Static | ZeroBOX

PE Compile Time

2023-06-25 06:27:57

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x000095c4 0x00009600 5.68228669785
.rsrc 0x0000c000 0x000004e0 0x00000600 3.70890204221
.reloc 0x0000e000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0000c0a0 0x0000024c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0000c2f0 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
<Module>
mscorlib
Microsoft.VisualBasic
MyApplication
MyComputer
MyProject
MyWebServices
ThreadSafeObjectProvider`1
Settings
ClientSocket
Messages
Helper
RemoteDesktop
AppendOutputTextDelegate
Microsoft.VisualBasic.ApplicationServices
ApplicationBase
Microsoft.VisualBasic.Devices
Computer
System
Object
.cctor
get_Computer
m_ComputerObjectProvider
get_Application
m_AppObjectProvider
get_User
m_UserObjectProvider
get_WebServices
m_MyWebServicesObjectProvider
Application
WebServices
Equals
GetHashCode
GetType
ToString
Create__Instance__
instance
Dispose__Instance__
get_GetInstance
m_ThreadStaticValue
GetInstance
uploader
nameee
Mutexx
System.Threading
_appMutex
System.Timers
dTimer2
doshost
dosport
dostype
dosstu
isConnected
System.Net.Sockets
Socket
BufferLength
Buffer
System.IO
MemoryStream
BeginConnect
IAsyncResult
BeginReceive
BeginRead
EndSend
isDisconnected
System.Diagnostics
Process
_MyProcess
get_MyProcess
set_MyProcess
WithEventsValue
processid
AppendOutputText
DataReceivedEventArgs
MyProcess_ErrorDataReceived
sender
MyProcess_OutputDataReceived
mouse_event
dwFlags
cButtons
dwExtraInfo
user32
keybd_event
System.Drawing
Bitmap
compress
STOBS64
capCreateCaptureWindowA
lpszWindowName
dwStyle
nWidth
nHeight
hwndParent
Handle
capGetDriverDescriptionA
wDriver
lpszName
cbName
lpszVer
getFolders
location
getFiles
getDrives
Download
MyProcess
GetHashT
strToHash
frombase64
Plugin
AES_Encryptor
AES_Decryptor
INDATE
Antivirus
CreateMutex
CloseMutex
ElapsedEventArgs
tickees
Capture
System.Drawing.Imaging
ImageCodecInfo
ImageFormat
GetEncoderInfo
format
MulticastDelegate
TargetObject
TargetMethod
AsyncCallback
BeginInvoke
DelegateCallback
DelegateAsyncState
EndInvoke
DelegateAsyncResult
Invoke
System.ComponentModel
EditorBrowsableAttribute
EditorBrowsableState
System.CodeDom.Compiler
GeneratedCodeAttribute
DebuggerHiddenAttribute
Microsoft.VisualBasic.CompilerServices
StandardModuleAttribute
HideModuleNameAttribute
System.ComponentModel.Design
HelpKeywordAttribute
System.Runtime.CompilerServices
RuntimeHelpers
GetObjectValue
RuntimeTypeHandle
GetTypeFromHandle
Activator
CreateInstance
MyGroupCollectionAttribute
System.Runtime.InteropServices
ComVisibleAttribute
ThreadStaticAttribute
CompilerGeneratedAttribute
System.Windows.Forms
get_ExecutablePath
Thread
FileInfo
Exception
ProjectData
EndApp
Environment
SpecialFolder
GetFolderPath
GetFileName
String
Concat
Exists
FileSystemInfo
FileAttributes
set_Attributes
SetProjectError
ClearProjectError
ElapsedEventHandler
add_Elapsed
ThreadStart
STAThreadAttribute
VB$AnonymousDelegate_0
_Lambda$__1
_Lambda$__2
DebuggerDisplayAttribute
DebuggerStepThroughAttribute
Collect
ComputerInfo
get_UserName
get_OSFullName
Replace
OperatingSystem
get_OSVersion
get_ServicePack
get_Is64BitOperatingSystem
Boolean
EndReceive
ToArray
Conversions
ToLong
Stream
Dispose
SocketFlags
WriteByte
get_Length
WaitCallback
ThreadPool
QueueUserWorkItem
SelectMode
IDisposable
get_Connected
WaitForPendingFinalizers
AddressFamily
SocketType
ProtocolType
set_ReceiveBufferSize
set_SendBufferSize
ToInteger
Connect
_Closure$__1
$VB$Local_A
_Lambda$__3
_Lambda$__4
_Lambda$__5
_Lambda$__6
GetTempPath
DataReceivedEventHandler
remove_ErrorDataReceived
remove_OutputDataReceived
add_ErrorDataReceived
add_OutputDataReceived
Operators
AddObject
get_Data
System.Net
WebClient
StreamWriter
FileAttribute
Rectangle
ProcessStartInfo
DateTime
System.Collections
IEnumerator
Strings
CompareMethod
CompareString
Restart
SocketShutdown
Shutdown
NewLateBinding
LateCall
ChangeType
Screen
get_PrimaryScreen
get_Bounds
get_Size
ConcatenateObject
LateGet
Cursor
set_Position
Convert
ToBoolean
ToByte
UIntPtr
GetTempFileName
DownloadFile
Interaction
CreateObject
LateSet
AppWinStyle
ToInt32
set_Interval
get_StartInfo
set_FileName
set_Arguments
set_UseShellExecute
set_RedirectStandardError
set_RedirectStandardOutput
set_CreateNoWindow
WaitForExit
set_RedirectStandardInput
get_Id
BeginErrorReadLine
BeginOutputReadLine
get_StartTime
get_StandardInput
TextWriter
WriteLine
GetProcesses
get_ProcessName
GetFileNameWithoutExtension
ProcessModule
get_MainModule
get_FileName
GetExtension
GetCurrentProcess
GetProcessById
Delete
Directory
ServerComputer
Microsoft.VisualBasic.MyServices
FileSystemProxy
get_FileSystem
RenameDirectory
RenameFile
ReadAllText
FromFile
Monitor
FileSystem
SetAttr
CreateDirectory
FileStream
Create
ReadAllBytes
ToBase64String
FromBase64String
WriteAllBytes
CopyDirectory
MoveDirectory
IEnumerable
GetEnumerator
get_Current
MoveNext
Network
get_Network
MessageBox
DialogResult
UploadFile
Environ
ImageConverter
Encoder
EncoderParameter
EncoderParameters
Quality
get_Param
get_Jpeg
FromStream
TypeConverter
ConvertTo
System.Text
Encoding
get_UTF8
GetBytes
DirectoryInfo
GetDirectories
get_Name
GetFiles
DriveInfo
System.Collections.Generic
IEnumerator`1
DriveType
System.Collections.ObjectModel
ReadOnlyCollection`1
get_Drives
get_DriveType
DllImportAttribute
avicap32.dll
MarshalAsAttribute
UnmanagedType
user32.dll
AccessedThroughPropertyAttribute
get_Default
GetString
get_ProcessorCount
get_MachineName
get_SystemDirectory
GetPathRoot
get_TotalSize
System.Security.Cryptography
MD5CryptoServiceProvider
StringBuilder
get_ASCII
HashAlgorithm
ComputeHash
Append
Substring
ToUpper
System.Reflection
Module
Assembly
GetModules
GetTypes
get_FullName
EndsWith
get_Assembly
RijndaelManaged
ICryptoTransform
SymmetricAlgorithm
set_Key
CipherMode
set_Mode
CreateEncryptor
TransformFinalBlock
CreateDecryptor
get_LastWriteTime
System.Security.Principal
WindowsIdentity
GetCurrent
WindowsPrincipal
WindowsBuiltInRole
System.Management
ManagementObjectSearcher
ManagementBaseObject
ManagementObjectCollection
ManagementObjectEnumerator
get_Item
WaitHandle
UdpClient
Random
IPAddress
IPEndPoint
EndPoint
Graphics
get_Width
get_Height
FromImage
System.Drawing.Drawing2D
CompositingQuality
set_CompositingQuality
CopyPixelOperation
CopyFromScreen
get_Position
Cursors
GraphicsUnit
DrawImage
GetImageEncoders
get_FormatID
get_Guid
op_Equality
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
winlogin
winlogin.exe
MyTemplate
14.0.0.0
My.Computer
My.Application
My.User
My.WebServices
4System.Web.Services.Protocols.SoapHttpClientProtocol
Create__Instance__
Dispose__Instance__
<generated method>
<generated method>
MyProcess
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
180.ip.ply.gg
http://exmple.com/Uploader.php
USB.exe
<123456789>
<Xwormmm>
QWgaicbZP6H1puz7
Microsoft
Service Pack
XWorm V2.1
XKlog.txt
Error:
uninstall
update
Height
getinfo
openhide
internetexplorer.application
navigate
visible
shellfuc
regfuc
WScript.Shell
RegWrite
REG_DWORD
RunBotKiller
calluac
script
Cilpper
injRun
startusb
PSleep
taskkill.exe
/pid
CMD.EXE
Process Started at:
runnnnnn
closeshell
GetText
setText
clearr
BScreen
GetDrives
FileManager
Delete
Folder
Execute
Rename
txtttt
viewimage
hidefolderfile
showfolderfile
creatnewfolder
creatfile
downloadfile
downloadedfile
sendfileto
install
NETINS
7zip\7z.exe
InsProg
JustFun
Wsound
BLOCK!
GETTCP
GetActiveWindows
killAct
InstallN
InstallngC
\ngrok.exe
Getpass
Pvbnet
Emails
Error!
LLCHAT
[Folder]
FileManagerSplitFileManagerSplit
FileManagerSplit
[Drive]
Memory
Clipper
startsp
PreventSleep
Err HWID
Class1
dd/MM/yyy
IsInRole
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
0.0.0.0
InternalName
winlogin.exe
LegalCopyright
OriginalFilename
winlogin.exe
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Witch.4!c
tehtris Clean
DrWeb Trojan.Siggen18.62195
ClamAV Win.Infostealer.XWorm-9941708-0
CMC Clean
CAT-QuickHeal Trojan.Generic.TRFH521
ALYac Trojan.GenericKD.68085143
Malwarebytes Generic.Trojan.MSIL.DDS
VIPRE Trojan.GenericKD.68085143
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 700000121 )
BitDefender Trojan.GenericKD.68085143
K7GW Trojan ( 700000121 )
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZemsilF.36662.cm0@amrAW5j
VirIT Trojan.Win32.Genus.SOZ
Cyren W32/MSIL_Agent.CDE.gen!Eldorado
Symantec Trojan Horse
Elastic Windows.Trojan.Xworm
ESET-NOD32 a variant of MSIL/Agent.BTN
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.MSIL.Witch.gen
Alibaba Backdoor:MSIL/AsyncRAT.80d8501e
NANO-Antivirus Trojan.Win32.Witch.jxrqxf
SUPERAntiSpyware Clean
MicroWorld-eScan Trojan.GenericKD.68085143
Rising Backdoor.AsyncRat!8.10CA0 (CLOUD)
Sophos Mal/Vermis-X
F-Secure Trojan:W32/XwormRAT.A
Baidu Clean
Zillya Trojan.Agent.Win32.3567441
TrendMicro Backdoor.Win32.XWORM.YXDF2Z
McAfee-GW-Edition BehavesLike.Win32.Generic.pm
Trapmine malicious.high.ml.score
FireEye Generic.mg.64aa45857bbf819c
Emsisoft Trojan.GenericKD.68085143 (B)
Ikarus Trojan.MSIL.Agent
Jiangmin Clean
Webroot W32.Trojan.GenKD
Avira TR/Dropper.Gen
MAX malware (ai score=84)
Antiy-AVL Trojan/MSIL.Witch
Microsoft Backdoor:MSIL/AsyncRat!atmn
Gridinsoft Malware.Win32.Gen.bot
Xcitium Clean
Arcabit Trojan.Generic.D40EE597
ViRobot Clean
ZoneAlarm HEUR:Trojan.MSIL.Witch.gen
GData MSIL.Backdoor.SiRAT.A
Google Detected
AhnLab-V3 Trojan/Win.HM.C4924593
Acronis Clean
McAfee GenericRXRO-DU!64AA45857BBF
TACHYON Clean
DeepInstinct MALICIOUS
VBA32 Backdoor.MSIL.XWorm.gen
Cylance unsafe
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Backdoor.Win32.XWORM.YXDF2Z
Tencent Malware.Win32.Gencirc.13df8523
Yandex Trojan.Witch!ZQW2AEaL0hk
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.121218.susgen
Fortinet MSIL/Agent.BTN!tr
AVG Win32:DropperX-gen [Drp]
Cybereason malicious.f31154
Avast Win32:DropperX-gen [Drp]
No IRMA results available.