Static | ZeroBOX

PE Compile Time

2023-09-20 11:23:50

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0000cab4 0x0000cc00 5.71197659458
.rsrc 0x00010000 0x00002c58 0x00002e00 5.14013071173
.reloc 0x00014000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00010130 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON 0x000126d8 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x000126ec 0x000003b6 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00012aa4 0x000001b4 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
Yfefeffeefa
Xffeefeffeef
afefefeffe
Xffeeffeefefa
Xfefeffeeffe
affeeffefea
XZ |3OZ
afeffeefeffehah
Xfefeffefeefhah
Yfeffeefefefa
XfefeffeefXa
Xfeffeefeffe_9
Xffeeffeeffea
9ffefeeffe
affefeeffe
feffefefefe
fefeffefeef
fefeffeef
;ffefeefeffe
;feffefefeef
afefeffefefe
fefefeffeef
ffefefeeffe
fefefeffefe
\4ffeeffefeefa(f
e>ffefeefeffeYa*
fefeffefeefY
ffefeeffeXa*
ffeefefeffeY
ffefeeffea
\fefeffeef(~
c &wt(Y
Yfe c[
8Kf "v
f 5YFVa}
Yfe c[
**8Df
o)5a}:
\/>
G]ca}h
o~}Y ^
b a0]a}T
v4.0.30319
#Strings
Rzcjkedka
Rzcjkedka.exe
<Module>
Instance
Rzcjkedka.Shared
StubInterceptorResolver
Rzcjkedka.Resolver
Object
System
mscorlib
TemplateSchemaListener
Rzcjkedka.Listeners
Tokenizer
Factory
TokenizerInterceptorModel
Rzcjkedka.Messages
Annotation
Rzcjkedka.States
DicParameterTemplate
AttrThreadProperty
Record
AlgoErrorMock
StatusInterceptorResolver
ThreadInterceptorModel
DecoratorAlgoMessage
Authentication
ListenerErrorInstance
Rzcjkedka.Instances
Message
Rzcjkedka.Maps
ParserServiceFactory
Rzcjkedka.Factories
DefinitionInterceptorResolver
ProducerThreadProperty
Rzcjkedka.Properties
ParameterInterceptorModel
Rzcjkedka.Models
ExceptionErrorInstance
IteratorServiceFactory
ConsumerServiceFactory
InterceptorInterceptorModel
<Module>{8c3d5603-1d64-411b-9be6-96a9e5056aba}
f8DBB999C7F92C64
Boolean
m8DBB999C7F92C64
.cctor
FindIdentifier
_Thread
parameter
_Interceptor
m_Service
_Schema
ConcurrentDictionary`2
System.Collections.Concurrent
String
_Error
callback
m_Expression
AwakeParams
StackFrame
System.Diagnostics
StackTrace
MethodBase
System.Reflection
RuntimeMethodHandle
GetFrame
InsertIdentifier
info_Low
TryGetValue
CalculateIdentifier
config_Position
loadcust
StringBuilder
System.Text
UInt16
UInt32
Assembly
Stream
System.IO
AssemblyName
set_Item
ToString
Monitor
System.Threading
Append
set_Position
op_Equality
DestroyIdentifier
Encoding
GetString
ExcludeIdentifier
PushIdentifier
CollectIdentifier
version_ord
GetMethod
get_Assembly
MemberInfo
get_DeclaringType
RunIdentifier
indexOf_counter
SelectParams
SetupParams
DeleteParams
OrderParams
RuntimeTypeHandle
GetTypeFromHandle
AddParams
SetParams
PublishParams
PostParams
FindParams
CalculateParams
GetExecutingAssembly
MoveParams
GetCallingAssembly
RemoveParams
VisitParams
CountParams
GetManifestResourceStream
LoginParams
ReflectParams
ReadParams
InvokeParams
ChangeParams
LogoutParams
i_High
IncludeParams
get_Unicode
RegisterParams
Intern
CustomizeParams
get_Count
PrintParams
ConcatParams
InitParams
GetName
FillParams
get_FullName
VerifyParams
GetPublicKeyToken
SearchParams
op_Inequality
ConnectParams
ValidateParams
value__
filter
_Singleton
WriteParams
DisableIdentifier
ReflectIdentifier
CancelIdentifier
LogoutIdentifier
EndOfStreamException
ResolveIdentifier
info_high
ViewIdentifier
CustomizeIdentifier
ArgumentOutOfRangeException
ComputeParams
SortParams
DisableParams
ReadByte
MapParams
InterruptParams
CalcParams
StopParams
Buffer
BlockCopy
global
InstantiateParams
PublishIdentifier
UInt64
List`1
System.Collections.Generic
get_Item
AddRange
IEnumerable`1
GetBytes
InvokeIdentifier
StopIdentifier
SetupIdentifier
RunParams
ForgotParams
ManageParams
DestroyParams
PrepareParams
TestParams
CancelParams
get_Name
ResetParams
ViewParams
FlushParams
init_amount
QueryParams
CloneParams
RevertParams
InsertStrategy
ExcludeStrategy
GetStrategy
get_MetadataToken
NewStrategy
ManageIdentifier
RateStrategy
PopStrategy
CheckStrategy
ResolveStrategy
no__ident
index_ivk
DefineStrategy
mean_ident
max_result
ListStrategy
first_size
sizecol
CollectStrategy
PushStrategy
_Request
m_Proxy
AwakeStrategy
PatchIdentifier
CloneIdentifier
PublishStrategy
PostStrategy
SelectStrategy
SetupStrategy
DeleteStrategy
OrderStrategy
LoginIdentifier
FindStrategy
CalculateStrategy
MoveStrategy
RemoveStrategy
VisitStrategy
CountStrategy
AddStrategy
SetStrategy
LoginStrategy
GetIdentifier
InvokeStrategy
ChangeStrategy
LogoutStrategy
IncludeStrategy
ReflectStrategy
ReadStrategy
RegisterStrategy
SearchIdentifier
ConnectIdentifier
MoveIdentifier
CustomizeStrategy
PrintStrategy
ConcatStrategy
CalcIdentifier
VerifyStrategy
SearchStrategy
ConnectStrategy
ValidateStrategy
UpdateStrategy
CreateStrategy
InitStrategy
FillStrategy
PatchStrategy
AwakeIdentifier
SortStrategy
DisableStrategy
MapStrategy
InterruptStrategy
WriteStrategy
ComputeStrategy
CalcStrategy
PostIdentifier
StartStrategy
AssetStrategy
CallStrategy
EnableStrategy
CompareStrategy
StopStrategy
RestartStrategy
SelectIdentifier
RunStrategy
PrepareIdentifier
MemoryStream
CryptoStream
System.Security.Cryptography
ICryptoTransform
TripleDESCryptoServiceProvider
SymmetricAlgorithm
CreateDecryptor
CryptoStreamMode
IDisposable
Dispose
RemoveIdentifier
ServicePointManager
System.Net
set_SecurityProtocol
SecurityProtocolType
HttpClient
System.Net.Http
GetAsync
Task`1
System.Threading.Tasks
HttpResponseMessage
get_Result
HttpContent
ReadAsByteArrayAsync
DestroyStrategy
Convert
FromBase64String
PrepareStrategy
CopyTo
TestStrategy
ForgotStrategy
ManageStrategy
CancelStrategy
ResetStrategy
get_Content
InsertVisitor
CreateIdentifier
AppDomain
QueryIdentifier
Action
get_Length
Enumerable
System.Linq
System.Core
Process
get_ProcessName
NewVisitor
get_CurrentDomain
CollectVisitor
ToArray
PushVisitor
RateVisitor
GetType
ExcludeVisitor
GetVisitor
PopVisitor
GetProcesses
CheckVisitor
Remove
ResolveVisitor
Concat
DefineVisitor
ListVisitor
Delegate
CreateDelegate
AwakeVisitor
DynamicInvoke
SetupVisitor
IncludeIdentifier
DeleteVisitor
OrderVisitor
invocation
m_Prototype
m_Config
system
merchant
CalculateVisitor
insert_ASSETAt
DefineIdentifier
WriteIdentifier
FlushIdentifier
RegisterIdentifier
NotSupportedException
InterruptIdentifier
ForgotIdentifier
Thread
get_CurrentThread
get_ManagedThreadId
StartIdentifier
VisitVisitor
CountVisitor
MoveVisitor
RemoveVisitor
m_Adapter
importer
m_Printer
LoginVisitor
value_amount
PopIdentifier
DeleteIdentifier
ValidateIdentifier
SortIdentifier
UpdateIdentifier
CompareIdentifier
InvokeVisitor
ReflectVisitor
ReadVisitor
_Template
_Issuer
m_Specification
m_Property
_Database
comparator
_Helper
ChangeVisitor
rowspec
OrderIdentifier
ReadIdentifier
CallIdentifier
TestIdentifier
CountIdentifier
VerifyIdentifier
ResetIdentifier
RegisterVisitor
LogoutVisitor
IncludeVisitor
CustomizeVisitor
m_115bb521969b496f971d4ffef21a24a6
m_35d95db66ec24c8d823ec21557065458
m_66ab5ea86dbc4c81a76d7ee56312384c
m_6f0de55af2e943c28b5a778a80156ad5
m_9bcd223ea8e44e789ba1d89c82823303
m_c7e1d59c842641a693c954722036eed1
m_e7be953a950e4483b81c24e3956a49b7
m_0216ce5ef15546d3b7cb12ea080bffc4
m_a0dd82ad99584c0997ddb1ba39913b16
m_ef2ec154474445289caedbfd9da59bef
m_4fdea5f5480248458f507a1dd4e22f1a
m_a306d2fde522424c9d403df95f421f2f
m_e66be0143b634873a4b6055eb38097cf
m_9202f4f80dd845efabcf4b029d82cc63
m_2403dff70a334e928eac13ce86cd84f8
m_66f520e85b8d415f9bc98496ae459020
m_3bb03fa9da4f473e94e172ded786606a
m_4325bea884bd4799ae3506dcf3282889
m_2a01709f1d654e24aeea6868b3a5585d
m_944d78dcbf2b4685ac8a6c4b37b856cb
m_79a41cabdc9d4c2aa7001cedb41bcc1c
m_a1e527cfcd3e451d99ca90c8250688d1
m_9c39892154d442dcbf1a05cfe3f1f8b6
m_c723103e76ad4544948db2a6df5dd129
m_7bfa5d69b56b4b629ddc983412801596
m_aa413c79e1c446bc954056aff0c08c27
m_a53407c014294b528f3db9daa12d6d8f
m_ff316bbdaced4a77b85a78c963da59b4
m_be467c5db4d542d08a4c30f3686d62e8
m_7460f11242d84cf1a55f655ba00bb89f
m_cc9ccd97cc354cdfb76c55d21188af97
m_ff4eb2ea8f73424fa537b889bfaf9e2b
m_f25219fcb8974d7d8c356a58eaff91b1
m_e509f716978841d78e53fa4cf48dde27
m_2e2c461459bc4259ad54a89b0bcbcb08
m_ae8618004baf4aea8fe8b55a03bf6f75
m_ce1e71d8ad2f4352864c5a81c68128c0
m_53ce88d394fe4f45b5db2db318b57081
m_1d9e9511f62d467db5f49bafbd86c27f
m_6f99c70d88354e48af70010fb8a2adc4
m_67f87a5518e0447da9e226245d930f1e
m_e0e15adad0d24b81a3395757251c393b
m_38aedf698e3f49738a9857371e19fa78
m_6ad642223db448db9a2666c7c25a0929
m_53f78ec6de8c40dfb483702b7bc84e4d
m_20476565d054416f935717886c8ecfcc
m_ca3108aaa5ef4905af2401284bffe658
m_52a4ad140485425081e581bf802bfd8b
m_7b830ac44e35446fb7c45cf7b823e13e
m_ecbec134006943898c1acc781d7c52a1
m_708e1a2fcc2f4ef894fb4865f7903729
m_80f063d9ed4043b4b44e26680042d426
m_a38134fffa8347c8a620cbea27800dc3
m_1b0b7b3b20cc4b39a9e79603ce34fa42
m_d82721cd28454218ad87e0fe38f371b9
m_9102b6e2db2d4539affe3e37486f0363
m_acc59dd53dbb46019649e1fce29a6ca5
m_430a4c2a866a4362a53eb1392f4d90fe
m_85646d2aa16144828d80f2bcf6746895
m_ea64e023770a4bc3979cdd9a59584cb7
m_cf685c85d7724743bc36fc58a4c2e660
m_af2ba4ca3b594e3a9c27384f12b092d0
m_c3d3f755a72b4ab7aba07a1612f84207
m_00327d9dc75642a8a649039f399e362d
m_599110556d4d47e6ad89bd085e08f72d
m_67203a47336f49b69c0569ff990655c7
m_6c056242405d48358dffc764dd04845c
m_b016ca665ae44b75a47f15a357236dfe
m_2f5fac47847542edbe0286d57c2c4ae3
m_4dfc44bdca4641b5a71e1ad4f133c289
m_933d402e6d184281aadb305bc78fd758
m_d4b6eb72544a4c8c94f347097632bc13
m_ed1ff815e9a14104a226a96f16834098
m_0ae7fd0dc9524475a5d945298b9a8a51
m_e81a98246bee4a33b2a27666d533d44e
m_487a988c498f47809444aed6002dd5a0
m_c5613f77e4684448a408d5f7f8b7e02e
m_a89d5674ceae4eb4985ff2d34099db83
m_d235691e2c0b4832a00bb839bc904e8d
m_f62ba41953574f229d15a4fec8c60434
m_21f4a551cf984d138806626e83ca8a33
m_531fd3ab291a4bb58b3ac69473811d84
m_12e8d06ffc42428ea83e6db4987351ae
m_edd37a3776e940a294ff1f23ae2be806
m_770a71a4941f4553bc1711a88e942763
m_8c4a6d0d02134050ae1a986083e5ea18
m_39165e1f76ea48229ad28ea0c66b3857
m_bb5998b23cc34b10ae5104014886bf50
m_5b110a99a7ce41ff9e9c010cf1f76acf
m_fa297b291e93490b844deaedeb532773
m_eaba7647d57f46bb8ea0defc9aef14ab
m_45cac15a590a4f38b472bcbb28c5391b
m_e9ab776da2104a778f539e619bf73d56
m_9b19a9c5ca434dfb801d6f5ee2113e45
m_646dfe0aac9640a599b01abd6041f0e0
m_57005cdc13e844b2a9980a18766bac2c
m_348eb2a105694d389d9f294332855f89
m_fc96d2141b7244c79221dbfd6435542f
m_ba143402aca7471aaaefb5af30ea4c88
m_f8e39135e5a143998914751a5d7a9a94
m_0627874f2ae9485d972b683374f12e6d
m_3269f7c7e1fb4210ac637c2652ad4810
m_9a480ada1a044754aa10b6114747efe5
m_c467fc9fc37a4b058a679b9b26b3f848
m_f697fcf69d124518ae9b9080aefb3745
m_0dde0c26ca0c4cc1b3e056ea0cf94bc6
m_fc73e2f8d8654843ae312e8a16839699
m_27876c93e04a4dd585cde2d3c559a024
m_155e2e38a4ac4b32b9584bc6c0833fd2
m_d7536cec52704cbb9027ac7acbe05e18
m_9dc59828cbcc48bf953e8c889a602489
m_2868531f7a224573b221a88d7b043aa5
m_b495e77130184a34b40fa9c3666f0a38
m_df97edbb128f450bbae9a67673abe78c
m_83b07286ee084f71b64f2ff2d8d665fa
m_87353c5e7ac54659ba7af06edbf6c5c7
m_6d43527a1f274ab191c9397882280142
m_3eb7e3984ff448a0b7030d1d551e5f0e
m_208c096513cb44ae9f774b5755f40fcb
m_5dfec9fe21c441588fd7b2eb9eeecb8d
m_b658d63b07da482ca3691adf096159b0
m_a658fff8f544458da6d54867015bf4fb
m_5f4ecc212a3d4750bf878478563baa99
m_99aef39751234ae9b1584576110217c1
m_572459bff0a0439f96474edba0932814
PrintVisitor
gc46322288c704c849f147d12c3c8dfbd
ConcatVisitor
InitVisitor
CompilationRelaxationsAttribute
System.Runtime.CompilerServices
RuntimeCompatibilityAttribute
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyConfigurationAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
GuidAttribute
System.Runtime.InteropServices
AssemblyFileVersionAttribute
TargetFrameworkAttribute
System.Runtime.Versioning
ComVisibleAttribute
DebuggerHiddenAttribute
WrapNonExceptionThrows
Windows ISO Downloader
HeiDoc V.O.F.
Copyright
2016-2020
$f87e605d-c882-4e84-b0fd-1aebff71efe8
8.46.0.154
.NETFramework,Version=v4.5
FrameworkDisplayName
.NET Framework 4.5
_CorExeMain
mscoree.dll
yyy\rrr#
**))omo
NNOxjjk
ede3__^
CCC.NNM
99:4yy{
&HHJ@sswt
<?xml version="1.0" encoding="utf-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" name="MyApplication.app" /><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo></assembly>
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Windows ISO Downloader
CompanyName
HeiDoc V.O.F.
FileDescription
Windows ISO Downloader
FileVersion
8.46.0.154
InternalName
Rzcjkedka.exe
LegalCopyright
Copyright
2016-2020
LegalTrademarks
OriginalFilename
Rzcjkedka.exe
ProductName
Windows ISO Downloader
ProductVersion
8.46.0.154
Assembly Version
8.46.0.154
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
McAfee Clean
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Trojan.Win32.MSIL_Heur.A
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.OXE
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky Clean
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Malware.Obfus/MSIL@AI.82 (RDM.MSIL2:czXuGGkN8zMol5DbKSftQQ)
TACHYON Clean
Sophos Clean
F-Secure Heuristic.HEUR/AGEN.1323708
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfee-GW-Edition Clean
Trapmine Clean
FireEye Clean
Emsisoft Clean
Ikarus Trojan.MSIL.Crypt
GData Clean
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1323708
Antiy-AVL Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Clean
Google Detected
AhnLab-V3 Clean
Acronis Clean
BitDefenderTheta Gen:NN.ZemsilF.36662.dm0@aa05pJp
ALYac Clean
MAX Clean
DeepInstinct MALICIOUS
VBA32 Clean
Cylance Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Agent.PRI!tr.dldr
AVG Clean
Avast Clean
CrowdStrike win/malicious_confidence_70% (D)
No IRMA results available.