Static | ZeroBOX

PE Compile Time

2023-08-23 00:59:14

PE Imphash

e58ab46f2a279ded0846d81bf0fa21f7

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x0004f000 0x00000000 0.0
UPX1 0x00050000 0x00010000 0x0000f800 7.9319532618
UPX2 0x00060000 0x00001000 0x00000200 1.65861324006

Imports

Library KERNEL32.DLL:
0x460028 LoadLibraryA
0x46002c GetProcAddress
0x460030 VirtualProtect
0x460034 VirtualAlloc
0x460038 VirtualFree
0x46003c ExitProcess

!This program cannot be run in DOS mode.
8MZt }S
C-GT1PU
~]vc^m
rt.;t$$t(
$P1uX}l
TCX$s,
?8uXRj
P[Asil
Qh\J{Z
.|r%a|
1VC20XC00
|J,v!hX
[dz/u%x$#
vBt3rd
{0N$9S
OVuxM?
1PCR!3
m7g8{RT
0"D}4"
"79iup
sis;)]
kr@l|*
=WB+E>
VK=go!
F!%3 H
Z3TPmT
o3h/ 
+J4un
r`I``.wlN
9(M sg
mlock.c/
bgdelHpp
_BLOCK_TYPE_IS_VALID(pHead->nBv
tidtab{#
argva_
ioinit
_HEAP_SELECTED/MSVCR_p
T_run4me er
4#R6028
to !ializ
oO7notz
ugh sp
2mono6"
bo5purVvirtu
BfJcG c
Ch_/i&
W8DuQs|
btu"Ldn
rf*Vis
-UC++ RALibr
c$bT|q;
-b3tyf.
Ffail`
>]()'IsVOHNP
rDdRl_
E && =lReque
)-0x%@XhG
Wbe6eY
8':0UW
!jWoBAJ
TNULLR
qaks(As0
xs~7x@L#
u`32.d
sz2M,ag~
`h`Ppx
_T('\0'O
w.lqwljs.Z
nlogl]a
[]``oj
^ lZ]j]sm;Y
y*P1t#
zzzHWd
}>$U#Kt"8!; =
|>/B.:-L,4|>
JdZNM":d
$ZDNLfB
*(UFKv
'#-+*?S
*@r,b7]
zVn^>]
z5f><v
:98FED<M
<B@ONM.yQ
-tt+ *l)
{6=5n423
S=<;:9
8GF+EoD2
CXA[<@
F>GNF/D
*mj$3\
^|-HjV}
LH)D8j
0LKXN
M { "j
MW(%!T
[m6yX:Km
4HN.F^KI
7]NWI}
"b&@*G*&
0>NoIf
TX}PATi'R+
_@1wd8
BCL0BN
*KMWH6
X}6ATWj
sWJ&b@,
w:O+iB
<F<ih4
b&R"B9r
^zZjfb
#bRnBj.
3.z*v63
<b2Z><#
}Jj~QW
%ld)z5
ylcJeaD}
~uI^^N
&nSrJ^
M>7-#U
*2%Ca,BAPK
?AdSE=
F'K"jrR
|`iLF6
T5R2iJ
#a)g]W
oL|/-
/.,+n
Z:pGXFN!<
`dZ)fs:
!Yr~-@.
KCNf03
PHB<6
-,+*)(765]\[ZYXgfX
edcba`Xlk
N<wvutkG9J
]kn3P
$&%bO-Q,
P[=<;:98GFEDCBAb
B.98n^
Helji]b8lYY
^"e`Z@
JGYj;il
`jNlhYkk
'HYHeo`
:YhetEo;{
O\dY[j
5YZ9v[f]l
iBe\lp
vi=ZZlp
LhYAHvF^
en\ll>
=Zdifocl
Z$inu}
iV1E^[
][`73:SiR
erhYPn
=:H=NES
GieZom
WK=E|j"=
??+>U=VN
<FAKH;LJ
>>I=9>V
6enfbn]neD
Xi<uoi
zkR$ $
s*:+(957,!9+,
)!--;9!<8;-!.6..,<9-.+-6q
mm [oa
FJJN/- -4
6v>FZ4
@J#8u+
<ZRJB:
<rvjnbi>
lkjihwy
-,+*)<
LJUIEO<
<;H<@A
odac^]<
<\[ZYX
<NSInQ
W'JG9gM
W>wpoN]
<BcQKfeXj
=bj;B9=L<=;CKN
&^G9`Z
~bdGgg
WmWJ=<g1
6?(_*
^w8-,Q
ARn%FbkI
Ilb='p
co*tn+,Ktn
t]BN9;
L:N!J[dv
bmwbdk jV'r
-6HtHE
Lkcnm\akgguck
KK:CKLH
IZcZYt
<]eZiKZKh[
8UhYW,
'?DoZo
'LOJA=
lZ9A[
^\Yeczo
?z 9V9
$5@O:+
`lkVAk
An9`g<c]h
LIKXNYQ
kZGfAh\R7
\4]^mi]ZA],g
RLiO.6
x(/?=H
656;6C6r6
6-5b5l5
1?1]1|1
-G-u-{-
+;*C*6);)[)`)w
515;5D5W5Z5`5v5{
4#4.4>4T4X4
3.272\
?a?k?t?
4)G)])e)u)p
6I6Y6\6
G5N5]5y5
[4v4~4
.0.N.I
.Z.m.r.x.
7D7H7~7
5#575B5Y5d5q5
212;2D2W2Z2`2v2{2
030K0T0_0n
?'?*?0?F"
.C-T-f-t
+d+v+}+
*'*<*X*`*
) )2)c)j)s)
(C(J(S(j(}(
o^2<2B2
281c1v1}1
0E0`0}~
.&- -7-D
,=+`+u
\t)}J~
(L(b(v(q(
;D686U6X6
Z:3C3{V
0$0t=0
?]?c?v?{?
.7.].k.
6&6"6.6*6
26>ZF6B6N6
J6V6R6^6Z6f6b6n6j6v6
.$.>.in
6'6 6)G/
V.5&5/
J3'3 3(3<3@3T
141H1P1X\
V-\-d-l
1,F,K,P,e
+/+4+9+N+S+X+m+{
+*0*E*J*_*d*i*~
).)3)8)M)R)g)l)q)
(!(6(;(@(U(Z(o(t(y
7-L7Q7f7k7p7
5%5.535K5S5X
1<0@0b0>?
[5e5n5r5
*b2w2y
?-?6?@?Q?h?pO
-%-*-AN_-X-
,.,),3,9,W,Q,\
+'*9*K*?
7#7*7@B
565?5:4
5o5p5z
0A0V0e0j0t0
9.O.X.a
?;,@,Tn
&L3R3o
2&2"2.2*262
V2P2ln
%1(101B1M
1*0N0H0\0f
g2+>:^
~B*V*j*r*z*
(*(>(F
:7B7V7j7r7z7
*:*F^N
fR*^ppp
>):)F)B)NVVB^)
j)vF~)z
B(NVV(R(^W
("@TqI $
kernel)
f7AL"ORe
KERNEL
vrrACPgR/
<ph\PH
aiseExzk
nCVers
QII ,{
+LeavW
GG5QFh
s1WWid(
6{rToM
0sBJroq
,c&A*O
>CM2!{
[tF2sh?Buff
=.text
XPTPSW
KERNEL32.DLL
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Clean
tehtris Clean
MicroWorld-eScan DeepScan:Generic.Rincux2.BF14C98E
ClamAV Clean
CMC Clean
CAT-QuickHeal Trojan.FarfliRI.S28114709
Malwarebytes Malware.AI.3333506357
VIPRE DeepScan:Generic.Rincux2.BF14C98E
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 004d3cae1 )
BitDefender DeepScan:Generic.Rincux2.BF14C98E
K7GW Trojan ( 004d3cae1 )
Cybereason malicious.1be6d2
BitDefenderTheta AI:Packer.20D6963A1E
VirIT Clean
Cyren W32/Farfli.FU.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win32/Injector.CJVZ
TrendMicro-HouseCall Clean
Avast Win32:RATX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Backdoor.Win32.Farfli.gen
Alibaba Clean
NANO-Antivirus Trojan.Win32.Farfli.jowqxn
ViRobot Clean
Rising Trojan.Generic@AI.100 (RDML:gCV1hYbBbdDlu0DAyHzW9w)
Emsisoft DeepScan:Generic.Rincux2.BF14C98E (B)
Baidu Clean
F-Secure Heuristic.HEUR/AGEN.1359717
DrWeb Trojan.MulDrop20.1002
Zillya Trojan.Injector.Win32.1533186
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.kc
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.fe262ce1be6d20d9
Sophos Clean
SentinelOne Static AI - Suspicious PE
GData DeepScan:Generic.Rincux2.BF14C98E
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1359717
Antiy-AVL Trojan/Win32.Injector
Gridinsoft Clean
Xcitium TrojWare.Win32.Magania.F@7jjkv4
Arcabit DeepScan:Generic.Rincux2.BF14C98E
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Backdoor.Win32.Farfli.gen
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Clean
Acronis suspicious
VBA32 BScope.Backdoor.Farfli
MAX malware (ai score=82)
DeepInstinct MALICIOUS
Cylance unsafe
Panda Clean
APEX Malicious
Tencent Clean
TACHYON Backdoor/W32.Farfli.380928.F
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Zard.30!tr
AVG Win32:RATX-gen [Trj]
Paloalto Clean
CrowdStrike win/malicious_confidence_70% (D)
No IRMA results available.