Static | ZeroBOX

PE Compile Time

1992-06-20 07:22:17

PE Imphash

b411f30c94b39aeb7f756dde75c64d60

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x0000e000 0x00000000 0.0
UPX1 0x0000f000 0x00004000 0x00004000 7.82295035548
.rsrc 0x00013000 0x00001000 0x00000400 3.1339377719

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x00010140 0x00000080 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x00010140 0x00000080 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x00010140 0x00000080 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library KERNEL32.DLL:
0x413198 LoadLibraryA
0x41319c GetProcAddress
0x4131a0 VirtualProtect
0x4131a4 VirtualAlloc
0x4131a8 VirtualFree
0x4131ac ExitProcess
Library advapi32.dll:
0x4131b4 RegCloseKey
Library oleaut32.dll:
0x4131bc SysFreeString
Library shell32.dll:
0x4131c4 ShellExecuteA
Library shfolder.dll:
0x4131cc SHGetFolderPathA
Library urlmon.dll:
0x4131d4 URLDownloadToFileA
Library user32.dll:
0x4131dc CharNextA
Library wsock32.dll:
0x4131e4 send

This program must be run under Win32
StringX
TObject
vtWFLFk
>zhWT:
tZXtU0:'
~KxI[)
7OFTWARE\Borland\Delphi\RT}C
FPUMaskValue
% v).w
Q82#<1
\uCiNu
vn%PWn
YUX2hw
Alg%3Z}
JO8|"G
3?^I'<<
<(+#'s
#/%ET?
TMParrayA
Utils
sMicrosof
Windows
entVersion\Run
4M;22`;n<
TFlood
la/5.0 (L
NT 6.1; WOW9) AppleWebKi/u
like Gecko%Ch
li4/Hs
:12)]
kuMacmt5
W1.7|d
GMSIE
Nx-USR.V2
/,2707
.NE>CLR
D3 29)5
wLux i687
ITseptp\
}23132buru/
L!DX [(`
!0/6GB
4#SLCC24edia8
yPVh5U-RT
!_sU)H
PhN?CPU
ghijklmnopq
Dvwxyzp
W.uk'M8
Range:by
~s=0-,#5
-A^n57
3h,ij;d
#.<g%z
!wHEADF
icaF/xJ
-Irm-ur
.Socvt
cuNQR6
3sys^H^r
jePCcc-
IPKPMTX
_N|uus
c.exe'
lSh|x
password
Y%`Td
,z?UQNXM
USKKDL^6
/Error
BCDEF,Ye
8DP`lO.
312*4'>
)2~2673uGWHQfwra{rNSINppaqrbmasd
ww~aug~.4xE
efCQQ*
k{Bfl`
gaE[Z{3~PAD
System
b{Init&K
IsWow64Process'
lstrcpy"Write
Memory
VirtualAll
izeofR(ou<e
ModujH
+mpu-rNam+
kC\i/S
XxUnhtd.=
16 SUs
:t_u[
,CODE8s
XPTPSW
KERNEL32.DLL
advapi32.dll
oleaut32.dll
shell32.dll
shfolder.dll
urlmon.dll
user32.dll
wsock32.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegCloseKey
SysFreeString
ShellExecuteA
SHGetFolderPathA
URLDownloadToFileA
CharNextA
DVCLAL
PACKAGEINFO
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Ranapama.m!c
tehtris Generic.Malware
ClamAV Win.Trojan.CeatRG-9877126-1
CMC Clean
CAT-QuickHeal Trojan.Ceatrg.20828
Skyhigh BehavesLike.Win32.ExploitMydoom.lc
ALYac Trojan.Ranapama.JH
Cylance Unsafe
Zillya Backdoor.Agent.Win32.41019
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 003edea01 )
Alibaba Backdoor:Win32/Ceatrg.8664404c
K7GW Trojan ( 003edea01 )
Cybereason malicious.ed727f
Baidu Win32.Trojan.Delf.af
VirIT Backdoor.Win32.Agent.AQZV
Symantec Downloader
Elastic malicious (moderate confidence)
ESET-NOD32 Win32/Delf.OGV
APEX Malicious
Avast Win32:Delf-AGT [Trj]
Cynet Malicious (score: 100)
Kaspersky Backdoor.Win32.Agent.cjxg
BitDefender Trojan.Ranapama.JH
NANO-Antivirus Trojan.Win32.Dwn.sryri
ViRobot Trojan.Win32.A.Agent.21504.AS
MicroWorld-eScan Trojan.Ranapama.JH
Tencent Backdoor.Win32.Agent.dae
Sophos Mal/DelpDldr-A
F-Secure Trojan.TR/Dldr.Delphi.Gen
DrWeb DDoS.MP.5
VIPRE Trojan.Ranapama.JH
TrendMicro BKDR_INJECT.SMW
McAfeeD Real Protect-LS!D0E834AED727
Trapmine malicious.high.ml.score
FireEye Generic.mg.d0e834aed727fe49
Emsisoft Trojan.Ranapama.JH (B)
Paloalto generic.ml
GData Trojan.Ranapama.JH
Jiangmin Trojan/Generic.adgxy
Webroot W32.Rogue.Gen
Varist W32/Downloader.K.gen!Eldorado
Avira TR/Dldr.Delphi.Gen
MAX malware (ai score=100)
Antiy-AVL Trojan[Backdoor]/Win32.Agent
Kingsoft malware.kb.b.1000
Gridinsoft Trojan.Win32.Agent.vb
Xcitium TrojWare.Win32.TrojanDownloader.Delf.gen@1xqow5
Arcabit Trojan.Ranapama.JH
SUPERAntiSpyware Trojan.Agent/Gen-Injector
ZoneAlarm Backdoor.Win32.Agent.cjxg
Microsoft Trojan:Win32/Ceatrg
Google Detected
AhnLab-V3 Trojan/Win32.Scar.R44539
Acronis Clean
McAfee GenericRXAA-AA!D0E834AED727
TACHYON Trojan/W32.DP-Injector.36864.B
VBA32 Trojan.Toga
Malwarebytes Generic.Trojan.Delf.DDS
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall BKDR_INJECT.SMW
Rising Backdoor.IPKiller!1.CA60 (CLOUD)
Yandex Trojan.GenAsa!WFirKA1EW3U
Ikarus Trojan-PWS.Win32.QQPass
MaxSecure Trojan.Malware.4169313.susgen
Fortinet W32/Injector.fam!tr
BitDefenderTheta AI:Packer.CEA8E99D18
AVG Win32:Delf-AGT [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Trojan[downloader]:Win/Ceatrg
No IRMA results available.