Static | ZeroBOX

PE Compile Time

2009-07-14 08:48:20

PDB Path

shrpubw.pdb

PE Imphash

96cc98468ed325b3857363887597bc67

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000c594 0x0000c600 5.59922657466
.data 0x0000e000 0x00000cc0 0x00000600 2.50288884815
.pdata 0x0000f000 0x0000099c 0x00000a00 4.25232819791
.rsrc 0x00010000 0x00055000 0x00054e00 5.45200369223
.reloc 0x00065000 0x00000782 0x00000800 3.33492107672

Resources

Name Offset Size Language Sub-language File type
MUI 0x00010378 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_BITMAP 0x0005bb7c 0x00001c7e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_BITMAP 0x0005bb7c 0x00001c7e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x000647b4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x00064c1c 0x000000ae LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library ADVAPI32.dll:
0x100001010 RegQueryValueExW
0x100001018 RegCloseKey
0x100001020 FreeSid
0x100001028 GetLengthSid
0x100001030 AddAccessAllowedAce
0x100001038 InitializeAcl
0x100001048 RegOpenKeyExW
0x100001050 MakeSelfRelativeSD
0x100001058 AllocateAndInitializeSid
0x100001060 LookupAccountNameW
0x100001068 MapGenericMask
0x100001080 RegQueryValueExA
0x100001090 RegConnectRegistryW
0x100001098 RegOpenKeyExA
Library KERNEL32.dll:
0x1000010e8 CreateDirectoryW
0x1000010f0 LocalAlloc
0x1000010f8 GlobalAlloc
0x100001100 GetFileAttributesW
0x100001108 GetComputerNameExW
0x100001110 lstrcmpiW
0x100001118 GetDriveTypeW
0x100001120 GetLogicalDriveStringsW
0x100001128 FormatMessageW
0x100001130 GetProcAddress
0x100001138 LocalFree
0x100001140 LoadLibraryA
0x100001150 RtlCaptureContext
0x100001158 RtlLookupFunctionEntry
0x100001160 RtlVirtualUnwind
0x100001168 UnhandledExceptionFilter
0x100001170 GetCurrentProcess
0x100001178 TerminateProcess
0x100001180 GetSystemTimeAsFileTime
0x100001188 GetCurrentProcessId
0x100001190 GetCurrentThreadId
0x100001198 HeapSetInformation
0x1000011a8 lstrlenW
0x1000011b0 GetComputerNameW
0x1000011b8 GetLastError
0x1000011c0 Sleep
0x1000011c8 GetStartupInfoW
0x1000011d8 GetModuleHandleW
0x1000011e0 QueryPerformanceCounter
0x1000011e8 GetTickCount
0x1000011f0 FreeLibrary
0x1000011f8 LoadLibraryW
Library GDI32.dll:
0x1000010c8 CreateFontIndirectW
0x1000010d0 GetDeviceCaps
0x1000010d8 DeleteObject
Library USER32.dll:
0x100001668 MessageBoxW
0x100001670 RegisterClipboardFormatW
0x100001678 EnableWindow
0x100001680 SendMessageW
0x100001688 GetParent
0x100001690 GetActiveWindow
0x100001698 ReleaseDC
0x1000016a0 PostMessageW
0x1000016a8 LoadImageW
0x1000016b0 SystemParametersInfoW
0x1000016b8 GetDC
Library MFC42u.dll:
0x100001208 None
0x100001210 None
0x100001218 None
0x100001220 None
0x100001228 None
0x100001230 None
0x100001238 None
0x100001240 None
0x100001248 None
0x100001250 None
0x100001258 None
0x100001260 None
0x100001268 None
0x100001270 None
0x100001278 None
0x100001280 None
0x100001288 None
0x100001290 None
0x100001298 None
0x1000012a0 None
0x1000012a8 None
0x1000012b0 None
0x1000012b8 None
0x1000012c0 None
0x1000012c8 None
0x1000012d0 None
0x1000012d8 None
0x1000012e0 None
0x1000012e8 None
0x1000012f0 None
0x1000012f8 None
0x100001300 None
0x100001308 None
0x100001310 None
0x100001318 None
0x100001320 None
0x100001328 None
0x100001330 None
0x100001338 None
0x100001340 None
0x100001348 None
0x100001350 None
0x100001358 None
0x100001360 None
0x100001368 None
0x100001370 None
0x100001378 None
0x100001380 None
0x100001388 None
0x100001390 None
0x100001398 None
0x1000013a0 None
0x1000013a8 None
0x1000013b0 None
0x1000013b8 None
0x1000013c0 None
0x1000013c8 None
0x1000013d0 None
0x1000013d8 None
0x1000013e0 None
0x1000013e8 None
0x1000013f0 None
0x1000013f8 None
0x100001400 None
0x100001408 None
0x100001410 None
0x100001418 None
0x100001420 None
0x100001428 None
0x100001430 None
0x100001438 None
0x100001440 None
0x100001448 None
0x100001450 None
0x100001458 None
0x100001460 None
0x100001468 None
0x100001470 None
0x100001478 None
0x100001480 None
0x100001488 None
0x100001490 None
0x100001498 None
0x1000014a0 None
0x1000014a8 None
0x1000014b0 None
0x1000014b8 None
0x1000014c0 None
0x1000014c8 None
0x1000014d0 None
0x1000014d8 None
0x1000014e0 None
0x1000014e8 None
0x1000014f0 None
0x1000014f8 None
0x100001500 None
0x100001508 None
0x100001510 None
0x100001518 None
0x100001520 None
0x100001528 None
0x100001530 None
0x100001538 None
0x100001540 None
0x100001548 None
0x100001550 None
0x100001558 None
0x100001560 None
0x100001568 None
0x100001570 None
0x100001578 None
0x100001580 None
0x100001588 None
0x100001590 None
0x100001598 None
0x1000015a0 None
0x1000015a8 None
0x1000015b0 None
0x1000015b8 None
0x1000015c0 None
0x1000015c8 None
0x1000015d0 None
0x1000015d8 None
0x1000015e0 None
0x1000015e8 None
0x1000015f0 None
Library msvcrt.dll:
0x1000016e8 _cexit
0x1000016f0 ?terminate@@YAXXZ
0x1000016f8 calloc
0x100001700 wcsncmp
0x100001708 free
0x100001710 __wgetmainargs
0x100001718 towupper
0x100001720 _exit
0x100001728 exit
0x100001730 _XcptFilter
0x100001738 __C_specific_handler
0x100001740 __CxxFrameHandler3
0x100001748 ??1type_info@@UEAA@XZ
0x100001750 _onexit
0x100001758 _lock
0x100001760 __dllonexit
0x100001768 _unlock
0x100001770 __set_app_type
0x100001778 _fmode
0x100001780 _commode
0x100001788 __setusermatherr
0x100001790 _amsg_exit
0x100001798 _initterm
0x1000017a0 _wcmdln
0x1000017a8 memset
0x1000017b0 memmove
0x1000017b8 _wcsnicmp
0x1000017c0 wcschr
0x1000017c8 wcsrchr
0x1000017d0 iswspace
0x1000017d8 memcpy
Library COMCTL32.dll:
0x1000010a8 DestroyPropertySheetPage
0x1000010b0 PropertySheetW
0x1000010b8 None
Library ole32.dll:
0x100001810 CoInitializeEx
0x100001818 CoCreateInstance
0x100001820 CoUninitialize
Library netutils.dll:
0x1000017e8 NetApiBufferFree
0x1000017f0 NetpwPathType
0x1000017f8 NetpIsRemote
0x100001800 NetpwNameValidate
Library srvcli.dll:
0x100001830 NetShareAdd
0x100001838 NetShareEnum
0x100001840 NetpsNameValidate
0x100001848 NetServerGetInfo
0x100001850 NetServerDiskEnum
0x100001858 NetShareSetInfo
0x100001860 NetShareGetInfo
Library ACLUI.dll:
0x100001000 None
Library WS2_32.dll:
0x1000016c8 WSACleanup
0x1000016d0 WSAStringToAddressW
0x1000016d8 WSAStartup
Library SHELL32.dll:
0x100001600 None
0x100001608 None
0x100001610 None
0x100001618 None
0x100001620 None
0x100001628 None
0x100001630 SHChangeNotify
0x100001638 SHBrowseForFolderW
0x100001648 SHGetDesktopFolder
0x100001650 SHGetMalloc
0x100001658 SHGetPathFromIDListW

!This program cannot be run in DOS mode.
J0sxJ8
J0siJ?
J0s~J"
J0snJ/
J0sgJ2
J0syJ8
J0s|J8
JRich9
`.data
.pdata
@.rsrc
@.reloc
ADVAPI32.dll
KERNEL32.dll
GDI32.dll
USER32.dll
MFC42u.dll
msvcrt.dll
NTDLL.DLL
COMCTL32.dll
ole32.dll
netutils.dll
srvcli.dll
ACLUI.dll
WS2_32.dll
SHELL32.dll
hhctrl.ocx
CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32
RtlIsDosDeviceName_U
CWizWelcome
CWizFolder
CWizClient0
CacheSettingsDlg2
CWizPerm
CWizFinish
shrpubw.pdb
WATAUAVAWH
D$0D9h
t#f9t
A_A^A]A\_
UVWATAUAVAWH
fD9d$P
D$ E9`
t*f9\$ t(f9t#H
|$ f9\$ tUH
@SUVWATH
A\_^][
WATAUH
0A]A\_
VWATAUAVH
t;fD9+t5fD
@A^A]A\_^
UVWATAUAVAWH
pA_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
VWATAUAWH
A_A]A\_^
UVWATAUH
\$PD!l$XH
A]A\_^]
t$ WATAUAVAWH
A_A^A]A\_
@SUVWATAUAVAWH
A_A^A]A\_^][
(<>=:/j
_BEF(D
3VHK3PIYHY`(
TZ]JY[
^PUPUL[
TLTJW`
=PY[\HS(SSVJ
0U[LYUL[6WLU(
0U[LYUL[6WLU<YS(
0U[LYUL[9LHK-PSL
0U[LYUL[*SVZL/HUKSL
/;;79,(+
O[[WZ!
(=(<>=:/j
/J'#/t
BEF(D(E
A^A]A\
L$ SVWH
UVWATAUH
PA]A\_^]
9 wsf9
WATAUH
0A]A\_
SVWATH
8A\_^[
LcA<E3
u*9Q<|%
RegConnectRegistryW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
FreeSid
GetLengthSid
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
MakeSelfRelativeSD
AllocateAndInitializeSid
LookupAccountNameW
MapGenericMask
GetSecurityDescriptorLength
GetSecurityDescriptorControl
ADVAPI32.dll
FreeLibrary
LocalFree
HeapSetInformation
RegisterApplicationRestart
lstrlenW
GetComputerNameW
GetLastError
LoadLibraryW
GetProcAddress
GetLogicalDriveStringsW
GetDriveTypeW
GetFileAttributesW
CreateDirectoryW
LocalAlloc
GlobalAlloc
FormatMessageW
GetComputerNameExW
lstrcmpiW
KERNEL32.dll
GetDeviceCaps
CreateFontIndirectW
DeleteObject
GDI32.dll
PostMessageW
LoadImageW
SystemParametersInfoW
ReleaseDC
GetActiveWindow
GetParent
SendMessageW
EnableWindow
RegisterClipboardFormatW
MessageBoxW
USER32.dll
MFC42u.dll
calloc
wcsncmp
iswspace
wcsrchr
wcschr
_wcsnicmp
memmove
towupper
__wgetmainargs
__C_specific_handler
_XcptFilter
_cexit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
_unlock
__dllonexit
_onexit
msvcrt.dll
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
DestroyPropertySheetPage
PropertySheetW
COMCTL32.dll
CoInitializeEx
CoUninitialize
CoCreateInstance
ole32.dll
NetApiBufferFree
NetpwPathType
NetpIsRemote
NetpwNameValidate
netutils.dll
NetServerGetInfo
NetShareGetInfo
NetpsNameValidate
NetShareAdd
NetShareSetInfo
NetServerDiskEnum
NetShareEnum
srvcli.dll
ACLUI.dll
WSAStringToAddressW
WS2_32.dll
SHGetPathFromIDListW
SHGetMalloc
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHChangeNotify
SHELL32.dll
RegQueryValueExA
RegOpenKeyExA
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ExpandEnvironmentStringsA
LoadLibraryA
memset
__CxxFrameHandler3
memcpy
.?AVCObject@@
.?AVCCmdTarget@@
.?AVCWinThread@@
.?AVCWinApp@@
.?AVCShrwizApp@@
.?AVCWnd@@
.?AVCDialog@@
.?AVCPropertyPage@@
.?AVCPropertyPageEx@@
.?AVCWizWelcome@@
.PEAVCException@@
.?AVCWizFolder@@
.?AVCWizClient0@@
.?AVCWizPerm@@
.?AVCWizFinish@@
.?AUIDataObject@@
.?AVCFileSecurityDataObject@@
.?AUIUnknown@@
.?AUISecurityInformation@@
.?AVCShareSecurityInformation@@
nnojjkjjkkkkkkkjjjjjjjjjjjjiiiiiiiiiiiiiiijjjjjjjjkjkkkkkkkkkkklllkkkklmllmppp
PPPSRR]\Z\[Y\[Z[ZY[ZY[ZY[ZY[ZY[ZZ[ZY[ZY[ZY\[Z]\[^]\_^\`_]a`^cb`dc`edafebhfchgd_``NMM
GTl;}xl
57:QVYY`cYacY`cX`cZ`bZacYadZ`dZ`dZaeZaeZ`dZ`cZadZadZ`d[ae[bd[beZad[ad[be[be[be[cfZbdzzz
4X~*Oz\vo
=QeG;1
7L_YWW
3Oje_Y
1:BPMG
5XuC@>
Kf}:IS3-'NLG
7Nd532
JU^Q`lEJONNNWVTTSPPOM~|u
?Zq31/853
srpihfrpntsrkhh_^^
LZfEINMPPLKKJHHQRP
a^]QOLhfdurpnkkaa`dec
~qqq|~|
oooiiimmmnnnoooqrrqrrppqnnnnnnnnnnnnmmmmmmllljjjiiiiiigggffffffbbbaaa```___```kkkisx~
^^_@ABSSTPQQPOPNOPNOPNOOOOOOOOOOOPPPQPPRQRSSTUUVWWWXXYZY[`^_WXZdfe
F|Xuj
8EVDINPMMEEGihd
5=H?CJRMMLIIPQQ
ILPHLRFKQEKQEIOGLQFKQFKRFKRFKRFKRFKRFKRGKRGKRGLRGLRGLRGLRHMRKPUQUZ
swwwwwwwwww
wwwwwwws3w
wwwwwwwwww
sxxswx
wwwwwwwwwww
wwwwwwwx
wwwwwww
wwwws37
wwwwwww
O/,JHH2(+
okjjiihhddcccccZWZcj
zzttqoooonnnnnnnnnnn
#DCMgV:I9
hijjootz}}
}}}}}}}}}}}}}}}
??>=999993322L
f^ZZZZZUUUUUOD
fffffff\ZZZZZE
ffffkkkkkkkknM
nnnnnnnnnnnnnU
qqqqqqqqqqqqqfK
qqqqqqqqqqqqqqH
ttttttttttttttM
ttttttttttttt
@@ABEJScVVVV
rNNNNNNNNN]
ffffffllqq
i[[[[[ji
<;442///
TbbbbZZZZH
mmmmmmmmmH
\tttttttttwP
mwwwwwwwwwZT
MwwywwyyyypH
e{{{{{{{{{{H
;<@MX]]]
SSSSSSSe
twwwww
oodddd
VMMM?b
OOOOM7
2Bm0&FA!KSSSSS<
SjjjjObK-+
Rkkkkh>`n84z:
6zzzzzwg`
tKlzzzv.1555=
tq@===5QtthK
xssppphK
LLLLLLs
EEEEED
J\4Q_qE
A<"7|m7NvV
SYSTEM\CurrentControlSet\Control\ProductOptions
ProductSuite
Small Business
ntdll.dll
/html/a42d60db-0585-4eac-88d0-b7d61991948f.htm
file_srv.chm
\\?\UNC
FileMgmt.dll
everyone
administrators
SBS Folder Operators
system
interactive
Shell IDList Array
netmsg.dll
.ipv6-literal.net
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Fabookie.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.Dropper.fm
ALYac Clean
Cylance unsafe
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/GenKryptik.GSSS
APEX Malicious
Avast Win64:Malware-gen
Cynet Malicious (score: 99)
Kaspersky Trojan.Win32.Fabookie.bwk
BitDefender Trojan.GenericKD.71236651
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.71236651
Tencent Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.Swrort.wzhtj
DrWeb Trojan.DownLoader46.47727
VIPRE Clean
TrendMicro Clean
Emsisoft Trojan.GenericKD.71236651 (B)
SentinelOne Clean
GData Win64.Trojan.Agent.GGD75K
Jiangmin Clean
Webroot W32.Fabookie
Varist W64/ABRisk.KAFK-4891
Avira TR/AD.Swrort.wzhtj
Antiy-AVL Clean
Kingsoft Win32.Trojan.Fabookie.bwk
Gridinsoft Ransom.Win64.Wacatac.cl
Xcitium Clean
Arcabit Trojan.Generic.D43EFC2B
SUPERAntiSpyware Clean
ZoneAlarm Trojan.Win32.Fabookie.bwk
Microsoft Trojan:Win64/PrivateLoader.RPZ!MTB
Google Detected
AhnLab-V3 Trojan/Win.Generic.R631490
Acronis Clean
McAfee Artemis!34A7DBF9C978
TACHYON Clean
VBA32 Clean
Malwarebytes Trojan.Fabookie
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Fabookie!8.11C3D (CLOUD)
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet W32/PossibleThreat
BitDefenderTheta Clean
AVG Win64:Malware-gen
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_60% (W)
No IRMA results available.