Static | ZeroBOX

PE Compile Time

2023-08-14 09:53:04

PE Imphash

ae6ae0f575f5bb1db94bcba94b27b8df

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0001be3e 0x0001c000 7.76482378873
.rdata 0x0001d000 0x00003080 0x00003200 4.89018311027
.data 0x00021000 0x023efa84 0x0000b000 0.284345046858
.rsrc 0x02411000 0x0000a990 0x0000aa00 5.50550403905

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0241a850 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_DIALOG 0x0241afb8 0x00000058 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x0241b790 0x000001fc LANG_JAPANESE SUBLANG_DEFAULT data
RT_STRING 0x0241b790 0x000001fc LANG_JAPANESE SUBLANG_DEFAULT data
RT_STRING 0x0241b790 0x000001fc LANG_JAPANESE SUBLANG_DEFAULT data
RT_GROUP_ICON 0x0241acb8 0x00000076 LANG_JAPANESE SUBLANG_DEFAULT data
RT_GROUP_ICON 0x0241acb8 0x00000076 LANG_JAPANESE SUBLANG_DEFAULT data
RT_VERSION 0x0241ad30 0x00000288 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library KERNEL32.dll:
0x41d008 FindResourceA
0x41d00c IsBadStringPtrW
0x41d010 CommConfigDialogA
0x41d014 SetEndOfFile
0x41d018 FindResourceW
0x41d01c CreateDirectoryW
0x41d020 WriteConsoleInputA
0x41d024 GetComputerNameW
0x41d028 GetModuleHandleW
0x41d02c VirtualFree
0x41d034 GlobalFindAtomA
0x41d038 LoadLibraryW
0x41d03c CreateEventA
0x41d040 GetModuleFileNameW
0x41d044 CreateFileW
0x41d048 GetACP
0x41d04c ReplaceFileA
0x41d050 GlobalUnlock
0x41d058 SetLastError
0x41d05c GetProcAddress
0x41d060 AttachConsole
0x41d064 SetFileAttributesA
0x41d068 LocalAlloc
0x41d06c EnumResourceTypesW
0x41d070 CancelIo
0x41d078 OpenFileMappingA
0x41d07c HeapReAlloc
0x41d080 HeapAlloc
0x41d084 HeapSize
0x41d088 GetStringTypeW
0x41d08c GetLastError
0x41d090 GetDateFormatW
0x41d094 MultiByteToWideChar
0x41d098 LCMapStringW
0x41d09c RtlUnwind
0x41d0a0 Sleep
0x41d0a4 HeapFree
0x41d0a8 GetCommandLineA
0x41d0ac HeapSetInformation
0x41d0b0 GetStartupInfoW
0x41d0b8 HeapCreate
0x41d0c0 ExitProcess
0x41d0c4 DecodePointer
0x41d0c8 WriteFile
0x41d0cc GetStdHandle
0x41d0d0 GetModuleFileNameA
0x41d0d8 WideCharToMultiByte
0x41d0e0 SetHandleCount
0x41d0e8 GetFileType
0x41d0f0 EncodePointer
0x41d0f4 TlsAlloc
0x41d0f8 TlsGetValue
0x41d0fc TlsSetValue
0x41d100 TlsFree
0x41d108 GetCurrentThreadId
0x41d114 GetTickCount
0x41d118 GetCurrentProcessId
0x41d124 IsDebuggerPresent
0x41d128 TerminateProcess
0x41d12c GetCurrentProcess
0x41d130 GetCPInfo
0x41d134 GetOEMCP
0x41d138 IsValidCodePage
0x41d144 RaiseException
Library USER32.dll:
0x41d150 SetMessageExtraInfo
0x41d154 GetCaretPos
0x41d158 DdeCmpStringHandles
0x41d15c CharUpperBuffW
0x41d160 GetClassInfoW
0x41d164 InsertMenuItemW
Library ADVAPI32.dll:
0x41d000 GetLengthSid
Library ole32.dll:
0x41d174 CoRevokeClassObject
0x41d178 CoMarshalHresult
Library WINHTTP.dll:
0x41d16c WinHttpWriteData

!This program cannot be run in DOS mode.
`.rdata
@.data
EPS~Cn
E<k=8V
SSSSSS
uLSSSSSSS
^SSSSS
j@j ^V
URPQQh
t"SS9] u
PPPPPPPP
PPPPPPPP
;t$,v-
UQPXY]Y[
t~-6?|
K*y &0
E[PSoo;q
j}TLMU88u|
<\Nr_7WX>
/-^.CS,
epJ"vD
_Ev lgz
R}tD?|G
'qhn|T
a3`)NXP
Tf.od#
'u S<I
P[CKAe
wJR+k)@8O
m}&mLF9
KfVC<k;#g
sAq#9t
$l}#asE
}}zJ.k
xfrH?3
Xr%/T<V
xwI>iW
hL&bxQ"
$8vq@GXOH
`%`fBNC
YU*VPj
SQ(Zt<
d&KdqT
nOJzu~
``fvEj
|f8]"+
"%mF7x
y<y|C'&V7
n6e{2G
92)6cY
92)6cY
0fMJJV
92)6cY
92)6cY
qv HC_
hfpbNK
<"QZ%b
}mKygV
pX{OJV4
j;}P+d
&g1K;
CKD}-Co
M>S=MQ
'w\UwF
1eZ5pu
$)JsyN-v
_Azk4)
k]ITLw2
~ugTAw2(
@%)re0
r*(5{O
>~>"o
<DkejfY
hi3fot
m+:aS[
taf1a>1W
c:/W^b
em/C@
$R]Ag!1|EN
w7D#B9
Zq!* =
FvONS)
XwWO]{
C)[q{S
:\.h|f
\WvpU;U9
%|x;XL
df1/qb
J:F\.PCN
43%[ZL
U~5\\>
p|?2KL
jZ*"%n
qdM5%M
"1qA7(
zuLG>d
q%(*8"
6&\00p
O,+*W
k_Km6y
&"&KBP
WXNnz
g#9w_s1
>aFrs>
@48w'&
qtPSynFu*
H&.3jv
7yg]<>R%9
4*0Z[w}
]8|u5g
n[ste1
.XR|#Nc{J
\[Y8{
n/F]G'
S#~G%#K
Zm[A4c
XEGF`u
WmM B|
tySt[V,kF
LuW&NT"
rAtEW{=
Ht5C[T
5X=4|A
R 4\Z|
!~~&_;
4v^YK)
S2^G=~
/&)\^9s
_f..j
)D}BX7coJ
s^@ar1
h*Sv<i(
0ySNhJU
;Xhh*'
,3EQ^C9
=`&Jz*
9V!1Fyh.
2NT=P}^}
i\8j4hq
88zzh~d
<0;}v"
7gMf49
O8iub"X=
(Bie[j,
':d}C-W;
|N$hWxQ
NhAgrIT
X9t^U0
!SeStk)#y
;"Yp8>+hzs
rpl'6g
R{)c5b
n:m/EW
/_hU$<
L\NyW]
QQSVWd
t=MOC
HtHu4j
t*=RCC
;7|G;p
tR99u2
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
kernel32.dll
VirtualProtect
busesomoyulejuvoyuc begenegotujafumufufibotelesogu joduhocilucaciyobohewobomoh guxayiwudesecefibosotacusozepax tukalimabu
bad exception
Unknown exception
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetDateFormatW
RemoveVectoredExceptionHandler
FindResourceA
IsBadStringPtrW
CommConfigDialogA
SetEndOfFile
FindResourceW
CreateDirectoryW
WriteConsoleInputA
GetComputerNameW
GetModuleHandleW
VirtualFree
SetProcessPriorityBoost
GlobalFindAtomA
LoadLibraryW
CreateEventA
GetModuleFileNameW
CreateFileW
GetACP
ReplaceFileA
GlobalUnlock
GetLastError
SetLastError
GetProcAddress
AttachConsole
SetFileAttributesA
LocalAlloc
EnumResourceTypesW
CancelIo
GetWindowsDirectoryW
OpenFileMappingA
KERNEL32.dll
GetKeyboardLayoutNameA
SetMessageExtraInfo
GetCaretPos
DdeCmpStringHandles
InsertMenuItemW
GetClassInfoW
CharUpperBuffW
USER32.dll
GetLengthSid
ADVAPI32.dll
CoMarshalHresult
CoRevokeClassObject
ole32.dll
WinHttpWriteData
WINHTTP.dll
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
SetUnhandledExceptionFilter
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetCPInfo
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapAlloc
HeapReAlloc
RaiseException
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVtype_info@@
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMME
MMMMMMMMMMMMMMMMMMMMvpF# MMMMMMMMMMMMMMMMMMg
MMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMP
y&MMMMMMMMMMMMMM
MMMMMMMMMMMMMMME
MMMMMMMMMMMMMMM
hA/gMMMMMMMMMMM
MMMMMMMMMM
cMMMMMMMMMM
MMMMMMMMMMMM
xMMMMMMMMMMMM
MMMMMMMMMMMMM
MMMMMMMMMMMM
MMMMMMMMMMMM
UMMMMM
MMMMMMMMMMMMMMMMMM
OMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
}~~}{~
zzz~|}
~}z~~~|
~}}|z~
|{{~~|
}{~}}~}~
|}~}|}
{~z|{|{}~~{{~
||{{|{
}{{{|~}z{
{{||||
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV-6666666666666666666666666666666666666666-VVVVVV6 77777777777777777777777777777777777777 6VVVVVV67
76VVVVVV67
76VVVVVV67
JJJJJJ
76VVVVVV67
JJJJJJJJJJJJJJ
76VVVVVV67
J]]]JJJJJJJJJ
76VVVVVV67
J]]]JJJJJJJJ
76VVVVVV67
J]]]JJJJJJJ
76VVVVVV67
]]]]]JJJJJJ
76VVVVVV67
]]]]JJJJJJ
76VVVVVV67
]]]]JJJJJ
76VVVVVV67
]]]]JJJJ
76VVVVVV67
]]]]JJ]
76VVVVVV67
]]]]]]
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV67
76VVVVVV)
%%%%%%%%%
)VVVVVV
VVVVVV
oo__FF
VVVVVV
ooo__FF
VVVVVV
VVVVVV
ooo__F
VVVVVV
eeeekkkk
VVVVVV(
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
..........................b
OOOOOOOOO
OOOOOOO
OOOOOOOOOOOOO
OOOOOO
OOOOOOOO
OOOOOOOO
OOOOOO
}OOOOO
ZZZZZZZZ
ZZZZZZZ
DDDDDDDDDD
DDDDBDBDBBB{{BD
DDDDDDBB7B7BBBD
DDDDBDD7DB7BBD
DD7D77777BD
{D7DB7BD
BD77DBD
BD7D7D
??????
zzzzzzzzzzzz
4M\ZCl
;7H=C|
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
- abort() has been called
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
AMicrosoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
KERNEL32.DLL
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
WUSER32.DLL
((((( H
h(((( H
H
Bkemivade ladad tofuvelu
kernel32.dll
kernel32.dll
zavikenizejonazuhicacetuvixuxe dihovemorehikozaxipaxajapa sem pajirom
msimg32.dll
VS_VERSION_INFO
StringFileInfo
032824E6
FileVersions
62.76.74.12
InternalName
FileDescription
FeelsLike
LegalCopyright
Copyrights (C) 2023, Navisradi
OriginalFilenames
Otlasi
ProductName
Morjez
ProductVersions
41.62.63.10
VarFileInfo
Translation
Warning
Japan tech:
Kogoxudoviwo rikahecomaxo
Xikotoke
ViwuzokigahikafLecih lojoreyejo cinobowewubowam hulowoyim javewubijuzawo faya zoriceyifesu yuhijupiyasutun daciheyita
Fide pav vavupefemen#Nosezi tunumejot golumiz sotigijifa]Tidumuwiporuhi moyedusev bacamadocax jil dok cik cimo bucoyifuwesedid dibapotuh wipesijixiyohECoku bevuyerejiw favusale gumipi bedupesosuwacul hufefusuyihi muvofik
Peloyem jifagocezup tojugey
Joma yumigeYBasafiwo dojufugit zem fakaf vacitovud cirajasa moxebaye nozafusecay duvowi xarowebokuvep\Tuyurakeyi laloto somame fifarukejehu sewoyenugurinuw fezaze misocofedopomok fikevacusu zeti$Kedipiboj vegirux wurujanezibeg vugiPNacu moxaxuja lisiwoyezacahu volimeyuyozonak daxax xixesehiguxiyi vesujile gupez'Tetutomozipuxe zonobudebo woyoxoxubogid
"Kuvolevesu cahohaleb gunarekut jen2Pecatemen moxecocewerure seloxufoyezigi guruyakemaDCajes nizanuci vagicanolihanuk xatok kawusefey pafilaraleda bofaride!Vehilacuwowar hujodoha wenorekofa
&Lefiyudazekusa yexafoduz sulegimakosan(Bukarogepu sox yoyem mel solu ner gipayi<Wusog nufa bikupagusazolu doxujev wafefozixu zeyalucinig vod
1Hujuvenixihibe poduh cazibaviv mozek mafatunubuvo3Nuwemapulinawo tik yim yatovubutepe nurozuj wakajih
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Tofsee.m!c
tehtris Generic.Malware
ClamAV Win.Packer.pkr_ce1a-9980177-0
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win32.Lockbit.dh
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
Alibaba Backdoor:Win32/Smokeloader.25c77ea2
K7GW Riskware ( 00584baa1 )
Cybereason Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HXLR
APEX Malicious
Avast Win32:CrypterX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Backdoor.Win32.Tofsee.gen
BitDefender Gen:Variant.Midie.150841
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Midie.150841
Tencent Trojan.Win32.Obfuscated.gen
TACHYON Clean
Sophos Troj/Krypt-VK
F-Secure Trojan.TR/Crypt.Agent.vsnuk
DrWeb Clean
VIPRE Clean
TrendMicro Trojan.Win32.PRIVATELOADER.YXEGJZ
McAfeeD Real Protect-LS!293460728C83
Trapmine malicious.high.ml.score
FireEye Generic.mg.293460728c83e7be
Emsisoft Gen:Variant.Midie.150841 (B)
SentinelOne Static AI - Malicious PE
GData Win32.Trojan-Downloader.SmokeLoader.NRWNJM
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist W32/Kryptik.MIZ.gen!Eldorado
Avira TR/Crypt.Agent.vsnuk
Antiy-AVL Clean
Kingsoft Win32.Hack.Tofsee.gen
Gridinsoft Trojan.Win32.SmokeLoader.tr
Xcitium Clean
Arcabit Trojan.Midie.D24D39
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Backdoor.Win32.Tofsee.gen
Microsoft Trojan:Win32/Smokeloader.SPXV!MTB
Google Detected
AhnLab-V3 Trojan/Win.Generic.R657819
Acronis suspicious
McAfee Artemis!293460728C83
MAX malware (ai score=88)
VBA32 Clean
Malwarebytes Trojan.MalPack.GS
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.PRIVATELOADER.YXEGJZ
Rising Backdoor.Tofsee!8.1E9 (TFE:5:K9grGyeiw1K)
Yandex Clean
Ikarus Trojan.Win32.Krypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HXLR!tr
BitDefenderTheta Gen:NN.ZexaF.36808.nq0@aqZwQljG
AVG Win32:CrypterX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Backdoor:Win/Tofsee.gyf
No IRMA results available.