Static | ZeroBOX

PE Compile Time

2015-05-13 02:15:47

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x00000bf4 0x00000c00 5.16605860787
.sdata 0x00004000 0x0000011c 0x00000200 4.26510978168
.rsrc 0x00006000 0x000002e0 0x00000400 2.33721237504
.reloc 0x00008000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x00006058 0x00000288 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.sdata
@.reloc
v2.0.50727
#Strings
<Module>
Program
Sample
PROCESSOR_INFO
MEM_COMMIT
PAGE_EXECUTE_READWRITE
MEM_RELEASE
Uninstall
VirtualAlloc
VirtualFree
CreateThread
CloseHandle
WaitForSingleObject
GetModuleHandle
GetProcAddress
LoadLibrary
GetLastError
dwStandard
dwFeature
Object
System
Console
WriteLine
RunInstallerAttribute
System.ComponentModel
.cctor
Installer
System.Configuration.Install
savedState
<PrivateImplementationDetails>{b4a65d39-f0a8-421a-a52c-c9d76b1aca09}
$ArrayType=284
$field-0
RuntimeHelpers
System.Runtime.CompilerServices
InitializeArray
RuntimeFieldHandle
IntPtr
op_Explicit
Marshal
System.Runtime.InteropServices
GetTypeFromHandle
RuntimeTypeHandle
SizeOf
AllocHGlobal
StructureToPtr
PtrToStructure
FreeHGlobal
kernel32
lpStartAddr
flAllocationType
flProtect
lpAddress
dwSize
dwFreeType
lpThreadAttributes
dwStackSize
lpStartAddress
dwCreationFlags
lpThreadId
handle
hHandle
dwMilliseconds
moduleName
hModule
procName
lpFileName
CompilerGeneratedAttribute
IDictionary
System.Collections
ValueType
script
RuntimeCompatibilityAttribute
mscorlib
script.exe
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
D$$[[aYZQ
hws2_ThLw&
PPPP@P@Ph
Hello From Main...I Don't Do Anything
Hello From Uninstall...I carry out the real work...
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
007f04b0
Comments
CompanyName
FileDescription
FileVersion
0.0.0.0
InternalName
script
LegalCopyright
LegalTrademarks
OriginalFilename
script.exe
ProductName
ProductVersion
Antivirus Signature
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Marte.4!c
Elastic Windows.Trojan.Metasploit
ClamAV Win.Trojan.MSShellcode-7
CMC Clean
CAT-QuickHeal Clean
Skyhigh Trojan-Veil-FLRI!308D9BEAB0EC
ALYac Generic.ShellCode.Marte.H.131E2AA9
Cylance Unsafe
Sangfor HackTool.Win32.Reverse_Bin_v2_5_through_v4_x.uwccg
CrowdStrike win/malicious_confidence_100% (W)
Alibaba VirTool:MSIL/Meterpreter.7bf47c98
K7GW Trojan ( 004d65ce1 )
K7AntiVirus Trojan ( 004d65ce1 )
huorong Backdoor/Meterpreter.ak
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec Meterpreter
tehtris Clean
ESET-NOD32 a variant of MSIL/Rozena.T
APEX Malicious
Avast Win32:Swrort-S [Trj]
Cynet Clean
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Generic.ShellCode.Marte.H.131E2AA9
NANO-Antivirus Trojan.Win32.Kryptik.entlde
ViRobot Clean
MicroWorld-eScan Generic.ShellCode.Marte.H.131E2AA9
Tencent Win32.Trojan.Generic.Ddhl
Sophos Troj/Rozena-D
F-Secure Heuristic.HEUR/AGEN.1308546
DrWeb Clean
VIPRE Generic.ShellCode.Marte.H.131E2AA9
TrendMicro Backdoor.Win32.COBEACON.SMD
McAfeeD ti!3570EAB57AC5
Trapmine suspicious.low.ml.score
CTX exe.trojan.meterpreter
Emsisoft Generic.ShellCode.Marte.H.131E2AA9 (B)
Ikarus Trojan.MSIL.Crypt
FireEye Generic.mg.308d9beab0eccfd8
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist W32/ABTrojan.AVHM-1542
Avira HEUR/AGEN.1308546
Fortinet W32/Rozena.D!tr
Antiy-AVL Trojan/Win32.Rozena.ed
Kingsoft malware.kb.c.1000
Gridinsoft Clean
Xcitium Malware@#1553555a3jiqc
Arcabit Generic.ShellCode.Marte.H.131E2AA9
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win32.Generic
Microsoft VirTool:MSIL/Meterpreter.G!MTB
Google Detected
AhnLab-V3 Malware/Win32.RL_Generic.C4286713
Acronis Clean
McAfee Trojan-Veil-FLRI!308D9BEAB0EC
TACHYON Clean
VBA32 Clean
Malwarebytes Malware.AI.3817415780
Panda Trj/CI.A
Zoner Clean
TrendMicro-HouseCall Clean
Rising HackTool.Swrort!1.6477 (CLASSIC)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
GData Generic.ShellCode.Marte.H.131E2AA9
AVG Win32:Swrort-S [Trj]
DeepInstinct MALICIOUS
alibabacloud Backdoor:Win/CobaltStrike.reverse.A
No IRMA results available.