Static | ZeroBOX

PE Compile Time

2022-02-15 13:15:37

PE Imphash

032ac126bef9dc99c70a99a6b91b16f2

PEiD Signatures

InstallShield 2000

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000dbee 0x0000e000 6.20844142886
.rdata 0x0000f000 0x00001a80 0x00002000 4.62175155542
.data 0x00011000 0x0004e37c 0x0004d000 3.04773469624

Imports

Library KERNEL32.dll:
0x40f000 GetProcAddress
0x40f004 LoadLibraryA
0x40f008 VirtualAlloc
0x40f00c VirtualFree
0x40f010 FreeLibrary
0x40f014 RtlUnwind
0x40f018 RaiseException
0x40f01c GetModuleHandleA
0x40f020 GetStartupInfoA
0x40f024 GetCommandLineA
0x40f028 GetVersion
0x40f02c ExitProcess
0x40f040 HeapFree
0x40f044 GetCurrentThreadId
0x40f048 TlsSetValue
0x40f04c TlsAlloc
0x40f050 SetLastError
0x40f054 TlsGetValue
0x40f058 GetLastError
0x40f060 TerminateProcess
0x40f064 GetCurrentProcess
0x40f06c GetModuleFileNameA
0x40f078 WideCharToMultiByte
0x40f084 SetHandleCount
0x40f088 GetStdHandle
0x40f08c GetFileType
0x40f094 GetVersionExA
0x40f098 HeapDestroy
0x40f09c HeapCreate
0x40f0a0 WriteFile
0x40f0a4 IsBadWritePtr
0x40f0a8 IsBadReadPtr
0x40f0ac HeapValidate
0x40f0b0 HeapAlloc
0x40f0b4 HeapReAlloc
0x40f0b8 DebugBreak
0x40f0c0 OutputDebugStringA
0x40f0c8 IsBadCodePtr
0x40f0cc GetCPInfo
0x40f0d0 GetACP
0x40f0d4 GetOEMCP
0x40f0d8 MultiByteToWideChar
0x40f0dc LCMapStringA
0x40f0e0 LCMapStringW
0x40f0e4 GetStringTypeA
0x40f0e8 GetStringTypeW
0x40f0ec SetFilePointer
0x40f0f0 SetStdHandle
0x40f0f4 FlushFileBuffers
0x40f0f8 CloseHandle

!This program cannot be run in DOS mode.
RichMdy
`.rdata
@.data
t@KHC
t.;t$$t(
=tGjyh
VC20XC00U
PPPPPPPP
PPPPPPPP
tFGQPS
mlock.c
dbgdel.cpp
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)
tidtable.c
stdenvp.c
stdargv.c
a_env.c
ioinit.c
__GLOBAL_HEAP_SELECTED
__MSVCRT_HEAP_SELECT
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
Client
Ignore
Normal
Error: memory allocation: bad memory block type.
Invalid allocation size: %u bytes.
Client hook allocation failure.
Client hook allocation failure at file %hs line %d.
dbgheap.c
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
_pFirstBlock == pHead
_pLastBlock == pHead
pHead->nBlockUse == nBlockUse
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
DAMAGE: after %hs block (#%d) at 0x%08X.
DAMAGE: before %hs block (#%d) at 0x%08X.
Client hook free failure.
memory check error at 0x%08X = 0x%02X, should be 0x%02X.
%hs located at 0x%08X is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0x%08X.
DAMAGED
_heapchk fails with unknown return value!
_heapchk fails with _HEAPBADPTR.
_heapchk fails with _HEAPBADEND.
_heapchk fails with _HEAPBADNODE.
_heapchk fails with _HEAPBADBEGIN.
Bad memory block found at 0x%08X.
_CrtMemCheckPoint: NULL state pointer.
Object dump complete.
crt block at 0x%08X, subtype %x, %u bytes long.
normal block at 0x%08X, %u bytes long.
client block at 0x%08X, subtype %x, %u bytes long.
{%ld}
%hs(%d) :
#File Error#(%d) :
Dumping objects ->
Data: <%s> %s
Detected memory leaks!
Assertion Failed
Warning
%s(%d) : %s
Assertion failed!
Assertion failed:
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
wsprintfA
user32.dll
Microsoft Visual C++ Debug Library
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
(Press Retry to debug the application)
Module:
File:
Line:
Expression:
For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.
dbgrpt.c
szUserMessage != NULL
GetLastActivePopup
GetActiveWindow
MessageBoxA
format != NULL
sprintf.c
string != NULL
vsprintf.c
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)
_flsbuf.c
str != NULL
`h````
ppxxxx
(null)
output.c
ch != _T('\0')
_getbuf.c
_file.c
H:mm:ss
dddd, MMMM dd, yyyy
M/d/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
fclose.c
stream != NULL
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
_freebuf.c
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
FreeLibrary
KERNEL32.dll
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
WriteFile
IsBadWritePtr
IsBadReadPtr
HeapValidate
HeapAlloc
HeapReAlloc
DebugBreak
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle
www.xy999.com
gxf72.
/ou+#h&k
v`X(fM
{`F"i/n
"rZ*2v5
RU `8%LY
[}R@|6
z'yS8\1
tr_eKPa_
J(y$k/
:Y;53
Ee)]XE1I0gcjx
$@[uYO
-U!7[x
HmhT]8
t>zsn3
dO,wN7rhl
wr_Q-x
3Vpb-1X4F
1N3E
5^@Bw;
OykiTR
y0'N>D
D|&u+6
NY2<V^,
c 9]]t
!UpDfr
!ByXGf
/:LeKb_.L
LubHkZ\
9Sz>S,0
.3EvSD#
["=gdD
~+qs[4
$3Q:@eQk
z.5[Q
YS3mZY
!t)$/0
$c >a
[=EkXk
5E{Pl
UPKz"z
"KEp\!
72S=<F<03Z
xcS=cm-
3#,'xi
-TW^`q
Z%&or,
yyb?0Alm
I2k\A<i
hO8e\a
(1p-Yj
hdCPZ}/i
0)(\hDvC
+D=gY|f
#B5GhM
!g&AA9PzB
#0NrBD
qL 7-#
e8_b|R5
N.4d&nz
^5:Jd2OMi
Hp7'7v
yC'{3<5
bB!=i,
P+b=l`({
WD{vhF5
F9`_o:
vk#Zs
J&$>5u
a>lPj|
9RdRS^
?R?#G{
V}RMZo
QI1OWw
bhpL{~ lb
S+,/jr
KKu.JS
[zOwRr
vEdl<A
yfpft=
.c*=5b
wN$2v
7'+-QY
h^.+olW
q5!<ZU
^k>; 3m
ezetV7
F)lS!F
[-[.zBsM
?r5X7}
_#d"b
Y;kK#\G
`Y&VF5
{;wcxcli
3xW*KH
w2| F9B&
%]~Kt{
K7X*Y-h
E;_M0$Z
>B4kyE
!&U^|a@
Gn-}ROC
k5oj8^|
>"e+4*G
9B%N19
p8{8U!
+ {\YS
&}_/#<
`Fk+,Zc5
u2(s@"
b:`'[i-
9iK#Y=E
a2bYfob
E8L^qJ
7K<g#T
MqWXEJ
-g_[>U
*-Z~RE
X6urL{
i{zEj
UGA&Y[
'9lA1)
b u56g
it\U@_M
fZw2DE
[V /_N
isChgVKi5h
PQw-F@F{
F 4eIdG
2M8P,G
StudyHard
HeapFree
kernel32.dll
HeapReAlloc
kernel32.dll
HeapAlloc
kernel32.dll
GetProcessHeap
kernel32.dll
HeapAlloc
kernel32.dll
VirtualAlloc
kernel32.dll
kernel32.dll
VirtualAlloc
kernel32.dll
VirtualFree
kernel32.dll
VirtualProtect
kernel32.dll
HeapFree
kernel32.dll
GetProcessHeap
KERNEL32.dll
.?AVtype_info@@
(null)
((((( H
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Farfli.4!c
tehtris Clean
MicroWorld-eScan Gen:Variant.Zegost.53
ClamAV Win.Trojan.Zegost-9971776-0
FireEye Generic.mg.d8c387e22a23fcda
CAT-QuickHeal Trojan.FarfliRI.S27090835
McAfee GenericRXLP-OX!D8C387E22A23
Cylance unsafe
Zillya Trojan.Kryptik.Win32.3701711
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 00562edc1 )
BitDefender Gen:Variant.Zegost.53
K7GW Trojan ( 00562edc1 )
CrowdStrike win/malicious_confidence_100% (W)
Baidu Clean
VirIT Trojan.Win32.GenusB.DGCY
Cyren W32/Trojan.LBET-0583
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HCAH
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky HEUR:Backdoor.Win32.Farfli.gen
Alibaba Backdoor:Win32/Farfli.60395a02
NANO-Antivirus Trojan.Win32.Kryptik.jmvgmk
ViRobot Trojan.Win.Z.Farfli.385024.FX
Rising Trojan.Kryptik!1.E27A (CLASSIC)
TACHYON Trojan/W32.Agent.385024.ADI
Emsisoft Gen:Variant.Zegost.53 (B)
F-Secure Trojan.TR/Crypt.XPACK.Gen
DrWeb Trojan.Siggen11.63246
VIPRE Gen:Variant.Zegost.53
TrendMicro TROJ_GEN.R002C0DF623
McAfee-GW-Edition BehavesLike.Win32.Downloader.fz
Trapmine suspicious.low.ml.score
CMC Clean
Sophos Troj/Farfli-EA
SentinelOne Static AI - Suspicious PE
GData Gen:Variant.Zegost.53
Jiangmin Backdoor.Farfli.eqx
Webroot Clean
Avira TR/Crypt.XPACK.Gen
Antiy-AVL Trojan[Backdoor]/Win32.Farfli
Gridinsoft Clean
Xcitium Backdoor.Win32.Farfli.FK@7jqjxo
Arcabit Trojan.Zegost.53
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Backdoor.Win32.Farfli.gen
Microsoft Trojan:Win32/Farfli.CT!MTB
Google Detected
AhnLab-V3 Malware/Win32.RL_Generic.R299466
Acronis Clean
VBA32 Trojan.Farfli
ALYac Gen:Variant.Zegost.53
MAX malware (ai score=82)
DeepInstinct MALICIOUS
Malwarebytes Generic.Crypt.Trojan.DDS
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DF623
Tencent Backdoor.Win32.farfli.zf
Yandex Trojan.GenAsa!gBhknYBDYco
Ikarus Win32.Outbreak
MaxSecure Trojan.Malware.73947863.susgen
Fortinet W32/Generic.AP.322A94!tr
BitDefenderTheta Gen:NN.ZexaF.36250.xmW@auqvm9i
AVG Win32:BackdoorX-gen [Trj]
Avast Win32:BackdoorX-gen [Trj]
No IRMA results available.