Static | ZeroBOX

PE Compile Time

2050-06-15 08:40:07

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0047b150 0x0047b200 3.41649921138
.rsrc 0x0047e000 0x000037d8 0x00003800 4.16670975096
.reloc 0x00482000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0047e100 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 134217728, next used block 117440512
RT_GROUP_ICON 0x004806b8 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x004806dc 0x0000039e LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00480a8c 0x00000d48 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
IEnumerable`1
List`1
ToInt32
Dictionary`2
__StaticArrayInitTypeSize=4694016
C2C79A7182DE491A364B97C7A1B2A23925B133A392A33707E5C82A5A13BDB916
get_UTF8
WindowsFormsApp49
<Module>
<PrivateImplementationDetails>
System.IO
mscorlib
System.Collections.Generic
add_OnRead
remove_OnRead
Json_OnRead
Thread
Interlocked
ReadToEnd
CompareExchange
Invoke
Enumerable
IDisposable
RuntimeFieldHandle
Console
WriteLine
Combine
ValueType
GetType
System.Core
WebResponse
GetResponse
Dispose
Create
Delegate
CompilerGeneratedAttribute
GuidAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
ObfuscationAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
ToByte
Remove
Qjoojov.exe
System.Threading
Encoding
System.Runtime.Versioning
GetString
Substring
get_Length
Dsqvrbxhrdvbblolvmlmi
GetResponseStream
Program
System
AppDomain
GetDomain
System.Reflection
ValueCollection
System.Linq
InvokeMember
StreamReader
TextReader
sender
Binder
EventHandler
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
get_Values
BindingFlags
EventArgs
get_Chars
RuntimeHelpers
Object
System.Net
Convert
WebRequest
System.Text
Qjoojov
InitializeArray
ToArray
Assembly
WrapNonExceptionThrows
Feature
code control flow obfuscationT
Exclude
Feature
string encryptionT
Exclude
Opera Installer
Opera Software
Copyright Opera Software 2022
$88e9edff-6649-4870-9b0c-6c8dfc66d127
92.0.4561.21
.NETFramework,Version=v4.6
FrameworkDisplayName
.NET Framework 4.6
_CorExeMain
mscoree.dll
4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C010300311761630000000000000000E0000E210B01060000C823000006000000000000FEE52300002000000000240000004000002000000002000004000000000000000400000000000000004024000002000000000000030040850000100000100000000010000010000000000000100000000000000000000000B0E523004B000000000024002C03000000000000000000000000000000000000002024000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E7465787400000004C623000020000000C8230000020000000000000000000000000000200000602E727372630000002C030000000024000004000000CA2300000000000000000000000000400000C02E72656C6F6300000C000000002024000002000000CE23000000000000000000000000004000004200000000000000000000000000000000
<?xml version="1.0" encoding="utf-8"?>
<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<!-- UAC Manifest Options
If you want to change the Windows User Account Control level replace the
requestedExecutionLevel node with one of the following.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Specifying requestedExecutionLevel element will disable file and registry virtualization.
Remove this element if your application requires this virtualization for backwards
compatibility.
-->
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- A list of the Windows versions that this application has been tested on
and is designed to work with. Uncomment the appropriate elements
and Windows will automatically select the most compatible environment. -->
<!-- Windows Vista -->
<!--<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" />-->
<!-- Windows 7 -->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />-->
<!-- Windows 8 -->
<!--<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />-->
<!-- Windows 8.1 -->
<!--<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />-->
<!-- Windows 10 -->
<!--<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />-->
</application>
</compatibility>
<!-- Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher
DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need
to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should
also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config.
Makes the application long-path aware. See https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation -->
<!--
<application xmlns="urn:schemas-microsoft-com:asm.v3">
<windowsSettings>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
<longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
</windowsSettings>
</application>
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
<!--
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="*"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
</assembly>
Rbkpiy.Lfncrxfuudrtczxtqnuegcdv
Vutiqxbzcw
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Opera Installer
CompanyName
Opera Software
FileDescription
Opera Installer
FileVersion
92.0.4561.21
InternalName
Qjoojov.exe
LegalCopyright
Copyright Opera Software 2022
LegalTrademarks
OriginalFilename
Qjoojov.exe
ProductName
Opera Installer
ProductVersion
92.0.4561.21
Assembly Version
92.0.4561.21
Antivirus Signature
Bkav W32.AIDetectNet.01
Lionic Clean
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan Gen:Variant.Lazy.257742
FireEye Generic.mg.74ae5df68e133e9f
CAT-QuickHeal Clean
McAfee Clean
Cylance Clean
VIPRE Gen:Variant.Lazy.257742
Sangfor Trojan.MSIL.Agent.NXY
K7AntiVirus Clean
BitDefender Gen:Variant.Lazy.257742
K7GW Clean
CrowdStrike win/malicious_confidence_100% (D)
BitDefenderTheta Gen:NN.ZemsilF.34754.@p0@aqZUsjf
VirIT Clean
Cyren W32/MSIL_Kryptik.GLW.gen!Eldorado
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.NXY
Zoner Clean
TrendMicro-HouseCall Clean
Paloalto Clean
ClamAV Clean
Kaspersky HEUR:Backdoor.MSIL.DcRat.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Ad-Aware Gen:Variant.Lazy.257742
Emsisoft Gen:Variant.Lazy.257742 (B)
Comodo Clean
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Clean
SentinelOne Static AI - Malicious PE
Trapmine Clean
CMC Clean
Sophos Generic ML PUA (PUA)
Ikarus Trojan.Agent
GData Gen:Variant.Lazy.257742
Jiangmin Clean
Webroot Clean
Google Detected
Avira HEUR/AGEN.1232003
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Trojan.Lazy.D3EECE
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/AgentTesla!ml
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
VBA32 Clean
ALYac Gen:Variant.Lazy.257742
TACHYON Clean
Malwarebytes Malware.AI.4031761534
Panda Clean
APEX Malicious
Tencent Clean
Yandex Clean
MAX malware (ai score=83)
MaxSecure Clean
Fortinet MSIL/Agen.AEY!tr.dldr
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.efcde3
Avast Win32:PWSX-gen [Trj]
No IRMA results available.