Static | ZeroBOX

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x0000e8aa	0x0000ea00	6.11401492737
.rdata	0x00010000	0x00003a62	0x00003c00	5.4050152387
.data	0x00014000	0x000047d8	0x00003600	4.53641807002

!This program cannot be run in DOS mode.

9Rich)

`.rdata

@.data

>ilciuo

L$$QRP

;PCOIu^

>ilciu

F(;F$s

>ilciu2

tHh` A

VC20XC00U

;t$(v(

UQPXY]Y[

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

hxea3dcc10944cee2544aff9b377e0479d7f797494

QaBvbNAuoU52qCgbqsgoLAbK5P21L6dn5Y

RLefLLmDAZZb5ZynfPMjZ475pQdHVZNz9J

NASUHUTM7J5HNOJVZ2EULOP6INPNPSE4KN6AQNRI

Cz6xMbBst86mjM44qAaE5ahkD3F8JpLY7LFGHMiKYzwS6mn

via1qs8zt7jr4sgru6r8dqtdpc93c5d8wmwu8rkz94z

dgb1qnyphwne0t26mmxh2amyzzxzerxarj6jmf8wpmr

grs1qscr354fdfddglta2hgajrcryl4gqh6ey360d3u

NYrK5XBV24JHrojN4ABNkZxNsDEcegofxc

n1HHGP3YmZp3YA7VgqVgfJqyKBV86d9SaJo

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

82gtgWB2n6yPeqTrAsvDunAH7cbbiTYw1ccN6FvPPHEFNLcBoQUWTx5SoWSHayK8ViH7WzMgVoYQLQzGxQhrTvzRDU32z8t

SP1GK1GES8EXB6E15KQJ0EM169NQQNDZG8A2GDRZQ

aPFoyg69vKYCfnKGo1eLBo5XAmoyuZniGc

f1sz5wwh6urr3gsycgkki7ns5iino3a7bu3chsgly

f53ea9bd3352fd3b24be04fa27ce2171b21d1378e658c50553d804cfa70ceb64

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

zil19delrukejtr306u0s7ludxrwk434jcl6ghpng3

cro1xq0gkfldclds7y7fa2x6x25zu7ttnxxkjs66gf

erd1hwcnscv0tldljl68upajgfqrcrmtznth4n6ee46le43cqpe5tatqw96dnx

kava1r9xek0h0vkfra44lg3rp07teh9elxg2n6vsdzn

inj1e2g9nyfjcnvgjpaa3czx2spgf2jx3gp4gk0nl9

osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3

one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5

thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur

tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0

sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

band1f05d98dvehkecw6ex3yd4pxqssw3uemx09sg2n

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr

addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg

nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb

G35598989

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Ge7amzjabAHdubjUYS2Cw84hNScLVRHmHg

E36963824

EQDYiebztC06Lpo9y1-m-g_bOsJ2KN3I-1mOgllNNIlIPZLi

B36461211

B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA

U33390790

http://185.215.113.66/

http://77.91.77.92/

http://91.202.233.141/

DisableWindowsUpdateAccess

NoAutoUpdate

CheckedValue

SOFTWARE\Microsoft\Security Center

FirewallOverride

FirewallDisableNotify

AntiSpywareOverride

AntiVirusOverride

AntiVirusDisableNotify

UpdatesOverride

UpdatesDisableNotify

SOFTWARE\Microsoft\Security Center\Svc

FirewallOverride

FirewallDisableNotify

AntiSpywareOverride

AntiVirusOverride

AntiVirusDisableNotify

UpdatesOverride

UpdatesDisableNotify

www.update.microsoft.com

0.0.0.0

TCP: P2P_SendGETLPacket(0,%s) failed!

HTTP/1.1 200 OK

LOCATION:

239.255.255.250

M-SEARCH * HTTP/1.1

ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1

Man:"ssdp:discover"

HOST: 239.255.255.250:1900

Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)

Content-Type: text/xml; charset="utf-8"

Connection: Close

Cache-Control: no-cache

Pragma: no-cache

<?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><m:GetExternalIPAddress xmlns:m="urn:schemas-upnp-org:service:WANIPConnection:1"/></SOAP-ENV:Body></SOAP-ENV:Envelope>

SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#GetExternalIPAddress"

<?xml version="1.0"?>

<SOAP-ENV:Envelope

xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"

SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">

<SOAP-ENV:Body>

<m:AddPortMapping xmlns:m="urn:schemas-upnp-org:service:WANIPConnection:1">

</m:AddPortMapping>

</SOAP-ENV:Body>

</SOAP-ENV:Envelope>

SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"

<?xml version="1.0"?>

<SOAP-ENV:Envelope

xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"

SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">

<SOAP-ENV:Body>

<m:DeletePortMapping xmlns:m="urn:schemas-upnp-org:service:WANIPConnection:1">

</m:DeletePortMapping>

</SOAP-ENV:Body>

</SOAP-ENV:Envelope>

SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#DeletePortMapping"

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

WS2_32.dll

StrStrW

StrCmpNW

PathMatchSpecW

PathFileExistsW

StrChrA

PathFindFileNameW

StrStrIA

StrCmpNIA

SHLWAPI.dll

URLDownloadToFileW

urlmon.dll

DeleteUrlCacheEntry

InternetCloseHandle

InternetReadFile

HttpSendRequestA

HttpOpenRequestA

InternetConnectA

InternetOpenA

InternetCrackUrlA

HttpAddRequestHeadersA

HttpQueryInfoA

InternetOpenUrlA

DeleteUrlCacheEntryW

InternetOpenUrlW

InternetOpenW

WININET.dll

memcpy

strlen

memset

isdigit

isalpha

_chkstk

_aulldiv

wcslen

wcscmp

_allshl

_aullshr

strstr

strcmp

memmove

memcmp

RtlTimeToSecondsSince1980

NtQuerySystemTime

mbstowcs

ntdll.dll

RtlUnwind

NtQueryVirtualMemory

_vscprintf

msvcrt.dll

GlobalUnlock

GlobalLock

GlobalAlloc

lstrlenA

lstrlenW

lstrcpynW

MultiByteToWideChar

ExitThread

GetTickCount

GetModuleHandleW

CloseHandle

UnmapViewOfFile

GetFileSize

MapViewOfFile

CreateFileMappingW

CreateFileW

InitializeCriticalSection

LeaveCriticalSection

EnterCriticalSection

FlushFileBuffers

WriteFile

lstrcpyW

QueryDosDeviceW

GetDriveTypeW

GetLogicalDrives

RemoveDirectoryW

FindClose

FindNextFileW

MoveFileExW

lstrcmpW

FindFirstFileW

CreateDirectoryW

lstrcmpiW

CopyFileW

DeleteFileW

SetFileAttributesW

GetDiskFreeSpaceExW

GetVolumeInformationW

GetModuleFileNameW

CreateThread

CreateEventA

ExpandEnvironmentStringsW

ExitProcess

GetLastError

CreateMutexA

HeapAlloc

GetCurrentProcessId

HeapSetInformation

HeapCreate

GetProcessHeaps

HeapReAlloc

HeapValidate

HeapFree

InterlockedExchange

InterlockedDecrement

WaitForSingleObject

InterlockedIncrement

InterlockedExchangeAdd

IsBadReadPtr

DuplicateHandle

GetCurrentProcess

SetThreadPriority

GetThreadPriority

GetCurrentThread

DeleteCriticalSection

GetLocaleInfoA

CreateProcessW

KERNEL32.dll

CloseClipboard

SetClipboardData

EmptyClipboard

OpenClipboard

DispatchMessageA

TranslateMessage

GetMessageA

CreateWindowExW

RegisterClassExW

wsprintfW

DefWindowProcA

ChangeClipboardChain

RegisterRawInputDevices

GetClipboardData

IsClipboardFormatAvailable

SendMessageA

SetWindowLongW

SetClipboardViewer

GetWindowLongW

wsprintfA

wvsprintfA

USER32.dll

RegCloseKey

RegQueryValueExW

RegOpenKeyExW

RegOpenKeyExA

RegCreateKeyExW

RegSetValueExA

RegSetValueExW

CryptReleaseContext

CryptGenRandom

CryptAcquireContextW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

CoCreateInstance

CoInitialize

CoUninitialize

CoInitializeEx

ole32.dll

OLEAUT32.dll

WSAWaitForMultipleEvents

WSASocketA

WSACreateEvent

WSAGetOverlappedResult

WSAEventSelect

WSAEnumNetworkEvents

WSASend

WSARecv

WSACloseEvent

SetEvent

GetQueuedCompletionStatus

PostQueuedCompletionStatus

GetSystemInfo

CreateIoCompletionPort

Jun 12 2024 03:46:54

Jun 12 2024 03:46:55

0123456789

0123456789abcdef

55a4er5wo

257952873527395927395728375987839759823798573987582379857257952873527395927395728375987839759823798573987582379857257952873527395927395728375987839759823798573987582379857257952873527395927395728375987839759823798573987582379857257952873527395927395728375987839759823798573987582379857

399257952873527395927395728375987839759823798573987582379857257952873527395927395728375987839759823798573987582379857257952873527395927395728375987839759823798573987582379857257952873527395927395728375987839759823798573987582379857257952873527395927395728375987839759823798573987582379857257952873527395927395728375987839759823798573987582379857

0123456789abcdef

gYhfu%

Y#{5dA^O

jjjjjj

bitcoincash:

cosmos

bitcoincash:

ronin:

bitcoincash:

cosmos

gnano_

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

NoDrives

/c start %s & start %s\VolDrvConfig.exe

%comspec%

%s.lnk

%s\%s\VolDrvConfig.exe

shell32.dll

Thumbs.db

$RECYCLE.BIN

desktop.ini

System Volume Information

%s\%s\%s

(%dGB)

Unnamed volume

Microsoft Corporation

%s:Zone.Identifier

%userprofile%

%windir%

Software\Microsoft\Windows\CurrentVersion\Run\

%temp%

Software\Microsoft\Windows\CurrentVersion\Run\

SYSTEM\CurrentControlSet\Services\UsoSvc

SYSTEM\CurrentControlSet\Services\WaaSMedicSvc

SYSTEM\CurrentControlSet\Services\DoSvc

SYSTEM\CurrentControlSet\Services\wuauserv

SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

SOFTWARE\Policies\Microsoft\Windows

WindowsUpdate

SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

SOFTWARE\Policies\Microsoft\Windows

WindowsUpdate

SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

SYSTEM\CurrentControlSet\Services\BITS

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

%s\tbtnds.dat

%s\tbtcmds.dat

service

serviceType

serviceList

device

deviceType

deviceList

urn:schemas-upnp-org:device:InternetGatewayDevice:1

urn:schemas-upnp-org:device:WANDevice:1

urn:schemas-upnp-org:device:WANConnectionDevice:1

urn:schemas-upnp-org:service:WANIPConnection:1

urn:schemas-upnp-org:service:WANPPPConnection:1

controlURL

URLBase

GetExternalIPAddressResponse

NewExternalIPAddress

6%temp%

%s\%d%d.exe

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

%s:Zone.Identifier

%s\%d%d.exe

%s:Zone.Identifier

sysmablsvr.exe

Windows Settings

Antivirus	Signature
Bkav	W32.BeeyWcsjvulF.Trojan
Lionic	Trojan.Win32.Phorpiex.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CMC	Clean
CAT-QuickHeal	Trojan.Multi
ALYac	Clean
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005533551 )
K7GW	Trojan ( 005533551 )
Cybereason	malicious.d12d96
Baidu	Clean
VirIT	Trojan.Win32.Genus.VXH
Symantec	ML.Attribute.HighConfidence
tehtris	Clean
ESET-NOD32	a variant of Win32/Phorpiex.V
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Phorpiex-10030343-0
Alibaba	Worm:Win32/Phorpiex.5c685c46
NANO-Antivirus	Trojan.Win32.Phorpiex.koniga
ViRobot	Clean
MicroWorld-eScan	Gen:Heur.Mint.Zard.39
Tencent	Malware.Win32.Gencirc.10c01086
TACHYON	Clean
Sophos	W32/Trizt-Gen
F-Secure	Heuristic.HEUR/AGEN.1366496
DrWeb	Trojan.DownLoader46.2135
VIPRE	Gen:Heur.Mint.Zard.39
McAfeeD	Real Protect-LS!ABABCA6D12D9
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.ababca6d12d96e8d
Emsisoft	Gen:Heur.Mint.Zard.39 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Clean
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1366496
Antiy-AVL	Trojan/Win32.Phorpiex
Kingsoft	malware.kb.a.1000
Gridinsoft	Trojan.Win32.Downloader.sa
Xcitium	Malware@#2w9v0gjci7x32
SUPERAntiSpyware	Clean
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C4630408
Acronis	Clean
BitDefenderTheta	AI:Packer.46E3DD1D1E
MAX	malware (ai score=82)
VBA32	BScope.Worm.Propriex
Malwarebytes	Phorpiex.Trojan.Bot.DDS
Panda	Adware/SecurityProtection
Zoner	Clean
TrendMicro-HouseCall	TROJ_GEN.R06CC0DFC24
Rising	Worm.Phorpiex!8.48D (TFE:3:2wXnuqqcioP)
Yandex	Trojan.Agent!d7bZodg/Ml0
Ikarus	Trojan.Win32.Phorpiex
MaxSecure	Clean
Fortinet	W32/Malicious_Behavior.SBX
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)
alibabacloud	Trojan:Win/Phorpiex.RM8PHU

Static Analysis

PE Compile Time

PE Imphash

Sections

Imports