Static | ZeroBOX

PE Compile Time

2015-05-21 02:57:17

PE Imphash

3ddb85e3158f28a83729dcc97be8a030

PEiD Signatures

UPX 2.93 - 3.00 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00017000 0x00000000 0.0
UPX1 0x00018000 0x0000c000 0x0000ba00 7.97006771699
.rsrc 0x00024000 0x00001000 0x00000400 4.49044143002

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x0002405c 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.DLL:
0x424268 LoadLibraryA
0x42426c GetProcAddress
0x424270 VirtualProtect
0x424274 VirtualAlloc
0x424278 VirtualFree
0x42427c ExitProcess
Library ADVAPI32.dll:
0x424284 FreeSid
Library DNSAPI.dll:
0x42428c DnsFree
Library SHLWAPI.dll:
0x424294 PathFindFileNameA
Library USER32.dll:
0x42429c wsprintfA
Library WS2_32.dll:
0x4242a4 __WSAFDIsSet

!This program cannot be run in DOS mode.
N:8P/TkP/TkP/Tk]}
k{/Tk]}
kE/Tk]}
k]/TkP/Uk
kU/Tk]}
kQ/TkP/
kQ/Tk-V
kQ/TkRichP/Tk
1UKRE[
_>+7LNU
cMk'Jq
0Q3n~1
c0:EW}
"tV:wC>
@>hbCXZ
ir-.}s,R>
cyc=j#
Dwlf24
\F5-\Ms
9lABXgBE
,X4I"w
2RQ<1K
p$<V3~
NW "\}
mCCZp&
(#`L`4$
-8]z;+
cF05uG
iW<>u'
*Dy:D5Jh
e$AS#.{
V1Np z
<E7#K+mr4n
R?WN<`
@|oI`w
^]b7yYa&
y \wb|r$
XQ?a/JD
{pSa1
l#xB4T
FVflnb
`8 \V^
VuSs?x
~c{01f_
$.1uVN
ikSG<{
Z` .p!C
|7^z^vT7
d(H-!$
C+Wyiop}
cI{UUBKu_
cSPR2E/
$}HSp
xh#Bz,P
Q5{(Y.B
z2mmMBSm
$FF)vY
fUB*ZUu
hS-#Q_P]Z
a u^y%
G+-%rQ
SbYR}#\6
N)3\k
8lx;aVS_nk
~$2ak;.
#|xJBy
?_/7p^
G6J1fP{O
je<u59
n~W|L6e
/XWPhJU
Iq gg;
ds&l$Qq
3f<rf1'{~
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H)
s`)L$4
D$t+D$\
)D$H)
9l$\w_
XPTPSW
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
KERNEL32.DLL
ADVAPI32.dll
DNSAPI.dll
SHLWAPI.dll
USER32.dll
WS2_32.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
FreeSid
DnsFree
PathFindFileNameA
wsprintfA
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Sdbot.m!c
Elastic malicious (moderate confidence)
ClamAV Win.Dropper.Gh0stRAT-6992450-0
CMC Clean
CAT-QuickHeal Trojan.Ghanarava.1736146904a75c8c
Skyhigh BehavesLike.Win32.Generic.pc
McAfee ACL/MintZard Trojan
Cylance Unsafe
Zillya Backdoor.SdBot.Win32.1
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (W)
Alibaba Backdoor:Win32/Sdbot.26f229a3
K7GW DoS-Trojan ( 004c26b11 )
K7AntiVirus DoS-Trojan ( 004c26b11 )
Baidu Win32.Trojan.Agent.asz
VirIT Trojan.Win32.Generic.FLU
Paloalto Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/DDoS.Agent.NBI
APEX Malicious
Avast Win32:Evo-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky Backdoor.Win32.Sdbot.agiy
BitDefender Gen:Heur.Mint.Zard.45
NANO-Antivirus Trojan.Win32.MLW.duuovm
ViRobot Clean
MicroWorld-eScan Gen:Heur.Mint.Zard.45
Tencent Malware.Win32.Gencirc.10bd9b8b
Sophos Mal/Behav-044
F-Secure Adware.ADWARE/Taranis.993
DrWeb DDoS.5784
VIPRE Gen:Heur.Mint.Zard.45
TrendMicro BKDR_SDBOT.SM
McAfeeD Real Protect-LS!BE47562482B7
Trapmine malicious.high.ml.score
CTX exe.trojan.generic
Emsisoft Gen:Heur.Mint.Zard.45 (B)
huorong Trojan/Bulta.b
FireEye Generic.mg.be47562482b77cba
Jiangmin Backdoor.SdBot.hk
Webroot Clean
Varist W32/Agent.EHB.gen!Eldorado
Avira ADWARE/Taranis.993
Fortinet W32/Agent.NBI!tr
Antiy-AVL Trojan[Backdoor]/Win32.SdBot
Kingsoft malware.kb.b.984
Gridinsoft Trojan.Win32.Agent.sa
Xcitium Backdoor.Win32.Sdbot.AM@83hwfp
Arcabit Trojan.Mint.Zard.45
SUPERAntiSpyware Clean
Microsoft Trojan:Win32/Sdbot!RND
Google Detected
AhnLab-V3 Trojan/Win32.Dorv.R304564
Acronis Clean
VBA32 BScope.Trojan.Win32.Inject.2
TACHYON Backdoor/W32.SdBot.109056.H
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall BKDR_SDBOT.SM
Rising Trojan.DDOS!1.AAC6 (CLOUD)
Yandex Trojan.GenAsa!p3uhb3yO/Co
Ikarus Trojan.Win32.DDos
MaxSecure Trojan.Malware.300983.susgen
GData Gen:Heur.Mint.Zard.45
AVG Win32:Evo-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud DDoS:Win/Sdbot
No IRMA results available.