Static | ZeroBOX

PE Compile Time

2023-06-17 01:16:13

PE Imphash

fcb17a5fbbc1dea101c155ad1f1e322e

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00003cdd 0x00000000 0.0
.rdata 0x00005000 0x00001d9c 0x00000000 0.0
.data 0x00007000 0x0000b6c8 0x00000000 0.0
.rsrc 0x00013000 0x00008560 0x00002000 2.05006599522
.vmp0 0x0001c000 0x0000c320 0x00000000 0.0
.vmp1 0x00029000 0x0001e0e6 0x0001f000 7.83052638532
.reloc 0x00048000 0x0000006c 0x00001000 0.166951288658

Resources

Name Offset Size Language Sub-language File type
RT_BITMAP 0x0001a130 0x00000158 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_BITMAP 0x0001a130 0x00000158 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_ICON 0x00013cf0 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00013cf0 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00013cf0 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x00013cf0 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_MENU 0x0001a288 0x00000058 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_DIALOG 0x0001a368 0x0000033a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_DIALOG 0x0001a368 0x0000033a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_STRING 0x0001b434 0x00000086 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_ACCELERATOR 0x0001b4bc 0x00000068 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty
RT_GROUP_ICON 0x00013e3c 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_GROUP_ICON 0x00013e3c 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_VERSION 0x00013e60 0x00000304 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
None 0x0001b524 0x0000000c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED empty

Imports

Library MFC42.DLL:
0x4340eb None
Library MSVCRT.dll:
0x4340f3 _except_handler3
Library KERNEL32.dll:
0x4340fb GetModuleHandleA
Library USER32.dll:
0x434103 PeekMessageA
Library GDI32.dll:
0x43410b BitBlt
Library ADVAPI32.dll:
0x434113 OpenProcessToken
Library SHELL32.dll:
0x43411b ShellExecuteA
Library KERNEL32.dll:
0x434123 LoadLibraryA
0x434127 VirtualProtect
0x43412b GetModuleFileNameA
0x43412f ExitProcess
Library USER32.dll:
0x434137 MessageBoxA

!This program cannot be run in DOS mode.
`.rdata
@.data
@.vmp0
.reloc
DDLLDDDL
LLDDLD
DDLDLD
LDDDDDDD
DDDDDDDDD
DDDDDDDDDDD
DDDDDDDDDDDDD
DDDDDDD
DDDDD@
n82<FP>3$
SH!1pf
&VlOe?
uUSER32.dll
V/rdhUf
[R[./"r
GetModuleFileNameA
D/;^t)
KERNEL32.dll
ShellExecuteA
9CoLgh^
PeekMessageA
3Q];Y
LoadLibraryA
File corrupted!. This program has been manipulated and maybe
it's infected by a Virus or cracked. This file won't work anymore.
Oynm<A
//YSM{
MSVCRT.dll
?'q&CaP
+i7E#A
GDI32.dll
lB-9U
RZDOEm
hrP~lj
I4m?=2
vwRL*u
&K'!D*
GuCA/-
?i#m"7
;`}z/%7
XMFC42.DLL
JSN6,8*N[[
X7-{$L
r5x_yn\
z%k~\:B
Za`GGBb
yDGVI%
9=kFifd
(fa2F|
"hK7{V'#
j0X$7Nf.
z4BEwD
CRI("5
b_"J}D
TZ.(Fx
:gNDna
mqLR!f
5GsBQQ
xLPDH\`Tx
Lllh}Z
wU8Ori
qJc5J)5kJ\
\Ro!ZQ~
o)\sng#k
w[w7w^wuw
1R\Jvb
!uPJ!b%
(<8rHbXuh
X]o-`s
c8h$hTo% s
w(wKwjw
&AK.$.lJx
vlF4"0
/7cK,$
#E*u[6
q!;i%;}:
[<c!~'
b-2g<F
ua{Gyg
,:)aM
~o2+nxU
mynjmM
+qe"=d{2
&mWsM'
x`;D$(
ADVAPI32.dll
L*hFD2#
,FP:$^
#n)RrY
&OY5_i
$( QyV
"`.|J81
U_]H{1
!/,(H2
p!\x6c
z)}wf+`{s
DNTxP^
L"{i8M
kXXxKe
Yo%.zoR
WS.8m<
Y9,xdX4
5"XRmc
m{97UC
60:t^(2<
"0~,:xV
M[YOf=
q1{BU$
`>\*(&
The procedure entry point %s could not be located in the dynamic link library %s
l$$h4.#
%A P:)sB
OtAhfN
&s]%I
]9#-7!
(Rl&`j
OHSHELL32.dll
OpenProcessToken
MessageBoxA
&J0S93
MgfS.M
'8!&1
"The ordinal %u could not be located in the dynamic link library %s
ZaMpv+
g1T>aw
m{0$}L
VirtualProtect
Q>T^F@
?};iZh
3'3]is
&U![~$N
ExitProcess
_except_handler3
'!2(P*D
D$@~JD
KygEsA
5230zK
BitBlt
_i^6l=c
GetModuleHandleA
rY?*6R<
sm~dYv
?LzlOx
z#p}5#{
a6`K#q
~2'B|/
N:(yk
$S2C4J
V%x,+R
^3Yt$x
$PyYz[
{&}Jx2
$wix,P
E,dM%w
S/:@97,9
5<~$c%r1
,,K:QZ$
Q"1`mj
oJ5o@
W&LM>5J
yl?,ER
y45+Lg
Yz8DQl
Xr;3h&
248yX{Ld
a\`[[9y
{XFND={g
G;;9^8$
G+z6#D
7t\mZy
>K 9+d}
&uAp%
gY#c{.
-lk<y,
bp^3Q_
QR-$"p
1,MAmp
'JIO7P
L7!y{i
:\r}-
@Lnq.Z
k:6(SL
2HYPPO
#Q?tmI
,T% <N
FUj/
N_Yh'{
,JUfX
,\,3"g
XxCRT
?p_ADg
a(p8OZg
gRG/kY
qgXfo_
X]#n{S
Ky'UC<h
Q``hA0j
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
FileDescription
PortScan MFC Application
FileVersion
1, 0, 0, 1
InternalName
PortScan
LegalCopyright
Copyright (C) 2001
LegalTrademarks
OriginalFilename
PortScan.EXE
ProductName
PortScan Application
ProductVersion
1, 0, 0, 1
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
ClamAV Clean
FireEye Generic.mg.8f26838bcfe78a27
CAT-QuickHeal Clean
McAfee Artemis!8F26838BCFE7
Cylance unsafe
VIPRE Trojan.GenericKD.67556515
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.GenericKD.67556515
K7GW Clean
K7AntiVirus Clean
Arcabit Trojan.Generic.D406D4A3
Baidu Clean
VirIT Clean
Cyren W32/ABRisk.MQJT-1717
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/Packed.VMProtect.AJI
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky Trojan.Win32.Miancha.jlk
Alibaba Trojan:Win32/Sabsik.7b45deb2
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.67556515
Rising Trojan.Generic@AI.97 (RDML:PzQqOIM5tnoNyE2vWbv0gg)
Emsisoft Trojan.GenericKD.67556515 (B)
F-Secure Heuristic.HEUR/AGEN.1324799
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Corrupt.cc
Trapmine malicious.high.ml.score
CMC Clean
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1324799
MAX malware (ai score=83)
Antiy-AVL Trojan[Packed]/Win32.VMProtect
Gridinsoft Clean
Xcitium TrojWare.Win32.Trojan.XPACK.Gen@2ho5ur
Microsoft Trojan:Win32/Sabsik.MTR!MTB
SUPERAntiSpyware Clean
ZoneAlarm Trojan.Win32.Miancha.jlk
GData Win32.Trojan.Agent.3Y872H
Google Detected
AhnLab-V3 Clean
Acronis Clean
BitDefenderTheta AI:Packer.4D72F3C21F
ALYac Clean
TACHYON Clean
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Download
Malwarebytes Malware.Heuristic.1003
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H01FG23
Tencent Clean
Yandex Clean
Ikarus Trojan.Win32.VMProtect
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
Cybereason malicious.f71c58
Panda Trj/CI.A
No IRMA results available.