Static | ZeroBOX

PE Compile Time

2024-04-23 07:14:41

PE Imphash

826994b0b08f6b39dd6e5d89103ca266

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00006eb8 0x00007000 6.25934891348
.data 0x00008000 0x000004d0 0x00000600 5.92576631444
.rdata 0x00009000 0x00000df0 0x00000e00 4.6490975853
.pdata 0x0000a000 0x000004b0 0x00000600 3.50775850606
.xdata 0x0000b000 0x00000468 0x00000600 3.56807619761
.bss 0x0000c000 0x00000c00 0x00000000 0.0
.idata 0x0000d000 0x000008b4 0x00000a00 3.63212626643
.CRT 0x0000e000 0x00000060 0x00000200 0.290466074313
.tls 0x0000f000 0x00000010 0x00000200 0.0
.rsrc 0x00010000 0x0002a8f0 0x0002aa00 4.16059967726
.reloc 0x0003b000 0x00000080 0x00000200 1.50214863044

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_ICON 0x0003a038 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US GLS_BINARY_LSB_FIRST
RT_GROUP_ICON 0x0003a4a0 0x000000d8 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x0003a578 0x00000374 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library KERNEL32.dll:
0x14000d230 CloseHandle
0x14000d238 CreateFileA
0x14000d240 CreateMailslotA
0x14000d248 CreateThread
0x14000d250 DeleteCriticalSection
0x14000d258 EnterCriticalSection
0x14000d260 GetCurrentProcess
0x14000d268 GetLastError
0x14000d270 GetMailslotInfo
0x14000d278 GetModuleHandleA
0x14000d280 GetProcAddress
0x14000d288 GetTickCount
0x14000d290 HeapAlloc
0x14000d298 HeapCreate
0x14000d2a0 HeapReAlloc
0x14000d2b0 IsDBCSLeadByteEx
0x14000d2b8 LeaveCriticalSection
0x14000d2c0 MultiByteToWideChar
0x14000d2c8 ReadFile
0x14000d2d8 Sleep
0x14000d2e0 TlsGetValue
0x14000d2e8 VirtualProtect
0x14000d2f0 VirtualQuery
0x14000d2f8 WaitForSingleObject
0x14000d300 WideCharToMultiByte
0x14000d308 WriteFile
Library msvcrt.dll:
0x14000d318 __C_specific_handler
0x14000d320 ___lc_codepage_func
0x14000d328 ___mb_cur_max_func
0x14000d330 __getmainargs
0x14000d338 __initenv
0x14000d340 __iob_func
0x14000d348 __set_app_type
0x14000d350 __setusermatherr
0x14000d358 _amsg_exit
0x14000d360 _cexit
0x14000d368 _commode
0x14000d370 _errno
0x14000d378 _fmode
0x14000d380 _initterm
0x14000d388 _onexit
0x14000d390 abort
0x14000d398 calloc
0x14000d3a0 exit
0x14000d3a8 fprintf
0x14000d3b0 fputc
0x14000d3b8 free
0x14000d3c0 fwrite
0x14000d3c8 localeconv
0x14000d3d0 malloc
0x14000d3d8 memcpy
0x14000d3e0 memset
0x14000d3e8 signal
0x14000d3f0 strerror
0x14000d3f8 strlen
0x14000d400 strncmp
0x14000d408 vfprintf
0x14000d410 wcslen

!This program cannot be run in DOS mode.
`.data
.rdata
@.pdata
@.xdata
.idata
@.reloc
ATUWVSH
[^_]A\
[^_]A\
ATUWVSH
P[^_]A\
ATUWVSH
@[^_]A\
UAWAVAUATWVSH
[^_A\A]A^A_]
ATUWVSH
[^_]A\H
:MZuYHcB<H
C$9C(~
u HcS$
AWAVAUATUWVSH
C$9C(~
H[^_]A\A]A^A_
S$9S(~
S$9S(~
UAWAVAUATWVSH
[^_A\A]A^A_]
C$9C(~
C$9C(~
UAWAVAUATWVSH
C$9C(~
S$9S(~
[^_A\A]A^A_]
UATWVSH
C$9C(~
[^_A\]
[^_A\]
=UUUUw
S$9S(~
AUATUWVSH
X[^_]A\A]
AWAVAUATUWVSH
[^_]A\A]A^A_
AWAVAUATUWVSH
8[^_]A\A]A^A_
AWAVAUATUWVSH
[^_]A\A]A^A_
[^_]A\A]A^A_
D$xA;E
ATUWVSHcY
[^_]A\
[^_]A\
AWAVAUATUWVSH
([^_]A\A]A^A_
AVAUATUWVSH
[^_]A\A]A^
AVAUATUWVSH
[^_]A\A]A^
WVSHcA
AVAUATUWVSH
0[^_]A\A]A^
ATUWVSH
@[^_]A\
AVAUATUWVSH
@[^_]A\A]A^
((3I^3(
a+.~Rt
%c%c%c%c%c%c%c%c%c%c%c%c%cslot-%d
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
Partial loss of significance (PLOSS)
Total loss of significance (TLOSS)
The result is too small to be represented (UNDERFLOW)
Unknown error
_matherr(): %s in %s(%g, %g) (retval=%g)
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
(null)
Infinity
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
CloseHandle
CreateFileA
CreateMailslotA
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetLastError
GetMailslotInfo
GetModuleHandleA
GetProcAddress
GetTickCount
HeapAlloc
HeapCreate
HeapReAlloc
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
ReadFile
SetUnhandledExceptionFilter
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
calloc
fprintf
fwrite
localeconv
malloc
memcpy
memset
signal
strerror
strlen
strncmp
vfprintf
wcslen
KERNEL32.dll
msvcrt.dll
>****R
/****F
*****2
b++++++
J++++++N
K,,,,,,3
K,,,,,,,G
K33333333
O333333334
O3333333335
P44444444445
P444444444445
Q6646464646468
Q66666666666668
Q777777777777778
y777777777777777;
y9999999999999999;
y99999999999999999H
y999999999999999999I
{9:9:9:9:9:9:9:9:9:9X
{::::::::::::::::::9
{<<<<<<<<<<<<<<<<<<:
{<r<r<r<r<r<r<r<r<<:
{<<<<<<<<<<<<<<<<rr:
|rrrrrrrrrrrrrrrrrr<
|rrrrrrrrrrrrrrrrrrr
wussssssssssssssssr
}xusttttttttttr
~zvtttttts
-&&&,g
-,,,,3v
-/,,,,@~
0//////B
2/////1/C
41111/1/1D
4111111111D
45555555555\
755555555555]
7885888888865R
9888888888885
9888888888886
9U8U8UU8U8U88
XUUUUUUUUUVU8
s`^ZWVVVVVV8
tb_[YWU
%M___@8EO
B____G?A
$F___P>
&H___;
!1)#9k
P[4sdW
tpH)kYXmUa
fCTPs<2&,2(+Z
\;A9c ;S
f6~"#E
U(#=N!
b>)ugj
fO)K{y
-S5yzu
.Wghm_6
40*Bj+FJKgdDMGy
~}$##Cu
UVFzj
7&lOHHP
%"ls{B
(null)
/-P?pR
/ P6pL
,/KPip
/-P?pR
/ P6pL
,/KPip
/-P?pR
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Beijing Huorong Network Technology Co., Ltd.
FileDescription
Huorong Internet Security Main UI
FileVersion
5.0.1.1
InternalName
HipsMain
LegalCopyright
Beijing Huorong Network Technology Co., Ltd.
OriginalFilename
HipsMain.exe
ProductName
Huorong Internet Security
ProductVersion
5.0.1.1
VarFileInfo
Translation
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.CobaltStrike.4!c
tehtris Clean
ClamAV Win.Malware.Zusy-10033301-0
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.Infected.dt
ALYac Gen:Variant.Zusy.554542
Cylance Clean
Zillya Trojan.GenKryptik.Win64.27153
Sangfor Trojan.Win64.Kryptik.V3o0
K7AntiVirus Trojan ( 00594da41 )
Alibaba Trojan:Win64/GenKryptik.36faa6eb
K7GW Trojan ( 00594da41 )
Cybereason malicious.1d8f0f
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/GenKryptik.FWMV
APEX Malicious
Avast Win64:Evo-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Zusy.554542
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Zusy.216576.C
MicroWorld-eScan Gen:Variant.Zusy.554542
Tencent Trojan.Win64.Kryptik.hm
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.PatchedWinSwrort.ckfiy
DrWeb BackDoor.Meterpreter.157
VIPRE Gen:Variant.Zusy.554542
TrendMicro Clean
McAfeeD ti!C8009295795A
Trapmine Clean
FireEye Gen:Variant.Zusy.554542
Emsisoft Gen:Variant.Zusy.554542 (B)
SentinelOne Clean
GData Gen:Variant.Zusy.554542
Jiangmin Clean
Webroot W32.Trojan.TR.AD.PatchedWinSwro
Varist Clean
Avira TR/AD.PatchedWinSwrort.ckfiy
Antiy-AVL Trojan/Win64.GenKryptik
Kingsoft Clean
Gridinsoft Trojan.Win64.Kryptik.sa
Xcitium Clean
Arcabit Trojan.Zusy.D8762E
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win64/CobaltStrike.AMBA!MTB
Google Detected
AhnLab-V3 Trojan/Win.CobaltStrike.C5628252
Acronis Clean
McAfee Artemis!EDF60741D8F0
MAX malware (ai score=80)
VBA32 Clean
Malwarebytes Malware.AI.3638408099
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Kryplod!8.100A5 (TFE:5:AImjlJANoeK)
Yandex Clean
Ikarus Win32.Outbreak
MaxSecure Clean
Fortinet W64/Kryptik.DWZ!tr
BitDefenderTheta Clean
AVG Win64:Evo-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike Clean
alibabacloud Trojan:Win/CobaltStrike.AZHO3DGW
No IRMA results available.