Static | ZeroBOX

PE Compile Time

2016-10-01 07:35:56

PE Imphash

934381a85d55af4033da1a769f2cce1d

PEiD Signatures

Armadillo v1.71

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000056c6 0x00005800 6.13994341135
.rdata 0x00007000 0x00000468 0x00000600 3.28239341158
.data 0x00008000 0x000130c4 0x00012e00 7.77346153848
.reloc 0x0001c000 0x000001fa 0x00000200 3.05106197029

Imports

Library KERNEL32.dll:
0x407008 GetShortPathNameW
0x40700c GetStartupInfoA
0x407010 GetModuleHandleA
0x407014 GetSystemDirectoryW
Library SHLWAPI.dll:
0x407058 PathAppendW
Library MSVCRT.dll:
0x40701c _exit
0x407020 _XcptFilter
0x407024 exit
0x407028 _acmdln
0x40702c __getmainargs
0x407030 _initterm
0x407034 __setusermatherr
0x407038 _adjust_fdiv
0x40703c __p__commode
0x407040 __p__fmode
0x407044 __set_app_type
0x407048 _except_handler3
0x40704c _controlfp
0x407050 memset

!This program cannot be run in DOS mode.
.rdata
.reloc
D$,aut[
^;yNSj
YYSSSj
YYSSSj
QQSVWhu
j'Xjqf
jrXjkf
jQXjgf
jKXjff
jQXjMf
VWjQXjmYjdf
Zj^^jOf
jA_jwf
_jqXjkf
SVWjQXjmYjdf
Xjg^j^
VjQXjMf
Xj^ZjOf
jA^jwf
VWjQXjMf
Xj^^jRf
XjmZjnf
XjkYjaf
_jlYjff
jQXjjf
jJXjkf
jQXjof
jGXjlf
jMXjdf
jVXjgf
j,Xjgf
D$$h|p@
QQSVW3
jdXj2YC
YYSSSh
jdXj2Y
jdXj2Y
YYSSSh
`SVWhu
QSSSSSSWS
DSVWhu
YYVVVV
GetSystemDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetShortPathNameW
KERNEL32.dll
PathAppendW
SHLWAPI.dll
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetModuleHandleA
GetStartupInfoA
memset
MMK\c8
CH0g q5
Hvf3$:
V>,`S.
3a5Nc7G
^F >HM
"rN %E`J
Y7!9~T,
~2-k`B
r@5(Y)-
*)mtW{E
"S)"Y2
-r0'`B
n-MnjSbF
Yc L8
+!CsRRj
6c>K =
lTo]>4V
7=| "@
;WL mK
-t mre
[>"N(d
y Tf L
??=t^.
AR`*N
+)H~`;u
WFxbH|`
~nn,T4]
`zW j.
Dc^Gm@
daFlaa
~;t7#~
c?NnN&
`!I6v44f
beqWUx
"}1y-R
`"Jn &
L: ,>
</I8?7
@C&M5B
`"qQ6
ik"+}|
]h-[M5
W7hW2`
j@MK*H
UcVueU
+ :_`3
O:e*\>
q=_zK,
4 U67T
2c^~#V|
II}K4:
`PExj^
`{QEcr`
)gP<'<
;Uu "L
B JL`v
f Q(6J
IyzFJk
,Cs`[1
S!N(B=
89b9[4
55Sm=I,
D%(Cdv@
-QTUCTu@
Pt 0x`pt
q`Dw $w`dqGTsGtp
|p'Br'
}79( X
Cw3vF6A vA
4=,4Uf4
PI"0M"
2ogrbD
r2NAR-%RUm
oa3lA7/6
;Gv7I+
QnQ,]
~To~4b
yYiyR
mQWD5Wt
Ao3 :-@vmH'O"
{Je_)`
Eqk%{Jh
qD 31^U
n2lu25d
W)fkw<U
n6gjbK
d~MVr-Qr
m)Q}im
uI2*;
<]^<5/
Q.AmnMK$
%hd,<dnW
SO^S/P
VeaVUo
TyS]`u
x`FDbFdaFTcF^
z`fFbffafVcfv`
6+V:5|
}PT1N*]B5B
we%OgQ
yZ#J>54
Lt<&t|
I"OC"o@
hA,hA
eK-a1|
~+9%+LOW
3tzm3<
G2E+~E
c`C*s%
$t _8*i
S`Nx`*
O@JO@+
F4H=!>%>)>->1>5>9>=>A>E>I>
=B>G>N>T>
11N1U1\1k1
5*51585?5E5M5S5Z5a5l5s5y5
6%656U6\6b6
@\*.exe
%ls%ls
Z0BAZwxx
ComSpec
/a /c %s
netsh firewall add allowedprogram "%s" %s ENABLE
netsh advfirewall firewall add rule name="%s" dir=in action=allow program="%s"
process call create %s
Antivirus Signature
Bkav W32.Common.65C381EC
Lionic Trojan.Win32.Androm.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Doina.48068
ClamAV Win.Trojan.Gamarue-7104066-1
CMC Clean
CAT-QuickHeal Trojan.MauvaiseRI.S5242859
McAfee W32/Patcher
Malwarebytes Malware.AI.20242711
VIPRE Gen:Variant.Doina.48068
Sangfor Suspicious.Win32.Save.ins
K7AntiVirus Trojan ( 0052099b1 )
BitDefender Gen:Variant.Doina.48068
K7GW Trojan ( 0052099b1 )
Cybereason malicious.260eb3
Baidu Clean
VirIT Trojan.Win32.Kasidet.BA
Cyren W32/Scar.Z.gen!Eldorado
Symantec SMG.Heur!gen
tehtris Clean
ESET-NOD32 Win32/Kasidet.AR
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky Backdoor.Win32.Androm.lctq
Alibaba Malware:Win32/km_24a4a.None
NANO-Antivirus Virus.Win32.Gen.ccmw
ViRobot Trojan.Win32.Agent.102912.AE
Rising Backdoor.Androm!8.113 (TFE:5:RINyg41Xs7G)
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.Ambler.bdftd
DrWeb Trojan.Kasidet.26
Zillya Clean
TrendMicro BKDR_ANDROM.SMQ
McAfee-GW-Edition BehavesLike.Win32.Swizzor.cc
Trapmine malicious.high.ml.score
FireEye Generic.mg.1dc2580260eb3d20
Emsisoft Gen:Variant.Doina.48068 (B)
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Doina.48068
Jiangmin Backdoor.Androm.lcz
Webroot W32.Trojan.Gen
Avira TR/AD.Ambler.bdftd
MAX malware (ai score=81)
Antiy-AVL Trojan[Backdoor]/Win32.Androm
Gridinsoft Trojan.Win32.Dropper.zv!s3
Xcitium TrojWare.Win32.TrojanDropper.Randrew.B@7a247q
Arcabit Trojan.Doina.DBBC4
SUPERAntiSpyware Backdoor.Andromeda/Variant
ZoneAlarm Backdoor.Win32.Androm.lctq
Microsoft TrojanDropper:Win32/Randrew.B!bit
Google Detected
AhnLab-V3 Backdoor/Win32.RL_Androm.R299528
Acronis Clean
BitDefenderTheta AI:Packer.F5A402241E
ALYac Gen:Variant.Doina.48068
TACHYON Backdoor/W32.Androm.102912.E
DeepInstinct MALICIOUS
VBA32 BScope.TrojanRansom.Blocker
Cylance unsafe
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall BKDR_ANDROM.SMQ
Tencent Malware.Win32.Gencirc.10b31355
Yandex Clean
Ikarus Trojan-Dropper.Win32.Randrew
MaxSecure Trojan.Malware.10043509.susgen
Fortinet W32/GenKryptik.DVPS!tr
AVG Win32:BotX-gen [Trj]
Avast Win32:BotX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.