Static | ZeroBOX

PE Compile Time

2023-04-11 18:36:48

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00036cf4 0x00036e00 7.67493147796
.rsrc 0x0003a000 0x00001248 0x00001400 5.39777818407
.reloc 0x0003c000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0003a130 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0003a598 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0003a5ac 0x000003c4 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0003a970 0x000008d3 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
,l/1ve+
<"-eJt
0<G%Z_
e%qwN;=
x?{&G}8
2<le'M
cX{{WG)I94k
bixjZG
mRyZO#p
SW3Sd_<'
1Ob^;Y
H/t6;=
xYi"w@
n%Z'eK
&QndKkT
ACUXzK7
C$p3X6
0Ic_Cf&
6%q_RU2
<~HB+M5g
47Az`U
4bOS2z
Un`.l[
>7CZC
ht(0Bz+0-V
3w=XyF
:kzc`h4,
As$7'$
|{Hjd}K
perOkyq
SnuULq
X/tQ`r+
}vfTG#=
e$htq[
_q3u]{'3k
mkWE#J
8q6mRh-
in~&`f:8
fLY6sC
9+;oas.^
N'Qk55(
FXBkdj
qPVQvXi
7g-^)g$
q4Rx=rU
kHmBaev
Bo~ipX
yq3(r<
C{Mi5g
h\@~5jbqA
9E@L/"
9p*EFZLk7*
'\~Zp_
m U@Q]*
!hql)C.
hq</:/
A.a>:R
+u[QEBt
N/\YZ=
Szt1Db
-hPBU2
N@=\G{v
&;x;O.
iH?<qa
Y+lv\a{
nb'Er7
:qm$;k
:Nu9ok8
g{<=>)
ASXir!
k6F]DU
|%8r`J
) bK:"
H~}u $
y%7&>}
3T<I+s
`DC!cdE.
JfSz2_
+iB0b(
RQ|`jb
L\S$Q
zu;E**?
x0Uk@J8
OIlN< F+
4f.Wz/e
B,j7T8
b/_&iG%
O8M7&-3
tDPqZ
Q }]M`
/Q6B`@
L4SnU,
NOEIvE
MLo0]X,
=FiHxg
h|A@8|[1
l;OV8 K
"7z Up?!<
wiyG@~)1
'~'P;G
>8X'sS
ZVEL{
5i'+;1
WdYxVh
}7]R5@yC
Kz{rp=
a4.*w|.E
8<Q)~N
0O$<LYD
^er)2
%vz7qf
",)M$.
u\`19~%
qBq#\%
tGn(.Z
1)PXGg4
n;1s!^
_9<zF2
6"!Od
tGxKI*
*y}6+o
Hu.cE|H7
he~U~P
~b4@,^
3~GuyD
${i>sbv
Rdfvv`
KLCZJEM
i\r=`g
6=h(tr
) (A=%0b
rl"EO-
~Lkp$R
m\&W!i
d=CA|/
}O3cDi
m/KPw>
@kjH|
W"Ny0[
%s>Xl>
yEh5M:
&TT,yu
\Y%1,]{
Nn/gU-
`YkPZu)
bcqAC{
VRYcDA
U#P'0>
rP"+(U*
e}]pdO
GsdalM
2kP_rC|m
]FWZbe<
Xwe7s|}
L4fKHm(
\)i:xh
u/6r2I%
r03j[?
@,e],S
n/L!_>
Z/(x">y
6xGc:P
B/Xivf
59w =g$)
cdM(/1
ZG){<QU7L@z
V_rRx}
%PS\7O
eQH9PJ
tT=r]}
`2pcU2
z|<VUn
`r#&X{
W&yP=,
6{cc1
$_khw2
X^uGokq^
_)z|Yv.{
pv'0/*
4_h>B;<5t
MxEHL=iL
h00kpE
aUi;&
brxE^#
"g:PAR
zT>UH?
o4`3({
6w6|Z8
iDIkbk/"
|1o__`
_D4`zIS<
Eg(vE|z
tdcz|a?
.dGvDW
k;or5=
OXkV:4
q,I\ec
KM>Px$p
hK!K**
-D;CYc{
f<$(rX
?U<6Vc
fM#i`i
Zi#I"d
*(sM.{b
`#*wr$T+0
FS&r3V
j]B+v"Ck~3
;`^QiY
Cqp*ks
KpkSk5
r2k+,:
QgNy$H0v
9&Z>b>
d"Fb*n8
]z$;dB_
b8{DI#
m>CY<r
*I"kJ0
#^}='"vAUV
4a1_&-<d=a5
u"H*JP
QPJa7H
YDeCZ~
;$2Siq
6+LhI-x
TPMAalo
^+R%},
-b07)F
u)"i1rX
6Z/2be
l1eX5I
R\b,=@
[#"ML-+G
B2}9:_
[>2D?'
*||}.v
sL>f+7
3.>)ks
\#i1J8;
<5USGz
!!wsZx4
yD*$3xZ
0)quM}
&|orhJ
}+_|7d
Dk>9@Q
;UMjw>
A{{s(<
OWRa'}w
VCy"\d
?DWsi^
?)md4f
=!TdDZ
\&%WkW4z
;-_lmD
kdkK5$Z
ZjUyfN
?edh1pk
[^*??/
@7lsW>
^7g+_R&
sy^MiCG
=W8"$Dq
kS9{y:Cj
Fu{jnQ
yPkmn9
5p#j[A
I9|G+u
`kN;6S
~W%lHr
U:w^mr
U:w^mr
6Z 9;P
VMDj^m
fT%&8
`v%&8n
1H%&8#
7+wZ ]
Z?_b`
j6Za8b
Z?_b`
(Z GK,Oa8)
?x~a8z
Pz>^Z }
<Z Bp*
qMKa8Q
/df3%+
<)f!%&80
cq7%&8|
5o^Za8
* -Lk28
_bj2
_bY*
|y 1Iika%
\xkqZ 0pbta+
#2%&8o
[Z qju
Z `0(va+
`A_1Z
7j^Z X
%0Mz
fxRa8}
#Z QcC
EXU%&8
b0Z /K
swBZ r
:,mZ Vp
0'7Z
AZ cp})a+
GtdZ 0
Z_bX
LF*Z TG
iZ :^.
Y_cX*
)IZa8g
Z WWZ/a8;
Y!^W%&
_bj/
?FS%&+
_bY*
073Z <
p"6oZa8
.z H@
<lnZ C
$X%&8Z
)2)%&8i
Fo%&8E
79c(%&8[
QW%`Z B
Zy)Z 2
'Z T%"
cjYLZ
Z_bX
;SZ gR
len%&+
Y_cX*
v4.0.30319
#Strings
server1.exe
mscorlib
SuppressIldasmAttribute
System.Runtime.CompilerServices
<Module>
GCHandle
System.Runtime.InteropServices
Assembly
System.Reflection
ResolveEventArgs
System
.cctor
RuntimeFieldHandle
Module
Encoding
System.Text
AssemblyName
Stream
System.IO
MemoryStream
RuntimeTypeHandle
MethodInfo
MethodBase
Thread
System.Threading
ParameterizedThreadStart
ValueType
Object
ConfusedByAttribute
Attribute
server1
ComVisibleAttribute
AssemblyTrademarkAttribute
AssemblyCopyrightAttribute
TargetFrameworkAttribute
System.Runtime.Versioning
AssemblyFileVersionAttribute
GuidAttribute
AssemblyProductAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
RuntimeCompatibilityAttribute
CompilationRelaxationsAttribute
AssemblyCompanyAttribute
AssemblyDescriptionAttribute
AssemblyTitleAttribute
STAThreadAttribute
server.Resources.resources
UInt32
GCHandleType
ResolveSignature
AppDomain
get_CurrentDomain
ResolveEventHandler
add_AssemblyResolve
Invoke
get_Target
GetTypes
ResolveMethod
GetParameters
ParameterInfo
LoadModule
Environment
String
RuntimeHelpers
InitializeArray
GetExecutingAssembly
get_ManifestModule
get_UTF8
get_Name
get_FullName
ToUpperInvariant
GetBytes
Convert
ToBase64String
GetEntryAssembly
GetManifestResourceStream
get_Length
Buffer
BlockCopy
ReadByte
GetTypeFromHandle
GetMethod
Concat
Equals
FailFast
set_IsBackground
get_CurrentThread
Debugger
get_IsAttached
IsLogging
get_IsAlive
GetString
Intern
GetElementType
CreateInstance
ConfuserEx v1.0.0
Important system file
Copyright
Hort SRL
.NETFramework,Version=v4.8
FrameworkDisplayName
.NET Framework 4.8
8.5.4.7
$cc7fad03-816e-432c-9b92-001f2d358386
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="utf-8"?>
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<!-- UAC Manifest Options
If you want to change the Windows User Account Control level replace the
requestedExecutionLevel node with one of the following.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Specifying requestedExecutionLevel node will disable file and registry virtualization.
If you want to utilize File and Registry Virtualization for backward
compatibility then delete the requestedExecutionLevel node.
-->
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- A list of all Windows versions that this application is designed to work with. Windows will automatically select the most compatible environment.-->
<!-- If your application is designed to work with Windows 7, uncomment the following supportedOS node-->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>-->
</application>
</compatibility>
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
<!-- <dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="*"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>-->
</asmv1:assembly>
@{?@{?
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Important system file
CompanyName
Important system file
FileDescription
Important system file
FileVersion
8.5.4.7
InternalName
server1.exe
LegalCopyright
Copyright
Hort SRL
LegalTrademarks
Important system file
OriginalFilename
server1.exe
ProductName
Important system file
ProductVersion
8.5.4.7
Assembly Version
8.8.1.7
Antivirus Signature
Bkav W32.AIDetectNet.01
Lionic Trojan.Win32.Hesv.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.MSILHeracles.37619
ClamAV Clean
FireEye Generic.mg.b8fd2b1bf9995f28
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
McAfee Artemis!B8FD2B1BF999
Malwarebytes Backdoor.Quasar.Generic
Zillya Clean
Sangfor Trojan.Win32.Agent.V1er
K7AntiVirus Trojan ( 0059cb6d1 )
BitDefender Gen:Variant.MSILHeracles.37619
K7GW Trojan ( 0059cb6d1 )
Baidu Clean
VirIT Trojan.Win32.MSIL_Heur.A
Cyren W32/MSIL_Agent.FBV.gen!Eldorado
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 multiple detections
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.MSIL.Hesv.gen
Alibaba TrojanSpy:MSIL/Quasar.c0ec5356
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Agent.230912.AM
Rising Malware.Obfus/MSIL@AI.97 (RDM.MSIL2:JPncos6k66RoiAUo6gYNBw)
Sophos Mal/Generic-S
F-Secure Trojan.TR/Dropper.MSIL.Gen
DrWeb Trojan.Inject4.56080
VIPRE Gen:Variant.MSILHeracles.37619
TrendMicro Backdoor.Win32.ASYNCRAT.YXDDKZ
McAfee-GW-Edition Artemis!Trojan
Trapmine Clean
CMC Clean
Emsisoft Gen:Variant.MSILHeracles.37619 (B)
Ikarus Clean
GData Gen:Variant.MSILHeracles.37619
Jiangmin Clean
Webroot Clean
Avira TR/Dropper.MSIL.Gen
MAX malware (ai score=80)
Antiy-AVL Clean
Gridinsoft Ransom.Win32.Sabsik.sa
Xcitium Clean
Arcabit Trojan.MSILHeracles.D92F3
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Spy.MSIL.Quasar.gen
Microsoft Trojan:MSIL/AgentTesla.LQL!MTB
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5390455
Acronis suspicious
VBA32 Clean
ALYac Gen:Variant.MSILHeracles.37619
TACHYON Clean
DeepInstinct MALICIOUS
Cylance unsafe
Panda Clean
Zoner Clean
TrendMicro-HouseCall Backdoor.Win32.ASYNCRAT.YXDDKZ
Tencent Msil.Trojan.Hesv.Sgil
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat.ZDS
BitDefenderTheta Gen:NN.ZemsilF.36132.om0@aSAz4!n
AVG Win32:RATX-gen [Trj]
Avast Win32:RATX-gen [Trj]
No IRMA results available.