API tools faq
paste
paladin316

Gozi_ee4ae9e98f8c943a6716d2d8c3251d2f_exe_2019-06-26_14_30.json

paladin316
Jun 26th, 2019
2,197
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 61.24 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Gozi_ee4ae9e98f8c943a6716d2d8c3251d2f.exe"
  7. [*] File Size: 261632
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "66ce6335b619398fcfa8edf051708b3abcc1a959f8c25912c7aea30d60fe2498"
  10. [*] MD5: "ee4ae9e98f8c943a6716d2d8c3251d2f"
  11. [*] SHA1: "e418b5d34949b1ca7b839d83c0bb9a9a3c8ebc31"
  12. [*] SHA512: "ac3329d396a833c19fbd2346b2b088f7c338b691cb5d7902a8c6d52b1fac956e605945a3bb2b12ff4f151a94615d27b44a8771c646bf3bf10fe4d20fe45aefee"
  13. [*] CRC32: "8120B655"
  14. [*] SSDEEP: "3072:v0T8VkplvIkxGJqWF5++rNAAeTzvGFuVL7tLQofHCuqJZXy40qC6/0v6v:v0AGVI8WF5AT7oCtMo6ugZXy40qC6/V"
  15.  
  16. [*] Process Execution: [
  17. "Gozi_ee4ae9e98f8c943a6716d2d8c3251d2f.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "Gozi_ee4ae9e98f8c943a6716d2d8c3251d2f.exe (2360) called API GetSystemTimeAsFileTime 18792 times"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 14 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "FireEye": "Generic.mg.ee4ae9e98f8c943a"
  38. },
  39. {
  40. "Cylance": "Unsafe"
  41. },
  42. {
  43. "Cybereason": "malicious.34949b"
  44. },
  45. {
  46. "Symantec": "ML.Attribute.HighConfidence"
  47. },
  48. {
  49. "APEX": "Malicious"
  50. },
  51. {
  52. "Paloalto": "generic.ml"
  53. },
  54. {
  55. "Rising": "Malware.Heuristic.MLite(96%) (AI-LITE:GrK5gvDDBnC1GIMkGYyBGw)"
  56. },
  57. {
  58. "Endgame": "malicious (high confidence)"
  59. },
  60. {
  61. "Invincea": "heuristic"
  62. },
  63. {
  64. "SentinelOne": "DFI - Suspicious PE"
  65. },
  66. {
  67. "Acronis": "suspicious"
  68. },
  69. {
  70. "Ikarus": "Trojan-Spy.Remcos"
  71. },
  72. {
  73. "eGambit": "Unsafe.AI_Score_69%"
  74. },
  75. {
  76. "CrowdStrike": "win/malicious_confidence_80% (D)"
  77. }
  78. ]
  79. }
  80. ]
  81.  
  82. [*] Started Service: []
  83.  
  84. [*] Executed Commands: []
  85.  
  86. [*] Mutexes: []
  87.  
  88. [*] Modified Files: []
  89.  
  90. [*] Deleted Files: []
  91.  
  92. [*] Modified Registry Keys: []
  93.  
  94. [*] Deleted Registry Keys: []
  95.  
  96. [*] DNS Communications: []
  97.  
  98. [*] Domains: []
  99.  
  100. [*] Network Communication - ICMP: []
  101.  
  102. [*] Network Communication - HTTP: []
  103.  
  104. [*] Network Communication - SMTP: []
  105.  
  106. [*] Network Communication - Hosts: []
  107.  
  108. [*] Network Communication - IRC: []
  109.  
  110. [*] Static Analysis: {
  111. "pe": {
  112. "peid_signatures": null,
  113. "imports": [
  114. {
  115. "imports": [
  116. {
  117. "name": "GetProcessHeap",
  118. "address": "0x1018044"
  119. },
  120. {
  121. "name": "GetConsoleMode",
  122. "address": "0x1018048"
  123. },
  124. {
  125. "name": "GetFileSizeEx",
  126. "address": "0x101804c"
  127. },
  128. {
  129. "name": "SetFileInformationByHandle",
  130. "address": "0x1018050"
  131. },
  132. {
  133. "name": "VirtualAlloc",
  134. "address": "0x1018054"
  135. },
  136. {
  137. "name": "CreateFileMappingA",
  138. "address": "0x1018058"
  139. },
  140. {
  141. "name": "VirtualLock",
  142. "address": "0x101805c"
  143. },
  144. {
  145. "name": "Module32FirstW",
  146. "address": "0x1018060"
  147. },
  148. {
  149. "name": "GetSystemInfo",
  150. "address": "0x1018064"
  151. },
  152. {
  153. "name": "CreateToolhelp32Snapshot",
  154. "address": "0x1018068"
  155. },
  156. {
  157. "name": "OutputDebugStringA",
  158. "address": "0x101806c"
  159. },
  160. {
  161. "name": "Module32NextW",
  162. "address": "0x1018070"
  163. },
  164. {
  165. "name": "GetCurrentProcessId",
  166. "address": "0x1018074"
  167. },
  168. {
  169. "name": "GetStringTypeW",
  170. "address": "0x1018078"
  171. },
  172. {
  173. "name": "LCMapStringW",
  174. "address": "0x101807c"
  175. },
  176. {
  177. "name": "HeapReAlloc",
  178. "address": "0x1018080"
  179. },
  180. {
  181. "name": "GetConsoleCP",
  182. "address": "0x1018084"
  183. },
  184. {
  185. "name": "FlushFileBuffers",
  186. "address": "0x1018088"
  187. },
  188. {
  189. "name": "FreeEnvironmentStringsW",
  190. "address": "0x101808c"
  191. },
  192. {
  193. "name": "GetEnvironmentStringsW",
  194. "address": "0x1018090"
  195. },
  196. {
  197. "name": "GetSystemTimeAsFileTime",
  198. "address": "0x1018094"
  199. },
  200. {
  201. "name": "QueryPerformanceCounter",
  202. "address": "0x1018098"
  203. },
  204. {
  205. "name": "GetModuleFileNameA",
  206. "address": "0x101809c"
  207. },
  208. {
  209. "name": "GetCurrentThreadId",
  210. "address": "0x10180a0"
  211. },
  212. {
  213. "name": "SetFilePointerEx",
  214. "address": "0x10180a4"
  215. },
  216. {
  217. "name": "GetCPInfo",
  218. "address": "0x10180a8"
  219. },
  220. {
  221. "name": "CreateEventA",
  222. "address": "0x10180ac"
  223. },
  224. {
  225. "name": "GetACP",
  226. "address": "0x10180b0"
  227. },
  228. {
  229. "name": "IsValidCodePage",
  230. "address": "0x10180b4"
  231. },
  232. {
  233. "name": "GetModuleHandleW",
  234. "address": "0x10180b8"
  235. },
  236. {
  237. "name": "GetStartupInfoW",
  238. "address": "0x10180bc"
  239. },
  240. {
  241. "name": "TlsFree",
  242. "address": "0x10180c0"
  243. },
  244. {
  245. "name": "TlsSetValue",
  246. "address": "0x10180c4"
  247. },
  248. {
  249. "name": "TlsGetValue",
  250. "address": "0x10180c8"
  251. },
  252. {
  253. "name": "TlsAlloc",
  254. "address": "0x10180cc"
  255. },
  256. {
  257. "name": "TerminateProcess",
  258. "address": "0x10180d0"
  259. },
  260. {
  261. "name": "GetCurrentProcess",
  262. "address": "0x10180d4"
  263. },
  264. {
  265. "name": "InitializeCriticalSectionAndSpinCount",
  266. "address": "0x10180d8"
  267. },
  268. {
  269. "name": "SetLastError",
  270. "address": "0x10180dc"
  271. },
  272. {
  273. "name": "SetUnhandledExceptionFilter",
  274. "address": "0x10180e0"
  275. },
  276. {
  277. "name": "UnhandledExceptionFilter",
  278. "address": "0x10180e4"
  279. },
  280. {
  281. "name": "DeleteCriticalSection",
  282. "address": "0x10180e8"
  283. },
  284. {
  285. "name": "HeapSize",
  286. "address": "0x10180ec"
  287. },
  288. {
  289. "name": "LoadLibraryExW",
  290. "address": "0x10180f0"
  291. },
  292. {
  293. "name": "OutputDebugStringW",
  294. "address": "0x10180f4"
  295. },
  296. {
  297. "name": "HeapFree",
  298. "address": "0x10180f8"
  299. },
  300. {
  301. "name": "IsProcessorFeaturePresent",
  302. "address": "0x10180fc"
  303. },
  304. {
  305. "name": "IsDebuggerPresent",
  306. "address": "0x1018100"
  307. },
  308. {
  309. "name": "RtlUnwind",
  310. "address": "0x1018104"
  311. },
  312. {
  313. "name": "RaiseException",
  314. "address": "0x1018108"
  315. },
  316. {
  317. "name": "GetCommandLineA",
  318. "address": "0x101810c"
  319. },
  320. {
  321. "name": "SetStdHandle",
  322. "address": "0x1018110"
  323. },
  324. {
  325. "name": "LeaveCriticalSection",
  326. "address": "0x1018114"
  327. },
  328. {
  329. "name": "EnterCriticalSection",
  330. "address": "0x1018118"
  331. },
  332. {
  333. "name": "WideCharToMultiByte",
  334. "address": "0x101811c"
  335. },
  336. {
  337. "name": "WaitForSingleObject",
  338. "address": "0x1018120"
  339. },
  340. {
  341. "name": "HeapAlloc",
  342. "address": "0x1018124"
  343. },
  344. {
  345. "name": "UnmapViewOfFile",
  346. "address": "0x1018128"
  347. },
  348. {
  349. "name": "MapViewOfFile",
  350. "address": "0x101812c"
  351. },
  352. {
  353. "name": "CreateFileA",
  354. "address": "0x1018130"
  355. },
  356. {
  357. "name": "GetWindowsDirectoryW",
  358. "address": "0x1018134"
  359. },
  360. {
  361. "name": "CloseHandle",
  362. "address": "0x1018138"
  363. },
  364. {
  365. "name": "GetVersionExA",
  366. "address": "0x101813c"
  367. },
  368. {
  369. "name": "ReadFileEx",
  370. "address": "0x1018140"
  371. },
  372. {
  373. "name": "GetStdHandle",
  374. "address": "0x1018144"
  375. },
  376. {
  377. "name": "GetLastError",
  378. "address": "0x1018148"
  379. },
  380. {
  381. "name": "CreateFileW",
  382. "address": "0x101814c"
  383. },
  384. {
  385. "name": "SetEvent",
  386. "address": "0x1018150"
  387. },
  388. {
  389. "name": "Sleep",
  390. "address": "0x1018154"
  391. },
  392. {
  393. "name": "WriteFile",
  394. "address": "0x1018158"
  395. },
  396. {
  397. "name": "FormatMessageA",
  398. "address": "0x101815c"
  399. },
  400. {
  401. "name": "MultiByteToWideChar",
  402. "address": "0x1018160"
  403. },
  404. {
  405. "name": "GetProcAddress",
  406. "address": "0x1018164"
  407. },
  408. {
  409. "name": "ExitProcess",
  410. "address": "0x1018168"
  411. },
  412. {
  413. "name": "DecodePointer",
  414. "address": "0x101816c"
  415. },
  416. {
  417. "name": "EncodePointer",
  418. "address": "0x1018170"
  419. },
  420. {
  421. "name": "WriteConsoleW",
  422. "address": "0x1018174"
  423. },
  424. {
  425. "name": "GetModuleHandleExW",
  426. "address": "0x1018178"
  427. },
  428. {
  429. "name": "WaitForSingleObjectEx",
  430. "address": "0x101817c"
  431. },
  432. {
  433. "name": "GetOEMCP",
  434. "address": "0x1018180"
  435. },
  436. {
  437. "name": "GetModuleFileNameW",
  438. "address": "0x1018184"
  439. },
  440. {
  441. "name": "GetFileType",
  442. "address": "0x1018188"
  443. }
  444. ],
  445. "dll": "KERNEL32.dll"
  446. },
  447. {
  448. "imports": [
  449. {
  450. "name": "EndDeferWindowPos",
  451. "address": "0x10181c0"
  452. },
  453. {
  454. "name": "GetWindow",
  455. "address": "0x10181c4"
  456. },
  457. {
  458. "name": "GetClassLongA",
  459. "address": "0x10181c8"
  460. },
  461. {
  462. "name": "UpdateWindow",
  463. "address": "0x10181cc"
  464. },
  465. {
  466. "name": "OffsetRect",
  467. "address": "0x10181d0"
  468. },
  469. {
  470. "name": "SetWindowTextA",
  471. "address": "0x10181d4"
  472. },
  473. {
  474. "name": "InsertMenuA",
  475. "address": "0x10181d8"
  476. },
  477. {
  478. "name": "BeginDeferWindowPos",
  479. "address": "0x10181dc"
  480. },
  481. {
  482. "name": "SystemParametersInfoA",
  483. "address": "0x10181e0"
  484. },
  485. {
  486. "name": "GetWindowRect",
  487. "address": "0x10181e4"
  488. },
  489. {
  490. "name": "GetDC",
  491. "address": "0x10181e8"
  492. },
  493. {
  494. "name": "GetWindowLongW",
  495. "address": "0x10181ec"
  496. },
  497. {
  498. "name": "GetDCEx",
  499. "address": "0x10181f0"
  500. },
  501. {
  502. "name": "DefMDIChildProcA",
  503. "address": "0x10181f4"
  504. },
  505. {
  506. "name": "DeferWindowPos",
  507. "address": "0x10181f8"
  508. },
  509. {
  510. "name": "ReleaseDC",
  511. "address": "0x10181fc"
  512. },
  513. {
  514. "name": "GetSystemMetrics",
  515. "address": "0x1018200"
  516. },
  517. {
  518. "name": "ClipCursor",
  519. "address": "0x1018204"
  520. },
  521. {
  522. "name": "GetMenuItemCount",
  523. "address": "0x1018208"
  524. },
  525. {
  526. "name": "AppendMenuA",
  527. "address": "0x101820c"
  528. },
  529. {
  530. "name": "DefWindowProcW",
  531. "address": "0x1018210"
  532. },
  533. {
  534. "name": "LoadImageA",
  535. "address": "0x1018214"
  536. },
  537. {
  538. "name": "GetSystemMenu",
  539. "address": "0x1018218"
  540. },
  541. {
  542. "name": "SetActiveWindow",
  543. "address": "0x101821c"
  544. },
  545. {
  546. "name": "SetCapture",
  547. "address": "0x1018220"
  548. },
  549. {
  550. "name": "LoadStringA",
  551. "address": "0x1018224"
  552. },
  553. {
  554. "name": "GetParent",
  555. "address": "0x1018228"
  556. },
  557. {
  558. "name": "LoadIconA",
  559. "address": "0x101822c"
  560. },
  561. {
  562. "name": "CreateMenu",
  563. "address": "0x1018230"
  564. },
  565. {
  566. "name": "GetWindowTextLengthA",
  567. "address": "0x1018234"
  568. },
  569. {
  570. "name": "GetScrollRange",
  571. "address": "0x1018238"
  572. },
  573. {
  574. "name": "GetWindowTextA",
  575. "address": "0x101823c"
  576. },
  577. {
  578. "name": "SetWindowLongA",
  579. "address": "0x1018240"
  580. },
  581. {
  582. "name": "MessageBoxA",
  583. "address": "0x1018244"
  584. },
  585. {
  586. "name": "InvalidateRect",
  587. "address": "0x1018248"
  588. },
  589. {
  590. "name": "AppendMenuW",
  591. "address": "0x101824c"
  592. },
  593. {
  594. "name": "GetWindowLongA",
  595. "address": "0x1018250"
  596. },
  597. {
  598. "name": "SetClassLongA",
  599. "address": "0x1018254"
  600. },
  601. {
  602. "name": "GetDlgItem",
  603. "address": "0x1018258"
  604. },
  605. {
  606. "name": "GetDesktopWindow",
  607. "address": "0x101825c"
  608. },
  609. {
  610. "name": "SetWindowPos",
  611. "address": "0x1018260"
  612. },
  613. {
  614. "name": "GetCursorPos",
  615. "address": "0x1018264"
  616. },
  617. {
  618. "name": "GetMenuItemInfoA",
  619. "address": "0x1018268"
  620. },
  621. {
  622. "name": "CreatePopupMenu",
  623. "address": "0x101826c"
  624. },
  625. {
  626. "name": "IsDlgButtonChecked",
  627. "address": "0x1018270"
  628. }
  629. ],
  630. "dll": "USER32.dll"
  631. },
  632. {
  633. "imports": [
  634. {
  635. "name": "StartPage",
  636. "address": "0x1018018"
  637. },
  638. {
  639. "name": "CreatePalette",
  640. "address": "0x101801c"
  641. },
  642. {
  643. "name": "SelectObject",
  644. "address": "0x1018020"
  645. },
  646. {
  647. "name": "GetTextMetricsA",
  648. "address": "0x1018024"
  649. },
  650. {
  651. "name": "SetTextAlign",
  652. "address": "0x1018028"
  653. },
  654. {
  655. "name": "GetObjectA",
  656. "address": "0x101802c"
  657. },
  658. {
  659. "name": "GetStockObject",
  660. "address": "0x1018030"
  661. },
  662. {
  663. "name": "CombineRgn",
  664. "address": "0x1018034"
  665. },
  666. {
  667. "name": "CreateRectRgn",
  668. "address": "0x1018038"
  669. },
  670. {
  671. "name": "MoveToEx",
  672. "address": "0x101803c"
  673. }
  674. ],
  675. "dll": "GDI32.dll"
  676. },
  677. {
  678. "imports": [
  679. {
  680. "name": "RegCreateKeyA",
  681. "address": "0x1018000"
  682. },
  683. {
  684. "name": "RegCloseKey",
  685. "address": "0x1018004"
  686. },
  687. {
  688. "name": "RegQueryValueExA",
  689. "address": "0x1018008"
  690. }
  691. ],
  692. "dll": "ADVAPI32.dll"
  693. },
  694. {
  695. "imports": [
  696. {
  697. "name": "SHGetFileInfoW",
  698. "address": "0x10181a0"
  699. }
  700. ],
  701. "dll": "SHELL32.dll"
  702. },
  703. {
  704. "imports": [
  705. {
  706. "name": "CoInitialize",
  707. "address": "0x1018294"
  708. },
  709. {
  710. "name": "CreateItemMoniker",
  711. "address": "0x1018298"
  712. },
  713. {
  714. "name": "CreateStreamOnHGlobal",
  715. "address": "0x101829c"
  716. }
  717. ],
  718. "dll": "ole32.dll"
  719. },
  720. {
  721. "imports": [
  722. {
  723. "name": "EnumPageFilesA",
  724. "address": "0x1018198"
  725. }
  726. ],
  727. "dll": "PSAPI.DLL"
  728. },
  729. {
  730. "imports": [
  731. {
  732. "name": "CreateToolbarEx",
  733. "address": "0x1018010"
  734. }
  735. ],
  736. "dll": "COMCTL32.dll"
  737. },
  738. {
  739. "imports": [
  740. {
  741. "name": "WSAStartup",
  742. "address": "0x101828c"
  743. }
  744. ],
  745. "dll": "WS2_32.dll"
  746. },
  747. {
  748. "imports": [
  749. {
  750. "name": "PathIsUNCServerA",
  751. "address": "0x10181a8"
  752. },
  753. {
  754. "name": "PathUnExpandEnvStringsA",
  755. "address": "0x10181ac"
  756. }
  757. ],
  758. "dll": "SHLWAPI.dll"
  759. },
  760. {
  761. "imports": [
  762. {
  763. "name": "DrawThemeBackground",
  764. "address": "0x1018278"
  765. },
  766. {
  767. "name": "DrawThemeParentBackground",
  768. "address": "0x101827c"
  769. },
  770. {
  771. "name": "GetBufferedPaintDC",
  772. "address": "0x1018280"
  773. },
  774. {
  775. "name": "IsThemeBackgroundPartiallyTransparent",
  776. "address": "0x1018284"
  777. }
  778. ],
  779. "dll": "UxTheme.dll"
  780. },
  781. {
  782. "imports": [
  783. {
  784. "name": "SnmpUtilMemAlloc",
  785. "address": "0x10182a4"
  786. },
  787. {
  788. "name": "SnmpUtilMemFree",
  789. "address": "0x10182a8"
  790. }
  791. ],
  792. "dll": "snmpapi.dll"
  793. },
  794. {
  795. "imports": [
  796. {
  797. "name": "TcDeleteFilter",
  798. "address": "0x10181b4"
  799. },
  800. {
  801. "name": "TcDeregisterClient",
  802. "address": "0x10181b8"
  803. }
  804. ],
  805. "dll": "TRAFFIC.dll"
  806. },
  807. {
  808. "imports": [
  809. {
  810. "name": "DsGetRdnW",
  811. "address": "0x1018190"
  812. }
  813. ],
  814. "dll": "NTDSAPI.dll"
  815. }
  816. ],
  817. "digital_signers": null,
  818. "exported_dll_name": null,
  819. "actual_checksum": "0x00041c7c",
  820. "overlay": null,
  821. "imagebase": "0x01000000",
  822. "reported_checksum": "0x00041c7c",
  823. "icon_hash": null,
  824. "entrypoint": "0x01008af2",
  825. "timestamp": "2019-06-26 09:58:49",
  826. "osversion": "6.0",
  827. "sections": [
  828. {
  829. "name": ".text",
  830. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  831. "virtual_address": "0x00001000",
  832. "size_of_data": "0x00016c00",
  833. "entropy": "6.72",
  834. "raw_address": "0x00000400",
  835. "virtual_size": "0x00016bdb",
  836. "characteristics_raw": "0x60000020"
  837. },
  838. {
  839. "name": ".rdata",
  840. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  841. "virtual_address": "0x00018000",
  842. "size_of_data": "0x0000c600",
  843. "entropy": "5.83",
  844. "raw_address": "0x00017000",
  845. "virtual_size": "0x0000c5ec",
  846. "characteristics_raw": "0x40000040"
  847. },
  848. {
  849. "name": ".data",
  850. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  851. "virtual_address": "0x00025000",
  852. "size_of_data": "0x00001600",
  853. "entropy": "3.63",
  854. "raw_address": "0x00023600",
  855. "virtual_size": "0x0000495c",
  856. "characteristics_raw": "0xc0000040"
  857. },
  858. {
  859. "name": ".rsrc",
  860. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  861. "virtual_address": "0x0002a000",
  862. "size_of_data": "0x0001b200",
  863. "entropy": "6.17",
  864. "raw_address": "0x00024c00",
  865. "virtual_size": "0x0001b088",
  866. "characteristics_raw": "0x40000040"
  867. }
  868. ],
  869. "resources": [],
  870. "dirents": [
  871. {
  872. "virtual_address": "0x00000000",
  873. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  874. "size": "0x00000000"
  875. },
  876. {
  877. "virtual_address": "0x00023660",
  878. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  879. "size": "0x0000012c"
  880. },
  881. {
  882. "virtual_address": "0x0002a000",
  883. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  884. "size": "0x0001b088"
  885. },
  886. {
  887. "virtual_address": "0x00000000",
  888. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  889. "size": "0x00000000"
  890. },
  891. {
  892. "virtual_address": "0x00000000",
  893. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  894. "size": "0x00000000"
  895. },
  896. {
  897. "virtual_address": "0x00000000",
  898. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  899. "size": "0x00000000"
  900. },
  901. {
  902. "virtual_address": "0x00000000",
  903. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  904. "size": "0x00000000"
  905. },
  906. {
  907. "virtual_address": "0x00000000",
  908. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  909. "size": "0x00000000"
  910. },
  911. {
  912. "virtual_address": "0x00000000",
  913. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  914. "size": "0x00000000"
  915. },
  916. {
  917. "virtual_address": "0x00000000",
  918. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  919. "size": "0x00000000"
  920. },
  921. {
  922. "virtual_address": "0x00022a68",
  923. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  924. "size": "0x00000040"
  925. },
  926. {
  927. "virtual_address": "0x00000000",
  928. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  929. "size": "0x00000000"
  930. },
  931. {
  932. "virtual_address": "0x00018000",
  933. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  934. "size": "0x000002b0"
  935. },
  936. {
  937. "virtual_address": "0x00000000",
  938. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  939. "size": "0x00000000"
  940. },
  941. {
  942. "virtual_address": "0x00000000",
  943. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  944. "size": "0x00000000"
  945. },
  946. {
  947. "virtual_address": "0x00000000",
  948. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  949. "size": "0x00000000"
  950. }
  951. ],
  952. "exports": [],
  953. "guest_signers": {},
  954. "imphash": "63716686ee0be39516bc59489f130c96",
  955. "icon_fuzzy": null,
  956. "icon": null,
  957. "pdbpath": null,
  958. "imported_dll_count": 14,
  959. "versioninfo": []
  960. }
  961. }
  962.  
  963. [*] Resolved APIs: [
  964. "kernel32.dll.FlsAlloc",
  965. "kernel32.dll.FlsFree",
  966. "kernel32.dll.FlsGetValue",
  967. "kernel32.dll.FlsSetValue",
  968. "kernel32.dll.InitializeCriticalSectionEx",
  969. "kernel32.dll.CreateEventExW",
  970. "kernel32.dll.CreateSemaphoreExW",
  971. "kernel32.dll.SetThreadStackGuarantee",
  972. "kernel32.dll.CreateThreadpoolTimer",
  973. "kernel32.dll.SetThreadpoolTimer",
  974. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  975. "kernel32.dll.CloseThreadpoolTimer",
  976. "kernel32.dll.CreateThreadpoolWait",
  977. "kernel32.dll.SetThreadpoolWait",
  978. "kernel32.dll.CloseThreadpoolWait",
  979. "kernel32.dll.FlushProcessWriteBuffers",
  980. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  981. "kernel32.dll.GetCurrentProcessorNumber",
  982. "kernel32.dll.GetLogicalProcessorInformation",
  983. "kernel32.dll.CreateSymbolicLinkW",
  984. "kernel32.dll.EnumSystemLocalesEx",
  985. "kernel32.dll.CompareStringEx",
  986. "kernel32.dll.GetDateFormatEx",
  987. "kernel32.dll.GetLocaleInfoEx",
  988. "kernel32.dll.GetTimeFormatEx",
  989. "kernel32.dll.GetUserDefaultLocaleName",
  990. "kernel32.dll.IsValidLocaleName",
  991. "kernel32.dll.LCMapStringEx",
  992. "kernel32.dll.GetTickCount64"
  993. ]
  994.  
  995. [*] Static Analysis: {
  996. "pe": {
  997. "peid_signatures": null,
  998. "imports": [
  999. {
  1000. "imports": [
  1001. {
  1002. "name": "GetProcessHeap",
  1003. "address": "0x1018044"
  1004. },
  1005. {
  1006. "name": "GetConsoleMode",
  1007. "address": "0x1018048"
  1008. },
  1009. {
  1010. "name": "GetFileSizeEx",
  1011. "address": "0x101804c"
  1012. },
  1013. {
  1014. "name": "SetFileInformationByHandle",
  1015. "address": "0x1018050"
  1016. },
  1017. {
  1018. "name": "VirtualAlloc",
  1019. "address": "0x1018054"
  1020. },
  1021. {
  1022. "name": "CreateFileMappingA",
  1023. "address": "0x1018058"
  1024. },
  1025. {
  1026. "name": "VirtualLock",
  1027. "address": "0x101805c"
  1028. },
  1029. {
  1030. "name": "Module32FirstW",
  1031. "address": "0x1018060"
  1032. },
  1033. {
  1034. "name": "GetSystemInfo",
  1035. "address": "0x1018064"
  1036. },
  1037. {
  1038. "name": "CreateToolhelp32Snapshot",
  1039. "address": "0x1018068"
  1040. },
  1041. {
  1042. "name": "OutputDebugStringA",
  1043. "address": "0x101806c"
  1044. },
  1045. {
  1046. "name": "Module32NextW",
  1047. "address": "0x1018070"
  1048. },
  1049. {
  1050. "name": "GetCurrentProcessId",
  1051. "address": "0x1018074"
  1052. },
  1053. {
  1054. "name": "GetStringTypeW",
  1055. "address": "0x1018078"
  1056. },
  1057. {
  1058. "name": "LCMapStringW",
  1059. "address": "0x101807c"
  1060. },
  1061. {
  1062. "name": "HeapReAlloc",
  1063. "address": "0x1018080"
  1064. },
  1065. {
  1066. "name": "GetConsoleCP",
  1067. "address": "0x1018084"
  1068. },
  1069. {
  1070. "name": "FlushFileBuffers",
  1071. "address": "0x1018088"
  1072. },
  1073. {
  1074. "name": "FreeEnvironmentStringsW",
  1075. "address": "0x101808c"
  1076. },
  1077. {
  1078. "name": "GetEnvironmentStringsW",
  1079. "address": "0x1018090"
  1080. },
  1081. {
  1082. "name": "GetSystemTimeAsFileTime",
  1083. "address": "0x1018094"
  1084. },
  1085. {
  1086. "name": "QueryPerformanceCounter",
  1087. "address": "0x1018098"
  1088. },
  1089. {
  1090. "name": "GetModuleFileNameA",
  1091. "address": "0x101809c"
  1092. },
  1093. {
  1094. "name": "GetCurrentThreadId",
  1095. "address": "0x10180a0"
  1096. },
  1097. {
  1098. "name": "SetFilePointerEx",
  1099. "address": "0x10180a4"
  1100. },
  1101. {
  1102. "name": "GetCPInfo",
  1103. "address": "0x10180a8"
  1104. },
  1105. {
  1106. "name": "CreateEventA",
  1107. "address": "0x10180ac"
  1108. },
  1109. {
  1110. "name": "GetACP",
  1111. "address": "0x10180b0"
  1112. },
  1113. {
  1114. "name": "IsValidCodePage",
  1115. "address": "0x10180b4"
  1116. },
  1117. {
  1118. "name": "GetModuleHandleW",
  1119. "address": "0x10180b8"
  1120. },
  1121. {
  1122. "name": "GetStartupInfoW",
  1123. "address": "0x10180bc"
  1124. },
  1125. {
  1126. "name": "TlsFree",
  1127. "address": "0x10180c0"
  1128. },
  1129. {
  1130. "name": "TlsSetValue",
  1131. "address": "0x10180c4"
  1132. },
  1133. {
  1134. "name": "TlsGetValue",
  1135. "address": "0x10180c8"
  1136. },
  1137. {
  1138. "name": "TlsAlloc",
  1139. "address": "0x10180cc"
  1140. },
  1141. {
  1142. "name": "TerminateProcess",
  1143. "address": "0x10180d0"
  1144. },
  1145. {
  1146. "name": "GetCurrentProcess",
  1147. "address": "0x10180d4"
  1148. },
  1149. {
  1150. "name": "InitializeCriticalSectionAndSpinCount",
  1151. "address": "0x10180d8"
  1152. },
  1153. {
  1154. "name": "SetLastError",
  1155. "address": "0x10180dc"
  1156. },
  1157. {
  1158. "name": "SetUnhandledExceptionFilter",
  1159. "address": "0x10180e0"
  1160. },
  1161. {
  1162. "name": "UnhandledExceptionFilter",
  1163. "address": "0x10180e4"
  1164. },
  1165. {
  1166. "name": "DeleteCriticalSection",
  1167. "address": "0x10180e8"
  1168. },
  1169. {
  1170. "name": "HeapSize",
  1171. "address": "0x10180ec"
  1172. },
  1173. {
  1174. "name": "LoadLibraryExW",
  1175. "address": "0x10180f0"
  1176. },
  1177. {
  1178. "name": "OutputDebugStringW",
  1179. "address": "0x10180f4"
  1180. },
  1181. {
  1182. "name": "HeapFree",
  1183. "address": "0x10180f8"
  1184. },
  1185. {
  1186. "name": "IsProcessorFeaturePresent",
  1187. "address": "0x10180fc"
  1188. },
  1189. {
  1190. "name": "IsDebuggerPresent",
  1191. "address": "0x1018100"
  1192. },
  1193. {
  1194. "name": "RtlUnwind",
  1195. "address": "0x1018104"
  1196. },
  1197. {
  1198. "name": "RaiseException",
  1199. "address": "0x1018108"
  1200. },
  1201. {
  1202. "name": "GetCommandLineA",
  1203. "address": "0x101810c"
  1204. },
  1205. {
  1206. "name": "SetStdHandle",
  1207. "address": "0x1018110"
  1208. },
  1209. {
  1210. "name": "LeaveCriticalSection",
  1211. "address": "0x1018114"
  1212. },
  1213. {
  1214. "name": "EnterCriticalSection",
  1215. "address": "0x1018118"
  1216. },
  1217. {
  1218. "name": "WideCharToMultiByte",
  1219. "address": "0x101811c"
  1220. },
  1221. {
  1222. "name": "WaitForSingleObject",
  1223. "address": "0x1018120"
  1224. },
  1225. {
  1226. "name": "HeapAlloc",
  1227. "address": "0x1018124"
  1228. },
  1229. {
  1230. "name": "UnmapViewOfFile",
  1231. "address": "0x1018128"
  1232. },
  1233. {
  1234. "name": "MapViewOfFile",
  1235. "address": "0x101812c"
  1236. },
  1237. {
  1238. "name": "CreateFileA",
  1239. "address": "0x1018130"
  1240. },
  1241. {
  1242. "name": "GetWindowsDirectoryW",
  1243. "address": "0x1018134"
  1244. },
  1245. {
  1246. "name": "CloseHandle",
  1247. "address": "0x1018138"
  1248. },
  1249. {
  1250. "name": "GetVersionExA",
  1251. "address": "0x101813c"
  1252. },
  1253. {
  1254. "name": "ReadFileEx",
  1255. "address": "0x1018140"
  1256. },
  1257. {
  1258. "name": "GetStdHandle",
  1259. "address": "0x1018144"
  1260. },
  1261. {
  1262. "name": "GetLastError",
  1263. "address": "0x1018148"
  1264. },
  1265. {
  1266. "name": "CreateFileW",
  1267. "address": "0x101814c"
  1268. },
  1269. {
  1270. "name": "SetEvent",
  1271. "address": "0x1018150"
  1272. },
  1273. {
  1274. "name": "Sleep",
  1275. "address": "0x1018154"
  1276. },
  1277. {
  1278. "name": "WriteFile",
  1279. "address": "0x1018158"
  1280. },
  1281. {
  1282. "name": "FormatMessageA",
  1283. "address": "0x101815c"
  1284. },
  1285. {
  1286. "name": "MultiByteToWideChar",
  1287. "address": "0x1018160"
  1288. },
  1289. {
  1290. "name": "GetProcAddress",
  1291. "address": "0x1018164"
  1292. },
  1293. {
  1294. "name": "ExitProcess",
  1295. "address": "0x1018168"
  1296. },
  1297. {
  1298. "name": "DecodePointer",
  1299. "address": "0x101816c"
  1300. },
  1301. {
  1302. "name": "EncodePointer",
  1303. "address": "0x1018170"
  1304. },
  1305. {
  1306. "name": "WriteConsoleW",
  1307. "address": "0x1018174"
  1308. },
  1309. {
  1310. "name": "GetModuleHandleExW",
  1311. "address": "0x1018178"
  1312. },
  1313. {
  1314. "name": "WaitForSingleObjectEx",
  1315. "address": "0x101817c"
  1316. },
  1317. {
  1318. "name": "GetOEMCP",
  1319. "address": "0x1018180"
  1320. },
  1321. {
  1322. "name": "GetModuleFileNameW",
  1323. "address": "0x1018184"
  1324. },
  1325. {
  1326. "name": "GetFileType",
  1327. "address": "0x1018188"
  1328. }
  1329. ],
  1330. "dll": "KERNEL32.dll"
  1331. },
  1332. {
  1333. "imports": [
  1334. {
  1335. "name": "EndDeferWindowPos",
  1336. "address": "0x10181c0"
  1337. },
  1338. {
  1339. "name": "GetWindow",
  1340. "address": "0x10181c4"
  1341. },
  1342. {
  1343. "name": "GetClassLongA",
  1344. "address": "0x10181c8"
  1345. },
  1346. {
  1347. "name": "UpdateWindow",
  1348. "address": "0x10181cc"
  1349. },
  1350. {
  1351. "name": "OffsetRect",
  1352. "address": "0x10181d0"
  1353. },
  1354. {
  1355. "name": "SetWindowTextA",
  1356. "address": "0x10181d4"
  1357. },
  1358. {
  1359. "name": "InsertMenuA",
  1360. "address": "0x10181d8"
  1361. },
  1362. {
  1363. "name": "BeginDeferWindowPos",
  1364. "address": "0x10181dc"
  1365. },
  1366. {
  1367. "name": "SystemParametersInfoA",
  1368. "address": "0x10181e0"
  1369. },
  1370. {
  1371. "name": "GetWindowRect",
  1372. "address": "0x10181e4"
  1373. },
  1374. {
  1375. "name": "GetDC",
  1376. "address": "0x10181e8"
  1377. },
  1378. {
  1379. "name": "GetWindowLongW",
  1380. "address": "0x10181ec"
  1381. },
  1382. {
  1383. "name": "GetDCEx",
  1384. "address": "0x10181f0"
  1385. },
  1386. {
  1387. "name": "DefMDIChildProcA",
  1388. "address": "0x10181f4"
  1389. },
  1390. {
  1391. "name": "DeferWindowPos",
  1392. "address": "0x10181f8"
  1393. },
  1394. {
  1395. "name": "ReleaseDC",
  1396. "address": "0x10181fc"
  1397. },
  1398. {
  1399. "name": "GetSystemMetrics",
  1400. "address": "0x1018200"
  1401. },
  1402. {
  1403. "name": "ClipCursor",
  1404. "address": "0x1018204"
  1405. },
  1406. {
  1407. "name": "GetMenuItemCount",
  1408. "address": "0x1018208"
  1409. },
  1410. {
  1411. "name": "AppendMenuA",
  1412. "address": "0x101820c"
  1413. },
  1414. {
  1415. "name": "DefWindowProcW",
  1416. "address": "0x1018210"
  1417. },
  1418. {
  1419. "name": "LoadImageA",
  1420. "address": "0x1018214"
  1421. },
  1422. {
  1423. "name": "GetSystemMenu",
  1424. "address": "0x1018218"
  1425. },
  1426. {
  1427. "name": "SetActiveWindow",
  1428. "address": "0x101821c"
  1429. },
  1430. {
  1431. "name": "SetCapture",
  1432. "address": "0x1018220"
  1433. },
  1434. {
  1435. "name": "LoadStringA",
  1436. "address": "0x1018224"
  1437. },
  1438. {
  1439. "name": "GetParent",
  1440. "address": "0x1018228"
  1441. },
  1442. {
  1443. "name": "LoadIconA",
  1444. "address": "0x101822c"
  1445. },
  1446. {
  1447. "name": "CreateMenu",
  1448. "address": "0x1018230"
  1449. },
  1450. {
  1451. "name": "GetWindowTextLengthA",
  1452. "address": "0x1018234"
  1453. },
  1454. {
  1455. "name": "GetScrollRange",
  1456. "address": "0x1018238"
  1457. },
  1458. {
  1459. "name": "GetWindowTextA",
  1460. "address": "0x101823c"
  1461. },
  1462. {
  1463. "name": "SetWindowLongA",
  1464. "address": "0x1018240"
  1465. },
  1466. {
  1467. "name": "MessageBoxA",
  1468. "address": "0x1018244"
  1469. },
  1470. {
  1471. "name": "InvalidateRect",
  1472. "address": "0x1018248"
  1473. },
  1474. {
  1475. "name": "AppendMenuW",
  1476. "address": "0x101824c"
  1477. },
  1478. {
  1479. "name": "GetWindowLongA",
  1480. "address": "0x1018250"
  1481. },
  1482. {
  1483. "name": "SetClassLongA",
  1484. "address": "0x1018254"
  1485. },
  1486. {
  1487. "name": "GetDlgItem",
  1488. "address": "0x1018258"
  1489. },
  1490. {
  1491. "name": "GetDesktopWindow",
  1492. "address": "0x101825c"
  1493. },
  1494. {
  1495. "name": "SetWindowPos",
  1496. "address": "0x1018260"
  1497. },
  1498. {
  1499. "name": "GetCursorPos",
  1500. "address": "0x1018264"
  1501. },
  1502. {
  1503. "name": "GetMenuItemInfoA",
  1504. "address": "0x1018268"
  1505. },
  1506. {
  1507. "name": "CreatePopupMenu",
  1508. "address": "0x101826c"
  1509. },
  1510. {
  1511. "name": "IsDlgButtonChecked",
  1512. "address": "0x1018270"
  1513. }
  1514. ],
  1515. "dll": "USER32.dll"
  1516. },
  1517. {
  1518. "imports": [
  1519. {
  1520. "name": "StartPage",
  1521. "address": "0x1018018"
  1522. },
  1523. {
  1524. "name": "CreatePalette",
  1525. "address": "0x101801c"
  1526. },
  1527. {
  1528. "name": "SelectObject",
  1529. "address": "0x1018020"
  1530. },
  1531. {
  1532. "name": "GetTextMetricsA",
  1533. "address": "0x1018024"
  1534. },
  1535. {
  1536. "name": "SetTextAlign",
  1537. "address": "0x1018028"
  1538. },
  1539. {
  1540. "name": "GetObjectA",
  1541. "address": "0x101802c"
  1542. },
  1543. {
  1544. "name": "GetStockObject",
  1545. "address": "0x1018030"
  1546. },
  1547. {
  1548. "name": "CombineRgn",
  1549. "address": "0x1018034"
  1550. },
  1551. {
  1552. "name": "CreateRectRgn",
  1553. "address": "0x1018038"
  1554. },
  1555. {
  1556. "name": "MoveToEx",
  1557. "address": "0x101803c"
  1558. }
  1559. ],
  1560. "dll": "GDI32.dll"
  1561. },
  1562. {
  1563. "imports": [
  1564. {
  1565. "name": "RegCreateKeyA",
  1566. "address": "0x1018000"
  1567. },
  1568. {
  1569. "name": "RegCloseKey",
  1570. "address": "0x1018004"
  1571. },
  1572. {
  1573. "name": "RegQueryValueExA",
  1574. "address": "0x1018008"
  1575. }
  1576. ],
  1577. "dll": "ADVAPI32.dll"
  1578. },
  1579. {
  1580. "imports": [
  1581. {
  1582. "name": "SHGetFileInfoW",
  1583. "address": "0x10181a0"
  1584. }
  1585. ],
  1586. "dll": "SHELL32.dll"
  1587. },
  1588. {
  1589. "imports": [
  1590. {
  1591. "name": "CoInitialize",
  1592. "address": "0x1018294"
  1593. },
  1594. {
  1595. "name": "CreateItemMoniker",
  1596. "address": "0x1018298"
  1597. },
  1598. {
  1599. "name": "CreateStreamOnHGlobal",
  1600. "address": "0x101829c"
  1601. }
  1602. ],
  1603. "dll": "ole32.dll"
  1604. },
  1605. {
  1606. "imports": [
  1607. {
  1608. "name": "EnumPageFilesA",
  1609. "address": "0x1018198"
  1610. }
  1611. ],
  1612. "dll": "PSAPI.DLL"
  1613. },
  1614. {
  1615. "imports": [
  1616. {
  1617. "name": "CreateToolbarEx",
  1618. "address": "0x1018010"
  1619. }
  1620. ],
  1621. "dll": "COMCTL32.dll"
  1622. },
  1623. {
  1624. "imports": [
  1625. {
  1626. "name": "WSAStartup",
  1627. "address": "0x101828c"
  1628. }
  1629. ],
  1630. "dll": "WS2_32.dll"
  1631. },
  1632. {
  1633. "imports": [
  1634. {
  1635. "name": "PathIsUNCServerA",
  1636. "address": "0x10181a8"
  1637. },
  1638. {
  1639. "name": "PathUnExpandEnvStringsA",
  1640. "address": "0x10181ac"
  1641. }
  1642. ],
  1643. "dll": "SHLWAPI.dll"
  1644. },
  1645. {
  1646. "imports": [
  1647. {
  1648. "name": "DrawThemeBackground",
  1649. "address": "0x1018278"
  1650. },
  1651. {
  1652. "name": "DrawThemeParentBackground",
  1653. "address": "0x101827c"
  1654. },
  1655. {
  1656. "name": "GetBufferedPaintDC",
  1657. "address": "0x1018280"
  1658. },
  1659. {
  1660. "name": "IsThemeBackgroundPartiallyTransparent",
  1661. "address": "0x1018284"
  1662. }
  1663. ],
  1664. "dll": "UxTheme.dll"
  1665. },
  1666. {
  1667. "imports": [
  1668. {
  1669. "name": "SnmpUtilMemAlloc",
  1670. "address": "0x10182a4"
  1671. },
  1672. {
  1673. "name": "SnmpUtilMemFree",
  1674. "address": "0x10182a8"
  1675. }
  1676. ],
  1677. "dll": "snmpapi.dll"
  1678. },
  1679. {
  1680. "imports": [
  1681. {
  1682. "name": "TcDeleteFilter",
  1683. "address": "0x10181b4"
  1684. },
  1685. {
  1686. "name": "TcDeregisterClient",
  1687. "address": "0x10181b8"
  1688. }
  1689. ],
  1690. "dll": "TRAFFIC.dll"
  1691. },
  1692. {
  1693. "imports": [
  1694. {
  1695. "name": "DsGetRdnW",
  1696. "address": "0x1018190"
  1697. }
  1698. ],
  1699. "dll": "NTDSAPI.dll"
  1700. }
  1701. ],
  1702. "digital_signers": null,
  1703. "exported_dll_name": null,
  1704. "actual_checksum": "0x00041c7c",
  1705. "overlay": null,
  1706. "imagebase": "0x01000000",
  1707. "reported_checksum": "0x00041c7c",
  1708. "icon_hash": null,
  1709. "entrypoint": "0x01008af2",
  1710. "timestamp": "2019-06-26 09:58:49",
  1711. "osversion": "6.0",
  1712. "sections": [
  1713. {
  1714. "name": ".text",
  1715. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1716. "virtual_address": "0x00001000",
  1717. "size_of_data": "0x00016c00",
  1718. "entropy": "6.72",
  1719. "raw_address": "0x00000400",
  1720. "virtual_size": "0x00016bdb",
  1721. "characteristics_raw": "0x60000020"
  1722. },
  1723. {
  1724. "name": ".rdata",
  1725. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1726. "virtual_address": "0x00018000",
  1727. "size_of_data": "0x0000c600",
  1728. "entropy": "5.83",
  1729. "raw_address": "0x00017000",
  1730. "virtual_size": "0x0000c5ec",
  1731. "characteristics_raw": "0x40000040"
  1732. },
  1733. {
  1734. "name": ".data",
  1735. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1736. "virtual_address": "0x00025000",
  1737. "size_of_data": "0x00001600",
  1738. "entropy": "3.63",
  1739. "raw_address": "0x00023600",
  1740. "virtual_size": "0x0000495c",
  1741. "characteristics_raw": "0xc0000040"
  1742. },
  1743. {
  1744. "name": ".rsrc",
  1745. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1746. "virtual_address": "0x0002a000",
  1747. "size_of_data": "0x0001b200",
  1748. "entropy": "6.17",
  1749. "raw_address": "0x00024c00",
  1750. "virtual_size": "0x0001b088",
  1751. "characteristics_raw": "0x40000040"
  1752. }
  1753. ],
  1754. "resources": [],
  1755. "dirents": [
  1756. {
  1757. "virtual_address": "0x00000000",
  1758. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1759. "size": "0x00000000"
  1760. },
  1761. {
  1762. "virtual_address": "0x00023660",
  1763. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1764. "size": "0x0000012c"
  1765. },
  1766. {
  1767. "virtual_address": "0x0002a000",
  1768. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1769. "size": "0x0001b088"
  1770. },
  1771. {
  1772. "virtual_address": "0x00000000",
  1773. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1774. "size": "0x00000000"
  1775. },
  1776. {
  1777. "virtual_address": "0x00000000",
  1778. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1779. "size": "0x00000000"
  1780. },
  1781. {
  1782. "virtual_address": "0x00000000",
  1783. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1784. "size": "0x00000000"
  1785. },
  1786. {
  1787. "virtual_address": "0x00000000",
  1788. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1789. "size": "0x00000000"
  1790. },
  1791. {
  1792. "virtual_address": "0x00000000",
  1793. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1794. "size": "0x00000000"
  1795. },
  1796. {
  1797. "virtual_address": "0x00000000",
  1798. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1799. "size": "0x00000000"
  1800. },
  1801. {
  1802. "virtual_address": "0x00000000",
  1803. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1804. "size": "0x00000000"
  1805. },
  1806. {
  1807. "virtual_address": "0x00022a68",
  1808. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1809. "size": "0x00000040"
  1810. },
  1811. {
  1812. "virtual_address": "0x00000000",
  1813. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1814. "size": "0x00000000"
  1815. },
  1816. {
  1817. "virtual_address": "0x00018000",
  1818. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1819. "size": "0x000002b0"
  1820. },
  1821. {
  1822. "virtual_address": "0x00000000",
  1823. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1824. "size": "0x00000000"
  1825. },
  1826. {
  1827. "virtual_address": "0x00000000",
  1828. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1829. "size": "0x00000000"
  1830. },
  1831. {
  1832. "virtual_address": "0x00000000",
  1833. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1834. "size": "0x00000000"
  1835. }
  1836. ],
  1837. "exports": [],
  1838. "guest_signers": {},
  1839. "imphash": "63716686ee0be39516bc59489f130c96",
  1840. "icon_fuzzy": null,
  1841. "icon": null,
  1842. "pdbpath": null,
  1843. "imported_dll_count": 14,
  1844. "versioninfo": []
  1845. }
  1846. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!