Static | ZeroBOX

PE Compile Time

2023-11-29 10:31:01

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00003024 0x00003200 5.46796296839
.rsrc 0x00006000 0x000002a0 0x00000400 2.12308917979
.reloc 0x00008000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00006058 0x00000244 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
GetType
GetMethod
Invoke
CreateInstance
v2.0.50727
#Strings
<Module>
Client.exe
Program
Client
Lime.Connection
IdGenerator
Lime.Helper
PreventSleep
EXECUTION_STATE
StringConverter
Native
Lime.NativeMethods
PacketHandler
Lime.Packets
Config
Lime.Settings
mscorlib
System
Object
System.Net.Sockets
Socket
client
isConnected
System.IO
MemoryStream
memoryStream
System.Threading
keepAlivePacket
TcpReceive
TcpSend
PacketFixer
SendInfo
GetHardDiskSerialNumber
GetCamera
GetSystem
GetCpu
GetActiveWindow
value__
ES_CONTINUOUS
ES_DISPLAY_REQUIRED
ES_SYSTEM_REQUIRED
StringToBytes
BytestoString
Decompress
Encode
Decode
System.Text
StringBuilder
GetWindowText
capGetDriverDescriptionA
SetThreadExecutionState
Handler
Invoke
GetAssembly
SavePlugin
currentMutex
programMutex
splitter
System.Diagnostics
Stopwatch
stopwatch
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
STAThreadAttribute
EventArgs
<Main>b__0
EventHandler
<>9__CachedAnonymousMethodDelegate1
CompilerGeneratedAttribute
ReleaseMutex
Thread
Environment
System.Windows.Forms
Application
add_ApplicationExit
ThreadStart
Stream
Dispose
Disconnect
AddressFamily
SocketType
ProtocolType
set_SendBufferSize
set_ReceiveBufferSize
Convert
ToInt32
Connect
TimerCallback
SelectMode
get_Available
get_Connected
SocketFlags
Receive
ToArray
String
Contains
ParameterizedThreadStart
get_Length
IDisposable
Collect
WaitForPendingFinalizers
packet
bytesArray
System.Collections.Generic
List`1
Microsoft.VisualBasic
Strings
CompareMethod
Concat
get_MachineName
get_UserName
Microsoft.VisualBasic.Devices
ComputerInfo
get_OSFullName
get_TotalPhysicalMemory
UInt64
System.Globalization
CultureInfo
get_CurrentCulture
get_Name
System.Net
GetHostName
IPHostEntry
GetHostByName
IPAddress
get_AddressList
GetValue
ToString
Interaction
Environ
Conversion
System.Management
ManagementObjectSearcher
ManagementObjectCollection
ManagementObjectEnumerator
GetEnumerator
ManagementBaseObject
get_Current
ManagementObject
get_Item
MoveNext
product
op_Inequality
Microsoft.Win32
Registry
get_Capacity
Encoding
get_Default
GetBytes
GetString
set_Position
System.IO.Compression
GZipStream
CompressionMode
get_UTF8
ToBase64String
FromBase64String
System.Runtime.InteropServices
DllImportAttribute
kernel32
GetVolumeInformationA
MarshalAsAttribute
UnmanagedType
user32
GetForegroundWindow
lpString
avicap32.dll
wDriver
lpszName
cbName
lpszVer
kernel32.dll
esFlags
op_Equality
get_ElapsedMilliseconds
RegistryKey
CurrentUser
OpenSubKey
ToBoolean
<PrivateImplementationDetails>{1A7BEB9F-767F-4703-9C2E-7DA5D8B71A0D}
ValueType
__StaticArrayInitTypeSize=7
$$method0x600001c-1
RuntimeHelpers
RuntimeFieldHandle
InitializeArray
CallType
CallByName
__StaticArrayInitTypeSize=9
$$method0x600001c-2
__StaticArrayInitTypeSize=3
$$method0x600001c-3
__StaticArrayInitTypeSize=6
$$method0x600001c-4
get_ExecutablePath
__StaticArrayInitTypeSize=14
$$method0x600001d-1
__StaticArrayInitTypeSize=5
$$method0x600001d-2
$$method0x600001e-1
AppDomain
get_CurrentDomain
SetValue
.cctor
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
eVTHQGJX
keepAlivePing!
Information
Select * from AntiVirusProduct
SELECT * FROM FirewallProduct
SystemDrive
select * from Win32_Processor
AddressWidth
root\SecurityCenter
displayName
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0
ProcessorNameString
Software\
HKEY_CURRENT_USER\SOFTWARE\
marcelotatuape.ddns.net
TnlhbkNhdFJldmVuZ2U=
2f73f0305bc24
Revenge-RAT
!@#%^NYAN#!@$
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
0.0.0.0
InternalName
Client.exe
LegalCopyright
OriginalFilename
Client.exe
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.RevengeRat.4!c
tehtris Clean
MicroWorld-eScan IL:Trojan.MSILZilla.19283
CMC Clean
CAT-QuickHeal Trojan.RratFC.S20328350
Skyhigh GenericRXJF-GR!1AF7A2E45F20
ALYac IL:Trojan.MSILZilla.19283
Malwarebytes Generic.Malware.AI.DDS
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Clean
BitDefender IL:Trojan.MSILZilla.19283
K7GW Clean
Cybereason malicious.b29212
Baidu Clean
VirIT Trojan.Win32.MSIL.DOY
Symantec ML.Attribute.HighConfidence
Elastic Windows.Trojan.Revengerat
ESET-NOD32 a variant of MSIL/Agent.ATK
Cynet Malicious (score: 99)
APEX Malicious
Paloalto Clean
ClamAV Win.Packed.Razy-9645384-0
Kaspersky HEUR:Trojan.Win32.RRAT.gen
Alibaba Backdoor:Win32/RevengeRat.d1e1d215
NANO-Antivirus Clean
ViRobot Clean
Rising Backdoor.LimeRat!1.D55A (CLASSIC)
Sophos Troj/RAT-GS
F-Secure Trojan.TR/ATRAPS.Gen
DrWeb BackDoor.RevetRat.2
VIPRE IL:Trojan.MSILZilla.19283
TrendMicro TROJ_GEN.R014C0DKT23
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.1af7a2e45f20ad74
Emsisoft IL:Trojan.MSILZilla.19283 (B)
SentinelOne Static AI - Malicious PE
GData Win32.Trojan.Agent.4KI6L2
Jiangmin Clean
Webroot W32.Malware.Gen
Varist W32/MSIL_Kryptik.AXU.gen!Eldorado
Avira TR/ATRAPS.Gen
MAX malware (ai score=84)
Antiy-AVL Trojan/Win32.RRAT
Kingsoft Win32.Trojan.RRAT.gen
Gridinsoft Trojan.Win32.Gen.tr
Xcitium Clean
Arcabit IL:Trojan.MSILZilla.D4B53
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.RRAT.gen
Microsoft Backdoor:MSIL/RevengeRat
Google Detected
AhnLab-V3 Trojan/Win32.RL_Generic.C3517676
Acronis Clean
McAfee GenericRXJF-GR!1AF7A2E45F20
TACHYON Clean
DeepInstinct MALICIOUS
VBA32 Backdoor.MSIL.Revenge.Heur
Cylance unsafe
Panda Trj/CI.A
Zoner Trojan.Win32.86676
TrendMicro-HouseCall TROJ_GEN.R014C0DKT23
Tencent Win32.Trojan.Rrat.Kflw
Yandex Clean
Ikarus Win32.Outbreak
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Bulz.06A5!tr
BitDefenderTheta Gen:NN.ZemsilF.36608.am0@aix2fIf
AVG Win32:BackdoorX-gen [Trj]
Avast Win32:BackdoorX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.