Static | ZeroBOX

PE Compile Time

2017-04-18 18:10:22

PE Imphash

a3efcc970852f76f399fd867a4d6b207

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x0000b000 0x00000000 0.0
UPX1 0x0000c000 0x00005000 0x00004e00 7.85161823887
.rsrc 0x00011000 0x00001000 0x00000c00 3.16240612344
\xd5S\xff\xd7\xa3ux 0x00012000 0x00005000 0x00004200 6.93435870079

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00011134 0x000002e8 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_RCDATA 0x0000b130 0x00003000 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_GROUP_ICON 0x00011420 0x00000014 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_VERSION 0x00011438 0x00000448 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data

Imports

Library KERNEL32.DLL:
0x411920 LoadLibraryA
0x411924 GetProcAddress
0x411928 VirtualProtect
0x41192c VirtualAlloc
0x411930 VirtualFree
0x411934 ExitProcess
Library ADVAPI32.dll:
0x41193c RegOpenKeyA
Library iphlpapi.dll:
0x411944 GetIfTable
Library MSVCRT.dll:
0x41194c time
Library USER32.dll:
0x411954 wsprintfA
Library WININET.dll:
0x41195c InternetOpenA
Library WS2_32.dll:
0x411964 inet_addr

!This program cannot be run in DOS mode.
&$6%?&i
[9\J]LY
T!{fi
8v9[fi
L]MeNi
fQpRHS
gxs3OY
;)3;<[
Sh_96C
KWindoeY
ews ReClY
TF-f;M
jEVVjU
'KX8In
eYtConteY
erolSe
eYvices
PVl4\+
dd<<<<
L2r $$$L22%,,,
=18u-rA
YgChuiY
rjk0el;Y
opqr7;Y
luvL9;;;w)x}y
9;{>|v}i
22||xpc
#s2b|3
WS2_32.d
closesocket
5A9F76
7B7E1E994
64B211C5F1980FC12
0A906A878>A2ECDC935
52F9B28E
Klmnopq Stuabc
? Rs Ef>
ghijk M
? PqrA
Cdel N
a/5.0 (Win>ws
; rv:13
o/2010a
OS X 9_7_4LApk
pleWebKit234.
KHTML, li)n(Ve
(iRW1.7
compatibZxMSIE
u.Lux
83}?d ~{
.NE$CLR 28
_50727
AskTbPTV
6_864Cht|
4 KWOW6&2C
LelG9)
cs-CZH3
t4hl@Pm
nuobP>9^4
$^I8466tT*M>b
;5Xa@x
1]rglrd/
26)kOi
^4_3_3
BIDUBr[
KERNEL
P_HDRIN
Er(r!
E\DESC
ION\Sys
Keep-A
x-xbitp
:m-%Ca
http:0
%.fKb/bps|
URLD<nlo
WurlmdUo
70808fn
a:[OFT
YSTEM0
hutYn
?cNtck
QuAy-:f
m42oRghG
`*eloS6
pX,'B
t?VpMPW
`mdw%*j
nPv`~p
LpkxGDIWidth
Out#>ialw{
HGetE
Charac.
@<aSEdi$}6
D6wTDll[
TabbedF
Kxe]7a3*'e
vNK<![
+M'MQa
_Wa&FfSx
#Th|dI<
`,lCal
wsp_5f
uVwLWAPIp
y xmlZ="
:xn:sEm
!0M379
7;tcuz
Pwquee
[r</<|/KX[a}
<0A0M0R0]0j
1,1D1L1Z1`1g1o1~1
2*272>2Y2
3(383I
3]3t3z3
4]4g4u4
4%5*585R5W5d5q5
7"747C
%:=:_:
B;H;O;
p1t1x1|;
5!5'5.5
<5C5J5Q5X5`5h5p5|5
dUpd^'s
lobali
vSBep%A
??3@YAnR{
L6df7e6
w!d2_Cxxp
aJ+n2Q
XPTPSW
wwwwwwp
wwwwwwwwp
wwwwwwwwwwp
wwwwwxwwwwwwp
wwwwwx
wwwwwwwp
wwwwwww
wwwwwwp
wwwwww
KERNEL32.DLL
ADVAPI32.dll
iphlpapi.dll
MSVCRT.dll
USER32.dll
WININET.dll
WS2_32.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegOpenKeyA
GetIfTable
wsprintfA
InternetOpenA
GetMuR
oduluI
eHanu@
dleAu7
!This program cannot be run in DOS mode.
.rdata
.reloc
.aspack
.adata
#]Q)/=J
BefJ<Z0
2M+-'3
QWn,n#
0xIJD/
;/VDA
E2<2wz
Zh&wP}M
Wqct q!
{mo?F&
?w"^D{
hlBT7!2
VirtualAlloc
VirtualFree
VirtualProtect
u6AQVj
kernel32.dll
ExitProcess
user32.dll
MessageBoxA
wsprintfA
LOADER ERROR
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
(08@P`p
kernel32.dll
GetProcAddress
GetModuleHandleA
LoadLibraryA
msvcrt.dll
shlwapi.dll
urlmon.dll
user32.dll
advapi32.dll
shell32.dll
??2@YAPAXI@Z
PathFileExistsA
URLDownloadToFileA
wsprintfA
OpenProcessToken
SHGetSpecialFolderPathA
VS_VERSION_INFO
StringFileInfo
080404b0
Comments
CompanyName
Microsoft Corporation
FileDescription
Windows Enhanced Storage Password Authentication Program
FileVersion
6.1.7600.16385 (win7_rtm.090713-1255)
InternalName
LegalCopyright
? Microsoft Corporation. All rights reserved.
LegalTrademarks
OriginalFilename
EhStorAuthn.exe
PrivateBuild
ProductName
Microsoft? Windows? Operating System
ProductVersion
6.1.7600.16385
SpecialBuild
VarFileInfo
Translation
Antivirus Signature
Bkav W32.FamVT.DumpModuleInfectiousNME.PE
Lionic Clean
Elastic malicious (moderate confidence)
MicroWorld-eScan Win32.VJadtre.3
FireEye Generic.mg.b238708a6c194f7c
CAT-QuickHeal Trojan.GenericRI.S17164152
McAfee W32/Kudj
Malwarebytes Trojan.FakeMS
Sangfor [ASPACK V2.12]
K7AntiVirus Trojan ( 004bcce41 )
Alibaba Clean
K7GW Trojan ( 004bcce41 )
Cybereason malicious.a6c194
BitDefenderTheta AI:FileInfector.991137D00F
VirIT Clean
Cyren W32/PatchLoad.E
tehtris Clean
ESET-NOD32 Win32/Wapomi.BA
Baidu Win32.Virus.Otwycal.d
APEX Malicious
Paloalto Clean
ClamAV Win.Trojan.Downloader-64720
Kaspersky Virus.Win32.Nimnul.f
BitDefender Win32.VJadtre.3
NANO-Antivirus Trojan.Win32.Banload.cstqaj
SUPERAntiSpyware Trojan.Agent/Gen-FakeMS
Avast Win32:Nitol-A [Trj]
Tencent Virus.Win32.Loader.aab
Ad-Aware Win32.VJadtre.3
TACHYON Virus/W32.Ramnit.C
Emsisoft Win32.VJadtre.3 (B)
Comodo Packed.Win32.MUPX.Gen@24tbus
F-Secure Clean
DrWeb Trojan.DownLoader18.16955
Zillya Virus.Nimnul.Win32.5
TrendMicro PE_WAPOMI.BM
McAfee-GW-Edition BehavesLike.Win32.Virut.pc
Trapmine malicious.high.ml.score
CMC Clean
Sophos ML/PE-A + W32/Nimnul-A
Ikarus Virus.Win32.Wapomi
Jiangmin Win32/Nimnul.f
Webroot Clean
Avira W32/Jadtre.B
Kingsoft Clean
Microsoft Virus:Win32/Mikcer.B
Gridinsoft Trojan.Heur!.03212289
Arcabit Clean
ViRobot Win32.Ramnit.F
ZoneAlarm Virus.Win32.Nimnul.f
GData Win32.Virus.Wapomi.A
Cynet Malicious (score: 100)
AhnLab-V3 Win32/VJadtre.Gen
Acronis suspicious
VBA32 Virus.Nimnul.19209
ALYac Win32.VJadtre.3
MAX malware (ai score=89)
Cylance Unsafe
Zoner Probably Heur.ExeHeaderL
TrendMicro-HouseCall PE_WAPOMI.BM
Rising Virus.Roue!1.9E10 (CLASSIC)
Yandex Trojan.GenAsa!H41PVEbKGsY
SentinelOne Static AI - Malicious PE
MaxSecure Virus.Nimnul.F
Fortinet W32/CoinMiner.EC2B!tr
AVG Win32:Nitol-A [Trj]
Panda W32/Pcarrier.A
CrowdStrike win/malicious_confidence_100% (D)
No IRMA results available.