Static | ZeroBOX

PE Compile Time

2023-09-18 13:26:36

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x000518b4 0x00051a00 7.93417984739
.rsrc 0x00054000 0x00006c00 0x00006c00 4.69675732756
.reloc 0x0005c000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0005a000 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0005a000 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0005a000 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0005a000 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0005a000 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0005a000 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0005a000 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0005a000 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0005a000 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0005a478 0x00000084 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0005a50c 0x000003d4 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0005a8f0 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
af &vq
&afe *
Xf TMZ
7QB(Xf sK
Yfee 9K,
ef ZjB
}{A*Xfe
Xfe \y
bfe !3
)ae &${
7 Y %I
t2 C=v
afe -l
'Yf .^
)D%X $q=
Ae OX!
Xfee 9
-+*Yf c
eJ,
Xefe H
3e p#7
(Yfe Y
c&ae g
7(ae `8
Y _!%(Xe
=\sn
a* f|$
Ye* 3*
uw%a}5
_b`};
_d};
/N,{EL
R0:+Iku
Y7,r}?F
VxllZ2
QofdUHP
*:6Oxy
Gz/,]L
't<>hV
}O$>W_
[wQ3 
}Tq]u]
k5gUE!
3-']yQ
X$4EVst.
o2P&&T
Fu':o'
/\#j\f
':COi\
zFKKk"Yl
~(03[SR!
?+6f'S
U,#iW0
Kn=Qm`
*?8y(O
(A!&(T
av>mN`
;6KPQu
#waSs4T
jkOl[
%l02kG
fJbi{g
3]:r|;
Lt_M_~@
K7[#g2
GRyRFbU
.i6-a8
6?l +
OS{|YjJ
EYDP,&
YE->Ns7Y
qKam~(
rZ tiB@
K(d'IgBD
Zf#0tQ
/yoN]>
J=YrG{
x-2qkec
)NV[BO
~B83D,O
DO]A"}A
zTeua2
?4iar=2
5Uwy6-Z;
JyR--
br @Q.
4bcCm
sqZ$s
XjPM{N
;lEmD4R
[64^9#
>g[sRim
U$w^b}
9i_n G
_k)b@q
{W?0SW
S_Wyi9
"uTY5(l
`#=,^<z4q
C~g@y'
B"R@\
-qQ^C!
g=`dKl
#}_eW"
~yJ G~Qd
Z2W3)
Q8?G,|
-$ ~8V
<c6&O&
h`j6OU
P.vHKM
@rh|/F=
.[Qp*I
:TD-^5
8%'t&Z
9"5Kt/
aqnRdQ
Fv-w;(n>&
pIj;=Aq
SS*@p&
L(uV;q
nS3.*Wo
wq7RSY:
SB1AIw
(i\s_@
z5!o5L&
def4?w
Nj%,TM
?~]T7}
X?bcB)@
%jMX$^V
vvhxFgu|
kH[ha[6
;y@1tA
dkSu"u
Indm3c
wB$ Fr
v:TG0cz
W#S'etQL
-p:BFd@U
>4ihcbS<P1\
_)Ov\*P
iqOQT]
52'wbF}R
l>?KBE
or9teG
OJb>LE`_
IO+m)RfdDx
zbOYv
9&_T$y
!~D;~tk
1-j0=P|1
&fw.f9
eG/PMw
?Q?hF-\
twF4 &J
'yVj?
5}L*h:\H
mTtl77
'#zmCYu9
+4Y)A0
%HF;M|
3XYD{4
\rA`zr:
=qFq{ h9> (a
+{Sy'Qu
*DWg&K:$
Cp( PJ
<Y1JUcR
w.i=b"
,ce\=~o
`Z2[x
[&}W<`&
VC*{<8
=\n"tB
av5:t@
UQX\:
C5fPu)
@_4St u
I]P!GO6
[Fk9M4
H(;|1
;nI #zUH6G
F[-gR)
-Y5E4$rBk$|
hR{L0]
hA>3fL^[A
_L>IU~
DR&A6_
%e&i12"
cC>zdH
gV.mzC
3S-Cy}
dTO;sb
Enw~@`
&/UFEY
}3nY\{
`Nd~YG
^!:(V7
iFA[?LKB
U]P4Od
6'Agte
,}h1e`!
3hS6ht
lFJY_cE
rV`qXU
%tv<E,u-
;~N2Q&
{ehR.Y
PaqZDKN-
5cK'nh
qLH@;d
eO4o?pf
x+vl&X
XlMC*Y%X
ISbcC$
r3Q0FS
/).>E
-H,>o"
RS3F[-q
1%T7^b
:[cfL'*
0t;0=X
5c:nFA*
(@m%R*^
-l G7c
TY&@L<
8Wr9U
aoMM',N
_9K%m
y9c[goI
^GVzRr
fk1QUj
:3gk=#
>+=p#a
`2##jW
5Y6rq{
;R8=kLs&a
E36Q9^
&{2%`.)
]Jdyl7
QvreL!j
{oUPsv
%X^{ozK;ks+
\<sHJm
Urbw?>
7@82[g
fI'GvFy
"mKHBe
%0g6-4p
N~J04$
/aVQm%v
^a"h;}
6d5_)X8$T
!4@.F2
%v@qAW
fI{nO`QFfY
h]'mZP
zktO4
S.k8OD$
|iSJ2a
6k=h}S
Kn>QSL
31'*1=
S3y^w1$
tNcz1%
]za5fj
1sG8C;
;UfQ(]7NFk
f)0/'%
zQ~8f[
u-Gj~^
e4_>G{{.
-IGM3x>
2t2`o"
jVUHJvq
K~M>@.
>4Kncb
V;!!0B
-$e1e#
~gf%t-
G7o:2%dd
m8T3G-t
Vc'`l[
OV&`p
$,aI}D
swIeye|
^,E"cU3*C/VZ&
w)amz`
L|~~ +K
9dDe-j
X'mnA+
xkc=g5
-EM'@!
n6U5oZi
y'|6"q
.|}Z4E
fuui9p
fRq56rwua
Tg|P8C
Iun3ZX
`jq^iw
>Dr]ST
P2~t#
EdUCo=
W^ulCRG
PU%L*{
I+x|!
n/Tyz`
)<{n3?
{"YbZi
zEXUI|
;Z {G?
H>5H&n
S\\1%k
Zr3pV
#~1.{@
c.~_E
B4s?%}
q''tW Sfb
{j;w>'
Dq#&8b_
^+&Il
17Cgw{
&'Hsr+
)-"s3Tt
oD;G6~>
a)`~$w'
6e>)U4B
5iGTO'
(ryS<A
VH<fGc
F@xF6L
'JM1Wh
Da Pg+S
W"~9jbf
$gw]}q<
gjNXn;
+LO' g
b}Yl@.
C7*Z.s
;3[rKVP
]hBW=%;
\`BhoLG
*oS_sV
zD_QgU
pDQhV)
.NMP|
0f-.S{C
qdJ\[g
[r>rNFN
i&iQE?m
*{^x?
G0}te"
j@^]?n/
_R|I|D
u?x)mEF
S2G"S)
m2Y90~
ALZvW4
2QOV/=
_ur-;L!G
/Sx_!
C>#)5d
,p c|*
]} Go5
Q`4!#8
?.(6@$
>18+/
BCdhnE
D,J!Q=
/G~mqVF
7$*MMo
TN3MPP
bT?#+T
PJaI*l
_9knO%
k*b2B}
kjc@.Z
Lk80+D7 -B
3rp+ek
xrhCnB
7FetJ!
bFrK1O
YK%>ot&[
LkYx";lI
:z@_{4
b5BjWi
1%9ZAq{
W?//,^
x5$=Nu$
`b\@D
MCFhgK
d=TT"#
JC5;$2
K;''TTz!
>.pDL`g
w2X7DA
~wtL 7hj
>(>fT\s
P~i~;TS
R~GnOe
OA^ JN
B(,$yL
sh;N=9
Ighg4%^55
@77^s&
7Ww5'Uf
d^$28+
(0y(xe
+>?ZH'-
>a=y5n
((!~vh[
h|0k
!I{94|
NZAj*=
,@-ddC
!&#t<N
'|"b&DbPt
I(T`|9M
Jb#dL=
ETi)nD
cAXg M^-d
RJf&WZ
~tfhy'Y
&m)qwdHb[.
&M~odv
A60k#`40
rydB4cW
#YO%#kg7
$yGN7P
skTd|Hr
Sq-%v[
>PjUV5,
}YX=;m+@m
8DD}6u Rj3
@HGrf_<
gaZXw(
8+}vcv
t/1`|o
31Tl"k
kTJ\Z|
#%#( RC
<9g|e
R*Lz#<
7<SOzH1
Qgr?P=
=VxVM-
uC(tOh
7$Qm~!D
m2c[nE
N-NW8C
~3Y<IU`*
m?J!\qi
cB^6$m
v2n8CEh]
(8*TXri
MUl=XZ
qv?gkM{
[m8r_v
?4DCRV
bPH+U?J4
RR%m&W
'W/sP-l6
%.1QDV
)pp+p}B
]LkmZoZ
n>LW wB
F%@<ex{B
|B}tJ
^oi3d;
E/{<7H<
$}?{(9
^OWU&,
nbIpeq
W2,ht7
MiKZUp(
sWSkow
:Hbq,#
QDKaFkmc
YB'+t:
2BW.3?\
4`7QFrJ
?XjT)`X
"dE5A"
GTt,8'
!)hj<e
^068@J#4
-lWY-]mC,
fIiG/
\j>Lh
I&.hx"
J)6 "0o
"Zx=M>q
Rp-PO8MB
6)d qZd
Iy6J({%
*&.?O9
1,*M|&T
_6#~3gV
OW4%u.<
&~S@iP
3:H~KS
ctaSbJ
ho85~\
cX'TW=y?l
9-GJQo\
;I'5:-
w (;"J
s$_lGr
JHNqPp
m3;V":j
~F[ ep?z
[p.IBcA
<Z?t(B
OFqyCO&
1fa;B#u
[H&/wS
{v}p<S@
+<9ZR(q
'dM/I~
SYOsZ1
}i}kw(h
!RQORF
csMi:N
h?(d@_
-)Si\j
]&9QyMY
=<GMU3
Z^DA.&
he[Yjfd
oKPreSU7
V/?6(r
~(5o'Q
/GVbJ{
b<7$YT
iET8FS7U
:jJaP@
C}D/PY
aaJeX{z
c;Tf)x
JlFf(v
lHH}>8
_hkWw(y
J9]Bqh
~=^C7a
/%I46PGf4
)lj8x^+
!YCu#PW
hTCFuTDC
v4.0.30319
#Strings
Ldc_I4_0
Ldloc_0
Stloc_0
Ldarg_0
Ldc_I4_M1
Ldloc_1
Stloc_1
IEnumerable`1
Task`1
ReadInt32
Ldloc_2
Stloc_2
Dictionary`2
Ldloc_3
Stloc_3
Ldc_I4
Conv_I4
Ldc_I4_5
ReadUInt16
get_UTF8
<Module>
System.IO
Ldloc_S
Stloc_S
Brfalse_S
Bne_Un_S
get_IV
set_IV
GenerateIV
value__
GetData
mscorlib
System.Dynamic
System.Collections.Generic
SerializeAsync
DeserializeAsync
IsValidJsonAsync
get_WriteIndented
set_WriteIndented
get_Millisecond
DefineMethod
GetMethod
OpCode
CryptoStreamMode
EndInvoke
BeginInvoke
IDisposable
Hashtable
UseDouble
RuntimeTypeHandle
GetTypeFromHandle
DefineDynamicModule
get_Name
GetName
AssemblyName
propertyName
DateTime
DefineType
CreateType
ValueType
SetReturnType
GetType
System.Core
MethodBase
Dispose
MulticastDelegate
EditorBrowsableState
STAThreadAttribute
EmbeddedAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
AttributeUsageAttribute
DebuggableAttribute
NullableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
DefaultMemberAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
NullableContextAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
ReadByte
LegalBlockSizesValue
LegalKeySizesValue
TryGetValue
SetValue
GetDynamicPropertyValue
SetDynamicPropertyValue
get_PropertyNameCaseInsensitive
set_PropertyNameCaseInsensitive
add_ResourceResolve
Vvdsupbjet.exe
set_BlockSize
get_InputBlockSize
get_OutputBlockSize
set_KeySize
Serialize
Deserialize
System.Threading
Encoding
System.Runtime.Versioning
FromBase64String
ReadString
GetString
UseLong
BinarySearch
get_Length
Newobj
AsyncCallback
TransformFinalBlock
TransformBlock
DeclareLocal
UseDecimal
DefineLabel
MarkLabel
System.ComponentModel
GetManifestResourceStream
get_BaseStream
CryptoStream
MemoryStream
stream
Program
get_Item
set_Item
System
SymmetricAlgorithm
Random
get_CanReuseTransform
ICryptoTransform
CancellationToken
cancellationToken
AppDomain
get_CurrentDomain
Application
System.Globalization
System.Reflection
KeyCollection
set_Position
InvalidOperationException
IsValidJson
StringComparison
CopyTo
MethodInfo
CultureInfo
MemberInfo
ParameterInfo
ConstructorInfo
PropertyInfo
InvokeMember
TryGetMember
TrySetMember
BinaryReader
TripleDESCryptoServiceProvider
MethodBuilder
ModuleBuilder
TypeBuilder
LocalBuilder
ParameterBuilder
AssemblyBuilder
GetMemberBinder
SetMemberBinder
binder
Buffer
ResourceManager
ParameterModifier
ResolveEventHandler
System.CodeDom.Compiler
DefineParameter
IJsonConverter
IntegerBehavior
FloatBehavior
get_IntegerConvertBehavior
set_IntegerConvertBehavior
get_FloatConvertBehavior
set_FloatConvertBehavior
GetILGenerator
.cctor
GetConstructor
Monitor
CreateDecryptor
CreateEncryptor
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
OpCodes
DebuggingModes
Pmnkojw.Properties
GetProperties
GetDynamicMemberNames
MethodAttributes
TypeAttributes
ParameterAttributes
NextBytes
get_IgnoreNullValues
set_IgnoreNullValues
KeySizes
BindingFlags
ResolveEventArgs
Microsoft.CodeAnalysis
get_CanTransformMultipleBlocks
System.Threading.Tasks
Equals
JsonConverter.Abstractions.Models
System.Windows.Forms
JsonConverter.Abstractions
System.Collections
get_JsonConverterOptions
set_JsonConverterOptions
DynamicJsonClassOptions
options
get_Chars
SetParameters
GetIndexParameters
DeserializeToDynamicJsonClass
ConvertToDynamicJsonClass
AssemblyBuilderAccess
AttributeTargets
get_Keys
Concat
Format
UseFloat
DynamicObject
GetObject
Vvdsupbjet
System.Reflection.Emit
IAsyncResult
result
UseInt
Convert
Callvirt
System.Text
Pmnkojw
get_Now
ToArray
ToCharArray
get_Key
set_Key
GetPublicKey
GenerateKey
ContainsKey
System.Security.Cryptography
get_Assembly
GetExecutingAssembly
BlockCopy
GetProperty
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
AllowMultiple
Inherited
AllowMultiple
Inherited
WrapNonExceptionThrows
acdID InTouch2
ACD Systems
9Copyright (c) 2014 ACD Systems Inc. All rights reserved.
$c1c5f4f5-ca81-4377-b4ca-6951234a5886
5.1.11017.0
.NETFramework,Version=v4.5
FrameworkDisplayName
.NET Framework 4.5|8
_CorExeMain
mscoree.dll
X--------W^
;^4------------W
X--------,,
-------,,
X......^
WeX-----,,
.........
;e^--,,
.............4
............X
.........4
XX......4
XXXXXX.
XXXXXXXXX
XXXXXXXXXXX
4444444XXXX
.......44XXX
.........XXXX
..........4XX
W------.....4X
--....4X
-..-..XW
.,-...X,,
X..------
X--------X
X..4;]2
^4-----,
4....3
;_X---
4......--44
4.....X
XXXXXX
XXXXXXXX
X...44XXX
X.....XXX
4---..X4X^W
,..,-...4X,
..-..X
....-.X
X,...,
X----^:4-
>"OZ
EEE3mmm#
9?t(\j
>Dn/^j
febq51/
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
eiQBbeq7Bw8Xf+OzSikbduH4aC4BfOK0RSRJXuqibDMGa/aXWi4XdO26UGYVfPuJbygedcG3RDhJdv+JYDMXaPq3RTQGYLSxTCktVeq4TikaIsizXQkLaeqQWzIfUe64TTEXIuizXQI8eOKzEhQcfequZjtJS+q3TQ4Ga+a4TmYzfevtTjgGRt+5WjQGcOC4EjoXbdCVXC8AfOGibTIfeOa4Eg4Xbcu3XTxJKLblG2RJWPylTDAQdfaFTC8EfP3tejQfaeOzaC4BfOK0RSQ3Yf+6Ri8Xa7S0SD8Xdfm7Ei4fduSzXTgBbQ==
DefineDynamicAssembly
TripleDES
Rijndael
System.Security.Cryptography.
, System.Security.Cryptography.Algorithms
Could not load type {0}
Create
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
acdID InTouch2
CompanyName
ACD Systems
FileDescription
acdID InTouch2
FileVersion
5.1.11017.0
InternalName
Vvdsupbjet.exe
LegalCopyright
Copyright (c) 2014 ACD Systems Inc. All rights reserved.
LegalTrademarks
OriginalFilename
Vvdsupbjet.exe
ProductName
acdID InTouch2
ProductVersion
5.1.11017.0
Assembly Version
5.1.11017.0
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Seraph.4!c
Elastic malicious (high confidence)
DrWeb Trojan.PackedNET.2365
MicroWorld-eScan IL:Trojan.MSILZilla.28600
ClamAV Clean
FireEye Generic.mg.5ca8de5b7c87d363
CAT-QuickHeal Clean
ALYac IL:Trojan.MSILZilla.28600
Malwarebytes Trojan.Crypt.MSIL.Generic
VIPRE IL:Trojan.MSILZilla.28600
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Clean
BitDefender IL:Trojan.MSILZilla.28600
K7GW Clean
Cybereason malicious.ddc56d
BitDefenderTheta Gen:NN.ZemsilF.36662.wm0@ayonSVd
VirIT Clean
Cyren W32/MSIL_Kryptik.JRW.gen!Eldorado
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of MSIL/Kryptik.AEYN
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan-Downloader.MSIL.Seraph.gen
Alibaba TrojanDownloader:MSIL/Seraph.867f84fc
NANO-Antivirus Clean
ViRobot Clean
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:s9Ly6oobr/HSX+uSY6hUTw)
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.MortyStealer.wzwcq
Baidu Clean
Zillya Clean
TrendMicro Backdoor.Win32.WARZONE.YXDISZ
McAfee-GW-Edition Artemis!Trojan
Trapmine suspicious.low.ml.score
CMC Clean
Emsisoft IL:Trojan.MSILZilla.28600 (B)
Ikarus Win32.Outbreak
GData IL:Trojan.MSILZilla.28600
Jiangmin Clean
Webroot Clean
Avira TR/AD.MortyStealer.wzwcq
Antiy-AVL Clean
Gridinsoft Trojan.Win32.Packed.sa
Xcitium Clean
Arcabit IL:Trojan.MSILZilla.D6FB8
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Downloader.MSIL.Seraph.gen
Microsoft Trojan:Win32/TrickBot.PRB!MTB
Google Detected
AhnLab-V3 Trojan/Win.MSILZilla.C5489339
Acronis Clean
McAfee Artemis!5CA8DE5B7C87
MAX malware (ai score=86)
DeepInstinct MALICIOUS
VBA32 Clean
Cylance unsafe
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Backdoor.Win32.WARZONE.YXDISZ
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Agent.PQW!tr.dldr
AVG Win32:RansomX-gen [Ransom]
Avast Win32:RansomX-gen [Ransom]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.