Static | ZeroBOX

PE Compile Time

2013-03-30 10:01:23

PE Imphash

423f01e9d2b066cd1b31541d1211d4ba

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00003928 0x00003a00 6.61166198793
.itext 0x00005000 0x000004b0 0x00000600 4.8923257688
.data 0x00006000 0x000007b0 0x00000800 1.26303430197
.bss 0x00007000 0x00002978 0x00000000 0.0
.idata 0x0000a000 0x000005de 0x00000600 4.42144115491
.tls 0x0000b000 0x00000008 0x00000000 0.0
.rdata 0x0000c000 0x00000018 0x00000200 0.20448815744
.reloc 0x0000d000 0x00000450 0x00000600 5.42663965008
.rsrc 0x0000e000 0x000024a8 0x00002600 6.61548106257

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0000eae8 0x00000568 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000eae8 0x00000568 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_RCDATA 0x0001024c 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x0001024c 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x0001024c 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x0001024c 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x0001027c 0x00000022 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x000102a0 0x00000207 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, ASCII text, with CRLF line terminators

Imports

Library advapi32.dll:
0x40a168 RegQueryValueExA
0x40a16c RegOpenKeyExA
0x40a170 RegCloseKey
Library user32.dll:
0x40a178 GetKeyboardType
0x40a17c DestroyWindow
0x40a180 MessageBoxA
Library kernel32.dll:
0x40a188 GetACP
0x40a18c Sleep
0x40a190 VirtualFree
0x40a194 VirtualAlloc
0x40a198 GetTickCount
0x40a1a0 GetCurrentThreadId
0x40a1a4 VirtualQuery
0x40a1a8 GetStartupInfoA
0x40a1ac GetCommandLineA
0x40a1b0 FreeLibrary
0x40a1b4 ExitProcess
0x40a1b8 WriteFile
0x40a1c0 RtlUnwind
0x40a1c4 RaiseException
0x40a1c8 GetStdHandle
Library kernel32.dll:
0x40a1d0 TlsSetValue
0x40a1d4 TlsGetValue
0x40a1d8 LocalAlloc
0x40a1dc GetModuleHandleA
Library user32.dll:
0x40a1e4 CharPrevA
Library kernel32.dll:
0x40a1ec WriteFile
0x40a1f0 WaitForSingleObject
0x40a1f4 SizeofResource
0x40a1f8 SetFileAttributesA
0x40a200 LockResource
0x40a204 LoadResource
0x40a20c GetFullPathNameA
0x40a210 GetFileAttributesA
0x40a214 GetExitCodeProcess
0x40a21c GetCurrentProcessId
0x40a220 GetCommandLineA
0x40a224 FreeResource
0x40a228 FreeLibrary
0x40a22c FindResourceA
0x40a230 DeleteFileA
0x40a234 CreateProcessA
0x40a238 CreateFileA
0x40a23c CloseHandle

This program must be run under Win32
`.itext
`.data
.idata
.rdata
@.reloc
B.rsrc
FastMM Borland Edition
2004, 2005 Pierre le Riche / Professional Software Development
An unexpected memory leak has occurred.
The unexpected small block leaks are:
bytes:
Unknown
String
The sizes of unexpected leaked medium and large blocks are:
Unexpected Memory Leak
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
_^[YY]
USERPROFILE
_^[YY]
xftjsrjsuyhew353y45y3e4r
SCRIPT
cmd.exe /c ""
Runtime error at 00000000
0123456789ABCDEF
0123456789ABCDEF
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
user32.dll
GetKeyboardType
DestroyWindow
MessageBoxA
kernel32.dll
GetACP
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
VirtualQuery
GetStartupInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
user32.dll
CharPrevA
kernel32.dll
WriteFile
WaitForSingleObject
SizeofResource
SetFileAttributesA
SetEnvironmentVariableA
LockResource
LoadResource
GetWindowsDirectoryA
GetFullPathNameA
GetFileAttributesA
GetExitCodeProcess
GetEnvironmentVariableA
GetCurrentProcessId
GetCommandLineA
FreeResource
FreeLibrary
FindResourceA
DeleteFileA
CreateProcessA
CreateFileA
CloseHandle
0"0*020:0B0J0R0Z0b0j0r0z0
3.3D3S3Z3e3u3
4 434>4I4X4q4
838<8r8|8
:!;+;B;
;(<2<8<O=_=i=
=7>G>Q>l>
3"3*333A3N3
8g8}8k9q9
:*;b;j;w;};
<)<:<O<\<|<
>%?5?K?i?
0*020H0`0n0
0+1X1a1
3G4o4v4
4#5-585I5
6,646`6l6
77)7.7M7R7r7
8%828G;a<r<
=2=?=K=R=\=f=u=
>0>@>Q>b>n>s>x>
?"?*?2?:?B?J?W?c?k?s?
2c2-3<3
4H4X4f4
4#585=5N5h5
6E6r6{6
7;7a7f7k7p7v7|7
7-838Q8Y8_8q8
00%0)0/060:0T0]0f0r0|0
1%1-121=1B1H1S1Y1h1n1x1
2/252O2U2[2e2k2w2|2
3+3H3R3X3]3f3u3z3
(0H0h0
,,,,88
,,,,,8
n,,,,,&
,,,,,&&
&&&&&&&&
&&&&&&&
&&&&&&
Ucoder
SysInit
System
CmnFunc2
KWindows
UTypes
2}#LJ2
}[9POB!\
a$dH7
h*!w#~
N7^oA?
PA<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.1.1.1"
processorArchitecture="X86"
name="[APP TO TEST WITH]"
type="win32"/>
<description>elevate execution level</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
DVCLAL
PACKAGEINFO
SCRIPT
MAINICON(
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Generic.4!c
Elastic Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win32.Generic.nh
ALYac Gen:Trojan.Heur.cKW@t5uwqPpiB
Cylance unsafe
Zillya Worm.AutoRun.Win32.119457
Sangfor Clean
CrowdStrike Clean
Alibaba Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 Clean
APEX Clean
Avast Win32:Malware-gen
Cynet Clean
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Trojan.Heur.cKW@t5uwqPpiB
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Trojan.Heur.cKW@t5uwqPpiB
Tencent Clean
TACHYON Clean
Sophos Clean
F-Secure Clean
DrWeb Trojan.Proxy.27884
VIPRE Gen:Trojan.Heur.cKW@t5uwqPpiB
TrendMicro Clean
Trapmine malicious.high.ml.score
FireEye Gen:Trojan.Heur.cKW@t5uwqPpiB
Emsisoft Gen:Trojan.Heur.cKW@t5uwqPpiB (B)
SentinelOne Static AI - Malicious PE
GData Gen:Trojan.Heur.cKW@t5uwqPpiB
Jiangmin Clean
Webroot Clean
Varist Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Heur.EC93B1
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Clean
Google Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
MAX malware (ai score=80)
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Win32.Generic.1936132D (C64:YzY0Onro+1sQRUHo)
Yandex Clean
Ikarus Clean
MaxSecure Trojan.Malware.300983.susgen
Fortinet Clean
BitDefenderTheta AI:Packer.36A18EAF1D
AVG Win32:Malware-gen
DeepInstinct MALICIOUS
alibabacloud Clean
No IRMA results available.