Static | ZeroBOX

PE Compile Time

2022-06-05 11:38:30

PE Imphash

604d14eda74ecb05dc3fd3f2233fd004

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00082000 0x00000000 0.0
UPX1 0x00083000 0x0004f000 0x0004ee00 7.99856653959
.rsrc 0x000d2000 0x00006000 0x00005a00 5.79643970957

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000d6c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000d6c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000d6c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000d6c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000d6c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000d6c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000d6c64 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_MENU 0x000b6d70 0x000002c8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x000b7038 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ACCELERATOR 0x000b7120 0x00000048 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_RCDATA 0x000b7168 0x00016d5b LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000d6e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000d6e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000d6e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000d6e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000d6e0c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x000d6e24 0x000001fc LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x000d7024 0x000004f4 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with very long lines, with no line terminators

Imports

Library ADVAPI32.dll:
0x4d7644 RegCloseKey
Library COMCTL32.dll:
0x4d764c None
Library COMDLG32.dll:
0x4d7654 GetSaveFileNameA
Library GDI32.dll:
0x4d765c BitBlt
Library KERNEL32.DLL:
0x4d7664 LoadLibraryA
0x4d7668 ExitProcess
0x4d766c GetProcAddress
0x4d7670 VirtualProtect
Library ole32.dll:
0x4d7678 CoGetObject
Library OLEAUT32.dll:
0x4d7680 SysStringLen
Library PSAPI.DLL:
0x4d7688 GetModuleBaseNameA
Library SHELL32.dll:
0x4d7690 DragFinish
Library USER32.dll:
0x4d7698 GetDC
Library VERSION.dll:
0x4d76a0 VerQueryValueA
Library WININET.dll:
0x4d76a8 InternetOpenA
Library WINMM.dll:
0x4d76b0 mixerOpen
Library WSOCK32.dll:
0x4d76b8 WSAStartup

!This program cannot be run in DOS mode.
>]xjx^5
>&<"H1
eCdjz@
DT\M-{
R-m12S
[r2HdZ
$o][ki^:N
Ps/uR&@~
EMBj$X
d8z-/$=D
|^q-z\4w
j[yry/)
2$x@A8
t;}"6~
#d+>C+w
T!Hq}h
=G%g$*-
D'al=b
/n.'m:
^NeE7{
1YiA}?
aU]lo
P|b<DP
EeKPpE
D_DaBn
qvR;s$
p^3~z,
_tDkzzS
C^cSS6
(nHW/H
P"oY7
FR*[KR
:'^${ed
lTekE^]+
%4>4/i
?vzQCP
Rz$#MDm.
[}*^,k
>sh NA
Y8~/?Z
&?i:8?$
9=%]ZB
K^e_&-QG
Px,&?ow
(w8e4x
t]m^;.
}3w]|$
1_(9nm
!ZSC-
hLH&uX
`2dnXe
]@Ozf|q
;<n@{f
OaC sj
Z$<>f"
kFVB8%
K^'7yk
gy6gV>M
mz=]fS
} lxK,
ss?#RGP\
W!?GnV
87Ce.zg
FA?-\Y
c6Lh#1oA
_. UU^+)v,=A
L~)^(W]
vgLr(d
t5O2{8
eqC-aV
ix9},G
&[wyG%
s05_?~
pN*:~FW$
*jknP_}
s~r,Cn
u/;:h_
.dRo\BE
heUOE'
dWr7:5
)'SEjr
J}lX&-0(
ZZYi.2
uc!8)E
_F!~qM.
-5D!@a
9rQ L~
l3lyjHBlE
6Ez4jy
i>r7kAX5 ,4j
ivx.O6
xEuAlX
p.o-q1V
eeR}rS
,iaqA`b
4;vPvH
t\VleC
X`I~,1
]pDPd,S
9/N_
B;xf[o
EiPS8}
wp 'eS
_RnwM\
a9j$X''
6xX8;_fA$
Us~HJe
Txhh|v
j2PkeA
;+C: }v
_t5my6
Yt4AaB
L>zoTI
8z,ipj
s{DN6M
^ #q{P
$UUu8=
Do%Llh<#
*h?X}ZO
4tm.<,x
TiZ)JD
]8GJ5W
@ktC,7
gp;VFW
*~cSME
2)W8=6
F}tjPm
&)M%;;
/ BlWzu
U{[`WP
*f*~gr
C"j0jx_
p}9ph|
|X6[cVY
Z `'Ih
#$s!8*A
jxGnD[
W_0n`WB
;~s6:1
O8ul%|
3/wzj#
)Luj}8
+RPVQ9
Q\<ONZ
XV}9'e
zx1Kq!:
3=#-EGi
/wpzX
<7L@po
k{KLc]i
5j4}\7
FEA<Ta
/P)H$6
P_PdX'T
r~2r?I}
tK.}v
RDd>{W
|vA{e/
@0lFyk
Yt":QXW
n0<@=8l
:[_=i["92d
x,cy6
<|1#/>V`
VHq'IHB
]0[uz9a;
:w&Km`|[|
X|>I.
~c^V(L
cQu<1\
:DTd)R
2G8J'O
y%{)N>
s'ESw9
kSmTI8
XHH"_7=
JW'K|(E
JMvEGqMEB
,Y`{#6
lG[ ?L
Jt+9k`*
rtPtr9I
~4SaxZ
}v%`L!
bvF8D.>/
*t58LE
}VGxA_
6>tMeV
a6Mr`U
fT 4pzZg
.D_CFCo
1(p:K
i}U{Hk
V_hX`2
wNd7z3
:,gdCD
1Nu^f"
psgyW2*U
if]_h3|
^2HlXg
xvP"[?
J`/N'n:
DZfTJdO?
.&NW)*
UEQA;h
U$LkYt\
2+pRdr
}cJ_ )
?90{D?
X?Ck1s
itI8Ny
U\E%xF
4QG/Ed
io`a|T
vy/|lc
5bw:#
m_%/4R>
?*]OMM
dor~l
SFZ6GXO~
eVhqyX
N8kMjj
\X_.mN
H87}q)f
#a%%y=
R"3m7*z2
hp'JI|
Q3dV_x%
)X%-Pz
PgRv[[F
0T"f[%
=d\Z6l
VB\MO]r
plv#xt
~Je m'
-s,1.K9
`o5?!4
Mdv!U$
2<Ez5S
mj7KNe
`8"TM6
_{-Ch5
D57-w+
<$v*{6,
z9P1N:
=h2G3v
* l;x?0e%
.}><P;B9
!cQOLZ
R,WqR6k%
{-U3r
K>ht.H
`sNi7.
4ry@-~
6:@LlD
{_|_3?<`
iUYSq
N R\]"
X0B8xc
0FDH<Z
(LaB>%"
B<M*S*
CcmU"?
UymW^l
'aVVPm
H16|hv
ANWrTT4
4iI@6!
CU{g."
|4$&=DX
nU4T%P
6 _|/+
LH*F"I
S:qPo\
;5JD{6
gx5,XA
6qVx)4u
oc/T6_R
|tWTc
,{1\,7
QcGlTE
$tiu&{
?'VD3i
y1~_g+C
27[,tM/'
?"H:u}
a/K1x>w
U9zpz8
})B5HG2
GHl9^n?
r*`,%>
I^wQ}Z
L(I#8SBbl
7!&lw+
^&%=lW
hsF&Ul%
*eVSGE
[~9u#
n5"3Op
J*u[5N
8eF:wHb
e@#4=d
!y:Mko
A].3A(/&
)_8;dS`
iESWuD
IUv/eW@t]Tj
IRz~.-:
op0+/s
YBoAqB:
Up|W%+
]5_3~r
Z` 8{3
C76UF_
==f7n
x%,\IGd
&vH1]k
kdo^|9M
CR,$&7%
rX36*k
.-[)V@
3pdae\1
!H`Irf
w#)e5!?&
[Y&9w{
3}u!8l
ZIGv;6
IqCYdP.
[RgZ*Q[
>\xTyP
*BP}5r+
FSoYR}
Wi4Q,p4N
v"0%s$
`[=X\R
D$;!i=
30`&_u
'jkLq#
/u6+D;
|*\jT]
+\p.!:f
`0>:bXp
Zx_~9L
<Gx/kN
#:b$h
!NWG> O
lLpa};
;8R{<,
z5x@e)
#6xPSC
N!mZiw
p/1P[(
iUXju?
_o`VuK
a A^BeS
8&BIjj
PdqtT>
:bAWN/
+"<"9;
eQ`*`+D
l5o}ZBK
B%rK\l
Lt)D"!
/+QNevc
ac90%T,3?}e
]N@eUMh
)T%2ibK
i $,1sZz
L3-nS~FW
raiY~,
@jhIS_
q/ce$Sw
`$+*sG
C./zi<
(fqwP>
XjmAz4
S4wki^t
RxilL/x
\?M1Y?"
}r5bF'5P
6{~~e.8kO
F^N>Er
NS-%i-Um
VN-uAh
y`0b6n
@TRsW<
CUXmKu
q3sl{!R
L"f|$?
DgfG)"
js6<Znb
RGdF}S/Y
P2Aa-u
uq&T&j
xdHFem
`'K*;;}
mXEnxi^;
Vh\pKD
#;N(#9&M
*Z'AX/
k.W6.3
^]X'D,
zR>\wz
3 0wHGt
A4ZML2
w n2[z
Z,:FiuK
6e'9Wo
\953O>)L
AuZ*=:E
k5+qkA
hxe5T{>
VL4:Pt
T,6HH7
EOUhz'
?V{l:
7\p^%<4
R,eeiW
|w=bO;
3Jd<;h?D
f4.w6U
q-6kl\
)#[RH^
01xSYD
,xY(Y^
Vz1\Ct
wQN ]c0
fH:w57z
Ul{jQ
NrE"ay
'hel_6
(d=tX<
C5L2<s
Sm{=#=
{ n;KP
[}:&Ij~
xbTy7*v
2evM; P
K8bnEl
&`+Pc-
'KUOW
1_',",
G7Q8_~b
6,4[hfL
Sp~)F&+F
j@Za$i
,aTfV%
jM5[tI
-^Nn*TZ
};Q7[H
7b9<S~
'x3Z3
H3/:Yu
y2mKXz<F%
8plDa?
oQH;_~
zb#N/7
(vw9,V
N%^M{$\
[MVdo$
]O2J&(
-'=Qe2
}{tD$f
2d:cc;
e>I.DqaTX
Ds*9-O$
.aWb[D
t='*Vg^
v!Z>DW
&S.mb?
ZwikR\
{U#TyNC
L+*u/<
S;jaIx
zCN3LGSxl^p
5[5e*1
n=P6MW
z!qn}Qw
LN9[<4
}F0/k3toB
KS<kH*
E13WdJ
r$g~l@+
GunLnl
j>h,8q
V},rhG
16o}KV
"9S%..
y{|kqnbz
;4:dJh*
mJ[0{A
Uka%1)
|ncmWO8R
Jg)[Sg
}fFIBo
)[?tvX
aQ/v>,
{KmnG1S
^:*tA
w={7AB
XP;MQ&
GBr_W\
b=lQ19
@^@uM/
d~/j,C
"FKZL~
f"C]RC
.T!fFt
\ojm6^
q8=f#$
LKWd|[
273K3
M{1;D
C{-{pM
6-^d\X
Jr,O[M*
[08@y7
|KUhn
x*zOqtI
HadFO
\7Z;F1R
fr1y_P
$*-ED`
`0NI+9
;Zcxq'e7
g9!,D}
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H)
s`)L$4
D$t+D$\
)D$H)
9l$\w_
XPTPSW
"""""/
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:v3="urn:schemas-microsoft-com:asm.v3"><assemblyIdentity version="1.1.00.00" name="AutoHotkey" type="win32" /><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/></application></compatibility><v3:application><v3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings" xmlns:ws2="http://schemas.microsoft.com/SMI/2016/WindowsSettings"><dpiAware>true</dpiAware><ws2:longPathAware>
ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.DLL
ole32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
USER32.dll
VERSION.dll
WININET.dll
WINMM.dll
WSOCK32.dll
RegCloseKey
GetSaveFileNameA
BitBlt
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
CoGetObject
GetModuleBaseNameA
DragFinish
VerQueryValueA
InternetOpenA
mixerOpen
>AUTOHOTKEY SCRIPT<
VS_VERSION_INFO
StringFileInfo
040904b0
FileDescription
FileVersion
1.1.34.03
InternalName
LegalCopyright
OriginalFilename
ProductName
ProductVersion
1.1.34.03
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Clean
Elastic malicious (moderate confidence)
MicroWorld-eScan Clean
ClamAV Clean
FireEye Generic.mg.1bdfa5d4db8f961f
CAT-QuickHeal Clean
McAfee Artemis!1BDFA5D4DB8F
Malwarebytes Malware.AI.1914786265
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason Clean
BitDefenderTheta Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 Clean
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky Clean
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.Generic@AI.99 (RDML:AF2cKbJeSE3sCytm9DaVGA)
TACHYON Clean
Sophos Clean
Baidu Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.fc
Trapmine malicious.high.ml.score
CMC Clean
Emsisoft Clean
Ikarus Clean
GData Clean
Jiangmin Trojan.Script.auxn
Webroot Clean
Avira Clean
Antiy-AVL Trojan/Win32.PossibleThreat
Gridinsoft Clean
Xcitium Packed.Win32.MUPX.Gen@24tbus
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Script/Phonzy.A!ml
Google Clean
AhnLab-V3 Malware/Win32.RL_Generic.R325756
Acronis Clean
VBA32 Clean
ALYac Clean
MAX Clean
DeepInstinct MALICIOUS
Cylance Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
AVG Clean
Avast Clean
CrowdStrike win/malicious_confidence_60% (W)
No IRMA results available.