Static | ZeroBOX

PE Compile Time

2023-10-09 07:53:42

PE Imphash

435f3d9018e2df7009825fb0dc48bb14

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0001f800 0x0001f800 6.48432308822
.rdata 0x00021000 0x0001e5fa 0x0001e600 7.13458884757
.data 0x00040000 0x000274b8 0x00026600 7.61732958864
.pdata 0x00068000 0x00000e58 0x00001000 4.95140374551
.gfids 0x00069000 0x00000020 0x00000200 0.408976416864
.rsrc 0x0006a000 0x000001e0 0x00000200 4.71767883295
.reloc 0x0006b000 0x0000051c 0x00000600 5.04269885202

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0006a060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x140021000 GetProcessHeap
0x140021008 CreateFileA
0x140021010 CloseHandle
0x140021018 GetComputerNameA
0x140021020 GetLastError
0x140021028 CreateThread
0x140021030 SuspendThread
0x140021038 OpenThread
0x140021040 GetFileAttributesA
0x140021048 GetCurrentThread
0x140021050 SetFileTime
0x140021058 ExitProcess
0x140021060 VirtualAlloc
0x140021068 GetCurrentProcess
0x140021070 DuplicateHandle
0x140021078 CreateMutexA
0x140021080 OpenMutexA
0x140021088 ReleaseMutex
0x140021090 GetSystemTime
0x140021098 EnterCriticalSection
0x1400210a0 LeaveCriticalSection
0x1400210a8 DeleteCriticalSection
0x1400210b0 RtlCaptureContext
0x1400210b8 RtlLookupFunctionEntry
0x1400210c0 RtlVirtualUnwind
0x1400210c8 IsDebuggerPresent
0x1400210d0 UnhandledExceptionFilter
0x1400210e0 TerminateProcess
0x1400210f0 HeapAlloc
0x1400210f8 HeapFree
0x140021100 GetModuleHandleW
0x140021108 GetProcAddress
0x140021110 SetLastError
0x140021120 TlsGetValue
0x140021128 TlsSetValue
0x140021130 FreeLibrary
0x140021138 LoadLibraryExW
0x140021140 LCMapStringW
0x140021148 MultiByteToWideChar
0x140021150 WideCharToMultiByte
0x140021158 GetACP
0x140021160 GetStringTypeW
0x140021168 FlushFileBuffers
0x140021170 WriteFile
0x140021178 GetConsoleCP
0x140021180 GetConsoleMode
0x140021188 SetStdHandle
0x140021190 GetCPInfo
0x140021198 IsValidCodePage
0x1400211a0 GetOEMCP
0x1400211a8 RaiseException
0x1400211b0 GetModuleHandleExW
0x1400211b8 SetFilePointerEx
0x1400211c0 WriteConsoleW
0x1400211c8 ReadFile
0x1400211d0 ReadConsoleW
0x1400211d8 CreateFileW
0x1400211e0 RtlUnwindEx

!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.gfids
@.rsrc
@.reloc
SVWUAWH
t$@Hc\$HH
|$PHcT$XHcl$`f
n|$pHcD$xLc
>fffff
A_]_^[
SVWUAWH
t$PHc\$XH
|$`HcT$hHcl$pH
^ffffff
Nfffff
A_]_^[
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
SVWUAWH
t$PHc\$XH
|$`HcT$hHcl$pf
^fffff
^fffff
A_]_^[
SVWUAWH
t$PHc\$XH
|$`HcT$hHcl$pH
A_]_^[
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
fffffff
SVWUAWH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xLc
^fffff
A_]_^[
SVWUAWH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
offfffff
^fffff
A_]_^[
SVWUAWH
t$PHc\$XH
|$`HcT$hHcl$pf
A_]_^[
SVWUAWH
fffffff
oL$ fD
`A_]_^[
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
ffffff
ffffff
A#ApDi
D$@HcD$LHcl$H
UVWATAUAVAWH
PA_A^A]A\_^]
t$@Hc\$HH
|$PHcT$XHcl$`f
n|$pHcD$xf
t$PHc\$XH
|$`HcT$hHcl$pH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$@Hc\$HH
|$PHcT$XHcl$`f
n|$pHcD$xf
ffffff
t$PHc\$XH
|$`HcT$hHcl$pH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$@Hc\$HH
|$PHcT$XHcl$`HcD$hH
9HcL$x
ffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
~fffffff
>fffffff
~fffffff
>fffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
fffffff
fffffff
t$PHc\$XH
|$`HcT$hHcl$pf
^fffff
^fffff
t$PHc\$XH
|$`HcT$hHcl$pH
ffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
fffffff
ffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
fffffff
fffffff
t$PHc\$XH
|$`HcT$hHcl$pf
^fffff
^fffff
t$PHc\$XH
|$`HcT$hHcl$pH
ffffff
ffffff
ffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
ffffff
ffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
ffffff
ffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
ffffff
ffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$PHc\$XH
|$`HcT$hHcl$pf
oL$ fD
ffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$PHc\$XH
|$`HcT$hHcl$pf
oL$ fD
fffffff
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
fffffff
oL$ fD
t$PHc\$XH
|$`HcT$hHcl$pHcD$xH
UVWATAUAVAWH
LcT$pA
A_A^A]A\_^]
VAVAWH
D+ApL3
A_A^^
A_A^^
t$ WATAUAVAWH
A_A^A]A\_
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
0A_A^A]A\_^]
SWAUAVAWH
PA_A^A]_[
PA_A^A]_[
PA_A^A]_[
PA_A^A]_[
PA_A^A]_[
VWATAVAWH
@LHcPLH
@LHcPLH
@A_A^A\_^
H SVWH
ffffff
fffffff
USVWATAUAVAWH
uC<0u?A
XA_A^A]A\_^[]
WATAVH
@A^A\_
WAUAVH
)D87tf
@A^A]_
WAVAWH
A_A^_
WAVAWH
A_A^_
|$ UATAUAVAWH
A_A^A]A\]
@8|$PtH
tC@8{2t
@8|$PtJ
tE@8{2t
WATAUAVAWH
@8q2u;H
A_A^A]A\_
UVWATAUAVAWH
D8i2u;H
tPD8k2u3H
0A_A^A]A\_^]
q0@80u
@HcC(H
UVWATAUAVAWH
0A_A^A]A\_^]
WATAUAVAWH
0A_A^A]A\_
UVWATAUAVAWH
D$XD8p
L$D;L$T
L$P+L$8
D$XD90}
L$P+L$H
A_A^A]A\_^]
L$0H;K
@80u#H
WATAUAVAWH
A_A^A]A\_
WAVAWH
@A_A^_
|$ UATAUAVAWH
A_A^A]A\]
D82u&H
D8t$Ht
USVWAVH
A^_^[]
UVWATAUAVAWH
A_A^A]A\_^]
VWATAVAW
A_A^A\_^
WATAUAVAWH
A_A^A]A\_
\$ UVWATAUAVAWH
H!D$ E
`A_A^A]A\_^]
@UATAUAVAWH
H!T$0D
uf!T$(H!T$
A_A^A]A\]
l$ VWATAVAWH
L$&@8t$&t0@8q
A81t@@8r
A_A^A\_^
@UATAUAVAWH
e0A_A^A]A\]
u3HcH<H
SVWATAUAWH
HA_A]A\_^[
@SUVWATAUAVAWH
D88Hte
8A_A^A]A\_^][
SUVWATAUAVAWH
D88Ht!
D98Ht;H
8A_A^A]A\_^][
VATAUAVAWH
A_A^A]A\^
UVWATAUAVAWH
D(8Ht}
`A_A^A]A\_^]
|$ ATAVAWH
\$@@8=
A_A^A\
L$ WATAUAVAWH
@A_A^A]A\_
WATAUAVAWH
A_A^A]A\_
ffffff
LcA<E3
VWATAUAWH
@A_A]A\_^
WATAUAVAWH
0A_A^A]A\_
SUVWATAUAVAWH
A_A^A]A\_^][
|$ ATAVAW
A_A^A\
WAVAWH
A9A`w]
@A_A^_
SUVWATAUAVAWH
hA_A^A]A\_^][
t$ AVH
UWATAVAWH
@A_A^A\_]
@<E#FpA
!O@V?2
POC!mr'
3vL0G(^C
k{)<'\
f`ubk{j
d~>`\\
nY*k"$L
P`Qy->
-XP,}=3
pNcdD1M
ledge; thoroughly; before. salvage
whereupon; producer
unwilling. dizzy, disgrace, mankind. citizen asked. provided
provide. elevation
color# respective# discharge. troop; tennis
bitter, sorry
cable, rank,
UUUUUU
UUUUUU
[aOni*{
~ $s%r
@b;zO]
v2!L.2
IND)ind)UUUUUU
UUUUUU
@^8U)zj
=imb;D
/>58d%
VM>cQ6
>jtm}S
)>6{1n
+f)>0'
;H9>&X
*StO9>T
n03>Pu
K~Je#>!
bp(=>?g
BC?>6t9^
K&>.yC
.xJ>Hf
y\PD>!
|b=})>
c [1>H'
uzKs@>
3>N;kU
kE>fvw
V6E>`"(5
?UUUUUU
?7zQ6$
FlsGetValue
FlsSetValue
GetCurrentPackageId
InitializeCriticalSectionEx
LCMapStringEx
LocaleNameToLCID
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
CorExitProcess
.text$a
.text$b
.text$cboaie
.text$cqdrzt
.text$dhxayw
.text$dmfdej
.text$eyhbul
.text$f
.text$g
.text$gzwcvv
.text$ifmvwd
.text$ismtav
.text$jmffhi
.text$kgtqbe
.text$l
.text$lgxfad
.text$mn
.text$mn$00
.text$mnsxfo
.text$ocaako
.text$prsyie
.text$pslqos
.text$qlqodo
.text$qqtctp
.text$r
.text$svlmlj
.text$x
.text$xpkhdo
.text$ybrcmg
.text$yfayhb
.idata$5
.00cfg
.CRT$XCA
.CRT$XCZ
.CRT$XIA
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$zzzdbg
.xdata
.idata$2
.idata$3
.idata$4
.idata$6
.pdata
.gfids$x
.gfids$y
.rsrc$01
.rsrc$02
GetProcessHeap
CreateFileA
CloseHandle
GetComputerNameA
GetLastError
CreateThread
SuspendThread
OpenThread
GetFileAttributesA
GetCurrentThread
SetFileTime
ExitProcess
VirtualAlloc
GetCurrentProcess
DuplicateHandle
CreateMutexA
OpenMutexA
ReleaseMutex
GetSystemTime
KERNEL32.dll
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
HeapAlloc
HeapFree
GetModuleHandleW
GetProcAddress
SetLastError
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
FreeLibrary
LoadLibraryExW
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetStringTypeW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetStdHandle
GetCPInfo
IsValidCodePage
GetOEMCP
RaiseException
GetModuleHandleExW
SetFilePointerEx
WriteConsoleW
ReadFile
ReadConsoleW
CreateFileW
RtlUnwindEx
_<#jIHsc\<
`!/IoJL
OI0-"h
)4Qq,FN
O1}u"9X.
P[x\O9
M7n_GB9{=
/S2xKD3]
y-~0i6
b+sn])K
?+ 03/!
(JNV33
(,BR14
<#l*&h
,/j>4{
Q<6;4@
0;.'0;}]
e9m20g
t8A"~R
##p;)O
W0Jv8pQ?i
2o.l5=@8J
w9E8HKU
!P!..iJ
mz<\o'"E
!`lO./j
I~LT"=b
:-HcKC
8"*?]F|
#kS{.PA
D1b#@$
=OR9@tL
+RuSE&
\#?Bs.
L[&M 7
@H}0@M
'B6'd5
~D8n$dP
f9lMj*
VhP-,i
h[3-Ei
D+|fJ[v
*-V\7Q{
>)R%BMM
*<|OY(:h
NKt&Cg
S\*AmF+
S)sM@N
9e1$RW
xd `\e
CKf#bwb
n>^"lL
L.I!xX
?T!-y}"
!}#A_i
*c)!pf
k4<$)G
g*KP"
4T!7>
!@."$xj:
z"![x+
(5I#+S
KD!L -
p<S KY|
qs] Dh
$<[!$M
! 1~#$
d #R
N`'"A
W/7D ^r
s9$11z
X0g#6{
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
minkernel\crts\ucrt\inc\corecrt_internal_strtox.h
__crt_strtox::floating_point_value::as_double
_is_double
__crt_strtox::floating_point_value::as_float
!_is_double
api-ms-win-appmodel-runtime-l1-1-1
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-file-l2-1-1
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-synch-l1-2-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-kernel32-package-current-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
kernel32
user32
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
mscoree.dll
CONOUT$
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan Clean
FireEye Generic.mg.243b6e0960e9d3b6
CAT-QuickHeal Clean
McAfee Artemis!243B6E0960E9
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
CrowdStrike win/malicious_confidence_90% (W)
Baidu Clean
VirIT Clean
Cyren Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 Clean
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro TrojanSpy.Win64.VIDAR.YXDJIZ
McAfee-GW-Edition BehavesLike.Win64.BumbleBee.gc
Trapmine suspicious.low.ml.score
CMC Clean
Emsisoft Clean
SentinelOne Static AI - Suspicious PE
GData Clean
Jiangmin Clean
Webroot Clean
Google Clean
Avira Clean
MAX Clean
Antiy-AVL Trojan/Win64.GenKryptik
Kingsoft malware.kb.a.988
Gridinsoft Spy.Win64.Vidar.bot
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Casdet!rfn
Cynet Malicious (score: 100)
AhnLab-V3 Clean
Acronis Clean
BitDefenderTheta Clean
ALYac Clean
TACHYON Clean
DeepInstinct MALICIOUS
VBA32 Clean
Cylance Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall TrojanSpy.Win64.VIDAR.YXDJIZ
Tencent Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
AVG Clean
Cybereason malicious.8823f8
Avast Clean
No IRMA results available.