Static | ZeroBOX

PE Compile Time

2015-03-09 19:37:00

PE Imphash

24ffff844f7eed74e1f1064cc9840ba9

PEiD Signatures

Armadillo v1.71

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001b83 0x00002000 5.33004571178
.data 0x00003000 0x000078b6 0x00008000 5.7559369249
.rsrc 0x0000b000 0x00000a98 0x00001000 2.51698122842

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0000b448 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b448 0x00000128 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED GLS_BINARY_LSB_FIRST
RT_DIALOG 0x0000b598 0x000001c6 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_GROUP_ICON 0x0000b570 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_VERSION 0x0000b760 0x00000338 LANG_FRENCH SUBLANG_FRENCH data

Imports

Library MFC42.DLL:
0x403054 None
0x403058 None
0x40305c None
0x403060 None
0x403064 None
0x403068 None
0x40306c None
0x403070 None
0x403074 None
0x403078 None
0x40307c None
0x403080 None
0x403084 None
0x403088 None
0x40308c None
0x403090 None
0x403094 None
0x403098 None
0x40309c None
0x4030a0 None
0x4030a4 None
0x4030a8 None
0x4030ac None
0x4030b0 None
0x4030b4 None
0x4030b8 None
0x4030bc None
0x4030c0 None
0x4030c4 None
0x4030c8 None
0x4030cc None
0x4030d0 None
0x4030d4 None
0x4030d8 None
0x4030dc None
0x4030e0 None
0x4030e4 None
0x4030e8 None
0x4030ec None
0x4030f0 None
0x4030f4 None
0x4030f8 None
0x4030fc None
0x403100 None
0x403104 None
0x403108 None
0x40310c None
0x403110 None
0x403114 None
0x403118 None
0x40311c None
0x403120 None
0x403124 None
0x403128 None
0x40312c None
0x403130 None
0x403134 None
0x403138 None
0x40313c None
0x403140 None
0x403144 None
0x403148 None
0x40314c None
0x403150 None
0x403154 None
0x403158 None
0x40315c None
0x403160 None
0x403164 None
0x403168 None
0x40316c None
0x403170 None
0x403174 None
0x403178 None
0x40317c None
0x403180 None
0x403184 None
0x403188 None
0x40318c None
0x403190 None
0x403194 None
0x403198 None
0x40319c None
0x4031a0 None
0x4031a4 None
0x4031a8 None
0x4031ac None
0x4031b0 None
0x4031b4 None
0x4031b8 None
0x4031bc None
0x4031c0 None
0x4031c4 None
0x4031c8 None
0x4031cc None
0x4031d0 None
0x4031d4 None
0x4031d8 None
0x4031dc None
0x4031e0 None
0x4031e4 None
0x4031e8 None
0x4031ec None
0x4031f0 None
Library MSVCRT.dll:
0x4031f8 _controlfp
0x4031fc __set_app_type
0x403200 __p__fmode
0x403204 __p__commode
0x403208 _adjust_fdiv
0x40320c __setusermatherr
0x403210 _initterm
0x403214 __getmainargs
0x403218 _acmdln
0x40321c exit
0x403220 _XcptFilter
0x403224 _exit
0x403228 _onexit
0x40322c __dllonexit
0x403230 _except_handler3
0x403234 memset
0x403238 __p__pgmptr
0x40323c sprintf
0x403240 memcpy
0x403244 _access
0x403248 __CxxFrameHandler
0x40324c strstr
0x403250 _setmbcp
0x403254 _mkdir
Library KERNEL32.dll:
0x403000 CloseHandle
0x403004 CreateFileA
0x403008 FreeLibrary
0x40300c GetTickCount
0x403010 GetFileAttributesA
0x403018 GetLastError
0x40301c GetProcAddress
0x403020 LoadLibraryA
0x403024 lstrcpyA
0x403028 GetCommandLineA
0x40302c Sleep
0x403030 lstrcmpiA
0x403034 SetThreadPriority
0x403038 GetCurrentThread
0x40303c SetPriorityClass
0x403040 GetCurrentProcess
0x403044 GetModuleHandleA
0x403048 GetStartupInfoA
0x40304c WriteFile
Library USER32.dll:
0x40325c SendMessageA
0x403260 IsIconic
0x403264 GetClientRect
0x403268 EnableWindow
0x40326c LoadIconA
0x403270 GetSystemMetrics
0x403274 wsprintfA
0x403278 DrawIcon

!This program cannot be run in DOS mode.
`.data
0@000 0
4|4`4T484,4
3|3h3d3D3$3
2x2p2d2T242(2$2
1x1h1\1X1T1P1L1H181(
?}?p?Q?=?1?%>
=w=q=i=
<d<B<4<.<
7q7g7_7X7R7L7 7
6v6q6Z6@6;606
5y5k5\5U5O585$4
4r4m4b4S3
3t3o3@373'3
2q2a2Q2A212!2
1y1i1Y1I191)1
0q0a0Q0F090)0
?v?i?\?O?B?5?(?
8a8L838,8
6~6x6r6d6[6R696#6
5o5j5b5[5H545)5
4~4w4l4^4W4L4E4:434(3
2Q2;232
1z1e1D1?1:1!1
0s0n0g0\070*0
>t>m>b>P>9>*>
<c<F<6</< <
;m;g;a;E;8; ;
:m:f:<:*:
9e9J9?909
7|7u7Z7T7
6z6s6l6X6Q6>6+6
5u5o5i5P5A59535*4
4v4q4d4I4*4#4
3s3B3%2
2{2Y2+1
1q1h1b1W1=1,1
0k0Q0L050%0
>}>p>8>2>$=
;f;a;L;E;<;1;;
:|:k:V:
8X8O8F8:818
4|4k4Z4
3{3R3E3'3 2
2S2(21
@@ofni_epytVA?.
AxEyeKetaerCgeR
AxEeulaVteSgeR
AyeKeteleDgeR
AeulaVeteleDgeR
AxEeulaVyreuQgeR
AxEyeKnepOgeR
AeulaVmunEgeR
AxEyeKmunEgeR
yeKesolCgeR
tohspanS23plehlooTetaerC
tsriF23ssecorP
txeN23ssecorP
segelivirPnekoTtsujdA
AeulaVegelivirPpukooL
lld.23LENREK
AnepOtenretnI
0.6 EISM
AlrUnepOtenretnI
eliFdaeRtenretnI
eldnaHesolCtenretnI
potkseDtupnInepO
ApotkseDnepO
lld.23resu
potkseDdaerhTteG
AnoitamrofnItcejbOresUteG
potkseDdaerhTteS
potkseDesolC
dIdaerhTtnerruCteG
AssecorPetaerC
AemaNeliFeludoMteG
AxetuMetaerC
xetuMesaeleR
rorrEtsaLteG
eldnaHesolC
Atacrtsl
tnuoCkciTteG
tcejbOelgniSroFtiaW
AsetubirttAeliFteG
AtnevEetaerC
tnevEteseR
oIlecnaC
tnevEteS
daerhTetanimreT
AxEnoisreVteG
ssecorPedoCtixEteG
AsgnirtStnemnorivnEdnapxE
ofnImetsySteG
AyrotceriDmetsySteG
AeliFevoM
AxEeliFevoM
dInoisseSelosnoCevitcAteGSTW
lld.23resU
Aftnirpsw
xEswodniWtixE
AxoBegasseM
elbisiVwodniWsI
AegasseMdneS
swodniWmunE
lld.TRCVSM
pmcrts
nelrts
ypcmem
tesmem
rtsrts
lld.23_2sw
putratSASW
punaelCASW
tekcos
emanybtsohteg
tcennoc
tekcosesolc
tpokcostes
ltcoIASW
tceles
emankcosteg
emantsohteg
lld.23IPAVDA
sutatSecivreSteS
AreldnaHlrtCecivreSretsigeR
AreganaMCSnepO
AecivreSnepO
AecivreStratS
eldnaHecivreSesolC
sutatSecivreSyreuQ
ecivreSlortnoC
AecivreSetaerC
A2gifnoCecivreSegnahC
ecivreSeteleD
nekoTssecorPnepO
xEnekoTetacilpuD
noitamrofnInekoTteS
AresUsAssecorPetaerC
lld.teniniw
rtPdaeRdaBsI
lld.23lenrek
ssecorP46woWsI
ssecorPtnerruCteG
0\rossecorPlartneC\metsyS\NOITPIRCSED\ERAWDRAH
zHMs%*d%
exe.23lldnuR\
daerhTniaM,"s%" s%
lld.23elO
ezilaitinIoC
ezilaitininUoC
ecnatsnIetaerCoC
lld.23tuaelO
gnirtSeerFsyS
d2.%:d2.% d2.%-d2.%-d4%
emiTllatsnI
s%etadpUG
s%:d%:s%
dnammoc\nepo\llehs\exe.erolpxei\snoitacilppA
dnammoc\nepo\llehs\s%
s% etadpUllD,"s%" 23lldnuR
llatsninU,"s%" 23lldnuR
s%\secivreS\teSlortnoCtnerruC\METSYS
krameR
noitacilppA
ytiruceS
metsyS
egelivirPnwodtuhSeS
yxorPesolC
yxorP_pooL
LLUN =!yxorPmh
yxorPnepO
yromeMmorFdaoL
.yromem morf yrarbil daol t'naC
eMnigulP
---DNE yromeMmorFdaoL
kab.d%\s%
lld.vneresu
kcolBtnemnorivnEetaerC
tluafeD\0atSniW
"s%" k- exe.tsohcvs\23metsyS\%%tooRmetsyS%%
sretemaraP\s%\secivreS\teSlortnoCtnerruC\METSYS
llDecivreS
tsohcvS\noisreVtnerruC\TN swodniW\tfosorciM\ERAWTFOS
noitpircseD
reffub dab
etacollA dab
llatsninU
niaMecivreS
daerhTniaM
llatsnI
etadpUllD
lld.llDniaM
pmcirts_
rpurts_
vidf_tsujda_
collam
mrettini_
tixeno_
tixenolld__
ZX@EAU@@ofni_epyt1??
lld.TRCVSM
rhcrts
xedaerhtnigeb_
collaer
sbmotscw
rhcrrts
ypcnrts
ypcrts
rtsrts
ftnirp
2dniwnu_lacol_
3reldnah_tpecxe_
nelrts
pmcmem
Z@IXAPAY@2??
tesmem
noitpecxEworhTxxC_
reldnaHemarFxxC__
ypcmem
Z@XAPXAY@3??
lld.23IPAVDA
AgoLtnevEnepO
AgoLtnevEraelC
goLtnevEesolC
lld.23RESU
Aftnirpsw
lld.23LENREK
Aipmcrtsl
AtnevEetaerC
tcejbOelgniSroFtiaW
eldnaHesolC
tnevEteS
eerFpaeH
tcetorPlautriV
paeHssecorPteG
collApaeH
xEsutatSyromeMlabolG
elosnoCeerF
AyrotceriDtnerruCteG
AyrotceriDmetsySteG
AeliFypoC
emiTlacoLteG
AeliFetaerC
eliFetirW
Atacrtsl
cexEniW
collAlacoL
eziSlacoL
eerFlacoL
AgnirtSgubeDtuptuO
tnuoCkciTteG
AyrarbiLdaoL
sserddAcorPteG
yrarbiLeerF
Aypcrtsl
Anelrtsl
rorrEtsaLteG
egnahcxEdekcolretnI
collAlautriV
eerFlautriV
H0tHwtH\t
k(hWVS
k(hWVS
tH3tHHtHV
hPPPPV
chhWVS
PPPPPP
V'tYFY
PVPPPPPP
VVVVVP
SSSSSP
-5hWSGS
hWSSSG
a@hWVSh
`xhSUUU
SVUctY
+hVSSS
coler.
atad.@
atadr.`
.edom SOD ni nur eb tonnac margorp sihT!
ZM8.138.116.47
System Remote Data Simulation Layer
Default
%ALLUSERSPROFILE%\Application Data\DRM\
GUpdate
SYSTEM\CurrentControlSet\Services\%s
DisplayName
Description
SYSTEM\CurrentControlSet\Services\%s\Parameters
shell32.dll
ShellExecuteA
kernel32.dll
CreateMutexA
ReleaseMutex
%s:%d:%s
GetVersionExA
%Temp%\
%s%d.dll
Install
"%s",MainThread
rundll32.exe
kernel32.dll
CreateToolhelp32Snapshot
Process32First
Process32Next
kernel32.dll
GetModuleFileNameA
GetSystemDirectoryA
MoveFileA
MoveFileExA
%s\%d.bak
shell32.dll
ShellExecuteA
/c ping 127.0.0.1 -n 1 && del /f/q "%s"
cmd.exe
ADVAPI32.dll
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
All Files (*.*)|*.*||
MFC42.DLL
strstr
__CxxFrameHandler
_access
memcpy
sprintf
__p__pgmptr
memset
_except_handler3
__dllonexit
_onexit
MSVCRT.dll
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
CloseHandle
WriteFile
CreateFileA
FreeLibrary
GetTickCount
GetFileAttributesA
ExpandEnvironmentStringsA
GetLastError
GetProcAddress
LoadLibraryA
lstrcpyA
GetCommandLineA
lstrcmpiA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
KERNEL32.dll
wsprintfA
GetSystemMetrics
DrawIcon
SendMessageA
IsIconic
GetClientRect
EnableWindow
LoadIconA
USER32.dll
_mkdir
_setmbcp
DDLLDDDL
LLDDLD
DDLDLD
LDDDDDDD
DDDDDDDDD
DDDDDDDDDDD
DDDDDDDDDDDDD
DDDDDDD
DDDDD@
d>ehV
emaNyldneirF
1110A)
SysListView32
msctls_trackbar32
Slider1
VS_VERSION_INFO
StringFileInfo
040c04b0
Comments
CompanyName
SARL CRL
FileDescription
Application MFC LoadDll
FileVersion
1, 0, 0, 0
InternalName
LegalCopyright
Copyright (C) 2011
LegalTrademarks
OriginalFilename
PrivateBuild
ProductName
Application LoadDll
ProductVersion
1, 0, 0, 0
SpecialBuild
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.YoungLotus.4!c
tehtris Clean
ClamAV Win.Dropper.Gh0stRAT-7073897-1
CMC Clean
CAT-QuickHeal Trojan.Younglotus.20397
Skyhigh BackDoor-FCWQ!7D8056785948
ALYac Clean
Cylance Unsafe
Zillya Trojan.YoungLotus.Win32.4
Sangfor Backdoor.Win32.Farfli.Vpkj
K7AntiVirus Trojan ( 0055e3e41 )
Alibaba Backdoor:Win32/YoungLotus.13c1f9fa
K7GW Trojan ( 0055e3e41 )
Cybereason malicious.859482
Baidu Clean
VirIT Backdoor.Win32.Generic.JUY
Paloalto generic.ml
Symantec SMG.Heur!gen
Elastic malicious (high confidence)
ESET-NOD32 Win32/Farfli.BGW
APEX Malicious
Avast Win32:DropperX-gen [Drp]
Cynet Malicious (score: 99)
Kaspersky Trojan.Win32.YoungLotus.t
BitDefender Gen:Heur.RI.1
NANO-Antivirus Trojan.Win32.YoungLotus.dpanmc
ViRobot Clean
MicroWorld-eScan Gen:Heur.RI.1
Tencent Malware.Win32.Gencirc.10b39405
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.Farfli.qqkhu
DrWeb Trojan.DownLoader12.47777
VIPRE Gen:Heur.RI.1
TrendMicro BKDR_ZEGOST.SM29
McAfeeD ti!F59D23FCB44D
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.7d8056785948284e
Emsisoft Gen:Heur.RI.1 (B)
SentinelOne Clean
GData Gen:Heur.RI.1
Jiangmin Trojan/YoungLotus.e
Webroot Trojan.Younglotus
Varist W32/S-0f55ee81!Eldorado
Avira TR/AD.Farfli.qqkhu
Antiy-AVL Trojan/Win32.Farfli
Kingsoft malware.kb.a.922
Gridinsoft Trojan.Win32.Gen.tr
Xcitium TrojWare.Win32.YoungLotus.TCM@5ruomd
Arcabit Trojan.RI.1
SUPERAntiSpyware Trojan.Agent/Gen-Zusy
ZoneAlarm Trojan.Win32.YoungLotus.t
Microsoft Backdoor:Win32/Venik!pz
Google Detected
AhnLab-V3 Trojan/Win32.Agent.R128989
Acronis Clean
McAfee BackDoor-FCWQ!7D8056785948
MAX malware (ai score=83)
VBA32 BScope.Trojan.DDoS.Nitol
Malwarebytes Malware.AI.4194114185
Panda Trj/Genetic.gen
Zoner Trojan.Win32.97590
TrendMicro-HouseCall BKDR_ZEGOST.SM29
Rising Trojan.Farfli!1.C639 (KTSE)
Yandex Trojan.GenAsa!BZKdUv1dR3c
Ikarus Win32.Outbreak
MaxSecure Trojan.Malware.8167493.susgen
Fortinet W32/Farfli.BGW!tr
BitDefenderTheta Gen:NN.ZexaF.36806.dm0@aq6CFGjf
AVG Win32:DropperX-gen [Drp]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Worm:Win/Farfli.ba5c7bd9
No IRMA results available.