Static | ZeroBOX

PE Compile Time

2023-03-19 06:10:08

PE Imphash

a3e85d80936c7ef42408e50a5a01f3d6

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0001bc5e 0x0001be00 7.76784043659
.rdata 0x0001d000 0x00002eec 0x00003000 4.92478099632
.data 0x00020000 0x02409404 0x00024800 0.0968147592617
.rsrc 0x0242a000 0x00004028 0x00004200 3.97654410787

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0242ceb0 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0242ceb0 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0242ceb0 0x00000468 LANG_JAPANESE SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_DIALOG 0x0242d5d8 0x00000058 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_STRING 0x0242dd00 0x00000322 LANG_JAPANESE SUBLANG_DEFAULT data
RT_STRING 0x0242dd00 0x00000322 LANG_JAPANESE SUBLANG_DEFAULT data
RT_STRING 0x0242dd00 0x00000322 LANG_JAPANESE SUBLANG_DEFAULT data
RT_GROUP_ICON 0x0242d318 0x00000030 LANG_JAPANESE SUBLANG_DEFAULT data
RT_VERSION 0x0242d348 0x0000028c LANG_NEUTRAL SUBLANG_NEUTRAL PGP symmetric key encrypted data - Plaintext or unencrypted data

Imports

Library KERNEL32.dll:
0x41d014 AllocConsole
0x41d018 CommConfigDialogA
0x41d01c SetEndOfFile
0x41d020 LocalCompact
0x41d028 LoadLibraryW
0x41d02c CreateEventA
0x41d030 GetModuleFileNameW
0x41d034 GetACP
0x41d038 ReplaceFileA
0x41d03c CreateDirectoryA
0x41d040 GetLastError
0x41d044 SetLastError
0x41d048 GetProcAddress
0x41d04c CreateJobSet
0x41d050 IsBadStringPtrW
0x41d054 CreateFileMappingA
0x41d058 LocalAlloc
0x41d05c GlobalFindAtomW
0x41d060 EnumResourceTypesW
0x41d068 SetFileAttributesW
0x41d06c RaiseException
0x41d070 HeapReAlloc
0x41d074 GetStringTypeW
0x41d078 MultiByteToWideChar
0x41d07c LCMapStringW
0x41d080 FindResourceA
0x41d084 WriteConsoleInputW
0x41d088 CreateFileA
0x41d08c GlobalFree
0x41d090 GetDateFormatW
0x41d094 HeapSize
0x41d098 RtlUnwind
0x41d09c HeapAlloc
0x41d0a0 GetCommandLineA
0x41d0a4 HeapSetInformation
0x41d0a8 GetStartupInfoW
0x41d0b0 GetModuleHandleW
0x41d0b4 ExitProcess
0x41d0b8 DecodePointer
0x41d0bc WriteFile
0x41d0c0 GetStdHandle
0x41d0c4 HeapCreate
0x41d0c8 EncodePointer
0x41d0cc HeapFree
0x41d0d4 GetModuleFileNameA
0x41d0dc WideCharToMultiByte
0x41d0e4 SetHandleCount
0x41d0ec GetFileType
0x41d0f4 TlsAlloc
0x41d0f8 TlsGetValue
0x41d0fc TlsSetValue
0x41d100 TlsFree
0x41d108 GetCurrentThreadId
0x41d114 GetTickCount
0x41d118 GetCurrentProcessId
0x41d12c IsDebuggerPresent
0x41d130 TerminateProcess
0x41d134 GetCurrentProcess
0x41d138 GetCPInfo
0x41d13c GetOEMCP
0x41d140 IsValidCodePage
0x41d144 Sleep
Library USER32.dll:
0x41d154 InsertMenuItemW
0x41d158 CharUpperBuffA
0x41d15c GetCaretPos
0x41d160 SetMessageExtraInfo
0x41d168 ShowCursor
0x41d16c GetClassInfoW
Library GDI32.dll:
0x41d00c GetCharABCWidthsI
Library ADVAPI32.dll:
0x41d000 CopySid
0x41d004 ClearEventLogA
Library MSIMG32.dll:
0x41d14c AlphaBlend

!This program cannot be run in DOS mode.
`.rdata
@.data
jlXjmf
E8k=8V
SSSSSS
SSSSSS
SSSSSSSSSS
u-SSSSSSS
^SSSSS
j@j ^V
URPQQh
t"SS9] u
;t$,v-
UQPXY]Y[
>ws[PBW
(Uh*#I
mE2R 5
"tT.MYD
2=H*~Q
Z|Nfk1
LRk^:.
n{b5Kt
'TKE">
h|wZ2B
(abZ'}
$8)o9Ss
MF8va&
$wzdFA
xP*Nb9
l4|e,f
ZWF=2A4
L"#1wi
tEyp(8
:wg:i1p>T
(vi8*\i
@Imbupl
c4^jpt,`
~.F37(.
k_05S~
Xi.6g_
2>FX?7Ilm
$~bONO
M[SJhWl
;<yx''Y
s>1%fw
~-`(R#
I}-'5,R
`5f37R 
A!QgX*D
_0+Y4b
v@/S!$3
/sW- f
iW?US~j
#>Rb;W
8RYGLH
V@CUep
4*thay
`s[Nf8bn
q}-p4$3F
:vbxQ)V
Q"{< Z
mEGX;!
GTmu_[
}N(k:_
o6NS A
w@1VH&
wLq_NW
VT842
x/{!@b
.c`"(_
#d%pLP
6R&oU.
B+7r"JO
/-1Gwc
*qb~}v
Bm>T);Z
s>u$Do%dTo
"TQ)?e
':D ]n
H8hF~qs}
>Rry~5
gNL2&
unXK>p
"Wv y*
+wF<w_
'q;k6jJ
mB<30d%
E<URL?
O7j|r]
>z"b#M
X9kJ+F+
4IP}-[V&
sM#AA(!
/FN=t\
;WN\D=
+V4B5]
{I!Cf3
;tASkW
Dxl\mr
3HzNHt
Wd,6#L;
i6V8&H
b[`A$q?
\'cfp:
HoALu{,
*o@}k<
"DeyU/
m!M,~~
!*q2+2
Ha#m}]S
M;fM|/C
Cu3qhC-
63\>1
7^6vK"
\A 'QM
*&s-+.
<t*vi7S
"x61Uy
ki.):
paev;t
T@a<t1
5w%oD{
QQ}'Zg
\!RMi
CkFpRp>
Rn"F,
.;ySEy
nU_@1C1
UY4OOw;
{vCB2t<
0r5T<TZ
p^yD_Hr|
;L']Ws
V/H>NJ
TVuDI'm
w7V.1&mQ
hi>F}]
J@p.eL
4$|B=pu
u|\gs"W
(zwRb,
I)H1^nzjw
_to@vva
E?YAqV}
Z|'wM\
j);n+d
{W2ZY+D
Fj@%]G.W?
%3#,aD
tah-')
-%w{6#
l%P1RC7
FUa9lXp
l$oo<3
+\lz2|
8fY/cO8
Z@Cc6B"XP
P.{ $3
:K?Y<0
dJ-:!;Y
:*8VUW
3C=%v6
0~:}vh
#p[|tG>
L-M3,n%
lBU(L?
@\{0=y7
e"Ug0<-[
Y+0?r@^
*6;d'}4
QQSVWd
t=MOC
HtHu4j
t*=RCC
;7|G;p
tR99u2
PPPPPPPP
PPPPPPPP
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
kernel32.dll
VirtualProtect
bad exception
Unknown exception
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
GetDateFormatW
CreateFileA
FindResourceA
WriteConsoleInputW
IsBadStringPtrW
AllocConsole
CommConfigDialogA
SetEndOfFile
LocalCompact
GetProcessPriorityBoost
LoadLibraryW
CreateEventA
GetModuleFileNameW
GetACP
ReplaceFileA
CreateDirectoryA
GetLastError
SetLastError
GetProcAddress
CreateJobSet
GlobalFree
CreateFileMappingA
LocalAlloc
GlobalFindAtomW
EnumResourceTypesW
GetWindowsDirectoryW
SetFileAttributesW
KERNEL32.dll
GetKeyboardLayoutNameA
SetMessageExtraInfo
GetCaretPos
CharUpperBuffA
ShowCursor
InsertMenuItemW
GetClassInfoW
USER32.dll
GetCharABCWidthsI
GDI32.dll
CopySid
ClearEventLogA
ADVAPI32.dll
AlphaBlend
MSIMG32.dll
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
HeapCreate
EncodePointer
HeapFree
SetUnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetCPInfo
GetOEMCP
IsValidCodePage
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
RaiseException
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVtype_info@@
j(W_)t_e
~z~z{{
}{~{z}
|}|||}
{}~~{~~|
{|{}||
~z~{{|
~{{~~{
|||{}~
}}{|~~
|{{y{{
}~y}~}
{|~|}{~{|{
{}~|~~
y~|}{}
{{|{{{~
~}{{|}}
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
- abort() has been called
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
AMicrosoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
KERNEL32.DLL
WUSER32.DLL
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
((((( H
h(((( H
H
viwocunitibuwinap
kernel32.dll
kernel32.dll
VS_VERSION_INFO
StringFileInfo
032824E6
FileVersions
62.76.74.12
InternalName
FileDescription
FeelsLike
LegalCopyright
Copyrights (C) 2023, Nabisradi
OriginalFilenames
Otlasik
ProductName
Porjezo
ProductVersions
11.62.63.10
VarFileInfo
Translation
Warning
Japan tech:
Nopu zihurediyec wonowogovaxugZagoxudun rivoxej decotonimemisa nifunot zeruhotixexabax rugelejif gecupo jisudagukamel xuramocuy cuyes
Ravi pexa bexode kole mekize
Vatupidazut yejeyuwajuh
Raduziwukuk nebi
Farenodazad0Cudopaxud zapibugebuc taho dokojufuhagabux pivih\Kejewavolotuce bohenazafuy worucokirutiliw riza jifol kecayewucas rar nibupube guxewataxolihgRiyolef bozifemi fapimicomubiy gayoyudetux veputogecobura nomanax muconayiluvilu yamo yaka carelalusese
Tipu nidinofucicixuz)Jet zotixazipoy reguciyeb jajewuma saralo
Xibosota cedefedul fisulunuy
Cunutebepaj lubag
Cepikemet jegenusisaf tid3Silafoledeyej viduyomu xipegowenato pizarogameratil
TLeg madujajoralobax jonuxuzacov honetolurilened yafirugap huvozejen citasec tolojuvuBNatetekov jokolita tutadisobaxejuh bovohonudunud kahimowotivim bey.Virola gap gudo bawuyupicire hetexo zeputuwexa
Besole
5Mejisuhuxuw jeze yakihat fudogifujafemo lumozapogogaymJowotoyuxumiba dom kucarutox kiyigiyov tusuribifaloro nepuwifa leseyasavekoyes vivedocatejufa wukujewocabizos
Hesenitibokufop jizegezasotas
bBohi hisosaposocatic fejofuk jasoyocanuweg meletasen cihehokusina wafuliton jemeyuzop kufomarijuma`Ladajem kuhekaweceratix mamegosubokal jawigoganupinek kezanecot hawejife zixidev bapotonehukomix
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Clean
tehtris Generic.Malware
ClamAV Win.Packer.pkr_ce1a-9980177-0
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win32.Lockbit.dt
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
Alibaba Clean
K7GW Riskware ( 00584baa1 )
Cybereason Clean
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 Clean
APEX Malicious
Avast Clean
Cynet Malicious (score: 100)
Kaspersky VHO:Trojan.Win32.DiskWriter.gen
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Tencent Trojan.Win32.Obfuscated.gen
TACHYON Clean
Sophos Troj/Krypt-VK
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfeeD Real Protect-LS!835246232DBB
Trapmine malicious.high.ml.score
FireEye Generic.mg.835246232dbb706d
Emsisoft Clean
SentinelOne Static AI - Malicious PE
GData Clean
Jiangmin Clean
Webroot Clean
Varist W32/Kryptik.MIZ.gen!Eldorado
Avira Clean
Antiy-AVL Clean
Kingsoft malware.kb.a.1000
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm VHO:Trojan.Win32.DiskWriter.gen
Microsoft Program:Win32/Wacapew.C!ml
Google Detected
AhnLab-V3 Clean
Acronis suspicious
McAfee Clean
MAX Clean
VBA32 Clean
Malwarebytes MachineLearning/Anomalous.95%
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Generic@AI.99 (RDMK:cmRtazq0rhB9l4lXzqeSfKtroOAa)
Yandex Clean
Ikarus Trojan-PWS.Win32.Tepfer
MaxSecure Trojan.Malware.300983.susgen
Fortinet Clean
BitDefenderTheta Gen:NN.ZexaF.36808.rq0@aiEYXnfG
AVG Clean
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Clean
No IRMA results available.