Static | ZeroBOX

PE Compile Time

1970-01-01 09:00:00

PE Imphash

e4b40ab6ac5308d4cbd835973d06cd63

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00006f28 0x00007000 6.30737884209
.data 0x00008000 0x0007d0e0 0x0007d200 0.0823964245598
.rdata 0x00086000 0x00000e20 0x00001000 4.23884984139
.pdata 0x00087000 0x000004bc 0x00000600 3.81554807492
.xdata 0x00088000 0x00000468 0x00000600 3.55292309975
.bss 0x00089000 0x00000be0 0x00000000 0.0
.idata 0x0008a000 0x00000864 0x00000a00 3.81368254548
.CRT 0x0008b000 0x00000060 0x00000200 0.286559824313
.tls 0x0008c000 0x00000010 0x00000200 0.0
.reloc 0x0008d000 0x00000084 0x00000200 1.54421523948

Imports

Library KERNEL32.dll:
0x14008a21c CloseHandle
0x14008a224 ConnectNamedPipe
0x14008a22c CreateFileA
0x14008a234 CreateNamedPipeA
0x14008a23c CreateThread
0x14008a244 DeleteCriticalSection
0x14008a24c EnterCriticalSection
0x14008a254 GetLastError
0x14008a25c GetModuleHandleA
0x14008a264 GetProcAddress
0x14008a26c GetStartupInfoA
0x14008a274 GetTickCount
0x14008a284 IsDBCSLeadByteEx
0x14008a28c LeaveCriticalSection
0x14008a294 MultiByteToWideChar
0x14008a29c ReadFile
0x14008a2ac Sleep
0x14008a2b4 TlsGetValue
0x14008a2bc VirtualAlloc
0x14008a2c4 VirtualProtect
0x14008a2cc VirtualQuery
0x14008a2d4 WideCharToMultiByte
0x14008a2dc WriteFile
Library msvcrt.dll:
0x14008a2ec __C_specific_handler
0x14008a2f4 ___lc_codepage_func
0x14008a2fc ___mb_cur_max_func
0x14008a304 __getmainargs
0x14008a30c __initenv
0x14008a314 __iob_func
0x14008a31c __set_app_type
0x14008a324 __setusermatherr
0x14008a32c _acmdln
0x14008a334 _amsg_exit
0x14008a33c _cexit
0x14008a344 _commode
0x14008a34c _errno
0x14008a354 _fmode
0x14008a35c _initterm
0x14008a364 _onexit
0x14008a36c abort
0x14008a374 calloc
0x14008a37c exit
0x14008a384 fprintf
0x14008a38c fputc
0x14008a394 free
0x14008a39c fwrite
0x14008a3a4 localeconv
0x14008a3ac malloc
0x14008a3b4 memcpy
0x14008a3bc memset
0x14008a3c4 signal
0x14008a3cc strerror
0x14008a3d4 strlen
0x14008a3dc strncmp
0x14008a3e4 vfprintf
0x14008a3ec wcslen

!This program cannot be run in DOS mode.
`.data
.rdata
@.pdata
@.xdata
.idata
.reloc
ATUWVSH
[^_]A\
[^_]A\
ATUWVSH
@[^_]A\
PHc56u
UAWAVAUATWVSH
[^_A\A]A^A_]
ATUWVSH
[^_]A\H
:MZuYHcB<H
C$9C(~
u HcS$
AWAVAUATUWVSH
C$9C(~
H[^_]A\A]A^A_
S$9S(~
S$9S(~
UAWAVAUATWVSH
[^_A\A]A^A_]
C$9C(~
C$9C(~
UAWAVAUATWVSH
C$9C(~
S$9S(~
[^_A\A]A^A_]
UATWVSH
C$9C(~
[^_A\]
[^_A\]
=UUUUw
S$9S(~
AUATUWVSH
X[^_]A\A]
AWAVAUATUWVSH
[^_]A\A]A^A_
AWAVAUATUWVSH
8[^_]A\A]A^A_
AWAVAUATUWVSH
[^_]A\A]A^A_
[^_]A\A]A^A_
D$xA;E
ATUWVSHcY
[^_]A\
[^_]A\
AWAVAUATUWVSH
([^_]A\A]A^A_
AVAUATUWVSH
[^_]A\A]A^
AVAUATUWVSH
[^_]A\A]A^
WVSHcA
AVAUATUWVSH
0[^_]A\A]A^
ATUWVSH
@[^_]A\
AVAUATUWVSH
@[^_]A\A]A^
j6cxsn
%c%c%c%c%c%c%c%c%cMSSE-%d-server
Argument domain error (DOMAIN)
Argument singularity (SIGN)
Overflow range error (OVERFLOW)
Partial loss of significance (PLOSS)
Total loss of significance (TLOSS)
The result is too small to be represented (UNDERFLOW)
Unknown error
_matherr(): %s in %s(%g, %g) (retval=%g)
Mingw-w64 runtime failure:
Address %p has no image-section
VirtualQuery failed for %d bytes at address %p
VirtualProtect failed with code 0x%x
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
(null)
Infinity
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
GCC: (GNU) 12.1.0
CloseHandle
ConnectNamedPipe
CreateFileA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
ReadFile
SetUnhandledExceptionFilter
TlsGetValue
VirtualAlloc
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
calloc
fprintf
fwrite
localeconv
malloc
memcpy
memset
signal
strerror
strlen
strncmp
vfprintf
wcslen
KERNEL32.dll
msvcrt.dll
(null)
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.CobaltStrike.4!c
Elastic Windows.Trojan.CobaltStrike
ClamAV Win.Trojan.CobaltStrike-9044898-1
CMC Clean
CAT-QuickHeal Trojan.Ghanarava.1737097536e0acc5
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Tedy.238453
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.CobaltStrike
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Backdoor:Win64/Artifact.82a5c90a
K7GW Trojan ( 00580c281 )
K7AntiVirus Trojan ( 00580c281 )
huorong Backdoor/CobaltStrike.d
Baidu Clean
VirIT Clean
Paloalto generic.ml
Symantec Backdoor.Cobalt
tehtris Clean
ESET-NOD32 a variant of Win64/CobaltStrike.Artifact.A
APEX Malicious
Avast Win64:Trojan-gen
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win64.CobaltStrike.gen
BitDefender Gen:Variant.Doina.87204
NANO-Antivirus Clean
ViRobot Trojan.Win.Z.Tedy.553472
MicroWorld-eScan Gen:Variant.Tedy.238453
Tencent Trojan.Win64.CobaltStrike.hb
Sophos ATK/Cobalt-JW
F-Secure Trojan.TR/Crypt.EPACK.Gen2
DrWeb Clean
VIPRE Gen:Variant.Tedy.238453
TrendMicro Trojan.Win64.COBEACON.SM.hp
McAfeeD ti!2ADF9DCC9DDC
Trapmine Clean
CTX exe.trojan.cobaltstrike
Emsisoft Gen:Variant.Tedy.238453 (B)
Ikarus Trojan.Win64.Cobaltstrike
FireEye Generic.mg.9f2637a15688e909
Jiangmin Trojan.Agent.erap
Webroot Clean
Varist W64/CobaltStrike.L.gen!Eldorado
Avira TR/Crypt.EPACK.Gen2
Fortinet W64/GenKryptik.FWMV!tr
Antiy-AVL RiskWare/Win64.Artifact
Kingsoft Win64.Trojan.CobaltStrike.gen
Gridinsoft Trojan.Win64.Kryptik.sa
Xcitium Malware@#312u84w54ntpz
Arcabit Trojan.Tedy.D3A375
SUPERAntiSpyware Clean
Microsoft Backdoor:Win64/CobaltStrike.NP!dha
Google Detected
AhnLab-V3 Trojan/Win.CobaltStrike.R626175
Acronis suspicious
McAfee Artemis!9F2637A15688
TACHYON Clean
VBA32 Backdoor.CobaltStrike
Malwarebytes Malware.AI.4284075484
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall Trojan.Win64.COBEACON.SM.hp
Rising Backdoor.CobaltStrike/x64!1.E382 (CLASSIC)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Clean
GData Gen:Variant.Tedy.238453
AVG Win64:Trojan-gen
DeepInstinct MALICIOUS
alibabacloud Backdoor:Win/CobaltStrike.B
No IRMA results available.