Static | ZeroBOX

PE Compile Time

2018-02-02 05:17:02

PE Imphash

13c32f913271e5cf427548b785e74521

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.code 0x00001000 0x00004f59 0x00005000 5.51664546475
.text 0x00006000 0x0000fed5 0x00010000 6.33466090086
.rdata 0x00016000 0x00004afd 0x00004c00 6.64187782617
.pdata 0x0001b000 0x00001098 0x00001200 4.80297530298
.data 0x0001d000 0x00002308 0x00001600 4.39346700958
.rsrc 0x00020000 0x00000b54 0x00000c00 7.22936506953

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x000208e8 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
RT_RCDATA 0x000208e8 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
RT_RCDATA 0x000208e8 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
RT_RCDATA 0x000208e8 0x00000001 LANG_NEUTRAL SUBLANG_NEUTRAL very short file (no magic)
RT_MANIFEST 0x000208ec 0x00000267 LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, ASCII text

Imports

Library msvcrt.dll:
0x14001d6d8 memset
0x14001d6e0 wcsncmp
0x14001d6e8 memmove
0x14001d6f0 wcsncpy
0x14001d6f8 wcsstr
0x14001d700 _wcsnicmp
0x14001d708 _wcsicmp
0x14001d710 wcslen
0x14001d718 wcscpy
0x14001d720 wcscmp
0x14001d728 memcpy
0x14001d730 tolower
0x14001d738 wcscat
0x14001d740 malloc
0x14001d748 free
Library KERNEL32.dll:
0x14001d758 GetModuleHandleW
0x14001d760 HeapCreate
0x14001d768 GetStdHandle
0x14001d770 HeapDestroy
0x14001d778 ExitProcess
0x14001d780 WriteFile
0x14001d788 LoadLibraryExW
0x14001d790 EnumResourceTypesW
0x14001d798 FreeLibrary
0x14001d7a0 RemoveDirectoryW
0x14001d7a8 GetExitCodeProcess
0x14001d7b0 EnumResourceNamesW
0x14001d7b8 GetCommandLineW
0x14001d7c0 LoadResource
0x14001d7c8 SizeofResource
0x14001d7d0 FreeResource
0x14001d7d8 FindResourceW
0x14001d7e0 GetShortPathNameW
0x14001d7e8 GetTempFileNameW
0x14001d7f0 EnterCriticalSection
0x14001d7f8 CloseHandle
0x14001d800 LeaveCriticalSection
0x14001d810 WaitForSingleObject
0x14001d818 TerminateThread
0x14001d820 CreateThread
0x14001d828 Sleep
0x14001d830 WideCharToMultiByte
0x14001d838 HeapAlloc
0x14001d840 HeapFree
0x14001d848 LoadLibraryW
0x14001d850 GetProcAddress
0x14001d858 GetCurrentProcessId
0x14001d860 GetCurrentThreadId
0x14001d868 GetModuleFileNameW
0x14001d870 GetEnvironmentVariableW
0x14001d878 SetEnvironmentVariableW
0x14001d880 GetCurrentProcess
0x14001d888 TerminateProcess
0x14001d890 RtlLookupFunctionEntry
0x14001d898 RtlVirtualUnwind
0x14001d8b0 HeapSize
0x14001d8b8 MultiByteToWideChar
0x14001d8c0 CreateDirectoryW
0x14001d8c8 SetFileAttributesW
0x14001d8d0 DeleteFileW
0x14001d8d8 GetCurrentDirectoryW
0x14001d8e0 SetCurrentDirectoryW
0x14001d8e8 GetTempPathW
0x14001d8f0 CreateFileW
0x14001d8f8 SetFilePointer
0x14001d900 TlsFree
0x14001d908 TlsGetValue
0x14001d910 TlsSetValue
0x14001d918 TlsAlloc
0x14001d920 HeapReAlloc
0x14001d928 DeleteCriticalSection
0x14001d930 GetLastError
0x14001d938 SetLastError
0x14001d940 UnregisterWait
0x14001d948 GetCurrentThread
0x14001d950 DuplicateHandle
Library SHELL32.DLL:
0x14001d968 ShellExecuteExW
0x14001d970 SHGetFolderLocation
0x14001d978 SHGetPathFromIDListW
Library WINMM.DLL:
0x14001d988 timeBeginPeriod
Library OLE32.DLL:
0x14001d998 CoInitialize
0x14001d9a0 CoTaskMemFree
Library SHLWAPI.DLL:
0x14001d9b0 PathQuoteSpacesW
0x14001d9b8 PathAddBackslashW
0x14001d9c0 PathRemoveBackslashW
0x14001d9c8 PathRemoveArgsW
0x14001d9d0 PathRenameExtensionW
Library USER32.DLL:
0x14001d9e0 CharUpperW
0x14001d9e8 CharLowerW
0x14001d9f0 MessageBoxW
0x14001d9f8 SendMessageW
0x14001da00 PostMessageW
0x14001da08 DefWindowProcW
0x14001da10 GetWindowLongPtrW
0x14001da18 GetWindowTextLengthW
0x14001da20 GetWindowTextW
0x14001da28 EnableWindow
0x14001da30 DestroyWindow
0x14001da38 UnregisterClassW
0x14001da40 LoadIconW
0x14001da48 LoadCursorW
0x14001da50 RegisterClassExW
0x14001da58 IsWindowEnabled
0x14001da60 GetSystemMetrics
0x14001da68 CreateWindowExW
0x14001da70 SetWindowLongPtrW
0x14001da78 SetFocus
0x14001da80 CreateAcceleratorTableW
0x14001da88 SetForegroundWindow
0x14001da90 BringWindowToTop
0x14001da98 GetMessageW
0x14001daa0 TranslateAcceleratorW
0x14001daa8 TranslateMessage
0x14001dab0 DispatchMessageW
0x14001dab8 DestroyAcceleratorTable
0x14001dac0 GetForegroundWindow
0x14001dac8 GetWindowThreadProcessId
0x14001dad0 IsWindowVisible
0x14001dad8 EnumWindows
0x14001dae0 SetWindowPos
Library GDI32.DLL:
0x14001daf0 GetStockObject
Library COMCTL32.DLL:
0x14001db00 InitCommonControlsEx

!This program cannot be run in DOS mode.
`.text
`.rdata
@.pdata
@.data
UAWAVH
D$XPM1
D$hPM1
HcD$`PH
PLc|$hH
Lc|$hLct$`H
Lct$`H
D$hLc|$`H
Lc|$hI
/PLc|$hI
PLc|$pI
Lc|$`I
D$`Lc|$hLct$`H
D$hLc|$`I
Lc|$hI
/PLc|$hI
PLc|$pI
/Lc|$`I
Mc</Lct$hI
D$pLc|$pI
D$XPM1
D$hPM1
D$(H;D$0
YZAXAYH
YZAXAYH
YZAXAYH
t$pYZAXAYH
t$pYZAXAYH
t$hYZAXH
t$hYZAXH
t$hYZAXH
PPPPPPH
$YZAXH
t$8YZAX
$YZAXH
t$xYZAXH
t$hYZAXH
L$XZQH
L$ UAWH
t$XYZAXAY
PPPPPPH
t$XYZAXH
PPPPPH
PYZAXH
PYZAXH
t$xYZAXAYH
t$xYZAXAYH
YZAXAYH
t$pYZH
$YZAXH
t$hYZAXAYH
PPPPPH
t$HYZAX
t$xYZAXH
t$8YZAX
D$HH;D$P
t$pYZH
YZAXAY
t$8YZAX
t$PYZAXH
t$XYZAXH
t$hYZAXH
L$ UH1
t$hYZH
PPPPPPH
t$XYZAXAY
PYZAXAYH
YZAXAY
L;<$uFQH
L;<$u<H
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
L;<$uLQH
t$HYZAXH
t$`YZAXAYH
YZAXAYH
PPPPPH
t$hYZAXAY
t$`YZH
YZAXAY
t$`YZH
YZAXAY
t$`YZH
PPPPPH
t$@YZAX
|$8L;|$pu
@UATAUAWH
fA9<Fu
(A_A]A\]
(A_A]A\]
|$ ATAVAWH
A_A^A\
SUVWATAVAWH
H+D$ I
H+D$(H
0A_A^A\_^][
|$ AVH
WAVAWH
A_A^_
@SVWAVH
(A^_^[
(A^_^[
WAVAWH
fD9;t1
A_A^_
UVWATAUAVAWH
A_A^A]A\_^]
t$ AVH
t$ UWAVH
UVWAVAWH
0A_A^_^]
UATAUAVAWH
f9LD^u
A_A^A]A\]
x UATAUAVAWH
A_A^A]A\]
f9(tIH
WAVAWH
fD9<Yu
0A_A^_
WAVAWH
A_A^_
WAVAWH
1Lcy(E
A_A^_
t LcC03
LHcO<H
t LcG03
HcQ(;Q<}
Q(;Q<}
M\f9L_
L$@D+A
HcD$@H
VWATAUAWH
A_A]A\_^
|$ AVH
HcD$HH
|$@HcD$HH
l$P9i$
HcD$PH
WATAVH
A^A\_
UVWATAUAVAWH
3t$@D3d$<D
3t$PE3
D3d$(A
D$ 3\$0D
3\$4A#
D3t$`D
nD3t$LD3
D3|$HA
D3l$@D
x D3l$(A
3D$83D$4A3
D$X3D$,D
L$ 3D$03
D$D3D$TA
3D$(A3
D$ 3l$4D
L$ 3D$<3
L$ 3D$,A3
D$ D3d$4D
D3t$XH
D3t$<A
D3t$0#
D3d$HA#
3l$T3|$0D
h<D3d$(
D3|$4A#
|$ 3l$8A
D3t$<A#
D3l$,3l$LA
D3l$P3l$0
3l$PA#
D3t$HD
D$ 3t$(
l$@D3l$4
D3l$0A
D3d$(A
D3|$<A#
D3t$LA#
D3t$,D
3t$<A3
l$@3l$L3t$HA
|$(3l$T
\$X3\$D
D3d$\A
3\$HA3
t$ D3|$T
D3|$PA3
D3|$H3
3l$DD3t$TD
3l$8D3D$4A
3l$PD3D$0
D3d$,D
D3d$4A
D$ 3t$(A
D3D$LD3D$,
D3d$<D3l$D
pA_A^A]A\_^]
WAVAWH
A_A^_
UVWATAUAVAWH
@A_A^A]A\_^]
|$ AVH
!s H!s
A9@ u`A
WATAUAVAWH
A_A^A]A\_
WATAUAVAWH
0A_A^A]A\_
H;G uSH9s
D$(HcD$HH
u%HcD$ H
+HcD$ H
HcD$ 3
HcL$HH
HcD$HH
HcD$ 3
D$ HcD$@H
H9D$@r2H
H9D$@w
D$ HcD$@H
D$XHcD$PH
D$ HcD$ H
HcD$XH
D$0HcD$XHcL$PH
D$ HcD$@H
HcD$@H
D$ HcD$@H
HcD$0H
D$(HcD$0H
D$8H9D$
A)|$HA
L$H;H(s
L$H;H8s
E)l$HD
A9D$|s[
D$|A;D$pr
A;L$0v#A
L9w8t?
i H9i0u
A0H9i8u
C4;C,A
C0;C,s
USVWAUAVAWH
A_A^A]_^[]
SUVWATAUAVAWH
8A_A^A]A\_^][
HcD$0H
WAVAWH
@A_A^_
|$ AVH
|$ AVH
t$ AVH
|$ AVH
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetKnownFolderPath
GetLongPathNameW
0123456789abcdefK
InitOnceExecuteOnce
incorrect header check
unknown compression method
invalid window size
unknown header flags set
header crc mismatch
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid code lengths set
invalid bit length repeat
invalid code -- missing end-of-block
invalid literal/lengths set
invalid distances set
invalid literal/length code
invalid distance code
invalid distance too far back
incorrect data check
incorrect length check
Qkkbal
[-&LMb#{'
w+OQvr
INSKyu
)\ZEo^m/
H*0"ZOW
mj>zjZ
IiGM>nw
ewh/?y
OZw3(?
V_:X1:
inflate 1.2.8 Copyright 1995-2013 Mark Adler
need dictionary
stream end
file error
stream error
data error
insufficient memory
buffer error
incompatible version
memset
msvcrt.dll
GetModuleHandleW
HeapCreate
GetStdHandle
HeapDestroy
ExitProcess
WriteFile
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
GetExitCodeProcess
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetShortPathNameW
GetTempFileNameW
KERNEL32.dll
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
SHELL32.DLL
timeBeginPeriod
WINMM.DLL
CoInitialize
CoTaskMemFree
OLE32.DLL
PathQuoteSpacesW
PathAddBackslashW
PathRemoveBackslashW
PathRemoveArgsW
PathRenameExtensionW
SHLWAPI.DLL
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsicmp
wcslen
wcscpy
wcscmp
memcpy
tolower
wcscat
malloc
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
TerminateProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTempPathW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
DuplicateHandle
RegisterWaitForSingleObject
CharUpperW
CharLowerW
MessageBoxW
SendMessageW
PostMessageW
DefWindowProcW
GetWindowLongPtrW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
DestroyWindow
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
GetSystemMetrics
CreateWindowExW
SetWindowLongPtrW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
USER32.DLL
GetStockObject
GDI32.DLL
InitCommonControlsEx
COMCTL32.DLL
1BWTHTi
wBt`O\
A'>09&{
D$JRB
P"9cYPAD
PAD<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.0.0.0"
processorArchitecture="amd64"
name="CompanyName.ProductName.YourApp"
type="win32" />
<description></description>
<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="amd64"
publicKeyToken="6595b64144ccf1df"
language="*" />
</dependentAssembly>
</dependency>
</assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
SHELL32.DLL
InputRequester
STATIC
BUTTON
Invalid memory access
Array bounds exceeded
Debugger breakpoint reached
Misaligned data access
Denormal floating-point operand
Division by zero (floating-point)
Inexact floating-point result
Invalid floating-point operation
Floating-point overflow (exponent to great)
Floating-point stack overflow or underflow
Floating-point underflow (exponent too small)
Illegal instruction
Memory page error
Division by zero
Integer overflow
Exception handler returned unknown value
Exception handler tried to continue after non-continuable exception
Privileged instruction
Single step trap
Stack overflow
Unknown error code
Shell32.DLL
Downloads\
Kernel32.DLL
Kernel32.dll
#+3;CScs
85FA718F4E154843D84BFB86A2DF1A60 C53E91049D7874906F27DF93F36143BC(D56981EBF3438A2A1B45C3235078F9B0C2F67AF1
F5B0DE26F1S
Antivirus Signature
Bkav W64.AIDetectMalware
Lionic Clean
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal cld.trojan.bzc
Skyhigh BehavesLike.Win64.Generic.ch
ALYac Clean
Cylance Unsafe
Zillya Trojan.Cometer.Win32.533
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_60% (W)
Alibaba TrojanSpy:PowerShell/MeterpreterShellCode.4579fc66
K7GW Riskware ( 0040eff71 )
K7AntiVirus Riskware ( 0040eff71 )
huorong Clean
Baidu Clean
VirIT Trojan.Win32.Dnldr24.BBST
Paloalto generic.ml
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Generik.KSCCFWO
APEX Malicious
Avast Script:SNH-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky UDS:Trojan.Win64.Badur
BitDefender Heur.BZC.MNT.Boxter.829.1C532416
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Heur.BZC.MNT.Boxter.829.1C532416
Tencent Clean
Sophos Mal/Generic-S
F-Secure Heuristic.HEUR/AGEN.1339807
DrWeb PowerShell.SpyBot.22
VIPRE Heur.BZC.MNT.Boxter.829.1C532416
TrendMicro Clean
McAfeeD ti!6F783FDDC426
Trapmine malicious.high.ml.score
CTX exe.trojan.generic
Emsisoft Heur.BZC.MNT.Boxter.829.1C532416 (B)
Ikarus Trojan-Spy.Agent
GData Heur.BZC.MNT.Boxter.829.1C532416
Jiangmin Trojan.Generic.cbdzv
Webroot W32.Trojan.Gen
Varist W64/Kryptik.XI
Avira HEUR/AGEN.1339807
Antiy-AVL Trojan/Win32.SchoolBoy
Kingsoft malware.kb.a.941
Gridinsoft Ransom.Win64.Gandcrab.oa!s1
Xcitium Clean
Arcabit Heur.BZC.MNT.Boxter.829.1C532416
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Artemis!70DBF2129AD1
TACHYON Clean
VBA32 Clean
Malwarebytes Generic.Malware/Suspicious
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002H09DS25
Rising Trojan.Badur!8.308 (CLOUD)
Yandex Trojan.GenAsa!VpprgU3GNoU
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet Clean
AVG Script:SNH-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Clean
No IRMA results available.