Static | ZeroBOX

PE Compile Time

2015-06-16 01:07:53

PE Imphash

7045005ef4130348fa4cbfc30a6f9d04

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00010000 0x00000000 0.0
UPX1 0x00011000 0x00009000 0x00008600 7.95218671663
.rsrc 0x0001a000 0x00001000 0x00000800 4.11286238003

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x000161a8 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL ISO-8859 text, with no line terminators
RT_RCDATA 0x000161a8 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL ISO-8859 text, with no line terminators
RT_RCDATA 0x000161a8 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL ISO-8859 text, with no line terminators
RT_RCDATA 0x000161a8 0x00000006 LANG_NEUTRAL SUBLANG_NEUTRAL ISO-8859 text, with no line terminators
RT_MANIFEST 0x0001a144 0x0000029c LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, ASCII text, with very long lines, with no line terminators

Imports

Library KERNEL32.DLL:
0x14001a4a8 LoadLibraryA
0x14001a4b0 GetProcAddress
0x14001a4b8 VirtualProtect
0x14001a4c0 VirtualAlloc
0x14001a4c8 VirtualFree
0x14001a4d0 ExitProcess
Library COMCTL32.DLL:
0x14001a4e0 InitCommonControlsEx
Library GDI32.DLL:
0x14001a4f0 BitBlt
Library msvcrt.dll:
0x14001a500 fabs
Library OLE32.DLL:
0x14001a510 CoInitialize
Library SHELL32.DLL:
0x14001a520 ShellExecuteExA
Library SHLWAPI.DLL:
0x14001a530 PathGetArgsA
Library USER32.DLL:
0x14001a540 GetDC
Library WINMM.DLL:
0x14001a550 timeBeginPeriod

!This program cannot be run in DOS mode.
iXIJ\_
F_Oy1Y
ScjHn7V
s\1`Zs
H*_3<p
Zh]XA2A
.8pUN :&
/'5jV1E6
n:6sT@
z-*w
lzBE0D
6wK]a(
9?0'Drr]
u?y}Q&
f0XFt8
w0pu )
j=ZW<xS(
(w~J'a2
! y3(E
H87K0;G
E/H74-
O)+\iUA
}O0pkc
S1wP0j
aY%!e
u9"7z\
B8"xO9{JP
[F/;d4
{5J}KBn
lM0O0J
c1A7|*
a<JHCD
>.-)VR
)=Ks>
*^<&:)+
~HAZArv5W
hR_\J"C
y{)#Kr_X
6#>i*Mr
/nH#J=
L1'=U_
L[a}I[
Z wFAS+
~q7me551
<jI8+X
`ZTu8Y
~V5a[M$
7UZ- u
\x]Iaq
CA[mag
o|#l4r
{?]xnR
p~<\x:
&`w#}Z
X`jN`}"
"[t*Yx
aCt6s#D
#<S)M1
L$sn>NIS
E58D[hUE"a
]7Rsn-
;sz95S(A
i@$U%&
2A23_B
j;"\h;
[]A\A]A^A_
(]_^[H
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly> </dependency> <v3:trustInfo xmlns:v3="urn:schemas-microsoft-com:asm.v3"> <v3:security> <v3:requestedPrivileges> <!-- level can be "asInvoker", "highestAvailable", or "requireAdministrator" --> <v3:requestedExecutionLevel level="highestAvailable" /> </v3:requestedPrivileges> </v3:security> </v3:trustInfo> </assembly>
KERNEL32.DLL
COMCTL32.DLL
GDI32.DLL
msvcrt.dll
OLE32.DLL
SHELL32.DLL
SHLWAPI.DLL
USER32.DLL
WINMM.DLL
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
InitCommonControlsEx
BitBlt
CoInitialize
ShellExecuteExA
PathGetArgsA
timeBeginPeriod
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Convagent.4!c
tehtris Generic.Malware
ClamAV Win.Trojan.Generic-7440302-0
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.Generic.nc
ALYac Trojan.GenericKD.63547160
Cylance Unsafe
Zillya Trojan.Convagent.Win32.12552
Sangfor Trojan.Win32.Convagent.Vxq0
K7AntiVirus Riskware ( 00584baa1 )
Alibaba Trojan:Win64/Genric.3dc46334
K7GW Riskware ( 00584baa1 )
Cybereason malicious.960a58
Baidu Clean
VirIT Backdoor.Win32.Generic.KKE
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 Clean
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky VHO:Trojan.Win32.Convagent.gen
BitDefender Trojan.GenericKD.63547160
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.63547160
Tencent Clean
Sophos Generic Reputation PUA (PUA)
F-Secure Clean
DrWeb Win32.HLLW.Autoruner2.51353
VIPRE Trojan.GenericKD.63547160
TrendMicro TROJ_GEN.R002C0PF724
McAfeeD Real Protect-LS!DA72C93960A5
Trapmine Clean
FireEye Generic.mg.da72c93960a58f7f
Emsisoft Trojan.Agent (A)
Jiangmin Trojan/PSW.Ruftar.gcx
Avira Clean
MAX malware (ai score=81)
Antiy-AVL Trojan/Win32.Convagent
Kingsoft Win32.Trojan.Convagent.gen
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Generic.D3C9A718
SUPERAntiSpyware Clean
ZoneAlarm VHO:Trojan.Win32.Convagent.gen
GData Trojan.GenericKD.63547160
Varist W64/ABTrojan.ZTUU-6188
AhnLab-V3 Trojan/Win.RealProtect-LS.C5317323
Acronis Clean
BitDefenderTheta Clean
TACHYON Trojan/W64.SchoolGirl.73216
VBA32 Clean
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0PF724
Rising Trojan.Convagent!8.12323 (CLOUD)
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet W64/CoinMiner.MB!tr
AVG Win64:Malware-gen
Avast Win64:Malware-gen
CrowdStrike win/malicious_confidence_70% (D)
alibabacloud Suspicious
No IRMA results available.