Static | ZeroBOX

PE Compile Time

1970-01-01 09:00:00

PE Imphash

a17186a0dbc86b565628d4a9b8c9cc17

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001ef8 0x00002000 6.00727401005
.data 0x00003000 0x0004bcc0 0x0004be00 7.25060812018
.rdata 0x0004f000 0x000005e0 0x00000600 4.63852033057
.pdata 0x00050000 0x000002ac 0x00000400 3.14725522239
.xdata 0x00051000 0x00000204 0x00000400 2.45458788326
.bss 0x00052000 0x00000978 0x00000000 0.0
.edata 0x00053000 0x000000b0 0x00000200 1.97055629253
.idata 0x00054000 0x00000758 0x00000800 4.04378042227
.CRT 0x00055000 0x00000058 0x00000200 0.201539378135
.tls 0x00056000 0x00000010 0x00000200 0.0
.reloc 0x00057000 0x000003f4 0x00000400 6.10446966678

Imports

Library KERNEL32.dll:
0x6bb141cc CloseHandle
0x6bb141d4 ConnectNamedPipe
0x6bb141dc CreateFileA
0x6bb141e4 CreateNamedPipeA
0x6bb141ec CreateThread
0x6bb141f4 DeleteCriticalSection
0x6bb141fc EnterCriticalSection
0x6bb14204 GetCurrentProcess
0x6bb1420c GetCurrentProcessId
0x6bb14214 GetCurrentThreadId
0x6bb1421c GetLastError
0x6bb14224 GetModuleHandleA
0x6bb1422c GetProcAddress
0x6bb1423c GetTickCount
0x6bb1424c LeaveCriticalSection
0x6bb1425c ReadFile
0x6bb14264 RtlAddFunctionTable
0x6bb1426c RtlCaptureContext
0x6bb14274 RtlLookupFunctionEntry
0x6bb1427c RtlVirtualUnwind
0x6bb1428c Sleep
0x6bb14294 TerminateProcess
0x6bb1429c TlsGetValue
0x6bb142ac VirtualAlloc
0x6bb142b4 VirtualProtect
0x6bb142bc VirtualQuery
0x6bb142c4 WriteFile
Library msvcrt.dll:
0x6bb142d4 __iob_func
0x6bb142dc _amsg_exit
0x6bb142e4 _initterm
0x6bb142ec _lock
0x6bb142f4 _unlock
0x6bb142fc abort
0x6bb14304 calloc
0x6bb1430c free
0x6bb14314 fwrite
0x6bb1431c malloc
0x6bb14324 realloc
0x6bb1432c signal
0x6bb14334 sprintf
0x6bb1433c strlen
0x6bb14344 strncmp
0x6bb1434c vfprintf

Exports

Ordinal Address Name
1 0x6bac169b DllGetClassObject
2 0x6bac1657 DllMain
3 0x6bac1695 DllRegisterServer
4 0x6bac1698 DllUnregisterServer
5 0x6bac16a4 StartW
!This program cannot be run in DOS mode.
P`.data
.rdata
`@.pdata
0@.xdata
0@.bss
.edata
0@.idata
.reloc
AUATUWVSH
([^_]A\A]
([^_]A\A]
([^_]A\A]
AVAUATVSH
[^A\A]A^
ATWVSH
X[^_A\
ATWVSH
X[^_A\
ATUWVSH
@[^_]A\
ATUWVSH
0[^_]A\
0[^_]A\
ATUWVSH
P[^_]A\
P[^_]A\
UAWAVAUATWVSH
[^_A\A]A^A_]
ATUWVSH
[^_]A\
ATWVSH
([^_A\H
tNHcA<H
tTIcB<L
tCHcA<H
tKIcA<L
tSIcK<L
5XU_ [
K<YOZ{
]TQ_s"fH
]TQ_'#fH
T^_;#fH
TLHHN}
TOHHzz
XVUTZH
XX^T^H
TS_W fH
A_3!fH
_?!fHR
_O!fHR
H^(%jt
H_(&jt
UTW>(h
XMYTSv
XLYTZv
TJ_o7fH
)_g)fH
y_O:fH
TO_/-fH
fwx fHRV
TV_c+fHn
~_K4fH
Tk<O [
XMYTSv
XMYT[v
_w%fHn
TYtnZ{
TN_O2fH
TN_o&fH
!_[&fH
TM_GdfH
Nx fHR
XMYT[v
TN_O6fH
vx fHR
]TT_' fH
TI_'%fH
TO_'"fH
TT_?#fH
[mTC_{
Y\n7!S
!fHn2r
I_wGfH
]\aHRJZ<
]\aHRJZ<
>\ Y>X
ThHH.@
TVHNZY
RhI>N7!
]\aHRJZ<
TQ_7pfH
f<HBZ
]Ta_'H
TV>X2$
XM}7i5
T@_W!fH
T@_K fH;ZY
TR_s!fH
fvx fH^V
TRHH^.
T@HH"3
wRJX>P
p 4 f4
h f\X7%
f<`.l
q8;!f2
TO_CqfH
Ti_[rfH
q(g f<
_g#fHRhA
y_GtfH
WR`A_StfH
ufHRha
TC__*fH
I\s\a
TW_c[fH
qh] f2
mTA_G4gH
'q4/ f
X_M[Y?Y
TX^1!fH
f\<\yXn
y_g fH
rUn ov\
y}4(=Z
y}4(=Z
TWHHn}
BTRHHBB
]TA\J\bK(
]TV_K#fH
]TW_/5fH
f\v\aH(
TR_#'fHn
_/FfHn
U{;OZ{
_c-fHn
]\aHR[
]TQ_[tfH
Tj^d!fH
TU_s:fH
^\WZY
Q_wjfH
B^5 fH
f^q fH
f\QflH
TV_S$fH
nv"!fH
qH/ fp]
P^/ fH
f>^\aH(
q`> f>e\
r]T_79
WT^^G&fH
U_{JfH
q(i f^
q<p fp]
<Q)q|\ f
TT_W|fH
q\w fp]
U_GYfH
'q@D f
qd} fp]
'q,S f
TT_ohfH
pTs f{
r4hG*Dv
$xiEZ,8U4
~<htRA>
1JNXv
nB_(U4
z|fi:hNU.
_{h`=rz{4
fRG jJS,K
~bo8Q<
mDZ+sxx5
Axne>a\N'
Xp~}6W0
1P3zv*
rAEDmm
9I'r>a
_H0tRA>iEZ,bHS"
~m7T\
'cp\.m{Q5
fF<qmKK+
7scT@}hYIouNRa~C[KO`dEDmmWYzvYRw
eg|w{L
8?t`>#
">{4kfZX
HBL~khQ
-u*mVc
oz,R#O0R
Z&56U>|%
Y!Ocjp
G@6?rE3iv
,MD,{,
)fxBRq5
7u2>RQt
;+^OOb
?8ndXG8
qSpxY
422*i0`h
y48SO]j
Tf$()gbt]
F?+V6=
0C&2H:`
3xg:wU
.bT$;
C0U+6sLM
} hD-KR*
CC<`"9)
r^/:3+@
c)m_)
E}Bp{
7C)v}E
'VZ{[h
`/[Vy^
'j~H|p
A`0aYKM(D
qSv`TN
H'tT8K
Sbk`&D
%c%c%c%c%c%c%c%c%cMSSE-%d-server
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
.pdata
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.3-win32 20200320
temp.dll
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartW
CloseHandle
ConnectNamedPipe
CreateFileA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
__iob_func
_amsg_exit
_initterm
_unlock
calloc
fwrite
malloc
realloc
signal
sprintf
strlen
strncmp
vfprintf
KERNEL32.dll
msvcrt.dll
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Clean
tehtris Clean
ClamAV Win.Trojan.CobaltStrike-9044898-1
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.Trojan.fc
ALYac Gen:Variant.Zusy.476921
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.CobaltStrike
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec Backdoor.Cobalt
Elastic Windows.Trojan.CobaltStrike
ESET-NOD32 a variant of Win64/CobaltStrike.Artifact.A
APEX Malicious
Avast Win64:Evo-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win64.CobaltStrike.gen
BitDefender Gen:Variant.Zusy.476921
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Zusy.476921
Tencent Trojan.Win32.CobaltStrike.16001072
TACHYON Trojan/W64.CobaltStrike.328192
Sophos ATK/Cobalt-W
F-Secure Heuristic.HEUR/AGEN.1362273
DrWeb Clean
VIPRE Gen:Variant.Zusy.476921
TrendMicro Backdoor.Win64.COBEACON.SMA
McAfeeD ti!CF6676B304DC
Trapmine Clean
FireEye Generic.mg.09a621243e242bc7
Emsisoft Gen:Variant.Zusy.476921 (B)
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Zusy.476921
Jiangmin Trojan.CobaltStrike.tu
Webroot Clean
Varist W64/CobaltStrike.X.gen!Eldorado
Avira HEUR/AGEN.1362273
Antiy-AVL RiskWare/Win64.Artifact.a
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Zusy.D746F9
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win64.CobaltStrike.gen
Microsoft Backdoor:Win64/CobaltStrike.NP!dha
Google Detected
AhnLab-V3 Malware/Win.Generic.R374111
Acronis suspicious
McAfee Injector-FEY.c!09A621243E24
MAX malware (ai score=80)
VBA32 Clean
Malwarebytes Trojan.CobaltStrike.Generic
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Backdoor.Win64.COBEACON.SMA
Rising Backdoor.CobaltStrike/x64!1.E382 (CLASSIC)
Yandex Clean
Ikarus Trojan.Win64.Cobaltstrike
MaxSecure Trojan.Malware.121218.susgen
Fortinet W64/CobaltStrike_Artifact.A!tr
BitDefenderTheta Clean
AVG Win64:Evo-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Backdoor:Win/Cobaltstrike
No IRMA results available.