Static | ZeroBOX

PE Compile Time

2024-03-03 15:02:18

PE Imphash

61d6334c6ae4948c906d9fa7fdf019fa

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00012336 0x00012400 6.61460964915
.rdata 0x00014000 0x00006934 0x00006a00 4.95005395451
.data 0x0001b000 0x0000171c 0x00000c00 2.1771411137
.rsrc 0x0001d000 0x000000f8 0x00000200 2.52495999013
.reloc 0x0001e000 0x000014d4 0x00001600 6.46322982936

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0001d060 0x00000091 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x10014000 GlobalAlloc
0x10014004 GlobalLock
0x10014008 GlobalUnlock
0x1001400c WideCharToMultiByte
0x10014010 Sleep
0x10014014 WriteConsoleW
0x10014018 CloseHandle
0x1001401c CreateFileW
0x10014020 SetFilePointerEx
0x10014024 GetConsoleMode
0x10014028 GetConsoleCP
0x1001402c WriteFile
0x10014030 FlushFileBuffers
0x10014034 SetStdHandle
0x10014038 HeapReAlloc
0x1001403c HeapSize
0x10014048 GetCurrentProcess
0x1001404c TerminateProcess
0x10014054 IsDebuggerPresent
0x10014058 GetStartupInfoW
0x1001405c GetModuleHandleW
0x10014064 GetCurrentProcessId
0x10014068 GetCurrentThreadId
0x10014070 InitializeSListHead
0x10014074 RtlUnwind
0x10014078 RaiseException
0x1001407c InterlockedFlushSList
0x10014080 GetLastError
0x10014084 SetLastError
0x10014088 EncodePointer
0x1001408c EnterCriticalSection
0x10014090 LeaveCriticalSection
0x10014094 DeleteCriticalSection
0x1001409c TlsAlloc
0x100140a0 TlsGetValue
0x100140a4 TlsSetValue
0x100140a8 TlsFree
0x100140ac FreeLibrary
0x100140b0 GetProcAddress
0x100140b4 LoadLibraryExW
0x100140b8 ExitProcess
0x100140bc GetModuleHandleExW
0x100140c0 GetModuleFileNameW
0x100140c4 HeapAlloc
0x100140c8 HeapFree
0x100140cc FindClose
0x100140d0 FindFirstFileExW
0x100140d4 FindNextFileW
0x100140d8 IsValidCodePage
0x100140dc GetACP
0x100140e0 GetOEMCP
0x100140e4 GetCPInfo
0x100140e8 GetCommandLineA
0x100140ec GetCommandLineW
0x100140f0 MultiByteToWideChar
0x100140f4 GetEnvironmentStringsW
0x100140fc LCMapStringW
0x10014100 GetProcessHeap
0x10014104 GetStdHandle
0x10014108 GetFileType
0x1001410c GetStringTypeW
0x10014110 DecodePointer
Library USER32.dll:
0x10014118 EmptyClipboard
0x1001411c SetClipboardData
0x10014120 CloseClipboard
0x10014124 GetClipboardData
0x10014128 OpenClipboard
Library WININET.dll:
0x10014130 InternetOpenW
0x10014134 InternetConnectA
0x10014138 HttpOpenRequestA
0x1001413c HttpSendRequestA
0x10014140 InternetReadFile
0x10014144 InternetCloseHandle

Exports

Ordinal Address Name
1 0x100011a0 ??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
2 0x100011a0 ??4CClipperDLL@@QAEAAV0@ABV0@@Z
3 0x10005030 Main
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
QQSVWd
URPQQh
;t$,v-
UQPXY]Y[
zSSSSj
f9:t!V
PPPPPPPP
PPPPPWS
PP9E u:PPVWP
QQSVj8j@
bad allocation
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CorExitProcess
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
AreFileApisANSI
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
Unknown exception
bad array new length
443351145ece4966ded809641c77cfa8
a091ec0a6e22276a96a99c1d34ef679c
FMcrF ysGC6BFxDpQX1=
EUtmTM7r75jV4xvqd08hOVbn3Ids
Content-Type: application/x-www-form-urlencoded
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
abcdefghijklmnopqrstuvwxyz0123456789
13Ko3ZvuHfx3ESJNnNmcSe5gzmmZTcYdXy
0x619B7A2AdFA73f224Cf3D3Fa6Adf644a8f2698f7
LRfywbm9Rg8KuoHQUf9V6Z6dVBNGQuKALK
D6uWuYJfWJdEZLf6sNcK3WmWXc7oac5XBt
4AhxCXJYG9mZCf8o7e2TneeDXASpzyGRddf51u7stARxaGwDjvP5x9R8VPkkLeYsyjW7YZfQofzQAc9YGH5baEkYHDT8VWu
invalid string position
string too long
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.edata
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.rsrc$01
.rsrc$02
CLIPPERDLL.dll
??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
??4CClipperDLL@@QAEAAV0@ABV0@@Z
GlobalAlloc
GlobalLock
GlobalUnlock
WideCharToMultiByte
KERNEL32.dll
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetClipboardData
USER32.dll
InternetOpenW
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
WININET.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVbad_alloc@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
</assembly>
0#0(020C0H0R0c0h0r0
1!13181B1Q1a1q1
1%2M2S2o2
4O4i4o6
9%9<9D9I9t9
:@:J:T:_:l:6;E;
2'2.272G2M2V2
;&<7<y<
<^=$>*>V>e>
0 1&1-131<1K1U1
1-272A2L2Y2
3%3/3:3G3
4 4\4f4n4
4.555E5\5c5i5r5
5J6]6y6
8"8^8d8k8q8z8
9*929<9k9u9
: :*:Y:c:m:x:
<(<2<l<s<
>9?C?K?`?
0"090@0F0O0h0p0z0
0'1:1V1^1h1
3!333b3
454O4b4y4
5%575f5
5b6l6q6|6
777f7/8N8v8
9"9J9w9
=5=T=o=
060E0\0b0h0n0t0z0
0;1H1p1
2"2)20272>2F2N2V2b2k2p2v2
3 3'3.353<3C3K3S3[3f3k3q3{3
434@4a4f4
5&5A5Y5
6#767@7
8;8E8N8W8l8u8
:-:A:^:
:%;.;5;;;A;M;S;v;~;
6+696?6Z6
7[7j7J8z:
5(565=5C5u5
7.7T7~7
8!8+878<8A8\8f8r8w8|8
<K<P<T<X<\<
40G0e0s0!2X2_2d2h2l2p2
7Q7t7{7
=1>>>M>b>l>
0%0.0?0Q0`0
4 5;5K5P5Z5_5j5u5
5B6U6x6
:-:>:C:
0+0T0i0{0
1$111Z1a1
252F2{2J3z3
4&4?4D4M4
5 5.555;5V5]5
56%6Q6W6i6
0A1H1O1V1p1
2>2f2V4
4"5n5w5{5
;;/;4;9;I;N;S;x;
<6<?<w<
=7=A=Q=V=[=v=
?-?9?F?M?W?m?
,0c0u0
001@1q1
364?4W4
5&545<5T5a5
8)858A8O8_8t8
0%070I0[0|0
= >S>h>y>
<6=@=j=>>
141X1c1p1
3"323@3Q3i3o3{3
607Z7b7
?.?M?x?
"0D0h0
686N6d6l6
323C3q3
3&5]637d7
=!=+=B=L=w=
>7>A>K>b>l>
?"?,?W?a?k?
0!0+0B0L0w0
171A1K1b1l1
2"2,2W2a2k2
L1T1X1\1`1d1h1l1p1t1x1|1
2 2$2(2024282<2@2D2H2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
> >$>(>,>0><>D>L>P>T>X>\>
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6|6
7 7$7(7
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
1 1(10181@1H1P1X1`1h1p1x1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
2"2&2,;4;<;D;L;T;\;d;l;t;|;
d0h0p0
1$1(181<1@1D1L1d1t1x1
2 2$2(202H2L2P2T2\2`2h2p2
3(3,3p6
7 7,7L7T7`7
8,848<8H8h8p8|8
9<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:P:t:|:
;$;,;4;<;@;D;L;`;h;p;x;|;
< <<<@<`<h<l<
=$=(=0=8=@=D=L=`=
> >@>`>
? ?@?`?
0 0@0`0
7 7$7(7,70747
:8:X:p:
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
mscoree.dll
((((( H
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
Antivirus Signature
Bkav W32.Common.AD8E17E1
Elastic malicious (high confidence)
ClamAV Win.Malware.Zusy-10015683-0
CMC Clean
CAT-QuickHeal Trojan.Agent
Skyhigh BehavesLike.Win32.NetLoader.ch
ALYac Gen:Variant.Zusy.446682
Cylance unsafe
Zillya Trojan.ClipBanker.Win32.20967
Sangfor Banker.Win32.Clipbanker.Vtsc
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/Amadey.4e5f0928
K7GW Trojan ( 005b155f1 )
K7AntiVirus Trojan ( 005b155f1 )
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/ClipBanker.SJ
APEX Clean
Avast Win32:TrojanX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Agent.gen
BitDefender Gen:Variant.Zusy.446682
NANO-Antivirus Trojan.Win32.ClipBanker.kiiqgo
ViRobot Clean
MicroWorld-eScan Gen:Variant.Zusy.446682
Tencent Malware.Win32.Gencirc.11bd22b5
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/ClipBanker.pjgxt
DrWeb Trojan.PWS.Stealer.38604
VIPRE Gen:Variant.Zusy.446682
TrendMicro TROJ_GEN.R002C0DC324
Trapmine Clean
FireEye Gen:Variant.Zusy.446682
Emsisoft Gen:Variant.Zusy.446682 (B)
SentinelOne Clean
GData Gen:Variant.Zusy.446682
Jiangmin Trojan.Agent.evln
Varist W32/ABPWS.FIWG-2614
Avira TR/ClipBanker.pjgxt
Antiy-AVL Trojan/Win32.ClipBanker
Kingsoft Win32.Trojan.Agent.gen
Gridinsoft Ransom.Win32.Banker.sa
Xcitium Clean
Arcabit Trojan.Zusy.D6D0DA
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
Microsoft Trojan:Win32/Amadey.MA!MTB
Google Detected
AhnLab-V3 Trojan/Win.Amadey.C5582822
Acronis Clean
McAfee RDN/PWS-Banker
MAX malware (ai score=84)
VBA32 TrojanDownloader.Deyma
Malwarebytes Trojan.ClipBanker
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DC324
Rising Trojan.ClipBanker!8.5FB (TFE:5:nquGHEI3J2D)
Yandex Trojan.Agent!QzehQKeIan4
Ikarus Trojan.Win32.Amadey
MaxSecure Trojan.Malware.771626.susgen
Fortinet W32/ClipBanker.SJ!tr
BitDefenderTheta Gen:NN.ZedlaF.36802.gu4@aymTc2hi
AVG Win32:TrojanX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Trojan:Win/ClipBanker.SJ
No IRMA results available.