Static | ZeroBOX

PE Compile Time

2023-09-12 01:16:55

PE Imphash

9881fe8bdd76fbd975354d75e7c256d2

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000e7c7 0x0000e800 6.47066900136
.rdata 0x00010000 0x000417e6 0x00041800 7.09103313628
.data 0x00052000 0x000bf598 0x000be400 5.40669840275
.pdata 0x00112000 0x00000e40 0x00001000 4.41604935436
.gfids 0x00113000 0x00000094 0x00000200 1.21397788582
.rsrc 0x00114000 0x00000728 0x00000800 3.74001700596
.reloc 0x00115000 0x00000624 0x00000800 4.74851496519

Resources

Name Offset Size Language Sub-language File type
RT_STRING 0x00114320 0x00000286 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x00114320 0x00000286 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_MANIFEST 0x001145a8 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text
None 0x00114120 0x000000c4 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library KERNEL32.dll:
0x180010000 EnterCriticalSection
0x180010008 LeaveCriticalSection
0x180010018 CloseHandle
0x180010020 GetLastError
0x180010028 GetCurrentActCtx
0x180010030 HeapCreate
0x180010038 TryEnterCriticalSection
0x180010040 CreateThread
0x180010048 OpenThread
0x180010050 FindFirstFileA
0x180010058 FindNextFileA
0x180010060 FindClose
0x180010068 WaitForSingleObject
0x180010070 WaitForMultipleObjects
0x180010078 GetCurrentThread
0x180010080 CreateFileMappingA
0x180010088 VirtualAlloc
0x180010090 DuplicateHandle
0x180010098 QueryPerformanceCounter
0x1800100a0 GetCurrentProcessId
0x1800100a8 GetCurrentThreadId
0x1800100b0 GetSystemTimeAsFileTime
0x1800100b8 InitializeSListHead
0x1800100c0 RtlCaptureContext
0x1800100c8 RtlLookupFunctionEntry
0x1800100d0 RtlVirtualUnwind
0x1800100d8 IsDebuggerPresent
0x1800100e0 UnhandledExceptionFilter
0x1800100f0 GetStartupInfoW
0x180010100 GetModuleHandleW
0x180010108 RtlUnwindEx
0x180010110 InterlockedFlushSList
0x180010118 SetLastError
0x180010120 DeleteCriticalSection
0x180010130 TlsAlloc
0x180010138 TlsGetValue
0x180010140 TlsSetValue
0x180010148 TlsFree
0x180010150 FreeLibrary
0x180010158 GetProcAddress
0x180010160 LoadLibraryExW
0x180010168 GetCurrentProcess
0x180010170 ExitProcess
0x180010178 TerminateProcess
0x180010180 GetModuleHandleExW
0x180010188 GetModuleFileNameA
0x180010190 MultiByteToWideChar
0x180010198 WideCharToMultiByte
0x1800101a0 HeapFree
0x1800101a8 HeapAlloc
0x1800101b0 LCMapStringW
0x1800101b8 FindFirstFileExA
0x1800101c0 IsValidCodePage
0x1800101c8 GetACP
0x1800101d0 GetOEMCP
0x1800101d8 GetCPInfo
0x1800101e0 GetCommandLineA
0x1800101e8 GetCommandLineW
0x1800101f0 GetEnvironmentStringsW
0x1800101f8 FreeEnvironmentStringsW
0x180010200 GetProcessHeap
0x180010208 GetStdHandle
0x180010210 GetFileType
0x180010218 GetStringTypeW
0x180010220 HeapReAlloc
0x180010228 HeapSize
0x180010230 SetStdHandle
0x180010238 RaiseException
0x180010240 WriteFile
0x180010248 FlushFileBuffers
0x180010250 GetConsoleCP
0x180010258 GetConsoleMode
0x180010260 SetFilePointerEx
0x180010268 WriteConsoleW
0x180010270 CreateFileW

Exports

Ordinal Address Name
1 0x18000f1b4 DllRegisterServer
!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.gfids
@.rsrc
@.reloc
SUVWATAUAVAWH
A_A^A]A\_^][
x ATAVAWH
3B$5pw
@A_A^A\
@SUVWATAUAVAWH
HA_A^A]A\_^][
x ATAVAWH
\$ A_A^A\
S,9P0t3E+
WATAUAVAWH
0A_A^A]A\_
WAVAWH
0A_A^_
WAVAWH
A_A^_
WATAUAVAWH
CX#H4D3
A_A^A]A\_
K WATAUAVAWH
A_A^A]A\_
@SUVWATAUAVAWH
8A_A^A]A\_^][
@SUVWATAUAVAWH
LF#H5k
HA_A^A]A\_^][
t$ WATAUAVAWH
HcD$xMc
A_A^A]A\_
|$ AVH
H3E H3E
WATAUAVAWH
A_A^A]A\_
ffffff
WATAUAVAWH
A_A^A]A\_
SVWAWH
L$PHc|$TI
(A__^[
(A__^[
SUVWATAUAVAWH
8A_A^A]A\_^][
u3HcH<H
x ATAVAWH
A_A^A\
UVWAVAWH
0A_A^_^]
WAVAWH
A86taH
0A_A^_
L$ WATAUAVAWH
@A_A^A]A\_
x ATAVAWH
A_A^A\
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
`A_A^A]A\_^]
x ATAVAWH
0A_A^A\
\$ UVWAVAWH
A_A^_^]
@8|$^t
l$ VWATAVAWH
L$&@8t$&t0@8q
A81t@@8r
A_A^A\_^
fD94Fu
fD9t$b
SVWATAUAWH
HA_A]A\_^[
D82u&H
D8t$Ht
USVWAVH
A^_^[]
l$ WAVAWH
A_A^_
@UATAVH
@UATAUAVAWH
e0A_A^A]A\]
@UATAUAVAWH
H!T$0D
uf!T$(H!T$
A_A^A]A\]
WAVAWH
@A_A^_
UVWATAUAVAWH
A_A^A]A\_^]
VWATAVAW
A_A^A\_^
WATAUAVAWH
A_A^A]A\_
\$ UVWATAUAVAWH
H!D$ E
`A_A^A]A\_^]
ffffff
fffffff
LcA<E3
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
`A_A^A]A\_^]
x AUAVAWH
0A_A^A]
A3@hD;
A\1A4H
x AUAVAWH
@A_A^A]
WATAUAVAWH
A_A^A]A\_
WAVAWH
@A_A^_
pantomime
wars; nickname, intervention; spreading
require
meeting
camp topple. contradict, substantial leak
graphic# OK. did; forgery, dignified. iso; conduct# epidemic. inherited
unload, poems, crash; recollect. sterile# saddle
faster. edition tumbled lee bully. go myself, grew. once
repeatedly
flew; completed
fuss# rpm
login. if. administrator, thankful
loud; altitude hermione, traced
consider trips meat. loud headless forgot geoffrey, assisted horizontal;
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
[truncated strftime output]
CorExitProcess
GetCurrentPackageId
LCMapStringEx
LocaleNameToLCID
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
UUUUUU
UUUUUU
=imb;D
/>58d%
VM>cQ6
>jtm}S
)>6{1n
+f)>0'
;H9>&X
*StO9>T
n03>Pu
K~Je#>!
bp(=>?g
BC?>6t9^
K&>.yC
.xJ>Hf
y\PD>!
|b=})>
c [1>H'
uzKs@>
3>N;kU
kE>fvw
V6E>`"(5
?UUUUUU
?7zQ6$
utpcxre663tc32.dll
DllRegisterServer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GetLastError
GetCurrentActCtx
HeapCreate
TryEnterCriticalSection
CreateThread
OpenThread
FindFirstFileA
FindNextFileA
FindClose
WaitForSingleObject
WaitForMultipleObjects
GetCurrentThread
CreateFileMappingA
VirtualAlloc
DuplicateHandle
KERNEL32.dll
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
FindFirstFileExA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapReAlloc
HeapSize
SetStdHandle
RaiseException
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CreateFileW
SbSaf~s
h7;4GtBJ<.]
`g`tLMM
*9Q(o{
NK2$z\q
e8x:^t
iCPiS
ko2p4
mT);.&
}M6?3T
1~<Ir|
z 4c#7
c\MZCie?
1Fs&Nif
Jg!"&)
QAHUy>m
pLZ].\
j+>5;+=
."<KE3J
JX@$]~
'_zX~}g)n8
J.k>l*v
}ImZL$
).`}P|
Z`AhtQL
6sGlCj
ao6h5\!
WoOioo;{
x{RdY
x]}%DO
VrL:tE
fRd~8YN
}|@Ik2tq/u
MRpm,Ki;
4R"siU@
lWxYuwZ
s;Va"S7
SuCVvO
L 'BTmpO
m~4{t5
!ROn"h
$|e^4_L
dW/)8(sm
E\]7s;G?
*RI#Bjaps
(4FcWNI
K#UR(
T:\r>0
Z+dgJ&
O GW^p2s
+sDFwf
YVh~K
l,{G*
pYhG("
):!rzH
GJWsom
*i8>?]
X)w+)=
|YXB R
tJ4Yzk
FA^$HQ'
HBN+*"
\mH>->&H
S,CciP0$.Q
M=&K`C4
P#CUgJ
=/\sJ"gt
Yt5l&^
v7!P_d-
Ub(a]J
>/2a5y9/^
`M|K w
h(OfemJk
.<{?TqUh'~
ZIfM)o
k)Y|Ez
G,A&H1
J[8Mcsg
<?jO (
1QrP7l
X;xSWI
LS}E&+
E,"dj.
_0hAB-
c7Lme[
-a@FU!#
,HVuc?VnG
3;n"B
?&nN"\
59n,?7
bA/`GE
'W'h*
F[A'Fnz
> GoDR
zLv/lD
D;$_1yI
Go5h7+
ffv}e
(Z`Aa$}=U
?9OF9
2dy]EL
CLAT,e)
MCD\cB=
S_i\X9
BsSe;N
Fb8B8/q
U2<Q7`Ss
7WoD!\u
#kG{g%
\KT~>&
0#SO%
"`M+*z
9-Av~K
mCIO9WH*
OrVRv:A0
IQQ"PI
T0=xA09
BM^IKI
#cg!(uS
g<Foa;%
\7C45[O
.X >wecj
::'4U.M
&l2W=g(
l$$TmUd;
Jc\*C@
<*$fh=
>u\w4rN:
w<Vj@`
.Clkx<
9Or{0b
7;21Zk.m3
xAX(:qfM
dr!?V*&
p!$,w2
GZbqWf
"9S36Ag
X/T4@
y@isb
YYSFj)
\2`5y>
SG+R(|*
-*t|=Y
yic(U_
yja;{VE
=nX@v
j9?I{$2[
O|G~02
_kJ},0
x@ty_L3w
,WO<IAq0c
ef?W'xHsA
7a7=)*
1m[e5^Z
\w#)oqSP
d+O9F
GA/e)oh@'
N }eC8
11qz3*
q".]d
AD4Yz8_+G
`Q(-<w
8=JUg
:ud:$A0
`;?b1#K
>mZPL"
"D$x.
NCO5F9
cx2!QZ
V_Jk_y
QRR{*;
"FBS;S
^@holf
(*|SlW0
RS5LOG
"e>#cl
RD^d"u)
^!Ei=>J
)d+rFs
b1P%T?
@ZCI43
>;hR8d2
<>dHiwvyh
Ik%SBke[S
4"Fr&S
%y>"ZE,:P
";>.ic]
%\[l:!
m(XqV83
hUOS.s
uL~Tc0
B0LHQ27aHC;g
Ldblt@
^*FmL&%
3q&n1'F
$#6FIT
,hfbVI P
iKDYg;d
%V(lm@
)DFcWrH
zN#*sbcn!)
oeS cn4.
t1+F;m
%+VHgp
a "E)<
a,*\ag
Q4KTcc]
MHINMX
\m.c?!Q
Y9<e{Y
Q/]i:A
&{1X:\{
$;S0AY
:lc``x19f
9U++1?
u}i-GI
0Y2/T;q
k*2,dMl
GEE:=/
Jfg^d8^
SSIo&P6
HJm[be'
hDss'\
]._X]E@
_$D(eA
A?FOTM;
{O^__M4
,*{/a'<&k
D[\"X8
897YF1
3b<4;i
Q%Cgt!1
vY6\4N
"BGSi|kx
"@/to=6
PvJ~7R
0-g3#Zw
2MrAfpjQ":VKLq
<L-$ob
MwJ4$*3
2t+g"(h
HF#=_1/r
7\AR>N
3L8U^vD
&<+4ONYX
2i,ol~
c1biTP
'Klv2U
9999999
99999999999999999
999999999
999999999999
9w999999999w9
99999w99w
99999999999w99w999999w
999ww9w9999999w999
999999
999999
99999wW
999999$9999
99w9999@9
99999999
w99999
999w999w999999
#99999999w9999
99w9999999
9999999ww
999999
ww99999
999999999999
99999999999w9999999999w99999
999ww999999999999999999999
99999999
w9999w999999999
99999w9w99999999999
9999999w9999
9w999999999999999
99999999w99
w99999999w99999999
999999999w9999999
9999999999999999999999999w999999999999
9999999999999w9999
99999w9w999999999999999w99999
99w99999999999w9999w9999999999999
999999999
999999w99999999999w
9999999999999999999w99
9999999999999w
999999999
w9999V99999999999
99999w999999999
9999w999999w99999999
999999w99999999
99999999999ww99
99999999999999
99999w9999
9999\9
9w9999
999999999999w999999999w999w99999999w99999
999999999
ww9999999w99999w9
ww9999999
9V9999w999w
999999999999999
9999w99
w9999999
99999w9
999999
999999
9999999w9
99999999999999999
999999999999999
999999999999w9
999w99
999999999999
999999
99w9ww9999999999
999w9999w
999999w9999
999w99999
999999w99
99w9999w9999999
99999999999w99999w9w99999999
9w9999w99999999999
9w9999
99999999
999w99999
9w999999999
99999999
9wW9999
9999w9w999w9w9999w9
9w999999999w999999999999w
w99w99
w9999999ww99w9
99999999999999
999999999999999
999w99w9999999999ww
99ww9999w
999999999999999999999999
99999w9999
99999999999999999V9w9999w
99999w9999
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
varieties_ Chris Reply_ Remembered wept
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
advapi32
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
mscoree.dll
api-ms-win-appmodel-runtime-l1-1-1
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l2-1-1
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-kernel32-package-current-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
user32
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
Haughty 695 974@ Affections
476+ 643$
tOppressive( %sClip condescending 652)
Inevitable Educational\
Einteger? %s Director) Performed 142 Wallpaper Superstition. consulate
haste 447 Unmoved_
%d %s Hereafter/ 143/ 195
%d 641! Moscow Detached
.Harderflint Popular Listened? mental Compelled
Alec compare Echo+ dip- %d Tales) Proceedingsickly_
arrested_ Beehive burn Fuel
9%d identical_ Cost? Puddle Despair Servant@ %d$ machinery
knocked 439, Careers 599.
Madame 419 492 515@
213, Newspapers climate@ Spur
%d %s\ 207$ 871( blond acorn
Antivirus Signature
Bkav W32.AIDetectMalware.64
Lionic Clean
tehtris Clean
MicroWorld-eScan Clean
ClamAV Clean
FireEye Generic.mg.e4919447b9ea5c4f
CAT-QuickHeal Clean
McAfee Clean
Malwarebytes Clean
VIPRE Clean
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Clean
K7GW Clean
K7AntiVirus Clean
BitDefenderTheta Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Injector.NO
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
TACHYON Clean
Sophos Clean
Baidu Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win64.MultiPlug.th
Trapmine Clean
CMC Clean
Emsisoft Clean
SentinelOne Clean
GData Clean
Jiangmin Clean
Webroot Clean
Avira Clean
Antiy-AVL Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Clean
Google Clean
AhnLab-V3 Clean
Acronis suspicious
VBA32 Clean
ALYac Clean
MAX Clean
DeepInstinct MALICIOUS
Cylance Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
AVG InjectorX-gen [Trj]
Avast InjectorX-gen [Trj]
No IRMA results available.