Static | ZeroBOX

PE Compile Time

2012-12-22 05:59:46

PE Imphash

dc73a9bd8de0fd640549c85ac4089b87

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000001f6 0x00000200 5.06407990051
.rdata 0x00002000 0x000001d8 0x00000200 4.27063873433
.data 0x00003000 0x00000034 0x00000200 0.568988040426
.rsrc 0x00004000 0x00032d9c 0x00032e00 7.81878468252
.reloc 0x00037000 0x00000052 0x00000200 0.736046433021

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_ICON 0x0000b300 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL GLS_BINARY_LSB_FIRST
RT_RCDATA 0x0000b768 0x0002b200 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x00036968 0x000000ae LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x00036a18 0x00000382 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, ASCII text, with CRLF line terminators

Imports

Library kernel32.dll:
0x402000 DeleteFileA
0x402004 ExitProcess
0x402008 FindResourceA
0x40200c FreeLibrary
0x402010 GetModuleHandleA
0x402014 GetProcAddress
0x402018 GetTempPathA
0x40201c LoadLibraryA
0x402020 LoadResource
0x402024 RtlMoveMemory
0x402028 SizeofResource
0x40202c VirtualAlloc
0x402030 lstrcatA
0x402034 CloseHandle
0x402038 CreateFileA
0x40203c FlushFileBuffers
0x402040 WriteFile

!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
kernel32.dll
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
\dup2patcher.dll
load_patcher
xxxxww
w47vP
BPwpP w
Bt'wrP P44w40
a'Wwu R
CGuwwgw$46
BVpv40
w'pCCa%
WwxwwwtRSCwWG7
rWwwCVw`
wwwwwapppppppp440pww
RRRRRRPp4
RCCA@!B
wrV4t%
wpapCG@
wpVw4!5%
wpWwwp5%BP
wwgwwpcC
wwwpppp
xwwwwwwxwp
wwsppp?ww
www4sww
$# ##%%%%%&##
./')00)
$1$)00)))**2((((
.3"%4(*5$6$7880006)(
((:#;'<
@$% A%8(B*888800
""@**'%#
(6'E$*8800'
F==$';%$
..#HIH*$%# ##(
J'''8,KLM
;?N.O"8PPQ8($%#70)*
SLLT9#
NVWOXYZZZ[\0'J%]0^8)60)($_LSL
@`aV8
bcccd[0$#ePfI6
#)00gg)
V`h5ijjddjjcP(VH[[\*#F=
k(',$#_
\lmmmmmn
#XopodqjH
8[rcs:*P[t8
800)(#
#N[uulvvvw
%`xyz{||})]7*ZZ*~
*Is)%
N #Puul
'7*0IIH
j|js*]e
\s^I\\s)'% ##
$ 'dcccccI
cdZ[P\s*$ (*
||q\$%0cZfPP\s
I*{P*#1I\s' %)
tqjc8"
{|ZPP`
!)Is(#
')*('$#
8II0$ #**($
[PP\IH)$ #('
d[PPQsH8(' "@
V4$%%E
OOO...
"""???????Puw
qjjqqqqqjcd[P
 !"#$$
&'()*+, -.*/01+22%
894$:;<=<*+3
66>?.0@
4$A%1B/
EFGHIJK1@
:B+L.MN
?RSJTTUVW+KX*)1Y%CC4
[\]^_TT`TabJ/4c
/fgggh
8ijklm-nop!qrK
C+.s)@
tuvvwxb
yz{|}~r/S
`Sn^K^X/3
F66666
 !"#$%&'()*&+$,-
./0123'4567+8$29:
BCDEFG.HIJ:
LMNOPQRSTU#VWXYHZ[[\.]
^_`abbcdefghijklmn
^rstuEvwxyzG{|7#}~
 !"#$%
&'()*+,-./01
456789:;<=>?@AB
CDE7FGHIJKL?MNOPQRSTUVWX,YZ[\]^_`abcdefgh,i1jklmnopqrestuvwxHyz{|}~
A@;;><=EECBEBA@EA>=E=99E533E+('E#!!E
i! !i/,,
i&%&i977
i0//iQJH
i;88ih][
iB>>imb^
iDB>ic\Y
i@?9`USO
865R;98Y976Y743Y.,,Y#! Y
('(wD@@
<99wfZX
KIDwqfc
B@:8JHG
becB`,c
R:)u8a
3"'QBz@
=hY(cx
x~]8xb*/
81P/`]~<
='e>g3
svQMlV
"c?"oza
xA{"u+l
NMiSoj
|6[85A]
f0!pDvE
m8d?Z)
hg mtl
|e(Z9:
M%{5M+
-m.D1?qt
CVA(9}f
up&Yjk
"0;RZE9
td7:Ad
\hRq;4p
qH/TZBW
/@nkqb
{V~nhG
:$]XcJ|>0
j|~z(u
ECvZ?Y
y]3X:cy
JBVT5Tm
Va|`4(\'k
<O@8GF*
Uus8 <a
]NO>?Wd
$yRrn99%
{-G#AL
y_-,:
-_9"Ph|
@)R_0p
t'"I1YE
dYb^nPH
%MU2ys
,GO?bX
R.K[LN
x<A:"W
<#MnPb
E*Pme*h
7J{_@
$71UC@
%%SA.Jh
7-VK[L
cB'hc
zYmLVK
Oi2dm[
[,8aR(
x~(S]/d
'9CNs*h~
=kA9b0"r{
hmE S#
(gMo;1m@
|4I+Lt
C>o~r=
*:&]-6F
O[\44m
<1o6gA
I7A X
GMtpSd
.R+'yC1(
L2Yj:1
}P~n$<
i%4x8kg
S8@7"?
*{'90`5%
I&%@7b
OD>;hA
yuvY^h/
9`p\=r
N,!wm9s
gm!62i
^F`w[d
jk5[?dr
tZqM#d(_
bznwuG
U:!bI:
1}@~k0
bH!l@WR
ez-J:B<
qCA*E?
t8Yvfbby
D)^#E
?uz>*R
lo93*O
e/Iuz9tf
+`]6oh
5wp02{<
].rd<C
z}+hDU
fttB`~
9$phkWlW
6+|e7e
Z4c%q4
-[P#~I<[
F8:E68
B%!m65
rU497R
l?b|H-$_
7y<xB~%
zQ2!z&
+A9O
azZ[Np
d[AE[8]e*
1J1I%/x)g,&1yN
:e'y'#
'L?PSde
{ @aUp
cTzcuk\
VV{R3t)
xg&NK4
43k*Pu
"z,ZCJs
LOXV1gERf
zP^br_
Jh:]{1
#D'Xq,GY
U_;WLPt<
KqHp.]
DFdHIt
a@&)S%p
$|*T;@
Q>BiB'
<0*`(w
8xyNmUM
ArN%1@
@%lac6
d9gF:0
lrAfGn
QI_t4i
/Rhx+~
FU,tA[
0g:Z7H
0 ;colt)
d.iS;Q?
KFzw<A
2,\>4BA
87.GnF
niVaof
F[.[P[
LZtP!b
z&U*@
E$|3.2
(*]E`r
)x*qG7
|=~YGZ
I@qO&]
&^R*[Q`O
LnFLqH?
L%OGhB
uQ()9@
0BdfNv<
hf1lx=
d0@eU,
V*1o$a!
Y!d&:q
Y}OAj^
e/:0N@$
CV}[WpN
9MdlYv:0
$%?#<]
*GE6`Fm
Q)x3Z+o
^A0DPt
/(q<^
iRB4wL
Rk'^$K
lFgV+`
C*ZQ4U
:Mo2JW
D,6p9~
wec^!2
1IM}Os4
ea eA6
9gil{~<
YSi2S+
7H@.{Z
`~u8+k
mG$[kT
z8Q==r
50Ys=ED
CbNkI6
]d;^oG
Id(5yz/
t-eaP%
Q]\I5~eX
Y{CwWO
RHs\]6
&sQeL$
hp?A^O9
k\Y6+t
nG{\:Sny
CVL:j$
DYk=W@
U.Y\Hd
20zo@Q6
IFK,[Q
WvyR1-
x{Ux@EY
B,]WZE
9289n1
OM_Y{q
c>iu|0
"Uv#fG
SCu!VU
h4F];V
E55wN@s
IeJL}|w
G9n9(S
pbX0!*z
ha|gs"33
#DXQUt
EhQ*^E
Sd@^u
XAYEy0
V+$L2a
:S+cY1A}
o5-R)
[+xAPz
xjkA]s
kk-i(=
yy@qG>
C`d;C~f0)
}Ah?7a]
H~^O[v
LOVMb=
z~fwW"
>aQreA5
^oJk>
hj,}-N
Lm>\qP$<\
e={`d}
k5Rmp
}\hlF,
]~Q0`2
J1T7bS
(md8H~
n`Qtw
TD&VX4
LCB$$'f]
`!['@
=nDv)e
a_0^1=
}k)lir
xs-Vg-8
A&lMxK\v<
RSxpAN
sTwc5L
oaykqjv
l>}~x
I`R\(.
\KTa:p
h[z[8F
.JN!X)
r2K5>j
nPhh?/5
IxJT=]
"cAl4'
aU"z>"WR~%
ryG,!
}wzze9
Z;pjLF
Y>Cg)X3
qsoi*rt
QWOVph
?<*KSc{G
lP7UFJ2
{A;bTK
D$e)=XB
0,DlMk
O(TxPQU
j/o+OC
's3[&\
zvpM3
>S3+J3\?`"o
8=<k7+
-_`M!
xyT>&0o
KPtU~z
r<R/X*
|: +2r
Dp1(bf
-:bjDj
>^5KYJl
H1:AO_,
]+*-q7U
W{84gI
{+1#(,Qnk
L6ey:2
y+`H90
J5LVd"
x1>mGAx6
B20n|/
QFAfEB
W5m:!}
%<9_
>O\%GL
ft t01
|e^t(X
"VM'dN
|cO/~^
A<|j6
JfKSVp:xd
"<*FkcV
Z[YW]S
cHaEZi
~Fi`R|B
@fZ{Io
1$0!)4
)@bT~@^nU
OP_Vb7
HnZwKlW
nq`fjs]
Y;H#r,AC
hjlf`Z
(F3Gwy`
^qHj\nT
l@EKQ[W
qqp&6Q
ihd]i~
0",2")2
UvCWp;
=#1'1%
yc$4<M
MNKOHKL
=/ClcZ~G
8TL9w_^*.X
79148-Ci
!%2^}P
L6y BD
ZV[O@<|
y:-'$(!0$
*L7[;D
gy+|#3>;)
>3;6<05
034745
CIS_Ta3
PA<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="2.0.0.0"
processorArchitecture="X86"
name="Patch"
type="win32"
<description>Patch</description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="X86"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="requireAdministrator"
uiAccess="false"
/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
181>1D1J1P1V1\1b1h1n1t1z1
Antivirus Signature
Bkav Clean
Lionic Hacktool.Win32.Agent.tpR4
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Riskware.Dupatcher.A4
Skyhigh BehavesLike.Win32.FilePatcher.dc
ALYac Application.Generic.3899159
Cylance Unsafe
Zillya Clean
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/grayware_confidence_100% (W)
Alibaba Clean
K7GW Trojan ( 0040f3a51 )
K7AntiVirus Trojan ( 0040f3a51 )
huorong Clean
Baidu Win32.Trojan.Generic.f
VirIT Clean
Paloalto generic.ml
Symantec SMG.Heur!gen
tehtris Clean
ESET-NOD32 a variant of Win32/HackTool.Patcher.AD potentially unsafe
APEX Clean
Avast FileRepMalware [Misc]
Cynet Malicious (score: 100)
Kaspersky Clean
BitDefender Application.Generic.3899159
NANO-Antivirus Clean
ViRobot Trojan.Win32.Agent.754688.B
MicroWorld-eScan Application.Generic.3899159
Tencent Clean
Sophos Generic Patcher (PUA)
F-Secure Clean
DrWeb Clean
VIPRE Application.Generic.3899159
TrendMicro Clean
McAfeeD Real Protect-LS!5610BD76AEBB
Trapmine malicious.moderate.ml.score
CTX exe.hacktool.patcher
Emsisoft Application.Generic.3899159 (B)
Ikarus possible-Threat.Hacktool.Patcher
FireEye Generic.mg.5610bd76aebbe70f
Jiangmin Clean
Webroot W32.Hacktool.Gen
Varist W32/Agent.EWQQ-1275
Avira Clean
Fortinet Riskware/GamePatcher
Antiy-AVL HackTool/Win32.Patcher.ad
Kingsoft Win32.HackTool.Keygen.v
Gridinsoft Hack.Win32.Patcher.sa
Xcitium Application.Win32.HackTool.Patcher.T@8rlo7s
Arcabit Application.Generic.D3B7F17
SUPERAntiSpyware Hack.Tool/Gen-Crack
ZoneAlarm Clean
Microsoft HackTool:Win32/Keygen
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee FilePatcher
TACHYON Clean
VBA32 Clean
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/CI.A
Zoner Clean
TrendMicro-HouseCall Trojan.Win32.VSX.PE04C9V
Rising HackTool.Patcher!1.B3BB (CLASSIC)
Yandex Clean
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
GData Win32.Riskware.Patcher.E
AVG FileRepMalware [Misc]
DeepInstinct MALICIOUS
alibabacloud HackTool:Win/Patcher.AF
No IRMA results available.