Static | ZeroBOX

PE Compile Time

2024-08-03 07:42:07

PE Imphash

f73673078cd62393b9d4c3d33642daf0

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x001dd748 0x001dd800 6.66611776164
.data 0x001df000 0x0000d1c0 0x0000d200 7.91646593712
.rdata 0x001ed000 0x00009998 0x00009a00 5.46766514746
.pdata 0x001f7000 0x00005ca0 0x00005e00 6.07893190907
.xdata 0x001fd000 0x00004724 0x00004800 3.54287659398
.bss 0x00202000 0x00065e90 0x00000000 0.0
.idata 0x00268000 0x00000648 0x00000800 3.66282505076
.CRT 0x00269000 0x00000058 0x00000200 0.262518091457
.tls 0x0026a000 0x00000010 0x00000200 0.0
.rsrc 0x0026b000 0x00000138 0x00000200 1.6285554479
.reloc 0x0026c000 0x0000038c 0x00000400 4.86005471552

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0026b058 0x000000dc LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library ADVAPI32.dll:
0x1402681a8 RegOpenKeyA
0x1402681b0 RegOpenKeyExW
0x1402681b8 RegOpenKeyW
0x1402681c0 RegQueryInfoKeyW
0x1402681c8 RegQueryMultipleValuesW
0x1402681d0 RegQueryValueA
0x1402681d8 RegQueryValueExW
Library KERNEL32.dll:
0x1402681e8 DeleteCriticalSection
0x1402681f0 EnterCriticalSection
0x1402681f8 GetLastError
0x140268200 GetProcAddress
0x140268208 GetStartupInfoA
0x140268218 LeaveCriticalSection
0x140268220 LoadLibraryA
0x140268230 Sleep
0x140268238 TlsAlloc
0x140268240 TlsGetValue
0x140268248 TlsSetValue
0x140268250 VirtualAlloc
0x140268258 VirtualFree
0x140268260 VirtualProtect
0x140268268 VirtualQuery
Library msvcrt.dll:
0x140268278 __C_specific_handler
0x140268280 __initenv
0x140268288 __set_app_type
0x140268290 __setusermatherr
0x140268298 _acmdln
0x1402682a0 _commode
0x1402682a8 _fmode
0x1402682b0 _initterm
0x1402682b8 _ismbblead
0x1402682c0 _onexit
0x1402682c8 abort
0x1402682d0 calloc
0x1402682d8 free
0x1402682e0 memcpy
0x1402682e8 memset
0x1402682f0 strncmp

!This program cannot be run in DOS mode.
`.data
.rdata
@.pdata
@.xdata
.idata
@.reloc
D$4=v"
.vH?E1
v9 %YQ
%JL*~A
s69|A1
D$D=T.{
5oAS"H
fffff.
^wO^mM1
e8[_^]
I?L5B\g
nIz(D!
nIz(D!
T2PC I
T2PC L1
L$8H9H
L$s=G'
D$@H;H
ffffff.
fffff.
-lT6M1
L$'=Zw
L$O=hGsg
%`)1I1
6A_LDI
6A_LDM1
JHH;J@H
mn;\D1
L$0H9H8
L$'=rs
ffffff.
ffffff.
%^SW5A
^SW5E!
jKjUBH
jKjUBH1
M0AuLI
5:Z^w!
75*< w=
i3#@M1
pxL^A!
ffffff.
9&5@M1
ffffff.
L$'=(ep
fffff.
L$'=vf
5%\ .=a
6@`LM1
{98rH1
ffffff.
L$?=<pG\
GUA-Dp
D$$=@y
D$ =(T
fffff.
YB@1D1
L$G=QX
D$L=-+
.p$HI!
.p$HL!
D$(=Ek
~3i]A!
xO]MaL1
T$p-Nf2!
J5+$`})
Y?wHH1
fffff.
-Kb")-
L$8H;B
+m^56W
ffffff.
o{]y1'
I]fyaH
I]fyaH1
ffffff.
L$G=?!
y@jd1!
L$HH;B
ffffff.
%I(Q\=
L$7=L**
L$@=k*
9m>aA!
Py5<58
5%Sm#-
L$H=6U
ffffff.
I%2jD)
L$f=V_
5El`<)
mOK5[I)
sy-2M1
5~J_oA!
%`"u4i
'^f7D1
ffffff.
D$\=o:0
o"Isw%
L$?=)]g
ffffff.
ffffff.
5&@'P!
?DcOD1
JL:FM;
L$5=.XJ^
*4@|E!
L$W=w20F
IX(6OxI1
ZY!~M1
RoPTH1
-lru-
fffff.
0N];jI
f"r8L1
L$W=@Pk
D$4=odv;
fffff.
%'xH<A
'xH<E!
L$;=92
ffffff.
fffff.
),W-##
fffff.
AXH;Ah
fffff.
?$JiE1
D$PH9QXH
fffff.
fffff.
T$TfD!
2#V6L1
AWAVVWUSH
5_=;91N
jrE^D1
[]_^A^A_
D$$=mU
L$/=,1
L$?=US
)c\:D1
L$7=Fy
%9axA!
fffff.
%<s$H
]Tq!FiL1
ffffff.
3,qEL1
fffff.
R'X\D1
L$(=)x
Erv1s.
Drv1s.
bQvZI1
L$(=~B
#:FUA1
5@7.RE
fffff.
J@4V=s
L$HH;B
L$HH;B
L$/=(<
tjmrH1
mgs-D1
ZbuhL9
N+fh>f\H
N+fh>f\H1
L$HH;B
L$?=2_
fffff.
L$HH;B
@<-GL1
%]L{D1
8`jPQ33+I
?Sz(RI
?Sz(RM1
5 MDt3
~,WgE1
5M7MF1
ffffff.
L^-?E\
D^-?E\
D5N2H1
ffffff.
L$HH;B
ffffff.
L$(=LY
"z%48
7F5yiM1
%*E~%=g
$qB!D!
9G~JL1
$Ah;V
[<`gM-I
[<`gM-L1
MO=:XmV
ffffff.
_gTqH1
ffffff.
.vH?E1
O qMH1
ffffff.
L$HH;B
ZVCJA1
L$?=0;
V=f5V=f
5XBf*=
D$H-*{
D$H-+06
ffffff.
Z8VCDV
Z8VCDV
v9 %YQ
-5_~55
V*m_D!
L$T=kj9"
kBOkL1
fffff.
D$$="S'4
zf :A1
8`jPQ33+I
L$/=\`
ffffff.
fffff.
D$$=$84
=D%FM1
L$7=ek
fffff.
L*lqE1
L$O=@]
L$7=47W#
ffffff.
D$,={wky
[<Dq5[<DqD)
L$@=oEa
zmU&A!
zmU&A!
fffff.
ZFz.D1
~(a9=L1
',,x'\H
',,x'\I1
L$7=%J
:]cqE1
cEn\fH
cEn\&H1
=zjwc
=k+L8
D$,=Z/#
9!-k]T
fffff.
FO5O^D
fffff.
MO=NUo
>0=$`C
ffffff.
GFcf=
sGgt?CH1
5v@T@A
i=O-DF
fffff.
a3[0%I
^wO^mL1
NaZ/{I
NaZ/{L1
D$,=US
{*VUD1
55_~5A
fffff.
ffffff.
a3[0%H
a3[0%I1
fffff.
ffffff.
D#5;GM
~\/F5P
D$ -JU
fffff.
02mlH1
PI_!L1
L$HH;B
o4z{H1
L$G="N
7X'sJM1
ffffff.
P%jhH1
T.f5),f
ffffff.
ffffff.
ffffff.
L$ =8%
mp?=H1
cEn\fH
cEn\fI1
51._&D
5XBf*i
L$(=~B
ffffff.
P:d"r&
Pf5CRf
fffff.
D$8Lc@
7X'sJM1
uLTwWm%
UAWAVAUATVWSH
M7=;91N
X0G <fL1
WXBel6I
d0Y28L1
QGwSM1
[_^A\A]A^A_]
~(`"!L1
fffff.
D$$=~B
}]"9I1
M7=y[+
D-e\D!
5xm)>=p
5HZF.H
5g`bU=[
[/hcH1
fffff.
D$ &s#p
gk4~%I
=LD&Vw
5:7~A
KE@H$I1
xnr5~xnr
5Q_I73
D$ "~;
WcI!H1
h~&|H)
B<PL1
sN0<jH
sN0<*H1
v{"L1
L$7=>}
D$4=[Wed
L$(=?x?
D$,=%c
bIQUL1
ffffff.
ffffff.
1/+N5m<
eh[_^]
fffff.
fffff.
E+qoH1
5ha;#=
D$$=hQu*
ffffff.
XBf*D)
ffffff.
L$?=0;
v9 %YQ
G}\.SH
G}\.SH1
O qMH1
rHzXM1
L$s=>}
D$X="@
=&QDA1
GFcf57fkC
Li25?L1
Li25?H
D$ %U\?
LcA/M1
#.J{D!
fffff.
(&tHD1
EqGkD1
bbuUM1
mFH$L1
mf5Nmf
1xpcD!
4uIA.H
4uIAnH1
Z8VCDV
fffff.
UAWAVAUATVWSH
D$ %U\?
!QvVH
!QvVH1
57fkCA
K@M/D1
WXBel6H
WXBel6H1
[_^A\A]A^A_]
D$T=Y_
\#L5ow
%G)59)
4I@2H1
5g`bUA
>lP\eH
>lP\eH1
%g{i^5
Z5M|b!
5<s$!
tSbPH)
-AoLo|L
-%A#XA
j\a;H1
r&D`6;
{w"`D1
^I^(7L1
%#a6kH
8.;tE1
$Ah5/
1I#uE!
N$G|II
xKRkD1
D.,UH1
D$,=X=
fffff.
fffff.
2+f5)f
fffff.
ffffff.
52]D!
52]E!
ffffff.
cEn\fH
fffff.
G}\.SH
G}\.SH1
v9 %YQ
qJY>E1
UAVVWSH
Z8VCDV
Z8VCDV
>PfDqI
>PfDqL1
J%WcL)
[_^A^]
ffffff.
o4z{H1
D$T=Rk
AWAVVWUSH
[]_^A^A_
L$-=Ph
ffffff.
5ecNX=B
fffff.
8ZlpE!
L$@H9Q
T$(H;J
5A@xDA!
D$$=[u
L%COD1
%,x'\A
,x'\D!
UAWAVAUATVWSH
M2E_AN
M2E_AN
n4.-5l4.-A
D$ p}
[_^A\A]A^A_]
2#V6M1
ffffff.
fffff.
*B._5s
L$G=[Fl
o`4RH1
gqa65D8
-vsDkxN
-vsDkxNWL1
5!i>!1
!mx8I1
5(*@D1
fffff.
#f5B#f
Lc-BH1
D$$=US
5ratQA!
@9^XA1
5$AhD
nH-QH1
Q$!'bI
L$HH;B
L$HH;B
"xu)Ky#H1
5cYV(A1
UAWAVATVWSH
rdyHD1
[_^A\A^A_]
ffffff.
sjM&D1
L$/=5H
/8[%Z#
UAWAVAUATVWS
"%rnD1
X xHH1
Cz|5ukfF1
x15Au#WH
DFy;H1
EO+OwI1
EO+OwI
[_^A\A]A^A_]
fffff.
5uY@=A
fffff.
ffffff.
UAWAVAUATVWSH
2&9-72
.I:A1
,3)VCeI
P~ocA!
-'SzX=&
%o\Wt=
[_^A\A]A^A_]
UAWAVATVWSH
*~&FE1
;"z4L1
%qKnh=
M}=fe+E
=|F0~
[_^A\A^A_]
L$HH;B
fmc&H1
I`:D1
B.`bD1
oJQsM1
ffffff.
L$G=zS
L$?=8%
L$W=b4
d=YAxW
j!H[D1
Kk=k5~
L$_=^Xq
t>;HH1
ffffff.
sf5'wf
.+-o>{
*!D\D1
5VB4.E
UAWAVAUATVWS
z5Q%7:
uf57pf
gJf5iNf
;Bf5mCf
5y\^vD
=Lg9?
nOF6L1
ysf5W{f
cf5tcf
58`jPD
n:%>5^
[_^A\A]A^A_]
%<nG<A
fffff.
fffff.
gqa65[
L$?=8%
KE&^A1
Jg-+P/
4f5q>f
L$@=t#
fffff.
uc_HL1
>%f5-/f
fffff.
UAWAVAUATVWS
af55cf
m9.wdM7GH
m9.wdM7GH1
:tb3M1
PSFU53
5VgJgH
5Q_I7+
*< wM1
[_^A\A]A^A_]
fffff.
5tz c)
fffff.
ffffff.
L$?=8%
.vH?E1
UAWAVAUATVWS
mlk^A!
pn" -j
sKP|L1
YaH*H1
;^yxj7H
;^yxj7H1
*e&L1
t>;HH1
%\rZ-A
\rZ-D!
5p%\=D
ovPD!
=JHsN
[_^A\A]A^A_]
ffffff.
&d`f u
5R'X\D
@=u$1G
4eYB:L1
g)w-M1
1J[`D1
ffffff.
fffff.
L$G=mU
L$@H;B
R]Brz3
R]Brz3
%JL*~=
(f5_)f
.vH?E1
5l#Dj1
<nG<Ei
{*VUD1
if58af
D$$=jdo
wa\sD1
D-e\H1
L$?=8%
ffffff.
Yw"|H1
5yK`VD
Rkf50if
-vsDkxN
-vsDkxN
,|quH1
y,ADD1
5xm)>A
5HZF.1
oJ5sjN
L$@H9H
5"$mJA1
dWb]D!
d>i56r
ffffff.
.vH?E1
jSf5iRf
k\f:D1
5FH`f!
{*VUD1
Br+=E!
fffff.
L$0=Qf
v9 %YQ
.vH?E1
=&QDA1
DG-U=}
5e.\G1
j!H[D1
ffffff.
>X4_D1
5He@F%#.
caFHD1
VB4.D1
5#vZ0H
5#vZ0H1
[f5N]f
u$e&M~NH1
V=p;5V=p;
L$8H;B
ffffff.
UAWAVAUATVWSH
04o&E1
>>KdH
>>KdH1
[_^A\A]A^A_]
52]D!
52]D!
'93dL1
.v<D1
%\rZ-A
5dWb]=
VAf5zJf
ffffff.
Lpf5?vf
?Sz(RH
?Sz(RH1
5 /IOA
%>D%48
ffffff.
!\LtD)
l/78I;
5^>lQ1
GIv9/lN
ffffff.
C{,XH1
Ujl,L1
(c85(9
M/=~wx
=CCG u
g&y3'
Ez`w*VOm<
kV -=b
~hj|\f9
&W`\U8
pK02ml
]HKdG~%:BT
G7_65$
1 ,p#"w
'ACe\>
DK+pKH9k
S:C5Ak
5}+eRr
"*$"?bnP
tWAd\'L
gshN|l
j|\f2\KXm
<H7MVZ
b4[0%9
Tht}f9
2[hez;g
6")1X%]YR<
ROvT0c
<oo~yT
<vTy[7
AyS[/D
0$4f>9"
UlgPwe{
Q<u>ux
9X96OO
WDfjp
yxj7hpY
Fxo2v(
cZK%Wc$
^C. oJ
aGFcf4
Fxo+|M
|A=z+iZx
!n`gT1
jeppi3"qfp
%<nG<'e
;).vH?
4~qd~(UbK
{'lxG%
thx]HL
}04GiZ
<nG<BV
|[HGiZ
v@T@ID1
)4YG_P
g&y3'
fq`>z|
75_~5{y
L:5{VN
~hj|\f9
\z(z:p{u
8j/[>&
h58M&
?0dWb]
eZ2D:`
(Oe9R\
0}\.S2N
!n`gT1J@4V
;Mmr^y
D~A=z+"
rpn" B
y)P>0C
MblMWi
Z\7o|L
w\#$H5I
L:5K%Wc
grn^dN
^c,x'\;hR
zQ\s{m
xg)8}a6YN
KspV=VC
PzTP_f
(Oe9R\
DG-U5Uo8
1 En\f
~hj|\f
pkB!4)
,o;/aC
RW;JP%jh
La,'mL
,x'\;hR
2FaWj*
~hj|\f9
1X%]YR<
SK}\.S2N
InitializeCriticalSection
InitializeConditionVariable
EnterCriticalSection
LeaveCriticalSection
WakeConditionVariable
SleepConditionVariableCS
@kernel32
@kernel32
CreateThread
@kernel32
@kernel32
VirtualAlloc
@kernel32
@kernel32
ExitProcess
@kernel32
@0123456789ABCDEF
sJ~i_
t-,*P
4!s]r
7$::8)
.7:266
.7:266
rK>?J
^-'J=<
JI&DLb
7$::8)
RtlCaptureContext
@ntdll
@ntdll
GetProcAddress
LoadLibraryA
CloseHandle
GetProcessHeap
SetErrorMode
GetDriveTypeW
VirtualFree
VirtualAlloc
@kernel32
@kernel32
GetSystemInfo
@kernel32
@kernel32
GetModuleFileNameW
CreateFileW
@kernel32
@kernel32
GetModuleHandleA
HeapCreate
HeapAlloc
VirtualQuery
CreateEventW
CreateTimerQueue
CreateTimerQueueTimer
WaitForSingleObject
VirtualProtect
SetEvent
DeleteTimerQueue
HeapDestroy
@ntdll
@NtContinue
@advapi32
@SystemFunction032
@kernel32
@CopyMemory
@kernel32
RegOpenKeyA
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryMultipleValuesW
RegQueryValueA
RegQueryValueExW
DeleteCriticalSection
EnterCriticalSection
GetLastError
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
__C_specific_handler
__initenv
__set_app_type
__setusermatherr
_acmdln
_commode
_fmode
_initterm
_ismbblead
_onexit
calloc
memcpy
memset
strncmp
ADVAPI32.dll
KERNEL32.dll
msvcrt.dll
#+3;CScs
VS_VERSION_INFO
StringFileInfo
040904E4
VarFileInfo
Translation
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Clean
tehtris Clean
Cynet Clean
CMC Clean
CAT-QuickHeal Clean
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win64.Agent.V1u9
K7AntiVirus Clean
BitDefender Clean
K7GW Clean
Cybereason Clean
Baidu Clean
Symantec Clean
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Kryptik.EMS
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky Trojan.Win64.SleepObf.eb
Alibaba Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Tencent Clean
TACHYON Clean
Sophos Clean
F-Secure Trojan.TR/Kryptik.hemnz
DrWeb Clean
VIPRE Clean
TrendMicro Trojan.Win64.SMOKELOADER.YXEHDZ
McAfeeD ti!F1530D12529D
Trapmine malicious.high.ml.score
FireEye Generic.mg.85b1854b81d15ac9
Emsisoft Clean
SentinelOne Clean
Jiangmin Clean
Webroot Clean
Varist Clean
Avira TR/Kryptik.hemnz
Antiy-AVL Clean
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Trojan.Win64.SleepObf.eb
Google Clean
AhnLab-V3 Clean
Acronis Clean
BitDefenderTheta Clean
MAX Clean
VBA32 Clean
Malwarebytes Generic.Malware/Suspicious
Panda Clean
Zoner Clean
TrendMicro-HouseCall Trojan.Win64.SMOKELOADER.YXEHDZ
Rising Trojan.Kryptik@AI.86 (RDML:FvvkDlCfmSj2WKWCy6wOUA)
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Trojan:Win/Kryptik.EZK
No IRMA results available.