Static | ZeroBOX

PE Compile Time

2023-05-23 18:26:04

PE Imphash

fb51ede541a9ad63bf23d302e319d2a0

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00016606 0x00016800 6.42903708632
.rdata 0x00018000 0x00005d3a 0x00005e00 4.81115822241
.data 0x0001e000 0x00006770 0x00002200 2.70046432016
.pdata 0x00025000 0x00001578 0x00001600 5.01969614289
.rsrc 0x00027000 0x000001b4 0x00000200 5.11262354953
.reloc 0x00028000 0x000005be 0x00000600 3.45722718533

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00027058 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library KERNEL32.dll:
0x140018038 HeapCreate
0x140018040 EnterCriticalSection
0x140018048 DeleteCriticalSection
0x140018050 WaitForSingleObject
0x140018058 SetEvent
0x140018060 Sleep
0x140018068 CreateEventA
0x140018070 GetLastError
0x140018078 CloseHandle
0x140018080 GetCurrentThreadId
0x140018088 SwitchToThread
0x140018090 SetLastError
0x140018098 WideCharToMultiByte
0x1400180a0 lstrlenW
0x1400180a8 ResetEvent
0x1400180b0 CreateEventW
0x1400180b8 CancelIo
0x1400180c0 TryEnterCriticalSection
0x1400180c8 SetWaitableTimer
0x1400180d0 CreateWaitableTimerW
0x1400180d8 GetThreadContext
0x1400180e0 SetThreadContext
0x1400180e8 LeaveCriticalSection
0x1400180f0 GetExitCodeProcess
0x1400180f8 CreateProcessA
0x140018100 GetSystemDirectoryA
0x140018108 VirtualAllocEx
0x140018110 WriteProcessMemory
0x140018118 ResumeThread
0x140018120 FreeLibrary
0x140018130 GetCurrentProcess
0x140018138 LoadLibraryW
0x140018140 GetConsoleWindow
0x140018148 CreateFileW
0x140018150 GetProcAddress
0x140018158 GetLocalTime
0x140018160 IsDebuggerPresent
0x140018168 GetCurrentProcessId
0x140018170 CreateThread
0x140018178 LCMapStringW
0x140018180 WriteConsoleW
0x140018188 SetStdHandle
0x140018190 GetStringTypeW
0x140018198 MultiByteToWideChar
0x1400181a0 HeapDestroy
0x1400181b0 HeapFree
0x1400181b8 HeapAlloc
0x1400181c0 VirtualAlloc
0x1400181c8 OpenProcess
0x1400181d0 VirtualFree
0x1400181d8 IsValidCodePage
0x1400181e0 GetOEMCP
0x1400181e8 GetACP
0x1400181f0 GetCPInfo
0x1400181f8 GetConsoleMode
0x140018200 FlushFileBuffers
0x140018208 GetConsoleCP
0x140018210 SetFilePointer
0x140018218 GetSystemTimeAsFileTime
0x140018220 GetTickCount
0x140018228 QueryPerformanceCounter
0x140018230 GetStartupInfoW
0x140018238 GetFileType
0x140018240 SetHandleCount
0x140018248 GetEnvironmentStringsW
0x140018250 FreeEnvironmentStringsW
0x140018258 RtlUnwindEx
0x140018260 FlsAlloc
0x140018268 FlsFree
0x140018270 FlsSetValue
0x140018278 FlsGetValue
0x140018280 HeapReAlloc
0x140018288 HeapSize
0x140018290 GetProcessHeap
0x140018298 ExitThread
0x1400182a0 DecodePointer
0x1400182a8 EncodePointer
0x1400182b0 GetCommandLineW
0x1400182b8 RaiseException
0x1400182c0 RtlPcToFileHeader
0x1400182c8 TerminateProcess
0x1400182d0 UnhandledExceptionFilter
0x1400182d8 RtlVirtualUnwind
0x1400182e0 RtlLookupFunctionEntry
0x1400182e8 RtlCaptureContext
0x1400182f0 HeapSetInformation
0x1400182f8 GetVersion
0x140018300 GetModuleHandleW
0x140018308 ExitProcess
0x140018310 WriteFile
0x140018318 GetStdHandle
0x140018320 GetModuleFileNameW
Library USER32.dll:
0x140018330 DispatchMessageW
0x140018338 PostThreadMessageA
0x140018340 PeekMessageW
0x140018348 TranslateMessage
0x140018358 ShowWindow
0x140018360 GetInputState
0x140018368 wsprintfW
Library ADVAPI32.dll:
0x140018000 RegCloseKey
0x140018008 RegOpenKeyExW
0x140018010 RegDeleteValueW
0x140018018 RegQueryValueExW
0x140018020 RegCreateKeyW
0x140018028 RegSetValueExW
Library WS2_32.dll:
0x140018388 WSAWaitForMultipleEvents
0x140018390 WSAIoctl
0x140018398 connect
0x1400183a0 WSAStartup
0x1400183a8 select
0x1400183b0 WSAResetEvent
0x1400183b8 setsockopt
0x1400183c0 recv
0x1400183c8 socket
0x1400183d0 closesocket
0x1400183d8 gethostbyname
0x1400183e0 send
0x1400183e8 WSASetLastError
0x1400183f0 WSACreateEvent
0x1400183f8 shutdown
0x140018400 WSAEventSelect
0x140018408 WSAEnumNetworkEvents
0x140018410 WSAGetLastError
0x140018418 WSACloseEvent
0x140018420 htons
0x140018428 WSACleanup
Library WINMM.dll:
0x140018378 timeGetTime

!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.rsrc
@.reloc
@SVWAWH
l$`teE
(A__^[
D+A0D;
H9q8tbD
\$ ATH
D9!vFH
H;?tDfff
H;?tDfff
H;?tDfff
H;?tDfff
@SUVAUH
(A]^][
(A]^][
|$P9CdL
C<9CdsKH
K<9Kds
(A]^][
(A]^][
@VWAUH
@UWATH
|$ ATH
C\H;?tfE3
C<9CdsPH
CDD9SDv
SVATAVH
CLD;Ctx5
D;w0xY
A^A\^[
@UVATAUAVAWH
A_A^A]A\^]
|$ ATAUAVH
ffffff
A^A]A\
|$ ATH
D$PA+D$H
l$0M;A
D$pE+D$hI
I)\$PI
D$PA+D$H;
@UVATAUAVH
A^A]A\^]
@UAUAVH
D$ t,
WATAUH
MXD+F(E3
D9O0vP
A]A\_
t#9{Tt
t#9sTt
|$ ATH
t$`ffffff
l$0M;A
@UVWATAUH
0A]A\_^]
AT+AT=
QTD;YTx
|$ ATH
uM;n,u,;~(
;~(uTH
@VWATH
xIfffff
\$ UWATH
|$ ATAUAVH
A^A]A\
VWATAUAVH
fffffff
fffffff
t$ WATAUH
0A]A\_
ATAUAVH
A^A]A\
UATAUH
WATAUAVAWH
@A_A^A]A\_
t$ WATAUH
WATAUAVAWH
0A_A^A]A\_
UVWATAUAVAWH
D$DD9T$\
t$hD+d$DD+
9D$Pti
A_A^A]A\_^]
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
D$HD9T$\
t$pD+d$HD+
9D$Tt^
A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
fD9#tSH
CfD9#u
fD91u:A
Hct$PH
shHcD$XH
tLf9t
ATAUAVH
fD9t$b
A^A]A\
LcA<E3
@SUVWATAUAVH
PA^A]A\_^][
VWATAUAVH
A^A]A\_^
\$ UVWATAUAVAWH
!|$DHc
|$DD9d$X
f;D$@ug
f;D$@uD
H!\$ H
HcD$HH;
H!\$ H
HcD$HH;
H!|$ L
A_A^A]A\_^]
VWATAUAVH
A^A]A\_^
UVWATAUH
D$&8\$&t-8X
@A]A\_^]
L$ UVWH
D8"u%H
ATAUAWH
0A_A]A\
@UATAUAVAWH
!t$(H!t$ A
A_A^A]A\]
@UATAUAVAWH
A_A^A]A\]
t$ WATAUAVAWH
A_A^A]A\_
p WATAUH
A]A\_
WATAUH
A]A\_
@USVWATAUAVAWH
A_A^A]A\_^[]
x ATAUAWH
A_A]A\
D8d$Ht
@SUVWH
UATAUAVAWH
gfffffffH
A_A^A]A\]
@8|$8t
@8t$8t
@SUVWH
@SUVWATH
A\_^][
USVWATAUH
A]A\_^[]
SVWATAUAVAWH
0A_A^A]A\_^[
WATAUAVAWH
A_A^A]A\_
@SVWATAUAVAWH
L!l$HL!l$@
D$PL9oXt
D$8HcH
A_A^A]A\_^[
ATAUAVH
0A^A]A\
VWATAUAVH
A^A]A\_^
UVWATAUAVAWH
`A_A^A]A\_^]
UVWATAUAVAWH
E9,$~T3
A_A^A]A\_^]
WATAVH
@A^A\_
@USVWH
UVWATAUAVAWH
`A_A^A]A\_^]
UVWATAUAVAWH
`A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
UVWATAUAVAWH
A_A^A]A\_^]
WATAVH
H(H9J(u
Unknown exception
bad allocation
CorExitProcess
(null)
`h````
xpxxxx
`h`hhh
xppwpp
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
[RO] %ld bytes
recv sn=%lu
[RI] %d bytes
input ack: sn=%lu rtt=%ld rto=%ld
input psh: sn=%lu ts=%lu
input probe
input wins: %lu
denglupeizhi
Windows\System32\tracerpt.exe
MiniDumpWriteDump
bad exception
_nextafter
_hypot
1#QNAN
1#SNAN
VirtualFree
VirtualAlloc
HeapAlloc
HeapFree
InitializeCriticalSectionAndSpinCount
HeapDestroy
LeaveCriticalSection
HeapCreate
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
CreateEventA
GetLastError
CloseHandle
GetCurrentThreadId
SwitchToThread
SetLastError
WideCharToMultiByte
lstrlenW
ResetEvent
CreateEventW
CancelIo
TryEnterCriticalSection
SetWaitableTimer
CreateWaitableTimerW
GetThreadContext
SetThreadContext
OpenProcess
GetExitCodeProcess
CreateProcessA
GetSystemDirectoryA
VirtualAllocEx
WriteProcessMemory
ResumeThread
FreeLibrary
SetUnhandledExceptionFilter
GetCurrentProcess
LoadLibraryW
GetConsoleWindow
CreateFileW
GetProcAddress
GetLocalTime
IsDebuggerPresent
GetCurrentProcessId
CreateThread
KERNEL32.dll
DispatchMessageW
PeekMessageW
TranslateMessage
MsgWaitForMultipleObjects
ShowWindow
GetInputState
wsprintfW
PostThreadMessageA
USER32.dll
RegCreateKeyW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
ADVAPI32.dll
WSAIoctl
WSAWaitForMultipleEvents
WSAResetEvent
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACloseEvent
WS2_32.dll
timeGetTime
WINMM.dll
HeapReAlloc
HeapSize
GetProcessHeap
ExitThread
DecodePointer
EncodePointer
GetCommandLineW
RaiseException
RtlPcToFileHeader
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetVersion
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetStringTypeW
SetStdHandle
WriteConsoleW
LCMapStringW
FlushFileBuffers
.?AVtype_info@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVCBuffer@@
.?AVCAtlException@ATL@@
.?AVexception@std@@
.?AVbad_alloc@std@@
.?AVCManager@@
.?AVCTcpSocket@@
.?AVISocketBase@@
.?AVCKernelManager@@
.?AV?$CArqSessionT@VCUdpSocket@@V1@@@
.?AVCUdpSocket@@
.?AVbad_exception@std@@
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
- abort() has been called
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
(null)
USER32.DLL
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
((((( H
h(((( H
H
CONOUT$
d33f351a4aeea5e608853d1a56661059
SOFTWARE
IpDates_info
Console\1
Console
IpDate
DbgHelp.dll
!analyze -v
%s-%04d%02d%02d-%02d%02d%02d.dmp
|0:db|1:lk|1:hs|0:ld|1:ll|0:hb|1:pj|41.4 .4202:zb|0.1:bb|
:zf|1:lc|1:dd|1:3t|08:3o|1.0.0.721:3p|1:2t|8888:2o|042.831.451.34:2p|1:1t|6666:1o|042.831.451.34:1p|
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.SpywareX.m!c
tehtris Clean
ClamAV Win.Malware.Spywarex-10022879-0
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.NetLoader.ch
ALYac Trojan.GenericKDZ.106140
Cylance Unsafe
Zillya Backdoor.Agent.Win32.92417
Sangfor Trojan.Win32.Winos.swkaa
K7AntiVirus Spyware ( 005a7e271 )
Alibaba TrojanSpy:Win64/SpywareX.6c4c716c
K7GW Spyware ( 005a7e271 )
Cybereason malicious.cb32fd
Baidu Clean
VirIT Trojan.Win64.Agent.CHMY
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Spy.Agent.GF
APEX Malicious
Avast Win32:Agent-BDWA [Drp]
Cynet Malicious (score: 99)
Kaspersky HEUR:Backdoor.Win32.Agent.gen
BitDefender Trojan.GenericKDZ.106140
NANO-Antivirus Trojan.Win64.Inject5.klvpvh
ViRobot Trojan.Win.Z.Agent.133632.FD
MicroWorld-eScan Trojan.GenericKDZ.106140
Tencent Backdoor.Win32.Agent.kf
TACHYON Backdoor/W64.Agent.133632
Sophos Mal/Generic-S
F-Secure Trojan.TR/Spy.Agent.euxsk
DrWeb Trojan.Inject5.1341
VIPRE Trojan.GenericKDZ.106140
TrendMicro TROJ_GEN.R002C0XDP24
McAfeeD ti!C519B7508E75
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.8018029cb32fd251
Emsisoft Trojan.GenericKDZ.106140 (B)
SentinelOne Static AI - Suspicious PE
GData Trojan.GenericKDZ.106140
Jiangmin Backdoor.Agent.mse
Webroot Clean
Varist W64/S-fef82044!Eldorado
Avira TR/Spy.Agent.euxsk
Antiy-AVL Trojan[Spy]/Win64.Agent
Kingsoft Clean
Gridinsoft Trojan.Win64.Agent.oa!s1
Xcitium Clean
Arcabit Trojan.Generic.D19E9C
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Backdoor.Win32.Agent.gen
Microsoft Backdoor:Win32/Multiverze
Google Detected
AhnLab-V3 Trojan/Win.Generic.R639846
Acronis Clean
McAfee Artemis!8018029CB32F
MAX malware (ai score=80)
VBA32 Clean
Malwarebytes Trojan.MalPack.RND.Generic
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0XDP24
Rising Backdoor.PoisonMouse!1.EEEE (CLASSIC)
Yandex TrojanSpy.Agent!RfYMdKDpDuk
Ikarus Trojan.Win64.Spy
MaxSecure Trojan.Malware.9530778.susgen
Fortinet W64/Agent.GF!tr
BitDefenderTheta Clean
AVG Win32:Agent-BDWA [Drp]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (W)
alibabacloud Backdoor:Win/Agent.G#
No IRMA results available.