Static | ZeroBOX

PE Compile Time

2011-06-17 17:39:17

PE Imphash

f4f7f76aa0a06aa9cec19206195b4f24

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0001f5d4 0x0001f600 6.66274439162
.rdata 0x00021000 0x000057a4 0x00005800 5.19369162251
.data 0x00027000 0x0000436c 0x00002000 3.14553202424
.rsrc 0x0002c000 0x00008e5f 0x00000200 5.11262354953

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0002c058 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US ASCII text, with CRLF line terminators

Imports

Library IPHLPAPI.DLL:
0x421010 GetAdaptersInfo
0x421018 GetNetworkParams
Library KERNEL32.dll:
0x421020 AllocConsole
0x421024 GetStdHandle
0x421028 CloseHandle
0x42102c WideCharToMultiByte
0x421030 lstrlenW
0x421034 GetCurrentProcess
0x421038 WriteConsoleA
0x42103c GetModuleFileNameA
0x421040 GetLastError
0x421044 Sleep
0x421048 GetTempPathA
0x421050 FreeConsole
0x42105c CompareStringW
0x421060 CompareStringA
0x421064 GetLocaleInfoW
0x421068 CreateFileA
0x42106c IsValidLocale
0x421070 EnumSystemLocalesA
0x421074 GetLocaleInfoA
0x421078 GetUserDefaultLCID
0x42107c GetStringTypeW
0x421080 GetStringTypeA
0x421084 LCMapStringW
0x421088 LCMapStringA
0x421090 LoadLibraryA
0x421094 WriteConsoleW
0x421098 GetConsoleOutputCP
0x42109c MultiByteToWideChar
0x4210a4 TerminateProcess
0x4210b0 IsDebuggerPresent
0x4210b4 RaiseException
0x4210b8 HeapFree
0x4210bc RtlUnwind
0x4210c0 HeapAlloc
0x4210c4 HeapReAlloc
0x4210c8 FindClose
0x4210d4 GetDriveTypeA
0x4210d8 FindFirstFileA
0x4210dc SetEndOfFile
0x4210e0 GetProcessHeap
0x4210e4 GetCommandLineA
0x4210e8 GetModuleHandleW
0x4210ec GetProcAddress
0x4210f0 TlsGetValue
0x4210f4 TlsAlloc
0x4210f8 TlsSetValue
0x4210fc TlsFree
0x421104 SetLastError
0x421108 GetCurrentThreadId
0x421110 HeapCreate
0x421114 VirtualFree
0x421124 VirtualAlloc
0x421128 SetHandleCount
0x42112c GetFileType
0x421130 GetStartupInfoA
0x421134 WriteFile
0x421138 GetConsoleCP
0x42113c GetConsoleMode
0x421140 FlushFileBuffers
0x421144 ReadFile
0x421148 SetFilePointer
0x42114c ExitProcess
0x421150 HeapSize
0x421154 GetFullPathNameA
0x42115c GetCPInfo
0x421160 GetACP
0x421164 GetOEMCP
0x421168 IsValidCodePage
0x42116c SetStdHandle
0x421184 GetTickCount
0x421188 GetCurrentProcessId
0x421190 CreateFileW
Library ADVAPI32.dll:
0x421000 GetTokenInformation
0x421004 OpenProcessToken
0x421008 LookupAccountSidA
Library WS2_32.dll:
0x4211a4 inet_ntoa
0x4211a8 WSAStartup
0x4211ac gethostname
0x4211b0 inet_addr
0x4211b4 getsockname
0x4211b8 closesocket
0x4211bc recvfrom
0x4211c0 socket
0x4211c4 sendto
0x4211c8 htonl
0x4211cc htons
0x4211d0 connect
0x4211d4 WSACleanup
0x4211d8 select
0x4211dc WSAGetLastError
Library NETAPI32.dll:
0x421198 NetWkstaUserGetInfo
0x42119c NetApiBufferFree

!This program cannot be run in DOS mode.
.rdata
@.data
D$ VSUP
PQSUVW
^\9nTr
^@9n8r
D$<SUVW
D$$SUVW
D$,SUVW
~$_^]Y
T$ PQR
PQRWVS
PQRWVS
EpSVWP
D$$QRP
\$\9t$Tr
\$H9t$@r
\$,9t$xr
|$\9t$@r
|$@9t$xr
F09^(u
QRQUPj
D$,Ph`
T$4RVf
L$$_][
L$T^_][3
L$`_^][3
0WWWWW
0WWWWW
QQSVWd
<\tM</tI
0SSSSS
F\= (B
HtHu4j
s[S;7|G;w
tR99u2
j@j ^V
0SSSSS
HHtXHHt
>If90t
uBh"cA
u[SSSP
0A@@Ju
<at9<rt,<wt
URPQQh
>=Yt1j
;t$,v-
UQPXY]Y[
^SSSSS
j"^SSSSS
0SSSSS
>:u8FV
VVVVVQRSSj
t"SS9]
PPPPPPPP
C PjPV
C$PjQV
C*PjTV
C+PjUV
C,PjVV
C-PjWV
C.PjRV
C/PjSV
PPPPPPPP
tGHt.Ht&
^SSSSS
8VVVVV
u,VVWV
t VV9u
t+WWVPV
^SSSSS
^SSSSS
^SSSSS
^SSSSS
j"^SSSSS
tGHt.Ht&
^SSSSS
8VVVVV
bad allocation
vector<T> too long
bad cast
ios_base::eofbit set
ios_base::failbit set
ios_base::badbit set
SYSTEM
Delete
NoRemove
ForceRemove
\login.log
userprofile
//login.log
c:\login.log
ERR:Send hear message failed,ret: %d
Send heart boom message to ac
ERR:Encrypt message failed, ret: %d
Reply:%s[%d]
ERR:Send login message failed,ret: %d
ERR:%s, ERR_NO:%d
Send message to AC [%d]... user: %s
g_vecDomainAC empty, can't find match ac ip, dns=%s
shareKey
sinforIP
domainIP
config
GetNetworkParams failed with error: %d
g_vecDomainAC empty
Error allocating memory needed to call GetNetworkParams
load sinforIP fail
path:%s
\sinforIP
ERR: command-params format: ip port key, ERR_NO:%d
Logon Failed!
Logon complete!
sinforIP=%s, key=%s
Send login info...
ERR: Logon method is err! ERR_NO: %d
winslogonMethod = %d
ERR: Get hostname failed, ERR_NO: %d
GET HOST AD, UserName & SOURCE...
ERR LINE: %d,Get login's info failed, Ret: %d
Check PORT...
ERR: command-params format: ip port key, ERR_NO: %d
Load finished...
try=%d, recv=%d
GetMatchAcIP fail
Please waiting for a moment ...
logon.exe is heart beat version
Err:free console!
Reply:200 Login OK
err: %d, A system error has occurred: %d
Info: %d, GetUserName: %s
'%s' not login, waiting...
ERR: %d, GetUserName failed:%d
ERR LINE: %d: LookupAccountSid failed:%d
ERR LINE: %d: GetTokenInformation failed:%d
ERR LINE: %d: OpenProcessToken failed:%d
Error LINE:%d, ErrNo:%u,LastErr:%d,Ret:%d
userdomain=%s
userdomain
seclogon
ERR:No such ip as getsockname, ERR_NO:%d
ERR:GetAdaptersInfo failed, ERR_NO:%d[%d]
ERR:GetNumberOfInterfaces failed, ERR:%d[%d]
SelfIP:%s
ERR: Getsockname failed, ERR_NO:%d
202.96.137.75
ERR:Init socket failed, ERR_NO:%d
ERR:WSAStartup failed, ERR_NO:%d
file:%s, line:%d, assert bug !!!!!
i:\af1.0\windows\
\logon\blockalloc.h
%s = %s
Unknown exception
Visual C++ CRT: Not enough memory to complete call to strerror.
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
bad exception
Illegal byte sequence
Directory not empty
Function not implemented
No locks available
Filename too long
Resource deadlock avoided
Result too large
Domain error
Broken pipe
Too many links
Read-only file system
Invalid seek
No space left on device
File too large
Inappropriate I/O control operation
Too many open files
Too many open files in system
Invalid argument
Is a directory
Not a directory
No such device
Improper link
File exists
Resource device
Unknown error
Bad address
Permission denied
Not enough space
Resource temporarily unavailable
No child processes
Bad file descriptor
Exec format error
Arg list too long
No such device or address
Input/output error
Interrupted function call
No such process
No such file or directory
Operation not permitted
No error
(null)
`h````
xpxxxx
CorExitProcess
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
UTF-16LE
UNICODE
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
`h`hhh
xppwpp
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
britain
america
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
Norwegian-Nynorsk
CONOUT$
string too long
invalid string position
GetNetworkParams
GetAdaptersInfo
GetNumberOfInterfaces
IPHLPAPI.DLL
GetEnvironmentVariableA
GetTempPathA
GetLastError
GetModuleFileNameA
WriteConsoleA
GetStdHandle
AllocConsole
FreeConsole
CloseHandle
WideCharToMultiByte
lstrlenW
GetCurrentProcess
KERNEL32.dll
LookupAccountSidA
GetTokenInformation
OpenProcessToken
ADVAPI32.dll
WS2_32.dll
NetApiBufferFree
NetWkstaUserGetInfo
NETAPI32.dll
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
RtlUnwind
HeapAlloc
HeapReAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
SetEndOfFile
GetProcessHeap
GetCommandLineA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
ExitProcess
HeapSize
GetFullPathNameA
GetCurrentDirectoryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetConsoleOutputCP
WriteConsoleW
LoadLibraryA
GetTimeZoneInformation
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileA
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
InitializeCriticalSection
CreateFileW
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVfacet@locale@std@@
.?AVcodecvt_base@std@@
.?AUctype_base@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$ctype@D@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$codecvt@DDH@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AVlogic_error@std@@
.?AVruntime_error@std@@
.?AVlength_error@std@@
.?AVfailure@ios_base@std@@
.?AVbad_cast@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AV_Locimp@locale@std@@
.?AVout_of_range@std@@
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD````````@@@@@@@@########$$$$$$$$ 45.15.9.44 1773
KERNEL32.DLL
(null)
mscoree.dll
((((( H
h(((( H
H
UTF-16LE
UNICODE
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Clean
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Clean
Cylance Unsafe
Zillya Trojan.Agent.Win32.1160276
Sangfor Clean
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason Clean
huorong Clean
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec Clean
Elastic Clean
ESET-NOD32 a variant of Win32/Agent.TXZ
APEX Malicious
Avast Win32:Malware-gen
Cynet Clean
Kaspersky Clean
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Clean
Tencent Win32.Trojan.Agent.Lcnw
TACHYON Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
McAfeeD ti!CCB40EB0137E
Trapmine Clean
FireEye Generic.mg.ceccc726e628b959
Emsisoft Clean
Ikarus Clean
GData Clean
Jiangmin Clean
Webroot Clean
Varist Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Wacatac.B!ml
Google Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!CECCC726E628
MAX Clean
VBA32 BScope.Trojan.Wacatac
Malwarebytes Malware.Heuristic.2046
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Agent!8.B1E (CLOUD)
Yandex Clean
SentinelOne Clean
MaxSecure Trojan.Malware.1728101.susgen
Fortinet Clean
BitDefenderTheta AI:Packer.1A5AF0A41F
AVG Win32:Malware-gen
DeepInstinct Clean
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Trojan:Win/Agent.TDP
No IRMA results available.