Static | ZeroBOX

PE Compile Time

2020-12-14 12:59:53

PE Imphash

09d0478591d4f788cb3e5ea416c25237

PEiD Signatures

PECompact 2.xx --> BitSum Technologies

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000a7000 0x0005f200 7.99943791261
.rsrc 0x000a8000 0x00002000 0x00001400 6.92902437906
.reloc 0x000aa000 0x00000200 0x00000200 0.23263253451

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000a80a0 0x000001b4 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_MANIFEST 0x000a8258 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library kernel32.dll:
0x4a83e0 LoadLibraryA
0x4a83e4 GetProcAddress
0x4a83e8 VirtualAlloc
0x4a83ec VirtualFree

!This program cannot be run in DOS mode.
PEC2^O
.reloc
)dI[)z
&*ZQ5V
Ip15FA
$Dxe6%
&1=[S1
mhV_^Y
y_%jA?
kEk+>I=k
)\D<gI
T=b4EbL
%:C5'%s
RIJ%wQ
61 {q-
&E>WzC
=5RGuD:rXiR
C5l5[J
4f?`J4:
Y]G7DDk
|:o @#L
pukMQU
G-|(Il
MiF{okx
6uO3xaC
gQu{a}8o~ *
wHeta=
&<4.C3
DFl2?#
x{NjRH/
@FBrOl>o
8UZZLwFc`
:O.JJn
l>8-{m
RvCH,7
m3J]c-/
]4&sC#u
ZG,3Y
gryM:\
}i5f&CN
G*gw5<
Uf?7f@
,[13$K
"ui<'2
uxvZI]
y38P2Ly
;N+efl
H6ER&m
Iu*@v6C:
D/z3`Z
D>D=VB
CBk,%d
dhl)h3
|:Z'ij'X4j
iHyFrk
.D"4Jh
YgV[s!
G*W/Dz_d
,a1R&A
rLV>"N
HsVSpT
{1,Px@
vreDU>wL
+>n^9rN
#.I'&p
k'v1TN
/yt|Ke7/
]><^;'
GSd0*?
xd\qEnh5a
fioB@w-
#8a]Vgg?Q<
E"?XKI/
S#ju+r[*?
-)"=@S
&}..l
PHUP?R
u4k7ZU
Y[c4~1
5`d6QWP
;VS-}R
f =OY8
}vB7x}N
3^%mJv
vgc#Uu
ZaE_19
T }K"U
Nu^xm1
"tUB?%
|V(A^6E
i);"0?
\r&+C#J
],hJDTZ
RTG1+J5
t)$,O\
7trd0$
+|4-(
d!strS
5Pv&S
27ri &
6-<7/e
n}_>z-t
qCciM.
L\>@6b
h!ob !\
@PrZ>M$3
H=j,:
~:PSXvi
JQy<i
>gy=I9
^AiLy*
nx9?5.
@z-k()m
]_)Rj
#R#xD)CwV
Xi|*CLF
W\qy=N
O\iz~
P')ZVW"
0jwaU;
W79!D;m-P
EA6Mr]qKa
[T]8/;
xsc)\X
{;j5W
a%5,DS
wK0lbK
Ho`bs?
[d O](E
%V][Hr
_6~D*[
=|}OIJ
Wx-.]Z%
f;[KgV
89x`6zL@:iOD
0;}`_T
.WoA9z
#ndIgM
<6D%1K@
-.OMaA
mfr?P1
ArOYR`$
@T2Pk=
[ii{"io
0ew{E)
4["eOXk
N(QMSLs
6g@y$%
X]SshWg
?^Y;V>D
A+"hMT
le2#OV
L?79n*
m3GY'(
&uwA?Y
_F+^W;
Eff)cv
4Zwj=&
\xD{f07
3V@Zgs
%8q!,S
sTk7.{
/1i_KV
[J~ITb?
:~[THO*
o%yivJf
I>r6.|
q-z*@~2sY%
tF,>4=
r3Gd&D@E
Y3]QLNW
I+QaINN*
^o(X3)
G"D^T~
x@( }f
@{.@]@x
iVYA;r
4dgg?O
-Y,ITbY<-r
@J0N! -
Pd'&>9
$&oX<r
7TXuf7W8
=UiE'K`
__%R.w
rCL{-|s
L=H00]
9Yc-$~^
[%hDE&$
?uVYxK<
K{uXG
[kz.6c$:
:XVDE>
i%#yPB
TlsLFh
GeLaLs
k;w'sz
xZo5>a
+s[Pm'h
2q}waeh/
1C`eOz
(Lma:(
dURI*4
Sn:?,+
fAi-Ze
;;lzZB
=sUL.I
&hUNg3
.Xf$wu
@_;Gg&
BN>aD6
kYU/g1
M[R&l"
W]Q^.BD
idAyO$C
P*uank
s!=;M:5
:iHE5K/
j[J[DR
oI%Zw
dT5&hea9
dnzk^I2$
y)tB+^s
UJs}tg
,zpT!(
fWnZIG
}V{#}@K
cgNg}n
{WQ{g8
6<wZLlv%
2%WRnL%
Y`aqo
^xyMHe
PECompact2
_bX!_?
\Ux#bX=
EJe0?w&
!n_(YE,v
PP2K+K
OJ[[
8qzBIptNk7
Z-|:sY
/IDWaYY
A<tO[P
mr-!mN@
lGIcSPL
I}Q'ilD
uM;h0
5RM+>@
l~UN_(
&h0E`@"
hBR(;MN*
<M'I1p#y
I{?z=k<
BrovKg
:Y_ps!W
*qg]8u
O7Sj7o
s` m*?
@d!\7[4
rps8Rz
CE-U}N-~
P=":G&
+heYANd;C
oHZz(\
jt'l-CJ`7
27`fHq
Z@W%g(
/.0[EQ
<\Xn@
#!=b&,
I7gXs3
f&)`E@
o&^(.8
,SRCI2
s/e*w)
ROm=&Z5
VZT1Mls|
j,hIO2
^4*%lF2>
O+0wjkU
'ZYeTd
OI<\O*
O62x+)
s_dG$HB
ns'GVA}U
>c;apV[
eb2*%T
&/tHa{
6{7z /
&BSr/~?
.zrL8^v
u[aFU>
jNM]K%
i:&G%Wt
xR :y3
*4uft6WZ
l/~ZU-
.bYO7B
WF{k}$
Ji0I`O
%`# i!
ZS/yfj
Ni$1+KTq
X9y0bK
srlEG!T
co1|$s
?F3(3|y
:M"ju5
Q.D+_X
;U|X|2
U4>{?x
F-;n(H
GR,(57L
"u;|Bc
EncFMET*
R!NkK_/
xonHo9
-A=Hg&a
5RTAJ
U[v4#9H
>fGxA7
_&(Um <
xc/c2VLP
W]:ohf
<@'d(c
n])PiI
6x3p_l
Eag]Ub5
xjA+h,
*+>PXC
BW!`8%
vFY{Yu
x@}?r3O
Nb,e]5
EtfWCjjR
'ohG,t
2)#p)O
b:XS(
|m_cXA
]D-A(Z
jSIDxK@
v&i/)(
6Tanh}
= \Bs;
SK(:c
f;/+C
rg^l;NP
4mVz}<
BezlY1_b
+rR<Pe
a5Mr=S
/#\L73
,DoIdL
bB_Y'@
AuR8<E
LU&(C'
n'ub(V
ISERpNK
mE1{`:
7jP+wZ
!2qv"*
vN%A>
S&yRf6
g=~Xp
Fwb%!@c
:R7Aj,
Mt'=.j+B
#,\s1Y
K|g=yP
GpX[x|w
co^6[9
4`<m=G
q]'0[,
&4DM@f
-uPXC$
g+/`%0I
"Z3?T7
BVCX~,
;zxco[
Ag}v V
"pwb*7
s&O;?&],
*B9.}~+p
WQ"[bFB
v0{:K
kj=+mA
Nui2vAH
.5V1Ebf
]c6.rQ
ngpq:
q5B<xkWt
C:{2pT
XgRhC*^
&f`M9R
u|_u*V
%YKi'&
M|O%C{
I=$=1-
5:1?qr
=:*SrI9
'+B4-|
zXFk^3.
I)7yE{
^;>Rz)J'
A}io?
e$]*n"
lz7_x5
@N|A8sNbl
6,H*uG
K!%N|00b
aX|?YR
7TUd|p
SXB)H6
4<wj4Oq
e}2t'=5c,\
40Uta.m
fM*Q"
4$@Wt/
ys/W[b
4r2B-],yN
)`O(:]
jB~OsR
NV$g"Se
dB5?{
QpSG23
I;DR?^
QrpYH5
Ry*NX2T*
xUoeu"CG0:
(LP_Vp
OMrFDm
84z!?Q2um
.jh"DB
*`'E+Z
6 7iPB
=G5]in
SjiMuf
n'"`EPwO
.iC^8P=
"kbG?+7
?.Y0"Z0'
/Hrph3Q{
\|+)#f&
l*c'B&
n0fPX(
M,-_G_
f~[Itt
Myc] mk
:ut 0X}
UF5`skD+|
xbSn`C#A
h7O%J+[
$EcdM
![:~1B
;}<o$i6.G
Ck5>Ui
-}KmV`
c|WGtp
dAp2%m
dvi EJ
o'_Li^Z
at`X[P
^n795>z
p*JYbC
K%EyAN
P]4sE3
wuB_[yG
"Bxlcf
wzRXMg
5"5/r`
K{5=v7
y=[!3+
F,un5-
'fl-C)u>
H{84pi
YVU=d{
g)}E)n
:"O|`s
1F5R>:Vg3Y
O\7"@16S5
EBA%X[
u$gdGk
&t/B[8
,d5pyM
aFe$g?
8Izh\~
',/,w8T
'0"$;J
,]9RHS8
ED4:I
)3bboW
eIg.8e
(jNj*f!`%-
4ww-YVC
[fM\HTr
_h22Xv
}x_2)l=(
kprd.f
sZX>Af
F6H+ki
$W<.r/)
y*t"@b
9zjrqr<d
S=}tTg
%h6-hL
]{!f!&
dTFHkX$
&NkyRyV
Qr"D%9
L1Q03y
_#{$(E
!~iz89
=,V'Y9rp
:>cbJ]Us
xM&,7C
ov`[Y>
sO7hb
MYKJeeHw
Hvq}qQ/
$-<U:k
nNe_ m%R6
`1f(nA
0$\l82
EoI7r@
7c36yZ
)S2H`-H*
YKD-?'
,4v/2r
2s8=bE
o_).?93
8:~#4$J7
=X`50;
F,LE7
zJ%p~-
H#W8bJ
BcD*|]
-O-[tu|
UrntVa
[fth02
tr<l.8
G.YOx
sP*Se,
`yeOfk02{H
@5Z'#5
tbJ:J*PJ
1NNF_z
1@);;C
.t3? *
9UN@Egj
;FzboM
4'VqOI
;zFH8Z~
I87!(~Z
|T!0\d
=z+aEW
8f->r[
E^|M*n
13dm7hs
RX1nWS
1r"n?F;q!
hsIIdd
CDaqx&6
"f42M;
w]!Mx7
#k[S]e
PS?---{
>;h_2\
`RlbF;@g
Q81ZprV
BU_.~p
tRApD\
%mEm;uxs
C7Sy6
(WBlJ?
"'uz\{
)r`6,P
\>,l\&
'9vMIF#
nCEXM$b
)_N(<{
Xh:pJO
@#kkA0
}03GB
lseHz#
9&y3{J
(m1g^t
h}E}p_M
HbgDN/E
A=dBxn
%yF~l.q{
~s\kXW
yD+DJq>
)~^d7(
{ZR4$hW>
~~wa~]
G0HU_}
xF&!Ks'
]o0+WsGt
slC\H~J
Gc1>u
yt*9F~#
queL}Y
]dBUaN{
^#+Wio^ou~
/|nc7
I&P(}z
cyAQmU
,|rtQ;
5{.lA*
)_HP.X
>Vg8!c
(d`x}'O#
s&q9+vO
/v1reR
a:eGDv
>9VDMW
Bx[0 Z
;637L=
b)H5,r
yz6=Gd
&`_C}>^%
F&Jm[B
/[aK[q
gNi4s\
?ZusP
2?p&ho,
vLL&ur
e0m2{;e
W-?_GF
G{Q|}
Rxc~?B
&?JdTA<k
GhOjR2J
/qHQ-:I(?$m
WWq_M9
Fo`&u,PIGnqgp
,/SrhS4
l3S\hZ
k]PEzO
ue-`W$e
~{\,JG
Tj3M%Pz
e<A~d_
{@dof
@C\M*H
FQ8!L4aZN
Qrh([;
]t"oLN
L<X&:b^;
LaR"UN|
NeCFDt
kVf+`(
DQRf:I
AV5n7qf
"Y6s:#
{KT^,M
nzG!ujv
B2-F
k]Gzt~
qkuAdY
/=jn@4D5(
WLN:dN.#
].ht-?
SRMZl[DO
5i&^<.v:
[7xC:
;^[@h_
h-z4Sd
HlAK]F~R
l>]AlWh
tn{eY)
)0DsB
W;gt@I
*b@x@f,
SRlhjL
V\],0TjS
U#ulWa
DqY@eZ
yCz{^d}
4oDfr
-PPQby
c.rTg_
9BJ?I*
Qmd0[4
>:A~v`
)%t?R%|
!%F|{7
XEH$`c
9mL@+3
%=>TWk~
qFP-f"`G
>{0m_N
e@8|}f
_WRs,[C
15@nU
-n.<$[
%<:ybD
}$RG2J{
'45\W@X
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
T#`{+<
i+K9{Q4R
SMy49[OOy
t}Y$w8
`;h2=2
i-%-@2
!{@PWQS
:dMZh0]o
msvb]x
ApAlicat
3^p*vu
Bo8xA=w
?ExitPI
`|Virt
USQWVR
Z^_Y[]
VS_VERSION_INFO
StringFileInfo
080404b0
FileVersion
20, 12, 14, 1135
LegalCopyright
Copyright (C) 2020
ProductVersion
20, 12, 14, 1135
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetect.malware1
Lionic Hacktool.Win32.Shellcode.3!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Graftor.494706
CMC Clean
CAT-QuickHeal Clean
Qihoo-360 Win32/Trojan.Generic.HxEA7N8A
McAfee RDN/GenericU
Cylance Unsafe
Zillya Exploit.Shellcode.Win32.12
Sangfor Exploit.Win32.Shellcode.gen
K7AntiVirus Trojan ( 00577f261 )
BitDefender Gen:Variant.Graftor.494706
K7GW Trojan ( 00577f261 )
CrowdStrike win/malicious_confidence_90% (W)
Baidu Clean
Cyren W32/Trojan.YYBI-5884
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent.ZJL
APEX Malicious
Paloalto generic.ml
ClamAV Clean
Kaspersky HEUR:Exploit.Win32.Shellcode.gen
Alibaba Trojan:Win32/Shellcode.9ec9d7d0
NANO-Antivirus Exploit.Win32.Shellcode.ifpkmf
ViRobot Trojan.Win32.S.Agent.396288.CB
Avast Win32:Trojan-gen
Tencent Win32.Exploit.Shellcode.Eaeg
Ad-Aware Gen:Variant.Graftor.494706
Emsisoft Gen:Variant.Graftor.494706 (B)
Comodo Malware@#2rks6x1k16vfn
F-Secure Heuristic.HEUR/AGEN.1103265
DrWeb Trojan.DownLoader36.34153
VIPRE Trojan-Spy.Win32.Zbot.gen (v)
TrendMicro Backdoor.Win32.ZEGOST.THAACBA
McAfee-GW-Edition BehavesLike.Win32.Generic.fc
FireEye Generic.mg.1d6edfa073e4a8f0
Sophos ML/PE-A + Mal/Behav-010
SentinelOne Clean
GData Gen:Variant.Graftor.494706
Jiangmin Clean
Webroot Clean
Avira HEUR/AGEN.1103265
MAX malware (ai score=100)
Antiy-AVL Clean
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Trojan.Win32.Agent.oa
Arcabit Trojan.Graftor.D78C72
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.Win32.Shellcode.gen
Microsoft Trojan:Win32/Ymacco.AAE2
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Agent.C3143770
Acronis Clean
ALYac Gen:Variant.Graftor.494706
TACHYON Clean
VBA32 suspected of Trojan.Downloader.gen
Malwarebytes Trojan.Downloader
Zoner Clean
TrendMicro-HouseCall Backdoor.Win32.ZEGOST.THAACBA
Rising Trojan.Agent!1.CF5E (CLOUD)
Yandex Clean
Ikarus Backdoor.Win32.Zegost
eGambit Unsafe.AI_Score_58%
Fortinet W32/Agent.ZJL!tr
BitDefenderTheta AI:Packer.4B743ECA1F
AVG Win32:Trojan-gen
Cybereason malicious.073e4a
Panda Trj/Genetic.gen
MaxSecure Trojan.Malware.74214920.susgen
No IRMA results available.