Static | ZeroBOX

PE Compile Time

2009-05-10 08:37:42

PE Imphash

25b3acc640473b6fce722f16eff93149

PEiD Signatures

UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x0000c000 0x00000000 0.0
UPX1 0x0000d000 0x0000b000 0x0000ae00 7.90424630188
.rsrc 0x00018000 0x00001000 0x00000a00 3.35099200565

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0001805c 0x00000768 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library ADVAPI32.dll:
0x41883c FreeSid
Library KERNEL32.DLL:
0x418844 LoadLibraryA
0x418848 ExitProcess
0x41884c GetProcAddress
0x418850 VirtualProtect
Library MSVCRT.dll:
0x418858 _iob
Library WS2_32.dll:
0x418860 WSARecv
Library WSOCK32.dll:
0x418868 WSAGetLastError

!This program cannot be run in DOS mode.
@+^uEl
j!;~AKv|
x^R-k~@
p@BDR=;S<
[BfA(tCQXh
dGHy-Y
H8u0\z<
V4`|G~
z&W;y%~A>[[W
9W}kf_
%&,RWW
46%*F
K[#DB/D
Ub/hH7
AL%>a6
1qc41t(
37f)*W~k
6Z4H|p
w6brW~=P
wSu$Y_
oR;+pS;
PG^Np{-C
t$9)u>Mv
m1pA^7{
>9mAP
F33|LY
dQ!{9s$
NRj:jA
V0d_HC$?
P0o*4F
42@_(U
@Et"j.
j0.#o
alTL8
6oTt7
YsP;4vX
COXZlR
RE1w*TI%
hQ&T:"
:_\u_tKpq
m1\@iz
_A$|]w
)X '9i7<S
fnn]I;
<9IK1W2
winiThLw&
wMozilla/5.0 (W$
[|dowsXT 10
) Gecko/20
1 Firefox/
T/O6Z_Oh2DCu_X0b4sYL
FEg1hY5f_R2oUsq-2FBCe7OY
5fyzWx30F0mf2_tTjbnFbloJRApswo
%kMtZ=
!=,~_
_U_">|
6'O)E&
pkQI(h
ts@1o.
c8Eu38(
m#[m_zo
{=bTN{
{H7sSdr
r#kC@@K8F
5.q*[_
\RH>4*k
l)?123456789abcdef
ABCDEF'
4M@TA4B$-
H|IdJ@
?7:;<=
 !"#$%L()*+,-./k
?GHIJKLMNO:STUVWXYZ
YWghijklmnopqrstuvwxyz
c?%s: C
t use c
~curre
y level g
er th%
[R6gW0..%d]
iFLBasic
okie:2
?mix PUT
HEAD+d
F6/<Ss
b:T:p:u:v
:rkVhwH:y:z:C:H:P:A:g:X:
apr_sock1
_;)ct()
fB10 fa
Zim#oy
m%yKNFO:9
kRw==
HTTP/1.0
-(%/{?
typee+
o"xt/`
/GE6CF
+ ApacO
h/+2.37
%cn4e!
KsKCSVG
&w $%%
ax!WAR
sults7
?ERROR
A6@[/g
T[+/-sd]kB
C`uCC]
2tkb/s
vneTrzsC
zrN:'[
!16+RH/lv
velCDr
S:name:;S
#e_%\l
-``sOO
~9`(J(%
500WTPc
vcp'<p+
Found6,
_ttp://w
oK3g* 1996N;mW
}+twi\>Zeus
8$Kvi#
>w-hGk%j
acXUxy:p
,:5usk
gzip'/-COi
+.Qd ."
.{qgv,b
}Defaj
,SsyRm
]bReer
n-SR@X6
d1#Fd3B
U/thAm
n6OOJ
/SO;ad!
d?u urU
ZwQupyI
LgveCb
-D#tDe
F(etvir5m
To.,[
ZonS--[f(
c: )epV
E1a2p&
`x3t!SA.Obj
Ov"lap
a_dll
~wcsncm
f.;lDtr
XPTPSW
ADVAPI32.dll
KERNEL32.DLL
MSVCRT.dll
WS2_32.dll
WSOCK32.dll
FreeSid
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
WSARecv
VS_VERSION_INFO
StringFileInfo
040904b0
Comments
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName
Apache Software Foundation
FileDescription
ApacheBench command line utility
FileVersion
2.2.14
InternalName
ab.exe
LegalCopyright
Copyright 2009 The Apache Software Foundation.
OriginalFilename
ab.exe
ProductName
Apache HTTP Server
ProductVersion
2.2.14
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Swrort.4!c
tehtris Clean
Cynet Malicious (score: 100)
CMC Clean
CAT-QuickHeal Clean
ALYac Generic.ShellCode.Marte.3.E7C6BFE3
Cylance Unsafe
Zillya Trojan.RozenaGen.Win32.2
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Clean
Alibaba Trojan:Win32/CobaltStrike.5c89
K7GW Clean
Cybereason malicious.181d00
Baidu Clean
VirIT Clean
Symantec Trojan Horse
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win32/Rozena.ZL
APEX Malicious
Avast Win32:Evo-gen [Trj]
ClamAV Win.Trojan.Swrort-5710536-0
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Generic.ShellCode.Marte.3.E7C6BFE3
NANO-Antivirus Virus.Win32.Gen-Crypt.ccnc
ViRobot Clean
MicroWorld-eScan Generic.ShellCode.Marte.3.E7C6BFE3
Tencent Trojan.Win32.CobaltStrike.16001078
Sophos Mal/Generic-S
F-Secure Trojan.TR/Crypt.ZPACK.Gen
DrWeb Clean
VIPRE Generic.ShellCode.Marte.3.E7C6BFE3
TrendMicro Backdoor.Win32.SWRORT.SMAL01
McAfeeD Real Protect-LS!BE101F8181D0
Trapmine malicious.high.ml.score
FireEye Generic.mg.be101f8181d00ee2
Emsisoft Generic.ShellCode.Marte.3.E7C6BFE3 (B)
Paloalto generic.ml
Jiangmin Clean
Webroot W32.Trojan.Swrort.Gen
Varist W32/Swrort.B.gen!Eldorado
Avira TR/Crypt.ZPACK.Gen
MAX malware (ai score=84)
Antiy-AVL Trojan/Win32.Rozena
Kingsoft malware.kb.b.951
Gridinsoft Trojan.Win32.Agent.sa
Xcitium TrojWare.Win32.Rozena.A@4jwdqr
Arcabit Generic.ShellCode.Marte.3.E7C6BFE3
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Generic
Google Detected
AhnLab-V3 Backdoor/Win32.Bifrose.R12476
Acronis Clean
BitDefenderTheta Gen:NN.ZexaF.36808.cmKfay8BMrki
TACHYON Clean
VBA32 Trojan.Swrort
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall Backdoor.Win32.SWRORT.SMAL01
Rising HackTool.Swrort!1.6477 (CLOUD)
Yandex Trojan.GenAsa!O0/tdGI4TGA
Ikarus Trojan.Agent
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Rozena.ABV!tr
AVG Win32:Evo-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Backdoor:Win/shellcode.api(dyn)
No IRMA results available.