Static | ZeroBOX

PE Compile Time

2089-04-02 00:29:32

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00005e24 0x00006000 5.98523820466
.rsrc 0x00008000 0x000270d4 0x00027200 7.66277595026
.reloc 0x00030000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0002e418 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0002e890 0x000000bc LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x0002e95c 0x00000578 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x0002eee4 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
^-(W
|NZZG@BqpVNsCJKSSU_
LZ[TAGBH
\QL0+@BMZP#Pfmnpnjb:i}~wlhok3{to-4]!'%5*
j('' */9+,.a 5+(`{xt`
8?<&42w2<
~vUKF_HKVLoNRQVCBYE}Q'\ag==SOKLSRcumdvUmt|znJ{}##IS}f
//25+)6>*
?29.7?52"w~u
goW[YRq\^EDXXYoy[fh{{lpf\Lodvjit~mBHusv|gb6Y@I)
CACECAC}sq1x{4ut;rn
g7&2/9*5,|r1!50"2tz
A]_H[QJ^OVA
SCSV@P*${j.becwwe!)jk%+;7mp?Kt|F`uwcq5E
5("1-:*<"2
("#%,&9<
712$(3
((160
kF@I|LQP
t^Oi_LO
bGPxeidk-6/ /"RctwluuQ]<%>?o`u}st`5@K
SS9%-*).
Q!:=U;>-;7o*,+/53#1!7)277~
5> <#>0#(
v4.0.30319
#Strings
FC6B65C5-6CD0-45DB-8496-704F98C64121
IEnumerable`1
CallSite`1
List`1
Microsoft.Win32
User32
ToInt32
Func`3
Func`4
SHA256
get_UTF8
<Module>
get_ASCII
KERNEL32.DLL
NTDLL.DLL
System.IO
set_IV
value__
mscorlib
System.Collections.Generic
get_Id
GetProcessById
SuspendThread
ResumeThread
OpenThread
ProcessThread
get_IsAttached
add_Created
System.Collections.Specialized
Append
set_IsBackground
Replace
set_Mode
CryptoStreamMode
CipherMode
AddRange
Invoke
GetExtendedTcpTable
GetEnvironmentVariable
Enumerable
IDisposable
RuntimeFieldHandle
RuntimeTypeHandle
CloseHandle
GetTypeFromHandle
get_MainWindowHandle
IsInRole
WindowsBuiltInRole
get_MainModule
ProcessModule
set_WindowStyle
ProcessWindowStyle
get_FileName
set_FileName
GetRandomFileName
get_MachineName
get_ProcessName
GetName
GetProcessesByName
AssemblyName
DateTime
SetLastWriteTime
SetCreationTime
SetLastAccessTime
LocalMachine
get_ChangeType
ValueType
System.Core
get_CodeBase
ReadOnlyCollectionBase
Dispose
Create
Delete
CallSite
CompilerGeneratedAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
FlagsAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
DeleteValue
GetValue
SetValue
Remove
StrikeNet.exe
Deserialize
System.Threading
Encoding
System.Runtime.Versioning
FromBase64String
ToBase64String
DownloadString
UploadString
ToString
GetString
Substring
set_ErrorDialog
IsMatch
ComputeHash
set_Path
get_ExecutablePath
get_FullPath
GetFullPath
GetTempPath
get_Length
FlushFinalBlock
System.Security.Principal
WindowsPrincipal
System.ComponentModel
Advapi32.dll
advapi32.dll
kernel32.dll
user32.dll
iphlpapi.dll
CryptoStream
MemoryStream
get_Item
set_Item
get_Is64BitOperatingSystem
SymmetricAlgorithm
HashAlgorithm
Random
ICryptoTransform
GetExtension
GetFileNameWithoutExtension
Application
get_Location
System.Web.Script.Serialization
System.Reflection
ICollection
ProcessThreadCollection
NameValueCollection
WebHeaderCollection
ManagementObjectCollection
ArgumentException
CSharpArgumentInfo
get_StartInfo
set_StartInfo
ProcessStartInfo
Microsoft.CSharp
System.Linq
get_Year
InvokeMember
MD5CryptoServiceProvider
StringBuilder
Microsoft.CSharp.RuntimeBinder
CallSiteBinder
Debugger
ManagementObjectSearcher
FileSystemWatcher
FileSystemEventHandler
ToUpper
CurrentUser
get_NotifyFilter
set_NotifyFilter
JavaScriptSerializer
IEnumerator
ManagementObjectEnumerator
GetEnumerator
.cctor
ConvertStringSecurityDescriptorToSecurityDescriptor
CreateEncryptor
IntPtr
System.Diagnostics
get_Threads
System.Runtime.InteropServices
System.Runtime.CompilerServices
GetInstances
DebuggingModes
GetValueNames
WatcherChangeTypes
GetProcesses
FileAttributes
SetAttributes
GetBytes
CSharpArgumentInfoFlags
CSharpBinderFlags
FileSystemEventArgs
System.Windows.Forms
Contains
System.Web.Extensions
System.Text.RegularExpressions
System.Collections
RegexOptions
get_Chars
get_Headers
RuntimeHelpers
NotifyFilters
ManagementClass
OpenProcess
NtQueryInformationProcess
GetCurrentProcess
IPAddress
get_Address
set_Arguments
set_EnableRaisingEvents
Exists
Concat
ManagementBaseObject
ManagementObject
System.Net
StrikeNet
Target
WaitForExit
DialogResult
WebClient
System.Management
Environment
Component
get_Current
GetCurrent
IPEndPoint
get_Count
ThreadStart
Convert
get_Port
ArrayList
set_RedirectStandardOutput
MoveNext
System.Text
get_Now
FindWindow
EnableWindow
set_CreateNoWindow
ShowWindow
MoveFileEx
FindWindowEx
GetIndex
MessageBox
InitializeArray
ToArray
ToCharArray
set_Key
OpenSubKey
RegistryKey
System.Security.Cryptography
GetExecutingAssembly
LastIndexOfAny
Registry
op_Equality
op_Inequality
SetKernelObjectSecurity
WindowsIdentity
1{CAF6FD80-9C02-4F45-90BB-9B1EB381CBD5}
<PrivateImplementationDetails>{CAF6FD80-9C02-4F45-90BB-9B1EB381CBD5}
WrapNonExceptionThrows
<WinSCP
<Setup for WinSCP 6.1.1 (SFTP, FTP, WebDAV and SCP client)
<Martin Prikryl
c(c) 2000-2023 Martin Prikryl
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
_CorExeMain
mscoree.dll
a`pa`paaaaa
aapp47
SqqqsS
%5%55551qsqqq0wsCCCCCRSS
pRRRRR
C@ppp40pS
sq7`RR@
0RSCSq7
pp45!qs7pt4
@1wsp
K**++-0+**++***++-0+,*.,*,,,+,/+-00711711010000|*
***,,02,,*
*,/3;>=B>=33,*
+/,0333 ,*
***3?=>GG?;3,,****
/00,,=>?323/,*
,***?G=hpl3/0.*,//.,
+30/3;==3>G=3;///03:opos
G,////:;/30{7
/33;=?[KDo
sF?Z:?[[q
A<?:::;?h[
+3=?[j
vvvyvy
^*0=?Gj
n\=?[^r
yvveeuyyxxxx
K-[^nr
wqqq`_qe_eydduu
KF^oooo
~popooororrrvvvvvvvvv
zzweq_eYYYY`
{[^^kklkliiiikkkkknonnqn`qnnqnnnos
v_YYg_
|\\\\\i\i\\\\\ii^h]]j]`````]`jnj^jkko
GHHHHH\HH\H\H\[[[[]]]]]]]]]]]]h^iijr
DDDEDEEDDDGBFDFGGZFZZZZZZZZ[[[\[hhhv
}CBCCCCCCDC0
=BF;;=FZFFZFFFGZG[hjnsz
}C7C77C7C70
.F=FFFFFFF[[hrv
}5576757C
+;.B=BBFBF[]q
}55555454
;==B=DGqv
}45454551
*377B=F]s
P!"445""
*-7377BD~
*-111777BP
1121477I
*11111416
11!"111N
!1""14S
1!""#R6&&
-!-
%)XW_df
'&'WTVf
%$))UUVb
MRJ/(()))WWt
MRJ</):)XWmt
ugA>|*
"LOOJ>><@AgmmmgA?32|+
#6II88>><3=3332-P7
,,-0/----!!!P9
! !!
I()++)())))+*))))*)))+/+///+///
(*-;1;1-
*(%((*;;CH;.-(*(%A6
--.1;;?;.,,-9ijo
;---88-
.1=Xjh
nTZTio
oTTSSil
sqs{u{y
mmmmonntrrrvv|
xswa_^]^
[[hhhhh[[jjill````llno
DDDDDHDYYXXZZZZZZZZii[jt
@@@@@@?8?CBBWWWWWWXXghi
776776(
.;!!==BBBBCXiw
N77676
(.,;;?BXl
N33333
!/%,1??Bn
)+3/6A
+3+33O
JL0&''Qc
KKF::<Ukpk>;
3422;91.++M7
(D%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%D
x/.--/.54/8>>88z5
'1::2)2T^D00LH&;4Fahfcemwgdr
yXbW`hijjuonksp
}VVVWUZ[[\_a
|HH72BCJSSYl
"9ARqv~5
+1*KN%%%%%%&%&)(---N
,s+ Ro6
cus%k,&_
m=XpOc
{nqu-K
=5*9K<#
}&>*_^=S
||>3}/,ja
/r;i!4
T>eJyXuZ,
-mZ/H>)
-J{#0L>
8'a)"`J~
|+%>?_
1}H52?
1wyd]d
:s t@@
<Q;|zy.u
kZ'iV<
uz{e[Q
`;SYj,
A P*n3
YfXTv,bR
XQyr$!
OO3+5}7
:][NUcCZ
`Xg0OC
L[q>RmY#
O=[n;31-
`wthS<
|O~8He=
d#paUw
#W<D'N
@iw$dF%
l-U1>:
?~+?>h
9@vPa9j
w[,7o^
t?~y]W
F"K1jn
r5R4/*K
X ~-'sk
b-GvK=
rQ7j-g
"*FR|cC
s6=Cb=MW
:YQk9C
}]2aIB
Md4xr2
wMJlYu
Z"83[f'#
%)0(E(f
%Ghg#U]
2n(e1&
%"}2%
L4%@B
Bu8Id1
F1&LW\
pi#PUl
[|\ zo
S}=mx[
CKN`HL
&d#psC5
b!qhY
{O~~t){H
Zkb?|*v~
H+fB5!
DGn[pd0~
@CtF'l
knX_/p
2 s|V:
5bQZ)_
\g^LfF
#}ukK)
@O_Sr.
pm@@8~+v
Vi6T8'
"|yJZ((
NglBX?
qbhc[@
.$d()O@j
onnT!hQ
cjGZYp
AEQj77q
N<jBP'Re
:7Y[`,
l+-'Nqr5]
K~ksK!
\*pGX{
c9oFmf
ihc9lq'qP
tT)r>![
1OOj/*
C^FVur
okoCfp[
$#I]Dh
~{r+gsZ
T6674K
>yY@rO
(VRAVD
N`e9pt
6j,-F)__
hQXTR
Ojj;J
>3Iiv\>_
BgA.'M
JC*^M+
,be;.-
^ 9_T,
^dlrrQ|
3mv::B
RT_RvF
f3b5c;
Yv2>|D
!bxv}&
5UmCen
PcpN@?
eVUj%
a%!7z\
GV<v;D
Rw,`qJt
?me]We
,QD/?_JX
)gqQ&v
Aff~Ae
Bg#[yvgb
NQ!i0M
UqJI`$
Q`D&uI
zQC6mJFdUM
QY~ 1tdW
fV:m<1
Pzs6ST
K}%I>
&2`@,C&%l
y=HBO
u[M(GV
tf`zkSg
%dvI3'
@r =itU
;*82QF
KXg1$$4
B@?a&Q
DnHC`^
^"N2nK
IK50~pA
~{+7s3
E&:Nw!
#2JAuA6
cK;R6L
20HW(y9
|v{~~q
(K^w5+
puyAAP
vI@1X4
FAS:D/;
@%RX?|<xi8
(F#uX7
1.WP>B
2R;"UP;
7quy~{
'HyC*@W1w
6{w-@Xj
Qz?<>H
#t&8ke
SN{ZoH@
CB8"Beq
<EiM1h
JQXYo|
]~f15o
(N aw=%
:<=f p
;M}N2
|GQf-C
q`~qs$
M1PG1L$bD
NGIOleF
hbcK5#
S$+dUV
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
/ P6pL
,/KPip
/-P?pR
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Setup for WinSCP 6.1.1 (SFTP, FTP, WebDAV and SCP client)
CompanyName
Martin Prikryl
FileDescription
WinSCP
FileVersion
InternalName
StrikeNet.exe
LegalCopyright
(c) 2000-2023 Martin Prikryl
LegalTrademarks
OriginalFilename
StrikeNet.exe
ProductName
WinSCP
ProductVersion
Assembly Version
6.1.1.0
Antivirus Signature
Bkav W32.Common.B2DAC14F
Lionic Trojan.Win32.Mamut.4!c
Elastic malicious (high confidence)
MicroWorld-eScan IL:Trojan.MSILMamut.10867
FireEye Generic.mg.f2c62f2ee6aa9450
CAT-QuickHeal Clean
Skyhigh Artemis!Trojan
McAfee Artemis!F2C62F2EE6AA
Malwarebytes Trojan.Agent.MSIL
Zillya Clean
Sangfor Clean
K7AntiVirus Trojan ( 005a642f1 )
BitDefender IL:Trojan.MSILMamut.10867
K7GW Trojan ( 005a642f1 )
CrowdStrike win/malicious_confidence_100% (W)
Baidu Clean
VirIT Trojan.Win32.Genus.TCS
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of MSIL/Agent.DXU
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.MSIL.Agent.gen
Alibaba Trojan:MSIL/Generic.ce44defc
NANO-Antivirus Clean
ViRobot Clean
Rising Clean
TACHYON Clean
Emsisoft IL:Trojan.MSILMamut.10867 (B)
F-Secure Trojan.TR/Agent.lfiyc
DrWeb Clean
VIPRE IL:Trojan.MSILMamut.10867
TrendMicro TROJ_GEN.R049C0XIL23
Trapmine Clean
CMC Clean
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
GData IL:Trojan.MSILMamut.10867
Jiangmin Clean
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Agent.lfiyc
Antiy-AVL Trojan/Win32.Wacatac
Kingsoft malware.kb.c.999
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium Malware@#hxodfraqqpr1
Arcabit IL:Trojan.MSILMamut.D2A73
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSIL.Agent.gen
Microsoft Trojan:Win32/Znyonm
Varist W32/ABRisk.CRFK-9192
AhnLab-V3 Trojan/Win.MSILMamut.C5487466
Acronis Clean
BitDefenderTheta Gen:NN.ZemsilF.36738.lm0@ayKzGTo
ALYac IL:Trojan.MSILMamut.10867
MAX malware (ai score=86)
DeepInstinct MALICIOUS
VBA32 TScope.Trojan.MSIL
Cylance unsafe
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R049C0XIL23
Tencent Malware.Win32.Gencirc.13ef8615
Yandex Clean
Ikarus Trojan.MSIL.Agent
MaxSecure Clean
Fortinet MSIL/Agent.DXU!tr
AVG Win32:TrojanX-gen [Trj]
Cybereason Clean
Avast Win32:TrojanX-gen [Trj]
No IRMA results available.