Static | ZeroBOX

PE Compile Time

2105-02-15 01:12:31

PDB Path

NMOLo.pdb

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
L`xK~~cF 0x00002000 0x0000018c 0x00000200 7.56798842982
.text 0x00004000 0x000012a4 0x00001400 5.66581449149
.rsrc 0x00006000 0x00029802 0x00029a00 5.01861557603
0x00030000 0x00000010 0x00000200 0.0980041756627
.reloc 0x00032000 0x0000000c 0x00000200 0.0776331623432

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0002ee30 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002ee30 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002ee30 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002ee30 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002ee30 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002ee30 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002ee30 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002ee30 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002ee30 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0002f298 0x00000084 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0002f31c 0x000002fc LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0002f618 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x430000 _CorExeMain

!This program cannot be run in DOS mode.
L`xK~~cF
`.rsrc
`.reloc
NMOLo.pdb
_CorExeMain
mscoree.dll
v4.0.30319
#Strings
Service1
UInt32
get_UTF8
<Module>
IFTRtHA
GetHINSTANCE
MHiBVF
System.IO
mscorlib
ReadToEnd
set_Method
aYfsDdxHce
IDisposable
RuntimeTypeHandle
GetTypeFromHandle
get_Module
get_FullyQualifiedName
set_ServiceName
SecurityProtocolType
GetType
ServiceBase
WebResponse
GetResponse
Dispose
Create
STAThreadAttribute
GuidAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
SuppressIldasmAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
ConfusedByAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
NMOLo.exe
dwSize
Encoding
System.Runtime.Versioning
FromBase64String
disposing
get_Length
Marshal
System.ComponentModel
kernel32.dll
set_SecurityProtocol
GetResponseStream
Program
System
Boolean
System.Reflection
OnStop
InvokeMember
StreamReader
TextReader
Binder
ServicePointManager
IContainer
.cctor
IntPtr
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
BindingFlags
get_Chars
System.ServiceProcess
lpAddress
components
Object
lpflOldProtect
VirtualProtect
flNewProtect
System.Net
op_Explicit
InitializeComponent
OnStart
Convert
HttpWebRequest
System.Text
Assembly
Confuser.Core 1.6.0+447341964f
WrapNonExceptionThrows
Copyright
2023
$ea5fc393-f611-411c-9773-f1285667085f
1.0.0.0
.NETFramework,Version=v4.6
FrameworkDisplayName
.NET Framework 4.6
h9|k\h
kC1\95
e~9y)a
JdG=g.*
<W_J"cr?|[o
\1:$!:$
]m:;;]
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
.+k.3t.;
Service1
https://transfer.sh/get/HmMjkfTFn6/douglas.txt
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
Riceboy.Riceboy
https://transfer.sh/get/Jpo1p6DN9U/Moneydll.txt
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
NMOLo.exe
LegalCopyright
Copyright
2023
LegalTrademarks
OriginalFilename
NMOLo.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav Clean
Lionic Clean
tehtris Clean
MicroWorld-eScan Clean
ClamAV Clean
FireEye Generic.mg.b05e3ab4699177f4
CAT-QuickHeal Clean
McAfee Clean
Cylance unsafe
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
CrowdStrike win/malicious_confidence_70% (D)
Arcabit Clean
Baidu Clean
VirIT Clean
Cyren W32/Trojan.LJKF-3609
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.LTA
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.MSIL.DOTHETUK.gen
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Sophos ML/PE-A
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Clean
Trapmine Clean
CMC Clean
Emsisoft Clean
SentinelOne Static AI - Malicious PE
Jiangmin Backdoor.MSIL.NanoBot.t
Webroot Clean
Avira Clean
MAX Clean
Antiy-AVL Trojan[PSW]/MSIL.Stealer
Gridinsoft Trojan.Heur!.030120A1
Xcitium Clean
Microsoft Trojan:Win32/Wacatac.B!ml
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSIL.DOTHETUK.gen
GData Clean
Google Detected
AhnLab-V3 Trojan/Win.Generic.R519514
Acronis Clean
BitDefenderTheta Gen:NN.ZemsilF.36318.ku0@aq4IR@g
ALYac Clean
TACHYON Clean
DeepInstinct MALICIOUS
VBA32 Clean
Malwarebytes Trojan.Downloader
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
Ikarus Trojan.Agent
MaxSecure Trojan.Malware.300983.susgen
Fortinet Clean
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.2d120a
Avast Win32:PWSX-gen [Trj]
No IRMA results available.