Static | ZeroBOX

PE Compile Time

2009-03-21 16:38:07

PE Imphash

25b3acc640473b6fce722f16eff93149

PEiD Signatures

UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x0000c000 0x00000000 0.0
UPX1 0x0000d000 0x0000b000 0x0000ae00 7.90407180119
.rsrc 0x00018000 0x00001000 0x00000a00 3.35099200565

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0001805c 0x00000768 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library ADVAPI32.dll:
0x41883c FreeSid
Library KERNEL32.DLL:
0x418844 LoadLibraryA
0x418848 ExitProcess
0x41884c GetProcAddress
0x418850 VirtualProtect
Library MSVCRT.dll:
0x418858 _iob
Library WS2_32.dll:
0x418860 WSARecv
Library WSOCK32.dll:
0x418868 WSAGetLastError

!This program cannot be run in DOS mode.
\xJGDW
DTtVRQQ
3SZt.
^!h$gE
[v.TE-QE
o[awx=]
JxP+h,,
dd;|41
D{w{)^<3
AsX:GE
]Kvza("be
T+@h)'W
GB1`+K
Ze2emH
k-tbf
&7hZhu
+I;6wq
KX3EWa
aa;,Vk
Wj0Dn5
`{lJ&Ba
F}?#V
si1z7j
rRNr78
Gf<01s+
#,|eCS
c9Ct1A
nY5+^g
bP[f^S
#tnH9p
Ep|#M7
Bn<%t<
QM/5PlQ
px8(ne
ESMh5l
hh@L,U
v(Zz.Z
EM!~!6x]
tq1.W}
@$S`26
eF =$t
O3PoA%
WAz]Sz
[_g:u%
5@A`2oT
VBPFN}
/>9wta
MKCjWv
]At^!{{
ZFHYLwo
Fq;_t1W
hV^t<=
k_{c%`
#^Ut1M8
`dGJH9
R{H}iF5
hQx"YYK
'(null)?12345
6789abcdef
ABCDEF
4l7L88
4|IdJ@
?7:;<=
 !"#$%
L()*+,-./
)GHIJKLMNO
:STUVWXYZWghijklmno
pqrstuvwxyz?+/'
R?Xc?%s: C
t use c
er th%
vidOD[R6gW
0..%d]
oi'URL
oLBasic
okie:2
Cmix PUT
b:T:p:u:v:rkVhwH:y:z:
C:H:P:A:g:X:
apr_sock
1_;)ct"
B10 fail
vZim#oy
[m%yKNFO:m
HTTP/1.0
~ Apac
h/+2.3t
KsKCSV
Gw $%%
n[zWARN
sults7
?ERROR
gT[+/-sd]t0
2tkb/s`
vneTrzsd]
c#+RH/f
d:hgK
velCDX
pu0#Pa!
:name:;SZ
0R6_%\6
Xl17<4
(J(%B
500WTPc(
vcp'k@#
Foundc
6,_ttp://w
Fg/<b'
py3g* 1996N
;mWwi\>Zeus
8$Kvi/
GD'=]d
exit 3Y
cXUxy:p
F'[-E\/
gzip'/-C
qgv,bl
d;-T c
ePOOSP(
KMG0E!
Pr?aWo
OforhM
/SO;adHj"
`d?u X7
neddPx
ZwQupyI
l32?QUe!
dTUUU2
F(etvG
-)epVa
Ov"lap
_!~k1v
rch%wcsncm
vBsaUi
XPTPSW
ADVAPI32.dll
KERNEL32.DLL
MSVCRT.dll
WS2_32.dll
WSOCK32.dll
FreeSid
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
WSARecv
VS_VERSION_INFO
StringFileInfo
040904b0
Comments
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName
Apache Software Foundation
FileDescription
ApacheBench command line utility
FileVersion
2.2.14
InternalName
ab.exe
LegalCopyright
Copyright 2009 The Apache Software Foundation.
OriginalFilename
ab.exe
ProductName
Apache HTTP Server
ProductVersion
2.2.14
VarFileInfo
Translation
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Jorik.lrUS
tehtris Clean
ClamAV Win.Trojan.MSShellcode-6360728-0
CMC Clean
CAT-QuickHeal Trojan.Swrort.A
ALYac Dump:Generic.ShellCode.Marte.3.A65A0C4B
Cylance Unsafe
Zillya Trojan.RozenaGen.Win32.2
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 001172b51 )
Alibaba Trojan:Win32/CobaltStrike.5c89
K7GW Trojan ( 001172b51 )
Cybereason malicious.958d32
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec Packed.Generic.347
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win32/Rozena.AA
APEX Malicious
Avast Win32:Evo-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Dump:Generic.ShellCode.Marte.3.A65A0C4B
NANO-Antivirus Virus.Win32.Gen-Crypt.ccnc
ViRobot Clean
MicroWorld-eScan Dump:Generic.ShellCode.Marte.3.A65A0C4B
Tencent Trojan.Win32.CobaltStrike.16001079
TACHYON Clean
Sophos Mal/Generic-S
F-Secure Trojan.TR/Crypt.ZPACK.Gen
DrWeb Clean
VIPRE Dump:Generic.ShellCode.Marte.3.A65A0C4B
McAfeeD Real Protect-LS!8C85FDC958D3
Trapmine malicious.high.ml.score
FireEye Generic.mg.8c85fdc958d3299c
Emsisoft Dump:Generic.ShellCode.Marte.3.A65A0C4B (B)
huorong HVM:Trojan/Swrort.gen!A
GData Dump:Generic.ShellCode.Marte.3.A65A0C4B
Jiangmin Clean
Webroot W32.Trojan.Swrort.Gen
Varist W32/Swrort.B.gen!Eldorado
Avira TR/Crypt.ZPACK.Gen
Antiy-AVL Trojan/Win32.Rozena
Kingsoft malware.kb.b.947
Gridinsoft Clean
Xcitium TrojWare.Win32.Rozena.A@4jwdqr
Arcabit Dump:Generic.ShellCode.Marte.3.A65A0C4B
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Generic
Microsoft Trojan:Win32/Meterpreter!pz
Google Detected
AhnLab-V3 Backdoor/Win32.Bifrose.R12476
Acronis Clean
McAfee GenericRXAA-AA!8C85FDC958D3
MAX malware (ai score=83)
VBA32 Trojan.Swrort
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall BKDR_SWRORT.SM
Rising Trojan.Crypto!8.364 (CLOUD)
Yandex Trojan.GenAsa!O0/tdGI4TGA
Ikarus Trojan.Agent
MaxSecure Trojan.Malware.7164915.susgen
Fortinet W32/Rozena.ABV!tr
BitDefenderTheta Gen:NN.ZexaF.36810.cmKfaOsCTfli
AVG Win32:Evo-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Backdoor:Win/meterpreter.A
No IRMA results available.