Static | ZeroBOX

PE Compile Time

2023-07-05 18:10:44

PDB Path

E:\ProjectHome\CSharpProjectHome\Loader\Loader\obj\Release\Loader.pdb

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00042758 0x00042800 7.97951938526
.rsrc 0x00046000 0x000004d4 0x00000600 3.71027780637
.reloc 0x00048000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00046090 0x00000244 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x000462e4 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
kernel32
810434BA364CD2FE220DD2E41A387F1F6D9831D12177A971D4B7C6448B14A214
__StaticArrayInitTypeSize=14
C0F0444B632FD4E56568349154C3EAC0A405791C06B29D011EFC0A53B8184E65
__StaticArrayInitTypeSize=6
<Module>
<PrivateImplementationDetails>
7741CBBD4BA5626FA5DC44AAD82CC54B70548DF1D41EBD5796092038586645AA
61233952CF451590F36E8080FCF6F821AF7C3DAF33309C2B6BF13067E8AF037E
get_ASCII
System.IO
Loader.data
mscorlib
Thread
CompressionMode
Invoke
IDisposable
RuntimeFieldHandle
hModule
procName
ValueType
MethodBase
Dispose
CompilerGeneratedAttribute
GuidAttribute
DebuggableAttribute
ComVisibleAttribute
TargetFrameworkAttribute
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
Loader.exe
get_Size
dwSize
System.Threading
Encoding
System.Runtime.Versioning
GetString
Marshal
GetManifestResourceStream
GZipStream
MemoryStream
Program
System
Random
System.IO.Compression
System.Reflection
CopyTo
MethodInfo
patchAddr
Loader
BytesXor
.cctor
UIntPtr
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
patchBytes
GetBytes
RuntimeHelpers
GetProcAddress
lpAddress
Object
lpflOldProtect
VirtualProtect
flNewProtect
op_Explicit
get_Default
get_EntryPoint
System.Text
InitializeArray
ToArray
_globalKey
GetExecutingAssembly
LoadLibrary
WrapNonExceptionThrows
$65AFA54C-7FA4-4436-BA84-A0156ABC3D8C
.NETFramework,Version=v4.5.2
FrameworkDisplayName
.NET Framework 4.5.2
lfggwgggggg
c5fZp\:%.
qXp~oT
u1G2l9s
o]G2=-g
ly\``h
g]'T7.
0o,zd:F
GoGw6g
d,udP"
.eQo8/0
Ai1o`\z
9a:O3
9a7>Gs
eE}G>cq1?
Ka9P2kI
)3a4}U\J<5o
2s))9s@@
3NfWo?
7)3nUV:
|4yD 5<
YFkwtv
,yBK]p
5SPY"j#
(0.YAd
As_hcL@
Dq0RFLd
LuT.f9
#C.&(;
r7"/w>
=>=+mx
d<nJz2a
"}m6>Vi6V0VH_
7Z*Aj
aMgQ./
Ra\j&x
53%pPR
; et"^
-mw9-sh
|H;3's
bNQ3i&nd
iD?p{N
LJ@Wg4~L
To"7t-u
@|\ nr4
~8ZI]
?>qdfH
siEbN2
['P,B|
yM%y,O]J
tc2-$ v
A~Um{P&8
G$:8@|
_q4Gu!
Dq*k'c
FrmTWjp
WA^-NM
0EesgM
b]d2H>
w_V}R:
aOvqXA
wSF~$r
^&E1\B
:`]a/Cq
,D|`j
Bl!FhB
!9koh
#eyW0n
wBf\xwx3
3.495.
m)lYVX
gS6E2&
m=XV#6
u|*As?:
>Hdy?3
O/D_x
Y7~|2v
}*k"%9
0.S!/7
`JA4`=
sY'Q^6
@|=Ds5
I>u 7J
X{(D?Xdb
m!Q"'x
(#AWn7
[Sh5L3*
o|n ';
y0.qtK
~VXpGb}
/V\'\?
|2\_k o7
e@_h:3
U4~% _:C~
~{'zJ
94#Hw
|`J9a
S@Nzk
oGfBJ+
p~>4.0
;nww'
SoK%y7
(XkJjB
q}d1$8
KfG yZ
$as V'
RX_q8l
HxN8&m$
|0i+ '
y4>.IXO
l(cCY!
K*o<F_
84.V8\
p^]`hw
W#ZvG
@,o|\j
zD%b!s
6SFzYGM
6-Jf%-
`SEp&`
A8k 8#>
C~&4.F|; o8
Q?B!o3
1#|F>x
vIqN0V
SX#i?VB
|wrZ-e
)TFXr{W
pKzj([
HHkFyia
r&[9YD
miaS#b
2snd[3
ioi35*
)%28mXw
,ZWWRyO(
mc:g"i
wASqJX
N~K xr
P\/V~*
,gkTU/e
Ws_'W)5%
la1kF|
n.)='m|Z&
m>n8~'
z+k>,}
AUYY!>!
5[UyHz
L\,fxZ
R^I=OT
~&.afF}
7*RIAs
g[Gvq4
;A->^$
|KZymo
k68C7n.>xCQ
RTl;*`
m}-fE-
K^=,>u
^~YPX"yq
2L:LC<9
/}tO|G
_e-Ku
5/Ko<,
97WZxC
5uAr|e
=-.9[x
+.So?QZ
z_t],9\/x
VW\i*S
zK!/OT
FRsEwl
??"{(*<
y"U]-U
5/G\['~vX
J|WS~O
vK^nP^
O_qr>a
_[U7k8
=#~v^w
`7}HLT
t+k8Wdu
C},mfQ
pByK!fW
im65tl
PS~*[Q
~;]QyT
} j=NU
+v<-y_
fAc+VXY
{.o|Px
=xR~@Rz
^tR#8*
&",m<C#
<Qm58&
gTW[P<
)1QNtvYSaY
{NQ9wg+O
}7wkcN
bx(8(+l:"(
:sTp/K'+<
noS6\Z^x#
]>]zY#
I|hdOr7
K7_+,|
&&x,YV
3/95'u
R*iE>reGJ
.=Z"|
RdTiy|
}WSq%/w
~-oxW~
"2[yWP
'E}@..z+
e_\Sz/
76s>>+
KTZ\?x
o=slTG
]LgdNt
lg?+lf0
C3bgt6s
6<t^E~dC
PR0^w*
B^!8<G.
XT|PX-Q
W>z-mz
w*e/[*
9) ;Y:
X9tCwrp
pS\qTw
KJNjd74
XV/+9uF
r6nT^*
<yxg'g
w^W>8&/
Ql9vH"hx[
|lp;M_
(zD(z;
ot:u0G
g>nJ4-
zQ(?tPs
PqS#9wD'~,
^.>sRw
N+nj*y_K*;
h^f?o*
+=wIp@%
8O('RF
ku;OJ*
z[YQ<!o$
w9'/)s
~]6K'=
qN;xG:
'Pwxk)
.GqXx'_q
o3'#v,.wS-
<+>w)g{
He-8O_*
`AA,;v
QrBRZ^"~
wPXxMq
Wpn?)-{U
bII'Q+
}U+nh7
8+zv_%
,yUS,_
VmZ-m~
,?WP"-
UZan)$
yg6kq 6
):)}SS
4/>.il
oz^|Y^
_E7.r_]
({ZO{qYs
\rL+z&
?/Sn<"
hxY|m?
C-"ML#)
?|*< Q
U(3-}
Bv4s4i;
ooi65v
;Fo#S&
`]] wzW
&WzZU"
n7+6n(
=PaLXo1aX
vV/\6A,)
ek?Pt[
eF[B:mN
:Om?<fb
]VY!.(z
^+;xW^V
J9[xjM
~(-ln-=Qp
_aewKt
=a??]q
n<%SB.
_zIW}L
yO?j^4
DwK97N
]2vycn
~8({(W
= gWWk
o$E<i
?5g_Uq
s\\tQ#
\*=tUvW
G<32f
^8W<`?
PqlgiSe
]^XZ|AB6
r^e-E-
LtK./:
(i$z_3
By0}*-
ITkr F
,H,l6#
!p6@c`
5bdd9
u=t6@m
|_%tK|?
{S|~g
Fv)Tw.
c;QR0_
cCi#a{
cP<`-t
>E::}6qG
ItvFuM
JC`m!
{q;|OA
/9%yys
2e$FKYi9
$Fzrr*9yY;
krr&o^z
6SV{<J~
r_DcMN
LI\{bd
~Mby-c.)hOE
3,;'`&
PdoB>1
3G`ic|
W?r?VF<
dVOqs=g
:5n{`L
]7\gat
sDZF]#
~itXo^`?
9/~y*=
<{`Hc/B
/=pmb%'
RYqx?&/
.>A0
fZ8G8L1
3W6E,j
W+W6]A
dyc>8xP
6$nn}C
kg1:&z\d
/pd<o)
EmLff5&
WdJ"j7
E:\ProjectHome\CSharpProjectHome\Loader\Loader\obj\Release\Loader.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
Loader.data
hd8912hfioh8fh189h2f
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
0.0.0.0
InternalName
Loader.exe
LegalCopyright
OriginalFilename
Loader.exe
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Clean
tehtris Clean
MicroWorld-eScan Clean
FireEye Generic.mg.7416ede6924c8511
CAT-QuickHeal Clean
ALYac Clean
Cylance unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
CrowdStrike win/malicious_confidence_100% (W)
Baidu Clean
VirIT Clean
Cyren Clean
Symantec MSIL.KillAV!gen1
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Kryptik.TDC
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky HEUR:Trojan-Spy.MSIL.Quasar.gen
Alibaba Trojan:MSIL/Kryptik.d959271b
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Sabsik.274944
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:Pfmfd6/BFmrQxjf1xsapTg)
Sophos Mal/Generic-S
F-Secure Trojan.TR/Dropper.MSIL.Gen
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
Trapmine Clean
CMC Clean
Emsisoft Clean
SentinelOne Static AI - Malicious PE
GData MSIL.Backdoor.Quasar.T7NEWB
Jiangmin Clean
Webroot Clean
Google Clean
Avira TR/Dropper.MSIL.Gen
MAX Clean
Antiy-AVL Trojan/MSIL.Kryptik
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Spy.MSIL.Quasar.gen
Microsoft Backdoor:MSIL/Quasar.GG!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.RL_AgentTesla.C4181110
Acronis suspicious
McAfee Artemis!7416EDE6924C
TACHYON Clean
DeepInstinct MALICIOUS
VBA32 Clean
Malwarebytes Generic.Malware/Suspicious
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0DG923
Tencent Msil.Trojan.Dropper.Swhl
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet MSIL/Generic.AP.274570!tr
BitDefenderTheta Gen:NN.ZemsilF.36302.qm0@aipcZnb
AVG Win32:CrypterX-gen [Trj]
Cybereason Clean
Avast Win32:CrypterX-gen [Trj]
No IRMA results available.