Static | ZeroBOX

PE Compile Time

2022-05-22 04:16:07

PDB Path

C:\yag_nuponug\caj\huyiman\lamuvifebuvuvu\buwepewibu55\lila.pdb

PE Imphash

5f8224784d628ea670c9630686419bc2

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000254ec 0x00025600 7.62667238929
.data 0x00027000 0x00176278 0x00001e00 2.5336832134
.rsrc 0x0019e000 0x0008b080 0x00011200 4.08898155425
.reloc 0x0022a000 0x0000288a 0x00002a00 2.61936629792

Resources

Name Offset Size Language Sub-language File type
RT_CURSOR 0x001ae870 0x00000568 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_CURSOR 0x001ae870 0x00000568 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_CURSOR 0x001ae870 0x00000568 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x001acc08 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ACCELERATOR 0x001ad0e8 0x00000038 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_CURSOR 0x001aedd8 0x00000030 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x001ad070 0x00000076 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x001ad070 0x00000076 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x001ad070 0x00000076 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x001aee08 0x00000274 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library KERNEL32.dll:
0x401010 PeekNamedPipe
0x401018 OpenJobObjectA
0x40101c AddConsoleAliasW
0x401028 GetTickCount
0x401030 GlobalAlloc
0x401034 LoadLibraryW
0x401038 IsProcessInJob
0x40103c SizeofResource
0x40104c GetNamedPipeInfo
0x401050 GetFileAttributesW
0x401054 GetVolumePathNameA
0x40105c ReleaseActCtx
0x401064 GetLastError
0x401068 GetProcAddress
0x40106c VirtualAlloc
0x401070 PeekConsoleInputW
0x40107c SetComputerNameA
0x401080 GlobalFree
0x401084 CreateHardLinkW
0x401088 GetNumberFormatW
0x40108c AddAtomW
0x401090 RemoveDirectoryW
0x401094 SetFileApisToANSI
0x40109c FoldStringW
0x4010a0 GetOEMCP
0x4010a4 FindNextFileA
0x4010a8 SetCalendarInfoA
0x4010ac _lopen
0x4010b4 GetCurrentProcessId
0x4010b8 GlobalAddAtomW
0x4010bc OpenFileMappingA
0x4010c0 ReadFile
0x4010c4 GetProcessHeap
0x4010c8 WriteConsoleInputW
0x4010cc BackupWrite
0x4010d0 GetComputerNameA
0x4010d4 HeapFree
0x4010d8 GetCommandLineA
0x4010dc GetStartupInfoA
0x4010e0 TerminateProcess
0x4010e4 GetCurrentProcess
0x4010f0 IsDebuggerPresent
0x4010f4 HeapAlloc
0x4010f8 RaiseException
0x4010fc HeapCreate
0x401100 VirtualFree
0x401110 HeapReAlloc
0x401114 GetModuleHandleW
0x401118 TlsGetValue
0x40111c TlsAlloc
0x401120 TlsSetValue
0x401124 TlsFree
0x40112c SetLastError
0x401130 GetCurrentThreadId
0x401138 Sleep
0x40113c HeapSize
0x401140 ExitProcess
0x401144 RtlUnwind
0x401148 WriteFile
0x40114c GetStdHandle
0x401150 GetModuleFileNameA
0x40115c WideCharToMultiByte
0x401164 SetHandleCount
0x401168 GetFileType
0x401174 SetFilePointer
0x401178 GetConsoleCP
0x40117c GetConsoleMode
0x401180 GetCPInfo
0x401184 GetACP
0x401188 IsValidCodePage
0x40118c GetModuleHandleA
0x401194 LoadLibraryA
0x401198 CloseHandle
0x40119c CreateFileA
0x4011a0 SetStdHandle
0x4011a4 WriteConsoleA
0x4011a8 GetConsoleOutputCP
0x4011ac WriteConsoleW
0x4011b0 MultiByteToWideChar
0x4011b4 LCMapStringA
0x4011b8 LCMapStringW
0x4011bc GetStringTypeA
0x4011c0 GetStringTypeW
0x4011c4 GetLocaleInfoA
0x4011c8 FlushFileBuffers
0x4011cc SetEndOfFile
Library USER32.dll:
0x4011d8 LoadMenuW
0x4011e0 CharToOemBuffA
Library GDI32.dll:
Library ADVAPI32.dll:
0x401000 RegOpenKeyA

!This program cannot be run in DOS mode.
`.data
@.reloc
bad allocation
Unknown exception
(null)
`h````
xpxxxx
_nextafter
_hypot
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
UTF-16LE
UNICODE
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
`h`hhh
xppwpp
GAIsProcessorFeaturePresent
KERNEL32
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
CONOUT$
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
1#QNAN
1#SNAN
bad allocation
zanedugabar
lahanekucofijajiwaw
sewomexikijalodedeleve soyugoloraci yamazid
rujehulayafaligubovotodeho
bad exception
RSDSHEYE
C:\yag_nuponug\caj\huyiman\lamuvifebuvuvu\buwepewibu55\lila.pdb
u hD-@
VVVVVV
0SSSSS
t h(.@
tehBb@
r=hvB
<at9<rt,<wt
URPQQh
>=Yt1j
jTh8WB
j@j ^V
0A@@Ju
_VVVVV
^WWWWW
j hXXB
tGHt.Ht&
^SSSSS
8VVVVV
;t$,v-
UQPXY]Y[
0SSSSS
0SSSSS
t"SS9]
PPPPPPPP
PPPPPPPP
0SSSSS
_VVVVV
t+WWVPV
<+t(<-t$:
+t HHt
u;h$-@
P.\0EX
-OdTZ<[:*
RX*nyv'
vAlb~NX
F&`eBD
s{|7`7~?h3
R[a[z7u
n_fjcW<
c?V"8
;4*Z!%
}'2;Lr<
EI>uirO
*18w,E
R~"ago
FVIQj>
Xi-@S.
AL>t%e
*7[m6w
)(KSw(
J2!uO-
@,1Ekd
3uM+MU
4zopEU
$V_ZEo
DLBT/r
x(Egw)
@t.~MI
)p3;Lg
@?Tk(,
G6s&Qk
6ta2xM
,jn'o]
e)+b V
Vo$4I.
!7=Akb
]I:K\>
5#>d;.N
A&oKwP{
&+*dzn?4a
T H\*zc
mymA6M
/ZE2~+
h>_y[6e]
3dV(Gu
,P1jT>9H
;Yxy"^
b,J9I(
r0>}pu4
Cf%\8p
R:4C6m,
YD4fb=
H6)06e
CP%+[8
+O+5_l
Nl^)Yu#/
#gL~YR
HrJlAT
/&_,UXs
ol]tkF
}9!gOcW
Jk^=Jd
"`heqEa6
FM:s,.
AU#Ud'
sNUq)%
R==eA0
G>lXgcl
-0852h(
1OIj<@
V_j'OHsq
{q<SJR*
J"C@ca0C
q;>TbC
;_~Tqqb
Kr^=|%
T@&*$GPp
S}O)zGZ
i7WiU]
\Tbs4A
7*Gis{
Z'{5Y`
ztq7r*
?BuX`$FVm
0sN^$~
xPm+oj
9J4eiI
vuZ4yt
v9qW3WL
n$78=8
6dS'94
3jwaj[C
X:Y9ZaBF
h*[jEE
Y"o_hQ:
)1d]:4
aMRxJh
Mp)wRX
mawi|<+
W.xY`
o7Rp5]
;"/3f(
umV>n>
7@JDfs
H<waS!d
no/fT )iM
[G7!UY
VX]^S}
,kq^zp8
gWbDD?b
5>xI:W
*h?s_ve
{[ZtfIB
hV"c`p
C[k!#*r
gb'*i_
yo|Tq;
J%,|67
>6NhX2a
Xy{,p_S
r)="<r
<#$=*>
MYckwg;H
oLOH8UV[#
6W[Zy&
q oK}`La
/CY,9tX
\H%_"m
8z\-jD
Mmc9Qng
{$Bqdh
d\N~N
e~'`.
0DziZ"
Vnfn>p
odT}c>V
cGK|Par
GetComputerNameA
WriteConsoleInputW
GetConsoleAliasesLengthW
PeekNamedPipe
WriteConsoleOutputCharacterA
OpenJobObjectA
AddConsoleAliasW
FreeEnvironmentStringsA
GetProcessPriorityBoost
GetTickCount
GetCompressedFileSizeW
GlobalAlloc
LoadLibraryW
IsProcessInJob
SizeofResource
SetVolumeMountPointA
GetSystemWindowsDirectoryA
EnumSystemCodePagesA
GetNamedPipeInfo
GetFileAttributesW
GetVolumePathNameA
GetLargestConsoleWindowSize
ReleaseActCtx
FillConsoleOutputCharacterW
GetLastError
GetProcAddress
VirtualAlloc
PeekConsoleInputW
BeginUpdateResourceW
BackupWrite
SetComputerNameA
GlobalFree
CreateHardLinkW
GetNumberFormatW
AddAtomW
RemoveDirectoryW
SetFileApisToANSI
BeginUpdateResourceA
FoldStringW
GetOEMCP
FindNextFileA
SetCalendarInfoA
_lopen
GetWindowsDirectoryW
GetCurrentProcessId
GlobalAddAtomW
OpenFileMappingA
KERNEL32.dll
ChangeDisplaySettingsA
LoadMenuW
GetWindowTextLengthA
CharToOemBuffA
USER32.dll
GetCharABCWidthsFloatA
GDI32.dll
RegOpenKeyA
ADVAPI32.dll
HeapFree
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapSize
ExitProcess
RtlUnwind
WriteFile
GetStdHandle
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
IsValidCodePage
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CloseHandle
CreateFileA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
SetEndOfFile
GetProcessHeap
ReadFile
.?AVtype_info@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVbad_exception@std@@
.?AVexception@std@@
[WS# ^
~}~y|||
{}|||~
{}|~~{~}
|}}{~|
|~~{y|
z~|~}}
{{{z~~z
|}~||~{
~z~|}z
~}|z~}~~
|}{}{~~
|z|{~~
|~|{~}z|~}
~}}|{~
~~~|||
|{}}~z
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
V>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>V
V>>>>>
jjjjxs
V>>>>>
V>>>>>
V>>>>>>
V>>>>>>>
V>>>>>>>>>>
V>>>>>>>>>>>
V>>>>>>>>>
V>>>>>>>>>>>>>>
V>>>>>>>>>>>>
III999~~11
99~~~11
999~~1
III999~~~11
III9999~11
I9~9~111
llllooo
FFFFF;F;F;;;;;;;;;;;;;;FF
F;;;;;;
F;;;;;;;
FF;;;;;;DW
FFF;;;;;
FFFFF;;;;
FFFFF;;;;;ZhlV
FFFFFFFF;;;
FFFFFFF;F;;;ZhlV:
YYYY///
555555nnn
\+%C.a
YYYYYYY/
+++++++++d
+++++++++++"d




2\2`2d2
2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
> >$>(>l>p>x>|>
?(?,?4?L?\?`?p?t?x?
1<1L1W1d1u1
2"2'202V2j2
3B3N3T3Y3_3e3l3s3z3
4'424:4C4K4R4[4`4
5)50595K5Q5g5p5}5
6<6A6F6K6]6h6p6
= =2=9=?=Q=Y=d=
070>0V0
8/8E8[8c8
<"<H<U<c<
=,=R=W=e=r=y=
>'>:>^>
i1w1}1
23292D2I2Q2W2a2h2|2
9R:,;4;L;d;
<,?3?i?o?z?
01080P0\0b0n0}0
1:1O1u1
2$3,3v3}3
4 4/4E4P4U4`4e4p4u4
5!5-5d5m5y5
8%858J8
:!:-:::^:p:~:
;2;a;p;;=h=
>3>U>`>
2R3X3v3
4M4R4z4
9 :&:<:G:^:j:w:~:
;I;b;p;
;4<<<|<
>9>F>R>Z>b>n>
Q0q0a1
:A:N:X:f:o:y:
>!>'>0>5>D>k>
0K1b1s1
<k=<?E?q?w?
1 1$1(1,10141~1
2#2(2,202Q2{2
3 3$3(3,3
4/4M4a4g4
7A7u7{7
8a9j9p9
:3:?:f:s:x:
3'3L3c3
9'909e9s9y9
=='=,=0=4=]=
?=?D?H?L?P?T?X?\?`?
0(090^0
262D2M2
363h3p3
4.484A4L4a4h4n4
546F6S6_6i6q6|6
6s7#8F8
:':?:F:P:X:e:l:
>!>3>E>W>i>
00&0-040<0D0L0X0a0f0l0v0
7s7y7~7
8;8H8'969X:N;V;
=,>2>B>
3&4=4m4
7,;0;4;8;<;@;D;H;L;P;T;X;e;@<X<g<
6 6@6`6
707L7P7p7
8,808P8p8
9$9@9`9
0 0(0,0
2$2,242<2D2L2T2\2d2l2t2|2
7$7,747<7D7L7T7
<0=@=P=`=p=
= >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
@(null)
KERNEL32.DLL
mscoree.dll
((((( H
h(((( H
H
kernel32.dll
kernel32.dll
msimg32.dll
/ P6pL
,/KPip
/-P?pR
/ P6pL
,/KPip
/-P?pR
/ P6pL
,/KPip
/-P?pR
VS_VERSION_INFO
StringFileInfo
042230F2
FileDescription
LegalCopyright
Copyright (C) 2022, Fofigraf
OriginalFilename
golfstrikator.exe
ProductsVersion
23.21.5.35
ProductName
Buddylanguo
ProductionVersion
12.45.26
VarFileInfo
Translation
Antivirus Signature
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Jaik.186433
ClamAV Win.Packer.pkr_ce1a-9980177-0
FireEye Generic.mg.fac282b834711d71
CAT-QuickHeal Clean
McAfee Artemis!FAC282B83471
Cylance unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Jaik.186433
K7GW Trojan ( 005690671 )
K7AntiVirus Trojan ( 005690671 )
Baidu Clean
VirIT Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 Clean
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/Generic.d1105624
NANO-Antivirus Clean
ViRobot Clean
Rising Trojan.SmokeLoader!1.EB63 (CLASSIC)
Emsisoft Gen:Variant.Jaik.186433 (B)
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
Trapmine malicious.moderate.ml.score
CMC Clean
Sophos Troj/Krypt-ACE
SentinelOne Static AI - Suspicious PE
GData Gen:Variant.Jaik.186433
Jiangmin Clean
Webroot W32.Trojan.Gen
Google Detected
Avira Clean
MAX malware (ai score=81)
Antiy-AVL Clean
Kingsoft malware.kb.a.1000
Gridinsoft Malware.Win32.Gen.bot
Xcitium Clean
Arcabit Trojan.Jaik.D2D841
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Znyonm
Varist Clean
AhnLab-V3 Clean
Acronis Clean
VBA32 BScope.Trojan.Tasker
ALYac Clean
TACHYON Clean
DeepInstinct MALICIOUS
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Tencent Clean
Yandex Clean
Ikarus Trojan.Win32.Crypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.ERHN!tr
BitDefenderTheta Clean
AVG Win32:Evo-gen [Trj]
Cybereason malicious.dff223
Avast Win32:Evo-gen [Trj]
No IRMA results available.