Static | ZeroBOX

PE Compile Time

2025-01-03 17:51:37

PDB Path

C:\Users\admin\Desktop\Hak.babi\Payload\C++\l3v0\x64\Release\l3v0.pdb

PE Imphash

b88f4cd742ae7c77b018b6db1bbdb1ee

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000116c 0x00001200 5.99556950765
.rdata 0x00003000 0x00001156 0x00001200 4.08678262211
.data 0x00005000 0x00000680 0x00000200 0.532489565814
.pdata 0x00006000 0x0000018c 0x00000200 3.06814517078
.rsrc 0x00007000 0x000001e0 0x00000200 4.70150325825
.reloc 0x00008000 0x00000030 0x00000200 0.710192889322

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00007060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x140003000 WaitForSingleObject
0x140003008 Sleep
0x140003010 CloseHandle
0x140003018 FreeConsole
0x140003020 CreateProcessW
0x140003028 RtlLookupFunctionEntry
0x140003030 GetModuleHandleW
0x140003038 IsDebuggerPresent
0x140003040 InitializeSListHead
0x140003048 GetSystemTimeAsFileTime
0x140003050 GetCurrentThreadId
0x140003058 GetCurrentProcessId
0x140003060 QueryPerformanceCounter
0x140003070 RtlVirtualUnwind
0x140003078 UnhandledExceptionFilter
0x140003088 GetCurrentProcess
0x140003090 TerminateProcess
0x140003098 RtlCaptureContext
Library WS2_32.dll:
0x1400030d8 WSASocketW
0x1400030e0 closesocket
0x1400030e8 WSACleanup
0x1400030f0 htons
0x1400030f8 WSAConnect
0x140003100 inet_pton
0x140003108 WSAStartup
0x140003110 recv
Library VCRUNTIME140.dll:
0x1400030a8 __C_specific_handler
0x1400030b0 __current_exception
0x1400030c0 memset
0x1400030c8 memcpy
Library api-ms-win-crt-runtime-l1-1-0.dll:
0x140003178 _crt_atexit
0x140003180 _c_exit
0x140003188 _configure_narrow_argv
0x140003190 _initialize_onexit_table
0x140003198 _set_app_type
0x1400031a0 _seh_filter_exe
0x1400031b0 exit
0x1400031b8 __p___argv
0x1400031c0 __p___argc
0x1400031c8 _exit
0x1400031d0 _initterm_e
0x1400031d8 _initterm
0x1400031e0 terminate
0x1400031e8 _cexit
Library api-ms-win-crt-convert-l1-1-0.dll:
0x140003120 atoi
Library api-ms-win-crt-math-l1-1-0.dll:
0x140003150 __setusermatherr
Library api-ms-win-crt-stdio-l1-1-0.dll:
0x1400031f8 _set_fmode
0x140003200 __p__commode
Library api-ms-win-crt-locale-l1-1-0.dll:
0x140003140 _configthreadlocale
Library api-ms-win-crt-heap-l1-1-0.dll:
0x140003130 _set_new_mode

!This program cannot be run in DOS mode.
`.rdata
@.data
.pdata
@.rsrc
@.reloc
t$ UWATAVAWH
u/HcH<H
3.107.255.174
C:\Users\admin\Desktop\Hak.babi\Payload\C++\l3v0\x64\Release\l3v0.pdb
.text$mn
.text$mn$00
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIZ
.CRT$XPA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata
.idata$2
.idata$3
.idata$4
.idata$6
.pdata
.rsrc$01
.rsrc$02
WaitForSingleObject
CloseHandle
FreeConsole
CreateProcessW
KERNEL32.dll
WSAConnect
inet_pton
WSASocketW
WS2_32.dll
__C_specific_handler
__current_exception
__current_exception_context
memset
VCRUNTIME140.dll
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
memcpy
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
cmd.exe
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.ReverseShell.m!c
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Trojan.Ghanarava.173600951652a855
Skyhigh Artemis!Trojan
ALYac Clean
Cylance Unsafe
Zillya Clean
Sangfor Backdoor.Win32.Reverseshell.V6sn
CrowdStrike win/malicious_confidence_90% (D)
Alibaba Trojan:Win64/ReverseShell.dc5864a7
K7GW Trojan ( 005966d11 )
K7AntiVirus Trojan ( 005966d11 )
huorong Clean
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win64/ReverseShell.I
APEX Malicious
Avast Win64:MalwareX-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky Backdoor.Win32.Agent.myvtnh
BitDefender Gen:Heur.Bodegun.16
NANO-Antivirus Trojan.Win64.Redcap.kunndc
ViRobot Clean
MicroWorld-eScan Gen:Heur.Bodegun.16
Tencent Win32.Backdoor.Agent.Ekjl
Sophos Mal/Generic-S
F-Secure Clean
DrWeb Clean
VIPRE Gen:Heur.Bodegun.16
TrendMicro Clean
McAfeeD ti!6DEF8CB28331
Trapmine Clean
CTX exe.trojan.reverseshell
Emsisoft Gen:Heur.Bodegun.16 (B)
Ikarus Trojan.Win64.Crypt
FireEye Gen:Heur.Bodegun.16
Jiangmin Clean
Webroot W32.Trojan.Gen
Varist W64/ABTrojan.COSP-0677
Avira TR/Redcap.evkdd
Fortinet W64/ReverseShell.I!tr
Antiy-AVL Trojan[Backdoor]/Win64.ReverseShell
Kingsoft Win32.Hack.Agent.myvtnh
Gridinsoft Trojan.Win64.Downloader.sa
Xcitium Malware@#32uvq5hfx0ddq
Arcabit Trojan.Bodegun.16
SUPERAntiSpyware Clean
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5713819
Acronis Clean
McAfee Artemis!BCE921DA7E4E
TACHYON Clean
VBA32 Clean
Malwarebytes Trojan.ReverseShell
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Kryptik@AI.85 (RDML:4MADlYUV48mjphoSbwUI8g)
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
GData Gen:Heur.Bodegun.16
AVG Win64:MalwareX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Trojan:Win/ReverseShell.I
No IRMA results available.