Static | ZeroBOX

PE Compile Time

2078-09-20 07:18:13

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0003a634 0x0003a800 7.85619136398
.rsrc 0x0003e000 0x00000386 0x00000400 2.9639905326
.reloc 0x00040000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0003e058 0x0000032e LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
ssdI\E
XSyYp3
Q/3^<i
a;^>qwC
SRN]D6
qQQaqC
H6c|pb@
I^_xDv
'w3Pm(
U.x2.L]n
,-e;W9
NQCA'm
C.HcM
z]+'[d
VU=wCX6$K
cBKarC
}|hI]-R
zN"&M
#R~>0h\[L
sD|^ah
N7+KK$
%0.I`mq
v+Kr1A
ML6R5}X
|RTsC^
Do)k[:
F .5K
56!?t-
Io[U]N
/x|A%XB
:s5@lBa8
N.K7FN
Fg>6Y\
@z'tBo
@X`\4/
''C1>3
>2?@t\m
~=Y/
VebM%$
U.kI,$
&8?^#;
6cW/&]
<?[]9jZ
k=VMGFY
cJ5RUs
UjQ?9l
1/LpsE->
yguWoj
-uO5ZX
n&(>Y[
yqT^/8oz
|1R'q Ky
m?NGkE
jMLB6BA
e5b7?[
byb.I8
JCZ}&f
9q"IIIY
-jMAOa
,X}R> 6
}N`BRS
QGYXx51?
w<CJrk
Z]3Z6N
b"H)+.
`z#x:1Q
A>.[uA
*4cir_
b}*)"';
SLjd$P
AkD)%_a
fm/-MF
N#@Lb\H
PM9F1#
:$V8(C
<Pe,#fu
|fQ4Dd
Md,e5H
}b!+zp
*6fU=a
8rU9t~
+N&/ j
#-hJp0
h;f7x>
!IO6q6
`@[>'\|
=>X ,5U
y~olX+J
XqPZL7
."4My
+umWV2
`dyViv
"\50hj
5`w6y1
jU.fh6
UJp\'/
~G TQAR
~%Fs<p
Sd2ed
K;aVu#
GB}q4tD-!
d#YrKH
Y#(}KY
q=!,5L
HBWM>4Y
O~y/qsT
Y)Wqb/
P6cCYF
}'cCK"
Y?t#tk
2O9J-2p?
X]y8Zhf/
4+;"#+
dt=;(0
'_"B3l
baFi(l
*^;9[S4
= Hyu'
&-U4NT
u;gPaAv
GsUGwl
!S2$uatn7A-
nxZNGm
SQ;q/o.
Z.UK{lB
K9=++*'g
c:--W
x/g+?t
1<5u"{24`ek
{iBuJmc
B::~Rbf+
T|J_.|
q7<_WZq
4*}MoH
sMX\,
)dNfQ(
)?6JLmW
aW0PXC
wl|)Zq
oF[?5y
U+?7$\
NQ1xT?
65t(t+
e$/]38
d"0Ags
Sd2mapC
s0&`u$
mPV]}KR
glD7SS[
ou\FP@@u
U;Xxc<
"T+|>V
&{0yd&<
S5<ED#
f @G8<
xL\8;&
Xu>k6{
uYg"WJ
NA&q*v1
NHg-F4
@HC\X~_
|}7-PJ
O~DQaU
fon]R.
oaV`fG
:}i9>)
F9`(~\
g0,adOyM
bDm\Z;
5N4xEO
TWb~b~5
w.stuT
?c!1CN4
a<9DE*
vQpy`2
A~B>=0E
GPsn#V
xW-_D@
u|/R;"
%@`"jF
7$r7g8i
#6fzS
1PMprs
w3<o\:3+
~+ 4FK
/ yo(
##nOT
A=wV&F
8s1@1,
.8'N8e
(Cdwb<
4z"B}Z
]d@lVf
q }1(4
Q/}e}>
-.aK2=
\&gP(|
.[.'ok
lTK9b+
azxw}]~
M#t-~]N
vC$?H)
?h)RR
L(~*HBD! w
3efmG$mA%
I0!Pga
+i`lg6
y])Exk{
)}byU
:(G?MX
]=i\/oh
K# /\4n
jp|l*<x
Yl],/f
Fg({#
h0%]CZ
qB4zu/
VfbZlu
ZMtX~L
uQVr/,
YjuR:y
y+xngq,8
|Yx&?k8
Us'dB]
E5T&|r
@gleXc
yT}Y:U
epvQ+q
h>~m&q
J[AMQ=
R4x#&/6
<!PWaPoL}
9Eq(\P
}a9u!{
?_>Wrj
(DJDT&G
qx2Mu!
pvJFC)Rf
gn^fjj
E4SOo[
YM"_E8
eq]-;g
3t=@P[
vO5Q\5X
tdTI2!~Z
N<l*qs
A6p43)]
y.w"=|k
CR$GQ;+
wCw5.Q
hC^N&^n
\/"Zp$
A*M] &J
;}BM;`
}^)=G
"dJ3^Y
>Ypd9(
(zR*e#
4+X7i,=rf1m
f@-T'g
-(se~s
o6L\G8P
/^xHEO
MS%Qwvd
aoY9pFiR
X``P3
7nJ1;dnUvL
D8#!lph
jdD lz
<)w;Nv\
NTZgV-
x{H.Y.[
F<KDz<
~42AXF
1-x#hy
Xx7>g-
at[&itr
9nkm}1y6
Xn.<{bud
i_;Pc
o.*. $
%>jMIl
|i/.I0
a|Orki
BZk` a
`"s}!t
^Yc5S9
UM[~WA
D=fxII
Ec<S_V
~vO3
Wu_6A$g
~XjRg[/`
I~$cgTM~
}nB`^0
_1`-bB
K)F=#i/
!-RB'DXPK}i2;7
*IJ(>6
hG":H)=Ri
{ZY@7
23F;7_
r?'/Mr
N~4'Hz
unB1v8
Z~MRmy
x1HGD_
} 0o=m
]F5n&[z
':P0I3G1K
G(O?7&
a+ h4P!V
5 xTN;a%
0D%&8U
tS0Z ,
C-Ca8f
{[%&8
=J:/Z
P?"a8u
*%Z Ij
GD\Za8{
8b%&8r
oZ }~U
0OVG%&+
aN=,Z T
pA.+Z q
GY( %+
_bj2
_bY*
DjZ e[6fa8
j>7a8k
5)398
eZ 1ElJa8
o$oZa8K
Z ~aXKa8w
pA%&8
Yv6R%&
Z_bX
f%G?%+
tHZa8x
d-6n%&+
Y_cX*
}I=Z l
T{FZ p
h%cZa8*
L%%#8
77 b_"^
Q,Z Bh
^(yZ LVy
2<w%&8
8'>HZ
xP%&8E
xP%&80
jZ ]]y
Z J(-6a8
J2~b8
-8 ]V`
3'nqZ
hl+Z Gs
<jX(*
jX jX(*
Z Qcr]a8
jX$jX(*
YZjX(*
xbSa8V
v4.0.30319
#Strings
<>c__DisplayClass1_0
<>c__DisplayClass2_0
<.ctor>b__0
Func`1
IEnumerable`1
List`1
UInt32
ReadInt32
ToInt32
Func`2
cbReserved2
lpReserved2
ToInt64
isWow64
__StaticArrayInitTypeSize=349706
ReadInt16
get_UTF8
<Module>
<PrivateImplementationDetails>
System.IO
base64EncodedData
SizeOfRawData
PointerToRawData
mscorlib
e_magic
System.Collections.Generic
dwThreadId
dwProcessId
hThread
lpReserved
<zfhcasig>k__BackingField
<PathOnDisk>k__BackingField
<Body>k__BackingField
<ExecuteInMemory>k__BackingField
Append
method
Replace
distance
CreateInstance
Source
exitCode
SizeOfImage
EndInvoke
BeginInvoke
IEnumerable
IDisposable
Waddle
RuntimeFieldHandle
RuntimeTypeHandle
GetTypeFromHandle
ProcessHandle
handle
MergeFile
lpTitle
ProcessModule
get_FileName
GetFileName
lpApplicationName
tionName
ExportName
lpCommandLine
ValueType
AllocationType
GetElementType
System.Core
Signature
ImageBase
ModuleBase
Dispose
Reverse
MulticastDelegate
posState
NumberOfBytesToWrite
CompilerGeneratedAttribute
UnverifiableCodeAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
dwFillAttribute
AssemblyFileVersionAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
ConfusedByAttribute
ParamArrayAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
ReadByte
matchByte
prevByte
Waddle.exe
dwXSize
dwYSize
inSize
RegionSize
outSize
windowSize
dictionarySize
SizeOf
get_zfhcasig
set_zfhcasig
System.Threading
Encoding
System.Runtime.Versioning
FromBase64String
ToString
GetString
get_Length
PtrToStringAnsi
zcvdznj
AsyncCallback
callback
get_PathOnDisk
set_PathOnDisk
AllocHGlobal
Marshal
inStream
outStream
MemoryStream
stream
System
Random
IsLittleEndian
hToken
hNewToken
NumberOfBytesWritten
get_Location
Destination
Action
action
System.Reflection
ProcessModuleCollection
EntryPointNotFoundException
MethodAccessException
StringComparison
Intern
lpStartupInfo
lpDesktop
System.Linq
fjcsutq
ToChar
FileHeader
OptionalHeader
StringBuilder
rangeDecoder
Buffer
GetDelegateForFunctionPointer
BitConverter
hStdError
GetEnumerator
.cctor
IntPtr
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
properties
ExpandEnvironmentVariables
bInheritHandles
get_Modules
numPosStates
lpThreadAttributes
lpProcessAttributes
WriteAllBytes
dwCreationFlags
ContextFlags
dwFlags
Equals
Models
NumBitLevels
numBitLevels
NumberOfSections
System.Collections
dwXCountChars
dwYCountChars
SizeOfHeaders
RuntimeHelpers
hProcess
GetCurrentProcess
get_BaseAddress
lpBaseAddress
VirtualAddress
GetExportAddress
numTotalBits
ZeroBits
numPosBits
numPrevBits
Object
object
Protect
Ashalet
op_Explicit
FirstOrDefault
IAsyncResult
result
lpEnvironment
get_Current
AddressOfEntryPoint
Convert
hStdInput
hStdOutput
MoveNext
System.Text
pContext
zwkgvotv
spuqvzv
e_lfanew
wShowWindow
nCmdShow
startIndex
InitializeArray
ToArray
ToCharArray
get_Body
set_Body
stringKey
GetCallingAssembly
GetExecutingAssembly
BlockCopy
get_ExecuteInMemory
set_ExecuteInMemory
lpCurrentDirectory
op_Inequality
System.Security
lpProces
Confuser.Core 1.6.0+447341964f
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
Bhive Inc
BHiver 4 Game
BHive md
BHive Corp.
5.14.22.1
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
_CorExeMain
mscoree.dll
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
BHiver 4 Game
CompanyName
FileDescription
Bhive Inc
FileVersion
5.14.22.1
InternalName
Waddle.exe
LegalCopyright
BHive Corp.
LegalTrademarks
OriginalFilename
Waddle.exe
ProductName
BHive md
ProductVersion
5.14.22.1
Assembly Version
131.32.5.3
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan Gen:Variant.Lazy.351635
CMC Clean
CAT-QuickHeal Clean
ALYac Gen:Variant.Lazy.351635
Malwarebytes Trojan.MalPack
VIPRE Gen:Variant.Lazy.351635
K7AntiVirus Clean
BitDefender Gen:Variant.Lazy.351635
K7GW Clean
CrowdStrike win/malicious_confidence_100% (D)
BitDefenderTheta Gen:NN.ZemsilF.36662.om0@aySXozj
VirIT Clean
Cyren W32/MSIL_Agent.FTV.gen!Eldorado
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of MSIL/Kryptik.AJBC
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
Alibaba Clean
NANO-Antivirus Clean
SUPERAntiSpyware Clean
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:Nh48ClUHs2SIzM1Mr7tiSQ)
TACHYON Clean
Sophos ML/PE-A
F-Secure Trojan.TR/Dropper.Gen
Baidu Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.c42c4ca7198620f4
Emsisoft Gen:Variant.Lazy.351635 (B)
Ikarus Trojan.MSIL.Crypt
GData Gen:Variant.Lazy.351635
Jiangmin Clean
Webroot Clean
Avira TR/Dropper.Gen
Antiy-AVL Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Lazy.D55D93
ViRobot Clean
ZoneAlarm HEUR:Trojan-Spy.MSIL.Stealer.gen
Microsoft Trojan:MSIL/Heracles.FAY!MTB
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
MAX malware (ai score=89)
DeepInstinct MALICIOUS
VBA32 Clean
Cylance unsafe
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Kryptik.AJBC!tr
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.472ea6
Avast Win32:PWSX-gen [Trj]
No IRMA results available.