Static | ZeroBOX

PE Compile Time

2024-08-02 22:28:39

PE Imphash

ff764c3d5517b7ba18154cf01d80c42b

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00078000 0x00000000 0.0
UPX1 0x00079000 0x0007d000 0x0007d000 7.99926691114
UPX2 0x000f6000 0x00001000 0x00000400 2.70357018435
.rsrc 0x000f7000 0x00000298 0x00000400 4.20531836209

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000f7058 0x00000240 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data

Imports

Library KERNEL32.DLL:
0x4f60c8 LoadLibraryA
0x4f60cc GetProcAddress
0x4f60d0 VirtualProtect
0x4f60d4 VirtualAlloc
0x4f60d8 VirtualFree
0x4f60dc ExitProcess
Library ADVAPI32.dll:
0x4f60e4 RegCloseKey
Library COMCTL32.dll:
0x4f60ec None
Library GDI32.dll:
0x4f60f4 SaveDC
Library SHELL32.dll:
0x4f60fc DragFinish
Library SHLWAPI.dll:
0x4f6104 PathFileExistsA
Library USER32.dll:
0x4f610c GetDC
Library WININET.dll:
0x4f6114 InternetOpenA
Library WINSPOOL.DRV:
0x4f611c ClosePrinter

!This program cannot be run in DOS mode.
{Richdo
e*ej9A
$e9e0w
%}$xKKq*Bs
<A\y/2\k
zA.MxS
#SDE5J
Ti,XAp
B3Z:(C
(/1Y+A
t0c,<"
lQq$Bl
&p2egx
:blZJ"z]
QOJN8F:
u29;N*
vc&Sy6
L"A<#N
ic<+i5
h<%EhU
>D5rv)z_*t
*7q7^0IW
!zHD*@{W
PqPyc6E
11Kr-$
'e@z"&
]=S #o
"xA8kj
ok!pV
h~__[lo`W
DuYOd.f7
d^6QVA#
xpy98p
!vhaI)=
)iV4n@
kLU#G
n%Vg1bw
y{pZA\
Id/]+W
dU//lo
}Mmmox
?4=.03
1l=^1X
ci[@x6rV
pLQqZc
jKq!+@W
[1w)0Q
pk8tw-
24T^2.Xb
E$kmN8;
sd"IORn
4Xq$=3
Rb`WM.
}mqt
xVC yV
7*!i_zS
H\W5_$
&Z@Rq3
*9{.M~
~,[T3t
7WQ/?%\
Uoa)!9
{{.D@}&
<7:6e(
9H'wB,B
oixy@!
lDy:^c
7]\##`Z{
bZ|F]3
&-@W]S
/$3mya
[>XVXO
f4(kc|
A\03fhX
RS)/is
]Dnw1U
5Q~f_
WJ!`K-
06t?e
Sav,n`4
(e2dT
h\v2+
*I3=`g
XEBN73
<!z>oH
e:4l7@
sO^}[9
j\!*T,-'
-A6f{*,
>YU!FJ
*eDF5
yUxvV(
TX0GNFq
gepmFu=
c&PiPe+
>wkcp[T
0>3&YX1
',{>VD`SlX4
Uh^-=A
5syLqna
p?k=_U
/AQO:B
s%Pg'[-Wb
A9.-CA
FARud>
[r}cR?^{
~]NX2+
/v#v[U
.D/:81
F+fpnI
BEVaYd
kryIS>J
6&%t;e.P
#4~kN
J~JNu7
7<Kb)J
AQ y<%
A9cfP
(v'q$7l^
my7MBp
cqQx>,
YSF0F*
Su"_c3
p+aT%7
oDZow_
;u$ g<:p
U.36\k
WhUg*w
)-9:F=
g(9%l,:
/\\!R|f
O[8Xc'
%i"M2t
:'z<m/
'dBDZ7K_
%mk0+Z`
evqI9o
Y,21k]
S(,} T/V
2aC'P
t=ZE3Y
$w-#Hgn
5rKwq
_) YIZ
t[;%.+
9w\Wvk
~2.s[9
\NCgfyz
3ZB=!*B
DW's#0
"Z{Q[K
gdhTmAV
+tI"6F
y42ab"
c0vf::
BK$d_c
S>l$v=
w~TJp !
g(l bf
G1kRuA
m(?CtP
\oP#Rc
zt@#4d
-E^|vH
vx`H6
H==;U\
N%!mrE
1MNkX)
g]f8nD]
N>$P6E:
o4pgsm
7z,=!J-
<Sjv8e
N9qPdDa
rCy""t
7+1yf@
IQN;Nv
h.fH5@
X16w~u%aY
wM})w"Q
SP|35t
i~,zSR
g)xHX0P
0M\O1\T,
|=QJ-V
;upvd9
G8=+13
aUi'=*
oF/Ea#
OU=Z?h
$`/h[~
Z?:nu'
q8=,K;
s\ciC:
|ES>1J
F@w"1t
prlsKi
;-89.TB
bJ3(aQ
(WWDn}
*K@# W
YT[F4'
"kp8,H
k;I6{ |
1ZPY][9
:[`)==d\
*.:uj|p
/W]Nx,
=,O6Rvj
!6`hTNF
|ra'q'@D
k`DAqD
.{cq`F
.Y&2;*
X(s_b<
7&fJO9<
G.,8r
4t%7R`8
}<[="nk
%evA#9
#W#hQ"
'p5x1on
EO}W;dx
wF|N k
AP0NV`0
1MjCI\
p:WRdY
pl]ZPy
fx<6 Iw
B3)`?5
S@aSt?
9Da15C
$x/ /%
_Z JZ}
L"57G4
Y84xdU
_1Gr%eG
!%+>pU
H1\<(`$T
K-lSyk
][.*ZD
*e|\%h
gXS)k["=3
f=\SX?
6_oSi!Zd
+>%@Lb&
U~dKq|c
gCkZ&-
.DKgUd
[TBT)t
bk~\{g
V3c{WW
Y}S=)x
J4A{V~
"pE|sd
x\d_y.6q
'p?[+K
G{UwFz
J<,cB3
sdXOZO
O%^cFS
uRO{RY
6s3W%boRq
'?5V-s
FDUaus
ZK7CCV
*Lv;?_
?k&4P?N>
J,Sm!}
Wus"IPz
?I}-$>_ao
EA&dcI$
E"u\\
k<+`TI/
Y"^rV\c
^.SB@V-
QK)r@)S
hmd$?P
b1LjS.
e9X?~~
]WWLK3
V4pNxk
F#lO5q
6?_b$XT
%!)!)$
@BI|:q1
LU*9q+0eg
51^MDU
vP9Ll
RP,z_N
S.=-9Z
OgQN9f
. tjlG
tX=&]|
g0jG+E
=9BVwXi
trkgg|D
W6!Kwi^w
IU9@V>
7D?[,PSA
aw|AwJ
.&#O'Z=.
[Tc6=0
L@F<A~
$Q7)TZ>
8nwSa_
z~jY]G~
K~V6k8U^
M 2,`t
*?Cf3Ckp
**fFc?T
XTK$5h
(pI#Mi\
}07vGo{:
s7Esa|M
1~<G+
Ppppe"
C05tCzo
{AS}O1
opcTq-
Bx*\JK~
>@$Er0
+'o`s)
+"0fDg
zh.O={
#UF>Y\
E,i=j|
GG6I"_I
+6U6W
L=m11<tf
Q}SS_=
Xpp,5+t
Om+S*U
uXN%o!
iX0'Er*
!}}cXM$Z
xlUDQ\
f7acVj
vi;VShg&J
u!Wza4
&,c.l5
/A:!r,
P1%sam
FeW7vWq
m*28y=
,Dg0@y
P^&dM#
8tH&xyy
$!Mc%~8e
{v)7n,
?0d<sh
nH0v-|
pm2dSAP^
CU)wew
ks>+M
bo#QuuA:
Ry7i!)
T>gl$@
+3h`$'
\~o/p~
y?2@fM
}@BA!@A7
G\Yvo=|
On`<+-
cfKi!t
*9.3f_P
mW?:**
s-"C=G
s.HeuN
*@4D F
7\VC$O/
V2V$.*
&*u33?
sRuX{W
az^-p#
7=%E+qI
y/ ]^:
71h>P!
X/@%;>
kma9z\c8rj
2AW2$S
)lFfMr54
%`k$,s!
[o-P7~^Q'{
h'avo#@
49j`WA
9M17@h
T{$~W(
y#Tn6
.Zr@o(v]
\YqD7
Ng8GEu$5
)/Elm*
2AuX1m
Zaa6N4v
okj}NX
uhx%h'
RMA-t1
%zuTg_
ZkGE3<
:[`&RI
?0.10JN
?$=$P7I}
f]BRIM
3W"E]e
ak8q|b
k&^Hcj
C~+`(;
L)0DIH
sN!E>3
:(U7gCT
[#;$F}fd
e@'L/7
1MVn"K
B);4Ju
}i#JT:
b<4P>w
<Z,4~H
%W|._%
oP-`r+
2eH8D>
4's2$|}Qr&
apX<>]%
O\|Q=Co
l/aXqVz
%mcyFV^
QJg+7o
=S5ru
.rz`O(
#ZAP@l
Pw NEA
s9&/f7
1&9uBb
7[\h^R
Wr@ck
[}[\|p
3qYs)^
J'E{Fq
Cn^O"^
QR4;X8
o&y@Tw
{n(CAu
gc-loy)\
plpW6['O
W.,0ob
MFJb&%
fLDr[i
Q2A3H9
pXR,& n(
6t!H$>
qY:a=.(%
rFiKYg>
I[q,_Tg
ip6e.DP1
[7+_$]}
I#^'S
78<1]?
'1vAm>`0
z7#zPX
Idh2Td
n`v^)-
#/1E$r
{In0W9Fo
A_:R@KK
E_(5]&
=::Yek
C%{09#bpg
y_;,d8]
r2%{PdmB6
.>q)X&
)2Z8.|
%Wr#y^
s6::^
J%d6QE
U~8'f+
Aq"i`X
t#;%Ru
V8G-C2X
bn,R|J-
bM!tO0
<tpRazt
}j^CY8f%p
Yj>9F{7
!}D2@L
d+i-52V
/+N<)'8
F6!}i[r{
EZ:@]M
A DQBw 8
.7OQ\}
-K-/EJ2
e`O#1B
t#BSr#
"6qAM|
%|LYn{j<
"$i;!n
$ttpy~vE,
3q m:p
$w}=4Ot
/B}oXJ
f`4!<X
$H3e^m
ld}2x%
6P 4+WZ
;S,<8\
?MTo>yU
O4CfgH_
oYK@[j
.U:3S&qj
\eY+cE
~>M5,|
j"4(M3>
1q'a9&3g?
wE]Dq5=
D(^h!2
ac_bib
-Ghh_f
W.jBo
(8USWr
dtM+)>
lhd,`-
}m[kcu
=z AfN
;[3Ib+s
U6Fjij
4Fzypx
d-X8DTM
&erf+(T
E]O>_A
>(KZp+
@1nd=i'
_l i|`
mx'7&&
Q,e7B3
(Vw*_'t}
n`T9~Qa
2a{< _
myS@3P
m,v?*!
0*=$JG&
v0B"yokoc
R-ICA\"~m}7
%b(sf"
`Abo=`
\P4~P,
JpZsBF
I]hyi~
xxrZLq
K#+'`Z)4
z1K2Ev
TJNg^0v
\2r2-JD'
;TE_d#
{-c[B1
CiRAMm@
f&Z:7y
4U|t2IL
.?gymY
xe9YX
,mc {2S
$$q`[F\
Oo30$x
%(O\*A
cF/QY@
F.\P[~
5:}HoF
zu U.K?
V 3&%P
/9U91F
1(_1&`
;4m[KV{
m U%Yf47
OlgHS[s
BiN@&Ra.
wM?)1XG
;nM#R+
[f#-Rm
\x`,JG
2xr<'vg[%Cr
fW9g,=
><%`7<H
9972v"
1;(D7C
^P;-{H~<
3xKYpi@//F(X
zj)%Ij
%cr#IDVN
G?uMaM
,]pfl
M@B4'c
c3_*9.C
]=t9\SW
!5I$_{
<}CXPz
7*0H]h
P?\|od
s%K2!,f
.8rWY>
S<K$R~
'?WG/Y
pZ)}<rht?*
+4"UId
O^wFK
{$-(^cj
WW5JpL
~C)e+J
#c:J[qg
cq}o@YUM
fv?a 1
JVoT>
3yZKP:(
S06)B~^
}v0O`X
^)Hrkn
Vl?[P2
0&#K(+
Ytob&'T
>NZkOx~R
8R]$/}
j{?V$S
<0A%a
"t'cA^
{|gAN7
;z1vlJ.
Uxd=0e*
Wq^7ru
9VXLC'
QV'Eq-C
P3D_4q3
JbRtt.
=1wJZM&i%
sb5B'K
fiS~v;~
6j=$~Fv
P6(MH`
?K-$7dO
8<uVe %
:-3r{dC
/!LyW0
M.fJH,x
~&2Oh>
%;U"J<
LAdj++3
8K7,((
03e`$u
+9ZT?;
R5bRc6
E|QP"f
}bs;iZ
[#bj^y
>>]l6e:
yR:6qm
k~)O#J
Tt: 2kQuB
7;; Ft
Nu:[F0r
zA12?;
C+n&4`=k
gD/!^W.
Lw2E-7]u
&=XImJ
rAbrhk
Y4^M93
zN1+%fCR@
-{<E;B
1|/*cg
Sg*-Ee
pPk*6]
'ki*hb
"7Q6:'c
L@F\QM
<|k.D^g
1}}a8ZJ_
\ a[v.
/'0?`4
a,~aUT
IP`t^.
'FB!Zi
R`QhEs
GFS`.h
diiYOz
8QzTE"W
!_JR(S
#!;r,qE
)UeE-z
bITvAg
ef7Bo@
JU3n6p
=`m`5hf
1,sZ6T}
ylO6JN!_
wzv/!Eh
-]%,>v?
g2#%S'I
`X3u+(
eJ%W2-
.KI"V(Cu
%TrjgR
='"6S$J
)LZK{Xi
0G>o;u:(
BxEMXJ
t,d50R
_v|"FR5
K"}1bh
q,d1au
9>"y+|
t$\z5|
XuIQSt8
hD;zgB
Z2,N</
`$P/K_
B5L"B*9#
"dqgaK
9)>Ri8~C
5^[ TO
-uP]raQ
E9M&gyY
p *(;=
D^.<P)W
C7.}_>
J=?}L#
A}:/6FB
u[A2R"
d{Q.CI(B
6ar3U,Q
S\4+sh
JD(/iFE
5Q6&_q
8-<}6%:
*txH E
O5D]u5
tng+|pPQ
=v.iCi
*R<@eE2
(|x4MS
O\.t=t
EK*R\YL
SJ?#?
@~K|rT?AU
/itAp#
vubE@E
\n+hF
g8=0Q7
8SIOY
L~ -$I
g:|Oogk
MXw_-r]
}UN#_8
W1\0uC
ahg-G<`
J]ZMV&
pUBLV_
2%2A<s
YQ3[9L
]_4;*|
J<uuIj
"zI~lS
K7>__i
a`s9>R
>dxl9s
Z$MAl*D*?
T3M(7u
2^"bQ/
H<s~F
:K[;(D
M=.H+pj
{r{dX9\
:8kKLX w
Weh^"3B
kM5HT3f
Hg^O[\*
J_CFg{
ALtaf(
f8%>.l
EAK2_`
S8>1^P
g&?TP9w2
ca+3:
po6s"$
Eb6k-d2
HLt+L(
$V)oh`
jgqkeA6ZVLo
>vb2@$
ghvF-?
Yh]p~z
Nz$IueE
)z4;M0
iU(O,_D
7IaaNP
~sYoRz
Z)W4P
XPq\Fx
"U44 |
6}J@=fzj
:Z>8]E|
^dVKa_
;|!Jy],
``"ZiW
YZ8)Hu
Q\RueV
z{/5tT
8;h)xy
$3Ro8G
>:M^:zO(
$qf#H}
+!n#?N
"Y5@xb3
)R{vsd
*>k9S^
UJ>Pl(Z
LmL.U$
)E''>?"
'h;cE1
$FjP$j
*RQ>]:
&l#rsA^&=M
.F!qe;
(J1D+9
/2q{xhZ
{C!VD6jfI
7'/jpZ.r$
W9}_CP
6N3S2
vgC5P{
RlWwVx
{tc{p5
[.dl4=
Zf)4*D\
Y7;MNy
M6U(9%
)X^}|J
!>=A>F
?a(dWX;E{
QC"SuG
vifx[@?
R|jd7I?
iP&C=f
',SabL
qpFu8+
E'fIz~{
(C5g5)
DK?.-k
HwI6~u
UTXI$?
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H)
s`)L$4
D$t+D$\
)D$H)
9l$\w_
XPTPSW
KERNEL32.DLL
ADVAPI32.dll
COMCTL32.dll
GDI32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WININET.dll
WINSPOOL.DRV
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegCloseKey
SaveDC
DragFinish
PathFileExistsA
InternetOpenA
ClosePrinter
HrCg@b
O(uckHr
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
VS_VERSION_INFO
StringFileInfo
080404B0
FileVersion
1.0.0.0
FileDescription
ProductName
ProductVersion
1.0.0.0
LegalCopyright
Comments
(http://www.eyuyan.com)
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.BlackMoon.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win32.Generic.hc
ALYac Gen:Variant.Zusy.554925
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Blackmoon.V33t
K7AntiVirus Clean
Alibaba Worm:Win32/MalwareX.3cf0c735
K7GW Clean
Cybereason malicious.2b5c5a
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.BlackMoon.A suspicious
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Zusy.554925
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Zusy.554925
Tencent Clean
TACHYON Clean
Sophos BlackMoon Packed (PUA)
F-Secure Trojan.TR/ATRAPS.Gen
DrWeb Clean
VIPRE Gen:Variant.Zusy.554925
TrendMicro TrojanSpy.Win32.BLACKMOON.YXEHDZ
McAfeeD Real Protect-LS!E91D7D92B5C5
Trapmine malicious.high.ml.score
FireEye Generic.mg.e91d7d92b5c5ab6d
Emsisoft Application.Generic (A)
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Zusy.554925
Jiangmin Clean
Webroot Clean
Varist W32/Trojan.GRW.gen!Eldorado
Avira TR/ATRAPS.Gen
Antiy-AVL Trojan[Packed]/Win32.Blackmoon
Kingsoft malware.kb.b.986
Gridinsoft Ransom.Win32.Sabsik.sa
Xcitium TrojWare.Win32.TrojanSpy.Banker.OV@6e1pyh
Arcabit Trojan.Zusy.D877AD
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Trojan/Win.Generic.R658019
Acronis Clean
McAfee Artemis!E91D7D92B5C5
MAX malware (ai score=84)
VBA32 Clean
Malwarebytes PUP.Optional.ChinAd
Panda Clean
Zoner Clean
TrendMicro-HouseCall TrojanSpy.Win32.BLACKMOON.YXEHDZ
Rising Downloader.Convagent!8.123D1 (CLOUD)
Yandex Clean
Ikarus Trojan.Win32.FakeAV
MaxSecure Dropper.Dinwod.frindll
Fortinet W32/CoinMiner.ESFJ!tr
BitDefenderTheta Gen:NN.ZexaF.36810.FqKfamzNWUcb
AVG Win32:MalwareX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (W)
alibabacloud VirTool:Win/Packed.BlackMoon.A
No IRMA results available.