Static | ZeroBOX

PE Compile Time

2024-03-31 23:21:52

PDB Path

C:\Users\User\source\repos\Loader\x64\Debug\Loader.pdb

PE Imphash

5f0d0057de3860edbc429c07d0073de1

PEiD Signatures

Microsoft Visual C++ V8.0 (Debug)

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.textbss 0x00001000 0x00010000 0x00000000 0.0
.text 0x00011000 0x00013d3a 0x00013e00 4.05915719827
.rdata 0x00025000 0x00006174 0x00006200 2.76691592104
.data 0x0002c000 0x00001668 0x00000800 1.99972571899
.pdata 0x0002e000 0x00002b44 0x00002c00 2.27378558226
.idata 0x00031000 0x00002674 0x00002800 4.10465759241
.msvcjmc 0x00034000 0x00000234 0x00000400 0.812822273616
.00cfg 0x00035000 0x00000175 0x00000200 0.474029545746
.rsrc 0x00036000 0x0000043c 0x00000600 2.13973793779
.reloc 0x00037000 0x00000415 0x00000600 1.70093099155

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00036170 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x140031070 CreateRemoteThread
0x140031078 OpenProcess
0x140031080 VirtualAlloc
0x140031088 VirtualAllocEx
0x140031090 WriteProcessMemory
0x140031098 ExitProcess
0x1400310a0 GetProcAddress
0x1400310a8 LoadLibraryA
0x1400310b0 CreateToolhelp32Snapshot
0x1400310b8 Process32FirstW
0x1400310c0 Process32NextW
0x1400310c8 VirtualQuery
0x1400310d0 GetCurrentProcess
0x1400310d8 CloseHandle
0x1400310e0 GetModuleHandleW
0x1400310e8 IsDebuggerPresent
0x1400310f0 GetProcessHeap
0x1400310f8 HeapFree
0x140031100 HeapAlloc
0x140031108 GetLastError
0x140031110 GetStartupInfoW
0x140031118 InitializeSListHead
0x140031120 GetSystemTimeAsFileTime
0x140031128 GetCurrentProcessId
0x140031130 QueryPerformanceCounter
0x140031140 TerminateProcess
0x140031150 UnhandledExceptionFilter
0x140031158 RtlVirtualUnwind
0x140031160 RtlLookupFunctionEntry
0x140031168 RtlCaptureContext
0x140031170 WideCharToMultiByte
0x140031178 MultiByteToWideChar
0x140031180 RaiseException
0x140031188 GetCurrentThreadId
0x140031190 FreeLibrary
Library ADVAPI32.dll:
0x140031000 AdjustTokenPrivileges
0x140031008 OpenProcessToken
0x140031010 LookupPrivilegeValueW
Library MSVCP140D.dll:
0x1400312b8 ?_Xbad_alloc@std@@YAXXZ
0x1400312d0 ??0_Lockit@std@@QEAA@H@Z
0x1400312d8 ??1_Lockit@std@@QEAA@XZ
Library WININET.dll:
0x140031538 InternetCloseHandle
0x140031540 InternetReadFile
0x140031548 InternetOpenW
0x140031550 InternetOpenUrlA
Library VCRUNTIME140D.dll:
0x140031408 __vcrt_LoadLibraryExW
0x140031410 __vcrt_GetModuleHandleW
0x140031428 __current_exception
0x140031440 __std_exception_destroy
0x140031448 __C_specific_handler
0x140031450 _CxxThrowException
0x140031458 __std_exception_copy
0x140031460 memmove
0x140031468 memcpy
Library VCRUNTIME140_1D.dll:
0x1400314d8 __CxxFrameHandler4
Library ucrtbased.dll:
0x1400315b0 _CrtDbgReport
0x1400315b8 _free_dbg
0x1400315c0 _malloc_dbg
0x1400315c8 _callnewh
0x1400315d0 _CrtDbgReportW
0x1400315d8 _seh_filter_exe
0x1400315e0 _set_app_type
0x1400315e8 __setusermatherr
0x1400315f0 _configure_narrow_argv
0x140031608 _initterm
0x140031610 _initterm_e
0x140031618 exit
0x140031620 _exit
0x140031628 _set_fmode
0x140031630 __p___argc
0x140031638 __p___argv
0x140031640 _cexit
0x140031648 _c_exit
0x140031658 _configthreadlocale
0x140031660 _set_new_mode
0x140031668 __p__commode
0x140031670 _seh_filter_dll
0x140031678 malloc
0x140031688 _execute_onexit_table
0x140031690 _crt_atexit
0x140031698 _crt_at_quick_exit
0x1400316a0 strcpy_s
0x1400316a8 strcat_s
0x1400316b0 terminate
0x1400316b8 _wmakepath_s
0x1400316c0 _wsplitpath_s
0x1400316c8 wcscpy_s
0x1400316d0 ungetc
0x1400316d8 setvbuf
0x1400316e0 rewind
0x1400316e8 fwrite
0x1400316f0 ftell
0x1400316f8 _fseeki64
0x140031700 fseek
0x140031708 fsetpos
0x140031710 fread
0x140031718 fputc
0x140031720 fopen
0x140031728 fgetpos
0x140031730 fgetc
0x140031738 fflush
0x140031740 fclose
0x140031750 _invalid_parameter
0x140031758 _stricmp
0x140031760 _unlock_file
0x140031768 _initialize_onexit_table
0x140031770 _lock_file

!This program cannot be run in DOS mode.
.textbss
`.rdata
@.data
.pdata
@.idata
@.msvcjmc4
.00cfg
@.rsrc
@.reloc
H+E(H;
L$ UWH
)HcEDH
EhH9EHt
D$pHc@
D$8HcD$ H
H9D$Hr
H9D$Hs
$Hc@<H
D$ H9D$(u
H;D$@v
@UVWAVH
VATAUAWH
(A_A]A\^
@SUWATAUAVAWH
A_A^A]A\_][
D$H9D$ s"
H3D$0H
H9D$ u
D$ Hc@<H
5Genu
5Auth
D$PfA9
fD9TDPt
USVWATAUAVH
u+L956
te+}o;>r^
A^A]A\_^[]
_Alloc_max
_Masked
fileSize
hToken
bytesRead
buffer
outFile
_Count_s
_Available
_Fileposition
output
_ArgList
_Psave
_Psave_guard
_New_capacity
_New_ptr
Unknown exception
bad array new length
invalid argument
C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.39.33519\include\xmemory
string too long
bad cast
GetCommandLineA
GetCommandLineW
__wgetmainargs
__getmainargs
ntdll.dll
NtUnmapViewOfSection
LoadLibraryA
KeeXPass.exe
C:\Users\Public\Documents\custom.dll
C:\Users\Public\Documents\program.exe
C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.39.33519\include\xstring
front() called on empty string
null pointer cannot point to a block of non-zero size
invalid string position
D:\a\_work\1\s\src\vctools\crt\github\stl\src\locale0.cpp
bad allocation
Stack around the variable '
' was corrupted.
The variable '
' is being used without being initialized.
The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention.
A cast to a smaller data type has caused a loss of data. If this was intentional, you should mask the source of the cast with the appropriate bitmask. For example:
char c = (i & 0xFF);
Changing the code in this way will not affect the quality of the resulting optimized code.
Stack memory was corrupted
A local variable was used before it was initialized
Stack memory around _alloca was corrupted
Unknown Runtime Check Error
Unknown Filename
Unknown Module Name
Run-Time Check Failure #%d - %s
Stack corrupted near unknown variable
Stack area around _alloca memory reserved by this function is corrupted
Data: <
Allocation number within this function:
Size:
Address: 0x
Stack area around _alloca memory reserved by this function is corrupted
%s%s%p%s%zd%s%d%s%s%s%s%s
A variable is being used without being initialized.
Stack pointer corruption
Cast to smaller type causing loss of data
Stack memory corruption
Local variable used before initialization
Stack around _alloca corrupted
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
PDBOpenValidate5
C:\Users\User\source\repos\Loader\x64\Debug\Loader.pdb
C:\Users\Public\Documents\custom.dll
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVbad_alloc@std@@
.?AVbad_cast@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AVtype_info@@
IsDebuggerPresent
CloseHandle
GetCurrentProcess
ExitProcess
CreateRemoteThread
OpenProcess
VirtualAlloc
VirtualAllocEx
WriteProcessMemory
GetModuleHandleW
GetProcAddress
LoadLibraryA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
KERNEL32.dll
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ADVAPI32.dll
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
MSVCP140D.dll
?_Xbad_alloc@std@@YAXXZ
InternetOpenW
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
WININET.dll
memcpy
memmove
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler4
__C_specific_handler
__C_specific_handler_noexcept
__std_type_info_destroy_list
__current_exception
__current_exception_context
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
VCRUNTIME140D.dll
VCRUNTIME140_1D.dll
_invalid_parameter
_get_stream_buffer_pointers
fclose
fflush
fgetpos
fsetpos
_fseeki64
fwrite
rewind
setvbuf
ungetc
_lock_file
_unlock_file
__stdio_common_vsprintf_s
malloc
_stricmp
_CrtDbgReport
_free_dbg
_malloc_dbg
_callnewh
_CrtDbgReportW
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
strcpy_s
strcat_s
terminate
_wmakepath_s
_wsplitpath_s
wcscpy_s
ucrtbased.dll
GetCurrentThreadId
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.39.33519\include\xmemory
"invalid argument"
SeDebugPrivilege
WinINetExample/1.0
Kernel32
C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.39.33519\include\xstring
"front() called on empty string"
"null pointer cannot point to a block of non-zero size"
Runtime Check Error.
Unable to display RTC Message.
Run-Time Check Failure #%d - %s
bin\amd64\MSPDB140.DLL
VCRUNTIME140D.dll
api-ms-win-core-registry-l1-1-0.dll
advapi32.dll
SOFTWARE\Wow6432Node\Microsoft\VisualStudio\14.0\Setup\VC
ProductDir
MSPDB140
MSPDB140
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.Win64.Kudj.ct
ALYac Trojan.GenericKD.74347499
Cylance Unsafe
Zillya Tool.Inject.Win64.473
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (D)
Alibaba HackTool:Win64/Inject.f3cb2ff0
K7GW Trojan ( 005a44c01 )
K7AntiVirus Trojan ( 005a44c01 )
huorong Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win64/HackTool.Inject.K
APEX Clean
Avast Win64:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky Clean
BitDefender Trojan.GenericKD.74347499
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.74347499
Tencent Malware.Win32.Gencirc.14141337
Sophos Mal/Generic-S
F-Secure Trojan.TR/Redcap.vpwbl
DrWeb Clean
VIPRE Trojan.GenericKD.74347499
TrendMicro Clean
McAfeeD ti!A26182AD8E56
Trapmine Clean
CTX exe.trojan.inject
Emsisoft Trojan.GenericKD.74347499 (B)
Ikarus Trojan.Win64.Spy
FireEye Generic.mg.47a0d90c01b43ed7
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist Clean
Avira TR/Redcap.vpwbl
Fortinet W64/Inject.K!tr
Antiy-AVL HackTool/Win64.Inject
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Generic.D46E73EB
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Program:Win32/Wacapew.C!ml
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!47A0D90C01B4
TACHYON Clean
VBA32 Clean
Malwarebytes Generic.Malware/Suspicious
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H0CDC24
Rising Trojan.Znyonm!8.18A3A (CLOUD)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.240991146.susgen
GData Trojan.GenericKD.74347499
AVG Win64:MalwareX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud HackTool:Win/Inject.K
No IRMA results available.