Static | ZeroBOX

PE Compile Time

2023-06-15 16:53:09

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00000d8c 0x00000e00 5.31790207315
.rsrc 0x00004000 0x00010e28 0x00011000 4.76690987701
.reloc 0x00016000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00004100 0x00010828 LANG_NEUTRAL SUBLANG_NEUTRAL dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON 0x00014938 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0001495c 0x000002cc LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00014c38 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
<>9__2_0
<Half>b__2_0
IEnumerable`1
Task`1
List`1
Func`2
<Module>
get_ASCII
mscorlib
System.Collections.Generic
GetAsync
ReadAsByteArrayAsync
Thread
HttpResponseMessage
AddRange
Enumerable
IDisposable
get_FullName
SecurityProtocolType
System.Core
Dispose
Reverse
CompilerGeneratedAttribute
GuidAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
aer45.exe
System.Threading
Encoding
System.Runtime.Versioning
FromBase64String
GetString
Normal
set_SecurityProtocol
Program
System
AppDomain
GetDomain
System.Reflection
System.Net.Http
System.Linq
InvokeMember
Binder
ServicePointManager
.cctor
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
GetTypes
BindingFlags
System.Threading.Tasks
Contains
Object
System.Net
get_Result
HttpClient
get_Content
HttpContent
get_Count
Convert
System.Text
ToArray
Assembly
WrapNonExceptionThrows
$06ede737-70ac-432c-874a-72690913fb1f
1.0.0.0
.NETFramework,Version=v4.8
FrameworkDisplayName
.NET Framework 4.8
_CorExeMain
mscoree.dll
m&H+l&G>k&FPk&GZk&Ffk&Ejk&Fpk&Fuk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Ftk&Fuk&Frk&Ekk&Fgl&G[k&FPl&G@m&H-o'J
m&H3k&Fuk&E
k&F{l&G9t(Q
l&G~j&E
n'I"i&A
m&H]k&E
l&GjK"
o'Kp'M
o'Lo'L
m&I\k&F
m&Ilk&F
q'M p'M
p'M&p'L
n&Jsl&G
q'M,m&I
p'L;p'L
o'Lim&I
o'Kzm&I
r'O n&J
q'M-p'M
q'M1n&J
q'MAp'M
q'NBn&J
p'MPp'L
p'MMo&K
q'N\p'M
p'MTo&K
p'Mgp'L
r'NZo'K
p'Mjp'L
r'Nao'K
q'Mqp'L
q'Ndo'K
q'Mup'L
r'Ngp'L
q'Ntq'M
r'Oip'L
q'Ntq'M
r'Ojp'L
q'Ntq'M
r'Ojp'L
r'Ntq'M
r'Njq'M
r'Otr'N
r'Njq'M
r'Otr'N
r'Ojq'M
r'Otr'N
r'Ojq'N
s'Otr'O
r'Ojq'N
s'Ptr'O
r'Oir'N
s'Ptr'O
s'Pjr'O
s'Ptr'P
s'Qnr'O
s'Qts'P
s'Qor'O
s'Qts'P
s'Qsr'O
s'Qts'P
t'Rts'P
t'Qts'Q
t'Rts'P
t'Rts'Q
t'Rts'P
t'Rts'Q
t'Rts'Q
t(Rtt'R
t'Rts'R
t(Stt'R
t'Rts'R
t(Stt'R
t(Rts'R
u(Stt'R
u(Stt'R
u(Stu(S
u(Stt'R
u(Stu(S
u(Ttt'S
u(Ttu(T
u(Stt'S
u(Ttu(T
v(Ttu(S
v(Ttv(T
v(Ttu(T
v(Ttv(T
v(Utu(T
v(Ttv(T
v(Utu(T
v(Utv(U
v(Utv(U
v(Utv(U
v(Utv(U
v(Utv(U
v(Utv(U
v(Utv(U
v(Utv(U
w(Vtw(V
w(Utw(V
w(Vtw(V
w(Utw(V
w(Vtw(V
w(Utw(V
w(Vtw(V
w(Utw(V
w)Vtx)W
w)Vtx)W
x)Vtx)W
w)Vtx)W
x)Wtx)W
x)Wtx)W
x)Wtx)X
y)Xty)X
y)Wty)X
y)Xty)X
y)Xty)X
y)Xuy)X
y)Xty)X
y)Xqy)X
y)Xty)X
z)Yiy)X
y)Xtz)Y
y)Xiy)X
y)Xtz)Y
z)Ydy)X
y)Xuz)Y
{)Zay)Y
z)Ypz)Y
z)Z[z)Y
z)Ziz)Z
y)XSz)Y
{)Zh{)Z
z)ZLz)Y
{*Z[{)Z
{)ZBz)Y
z)YN{)Z
z)Y2{)Z
{*[A{*[
{)Z{)Z
{)Z-{*[
{*[f|*[
|*[w|*\
|*\)|*\
{*[7|*[
|*\q|*\
|*["|*\
|*[V}*]
|*\f|*\
|*[Q}*]
|*\o}*\
|*\x{*[
{*[)|*\g|*\
|*\m{*[.w(U
{)Z {*[3|*\D|*\N{*ZU}*]^}*]e|*\i|*\j|*\j|*\j|*\j|*\j|*\j|*\j|*\j|*\i|*\j|*\n|*\o|*[o{*[s{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t{*[t|*[r|*[o|*[p|*\m|*\i|*\j|*\j|*\j|*\j|*\j|*\j|*\j|*\j|*\j|*\i}*]e}*]`{*[W|*[O|*\E{*[4|*[$y)X
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
http://192.210.215.42/bf/panel/uploads/Yjsdwwlrsgm.mp3
u3LJbP0xP
u9BJwnnORwvr1FUHJ9.GvR5X6GauMmAovfrVj
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
aer45.exe
LegalCopyright
LegalTrademarks
OriginalFilename
aer45.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stealer.12!c
tehtris Clean
MicroWorld-eScan Trojan.GenericKD.67561074
ClamAV Clean
FireEye Generic.mg.b1a48b37d6eae92a
CAT-QuickHeal Clean
ALYac Trojan.GenericKD.67561074
Malwarebytes Trojan.Downloader.MSIL.Generic
VIPRE Trojan.GenericKD.67561074
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan-Downloader ( 005a70051 )
BitDefender Trojan.GenericKD.67561074
K7GW Trojan-Downloader ( 005a70051 )
Cybereason Clean
Arcabit Trojan.Generic.D406E672
Baidu Clean
VirIT Trojan.Win32.MSIL_Heur.A
Symantec MSIL.Downloader!gen7
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.PHW
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
Alibaba TrojanSpy:MSIL/Stealer.35784f0d
NANO-Antivirus Clean
ViRobot Clean
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:jI3w1Edgq6G3Oj4tpOOZ/A)
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/Dldr.Agent.xqhgg
DrWeb Trojan.DownLoaderNET.658
Zillya Trojan.Stealer.Win32.107521
TrendMicro TROJ_GEN.R002C0XFI23
McAfee-GW-Edition BehavesLike.Win32.AdwareTskLnk.lt
Trapmine Clean
CMC Clean
Emsisoft Trojan.GenericKD.67561074 (B)
Ikarus Trojan-Downloader.MSIL.Agent
Jiangmin Clean
Webroot Clean
Avira TR/Dldr.Agent.xqhgg
Antiy-AVL Trojan[Spy]/MSIL.Stealer
Gridinsoft Clean
Xcitium Clean
Microsoft Trojan:Win32/Wacatac.B!ml
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Spy.MSIL.Stealer.gen
GData Trojan.GenericKD.67561074
Google Detected
AhnLab-V3 Malware/Gen.RL_Reputation.C4339731
Acronis Clean
McAfee Artemis!B1A48B37D6EA
MAX malware (ai score=80)
DeepInstinct MALICIOUS
VBA32 TScope.Trojan.MSIL
Cylance unsafe
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0XFI23
Tencent Malware.Win32.Gencirc.13d5c1a5
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.73709669.susgen
Fortinet MSIL/GenKryptik.GKRQ!tr
BitDefenderTheta Gen:NN.ZemsilF.36270.em0@a4vmeSo
AVG Win32:DropperX-gen [Drp]
Avast Win32:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.