Static | ZeroBOX

PE Compile Time

2025-01-06 03:04:46

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x000017c4 0x00001800 5.9314985947
.rsrc 0x00004000 0x00001760 0x00001800 4.69536242285
.reloc 0x00006000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000044b0 0x000010a8 LANG_NEUTRAL SUBLANG_NEUTRAL dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON 0x00005558 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_VERSION 0x00004130 0x0000037c LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00005570 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
H4sIAAAAAAAEAI1UXW/aMBR9R+I/eHQPmzQHtaXQIvWBAm2ZaIsIHxXrHoxzCS6JndoOELQfPzsJLbR02kvk+J7re+49xz5CLmjUXgONNRMc9UTAaFIsmF38upttIuxSEQFqxlIC10MFEn3ADLkEpSWjGrxioVg4QiMiGZkGoIqFr+tQMn8oA3SJSnOtI1Uvl32m5/HUoSIsp+H8KyEAokCVPbHigSBeeVl1Tk6ckyyOsx8cqiXFK8arFWfDopKpQQWffSgCSxZMmXYiKcoZwHlWglu8IEoPJduiDXiVeAuxepk+J1TFKxJtknBzzsgZeHN2oY+9mmNznFmc5m/59Yie20O+Al/Wh2673+s/XHe67adWDlBPKfMtT8aVJkGwTWvWs7ANrcw+6IbnmVkqG6ycdePKZEOjagW0J0acXjy7w/PK+Crxm7XoLPSkWE0YrXZHrUm7r1pqc+3TPr2unt6E1cWI1h7V0o+W89vTqns/a4bDxvR4sJq6N7XeaEBszUiIIB+aXToqjiIhteFkpalXKqcpMyEXIO9JCBZ4l4zT/1Km9LZR9HjXZ36xMJZMA74VSqPSNsa4n4UdxzFpHb4UC8BjmPbhJTbOQdhq8WYU/BDraxYA2p8zNu67IorRHpHKnJkRaK+1JFQfqp+H3pU3I8aDxHgaN5SCcBokaWtuojSETufBaYowsiIYgzuWRhYpFn4dhkxYZFG/6/W83kC0mASqhUy+7XXwA+0a4Pu7Ae5Y9PMx7oCybnLr5476KRjH6XrPaqXd6/O0fxc+U+PtSr3JsVPrsBh3ZAHopj1AMj9LC6TngFQElM0YeGjY7+x3Z1JsYweSDPTfhtne4vdc0B9kKOP7OAgyWq4mMncIYhwRNGeeBxyZN8Tos88nxb5a5gA8n3s6UvMS/u/Us3cA1mCS0xq4JwW1dx3b4Wbpr4fihvTj0Ly4XWZJYZyN/nJHghLC45SQqxMjzm3K0fa7203WxJwopGxNI0DIuO3uY19fkBkjGhC1MDJy4pu
v4.0.30319
#Strings
<Module>
iq33xp0h.exe
Program
Source
mscorlib
System
Object
SW_HIDE
SW_SHOW
GetConsoleWindow
ShowWindow
System.Collections.ObjectModel
Collection`1
System.Management.Automation
PSObject
_RunPS
System.IO
Stream
CopyTo
nCmdShow
PSScript
WorkingDir
System.Reflection
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyConfigurationAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
AssemblyCultureAttribute
System.Runtime.InteropServices
ComVisibleAttribute
GuidAttribute
AssemblyVersionAttribute
AssemblyFileVersionAttribute
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
iq33xp0h
DllImportAttribute
kernel32.dll
user32.dll
System.Diagnostics
Process
GetCurrentProcess
get_MainWindowTitle
String
IsNullOrEmpty
Assembly
GetExecutingAssembly
GetManifestResourceStream
System.Resources
ResourceReader
GetResourceData
IDisposable
Dispose
System.Text
Encoding
get_ASCII
GetString
get_Chars
Substring
Concat
ToLower
op_Equality
Console
WriteLine
ToString
Exception
get_Message
System.Threading
Thread
PowerShell
Create
GetDirectoryName
AddScript
Invoke
PSDataStreams
get_Streams
PSDataCollection`1
ErrorRecord
get_Error
System.Collections.Generic
IEnumerator`1
GetEnumerator
get_Current
System.Collections
IEnumerator
MoveNext
get_BaseObject
get_UTF8
GetBytes
MemoryStream
System.IO.Compression
GZipStream
CompressionMode
ToArray
Convert
ToBase64String
FromBase64String
Resources.resx
PowerShell-Wrapper
PowerShell2Exe
Zander Tools
PowerShell to EXE converter
"Copyright
2023 by Roger Zander
$2193048a-dcd5-433e-a2c0-28384b9ebad2
1.0.1.2
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
psCode.ps1
Resources.resx
psCode.ps1
$args = @("
/debug
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
PowerShell2Exe
CompanyName
Zander Tools
FileDescription
PowerShell-Wrapper
FileVersion
1.0.1.2
InternalName
iq33xp0h.exe
LegalCopyright
Copyright
2023 by Roger Zander
OriginalFilename
iq33xp0h.exe
ProductName
PowerShell to EXE converter
ProductVersion
1.0.1.2
Assembly Version
1.0.1.2
Antivirus Signature
Bkav W32.Common.73C828D3
Lionic Trojan.Win32.Alien.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Jalapeno.4902
CTX exe.trojan.msil
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
Skyhigh Clean
ALYac Gen:Variant.Jalapeno.4902
Cylance Unsafe
Zillya Clean
Sangfor Riskware.Msil.Alien.Vkug
CrowdStrike win/grayware_confidence_90% (D)
K7GW Riskware ( 0053bf301 )
K7AntiVirus Riskware ( 0053bf301 )
huorong HEUR:TrojanDownloader/PS.NetLoader.ae
VirIT HackTool.Win32.Agent.CHIM
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of MSIL/Riskware.HackTool.Agent.AV
APEX Malicious
Paloalto Clean
Cynet Clean
Kaspersky HEUR:Trojan.MSIL.Alien.gen
Alibaba Trojan:MSIL/Heracles.3d28f8df
NANO-Antivirus Clean
ViRobot Clean
Tencent Trojan.Msil.Alien.ca
Sophos Generic Reputation PUA (PUA)
F-Secure Heuristic.HEUR/AGEN.1308614
DrWeb Trojan.StarterNET.15
VIPRE Gen:Variant.Jalapeno.4902
McAfeeD ti!7D54679530CE
Trapmine Clean
CMC Clean
Emsisoft Gen:Variant.Jalapeno.4902 (B)
Ikarus Win32.Outbreak
Jiangmin Clean
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1308614
Antiy-AVL Clean
Kingsoft MSIL.Trojan.Alien.gen
Gridinsoft Trojan.Win32.Agent.sa
Xcitium Clean
Arcabit Trojan.Jalapeno.D1326
SUPERAntiSpyware Clean
Microsoft Trojan:MSIL/Heracles.PTDU!MTB
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5437079
Acronis Clean
VBA32 TScope.Trojan.MSIL
TACHYON Clean
Malwarebytes Binder.Trojan.Dropper.DDS
Panda Trj/CI.A
Zoner Clean
TrendMicro-HouseCall Clean
Rising Downloader.NetLoader/PS!8.1B9E5 (CLOUD)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
Fortinet Riskware/HackTool
DeepInstinct MALICIOUS
alibabacloud Grayware:MSIL/Alien
No IRMA results available.