Static | ZeroBOX

PE Compile Time

2018-01-07 21:06:24

PE Imphash

0fd81f440ebc75b9643f0a9a76fd8d29

PEiD Signatures

UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00022000 0x00000000 0.0
UPX1 0x00023000 0x0000f000 0x0000ea00 7.90455899646
.rsrc 0x00032000 0x00001000 0x00000a00 3.00346604835

Resources

Name Offset Size Language Sub-language File type
RT_BITMAP 0x00032200 0x000004e8 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x00032200 0x000004e8 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_ACCELERATOR 0x000326ec 0x00000008 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
None 0x000326f8 0x0000000a LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data

Imports

Library KERNEL32.DLL:
0x4327e0 LoadLibraryA
0x4327e4 GetProcAddress
0x4327e8 ExitProcess
Library ADVAPI32.dll:
0x4327f0 LsaClose
Library GDI32.dll:
0x4327f8 BitBlt
Library MSVCP60.dll:
0x432800 ?_Xran@std@@YAXXZ
Library MSVCRT.dll:
0x432808 free
Library MSVFW32.dll:
0x432810 ICOpen
Library PSAPI.DLL:
0x432818 EnumProcessModules
Library SHELL32.dll:
0x432820 ShellExecuteA
Library WINMM.dll:
0x432828 waveInStop
Library WS2_32.dll:
0x432830 send

Exports

Ordinal Address Name
1 0x4014d3 dfdg
!This program cannot be run in DOS mode.
&@CRP#?
CEt$zv
I)0^_/
%'()*+!
KR@rv~
PE@eg?
@Ne9VQ
dleifc
Fr\Mst
uOrv!w
ndxyHfzi
cGumWr
&QwI,c@
C!oQ"n#
%o'Y([
4,5A|6
4Y5r"9
(9%_YZ:T@
vSUH!:
!222cuml
OAjC[jS
,5s\44D*
Rh?.OC
66l{Cm;
tX(UPb(
<AtG<BtC
2\(6Un[
AU0Ssf,$G@
%`T#@2
\u!V>(
U<O*+-
I_}8ZW8
M/U]'t
!#Srf
|uTA&2Uc
J22B!O
%u&tYn
.op<*F
t-</t)F
P}-[t.
(O\+TH
L:H`*h
4Ring0
67YkrJ,
jC(B<
k<;NAj9
. d!aJ
W<LlTXA
i78d&9l:;
 !T+"
}#x0$%Au&
YG4HsI
(JKL1
t60uxv#K
x(yz'K
{)|}##''~
XY''''Z[\]''#'^_`a'g''bcedeH
p.,'.'
:&'dVw
*F+r,-m
P/0612t
4enY7Q
%610V@
{6`,(_
"[ GF"
W\H$Q`
En$U?G
Nx|c',!
IL`rDu.
-R)P#US
Wi n!
DskOC:
%pbWj)
@m*9M:;=
@,)dQ"
PIw! 6
~0;~,}
EF$#(*
aTRLL'
shibl3
BhC4D%
fEaFGP
_YQ]T
,O-p.NnA
R8|M}~zg
I.#56O
789:;<
<=>.?@U*AzE|xB
RaSdTFUiV
<0^_`ab
cdCwelf
oghiQja
tBkld?m
AVBiCdDe
8 Tl4cJ
)t*D-v3
.*79oZ:n;A
tjdPoE
$qP|h-
0IV324MP48cvi/
MSV(Wh)
QO56{7u
~OBC0Do&EFy:
<OGHIJK
"5#$%W
LA?MNIOs}
:PQSXRST.
H4DYZ[\
:`a+bgNcwdd}
4efDgh
%G<H,Wr
ophos\
)@`[HK
`.03,f-s
l6.a/v0312
<O23456
#dx.T+
HDTJ.9
J.dD4#
<VQIPRt%#
KOPMOD
XtP&4o
UmV WXN
u"vWwSxy
Oz{p)|
4'(?)c*
f/0012Y4oO
56jT7F89O
OW:;DN<[=>
1j!LPA
H-W#q6
l@EAMDuEr
FGeHnLN
JLNP@R
XnYt\]
`l;abeS
@%+AB\K(
;p;hc1
,($####
gdd,04
K<@@.9
KNLLP9
KN.X\\
``ddKN.9hhl
lpptN.9
l(]St#%t
-6N$H*=
te52;5HDX
[s(z$>n
4F<?tQ
tZ9H tU
9_|t9[
gp&-)
F)8Sne;
l4CglU
:U0Sq8
UTZ<&,
JfMu$Z
G"W<Oo,
QoWT,xt
p!LP6N
3/YUn>^
}Iqhk
,V*Eh0
(6$lZ^?
tjUG-V
N30Sw<
WL/VOH
8,QW:<
9tau}(
`k4W8`
\WGWV@
.\XS@}Q Mq0Iy
.\T51\(
RAo_f&
USER32.dll
deflate 1.
4 Copyright
995-2002 Jean-loup Gai7y V
8@P`pB
_[WSOKG
in+Mark A
CWTSAPI
#Z!Ox
(pdK$KHX%
KERNEL!Av3?'8
RasDefaultCredentials
Params!%
1vicYPhoneNumbX
p]\command
Forbid
3TTP0 214 OK
WinSta0\
ecurity
Appli]
CONCT_
NetSubKeT\xqsR ,yP
xtl\XPi
iH<80$
4tplhd
HD@<8@H
|xtpl@
JhhsQC
*+,-./i
i01234
ABCDEFi
iGHIJK
4`abcd
efghiM
4Mjklmno4M
4pqrst
uvwxyI
65432+
43+1;H
leUIns`
DownAr/
.1WgeC
BJksOk
G_BINAR
MULTI_SZB
CDWORD
GDlw+dX
zvx}yy
tvwqtxmjhd
ZXX[RTWUQ
NLNIh7T
D<;952
MH(.-)),*!#'&"{"
yx~xzsup|qvm
n9ojkai
gcb^\\
YUWVWRPRU
OHJIKIE@GG@
A<8?=9>=;64
E|ESCRIPT
/-see.ex
DR.WEB
_ccSvcH
<TXyImeO
munquipt
IkSf|e0A
7XHCKSo!d-|
&4hUnTh
Icon8[v
goosaGUI
K$;G8%
YkxYAg
SYSTEM\C
t\-s\[
Zw;JXi
YUA]@?
dynamic
pbed'KF
0<DN4M
U$5[OXH
fGet"w4
CharNext"
ipbo`d/
s=%Opo
!jXPa++
~ickCou%
eL+alx
rD/cf]
8K1AFA
AAEX_N@ZMCJ1?
CAPBDXZ@4DBZnpYO
OINffcn
nUQJRG,
:!4K!!-G&
P=L*5S
~80o99|B
r `.rd
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww@
KERNEL32.DLL
ADVAPI32.dll
GDI32.dll
MSVCP60.dll
MSVCRT.dll
MSVFW32.dll
PSAPI.DLL
SHELL32.dll
WINMM.dll
WS2_32.dll
LoadLibraryA
GetProcAddress
ExitProcess
LsaClose
BitBlt
?_Xran@std@@YAXXZ
ICOpen
EnumProcessModules
ShellExecuteA
waveInStop
X7.dat
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Farfli.m!c
Elastic malicious (moderate confidence)
ClamAV Win.Trojan.Generic-6305873-0
CMC Clean
CAT-QuickHeal Trojan.Mauvaise.SL1
Skyhigh BehavesLike.Win32.Generic.kc
ALYac Clean
Cylance Unsafe
Zillya Trojan.Farfli.Win32.44655
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Backdoor:Win32/Farfli.13f8489b
K7GW Trojan ( 0053af701 )
K7AntiVirus Trojan ( 0053af701 )
huorong Backdoor/ToBea.c
Baidu Win32.Trojan.Farfli.t
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/Farfli.ATE
APEX Malicious
Avast Win32:Evo-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Backdoor.Win32.Generic
BitDefender Trojan.GenericKD.75526179
NANO-Antivirus Trojan.Win32.Dwn.dxihqn
ViRobot Trojan.Win32.Agent.192512.FD[UPX]
MicroWorld-eScan Trojan.GenericKD.75526179
Tencent Malware.Win32.Gencirc.1168a129
Sophos Mal/Generic-S
F-Secure Clean
DrWeb Trojan.DownLoader16.26781
VIPRE Gen:Heur.Mint.Zard.30
TrendMicro BKDR_ZEGOST.SM44
McAfeeD ti!924C4682DAA9
Trapmine malicious.moderate.ml.score
CTX exe.trojan.farfli
Emsisoft Trojan.GenericKD.75526179 (B)
Ikarus Trojan-PWS.Win32.Bjlog
FireEye Generic.mg.407c9a93188dc708
Jiangmin Backdoor.Generic.bqnp
Webroot Clean
Varist W32/ABTrojan.FYFU-9137
Avira Clean
Fortinet W32/Generic.AC.40BBF5
Antiy-AVL Trojan/Win32.Farfli
Kingsoft malware.kb.b.987
Gridinsoft Clean
Xcitium TrojWare.Win32.AntiAV.~D@fny3h
Arcabit Trojan.Mint.Zard.30
SUPERAntiSpyware Clean
Microsoft Trojan:Win32/Farfli!rfn
Google Detected
AhnLab-V3 Trojan/Win32.Agent.R97143
Acronis Clean
McAfee Artemis!407C9A93188D
TACHYON Trojan/W32.Agent.188416.BMN
VBA32 BScope.Backdoor.gh0RAT
Malwarebytes MachineLearning/Anomalous.100%
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall BKDR_ZEGOST.SM44
Rising Trojan.Farfli!8.FF (TFE:5:CQejOpL0yUV)
Yandex Trojan.GenAsa!iwTZsTxBTgQ
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.1728101.susgen
GData Trojan.GenericKD.75526179
AVG Win32:Evo-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Clean
No IRMA results available.