popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

PE Compile Time

2023-04-04 16:34:19

PE Imphash

a99bb2525c7a5684028f67b9c34884da

PEiD Signatures

Armadillo v1.71

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000193a 0x00002000 4.89791643207
.rdata 0x00003000 0x000013fe 0x00002000 3.47674533638
.data 0x00005000 0x00000404 0x00001000 0.970474271555
.rsrc 0x00006000 0x00002258 0x00003000 3.58378123158

Resources

Name Offset Size Language Sub-language File type
RT_BITMAP 0x00006e80 0x00000428 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_ICON 0x00006d30 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00006d30 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00006d30 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00006d30 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_MENU 0x000072c8 0x00000222 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00007638 0x00000062 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00007638 0x00000062 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00008218 0x0000003a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_ACCELERATOR 0x000074f0 0x00000070 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_GROUP_ICON 0x00006e58 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_GROUP_ICON 0x00006e58 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_VERSION 0x000076a0 0x000002dc LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_MANIFEST 0x00007980 0x0000028b LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED XML 1.0 document text
None 0x000072a8 0x0000001e LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data

Imports

Library MFC42.DLL:
• 0x403038 None
• 0x40303c None
• 0x403040 None
• 0x403044 None
• 0x403048 None
• 0x40304c None
• 0x403050 None
• 0x403054 None
• 0x403058 None
• 0x40305c None
• 0x403060 None
• 0x403064 None
• 0x403068 None
• 0x40306c None
• 0x403070 None
• 0x403074 None
• 0x403078 None
• 0x40307c None
• 0x403080 None
• 0x403084 None
• 0x403088 None
• 0x40308c None
• 0x403090 None
• 0x403094 None
• 0x403098 None
• 0x40309c None
• 0x4030a0 None
• 0x4030a4 None
• 0x4030a8 None
• 0x4030ac None
• 0x4030b0 None
• 0x4030b4 None
• 0x4030b8 None
• 0x4030bc None
• 0x4030c0 None
• 0x4030c4 None
• 0x4030c8 None
• 0x4030cc None
• 0x4030d0 None
• 0x4030d4 None
• 0x4030d8 None
• 0x4030dc None
• 0x4030e0 None
• 0x4030e4 None
• 0x4030e8 None
• 0x4030ec None
• 0x4030f0 None
• 0x4030f4 None
• 0x4030f8 None
• 0x4030fc None
• 0x403100 None
• 0x403104 None
• 0x403108 None
• 0x40310c None
• 0x403110 None
• 0x403114 None
• 0x403118 None
• 0x40311c None
• 0x403120 None
• 0x403124 None
• 0x403128 None
• 0x40312c None
• 0x403130 None
• 0x403134 None
• 0x403138 None
• 0x40313c None
• 0x403140 None
• 0x403144 None
• 0x403148 None
• 0x40314c None
• 0x403150 None
• 0x403154 None
• 0x403158 None
• 0x40315c None
• 0x403160 None
• 0x403164 None
• 0x403168 None
• 0x40316c None
• 0x403170 None
• 0x403174 None
• 0x403178 None
• 0x40317c None
• 0x403180 None
• 0x403184 None
• 0x403188 None
• 0x40318c None
• 0x403190 None
• 0x403194 None
• 0x403198 None
• 0x40319c None
• 0x4031a0 None
• 0x4031a4 None
• 0x4031a8 None
• 0x4031ac None
• 0x4031b0 None
• 0x4031b4 None
• 0x4031b8 None
• 0x4031bc None
• 0x4031c0 None
• 0x4031c4 None
• 0x4031c8 None
• 0x4031cc None
• 0x4031d0 None
• 0x4031d4 None
• 0x4031d8 None
• 0x4031dc None
• 0x4031e0 None
• 0x4031e4 None
• 0x4031e8 None
• 0x4031ec None
• 0x4031f0 None
• 0x4031f4 None
• 0x4031f8 None
• 0x4031fc None
• 0x403200 None
• 0x403204 None
• 0x403208 None
• 0x40320c None
• 0x403210 None
• 0x403214 None
• 0x403218 None
• 0x40321c None
• 0x403220 None
• 0x403224 None
• 0x403228 None
• 0x40322c None
• 0x403230 None
• 0x403234 None
• 0x403238 None
• 0x40323c None
• 0x403240 None
• 0x403244 None
• 0x403248 None
• 0x40324c None
• 0x403250 None
• 0x403254 None
• 0x403258 None
• 0x40325c None
• 0x403260 None
• 0x403264 None
• 0x403268 None
• 0x40326c None
• 0x403270 None
• 0x403274 None
• 0x403278 None
• 0x40327c None
• 0x403280 None
• 0x403284 None
• 0x403288 None
• 0x40328c None
• 0x403290 None
• 0x403294 None
• 0x403298 None
• 0x40329c None
• 0x4032a0 None
• 0x4032a4 None
• 0x4032a8 None
• 0x4032ac None
• 0x4032b0 None
• 0x4032b4 None
• 0x4032b8 None
• 0x4032bc None
• 0x4032c0 None
• 0x4032c4 None
• 0x4032c8 None
• 0x4032cc None
• 0x4032d0 None
• 0x4032d4 None
• 0x4032d8 None
• 0x4032dc None
• 0x4032e0 None
• 0x4032e4 None
• 0x4032e8 None
• 0x4032ec None
• 0x4032f0 None
• 0x4032f4 None
• 0x4032f8 None
• 0x4032fc None
• 0x403300 None
• 0x403304 None
• 0x403308 None
• 0x40330c None
• 0x403310 None
• 0x403314 None
• 0x403318 None
• 0x40331c None
• 0x403320 None
• 0x403324 None
• 0x403328 None
• 0x40332c None
• 0x403330 None
• 0x403334 None
• 0x403338 None
• 0x40333c None
• 0x403340 None
• 0x403344 None
• 0x403348 None
• 0x40334c None
• 0x403350 None
• 0x403354 None
• 0x403358 None
• 0x40335c None
• 0x403360 None
• 0x403364 None
• 0x403368 None
• 0x40336c None
• 0x403370 None
• 0x403374 None
• 0x403378 None
• 0x40337c None
Library MSVCRT.dll:
• 0x403384 _controlfp
• 0x403388 _except_handler3
• 0x40338c __set_app_type
• 0x403390 __p__fmode
• 0x403394 __p__commode
• 0x403398 _adjust_fdiv
• 0x40339c __setusermatherr
• 0x4033a0 _initterm
• 0x4033a4 __getmainargs
• 0x4033a8 _acmdln
• 0x4033ac _XcptFilter
• 0x4033b0 exit
• 0x4033b4 _setmbcp
• 0x4033b8 __CxxFrameHandler
• 0x4033bc __dllonexit
• 0x4033c0 _exit
• 0x4033c4 _onexit
Library KERNEL32.dll:
• 0x403010 CreateDirectoryA
• 0x403014 GetProcAddress
• 0x403018 GetStartupInfoA
• 0x403020 Process32First
• 0x403024 GetModuleHandleA
• 0x403028 LoadLibraryA
• 0x40302c CloseHandle
• 0x403030 Process32Next
Library USER32.dll:
• 0x4033cc GetDC
• 0x4033d0 EnableWindow
• 0x4033d4 UpdateWindow
• 0x4033d8 LoadImageA
Library GDI32.dll:
• 0x403000 GetObjectA
• 0x403004 BitBlt
• 0x403008 CreateCompatibleDC
Library WININET.dll:
• 0x4033e0 DeleteUrlCacheEntry
!This program cannot be run in DOS mode.
ARich1
`.rdata
@.data
u:hpP@
u)h`P@
L$DhP
D$4RPj
L$8_^d
d$$htR@
d$$hhR@
d$$hhR@
d$$hXR@
d$$hHR@
MFC42.DLL
__CxxFrameHandler
__dllonexit
_onexit
MSVCRT.dll
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryA
CreateDirectoryA
GetModuleHandleA
GetStartupInfoA
KERNEL32.dll
UpdateWindow
EnableWindow
LoadImageA
USER32.dll
BitBlt
GetObjectA
CreateCompatibleDC
GDI32.dll
DeleteUrlCacheEntry
WININET.dll
_setmbcp
Local AppWizard-Generated Applications
Define.exe
WeChat.exe
QQProtect.exe
ZhuDongFangYu.exe
Telegram.exe
CDlgBarDoc
CDlgBarView
223.100.txt
CMainFrame
urlmon.dll
wnloadToFileA
C:\ProgramData\SqlVersion.dll
SQL_verify
SqlVersion9.dll
SqlVersion.dll
Media.xml
LiveUpdate.exe
setting.ini
pdate360.dat
pdate.dat
C:\ProgramData\Thunder\
C:\ProgramData\
http://img.cloudservicesdevc.tk/picturess/2023/
DDLLDDDL
LLDDLD
DDLDLD
LDDDDDDD
DDDDDDDDD
DDDDDDDDDDD
DDDDDDDDDDDDD
DDDDDDD
DDDDD@
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
wwtGwwwwwwwwwwwwwwwtDDDDw
wwGtwDwwwwwtDDDDw
pwwwwppwwww
wwGttwGwwwwt
33330wp3
wwGttwGwwwwt
wwtDtwGwp
33330p333333
wwwttDwwp
wwwwpppwww
wwp0wwww
wwp0wwww
OGp888888
wwp0wwww
wwwppwwwp
p0wwww
DDGwp8
wwwwwwww
p0wwww
wwwwwwpwppp0wwww
wwwwwww
wwwwwww
wwwwwp
SX[:N(
HrCg@b
HrCg@b
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
<dependency>
<dependentAssembly>
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
</dependentAssembly>
</dependency>
</assembly>
SSbpS:g
SbpS;m
>f:yteu
ceQjR4
S>e'Y0R
Rbc0RHQMR
Y0Rck8^'Y
Ctrl+N
(&O)...
Ctrl+O
Ctrl+S
(&A)...
(&P)...
Ctrl+P
(&R)...
Ctrl+Z
Ctrl+X
Ctrl+C
Ctrl+V
DlgBar(&A)...
DlgBar
DlgBar 1.0
(C) 1999
System
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
DlgBar Microsoft
FileVersion
1, 0, 0, 1
InternalName
DlgBar
LegalCopyright
(C) 1999
LegalTrademarks
OriginalFilename
DlgBar.EXE
ProductName
DlgBar
ProductVersion
1, 0, 0, 1
VarFileInfo
Translation
0DlgBar
DlgBar
DlgBar.Document
DlgBar Document
DlgBar
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Agent.l9y2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.66276452
ClamAV Clean
FireEye Trojan.GenericKD.66276452
CAT-QuickHeal Clean
McAfee Artemis!D06C243962C5
Malwarebytes Malware.AI.2080635735
VIPRE Clean
Sangfor Clean
K7AntiVirus Trojan-Downloader ( 005a19c71 )
BitDefender Trojan.GenericKD.66276452
K7GW Trojan-Downloader ( 005a19c71 )
CrowdStrike win/malicious_confidence_90% (W)
BitDefenderTheta Gen:NN.ZexaF.36132.cq0@aKhXH5cb
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/TrojanDownloader.Agent.GUA
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.Win32.Agent.gen
Alibaba TrojanDownloader:Win32/Generic.abcd4cc0
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Agent.36864.XM
Rising Downloader.Agent!8.B23 (TFE:5:i0f1n8j0TET)
TACHYON Clean
Sophos Mal/Generic-S
Baidu Clean
F-Secure Trojan.TR/Dldr.Agent.tyixa
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Injector.nz
Trapmine malicious.moderate.ml.score
CMC Clean
Emsisoft Trojan.GenericKD.66276452 (B)
Ikarus Trojan-Downloader.Win32.Agent
GData Win32.Trojan.Agent.1GWZCU
Jiangmin Clean
Webroot Clean
Avira TR/Dldr.Agent.tyixa
Antiy-AVL Trojan[Downloader]/Win32.Agent
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium Clean
Arcabit Trojan.Generic.D3F34C64
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5404996
Acronis Clean
VBA32 BScope.TrojanPSW.Panda
ALYac Clean
MAX malware (ai score=85)
DeepInstinct MALICIOUS
Cylance unsafe
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0DD623
Tencent Win32.Trojan-Downloader.Oader.Hkjl
Yandex Clean
SentinelOne Clean
MaxSecure Clean
Fortinet W32/Agent.GTJ!tr.dldr
AVG Win32:Trojan-gen
Avast Win32:Trojan-gen
No IRMA results available.