Static | ZeroBOX

PE Compile Time

2023-06-07 10:32:04

PDB Path

BHNh772.pdb

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0002b0ec 0x0002b200 7.63431321917
.rsrc 0x0002e000 0x00000596 0x00000600 4.0889615502

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0002e0a0 0x0000030c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0002e3ac 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

!This program cannot be run in DOS mode.
`.rsrc
e/\Y5T
fXYNS$J
?]av"z
UhY(\G
;MLAdR
8ZYv=*
a'+=_8
b&+R5}
Lx.g\D
c@`m 7LBS
MU~s![
vCS?R3.
}zK*E
K'@P;h
.j6;qp
)E+S-<
xer~&%3G
8v.f#B
{`bzS=
rCxS0,
*T=crc
;1QSE`
^M-Fv@
8<+z&[
+UN0OJh
9G)$5:
bRDUDC
qxUz(rrH
P/iD.
%h$Onn#8
~-v1F4
G0|1toCp
/yT\yP
R:[`]1
&m|E
%d,Rxmz
S} =^=\!
$bfNzx
k'i0Nr
%hoA5>
*by\H:
3Q:!m)YB8
|lJ{Nz
20xpa
?\"\-~
O[=~;"ev
-_WeYg
2\Brqp
qztA~x
VpCCB@
Rg9*n)
`i[85N
CIl/A9:2
,h?uv(
0NaVj8
k\er2w
7e'!\C
;Hw:+]t
p3U:,~|
F?Ee:Q
Co|w/#o
*#FNvu
aTuqEz
@o/`"$=
9<lp5
bP`U!>
BQ6'F~
&UDL*&~_
":2U^[
Kr<3]3
G#!/M;1Y
h?=].3
&M.!5 {
V)b|\<
~A%,ZX=1
zSBl4y
.sDW9<
Rw0n,0
$Tb$\<
ct2-)g
b@6RVL
Kd3;$H
$*>|)j
&m&S[8{
^]hU#L
{}Ci 
[at`f#
v7Wn-n
6Q2UWC
qv{?fS
L8DQfyw
0]VeRS
3"'M~U
0LC._*
`<pbrR2s8'
&.S^d1\O
PTq$6.
u&1em{
dsN@%
${\BlP
\8JNV./
Gm)W@
f{Sg{e
K,9hSaA3
h(`B=v
^9B"%
=Ap~*p
Hv*8<u
^c@Y55q6QQ
r>;}%kO
&v-$(K
RS(}>k
Lb3xm)
BJlq]a
lGnd}wM
&d<Hmj
qoWL5nC
1%3u{E
bS=_9^'
]Nt5d/
wM,E-y
,-)Y`g
SyrS\o0
ci_nY\
*zT""k
BQdi:N
k/EL0]
Gn.i2pJ
wBtT&a
1JUv{L
_76ciZ8
fi)rtB5V
R!3u|]
0FA):>
)fIicdR
n$"1}1EqU
E(/@.k
gWYMe$
9dk6T<Og
1?'I/)
0c7zuB
C 3*!k*c;$
rP)4ywM
a(PQ2*
v">y{6
T9`h
A:rDiYD
oh9.GA
c/xk ~^
ETgU!h)
.k*rOs
M~S>RQ
Ugu,FR/%(
\vt|of
LGGjF]O9M
bFdj?Y
zN/;@'
b9-NO*
bG4`b9A
AB20$P-P@
pzFPKH
uqIskK.
v;q8QR
YD%Bf-
CUtVuR6
xEUx</
C~ k}"
HKaceA
SWd_!J
XZc2%*
Uzy.P(L(
mg< s#q
M6=[fC_
qzZo\}
tK:=aW
(xxx#]
,BH=+*
AkMSh4
-i$!F
}q$@kT
,M8#mWNP5
e.{Z50
0Zz67w
n1Su[
-IwN?qpm
{Byhq
P##MK7K
F(GnEB
[.`)=3
1Rrt
K:lR.b
(I?{/s
&j?\Ikw{
t`V@j6
8Ic6E
eW%UvK
J^/e2;
PF)WQK
~V:j'C
xlMDOh
'>t$
-7'YeR
{T_GF3F
Fn-g!Y
MJ2F-9H
I@+Kx.
L*L|#Jos
XH[AT
z4Fe!;q
#J:k'}
x;gOo|j
;e/;M&SF #
;Yp{)s_
_"OUYwn
{=P%7f
w^ s9
O3^6DW
,WBX"
&XJ?4"
#?t'jC
za(Z~>
y.rL6+
|an@S
V-AHK)
j-2BR9
0(6pC8
3uu1E:5
m$BNbKV)`p
'rYXzt
}QLa}y
Gxa%&8
_o>y%+
ixZ O0
oohZ A!*
AhZa8v
Z MN;ga8
\Z Qx
-gz%&
XAa8D
zH:a8|
' ;a8h
;KGw
5:Z %N
_bj2
_bY*
x[I#Z K
-Z [_\
@|q8%&8
lTZ h(w
Z k:l!a8Z
x6%&8=
bp%&8M
=<rt8[
83Z Vt
Z_bX
04{Z q
7Z izo
WF%&8U
9 mWUfa%
sMoa8p
Z o_@da87
/H6tZa8
Y_cX*
r~%&8)
{Z $xm
!iPZZ
*e6Za+
5wQ Za+
Oo6FZ
}+%&8e
X4Z <!
`A\Z 
jZ GkO
70zI%+
k0%&8%
& (P%+
RnZ :a
Z Uq04a8
RzZa8b
v4.0.30319
#Strings
BHNh772$
BHNh772%
DLBaE\1E,g*;p7}fPHnx(M{,+
cf595c41e34fae9d34a62be861bbebf51
UInt32
ToInt32
BHNh772
c8870bc13af2770de926d16fc75f3a824
ToInt64
ca7e8b056ae5b4203a039346f2f8d53f7
get_UTF8
c2135129d04cbdf3a825d2cb3976c0bc8
c3bafb76ede496e426f66e14e37129e39
<Module>
System.IO
set_IV
c1692e0dec345c6bdfc756ed39a9d601b
c92b8f3af304556f07caf6257ea1a2d6b
mscorlib
cc5c8984fa43fe4fc7bdcfd24dbfb2e2c
get_CurrentThread
thread
get_IsAttached
set_IsBackground
GetMethod
c248fdb8a044a5f50e405976e03871c8e
Replace
distance
CreateInstance
CompressionMode
get_Unicode
Invoke
ToDouble
RuntimeFieldHandle
RuntimeTypeHandle
GetTypeFromHandle
ToSingle
get_Name
get_FullName
ValueType
GetType
GetElementType
MethodBase
Reverse
posState
STAThreadAttribute
GuidAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
SuppressIldasmAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
ConfusedByAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
ReadByte
matchByte
prevByte
get_IsAlive
add_AssemblyResolve
BHNh772.exe
get_InputBlockSize
get_OutputBlockSize
inSize
outSize
windowSize
dictionarySize
IndexOf
System.Threading
Encoding
IsLogging
System.Runtime.Versioning
FromBase64String
GetString
Substring
get_Length
KifMurhxUwpbBEgKZHLyvvXcZxtj
TransformFinalBlock
TransformBlock
GetManifestResourceStream
DeflateStream
inStream
outStream
MemoryStream
stream
System
SymmetricAlgorithm
ICryptoTransform
Boolean
IsLittleEndian
AppDomain
get_CurrentDomain
System.IO.Compression
System.Globalization
System.Reflection
get_Position
set_Position
Intern
MethodInfo
InvokeMember
DESCryptoServiceProvider
sender
Binder
rangeDecoder
Buffer
Debugger
ResolveEventHandler
BitConverter
.cctor
Monitor
CreateDecryptor
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
properties
NumberStyles
numPosStates
GetBytes
BindingFlags
ResolveEventArgs
Equals
Models
NumBitLevels
numBitLevels
get_Chars
RuntimeHelpers
numTotalBits
numPosBits
numPrevBits
Object
Environment
ParameterizedThreadStart
Convert
FailFast
System.Text
startIndex
InitializeArray
ToArray
set_Key
System.Security.Cryptography
GetCallingAssembly
GetExecutingAssembly
BlockCopy
set_Capacity
op_Equality
Confuser.Core 1.6.0+447341964f
Copyright
2023
$7f84feb1-d02b-41b7-a951-b990c00d9c93
.NETFramework,Version=v4.5.1
FrameworkDisplayName
.NET Framework 4.5.1
1.0.0.0
BHNh772
WrapNonExceptionThrows
BHNh772.pdb
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
BHNh772
FileVersion
1.0.0.0
InternalName
BHNh772.exe
LegalCopyright
Copyright
2023
LegalTrademarks
OriginalFilename
BHNh772.exe
ProductName
BHNh772
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Remcos.4!c
tehtris Clean
MicroWorld-eScan Clean
FireEye Clean
CAT-QuickHeal Clean
ALYac Clean
Malwarebytes Generic.Malware/Suspicious
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
CrowdStrike win/malicious_confidence_100% (W)
Baidu Clean
VirIT Trojan.Win64.MSIL_Heur.A
Cyren Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Kryptik.AHED
APEX Clean
Paloalto Clean
ClamAV Clean
Kaspersky HEUR:Backdoor.MSIL.Remcos.gen
BitDefender Clean
NANO-Antivirus Clean
SUPERAntiSpyware Clean
Avast TrojanX-gen [Trj]
Tencent Win32.Trojan.Agen.Ddhl
TACHYON Clean
Emsisoft Clean
F-Secure Heuristic.HEUR/AGEN.1326434
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
Trapmine Clean
CMC Clean
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1326434
Antiy-AVL Clean
Microsoft Trojan:Win32/Casdet!rfn
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
ViRobot Clean
ZoneAlarm HEUR:Backdoor.MSIL.Remcos.gen
GData Clean
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!B682E3DC1F18
MAX Clean
VBA32 Clean
Cylance unsafe
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:vHj0+Z2fWb3e0hsDyX6ZYw)
Yandex Clean
Ikarus Win32.Outbreak
MaxSecure Trojan.Malware.300983.susgen
Fortinet Clean
BitDefenderTheta Clean
AVG TrojanX-gen [Trj]
Cybereason Clean
DeepInstinct MALICIOUS
No IRMA results available.