Static | ZeroBOX

PE Compile Time

2023-10-08 12:07:05

PE Imphash

070b5b44988eb91ceb5948a1cf23bcef

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000b95a 0x0000ba00 6.5627883275
.rdata 0x0000d000 0x00002f64 0x00003000 5.34569943528
.data 0x00010000 0x00002d44 0x00001200 2.28475657124
.rsrc 0x00013000 0x000001b4 0x00000200 5.10724290988
.reloc 0x00014000 0x00001656 0x00001800 3.96890245396

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00013058 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library KERNEL32.dll:
0x1000d000 CloseHandle
0x1000d004 Sleep
0x1000d008 Process32Next
0x1000d00c Process32First
0x1000d014 GetLastError
0x1000d01c CreateMutexA
0x1000d020 OpenMutexA
0x1000d024 FlushFileBuffers
0x1000d028 CreateFileA
0x1000d02c WriteConsoleW
0x1000d030 GetConsoleOutputCP
0x1000d034 WriteConsoleA
0x1000d038 SetStdHandle
0x1000d040 LoadLibraryA
0x1000d048 RaiseException
0x1000d04c TerminateProcess
0x1000d050 GetCurrentProcess
0x1000d05c IsDebuggerPresent
0x1000d060 RtlUnwind
0x1000d064 GetCurrentThreadId
0x1000d068 GetCommandLineA
0x1000d06c HeapAlloc
0x1000d070 HeapFree
0x1000d074 GetCPInfo
0x1000d078 InterlockedIncrement
0x1000d07c InterlockedDecrement
0x1000d080 GetACP
0x1000d084 GetOEMCP
0x1000d088 IsValidCodePage
0x1000d08c GetModuleHandleW
0x1000d090 GetProcAddress
0x1000d094 TlsGetValue
0x1000d098 TlsAlloc
0x1000d09c TlsSetValue
0x1000d0a0 TlsFree
0x1000d0a4 SetLastError
0x1000d0a8 ExitProcess
0x1000d0ac SetHandleCount
0x1000d0b0 GetStdHandle
0x1000d0b4 GetFileType
0x1000d0b8 GetStartupInfoA
0x1000d0bc DeleteCriticalSection
0x1000d0c0 GetModuleFileNameA
0x1000d0c8 GetEnvironmentStrings
0x1000d0d0 WideCharToMultiByte
0x1000d0d4 GetEnvironmentStringsW
0x1000d0d8 HeapCreate
0x1000d0dc HeapDestroy
0x1000d0e0 VirtualFree
0x1000d0e8 GetTickCount
0x1000d0ec GetCurrentProcessId
0x1000d0f0 LeaveCriticalSection
0x1000d0f4 EnterCriticalSection
0x1000d0f8 VirtualAlloc
0x1000d0fc HeapReAlloc
0x1000d100 WriteFile
0x1000d104 LCMapStringA
0x1000d108 MultiByteToWideChar
0x1000d10c LCMapStringW
0x1000d110 GetStringTypeA
0x1000d114 GetStringTypeW
0x1000d118 GetLocaleInfoA
0x1000d11c HeapSize
0x1000d120 SetFilePointer
0x1000d124 GetConsoleCP
0x1000d128 GetConsoleMode
Library USER32.dll:
0x1000d138 KillTimer
0x1000d13c SetTimer
0x1000d140 GetMessageA
0x1000d144 MessageBoxA
0x1000d148 GetDesktopWindow
0x1000d14c PostQuitMessage
0x1000d150 TranslateMessage
0x1000d154 DispatchMessageA
Library SHELL32.dll:
0x1000d130 ShellExecuteExA
Library urlmon.dll:
0x1000d15c URLDownloadToFileA

Exports

Ordinal Address Name
1 0x10002100 Edge
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
D$(SVW
9|$hs
}@9|$hr
\$p9|$hr
\$p9|$hr
9D$ up
0WWWWW
0WWWWW
QQSVWd
0SSSSS
0A@@Ju
HtHu4j
s[S;7|G;w
tR99u2
j@j ^V
>=Yt1j
URPQQh
t"SS9]
0SSSSS
PPPPPPPP
0SSSSS
PPPPPPPP
;t$,v-
UQPXY]Y[
^SSSSS
j"^SSSSS
HHtYHHt
t+WWVPV
bad allocation
abcdef0g1h2i3j4k5l6m7n8o9pqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
\edge.jpg
\edge.xml
http://%s/%d
154.211.22.56:8000
{613880B3-8AF3-4350-BF41-83FB6619F485}
Unknown exception
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
bad exception
(null)
`h````
xpxxxx
CorExitProcess
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
`h`hhh
xppwpp
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
CONOUT$
string too long
invalid string position
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
GetLastError
GetEnvironmentVariableA
CreateMutexA
OpenMutexA
KERNEL32.dll
KillTimer
DispatchMessageA
TranslateMessage
PostQuitMessage
GetDesktopWindow
MessageBoxA
GetMessageA
SetTimer
USER32.dll
ShellExecuteExA
SHELL32.dll
URLDownloadToFileA
urlmon.dll
GetSystemTimeAsFileTime
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCurrentThreadId
GetCommandLineA
HeapAlloc
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
downexec.dll
.?AVbad_alloc@std@@
.?AVexception@std@@
AppData
.?AVtype_info@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVbad_exception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
;$<N<S<
=3=C=H=2>M>R>C?^?c?
1*141u1
2/2<2I2T2e2{2
5E6M6b6m6
8$8T8Z8b8o8
:S;k;p;
?#?i?o?
A0n0;1M1
3O3U3f3|3
7$7(7,7074787<7@7
9-9S9q9x9|9
9V:a:|:
; ;$;(;,;0;z;
0"0\0i0s0
434<4B4K4P4_4
8*818E8L8s8y8
9'959;9G9M9Z9d9k9
:D:J:t:z:
:N;q;{;
<)</<?<E<Z<h<s<z<
=,=B=M=R=]=b=m=r=
?"?(?.?4?:?A?H?O?V?]?d?k?s?{?
8);P;];[=O>
2#2Z2c2o2
32383A3H3j3
4 4)4?4J4d4p4x4
5$5)5G5
8+969@9Q9\9
; ;(;.;3;9;
=!=U=Z=h=p=|=
0;1U1x1
1$22282[2b2{2
6"6+686C6U6h6s6y6
7#70767P7a7g7x7
<]<0>;>C>l>
?C?H?p?
0Q0]0i1"343A3M3W3_3j3
7-747>7F7S7Z7
;!;3;E;W;&>^>
S0`0x0
7j839d9z9
<-<:<F<V<]<l<x<
=A=P=Y=}=
=/=u={=
0V1[1`1e1u1
1C2H2O2T2[2`2
5!5a5~5
:<:J:Y:g:o:|:
7"7,7I7Z7d7
9=9H9L9Q9
p1t1x1|1
3,303D4H4L4P4T4X4
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2
<D=H=\=`=p=t=x=
>(>8><>L>P>T>\>t>
? ?$?4?8?<?@?H?`?
0 0L0T0x0
1$1(1H1h1
2(242P2\2x2
383@3D3\3`3|3
44484X4x4
585T5X5x5
6 6(646T6\6d6p6
0 0D1H1L1x1
9 9$9P9T9X9
;$;,;4;<;D;L;T;\;d;l;t;|;
< <$<(<,<0<4<8<<<@<P<X<\<`<d<h<l<p<t<x<|<
<8?<?@?D?H?L?P?T?X?\?
KERNEL32.DLL
(null)
mscoree.dll
((((( H
h(((( H
H
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Lotok.m!c
tehtris Clean
MicroWorld-eScan Gen:Variant.Doina.65070
CMC Clean
CAT-QuickHeal Trojan.IGENERIC
Skyhigh BehavesLike.Win32.NetLoader.lh
McAfee Trojan-FVWA!A04B173E5B0C
Malwarebytes Trojan.Downloader
Zillya Backdoor.Lotok.Win32.3545
Sangfor Trojan.Win32.Silverfox.ulgyzg
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Backdoor:Win32/Lotok.de2403e4
K7GW Trojan-Downloader ( 005ac8791 )
K7AntiVirus Trojan-Downloader ( 005ac8791 )
Baidu Clean
VirIT Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Agent.HHI
APEX Malicious
Paloalto Clean
ClamAV Win.Trojan.Doina-10012690-0
Kaspersky HEUR:Backdoor.Win32.Lotok.gen
BitDefender Gen:Variant.Doina.65070
NANO-Antivirus Trojan.Win32.Lotok.kckclu
SUPERAntiSpyware Clean
Avast Win32:RATX-gen [Trj]
Tencent Trojan.Win32.Agent_yh.16001053
Emsisoft Gen:Variant.Doina.65070 (B)
F-Secure Trojan.TR/Dldr.Agent.cpsmb
DrWeb Trojan.DownLoader46.24420
VIPRE Gen:Variant.Doina.65070
TrendMicro TROJ_GEN.R002C0PJV23
Trapmine Clean
FireEye Generic.mg.a04b173e5b0cb462
Sophos Troj/DwnLd-ANC
SentinelOne Clean
MAX malware (ai score=88)
Jiangmin Clean
Webroot Clean
Google Detected
Avira TR/Dldr.Agent.cpsmb
Varist W32/S-c71d2f7c!Eldorado
Antiy-AVL Trojan[Backdoor]/Win32.Lotok
Kingsoft Clean
Microsoft Trojan:Script/Phonzy.B!ml
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Doina.DFE2E
ViRobot Trojan.Win.Z.Lotok.72192.D
ZoneAlarm HEUR:Backdoor.Win32.Lotok.gen
GData Gen:Variant.Doina.65070
Cynet Malicious (score: 99)
AhnLab-V3 Trojan/Win.Generic.R619293
Acronis Clean
BitDefenderTheta Gen:NN.ZedlaF.36792.eu4@aukuV8ki
ALYac Gen:Variant.Doina.65070
TACHYON Clean
VBA32 Backdoor.Farfli
Cylance unsafe
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0PJV23
Rising Downloader.Agent!1.EC5B (CLASSIC)
Yandex Trojan.DL.Agent!t8htsWGaJaU
Ikarus Trojan-Downloader.Win32.Agent
MaxSecure Trojan.Malware.101018141.susgen
Fortinet W32/Agent.HHI!tr.dldr
AVG Win32:RATX-gen [Trj]
DeepInstinct MALICIOUS
No IRMA results available.