Static | ZeroBOX

PE Compile Time

1970-01-01 09:00:00

PE Imphash

147442e63270e287ed57d33257638324

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000020a8 0x00002200 5.92086855321
.data 0x00004000 0x000004f0 0x00000600 5.90136941265
.rdata 0x00005000 0x00000910 0x00000a00 4.47291266022
.pdata 0x00006000 0x000002b8 0x00000400 2.96686532075
.xdata 0x00007000 0x00000238 0x00000400 2.63377537785
.bss 0x00008000 0x000009d0 0x00000000 0.0
.idata 0x00009000 0x000008d8 0x00000a00 3.70836070693
.CRT 0x0000a000 0x00000068 0x00000200 0.27091922826
.tls 0x0000b000 0x00000010 0x00000200 0.0

Imports

Library KERNEL32.dll:
0x409224 CloseHandle
0x40922c ConnectNamedPipe
0x409234 CreateFileA
0x40923c CreateNamedPipeA
0x409244 CreateThread
0x40925c GetCurrentProcess
0x409264 GetCurrentProcessId
0x40926c GetCurrentThreadId
0x409274 GetLastError
0x40927c GetModuleHandleA
0x409284 GetProcAddress
0x40928c GetStartupInfoA
0x40929c GetTickCount
0x4092bc ReadFile
0x4092c4 RtlAddFunctionTable
0x4092cc RtlCaptureContext
0x4092dc RtlVirtualUnwind
0x4092ec Sleep
0x4092f4 TerminateProcess
0x4092fc TlsGetValue
0x40930c VirtualAlloc
0x409314 VirtualProtect
0x40931c VirtualQuery
0x409324 WriteFile
Library msvcrt.dll:
0x40933c __getmainargs
0x409344 __initenv
0x40934c __iob_func
0x409354 __lconv_init
0x40935c __set_app_type
0x409364 __setusermatherr
0x40936c _acmdln
0x409374 _amsg_exit
0x40937c _cexit
0x409384 _fmode
0x40938c _initterm
0x409394 _onexit
0x40939c abort
0x4093a4 calloc
0x4093ac exit
0x4093b4 fprintf
0x4093bc free
0x4093c4 fwrite
0x4093cc malloc
0x4093d4 memcpy
0x4093dc signal
0x4093e4 sprintf
0x4093ec strlen
0x4093f4 strncmp
0x4093fc vfprintf

!This program cannot be run in DOS mode.
P`.data
.rdata
`@.pdata
0@.xdata
0@.bss
.idata
AUATUWVSH
[^_]A\A]
[^_]A\A]
ATUWVSH
@[^_]A\
ATWVSH
X[^_A\
ATWVSH
X[^_A\
ATUWVSH
0[^_]A\
0[^_]A\
ATUWVSH
PHc=Ch
P[^_]A\
P[^_]A\
UAWAVAUATWVSH
[^_A\A]A^A_]
ATUWVSH
[^_]A\
ATWVSH
([^_A\H
tNHcA<H
tTIcB<L
tCHcA<H
tKIcA<L
tSIcK<L
s1AIs1j
U2`+ 2
j(.J2`+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
%c%c%c%c%c%c%c%c%cMSSE-%d-server
Unknown error
Argument domain error (DOMAIN)
Overflow range error (OVERFLOW)
Partial loss of significance (PLOSS)
Total loss of significance (TLOSS)
The result is too small to be represented (UNDERFLOW)
Argument singularity (SIGN)
_matherr(): %s in %s(%g, %g) (retval=%g)
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
.pdata
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.3-win32 20200320
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.2-win32 20191008
GCC: (GNU) 9.3-win32 20200320
CloseHandle
ConnectNamedPipe
CreateFileA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
__C_specific_handler
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
calloc
fprintf
fwrite
malloc
memcpy
signal
sprintf
strlen
strncmp
vfprintf
KERNEL32.dll
msvcrt.dll
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.CobaltStrike.4!c
Elastic Windows.Trojan.CobaltStrike
ClamAV Win.Trojan.CobaltStrike-9044898-1
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.Trojan.lm
ALYac Dump:Generic.ShellCode.Marte.2.281E5E21
Cylance Unsafe
Zillya Trojan.CobaltStrike.Win64.13786
Sangfor Trojan.Win32.CobaltStrike
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Backdoor:Win64/Artifact.eda1b728
K7GW Trojan ( 00580b4c1 )
K7AntiVirus Trojan ( 00580b4c1 )
huorong Backdoor/CobaltStrike.d
Baidu Clean
VirIT Trojan.Win64.Genus.BRF
Paloalto generic.ml
Symantec Backdoor.Cobalt
tehtris Clean
ESET-NOD32 a variant of Win64/CobaltStrike.Artifact.A
APEX Malicious
Avast Win64:Evo-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Dump:Generic.ShellCode.Marte.2.281E5E21
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Dump:Generic.ShellCode.Marte.2.281E5E21
Tencent Trojan.Win64.Cobalstrike.ya
Sophos ATK/Cobalt-A
F-Secure Heuristic.HEUR/AGEN.1345031
DrWeb BackDoor.CobaltStrike.46
VIPRE Dump:Generic.ShellCode.Marte.2.281E5E21
TrendMicro Backdoor.Win64.COBEACON.SMA
McAfeeD ti!2D4791C66DB3
Trapmine Clean
CTX exe.trojan.cobaltstrike
Emsisoft Dump:Generic.ShellCode.Marte.2.281E5E21 (B)
Ikarus Trojan.Win64.Cobaltstrike
FireEye Generic.mg.5cebc6552eb1d066
Jiangmin Trojan.CozyDuke.dk
Webroot W32.Malware.Gen
Varist W64/Kryptik.GRO
Avira HEUR/AGEN.1345031
Fortinet W64/Kryptik.BVR!tr
Antiy-AVL RiskWare/Win64.Artifact
Kingsoft malware.kb.a.860
Gridinsoft Trojan.Win64.Kryptik.oa!s1
Xcitium Malware@#1bbb05n8tpb2i
Arcabit Dump:Generic.ShellCode.Marte.2.281E5E21
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win64.CobaltStrike.gen
Microsoft Trojan:Win64/Cobaltstrike.RPX!MTB
Google Detected
AhnLab-V3 Malware/Win64.RL_Backdoor.R363496
Acronis Clean
McAfee CobaltStrike-so!5CEBC6552EB1
TACHYON Trojan/W64.CobaltStrike.19456
VBA32 Backdoor.Win64.CobaltStrike
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Backdoor.Win64.COBEACON.SMA
Rising Backdoor.CobaltStrike/x64!1.E382 (CLASSIC)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.117975280.susgen
GData Dump:Generic.ShellCode.Marte.2.281E5E21
AVG Win64:Evo-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Backdoor:Win/CobaltStrike.B
No IRMA results available.