Static | ZeroBOX

PE Compile Time

2023-09-16 20:59:37

PE Imphash

d0d523c12097b517245d838376423429

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000105df 0x00010600 6.90764983281
.rdata 0x00012000 0x0000363a 0x00003800 5.32204976613
.data 0x00016000 0x00001c5c 0x00001200 3.58618322553
.reloc 0x00018000 0x0000004e 0x00000200 1.36531262138
.rsrc 0x00019000 0x00019ca8 0x00019e00 6.16475805888

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x000194a8 0x00019800 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x000190a0 0x00000408 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library KERNEL32.dll:
0x41200c lstrlenW
0x412010 VirtualProtect
0x412014 GetProcAddress
0x412018 LoadLibraryA
0x41201c VirtualAlloc
0x412020 LockResource
0x412024 LoadResource
0x412028 CreateThread
0x41202c FindResourceW
0x412030 GetModuleHandleW
0x412034 GetLastError
0x412038 CreateMutexA
0x41203c GetModuleHandleA
0x412040 FreeConsole
0x412044 Sleep
0x412048 SizeofResource
0x41204c WaitForSingleObject
0x412050 RtlUnwind
0x412054 RaiseException
0x412058 GetCommandLineA
0x41205c TlsGetValue
0x412060 TlsAlloc
0x412064 TlsSetValue
0x412068 TlsFree
0x412070 SetLastError
0x412074 GetCurrentThreadId
0x41207c HeapFree
0x412080 HeapAlloc
0x412084 TerminateProcess
0x412088 GetCurrentProcess
0x412094 IsDebuggerPresent
0x412098 ExitProcess
0x41209c WriteFile
0x4120a0 GetStdHandle
0x4120a4 GetModuleFileNameA
0x4120b4 WideCharToMultiByte
0x4120bc SetHandleCount
0x4120c0 GetFileType
0x4120c4 GetStartupInfoA
0x4120cc HeapCreate
0x4120d0 VirtualFree
0x4120d8 GetTickCount
0x4120dc GetCurrentProcessId
0x4120e4 GetCPInfo
0x4120e8 GetACP
0x4120ec GetOEMCP
0x4120f0 IsValidCodePage
0x4120fc HeapReAlloc
0x412100 HeapSize
0x412108 LCMapStringA
0x41210c MultiByteToWideChar
0x412110 LCMapStringW
0x412114 GetStringTypeA
0x412118 GetStringTypeW
0x41211c GetLocaleInfoA
Library COMDLG32.dll:
0x412000 GetSaveFileNameA
0x412004 GetOpenFileNameA

!This program cannot be run in DOS mode.
`.rdata
@.data
.reloc
"Q*N*C
*K`B|*Q*N*9
6|!!!c
`a3*9`J
{!!!c@!!!
*9*7*J`K,*3*3`B
Y`S?*J
_:!!!c
fb!!!i
SC!!!g
!!!*2`K
[}!!!g
!!!*N`[[
S8!!!`V
!!!`OH*7`F
2H!!!*F*F`^
*I*G`Wr`F
*J*O`R
*6`Zt`W
!!!*K*3
6e!!!*3
B!!!*J`[I*G`C9*9f>!!!
Ae1"!!!!6
3s!!!*C
`N>`Gb
`Cb*B*K*2
*6*6`G
i !!!8
d1e1"!
e1"!!!!6
d1e1"!
i!!!8
3&!!!`[
W`BX*2
F@!!!*N
!!!`Ws
*3*C*N*C
Ch!!!*3`Bj`F
*6`BF`N(*K`G
O!!!c:!!!
>!!!`a
n!!!fQ!!!*2PI
*F*3`J
*6*2*2`a
*J*C*B`I
!!!*2*K*N
`V7*6*B
6X!!!c4!!!b
`R$*O`[
"Q*O*7`Y&*J`ae
R*7*F`Z2*Ng
*B*Q*F
\!!!*O`K
*3*B`Y
!!!*K*I*2
V-!!!`Ck*G`V
`^9*Q*9
!!!*3*3`Y
!!!*Q`J
Ee1"!!!!6
!!!cn!!!*Bi
[t!!!*3
&!!!`B
FH!!!*O`O%`B
*2*I*O
Qe1"!!!!
ae1"!!!!6
!!!`I\
R*G`Q/
7V!!!`RB
`G5*F`Q9
^S!!!`[
6i!!!*7
[e!!!g
;s!!!*N
*6`Sk`G
[Z!!!`N
!!!*K`IO
FJ!!!*3*6
!!!`CG
6T!!!`Y
:@!!!`Q
gP!!!*2bv!!!
G.!!!`[q
ee1"!!!!6
die1"!
ue1"!!!!6
dye1"!
"""8n#""
e1"!!!!6
e1"!!!
!8K#""
BY!!!*9*K`Q4*F
C[!!!g=!!!*6
S!!!*9
6i!!!*G
*C*3`Q
!!!*C`Q#
W[!!!*N
^G!!!*6*Ic
R.!!!`S
W6!!!*I
!!!`^9
*3*2`V
!!!`Rf
`N8bW!!!`a?`C
c)!!!*9`I
*N`WL*Q`_
!!!`^}*3*6
d1"*9`^
!!!*K`a
fh!!!`C_
*Q*G`VR
*B*B`We
VU!!!*Q
`Sa`NK
!!!*Ib
:*!!!*Q*K*G
*2*2`W
3H!!!`B1
*Bft!!!
*B*K*7`Bn*6
Vl!!!*7
*B*N*B`a
*B`CPf
!!!bp!!!*F
CC!!!cz!!!
W*9b5!!!
2y!!!`S~`G
!!!*6*3gU!!!`R
[b!!!`Oi
!!!`SE
F6!!!*C
^2!!!*Ii1!!!
:h!!!h
g9!!!!
>z!!!`N
*J`Rw`Y5*6
`W|*9`F
`az*3*Qc
!!!`I!
*Q*9*CfQ!!!*F*C
*G*F*I*G`K
`[N*G*6
p!!!`B
W`Yl*I
71!!!`V
C`!!!*6`S
V*G*K`KGcX!!!*7*O`O
iw!!!*7*7*O
*B`Jy*C*K*Q*9i
i!!!i<!!!`R
`Vb*N*9i
W*!!!*7`Y
[*O`G
i!!!`Y
:+!!!*B
!!!*2fE!!!
BL!!!*F
RC!!!*F*O*I`I
*G*O`Bu
*K*C*3`a
^UUUUUUUUUUUUUUUU
QQSVWd
0WWWWW
0WWWWW
_VVVVV
^WWWWW
j,h`LA
HtHu4j
s[S;7|G;w
tR99u2
0SSSSS
>=Yt1j
jTh0NA
j@j ^V
0A@@Ju
0SSSSS
_VVVVV
;t$,v-
UQPXY]Y[
URPQQh
0SSSSS
0SSSSS
t"SS9]
v$;5$lA
PPPPPPPP
PPPPPPPP
<+t(<-t$:
+t HHt
t+WWVPV
bad allocation
ouqepbqgrrlwgrtvtworwlrzjyovleksdliqhhpitsakcsytwgqxgurftvbwcaeafxgruaoavsgcbtcjfzsvtkirjwainfne
sfjrdmzfjktyzmnnkyzebyjehtveifrhtjhiqvmwffzrvzf
sfjrdmzfjktyzmnnkyzebyjehtveifrhtjhiqvmwffzrvzf
sfjrdmzfjktyzmnnkyzebyjehtveifrhtjhiqvmwffzrvzf
amtgjozsgqockshzkocxyhpnxcbubhauydxaiyqaiatngrekfiyifcfsolhuiwzkupnxtqswjhybsqdsrlqo
iiqdsbezrpuordlqjeeelqaaxiiyytqxqqmcx
amtgjozsgqockshzkocxyhpnxcbubhauydxaiyqaiatngrekfiyifcfsolhuiwzkupnxtqswjhybsqdsrlqo
amtgjozsgqockshzkocxyhpnxcbubhauydxaiyqaiatngrekfiyifcfsolhuiwzkupnxtqswjhybsqdsrlqo
twmxeziltjdynnovjaavkktkwwqbmgttnarxmhhnojhbvfyncxwhhprmxppkulmcyetbrricxxxiimuqrkofffaoedb
nwqbzjzpclbzkrckecmdcnuioxblrsmdyvyftosn
rscuuvkglaqrjgwbjkhtcjdaooabibrmiojiwlcnupfpmgcmobmvoipqkewkwk
khsdxn
rscuuvkglaqrjgwbjkhtcjdaooabibrmiojiwlcnupfpmgcmobmvoipqkewkwk
rscuuvkglaqrjgwbjkhtcjdaooabibrmiojiwlcnupfpmgcmobmvoipqkewkwk
sknxcurbiinfwunteplevozuazntzmaribkohrwvxcfwpxhsusdlinaajadmlfuxpvvou
nyafmlzblfxgabwwgsdouoqaisozvuukeasdwqigqtexbsbjuokybjhwziomxzjgmlwjytvxbavibvlzqdkjpjxemyp
vghammgsxxxltxedpkeiffiysasit
vghammgsxxxltxedpkeiffiysasit
vghammgsxxxltxedpkeiffiysasit
ihuehptsvfosdmrlplcmhzxklxxsoiutwjybqrbztbibsfuhfoswqefpjqv
htongbciynxanprrmisurejrisnugflvppsadwylacfttnnkeictgyzjaz
gypdcyhmrjheqwajtvujgvduzab
ysymwtnbnjxzbhkjhctnpdawrupzybdpw
xnxder
beiflqobyosjfppgjrwrlatrdsrvrqqlqsxywcxposysyqqezuyqjkoynialtwrgkisyvzgzmfoyvslhidjynfztwrxzuhege
ibpqrkuankzovvrrlzjodlcsxxwbtqjsieiwkwkkfisgdmcgvqqooiaqknjktpgqbebcwbywbotswzueyuutmruczzulfbxzrz
wwqnqibrxuyytmsysxvwyjegizcoczieiyqzxxcdfcumcuzvwn
tzbsqvjhkysxwmieahbbaeyzndtdonnpiveaabbcayedwnjgawhwfxluolktnzkifeheeekflvebozcvrzxiotvrlhjnj
glbssspmlrzzbnzbupygwganpgurxbcvc
dlnjtdvadjbwxxbltdtsfuuxkfcfliyokoqfkzfvuyvblrispifhgjgspfvjplna
jzbwkgvfebgxsoffikycysljpctdbjkshsizyiynabwpmbnzhywzaiaoljagafcpotsfgdkrgjmf
grjntidialsyjbprbgvkrhdwqrpfaxxkbkubjyicxsklnxwieyzfxcpkaeobguyznljpjypaqiieqvxnxryzrunjz
egxndnjbisryrmvhqygmeojmvkthppildyhakrn
ckypbfzxbuutrepjrocvjycutnjafpsidignmhdqjsznier
ajiweoqqomlztvxjcwqctcctamxrwjhzmyle
bad allocation
string too long
invalid string position
Unknown exception
GAIsProcessorFeaturePresent
KERNEL32
bad exception
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
1#QNAN
1#SNAN
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
WaitForSingleObject
CreateThread
lstrlenW
VirtualProtect
GetProcAddress
LoadLibraryA
VirtualAlloc
LockResource
LoadResource
SizeofResource
FindResourceW
GetModuleHandleW
GetLastError
CreateMutexA
GetModuleHandleA
FreeConsole
KERNEL32.dll
GetSaveFileNameA
GetOpenFileNameA
COMDLG32.dll
RtlUnwind
RaiseException
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
kernel32.dll
7CzVlwcdoDpEnBXAC8lfMSirKzPYOhQ1rM6uRJ5jUH4hZMBVe4TUd0G0NpUk%
gehpevj
tviihc
~}vutsrqponmlkjihgfedcba`_^]
~}vutsrqponmlkjihgfedcba`_^]
~}vutsrqponmlkjihgfedcba`_^]
~}vutsrqponmlkjihgfedcba`_^]
~}vutsrqponmlkjihgfedcba`_^]
~}vutsrqponmlkjihgfedcba`_^]
~}vutsrqponmlkjihgfedcba`_^]
gsinm~klh_
_c^uta
o}`^h~
frkvku
cqkpc^
_qjjgs
rl^cql
`jfskv
`jfskv
`jfskv
`jfskv
`jfskvrv
`jfskv
nd}kvh~
afgh__}
pskfgv
orkvj^c~
bnv_`_^
qa`evn
r_sp^h~
bdcevknv
}rvkvis
dbttrddqbk
hhcuvkk
rsrevcnhi
bdcevknv
~}vutsrqponmlkjihgfedcba`_^]
~}vutsrqponmlkjihgfedcba`_^]
kviphkkri
tricbe^
kvipbvpr
grenhsntvk
gbukndors
nkknvj
nkknvjd
kviphkkri
jrjtjg
jvkkht
dcekri
jrjdrc
dcetvc
jrjtg^
vcr_nc
dcechlxd
jdatec
kdcetvc
KERNEL32.DLL
mscoree.dll
((((( H
h(((( H
H
VS_VERSION_INFO
StringFileInfo
040904E4
Comments
Thinner flubbed
CompanyName
Turncoats pundits muslim
FileDescription
Willing loses
FileVersion
1.311.42.5
InternalName
Rakish
LegalCopyright
Copyright
Formatted deputy knickers enraged erosive
LegalTrademarks
Trepidation internally furriers freed outhouses sourness
OriginalFilename
Mashed conga
ProductName
Digression beeps
ProductVersion
1.311.42.5
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stealerc.4!c
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan Gen:Variant.Midie.130088
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
McAfee Artemis!A7BE047E27CF
Malwarebytes Malware.AI.752785794
VIPRE Gen:Variant.Babar.131148
Sangfor Trojan.Win32.Kryptik.Vymw
K7AntiVirus Clean
BitDefender Gen:Variant.Midie.130088
K7GW Clean
Cybereason malicious.b434be
BitDefenderTheta Gen:NN.ZexaF.36662.lu0@aazwPxdi
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/Kryptik.HSYN
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/Kryptik.9a109a29
NANO-Antivirus Clean
ViRobot Clean
Rising Backdoor.Agent!8.C5D (TFE:5:e4duRlO0FPI)
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Trojan.Win32.SMOKELOADER.YXDIQZ
McAfee-GW-Edition BehavesLike.Win32.Worm.ch
Trapmine malicious.high.ml.score
FireEye Generic.mg.a7be047e27cfe019
Emsisoft Gen:Variant.Midie.130088 (B)
Ikarus Trojan.Agent
Jiangmin Trojan.PSW.Reline.afc
Webroot Clean
Avira Clean
Antiy-AVL Clean
Microsoft Trojan:Win32/Vidar.ASAF!MTB
Gridinsoft Ransom.Win32.Sabsik.sa
Xcitium Clean
Arcabit Trojan.Babar.D2004C
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Gen:Variant.Midie.130088
Google Detected
AhnLab-V3 Clean
Acronis Clean
VBA32 Clean
ALYac Gen:Variant.Babar.131148
MAX malware (ai score=83)
DeepInstinct MALICIOUS
Cylance unsafe
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0CIG23
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet Clean
AVG Win32:PWSX-gen [Trj]
Avast Win32:PWSX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.