Static | ZeroBOX

PE Compile Time

2023-09-27 00:43:58

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00038f14 0x00039000 7.68247584334
.rsrc 0x0003c000 0x00001298 0x00001400 5.19125690493
.reloc 0x0003e000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0003c130 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0003c598 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0003c5ac 0x00000418 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0003c9c4 0x000008d3 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
5WvlE=#
<=!;ae+
N{+#0^
^FKF));
#"DOUYF
pw~TQg_r
c^A}^g
'P>W^*
0f)6'Q
yyL(kU
9)?'S>
MR5#JBx
h\|@qsk
#LsbxHd
bf5SjK
gOhuEi
aR}HR&p
0x1N@o
Hbbm-k
a:,iR_
G,Qj:l
Jt/F01
X<FdT
]7>gXMN
!)D<;f
WHR\&5
Ok);@R
]~;s*o
_d&Zf0
,2fmu6
U;mSE2
s~||i+
fpetd4
]!1q%C
)(ni&|,
=Sw->=
cU-!v"Z
Ny){g^
%v+6JK
P.*+O0
b<\ocG
4R, O[
Z%vxf2f
8h@B"z
]A3zB?
@~bt-
j%+uWl
a,K.bm
?' b2S
HfBNt
nMUmjcka$
E)drQw
v.([}9hW
/ls@3E^I
sPw8}I
BiN$fW
/cnt&j
SGg?*P
(1,r~Xv~
@N_4W"
IN]cD{-sL]
Vz7LgO
Hx%(`J{
B."(Fk
uDE$-w
mbfv<Z:
OEWSEyfR
B7oZEn
m__=$p
%cqfpU8/N
$Jzz[#
>Y!&=l9
t("~-T
n?bqW1+
$Z)$bAH
?r- |$
_uzxg<d
yu^e~m
pT7`Zg
=m^4X
]-/vtx
rnoeny
nS9qLF
3*2DE@a
P0osZz
hw+<+^gF
MNv3Lu
K#\IdE
0-7A$$
aRPVnC
)$&j-lfW
RtpS<(>2
[e">D*
'yg^+=
~nI5wHi
NECTQQm
go%1kd
nt>~VG
esFP'9
8Qq.Rj!
GA<Q35
[f]}ng
xs?@v_
(-ea1Da
e&!b!
@\qU$
,WS\DC
pFTKs
g's:+q
N0Bk<m1
a3k4_6
s`vr~}K
L}<NO:F
\|c%W8
99U6 i
b Up}"8
Z8\-B8
V&YCtD
A5NT=
Ug7UfdW
SIvSSfp
oeW"pY
)N2nQl
k?L*y`57D
cTDE7[
)+%DGs
K5\Q O
X&wk@N
gGTwI
eo4-{k.
x60>lb
dM@/7*
&4v:sw
UsEs#%H
qNvf.NK
.j{$#7
_yiRZr
Z!:QVG
r7Uu+>r
9q-r(u
\'E"%^N
x-e]wv
6tJ(vy
#g(bw?
C[B1Qn
O9oVETAj
DWaCnB
amu$[+?
z{<\a5
o1-)1D>-
`EcvRs
lM|<sy[
;juMq5!^l-i
\C.d+u
?1aD5p#
uLCo337
^:H O>0Y
~1VC2M
nLV=TFm
rZ$co}s
s/>v.|
ZVdjwYt
^&`nt0
['D`lR<
H'RLnli
T0I17?sn
)I|aM~
B6kU'q
W}$Xldy
XdEV%M
D8M_UO
}Eo){_
r_v9~=q
'*MBay
s]E~8pw
X{;@%z
&|-|Mw1
w.x;Aot
yD,:En
~RJpq'-
7mT$F"AT
Ad61e!
"UVKRJP
|c7*Xn
g'[<(m
W4!].9
N3*_nq
9z2E)4+J
$cB*`T
9w!kj9
|+yPLQ
&G_oT5
>\udW*
PS~4E{
1%;-%q
k`NN3F&
i:?&mV
1_1JR4
[;'Tc5
eI{V*`d
wj|0R#
zURZ<!
ZKN5o(
n@=jFm
-r[qu(D-
)5d{Qxg
60D_~w
!]W<8l
9Qm"Mj:
}Ro0[H
@aA|xS
}3j*eG
I`,WWF/<+
PlB\I.
zCKp/bD
? Z*:1
P0PoDb
_P@G=B#`M
a?7mR\S
r=:/@0
,VxIsa
=Q-P6Ev
'sMfVD
Ps@+pmF',~G
_0Q3cg
|q1l7KK
R;yO0Y]N
(2{jbxC
8|ygzP
B.l?af
s\HE9c
d>:^_{5
K%lILH;5
b?3H:@t
C=tQ&{60Ty
f46ElWVHK
HuY^%KEo
.%jfq;
|+`}mg
.]a .m
!iK,H#
ieseC)
j(%KjH
jZh ~`
j7BClOM
g:tfD1Gm1
7%d@GU
F*5}x9A}
BgZ:,
;"Th!e
fMM=#8$
ypSk48
2qO;!b
yicOI%:
C+]AIY
EkaF I
r|I|"H
AniC[-
(v"gt0^%
\.FR"/Ki
824sMv
*%TToI
Y:+AxO
F&l|OZB
V'MgXZ
aWMWi|D
@ME:X%
?_B/=5j6>
W$n.>wc
K2|N=q
iEmtiG
)~^[%_
R,uL0is
U{2{t`
YAG<mS
.\U0O5
31uv$qq
:"/FL]QH"
hZ%L^Y
/|mwEi
xK|p;A
xK|p;A
Z >'QEa8
VMDj^m
Z ;*dka8
C<R)Z
TZ e!'
8Z va%
ocW&Z
<yd/Z -j
Z -O!da8
Z?_b`
I:rZ t
J8?J
T|g&%&8
Z?_b`
45KkZ y
kA[%&8Q
3vP.%&8
'hZ Erkba8U
[UUZ ewYa8
N3&rZa8!
Z Mx6[a8
Z aI!Fa8
WozZ Y
B)HZ ~S:
yk%&8#
_bj/
_bY*
+Z *dJ
[kF%&+
$Z DR}
pO%>
McO5%+
=@%&8N
ac<M%&8?
U/`b%&8
xBgZ Z
EtP[8
ruYZ m<BJa8
Z b$(Oa8
z4KbZ
bmZa8/
Z_bX
xWda8<
p}ba8p
=NZ slVka+
Y_cX*
%,DZ M
eZ Y!Xaa+
V8%&8b
.p'%&8
$M*p%+
_bj2
_bY*
Z WfrGa87
$Wu^+
QXq>Z
.g 3&E
L6Z 9s
4H_]Za8W
Z_bX
+Z ,Z.
U>|Z l
c$ .[2/a%
B!DuZa+
[\%&8(
Y_cX*
?>ga8C
Z +l95a+
?Tka8G
v4.0.30319
#Strings
server1.exe
mscorlib
SuppressIldasmAttribute
System.Runtime.CompilerServices
<Module>
Assembly
System.Reflection
GCHandle
System.Runtime.InteropServices
ResolveEventArgs
System
.cctor
RuntimeFieldHandle
Module
Encoding
System.Text
AssemblyName
Stream
System.IO
MemoryStream
RuntimeTypeHandle
MethodInfo
MethodBase
Thread
System.Threading
ParameterizedThreadStart
ValueType
Object
ConfusedByAttribute
Attribute
server1
ComVisibleAttribute
AssemblyTrademarkAttribute
AssemblyCopyrightAttribute
TargetFrameworkAttribute
System.Runtime.Versioning
AssemblyFileVersionAttribute
GuidAttribute
AssemblyProductAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
RuntimeCompatibilityAttribute
CompilationRelaxationsAttribute
AssemblyCompanyAttribute
AssemblyDescriptionAttribute
AssemblyTitleAttribute
STAThreadAttribute
server.Resources.resources
UInt32
GCHandleType
get_Target
ResolveMethod
Invoke
GetParameters
ParameterInfo
ResolveSignature
AppDomain
get_CurrentDomain
ResolveEventHandler
add_AssemblyResolve
GetTypes
LoadModule
Environment
String
RuntimeHelpers
InitializeArray
GetExecutingAssembly
get_ManifestModule
get_UTF8
get_Name
get_FullName
ToUpperInvariant
GetBytes
Convert
ToBase64String
GetEntryAssembly
GetManifestResourceStream
get_Length
Buffer
BlockCopy
ReadByte
GetTypeFromHandle
GetMethod
Concat
Equals
FailFast
set_IsBackground
get_CurrentThread
Debugger
get_IsAttached
IsLogging
get_IsAlive
GetElementType
CreateInstance
GetString
Intern
op_Equality
ConfuserEx v1.0.0
Important Windows Setting
,Copyright
2023 Important Windows Setting
.NETFramework,Version=v4.8
FrameworkDisplayName
.NET Framework 4.8
7.9.5.9
$cc7fad03-816e-432c-9b92-001f2d358399
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="utf-8"?>
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<!-- UAC Manifest Options
If you want to change the Windows User Account Control level replace the
requestedExecutionLevel node with one of the following.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Specifying requestedExecutionLevel node will disable file and registry virtualization.
If you want to utilize File and Registry Virtualization for backward
compatibility then delete the requestedExecutionLevel node.
-->
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- A list of all Windows versions that this application is designed to work with. Windows will automatically select the most compatible environment.-->
<!-- If your application is designed to work with Windows 7, uncomment the following supportedOS node-->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>-->
</application>
</compatibility>
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
<!-- <dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="*"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>-->
</asmv1:assembly>
@{?@{?
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Important Windows Setting
CompanyName
Important Windows Setting
FileDescription
Important Windows Setting
FileVersion
7.9.5.9
InternalName
server1.exe
LegalCopyright
Copyright
2023 Important Windows Setting
LegalTrademarks
Important Windows Setting
OriginalFilename
server1.exe
ProductName
Important Windows Setting
ProductVersion
7.9.5.9
Assembly Version
8.8.4.9
Antivirus Signature
Bkav W32.Common.05547E32
Lionic Trojan.Win32.Generic.4!c
tehtris Clean
MicroWorld-eScan Gen:Variant.Marsilia.76780
ClamAV Clean
FireEye Generic.mg.2902f7ba556f9db5
CAT-QuickHeal Trojan.Generic
McAfee Artemis!2902F7BA556F
Malwarebytes Backdoor.AsyncRAT.Generic
VIPRE Gen:Variant.Marsilia.76780
Sangfor Trojan.Win32.Asyncrat.Visn
K7AntiVirus Trojan ( 0059cb6d1 )
BitDefender Gen:Variant.Marsilia.76780
K7GW Trojan ( 0059cb6d1 )
Cybereason malicious.e544df
BitDefenderTheta Gen:NN.ZemsilF.36738.om0@aqe9Mze
VirIT Trojan.Win32.MSIL_Heur.A
Cyren W32/ABRisk.YQZT-7711
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 multiple detections
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Trojan:MSIL/AsyncRAT.04adf593
NANO-Antivirus Trojan.Win32.Vapsup.kbmrso
ViRobot Trojan.Win.Z.Bulz.239616
Rising Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:FObBXueJ3wvCKMnWzJ8PwQ)
Sophos Mal/Generic-S
Baidu Clean
F-Secure Trojan.TR/Injector.xusov
DrWeb Trojan.Siggen9.56514
Zillya Clean
TrendMicro Backdoor.Win32.ASYNCRAT.YXDI1Z
McAfee-GW-Edition BehavesLike.Win32.BadFile.dc
Trapmine Clean
CMC Clean
Emsisoft Gen:Variant.Marsilia.76780 (B)
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Marsilia.76780
Jiangmin Clean
Webroot W32.Trojan.TR.Injector.xusov
Avira TR/Injector.xusov
MAX malware (ai score=84)
Antiy-AVL Trojan/Win32.Wacatac
Kingsoft malware.kb.c.1000
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium Malware@#1lqpmoxtugpvg
Arcabit Trojan.Marsilia.D12BEC
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSIL.Vapsup.gen
Microsoft Trojan:MSIL/AsyncRAT.AP!MTB
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5183760
Acronis Clean
VBA32 TScope.Trojan.MSIL
ALYac Gen:Variant.Marsilia.76780
TACHYON Clean
DeepInstinct MALICIOUS
Cylance unsafe
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Backdoor.Win32.ASYNCRAT.YXDI1Z
Tencent Win32.Trojan.Generic.Jqil
Yandex Clean
Ikarus Trojan.MSIL.Agent
MaxSecure Trojan.Malware.7164915.susgen
Fortinet Malicious_Behavior.SB
AVG Win32:RATX-gen [Trj]
Avast Win32:RATX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.