Static | ZeroBOX

PE Compile Time

2016-12-12 06:50:48

PE Imphash

4ea4df5d94204fc550be1874e1b77ea7

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000061f1 0x00006200 6.47707476341
.rdata 0x00008000 0x000013a4 0x00001400 5.16300165576
.data 0x0000a000 0x00020338 0x00000600 3.97455584349
.ndata 0x0002b000 0x0002b000 0x00000000 0.0
.rsrc 0x00056000 0x0001ae08 0x0001b000 3.97758101491

Resources

Name Offset Size Language Sub-language File type
RT_BITMAP 0x00056358 0x00000368 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ICON 0x00070030 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x00070030 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x00070030 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x00070030 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x00070030 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x00070030 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_DIALOG 0x00070a08 0x00000060 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00070a08 0x00000060 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00070a08 0x00000060 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00070a08 0x00000060 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00070a08 0x00000060 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00070a08 0x00000060 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x00070a68 0x0000005a LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x00070ac8 0x0000033e LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, ASCII text, with very long lines, with no line terminators

Imports

Library KERNEL32.dll:
0x408074 GetFileAttributesW
0x408078 GetFullPathNameW
0x40807c Sleep
0x408080 GetTickCount
0x408084 CreateFileW
0x408088 GetFileSize
0x40808c MoveFileW
0x408090 SetFileAttributesW
0x408094 GetModuleFileNameW
0x408098 CopyFileW
0x40809c ExitProcess
0x4080a8 GetTempPathW
0x4080ac GetCommandLineW
0x4080b0 GetVersion
0x4080b4 SetErrorMode
0x4080b8 WaitForSingleObject
0x4080bc GetCurrentProcess
0x4080c0 CompareFileTime
0x4080c4 GlobalUnlock
0x4080c8 GlobalLock
0x4080cc CreateThread
0x4080d0 GetLastError
0x4080d4 CreateDirectoryW
0x4080d8 CreateProcessW
0x4080dc RemoveDirectoryW
0x4080e0 lstrcmpiA
0x4080e4 GetTempFileNameW
0x4080e8 WriteFile
0x4080ec lstrcpyA
0x4080f0 lstrcpyW
0x4080f4 MoveFileExW
0x4080f8 lstrcatW
0x4080fc GetSystemDirectoryW
0x408100 GetProcAddress
0x408104 GetModuleHandleA
0x408108 GlobalFree
0x40810c GlobalAlloc
0x408110 GetShortPathNameW
0x408114 SearchPathW
0x408118 lstrcmpiW
0x40811c SetFileTime
0x408120 CloseHandle
0x408128 lstrcmpW
0x40812c GetDiskFreeSpaceW
0x408130 lstrlenW
0x408134 lstrcpynW
0x408138 GetExitCodeProcess
0x40813c FindFirstFileW
0x408140 FindNextFileW
0x408144 DeleteFileW
0x408148 SetFilePointer
0x40814c ReadFile
0x408150 FindClose
0x408154 MulDiv
0x408158 MultiByteToWideChar
0x40815c lstrlenA
0x408160 WideCharToMultiByte
0x40816c FreeLibrary
0x408170 LoadLibraryExW
0x408174 GetModuleHandleW
Library USER32.dll:
0x408198 GetSystemMenu
0x40819c SetClassLongW
0x4081a0 IsWindowEnabled
0x4081a4 EnableMenuItem
0x4081a8 SetWindowPos
0x4081ac GetSysColor
0x4081b0 GetWindowLongW
0x4081b4 SetCursor
0x4081b8 LoadCursorW
0x4081bc CheckDlgButton
0x4081c0 GetMessagePos
0x4081c4 LoadBitmapW
0x4081c8 CallWindowProcW
0x4081cc IsWindowVisible
0x4081d0 CloseClipboard
0x4081d4 SetClipboardData
0x4081d8 EmptyClipboard
0x4081dc OpenClipboard
0x4081e0 wsprintfW
0x4081e4 ScreenToClient
0x4081e8 GetWindowRect
0x4081ec GetSystemMetrics
0x4081f0 SetDlgItemTextW
0x4081f4 GetDlgItemTextW
0x4081f8 MessageBoxIndirectW
0x4081fc CharPrevW
0x408200 CharNextA
0x408204 wsprintfA
0x408208 DispatchMessageW
0x40820c PeekMessageW
0x408210 GetDC
0x408214 ReleaseDC
0x408218 EnableWindow
0x40821c InvalidateRect
0x408220 SendMessageW
0x408224 DefWindowProcW
0x408228 BeginPaint
0x40822c GetClientRect
0x408230 FillRect
0x408234 EndDialog
0x408238 RegisterClassW
0x408240 CreateWindowExW
0x408244 GetClassInfoW
0x408248 DialogBoxParamW
0x40824c CharNextW
0x408250 ExitWindowsEx
0x408254 DestroyWindow
0x408258 LoadImageW
0x40825c SetTimer
0x408260 SetWindowTextW
0x408264 PostQuitMessage
0x408268 ShowWindow
0x40826c GetDlgItem
0x408270 IsWindow
0x408274 SetWindowLongW
0x408278 FindWindowExW
0x40827c TrackPopupMenu
0x408280 AppendMenuW
0x408284 CreatePopupMenu
0x408288 DrawTextW
0x40828c EndPaint
0x408290 CreateDialogParamW
0x408294 SendMessageTimeoutW
0x408298 SetForegroundWindow
Library GDI32.dll:
0x40804c SelectObject
0x408050 SetBkMode
0x408054 CreateFontIndirectW
0x408058 SetTextColor
0x40805c DeleteObject
0x408060 GetDeviceCaps
0x408064 CreateBrushIndirect
0x408068 SetBkColor
Library SHELL32.dll:
0x408184 SHBrowseForFolderW
0x408188 SHGetFileInfoW
0x40818c ShellExecuteW
0x408190 SHFileOperationW
Library ADVAPI32.dll:
0x408000 RegDeleteKeyW
0x408004 SetFileSecurityW
0x408008 OpenProcessToken
0x408014 RegOpenKeyExW
0x408018 RegEnumValueW
0x40801c RegDeleteValueW
0x408020 RegCloseKey
0x408024 RegCreateKeyExW
0x408028 RegSetValueExW
0x40802c RegQueryValueExW
0x408030 RegEnumKeyW
Library COMCTL32.dll:
0x408038 ImageList_AddMasked
0x40803c None
0x408040 ImageList_Destroy
0x408044 ImageList_Create
Library ole32.dll:
0x4082a0 OleUninitialize
0x4082a4 OleInitialize
0x4082a8 CoTaskMemFree
0x4082ac CoCreateInstance

!This program cannot be run in DOS mode.
`.rdata
@.data
.ndata
s495l
SQSSSPW
Instu_
softuV
NulluM
SVWj _3
Aj"A[f
D$$SPS
Vj%SSS
f9=(7B
D$$+D$
D$,+D$$P
\u f9O
90u'AAf
UXTHEME
USERENV
SETUPAPI
APPHELP
PROPSYS
DWMAPI
CRYPTBASE
OLEACC
CLBCATQ
RichEd32
RichEd20
MulDiv
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
ReadFile
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsW
lstrcmpW
lstrcmpiW
CloseHandle
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
SetFileAttributesW
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
KERNEL32.dll
EndPaint
DrawTextW
FillRect
GetClientRect
BeginPaint
DefWindowProcW
SendMessageW
InvalidateRect
EnableWindow
ReleaseDC
LoadImageW
SetWindowLongW
GetDlgItem
IsWindow
FindWindowExW
SendMessageTimeoutW
wsprintfW
ShowWindow
SetForegroundWindow
PostQuitMessage
SetWindowTextW
SetTimer
CreateDialogParamW
DestroyWindow
ExitWindowsEx
CharNextW
DialogBoxParamW
GetClassInfoW
CreateWindowExW
SystemParametersInfoW
RegisterClassW
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
USER32.dll
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
GDI32.dll
SHFileOperationW
ShellExecuteW
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHELL32.dll
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
ADVAPI32.dll
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
COMCTL32.dll
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
ole32.dll
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VERSION
SHGetFolderPathW
SHFOLDER
SHAutoComplete
SHLWAPI
SHELL32
InitiateShutdownW
RegDeleteKeyExW
ADVAPI32
GetUserDefaultUILanguage
GetDiskFreeSpaceExW
SetDefaultDllDirectories
KERNEL32
[Rename]
%ls=%ls
wwwwww}
wwwwww}
wwwwww}
wwwwww}
wwwwww}
wwwwp}
wwwwp}
wwwwp}
wwwwp}
wwwwp}
wwwwp}
wwwwp}
wwwwp}
wwwwp}
wwwwp}
wwwxp}
wwwwp}
wwwwp}
ky3SSW
3<<D;w
9":241~W
6<L;vtN
%FZc\,
~7i!~
Xst;5G
Qvkt;m
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v3.01</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility></assembly>
NullsoftInst
Cd)-el
T^ ]Ta
eRoRlo
PUjO`@&XG
Kmn,:k
/LOJ^
mo$B:1=
(VdBk#2/
|5@A,S
yqKf]n
~47!`_
\du!(
K9]#|T
425L"'
mZ\Hun
A4XB?I
N5rMEgX
7Lo$P=@e
E~hJ8/
r'(6+{
g=5XP{i
y~E/Vk3GGI>xv
80N yO
Pe|m<Q
>4(mQ)o
#{r}MH
6(/riKC
oU*75b7
5sW@iv
^|kb$~Q
xa-)|A
%p?zUJ
B9x@R-
]=eSw
W(8Sw"
^mb,6j9
b`:sZ7_c
O[Epaqw
5W#RlZ@
19PKUs
Vbx|W@
%]rHAA1
3(y^)V
]Skqi~9t
eKaF3`u>
(eu*sVH
W|hk>s
<{a'.m3
Ye:VW6
.3o*@C
EhyV u
{z/_~}i[
~~~T@1q!
0DQmY?PAK
MT?vMA.
8"i!-s
VhI[cD
}EoM5W
8F'is.y
.('N2y
8jyRZ?
9:9p1>
B_$`/^
%[L`h`
Y9znIw
LeI4\C
!z>h3&9
0| nfN;
:.%<4!
&E3^3M
.5~5j
%M3j~5U
cGy"Aa
Zv%!4lv
Uq*ibs;
ONzb#|7
1584(4(
%~dV7c
9ZL@'^
@K&.aWY]&d
STV1}N
&Gv0$a
P8^?tj
VZ}g<M
58B8;M
t<lr?r
p-j8hp=
:b/K(A}
^7g#TU
2'A>+
PNAKqA
v&5F,Z
L7E8yXX?
jw4\tuM
*suyc`
E"b/>4U
K7!u61
`|d8|Y
Sftn1L\
MD;oNp
C5\x#_
1w]Z\,
OHz)v_
(W9-sU
QRvvf{
1e[oSF
>`\T}N
qzkH7o
NzwIz2
EN&apm%&
mfk[/s
KaX[]y
.wC-&e
w*h)=LW
?ydbqm(5
)WwW6<K
amJ>*x
,Pk5'\V
xS,~:5,
wg.oL3
c?RKQDh-
tqE! Y
S.x];+
}W`7e0=
T`jH*)
<3T7a.c
7y/]K*
6H~Vj
~Y4xfU
G:$#/c
T-IDRrr
\p?1b;
jemXi2
$VM;$D_
R@!4:
`|6*d:
R@X\XWT
jFD8|F
{2dg:D
jq@qlO7I
=mmE!?
ffr&_2
_6B=|a
4/dRY9
KToa?C
@.Eg ?0
>526EG
J6Em]u
)/b;yL
3Bg$aF$
-EiXf:
tyqe++
.mE8<nbD
WI12[c
i~"IEY:t
z.y_ d
|kQ-<2f
`>`%Hl/
@Q!6T$
zoQ,|fs;
!sd/`E
T^zH(g
d&{X[[
MbXgz|
uUi>}?+
I(EWFnZf\v
6 GfwqEU
mN-9by
AEh Y"?
c3csCZ
!+z!J:-
B9+H[c
#7K"r#
imNH,)RF
x[W;+%f
~sn{>#
RZnHVF
g#tCVSE
_9>GA"Kn
vqDaa
w)CF]6
@8^:(F
W:wF0I
Tc\W?\
SM57NVL
Yr%c_+
g.J^Hjp0t
5uh69T
{HUS}|2yW
TDsXIR
.O\SPm
u\wa2
3ZW'{-
<wPo!nN
0OK'C
*XPLX9p$
{MjGPP
!&)U]\
IrYq8v
q!b+wt
SOWq?O
x6q0}O]
TV%*Gw
a-7IFw
($~Qj
X?jN?m
h5x#^$b
U@mpjtt
b)]th
IhELIk
Y5-kV|
;/5}lLjJ
UN(~6b
d_=<%e
{S=|c6
/gU_[fn
4.TVJM8
@hYgs!V
Vp^a:0
F`?hG1
gT(9WA
|uxAMB
[x;o&2
@aunL&O`
@O8wG #8~
\}Hcu?m\
#C.^v!
=EizLl
H']:j6V
:{,(?U
/w64Ptsc
YDitOT[
M049rm
K>g.=U
Vt?g-4
J^qeQ<
8O@&ug
R_yxG`
b#Ed,j
%wG(9D
1YB=_T
:YOi&'
P6AuY"
Nl-QY{
,6e]c5
,KuVWHP&4L
utiFNwQ GL
;FXQjD
9p9s>x
m%AI:8
zIAd' @
'tZ)0S
BS8yZB
Y||sU%
}5CN~|
w@Gnme
eEm>4,kzC5
BPS_[s
m3v-&2&
2.Cn$v
pt0+{{
.^M7cO
Rf:)Ag
='gbI+
P(yr=}
i)ldap
hWr6qQLy
nCxzOw
cyUKth{ZN
s7+C0$p
%w+Xb}
De!1;T
czD>?M
n,7:us
5ds tt
QT5erc
{(3 M*
~^j6AM
4(1#w5
A{hYh.
kgu4(
+5x+bc
M7C"br
Y88hhc
\6:*w8+
3I{#)E7x
}ix7=+
X{ap*#2
Tag(3Czx
~+!__
sDb']=C
Q#)n@m
,p-(*:
%-;6m['
e_w!f$
1-@R%9s
SbA\r
L9 ahJ,
3?,TS$Bx
a#u$K)h
7U36|0
MN@f3l.m
U2u\aBU
f]F@!Y
+G}]Rk
](Mb^L
}PJ%R!
x5ux~A
*vXY_,
'>db[)
FBHd2bd
nG#/O-
/qJ1n+
|b3v'N
>L!kF$3
M"%Jfq
\uY6"~
F%_>U!
,e=47{Q
'}CWBq
#i{GyR
CH)kh:g$
_y09)T
2QrOis
;)yvOY
n```o|
fVK;"7
%tgGxN0J
2h{^]B
~)S7(i]
,;>}_4
cP=0D
pi^&hU
_tV#9x
3 ,`m8d
/|k;lU
z/muk$
\6GR&x
bRg]xe
[$r!AF
eZ4v64
(;eF>4d
(jiq't
VO2VE*
GP$5AL
6+sH`&M0
6Wh>n8
r4J\/v$
O1ZtTg
#EyZ9y
8S^@c2a
n<{O^m}
a":}Ck
FT:w4k
tv:z/
#Oq&_2$z
-W8uBA
<S-2%7
ka)wf`X?
<Uyb8=[
$0]kr1
{AYuhW|
~^KZti
O&LQ bL
x%(0fX)
e.Zy<
d57G~5
1';nA;
RichEdit
RichEdit20W
.DEFAULT\Control Panel\International
Control Panel\Desktop\ResourceLocale
Software\Microsoft\Windows\CurrentVersion
\Microsoft\Internet Explorer\Quick Launch
verifying installer: %d%%
unpacking data: %d%%
... %d%%
Installer integrity check has failed. Common causes include
incomplete download and damaged media. Contact the
installer's author to obtain a new copy.
More information at:
http://nsis.sf.net/NSIS_Error
Error writing temporary file. Make sure your temp folder is valid.
Error launching installer
SeShutdownPrivilege
NSIS Error
%u.%u%s%s
*?|<>/":
%s%S.dll
MS Shell Dlg
MS Shell Dlg
SysTreeView32
MS Shell Dlg
MS Shell Dlg
msctls_progress32
SysListView32
MS Shell Dlg
MS Shell Dlg
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Clean
FireEye Clean
CAT-QuickHeal Clean
McAfee Clean
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
Cybereason Clean
BitDefenderTheta Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 Clean
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Sophos Clean
Baidu Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition Clean
Trapmine Clean
CMC Clean
Emsisoft Clean
SentinelOne Static AI - Suspicious PE
GData Clean
Jiangmin Clean
Webroot Clean
Google Clean
Avira Clean
MAX Clean
Antiy-AVL Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Leonem
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
VBA32 Clean
TACHYON Clean
DeepInstinct MALICIOUS
Cylance Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
Ikarus Win32.Outbreak
MaxSecure Clean
Fortinet Clean
AVG FileRepMalware [Misc]
Avast FileRepMalware [Misc]
CrowdStrike win/malicious_confidence_90% (W)
No IRMA results available.