Static | ZeroBOX

PE Compile Time

2024-03-18 15:59:46

PE Imphash

2fe71839ceddb4efe940c5cf91ea178e

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00007d28 0x00007e00 6.26509470099
.data 0x00009000 0x000004e0 0x00000600 6.0248885397
.rdata 0x0000a000 0x00000e30 0x00001000 4.29394479715
.pdata 0x0000b000 0x00000654 0x00000800 3.65660178633
.xdata 0x0000c000 0x00000558 0x00000600 3.87014372366
.bss 0x0000d000 0x00002b60 0x00000000 0.0
.idata 0x00010000 0x00000838 0x00000a00 3.58037940272
.CRT 0x00011000 0x00000060 0x00000200 0.286559824313
.tls 0x00012000 0x00000010 0x00000200 0.0
.rsrc 0x00013000 0x000003e8 0x00000400 3.32483040964
.reloc 0x00014000 0x00000080 0x00000200 1.5153978675

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00013058 0x0000038c LANG_ENGLISH SUBLANG_ENGLISH_US PGP symmetric key encrypted data - Plaintext or unencrypted data

Imports

Library KERNEL32.dll:
0x140010218 DeleteCriticalSection
0x140010220 EnterCriticalSection
0x140010228 GetCurrentProcess
0x140010230 GetLastError
0x140010238 GetModuleHandleA
0x140010240 GetProcAddress
0x140010248 GetTickCount
0x140010250 HeapAlloc
0x140010258 HeapCreate
0x140010260 HeapReAlloc
0x140010270 IsDBCSLeadByteEx
0x140010278 LeaveCriticalSection
0x140010280 MultiByteToWideChar
0x140010290 Sleep
0x140010298 TlsGetValue
0x1400102a0 VirtualProtect
0x1400102a8 VirtualQuery
0x1400102b0 WaitForSingleObject
0x1400102b8 WideCharToMultiByte
Library msvcrt.dll:
0x1400102c8 __C_specific_handler
0x1400102d0 ___lc_codepage_func
0x1400102d8 ___mb_cur_max_func
0x1400102e0 __getmainargs
0x1400102e8 __initenv
0x1400102f0 __iob_func
0x1400102f8 __set_app_type
0x140010300 __setusermatherr
0x140010308 _amsg_exit
0x140010310 _cexit
0x140010318 _commode
0x140010320 _errno
0x140010328 _fmode
0x140010330 _initterm
0x140010338 _onexit
0x140010340 abort
0x140010348 calloc
0x140010350 exit
0x140010358 fprintf
0x140010360 fputc
0x140010368 free
0x140010370 fwrite
0x140010378 localeconv
0x140010380 malloc
0x140010388 mbstowcs
0x140010390 memcpy
0x140010398 memset
0x1400103a0 rand
0x1400103a8 signal
0x1400103b0 strerror
0x1400103b8 strlen
0x1400103c0 strncmp
0x1400103c8 vfprintf
0x1400103d0 wcslen
0x1400103d8 wcsncat
0x1400103e0 wcsncpy

!This program cannot be run in DOS mode.
`.data
.rdata
@.pdata
@.xdata
.idata
@.reloc
ATUWVSH
[^_]A\
[^_]A\
ATUWVSH
p[^_]A\
AUATUWVSH
tEHcJ<
([^_]A\A]
UAWAVAUATWVSH
[^_A\A]A^A_]
ATUWVSH
[^_]A\H
:MZuYHcB<H
C$9C(~
u HcS$
AWAVAUATUWVSH
C$9C(~
H[^_]A\A]A^A_
S$9S(~
S$9S(~
UAWAVAUATWVSH
[^_A\A]A^A_]
C$9C(~
C$9C(~
UAWAVAUATWVSH
C$9C(~
S$9S(~
[^_A\A]A^A_]
UATWVSH
C$9C(~
[^_A\]
[^_A\]
=UUUUw
S$9S(~
AUATUWVSH
X[^_]A\A]
AWAVAUATUWVSH
[^_]A\A]A^A_
AWAVAUATUWVSH
8[^_]A\A]A^A_
AWAVAUATUWVSH
[^_]A\A]A^A_
[^_]A\A]A^A_
D$xA;E
ATUWVSHcY
[^_]A\
[^_]A\
AWAVAUATUWVSH
([^_]A\A]A^A_
AVAUATUWVSH
[^_]A\A]A^
AVAUATUWVSH
[^_]A\A]A^
WVSHcA
AVAUATUWVSH
0[^_]A\A]A^
ATUWVSH
@[^_]A\
AVAUATUWVSH
@[^_]A\A]A^
pOcGnA
N
%c%c%c%c%c%c%c%c%cSoteriaSoteria\%d
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
Partial loss of significance (PLOSS)
Total loss of significance (TLOSS)
The result is too small to be represented (UNDERFLOW)
Unknown error
_matherr(): %s in %s(%g, %g) (retval=%g)
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
(null)
Infinity
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
GCC: (GNU) 12-win32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetTickCount
HeapAlloc
HeapCreate
HeapReAlloc
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
SetUnhandledExceptionFilter
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
calloc
fprintf
fwrite
localeconv
malloc
mbstowcs
memcpy
memset
signal
strerror
strlen
strncmp
vfprintf
wcslen
wcsncat
wcsncpy
KERNEL32.dll
msvcrt.dll
(null)
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Windows Explorer
FileVersion
10.0.19041.1266 (WinBuild.160101.0800)
InternalName
explorer
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
EXPLORER.EXE
ProductName
Microsoft
Windows
Operating System
ProductVersion
10.0.19041.1266
VarFileInfo
Translation
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Clean
tehtris Clean
ClamAV Win.Trojan.CobaltStrike-9044898-1
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Clean
Cylance Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason malicious.0e1e8a
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec Clean
ESET-NOD32 a variant of Win64/Kryptik_AGen.LR
APEX Malicious
Avast Clean
Cynet Clean
Kaspersky HEUR:Trojan.Win64.CobaltStrike.gen
BitDefender Gen:Heur.Whisperer.1.0000000400
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Heur.Whisperer.1.0000000400
Tencent Trojan.Win32.CobaltStrike.16001072
TACHYON Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
VIPRE Gen:Heur.Whisperer.1.0000000400
TrendMicro Clean
McAfeeD Clean
Trapmine Clean
FireEye Gen:Heur.Whisperer.1.0000000400
Emsisoft Gen:Heur.Whisperer.1.0000000400 (B)
huorong Clean
GData Gen:Heur.Whisperer.1.0000000400
Jiangmin Clean
Webroot Clean
Varist Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Whisperer.1.0000000400
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win64.CobaltStrike.gen
Microsoft Trojan:Win64/CobaltStrike.BL!MTB
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
MAX malware (ai score=86)
VBA32 Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Clean
Yandex Clean
Ikarus Trojan.Win64.Cobaltstrike
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG Clean
DeepInstinct Clean
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Clean
No IRMA results available.