Static | ZeroBOX

PE Compile Time

2022-06-05 11:38:30

PE Imphash

604d14eda74ecb05dc3fd3f2233fd004

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00070000 0x00000000 0.0
UPX1 0x00071000 0x0004b000 0x0004ac00 7.99860893457
.rsrc 0x000bc000 0x00006000 0x00005a00 5.79450213834

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000c0c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000c0c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000c0c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000c0c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000c0c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000c0c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000c0c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_MENU 0x000b6d70 0x000002c8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x000b7038 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ACCELERATOR 0x000b7120 0x00000048 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_RCDATA 0x000b7168 0x000002a4 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000c0e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000c0e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000c0e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000c0e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000c0e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x000c0e24 0x000001fc LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x000c1024 0x000004f4 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with very long lines, with no line terminators

Imports

Library ADVAPI32.dll:
0x4c1644 RegCloseKey
Library COMCTL32.dll:
0x4c164c None
Library COMDLG32.dll:
0x4c1654 GetSaveFileNameA
Library GDI32.dll:
0x4c165c BitBlt
Library KERNEL32.DLL:
0x4c1664 LoadLibraryA
0x4c1668 ExitProcess
0x4c166c GetProcAddress
0x4c1670 VirtualProtect
Library ole32.dll:
0x4c1678 CoGetObject
Library OLEAUT32.dll:
0x4c1680 SysStringLen
Library PSAPI.DLL:
0x4c1688 GetModuleBaseNameA
Library SHELL32.dll:
0x4c1690 DragFinish
Library USER32.dll:
0x4c1698 GetDC
Library VERSION.dll:
0x4c16a0 VerQueryValueA
Library WININET.dll:
0x4c16a8 InternetOpenA
Library WINMM.dll:
0x4c16b0 mixerOpen
Library WSOCK32.dll:
0x4c16b8 WSAStartup

!This program cannot be run in DOS mode.
>]xjx^5
>&<"H1
eCdjz@
DT\M-{
R-m12S
[r2HdZ
$o][ki^:N
Ps/uR&@~
EMBj$X
d8z-/$=D
|^q-z\4w
j[yry/)
2$x@A8
t;}"6~
#d+>C+w
T!Hq}h
=G%g$*-
D'al=b
/n.'m:
^NeE7{
1YiA}?
aU]lo
P|b<DP
EeKPpE
D_DaBn
qvR;s$
p^3~z,
_tDkzzS
C^cSS6
(nHW/H
P"oY7
FR*[KR
:'^${ed
lTekE^]+
%4>4/i
?vzQCP
Rz$#MDm.
[}*^,k
>sh NA
Y8~/?Z
&?i:8?$
9=%]ZB
K^e_&-QG
Px,&?ow
(w8e4x
t]m^;.
}3w]|$
1_(9nm
!ZSC-
hLH&uX
`2dnXe
]@Ozf|q
;<n@{f
OaC sj
Z$<>f"
kFVB8%
K^'7yk
gy6gV>M
mz=]fS
} lxK,
ss?#RGP\
W!?GnV
87Ce.zg
FA?-\Y
c6Lh#1oA
_. UU^+)v,=A
L~)^(W]
vgLr(d
t5O2{8
eqC-aV
ix9},G
&[wyG%
s05_?~
pN*:~FW$
*jknP_}
s~r,Cn
u/;:h_
.dRo\BE
heUOE'
dWr7:5
)'SEjr
J}lX&-0(
ZZYi.2
uc!8)E
_F!~qM.
-5D!@a
9rQ L~
l3lyjHBlE
6Ez4jy
i>r7kAX5 ,4j
ivx.O6
xEuAlX
p.o-q1V
eeR}rS
,iaqA`b
4;vPvH
t\VleC
X`I~,1
]pDPd,S
9/N_
B;xf[o
EiPS8}
wp 'eS
_RnwM\
a9j$X''
6xX8;_fA$
Us~HJe
Txhh|v
j2PkeA
;+C: }v
_t5my6
Yt4AaB
L>zoTI
8z,ipj
s{DN6M
^ #q{P
$UUu8=
Do%Llh<#
*h?X}ZO
4tm.<,x
TiZ)JD
]8GJ5W
@ktC,7
gp;VFW
*~cSME
2)W8=6
F}tjPm
&)M%;;
/ BlWzu
U{[`WP
*f*~gr
C"j0jx_
p}9ph|
|X6[cVY
Z `'Ih
#$s!8*A
jxGnD[
W_0n`WB
;~s6:1
O8ul%|
3/wzj#
)Luj}8
+RPVQ9
Q\<ONZ
XV}9'e
zx1Kq!:
3=#-EGi
/wpzX
<7L@po
k{KLc]i
5j4}\7
FEA<Ta
/P)H$6
P_PdX'T
r~2r?I}
tK.}v
RDd>{W
|vA{e/
@0lFyk
Yt":QXW
n0<@=8l
:[_=i["92d
x,cy6
<|1#/>V`
VHq'IHB
]0[uz9a;
:w&Km`|[|
X|>I.
~c^V(L
cQu<1\
:DTd)R
2G8J'O
y%{)N>
s'ESw9
kSmTI8
XHH"_7=
JW'K|(E
JMvEGqMEB
,Y`{#6
lG[ ?L
Jt+9k`*
rtPtr9I
~4SaxZ
}v%`L!
bvF8D.>/
*t58LE
}VGxA_
6>tMeV
a6Mr`U
fT 4pzZg
.D_CFCo
1(p:K
i}U{Hk
V_hX`2
wNd7z3
:,gdCD
1Nu^f"
psgyW2*U
if]_h3|
^2HlXg
xvP"[?
J`/N'n:
DZfTJdO?
.&NW)*
UEQA;h
U$LkYt\
2+pRdr
}cJ_ )
?90{D?
X?Ck1s
itI8Ny
U\E%xF
4QG/Ed
io`a|T
vy/|lc
5bw:#
m_%/4R>
?*]OMM
dor~l
SFZ6GXO~
eVhqyX
N8kMjj
\X_.mN
H87}q)f
#a%%y=
R"3m7*z2
hp'JI|
Q3dV_x%
)X%-Pz
PgRv[[F
0T"f[%
=d\Z6l
VB\MO]r
plv#xt
~Je m'
-s,1.K9
`o5?!4
Mdv!U$
2<Ez5S
mj7KNe
`8"TM6
_{-Ch5
D57-w+
<$v*{6,
z9P1N:
=h2G3v
* l;x?0e%
.}><P;B9
!cQOLZ
R,WqR6k%
{-U3r
K>ht.H
`sNi7.
4ry@-~
6:@LlD
{_|_3?<`
iUYSq
N R\]"
X0B8xc
0FDH<Z
(LaB>%"
B<M*S*
CcmU"?
UymW^l
'aVVPm
H16|hv
ANWrTT4
4iI@6!
CU{g."
|4$&=DX
nU4T%P
6 _|/+
LH*F"I
S:qPo\
;5JD{6
gx5,XA
6qVx)4u
oc/T6_R
|tWTc
,{1\,7
QcGlTE
$tiu&{
?'VD3i
y1~_g+C
27[,tM/'
?"H:u}
a/K1x>w
U9zpz8
})B5HG2
GHl9^n?
r*`,%>
I^wQ}Z
L(I#8SBbl
7!&lw+
^&%=lW
hsF&Ul%
*eVSGE
[~9u#
n5"3Op
J*u[5N
8eF:wHb
e@#4=d
!y:Mko
A].3A(/&
)_8;dS`
iESWuD
IUv/eW@t]Tj
IRz~.-:
op0+/s
YBoAqB:
Up|W%+
]5_3~r
Z` 8{3
C76UF_
==f7n
x%,\IGd
&vH1]k
kdo^|9M
CR,$&7%
rX36*k
.-[)V@
3pdae\1
!H`Irf
w#)e5!?&
[Y&9w{
3}u!8l
ZIGv;6
IqCYdP.
[RgZ*Q[
>\xTyP
*BP}5r+
FSoYR}
Wi4Q,p4N
v"0%s$
`[=X\R
D$;!i=
30`&_u
'jkLq#
/u6+D;
|*\jT]
+\p.!:f
`0>:bXp
Zx_~9L
<Gx/kN
#:b$h
!NWG> O
lLpa};
;8R{<,
z5x@e)
#6xPSC
N!mZiw
p/1P[(
iUXju?
_o`VuK
a A^BeS
8&BIjj
PdqtT>
:bAWN/
+"<"9;
eQ`*`+D
l5o}ZBK
B%rK\l
Lt)D"!
/+QNevc
ac90%T,3?}e
]N@eUMh
)T%2ibK
i $,1sZz
L3-nS~FW
raiY~,
@jhIS_
q/ce$Sw
`$+*sG
C./zi<
(fqwP>
XjmAz4
S4wki^t
RxilL/x
\?M1Y?"
}r5bF'5P
6{~~e.8kO
F^N>Er
NS-%i-Um
VN-uAh
y`0b6n
@TRsW<
CUXmKu
q3sl{!R
L"f|$?
DgfG)"
js6<Znb
RGdF}S/Y
P2Aa-u
uq&T&j
xdHFem
`'K*;;}
mXEnxi^;
Vh\pKD
#;N(#9&M
*Z'AX/
k.W6.3
^]X'D,
zR>\wz
3 0wHGt
A4ZML2
w n2[z
Z,:FiuK
6e'9Wo
\953O>)L
AuZ*=:E
k5+qkA
hxe5T{>
VL4:Pt
T,6HH7
EOUhz'
?V{l:
7\p^%<4
R,eeiW
|w=bO;
3Jd<;h?D
f4.w6U
q-6kl\
)#[RH^
01xSYD
,xY(Y^
Vz1\Ct
wQN ]c0
fH:w57z
Ul{jQ
NrE"ay
'hel_6
(d=tX<
C5L2<s
Sm{=#=
{ n;KP
[}:&Ij~
xbTy7*v
2evM; P
K8bnEl
&`+Pc-
'KUOW
1_',",
G7Q8_~b
6,4[hfL
Sp~)F&+F
j@Za$i
,aTfV%
jM5[tI
-^Nn*TZ
};Q7[H
7b9<S~
'x3Z3
H3/:Yu
y2mKXz<F%
8plDa?
oQH;_~
zb#N/7
(vw9,V
N%^M{$\
[MVdo$
]O2J&(
-'=Qe2
}{tD$f
2d:cc;
e>I.DqaTX
Ds*9-O$
.aWb[D
t='*Vg^
v!Z>DW
&S.mb?
ZwikR\
{U#TyNC
L+*u/<
S;jaIx
zCN3LGSxl^p
5[5e*1
n=P6MW
z!qn}Qw
LN9[<4
}F0/k3toB
KS<kH*
E13WdJ
r$g~l@+
GunLnl
j>h,8q
V},rhG
16o}KV
"9S%..
y{|kqnbz
LS^Rv`
]c:`u(A
ph85OMj
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H)
s`)L$4
D$t+D$\
)D$H)
9l$\w_
XPTPSW
"""""/
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:v3="urn:schemas-microsoft-com:asm.v3"><assemblyIdentity version="1.1.00.00" name="AutoHotkey" type="win32" /><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/></application></compatibility><v3:application><v3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings" xmlns:ws2="http://schemas.microsoft.com/SMI/2016/WindowsSettings"><dpiAware>true</dpiAware><ws2:longPathAware>
ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.DLL
ole32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
USER32.dll
VERSION.dll
WININET.dll
WINMM.dll
WSOCK32.dll
RegCloseKey
GetSaveFileNameA
BitBlt
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
CoGetObject
GetModuleBaseNameA
DragFinish
VerQueryValueA
InternetOpenA
mixerOpen
>AUTOHOTKEY SCRIPT<
VS_VERSION_INFO
StringFileInfo
040904b0
FileDescription
FileVersion
1.1.34.03
InternalName
LegalCopyright
OriginalFilename
ProductName
ProductVersion
1.1.34.03
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (moderate confidence)
DrWeb Clean
MicroWorld-eScan Clean
FireEye Generic.mg.5057042b2949c60f
CAT-QuickHeal Clean
McAfee Artemis!5057042B2949
Malwarebytes Malware.AI.1914786265
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
Cybereason malicious.4acc19
BitDefenderTheta Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 Clean
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky Clean
Alibaba Clean
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Agent.330240.Y
Rising Trojan.Generic@AI.99 (RDML:SELtltjpue0/Ge/KisSuwg)
TACHYON Clean
Emsisoft Clean
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.fc
Trapmine malicious.high.ml.score
CMC Clean
Sophos Clean
Ikarus Trojan.Win32.AHK
GData Clean
Jiangmin Trojan.Script.auxn
Webroot Clean
Google Detected
Avira Clean
Antiy-AVL Trojan/Win32.PossibleThreat
Gridinsoft Clean
Xcitium Packed.Win32.MUPX.Gen@24tbus
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Script/Phonzy.A!ml
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Generic.R325756
Acronis Clean
VBA32 BScope.Trojan.APosT
ALYac Clean
MAX Clean
DeepInstinct MALICIOUS
Cylance Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Clean
Fortinet W32/PossibleThreat
AVG Clean
Avast Clean
CrowdStrike win/malicious_confidence_60% (W)
No IRMA results available.