Static | ZeroBOX

PE Compile Time

2022-12-11 07:03:18

PE Imphash

d71d7fdd44a947be9fe6de2a6620b3f7

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000158ea 0x00015a00 6.61899065368
.rdata 0x00017000 0x000072c2 0x00007400 5.05214647344
.data 0x0001f000 0x0002d774 0x0002ce00 5.9711005116
.rsrc 0x0004d000 0x000001e0 0x00000200 4.71377258295
.reloc 0x0004e000 0x00001100 0x00001200 6.36707421206

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0004d060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library SHELL32.dll:
0x417120 CommandLineToArgvW
Library GDI32.dll:
0x417000 GetPolyFillMode
0x417004 ArcTo
Library KERNEL32.dll:
0x41700c CreateFileW
0x417010 WriteConsoleW
0x417014 GetModuleHandleExW
0x417018 GetCommandLineW
0x41701c LocalFree
0x417024 GetCurrentProcessId
0x417028 GetCurrentThreadId
0x417030 InitializeSListHead
0x417034 IsDebuggerPresent
0x417040 GetStartupInfoW
0x417048 GetModuleHandleW
0x41704c GetCurrentProcess
0x417050 TerminateProcess
0x417054 RaiseException
0x417058 RtlUnwind
0x41705c GetLastError
0x417060 SetLastError
0x417074 TlsAlloc
0x417078 TlsGetValue
0x41707c TlsSetValue
0x417080 TlsFree
0x417084 FreeLibrary
0x417088 GetProcAddress
0x41708c LoadLibraryExW
0x417090 EncodePointer
0x417094 GetStdHandle
0x417098 WriteFile
0x41709c GetModuleFileNameW
0x4170a0 ExitProcess
0x4170a4 DecodePointer
0x4170a8 GetCommandLineA
0x4170ac HeapAlloc
0x4170b0 HeapFree
0x4170b4 CompareStringW
0x4170b8 LCMapStringW
0x4170bc GetFileType
0x4170c0 FindClose
0x4170c4 FindFirstFileExW
0x4170c8 FindNextFileW
0x4170cc IsValidCodePage
0x4170d0 GetACP
0x4170d4 GetOEMCP
0x4170d8 GetCPInfo
0x4170dc MultiByteToWideChar
0x4170e0 WideCharToMultiByte
0x4170f0 SetStdHandle
0x4170f4 GetStringTypeW
0x4170f8 GetProcessHeap
0x4170fc FlushFileBuffers
0x417100 GetConsoleOutputCP
0x417104 GetConsoleMode
0x417108 GetFileSizeEx
0x41710c SetFilePointerEx
0x417110 HeapSize
0x417114 HeapReAlloc
0x417118 CloseHandle

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
URPQQh =@
UQPXY]Y[
QQSVWd
F4_^[]
<ItC<Lt3<Tt#<h
A<lt'<tt
Tt)jhZf;
Jjl^f;
V2jx_f;
F2jgYf;
YYhxqA
u,PQRS
Wj0XPV
SPjdVQ
zSSSSj
f9:t!V
QQSVj8j@
CY<u
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
bad allocation
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__swift_3
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
bad exception
(null)
CorExitProcess
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[aOni*{
~ $s%r
@b;zO]
v2!L.2
1#QNAN
1#SNAN
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
Unknown exception
bad array new length
string too long
user32.dll
kernel32.dll
VirtualProtect
ixHhA1 + %d
%d: %ws
.text$mn
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.rsrc$01
.rsrc$02
SHGetFolderPathAndSubDirW
CommandLineToArgvW
SHELL32.dll
GetPolyFillMode
GDI32.dll
GetCommandLineW
LocalFree
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
KERNEL32.dll
RaiseException
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
$_Uvt,
T<pjY+p
T0pjQ+p
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVbad_exception@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVtype_info@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
6;6@6M6
9#959?9
9-:<:E:R:h:
;!;';:;
<&<0<P<
='=,=?=Q=n=
> >'>/>7>?>K>T>Y>_>i>s>
0 050>0m0v0
3&4k4p4t4x4|4
=">C>Q>W>r>
?$?@?`?n?u?{?
0H0R0r0|0
1)1.131N1X1d1i1n1
0!1-3e3
3!464L4Y4g4u4
S0W0[0_0c0g0k0o0
0o1s1w1{1
1f80;7;\;`;d;h;l;
:);[;l;w;
;(=>=X=f=r=
==>K>T>
1!1+1]1d1
333N3c3h3r3w3
6W6_6i6r6
6M7Y7^7d7i7q7w7
=,=7=?=J=P=[=a=o=
:&:+:0:@:E:J:Z:_:d:t:y:~:
;5;a;j;
="===L=W=\=a=
>1>U>l>q>|>
?$?1?6?D?z?
0 0%0X2
4+4n4t4P5-646
>9>N>`>m>
???F?g?
0+0@0J0m0w0
8C9J9Q9X9r9
:@:h:W<z<
=j=s=w=}=
2%333?3P3^3i314
6G6N6Y6g6n6t6
81888T8[8r8
9.9^9g9
:*:<:N:`:
0E1L1V1z1
374@4X4
0.1N1Y1g1
1#2B2T2^2
343[3|3
4D4c45O5i5
e125<5F5P5
4W5]5j5u5
546F6X6
<M=g=t=
667q9w9|9
:Y:a:i:q:y:
;!;-;9;Y;
1[1\2l2}2
3'3a3p3|3
4L4U4^4g4
2+2?2E2
'7J7S7
788R8Z8g8o8
,181D1H1L1P1T1X1d1h1l1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5
8H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
<$<,<4<<<D<L<T<\<d<l<
?L?P?`?d?h?p?
0 00040D0H0L0T0l0|0
1 1014181P1t5|5
6 6<6@6`6h6l6
7$7(70787@7D7L7`7
8 8@8`8|8
9 9@9`9
: :@:`:
; ;(;,;0;8;L;T;h;p;x;
81h1x1
1 7(7,7074787<7@7D7H7L7X7\7`7d7h7l7p7t7
DigiCert Inc1
www.digicert.com110/
(DigiCert SHA2 Assured ID Timestamping CA0
210101000000Z
310106000000Z0H1
DigiCert, Inc.1 0
DigiCert Timestamp 20210
http://www.digicert.com/CPS0
,http://crl3.digicert.com/sha2-assured-ts.crl02
,http://crl4.digicert.com/sha2-assured-ts.crl0
http://ocsp.digicert.com0O
Chttp://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
QJxy6z'
dwc_#Ri
DigiCert Inc1
www.digicert.com1$0"
DigiCert Assured ID Root CA0
160107120000Z
310107120000Z0r1
DigiCert Inc1
www.digicert.com110/
(DigiCert SHA2 Assured ID Timestamping CA0
fnVa')
http://ocsp.digicert.com0C
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
https://www.digicert.com/CPS0
8aMbF$
V3"/"6
Washington1
Redmond1
Microsoft Corporation1)0'
Microsoft Code Verification Root0
110415194533Z
210415195533Z0l1
DigiCert Inc1
www.digicert.com1+0)
"DigiCert High Assurance EV Root CA0
:8P[w1
AA"Nea
Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
DigiCert Inc1
www.digicert.com1+0)
"DigiCert EV Code Signing CA (SHA2)0
190401000000Z
220111120000Z0
Private Organization1
236387771
Taipei City1
ASUSTeK Computer Inc.1
ASUSTeK Computer Inc.0
TW-236387770
1http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
1http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
https://www.digicert.com/CPS0
http://ocsp.digicert.com0H
<http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Z[p4gS
G(F;{9QXi
DigiCert Inc1
www.digicert.com1+0)
"DigiCert High Assurance EV Root CA0
120418120000Z
270418120000Z0l1
DigiCert Inc1
www.digicert.com1+0)
"DigiCert EV Code Signing CA (SHA2)0
+.+1Xf
http://ocsp.digicert.com0I
=http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
:http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
:http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
.http://www.digicert.com/ssl-cps-repository.htm0
DigiCert Inc1
www.digicert.com1+0)
"DigiCert EV Code Signing CA (SHA2)
DigiCert Inc1
www.digicert.com110/
(DigiCert SHA2 Assured ID Timestamping CA
210825050323Z0/
Aapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
(null)
mscoree.dll
Aapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
Aja-JP
((((( H
((((( H
(
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
dC:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
CihAzbaqtyq
uiAhx12
RAny use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability and are incorporated herein by reference
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Clean
ClamAV Clean
FireEye Generic.mg.d718535b14065b86
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Clean
K7AntiVirus Trojan ( 00597f681 )
BitDefender Clean
K7GW Trojan ( 00597f681 )
Cybereason Clean
Baidu Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 Clean
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky VHO:Trojan-PSW.Win32.Reline.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Stealer.Agent!8.C2 (TFE:4:ua3vGMabA0L)
Ad-Aware Clean
Emsisoft Clean
Comodo Clean
F-Secure Clean
DrWeb Trojan.PWS.StealerNET.125
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition Clean
Trapmine malicious.high.ml.score
CMC Clean
Sophos Clean
Ikarus Clean
GData Clean
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1252646
MAX Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm VHO:Trojan-PSW.Win32.Reline.gen
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Google Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
TACHYON Clean
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Clean
MaxSecure Backdoor.W32.Mokes.gen_242962
Fortinet Clean
BitDefenderTheta Gen:NN.ZexaF.36106.tuY@a4AoIPli
AVG Win32:PWSX-gen [Trj]
Avast Win32:PWSX-gen [Trj]
CrowdStrike win/malicious_confidence_90% (D)
No IRMA results available.