Static | ZeroBOX

PE Compile Time

2083-11-10 05:39:21

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x000e33f4 0x000e3400 4.04430220742
.rsrc 0x000e6000 0x0000060a 0x00000800 3.47793744672
.reloc 0x000e8000 0x0000000c 0x00000200 0.101910425663

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000e60a0 0x00000380 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x000e6420 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
Reserved1
kernel32
ToUInt32
ToInt32
Reserved2
ToInt16
get_UTF8
<Module>
CreateProcessA
LoadLibraryA
nQEacrO6tB
System.IO
mscorlib
ThreadId
ProcessId
GetProcessById
bytesRead
ResumeThread
thread
payload
GetMethod
method
CryptoStreamMode
EndInvoke
BeginInvoke
IDisposable
ThreadHandle
RuntimeTypeHandle
GetTypeFromHandle
ProcessHandle
handle
get_Name
applicationName
commandLine
ValueType
get_ParameterType
MethodBase
Dispose
Create
CreateProcessA_Delegate
ResumeThread_Delegate
ZwUnmapViewOfSection_Delegate
Wow64GetThreadContext_Delegate
Wow64SetThreadContext_Delegate
VirtualAllocEx_Delegate
ReadProcessMemory_Delegate
WriteProcessMemory_Delegate
MulticastDelegate
EmbeddedAttribute
CompilerGeneratedAttribute
GuidAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
ObfuscationAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
IsReadOnlyAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
Liviucotfas.exe
get_Size
bufferSize
SizeOf
Encoding
System.Runtime.Versioning
FromBase64String
GetString
length
LoadApi
CreateApi
AsyncCallback
callback
Marshal
CryptoStream
MemoryStream
Program
System
SymmetricAlgorithm
ICryptoTransform
bytesWritten
StartupInformation
ProcessInformation
processInformation
ZwUnmapViewOfSection
System.Reflection
Exception
MethodInfo
startupInfo
MemberInfo
ParameterInfo
Desktop
Buffer
buffer
GetDelegateForFunctionPointer
BitConverter
StdError
.cctor
CreateDecryptor
IntPtr
Liviucotfas
System.Diagnostics
GetMethods
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
inheritHandles
threadAttributes
processAttributes
GetBytes
creationFlags
Microsoft.CodeAnalysis
ReturnParams
GetParameters
hProcess
process
GetProcAddress
baseAddress
address
Object
object
protect
IAsyncResult
result
environment
Decrypt
Convert
StdInput
StdOutput
System.Text
Wow64GetThreadContext
Wow64SetThreadContext
context
VirtualAllocEx
startIndex
ToArray
System.Security.Cryptography
ReadProcessMemory
WriteProcessMemory
currentDirectory
op_Equality
WrapNonExceptionThrows
Liviucotfas
Copyright
Liviucotfas 2024
$45686882-4992-4a9b-8b48-1c1257656f6c
3.5.4.3
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
Exclude
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
Ef+hNgbDtRYDAVtsXjYmNesirAYwMzZMRilDMksYkXutZZ71bc1sGEiEEfuubShzI5u8JGUnmjsQrPukn9RL74Y+UdkGiZzo/52VHzYRUQZyNvaVp/5f6s78qzDDgbX+1FEbMhQASifRLY2DkzLO0L6dDOmjrVqrH6O/qcYiV/Ew58EMrHZqJD7dH7Vt6eGSujzHjcdyYCQAKqtV4uGRWvxlcXDU8kYwz0VXjzBO/zHUgEZDspBRJV4S0DGTLiG/xBN3Xl+aRDE29dGn4A/s345wCQP6Cgp3/C+HZQDgl4SQNt/9PigRUuVwKcT+iP6g5DuhwBKnQZqYZ+CNetrIcb2OjKtgHPdE6XkolJQRBKrYD8XVv1ROh3ZQk9Fyelm0x+oJMjbevy0W2XeFad5ayrYr4ag4bsScmrd41+qAO1vPuKOhME24u2crOu4n9BNYoYxKn4CIfMb5bO04rOmUjPjdI0FRubG9OZWbacONjO4zX7RDS98qNuJ1EGKTWcc8VFmmKQPM1nYwemJPf6A7wXvs6ElXN8Fhecsa99dk/Jv0dFV4Sij6zwrKU51DPbFEF2mmCNCQW71DX8nZJxhz/PPFEt0VrVjTeTeO8+6vgzHA0cL0d3BiVqRnJrAX6QrcRO7gWpDiitVmqzg8a5pK8jPq2yA6d6VhdnysZiuUEI6bofdkqSqMmHZ/5e1fIhymI7VTLp7RSokFNnHBjO2zun8fVwcEI/X+jgx07hd4Sh8eghxcZ1poXB5m7Q2Wp8tTlPkWZ8YVKj63/pf3Z/Z9/1AdGHsLEOMyltiGwr0O/Bes9Odaj+xj+wWZBKAmMIDzqKTjrN1T5N57sywHNIWx08v566+NzylPauDjASfKlyJlRbqOaBFnVnmOJlrIvWUYJe31POFsPafwhj1NWji7jrZO07fym2Y7Av+r4ViGxO8j9alSlhE23RDvZDtw0mJqrCsm/44MZHH6NQ747YYVg7OhWSj6YSMTFRgXJjRSzfVGmnzt2Zrjp4+GO1t0DyWk
QzpcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29ya1x2NC4wLjMwMzE5XFJlZ0FzbS5leGU=
ToInt16
ToInt32
GetBytes
kernel32
ResumeThread
Wow64SetThreadContext
SetThreadContext
Wow64GetThreadContext
GetThreadContext
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
ZwUnmapViewOfSection
CreateProcessA
BlockCopy
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Liviucotfas
CompanyName
Liviucotfas
FileDescription
Liviucotfas
FileVersion
3.5.4.3
InternalName
Liviucotfas.exe
LegalCopyright
Copyright
Liviucotfas 2024
LegalTrademarks
Liviucotfas
OriginalFilename
Liviucotfas.exe
ProductName
Liviucotfas
ProductVersion
3.5.4.3
Assembly Version
3.5.4.3
Antivirus Signature
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Generic.4!c
tehtris Generic.Malware
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win32.Generic.dt
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 0050bedf1 )
Alibaba Trojan:MSIL/Injector.99f78a9e
K7GW Trojan ( 0050bedf1 )
Cybereason malicious.f41070
huorong Trojan/MSIL.Injector.fx
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Injector.LOS
APEX Malicious
Avast FileRepMalware [Misc]
Cynet Clean
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Heur.MSIL.Krypt.6
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Heur.MSIL.Krypt.6
Tencent Malware.Win32.Gencirc.1415036e
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.InjectNET.17
VIPRE Gen:Heur.MSIL.Krypt.6
TrendMicro Clean
McAfeeD Real Protect-LS!F38BCACF4107
Trapmine Clean
FireEye Generic.mg.f38bcacf41070de4
Emsisoft Gen:Heur.MSIL.Krypt.6 (B)
Ikarus Trojan.MSIL.Injector
GData Gen:Heur.MSIL.Krypt.6
Jiangmin Clean
Webroot Clean
Varist W32/MSIL_Troj.C.gen!Eldorado
Avira TR/Dropper.Gen
Antiy-AVL Trojan/Win32.Agent
Kingsoft Win32.Trojan.Generic.a
Gridinsoft Trojan.Win32.Downloader.sa
Xcitium Clean
Arcabit Trojan.MSIL.Krypt.6
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Generic
Microsoft Trojan:Win32/Casdet!rfn
Google Detected
AhnLab-V3 Malware/Win32.RL_Generic.C3997807
Acronis Clean
McAfee Artemis!F38BCACF4107
MAX malware (ai score=87)
VBA32 Trojan.MSIL.DiscoStealer.Heur
Malwarebytes Generic.Malware/Suspicious
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0CH324
Rising Malware.Obfus/MSIL@AI.87 (RDM.MSIL2:RAFw+CM/8PVA6muL3xMbKA)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/LOS!tr
BitDefenderTheta AI:Packer.7B4FE22D1F
AVG FileRepMalware [Misc]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Trojan:MSIL/Injector.LOS
No IRMA results available.