Static | ZeroBOX

PE Compile Time

2021-09-15 14:13:35

PE Imphash

320ffb3ead7d13ea9d4a4b7814c6523f

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0005d000 0x00012800 7.99655156694
.sedata 0x0005e000 0x000c8000 0x000c7a00 7.7875064487
.idata 0x00126000 0x00001000 0x00000200 4.20752531018
.rsrc 0x00127000 0x00001000 0x00000a00 2.97314938448
.sedata 0x00128000 0x00001000 0x00001000 7.98178060492

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00127588 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00127588 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00127588 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x001276d4 0x00000014 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_GROUP_ICON 0x001276d4 0x00000014 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_MANIFEST 0x001276e8 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library KERNEL32.dll:
0x526196 GetProcAddress
Library SHELL32.dll:
0x5261a2 ShellExecuteA
Library urlmon.dll:
0x5261ae URLDownloadToFileA
Library MSVCRT.dll:
0x5261ba strncpy
Library IPHLPAPI.DLL:
0x5261c6 GetInterfaceInfo
Library PSAPI.DLL:
0x5261d2 GetMappedFileNameW
Library USER32.dll:
0x5261de GetWindow
Library ADVAPI32.dll:
0x5261ea RegDeleteKeyA

!This program cannot be run in DOS mode.
.sedata
.idata
.sedata
]2Ua{*
'cj&Uj
'jp6)8
etXUZY
$t,Lu6
nIngF[
I(hrh6i
BErT^Pj
l!\H6
M@RT)
fiZ} O
8MyvK_I
Sn=:Lv
$zOa"of
AEpf$
"9&|h@
7m!=e1
h7~,Ia
Z.I435
O55M=J(
$@b(I@
3@)gXcL
H"#WGt?
.3Zq9v
7r!j"CU)S
q!]zMD\B
t'j6;'
IY2uKN
r/HWG$
zbt,n
f7#/WW\:G
RUZs2?
Ngj!co
3!|WL
>Z14jr
5AO^JM
j%/mz2l2
D%vrI@nH
R?YP~f7
E+nEJ{
^Sd|Cy
;K9dhK
0T6},5m
*ivfqReia!+2
PbT}!7*"
P4CfGx
:\Viujw
6}`--S
2g<qn?%PU
{CIr/:
:"TRSA
,;*p;y
O$03~B|
ZIDd\52ci
s*f8QF
,`@rfo
_}+{8DtTlt
Yk3`1U
rpOUE|
F cdrd
npcF@Q
4D{"^5
exO _'
+'iKC2R
-#Fbua
$^/?Ak
-{>VX4_~
O'hVDk
x!%1=#
/SlbBrQY
,[R<60
3}9V4np(iB*
ab>9mX
0LUQ2#
Xxa=#~
5cfm\E
msRX^g
K'_+$a
Sj&9k:s
t[Ge~Y
/4M"V-
pHhU40
&.$C`!
:*c-;m
tF8agJ
=z@mnd
Y%1U-]
x8Z1iD
1id,wV
-%i).Ra~
qP4#|/
$O4KSE
EoVWOY
%L[Q
B^*Eo_
W<ThM)
kRa=2B
CIfpE;
l+s&d
}Mee_P
Gm'c<J
0kKQB3k
V^Aj#B
_[#5M!Z
Ti(/R*y
P{O/Aal
T"H3Vp(
Vf)hT}P
w8e0tQ!
/`$KH;
v2POCU
wgFZo7
ST#:Y\
*t-AZ\
^.AZd+B
41,{ u
zUuH/{
=3r,{
;L$,wv)L$,
rmqpsj
5=Z6{R
6xi"'
rm|OF4
/6!`kD
/6!`fM
f$H;_
03*E1#,m
2-\6+m
fd2r4i
!8$8:l
|%fWfW
fHz9{7g
#=Z:4'N
;nyX\F
7cMm=f
[m|O]-
8r4:QS
~ 2Oxr
Og#`7Z
e\jv++B
YiZs0H
*'&[03*
O?}',H
%TMiXf
nyXfPf
84rD}L
~/u3H@
r-=ZZS
/}``3H
3N*3sj
GetModuleHandleA
GetProcessHeap
HeapCreate
ntdll.dll
RtlAllocateHeap
LoadLibraryExA
CreateFileW
GetFileSize
ReadFile
CloseHandle
VirtualProtect
GetTickCount
GetProcAddress
RtlFreeHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DbgBreakPoint
DbgUserBreakPoint
DbgUiRemoteBreakin
kernel32.dll
NtQueryInformationThread
NtSetInformationThread
user32.dll
advapi32.dll
hid.dll
iphlpapi.dll
VirtualAlloc
VirtualFree
SetThreadAffinityMask
GetCurrentThread
ExitProcess
GetSystemDefaultLangID
GetSystemTime
SystemTimeToFileTime
WriteFile
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThreadId
GetExitCodeThread
OpenThread
TerminateThread
SuspendThread
MultiByteToWideChar
WideCharToMultiByte
IsWow64Process
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CheckRemoteDebuggerPresent
CreateThread
ResumeThread
GetThreadContext
SetThreadContext
mscoree.dll
mscorwks.dll
mscorsvr.dll
KernelBase.dll
mscoreei.dll
clr.dll
diasymreader.dll
SECheckProtection
SEGetAppStatus
SESetAppStatus
SEGetLicenseUserInfoW
SEGetLicenseTrialInfo
SEGetNumExecUsed
SEGetNumExecLeft
SESetNumExecUsed
SEGetExecTimeUsed
SEGetExecTimeLeft
SESetExecTime
SEGetTotalExecTimeUsed
SEGetTotalExecTimeLeft
SESetTotalExecTime
SEGetNumDaysUsed
SEGetNumDaysLeft
SECheckHardwareID
SECheckExpDate
SECheckExecTime
SECheckTotalExecTime
SECheckCountryID
SEGetHardwareIDW
SECheckLicenseFileW
SEGetLicenseHash
SENotifyLicenseBanned
SEResetTrial
SEGetProtectionDate
SEAddMemoryGuard
SEDelMemoryGuard
CreateFileMappingW
MapViewOfFile
MapViewOfFileEx
UnmapViewOfFile
LoadLibraryExW
LoadLibraryA
=j&&LZ66lA??~
}{))R>
f""D~**T
V22dN::t
o%%Jr..\$
&&Lj66lZ??~A
99rKJJ
==zGdd
""Df**T~
;22dV::tN
$$Hl\\
C77nYmm
%%Jo..\r
>!KK
55j_WW
&Lj&6lZ6?~A?
~=zG=d
"Df"*T~*
2dV2:tN:
x%Jo%.\r.
t>!K
a5j_5W
ggV}++
Lj&&lZ66~A??
bS11*?
Xt,,4.
RRvM;;
MMfU33
PPxD<<%
Bc!! 0
~~zG==
Df""T~**;
dV22tN::
xxJo%%\r..8$
tt>!
pp|B>>q
aaj_55
UUPx((
cccc||||wwww{{{{
kkkkoooo
gggg++++
YYYYGGGG
&&&&6666????
nnnnZZZZ
RRRR;;;;
[[[[jjjj
9999JJJJLLLLXXXX
CCCCMMMM3333
PPPP<<<<
~~~~====dddd]]]]
ssss````
""""****
2222::::
$$$$\\\\
7777mmmm
llllVVVV
eeeezzzz
xxxx%%%%....
ttttKKKK
pppp>>>>
ffffHHHH
aaaa5555WWWW
UUUU((((
BBBBhhhhAAAA
='9-6d
_jbF~T
11#?*0
,4$8_@
t\lHBW
QPeA~S
>4$8,@
p\lHtW
+HpXhE
T[$:.6
00006666
CCCCDDDD
TTTT{{{{
####====
ffff((((
vvvv[[[[
IIIImmmm
%%%%rrrr
]]]]eeee
llllppppHHHHPPPP
FFFFWWWW
kkkk::::
AAAAOOOOgggg
tttt""""
nnnnGGGG
VVVV>>>>KKKK
yyyy
YYYY''''
____````QQQQ
;;;;MMMM
ccccUUUU!!!!
6bad allocation
_except_handler3
MSVCRT.dll
GetInterfaceInfo
IPHLPAPI.DLL
??3@YAXPAX@Z
strncpy
wcsrchr
??2@YAPAXI@Z
strncat
_wcsicmp
_wcsnicmp
__dllonexit
_onexit
_initterm
malloc
_adjust_fdiv
GetMappedFileNameW
PSAPI.DLL
DeviceIoControl
DeleteCriticalSection
GetModuleFileNameW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleExA
LoadLibraryExW
MapViewOfFileEx
GetLogicalDriveStringsW
QueryDosDeviceW
KERNEL32.dll
wsprintfW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
MessageBoxW
FindWindowA
GetDesktopWindow
GetClassNameA
GetWindow
USER32.dll
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
ADVAPI32.dll
SHGetFolderPathW
SHELL32.dll
fH}(fC
Hx9y7Z
5psj_^
l$ fSf
2-<fSf
103*Ef
K*z|{B
Bz){/V
strncpy
_onexit
MSVCRT.dll
??2@YAPAXI@Z
s03*Ea
MSVCRT.dll
IPHLPAPI.DLL
GetInterfaceInfo
_except_handler3
MSVCRT.dll
??3@YAXPAX@Z
MSVCRT.dll
MSVCRT.dll
MSVCRT.dll
__dllonexit
wcsrchr
MSVCRT.dll
malloc
MSVCRT.dll
_adjust_fdiv
MSVCRT.dll
strncat
MSVCRT.dll
_initterm
_wcsicmp
MSVCRT.dll
_wcsnicmp
MSVCRT.dll
??2@YAPAXI@Z
MSVCRT.dll
MSVCRT.dll
MSVCRT.dll
_initterm
MSVCRT.dll
PSAPI.DLL
MSVCRT.dll
__dllonexit
MSVCRT.dll
GetMappedFileNameW
KERNEL32.dll
GetLogicalDriveStringsW
GetMappedFileNameW
KERNEL32.dll
QueryDosDeviceW
PSAPI.DLL
MSVCRT.dll
GetWindow
_wcsnicmp
KERNEL32.dll
GetModuleFileNameW
UnmapViewOfFile
KERNEL32.dll
USER32.dll
USER32.dll
GetClassNameA
MSVCRT.dll
USER32.dll
OpenClipboard
USER32.dll
EmptyClipboard
SetClipboardData
USER32.dll
USER32.dll
CloseClipboard
MapViewOfFileEx
KERNEL32.dll
strncat
wcsrchr
KERNEL32.dll
MapViewOfFile
KERNEL32.dll
CreateFileMappingW
USER32.dll
wsprintfW
MessageBoxW
USER32.dll
strncpy
wsprintfW
KERNEL32.dll
DeleteCriticalSection
KERNEL32.dll
MSVCRT.dll
GetModuleHandleExA
MSVCRT.dll
KERNEL32.dll
LoadLibraryExW
RegDeleteKeyA
ADVAPI32.dll
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
RegSetValueExA
RegCloseKey
ADVAPI32.dll
RegQueryValueExA
ADVAPI32.dll
ADVAPI32.dll
RegOpenKeyExA
KERNEL32.dll
MSVCRT.dll
DeviceIoControl
USER32.dll
USER32.dll
MessageBoxW
SHELL32.dll
SHGetFolderPathW
_wcsicmp
MSVCRT.dll
USER32.dll
GetDesktopWindow
USER32.dll
FindWindowA
USER32.dll
FindWindowA
FindWindowA
USER32.dll
FindWindowA
USER32.dll
f^f^WfT
j$m>Z,
z5{3hD$
S3*Euf
-vJw"0^-
/6!`bD
rm|UPd
("k'p-
#<6V@~
jcIq(
sbl:tA
vXL}@:
g#z{r
&BjhT^
*O:vn4KV
+d%~j@
Ho,'g48
qll|"T
z_6$#n7
Q3ydpa@
0"+!6U
6Zr<)K
vn*L<<
6=#J*W
j =DfN
$Hr*s(j
rm|OfX
6.?2bq
OJ7g+
.p9;MN
y;eTV
~L2n%I
Z~Bl8Y
RjTmIH
:#kF)
y90\8C
;7o!*l
{$5o"
-Tu{csV
Q35]]!
5"5vm?
@`clIL
pt#R%H
h|r-%c
6i6AZo`
5&n8rLsot
103*~=
rmr9s7
}$AZ>k
f=&rwP
{9z!fZf
Y'(6AZI
v3w1&Q
6!`dTC
84'NMg(
2-<mM-
`Mw!vVq
crm|h5-w&
PFe|#0O
4 Adg
@Zg6!`
"pj`1jd
C".?%;Q
103!C<_
Yo1}Mt
03*E"]
d$ afU
103*ET
{RfSfRW
.Eia!`
Y&K/{ {
Eaqps
K,{ =T&G
rm|O|b
4Kwkova
ova^J0
v_m.B}
|lL'`S
sKBDNO
JEqvY9
KJ10X4|
SRGZ]|
"rpm7SI
gh.ukw
0~~Oei
w-e{My]?
<R:(ebh
>)e\Jz
z~/e%V~;
,ez(=|>
.e{1a'
,ejN2U
1Dx,e+
'eUJs/
+e'G@c]S
T%(eCc
O7Os9,e
&I'eZ&
hH0)(e
_n&e&$
Od")ehU
In"(eOg
%m(eH&
X{3O/eW
/e{r|$
(ek2'#
-LE&e,
'eWk/!
vOM($t
b"rpc\\zc
;\m[#M
bIR7v
]KPD}^
fsl#iW9
><31Hx{
M9tMP-
&0(Y\<
{swM45K
/67vYe
;Zq"HG
RKuv<Ihyc
wUru-o
"e}-Nq
#Jq,W4n
E{(Q0l
[K!xl%L0
K0nN7x
X4&3K0
vO=!<
H0:VIn
J^xO0C$D
G0Z>Zn
bLaH0V
xa$P02
gQ0W8[
I0626k
Q0CWoU/
"IO#L0Q1
0x?7yIo%0H
8edqj|
AX3@_xX
l3Rk3S
Ed{*95
DoPmlgb
\CBgq$Q
rm|OAv"=
"9/o++p
',l@8~
lK'yE[
C=}Ka2
E5uwX6
p~7f~n[5
h~SF|n9
~@|n-%
v]OC|n
(>p)`|n-
Y]5|n
Ay|n8JH
3}nD!O
j|n1Ps
d$ jxf
xfWfPW
urm|OEBN
5$WlWv
aNqps+
miz-n9r
C?m3+4
TTs,TY
>:x_}mI
`z[O'22
>be<k:
>"Kb9F"u
p4/6!`s
,,-fw&
,{qhim
((69A
\03*E=O=
c4, Pw
|^&\^Ji
Vzjs(`p[
I-9#eo
&Ev0Zy
{$n[`K
Y\,h/)
|.:Vq}w
Mwtoe5O'
X7C==5
M;|![A7
#Z~pGw
XkrPf<
A!h";p
}O>=d*+
FutW0+
(cDZY,
O8V~;_
f.?:,'
yJkfkf>
?%53U"
qtC3*E
5j.7~.
(q"Yuu
Dz[LfV
<$KfKfC
q1p/Y@
103*Ep
?9J_!r
Vni=}H
/65W,_
/br_F$
d$$VfS
}LfRPf
pl$+%k
yz84Wu
xE4RJv
|WVo[3
>j/,a]
,Z5vf
vM;PK(
*Bs{j8
$1Xo)'
*p!(b.
i{hW4S
2-<OX4
5f *sc
:QT6,Kbq
;RL7-Lcr
(GxPud
BH([ZU
CzbbhM
:|g=}K
:_E$"{
w3yK#TO
ZXrm|O
=V42-<
nyXZ~B_
BBrz
$'I6!`
,ptWv6
-VvkaP
ld@QvRTY7
QvoN111
r3Xv82
0Qv.J26D2/
H@=+Qv
VvtJq/
EQvdJ<
e)L?.Vv
:*}/="Sv
\fcrZ,
CSV+Sv
}<}>Sv
adWv@B5
2x?JTv
{}&Yv4
QvN67e
Kv+Qv
*8;Sv*
E#HW/Svg
ssCe~I
5&p1#g
`.d8qR
qvCDwz{{
Q#|DM[l
1Z!~>iF
03*Ehj
-4=N-<
_-K2HR`
QG2H>t
9[gy&B
b]Ajy;T
jX_hvq
/6!t0'
=kTtJ
!>?@q6
gzh_vti
qp)%c{
}>Oyr
m;tG3H/
,02HI_
[_e6G9
e{qhifk
dnN7xg
y-X.=3
@zAh,'
p;)Te
s3s/y@
4R2HWM
<Zj*O}
whsYcX
,H2(y'
<Vmqm*
LUFtP
nrm|Of
w-)bMt
F#eq{Yu
qR5XI%
qpso(M
=yXo@7
ic9;Vb
s;0HC[
vqrm|O
9Pd5+Jaf
4h%#l7
RTY7^$
vsmRx\
#{$Hcl
=(),:+
4,n~h$~
103H}*
2tR0rM%
#!^-H>T
4[-H1G
2-<5]!
/Nmf[+
'$EiyX
O}l'4R
rm|kEY
",103*W
ysqbAAT,&
VP&(CO
y<yeBD
rmty|O
|N@i0u5
7^aoCX
Mcs>rS
Ji#"q?
f'L0?z
jRAJ~~
@`c~R`#
@[03*+1
q(B?XE
*vL>Vx
u?t$fAa
qpOs,_
gl]h\HG
03*ES
6103*E
2qpsjw
!D50[K=
Vg,+R
MGv03*
Hq\cSu
Dm6*6<C}
we+=Ux
gYq-ny
!M7W'b
O$!:[T_
K}tq.[
1|Q\!y
q+K/6!`d
ZK03*E
"K"rEF
;;=Xdh
;*l:rX
5hu*lX
S;H6,f
*aV4'N
'VmS-9
;#3@rsV
7-$8r]j
Pp(ml+
rm|Mvl
'^qICqd
>hAClX
j$A I+@
;R77-Lcr
'qaGdM
4vj@eN".
<2Qhu<S
"Kb972
GQ"+ B
M03EFx
'>vd6!`
*VBa1j
.~eqpsj
qpsj:UT
ErSch b
F<103*j
f2$)M
Kk05O6
@bD6!`
#`Ap*q(
1%|~AH
1%|~AH
kGO!4"L
UDbgc$
;*3yTL
Zgcu^~
nyXc5u
PSTTQj
uf)wq_
*/6!`M
<H6Nq
]M7Q1O
,tfEZ\Stj
j-&=H8
V%m,@$
oxCVxK<
]X<N\,
TWy(ec
Q}oyX
E5O=;8
BX4~Ee
RA_d`h
/6!`WOgN
'j%4HH
tJErm2-
K;i578
zz722w
q#p!,?
wqo`e2ESF
(KTL(N
1Y+@%J
q\oJv<E
c[s~4H
tlnmlE
_Y#dpl
ova)B4
{az= ^
nt=HQG
WC "Vi
v$*'<H
&QhY!mX
NQh:MCbq
>QK++,
4_v8';
"3J$\1
GDy">,
{/-0y"
z>.|vx
V03*E{
nyXh4qmX
bXWNht
9d8o}]
@M<Z_[
Dh9gmX
+`ApGq
d5HLBd1
UOM\4.$
F~?1+}
"N~+O%
}tKB%<W
X0*XO'[R*$
.WF0Ppx
rm|O]&
B?.kSfV
4t*Q^R
UqURg~[$f
6Stt&
03*E&e
`tYY}7
9bQ;[{
d5u!i-
QEm.A_
4_F6hA
yS~uf
Y"(9<%a
JM%P*<
,CrI\;j
6!`}%e|
W'3H5
BE\AHG
{^"ue(
!6H9h8
nyXh-
\B&*lq
#&e+AM
E3ODvW
kecF~B
\-PG#Jjr
'/A]Ha
UKNZ\
?&}5$W
d<Hg7DY
ny( gP
>3,6!`
F]QB8W
03*E_\E
_r2YP]
h.=Q/p
QBOTQU
-~&coK
3s&6[&
~f 0?/
WojPH$
:_VGG6
/Z" GBd,a6E
1" Z)5
sH_kfk
~xXX]*+BM
$kJJY!
.Z=Hg=
||E,e_
vm${(C
3>t:+8=:>
"xSK.9
ZU#?=d
/6!`5O
k^mgi
LF>+!@Q
hhHWnX
_[Yy1J
}hUInX
[MG[3}
9^%I]'
ova%aL
%,1.2v
ih0AnX
',)-qY
103ot2
b@TQTOs
sD+(Q^
+B3GDi
KIjq,Y
:=H{K5
%3H&|>
4'!5250Th2
07qnr
%T!py4
n5$WOv<
r{FG^Q7@
"hojnX
gqpsj;
cvahT^
^h~g2P
kg<i(D
w~$I%D
z=HrBv
*jz3qO
.M=6 BT
w=??B1
n>a;=H
pWR>i=8
Wz=~Br
k2:0 ;
0?>g|X
xe!:u\j
O/K(ho
~0g^)_
icCqA;
&V,GX4
[/,Sq2_
DZGZJA
qpsMotO
tWQO2j'
_=Hq'J
;renyX
>H`8Jz!
/6!w05
QBOTQUa
lqps[}
Q8^4HL1j
=6P+|*
5L!Kj{
_dYm_E
\]t[F4
1)=8#J
?=f-;W
a'}?^A
psj(PQ)
OBs& s
i,b],[
A~jGI5
^x`Z+u
rm|O;]b?k]
n]><7,
,%Tnf>q
)*7vNH\4~
j-6eVA'>
,q~Sr2
8},t;3
'\ )F!
I'lyN]%
7<R'_k
Eyc%y|
;r}qWk
&XkoK'q
7#}Yks
WOa[kN\
M`'@Xkh
<Vkw3
g7>AYk
npq6_]Xk
{7wVJe
}U@Xk
_kCWjY
8VkNq$
]k{1a'
7_"1t{
BT>g5.~;H
ka""O)
3L4Y'hj8Hs
8z4'NF$
+l\(1m|O
0Tn9$C
C\Dm;6S9H
7K-<dz
@h9@v&
J^g:MG
jQf.oz${c
Cc(g{*
GZ}.,ZG?
iC\[Z[]
,vc{M!
,xL'c%viQ
qkSa@W
}1v4@<
K_~10$,
(8{C=7
~g]p8c[
;c6y3sf<)
eg^C,Z
|QcNT%
!;h-Fh
`\[;>r
d(cWOb9
3BkHI!0
[_K2kvJ
{QOO20
\*\%nB%
2u/wMAl
?|sk*9"8
j2SdpT
H[#Q)j
-vx^(p
ftw^is
JaBF^R&s
@7A#5ZJ
F(.b4<+
x!v{R!>
,<'n-r
WPMWtY
t<c=>,
1i^c$m&P^
0"Y'z,I
TlsFree
tSleep
GetACP
?KERNEL32.dll
H!f=s"
GetProcAddress
HeapSize
RtlUnwind
0RaiseException
GetModuleHandleA
GetCommandLineA
GetStartupInfoW
BTerminateProcess
TlsAlloc
HeapFree
EncodePointer
TlsGetValue
>TlsSetValue
GetCurrentProcess
HeapSetInformation
IsDebuggerPresent
/6SfXf[
DecodePointer
pSetLastError
,GetModuleHandleW
InterlockedIncrement
WriteFile
-GetCPInfo
:HeapCreate
:GetLastError
GetCurrentThreadId
ExitProcess
GetStdHandle
;GetFileType
GetFileAttributesA
GetModuleFileNameW
SetHandleCount
GetTickCount
GetOEMCP
2IsValidCodePage
HeapAlloc
&PSAPI.DLL
UCloseHandle
LoadLibraryW
CreateProcessA
%LCMapStringW
(GetStringTypeW
/GetModuleFileNameA
HeapReAlloc
xCompareStringW
SHELL32.dll
ShellExecuteA
urlmon.dll
MSVCRT.dll
UnhandledExceptionFilter
InterlockedDecrement
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
Tr<"L7
&bBS-V
GetCurrentProcessId
DeleteCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetExitCodeProcess
QueryPerformanceCounter
WaitForSingleObject
USER32.dll
EnterCriticalSection
URLDownloadToFileA
MultiByteToWideChar
ADVAPI32.dll
IPHLPAPI.DLL
SetEnvironmentVariableA
Safengine Shielden v2.3.9.0
KERNEL32.dll
SHELL32.dll
urlmon.dll
MSVCRT.dll
IPHLPAPI.DLL
PSAPI.DLL
USER32.dll
ADVAPI32.dll
GetProcAddress
ShellExecuteA
URLDownloadToFileA
strncpy
GetInterfaceInfo
GetMappedFileNameW
GetWindow
RegDeleteKeyA
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
Antivirus Signature
Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.Generic.lIx9
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Symmi.75598
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
ALYac Gen:Variant.Symmi.75598
Cylance Unsafe
VIPRE Gen:Variant.Symmi.75598
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 005239691 )
BitDefender Gen:Variant.Symmi.75598
K7GW Trojan ( 005239691 )
Cybereason malicious.37325b
Baidu Clean
VirIT Clean
Cyren W32/ABRisk.YHQG-3684
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Packed.NoobyProtect.M suspicious
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky Backdoor.Win32.Farfli.cejj
Alibaba Packed:Win32/NoobyProtect.06d96a2d
NANO-Antivirus Trojan.Win32.Farfli.jsxwrl
ViRobot Clean
Rising Backdoor.Farfli!8.B4 (TFE:5:TpoaHBHYiZI)
Ad-Aware Gen:Variant.Symmi.75598
TACHYON Clean
Sophos Generic ML PUA (PUA)
Comodo TrojWare.Win32.Amtar.KNB@4wlm66
F-Secure Clean
DrWeb BackDoor.Siggen2.3334
Zillya Clean
TrendMicro TROJ_GEN.R002C0DJ722
McAfee-GW-Edition BehavesLike.Win32.Generic.cc
Trapmine malicious.high.ml.score
FireEye Generic.mg.53460de37325b497
Emsisoft Gen:Variant.Symmi.75598 (B)
Ikarus PUA.NoobyProtect
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1237416
Antiy-AVL Trojan/Generic.ASBOL.C6B4
Kingsoft Win32.Hack.Undef.(kcloud)
Microsoft Trojan:Win32/Tnega!MSR
Gridinsoft Trojan.Heur!.030100A1
Arcabit Trojan.Symmi.D1274E
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Win32.Packed.NoobyProtect.B
Google Detected
AhnLab-V3 Trojan/Win.Generic.R514498
Acronis suspicious
McAfee RDN/Generic BackDoor
MAX malware (ai score=85)
VBA32 Clean
Malwarebytes Malware.AI.1868818684
Panda Trj/Agent.TV
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DJ722
Tencent Win32.Backdoor.Farfli.Osmw
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet Riskware/Application
BitDefenderTheta Gen:NN.ZexaF.34698.3uW@aiSjXkej
AVG Win32:MalwareX-gen [Trj]
Avast Win32:MalwareX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.