Static | ZeroBOX

PE Compile Time

2020-06-09 09:17:28

PE Imphash

17b461a082950fc6332228572138b80c

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000020f0 0x00002200 6.03397581892
.data 0x00004000 0x00042490 0x00042600 7.14547667181
.rdata 0x00047000 0x000002d0 0x00000400 4.00037373567
.pdata 0x00048000 0x0000027c 0x00000400 2.97342307908
.xdata 0x00049000 0x00000238 0x00000400 2.65379684452
.bss 0x0004a000 0x00000a30 0x00000000 0.0
.idata 0x0004b000 0x00000958 0x00000a00 4.1419693576
.CRT 0x0004c000 0x00000068 0x00000200 0.256446748701
.tls 0x0004d000 0x00000048 0x00000200 0.217769955458

Imports

Library KERNEL32.dll:
0x44b244 CloseHandle
0x44b24c ConnectNamedPipe
0x44b254 CreateFileA
0x44b25c CreateNamedPipeA
0x44b264 CreateThread
0x44b27c GetCurrentProcess
0x44b284 GetCurrentProcessId
0x44b28c GetCurrentThreadId
0x44b294 GetLastError
0x44b29c GetModuleHandleA
0x44b2a4 GetProcAddress
0x44b2ac GetStartupInfoA
0x44b2bc GetTickCount
0x44b2d4 LoadLibraryW
0x44b2e4 ReadFile
0x44b2ec RtlAddFunctionTable
0x44b2f4 RtlCaptureContext
0x44b304 RtlVirtualUnwind
0x44b314 Sleep
0x44b31c TerminateProcess
0x44b324 TlsGetValue
0x44b334 VirtualAlloc
0x44b33c VirtualProtect
0x44b344 VirtualQuery
0x44b34c WriteFile
Library msvcrt.dll:
0x44b364 __dllonexit
0x44b36c __getmainargs
0x44b374 __initenv
0x44b37c __iob_func
0x44b384 __lconv_init
0x44b38c __set_app_type
0x44b394 __setusermatherr
0x44b39c _acmdln
0x44b3a4 _amsg_exit
0x44b3ac _cexit
0x44b3b4 _fmode
0x44b3bc _initterm
0x44b3c4 _lock
0x44b3cc _onexit
0x44b3d4 _unlock
0x44b3dc abort
0x44b3e4 calloc
0x44b3ec exit
0x44b3f4 fprintf
0x44b3fc free
0x44b404 fwrite
0x44b40c malloc
0x44b414 memcpy
0x44b41c signal
0x44b424 sprintf
0x44b42c strlen
0x44b434 strncmp
0x44b43c vfprintf

!This program cannot be run in DOS mode.
P`.data
.rdata
P@.pdata
0@.xdata
0@.bss
.idata
ffffff.
ATUWVSH
[^_]A\
ATUWVSH
@[^_]A\
ATUWVSH
[^_]A\
ATUWVSH
@[^_]A\
ffffff.
AUATUWVSH
[^_]A\A]
[^_]A\A]
[^_]A\A]
ATWVSH
[^_A\]
ATUWVSH
@[^_]A\
L3d$0H
@[^_]A\
([^_]H
+N99]*
s)p]se
4_N$4W_
4_~<4_3L
1@8u=_
1L8u=_
1|8u=_
8uO,z/
oO,0o8
188u=_
oO$0k=
[4_4LB,:
s)pTs)y
0Y7$4Y>
D_nx>]o
8m0Yvx
8m0Yvx
D_nx>]o
w)9<s))$s)14~
4_nD4_t
0_vT0_|
0_vL0_|
0_~D4_nL4_vT
4_vD0_|
s/14s/)<w/
4_vDW$
=Y{$=_
T4_vD9_
0_~t4_vD=_
N84_vL9_
0_~t4_vL=_
N80_~|4_vD=_
4_nL4_vD
0_~t4_vD
+s/9<s'
0_vD0_~t4_n|4_vT4]
=s)A5=
+NS4_g
6D)>+z
v4Y>w]
_s\8_C
8_~D4Yn
8_FD0Y~
8_FD0Y~
8_FD0Y~
^vu8Y?$
^vw8Y?$
#^v~=WZ
^vy9]b
^vz8Y?$
Y7$=_x
6D)>+z
YxZA*:
)T4d=^
4~-m_8
-{?.-S
v_9%^+
Pd`YkG
=Y{Z9_
s)1Cr/
W=w)9Cs)1Cz/
s)){s)1Cs
X[4]fC
0Y~34Yn
s)){s)1C
+Nh4_fC
s<4]~K4
S=_/>=
z/phz/8h
4_fC8_v{0_n
4Ync4Yv
[4Yvc
G,4){*
|_vG=]p
4Yv34_
X1Y/61Y75
g=Y{[4
NyG;O
4Ynl4YvD
[0Y~D4YvD
s)1dz/
w)9ds)1dr/
4Y~D4_
0Yv$4]
w)9,s/
4YnD4_
s))ds)0
4Yn\4Yw
4Yn$4Yw
w)9Ls))
4Yn<4Yv<
4Ynl4Yw
0Y~<4Yo
0Y~$4Yo
4Yvl=_
w)9Ts)(
4Yn$4Yw
0Y~<4Yo
0Y~$4Yo
4Yn<4Yv<9
s))Ts)1T~
4Yn$4Yw
w)1Ts-8
s)9,s)1
.8R4]o
,z/0Q;
s)1c8v
4YnC4Yv[
s))cs)1c
4YvC=_
=Y{[=Q
v)5(By5_
8YT[8YC
s)9Ds)p
s)1|r/
s)1Ds)p
s))|v/
bG#Ga5
4Y/n4Yw
@s/)Ts)0
0Yv,4Yo
[0Y~,5_
4Y7u4Yn,0]
8_744+
4Yn,4Yw
l1Y/68
v)5(s[
s)9\v/
s)9<s)
s))<r/
4YnL4Yw
s))\s)1
4Yn,4Yv,
s))\s)0
0Y~,4Yn
w)9\s))
s))<s)1
w)9\s))
4Yn,4Yw
0Y~t4Yn
0Y~t4Yn
w)9ls))ts)1l
s)1tz/
4Y~,0Yv
w)9ts-8
s)9<s-8
0Y~34Ync4Yv
w)9Cs))
4Yn{4Yv
w)9Ts-8
4Yv\4]
w)9,s/
[4Yv<=_
4_~d8P
4YnD4Yv
s))ds)1d
4YnD4Yw
0Y~<4Yn\4Yv<
4Yn<4Yv<
s))Ts)0
w)9Ts-8
4Yv\4]
4Y~c0YvS4]
0Y~c4Yn
<4YnS4Yv{
s))#s)1
w)1#s-8
u4YvD5_
[0Y~D4_
4YvD=_
4YnD0_
[4YvD=_
s))4w/
v)HSz/
v=l;$|
w)9ts/
/9Tw/0
[4Y~45_
w)9Ds)(
t4Y>3}
s-9ss-9{s-9c
T4Ys[4W
3w)9ss))
s-9Ss-9[s-9C
0Yv#0Y~C
OD4_6;
u4YvS5_
w)9?s))
m4]~C4]~K
5WXt|_x
8TW,Nv
s))Ds)1`
O _~d8
s-9cs-9ks-9
8_~c4_n
s)1cv/
|YhZ4Yt
|YhZ4Yt
d4Yvs8]Fs4]~
/9cs/)s
4YvC8_
+s)1c~/
s-e<Gy
U4Yv`8Yy
s-9<s-9$s-9,s/y
4]fD4]FL
4_0[i5
s)=+s'
s)=+s'
4Yv\8_
4Yv;8_
4Yn34Yv
s)<<z/
[8Y}X4Yo
s/u=GZ
+s))$s)14z
t_3[iQ
9NI4_g
8Y}X4Yl
4YvD4_
s)14s-8
4Ysl5_
s'u+s)y
4YvD=l;
+w)yyW[
+s)q}P[
+w)yMP[
+w)yy_
+s)q5R[
+w)yMR[
/1Dw)9H
[8_v44Y6/#
4Y?%4]
s<5_?b4W
m4]jL4]jT4]j\
4g-4r[
V4Yv|8Yx
)?*w)
u4Y6CU
w)qyaZ
m4]zT0]j\
4g-$w/0
4g-4w/0
s/w<oW
4_4[iU.
Cs)iM,
);+s/
4Y>38*
s)1hw)y
\4Ys[4W
m9Yj[8]6wt
TC+4-
L\:Oji:
v4]~44Q
s/!tz|
s)1ts/
s/9Dw)0
4_~40_
v4]~44Q
s/!tz|
s)1ts/
s/9Dw)0
4_~40_
=+;OY+q
4]0[iI
s)`,s/
)>Kz)<
X_4_>;
Ds/yUL
4_7T4Q
s-p,s!
6_7L0]W
6_7L5_7
q/h<z'
6_7L0Yw
c6_7N=\
4_?e="
e4]4Oh#
`9YJ]=
3s-9<w
_fD0_^
0Yvx4Yn|4_7
-O^~|7_
Iz4_4L2
2b;+;O
dg4_6[}
o4]>/r
4_?fsj
s/,,s!
4_t\4Q
V4YvD5_
s/94s/
s)14s-8
v4Y|D4#
d5]xL5]xD5]x|
d5]xL5]xD5]x|
's/yy
4_7T4W
[5_7S4W
5_?Z4W7
r/x"s'@
^4Ys|5_
}]F{<\F
4]FS9P
t]F[=`+O{
]~c8]V
|_~c0YvK
[4]~C4W
+s-93s'
4Ynw=l:
8Y{Z8\~
G#4"]+
5_wa|_
4Ys|5_
6_?s>T_
6_7s>T_
;/8U'-8
'r/p"
+r-P"v-[?g
l0]_lt
O"v-K?^
l0]Olt
sc,)>k]'
|?8)$*{
4Ynk5_
+s)1{~
0Yv;4_:
s/1Ks-
Cs))Cs/}+
s))cs-(
s/1Cs-8
4_v;4_*[
V4Ys|5_
v4YyD5#
G~9c%c^
Ms0m._M;
w%n$})
gn~<r>fE
8C#[.1
WLf6H.RLt
pub*h,
l+c7g&j9z1q+q<x%
m4C+G?N"I"Y9[)T0U
3i"q8~9c%s0m.8G7G5N9L"U+Q/\%Z
x$G+[-I V6[=A?U6LH
l7s3e9x>~+e)w%n$
d8C#[6H.R$U9I*^4@p7
7~<r>l!e%b*h,H
#Tj4/tn
)Tl45tp
#Tj4/tn
'6d$-Dh
'vd$-Dh
#Tj4/tn
#Tj4/tn
vh$)Dl
#Tj4/tn
"Tk4.t|
(6p$1Dt
+Tr47tv
'Tf4#tj
6h$)Dl
#vh$)Dl
6h$)Dl
#Tj4/tn
+Tr47tv
+Tr47tv
"Tk4.t|
46w$2D{
rF1Tt4=tx
1Tt4=tx
!Td4-th
6Tw42t{
*Ts46tw
m66Tw42t{
+Tr47tv
#Tj4/tn
&b$'Df
Vd$-Dh
$6d$-Dh
!Td4-th
$vd$-Dh
+Tr47tv
+Tr47tv
6Tw42t{
6Tw42t{
+Tr47tv
6Tw42t{
']%ysa
_set_invalid_parameter_handler
%c%c%c%c%c%c%c%c%cMSSE-%d-server
.pdata
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
Partial loss of significance (PLOSS)
Total loss of significance (TLOSS)
The result is too small to be represented (UNDERFLOW)
Unknown error
_matherr(): %s in %s(%g, %g) (retval=%g)
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
CloseHandle
ConnectNamedPipe
CreateFileA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
QueryPerformanceCounter
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
__C_specific_handler
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
_unlock
calloc
fprintf
fwrite
malloc
memcpy
signal
sprintf
strlen
strncmp
vfprintf
KERNEL32.dll
msvcrt.dll
msvcrt.dll
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.CobaltStrike.4!c
Elastic Windows.Trojan.CobaltStrike
ClamAV Win.Trojan.CobaltStrike-9044898-1
CMC Clean
CAT-QuickHeal Trojan.CobaltStr.S17675256
Skyhigh BehavesLike.Win64.Trojan.dc
ALYac Gen:Variant.Zusy.476946
Cylance Unsafe
Zillya Trojan.CobaltStrike.Win64.13339
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/CozyDuke.1012
K7GW Trojan ( 00580b4c1 )
K7AntiVirus Trojan ( 00580b4c1 )
huorong Backdoor/CobaltStrike.d
Baidu Clean
VirIT Trojan.Win64.CbltStrkT.DZI
Paloalto generic.ml
Symantec Backdoor.Cobalt!gen1
tehtris Clean
ESET-NOD32 a variant of Win64/CobaltStrike.Artifact.A
APEX Malicious
Avast Win64:HacktoolX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win64.CobaltStrike.gen
BitDefender Gen:Variant.Zusy.476946
NANO-Antivirus Trojan.Win64.CobaltStrike.kostpq
ViRobot Clean
MicroWorld-eScan Gen:Variant.Zusy.476946
Tencent Trojan.Win64.Cobaltstrike.za
Sophos ATK/Cobalt-CC
F-Secure Heuristic.HEUR/AGEN.1344219
DrWeb BackDoor.CobaltStrike.86
VIPRE Gen:Variant.Zusy.476946
TrendMicro Backdoor.Win64.COBEACON.SMA
McAfeeD ti!FE3848B53BF6
Trapmine Clean
CTX exe.trojan.cobaltstrike
Emsisoft Trojan.CobaltStrike (A)
Ikarus Trojan.Win64.Cobaltstrike
FireEye Generic.mg.a7fcb5ec6dfef339
Jiangmin Trojan.Generic.fsici
Webroot W32.Trojan.Cobalt
Varist W64/Agent.NDUI
Avira HEUR/AGEN.1344219
Fortinet W64/Agent.CY!tr
Antiy-AVL RiskWare/Win64.Artifact.a
Kingsoft malware.kb.a.997
Gridinsoft Trojan.Win64.Agent.oa!s1
Xcitium Malware@#4bd1nrck0jd1
Arcabit Trojan.Zusy.D74712
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.Win64.CobaltStrike.gen
Microsoft VirTool:Win64/CobaltStrike.G
Google Detected
AhnLab-V3 Trojan/Win64.CobaltStrike.R356638
Acronis Clean
McAfee Trojan-FSXF!A7FCB5EC6DFE
TACHYON Trojan/W64.CobaltStrike.288256
VBA32 Trojan.Win64.CobaltStrike
Malwarebytes CobaltStrike.Trojan.Infiltration.DDS
Panda Trj/CI.A
Zoner Clean
TrendMicro-HouseCall Backdoor.Win64.COBEACON.SMA
Rising Backdoor.CobaltStrike/x64!1.D04A (CLASSIC)
Yandex Trojan.GenAsa!ZICJWVi3Ujg
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
GData Gen:Variant.Zusy.476946
AVG Win64:HacktoolX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Clean
No IRMA results available.