Static | ZeroBOX

PE Compile Time

2022-02-15 13:15:37

PE Imphash

032ac126bef9dc99c70a99a6b91b16f2

PEiD Signatures

InstallShield 2000

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000dbee 0x0000e000 6.20844142886
.rdata 0x0000f000 0x00001a80 0x00002000 4.62175155542
.data 0x00011000 0x0004e37c 0x0004d000 3.05049426817

Imports

Library KERNEL32.dll:
0x40f000 GetProcAddress
0x40f004 LoadLibraryA
0x40f008 VirtualAlloc
0x40f00c VirtualFree
0x40f010 FreeLibrary
0x40f014 RtlUnwind
0x40f018 RaiseException
0x40f01c GetModuleHandleA
0x40f020 GetStartupInfoA
0x40f024 GetCommandLineA
0x40f028 GetVersion
0x40f02c ExitProcess
0x40f040 HeapFree
0x40f044 GetCurrentThreadId
0x40f048 TlsSetValue
0x40f04c TlsAlloc
0x40f050 SetLastError
0x40f054 TlsGetValue
0x40f058 GetLastError
0x40f060 TerminateProcess
0x40f064 GetCurrentProcess
0x40f06c GetModuleFileNameA
0x40f078 WideCharToMultiByte
0x40f084 SetHandleCount
0x40f088 GetStdHandle
0x40f08c GetFileType
0x40f094 GetVersionExA
0x40f098 HeapDestroy
0x40f09c HeapCreate
0x40f0a0 WriteFile
0x40f0a4 IsBadWritePtr
0x40f0a8 IsBadReadPtr
0x40f0ac HeapValidate
0x40f0b0 HeapAlloc
0x40f0b4 HeapReAlloc
0x40f0b8 DebugBreak
0x40f0c0 OutputDebugStringA
0x40f0c8 IsBadCodePtr
0x40f0cc GetCPInfo
0x40f0d0 GetACP
0x40f0d4 GetOEMCP
0x40f0d8 MultiByteToWideChar
0x40f0dc LCMapStringA
0x40f0e0 LCMapStringW
0x40f0e4 GetStringTypeA
0x40f0e8 GetStringTypeW
0x40f0ec SetFilePointer
0x40f0f0 SetStdHandle
0x40f0f4 FlushFileBuffers
0x40f0f8 CloseHandle

!This program cannot be run in DOS mode.
RichMdy
`.rdata
@.data
t@KHC
t.;t$$t(
=tGjyh
VC20XC00U
PPPPPPPP
PPPPPPPP
tFGQPS
mlock.c
dbgdel.cpp
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)
tidtable.c
stdenvp.c
stdargv.c
a_env.c
ioinit.c
__GLOBAL_HEAP_SELECTED
__MSVCRT_HEAP_SELECT
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
Client
Ignore
Normal
Error: memory allocation: bad memory block type.
Invalid allocation size: %u bytes.
Client hook allocation failure.
Client hook allocation failure at file %hs line %d.
dbgheap.c
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
_pFirstBlock == pHead
_pLastBlock == pHead
pHead->nBlockUse == nBlockUse
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
DAMAGE: after %hs block (#%d) at 0x%08X.
DAMAGE: before %hs block (#%d) at 0x%08X.
Client hook free failure.
memory check error at 0x%08X = 0x%02X, should be 0x%02X.
%hs located at 0x%08X is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0x%08X.
DAMAGED
_heapchk fails with unknown return value!
_heapchk fails with _HEAPBADPTR.
_heapchk fails with _HEAPBADEND.
_heapchk fails with _HEAPBADNODE.
_heapchk fails with _HEAPBADBEGIN.
Bad memory block found at 0x%08X.
_CrtMemCheckPoint: NULL state pointer.
Object dump complete.
crt block at 0x%08X, subtype %x, %u bytes long.
normal block at 0x%08X, %u bytes long.
client block at 0x%08X, subtype %x, %u bytes long.
{%ld}
%hs(%d) :
#File Error#(%d) :
Dumping objects ->
Data: <%s> %s
Detected memory leaks!
Assertion Failed
Warning
%s(%d) : %s
Assertion failed!
Assertion failed:
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
wsprintfA
user32.dll
Microsoft Visual C++ Debug Library
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
(Press Retry to debug the application)
Module:
File:
Line:
Expression:
For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.
dbgrpt.c
szUserMessage != NULL
GetLastActivePopup
GetActiveWindow
MessageBoxA
format != NULL
sprintf.c
string != NULL
vsprintf.c
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)
_flsbuf.c
str != NULL
`h````
ppxxxx
(null)
output.c
ch != _T('\0')
_getbuf.c
_file.c
H:mm:ss
dddd, MMMM dd, yyyy
M/d/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
fclose.c
stream != NULL
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
_freebuf.c
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
FreeLibrary
KERNEL32.dll
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
WriteFile
IsBadWritePtr
IsBadReadPtr
HeapValidate
HeapAlloc
HeapReAlloc
DebugBreak
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle
www.xy999.com
p*2K9!
4E{(O,
N,\ub^
Y>Tou/
n}-*m.
'y0;rJ}
|$F"E\
Y>Tou/
n}-*m.
'y0;rJ}
|$F"E\
Y>Tou/
n}-*m.
'y0;rJ}
|yEIU}
! s:"BP6
vnE7R&
s*K3wR4XK
$0w2Jef
o^{*e{
RVa<K]zN<
Qk^B*}
j:BG0oW
tH5@K/F
hq"+y'
8.7ck0u
LZ"qra
+Al&lt
*Fn(~n
[<~#l=
et_k~:
Pe/J5!
o#"pgU
<*I`j?
ouKEf`
L`M_OHt
b>-Bsn
XV51~}
aBvT@(
4nAPjK
c"Wa;3AsP
0 872>
6Y8u vO[
59Y\UY
/W^+4;VD0
K(z~xC~X
6s{D2
X)0u*29
b'9FW&
(>Gk#Q
lBYu)Q
N#P3gL
.&'Eo"
P!B:QB
!L@L"p
A&$35_
s#abkx
#d|CD&
{4ek$7g0
O')vB
=E,w1TN
&T\0b9
w47q6xp
O-n8qUL
f_DR`zOY
tZ7#k<
Rn6I^Y
l@pv4a
k,zns2}Q=
#T{`4&
"N<7-X
R;jPR)+
s'0-&5?
Z} 7D=`N
w-;]&c
)/xRn|
1{ML>Nk
G=ikXUc
.@~lVc.
$\4ogXd
K:yyu"
8gv{DJt
]%i0$:o
U:,'J!M
PJBn{|
&G"c_\WB
BLmV!&
&FH6o^(
~CIy1J
~1=Gm?y.
2 F~J<i
(`-s2J
(m`Xpv
n}-*m.
'y0;rJ}
|$F"E\
Y>Tou/
GLm?zF
2=llS5
Z?JC+@9
3 XY+~
O5]7GXF
d#P-Fj
O.xA|
{K</mj
fq+dLB
NRC({u{
A;1CN2
GSzSNE
AK/bx&
Rnp8n.
VJz[[`
nJU@t=
B'|aq*
M|Ji?fqF
I4B1V"m]
{;g;F/
2&IS5d
o<~cA/`
\YtYt0EQQ
~PGHYm
&7*moFIY
/_}%-z
,?zM7m
a!_w+A>
v!dp2j
*qMO9z
\=Z37G?
?ib,5i
jkU? (f$
G-\<=23
k`3wm=
$QjEZK
dYL)M[,
{BkyXK
I"Y"x9y
DN[O38
%*(qNF_V
2#:q]V
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
+2~6Gf
;y{K`H
'^)+6g
WZwFL4
;/W/L?SH
8ECsJWdkE
~+T#'lc
$0{r&t
l3v4!
QNFW2E
er/6s4g
kTmI*y
n}-*m.
'y0;rJ}
|$F"E\
StudyHard
HeapFree
kernel32.dll
HeapReAlloc
kernel32.dll
HeapAlloc
kernel32.dll
GetProcessHeap
kernel32.dll
HeapAlloc
kernel32.dll
VirtualAlloc
kernel32.dll
kernel32.dll
VirtualAlloc
kernel32.dll
VirtualFree
kernel32.dll
VirtualProtect
kernel32.dll
HeapFree
kernel32.dll
GetProcessHeap
KERNEL32.dll
.?AVtype_info@@
(null)
((((( H
Antivirus Signature
Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.Farfli.4!c
tehtris Clean
MicroWorld-eScan Gen:Variant.Zegost.53
ClamAV Clean
CMC Clean
CAT-QuickHeal Trojan.FarfliRI.S27090835
ALYac Gen:Variant.Zegost.53
Malwarebytes Malware.AI.152148258
Zillya Trojan.Kryptik.Win32.3701711
Sangfor Suspicious.Win32.Save.ins
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Zegost.53
K7GW Trojan ( 00562edc1 )
K7AntiVirus Trojan ( 00562edc1 )
Baidu Clean
VirIT Clean
Cyren W32/Trojan.LBET-0583
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HCAH
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky HEUR:Backdoor.Win32.Farfli.gen
Alibaba Backdoor:Win32/Farfli.0e06db30
NANO-Antivirus Trojan.Win32.Kryptik.jmvgmk
ViRobot Trojan.Win.Z.Farfli.385024.DT
Rising Trojan.Kryptik!1.E27A (CLASSIC)
Sophos Troj/Farfli-EA
F-Secure Trojan.TR/Crypt.XPACK.Gen
DrWeb Trojan.Siggen11.63246
VIPRE Gen:Variant.Zegost.53
TrendMicro TROJ_GEN.R002C0DDH23
McAfee-GW-Edition GenericRXLP-OX!4CBE3BAF2593
Trapmine suspicious.low.ml.score
FireEye Generic.mg.4cbe3baf25933bc9
Emsisoft Gen:Variant.Zegost.53 (B)
Ikarus Trojan.Win32.Injector
GData Gen:Variant.Zegost.53
Jiangmin Backdoor.Farfli.eqx
Webroot W32.Gen.BT
Avira TR/Crypt.XPACK.Gen
MAX malware (ai score=84)
Antiy-AVL Trojan[Backdoor]/Win32.Farfli
Gridinsoft Clean
Xcitium Backdoor.Win32.Farfli.FK@7jqjxo
Arcabit Trojan.Zegost.53
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Backdoor.Win32.Farfli.gen
Microsoft Trojan:Win32/Farfli.CT!MTB
Google Detected
AhnLab-V3 Malware/Win32.RL_Generic.R299466
Acronis Clean
McAfee GenericRXLP-OX!4CBE3BAF2593
TACHYON Trojan/W32.Agent.385024.ADI
DeepInstinct MALICIOUS
VBA32 Trojan.Farfli
Cylance unsafe
Panda Trj/CI.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DDH23
Tencent Backdoor.Win32.farfli.zf
Yandex Trojan.GenAsa!gBhknYBDYco
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.73947863.susgen
Fortinet W32/Generic.AP.322A94!tr
BitDefenderTheta Gen:NN.ZexaF.36164.xmW@auqvm9i
AVG Win32:BackdoorX-gen [Trj]
Avast Win32:BackdoorX-gen [Trj]
No IRMA results available.