Static | ZeroBOX

PE Compile Time

2024-10-27 04:06:22

PE Imphash

0966ec256ca7448da6318b6291c44568

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000c003 0x0000c200 6.57219945142
.rdata 0x0000e000 0x00005fec 0x00006000 4.88168439968
.data 0x00014000 0x00003308 0x00000a00 2.06369632925
.rsrc 0x00018000 0x000000f8 0x00000200 2.51957935048
.reloc 0x00019000 0x00000ed4 0x00001000 6.2965713759

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00018060 0x00000091 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x1000e010 CreateFileW
0x1000e014 GetFileSize
0x1000e018 ReadFile
0x1000e01c lstrcatW
0x1000e020 Sleep
0x1000e024 lstrlenW
0x1000e028 WriteConsoleW
0x1000e02c GetModuleFileNameW
0x1000e030 LoadLibraryW
0x1000e034 CloseHandle
0x1000e038 GetProcAddress
0x1000e044 GetCurrentProcess
0x1000e048 TerminateProcess
0x1000e054 GetCurrentProcessId
0x1000e058 GetCurrentThreadId
0x1000e060 InitializeSListHead
0x1000e064 IsDebuggerPresent
0x1000e068 GetStartupInfoW
0x1000e06c GetModuleHandleW
0x1000e070 InterlockedFlushSList
0x1000e074 RtlUnwind
0x1000e078 GetLastError
0x1000e07c SetLastError
0x1000e080 EnterCriticalSection
0x1000e084 LeaveCriticalSection
0x1000e088 DeleteCriticalSection
0x1000e090 TlsAlloc
0x1000e094 TlsGetValue
0x1000e098 TlsSetValue
0x1000e09c TlsFree
0x1000e0a0 FreeLibrary
0x1000e0a4 LoadLibraryExW
0x1000e0a8 EncodePointer
0x1000e0ac RaiseException
0x1000e0b0 ExitProcess
0x1000e0b4 GetModuleHandleExW
0x1000e0b8 HeapAlloc
0x1000e0bc HeapFree
0x1000e0c0 FindClose
0x1000e0c4 FindFirstFileExW
0x1000e0c8 FindNextFileW
0x1000e0cc IsValidCodePage
0x1000e0d0 GetACP
0x1000e0d4 GetOEMCP
0x1000e0d8 GetCPInfo
0x1000e0dc GetCommandLineA
0x1000e0e0 GetCommandLineW
0x1000e0e4 MultiByteToWideChar
0x1000e0e8 WideCharToMultiByte
0x1000e0ec GetEnvironmentStringsW
0x1000e0f4 LCMapStringW
0x1000e0f8 GetProcessHeap
0x1000e0fc GetStdHandle
0x1000e100 GetFileType
0x1000e104 GetStringTypeW
0x1000e108 HeapSize
0x1000e10c HeapReAlloc
0x1000e110 SetStdHandle
0x1000e114 FlushFileBuffers
0x1000e118 WriteFile
0x1000e11c GetConsoleOutputCP
0x1000e120 GetConsoleMode
0x1000e124 SetFilePointerEx
0x1000e128 DecodePointer
Library ADVAPI32.dll:
0x1000e000 RegSetValueExW
0x1000e004 RegOpenKeyExW
0x1000e008 RegCloseKey

Exports

Ordinal Address Name
1 0x100012bb Z1
!This program cannot be run in DOS mode.
5`fl<a
5`fl5a
5`fl7a
5`Rich
`.rdata
@.data
@.reloc
URPQQh
UQPXY]Y[
QQSVWd
uSSSSj
f9:t!V
PPPPPPPP
PPPPPWV
PP9E uPPSWP
QQSVj8j@
PVVVVV
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
Unknown exception
bad exception
CorExitProcess
AreFileApisANSI
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
?5Wg4p
%S#[k=
"B <1=
_hypot
_nextafter
.text$mn
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCZ
.CRT$XIA
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.edata
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.rsrc$01
.rsrc$02
awesomium.dll
GetProcAddress
LoadLibraryW
GetModuleFileNameW
lstrcatW
CreateFileW
GetFileSize
ReadFile
CloseHandle
lstrlenW
KERNEL32.dll
RegOpenKeyExW
RegSetValueExW
RegCloseKey
ADVAPI32.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVtype_info@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
</assembly>
1)1/151=1B1H1\1b1p1
2-2K2Z2j2|2
263b3o3
4=4G4U4p4
6J6S6^6e6x6
7!717A7Q7Z7y7
::%:+:@:U:\:b:t:~:
< <9<B<G<Z<n<s<
>$>->\>e>n>|>
0!0.0P0
3U4a4z5
696G6M6h6
767V7d7k7q7
1*161E1]1
2!2<2F2R2W2\2w2
3_3n3N4{6
4c4o4z4
5 5g5v5
8V8_8L:
>M>b>m>u>
?,?=?B?d?
666M6T6s6
7!7H7]7m7z7
8&8@8O8p8
9*979P9}9
9+:::S:A;K;X;
<!<-<W<z<
=.=t=z=
4N4V4\4
9$9>9M9W9d9n9~9
4!41464;4c4|4
5"5+545e5}5
6%6/6?6D6I6d6s6~6
7*7:7s7
8$8.8D8|8
9:9L9|9
;V;t;};
<U<Z<_<d<m<
>^>d>m>
>M?g?l?
2+2F2S2a2o2z2
363@3c3m3
5*5/585
839I9\9
5]5l5z5
66Z6a6
6)7>7H7
8)8_8w8
<0]0.1T1
3#393F3K3Y3
6(6:6L6^6p6
;7;D;t;
@1F1K1R1b1p1
2*3g3q3
394A4I4Q4Y4w4
:;;<<L<]<e<u<
=A=P=\=k=~=
=,>5>>>G>r>
01@1D1H1T1X1\1t1x1|1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
4 ;$;(;8<<<@<X<\<`<@=H=P=T=X=\=`=d=h=l=t=x=|=
=(?,?0?4?h?l?p?t?x?|?
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6|6
1 1(10181@1H1P1X1`1h1p1x1
2 2(20282@2H2P2X2`2h2p2x2
3 3(30383@3H3P3X3`3h3p3x3
4 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6P6X6`6h6p6x6
7 7(70787@7H7P7X7`7h7p7x7
;$;,;4;<;D;L;T;\;d;l;t;|;
? ?$?4?8?@?X?
P3p3|3
4 4(4,4<4`4l4t4
5@5L5|5
5 6<6@6`6
7 7@7`7
8 8@8`8
7(7,7074787<7@7D7p8
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
mscoree.dll
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-file-l1-2-4
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
kernelbase
api-ms-win-appmodel-runtime-l1-1-2
user32
api-ms-win-core-fibers-l1-1-0
ext-ms-
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
((((( H
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
CONOUT$
Software\Microsoft\Windows\CurrentVersion\Run
MyAppName
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Loader.4!c
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Trojan.GenericKD.74673089
Cylance Unsafe
Zillya Clean
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/Loader.92623f90
K7GW Trojan ( 005bced11 )
K7AntiVirus Trojan ( 005bced11 )
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/ShellcodeRunner.KE
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky Trojan.Win32.Loader.mpf
BitDefender Trojan.GenericKD.74673089
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.74673089
Tencent Win32.Trojan.Loader.Zolw
Sophos Mal/Generic-S
F-Secure Trojan.TR/Agent.puxxv
DrWeb Trojan.Loader.2241
VIPRE Trojan.GenericKD.74673089
TrendMicro Clean
McAfeeD ti!B1631299DF67
Trapmine Clean
CTX dll.trojan.loader
Emsisoft Trojan.GenericKD.74673089 (B)
huorong Clean
FireEye Generic.mg.e49624fdefe90d42
Jiangmin Clean
Webroot Clean
Varist W32/ABTrojan.CFHX-4299
Avira TR/Agent.puxxv
Fortinet W32/ShellcodeRunner.KE!tr
Antiy-AVL Trojan/Win32.Loader
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Clean
Xcitium Malware@#1y6xttockp9mp
Arcabit Trojan.Generic.D4736BC1
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Trojan/Win.Generic.R675877
Acronis Clean
McAfee Artemis!E49624FDEFE9
TACHYON Clean
VBA32 Clean
Malwarebytes Trojan.ShellCode
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.ShellcodeRunner!8.6166 (CLOUD)
Yandex Clean
Ikarus Trojan.Win32.Shellcoderunner
MaxSecure Trojan.Malware.296767883.susgen
GData Trojan.GenericKD.74673089
AVG Win32:MalwareX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Clean
No IRMA results available.