Static | ZeroBOX

PE Compile Time

2023-03-09 21:17:18

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x000118f4 0x00011a00 7.87790404364
.rsrc 0x00014000 0x00009128 0x00009200 6.05051273286
.reloc 0x0001e000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0001c74c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0001c74c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0001c74c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0001c74c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0001c74c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0001cbb4 0x0000004c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0001cc00 0x00000338 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0001cf38 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
t{C'.-
u:oIEw
CH|<iLIc`
MdM%F4 x}X
iQd O`
#uAT;M
Q+S&]W
uMx9(d\
TIH-U=
]VNjEE
rFf9Ok
VLZmc_
Jt|;75
~T= +1WZ}z#
,A\(g4
S&uQ*4A
\_-xE'
"o2<qt
WQWMRH3
dXvAXF[
S]Nisjf
U@.6!Q
kXeVI*x
k]]C"mc
T%N5{S
NXtp;tB
@Xb\(U
~ciZ%d
"SrOvK
b;?Pbv
7??-eSdkE *
GS2w3=
sV&Z5|
FQJC&pc
qjWBE0
g1:!Eg
6qtc(.Y
~VGE3B
p7O-Gja
[]`0i6"
Vr(~lv;6/
#"+"#A
P0?=i_
M8zNi-
%=SCHL
} Yq@e
6C@L-vr
*aIv]A
4U}p=v#
B_1qh0
J"M^Dy
$e\{hJL
QY{*b(
(L[\07
>%z A'
L]$D]J
X<]YLb
]I-74.
8_FseF
4WDvfP
"k)Z)}
Zl1S?2
lF1]p
2W-RREd
s.AiKM
UW~tif
UEwsUA
r48_gw
rmBwqR
Dk`gjV
6N2Y[)kW
|$rAF
*hIGhi
k}08fj
+D>Ys6e
G7V'w4I
OYGuP}
w~6@i5
!9Z/G`
0i1XT{
J`/5s"
cn*O!$
WB%?Z`u
^SJT8*7
'4bvXH
P@)tY5?
a~7Xe)
'SG5,;L
&bGy+4
1Xv~{zu
J_C>*ge
Y_cX*n
VMDj^m
Z?_b`
_bj2
_bY*
Z_bX
v4.0.30319
#Strings
By Pass360 To QF.exe
<Module>
DataField
Decrypt
mscorlib
GCHandle
System.Runtime.InteropServices
Resolve
Assembly
System.Reflection
ResolveEventArgs
System
Decompress
.cctor
DataType
ValueType
BitDecoder
Decode
BitTreeDecoder
Models
NumBitLevels
ReverseDecode
Decoder
Object
Stream
System.IO
ReleaseStream
Normalize
DecodeDirectBits
LzmaDecoder
m_IsMatchDecoders
m_IsRep0LongDecoders
m_IsRepDecoders
m_IsRepG0Decoders
m_IsRepG1Decoders
m_IsRepG2Decoders
m_LenDecoder
m_LiteralDecoder
m_OutWindow
m_PosDecoders
m_PosSlotDecoder
m_RangeDecoder
m_RepLenDecoder
_solid
m_DictionarySize
m_DictionarySizeCheck
m_PosAlignDecoder
m_PosStateMask
SetDictionarySize
SetLiteralProperties
SetPosBitsProperties
SetDecoderProperties
GetLenToPosState
LenDecoder
m_LowCoder
m_MidCoder
m_Choice
m_Choice2
m_HighCoder
m_NumPosStates
Create
LiteralDecoder
m_Coders
m_NumPosBits
m_NumPrevBits
m_PosMask
GetState
DecodeNormal
DecodeWithMatchByte
Decoder2
m_Decoders
OutWindow
_buffer
_stream
_streamPos
_windowSize
CopyBlock
PutByte
GetByte
UpdateChar
UpdateMatch
UpdateRep
UpdateShortRep
IsCharState
ConfusedByAttribute
Attribute
By Pass360 To QF
AssemblyTrademarkAttribute
AssemblyCopyrightAttribute
AssemblyProductAttribute
ComVisibleAttribute
TargetFrameworkAttribute
System.Runtime.Versioning
AssemblyFileVersionAttribute
GuidAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
RuntimeCompatibilityAttribute
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
AssemblyTitleAttribute
AssemblyCompanyAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
STAThreadAttribute
UInt32
GCHandleType
Module
MethodBase
RuntimeHelpers
InitializeArray
RuntimeFieldHandle
GetExecutingAssembly
get_ManifestModule
get_Target
LoadModule
ResolveSignature
AppDomain
get_CurrentDomain
ResolveEventHandler
add_AssemblyResolve
GetTypes
ResolveMethod
GetParameters
ParameterInfo
Invoke
Encoding
System.Text
get_UTF8
get_Name
AssemblyName
get_FullName
String
ToUpperInvariant
GetBytes
Convert
ToBase64String
GetEntryAssembly
GetManifestResourceStream
get_Length
Buffer
BlockCopy
MemoryStream
ReadByte
ConfuserEx v1.0.0
Copyright
2022
nopowershell
.NETFramework,Version=v4.5
FrameworkDisplayName
.NET Framework 4.5
1.0.0.0
$cfa0325d-6350-4d8c-9ce7-d3f2b77b98d2
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
EJIDATx
_>>}5~5
W!=Kp/s
;!BzJl
U}E7
(W?D|*
`Yp)<|
ju1OJ%
5s`~I3
UY#P+H
XwB_(%4{
1+a%B~j
='H~!(Y`M
+[/mfi+
I?$=%?
_m4_"3
K{8[/k
;E\w?DHO7
ayy[Z,?
-~G')v<
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
By Pass360 To QF.exe
LegalCopyright
Copyright
2022
LegalTrademarks
OriginalFilename
By Pass360 To QF.exe
ProductName
nopowershell
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Lionic Trojan.Win32.Generic.4!c
tehtris Clean
MicroWorld-eScan Trojan.GenericKD.66066090
FireEye Generic.mg.40528a8ce542af78
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
ALYac Trojan.GenericKD.66066090
Cylance unsafe
Zillya Clean
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
CrowdStrike win/malicious_confidence_60% (W)
Baidu Clean
VirIT Trojan.Win32.MSIL_Heur.A
Cyren Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 Clean
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky Clean
BitDefender Trojan.GenericKD.66066090
NANO-Antivirus Clean
ViRobot Clean
Tencent Clean
TACHYON Clean
Emsisoft Trojan.GenericKD.66066090 (B)
F-Secure Clean
DrWeb Clean
VIPRE Trojan.GenericKD.66066090
McAfee-GW-Edition Artemis!Trojan
Trapmine Clean
CMC Clean
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.PSW
GData Trojan.GenericKD.66066090
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1311777
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium Clean
Arcabit Trojan.Generic.D3F016AA
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:MSIL/Malgent!MSR
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!40528A8CE542
MAX malware (ai score=88)
Malwarebytes Malware.AI.3973108146
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R03BH0CCP23
Rising Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:rtkXl/djlcNeTpHDEwCgVA)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet PossibleThreat
BitDefenderTheta Gen:NN.ZemsilF.36344.gm0@amnzN!j
Panda Clean
No IRMA results available.