Static | ZeroBOX

PE Compile Time

2023-03-07 15:40:05

PDB Path

E:\PTtoolsANDnode\tools\6.免杀\cs免杀 2022-0307\FilelessPELoader-main\FilelessPELoader-main\FilelessPELoader\Release\FilelessPELoader.pdb

PE Imphash

6dd303f3762d1ed0a4f4e507f85f4afe

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001dc4 0x00001e00 6.33151351963
.rdata 0x00003000 0x00001798 0x00001800 4.93967363206
.data 0x00005000 0x00000418 0x00000200 1.77599479148
.rsrc 0x00006000 0x000001e0 0x00000200 4.69759700825
.reloc 0x00007000 0x00000338 0x00000400 5.80488867788

Resources

Name Offset Size Language Sub-language File type
RT_MANIFEST 0x00006060 0x0000017d LANG_ENGLISH SUBLANG_ENGLISH_US XML 1.0 document text

Imports

Library KERNEL32.dll:
0x403024 LoadLibraryA
0x403028 GetProcAddress
0x40302c GetLastError
0x403030 WideCharToMultiByte
0x403040 MultiByteToWideChar
0x403044 ExitThread
0x403048 LocalAlloc
0x40304c TerminateProcess
0x403050 VirtualAlloc
0x403054 GetCurrentProcess
0x403058 GetCurrentProcessId
0x40305c GetCurrentThreadId
0x403064 InitializeSListHead
0x403068 IsDebuggerPresent
0x40306c GetModuleHandleW
Library USER32.dll:
0x403088 EnumThreadWindows
Library ADVAPI32.dll:
0x403004 CryptDecrypt
0x403008 CryptCreateHash
0x40300c CryptDeriveKey
0x403010 CryptHashData
0x403014 CryptDestroyHash
0x403018 CryptReleaseContext
0x40301c CryptDestroyKey
Library SHELL32.dll:
0x403080 CommandLineToArgvW
Library MSVCP140.dll:
Library WINHTTP.dll:
0x4030bc WinHttpConnect
0x4030c0 WinHttpCloseHandle
0x4030c4 WinHttpOpenRequest
0x4030c8 WinHttpReadData
0x4030cc WinHttpOpen
0x4030d8 WinHttpSendRequest
Library VCRUNTIME140.dll:
0x403090 __CxxFrameHandler3
0x40309c __current_exception
0x4030a4 memset
0x4030ac _CxxThrowException
0x4030b0 memmove
0x4030b4 memcpy
Library api-ms-win-crt-runtime-l1-1-0.dll:
0x403114 _exit
0x403118 _initterm_e
0x40311c _initterm
0x403128 _cexit
0x40312c _c_exit
0x403130 _controlfp_s
0x403134 terminate
0x40313c __p___argv
0x403148 _crt_atexit
0x403150 _set_app_type
0x403154 exit
0x403158 _seh_filter_exe
0x403160 __p___argc
Library api-ms-win-crt-heap-l1-1-0.dll:
0x4030ec free
0x4030f0 _set_new_mode
0x4030f4 malloc
0x4030f8 _callnewh
0x4030fc calloc
Library api-ms-win-crt-convert-l1-1-0.dll:
0x4030e0 atoi
0x4030e4 mbstowcs
Library api-ms-win-crt-stdio-l1-1-0.dll:
0x40316c __p__commode
0x403170 _set_fmode
0x403174 __acrt_iob_func
Library api-ms-win-crt-string-l1-1-0.dll:
0x40317c _stricmp
Library api-ms-win-crt-math-l1-1-0.dll:
0x40310c __setusermatherr
Library api-ms-win-crt-locale-l1-1-0.dll:
0x403104 _configthreadlocale

!This program cannot be run in DOS mode.
-TJLL:
RichLL:
`.rdata
@.data
@.reloc
SSSSSSW
u"h$5@
VShL5@
u"hl5@
D$ PWj
bad allocation
Unknown exception
bad array new length
Failed in CryptAcquireContextW (%u)
Failed in CryptCreateHash (%u)
Failed in CryptHashData (%u)
Failed in CryptDeriveKey (%u)
Failed in CryptDecrypt (%u)
Failed in WinHttpConnect (%u)
Failed in WinHttpOpenRequest (%u)
Failed in WinHttpSendRequest (%u)
Failed in WinHttpReceiveResponse (%u)
Error %u in WinHttpQueryDataAvailable (%u)
Error %u in WinHttpReadData.
Failed in retrieving the Shellcode
Error %d has occurred.
GetCommandLineA
GetCommandLineW
__wgetmainargs
__getmainargs
__p___argv
__p___wargv
__p___argc
quick_exit
ExitProcess
ntdll.dll
NtUnmapViewOfSection
[+] Usage: %s <Host> <Port> <Cipher> <Key>
[+] Get AES Encrypted PE from %s:%d
[-] Failed in getting AES Encrypted PE
[+] Get AES Key from %s:%d
[-] Failed in getting key
[+] AES PE Address : %p
[+] AES Key Address : %p
[+] Decrypt the PE
[+] PE Decrypted
whatEver
[+] Loading and Running PE
[+] Finished
vector too long
E:\PTtoolsANDnode\tools\6.
2022-0307\FilelessPELoader-main\FilelessPELoader-main\FilelessPELoader\Release\FilelessPELoader.pdb
.text$mn
.text$x
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIZ
.CRT$XPA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$voltmd
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data$r
.data$rs
.rsrc$01
.rsrc$02
GetCurrentProcess
VirtualAlloc
TerminateProcess
LocalAlloc
ExitThread
MultiByteToWideChar
GetLastError
LoadLibraryA
GetProcAddress
WideCharToMultiByte
KERNEL32.dll
EnumThreadWindows
USER32.dll
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptDeriveKey
CryptCreateHash
CryptDecrypt
CryptAcquireContextW
CryptDestroyKey
ADVAPI32.dll
CommandLineToArgvW
SHELL32.dll
?_Xlength_error@std@@YAXPBD@Z
MSVCP140.dll
WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse
WINHTTP.dll
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
_CxxThrowException
__current_exception
__current_exception_context
memset
_except_handler4_common
VCRUNTIME140.dll
calloc
mbstowcs
__acrt_iob_func
__stdio_common_vfprintf
_stricmp
_invalid_parameter_noinfo_noreturn
malloc
_callnewh
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
memcpy
memmove
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVbad_array_new_length@std@@
.?AVtype_info@@
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
1#1?1_1p1y1
1-2?2X2o2v2
3U3b3h3v3|3
6:6H6T6p6~6
7 7,7H7V7b7~7
9$9*919F9^9d9r9}9
</<R<]<g<
<$=.=4=T=^=d=z=
1070>0
3%3,3?3M3S3Y3_3e3k3r3y3
4!4>4D4X4
5@5O5f5l5r5x5~5
5E6R6z6
7@7I7]7c7
:P:U:i:s:|:#;,;4;o;y;
<#<*<9<C<I<O<U<[<a<g<m<s<y<
8,808D8T8X8h8x8
= =(=0=D=
040P0x0
WinHTTP Example/1.0
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Trojan.Ghanarava.1743000497d65692
Skyhigh Clean
ALYac Gen:Variant.Fragtor.460102
Cylance Unsafe
Zillya Clean
Sangfor Trojan.Win32.Turtleloader.V0bj
CrowdStrike win/malicious_confidence_90% (W)
Alibaba Trojan:Win32/TurtleLoader.2cc73bf9
K7GW Clean
K7AntiVirus Clean
huorong Clean
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/HackTool.Inject.AY
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Inject.gen
BitDefender Gen:Variant.Fragtor.460102
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Gen:Variant.Fragtor.460102
Tencent Win32.Trojan.Agen.Ztjl
Sophos ATK/FPELoader-A
F-Secure Heuristic.HEUR/AGEN.1374964
DrWeb Clean
VIPRE Gen:Variant.Fragtor.460102
TrendMicro Clean
McAfeeD ti!7CF57C07F5D1
Trapmine Clean
CTX exe.trojan.agen
Emsisoft Gen:Variant.Fragtor.460102 (B)
Ikarus Clean
FireEye Generic.mg.7b10d8430d88fe76
Jiangmin TrojanDownloader.Seraph.ap
Webroot Clean
Varist W32/Injector.ALK.gen!Eldorado
Avira HEUR/AGEN.1374964
Fortinet W32/Inject.AY!tr
Antiy-AVL Trojan/Win32.TurtleLoader
Kingsoft Clean
Gridinsoft Trojan.Win32.Downloader.sa
Xcitium Clean
Arcabit Trojan.Fragtor.D70546
SUPERAntiSpyware Clean
ZoneAlarm ATK/FPELoader-A
Microsoft Trojan:Win32/TurtleLoader.PEL!dha
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!7B10D8430D88
TACHYON Clean
VBA32 Clean
Malwarebytes Generic.Malware/Suspicious
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R014H01CQ25
Rising Trojan.TurtleLoader!8.123C4 (TFE:5:wxIANB7ovpI)
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
GData Gen:Variant.Fragtor.460102
AVG Win32:MalwareX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud HackTool:Win/Inject.AN
No IRMA results available.