Static | ZeroBOX

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00002000	0x0044662c	0x00446800	7.98177240472
.rsrc	0x0044a000	0x000005be	0x00000600	4.12710874935
.reloc	0x0044c000	0x0000000c	0x00000200	0.101910425663

Name	Offset	Size	Language	Sub-language	File type
RT_VERSION	0x0044a05c	0x0000033c	LANG_NEUTRAL	SUBLANG_NEUTRAL	data
RT_MANIFEST	0x0044a3d4	0x000001ea	LANG_NEUTRAL	SUBLANG_NEUTRAL	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

!This program cannot be run in DOS mode.

`.rsrc

@.reloc

, +W{l

+K+L0%,

+F91(+CA2

+!+"02

+I+J02

+G91&

+<+=9%,

+10Y*+.F0

++A%,

X*+aY

+E+F+G

+D++C+Do|

+=+>+?

-_ 3Q

-f+k8p

+"*+"{E

++ +%*

+ &+${f

+&+.+/+4+5+6,

+@+A+B+G

,++-+.+3

+/+4+9+:+;+<

+!+"+#+%+&(

+K+L+M

,%+b8c

p+'z++{

p+5z+9+:+;+@+A{x

+6+7{x

p+'z+++,+-+.}w

p+2z+6-

p+0z+4{

+0+1+2+7{

+&+'+(+-

+'+(+)+*s

-'&+++,

+Z+_+`+ao

-1+1+2+3+4+5+7,

*+5+6,

&&&&&8

- +V+W

- +\+]

,D&+E+F

+!+"+#

,!+&uV

,1&+1r

p+-+2r

-0+U8Z

3"+\{$

+'+(,

+(*+(+)+*+/

+(+)+*+/+0+1,

+4+5+6

+O+P+U{i

*+S+T+U+V+WoU

+V+W+X+`+

+f+g+h{

+.+/+4+9

++ {h

+R+S+T+Y{c

+W*+W+Xo

+7- +:{d

,!+0{e

,8,+r[

+(+)+.+/+4+5+:+;

+"+#+(+)+.+/s

-#+,,

+(+)+*,

+*+++0o

-++U{t

3!+R{s

,N&+NE

-++4+=

+5+6{u

+ +!+&

-&+&+'+,

+(+-+.

++ +!*

&+5+@+A+F

-++U{}

3!+R{|

,%+.{|

++$+%+*+++0+1

-#+,,

+(+)+*,

+*+++0o

,N&+NE

-++4+=

,++o8p

-S+S+T8Y

+$+,+-+2+3o

%,(2(8_

p+^-%+dr

+N+O+T+U-

+N+O+T

+M+N+V+Z-

+T+Y+Z+_

+9z+={

+2+3+8+=+>-

+]z+a{

+V+W+\+a+b-

+@z+D{

+9+:+?+D+E-

,&+&+'

++ +%+&+++,

z++ +%

+5+6+;

,(+({)

,1+1{5

,(+({A

,1+1{J

-%+A{W

+=+3+<{S

+8+9+:+?+D+E

+"+#+(

+"+#+(*

+++,+13

+0+1+2

+0+1oa

+ +!+"+#

-'&&+*++ob

+=+>+C

+A+B+G+H+I+Job

+ +!+"+#

-'&&+*++oa

+=+>+C

+A+B+G+H+I+Joa

+'+(+-

+*+++03

*+(+)+.3

+[z+b{

*+`+a{

+"X+"+#+$+%

+5+6,)

,++1,'+0{

+5+:+?+D+I

+2+3+8

+2+7+<

+9+>+C

+8+9+>

+8+9+>+?{

+,+1+2+7

+,+-+2+3{

+W+_+c8h

+e+f+j

,[+Z{B

+ +!+&

+E+M+N+S+T

+!+"+'

+R+S{<

+.-!+1{

,Z+Y{;

+U+V{<

+M+N{;

+9+:|"

++ |"

+8+9+>-#+A{C

+=+>+C-

+( +'+,+-+.+3

p+5z+9

,?&+C+D+I

+@+A+B

p+cz+j{A

+i+j+r,0+x+|

+R+S{p

+"+'+(+)

+(+-+2+3{

-.+]+^u

-#+_+`u

,'+)+*+++,

%,;*8e

+J+K+L{

+L+M+N+O+Pu

+>+C+D+I+J+K

,O&+OoD

*+A+B,8+E+F, ~

+H,#+K

+*+++,{v

+!+"{v

~1>+\

%,D*8u

+-+.{.

+8+=+B

bY {z}

+!+"+'

+Z+2+`{

%-"+d8e

.++]+a+e{0

+d+e+m8n

+ +!*s

,$+7+8+:+;r

+o+s8x

+o+p|#

p+'z++-

p+"z+&{

+"+#+$

,+r8s

Y_bX

Y_cX

Y_bY

Y_bX

+@+"+?+@{v

+K+8+J+K

+.+/+0+5{

+*++{7

+'_d}7

,?&+C+D+I

+@+A+B

Y_bX

Y_bXT

+Tz+[

+>+?+@{;

,(+9+:+?+@E

+7+8+9+>+C+D,

+G+H+I(

+/+0+5+6+;

+=+>+C+D

_+U+V{

_b`}7

,8&+<{

p+=z+A-

p+;z+?{

+f+k+l8q

+3+4+5+6

+,+-+.{

+< +;+@+A

-%+A+B}

""o&

''o&

\\o&

hXhS+E

+++,{7

__d}7

+?+@-6

+;+@+A-!

+ +!+"*

+* +)+.+/+0+5

+C+Q{u

+P+X+\

2(+Z+[{x

+W+\+]{v

,1+R+S+X+Yu

-"+Z+[u

+G+H,5+G+H+M+N-

_b`}

_b`}7

,;+@+A+I+

+>+C{j

+?+D{j

+@+A+F{j

p+gz+k+l|

+"+#{K

-&&&+)|

-9&+=r

+3+4+5+6+7

-;&&&&

+L+M-+L+M+R+S{

+<+A+B{

p+&z+*

p+ z+${

Y_bY

+"+#+$}&

+ +!}(

+M+N8S

-+B+C

+P+Q+R

,W&+^+b

+r+v8w

+%+&+'+(+)s

+J+K+P,1+S{x

+Q-0+P{x

++ _c+

p+_z+c

v4.0.30319

#Strings

&)&M&Z&a&g&o&

','2'T'i'

(B(L([(

)$)*):)d)

+1+<+C+Q+W+g+

+9,Y,q,

-#-.-U-|-

."/./8/b/o/u/{/

/$050Q0d0

1%151;1A1K1Y1i1z1~1

2%282Q2l2t2z2

3(3.343=3B3\3o3~3

314X4f4m4

5'5-595

/7>Pk

H P X a o

!U!]!h!q!{!

"="C"K"q"z"

%2%<%D%K%

&F'M'.(:(R(y(

(@)J)T)})

+(+l+w+

,A-K-a-k-o-y-

.".2.a.m.

.I/Q/Y/

/)0/0`1

newnoadminpc.exe

newnoadminpc

mscorlib

Object

System

ValueType

EventType

SharpYaml.Events

YamlStyle

SharpYaml

Exception

IEnumerable`1

System.Collections.Generic

KeyValuePair`2

IEnumerable

System.Collections

IEnumerator`1

IEnumerator

IDisposable

IEqualityComparer`1

IEquatable`1

Attribute

SerializeMemberMode

SharpYaml.Serialization

IDictionaryEnumerator

ICollection`1

ICollection

Comparer`1

IDictionary`2

IDictionary

MulticastDelegate

KeyedCollection`2

System.Collections.ObjectModel

ScalarStyle

MemoryStream

System.IO

PoweredByAttribute

SmartAssembly.Attributes

Action

ResourceManager

System.Resources

CultureInfo

System.Globalization

TextWriter

Stack`1

Queue`1

System.Text.RegularExpressions

MatchEvaluator

value__

YAML_NO_EVENT

YAML_STREAM_START_EVENT

YAML_STREAM_END_EVENT

YAML_DOCUMENT_START_EVENT

YAML_DOCUMENT_END_EVENT

YAML_ALIAS_EVENT

YAML_SCALAR_EVENT

YAML_SEQUENCE_START_EVENT

YAML_SEQUENCE_END_EVENT

YAML_MAPPING_START_EVENT

YAML_MAPPING_END_EVENT

List`1

System.Core

HashSet`1

IList`1

TextReader

StringBuilder

System.Text

Dictionary`2

Func`2

DateTime

PropertyInfo

System.Reflection

FieldInfo

MethodInfo

Action`2

DictionaryEntry

Nullable`1

MemberInfo

Assembly

Default

Assign

Content

Binary

IComparer`1

EqualityComparer`1

SingleQuoted

DoubleQuoted

Literal

Folded

Version

.cctor

ToString

GetHashCode

Stream

document

Invoke

BeginInvoke

IAsyncResult

AsyncCallback

callback

object

EndInvoke

result

ResolveEventArgs

ICryptoTransform

System.Security.Cryptography

MoveFileEx

kernel32

AppDomain

Bneykyvwp

Jyncpuvour

Gvugozceox

Buffer

EndOfInput

IsUnicode

ForceIndentLess

Parser

NestingIncrease

IsImplicit

Anchor

IsCanonical

IsPlainImplicit

IsQuotedImplicit

Reader

Writer

Settings

ObjectSerializerBackend

Current

Column

CurrentPosition

Pattern

PatternSource

AllowFailsafeString

Members

HasMembers

IsCompilerGenerated

AttributeRegistry

ElementType

HasOnlyCapacity

IsPureCollection

HasAdd

IsGenericDictionary

KeyType

IsPureDictionary

System.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<System.Object,System.Object>>.Current

System.Collections.IEnumerator.Current

HasSet

ShouldSerialize

DeclaringType

UnderlyingType

EmittedAnchors

SourceValue

SourceType

RenderedValue

IsSerializing

Schema

Serializer

ObjectSerializer

ObjectFactory

Emitter

UseShortTypeName

AllNodes

System.Collections.Generic.IEnumerator<SharpYaml.Serialization.YamlNode>.Current

RootNode

Children

SerializeMethod

PreferredIndent

EmitAlias

IndentLess

SortKeyForMapping

EmitJsonComptible

EmitCapacityForList

LimitPrimitiveFlowSequence

EmitDefaultValues

EmitShortTypeName

DefaultStyle

SpecialCollectionMember

Attributes

Documents

IsPossible

IsRequired

TokenNumber

System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<TKey,TValue>>.IsReadOnly

Comparer

System.Collections.Generic.IDictionary<TKey,TValue>.Keys

Values

System.Collections.Generic.IDictionary<TKey,TValue>.Values

System.Collections.IDictionary.IsFixedSize

System.Collections.IDictionary.IsReadOnly

System.Collections.IDictionary.Keys

System.Collections.IDictionary.Values

System.Collections.IDictionary.Item

System.Collections.ICollection.IsSynchronized

System.Collections.ICollection.SyncRoot

NotStartedOrEnded

System.Collections.IDictionaryEnumerator.Key

System.Collections.IDictionaryEnumerator.Value

System.Collections.IDictionaryEnumerator.Entry

System.Collections.Generic.ICollection<TKey>.IsReadOnly

System.Collections.Generic.ICollection<TValue>.IsReadOnly

System.Collections.Generic.ICollection<T>.IsReadOnly

Length

Position

Handle

Prefix

Suffix

IsWebApplication

AvailableBits

AvailableBytes

IsNeedingInput

TotalOut

IsFinished

BitCount

IsFlushed

GetEnumerator

MoveNext

get_Current

Dispose

Equals

Contains

Remove

get_IsReadOnly

get_Keys

get_Values

CopyTo

get_IsFixedSize

get_Item

set_Item

get_IsSynchronized

get_SyncRoot

get_Count

ContainsKey

TryGetValue

get_Key

get_Value

get_Entry

Compare

GetKeyForItem

CompilationRelaxationsAttribute

System.Runtime.CompilerServices

RuntimeCompatibilityAttribute

DebuggableAttribute

System.Diagnostics

DebuggingModes

AssemblyTitleAttribute

AssemblyDescriptionAttribute

AssemblyConfigurationAttribute

AssemblyCompanyAttribute

AssemblyProductAttribute

AssemblyCopyrightAttribute

AssemblyTrademarkAttribute

GuidAttribute

System.Runtime.InteropServices

AssemblyFileVersionAttribute

TargetFrameworkAttribute

System.Runtime.Versioning

ComVisibleAttribute

CompilerGeneratedAttribute

GeneratedCodeAttribute

System.CodeDom.Compiler

DebuggerNonUserCodeAttribute

DefaultMemberAttribute

ExtensionAttribute

AttributeUsageAttribute

AttributeTargets

DebuggerDisplayAttribute

ObsoleteAttribute

DebuggerHiddenAttribute

ParamArrayAttribute

EditorBrowsableAttribute

System.ComponentModel

EditorBrowsableState

{fe43f62a-c90a-4c01-8a9c-a93383fa8271}

GetTypeFromHandle

RuntimeTypeHandle

get_Assembly

GetObject

String

get_Chars

get_Length

get_Encoding

Encoding

get_UTF8

get_Unicode

get_BigEndianUnicode

get_InvariantCulture

Format

IFormatProvider

ArgumentOutOfRangeException

Dequeue

Enqueue

Enumerator

IsNullOrEmpty

AppendFormat

Capture

GetBytes

RegexOptions

get_Name

GetType

IsMatch

Boolean

ArgumentException

ArgumentNullException

Enumerable

System.Linq

OfType

InvalidOperationException

RemoveAt

Insert

get_FullName

NotSupportedException

get_Success

Concat

Replace

Convert

ToInt32

ToDouble

get_Groups

GroupCollection

op_Equality

get_Millisecond

get_Hour

get_Minute

get_Second

op_Inequality

get_IsValueType

Activator

CreateInstance

get_IsArray

GetConstructor

ConstructorInfo

Comparison`1

ToArray

get_HasValue

CompareTo

CompareOrdinal

KeyNotFoundException

GetFields

BindingFlags

Select

AddRange

GetProperties

ToList

get_Namespace

StartsWith

get_IsClass

get_IsInterface

GetElementType

GetMethod

get_ReturnType

DefaultValueAttribute

get_CanRead

GetGetMethod

GetIndexParameters

ParameterInfo

get_IsPublic

MethodBase

GetArrayRank

MakeGenericType

GetGenericArguments

GetProperty

IsAssignableFrom

MakeGenericMethod

Thread

System.Threading

get_CurrentThread

get_ManagedThreadId

get_DeclaringType

get_FieldType

GetValue

SetValue

Nullable

GetUnderlyingType

get_CanWrite

GetSetMethod

get_PropertyType

FirstOrDefault

GetTypeCode

TypeCode

ReferenceEquals

RuntimeHelpers

get_IsEnum

TimeSpan

ToCharArray

UInt16

UInt32

UInt64

Single

Double

Decimal

ToObject

GetCustomAttributes

GetTypes

LastIndexOf

Substring

EscapeUriString

UnescapeDataString

get_AssemblyQualifiedName

Random

Append

IndexOf

get_Default

GetLowerBound

get_Rank

ArrayTypeMismatchException

Interlocked

CompareExchange

Collection`1

GetInterfaces

get_IsGenericType

GetGenericTypeDefinition

get_BaseType

get_IsGenericTypeDefinition

IntPtr

get_IsPrimitive

op_Explicit

Process

GetCurrentProcess

get_MainModule

ProcessModule

get_ModuleName

ToLower

ResolveEventHandler

get_CurrentDomain

add_ResourceResolve

GetManifestResourceNames

Monitor

GetExecutingAssembly

StackTrace

GetFrames

StackFrame

get_Module

Module

InitializeArray

RuntimeFieldHandle

BlockCopy

get_Position

set_Position

TransformFinalBlock

get_Message

SymmetricAlgorithm

CreateDecryptor

CreateEncryptor

RijndaelManaged

StringComparison

System.Threading.Tasks

EndOfStreamException

IComparable

set_Length

StringWriter

ToByte

FormatException

WriteLine

ReadByte

InvokeMember

Binder

add_AssemblyResolve

WriteByte

ToBase64String

GetManifestResourceStream

GetTempPath

Antivirus	Signature
Bkav	Clean
Lionic	Clean
Elastic	malicious (high confidence)
ClamAV	Win.Packed.Msilheracles-10017859-0
CMC	Clean
CAT-QuickHeal	Clean
Skyhigh	BehavesLike.Win32.Generic.rc
ALYac	Gen:Variant.Jalapeno.20123
Cylance	Unsafe
Zillya	Clean
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
Alibaba	Clean
K7GW	Clean
K7AntiVirus	Clean
huorong	Clean
Baidu	Clean
VirIT	Trojan.Win32.MSIL_Heur.A
Paloalto	Clean
Symantec	ML.Attribute.HighConfidence
tehtris	Clean
ESET-NOD32	a variant of MSIL/Kryptik.ANKW
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Cynet	Clean
Kaspersky	HEUR:Trojan-PSW.MSIL.PureLogs.gen
BitDefender	Gen:Variant.Jalapeno.20123
NANO-Antivirus	Clean
ViRobot	Clean
MicroWorld-eScan	Gen:Variant.Jalapeno.20123
Tencent	Clean
Sophos	Generic ML PUA (PUA)
F-Secure	Heuristic.HEUR/AGEN.1371449
DrWeb	Clean
VIPRE	Gen:Variant.Jalapeno.20123
TrendMicro	Clean
Trapmine	malicious.high.ml.score
CTX	exe.unknown.jalapeno
Emsisoft	Gen:Variant.Jalapeno.20123 (B)
Ikarus	Trojan.MSIL.Agent
FireEye	Generic.mg.e24846b05948ac79
Jiangmin	Clean
Webroot	Clean
Varist	W32/MSIL_Kryptik.KLQ.gen!Eldorado
Avira	HEUR/AGEN.1371449
Fortinet	MSIL/Kryptik.ANKW!tr
Antiy-AVL	Clean
Kingsoft	malware.kb.c.996
Gridinsoft	Clean
Xcitium	Clean
Arcabit	Trojan.Jalapeno.D4E9B
SUPERAntiSpyware	Clean
ZoneAlarm	Clean
Microsoft	Clean
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5747892
Acronis	Clean
McAfee	Clean
TACHYON	Clean
VBA32	Clean
Panda	Clean
Zoner	Clean
TrendMicro-HouseCall	Trojan.Win32.VSX.PE04C9V
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:/1fZc2ATRs0KEKnBNunopA)
Yandex	Clean
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
GData	Gen:Variant.Jalapeno.20123
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	Clean
alibabacloud	Clean

Static Analysis

PE Compile Time

PE Imphash

Sections

Resources

Imports