Static | ZeroBOX

PE Compile Time

2024-04-18 04:19:33

PE Imphash

82004e1f718cc406824f64c2578845d6

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00012a5e 0x00012c00 6.64872308011
.rdata 0x00014000 0x00006aec 0x00006c00 5.15546808392
.data 0x0001b000 0x00017a44 0x00017200 7.95100518996
.rsrc 0x00033000 0x000001e0 0x00000200 4.7113407226
.reloc 0x00034000 0x00001024 0x00001200 6.22328810769

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00033060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library GDI32.dll:
0x414000 OffsetRgn
Library KERNEL32.dll:
0x414008 VirtualProtect
0x41400c WaitForSingleObject
0x414010 CloseHandle
0x414014 FreeConsole
0x414018 CreateThread
0x414024 GetCurrentProcess
0x414028 TerminateProcess
0x414034 GetCurrentProcessId
0x414038 GetCurrentThreadId
0x414040 InitializeSListHead
0x414044 IsDebuggerPresent
0x414048 GetStartupInfoW
0x41404c GetModuleHandleW
0x414050 WriteConsoleW
0x414054 RtlUnwind
0x414058 GetLastError
0x41405c SetLastError
0x414070 TlsAlloc
0x414074 TlsGetValue
0x414078 TlsSetValue
0x41407c TlsFree
0x414080 FreeLibrary
0x414084 GetProcAddress
0x414088 LoadLibraryExW
0x41408c EncodePointer
0x414090 RaiseException
0x414094 GetStdHandle
0x414098 WriteFile
0x41409c GetModuleFileNameW
0x4140a0 ExitProcess
0x4140a4 GetModuleHandleExW
0x4140a8 GetCommandLineA
0x4140ac GetCommandLineW
0x4140b0 HeapAlloc
0x4140b4 HeapFree
0x4140b8 CompareStringW
0x4140bc LCMapStringW
0x4140c0 GetFileType
0x4140c4 FindClose
0x4140c8 FindFirstFileExW
0x4140cc FindNextFileW
0x4140d0 IsValidCodePage
0x4140d4 GetACP
0x4140d8 GetOEMCP
0x4140dc GetCPInfo
0x4140e0 MultiByteToWideChar
0x4140e4 WideCharToMultiByte
0x4140f4 SetStdHandle
0x4140f8 GetStringTypeW
0x4140fc GetProcessHeap
0x414100 FlushFileBuffers
0x414104 GetConsoleOutputCP
0x414108 GetConsoleMode
0x41410c GetFileSizeEx
0x414110 SetFilePointerEx
0x414114 HeapSize
0x414118 HeapReAlloc
0x41411c CreateFileW
0x414120 DecodePointer

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
u"h@#C
URPQQh0'@
UQPXY]Y[
QQSVWd
<ItC<Lt3<Tt#<h
A<lt'<tt
F +F4+
8^8tb9^4~]
YYhtAA
t!hdNA
M,j"^QRRRRR
Vj0XPW
r!SSPVQ
dr#SSjdVQ
M$j"^QRRRRR
j"[VWWWW
u#Vht(C
uSSSSj
f9:t!V
QQSVj8j@
xg;5p(C
F95l#C
xE;5p(C
^PQQQQQ
E ^PQQQQ
CY<u
PPPPPPPP
PPPPPVW
PP9E u!PPSVP
xK;5p(C
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__swift_3
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
Unknown exception
bad exception
(null)
CorExitProcess
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[aOni*{
~ $s%r
@b;zO]
v2!L.2
1#QNAN
1#SNAN
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
""""""""""""""""****************NNNNNNNNNNNNNNNNjjjjjjjjjjjjjjjjllllllllllllllllppppppppppppppppsssssssssssssssstttttttttttttttt
.text$mn
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.rsrc$01
.rsrc$02
OffsetRgn
GDI32.dll
VirtualProtect
WaitForSingleObject
CloseHandle
FreeConsole
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
KERNEL32.dll
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CreateFileW
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
!,/>jo
S=s9J^
z[@xdnh
s, ji0
%sH'SS
~-9|p6
54)A@[\
@_Gyz`(>U
,U'q"&$n
Flw(tt37
yVU3u
V4N9-~ "
;lev-k
W{Yn4
S;Kk.Ic
B5O{CKH
{7Udbh
BvF%XX
4W<=Bz-
{:oWZx
12'=xZ#
p NAA8
(R@[eu
U.75uI
l3x_)V
lA4T=L
>F`\Ae
&P2!K
H)V*5h
6BQ6w}Tg
F*60&\
{=4b@3
`trGm!*
J'^5@aG
JFcZY9`
)h%acY
t-!06+
iH5Km`
:RqANh/
R?5c&!Q
yHWR@}
vo!PG]
y:@t=5~
$,bh{>
<^9t-Y
`/Psn6
|H.]4[
ohWy=TU[
g2v4:4S
m 4GFc
C7D(rzN"
$qq,)A
$gHbGq
tZ5}>>
Nq[9>o6
UV5a|l
h9;2>_
4J;n|o
?iS#Yj
7x0m;0{
UO'a-t
_Csu2o
fTtG,~
AP2T94
tY\/0U
&y'Lz\
5raY%W
h!9\:7,
Huw.H%
l 2@b7r
NtPkvj
*^iV:ZF
d-+fNQ%
z,Jkvg
%8H%Sb*
|IS~Se
c(ts-M
K2YY7
fgcm-8
0U'M%
1q`5_v
@=^c'.
Sc<;FF
M_54\!
"T{pxj4
/XM>0p
EVi'~]w
`6l^|"
og"AY*r
E<D9yc
'/3SAxjEx
j`$>\Y
e7)&$t
m0V*2,G
}fdB23
^N78xwm|
!OL.2
Rvx[C\V
Z]'#bkw
fI'QKu8
wm3$hp
Jwre/S
:sIJ^C`
'CNJ19J
`df"\7^
W=l&"t
~Q^cxi
'Co:sK
;`W^ac;a
07Y&:[
btqIa_&
N>rFl2
I^@ErO
y,{\s"
LV:#9_v
nFJ9/q
AecxYmx.1
NnOK'k
x)kz"J
3K"VV
UdYwe29
IV8JC4
4j%lbx
ImZ1"B
LF-d}o!co
#lOp=.
%G[Nmr
cx,PK-#3
I qhA7
&0UbEx
8ENki[
LqD0i
k:'pLi!I
!Y]He
It8=fm
DV?Q,,4
J$=p1.
fY95taJ
_{AxR
!O6"u=
)VDS6eN
t[UaVV%
M&CT;aC
rPmsaQ
\C=ynh
. +C+
A+x"M"
V\47iC
#;hu1&
M Qk'I-
!j/l3\
}WA.0Nv
(CM'vkt}
Ehd|cln
G45BIP
?3(ze'
DN/dX}r
xP|H&{
~~|H&{
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVtype_info@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
4)40484G4Q4r4
674797>7_7d7q7
99'939<9A9G9Q9[9k9{9
9%:X:~:
<!<.<D<~<
>&>e>k>
?1?N?z?
60?0G0
171>1M1
828S8a8g8
9(949P9p9~9
:-:X:b:
;#;-;9;>;C;^;h;t;y;~;
2=3(4X4q4
5-5B5X5e5s5
k1s1y1
464j5P7T7X7\7`7d7h7l7
8&<-<J<N<R<V<Z<
1)1R1O3^3w3e4o4|4
4"5;5E5Q5{5
77&7.7F7T7\7t7
="=-=E=S=v=
>">7>D>Z>a>m>
#010J0R0[0d0u0
1O1[1`1f1k1s1y1
6)616<6B6M6S6a6k6o6w6
737D7I7
7i8t8o9
;*;C;Q;];i;};
;*<B<R<f<k<p<
="='=,=G=Q=a=f=k=
>!>&>+>L>\>
?&?2?@?a?h?
2"3T3o3
8,868Y8c8
6_7q7w7"8t8
9T:/;6;c;j;
<7<^<s<
=)=<=V=e=
404H4{4
=>(>,>2>6><>@>J>]>k>
4#444B4I4
7F7M7X7f7m7s7
90979S9Z9q9
:-:]:f:
;);;;M;_;
2$2H2x2
33*3`3~3
4[4`4e4j4s445=5
6(6^6{6
0>0E0L0o0
878c8B9O9z9
:=;W;d;
69%9*919A9O9`9x9~9
:!:):G:O:
2-252E2V2
3 3,3;3N3m3
6"7A7r7
:/:E:M:?>E?u?
62;2M2k2
(141@1D1H1L1P1T1`1d1h1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5D;H;L;\<`<d<|<
`0d0h0l0p0t0x0|0
6P6T6X6\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
9 9(90989@9H9P9X9`9h9p9x9
7$7,747<7D7L7T7\7d7l7(8,8
:(:,:0:8:P:`:d:t:x:
?$?H?T?\?
0 0(040x0
1@1`1|1
2 2@2`2
3 3@3`3
4 4<4@4
20242`7d7h7l7p7t7x7|7
DigiCert Inc1
www.digicert.com1+0)
"DigiCert EV Code Signing CA (SHA2)0
201008000000Z
231012120000Z0
Private Organization1
236387771
Taipei City1
Beitou District1
ASUSTeK COMPUTER INC.1
ASUSTeK COMPUTER INC.0
TW-236387770
1http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
1http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
https://www.digicert.com/CPS0
http://ocsp.digicert.com0H
<http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
D<|x"
DigiCert Inc1
www.digicert.com1+0)
"DigiCert High Assurance EV Root CA0
120418120000Z
270418120000Z0l1
DigiCert Inc1
www.digicert.com1+0)
"DigiCert EV Code Signing CA (SHA2)0
+.+1Xf
http://ocsp.digicert.com0I
=http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
:http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
:http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
.http://www.digicert.com/ssl-cps-repository.htm0
DigiCert Inc1
www.digicert.com1+0)
"DigiCert EV Code Signing CA (SHA2)
20230725093112Z
DigiCert, Inc.1;09
2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA0
220921000000Z
331121235959Z0F1
DigiCert1$0"
DigiCert Timestamp 2022 - 20
Ihttp://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
http://ocsp.digicert.com0X
Lhttp://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
(f*^[0
DigiCert Inc1
www.digicert.com1!0
DigiCert Trusted Root G40
220323000000Z
370322235959Z0c1
DigiCert, Inc.1;09
2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA0
http://ocsp.digicert.com0A
5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
2http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
DigiCert Inc1
www.digicert.com1$0"
DigiCert Assured ID Root CA0
220801000000Z
311109235959Z0b1
DigiCert Inc1
www.digicert.com1!0
DigiCert Trusted Root G40
]J<0"0i3
v=Y]Bv
http://ocsp.digicert.com0C
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
~qj#k"
DigiCert, Inc.1;09
2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA
230725093112Z0+
/1(0&0$0"
u\1<Pb
Aapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
(null)
mscoree.dll
Aapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
api-ms-win-core-fibers-l1-1-0
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
Aja-JP
((((( H
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
RAny use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability and are incorporated herein by reference
Antivirus Signature
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh Artemis!Trojan
ALYac Clean
Cylance unsafe
Zillya Clean
Sangfor Infostealer.Win32.Reline.V1lg
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Clean
K7GW Trojan ( 005b44341 )
K7AntiVirus Trojan ( 005b44341 )
Baidu Clean
VirIT Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/GenKryptik.GWRU
APEX Malicious
Avast Win32:PWSX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-PSW.Win32.Reline.gen
BitDefender Trojan.Generic.35718958
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Trojan.Generic.35718958
Tencent Win32.Trojan.FalseSign.Nqil
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.PhemedromeSteal.odadv
DrWeb Trojan.DownLoaderNET.764
VIPRE Clean
TrendMicro Trojan.Win32.AMADEY.YXEDRZ
Trapmine malicious.high.ml.score
FireEye Generic.mg.51b0ed6b4908a21e
Emsisoft Trojan.Generic.35718958 (B)
Paloalto Clean
GData MSIL.Trojan-Stealer.XehookStealer.HPN7BH
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist W32/Kryptik.MBW.gen!Eldorado
Avira TR/AD.PhemedromeSteal.odadv
MAX malware (ai score=82)
Antiy-AVL Trojan[Backdoor]/Win32.Convagent
Kingsoft Win32.Trojan-PSW.Reline.gen
Gridinsoft Ransom.Win32.Wacatac.cl
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-PSW.Win32.Reline.gen
Microsoft Trojan:Win32/Znyonm
Google Detected
AhnLab-V3 Trojan/Win.PWStealer.C5614197
Acronis Clean
McAfee Artemis!51B0ED6B4908
TACHYON Clean
VBA32 Clean
Malwarebytes Trojan.Crypt.Generic
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXEDRZ
Rising Stealer.Reline!8.132F4 (CLOUD)
Yandex Clean
Ikarus Trojan.Win32.Krypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.GWQT!tr
BitDefenderTheta Gen:NN.ZexaF.36802.nuY@aawuULni
AVG Win32:PWSX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Clean
No IRMA results available.