Static | ZeroBOX

PE Compile Time

2023-11-02 18:20:54

PDB Path

E:\Projects\WxWorkMultiOpen\Release\WxWorkMultiOpen.pdb

PE Imphash

198cae56a522dac5925be33cafddc4a6

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00014498 0x00014600 6.64026340141
.rdata 0x00016000 0x0000bc10 0x0000be00 5.64879277834
.data 0x00022000 0x0000183c 0x00000c00 2.14476834182
.rsrc 0x00024000 0x000001e0 0x00000200 4.71767883295
.reloc 0x00025000 0x000012a8 0x00001400 6.3528340799

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00024060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x41601c GetProcAddress
0x416020 VirtualAllocEx
0x416024 CreateRemoteThread
0x416028 VirtualFree
0x41602c VirtualAlloc
0x416030 DuplicateHandle
0x416034 MultiByteToWideChar
0x416038 CreateProcessW
0x41603c GetModuleFileNameW
0x416044 CloseHandle
0x416048 WideCharToMultiByte
0x41604c lstrcmpA
0x416050 Sleep
0x416054 CreateFileW
0x416058 Process32FirstW
0x41605c Process32NextW
0x416060 GetLastError
0x416068 OpenProcess
0x41606c GetModuleHandleA
0x416070 GetCurrentProcess
0x416074 HeapSize
0x416078 SetFilePointerEx
0x41607c WriteProcessMemory
0x416080 GetFileSizeEx
0x416084 GetConsoleMode
0x416088 GetConsoleOutputCP
0x41608c FlushFileBuffers
0x4160a0 EncodePointer
0x4160a4 DecodePointer
0x4160a8 GetStringTypeW
0x4160ac GetCPInfo
0x4160b8 TerminateProcess
0x4160c4 GetCurrentProcessId
0x4160c8 GetCurrentThreadId
0x4160d0 InitializeSListHead
0x4160d4 IsDebuggerPresent
0x4160d8 GetStartupInfoW
0x4160dc GetModuleHandleW
0x4160e0 RtlUnwind
0x4160e4 RaiseException
0x4160e8 SetLastError
0x4160f0 TlsAlloc
0x4160f4 TlsGetValue
0x4160f8 TlsSetValue
0x4160fc TlsFree
0x416100 FreeLibrary
0x416104 LoadLibraryExW
0x416108 GetStdHandle
0x41610c WriteFile
0x416110 ExitProcess
0x416114 GetModuleHandleExW
0x416118 GetCommandLineA
0x41611c GetCommandLineW
0x416120 HeapAlloc
0x416124 HeapFree
0x416128 CompareStringW
0x41612c LCMapStringW
0x416130 GetFileType
0x416134 HeapReAlloc
0x416138 FindClose
0x41613c FindFirstFileExW
0x416140 FindNextFileW
0x416144 IsValidCodePage
0x416148 GetACP
0x41614c GetOEMCP
0x41615c SetStdHandle
0x416160 GetProcessHeap
0x416164 WriteConsoleW
Library ADVAPI32.dll:
0x416004 RegCloseKey
0x416008 RegOpenKeyExW
0x41600c RegQueryValueExW
0x416014 OpenProcessToken

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
u"h8-B
QQSVWd
URPQQh
UQPXY]Y[
F4_^[]
<ItC<Lt3<Tt#<h
A<lt'<tt
PPPPPPPP
u,PQRS
Wj0XPV
SPjdVQ
PPPPPWS
PP9E u:PPVWP
zSSSSj
f9:t!V
QQSVj8j@
CY<u
PPPPPPPP
bad allocation
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
cross device link
destination address required
device or resource busy
directory not empty
executable format error
file exists
file too large
filename too long
function not supported
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
interrupted
invalid argument
invalid seek
io error
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no lock available
no message available
no message
no protocol option
no space on device
no stream resources
no such device or address
no such device
no such file or directory
no such process
not a directory
not a socket
not a stream
not connected
not enough memory
not supported
operation canceled
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
permission denied
protocol error
protocol not supported
read only file system
resource deadlock would occur
resource unavailable try again
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many files open
too many links
too many symbolic link levels
value too large
wrong protocol type
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefghijklmnopqrstuvwxyz
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
(null)
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[aOni*{
~ $s%r
@b;zO]
v2!L.2
CorExitProcess
AreFileApisANSI
CompareStringEx
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
_hypot
_nextafter
1#QNAN
1#SNAN
]vQ<)8
|)P!?Ua0
Eb2]A=
u?^p?o4
y1~?|"
?x+s7
?5Od%
?|I7Z#
>,'1D=
?g)([|X>=
~U`?K
:h"?bC
@H#?43
Ax#?uN}*
r7Yr7=
F0$?3=1
H`$?h|
&?~YK|
sU0&?W
<8bunz8
?#%X.y
F||<##
<@En[vP
b<log10
?5Wg4p
%S#[k=
"B <1=
LoadLibraryA
kernel32.dll
LoadLibraryA
Unknown exception
bad array new length
string too long
ZwQuerySystemInformation
ntdll.dll
NtQueryObject
\WxWorkApis.dll
E:\Projects\WxWorkMultiOpen\Release\WxWorkMultiOpen.pdb
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCC
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.rsrc$01
.rsrc$02
WriteProcessMemory
GetCurrentProcess
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetLastError
Process32NextW
Process32FirstW
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
VirtualFree
VirtualAlloc
DuplicateHandle
MultiByteToWideChar
CreateProcessW
GetModuleFileNameW
GetCurrentDirectoryA
WideCharToMultiByte
lstrcmpA
KERNEL32.dll
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ADVAPI32.dll
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
CreateFileW
WriteConsoleW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVbad_exception@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVtype_info@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
0!0&0,03080>0H0T0`0l0v0
1E1m1s1
2!262L2
3G3_3i3x3
7C8N8m8y8
<)<f?x?
080h0q0
2h3s3{3
4$4?4H4P4`4k475=5R5q5
6 606F6^6q6
;";7;L;S;Y;k;u;
="=5=C=I=O=U=[=a=h=o=v=}=
>1>S>b>k>x>
?;?D?J?]?
)0I0S0s0
11$171K1P1c1
393B3K3Y3b3
5#676S6]6g6u6
1+20454u4
6!6C6W6h6t6
77$7?7L7U7Z7_7z7
848D8\8
9#919A9V9m9
:":==E=L=
0-1115191=1A1E1I1@6G6l6p6t6x6|6
5+626=6K6R6X6s6z6
7N7Y7D9N9g9q9
;)<S<n<
=4=9=E=J=^=->4>F>Z>b>l>u>
?P?\?a?g?l?t?z?
4#4/4I4
5/5@5E5
5?7E7q7w7
838A8M8Y8m8
9.9>9R9W9\9y9
:3:=:M:R:W:r:
<)<5<C<d<k<
1U22393
8&8O8d8v8
99,9U9\9}9
:0:A:V:`:
4.646O6T6
7!777@7K7S7q7}7
:&;.;T;x;
8=9\9r9
:m:r:w:|:
7]7d7k7r7
4!484N4
4$5-5N5`5r5
6&6G6Y6k6}6
;)<a<0=d?
3G3\3m3
3<4X4z4
2%:-:d:k:
131^1y1
:o;u;~;
1-2G2T2
5$6_8e8j8q8
899A9I9Q9Y9w9
=-=K=_=e=
3#4@4]4g4q4{4
l1t1x1|1
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7<=@=D=
? ?(?0?8?@?H?P?X?`?h?p?x?
0 0(00080@0H0P0X0`0h0p0x0
1 1(10181@1H1P1X1`1h1p1x1
2 2(20282@2H2P2X2`2h2p2x2
2 2$2(2,20242<2@2D2H2L2P2T2X2d2l2t2x2|2
7@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
=$=,=4=<=D=L=T=\=d=l=t=|=
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
7 7$7(707H7X7\7l7p7t7x7
8,8<8@8D8H8L8T8X8`8x8|8
9 =@=L=l=x=
>T>X>t>x>
> ?,?4?\?`?|?
080X0x0
181X1x1
282X2x2
383T3X3`3d3h3p3
1 1$1(1,10141@1D1H1L1P1T1X1\1
2 202H2T2X2\2x2|2
jjjjjj
Aapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
(null)
((((( H
((((( H
(
mscoree.dll
Aapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
api-ms-win-appmodel-runtime-l1-1-2
user32
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
Aja-JP
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
SeDebugPrivilege
WXWork.exe
Mutant
WeWork
Software\Tencent\WXWork
Executable
ExclusiveObjectInstance1
ExclusiveObject
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win32.BadFile.ch
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 Clean
APEX Malicious
Avast Clean
Cynet Malicious (score: 100)
Kaspersky Clean
BitDefender Clean
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Agent.141824.CI
MicroWorld-eScan Clean
Tencent Clean
TACHYON Clean
Sophos Generic ML PUA (PUA)
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfeeD ti!56149C2CAA7E
Trapmine Clean
FireEye Generic.mg.2ddfe23a170af97e
Emsisoft Clean
SentinelOne Clean
GData Clean
Jiangmin Clean
Webroot Clean
Varist Clean
Avira Clean
Antiy-AVL Trojan/Win32.Znyonm
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Casdet!rfn
Google Clean
AhnLab-V3 Trojan/Win.Generic.C4979265
Acronis Clean
McAfee Artemis!2DDFE23A170A
MAX Clean
VBA32 Clean
Malwarebytes Malware.AI.3262332800
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Generic@AI.100 (RDML:RovDt5c8miygP7OCA115CQ)
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Gen:NN.ZexaF.36806.iuW@a0fNK4di
AVG Clean
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_70% (D)
alibabacloud Clean
No IRMA results available.