Static | ZeroBOX

PE Compile Time

2020-06-09 09:17:15

PE Imphash

dc25ee78e2ef4d36faa0badf1e7461c9

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001d44 0x00001e00 5.87033837303
.data 0x00003000 0x00000424 0x00000600 5.42172835436
.rdata 0x00004000 0x000002f4 0x00000400 4.36563919678
.bss 0x00005000 0x0000045c 0x00000000 0.0
.idata 0x00006000 0x000006ec 0x00000800 4.20101165417
.CRT 0x00007000 0x00000034 0x00000200 0.249129902058
.tls 0x00008000 0x00000020 0x00000200 0.22482003451

Imports

Library KERNEL32.dll:
0x406138 CloseHandle
0x40613c ConnectNamedPipe
0x406140 CreateFileA
0x406144 CreateNamedPipeA
0x406148 CreateThread
0x406154 FreeLibrary
0x406158 GetCurrentProcess
0x40615c GetCurrentProcessId
0x406160 GetCurrentThreadId
0x406164 GetLastError
0x406168 GetModuleHandleA
0x40616c GetProcAddress
0x406170 GetStartupInfoA
0x406178 GetTickCount
0x406184 LoadLibraryA
0x406188 LoadLibraryW
0x406190 ReadFile
0x406198 Sleep
0x40619c TerminateProcess
0x4061a0 TlsGetValue
0x4061a8 VirtualAlloc
0x4061ac VirtualProtect
0x4061b0 VirtualQuery
0x4061b4 WriteFile
Library msvcrt.dll:
0x4061bc __dllonexit
0x4061c0 __getmainargs
0x4061c4 __initenv
0x4061c8 __lconv_init
0x4061cc __set_app_type
0x4061d0 __setusermatherr
0x4061d4 _acmdln
0x4061d8 _amsg_exit
0x4061dc _cexit
0x4061e0 _fmode
0x4061e4 _initterm
0x4061e8 _iob
0x4061ec _lock
0x4061f0 _onexit
0x4061f4 _unlock
0x4061f8 _winmajor
0x4061fc abort
0x406200 calloc
0x406204 exit
0x406208 fprintf
0x40620c free
0x406210 fwrite
0x406214 malloc
0x406218 memcpy
0x40621c signal
0x406220 sprintf
0x406224 strlen
0x406228 strncmp
0x40622c vfprintf

!This program cannot be run in DOS mode.
P`.data
.rdata
0@.bss
.idata
3l$(3l$,1
h}PtXk
oC3nq(
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
_set_invalid_parameter_handler
libgcj-12.dll
_Jv_RegisterClasses
%c%c%c%c%c%c%c%c%cMSSE-%d-server
mingwm10.dll
__mingwthr_remove_key_dtor
__mingwthr_key_dtor
Unknown error
_matherr(): %s in %s(%g, %g) (retval=%g)
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
The result is too small to be represented (UNDERFLOW)
Total loss of significance (TLOSS)
Partial loss of significance (PLOSS)
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
CloseHandle
ConnectNamedPipe
CreateFileA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
QueryPerformanceCounter
ReadFile
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
_unlock
_winmajor
calloc
fprintf
fwrite
malloc
memcpy
signal
sprintf
strlen
strncmp
vfprintf
KERNEL32.dll
msvcrt.dll
msvcrt.dll
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Sheljector.trJD
Elastic Windows.Trojan.CobaltStrike
ClamAV Win.Trojan.CobaltStrike-7899872-1
CMC Clean
CAT-QuickHeal Trojan.GenericPMF.S22096310
Skyhigh BehavesLike.Win32.Trojan.lm
ALYac Trojan.GenericKDZ.80482
Cylance Unsafe
Zillya Trojan.Rozena.Win32.99309
Sangfor Trojan.Win32.CobaltStrike
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/Rozena.12cc
K7GW Trojan ( 005622831 )
K7AntiVirus Trojan ( 005622831 )
huorong Backdoor/CobaltStrike.d
Baidu Clean
VirIT Trojan.Win32.Inject3.DZW
Paloalto generic.ml
Symantec Backdoor.Cobalt
tehtris Clean
ESET-NOD32 a variant of Win32/CobaltStrike.Artifact.A
APEX Malicious
Avast Win32:HacktoolX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.CobaltStrike.gen
BitDefender Trojan.GenericKDZ.80482
NANO-Antivirus Trojan.Win32.Inject3.horsiq
ViRobot Trojan.Win32.Cobalt.14336.J
MicroWorld-eScan Trojan.GenericKDZ.80482
Tencent Hacktool.Win32.CobaltStrike.za
Sophos ATK/Cobalt-A
F-Secure Trojan.TR/Crypt.XPACK.Gen7
DrWeb Trojan.Inject3.2700
VIPRE Trojan.GenericKDZ.80482
TrendMicro Trojan.Win32.COBALT.SM
McAfeeD ti!E68B138B56EC
Trapmine Clean
CTX exe.trojan.cobaltstrike
Emsisoft Trojan.Rozena (A)
Ikarus Trojan.Win32.CobaltStrike
FireEye Generic.mg.ac32f23e9c96c392
Jiangmin Trojan.Generic.ftawl
Webroot
Varist W32/CobaltStrike.RAUR-3469
Avira TR/Crypt.XPACK.Gen7
Fortinet W32/Rozena.SA!tr
Antiy-AVL Trojan/Win32.Wacatac
Kingsoft malware.kb.a.998
Gridinsoft Trojan.Win32.Heur.oa!s1
Xcitium Clean
Arcabit Trojan.Generic.D13A62
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.CobaltStrike.gen
Microsoft Backdoor:Win64/CobaltStrike!pz
Google Detected
AhnLab-V3 Trojan/Win32.CobaltStrike.R329694
Acronis Clean
McAfee Trojan-Cobalt!AC32F23E9C96
TACHYON Trojan/W32.Agent.14336.WO
VBA32 TScope.Malware-Cryptor.SB
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/CI.A
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.COBALT.SM
Rising Backdoor.CobaltStrike!1.D049 (CLASSIC)
Yandex Trojan.GenAsa!/C5jzoNrl5s
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
GData Win32.Trojan.PSE.PHVAWJ
AVG Win32:HacktoolX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Backdoor:Win/CobaltStrike.B
No IRMA results available.