Static | ZeroBOX

PE Compile Time

2019-06-24 08:27:55

PE Imphash

824637e9faa330dbb88c3aeabc598215

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00014d7a 0x00014e00 6.26751971282
.rdata 0x00016000 0x000065c0 0x00006600 4.82561638718
.data 0x0001d000 0x00001448 0x00000a00 2.55559536163
.reloc 0x0001f000 0x00001100 0x00001200 6.415126894

Imports

Library KERNEL32.dll:
0x416008 DecodePointer
0x41600c RaiseException
0x416010 GetLastError
0x416014 HeapAlloc
0x416018 GetProcessHeap
0x416024 GetTickCount
0x416028 IsDebuggerPresent
0x41602c MultiByteToWideChar
0x416030 FreeConsole
0x416034 OutputDebugStringW
0x416040 CloseHandle
0x416044 CreateFileW
0x416048 LoadLibraryA
0x41604c GetTempPathA
0x416050 SetFilePointerEx
0x416054 GetConsoleMode
0x416058 GetConsoleOutputCP
0x41605c FlushFileBuffers
0x416060 LCMapStringW
0x416064 CompareStringW
0x416070 GetCurrentProcess
0x416074 TerminateProcess
0x416080 GetCurrentProcessId
0x416084 GetCurrentThreadId
0x41608c InitializeSListHead
0x416090 GetStartupInfoW
0x416094 GetModuleHandleW
0x416098 RtlUnwind
0x41609c SetLastError
0x4160a0 EncodePointer
0x4160a8 TlsAlloc
0x4160ac TlsGetValue
0x4160b0 TlsSetValue
0x4160b4 TlsFree
0x4160b8 FreeLibrary
0x4160bc GetProcAddress
0x4160c0 LoadLibraryExW
0x4160c4 GetStdHandle
0x4160c8 WriteFile
0x4160cc GetModuleFileNameW
0x4160d0 ExitProcess
0x4160d4 GetModuleHandleExW
0x4160d8 GetCommandLineA
0x4160dc GetCommandLineW
0x4160e0 HeapFree
0x4160e4 HeapSize
0x4160e8 HeapReAlloc
0x4160ec FindClose
0x4160f0 FindFirstFileExW
0x4160f4 FindNextFileW
0x4160f8 IsValidCodePage
0x4160fc GetACP
0x416100 GetOEMCP
0x416104 GetCPInfo
0x416108 WideCharToMultiByte
0x416118 SetStdHandle
0x41611c GetFileType
0x416120 GetStringTypeW
0x416124 WriteConsoleW
Library USER32.dll:
0x41612c CharLowerA
Library ADVAPI32.dll:
0x416000 GetUserNameA
Library WINHTTP.dll:
0x416134 WinHttpOpenRequest
0x416138 WinHttpCloseHandle
0x41613c WinHttpOpen
0x416140 WinHttpReadData
0x41614c WinHttpSendRequest
0x416150 WinHttpConnect

!This program cannot be run in DOS mode.
`.rdata
@.data
.reloc
QQSVWd
URPQQh
UQPXY]Y[
uSSSSj
f9:t!V
QQSVj8j@
PPPPPPPP
PPPPPVW
PP9E u!PPSVP
atlTraceStencil
atlTraceString
atlTraceMap
atlTraceUtil
atlTraceSecurity
atlTraceSync
atlTraceISAPI
ForceRemove
NoRemove
Delete
Component Categories
FileType
Interface
Hardware
SECURITY
SYSTEM
Software
TypeLib
george
JohnDoe
advapi32.dll
cdn.discordapp.com
/attachments/906552604258082849/1127979465348218900/Output.bin
atlTraceGeneral
atlTraceCOM
atlTraceQI
atlTraceRegistrar
atlTraceRefcount
atlTraceWindowing
atlTraceControls
atlTraceHosting
atlTraceDBClient
atlTraceDBProvider
atlTraceSnapin
atlTraceNotImpl
atlTraceAllocation
atlTraceException
atlTraceTime
atlTraceCache
Unknown exception
bad array new length
vector too long
bad allocation
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__swift_3
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CorExitProcess
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
GetTempPathA
IsDebuggerPresent
DecodePointer
RaiseException
GetLastError
HeapAlloc
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetTickCount
LoadLibraryA
MultiByteToWideChar
FreeConsole
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
KERNEL32.dll
CharLowerA
USER32.dll
GetUserNameA
ADVAPI32.dll
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WINHTTP.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
HeapSize
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVbad_array_new_length@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVbad_exception@std@@
.?AVtype_info@@
5'5@5G5M5[5e5k5~5
7747w7
<8D8f8t8
9(9/9=9K9R9`9n9t9
:":@:Y;
:!<}<[=
=!=8=l=
1#1)1/151;1P1e1l1r1
2+2=2o2x2
3'3,323<3F3V3f3v3
4#4(4.484B4U4Z4g4
5&535I5
747s7y7
8#8A8^8
:6:?:H:V:_:
<(=/=4=8=<=@=
8):J:X:^:y:
;;+;z;
9*:1:Z:v:
;G;Q;q;{;
<(<-<2<M<W<c<h<m<
70P0Z0f0
4"4)414I4W4_4w4
:%:0:H:V:y:
;%;:;G;];d;p;
<&=4=M=U=^=g=x=
>R>^>c>i>n>v>|>
44X4~4
8g9B:I:v:}:
;,;J;q;
<*<<<O<i<x<
= =B=S=m=s=~=
5\5d5j5
9!:(:/:6:P:_:i:v:
0o2'3q3
9Y9h9v9
==1=C=U=g=y=
>*><>N>p?
2#3\3s3
4+40454E4J4O4_4d4i4y4~4
5'5H5U5j5s5
7!7&7+7F7U7`7e7j7
8:8^8u8~8
8%9]9u9
::p:u:z:
=!=&=-?G?V?d?p?|?
00-080N0b0x2
5#5J5T5
112F2P2
2"313g3
>(>5>:>H>
??/?h?
306=6h6
9 929z9
:,:5:>:
?:?@?N?
1Q2]2q2}2
3"3?3O3[3j3}4
4'5D5X5c5
7&8F8V8
9]:h:n:w:
0:1U1k1
=5=_=q=
X1d1h1t1x1|1
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9
3 3$3(3,303<3D3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
4 8$8(8,8h>l>p>t>x>|>
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
?$?,?4?<?D?L?T?\?d?l?t?|?
2(2,20282P2`2d2t2x2|2
3$3<3L3P3`3d3l3
3D6T6d6t6
7 747H7\7d7l7t7x7|7
8 8$8(808D8\8`8|8
9(949<9d9h9
9 :,:\:`:
;(;D;H;h;
<(<H<h<
=(=H=d=h=
1 1,10141P1T1
9 9@9`9
jjjjjj
bcmd.exe
ERROR : Unable to initialize critical section in CAtlBaseModule
Aapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
mscoree.dll
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
Aja-JP
((((( H
Aapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
api-ms-win-core-fibers-l1-1-0
ext-ms-
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Coins.4!c
tehtris Generic.Malware
MicroWorld-eScan Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
McAfee Artemis!10ADFD55D2FE
Malwarebytes Clean
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Agent.HAS
APEX Malicious
Paloalto Clean
Cynet Clean
Kaspersky HEUR:Trojan-PSW.Win32.Coins.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Generic@AI.100 (RDML:IMGCJz7UY6UvSH03hyjlYA)
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Trojan.Win32.AMADEY.YXDGKZ
McAfee-GW-Edition Artemis!Trojan
Trapmine Clean
FireEye Generic.mg.10adfd55d2fe1b14
Emsisoft Clean
Ikarus Win32.Outbreak
GData Clean
Jiangmin Clean
Webroot W32.Coins.Gen
Avira Clean
Antiy-AVL Clean
Gridinsoft Malware.Win32.Downloader.cc
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-PSW.Win32.Coins.gen
Microsoft Trojan:Win32/SpywareX.CRDB!MTB
Google Detected
AhnLab-V3 Clean
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.36302.hqW@aG9InDn
ALYac Clean
MAX Clean
DeepInstinct MALICIOUS
VBA32 BScope.Trojan-Dropper.Injector
Cylance Clean
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXDGKZ
Tencent Clean
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Clean
Fortinet W32/PossibleThreat
AVG Win32:PWSX-gen [Trj]
Avast Win32:PWSX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.