Static | ZeroBOX

PE Compile Time

2024-10-19 14:04:01

PDB Path

C:\Users\jhgyuo\Desktop\code\地狱之门\RecycledGate-main\Sample\x64\Release\Sample.pdb

PE Imphash

f0c19bb0e4412ca369207496c9ec5689

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000015ac 0x00001600 6.21831992859
.rdata 0x00003000 0x00001300 0x00001400 4.33400511667
.data 0x00005000 0x00000638 0x00000200 0.444405306177
.pdata 0x00006000 0x00000210 0x00000400 2.30971058449
.rsrc 0x00007000 0x000001e0 0x00000200 4.70150325825
.reloc 0x00008000 0x00000030 0x00000200 0.69827769086

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00007060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x140003000 ReadFile
0x140003008 GetCurrentProcess
0x140003010 VirtualAlloc
0x140003018 CreateFileA
0x140003020 CloseHandle
0x140003028 GetFileSize
0x140003030 CreateProcessA
0x140003038 RtlLookupFunctionEntry
0x140003040 RtlVirtualUnwind
0x140003048 UnhandledExceptionFilter
0x140003058 TerminateProcess
0x140003068 GetModuleHandleW
0x140003070 IsDebuggerPresent
0x140003078 InitializeSListHead
0x140003080 GetSystemTimeAsFileTime
0x140003088 GetCurrentThreadId
0x140003090 GetCurrentProcessId
0x140003098 QueryPerformanceCounter
0x1400030a0 RtlCaptureContext
Library VCRUNTIME140.dll:
0x1400030b0 __C_specific_handler
0x1400030b8 __current_exception
0x1400030c8 memset
0x1400030d0 memcpy
Library api-ms-win-crt-stdio-l1-1-0.dll:
0x1400031a8 __stdio_common_vfprintf
0x1400031b0 __acrt_iob_func
0x1400031b8 __p__commode
0x1400031c0 _set_fmode
Library api-ms-win-crt-runtime-l1-1-0.dll:
0x140003110 _initialize_onexit_table
0x140003120 __p___argv
0x140003128 terminate
0x140003130 _seh_filter_exe
0x140003138 _set_app_type
0x140003140 _c_exit
0x140003148 _cexit
0x140003150 __p___argc
0x140003158 _crt_atexit
0x140003160 _exit
0x140003168 exit
0x140003170 _initterm_e
0x140003178 _initterm
0x140003190 _configure_narrow_argv
Library api-ms-win-crt-math-l1-1-0.dll:
0x140003100 __setusermatherr
Library api-ms-win-crt-locale-l1-1-0.dll:
0x1400030f0 _configthreadlocale
Library api-ms-win-crt-heap-l1-1-0.dll:
0x1400030e0 _set_new_mode

!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.rsrc
@.reloc
@VATAWH
L$ SVWH
u/HcH<H
%s shellcode.bin
[-] Failed to open: %s
[-] File is empty?
Out of memory o.0
[*] Failed to read
C:\Windows\explorer.exe
[-] Failed to create section
[*] Created section: 0x%p
[-] Failed to map view of section locally
[*] Mapped section locally: 0x%p
[-] Failed to map view of section remotely
[*] Mapped section remote: 0x%p
[-] Failed to call NtQueueApcThread
[*] NtQueueApcThread successfull
[-] Failed to resume thread
[*] Resumed thread
C:\Users\jhgyuo\Desktop\code\
\RecycledGate-main\Sample\x64\Release\Sample.pdb
.text$mn
.text$mn$00
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIZ
.CRT$XPA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata
.idata$2
.idata$3
.idata$4
.idata$6
.pdata
.rsrc$01
.rsrc$02
ReadFile
GetCurrentProcess
VirtualAlloc
CreateFileA
CloseHandle
GetFileSize
CreateProcessA
KERNEL32.dll
__C_specific_handler
__current_exception
__current_exception_context
memset
VCRUNTIME140.dll
__acrt_iob_func
__stdio_common_vfprintf
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
memcpy
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Trojan.Agent
Skyhigh Clean
ALYac Trojan.GenericKD.74657949
Cylance Unsafe
Zillya Clean
CrowdStrike win/malicious_confidence_90% (D)
Alibaba Clean
K7GW Clean
K7AntiVirus Clean
huorong Clean
Baidu Clean
VirIT Trojan.Win64.Genus.FZG
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 Clean
APEX Malicious
Avast Win64:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky Clean
BitDefender Trojan.GenericKD.74657949
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.74657949
Tencent Clean
Sophos Mal/Generic-S
F-Secure Heuristic.HEUR/AGEN.1374958
DrWeb Tool.Inject.85
VIPRE Trojan.GenericKD.74657949
TrendMicro Clean
McAfeeD ti!A3C7DE8DF765
Trapmine Clean
CTX exe.trojan.generic
Emsisoft Trojan.GenericKD.74657949 (B)
Ikarus Clean
FireEye Trojan.GenericKD.74657949
Jiangmin Clean
Webroot Clean
Varist W64/ABTrojan.GFJF-8792
Avira HEUR/AGEN.1374958
Fortinet W32/PossibleThreat
Antiy-AVL Trojan/Win32.Agent
Kingsoft Clean
Gridinsoft Clean
Xcitium Malware@#3l8q1dcwl2a9p
Arcabit Trojan.Generic.D473309D
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5691172
Acronis Clean
McAfee Artemis!FDA96828C882
TACHYON Clean
VBA32 Clean
Malwarebytes Trojan.ShellCode
Panda Trj/Chgt.AD
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Kryptik@AI.98 (RDML:WpOkXzVut7S5Al9n3PG7WA)
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Clean
GData Trojan.GenericKD.74657949
AVG Win64:MalwareX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Clean
No IRMA results available.