Static | ZeroBOX

PE Compile Time

2024-03-18 15:59:36

PE Imphash

6d8e187825cbe7dbdc0aff9da7ee9481

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00007ab8 0x00007c00 6.25527532166
.data 0x00009000 0x000004e0 0x00000600 6.02325973822
.rdata 0x0000a000 0x00000aa0 0x00000c00 4.3225686783
.pdata 0x0000b000 0x00000648 0x00000800 3.59861512675
.xdata 0x0000c000 0x00000520 0x00000600 3.75167011789
.bss 0x0000d000 0x00002ad0 0x00000000 0.0
.edata 0x00010000 0x000000aa 0x00000200 1.85058413646
.idata 0x00011000 0x000006cc 0x00000800 3.7971064955
.CRT 0x00012000 0x00000058 0x00000200 0.253231201804
.tls 0x00013000 0x00000010 0x00000200 0.0
.reloc 0x00014000 0x00000064 0x00000200 1.16832723816

Imports

Library KERNEL32.dll:
0x2fbad11c8 DeleteCriticalSection
0x2fbad11d0 EnterCriticalSection
0x2fbad11d8 GetCurrentProcess
0x2fbad11e0 GetLastError
0x2fbad11e8 GetModuleHandleA
0x2fbad11f0 GetProcAddress
0x2fbad11f8 GetTickCount
0x2fbad1200 HeapAlloc
0x2fbad1208 HeapCreate
0x2fbad1210 HeapReAlloc
0x2fbad1220 IsDBCSLeadByteEx
0x2fbad1228 LeaveCriticalSection
0x2fbad1230 MultiByteToWideChar
0x2fbad1238 Sleep
0x2fbad1240 TlsGetValue
0x2fbad1248 VirtualProtect
0x2fbad1250 VirtualQuery
0x2fbad1258 WaitForSingleObject
0x2fbad1260 WideCharToMultiByte
Library msvcrt.dll:
0x2fbad1270 ___lc_codepage_func
0x2fbad1278 ___mb_cur_max_func
0x2fbad1280 __iob_func
0x2fbad1288 _amsg_exit
0x2fbad1290 _errno
0x2fbad1298 _initterm
0x2fbad12a0 _lock
0x2fbad12a8 _unlock
0x2fbad12b0 abort
0x2fbad12b8 calloc
0x2fbad12c0 fputc
0x2fbad12c8 free
0x2fbad12d0 fwrite
0x2fbad12d8 localeconv
0x2fbad12e0 malloc
0x2fbad12e8 mbstowcs
0x2fbad12f0 memcpy
0x2fbad12f8 memset
0x2fbad1300 rand
0x2fbad1308 realloc
0x2fbad1310 strerror
0x2fbad1318 strlen
0x2fbad1320 strncmp
0x2fbad1328 vfprintf
0x2fbad1330 wcslen
0x2fbad1338 wcsncat
0x2fbad1340 wcsncpy

Exports

Ordinal Address Name
1 0x2fbac2631 DllGetClassObject
2 0x2fbac25c7 DllMain
3 0x2fbac262b DllRegisterServer
4 0x2fbac262e DllUnregisterServer
5 0x2fbac263a StartW
!This program cannot be run in DOS mode.
`.data
.rdata
@.pdata
@.xdata
.edata
@.idata
.reloc
AUATUWVSH
([^_]A\A]
ATUWVSH
[^_]A\
ATUWVSH
p[^_]A\
AUATUWVSH
tEHcJ<
([^_]A\A]
UAWAVAUATWVSH
[^_A\A]A^A_]
ATUWVSH
[^_]A\H
:MZuYHcB<H
C$9C(~
u HcS$
AWAVAUATUWVSH
C$9C(~
H[^_]A\A]A^A_
S$9S(~
S$9S(~
UAWAVAUATWVSH
[^_A\A]A^A_]
C$9C(~
C$9C(~
UAWAVAUATWVSH
C$9C(~
S$9S(~
[^_A\A]A^A_]
UATWVSH
C$9C(~
[^_A\]
[^_A\]
=UUUUw
S$9S(~
AUATUWVSH
X[^_]A\A]
AWAVAUATUWVSH
[^_]A\A]A^A_
AWAVAUATUWVSH
8[^_]A\A]A^A_
AWAVAUATUWVSH
[^_]A\A]A^A_
[^_]A\A]A^A_
D$xA;E
ATUWVSHcY
[^_]A\
[^_]A\
AWAVAUATUWVSH
([^_]A\A]A^A_
AVAUATUWVSH
[^_]A\A]A^
AVAUATUWVSH
[^_]A\A]A^
WVSHcA
AVAUATUWVSH
0[^_]A\A]A^
ATUWVSH
@[^_]A\
AVAUATUWVSH
@[^_]A\A]A^
%c%c%c%c%c%c%c%c%cSoteriaSoteria\%d
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
(null)
Infinity
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
temp.dll
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartW
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetTickCount
HeapAlloc
HeapCreate
HeapReAlloc
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_unlock
calloc
fwrite
localeconv
malloc
mbstowcs
memcpy
memset
realloc
strerror
strlen
strncmp
vfprintf
wcslen
wcsncat
wcsncpy
KERNEL32.dll
msvcrt.dll
(null)
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Clean
tehtris Clean
ClamAV Win.Trojan.CobaltStrike-9044898-1
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
McAfee Clean
Cylance Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason malicious.d59dde
huorong Clean
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec Clean
Elastic malicious (high confidence)
ESET-NOD32 Clean
APEX Malicious
Avast Clean
Cynet Clean
Kaspersky HEUR:Trojan.Win64.CobaltStrike.gen
BitDefender Gen:Heur.Whisperer.1.0000000400
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Heur.Whisperer.1.0000000400
Tencent Trojan.Win32.CobaltStrike.16001072
TACHYON Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
VIPRE Gen:Heur.Whisperer.1.0000000400
TrendMicro Clean
McAfeeD Clean
Trapmine Clean
FireEye Gen:Heur.Whisperer.1.0000000400
Emsisoft Gen:Heur.Whisperer.1.0000000400 (B)
Ikarus Trojan.Win64.Cobaltstrike
GData Gen:Heur.Whisperer.1.0000000400
Jiangmin Clean
Webroot Clean
Varist Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Whisperer.1.0000000400
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win64.CobaltStrike.gen
Microsoft Trojan:Win64/CobaltStrike.BL!MTB
Google Detected
AhnLab-V3 Clean
Acronis suspicious
BitDefenderTheta Clean
MAX malware (ai score=80)
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Clean
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Clean
Fortinet Clean
AVG Clean
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Clean
No IRMA results available.