Static | ZeroBOX

PE Compile Time

2024-09-19 14:47:01

PE Imphash

1299062c7b29ddbc3d30daa2b2edea43

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00018e38 0x00019000 5.98212755697
.data 0x0001a000 0x000009f0 0x00000a00 3.82528735633
.rdata 0x0001b000 0x00000820 0x00000a00 4.55844669653
.pdata 0x0001c000 0x0000021c 0x00000400 2.57093827228
.xdata 0x0001d000 0x00000194 0x00000200 3.18471005288
.bss 0x0001e000 0x00000190 0x00000000 0.0
.edata 0x0001f000 0x00000036 0x00000200 0.53832580461
.idata 0x00020000 0x00000610 0x00000800 3.32802603558
.CRT 0x00021000 0x00000060 0x00000200 0.286559824313
.tls 0x00022000 0x00000010 0x00000200 0.0
.reloc 0x00023000 0x00000154 0x00000200 3.93116610009

Imports

Library ADVAPI32.dll:
0x1400201a8 SetServiceStatus
Library KERNEL32.dll:
0x1400201c0 DeleteCriticalSection
0x1400201c8 EnterCriticalSection
0x1400201d0 GetLastError
0x1400201d8 GetStartupInfoA
0x1400201e8 LeaveCriticalSection
0x1400201f8 Sleep
0x140020200 TlsGetValue
0x140020208 VirtualProtect
0x140020210 VirtualQuery
Library msvcrt.dll:
0x140020220 __C_specific_handler
0x140020228 __initenv
0x140020230 __iob_func
0x140020238 __getmainargs
0x140020240 __set_app_type
0x140020248 _acmdln
0x140020250 __setusermatherr
0x140020258 _amsg_exit
0x140020260 _cexit
0x140020268 _commode
0x140020270 _fmode
0x140020278 memcpy
0x140020280 _initterm
0x140020288 _onexit
0x140020290 abort
0x140020298 calloc
0x1400202a0 exit
0x1400202a8 fprintf
0x1400202b0 free
0x1400202b8 fwrite
0x1400202c0 malloc
0x1400202c8 signal
0x1400202d0 strlen
0x1400202d8 strncmp
0x1400202e0 vfprintf

!This program cannot be run in DOS mode.
`.data
.rdata
@.pdata
@.xdata
.edata
@.idata
.reloc
AUATUWVSH
[^_]A\A]
[^_]A\A]
UAWAVAUATWVSH
[^_A\A]A^A_]
AUATWVSH
[^_A\A]H
ATWVSH
([^_A\
([^_A\
:MZuWHcB<H
[^_]A\
AWAVAUATL
[^_A\A]A^A_]
AVAUATUH
[^_]A\A]A^A_
([^_A\
@[^_]A\
[A\A]A^
AUATUWVSH
0[^_]A\A]A^
ATUWV1
[^_]A\
8[^_A\
H[^_]A\A]A^A_
AVAUATE1
^_]A\A]A^
AWAVAUATUWVSH
D$0fA9
H[^_]A\A]A^A_
H[^_]A\A]A^A_
AWAVE1
AUATE1
X[^_]A\A]A^A_
[^_]A\A]A^A_
H[^_]A\A]A^A_
H[^_]A\A]A^A_
AWAVAUATWVSH
[^_A\A]A^A_]
AUATUWVSH
@[^_]A\A]A^
AWAVAUI
ATWVSH
[^_A\A]A^A_
AVAUATUWVSH
[^_]A\A]A^A_
AWAVAUATWVSH
[^_A\A]A^A_]
AWAVAUI
ATUWVSH
[^_]A\A]A^A_
[^_]A\A]A^A_
AVAUATI
_A\A]A^
AVAUATI
x[^_]A\A]A^A_
AVAUATWVSH
`[^_A\A]A^A_
[A\A]A^
AWAVAUATI
[^_]A\A]A^A_
AWAVAUI
8A\A]A^A_
AWAVAUI
ATUWVSH
L$hD9t$Xv1H
L$hD9|$Xv
x[^_]A\A]A^A_
L$h9|$XvK
L$h9\$\v(
D$hD9l$\v
L$h9\$Xv!
[^_]A\A]A^A_
tGD9#t
[_A\A]]
[_A\A]]
AWAVAUI
ATWVSH
[^_A\A]A^A_]
AUATUWVSH
h[^_]A\A]A^A_
AWAVAUI
ATWVSH
u8D91u3D
[^_A\A]A^A_]
[^_A\A]A^A_]
[^_A\A]A^A_]
[_A\A]
AWAVAUI
ATUWVSH
l$hA9}
T$h9t$dv
[^_]A\A]A^A_
[^_]A\A]A^A_
AUATSH
[A\A]A^
AVAUATUWVSH
X[^_]A\A]A^A_
[^_]A\
AUATWSH
[_A\A]A^
AWAVAUI
ATUWVH
[^_]A\A]A^A_
[^_]A\A]
AWAVAUATWVSH
9D$d~7H
[^_A\A]A^A_]
AUATUWVSH
T$<H)S
H[^_]A\A]
AUATWL
[^_A\A]A^A_]
AVAUATI
0[^_]A\A]A^
AWAVAUATUWVSH
[^_]A\A]A^A_
AWAVE1
[^_]A\A]A^A_
AVAUATA
9t$$v7H
[^_]A\A]A^
AWAVAUATUWVL
[^_]A\A]A^A_
t HcA<
[^_A\A]
AWAVAUATI
[^_]A\A]A^A_
[^_]A\A]A^A_
AWAVAUI
[^_]A\A]A^A_
AVAUATUH
[^_]A\A]A^A_
([^_A\A]A^
AVAUATI
[^_]A\A]A^
AUATWVH
[^_A\A]A^]
?f9L$*r
?f9\$*
AWAVAUATI
[^_]A\A]A^A_
[A\A]A^
[^_]A\
AWAVAUE1
ATUWVSH
X[^_]A\A]A^A_
AWAVE1
AUATE1
[^_]A\A]A^A_
AVAUATI
[^_A\A]A^A_]
AWAVAUATUWVSH
X[^_]A\A]A^A_
AVAUATUH
[^_]A\A]A^
[^_]A\
AWAVE1
AUATUWVSH
[^_]A\A]A^A_
AUATUWVSH
[^_]A\A]
H[^A\A]
A\A]A^
[^_]A\
[^_]A\A]A^
A\A]A^
[^_]A\A]A^
[^_]A\
[^_A\A]A^A_]
AWAVAUATUWVSH
H[^_]A\A]A^A_
ATWVSH
([^_A\
AVAUATE1
[^_]A\A]A^A_
[^_]A\A]A^
AVAUATI
[^_]A\A]A^
AWAVAUATUWVH
H[^_]A\A]A^A_
P[^_]A\
([^_]A\A]
BTD9J8u
Q8D9P8u
[^_]A\
ATUWVSH
?f9t$*v
[^_]A\
ATUWVSH
p[^_]A\
AWAVAUATI
[^_A\A]A^A_]
AWAVAUATUWVSH
X[^_]A\A]A^A_
\$8uzH
AVAUATUWVSH
x[^_]A\A]A^A_
X[^_A\
AUATE1
D$8H9D$h
H9D$xu
[^_A\A]A^A_]
AWAVAUATWVSH
[^_A\A]A^A_]
[^_]A\
@[^_A\A]
AWAVAUATUWVSH
[^_]A\A]A^A_
ATWVSH
4$H90u
([^_A\
AUATUWVSH
[^_]A\A]
AWAVAUATUWV1
[^_]A\A]A^A_
AVAUATUWVH
[^_]A\A]A^A_
DemonSvc
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
Partial loss of significance (PLOSS)
Total loss of significance (TLOSS)
The result is too small to be represented (UNDERFLOW)
Unknown error
_matherr(): %s in %s(%g, %g) (retval=%g)
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
demon.x64.exe
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
DeleteCriticalSection
EnterCriticalSection
GetLastError
GetStartupInfoA
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
TlsGetValue
VirtualProtect
VirtualQuery
__C_specific_handler
__initenv
__iob_func
__getmainargs
__set_app_type
_acmdln
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
memcpy
_initterm
_onexit
calloc
fprintf
fwrite
malloc
signal
strlen
strncmp
vfprintf
ADVAPI32.dll
KERNEL32.dll
msvcrt.dll
C:\Windows\System32\notepad.exe
C:\Windows\SysWOW64\notepad.exe
comms.lovebank.co.za
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
BidvestBank Internetbanking
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Havokiz.m!c
Elastic Windows.Trojan.Generic
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Trojan.Demon.S33863801
ALYac Generic.Trojan.Havokiz.Marte.D.C613B948
Cylance Clean
Zillya Clean
Sangfor Trojan.Win64.Havoc.V2a1
CrowdStrike win/malicious_confidence_70% (D)
Alibaba Trojan:Win32/Havoc.5c505639
K7GW Clean
K7AntiVirus Trojan ( 005aabc71 )
huorong Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win64/Havoc.F
APEX Malicious
Avast Win64:Evo-gen [Trj]
ClamAV Win.Malware.Havoc-10019364-0
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Generic.Trojan.Havokiz.Marte.D.C613B948
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Generic.Trojan.Havokiz.Marte.D.C613B948
Tencent Trojan.Win64.Havoc.16001250
Sophos ATK/Havoc-H
F-Secure Heuristic.HEUR/AGEN.1375506
DrWeb Clean
VIPRE Generic.Trojan.Havokiz.Marte.D.C613B948
TrendMicro TROJ_GEN.R002C0DJB24
McAfeeD ti!A87EC35FFA4D
Trapmine Clean
CTX exe.trojan.havoc
Emsisoft Generic.Trojan.Havokiz.Marte.D.C613B948 (B)
Ikarus Trojan.Win64.Havoc
FireEye Generic.Trojan.Havokiz.Marte.D.C613B948
Jiangmin Clean
Webroot Clean
Varist Clean
Avira HEUR/AGEN.1375506
Antiy-AVL Trojan/Win64.Havoc
Kingsoft Clean
Gridinsoft Trojan.Win64.Agent.sa
Xcitium Clean
Arcabit Generic.Trojan.Havokiz.Marte.D.C613B948
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Havoc.C
Google Detected
AhnLab-V3 Malware/Win.Havokiz.C5305048
Acronis Clean
VBA32 Clean
TACHYON Clean
Malwarebytes Generic.Malware/Suspicious
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0DJB24
Rising HackTool.Havokiz!8.16DCF (TFE:2:aNXqsYGs0SG)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet Clean
AVG Win64:Evo-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Backdoor:Win/Havoc.L
No IRMA results available.