Static | ZeroBOX

PE Compile Time

2024-04-15 00:51:34

PE Imphash

fb0ee5bafbb99ce467989526f0be15c6

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00002464 0x00002600 6.06274270455
.rdata 0x00004000 0x00001bf2 0x00001c00 5.50627774006
.data 0x00006000 0x0000038c 0x00000200 0.352759488216
.rsrc 0x00007000 0x000002a8 0x00000400 5.17742814871
.reloc 0x00008000 0x00000286 0x00000400 3.80795581558

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00007058 0x00000250 LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library SHLWAPI.dll:
0x40411c PathCombineW
0x404120 StrCmpNW
Library MSVCR90.dll:
0x4040a0 _crt_debugger_hook
0x4040a4 _controlfp_s
0x4040a8 _invoke_watson
0x4040b0 _decode_pointer
0x4040b4 _onexit
0x4040b8 _lock
0x4040bc __dllonexit
0x4040c0 _unlock
0x4040c4 ?terminate@@YAXXZ
0x4040c8 __set_app_type
0x4040cc _encode_pointer
0x4040d0 __p__fmode
0x4040d4 __p__commode
0x4040d8 _adjust_fdiv
0x4040dc __setusermatherr
0x4040e0 _configthreadlocale
0x4040e4 _initterm_e
0x4040e8 _initterm
0x4040ec _acmdln
0x4040f0 exit
0x4040f4 _ismbblead
0x4040f8 _XcptFilter
0x4040fc _exit
0x404100 _cexit
0x404104 __getmainargs
0x404108 _amsg_exit
0x40410c wcsstr
0x404110 memcpy
0x404114 memset
Library KERNEL32.dll:
0x404010 IsDebuggerPresent
0x404018 GetCurrentProcess
0x40401c TerminateProcess
0x404024 GetCurrentProcessId
0x404028 GetCurrentThreadId
0x40402c GetTickCount
0x404038 GetStartupInfoA
0x404040 InterlockedExchange
0x404044 ExitThread
0x404048 FindFirstFileW
0x40404c lstrcmpW
0x404050 FindNextFileW
0x404054 GetLogicalDrives
0x404058 GetDriveTypeW
0x40405c QueryDosDeviceW
0x404060 lstrcpyW
0x404064 GetFileSize
0x404068 CreateFileMappingA
0x40406c MapViewOfFile
0x404070 FlushViewOfFile
0x404074 UnmapViewOfFile
0x404078 SetFilePointer
0x40407c SetEndOfFile
0x404080 CreateFileW
0x404084 CloseHandle
0x404088 CreateThread
0x40408c ExitProcess
0x404090 GetLastError
0x404094 CreateMutexA
0x404098 Sleep
Library USER32.dll:
0x404128 CharLowerW
Library ADVAPI32.dll:
0x404000 RegCloseKey
0x404004 RegOpenKeyExW
0x404008 RegQueryValueExW
Library ole32.dll:
0x404130 CoInitializeEx

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
tXh,T@
t=h0T@
959979
D$89D$
D$0Hc@<H
9D$XsbH
9D$Tu H
D$HH9D$(
H9D$Pu
StrCmpNW
PathCombineW
SHLWAPI.dll
memset
memcpy
wcsstr
MSVCR90.dll
_amsg_exit
__getmainargs
_cexit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
CreateThread
ExitProcess
GetLastError
CreateMutexA
CloseHandle
CreateFileW
SetEndOfFile
SetFilePointer
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
lstrcpyW
QueryDosDeviceW
GetDriveTypeW
GetLogicalDrives
FindNextFileW
lstrcmpW
FindFirstFileW
ExitThread
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
KERNEL32.dll
CharLowerW
USER32.dll
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ADVAPI32.dll
CoInitializeEx
ole32.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
<dependency>
<dependentAssembly>
<assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>
</dependentAssembly>
</dependency>
</assembly>PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
0#020<0G0Q0\0
B1s1n4
5-575k6
7$7.787
9#9*91989?9F9M9T9
<"<'<,<2<:<N<e<
="=*=@=E=
>2>=>C>
?X?^?h?o?z?
,010R0W0v0
1/1M1a1g1
3 3&3,32383H3N3T3d3j3p3v3|3
4*4/454;4Q4X4`4
<1H1L1
jjjjjjj
9%appdata%
\windrx.txt
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDrives
windows
system
programdata
program files
appdata
application data
default
msocache
config.msi
perflogs
$recycle.bin
VolDri
Antivirus Signature
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Ransom.GandCrab.2664
Cylance unsafe
Sangfor Downloader.Win32.Zeropi.V48v
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Virus:Win32/Zeropi.5675b115
K7GW Trojan-Downloader ( 005b43121 )
K7AntiVirus Trojan-Downloader ( 005b43121 )
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/TrojanDownloader.Agent_AGen.GG
APEX Malicious
McAfee Artemis!F4355AF73C2D
Avast Win32:Malware-gen
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Ransom.GandCrab.2664
NANO-Antivirus Virus.Win32.Zeropi.klqdzp
ViRobot Trojan.Win.Z.Sabsik.20480
MicroWorld-eScan Gen:Variant.Ransom.GandCrab.2664
Tencent Malware.Win32.Gencirc.11bee7e1
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.Phorpiex.dzptg
DrWeb Trojan.DownLoader46.2135
VIPRE Gen:Variant.Ransom.GandCrab.2664
TrendMicro Trojan.Win32.ZEROPI.USBLDF24
Trapmine Clean
FireEye Gen:Variant.Ransom.GandCrab.2664
Emsisoft Gen:Variant.Ransom.GandCrab.2664 (B)
SentinelOne Clean
GData Win32.Trojan.PSE.17C6J32
Jiangmin Clean
Varist Clean
Avira TR/AD.Phorpiex.dzptg
Antiy-AVL Trojan/Win32.Sabsik
Kingsoft Win32.Virus.Zeropi.gen
Gridinsoft Ransom.Win32.Sabsik.sa
Xcitium Clean
Arcabit Trojan.Ransom.GandCrab.DA68
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Virus.Win32.Zeropi.gen
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Google Detected
AhnLab-V3 Malware/Win.Generic.C5472676
Acronis Clean
BitDefenderTheta Clean
MAX malware (ai score=88)
VBA32 BScope.Worm.Propriex
Malwarebytes Malware.AI.2121431273
Panda Clean
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.ZEROPI.USBLDF24
Rising Trojan.Phorpiex!1.EB7A (CLASSIC)
Yandex Clean
Ikarus Win32.Outbreak
MaxSecure Clean
Fortinet W32/Agent_AGen.GG!tr.dldr
AVG Win32:Malware-gen
DeepInstinct MALICIOUS
alibabacloud Virus:Win/Zeropi.gen
No IRMA results available.