PE Compile Time

2020-01-03 13:48:04

PE Imphash

69cde517f1dded1a63d142cb349703e1

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000a364 0x0000a400 6.27136397032
.data 0x0000c000 0x00000030 0x00000200 0.40261925237
.rdata 0x0000d000 0x00000cb8 0x00000e00 4.93172949523
.eh_fram 0x0000e000 0x00001c58 0x00001e00 4.80386408869
.bss 0x00010000 0x00000a24 0x00000000 0.0
.idata 0x00011000 0x00000a4c 0x00000c00 4.74147956253
.CRT 0x00012000 0x00000018 0x00000200 0.0980041756627
.tls 0x00013000 0x00000020 0x00000200 0.20448815744
.rsrc 0x00014000 0x00006b80 0x00006c00 7.98419053084

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x0001ab00 0x00000080 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x0001ab00 0x00000080 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x0001ab00 0x00000080 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library ADVAPI32.DLL:
0x4111f4 CryptGenRandom
0x4111f8 CryptReleaseContext
Library KERNEL32.dll:
0x411204 CloseHandle
0x411208 CopyFileA
0x41120c CreateFileA
0x411210 CreateProcessA
0x411218 DeleteFileA
0x41121c EndUpdateResourceA
0x411224 ExitProcess
0x411228 FindClose
0x41122c FindFirstFileA
0x411230 FindNextFileA
0x411234 FindResourceA
0x411238 FreeLibrary
0x41123c GetCommandLineA
0x411240 GetLastError
0x411244 GetModuleFileNameA
0x411248 GetModuleHandleA
0x41124c GetProcAddress
0x411250 GetStartupInfoA
0x411254 GetThreadContext
0x41125c InterlockedExchange
0x411260 IsDBCSLeadByteEx
0x411268 LoadLibraryA
0x41126c LoadResource
0x411270 LockResource
0x411274 MoveFileA
0x411278 MultiByteToWideChar
0x41127c ResumeThread
0x411280 SetThreadContext
0x411288 SizeofResource
0x41128c Sleep
0x411290 TlsGetValue
0x411294 UpdateResourceA
0x411298 VirtualAllocEx
0x41129c VirtualProtect
0x4112a0 VirtualQuery
0x4112a4 WaitForSingleObject
0x4112a8 WideCharToMultiByte
0x4112ac WriteFile
0x4112b0 WriteProcessMemory
Library msvcrt.dll:
0x4112b8 _strdup
0x4112bc _stricoll
Library msvcrt.dll:
0x4112c4 __getmainargs
0x4112c8 __mb_cur_max
0x4112cc __p__environ
0x4112d0 __p__fmode
0x4112d4 __set_app_type
0x4112d8 _cexit
0x4112dc _errno
0x4112e0 _fpreset
0x4112e4 _fullpath
0x4112e8 _iob
0x4112ec _isctype
0x4112f0 _onexit
0x4112f4 _pctype
0x4112f8 _setmode
0x4112fc abort
0x411300 atexit
0x411304 atoi
0x411308 calloc
0x41130c fputc
0x411310 free
0x411314 fwrite
0x411318 getenv
0x41131c localeconv
0x411320 malloc
0x411324 mbstowcs
0x411328 memcpy
0x41132c memset
0x411330 realloc
0x411334 setlocale
0x411338 signal
0x41133c strchr
0x411340 strcoll
0x411344 strlen
0x411348 strstr
0x41134c tolower
0x411350 vfprintf
0x411354 wcslen
0x411358 wcstombs
Library SHELL32.DLL:
0x411360 ShellExecuteA

!This program cannot be run in DOS mode.
P`.data
.rdata
`@.eh_framX
0@.bss
.idata
P@t;9u
<,t!~><{t^<}uG
9t$Xv|
9l$Xv~
D$|;D$\|5
T$ ;D$ u
D$ 9D$|
|$D+|$
9D$<s?
u?+D$p
9|$(vm
libgcc_s_dw2-1.dll
__register_frame_info
__deregister_frame_info
Find buffer resource error: %lu
Load buffer resource error: %lu
Lock buffer resource error: %lu
Find file size error: %lu
Find key resource error: %lu
Load key resource error: %lu
Update resource error: %lu
End update resource error: %lu
DOS signature error
PE signature error
Create process error %lu
Get thread context
ntdll.dll
ZwUnmapViewOfSection
Virtual alloc error: %lu
Write headers error: %lu
Set thread context error: %lu
Resume thread error: %lu
old.exe
%s delete
Create process error: %lu
Decrypt buffer error: %lu
Generate key error: %lu
Encrypt buffer error: %lu
delete
Extract file error: %lu
Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
glob-1.0-mingw32
aAeEfFgGcCdiouxXnpsS
(null)
PRINTF_EXPONENT_DIGITS
+-' 0#
Infinity
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (MinGW.org GCC-8.2.0-5) 8.2.0
GCC: (MinGW.org GCC-8.2.0-5) 8.2.0
GCC: (MinGW.org GCC-8.2.0-5) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
GCC: (GNU) 8.2.0
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
BeginUpdateResourceA
CloseHandle
CopyFileA
CreateFileA
CreateProcessA
DeleteCriticalSection
DeleteFileA
EndUpdateResourceA
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FreeLibrary
GetCommandLineA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetThreadContext
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadResource
LockResource
MoveFileA
MultiByteToWideChar
ResumeThread
SetThreadContext
SetUnhandledExceptionFilter
SizeofResource
TlsGetValue
UpdateResourceA
VirtualAllocEx
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
WriteProcessMemory
_strdup
_stricoll
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_fpreset
_fullpath
_isctype
_onexit
_pctype
_setmode
atexit
calloc
fwrite
getenv
localeconv
malloc
mbstowcs
memcpy
memset
realloc
setlocale
signal
strchr
strcoll
strlen
strstr
tolower
vfprintf
wcslen
wcstombs
ShellExecuteA
ADVAPI32.DLL
KERNEL32.dll
msvcrt.dll
msvcrt.dll
SHELL32.DLL
>(]nNa
4u]/[#
f+(#OC
J|ER7VW
?B}9c&
]!1 0k
Pt"~Jf
-\TBY`gPr
F6}S(=
VRk,wj
^]'kz-T:K
)[s;"Jt
k"<geK
VlKSul'g
B1)DU/bT1
"z@JFp.e
QntX-P
Ihz0[bK
W1|A|3h
=cqL|N
Q`F!N(
/HB&@7A
mA}dE_
.[9"XR+
[JE>6Y
BM*s]aAG
K,wKPJ|
u@KZ*fZ*
Wf`vl
qn3UcT
F\=7nz
Heb cT
%YWkoAT;
Q0ih>k
nq/]5"
6m[Xq%
x;;UW&
&4'4+ddZ(
KxPK7h
crQTb*
i;40e{i
LA$^$D
n^X6n
ZO5w{m'
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
(null)
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Clean
Elastic malicious (high confidence)
ClamAV Win.Trojan.Processhijack-10056424-0
CMC Clean
CAT-QuickHeal Trojan.ProcHijack.S36275531
Skyhigh BehavesLike.Win32.Generic.mh
ALYac Gen:Trojan.ProcessHijack.fKW@a0CCV2h
Cylance Unsafe
Zillya Trojan.Injector.Win32.676753
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (D)
Alibaba Clean
K7GW Trojan ( 005c8a4a1 )
K7AntiVirus Trojan ( 0055c6551 )
huorong HVM:Trojan/Injector.gen!B
Baidu Clean
VirIT Trojan.Win32.AgentT.DHP
Paloalto Clean
Symantec Trojan.Evoject!gen
tehtris Clean
ESET-NOD32 a variant of Win32/Injector.EJEN
APEX Malicious
Avast Win32:Evo-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.Win32.Inject.gen
BitDefender Gen:Trojan.ProcessHijack.fKW@a0CCV2h
NANO-Antivirus Trojan.Win32.Inject3.gswtve
ViRobot Clean
MicroWorld-eScan Gen:Trojan.ProcessHijack.fKW@a0CCV2h
Tencent Trojan.Win32.Injector.hy
Sophos Troj/Inject-KAK
F-Secure Trojan.TR/Hijacker.Gen
DrWeb Trojan.Inject5.53255
VIPRE Gen:Trojan.ProcessHijack.fKW@a0CCV2h
TrendMicro Clean
McAfeeD ti!C4CD302ACEF1
Trapmine Clean
CTX exe.trojan.a0ccv2h
Emsisoft Gen:Trojan.ProcessHijack.fKW@a0CCV2h (B)
Ikarus Trojan.Win32.Injector
GData Gen:Trojan.ProcessHijack.fKW@a0CCV2h
Jiangmin Worm.Generic.albs
Webroot W32.Malware.gen
Varist W32/Trojan.ELRM-9316
Avira TR/Hijacker.Gen
Antiy-AVL Trojan/Win32.Wacatac
Kingsoft malware.kb.a.999
Gridinsoft Ransom.Win32.Zbot.oa!s1
Xcitium Clean
Arcabit Trojan.ProcessHijack.ED79FE
SUPERAntiSpyware Trojan.Agent/Gen-Injector
ZoneAlarm Troj/Inject-KAK
Microsoft Trojan:Win32/ProcessHijack.GTM!MTB
Google Detected
AhnLab-V3 Trojan/Win32.Injector.C3865649
Acronis Clean
VBA32 Trojan.Inject
TACHYON Clean
Malwarebytes Malware.AI.4209882117
Panda Trj/Genetic.gen
Zoner Clean
TrendMicro-HouseCall Clean
Rising Worm.Generic!8.402 (TFE:5:ORJAjJ8xtJM)
Yandex Trojan.GenAsa!ov0v6LJSezc
TrellixENS Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.121218.susgen
Fortinet W32/Injector.EJEN!tr
AVG Win32:Evo-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Clean
IRMA Signature
Trend Micro SProtect (Linux) Clean
Avast Core Security (Linux) Win32:Evo-gen [Trj]
C4S ClamAV (Linux) Win.Trojan.Processhijack-10056424-0
Trellix (Linux) Clean
Sophos Anti-Virus (Linux) Troj/Inject-KAK
Bitdefender Antivirus (Linux) Gen:Trojan.ProcessHijack.fKW@a0CCV2h
G Data Antivirus (Windows) Virus: Gen:Trojan.ProcessHijack.fKW@a0CCV2h (Engine A)
WithSecure (Linux) Trojan.TR/Hijacker.Gen
ESET Security (Windows) a variant of Win32/Injector.EJEN trojan
DrWeb Antivirus (Linux) Trojan.Inject5.53255
ClamAV (Linux) Clean
eScan Antivirus (Linux) Gen:Trojan.ProcessHijack.fKW@a0CCV2h(DB)
Kaspersky Standard (Windows) HEUR:Trojan.Win32.Inject.gen
Emsisoft Commandline Scanner (Windows) Gen:Trojan.ProcessHijack.fKW@a0CCV2h (B)
Cuckoo

We're processing your submission... This could take a few seconds.