Static | ZeroBOX

PE Compile Time

2015-06-16 01:07:58

PE Imphash

7045005ef4130348fa4cbfc30a6f9d04

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00010000 0x00000000 0.0
UPX1 0x00011000 0x00009000 0x00008c00 7.95462228737
.rsrc 0x0001a000 0x00001000 0x00000800 4.25044176529

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x00016690 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL UTF-8 Unicode text, with no line terminators
RT_RCDATA 0x00016690 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL UTF-8 Unicode text, with no line terminators
RT_RCDATA 0x00016690 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL UTF-8 Unicode text, with no line terminators
RT_RCDATA 0x00016690 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL UTF-8 Unicode text, with no line terminators
RT_RCDATA 0x00016690 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL UTF-8 Unicode text, with no line terminators
RT_RCDATA 0x00016690 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL UTF-8 Unicode text, with no line terminators
RT_MANIFEST 0x0001a1ac 0x0000029c LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, ASCII text, with very long lines, with no line terminators

Imports

Library KERNEL32.DLL:
0x14001a510 LoadLibraryA
0x14001a518 GetProcAddress
0x14001a520 VirtualProtect
0x14001a528 VirtualAlloc
0x14001a530 VirtualFree
0x14001a538 ExitProcess
Library COMCTL32.DLL:
0x14001a548 InitCommonControlsEx
Library GDI32.DLL:
0x14001a558 BitBlt
Library msvcrt.dll:
0x14001a568 fabs
Library OLE32.DLL:
0x14001a578 CoInitialize
Library SHELL32.DLL:
0x14001a588 ShellExecuteExA
Library SHLWAPI.DLL:
0x14001a598 PathGetArgsA
Library USER32.DLL:
0x14001a5a8 GetDC
Library WINMM.DLL:
0x14001a5b8 timeBeginPeriod

!This program cannot be run in DOS mode.
qF\PV8
bno(liG
)%1X;h
;4B=5:A
M4"P@y5Xf;
T=>xp>^D
wMVc.z
afrFb/
Q6lMn]/
[`wGg%
ufzo*L
zZn':e1
+2U'c]F
"dvwa5
"3]U}4
9d:O1B
-+3Wuc
Dz|bk
KR/:E3
~>iK7}8
*DeGg\
'8#(&7
9C~BAd=f
]59Ct5
G-w?yF
zqWEA|
=9B`WE%
,'J/ Y
qi#H<h(
@l4mx=x
gKV>KH
rP*U01
(SGHH0(
wzyWlw
:5z_i5
q,<5_ot
IG(&E-&
05-M:k
Dvi(KT
sT5x)4
{xTtxT]
$@qj|}
F,JPlPo
fS3/*u
g_9;z54
aW sU@1
2h")nE
n2Cr99
<\17La
0]YIQ\Q
Wow9bz
[]A\A]A^A_
(]_^[H
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly> </dependency> <v3:trustInfo xmlns:v3="urn:schemas-microsoft-com:asm.v3"> <v3:security> <v3:requestedPrivileges> <!-- level can be "asInvoker", "highestAvailable", or "requireAdministrator" --> <v3:requestedExecutionLevel level="highestAvailable" /> </v3:requestedPrivileges> </v3:security> </v3:trustInfo> </assembly>
KERNEL32.DLL
COMCTL32.DLL
GDI32.DLL
msvcrt.dll
OLE32.DLL
SHELL32.DLL
SHLWAPI.DLL
USER32.DLL
WINMM.DLL
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
InitCommonControlsEx
BitBlt
CoInitialize
ShellExecuteExA
PathGetArgsA
timeBeginPeriod
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Convagent.4!c
tehtris Generic.Malware
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.Generic.nc
ALYac Clean
Cylance Unsafe
Zillya Trojan.Convagent.Win32.12513
Sangfor Trojan.Win32.Agent.Vpl1
K7AntiVirus Clean
Alibaba Trojan:Win64/Genric.bb431c3d
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 Clean
APEX Malicious
Avast Win64:Malware-gen
Cynet Malicious (score: 100)
Kaspersky Clean
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Tencent Clean
Sophos Clean
F-Secure Clean
DrWeb BAT.Siggen.70
VIPRE Clean
TrendMicro TROJ_FRS.VSNTJQ23
McAfeeD Real Protect-LS!B61F420FBF37
Trapmine Clean
FireEye Generic.mg.b61f420fbf37cc18
Emsisoft Trojan.Agent (A)
Paloalto Clean
GData Clean
Jiangmin Trojan.Scar.ej
Webroot Clean
Varist W64/ABRisk.TJAQ-1141
Avira Clean
MAX Clean
Antiy-AVL Trojan/Win32.Agent
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Casdet!rfn
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!B61F420FBF37
TACHYON Trojan/W32.SchoolGirl.76288
VBA32 Clean
Malwarebytes Malware.AI.2189428007
Panda PUP/Hacktool
Zoner Clean
TrendMicro-HouseCall TROJ_FRS.VSNTJQ23
Rising Trojan.Convagent!8.12323 (CLOUD)
Yandex Clean
Ikarus BAT.Siggen
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
BitDefenderTheta Clean
AVG Win64:Malware-gen
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_70% (W)
alibabacloud Suspicious
No IRMA results available.