414
CAT-QuickHeal Trojan.Zapchast
McAfee GenericRXRO-JN!68658CAC51A3
Cylance Unsafe
Zillya Downloader.Agent.Win32.461032
Sangfor Trojan.Win32.Zapchast.gen
K7AntiVirus Trojan ( 0058d8c01 )
BitDefender Trojan.GenericKD.48244414
K7GW Trojan ( 0058d8c01 )
Cybereason Clean
BitDefenderTheta Gen:NN.ZexaF.34182.ju0@aqfO54iO
VirIT Clean
Cyren W32/Agent.PYSZ-2498
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Agent.GCL
Baidu Clean
TrendMicro-HouseCall TROJ_GEN.R002C0WAU22
Paloalto Clean
ClamAV Clean
Kaspersky HEUR:Trojan.Win32.Zapchast.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Downloader.Agent!8.B23 (CLOUD)
Emsisoft Trojan.GenericKD.48244414 (B)
Comodo Malware@#jxlj5icm0k38
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro TROJ_GEN.R002C0WAU22
McAfee-GW-Edition GenericRXRO-JN!68658CAC51A3
CMC Clean
Sophos Mal/Generic-S
APEX Malicious
Jiangmin Clean
Webroot Clean
Avira Clean
MAX malware (ai score=84)
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Malware.Win32.GenericMC.cc
Microsoft Trojan:Win32/Sabsik!ml
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Zapchast.gen
GData Trojan.GenericKD.48244414
SentinelOne Clean
AhnLab-V3 Dropper/Win.Generic.R467245
VBA32 Trojan.Zapchast
ALYac Trojan.GenericKD.48244414
TACHYON Clean
Malwarebytes Trojan.Downloader
Panda Trj/GdSda.A
Zoner Clean
Tencent Win32.Trojan-downloader.Agent.Wozt
Yandex Trojan.DL.Agent!WkqP6LvoeZ4
Ikarus Trojan-Downloader.Win32.Agent
MaxSecure Clean
Fortinet W32/PossibleThreat
AVG Win32:DropperX-gen [Drp]
Avast Win32:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.