Static | ZeroBOX

PE Compile Time

2023-09-08 00:02:06

PE Imphash

431b9eee3827e493b6144e5f38c219a4

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00015ce8 0x00015e00 6.72070262482
.rdata 0x00017000 0x00006dcc 0x00006e00 5.15988268281
.data 0x0001e000 0x000013b4 0x00000a00 2.38346526704
.BsS 0x00020000 0x00078e04 0x00079000 6.76530355923
.rsrc 0x00099000 0x000001e0 0x00000200 4.71377258295
.reloc 0x0009a000 0x00001118 0x00001200 6.37704003407

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00099060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x417008 GetCurrentProcess
0x41700c TerminateProcess
0x417018 GetCurrentProcessId
0x41701c GetCurrentThreadId
0x417024 InitializeSListHead
0x417028 IsDebuggerPresent
0x41702c GetStartupInfoW
0x417030 GetModuleHandleW
0x417034 WriteConsoleW
0x417038 RaiseException
0x41703c RtlUnwind
0x417040 GetLastError
0x417044 SetLastError
0x417048 EncodePointer
0x41705c TlsAlloc
0x417060 TlsGetValue
0x417064 TlsSetValue
0x417068 TlsFree
0x41706c FreeLibrary
0x417070 GetProcAddress
0x417074 LoadLibraryExW
0x417078 GetStdHandle
0x41707c WriteFile
0x417080 GetModuleFileNameW
0x417084 ExitProcess
0x417088 GetModuleHandleExW
0x41708c GetCommandLineA
0x417090 GetCommandLineW
0x417094 HeapAlloc
0x417098 HeapFree
0x41709c CompareStringW
0x4170a0 LCMapStringW
0x4170a4 GetFileType
0x4170a8 FindClose
0x4170ac FindFirstFileExW
0x4170b0 FindNextFileW
0x4170b4 IsValidCodePage
0x4170b8 GetACP
0x4170bc GetOEMCP
0x4170c0 GetCPInfo
0x4170c4 MultiByteToWideChar
0x4170c8 WideCharToMultiByte
0x4170d8 SetStdHandle
0x4170dc GetStringTypeW
0x4170e0 GetProcessHeap
0x4170e4 FlushFileBuffers
0x4170e8 GetConsoleOutputCP
0x4170ec GetConsoleMode
0x4170f0 GetFileSizeEx
0x4170f4 SetFilePointerEx
0x4170f8 HeapSize
0x4170fc HeapReAlloc
0x417100 CloseHandle
0x417104 CreateFileW
0x417108 DecodePointer

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
D$8SUV
;D$Tt\
\fHAfJ
fFfBf3
fHfOJfHHfHG+
fBfAfBf
*fKJN@f
QQSVWd
URPQQh`s@
UQPXY]Y[
<ItC<Lt3<Tt#<h
A<lt'<tt
F +F4+
8^8tb9^4~]
YYh\qA
M,j"^QRRRRR
Vj0XPW
r!SSPVQ
dr#SSjdVQ
M$j"^QRRRRR
j"[VWWWW
uSSSSj
f9:t!V
QQSVj8j@
^PQQQQQ
E ^PQQQQ
CY<u
PPPPPPPP
PPPPPVW
PP9E u!PPSVP
Unknown exception
bad array new length
string too long
%d Anthony Martin Grosvenor Christopher %d
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Parker
Jo-Man
vector too long
@bad allocation
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__swift_3
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
(null)
CorExitProcess
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[aOni*{
~ $s%r
@b;zO]
v2!L.2
1#QNAN
1#SNAN
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
.text$mn
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.rsrc$01
.rsrc$02
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
KERNEL32.dll
RaiseException
RtlUnwind
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVbad_array_new_length@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVbad_exception@std@@
.?AVtype_info@@
QYyE4y
o$EFty
9yFyY?2
V153e_
VE:p5(
VE:hkw
sJcEty
9}5,fe
V1:7_U
9}$Eeu
>E5Oq;
9y5Oq;
>15_OG
9y5-F_
9}5;{1H
>E5p5(
9}5,]d
VE:,]d
9U5Oq;
9y5T~4
>153"CU
9}5;:h
>E5&9b
&1$ER8
j<3~}K
!YyJyY
!Yqp!Y
YmJ!Y}
03$E3~
9y$EI(
QYmJBZ
YMH)Ya
!Yy$E$<
QYUZc:
QY!%QY
jrBJer=
k>0%>C
>153e_
_YOffE
-yJeJe
9y5ym9#
yY&30{
VE:]'am
V15HSI
>E5R)FV
-U`3"CU
V15-F_
9}5p5(
&1$Edy
&1$E>1
7y?>L)
9}5.j5L
-yJeJe
7y7D\q
7y\ H/
7yR)FV
9y:7_U
9y5-F_
9}5p5(
9y53e_
9}5p5(
V15p5(
>15)Qqk~*
>i5ym9#
V15,fe
7y)Qqk
7yR)FV
7y&<29
7y?>L)
7y)&b}
7y,fe
7y]'am
7y\ H/
>/%>6`y
9}5-F_
=:/4Ga~
VE:p5(
9y5NHe
V153e_
V15-F_
>E5NHe
yY3"CU
QYy5NQ
yYYOff
V1:hkw
>15TdR3
Yy,fe
$$$$$E
$$$$$E
$$$$$E]
$$$$$El
$$$$$E
$$$$$Ep(
$$$$$Ew
$$$$$E
0m#yH%
5yx>1EE;
IpVEBz
&}pcBz
IpcBz$
a0}Er0
&-~GY
IpVuBz
IpVuBzR
>E%>1E
x=0^#y
#-=2=z=
F2<-G9
B<-G9R
e<-G9R
9Y0U$E
/AZ<-F
/AZ<-G9
/AZ<-G9
/AZ<-G9
&u<-G9
":h?R_
[Kg*`@Mza
<:zz,_
D,A!r<@
jjjjjjjj
}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
UUUUUUUUZZZZZZZZSSSSSSSSSSSSSSSS
yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
znB)J`
^)PV8y
{Y">&}
&_ly*P]6N2
`KRQzg
;xDZ`y9p
Dc0b4APj
Tf$W!o
qmVVVVm
D5:3`af_\
@AF?<-2+8
C016/,
|mrkxY^WT
D5:3`af_\
@AF?<-2+8
C016/,
D5:3`af_\
@AF?<-2+8
C016/,
|mrkxY^WT
D5:3`af_\
@AF?<-2+8
C016/,
y#n2K4:)jaw[
}}}}}}}}}}}}}}}}}}}}}}}}}}
mmmmmmmmmmmmmmmmmmmmmmmmmm
}}}}}}}}}}}}}}}}}}}}}}}}}}
mmmmmmmmmmmmmmmmmmmmmmmmmm
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
5%6H6}6
7/7e7u7
828B8L8R8W8^8w8
94;F=K=]=
=4>A>m>y>
888S8i8
:0:5:::[:`:m:
< <'<.<5<<<C<J<R<Z<b<n<w<|<
>(>/>5>G>Q>
???N?W?d?z?
0*03090L0
181B1b1
2%292>2Q2q2
3,454>4L4U4w4~4
6a6y6~6
93:g:o:
;';E;S;
=8=?=D=H=L=P=
4$4*4E4m4
4F5U556b8
4*4F4f4t4{4
5!5A5K5W5s5
6'63686=6[6e6q6v6{6
7Z7a7g7
8O8=9G9T9
;#;:;];r;
8N:4<8<<<@<D<H<L<P<
1.12161:1>1
626+8I8a8|8
:&:9:@:H:`:n:v:
=>&>V?
010<0G0_0m0
0 1-1<1Q1^1t1{1
2=3K3d3l3u3~3
4i4u4z4
889C9K9V9\9g9m9{9
:/:4:M:^:c:
0+0>0X0l0
1-1[1j1|1
2%222V2`2
4!41464;4c4|4
5"5+5c5{5
5'6K6[6`6e6
7"7@7O7Z7_7d7
8-868M8_8k8y8
=+=[=~=
=5>;>[>}?
41>1e1o1
1x2*3k3
<?=F=M=T=n=}=
84:::H:W:w;
<B<I<e<l<
<+=?=o=x=
>)>;>M>_>q>
4%5,565Z5
6b6i6p6w6
8 888d8
;>H>s>
607V7}7
7)797r7
>(>3>@>R>
>7?L?U?^?
465Y5g5
<<.<3<y<
<!=-=A=M=Y=y=
>>+>:>M?~?
3&3{3|4
4-585>5G5
6#6l6u6~6
<$<A<^<{<
1(1,1014181<1H1L1P1d1h1l1
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6|<
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<1@1D1H1L1P1T1X1 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6
\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
8$8,848<8D8L8T8\8d8l8|9
9L:P:`:d:l:
; ;0;4;D;H;L;T;l;|;
<(<,<0<8<P<
D0H0X0|0
1 141<1P1X1l1t1|1
2 2<2@2`2h2l2
3$3(30383@3D3L3`3
4<4@4`4
5(5H5h5
6(6H6h6
7(7D7H7h7
181H1X1h1x1
1074787<7@7D7H7L7P7T7`7d7h7l7p7t7x7|7
909P9p9
Aapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
(null)
mscoree.dll
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
Aapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
api-ms-win-core-fibers-l1-1-0
ext-ms-
Aja-JP
((((( H
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Injurer.4!c
tehtris Clean
ClamAV Clean
FireEye Generic.mg.ef9728a0916c18e4
CAT-QuickHeal Clean
ALYac Trojan.GenericKDZ.102784
Cylance unsafe
Zillya Clean
Sangfor Trojan.Win32.Kryptik.Vi1w
K7AntiVirus Trojan ( 005aaead1 )
BitDefender Trojan.GenericKDZ.102784
K7GW Trojan ( 005aaead1 )
CrowdStrike win/malicious_confidence_100% (W)
Baidu Clean
VirIT Trojan.Win32.GenusT.DQZL
Cyren W32/Kryptik.KPQ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/GenKryptik.GNPB
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Injurer.gen
Alibaba Trojan:Win32/Injurer.3b4b8c18
NANO-Antivirus Trojan.Win32.Stealer.jzopyb
ViRobot Clean
MicroWorld-eScan Trojan.GenericKDZ.102784
Rising Stealer.Stealerc!8.17BE0 (TFE:5:NwBlA3L3cWV)
Emsisoft Trojan.GenericKDZ.102784 (B)
F-Secure Trojan.TR/AD.Nekark.azngh
DrWeb Trojan.Inject4.60850
VIPRE Trojan.GenericKDZ.102784
TrendMicro TrojanSpy.Win32.LUMMASTEALER.YXDIIZ
McAfee-GW-Edition BehavesLike.Win32.Generic.jc
Trapmine suspicious.low.ml.score
CMC Clean
Sophos Troj/Krypt-ABT
SentinelOne Static AI - Suspicious PE
GData Win32.Trojan.PSE.IXOKYQ
Jiangmin Clean
Webroot Clean
Avira TR/AD.Nekark.azngh
MAX malware (ai score=89)
Antiy-AVL Clean
Gridinsoft Ransom.Win32.Sabsik.sa
Xcitium Clean
Arcabit Trojan.Generic.D19180
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Injurer.gen
Microsoft Trojan:Win32/LummaStealer.CCAK
Google Detected
AhnLab-V3 Trojan/Win.Injection.R604264
Acronis Clean
VBA32 Clean
TACHYON Clean
DeepInstinct MALICIOUS
Malwarebytes Spyware.MysticStealer
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TrojanSpy.Win32.LUMMASTEALER.YXDIIZ
Tencent Malware.Win32.Gencirc.10bf2012
Yandex Clean
Ikarus Trojan.Win32.Krypt
MaxSecure Trojan.Malware.121218.susgen
Fortinet W32/GenKryptik.GNPB!tr
BitDefenderTheta Gen:NN.ZexaF.36662.LyW@a8mWnFhi
AVG Win32:Evo-gen [Trj]
Avast Win32:Evo-gen [Trj]
No IRMA results available.