Static | ZeroBOX

PE Compile Time

2024-05-29 21:02:18

PE Imphash

caf38daefab29cfad89407d623eabb48

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00006070 0x00006200 5.82747187107
.rdata 0x00008000 0x00001fea 0x00002000 4.26002785639
.data 0x0000a000 0x00002df8 0x00000600 2.13505579462
.pdata 0x0000d000 0x000004d4 0x00000600 3.51556057155
.gehcont 0x0000e000 0x00000010 0x00000200 0.0815394123432
_RDATA 0x0000f000 0x000000fc 0x00000200 1.97299635917
.reloc 0x00010000 0x00000114 0x00000200 3.35368228481

Imports

Library api-ms-win-crt-string-l1-1-0.dll:
0x180008178 wcsnlen
0x180008180 _wcsicmp
0x180008188 wcsncmp
0x180008190 wcsncpy
0x180008198 wcsncat
Library api-ms-win-crt-convert-l1-1-0.dll:
0x1800080f8 mbstowcs
Library api-ms-win-crt-utility-l1-1-0.dll:
0x1800081b8 srand
0x1800081c0 rand
Library api-ms-win-crt-time-l1-1-0.dll:
0x1800081a8 _time64
Library api-ms-win-crt-runtime-l1-1-0.dll:
0x180008120 terminate
0x180008128 _seh_filter_dll
0x180008130 _configure_narrow_argv
0x180008138 abort
0x180008148 _initterm_e
0x180008150 _initialize_onexit_table
0x180008158 _initterm
0x180008160 _cexit
0x180008168 _execute_onexit_table
Library KERNEL32.dll:
0x180008000 RtlLookupFunctionEntry
0x180008008 GetCurrentProcess
0x180008010 LoadLibraryExW
0x180008018 GetProcAddress
0x180008020 FreeLibrary
0x180008028 TlsFree
0x180008030 TlsSetValue
0x180008038 TlsGetValue
0x180008040 TlsAlloc
0x180008050 DeleteCriticalSection
0x180008058 SetLastError
0x180008060 InterlockedFlushSList
0x180008068 RtlUnwindEx
0x180008080 UnhandledExceptionFilter
0x180008088 IsDebuggerPresent
0x180008090 RtlVirtualUnwind
0x180008098 TerminateProcess
0x1800080a0 RtlCaptureContext
0x1800080a8 GetLastError
0x1800080b0 HeapAlloc
0x1800080b8 HeapFree
0x1800080c0 GetProcessHeap
0x1800080c8 QueryPerformanceCounter
0x1800080d0 GetCurrentProcessId
0x1800080d8 GetCurrentThreadId
0x1800080e0 GetSystemTimeAsFileTime
0x1800080e8 InitializeSListHead
Library api-ms-win-crt-heap-l1-1-0.dll:
0x180008108 free
0x180008110 calloc

Exports

Ordinal Address Name
1 0x180001000 DllMain
!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.gehcont
@_RDATA
@.reloc
D$hMDMP
L$@H;A
H;D$8s
L$8H9H
H9D$ r
H9D$ s
8MDMPtH
HcD$$H
HcD$$H
D$XH9D$8u
y\-zQH
D$49D$(s9
D$49D$,sD
D$49D$0sD
9D$ s
=ntdlt
=l.dlu
9D$ sI
9D$ s0
|$ AVH
H3E H3E
WATAUAVAWH
A_A^A]A\_
ffffff
fffffff
WATAUAVAWH
A_A^A]A\_
LcA<E3
u HcA<H
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
.text$mn
.text$mn$00
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCZ
.CRT$XIA
.CRT$XIZ
.CRT$XPA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata
.edata
.idata$2
.idata$3
.idata$4
.idata$6
.pdata
.gehcont$y
_RDATA
nanodump_ssp.x64.dll
DllMain
wcsnlen
_wcsicmp
mbstowcs
wcsncat
wcsncpy
_time64
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
terminate
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
KERNEL32.dll
calloc
wcsncmp
api-ms-win-crt-heap-l1-1-0.dll
RtlUnwindEx
InterlockedFlushSList
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetCurrentProcess
TerminateProcess
C:\Users\Public\report5.docx
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
Advapi32.dll
Advapi32.dll
Kernel32.dll
D:(A;OICI;GA;;;WD)
\\.\pipe\%ws
Kernel32.dll
\\.\pipe\%ws
Kernel32.dll
Kernel32.dll
Kernel32.dll
Kernel32.dll
ntdll.dll
lsasrv.dll
msv1_0.dll
tspkg.dll
wdigest.dll
kerberos.dll
livessp.dll
dpapisrv.dll
kdcsvc.dll
cryptdll.dll
lsadb.dll
samsrv.dll
rsaenh.dll
ncrypt.dll
ncryptprov.dll
eventlog.dll
wevtsvc.dll
termsrv.dll
cloudap.dll
lsasrv.dll
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.LsassDump.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh Artemis!Trojan
ALYac Generic.Trojan.LsassDump.D.44A005D8
Cylance Unsafe
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
Alibaba HackTool:Win64/NanoDump.e7dc32f7
K7GW Clean
Cybereason Clean
huorong Clean
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec Trojan.Gen.MBT
Elastic Clean
ESET-NOD32 a variant of Win64/HackTool.NanoDump.E
APEX Clean
Avast MalwareX-gen [Trj]
Cynet Clean
Kaspersky Clean
BitDefender Generic.Trojan.LsassDump.D.44A005D8
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Generic.Trojan.LsassDump.D.44A005D8
Tencent Clean
TACHYON Clean
Sophos ATK/NanoDump-C
F-Secure Clean
DrWeb Clean
VIPRE Generic.Trojan.LsassDump.D.44A005D8
TrendMicro TROJ_GEN.R002C0DH524
McAfeeD ti!091CAB51D77F
Trapmine Clean
FireEye Generic.Trojan.LsassDump.D.44A005D8
Emsisoft Generic.Trojan.LsassDump.D.44A005D8 (B)
Ikarus Trojan.Win64.Hacktool
GData Generic.Trojan.LsassDump.D.44A005D8
Jiangmin Clean
Webroot Clean
Varist W64/ABApplication.DTWH-6696
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Generic.Trojan.LsassDump.D.44A005D8
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win64/CobaltStrike.UH!MTB
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!4D40D90F8BB6
MAX malware (ai score=88)
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DH524
Rising Trojan.CobaltStrike!8.EDF2 (CLOUD)
Yandex Clean
SentinelOne Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG MalwareX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike Clean
alibabacloud HackTool:Win/NanoDump.E
No IRMA results available.