Static | ZeroBOX

PE Compile Time

2019-07-30 17:52:08

PE Imphash

f326f88ca83c9aacaa44acfb8884f1d4

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.code 0x00001000 0x00005b79 0x00005c00 5.50779274356
.text 0x00007000 0x00010d25 0x00010e00 6.35313701668
.rdata 0x00018000 0x00004b9d 0x00004c00 6.68530518547
.pdata 0x0001d000 0x00001140 0x00001200 5.00395662987
.data 0x0001f000 0x000023b8 0x00001600 4.38809840644
.rsrc 0x00022000 0x00000c0c 0x00000e00 7.15466903166

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x000229a0 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
RT_RCDATA 0x000229a0 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
RT_RCDATA 0x000229a0 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
RT_RCDATA 0x000229a0 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
RT_MANIFEST 0x000229a4 0x00000267 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, ASCII text

Imports

Library msvcrt.dll:
0x14001f6c8 memset
0x14001f6d0 wcsncmp
0x14001f6d8 memmove
0x14001f6e0 wcsncpy
0x14001f6e8 wcsstr
0x14001f6f0 _wcsnicmp
0x14001f6f8 _wcsdup
0x14001f700 free
0x14001f708 _wcsicmp
0x14001f710 wcslen
0x14001f718 wcscpy
0x14001f720 wcscmp
0x14001f728 wcscat
0x14001f730 memcpy
0x14001f738 tolower
0x14001f740 malloc
Library KERNEL32.dll:
0x14001f750 GetModuleHandleW
0x14001f758 HeapCreate
0x14001f760 GetStdHandle
0x14001f768 SetConsoleCtrlHandler
0x14001f770 HeapDestroy
0x14001f778 ExitProcess
0x14001f780 WriteFile
0x14001f788 GetTempFileNameW
0x14001f790 LoadLibraryExW
0x14001f798 EnumResourceTypesW
0x14001f7a0 FreeLibrary
0x14001f7a8 RemoveDirectoryW
0x14001f7b0 EnumResourceNamesW
0x14001f7b8 GetCommandLineW
0x14001f7c0 LoadResource
0x14001f7c8 SizeofResource
0x14001f7d0 FreeResource
0x14001f7d8 FindResourceW
0x14001f7e0 GetShortPathNameW
0x14001f7e8 GetSystemDirectoryW
0x14001f7f0 EnterCriticalSection
0x14001f7f8 CloseHandle
0x14001f800 LeaveCriticalSection
0x14001f810 WaitForSingleObject
0x14001f818 TerminateThread
0x14001f820 CreateThread
0x14001f828 Sleep
0x14001f830 WideCharToMultiByte
0x14001f838 HeapAlloc
0x14001f840 HeapFree
0x14001f848 LoadLibraryW
0x14001f850 GetProcAddress
0x14001f858 GetCurrentProcessId
0x14001f860 GetCurrentThreadId
0x14001f868 GetModuleFileNameW
0x14001f870 PeekNamedPipe
0x14001f878 TerminateProcess
0x14001f880 GetEnvironmentVariableW
0x14001f888 SetEnvironmentVariableW
0x14001f890 GetCurrentProcess
0x14001f898 DuplicateHandle
0x14001f8a0 CreatePipe
0x14001f8a8 CreateProcessW
0x14001f8b0 GetExitCodeProcess
0x14001f8b8 RtlLookupFunctionEntry
0x14001f8c0 RtlVirtualUnwind
0x14001f8d8 HeapSize
0x14001f8e0 MultiByteToWideChar
0x14001f8e8 CreateDirectoryW
0x14001f8f0 SetFileAttributesW
0x14001f8f8 GetTempPathW
0x14001f900 DeleteFileW
0x14001f908 GetCurrentDirectoryW
0x14001f910 SetCurrentDirectoryW
0x14001f918 CreateFileW
0x14001f920 SetFilePointer
0x14001f928 TlsFree
0x14001f930 TlsGetValue
0x14001f938 TlsSetValue
0x14001f940 TlsAlloc
0x14001f948 HeapReAlloc
0x14001f950 DeleteCriticalSection
0x14001f958 GetLastError
0x14001f960 SetLastError
0x14001f968 UnregisterWait
0x14001f970 GetCurrentThread
Library SHELL32.DLL:
0x14001f988 ShellExecuteExW
0x14001f990 SHGetFolderLocation
0x14001f998 SHGetPathFromIDListW
Library WINMM.DLL:
0x14001f9a8 timeBeginPeriod
Library OLE32.DLL:
0x14001f9b8 CoInitialize
0x14001f9c0 CoTaskMemFree
Library SHLWAPI.DLL:
0x14001f9d0 PathAddBackslashW
0x14001f9d8 PathRenameExtensionW
0x14001f9e0 PathQuoteSpacesW
0x14001f9e8 PathRemoveArgsW
0x14001f9f0 PathRemoveBackslashW
Library USER32.DLL:
0x14001fa00 CharUpperW
0x14001fa08 CharLowerW
0x14001fa10 MessageBoxW
0x14001fa18 DefWindowProcW
0x14001fa20 GetWindowLongPtrW
0x14001fa28 GetWindowTextLengthW
0x14001fa30 GetWindowTextW
0x14001fa38 EnableWindow
0x14001fa40 DestroyWindow
0x14001fa48 UnregisterClassW
0x14001fa50 LoadIconW
0x14001fa58 LoadCursorW
0x14001fa60 RegisterClassExW
0x14001fa68 IsWindowEnabled
0x14001fa70 GetSystemMetrics
0x14001fa78 CreateWindowExW
0x14001fa80 SetWindowLongPtrW
0x14001fa88 SendMessageW
0x14001fa90 SetFocus
0x14001fa98 CreateAcceleratorTableW
0x14001faa0 SetForegroundWindow
0x14001faa8 BringWindowToTop
0x14001fab0 GetMessageW
0x14001fab8 TranslateAcceleratorW
0x14001fac0 TranslateMessage
0x14001fac8 DispatchMessageW
0x14001fad0 DestroyAcceleratorTable
0x14001fad8 PostMessageW
0x14001fae0 GetForegroundWindow
0x14001fae8 GetWindowThreadProcessId
0x14001faf0 IsWindowVisible
0x14001faf8 EnumWindows
0x14001fb00 SetWindowPos
Library GDI32.DLL:
0x14001fb10 GetStockObject
Library COMCTL32.DLL:
0x14001fb20 InitCommonControlsEx

!This program cannot be run in DOS mode.
`.text
`.rdata
@.pdata
@.data
UAWAVH
D$XPM1
D$hPM1
HcD$`PH
PLc|$hH
Lc|$hLct$`H
Lct$`H
D$hLc|$`H
Lc|$hI
/PLc|$hI
PLc|$pI
Lc|$`I
D$`Lc|$hLct$`H
D$hLc|$`I
Lc|$hI
/PLc|$hI
PLc|$pI
/Lc|$`I
Mc</Lct$hI
D$pLc|$pI
D$XPM1
D$hPM1
D$(H;D$0
YZAXAYH
YZAXAYH
YZAXAYH
t$pYZAXAYH
t$pYZAXAYH
t$hYZAXH
t$hYZAXH
t$hYZAXH
t$hYZAXAY
t$`YZH
YZAXAY
t$`YZH
YZAXAY
t$`YZH
YZAXAY
t$`YZH
PPPPPPH
$YZAXH
t$8YZAX
$YZAXH
t$xYZAXH
t$hYZAXH
L$XZQH
t$XYZAXAY
HcD$@PM1
L;<$t8I
L;<$t+I
PPPPPH
PYZAXH
PYZAXH
t$xYZAXAYH
t$xYZAXAYH
YZAXAYH
t$pYZH
$YZAXH
t$hYZAXAYH
PPPPPH
t$xYZAXH
t$8YZAX
D$HH;D$P
t$pYZH
YZAXAY
t$8YZAX
t$PYZAXH
t$XYZAXH
t$hYZAXH
L$ UH1
t$hYZH
PPPPPPH
t$XYZAXAY
PYZAXAYH
PPPPPPH
t$XYZAXH
t$`YZH
t$XYZH
YZAXAY
L;<$uFQH
L;<$u<H
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
t$HYZAXH
t$xYZAXH
t$hYZH
t$pYZH
t$xYZH
t$`YZH
YZAXAYH
YZAXAYH
L$ AWH
YZAXAYH
PPPPPH
t$`YZAXAYH
t$`YZH
YZAXAY
PPPPPH
PPPPPH
t$@YZAX
|$8L;|$pu
@UATAUAWH
fA9<Fu
(A_A]A\]
(A_A]A\]
|$ ATAVAWH
A_A^A\
SUVWATAVAWH
H+D$ I
H+D$(H
0A_A^A\_^][
|$ AVH
WAVAWH
A_A^_
@SVWAVH
(A^_^[
(A^_^[
WAVAWH
fD9;t1
A_A^_
@SUVWATAUAVAWH
fC9,~u
fB9,ou
u!Hc\$8H
HA_A^A]A\_^][
UVWATAUAVAWH
A_A^A]A\_^]
t$ AVH
t$ UWAVH
UVWAVAWH
0A_A^_^]
x UATAUAVAWH
A_A^A]A\]
UATAUAVAWH
f9LD^u
A_A^A]A\]
f9(tIH
USVWATAUAVAWH
A_A^A]A\_^[]
HcD$0H
WAVAWH
fD9<Yu
0A_A^_
WAVAWH
A_A^_
WAVAWH
1Lcy(E
A_A^_
t LcC03
LHcO<H
t LcG03
HcQ(;Q<}
Q(;Q<}
M\f9L_
L$@D+A
HcD$@H
VWATAUAWH
A_A]A\_^
|$ AVH
HcD$HH
|$@HcD$HH
l$P9i$
HcD$PH
WATAVH
A^A\_
UVWATAUAVAWH
3t$@D3d$<D
3t$PE3
D3d$(A
D$ 3\$0D
3\$4A#
D3t$`D
nD3t$LD3
D3|$HA
D3l$@D
x D3l$(A
3D$83D$4A3
D$X3D$,D
L$ 3D$03
D$D3D$TA
3D$(A3
D$ 3l$4D
L$ 3D$<3
L$ 3D$,A3
D$ D3d$4D
D3t$XH
D3t$<A
D3t$0#
D3d$HA#
3l$T3|$0D
h<D3d$(
D3|$4A#
|$ 3l$8A
D3t$<A#
D3l$,3l$LA
D3l$P3l$0
3l$PA#
D3t$HD
D$ 3t$(
l$@D3l$4
D3l$0A
D3d$(A
D3|$<A#
D3t$LA#
D3t$,D
3t$<A3
l$@3l$L3t$HA
|$(3l$T
\$X3\$D
D3d$\A
3\$HA3
t$ D3|$T
D3|$PA3
D3|$H3
3l$DD3t$TD
3l$8D3D$4A
3l$PD3D$0
D3d$,D
D3d$4A
D$ 3t$(A
D3D$LD3D$,
D3d$<D3l$D
pA_A^A]A\_^]
WAVAWH
A_A^_
UVWATAUAVAWH
@A_A^A]A\_^]
|$ AVH
!s H!s
A9@ u`A
WATAUAVAWH
A_A^A]A\_
WATAUAVAWH
0A_A^A]A\_
H;G uSH9s
D$(HcD$HH
u%HcD$ H
+HcD$ H
HcD$ 3
HcL$HH
HcD$HH
HcD$ 3
D$ HcD$@H
H9D$@r2H
H9D$@w
D$ HcD$@H
D$XHcD$PH
D$ HcD$ H
HcD$ H
HcD$XH
D$0HcD$XHcL$PH
D$ HcD$@H
HcD$@H
D$ HcD$@H
HcD$0H
D$(HcD$0H
D$8H9D$
UVATAVAWH
A_A^A\^]
wEA;M0w?
MP;H(s
MP;H8s
A;M8v"A
E;}$tXH
L9w@t?
i H9i0u
A0H9i8u
~0L9s0tKL9s8tEH
L9w0t1L9w8t+H
t"H99u
C<;C4A
C8;C4s
USVWAUAVAWH
A_A^A]_^[]
SUVWATAUAVAWH
8A_A^A]A\_^][
HcD$0H
WAVAWH
@A_A^_
|$ AVH
|$ AVH
t$ AVH
|$ AVH
SHBrowseForFolderW
SHGetPathFromIDListW
GetLongPathNameW
SHGetKnownFolderPath
0123456789abcdefK
InitOnceExecuteOnce
1.2.11
incorrect header check
unknown compression method
invalid window size
unknown header flags set
header crc mismatch
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid code lengths set
invalid bit length repeat
invalid code -- missing end-of-block
invalid literal/lengths set
invalid distances set
invalid literal/length code
invalid distance code
invalid distance too far back
incorrect data check
incorrect length check
Qkkbal
[-&LMb#{'
w+OQvr
INSKyu
)\ZEo^m/
H*0"ZOW
mj>zjZ
IiGM>nw
ewh/?y
OZw3(?
V_:X1:
inflate 1.2.11 Copyright 1995-2017 Mark Adler
need dictionary
stream end
file error
stream error
data error
insufficient memory
buffer error
incompatible version
memset
msvcrt.dll
GetModuleHandleW
HeapCreate
GetStdHandle
SetConsoleCtrlHandler
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetShortPathNameW
GetSystemDirectoryW
KERNEL32.dll
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
SHELL32.DLL
timeBeginPeriod
WINMM.DLL
CoInitialize
CoTaskMemFree
OLE32.DLL
PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
SHLWAPI.DLL
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
_wcsicmp
wcslen
wcscpy
wcscmp
wcscat
memcpy
tolower
malloc
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
PeekNamedPipe
TerminateProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
DuplicateHandle
CreatePipe
CreateProcessW
GetExitCodeProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
GetWindowLongPtrW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
DestroyWindow
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
GetSystemMetrics
CreateWindowExW
SetWindowLongPtrW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
USER32.DLL
GetStockObject
GDI32.DLL
InitCommonControlsEx
COMCTL32.DLL
d[t{mLf
a#be&
YcaIc9f$
.LdMT0
+BY$Q;x
PAD<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.0.0.0"
processorArchitecture="amd64"
name="CompanyName.ProductName.YourApp"
type="win32" />
<description></description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="amd64"
publicKeyToken="6595b64144ccf1df"
language="*" />
</dependentAssembly>
</dependency>
</assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
InputRequester
STATIC
BUTTON
SHELL32.DLL
Invalid memory access
Array bounds exceeded
Debugger breakpoint reached
Misaligned data access
Denormal floating-point operand
Division by zero (floating-point)
Inexact floating-point result
Invalid floating-point operation
Floating-point overflow (exponent to great)
Floating-point stack overflow or underflow
Floating-point underflow (exponent too small)
Illegal instruction
Memory page error
Division by zero
Integer overflow
Exception handler returned unknown value
Exception handler tried to continue after non-continuable exception
Privileged instruction
Single step trap
Stack overflow
Unknown error code
Kernel32.DLL
Shell32.DLL
Downloads\
Kernel32.dll
#+3;CScs
(181624777BC343F90D4940AA79C0BB8B823541D8 60AD6DB11285828781ACC751F38E5E1C C0668708E31D9FE6B2C767B3AB20323D
E06D72BED8
Antivirus Signature
Bkav W32.Common.FFE247B3
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.68501123
ClamAV Clean
FireEye Generic.mg.413157ad1210bff4
CAT-QuickHeal Clean
ALYac Clean
Cylance unsafe
VIPRE Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
BitDefender Trojan.GenericKD.68501123
K7GW Clean
Cybereason malicious.dd1f9c
Baidu Clean
VirIT Clean
Cyren W64/Boxter.A.gen!Eldorado
Symantec Clean
tehtris Generic.Malware
ESET-NOD32 Clean
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky Clean
Alibaba Clean
NANO-Antivirus Clean
SUPERAntiSpyware Clean
Rising Clean
Sophos Mal/Generic-S
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win64.RealProtect.ch
Trapmine suspicious.low.ml.score
CMC Clean
Emsisoft Trojan.GenericKD.68501123 (B)
Ikarus Clean
GData Trojan.GenericKD.68501123
Jiangmin Clean
Webroot Pua.Gen
Avira Clean
MAX malware (ai score=84)
Antiy-AVL Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Generic.D4153E83
ViRobot Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Casdet!rfn
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!413157AD1210
TACHYON Trojan/W64.Agent.126976.B
DeepInstinct MALICIOUS
VBA32 Clean
Malwarebytes Generic.Malware.AI.DDS
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
BitDefenderTheta Clean
AVG Clean
Avast Clean
CrowdStrike Clean
No IRMA results available.