Static | ZeroBOX

PE Compile Time

2004-12-30 03:07:16

PDB Path

c:\netcat\Release\netcat.pdb

PE Imphash

b47060fbcbd9d8ec9716eb4a0fdbc38f

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000996e 0x0000a000 6.48018204029
.rdata 0x0000b000 0x000027aa 0x00003000 4.60864913577
.data 0x0000e000 0x00001e04 0x00001000 1.18643298305

Imports

Library WS2_32.dll:
0x40b120 __WSAFDIsSet
0x40b124 select
0x40b128 listen
0x40b12c getsockname
0x40b130 recvfrom
0x40b134 accept
0x40b138 WSASetLastError
0x40b13c socket
0x40b140 setsockopt
0x40b144 bind
0x40b148 connect
0x40b14c htons
0x40b150 getservbyport
0x40b154 ntohs
0x40b158 getservbyname
0x40b15c inet_addr
0x40b160 gethostbyname
0x40b164 inet_ntoa
0x40b168 gethostbyaddr
0x40b16c WSAGetLastError
0x40b170 WSAStartup
0x40b174 WSACleanup
0x40b178 shutdown
0x40b17c closesocket
0x40b180 recv
0x40b184 send
Library KERNEL32.dll:
0x40b004 CreateFileA
0x40b00c PeekConsoleInputA
0x40b010 LCMapStringW
0x40b014 LCMapStringA
0x40b018 GetSystemInfo
0x40b01c VirtualProtect
0x40b020 GetLocaleInfoA
0x40b024 GetStringTypeW
0x40b028 GetStringTypeA
0x40b02c HeapSize
0x40b030 SetStdHandle
0x40b034 SetFilePointer
0x40b03c GetOEMCP
0x40b040 GetACP
0x40b044 CompareStringW
0x40b048 GetCPInfo
0x40b04c MultiByteToWideChar
0x40b050 CompareStringA
0x40b054 VirtualQuery
0x40b058 InterlockedExchange
0x40b05c GetLastError
0x40b060 CloseHandle
0x40b064 CreateProcessA
0x40b068 DuplicateHandle
0x40b06c GetCurrentProcess
0x40b070 ExitThread
0x40b074 Sleep
0x40b078 ReadFile
0x40b07c PeekNamedPipe
0x40b080 WriteFile
0x40b084 CreatePipe
0x40b088 DisconnectNamedPipe
0x40b08c TerminateProcess
0x40b094 TerminateThread
0x40b098 CreateThread
0x40b09c GetStdHandle
0x40b0a0 FreeConsole
0x40b0a4 ExitProcess
0x40b0a8 HeapFree
0x40b0ac HeapAlloc
0x40b0b0 GetProcAddress
0x40b0b4 GetModuleHandleA
0x40b0b8 SetEndOfFile
0x40b0bc GetCommandLineA
0x40b0c0 GetVersionExA
0x40b0c8 GetTickCount
0x40b0cc GetCurrentThreadId
0x40b0d0 GetCurrentProcessId
0x40b0d4 GetModuleFileNameA
0x40b0d8 HeapDestroy
0x40b0dc HeapCreate
0x40b0e0 VirtualFree
0x40b0e4 VirtualAlloc
0x40b0e8 HeapReAlloc
0x40b0ec WideCharToMultiByte
0x40b0f0 SetHandleCount
0x40b0f4 GetFileType
0x40b0f8 GetStartupInfoA
0x40b0fc FlushFileBuffers
0x40b100 RtlUnwind
0x40b118 LoadLibraryA

!This program cannot be run in DOS mode.
`.rdata
@.data
VVVVVj
u#PPPPPj
u9SSSSSj
uDSSSSSj
StWHtBHt*SSSSj
;l$$uM9
tsf9=d
C =02CVu
B 02CV
VC20XC00U
HHt`HHt\
t.;t$$t(
QQSVW3
t#SSUP
t$$VSS
_^][YY
VWumhh
WWWWVSW
t2WWVPVSW
t!SS9]
Failed to execute shell, error = %s
SessionReadShellThreadFn exitted, error = %s
Failed to execute shell
Failed to create shell stdin pipe, error = %s
Failed to create shell stdout pipe, error = %s
WaitForMultipleObjects error: %s
Failed to create ReadShell session thread, error = %s
POSIXLY_CORRECT
%s: invalid option -- %c
%s: illegal option -- %c
%s: option requires an argument -- %c
%s: unrecognized option `%c%s'
%s: unrecognized option `--%s'
%s: option `%s' requires an argument
%s: option `%c%s' doesn't allow an argument
%s: option `--%s' doesn't allow an argument
%s: option `%s' is ambiguous
unknown socket error
NO_DATA
NO_RECOVERY
TRY_AGAIN
HOST_NOT_FOUND
DISCON
NOTINITIALISED
VERNOTSUPPORTED
SYSNOTREADY
REMOTE
STALE
DQUOT
USERS
PROCLIM
NOTEMPTY
HOSTUNREACH
HOSTDOWN
NAMETOOLONG
LOOP
connection refused
TIMEDOUT
TOOMANYREFS
SHUTDOWN
NOTCONN
ISCONN
NOBUFS
CONNRESET
CONNABORTED
NETRESET
NETUNREACH
NETDOWN
ADDRNOTAVAIL
ADDRINUSE
AFNOSUPPORT
PFNOSUPPORT
OPNOTSUPP
SOCKTNOSUPPORT
PROTONOSUPPORT
NOPROTOOPT
PROTOTYPE
MSGSIZE
DESTADDRREQ
NOTSOCK
ALREADY
INPROGRESS
WOULDBLOCK
MFILE
INVAL
FAULT
ACCES
BADF
INTR
Hmalloc %d failed
DNS fwd/rev mismatch: %s != %s
Warning: forward host lookup failed for %s: h_errno %d
%s: inverse host lookup failed: h_errno %d
Warning: inverse host lookup failed for %s: h_errno %d
%s: forward host lookup failed: h_errno %d
gethostpoop fuxored
Can't parse %s as an IP address
Warning: port-bynum mismatch, %d != %d
loadports: bogus values %d, %d
loadports: no block?!
Warning: source routing unavailable on this machine, ignoring
Can't grab %s:%d with bind
retrying local %s:%d
nnetfd reuseaddr failed
Can't get socket
connect to [%s] from %s [%s] %d
invalid connection to [%s] from %s [%s] %d
post-rcv getsockname failed
] %d ...
listening on [
local getsockname failed
local listen fuxored
UDP listen needs -p arg
udptest first write failed?! errno %d
ofd write err
%8.8x
oprint called with no open fd?!
too many output retries
net timeout
select fuxored
Preposterous Pointers: %d, %d
port numbers can be individual or ranges: m-n [inclusive]
UDP mode
verbose [use twice to be more verbose]
-w secs
timeout for connects and final net reads
zero-I/O mode [used for scanning]
answer TELNET negotiation
-g gateway
source-routing hop point[s], up to 8
-G num
source-routing pointer: 4, 8, 12, ...
this cruft
-i secs
delay interval for lines sent, ports scanned
listen mode, for inbound connects
listen harder, re-listen on socket close
numeric-only IP addresses, no DNS
-o file
hex dump of traffic
-p port
local port number
randomize local and remote ports
-s addr
local source address
-e prog
inbound program to exec [dangerous!!]
detach from console, background mode
[v1.11 NT www.vulnwatch.org/netcat/]
connect to somewhere:
nc [-options] hostname port[s] [ports] ...
listen for inbound:
nc -l -p port [options] [hostname] [port]
options:
no port[s] to connect to
no destination
no connection
invalid port %s
can't open %s
nc -h for help
invalid wait-time %s
too many -g hops
invalid hop pointer %d, must be multiple of 4 <= 28
all-A-records NIY
sent %d, rcvd %d
%s [%s] %d (%s)
%s [%s] %d (%s) open
invalid local port %s
invalid interval time %s
ade:g:G:hi:lLno:p:rs:tuvw:z
Cmd line:
CorExitProcess
mscoree.dll
Microsoft Visual C++ Runtime Library
Program:
<program name unknown>
A buffer overrun has been detected which has corrupted the program's
internal state. The program cannot safely continue execution and must
now be terminated.
Buffer overrun detected!
A security error of unknown cause has been detected which has
corrupted the program's internal state. The program cannot safely
continue execution and must now be terminated.
Unknown security failure detected!
`h````
ppxxxx
(null)
runtime error
TLOSS error
SING error
DOMAIN error
- This application cannot run using the active version of the Microsoft .NET Runtime
Please contact the application's support team for more information.
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Runtime Error!
Program:
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
CONIN$
c:\netcat\Release\netcat.pdb
WS2_32.dll
GetLastError
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
ExitThread
ReadFile
PeekNamedPipe
WriteFile
CreatePipe
DisconnectNamedPipe
TerminateProcess
WaitForMultipleObjects
TerminateThread
CreateThread
GetStdHandle
FreeConsole
KERNEL32.dll
ExitProcess
HeapFree
HeapAlloc
GetProcAddress
GetModuleHandleA
GetSystemTimeAsFileTime
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
WideCharToMultiByte
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LoadLibraryA
InterlockedExchange
VirtualQuery
CompareStringA
MultiByteToWideChar
GetCPInfo
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
SetFilePointer
SetStdHandle
HeapSize
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
LCMapStringA
LCMapStringW
PeekConsoleInputA
GetNumberOfConsoleInputEvents
CreateFileA
SetEndOfFile
(UNKNOWN)
sent %d, rcvd %d
0123456789abcdef
</body></html>
jjjjjj
(null)
((((( H
h(((( H
H
;T^h<U_i=V`j>Wak?Xbl@YcmAZdnB[eoC\fpD]gq
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Riskware.Win32.NetCat.1!c
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Trojan.GenericPMF.S519521
Skyhigh Tool-NetCat.g
ALYac Application.RemoteAdmin.RGU
Cylance unsafe
Zillya Trojan.RemoteAdmin.Win32.8
Sangfor Hacktool.Win32.Remoteadmin.V3hj
K7AntiVirus Unwanted-Program ( 0049ebb41 )
Alibaba Clean
K7GW Unwanted-Program ( 0049ebb41 )
Cybereason Clean
Baidu Clean
VirIT RemoteAdmin.Win32.Netcat.A
Paloalto generic.ml
Symantec NetCat
tehtris Clean
ESET-NOD32 Win32/RemoteAdmin.NetCat potentially unsafe
APEX Clean
Avast FileRepMalware [Trj]
Cynet Malicious (score: 99)
Kaspersky not-a-virus:RemoteAdmin.Win32.NetCat.a
BitDefender Application.RemoteAdmin.RGU
NANO-Antivirus Riskware.Win32.NetCat.eimnse
ViRobot Clean
MicroWorld-eScan Application.RemoteAdmin.RGU
Tencent Malware.Win32.Gencirc.13c13687
TACHYON Clean
Sophos NetCat (PUA)
F-Secure Riskware:W32/NetCat.C
DrWeb Clean
VIPRE Application.RemoteAdmin.RGU
TrendMicro HackTool.Win32.Netcat.SM
Trapmine Clean
FireEye Generic.mg.1965ab1b3664aac8
Emsisoft Application.RemoteAdmin.RGU (B)
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan/VulnWatch.a
Webroot W32.Malware.Gen
Varist W32/Agent.THOE-8538
Avira SPR/NetCat.P
Antiy-AVL RiskWare[RemoteAdmin]/Win32.NetCat.a
Kingsoft Win32.Troj.Undef.a
Gridinsoft Malware.Win32.Gen.sm!s1
Xcitium ApplicUnsaf.Win32.RemoteAdmin.NetCat.g@1miisx
Arcabit Application.RemoteAdmin.RGU
SUPERAntiSpyware PUP.NetCat/Variant
ZoneAlarm not-a-virus:RemoteAdmin.Win32.NetCat.a
GData Application.RemoteAdmin.RGU
Google Detected
AhnLab-V3 Win-AppCare/NTSniff_v111.61440
Acronis Clean
McAfee Tool-NetCat.g
MAX malware (ai score=100)
VBA32 Clean
Malwarebytes Generic.Malware.AI.DDS
Panda Hacktool/NetCat.B
Zoner Trojan.Win32.38913
TrendMicro-HouseCall Clean
Rising HackTool.NetCat!1.BBDD (CLASSIC)
Yandex Clean
Ikarus Clean
MaxSecure Trojan.Malware.1934784.susgen
Fortinet Riskware/NetCat.AO
BitDefenderTheta Clean
AVG FileRepMalware [Trj]
DeepInstinct MALICIOUS
alibabacloud Backdoor[rat]:Win/RemoteAdmin.NylLqj
No IRMA results available.