popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

PE Compile Time

2023-03-11 13:44:31

PE Imphash

68ea642d9ea854cd557366cd6c8ee49a

PEiD Signatures

Armadillo v1.71

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000005b2 0x00000600 5.52853426525
.rdata 0x00002000 0x000006c2 0x00000800 4.13498604265
.data 0x00003000 0x0000003c 0x00000200 0.0203931352361
.rsrc 0x00004000 0x000001b4 0x00000200 5.09797908882
.reloc 0x00005000 0x000000f6 0x00000200 2.4753441891

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00004058 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library SHLWAPI.dll:
• 0x402070 PathFileExistsW
Library MSVCRT.dll:
• 0x40202c __setusermatherr
• 0x402030 _adjust_fdiv
• 0x402034 __p__commode
• 0x402038 __p__fmode
• 0x40203c _initterm
• 0x402040 _except_handler3
• 0x402044 _controlfp
• 0x402048 __getmainargs
• 0x40204c _acmdln
• 0x402050 exit
• 0x402054 _XcptFilter
• 0x402058 _exit
• 0x40205c srand
• 0x402060 rand
• 0x402064 memset
• 0x402068 __set_app_type
Library WININET.dll:
• 0x402080 InternetOpenUrlA
• 0x402084 InternetReadFile
• 0x402088 InternetOpenA
• 0x40208c InternetCloseHandle
• 0x402090 InternetOpenW
• 0x402094 InternetOpenUrlW
Library urlmon.dll:
• 0x40209c URLDownloadToFileW
Library KERNEL32.dll:
• 0x402000 CloseHandle
• 0x402004 DeleteFileW
• 0x402008 CreateFileW
• 0x402010 GetTickCount
• 0x402014 GetModuleHandleA
• 0x402018 GetStartupInfoA
• 0x40201c Sleep
• 0x402020 CreateProcessW
• 0x402024 WriteFile
Library USER32.dll:
• 0x402078 wsprintfW
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
L$$QRj
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
http://twizt.net/peinstall.php
PathFileExistsW
SHLWAPI.dll
memset
MSVCRT.dll
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetOpenUrlA
InternetOpenA
WININET.dll
URLDownloadToFileW
urlmon.dll
CreateProcessW
DeleteFileW
CloseHandle
WriteFile
CreateFileW
ExpandEnvironmentStringsW
GetTickCount
GetModuleHandleA
GetStartupInfoA
KERNEL32.dll
wsprintfW
USER32.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
151Y1j1
22&2.2
32393t3z3
4$4)4M4T4[4b4h4p4v4}4
4$5H5X5x5~5
%temp%
%s\%d%d.exe
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
%s:Zone.Identifier
%s\%d%d.exe
%s:Zone.Identifier
%temp%
%s\33573537.jpg
http://twizt.net/newtpp.exe
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Tiny.a!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win32.Generic.xt
ALYac Clean
Cylance Unsafe
Zillya Downloader.Tiny.Win32.25607
Sangfor Downloader.Win32.Agent.V1z7
K7AntiVirus Trojan ( 005a7a411 )
Alibaba TrojanDownloader:Win32/Generic.4ef83f0b
K7GW Trojan ( 005a7a411 )
Cybereason malicious.1d4b07
Baidu Clean
VirIT Trojan.Win32.Genus.OHA
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Tiny.NTO
APEX Malicious
Avast Win32:Evo-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Downloader.Win32.Convagent.gen
BitDefender Gen:Heur.Mint.Zard.11
NANO-Antivirus Trojan.Win32.Tiny.jvzevg
ViRobot Clean
MicroWorld-eScan Gen:Heur.Mint.Zard.11
Tencent Malware.Win32.Gencirc.11bbe92b
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/Crypt.XPACK.Gen
DrWeb Trojan.DownLoader.origin
VIPRE Gen:Heur.Mint.Zard.11
TrendMicro Mal_DLDER
McAfeeD Real Protect-LS!CFB7FBF1D4B0
Trapmine Clean
FireEye Generic.mg.cfb7fbf1d4b077a0
Emsisoft Gen:Heur.Mint.Zard.11 (B)
SentinelOne Static AI - Malicious PE
GData Gen:Heur.Mint.Zard.11
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist Clean
Avira TR/Crypt.XPACK.Gen
Antiy-AVL Trojan[Downloader]/Win32.Tiny
Kingsoft malware.kb.a.1000
Gridinsoft Clean
Xcitium Malware@#39haopuw30io5
Arcabit Trojan.Mint.Zard.11
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Downloader.Win32.Convagent.gen
Microsoft Trojan:Win32/Phorpiex.RB!MTB
Google Detected
AhnLab-V3 Trojan/Win.Dlder.C5394644
Acronis Clean
McAfee GenericRXAA-FA!CFB7FBF1D4B0
MAX malware (ai score=100)
VBA32 BScope.Trojan.Caynamer
Malwarebytes Generic.Malware/Suspicious
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Mal_DLDER
Rising Downloader.Agent!1.F26F (CLASSIC)
Yandex Trojan.DL.Tiny!a5jVzlzuyvs
Ikarus Trojan-Downloader.Win32.Tiny
MaxSecure Trojan.Malware.1728101.susgen
Fortinet W32/Malicious_Behavior.SBX
BitDefenderTheta AI:Packer.46101D181F
AVG Win32:Evo-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Trojan[downloader]:Win/Phorpiex.RK8PHU
No IRMA results available.