Static | ZeroBOX

PE Compile Time

2095-04-05 12:34:34

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00001390 0x00001400 5.44587475189
.rsrc 0x00004000 0x000010dc 0x00001200 4.91324335807
.reloc 0x00006000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00004090 0x000002e4 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00004384 0x00000d53 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
<>9__2_0
<RandomString>b__2_0
<>c__DisplayClass7_0
<Install>b__0
IEnumerable`1
List`1
Func`2
<Module>
System.IO
DownloadData
AddExeToLocalApplicationData
mscorlib
System.Collections.Generic
Thread
Replace
Enumerable
IDisposable
set_WindowStyle
ProcessWindowStyle
set_FileName
ReadLine
fullLine
rawline
SecurityProtocolType
System.Core
Dispose
CompilerGeneratedAttribute
GuidAttribute
UnverifiableCodeAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
SecurityPermissionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
New.exe
System.Threading
System.Runtime.Versioning
DownloadString
RandomString
GetFolderPath
get_Length
length
Install
set_SecurityProtocol
Program
System
Random
random
SecurityAction
System.Reflection
set_StartInfo
ProcessStartInfo
AddBatchToStartup
System.Linq
StringReader
TextReader
SpecialFolder
ServicePointManager
.cctor
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
AddExeToMyPictures
AddBatchToMyPictures
fileBytes
WriteAllBytes
Contains
System.Security.Permissions
get_Chars
Process
set_Arguments
Concat
Repeat
Object
Select
System.Net
WebClient
Environment
ThreadStart
saved_installList
WriteAllText
ToArray
System.Security
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
Copyright
2000
$bedfb417-a2df-4ae5-bb1c-1b8c00b3eb71
1.0.0.0
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="utf-8"?>
<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<!-- UAC Manifest Options
If you want to change the Windows User Account Control level replace the
requestedExecutionLevel node with one of the following.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Specifying requestedExecutionLevel element will disable file and registry virtualization.
Remove this element if your application requires this virtualization for backwards
compatibility.
-->
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- A list of the Windows versions that this application has been tested on
and is designed to work with. Uncomment the appropriate elements
and Windows will automatically select the most compatible environment. -->
<!-- Windows Vista -->
<!--<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" />-->
<!-- Windows 7 -->
<!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />-->
<!-- Windows 8 -->
<!--<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />-->
<!-- Windows 8.1 -->
<!--<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />-->
<!-- Windows 10 -->
<!--<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />-->
</application>
</compatibility>
<!-- Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher
DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need
to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should
also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config.
Makes the application long-path aware. See https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation -->
<!--
<application xmlns="urn:schemas-microsoft-com:asm.v3">
<windowsSettings>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
<longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
</windowsSettings>
</application>
<!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
<!--
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="*"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
</assembly>
%-)V+h[h
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
start "" "
https://pastebin.com/raw/V6VJsrV3
https://yip.su/RNWPd.exe
https://iplogger.com/1djqU4
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
1.0.0.0
InternalName
New.exe
LegalCopyright
Copyright
2000
LegalTrademarks
OriginalFilename
New.exe
ProductName
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav W32.Common.D753F82A
Lionic Trojan.Win32.Upatre.1j!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Zusy.502235
CMC Clean
CAT-QuickHeal Trojan.IGENERIC
Skyhigh Downloader-FCID!D334FDBE7080
McAfee Artemis!D334FDBE7080
Malwarebytes Malware.AI.3634750077
VIPRE Gen:Variant.Zusy.502235
Sangfor Downloader.Msil.Tiny.Vfvp
K7AntiVirus Trojan-Downloader ( 005abba61 )
BitDefender Gen:Variant.Zusy.502235
K7GW Trojan-Downloader ( 005abba61 )
Cybereason malicious.e8de42
Baidu Clean
VirIT Trojan.Win32.MSIL_Heur.A
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of MSIL/TrojanDownloader.Tiny.CIQ
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky HEUR:Trojan-Downloader.MSIL.Upatre.gen
Alibaba TrojanDownloader:MSIL/Upatre.87a12464
NANO-Antivirus Trojan.Win32.Upatre.kccben
ViRobot Clean
Rising Trojan.IPLogger!1.B69D (CLASSIC)
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/Dldr.Tiny.jftmx
DrWeb Trojan.DownLoaderNET.786
Zillya Downloader.Upatre.Win32.77227
TrendMicro TROJ_GEN.R002C0XJ923
Trapmine Clean
FireEye Generic.mg.d334fdbe7080a9e3
Emsisoft Gen:Variant.Zusy.502235 (B)
Ikarus Trojan-Downloader.MSIL.Tiny
GData Gen:Variant.Zusy.502235
Jiangmin Clean
Webroot Clean
Google Detected
Avira TR/Dldr.Tiny.jftmx
Varist W32/ABRisk.LPSU-0582
Antiy-AVL Trojan[Downloader]/MSIL.Tiny
Kingsoft malware.kb.c.977
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium Clean
Arcabit Trojan.Zusy.D7A9DB
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Downloader.MSIL.Upatre.gen
Microsoft Trojan:Win32/Znyonm
Cynet Malicious (score: 100)
AhnLab-V3 Downloader/Win.FCID.C5496363
Acronis Clean
BitDefenderTheta Gen:NN.ZemsilF.36738.am0@amCu6ff
ALYac Gen:Variant.Marsilia.75727
MAX malware (ai score=80)
DeepInstinct MALICIOUS
VBA32 Downloader.MSIL.Pabin.Heur
Cylance unsafe
Panda Trj/RnkBend.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0XJ923
Tencent Malware.Win32.Gencirc.13f1cb2e
Yandex Trojan.DL.Tiny!XsM9+jL4paI
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.73810839.susgen
Fortinet PossibleThreat.MU
AVG Win32:DropperX-gen [Drp]
Avast Win32:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.