Static | ZeroBOX

PE Compile Time

2010-03-15 15:27:50

PE Imphash

af7b8813a2e213ad2ed4a1d42c1b2975

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00019000 0x00000000 0.0
UPX1 0x0001a000 0x0000c000 0x0000b400 7.88857711288
.rsrc 0x00026000 0x00002000 0x00001200 4.57294769748

Resources

Name Offset Size Language Sub-language File type
RT_BITMAP 0x0002142c 0x00000bb6 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ICON 0x0002671c 0x00000128 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_ICON 0x0002671c 0x00000128 LANG_NEUTRAL SUBLANG_DEFAULT GLS_BINARY_LSB_FIRST
RT_DIALOG 0x00022cf8 0x0000021e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00022cf8 0x0000021e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00022cf8 0x0000021e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00022cf8 0x0000021e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00022cf8 0x0000021e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_DIALOG 0x00022cf8 0x0000021e LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x0002398c 0x0000004c LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x0002398c 0x0000004c LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x0002398c 0x0000004c LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x0002398c 0x0000004c LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_STRING 0x0002398c 0x0000004c LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x00026848 0x00000022 LANG_NEUTRAL SUBLANG_DEFAULT data
RT_MANIFEST 0x00026870 0x000005b8 LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document, ASCII text, with CRLF line terminators

Imports

Library KERNEL32.DLL:
0x426ef0 LoadLibraryA
0x426ef4 GetProcAddress
0x426ef8 VirtualProtect
0x426efc VirtualAlloc
0x426f00 VirtualFree
0x426f04 ExitProcess
Library ADVAPI32.dll:
0x426f0c RegCloseKey
Library COMCTL32.dll:
0x426f14 None
Library COMDLG32.dll:
0x426f1c GetSaveFileNameA
Library GDI32.dll:
0x426f24 DeleteDC
Library ole32.dll:
0x426f2c OleInitialize
Library OLEAUT32.dll:
0x426f34 VariantInit
Library SHELL32.dll:
0x426f3c SHGetMalloc
Library USER32.dll:
0x426f44 GetDC

!This program cannot be run in DOS mode.
xF8zuWh
MaZ'/~
)(-[,f
7}0d=Y
#\lX53
<IpKv7g
ONj!fs
TV=#;O|
C/a7HVH
fc4oN#(
u=YW(,
9~f=9:vS$+J
$8u)9_
\pu4 +X0
kEds#[$
xP.~CF
$)>f&DY;
;xQBIfh
wddpwla,
|PTdju
MZzb-6
^dl"ukte
\t#<&u3
E(/9c0%
<*t*<?t
^hl$Vh@
{(`u$8FX
lo rtBj
1rJN;~
Bv#sfH
Zs44~/z
34?+UDa
X@SN0k
,^,p!Z
@g8&Ru&
1svPPN|2:
@0J&0?
LzY+mW`
w.[#Qr
$L^5djd
@0).P"Q
Btz}T_
!LB5P I
+(Vdpe
^\qEjf
+L_e4$
kKu[xFp
jN`1t+'
+bII[ie
=o,wZ-Y
;VP39$yu"8
/Ok8f
\WuVy
pV.NPj7
$7I$KP
(Ik6k,
E_iHt=
@5Z;,r
G%6G->4
Wh(Fx~
=S6v!w
N/P@}
<s_.D
T^QIN2
UE'>_%
9d\WP'L$
P+`4RHB!
xTt>N_Y
KP]yI&
c1~,@s
'?9\:Ut
|MF19x
B$p?]A
gkM.|"
Z8D=}c{
eRestorePrivilege
.*s(%d)Krtmp
d allocation
B)#.$g
><br>
&nbsp;
<Dy(>body{f
t-fam9y:"AB
size:12;}</.7/h
utf-8">
<meta %tp-e
="cKeNBpe"
W~harseC^
nH]ClassN
HARoCo
3hlwapi.d
EFILELG
SWORD1+j
KNEXTVOL
ooft`F\WinRAR
inf.ln
mFqsDirSMic
]dows\C
TwtTEX
1u;3BM
hmLv'F
Sa@SUpdaHL
5S4 CRhEd
runa-t
_/2 "-d5
c(g?_accX
9mXC[y
lsEwCOMCj32.W
L:pd20T
.WRSDS
\\build\p^
(4XH>
(08@@
={D*{D-yD.wD1
guD2sD5qD6o
D9mD:kD=iD>
"8WwuE
)S7'u+
o)S37%.-
YuQnMa
y+df{ng
CE%t2bcg
sqF";&QIr
y/5k[R
L`#CTgoU32
6;#o!yM
!5/+5e
[eUbg+K
[o5K6Y{c
WCreaDi
K#*ndClose
GwTickCount
ToMultiBytlXK
gT@ ExeG
l]rlenA
X{`oprce"Ha
eSving
eInfopN
cAiApAddr<D
ViewOf
+$m|L`e.
BIsDBCSL
/(Full
-a+`.r
33chBP
0xe1DC
LSIDI}
B~wsK{
`_l$'(Orsr
XPTPSW
wwwwwwwwwwwwww
wwwwwwwwwwwwww
DDDDDDDDD@
DDDDDDDDDGpw
DDDDDDDDDGpw
DDDDDDDDDDDDDD
wwwwwwwwwwwwww
DDDDDD
wwwwww
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.0.0.0"
processorArchitecture="*"
name="WinRAR SFX"
type="win32"/>
<description>WinRAR SFX module</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="*"
publicKeyToken="6595b64144ccf1df"
language="*"/>
</dependentAssembly>
</dependency>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
KERNEL32.DLL
ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegCloseKey
GetSaveFileNameA
DeleteDC
OleInitialize
SHGetMalloc
clrinst.bat
sysclr.bat
alark.exe
$$EEqR(
44,R$<
8*q"S<
F<ELio
m9fCt<
I'^ClI
NKKc3.+$
7#.s/~
,c:3/e^h
s^5r_Kr/
instsrv.exe
]M=U(E
>3Y5%B
wTR?vd
,d];Ny
i$c3RXc0
DnFpG@
Sh:g(CJE
c*?f9g
agToi
veHRW+
ZCh7a2
b{z#{G'
wIB^w)
O[1bJM
|4?p&
^CNG~l
*Xxj;z
d6iAtZ
,yiXf
98$g4~R
r4JrP&
-/v905"Aq
5PuKXA
I{(TZj
zcwb.i
]G"VNTh
5KB^jdh
f$?ieq
qY<3f*'
j9s_^G
{-Zr/o
v2vrhg
miterINST.exe
sysclr.exe
J3RAg\,"
BPm={I
2-Fzzc
+@EMc0N/
{MpHC#
XEyQC#
6LTmoYx
R`UTYTr
w3x&Gr
I,<k-B2
([g$zU
jx57
?Z:mG3>
ASKNEXTVOL
GETPASSWORD1
LICENSEDLG
RENAMEDLG
REPLACEFILEDLG
STARTDLG
Antivirus Signature
Lionic Trojan.Win32.Generic.lCIq
Elastic malicious (moderate confidence)
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clearlogs
ALYac Application.Clearlog.A
Cylance Unsafe
Zillya Clean
CrowdStrike win/grayware_confidence_90% (W)
Alibaba Clean
K7GW Riskware ( 0015e4f01 )
K7AntiVirus Riskware ( 0015e4f01 )
Baidu Win32.HackTool.Clearlog.b
VirIT Trojan.Win32.Agent.AYQF
Paloalto generic.ml
Symantec Hacktool.Clearlogs
tehtris Clean
ESET-NOD32 multiple detections
APEX Clean
Avast SFX:Dropper-L [Drp]
ClamAV Win.Trojan.Genome-5527
Kaspersky UDS:Trojan.Win32.Scar
BitDefender Application.Bat.VJC
NANO-Antivirus Trojan.Win32.DownLoad3.cqqapi
ViRobot Clean
MicroWorld-eScan Application.Bat.VJC
Tencent Win32.Hacktool.Clearlog.Qimw
Sophos Mal/Generic-S
F-Secure Trojan.TR/Spy.6144.213
DrWeb VirusConstructor.ClearLogs
VIPRE Application.Bat.VJC
TrendMicro TSPY_FAREIT.YYSRV
McAfeeD ti!D00D806F1DF7
Trapmine Clean
CTX exe.trojan.clearlog
Emsisoft Application.Bat.VJC (B)
huorong Trojan/Generic!85DC216AEE02F840
FireEye Generic.mg.a736e23ae291f6d3
Jiangmin HackTool.Clearlog.l
Webroot Clean
Varist W32/Trojan.RFBI-8246
Avira TR/Dropper.Gen
Fortinet W32/Agent.AYQF!tr
Antiy-AVL HackTool/Win32.KeyGen
Kingsoft Clean
Gridinsoft Trojan.Win32.Gen.cc!s2
Xcitium Malware@#2f8qa3jru3l1h
Arcabit Application.Bat.VJC [many]
SUPERAntiSpyware Clean
ZoneAlarm HackTool.Win32.Clearlog.c
Microsoft HackTool:Win32/Multiverze
Google Detected
AhnLab-V3 PUP/Win32.Agent.R348454
Acronis Clean
McAfee Artemis!A736E23AE291
TACHYON Clean
VBA32 BScope.Trojan.Ditertag
Malwarebytes Malware.AI.1986806844
Panda Trj/CI.A
Zoner Probably Heur.ExeHeaderL
TrendMicro-HouseCall TSPY_FAREIT.YYSRV
Rising Hack.Clearlog.k (CLASSIC)
Yandex Clean
Ikarus HackTool.Win32.Clearlog
MaxSecure Trojan.Malware.12232.susgen
GData Gen:Variant.Razy.117592
AVG SFX:Dropper-L [Drp]
DeepInstinct MALICIOUS
alibabacloud Clean
No IRMA results available.