API tools faq
paste
paladin316

Exes_bd50746ff9a9256a83cda14722326f1e_exe_2019-07-03_19_30.json

paladin316
Jul 3rd, 2019
2,137
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 43.77 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Delf"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_bd50746ff9a9256a83cda14722326f1e.exe"
  7. [*] File Size: 114688
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "100e5fa4c35e8c28f8aab2babbb5ce963ebeef510a5ee89ec6789f478599a312"
  10. [*] MD5: "bd50746ff9a9256a83cda14722326f1e"
  11. [*] SHA1: "91f9d878281b244592316393646503a283175a85"
  12. [*] SHA512: "fea8d658a2212f94277ff2b02a78b080f716df17b5e3b4fb738827a95ce963c0ffbf85188f815627a298774e65453b5d52a09cec1c5b8f7fd4adc40d90a3315f"
  13. [*] CRC32: "BCD77A5A"
  14. [*] SSDEEP: "3072:KExRaX6raoCoCyz6/mqv1JR+yBtGOeheWgin5q:faZ1tme+1winI"
  15.  
  16. [*] Process Execution: [
  17. "Exes_bd50746ff9a9256a83cda14722326f1e.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "File has been identified by 57 Antiviruses on VirusTotal as malicious",
  23. "Details": [
  24. {
  25. "MicroWorld-eScan": "Trojan.GenericKD.32002590"
  26. },
  27. {
  28. "FireEye": "Generic.mg.bd50746ff9a9256a"
  29. },
  30. {
  31. "CAT-QuickHeal": "Trojan.GenericPMF.S4165517"
  32. },
  33. {
  34. "McAfee": "GenericRXGZ-WP!BD50746FF9A9"
  35. },
  36. {
  37. "Malwarebytes": "Spyware.AzorUlt"
  38. },
  39. {
  40. "SUPERAntiSpyware": "Trojan.Agent/Gen-Downloader"
  41. },
  42. {
  43. "CrowdStrike": "win/malicious_confidence_100% (W)"
  44. },
  45. {
  46. "Alibaba": "TrojanPSW:Win32/Delf.50eb8c2d"
  47. },
  48. {
  49. "K7GW": "Password-Stealer ( 0052f9a71 )"
  50. },
  51. {
  52. "K7AntiVirus": "Password-Stealer ( 0052f9a71 )"
  53. },
  54. {
  55. "Invincea": "heuristic"
  56. },
  57. {
  58. "F-Prot": "W32/Delf_Troj.D.gen!Eldorado"
  59. },
  60. {
  61. "Symantec": "ML.Attribute.HighConfidence"
  62. },
  63. {
  64. "APEX": "Malicious"
  65. },
  66. {
  67. "Paloalto": "generic.ml"
  68. },
  69. {
  70. "ClamAV": "Win.Malware.Delf-6957976-0"
  71. },
  72. {
  73. "Kaspersky": "Trojan-PSW.Win32.Delf.aidq"
  74. },
  75. {
  76. "BitDefender": "Trojan.GenericKD.32002590"
  77. },
  78. {
  79. "NANO-Antivirus": "Trojan.Win32.Stealer.fitdqk"
  80. },
  81. {
  82. "AegisLab": "Trojan.Win32.Delf.moev"
  83. },
  84. {
  85. "Avast": "Win32:Trojan-gen"
  86. },
  87. {
  88. "Endgame": "malicious (high confidence)"
  89. },
  90. {
  91. "Sophos": "Mal/Generic-S"
  92. },
  93. {
  94. "F-Secure": "Trojan.TR/Crypt.XPACK.Gen"
  95. },
  96. {
  97. "DrWeb": "Trojan.PWS.Stealer.24943"
  98. },
  99. {
  100. "Zillya": "Trojan.Azorult.Win32.4"
  101. },
  102. {
  103. "TrendMicro": "TrojanSpy.Win32.COINSTEAL.SMPIS"
  104. },
  105. {
  106. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.ch"
  107. },
  108. {
  109. "Trapmine": "malicious.high.ml.score"
  110. },
  111. {
  112. "Emsisoft": "Trojan.GenericKD.32002590 (B)"
  113. },
  114. {
  115. "Ikarus": "Trojan-PSW.Delf"
  116. },
  117. {
  118. "Cyren": "W32/Delf_Troj.D.gen!Eldorado"
  119. },
  120. {
  121. "Jiangmin": "Trojan.PSW.Azorult.pr"
  122. },
  123. {
  124. "Avira": "TR/Crypt.XPACK.Gen"
  125. },
  126. {
  127. "Fortinet": "W32/PSW.DELF.OSF!tr"
  128. },
  129. {
  130. "Antiy-AVL": "Trojan[Ransom]/Win32.Blocker"
  131. },
  132. {
  133. "Microsoft": "Trojan:Win32/Gandcrab!rfn"
  134. },
  135. {
  136. "Arcabit": "Trojan.Generic.D1E8521E"
  137. },
  138. {
  139. "ZoneAlarm": "Trojan-PSW.Win32.Delf.aidq"
  140. },
  141. {
  142. "GData": "Trojan.GenericKD.32002590"
  143. },
  144. {
  145. "TACHYON": "Trojan/W32.DP-Agent.114688.Q"
  146. },
  147. {
  148. "AhnLab-V3": "Trojan/Win32.Delf.R260844"
  149. },
  150. {
  151. "Acronis": "suspicious"
  152. },
  153. {
  154. "ALYac": "Trojan.GenericKD.32002590"
  155. },
  156. {
  157. "MAX": "malware (ai score=100)"
  158. },
  159. {
  160. "VBA32": "BScope.TrojanRansom.Blocker"
  161. },
  162. {
  163. "Cylance": "Unsafe"
  164. },
  165. {
  166. "ESET-NOD32": "a variant of Win32/PSW.Delf.OSF"
  167. },
  168. {
  169. "TrendMicro-HouseCall": "TrojanSpy.Win32.COINSTEAL.SMPIS"
  170. },
  171. {
  172. "Rising": "Stealer.AZORult!1.B7AE (CLOUD)"
  173. },
  174. {
  175. "SentinelOne": "DFI - Suspicious PE"
  176. },
  177. {
  178. "MaxSecure": "Trojan.Malware.74069368.susgen"
  179. },
  180. {
  181. "Ad-Aware": "Trojan.GenericKD.32002590"
  182. },
  183. {
  184. "AVG": "Win32:Trojan-gen"
  185. },
  186. {
  187. "Cybereason": "malicious.ff9a92"
  188. },
  189. {
  190. "Panda": "Trj/Genetic.gen"
  191. },
  192. {
  193. "Qihoo-360": "Win32/Trojan.Coins.A"
  194. }
  195. ]
  196. },
  197. {
  198. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  199. "Details": [
  200. {
  201. "target": "clamav:Win.Malware.Delf-6957976-0, sha256:100e5fa4c35e8c28f8aab2babbb5ce963ebeef510a5ee89ec6789f478599a312, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  202. }
  203. ]
  204. },
  205. {
  206. "Description": "Collects information to fingerprint the system",
  207. "Details": []
  208. },
  209. {
  210. "Description": "Anomalous binary characteristics",
  211. "Details": [
  212. {
  213. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  214. }
  215. ]
  216. }
  217. ]
  218.  
  219. [*] Started Service: []
  220.  
  221. [*] Executed Commands: []
  222.  
  223. [*] Mutexes: [
  224. "A81FB8C60-BBE6E186-FC9B5DB5-36DA4559-33946726"
  225. ]
  226.  
  227. [*] Modified Files: []
  228.  
  229. [*] Deleted Files: []
  230.  
  231. [*] Modified Registry Keys: []
  232.  
  233. [*] Deleted Registry Keys: []
  234.  
  235. [*] DNS Communications: [
  236. {
  237. "type": "A",
  238. "request": "f0315859.xsph.ru",
  239. "answers": []
  240. }
  241. ]
  242.  
  243. [*] Domains: [
  244. {
  245. "ip": "141.8.192.151",
  246. "domain": "f0315859.xsph.ru"
  247. }
  248. ]
  249.  
  250. [*] Network Communication - ICMP: []
  251.  
  252. [*] Network Communication - HTTP: []
  253.  
  254. [*] Network Communication - SMTP: []
  255.  
  256. [*] Network Communication - Hosts: []
  257.  
  258. [*] Network Communication - IRC: []
  259.  
  260. [*] Static Analysis: {
  261. "pe": {
  262. "peid_signatures": null,
  263. "imports": [
  264. {
  265. "imports": [
  266. {
  267. "name": "DeleteCriticalSection",
  268. "address": "0x41d0dc"
  269. },
  270. {
  271. "name": "LeaveCriticalSection",
  272. "address": "0x41d0e0"
  273. },
  274. {
  275. "name": "EnterCriticalSection",
  276. "address": "0x41d0e4"
  277. },
  278. {
  279. "name": "InitializeCriticalSection",
  280. "address": "0x41d0e8"
  281. },
  282. {
  283. "name": "VirtualFree",
  284. "address": "0x41d0ec"
  285. },
  286. {
  287. "name": "VirtualAlloc",
  288. "address": "0x41d0f0"
  289. },
  290. {
  291. "name": "LocalFree",
  292. "address": "0x41d0f4"
  293. },
  294. {
  295. "name": "LocalAlloc",
  296. "address": "0x41d0f8"
  297. },
  298. {
  299. "name": "GetTickCount",
  300. "address": "0x41d0fc"
  301. },
  302. {
  303. "name": "QueryPerformanceCounter",
  304. "address": "0x41d100"
  305. },
  306. {
  307. "name": "GetVersion",
  308. "address": "0x41d104"
  309. },
  310. {
  311. "name": "GetCurrentThreadId",
  312. "address": "0x41d108"
  313. },
  314. {
  315. "name": "WideCharToMultiByte",
  316. "address": "0x41d10c"
  317. },
  318. {
  319. "name": "MultiByteToWideChar",
  320. "address": "0x41d110"
  321. },
  322. {
  323. "name": "GetThreadLocale",
  324. "address": "0x41d114"
  325. },
  326. {
  327. "name": "GetStartupInfoA",
  328. "address": "0x41d118"
  329. },
  330. {
  331. "name": "GetModuleFileNameA",
  332. "address": "0x41d11c"
  333. },
  334. {
  335. "name": "GetLocaleInfoA",
  336. "address": "0x41d120"
  337. },
  338. {
  339. "name": "GetCommandLineA",
  340. "address": "0x41d124"
  341. },
  342. {
  343. "name": "FreeLibrary",
  344. "address": "0x41d128"
  345. },
  346. {
  347. "name": "ExitProcess",
  348. "address": "0x41d12c"
  349. },
  350. {
  351. "name": "WriteFile",
  352. "address": "0x41d130"
  353. },
  354. {
  355. "name": "UnhandledExceptionFilter",
  356. "address": "0x41d134"
  357. },
  358. {
  359. "name": "RtlUnwind",
  360. "address": "0x41d138"
  361. },
  362. {
  363. "name": "RaiseException",
  364. "address": "0x41d13c"
  365. },
  366. {
  367. "name": "GetStdHandle",
  368. "address": "0x41d140"
  369. }
  370. ],
  371. "dll": "kernel32.dll"
  372. },
  373. {
  374. "imports": [
  375. {
  376. "name": "GetKeyboardType",
  377. "address": "0x41d148"
  378. },
  379. {
  380. "name": "MessageBoxA",
  381. "address": "0x41d14c"
  382. },
  383. {
  384. "name": "CharNextA",
  385. "address": "0x41d150"
  386. }
  387. ],
  388. "dll": "user32.dll"
  389. },
  390. {
  391. "imports": [
  392. {
  393. "name": "RegQueryValueExA",
  394. "address": "0x41d158"
  395. },
  396. {
  397. "name": "RegOpenKeyExA",
  398. "address": "0x41d15c"
  399. },
  400. {
  401. "name": "RegCloseKey",
  402. "address": "0x41d160"
  403. }
  404. ],
  405. "dll": "advapi32.dll"
  406. },
  407. {
  408. "imports": [
  409. {
  410. "name": "SysFreeString",
  411. "address": "0x41d168"
  412. },
  413. {
  414. "name": "SysReAllocStringLen",
  415. "address": "0x41d16c"
  416. },
  417. {
  418. "name": "SysAllocStringLen",
  419. "address": "0x41d170"
  420. }
  421. ],
  422. "dll": "oleaut32.dll"
  423. },
  424. {
  425. "imports": [
  426. {
  427. "name": "GetModuleHandleA",
  428. "address": "0x41d178"
  429. }
  430. ],
  431. "dll": "kernel32.dll"
  432. },
  433. {
  434. "imports": [
  435. {
  436. "name": "RegOpenKeyExA",
  437. "address": "0x41d180"
  438. },
  439. {
  440. "name": "RegEnumKeyA",
  441. "address": "0x41d184"
  442. },
  443. {
  444. "name": "FreeSid",
  445. "address": "0x41d188"
  446. }
  447. ],
  448. "dll": "advapi32.dll"
  449. },
  450. {
  451. "imports": [
  452. {
  453. "name": "WriteFile",
  454. "address": "0x41d190"
  455. },
  456. {
  457. "name": "Sleep",
  458. "address": "0x41d194"
  459. },
  460. {
  461. "name": "LocalFree",
  462. "address": "0x41d198"
  463. },
  464. {
  465. "name": "LoadLibraryExW",
  466. "address": "0x41d19c"
  467. },
  468. {
  469. "name": "LoadLibraryA",
  470. "address": "0x41d1a0"
  471. },
  472. {
  473. "name": "GlobalUnlock",
  474. "address": "0x41d1a4"
  475. },
  476. {
  477. "name": "GlobalLock",
  478. "address": "0x41d1a8"
  479. },
  480. {
  481. "name": "GetTickCount",
  482. "address": "0x41d1ac"
  483. },
  484. {
  485. "name": "GetSystemInfo",
  486. "address": "0x41d1b0"
  487. },
  488. {
  489. "name": "GetProcAddress",
  490. "address": "0x41d1b4"
  491. },
  492. {
  493. "name": "GetModuleHandleA",
  494. "address": "0x41d1b8"
  495. },
  496. {
  497. "name": "GetModuleFileNameA",
  498. "address": "0x41d1bc"
  499. },
  500. {
  501. "name": "GetFileAttributesW",
  502. "address": "0x41d1c0"
  503. },
  504. {
  505. "name": "GetCurrentProcessId",
  506. "address": "0x41d1c4"
  507. },
  508. {
  509. "name": "GetCurrentProcess",
  510. "address": "0x41d1c8"
  511. },
  512. {
  513. "name": "FreeLibrary",
  514. "address": "0x41d1cc"
  515. },
  516. {
  517. "name": "FindNextFileW",
  518. "address": "0x41d1d0"
  519. },
  520. {
  521. "name": "FindFirstFileW",
  522. "address": "0x41d1d4"
  523. },
  524. {
  525. "name": "FindClose",
  526. "address": "0x41d1d8"
  527. },
  528. {
  529. "name": "ExitProcess",
  530. "address": "0x41d1dc"
  531. },
  532. {
  533. "name": "DeleteFileW",
  534. "address": "0x41d1e0"
  535. },
  536. {
  537. "name": "CreateDirectoryW",
  538. "address": "0x41d1e4"
  539. },
  540. {
  541. "name": "CopyFileW",
  542. "address": "0x41d1e8"
  543. }
  544. ],
  545. "dll": "kernel32.dll"
  546. },
  547. {
  548. "imports": [
  549. {
  550. "name": "SelectObject",
  551. "address": "0x41d1f0"
  552. },
  553. {
  554. "name": "DeleteObject",
  555. "address": "0x41d1f4"
  556. },
  557. {
  558. "name": "DeleteDC",
  559. "address": "0x41d1f8"
  560. },
  561. {
  562. "name": "CreateCompatibleDC",
  563. "address": "0x41d1fc"
  564. },
  565. {
  566. "name": "CreateCompatibleBitmap",
  567. "address": "0x41d200"
  568. },
  569. {
  570. "name": "BitBlt",
  571. "address": "0x41d204"
  572. }
  573. ],
  574. "dll": "gdi32.dll"
  575. },
  576. {
  577. "imports": [
  578. {
  579. "name": "ReleaseDC",
  580. "address": "0x41d20c"
  581. },
  582. {
  583. "name": "GetSystemMetrics",
  584. "address": "0x41d210"
  585. },
  586. {
  587. "name": "GetDC",
  588. "address": "0x41d214"
  589. },
  590. {
  591. "name": "CharToOemBuffA",
  592. "address": "0x41d218"
  593. }
  594. ],
  595. "dll": "user32.dll"
  596. },
  597. {
  598. "imports": [
  599. {
  600. "name": "OleInitialize",
  601. "address": "0x41d220"
  602. },
  603. {
  604. "name": "CoCreateInstance",
  605. "address": "0x41d224"
  606. }
  607. ],
  608. "dll": "ole32.dll"
  609. }
  610. ],
  611. "digital_signers": null,
  612. "exported_dll_name": null,
  613. "actual_checksum": "0x0001e6a0",
  614. "overlay": null,
  615. "imagebase": "0x00400000",
  616. "reported_checksum": "0x00000000",
  617. "icon_hash": null,
  618. "entrypoint": "0x0041a684",
  619. "timestamp": "1992-06-19 22:22:17",
  620. "osversion": "4.0",
  621. "sections": [
  622. {
  623. "name": "CODE",
  624. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  625. "virtual_address": "0x00001000",
  626. "size_of_data": "0x00019800",
  627. "entropy": "6.19",
  628. "raw_address": "0x00000400",
  629. "virtual_size": "0x000196b0",
  630. "characteristics_raw": "0x60000020"
  631. },
  632. {
  633. "name": "DATA",
  634. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  635. "virtual_address": "0x0001b000",
  636. "size_of_data": "0x00000800",
  637. "entropy": "6.28",
  638. "raw_address": "0x00019c00",
  639. "virtual_size": "0x0000066c",
  640. "characteristics_raw": "0xc0000040"
  641. },
  642. {
  643. "name": "BSS",
  644. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  645. "virtual_address": "0x0001c000",
  646. "size_of_data": "0x00000000",
  647. "entropy": "0.00",
  648. "raw_address": "0x0001a400",
  649. "virtual_size": "0x000008c5",
  650. "characteristics_raw": "0xc0000000"
  651. },
  652. {
  653. "name": ".idata",
  654. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  655. "virtual_address": "0x0001d000",
  656. "size_of_data": "0x00000800",
  657. "entropy": "4.58",
  658. "raw_address": "0x0001a400",
  659. "virtual_size": "0x0000079e",
  660. "characteristics_raw": "0xc0000040"
  661. },
  662. {
  663. "name": ".reloc",
  664. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ",
  665. "virtual_address": "0x0001e000",
  666. "size_of_data": "0x00001400",
  667. "entropy": "6.67",
  668. "raw_address": "0x0001ac00",
  669. "virtual_size": "0x0000135c",
  670. "characteristics_raw": "0x50000040"
  671. }
  672. ],
  673. "resources": [],
  674. "dirents": [
  675. {
  676. "virtual_address": "0x00000000",
  677. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  678. "size": "0x00000000"
  679. },
  680. {
  681. "virtual_address": "0x0001d000",
  682. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  683. "size": "0x0000079e"
  684. },
  685. {
  686. "virtual_address": "0x00000000",
  687. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  688. "size": "0x00000000"
  689. },
  690. {
  691. "virtual_address": "0x00000000",
  692. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  693. "size": "0x00000000"
  694. },
  695. {
  696. "virtual_address": "0x00000000",
  697. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  698. "size": "0x00000000"
  699. },
  700. {
  701. "virtual_address": "0x0001e000",
  702. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  703. "size": "0x0000135c"
  704. },
  705. {
  706. "virtual_address": "0x00000000",
  707. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  708. "size": "0x00000000"
  709. },
  710. {
  711. "virtual_address": "0x00000000",
  712. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  713. "size": "0x00000000"
  714. },
  715. {
  716. "virtual_address": "0x00000000",
  717. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  718. "size": "0x00000000"
  719. },
  720. {
  721. "virtual_address": "0x00000000",
  722. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  723. "size": "0x00000000"
  724. },
  725. {
  726. "virtual_address": "0x00000000",
  727. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  728. "size": "0x00000000"
  729. },
  730. {
  731. "virtual_address": "0x00000000",
  732. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  733. "size": "0x00000000"
  734. },
  735. {
  736. "virtual_address": "0x00000000",
  737. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  738. "size": "0x00000000"
  739. },
  740. {
  741. "virtual_address": "0x00000000",
  742. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  743. "size": "0x00000000"
  744. },
  745. {
  746. "virtual_address": "0x00000000",
  747. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  748. "size": "0x00000000"
  749. },
  750. {
  751. "virtual_address": "0x00000000",
  752. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  753. "size": "0x00000000"
  754. }
  755. ],
  756. "exports": [],
  757. "guest_signers": {},
  758. "imphash": "6d1f2b41411eacafcf447fc002d8cb00",
  759. "icon_fuzzy": null,
  760. "icon": null,
  761. "pdbpath": null,
  762. "imported_dll_count": 10,
  763. "versioninfo": []
  764. }
  765. }
  766.  
  767. [*] Resolved APIs: [
  768. "crypt32.dll.CryptUnprotectData",
  769. "crtdll.dll.wcscmp",
  770. "gdiplus.dll.GdiplusStartup",
  771. "gdiplus.dll.GdiplusShutdown",
  772. "gdiplus.dll.GdipCreateBitmapFromHBITMAP",
  773. "gdiplus.dll.GdipGetImageEncodersSize",
  774. "gdiplus.dll.GdipGetImageEncoders",
  775. "gdiplus.dll.GdipDisposeImage",
  776. "gdiplus.dll.GdipSaveImageToStream",
  777. "ole32.dll.CreateStreamOnHGlobal",
  778. "ole32.dll.GetHGlobalFromStream",
  779. "kernel32.dll.ExpandEnvironmentStringsW",
  780. "kernel32.dll.GetComputerNameW",
  781. "kernel32.dll.GlobalMemoryStatus",
  782. "kernel32.dll.CreateFileW",
  783. "kernel32.dll.GetFileSize",
  784. "kernel32.dll.CloseHandle",
  785. "kernel32.dll.ReadFile",
  786. "kernel32.dll.GetFileAttributesW",
  787. "kernel32.dll.CreateMutexA",
  788. "kernel32.dll.ReleaseMutex",
  789. "kernel32.dll.GetLastError",
  790. "kernel32.dll.GetCurrentDirectoryW",
  791. "kernel32.dll.SetEnvironmentVariableW",
  792. "kernel32.dll.GetEnvironmentVariableW",
  793. "kernel32.dll.SetCurrentDirectoryW",
  794. "kernel32.dll.FindFirstFileW",
  795. "kernel32.dll.FindNextFileW",
  796. "kernel32.dll.LocalFree",
  797. "kernel32.dll.GetTickCount",
  798. "kernel32.dll.CopyFileW",
  799. "kernel32.dll.FindClose",
  800. "kernel32.dll.GlobalMemoryStatusEx",
  801. "kernel32.dll.CreateToolhelp32Snapshot",
  802. "kernel32.dll.Process32FirstW",
  803. "kernel32.dll.Process32NextW",
  804. "kernel32.dll.GetModuleFileNameW",
  805. "kernel32.dll.SetDllDirectoryW",
  806. "kernel32.dll.GetLocaleInfoA",
  807. "kernel32.dll.GetLocalTime",
  808. "kernel32.dll.GetTimeZoneInformation",
  809. "kernel32.dll.RemoveDirectoryW",
  810. "kernel32.dll.DeleteFileW",
  811. "kernel32.dll.GetLogicalDriveStringsA",
  812. "kernel32.dll.GetDriveTypeA",
  813. "kernel32.dll.CreateProcessW",
  814. "advapi32.dll.GetUserNameW",
  815. "advapi32.dll.RegCreateKeyExW",
  816. "advapi32.dll.RegQueryValueExW",
  817. "advapi32.dll.RegCloseKey",
  818. "advapi32.dll.RegOpenKeyExW",
  819. "advapi32.dll.AllocateAndInitializeSid",
  820. "advapi32.dll.LookupAccountSidA",
  821. "advapi32.dll.CreateProcessAsUserW",
  822. "advapi32.dll.CheckTokenMembership",
  823. "advapi32.dll.RegOpenKeyW",
  824. "advapi32.dll.RegEnumKeyW",
  825. "advapi32.dll.RegEnumValueW",
  826. "advapi32.dll.CryptAcquireContextA",
  827. "advapi32.dll.CryptCreateHash",
  828. "advapi32.dll.CryptHashData",
  829. "advapi32.dll.CryptGetHashParam",
  830. "advapi32.dll.CryptDestroyHash",
  831. "advapi32.dll.CryptReleaseContext",
  832. "user32.dll.EnumDisplayDevicesW",
  833. "user32.dll.wvsprintfA",
  834. "user32.dll.GetKeyboardLayoutList",
  835. "shell32.dll.ShellExecuteExW",
  836. "ntdll.dll.RtlComputeCrc32",
  837. "sechost.dll.LookupAccountSidLocalA",
  838. "wininet.dll.InternetOpenA",
  839. "wininet.dll.InternetConnectA",
  840. "wininet.dll.HttpOpenRequestA",
  841. "wininet.dll.HttpAddRequestHeadersA",
  842. "wininet.dll.HttpSendRequestA",
  843. "wininet.dll.InternetReadFile",
  844. "wininet.dll.InternetCloseHandle",
  845. "wininet.dll.InternetCrackUrlA",
  846. "wininet.dll.InternetSetOptionA",
  847. "rasapi32.dll.RasConnectionNotificationW",
  848. "sechost.dll.OpenServiceA",
  849. "sechost.dll.NotifyServiceStatusChangeA",
  850. "cryptbase.dll.SystemFunction036",
  851. "wsock32.dll.WSAStartup",
  852. "wsock32.dll.gethostbyname",
  853. "wsock32.dll.socket",
  854. "wsock32.dll.send",
  855. "wsock32.dll.recv",
  856. "wsock32.dll.htons",
  857. "wsock32.dll.connect",
  858. "wsock32.dll.closesocket",
  859. "rpcrt4.dll.RpcBindingFree"
  860. ]
  861.  
  862. [*] Static Analysis: {
  863. "pe": {
  864. "peid_signatures": null,
  865. "imports": [
  866. {
  867. "imports": [
  868. {
  869. "name": "DeleteCriticalSection",
  870. "address": "0x41d0dc"
  871. },
  872. {
  873. "name": "LeaveCriticalSection",
  874. "address": "0x41d0e0"
  875. },
  876. {
  877. "name": "EnterCriticalSection",
  878. "address": "0x41d0e4"
  879. },
  880. {
  881. "name": "InitializeCriticalSection",
  882. "address": "0x41d0e8"
  883. },
  884. {
  885. "name": "VirtualFree",
  886. "address": "0x41d0ec"
  887. },
  888. {
  889. "name": "VirtualAlloc",
  890. "address": "0x41d0f0"
  891. },
  892. {
  893. "name": "LocalFree",
  894. "address": "0x41d0f4"
  895. },
  896. {
  897. "name": "LocalAlloc",
  898. "address": "0x41d0f8"
  899. },
  900. {
  901. "name": "GetTickCount",
  902. "address": "0x41d0fc"
  903. },
  904. {
  905. "name": "QueryPerformanceCounter",
  906. "address": "0x41d100"
  907. },
  908. {
  909. "name": "GetVersion",
  910. "address": "0x41d104"
  911. },
  912. {
  913. "name": "GetCurrentThreadId",
  914. "address": "0x41d108"
  915. },
  916. {
  917. "name": "WideCharToMultiByte",
  918. "address": "0x41d10c"
  919. },
  920. {
  921. "name": "MultiByteToWideChar",
  922. "address": "0x41d110"
  923. },
  924. {
  925. "name": "GetThreadLocale",
  926. "address": "0x41d114"
  927. },
  928. {
  929. "name": "GetStartupInfoA",
  930. "address": "0x41d118"
  931. },
  932. {
  933. "name": "GetModuleFileNameA",
  934. "address": "0x41d11c"
  935. },
  936. {
  937. "name": "GetLocaleInfoA",
  938. "address": "0x41d120"
  939. },
  940. {
  941. "name": "GetCommandLineA",
  942. "address": "0x41d124"
  943. },
  944. {
  945. "name": "FreeLibrary",
  946. "address": "0x41d128"
  947. },
  948. {
  949. "name": "ExitProcess",
  950. "address": "0x41d12c"
  951. },
  952. {
  953. "name": "WriteFile",
  954. "address": "0x41d130"
  955. },
  956. {
  957. "name": "UnhandledExceptionFilter",
  958. "address": "0x41d134"
  959. },
  960. {
  961. "name": "RtlUnwind",
  962. "address": "0x41d138"
  963. },
  964. {
  965. "name": "RaiseException",
  966. "address": "0x41d13c"
  967. },
  968. {
  969. "name": "GetStdHandle",
  970. "address": "0x41d140"
  971. }
  972. ],
  973. "dll": "kernel32.dll"
  974. },
  975. {
  976. "imports": [
  977. {
  978. "name": "GetKeyboardType",
  979. "address": "0x41d148"
  980. },
  981. {
  982. "name": "MessageBoxA",
  983. "address": "0x41d14c"
  984. },
  985. {
  986. "name": "CharNextA",
  987. "address": "0x41d150"
  988. }
  989. ],
  990. "dll": "user32.dll"
  991. },
  992. {
  993. "imports": [
  994. {
  995. "name": "RegQueryValueExA",
  996. "address": "0x41d158"
  997. },
  998. {
  999. "name": "RegOpenKeyExA",
  1000. "address": "0x41d15c"
  1001. },
  1002. {
  1003. "name": "RegCloseKey",
  1004. "address": "0x41d160"
  1005. }
  1006. ],
  1007. "dll": "advapi32.dll"
  1008. },
  1009. {
  1010. "imports": [
  1011. {
  1012. "name": "SysFreeString",
  1013. "address": "0x41d168"
  1014. },
  1015. {
  1016. "name": "SysReAllocStringLen",
  1017. "address": "0x41d16c"
  1018. },
  1019. {
  1020. "name": "SysAllocStringLen",
  1021. "address": "0x41d170"
  1022. }
  1023. ],
  1024. "dll": "oleaut32.dll"
  1025. },
  1026. {
  1027. "imports": [
  1028. {
  1029. "name": "GetModuleHandleA",
  1030. "address": "0x41d178"
  1031. }
  1032. ],
  1033. "dll": "kernel32.dll"
  1034. },
  1035. {
  1036. "imports": [
  1037. {
  1038. "name": "RegOpenKeyExA",
  1039. "address": "0x41d180"
  1040. },
  1041. {
  1042. "name": "RegEnumKeyA",
  1043. "address": "0x41d184"
  1044. },
  1045. {
  1046. "name": "FreeSid",
  1047. "address": "0x41d188"
  1048. }
  1049. ],
  1050. "dll": "advapi32.dll"
  1051. },
  1052. {
  1053. "imports": [
  1054. {
  1055. "name": "WriteFile",
  1056. "address": "0x41d190"
  1057. },
  1058. {
  1059. "name": "Sleep",
  1060. "address": "0x41d194"
  1061. },
  1062. {
  1063. "name": "LocalFree",
  1064. "address": "0x41d198"
  1065. },
  1066. {
  1067. "name": "LoadLibraryExW",
  1068. "address": "0x41d19c"
  1069. },
  1070. {
  1071. "name": "LoadLibraryA",
  1072. "address": "0x41d1a0"
  1073. },
  1074. {
  1075. "name": "GlobalUnlock",
  1076. "address": "0x41d1a4"
  1077. },
  1078. {
  1079. "name": "GlobalLock",
  1080. "address": "0x41d1a8"
  1081. },
  1082. {
  1083. "name": "GetTickCount",
  1084. "address": "0x41d1ac"
  1085. },
  1086. {
  1087. "name": "GetSystemInfo",
  1088. "address": "0x41d1b0"
  1089. },
  1090. {
  1091. "name": "GetProcAddress",
  1092. "address": "0x41d1b4"
  1093. },
  1094. {
  1095. "name": "GetModuleHandleA",
  1096. "address": "0x41d1b8"
  1097. },
  1098. {
  1099. "name": "GetModuleFileNameA",
  1100. "address": "0x41d1bc"
  1101. },
  1102. {
  1103. "name": "GetFileAttributesW",
  1104. "address": "0x41d1c0"
  1105. },
  1106. {
  1107. "name": "GetCurrentProcessId",
  1108. "address": "0x41d1c4"
  1109. },
  1110. {
  1111. "name": "GetCurrentProcess",
  1112. "address": "0x41d1c8"
  1113. },
  1114. {
  1115. "name": "FreeLibrary",
  1116. "address": "0x41d1cc"
  1117. },
  1118. {
  1119. "name": "FindNextFileW",
  1120. "address": "0x41d1d0"
  1121. },
  1122. {
  1123. "name": "FindFirstFileW",
  1124. "address": "0x41d1d4"
  1125. },
  1126. {
  1127. "name": "FindClose",
  1128. "address": "0x41d1d8"
  1129. },
  1130. {
  1131. "name": "ExitProcess",
  1132. "address": "0x41d1dc"
  1133. },
  1134. {
  1135. "name": "DeleteFileW",
  1136. "address": "0x41d1e0"
  1137. },
  1138. {
  1139. "name": "CreateDirectoryW",
  1140. "address": "0x41d1e4"
  1141. },
  1142. {
  1143. "name": "CopyFileW",
  1144. "address": "0x41d1e8"
  1145. }
  1146. ],
  1147. "dll": "kernel32.dll"
  1148. },
  1149. {
  1150. "imports": [
  1151. {
  1152. "name": "SelectObject",
  1153. "address": "0x41d1f0"
  1154. },
  1155. {
  1156. "name": "DeleteObject",
  1157. "address": "0x41d1f4"
  1158. },
  1159. {
  1160. "name": "DeleteDC",
  1161. "address": "0x41d1f8"
  1162. },
  1163. {
  1164. "name": "CreateCompatibleDC",
  1165. "address": "0x41d1fc"
  1166. },
  1167. {
  1168. "name": "CreateCompatibleBitmap",
  1169. "address": "0x41d200"
  1170. },
  1171. {
  1172. "name": "BitBlt",
  1173. "address": "0x41d204"
  1174. }
  1175. ],
  1176. "dll": "gdi32.dll"
  1177. },
  1178. {
  1179. "imports": [
  1180. {
  1181. "name": "ReleaseDC",
  1182. "address": "0x41d20c"
  1183. },
  1184. {
  1185. "name": "GetSystemMetrics",
  1186. "address": "0x41d210"
  1187. },
  1188. {
  1189. "name": "GetDC",
  1190. "address": "0x41d214"
  1191. },
  1192. {
  1193. "name": "CharToOemBuffA",
  1194. "address": "0x41d218"
  1195. }
  1196. ],
  1197. "dll": "user32.dll"
  1198. },
  1199. {
  1200. "imports": [
  1201. {
  1202. "name": "OleInitialize",
  1203. "address": "0x41d220"
  1204. },
  1205. {
  1206. "name": "CoCreateInstance",
  1207. "address": "0x41d224"
  1208. }
  1209. ],
  1210. "dll": "ole32.dll"
  1211. }
  1212. ],
  1213. "digital_signers": null,
  1214. "exported_dll_name": null,
  1215. "actual_checksum": "0x0001e6a0",
  1216. "overlay": null,
  1217. "imagebase": "0x00400000",
  1218. "reported_checksum": "0x00000000",
  1219. "icon_hash": null,
  1220. "entrypoint": "0x0041a684",
  1221. "timestamp": "1992-06-19 22:22:17",
  1222. "osversion": "4.0",
  1223. "sections": [
  1224. {
  1225. "name": "CODE",
  1226. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1227. "virtual_address": "0x00001000",
  1228. "size_of_data": "0x00019800",
  1229. "entropy": "6.19",
  1230. "raw_address": "0x00000400",
  1231. "virtual_size": "0x000196b0",
  1232. "characteristics_raw": "0x60000020"
  1233. },
  1234. {
  1235. "name": "DATA",
  1236. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1237. "virtual_address": "0x0001b000",
  1238. "size_of_data": "0x00000800",
  1239. "entropy": "6.28",
  1240. "raw_address": "0x00019c00",
  1241. "virtual_size": "0x0000066c",
  1242. "characteristics_raw": "0xc0000040"
  1243. },
  1244. {
  1245. "name": "BSS",
  1246. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1247. "virtual_address": "0x0001c000",
  1248. "size_of_data": "0x00000000",
  1249. "entropy": "0.00",
  1250. "raw_address": "0x0001a400",
  1251. "virtual_size": "0x000008c5",
  1252. "characteristics_raw": "0xc0000000"
  1253. },
  1254. {
  1255. "name": ".idata",
  1256. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1257. "virtual_address": "0x0001d000",
  1258. "size_of_data": "0x00000800",
  1259. "entropy": "4.58",
  1260. "raw_address": "0x0001a400",
  1261. "virtual_size": "0x0000079e",
  1262. "characteristics_raw": "0xc0000040"
  1263. },
  1264. {
  1265. "name": ".reloc",
  1266. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ",
  1267. "virtual_address": "0x0001e000",
  1268. "size_of_data": "0x00001400",
  1269. "entropy": "6.67",
  1270. "raw_address": "0x0001ac00",
  1271. "virtual_size": "0x0000135c",
  1272. "characteristics_raw": "0x50000040"
  1273. }
  1274. ],
  1275. "resources": [],
  1276. "dirents": [
  1277. {
  1278. "virtual_address": "0x00000000",
  1279. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1280. "size": "0x00000000"
  1281. },
  1282. {
  1283. "virtual_address": "0x0001d000",
  1284. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1285. "size": "0x0000079e"
  1286. },
  1287. {
  1288. "virtual_address": "0x00000000",
  1289. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1290. "size": "0x00000000"
  1291. },
  1292. {
  1293. "virtual_address": "0x00000000",
  1294. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1295. "size": "0x00000000"
  1296. },
  1297. {
  1298. "virtual_address": "0x00000000",
  1299. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1300. "size": "0x00000000"
  1301. },
  1302. {
  1303. "virtual_address": "0x0001e000",
  1304. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1305. "size": "0x0000135c"
  1306. },
  1307. {
  1308. "virtual_address": "0x00000000",
  1309. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1310. "size": "0x00000000"
  1311. },
  1312. {
  1313. "virtual_address": "0x00000000",
  1314. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1315. "size": "0x00000000"
  1316. },
  1317. {
  1318. "virtual_address": "0x00000000",
  1319. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1320. "size": "0x00000000"
  1321. },
  1322. {
  1323. "virtual_address": "0x00000000",
  1324. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1325. "size": "0x00000000"
  1326. },
  1327. {
  1328. "virtual_address": "0x00000000",
  1329. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1330. "size": "0x00000000"
  1331. },
  1332. {
  1333. "virtual_address": "0x00000000",
  1334. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1335. "size": "0x00000000"
  1336. },
  1337. {
  1338. "virtual_address": "0x00000000",
  1339. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1340. "size": "0x00000000"
  1341. },
  1342. {
  1343. "virtual_address": "0x00000000",
  1344. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1345. "size": "0x00000000"
  1346. },
  1347. {
  1348. "virtual_address": "0x00000000",
  1349. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1350. "size": "0x00000000"
  1351. },
  1352. {
  1353. "virtual_address": "0x00000000",
  1354. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1355. "size": "0x00000000"
  1356. }
  1357. ],
  1358. "exports": [],
  1359. "guest_signers": {},
  1360. "imphash": "6d1f2b41411eacafcf447fc002d8cb00",
  1361. "icon_fuzzy": null,
  1362. "icon": null,
  1363. "pdbpath": null,
  1364. "imported_dll_count": 10,
  1365. "versioninfo": []
  1366. }
  1367. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!