Static | ZeroBOX

PE Compile Time

2009-09-01 10:35:30

PE Imphash

25b3acc640473b6fce722f16eff93149

PEiD Signatures

UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x0000c000 0x00000000 0.0
UPX1 0x0000d000 0x0000b000 0x0000ae00 7.89777563709
.rsrc 0x00018000 0x00001000 0x00000a00 3.35099200565

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0001805c 0x00000768 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library ADVAPI32.dll:
0x41883c FreeSid
Library KERNEL32.DLL:
0x418844 LoadLibraryA
0x418848 ExitProcess
0x41884c GetProcAddress
0x418850 VirtualProtect
Library MSVCRT.dll:
0x418858 _iob
Library WS2_32.dll:
0x418860 WSARecv
Library WSOCK32.dll:
0x418868 WSAGetLastError

!This program cannot be run in DOS mode.
AaZD@A
J#H0 p
)PVRQQo
txov|)
0vQyx!
m]/*FR
wi)ao9l
`1@1j
mgpKWv
I=>!XQ
P! oGP
@VIM;D
,dVGI8
U[5_mGp
3V2#mt
{@1Rn1
H K1<h
t.WxPG1{
dn/8Sa,1
TD/WHG+vh
z(un#?
-\z[vUMMGLN
B4aBRY\:
u5Mw^p
h ;R]
!{9Ao](
p+T:"<E
>-;_-F
:@)H&CG
u *! <fu
iG/Lzv
#3mr9wM
1c@$:C
w1rLHH
A;:e7/
6h WMA
78B5UN
VF7#hZ
#h()w,
GRx2dz
winiThLw&
Mozilla/5.0 (W$dows NT
pleWebKit-37.360KHTML
like Gecko&ChWme/98
/j4iNEL86xF
nHqdHeXmzAeBZiOx9qbqO8yBqj
zgBFOyC*azB5bwLdZU
ab3MNGjdmy12pxE3xxztmLvqXP5k8U
59R8dtwPDz7ybR5HCxU4G
{89.19
Q<zCD+
znEiWE
JJCCKC
~+mAt0
4M~tld\R4M
4H>4*
'(null)?12345678
9abcdef
ABCDEF
6l7L8i
4M|IdJ@Kl
Tue{ed
BYkm4
?7:;<=
 !"#$%L()*+,-./Y
GHIJKLMNO:STUVWXYZ
Wghijklmnopqrstuvwxyz?
c?%s: CK
t use c
y level g
er th%
[R6gW0..%d]
iFLBasic
okie:2
Cmix PUT
adC/<S
:u:v:rkV
x:y:z:C:H:P
:A:g:X:
apr_sock
1_;)ct"
B10 fail
vZim#oy
[m%yKNFO:m
HTTP/1.0
+2.37
(i :oD)g
}dKCSVGw u
!$ !<0>
ax!WARN
sults7
obyly@
C?ERROR
T[+/-sd]ku
`CC]TsD
2tkb/s
6eTrzszr
N:'[Kby
7$H/>:
velCDr+K8,
d#Pa!#
-lSN=4
-`OOsRb
~9(J(%
MWTPco
BCcp'<p+
Found6,_ttp:/
.a&.Fg/<bK
o* 1996N;mWwi
}+\>Zeus
V0-kgw
@o; is
Ea{lt;
g8$Kvi#
w-hGDPk%j'=|jc
exit 3l
FKshow
il t5;N
XUxy:p
egF'[Q
zip'/-COc
F>"me4
SOSPKb}
xKMG0E
SAS4V0
LSsyRm
h+;?ak+
!~kssA
enB0`X=<
]bReerkV
X$b@Oforh
l/thA\d
Gp!F? jus
?u urUf
ZwQupyI
l32TUY
nD#tDI
ZonSf(,[-
c: E1w
2pc3t&
Ov"lap
WE:Xcp
rch%wcsncm
XPTPSW
ADVAPI32.dll
KERNEL32.DLL
MSVCRT.dll
WS2_32.dll
WSOCK32.dll
FreeSid
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
WSARecv
VS_VERSION_INFO
StringFileInfo
040904b0
Comments
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName
Apache Software Foundation
FileDescription
ApacheBench command line utility
FileVersion
2.2.14
InternalName
ab.exe
LegalCopyright
Copyright 2009 The Apache Software Foundation.
OriginalFilename
ab.exe
ProductName
Apache HTTP Server
ProductVersion
2.2.14
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Swrort.4!c
tehtris Clean
ClamAV Win.Trojan.Swrort-5710536-0
CMC Clean
CAT-QuickHeal Trojan.Swrort.A
Skyhigh BehavesLike.Win32.Generic.pc
ALYac Generic.ShellCode.Marte.3.30323BD4
Cylance Unsafe
Zillya Trojan.RozenaGen.Win32.2
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 001172b51 )
Alibaba Trojan:Win32/CobaltStrike.5c89
K7GW Trojan ( 001172b51 )
Cybereason malicious.23c896
Baidu Clean
VirIT Clean
Symantec Trojan Horse
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win32/Rozena.ZL
APEX Malicious
Avast Win32:Evo-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Generic.ShellCode.Marte.3.30323BD4
NANO-Antivirus Virus.Win32.Gen-Crypt.ccnc
ViRobot Clean
MicroWorld-eScan Generic.ShellCode.Marte.3.30323BD4
Tencent Trojan.Win32.CobaltStrike.16001078
Sophos Mal/Generic-S
F-Secure Trojan.TR/Crypt.ZPACK.Gen
DrWeb Clean
VIPRE Generic.ShellCode.Marte.3.30323BD4
TrendMicro Backdoor.Win32.SWRORT.SMAL01
McAfeeD Real Protect-LS!40094E123C89
Trapmine malicious.high.ml.score
FireEye Generic.mg.40094e123c896254
Emsisoft Generic.ShellCode.Marte.3.30323BD4 (B)
Paloalto generic.ml
GData Win32.Trojan.PSE.1TDK453
Jiangmin Clean
Webroot W32.Trojan.Swrort.Gen
Varist W32/Swrort.B.gen!Eldorado
Avira TR/Crypt.ZPACK.Gen
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.Rozena
Kingsoft malware.kb.b.949
Gridinsoft Trojan.Win32.Agent.sa
Xcitium TrojWare.Win32.Rozena.A@4jwdqr
Arcabit Generic.ShellCode.Marte.3.30323BD4
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Generic
Microsoft Trojan:Win32/Meterpreter!pz
Google Detected
AhnLab-V3 Backdoor/Win32.Bifrose.R12476
Acronis Clean
McAfee GenericRXAA-AA!40094E123C89
TACHYON Clean
VBA32 Trojan.Swrort
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall Backdoor.Win32.SWRORT.SMAL01
Rising HackTool.Swrort!1.6477 (CLOUD)
Yandex Trojan.GenAsa!O0/tdGI4TGA
Ikarus Trojan.Agent
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Rozena.ABV!tr
BitDefenderTheta Gen:NN.ZexaF.36808.cmKfaao3uqpi
AVG Win32:Evo-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Backdoor:Win/shellcode.api(dyn)
No IRMA results available.