Static | ZeroBOX

PE Compile Time

2103-10-13 12:19:28

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x000172f4 0x00017400 6.40112861938
.rsrc 0x0001a000 0x000048c6 0x00004a00 4.89113060682
.reloc 0x00020000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0001a130 0x00004228 LANG_NEUTRAL SUBLANG_NEUTRAL dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_GROUP_ICON 0x0001e358 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0001e36c 0x00000370 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0001e6dc 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
!TM g\
X @D>7 %
Xa gdjz
X -hC< z
L%g B
Xa x?ZM
X Jc.q
8hS Tg
X i3P_
Xa ~Y[7
X G@*B ~M
X !r*s &F
X ZP0j
X SeY8 {1
Xa gM!T
X M]yt
X U3:O
Xa 1mo&
X %!tF
=^[ L%
9k= N;
X M#I
X kPM0
X d:<D Hd
{;P T-
X &o>'
X p!nd
9ua Rr
` \*
a >G[4@
%{ uZn.a
H'!a Ol$i@
a WePm@
Md*[ }
"; H@4Va R
[,P TG
X %=0= ;
Xa r)E5
Xa NJ:
Xa lnRM zw
X N+<i
C7" %a
A3C Zm
X *oUA b
X =ZeN
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
+iCCPPhotoshop ICC profile
c``2ptqre
> v^~^*
IDATx^
fc9d{u
fc9dku
]fS9d[u
fC9dKu
f39dKu
f39d;u
g#9d+u
e!9d)u1
bB9dZu
a"9d*u
TuiNQy
TuiNQy
4uaNQy
4uYNQy
4uYNPY
YTgOPYp
TwOPYp
[RxNr}
[QtNq}
[Ppvw}
[Ppvw}
[PpNp}
[RxNt}
v]"<Ve
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
+iCCPPhotoshop ICC profile
c``2ptqre
> v^~^*
IDATx^
ca9diuqy
3`A9dYuYy
>u&|^e
.%Sy2
=/UnL,
vu9NPY
Vu)NPY
!r8H}Q
[S|Nv]
u.:"Ry
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
+iCCPPhotoshop ICC profile
c``2ptqre
> v^~^*
IDATx^
esYd{u
jfNW}b2YdJ
vW}`3u
vW}`3u
vW}`3u
vW}`3u
vW}`3u
vW}`3u
vW}`3u
vW}`3u
vW}`3u
vW}`3u
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
v4.0.30319
#Strings
<>9__1_0
<PerformAntiVM>b__1_0
<get_Directories>b__1_0
<limitTimer_tick>b__9_0
rVqby0
<>9__1_1
<get_Directories>b__1_1
IEnumerable`1
IEnumerator`1
List`1
ajpCa1
dwItem1
<>7__wrap1
<>m__Finally1
Microsoft.Win32
UInt32
ToInt32
jdIp72
<>9__1_2
<get_Directories>b__1_2
Func`2
ph0xi2
dwItem2
<>7__wrap2
zTVPr2
<>9__1_3
<get_Directories>b__1_3
<GetFiles>d__3
<>7__wrap3
FromBase64
ToBase64
<>9__1_4
<get_Directories>b__1_4
<GetFiles>d__4
j2tvz4
pArdK5
qjwPO6
bSSjd6
get_UTF8
b56zD9
pMYNc9
iycQl9
fa13n9
get_RSA
set_RSA
liXqZA
nbReFD
get_KeyID
set_KeyID
az8s8E
wVPYgG
p2mzRH
jhj8qI
kTdbIL
usvsaM
yvp6sM
nrb82O
System.IO
kXsYMP
r5GQPQ
lPAKOR
kiHP7S
juHP0T
tkWCIT
vaHDRU
get_IV
GenerateIV
n0L1RW
jUAAEX
orcWOY
zRVooZ
idMbu_
xwD_Oa
get_Data
set_Data
DecryptData
EncryptData
bAEIOb
wkToeb
FromArgb
mscorlib
vyE7yb
a8sHCc
afq3Yc
y3PEYc
System.Collections.Generic
WndProc
sjcwoc
get_CurrentManagedThreadId
<>l__initialThreadId
wEventId
get_KeyId
set_KeyId
OpenRead
get_IsAttached
get_Locked
get_Blocked
get_Unlocked
set_Enabled
get_Hand
Append
RegistryValueKind
k8zbVe
o6jbXe
Replace
FlatButtonAppearance
get_FlatAppearance
set_Mode
set_AutoScaleMode
set_SizeMode
PictureBoxSizeMode
PaddingMode
CryptoStreamMode
CompressionMode
CipherMode
DeleteSubKeyTree
Ikimsczuxvscbrunzswxfe
set_Image
set_InitialImage
get_KeyStorage
set_KeyStorage
get_Message
SendMessage
InputLanguage
AddRange
get_KeyTable
set_KeyTable
ReadKeyTable
GetEnvironmentVariable
IEnumerable
IDisposable
get_Visible
set_Visible
get_Handle
GetModuleHandle
RuntimeTypeHandle
GetTypeFromHandle
Single
DecryptFile
EncryptFile
IsInRole
WindowsBuiltInRole
Console
set_Title
DockStyle
set_BorderStyle
set_FormBorderStyle
set_FlatStyle
FontStyle
set_WindowStyle
ProcessWindowStyle
get_Name
set_Name
get_TwoLetterISOLanguageName
get_FileName
set_FileName
GetFileName
get_FullName
WriteLine
get_NewLine
Combine
set_Multiline
ValueType
get_DriveType
OfType
System.Core
ToStructure
get_Culture
set_Culture
ReleaseCapture
ReadOnlyCollectionBase
ButtonBase
TextBoxBase
System.IDisposable.Dispose
Reverse
EditorBrowsableState
set_WindowState
FormWindowState
<>1__state
Delete
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
IteratorStateMachineAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
DebuggerHiddenAttribute
ExtensionAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
GetValue
SetValue
Remove
set_Size
get_BlockSize
set_BlockSize
set_AutoSize
get_ClientSize
set_ClientSize
Serialize
Deserialize
ISupportInitialize
zvIKBg
eYZAhg
System.Threading
set_Padding
Encoding
System.Drawing.Imaging
IsLogging
System.Runtime.Versioning
FromBase64String
ToBase64String
FromXmlString
DecryptBytesToString
GetString
get_AppStarting
System.Drawing
OpenFileDialog
CommonDialog
ShowDialog
get_Msg
fxhEqh
GetTempPath
GetFolderPath
get_Width
get_Length
set_MaxLength
StartsWith
nZTGQi
fuWinIni
bxNFoi
vgcH0j
add_Tick
add_Click
buttonBrowsePrivateKeyFile_Click
buttonMinimize_Click
buttonExit_Click
buttonDecrypt_Click
limitTimer_tick
set_Dock
FlushFinalBlock
System.Security.Principal
WindowsPrincipal
set_Interval
System.ComponentModel
CompressionLevel
kernel32.dll
shell32.dll
User32.dll
user32.dll
Srclient.dll
IsNull
get_Control
ContainerControl
ijbVLm
DeflateStream
FromStream
CryptoStream
MemoryStream
get_LParam
lParam
uParam
lpvParam
wParam
gEzeem
get_Item
System
SymmetricAlgorithm
AsymmetricAlgorithm
ICryptoTransform
TimeSpan
set_TextAlign
SeekOrigin
set_ShowIcon
MessageBoxIcon
get_Extension
GetFileNameWithoutExtension
System.IO.Compression
Application
get_Location
set_Location
System.Globalization
uAction
System.Reflection
InputLanguageCollection
ControlCollection
ManagementObjectCollection
SearchOption
CryptographicException
NotSupportedException
get_Button
add_MouseDown
OnMouseDown
sTVFyn
MoveTo
CopyTo
FileInfo
CultureInfo
DriveInfo
FileSystemInfo
SystemParametersInfo
ProcessStartInfo
DirectoryInfo
cuZrvo
gEBrXp
Bitmap
get_Bmp
set_TabStop
System.Linq
ToChar
RSACryptoServiceProvider
RNGCryptoServiceProvider
AesCryptoServiceProvider
StringBuilder
SpecialFolder
get_ResourceManager
Debugger
ManagementObjectSearcher
get_Cipher
set_Cipher
MouseEventHandler
System.CodeDom.Compiler
IContainer
ToUpper
IsUpper
CurrentUser
BinaryWriter
set_Filter
Register
BinaryFormatter
ToLower
<>3__targetDir
tDQgkr
set_Anchor
set_ForeColor
set_BackColor
set_UseVisualStyleBackColor
set_MouseDownBackColor
set_MouseOverBackColor
set_Cursor
IEnumerator
ManagementObjectEnumerator
System.Collections.Generic.IEnumerable<System.IO.FileInfo>.GetEnumerator
System.Collections.IEnumerable.GetEnumerator
RandomNumberGenerator
.cctor
CreateDecryptor
CreateEncryptor
IntPtr
System.Diagnostics
FromSeconds
System.Runtime.InteropServices
System.Runtime.CompilerServices
GetInstances
System.Resources
Eternity.MainForm.resources
Eternity.Properties.Resources.resources
DebuggingModes
get_InstalledInputLanguages
get_Directories
GetAllFiles
GetFiles
AnchorStyles
GetValueNames
ReadAllBytes
WriteAllBytes
EncryptStringToBytes
GetBytes
GetDrives
uFlags
MouseEventArgs
get_Controls
System.Windows.Forms
sz2sms
Contains
set_AutoScaleDimensions
System.Collections
ObjectGetOptions
MouseButtons
MessageBoxButtons
get_Chars
SystemColors
Cursors
ManagementClass
Process
Compress
Decompress
set_Arguments
get_Exists
set_CheckFileExists
get_rkEncryptedKeys
set_rkEncryptedKeys
Concat
AppendFormat
ImageFormat
ManagementBaseObject
GetObject
ManagementObject
Select
System.Net
System.Collections.IEnumerator.Reset
get_TimeLeft
set_TimeLeft
get_Height
op_Explicit
EndInit
BeginInit
GraphicsUnit
WaitForExit
FirstOrDefault
set_Result
DialogResult
WebClient
PointToClient
System.Management
ContentAlignment
Environment
InitializeComponent
System.Collections.Generic.IEnumerator<System.IO.FileInfo>.Current
System.Collections.IEnumerator.Current
System.Collections.Generic.IEnumerator<System.IO.FileInfo>.get_Current
System.Collections.IEnumerator.get_Current
GetCurrent
<>2__current
SRRemoveRestorePoint
set_Font
Decrypt
<>3__for_decrypt
Encrypt
Convert
set_TopMost
SuspendLayout
ResumeLayout
PerformLayout
MoveNext
System.Text
get_Text
set_Text
AppendText
ReadAllText
ToText
ResetText
DecryptText
EncryptText
Igngvqmzoxpjwvscuuodlv
Irugkakmlgxckrnmqjpzqv
Icobctrdnaisryddvkfiyv
aPRiYw
IWin32Window
set_CreateNoWindow
Iecjvlqayjtvxcufskgcww
lASRGx
anETTx
enK7cx
set_TabIndex
MessageBox
PictureBox
set_ControlBox
TextBox
uRfv0y
ToByteArray
ToArray
ToCharArray
get_Key
set_Key
CreateSubKey
OpenSubKey
ImportRSAPrivateKey
get_HasPrivateKey
SaveKey
GetKey
RegistryKey
SHChangeNotify
System.Security.Cryptography
tSA0ly
get_Assembly
GetExecutingAssembly
GetEntryAssembly
Ipcthwxxbtkjjtevsacfly
get_PublicOnly
set_ReadOnly
set_IsReadOnly
System.Runtime.Serialization.Formatters.Binary
CreateDirectory
set_InitialDirectory
GetCurrentDirectory
get_RootDirectory
Registry
op_Equality
op_Inequality
WindowsIdentity
IsNullOrEmpty
nFGzVz
WrapNonExceptionThrows
Windows Security Services
Copyright
Microsoft 2021
$6493f1a6-4642-4b6f-abad-dea8a91e07a3
1.0.0.4
.NETFramework,Version=v4.7.2
FrameworkDisplayName
.NET Framework 4.7.2
rEternity.Ransomware.EncryptionTargets+<GetFiles>d__3, hkicu, Version=1.0.0.4, Culture=neutral, PublicKeyToken=null
rEternity.Ransomware.EncryptionTargets+<GetFiles>d__4, hkicu, Version=1.0.0.4, Culture=neutral, PublicKeyToken=null
3System.Resources.Tools.StronglyTypedResourceBuilder
17.0.0.0
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
Blocked
Locked
Unlocked
IC{hX]euWM
M__F\GAP]GNT\Q>0$!
RsXy8hR
U(DDUuR
9t"c'|#
<.!=L#38?:"%
=!60XE
?>?.=<(1<)(
lYBq_z
? 7^%)$7 :
:6'895)
?''E2+<!
E>."%*/"
M#4%/0'
F;<F5>7&
*/;*"/+O/>.
/.$7Z +3/G# (Z<-3""*2G?2&?)
02-~.8+vR60
R"!,&/
&".~?<<
!(&X) 4,3*
C#1=!3?
9<=&T19#T%()*!&8T47% %
6fmx_On
=|Qj.xv
"~}3d\GbN
i2jlFF
!;*=0
@)<(8"
>?5&0$*
*5;1V "=#,
&;< !.
esgrfK
=$z53a1
a+.g-<
nl06Cg
N!*&20
29/'&>
$6++$4
#*u:58'F
%'28+3
bAnSLr
7b'd8s:S
^kxZkz
)<?&#"
iIh:;;
>-?Ih;"
iIiQ,c0=(
!,`C U
?WFE`
3:D:X7
cZ?1<1
,ZD3.#
Du 2+;3
936:=\2
/lLe-@
99j-?-
<>a]m!7
(;aum1
4)a]m1
km0#ac
cm0#ax
xm**am
+7aX$]
g48ay
h ETac
? XrC&
?2h|+K=^
2ImMFq
*/az$]@
6w_+~*
v%`v>f
'mav*u
:eav)`
s4rav4r
yRY7oC
qh5zpq]A
zh0_pw
txcgUa
>v(c'|2c
wSzete
'/."201$
9w6|'p)g9j<m1
ksWS3A
v8qTsY
xXyvHU
#,><&ZW%;(DI 2$-6! I2=2%2-W;>$3( >-I]CWXGYBSW90!0I
-5=>?4(
3'!F1/3+3$/+:
>$52c 8(
maw7ph
6q&n8k6q
6q,`7q5k7LSe9u3n(`
+"/5f#5
TimeLeft
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
Windows Security Services
FileVersion
1.0.0.4
InternalName
Eternity.exe
LegalCopyright
Copyright
Microsoft 2021
LegalTrademarks
OriginalFilename
Eternity.exe
ProductName
Windows Security Services
ProductVersion
1.0.0.4
Assembly Version
1.0.0.4
Antivirus Signature
Bkav W32.AIDetectNet.01
Lionic Trojan.Win32.Generic.4!c
tehtris Clean
DrWeb Clean
MicroWorld-eScan IL:Trojan.MSILZilla.26888
FireEye IL:Trojan.MSILZilla.26888
CAT-QuickHeal Trojan.MsilFC.S28986274
McAfee GenericRXUL-FZ!5505BBDDC971
Malwarebytes Ransom.Eternity
VIPRE Gen:Variant.Lazy.255872
Sangfor Trojan.Msil.AgentTesla.Vm29
K7AntiVirus Clean
BitDefender IL:Trojan.MSILZilla.26888
K7GW Clean
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZemsilF.36132.hm0@ayXHQen
VirIT Clean
Cyren W32/MSIL_Kryptik.HBH.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Filecoder.AQJ
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky HEUR:Trojan.MSIL.DelShad.gen
Alibaba Trojan:MSIL/AgentTesla.f0758136
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Agent.115200.Z
Rising Ransom.Agent!8.6B7 (CLOUD)
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Heuristic.HEUR/AGEN.1361869
Baidu Clean
Zillya Clean
TrendMicro TROJ_GEN.R002C0DD923
McAfee-GW-Edition GenericRXUL-FZ!5505BBDDC971
Trapmine Clean
CMC Clean
Emsisoft IL:Trojan.MSILZilla.26888 (B)
Ikarus Win32.Outbreak
GData IL:Trojan.MSILZilla.26888
Jiangmin Clean
Webroot W32.Trojan.Gen
Google Detected
Avira HEUR/AGEN.1361869
Antiy-AVL Trojan/MSIL.Filecoder
Gridinsoft Trojan.Win32.Agent.cl
Xcitium Clean
Arcabit IL:Trojan.MSILZilla.D6908
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSIL.DelShad.gen
Microsoft Trojan:MSIL/AgentTesla.ESL!MTB
Cynet Malicious (score: 99)
AhnLab-V3 Ransomware/Win.Eternity.C5225381
Acronis Clean
VBA32 Clean
ALYac Gen:Variant.Lazy.255872
MAX malware (ai score=88)
DeepInstinct MALICIOUS
Cylance unsafe
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DD923
Tencent Malware.Win32.Gencirc.10be93fd
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Clean
Fortinet MSIL/Agent.EBS!tr.spy
AVG Win32:RansomX-gen [Ransom]
Avast Win32:RansomX-gen [Ransom]
No IRMA results available.