Static | ZeroBOX

PE Compile Time

2039-01-05 18:46:45

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00001008 0x00001200 5.08906836778
.rsrc 0x00004000 0x00021e10 0x00022000 6.02151698491
.reloc 0x00026000 0x0000000c 0x00000200 0.0776331623432

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000247f4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x000247f4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x000247f4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x000247f4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x000247f4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x00024c6c 0x0000004c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x00024cc8 0x000003ec LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x000250c4 0x00000d48 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
WindowsFormsApp98
<Module>
System.IO
add_OnData
remove_OnData
Program_OnData
mscorlib
get_Id
Thread
Interlocked
CompressionMode
CompareExchange
Invoke
IDisposable
Console
set_Title
get_MainModule
ProcessModule
get_FileName
get_FullName
Combine
WebResponse
GetResponse
Dispose
Create
Delegate
CompilerGeneratedAttribute
GuidAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
Remove
Uvqzst.exe
System.Threading
System.Runtime.Versioning
String
get_Length
BufferedStream
get_BaseStream
GetResponseStream
GZipStream
MemoryStream
Program
System
AppDomain
GetDomain
System.IO.Compression
System.Reflection
Exception
CopyTo
FileInfo
InvokeMember
StreamReader
sender
Binder
EventHandler
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
GetTypes
BindingFlags
EventArgs
GetCurrentProcess
Object
System.Net
WebRequest
Uvqzst
Lkbnkvitcbruxjtsqlpasaw
ToArray
Assembly
op_Equality
WrapNonExceptionThrows
+Notepad++ : a free (GNU) source code editor
Don HO don.h@free.fr
Notepad++
Copyleft 1998-2017 by Don HO
$0f4535ef-510b-4cee-89c0-b377dad58456
8.4.6.0
.NETFramework,Version=v4.6
FrameworkDisplayName
.NET Framework 4.6
_CorExeMain
mscoree.dll
8etuu9
/""###
R200 _
uww_<11
lVFFFd
'[+jjN):
~o|^)U
geW|1p]
Tn,w9p
@Dhkkc
GDdhjdrVe
"rq)Wz
lgPtQ(
wC?n$P
leQ(Uw
YGGG9|
$B)"n
(ub% L+
C4`OXQ(
'WJgA+
=H__K
X,vk[[
F4.zGk
m F9_f
366Jgg
RiFU^c
I)(XvY
`![zd~Ft
T,H<x^
([~i-[
,`naE(
FWz;:/
TO >>j
kT2*O1
D1a3}X
{S+}[[
OO5,~j2[l
f4QdCG
k{ja$U
-!:wv`
{UosSO|}
\n:_CL=WtGb]
L<3Kz:
rOWfl<
J8ZE=t\
64Q>s
}cL?1[
B)eB`-
~V)uTk
RLLL019
]_Rm[
;:W]P)
TM,XnI
AJIw{
9SC(RH
L$$RGq
TWOJAs<D
&r(7`C:
zu)M[K
J|AVJYPJ
;| c'O
{55G<f
t]8n=+
Cv<Kv,
*J/kXc
z9eUz)
V"Pf8B
TG+TF+$
4@}c=F2
8(-7#"
,K4';tN
6~.^M`
*QhHQW!j1F
F,h`x+}
B`TD~X3
`5Dg4V
E7dUMD
5 \X['@
BDz;yCo
8(V>eJ
C #%#O|
#liMwnS
91b*^})
'42#&S
2BHRMH1vF
`I^`(<
l6KG;8
f~oLp0
ol!nUQcc
_C6fYJ
n+[5idM
? F!l4
fHY(mN
96V6RK
TK6kW>
u"B#kp
e{<~Mb;
(MUZ@mQQ
RXF9\D
222xRQR$tst
110`&&'*AAA
!8j2.V
iS6662ihi
###-(((:,,,K,,,K(((?$$$.
 }BAB(
&#BuOI
???yT
.,.y/-/
0-,81/0c1-,81&-
+''s'''
<?xml version="1.0" encoding="utf-8"?>
<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<!-- UAC Manifest Options
If you want to change the Windows User Account Control level replace the
requestedExecutionLevel node with one of the following.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Specifying requestedExecutionLevel element will disable file and registry virtualization.
Remove this element if your application requires this virtualization for backwards
compatibility.
-->
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- A list of the Windows versions that this application has been tested on
and is designed to work with. Uncomment the appropriate elements
and Windows will automatically select the most compatible environment. -->
<!-- Windows Vista -->
<!--<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" />-->
<!-- Windows 7 -->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />-->
<!-- Windows 8 -->
<!--<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />-->
<!-- Windows 8.1 -->
<!--<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />-->
<!-- Windows 10 -->
<!--<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />-->
</application>
</compatibility>
<!-- Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher
DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need
to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should
also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config.
Makes the application long-path aware. See https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation -->
<!--
<application xmlns="urn:schemas-microsoft-com:asm.v3">
<windowsSettings>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
<longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
</windowsSettings>
</application>
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
<!--
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="*"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
</assembly>
Zzmuzbvv.Jkkrbnzitxjovi
Ljxeqciujdxngghotnxsr
http://www.bondkosmetyki.pl/wp-content/plugins/Kenjjqbio.png
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Notepad++ : a free (GNU) source code editor
CompanyName
Don HO don.h@free.fr
FileDescription
Notepad++ : a free (GNU) source code editor
FileVersion
8.4.6.0
InternalName
Uvqzst.exe
LegalCopyright
Copyleft 1998-2017 by Don HO
LegalTrademarks
OriginalFilename
Uvqzst.exe
ProductName
Notepad++
ProductVersion
8.4.6.0
Assembly Version
8.4.6.0
Antivirus Signature
Bkav W32.AIDetectNet.01
Lionic Clean
tehtris Clean
ClamAV Clean
FireEye Generic.mg.2cd179ab4d6e70b4
CAT-QuickHeal Clean
McAfee Artemis!2CD179AB4D6E
Cylance Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender IL:Trojan.MSILZilla.23760
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Cyren W32/MSIL_Agent.DWN.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.NYV
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky UDS:Trojan.MSIL.Scarsi.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan IL:Trojan.MSILZilla.23760
Rising Clean
Ad-Aware Clean
Emsisoft Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
Trapmine Clean
CMC Clean
Sophos Clean
Ikarus Clean
GData MSIL.Trojan-Downloader.Agent.BJF
Jiangmin Clean
Webroot Clean
Avira Clean
MAX malware (ai score=86)
Antiy-AVL Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Google Detected
AhnLab-V3 Clean
Acronis Clean
VBA32 Downloader.MSIL.gen.rexp
ALYac Clean
TACHYON Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Clean
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat
BitDefenderTheta Gen:NN.ZemsilF.34754.im0@a8fiFMj
AVG Win32:RATX-gen [Trj]
Avast Win32:RATX-gen [Trj]
CrowdStrike win/malicious_confidence_90% (D)
No IRMA results available.