Static | ZeroBOX

PE Compile Time

2022-10-30 20:47:51

PE Imphash

8216626f230fae173fa22074eefacb8e

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00067a3e 0x00067c00 7.91062436841
.rdata 0x00069000 0x000029de 0x00002a00 4.98956453692
.data 0x0006c000 0x003f410c 0x00002c00 1.69098222224
.rsrc 0x00461000 0x00001930 0x00001a00 5.4445871995

Resources

Name Offset Size Language Sub-language File type
RT_CURSOR 0x004622f8 0x00000130 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ICON 0x00461210 0x000010a8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x004625f0 0x0000033e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ACCELERATOR 0x004622d0 0x00000028 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_CURSOR 0x00462428 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x004622b8 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x00462440 0x000001b0 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library KERNEL32.dll:
0x469008 LocalUnlock
0x46900c PulseEvent
0x469028 CreateDirectoryW
0x46902c CreateNamedPipeW
0x469030 GetLocaleInfoW
0x469034 FatalAppExitW
0x469038 SetConsoleCP
0x46903c HeapCreate
0x469040 ReplaceFileA
0x469044 GetConsoleAliasesW
0x469048 GetStdHandle
0x469050 GetComputerNameA
0x469058 SetStdHandle
0x46905c PrepareTape
0x469060 LoadLibraryA
0x469064 LocalAlloc
0x469068 AddAtomA
0x469070 lstrcatW
0x469074 VirtualProtect
0x469078 EnumDateFormatsW
0x46907c GetFileTime
0x469080 SetFileAttributesW
0x469088 CreateFileW
0x46908c WriteConsoleW
0x469090 SetLastError
0x469098 CloseHandle
0x46909c SetFilePointer
0x4690a0 HeapAlloc
0x4690a4 EncodePointer
0x4690a8 DecodePointer
0x4690ac GetCommandLineW
0x4690b0 HeapSetInformation
0x4690b4 GetStartupInfoW
0x4690b8 TerminateProcess
0x4690bc GetCurrentProcess
0x4690c8 IsDebuggerPresent
0x4690d0 GetProcAddress
0x4690d4 GetModuleHandleW
0x4690d8 ExitProcess
0x4690dc WriteFile
0x4690e0 GetModuleFileNameW
0x4690e4 Sleep
0x4690e8 HeapSize
0x4690fc SetHandleCount
0x469104 GetFileType
0x46910c TlsAlloc
0x469110 TlsGetValue
0x469114 TlsSetValue
0x469118 TlsFree
0x469120 GetCurrentThreadId
0x469124 GetLastError
0x46912c GetTickCount
0x469130 GetCurrentProcessId
0x469138 RaiseException
0x46913c LoadLibraryW
0x469140 HeapReAlloc
0x469144 RtlUnwind
0x469148 HeapFree
0x46914c GetCPInfo
0x469150 GetACP
0x469154 GetOEMCP
0x469158 IsValidCodePage
0x46915c WideCharToMultiByte
0x469160 GetConsoleCP
0x469164 GetConsoleMode
0x469168 FlushFileBuffers
0x46916c LCMapStringW
0x469170 MultiByteToWideChar
0x469174 GetStringTypeW
Library USER32.dll:
0x46917c SetActiveWindow
0x469180 SetKeyboardState
0x469184 DestroyIcon
0x469188 GetClassLongA
Library ADVAPI32.dll:
0x469000 GetAce
Library ole32.dll:
0x469190 CoTaskMemFree

!This program cannot be run in DOS mode.
`.rdata
@.data
tWItHIt9It
uTVWh[<@
^SSSSS
HHtXHHt
?If90t
QQSVWh
j@j ^V
URPQQh`V@
;t$,v-
UQPXY]Y[
t"SS9] u
<+t"<-t
+t HHt
PPPPPPPP
PPPPPPPP
I;'~Sr9q
=+7.l{l!/
{mWEMf
$twiqT
Xk:=~t
JRTVsE
KfC{<h
!*0CAH
LJDx-Z
qc]h ^a
6e1!35<
S06c 0L
GeKG-=?
:[y+z[
Alj(14
@81q$6
8d5R"I7gG
;t1!.#
u&:{/!
Np*+np&
YKEPmqA-G
6SjlhN
@X)M.j
(['3&%j
8%=Z>
Z'sR)2
>GYk3q
TLs7{5x
Sr3(@Tu)
FjiY/Mh
Bx5JIB
cfusud#
mY?% V
.1i b[eoH
ofLFUb
kp#n 6
:<DgT5
Z*&v#Y6).
]72nR\:
^=eFz\v-
MVpZS,
z!Cfm!
$QklaY"
~!?\q
X{p1G[
R-#$9Z
@>?n {
a627C>
`:hb9
[,N 5q
Z:Eyxt
KO9hv<0
s?=+[nA
fi^oh(/D:
1~MN.z/nL
iZ,$uW"
ORl#F7
rEg>ZI
.om!%(
;WMzk;
i2W(]X
i.B<Aa
nGyu#%i
fP4{M+
)3*FYY
lh<lg=
F{[N"M
}") d1j
o@R8K~D
+y-XGv
jiw!Ps|itn
nTI/,qJ
-v3Z?)
,*c q3
paS=$iL
xYt-KT
X@dn&M
%LeH2e
D'S81on
-jhgK%0
OEH})X
)d/0e/
oKV>C%k
xs6u'5&
$y,d(W
7p9ty.p(
k=.`M
HMAWW*
Gg,5,2
L,z>K"
tfO"Z"
{GD'Oe
<"CGsJUd*
6/VjB
\2'/_2
;Ua%!,
)1kks9
?GWhxW
gSzBw!&
3'&Dou$R
yy0ptZ
V2&S{*3
DQKFB>
t{`aJPP
E'o#/W
&8t`H
x4[E?
1XKqsD
NPsd~*
LWEu<;z
{}'n*sH
-+1'?H
GSa}pL
8#5_$qc4
qnB!m5:
;0*|tX
qJx5UP+jn
)O}c]_I
8k=XSuo
Y7<H%:Ac
]>y25s
;4*3GF
jBLmG
?E)ioj
dPZ"hU
*&M3e}OZ
D+,3p:
vi)//$v
*Ea|K
g"rU0{X+M
01h;'*
S{=<R
MRD}DF
X[Wf*E1
'.ip=[
0u[oLF6s
eL<8/B
"]Fp4mW
;F^+{v
RbBMTX'
t+\`)0
0&E<u
)K6540
t?/ka8
.-&k7".
t_9b`
RyA}rp
z"[%X8j
dG)niIN
5(,/'R
/?f}"n
O@KYRz
##:3#4
Mf2CPc
)b`{g^
XO8cpo*
V.{//&N
QJ&+4g}n
"mp>fk
qK;\\p
M<_x wq
PaIx#A
:4{a#R*
B?vc_$
#-fVRq
VZPxBj
yEK86\
ub<`-!
HEe?-0
n~US)&
`ps=U:
X@geW$c
#six1$o
9~mf))
19Q3Dg/
IX%?sD
}Jsd]89~
d:Xa!N
s4~t&!
ZqLidR
dp|+..^
(z]v0d
P$4c0Z
qsp4ur
qEGobw
F}Rs|N
$Zga|U
i h#i*c,T]
Vlz\Tw?xc|
i:| ]O
)sS8 ~
t789b3
O[tI"dg/S
|.(${]
gIlm R
2~V*;J
| SA`3
bLfZ)W@
f=R\Gw,
imBec@
10t:^b
:zbF}x
)_xF89v
qen3-x
h[b.7Fa
1yZ;tk
rOsHW\~
5*o$"5
U(;dEO
/g!9#v
-?6Vsl
HWr,Q)0
+)p S %
KLI(~i
"AI&8C
xO0AZ0R
Vp]!tH
&C;%#vv
cw3%1h
lAE"^~
r10xpx
)eYv4\]ny*
/kL]jE
U}jS][
wIXi+5
k-H<~N
qe?O{
IP|7j`W
SYnr3o
h |#Nz
:+YEI\
B^@]|F8
j}_7&%,
9A D<{
Cg,'P;
?d}Ip0s
zk8(8PB%
HI`*A3Gas
6/KA~(hJ3
@bMxoV
F,^#T{
jFPXxl
m"XYHf
DLkkc%
PT};`sE
G\&"u
87`$r~
Cn`(y!}
"=ochh
3)P?fI
WtUC4x
%6EZ|@
uOuUL7
`iD<V-9N
ZWDf:#
';91[Pp
;,$+yG0
WUA?).
fuM0*u
4&Cllr
1||-p7
RjX_R9
V|<R7`
;{I5nC
~YF^]X
OvZ`b-
'Se.g?`
XGN~ES
nKL),d
O}fkJ'
[,kBc^
i`E/lv
U;AIU:t+ni
p=w9_'
s+pcm<
BK/*eb
w20V!e
9Gxsp"
sKYQJ*x
IvK<t
C\Vq''
z'ZlxBE?
2-,fn
*k 8g|
u0MtsV
XyS1u[
"75DGg
<E\3Y#}
(kY=R%H%
hMrc}4M
.Up~Ps
h1_k"9F
6@uN9>
Jj)-al
b'?i%s
1Ie_Sj
Aq&j(
jJj~N[n
~7.I0I
t1DtGx47g
nd%[Q(
X-[.ds
,}&OWW
PDvb.$Z
}bG2H
YYTp+k#gL
PvJY(E
<E'e\
V_8xlt#
T"[W`u
`:Ati
bC#"KO
[`@M4=
rZh(@{
@=R-u-IuodG
i1VKye
E&hf5M
j?;~\h
-p1)lA
=O|bQI
fq`WsU-C
M#os4
9vU{CR
][.BmG
aGN)-{~
VsH7AB
VP4Yke1
!Hy*J!
g{k9A}
U}0bEQf
0d 4wC
iS$3{j
|cmD+*
_[F_?K
Z%bzU X
mnH`e*
;`OE)9q
D[ VuR
E'G{+huNx
2*$o(
l7c28O
hnd1yio
HU#R6p
v[Sa^FG[
@w j69
4daf;%
GZW3 #/
IHOiE8b
L!e)|TH
m%>UT6
+tl8f[cOP
]x$([=
g0wc}B
{a2es+;h^
ioo]
NI[,[>s
voMp=Y
aM.k_J)
]{H&>o
5U1X}J
RkbJZ"y
Nkv%Yk
CIJM!o
5@Wm=D
rYUwk+.
*Q}PFbd
TO9 V4
f%Ha6w'
/'{aTCxf)
4O/^,1r
"r%9L]
QCFM&}
RO&>c1
=grVJ ClxT
tl{%B&!8s@L
4]"Vor
(4Rd=x
Q>o>/o
3y~6=VZ
>9z1_lu
LuSr*^IQ9{,
c}&F^4
~T$?WkR
'_.@!5<S
>hc_"T
<Zd*i}
_%}fN:
(V\_Lj
{%J_gK
mUz#N47
k*uV6L
\E[W|X
ACR^Xe!
6@wBr!
ob',_v9
""ho)H
!LAO&'
~1+<*TawNR
Uq),3i
39O8vy
i5j)SF
I_aY6/
%@6UizhA@
r@;Sow
HnLlTs
eUU1g{
Ti)lj4,n1
HXNS6g
vF)^xmy#
z#,k43
00`[m}
'\uZY} <[
$.dn;<!2>\'
tcZlso
3uG j!
^t\AxG*pCA
>\+_U*Vc
eKuz%R
$qm9g
D7N|(eO
6PH@fO
zT"?~=
TUpx*5
%8(y$LC
Feb]2M
q[^#Y[
XNwpT1
0VYBx3A
.X`t,T
mN}D4tN
yeLby!
VxwwKl
DtZ!,viw;Z(sL
xjd1:K
*yf;n
^}tHS2F
e$mpJAhg8
4lgFEV
"X*J:(
H{ AVt
88`3O;
yP5^#_
Q"m^B
H.AdcG}
lq$N'
;+6<|`D;w
_OQ#Mn
hk_deR
- ^xVnb
x]-6R0
_%'Y4v
j+B-dB
oO{TsB
5C/@.E
Jn!Q8#D
BB;;2t
_mB4:4r|
z-Ub'\
GB=S}3
VMIZIqW
wD{IOy
y1^F%\
S\1Fe"
3F\uy
AfLpN^!KW
JL0f:V
[Me]-;uuv
S1#*fn
{MLQ;!
r:JIlvj{
Gag1$.+B8<?
Rl5?Ko,%
Y[%`#M
|cx3;o
|=fX6K
6.RHF1d)n
pn3;bg
R+d=oXL
N}FSgQ
t(@M/B
1?0i]V
Ou@,ApNTieU
CJ<b0W
-P+0w&
!<fZ$k
n!k0vyU
K6LUUT
h%:]ue
v5{'c,
O/c0CRR
=scCy:)S
qrvSL)
]0qacN
(g1w0f
`2yJ3
U>5q,3
X"@Lg^j)
\.^=W>
QUHR@E
!|rMym
!J!Jd.
%[~R0oGO
6l2WvVw
5$=!c>
zuvx|<*
"Kr0W'
P">"l2
jo(UcoM
,aCBg!
'LM="
n_9UK1
j\[rv0
=#b|Z}O
V)h'wl
{g|f%<
!&0)G]
Py@P`X1
T(xvoZ
{{^>M
k`P(.}=
Bd5gXe
pKaw]o
sJ!b@G
H8}}Z@-
<!S=BT
UwlR5c
bv~gl{
QA5Ky(
MaDI"h'
L_#3.o
Fzp=E.
"Z%/C%M
S5 "z((
|M0ij
@ 3/oL
4hft&=gl
K);Lv0
GJ3@oKuz
TpmK.Z
oWs$>3
W|u}Vx
[,Kf5W
RqBIs:-#
Q<bXLX
1e,e(q
%d<(o'
G]nRD~
6b2Ft!
b[4pI|
->Hx\%
lHFXrs
.]woh=
@(Q(/;%
;R*2i3
7<o4$`>D
zW#t{Q$
MLVaop
*PB)OR
QNT|O!
Pxk@3Y^z
q'zTn`iQ&
i(}u M
%xw(ug
ze/sy`
0f,+E2K
y.'=ht
x8$I$1
!f;cde\
K)XLq?~ ^
51m0zy
c/r9,\M
6.gPeZc
+9B>{U
Nr#/i7
NI&gmG+
LkVwtN
PO\-#e
ICUjm>
@/oGUrWI
Ky}xPsG
X5+@h8
Y^&#
L$$_[3
SSSSSS
CorExitProcess
(null)
`h````
xpxxxx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
_nextafter
_hypot
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
`h`hhh
xppwpp
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
1#QNAN
1#SNAN
zutesetutoyoderukeyihexo
GetSystemDefaultLangID
GetComputerNameA
LocalUnlock
PulseEvent
GetConsoleAliasesLengthW
GetProcessIoCounters
WriteConsoleOutputCharacterA
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
InterlockedDecrement
CreateDirectoryW
CreateNamedPipeW
GetLocaleInfoW
FatalAppExitW
SetConsoleCP
HeapCreate
ReplaceFileA
GetConsoleAliasesW
GetStdHandle
GetCurrentDirectoryW
SetLastError
CreateTimerQueueTimer
SetStdHandle
PrepareTape
LoadLibraryA
LocalAlloc
AddAtomA
DebugSetProcessKillOnExit
lstrcatW
VirtualProtect
EnumDateFormatsW
GetFileTime
SetFileAttributesW
GetVolumeInformationW
KERNEL32.dll
GetClassLongA
DestroyIcon
SetKeyboardState
SetActiveWindow
USER32.dll
GetAce
ADVAPI32.dll
CoTaskMemFree
ole32.dll
HeapAlloc
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetModuleFileNameW
HeapSize
EnterCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
LoadLibraryW
HeapReAlloc
RtlUnwind
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
CloseHandle
WriteConsoleW
CreateFileW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
KYEO>@
jjjjjjjj
Fjjjjjjj
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
- abort() has been called
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
FMicrosoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
(null)
KERNEL32.DLL
WUSER32.DLL
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
((((( H
h(((( H
H
CONOUT$
resawatoxuzinela
kanipefumikolilesefodikunaxowog
renej luwoyisawopab dadabayegutenecisufoba wozonotuwugewiropoxu vogiwipeladoxakanahotucucuwi
VS_VERSION_INFO
StringFileInform
040504E4
FileVersion
10.3.3.59
ProductVersion
27.86.30.51
InternalName
Slupido
CompanyName
Torchok
VarFileInfo
Translation
Kotubolohebefu%Vasuyucojek hemuxazayefeza miwe yirub
Robah luj cerizunerGGiwuvayasaye melexeye beculepub holumojore vosuxurikube jenuxafejifamoh=Fub hasobucuwuwu zamojibuw wujenuji dafatavujug get xixamaxow4Kiyigubot yajazavinodiv jax fudusome zihohonelalipotHWuwiwuboviwe suzurivici mixu camatuluxigaj cewayenumimeveh yeci guwikeviIVifagupacalif vemaseveseviti cebowimezu piduzuhoteduv nirapelo non bekebi
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agent.Y!c
Elastic malicious (high confidence)
ClamAV Win.Ransomware.Lockbit-10022840-0
CMC Clean
CAT-QuickHeal Ransom.Stop.P5
Skyhigh BehavesLike.Win32.VirRansom.gc
McAfee Artemis!2DE9A9ECF306
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.4800098
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
Alibaba Malware:Win32/km_24ada3.None
K7GW Riskware ( 00584baa1 )
Cybereason malicious.cf306c
Baidu Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Kryptik.HWJL
APEX Malicious
Avast Win32:DropperX-gen [Drp]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Agent.gen
BitDefender Gen:Variant.Zusy.538479
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Zusy.454656.G
MicroWorld-eScan Gen:Variant.Zusy.538479
TACHYON Clean
Sophos Troj/Krypt-AEE
F-Secure Trojan.TR/Crypt.Agent.iexzs
DrWeb Clean
VIPRE Gen:Variant.Zusy.538479
TrendMicro TROJ_GEN.R002C0DEV24
McAfeeD Real Protect-LS!2DE9A9ECF306
Trapmine malicious.high.ml.score
FireEye Generic.mg.2de9a9ecf306c424
Emsisoft Gen:Variant.Zusy.538479 (B)
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Zusy.538479
Jiangmin Clean
Webroot Clean
Varist W32/Kryptik.LPW.gen!Eldorado
Avira TR/Crypt.Agent.iexzs
Antiy-AVL Trojan/Win32.Kryptik.hwle
Kingsoft malware.kb.a.1000
Gridinsoft Trojan.Win32.Gen.tr
Xcitium Clean
Arcabit Trojan.Zusy.D8376F
SUPERAntiSpyware Trojan.Agent/Gen-Zenpak
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
Microsoft Trojan:Win32/Glupteba.AMMA!MTB
Google Detected
AhnLab-V3 Malware/Win.AGEN.R635993
Acronis suspicious
ALYac Gen:Variant.Zusy.538479
MAX malware (ai score=89)
VBA32 Clean
Malwarebytes Trojan.MalPack.GS
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DEV24
Tencent Trojan.Win32.Obfuscated.gen
Yandex Clean
Ikarus Win32.Outbreak
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Conwise.RCE!tr
BitDefenderTheta Gen:NN.ZexaF.36806.Bq0@aW5OXXpi
AVG Win32:DropperX-gen [Drp]
DeepInstinct MALICIOUS
alibabacloud Trojan:Win/Glupteba.AZOO3DGW
No IRMA results available.