Static | ZeroBOX

PE Compile Time

2024-07-18 18:21:27

PDB Path

D:\Pentest\tools\Voidgate\voidgate-master\x64\Release\Voidgate.pdb

PE Imphash

2b29ecda909fdba87059f051e118961a

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000021fa 0x00002200 6.09256274861
.rdata 0x00004000 0x00001b46 0x00001c00 4.42399250524
.data 0x00006000 0x00000900 0x00000400 5.12919665417
.pdata 0x00007000 0x000002d0 0x00000400 3.05769566933
.rsrc 0x00008000 0x000001e0 0x00000200 4.6961226186
.reloc 0x00009000 0x00000050 0x00000200 1.10485125915

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00008060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x140004000 VirtualFree
0x140004008 VirtualAlloc
0x140004018 GetLastError
0x140004020 GetCurrentThread
0x140004028 GetThreadContext
0x140004030 SetThreadContext
0x140004038 RtlLookupFunctionEntry
0x140004040 RtlVirtualUnwind
0x140004048 UnhandledExceptionFilter
0x140004058 GetCurrentProcess
0x140004060 TerminateProcess
0x140004070 IsDebuggerPresent
0x140004078 GetModuleHandleW
0x140004080 QueryPerformanceCounter
0x140004088 GetCurrentProcessId
0x140004090 GetCurrentThreadId
0x140004098 GetSystemTimeAsFileTime
0x1400040a0 InitializeSListHead
0x1400040a8 RtlCaptureContext
Library VCRUNTIME140_1.dll:
0x140004178 __CxxFrameHandler4
Library VCRUNTIME140.dll:
0x140004120 memset
0x140004130 memmove
0x140004138 __current_exception
0x140004140 _CxxThrowException
0x140004148 __C_specific_handler
0x140004150 __std_terminate
0x140004158 __std_exception_copy
0x140004160 __std_exception_destroy
0x140004168 memcpy
Library api-ms-win-crt-runtime-l1-1-0.dll:
0x1400041d0 terminate
0x1400041d8 _exit
0x1400041e0 exit
0x1400041e8 _initterm_e
0x1400041f0 __p___argc
0x1400041f8 __p___argv
0x140004218 _set_app_type
0x140004220 _seh_filter_exe
0x140004228 _cexit
0x140004230 _crt_atexit
0x140004248 _configure_narrow_argv
0x140004250 _initterm
0x140004258 _c_exit
0x140004260 _initialize_onexit_table
Library api-ms-win-crt-heap-l1-1-0.dll:
0x140004188 free
0x140004190 _set_new_mode
0x140004198 malloc
0x1400041a0 _callnewh
Library api-ms-win-crt-math-l1-1-0.dll:
0x1400041c0 __setusermatherr
Library api-ms-win-crt-stdio-l1-1-0.dll:
0x140004270 _set_fmode
0x140004278 __p__commode
Library api-ms-win-crt-locale-l1-1-0.dll:
0x1400041b0 _configthreadlocale

!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.rsrc
@.reloc
@SUWAVAWH
A_A^_][
A_A^_][
VWATAVAWH
0A_A^A\_^
VWATAVAWH
0A_A^A\_^
u0HcH<H
H3E H3E
bad allocation
Unknown exception
bad array new length
string too long
e9ZsvXhWNhdps99nFG
VirtualAlloc
Executing the payload with VEH ASM decryption... This may take a while depending on the efficiency of the shellcode...
failed with error code:
[X] ERROR -
D:\Pentest\tools\Voidgate\voidgate-master\x64\Release\Voidgate.pdb
.text$di
.text$mn
.text$mn$00
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIZ
.CRT$XPA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.pdata
.rsrc$01
.rsrc$02
VirtualFree
VirtualAlloc
AddVectoredExceptionHandler
GetLastError
GetCurrentThread
GetThreadContext
SetThreadContext
KERNEL32.dll
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
MSVCP140.dll
__CxxFrameHandler4
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memset
VCRUNTIME140_1.dll
VCRUNTIME140.dll
_invalid_parameter_noinfo_noreturn
_callnewh
malloc
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
__setusermatherr
_get_initial_narrow_environment
_initterm
_initterm_e
_set_fmode
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
terminate
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
memcpy
memmove
WNh%!2ik?
)<.*cx6
=Z;CA99/
0iVNh=1
3Nhdpsxi/
.?AVtype_info@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
Antivirus Signature
Bkav Clean
Lionic Clean
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Clean
Cylance Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason Clean
huorong Clean
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec Clean
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Injector.QR
APEX Malicious
Avast Clean
Cynet Clean
Kaspersky Clean
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Tencent Clean
TACHYON Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfeeD ti!1979B3E93669
Trapmine Clean
FireEye Clean
Emsisoft Clean
Ikarus Trojan.Win64.Injector
GData Clean
Jiangmin Clean
Webroot Clean
Varist Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!8F92F52BFFEA
MAX Clean
VBA32 Clean
Malwarebytes Generic.Malware/Suspicious
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Malware.Undefined!8.C (TFE:5:pnNXHYOY5pO)
Yandex Clean
SentinelOne Clean
MaxSecure Trojan.Malware.300983.susgen
Fortinet Clean
BitDefenderTheta Clean
AVG Clean
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (D)
alibabacloud Trojan:Win/Injector.QV
No IRMA results available.