API tools faq
paste
paladin316

Exes_a51e4a1821edbea72d78ee6704801a2b_exe_2019-07-02_13_30.json

paladin316
Jul 2nd, 2019
2,123
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 61.81 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Ispy"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_a51e4a1821edbea72d78ee6704801a2b.exe"
  7. [*] File Size: 1084416
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "0fd82b373b6c2622fa48442680f19bd70924be403cb67cbd18b9cc8e24e61f1a"
  10. [*] MD5: "a51e4a1821edbea72d78ee6704801a2b"
  11. [*] SHA1: "0bb5042c4d2443c0e2f4400595a636ad4cb8b307"
  12. [*] SHA512: "565aa46c5dc0bb8b98e822ca04fb00b838585f0fcfcd0d39cf2c15c966c2048aad3ae27ef7f856f9fa8561159989d031afd8531156aca2b2f8c88994ea3be0b5"
  13. [*] CRC32: "B1B6CA45"
  14. [*] SSDEEP: "24576:IBXu9HGaVHeCrsqI9Nc2UtgHPPGbpeE50Yf:Iw9VHeCrdI9OjKvPGbpr55"
  15.  
  16. [*] Process Execution: [
  17. "Exes_a51e4a1821edbea72d78ee6704801a2b.exe",
  18. "RegAsm.exe",
  19. "vbc.exe",
  20. "services.exe",
  21. "svchost.exe",
  22. "WmiPrvSE.exe",
  23. "svchost.exe",
  24. "lsass.exe"
  25. ]
  26.  
  27. [*] Signatures Detected: [
  28. {
  29. "Description": "Creates RWX memory",
  30. "Details": []
  31. },
  32. {
  33. "Description": "A process attempted to delay the analysis task.",
  34. "Details": [
  35. {
  36. "Process": "WmiPrvSE.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  37. },
  38. {
  39. "Process": "RegAsm.exe tried to sleep 503 seconds, actually delayed analysis time by 0 seconds"
  40. }
  41. ]
  42. },
  43. {
  44. "Description": "Reads data out of its own binary image",
  45. "Details": [
  46. {
  47. "self_read": "process: Exes_a51e4a1821edbea72d78ee6704801a2b.exe, pid: 1876, offset: 0x00000000, length: 0x00108c00"
  48. }
  49. ]
  50. },
  51. {
  52. "Description": "The binary likely contains encrypted or compressed data.",
  53. "Details": [
  54. {
  55. "section": "name: UPX1, entropy: 7.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00055c00, virtual_size: 0x00056000"
  56. },
  57. {
  58. "section": "name: .rsrc, entropy: 7.96, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x000b2c00, virtual_size: 0x000b3000"
  59. }
  60. ]
  61. },
  62. {
  63. "Description": "The executable is compressed using UPX",
  64. "Details": [
  65. {
  66. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00133000"
  67. }
  68. ]
  69. },
  70. {
  71. "Description": "Executed a process and injected code into it, probably while unpacking",
  72. "Details": [
  73. {
  74. "Injection": "Exes_a51e4a1821edbea72d78ee6704801a2b.exe(1876) -> RegAsm.exe(876)"
  75. }
  76. ]
  77. },
  78. {
  79. "Description": "Attempts to restart the guest VM",
  80. "Details": []
  81. },
  82. {
  83. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  84. "Details": [
  85. {
  86. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 539168 times"
  87. }
  88. ]
  89. },
  90. {
  91. "Description": "Steals private information from local Internet browsers",
  92. "Details": [
  93. {
  94. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
  95. },
  96. {
  97. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  98. },
  99. {
  100. "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat"
  101. }
  102. ]
  103. },
  104. {
  105. "Description": "Exhibits behavior characteristic of iSpy Keylogger",
  106. "Details": []
  107. },
  108. {
  109. "Description": "Installs itself for autorun at Windows startup",
  110. "Details": [
  111. {
  112. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\systray.url"
  113. },
  114. {
  115. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\systray.url"
  116. },
  117. {
  118. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\systray.url"
  119. }
  120. ]
  121. },
  122. {
  123. "Description": "Creates a hidden or system file",
  124. "Details": [
  125. {
  126. "file": "C:\\Users\\user\\bootsect"
  127. },
  128. {
  129. "file": "C:\\Users\\user\\bootsect\\mshta.exe"
  130. },
  131. {
  132. "file": "C:\\Users\\user\\bootsect\\systray.vbs"
  133. }
  134. ]
  135. },
  136. {
  137. "Description": "File has been identified by 49 Antiviruses on VirusTotal as malicious",
  138. "Details": [
  139. {
  140. "MicroWorld-eScan": "Trojan.GenericKD.41257784"
  141. },
  142. {
  143. "FireEye": "Generic.mg.a51e4a1821edbea7"
  144. },
  145. {
  146. "CAT-QuickHeal": "HackTool.BrowserPassview"
  147. },
  148. {
  149. "McAfee": "Artemis!A51E4A1821ED"
  150. },
  151. {
  152. "Cylance": "Unsafe"
  153. },
  154. {
  155. "BitDefender": "Trojan.GenericKD.41257784"
  156. },
  157. {
  158. "K7GW": "Trojan ( 0054d6ae1 )"
  159. },
  160. {
  161. "K7AntiVirus": "Trojan ( 0054d6ae1 )"
  162. },
  163. {
  164. "Invincea": "heuristic"
  165. },
  166. {
  167. "Symantec": "Trojan Horse"
  168. },
  169. {
  170. "APEX": "Malicious"
  171. },
  172. {
  173. "Paloalto": "generic.ml"
  174. },
  175. {
  176. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  177. },
  178. {
  179. "Alibaba": "Backdoor:Win32/Androm.3f9b823f"
  180. },
  181. {
  182. "ViRobot": "Trojan.Win32.Z.Blocker.1084416"
  183. },
  184. {
  185. "AegisLab": "Trojan.Multi.Generic.4!c"
  186. },
  187. {
  188. "Rising": "Trojan.Win32.Agent_.rm (CLOUD)"
  189. },
  190. {
  191. "Ad-Aware": "Trojan.GenericKD.41257784"
  192. },
  193. {
  194. "Emsisoft": "Trojan.GenericKD.41257784 (B)"
  195. },
  196. {
  197. "Comodo": "Malware@#tmsc7f0ex6mo"
  198. },
  199. {
  200. "F-Secure": "Trojan.TR/AD.HawkEyeKeylogger.eltil"
  201. },
  202. {
  203. "DrWeb": "Tool.PassView.1917"
  204. },
  205. {
  206. "Zillya": "Trojan.Packed.Win32.158080"
  207. },
  208. {
  209. "TrendMicro": "TROJ_GEN.R04AC0RE519"
  210. },
  211. {
  212. "McAfee-GW-Edition": "BehavesLike.Win32.Dropper.tc"
  213. },
  214. {
  215. "Fortinet": "W32/Generik.ILJSTYX!tr"
  216. },
  217. {
  218. "Ikarus": "Trojan.Autoit"
  219. },
  220. {
  221. "Cyren": "W32/Trojan.HVGU-1921"
  222. },
  223. {
  224. "Jiangmin": "Trojan.Miner.bdn"
  225. },
  226. {
  227. "Avira": "TR/AD.HawkEyeKeylogger.eltil"
  228. },
  229. {
  230. "Antiy-AVL": "Trojan[Dropper]/Win32.Sysn"
  231. },
  232. {
  233. "Endgame": "malicious (moderate confidence)"
  234. },
  235. {
  236. "Arcabit": "Trojan.Generic.D2758B38"
  237. },
  238. {
  239. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  240. },
  241. {
  242. "Microsoft": "HackTool:Win32/BrowserPassview"
  243. },
  244. {
  245. "Sophos": "Troj/Agent-BBJJ"
  246. },
  247. {
  248. "AhnLab-V3": "Trojan/Win32.Stimilina.C3206305"
  249. },
  250. {
  251. "ALYac": "Trojan.GenericKD.41257784"
  252. },
  253. {
  254. "Malwarebytes": "Trojan.MalPack.Generic"
  255. },
  256. {
  257. "Panda": "Trj/CI.A"
  258. },
  259. {
  260. "ESET-NOD32": "a variant of Win32/Packed.AutoIt.RE"
  261. },
  262. {
  263. "TrendMicro-HouseCall": "TROJ_GEN.R04AC0RE519"
  264. },
  265. {
  266. "Tencent": "Win32.Trojan.Inject.Auto"
  267. },
  268. {
  269. "SentinelOne": "DFI - Suspicious PE"
  270. },
  271. {
  272. "GData": "Trojan.GenericKD.41257784"
  273. },
  274. {
  275. "AVG": "Win32:Trojan-gen"
  276. },
  277. {
  278. "Avast": "Win32:Trojan-gen"
  279. },
  280. {
  281. "CrowdStrike": "win/malicious_confidence_90% (W)"
  282. },
  283. {
  284. "Qihoo-360": "Win32/Backdoor.c6a"
  285. }
  286. ]
  287. },
  288. {
  289. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  290. "Details": []
  291. },
  292. {
  293. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  294. "Details": [
  295. {
  296. "target": "clamav:Win.Malware.Generic-6961740-0, sha256:0fd82b373b6c2622fa48442680f19bd70924be403cb67cbd18b9cc8e24e61f1a, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  297. },
  298. {
  299. "dropped": "clamav:Win.Malware.Generic-6961740-0, sha256:7594ad0bbe6cf2a2343675b42ed6a8c4571a465b8735efd3b954116d9694005b , guest_paths:C:\\Users\\user\\bootsect\\mshta.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  300. }
  301. ]
  302. },
  303. {
  304. "Description": "Creates a slightly modified copy of itself",
  305. "Details": [
  306. {
  307. "file": "C:\\Users\\user\\bootsect\\mshta.exe"
  308. },
  309. {
  310. "percent_match": 100
  311. }
  312. ]
  313. }
  314. ]
  315.  
  316. [*] Started Service: [
  317. "VaultSvc"
  318. ]
  319.  
  320. [*] Executed Commands: [
  321. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  322. "C:\\Windows\\system32\\lsass.exe"
  323. ]
  324.  
  325. [*] Mutexes: [
  326. "Global\\CLR_CASOFF_MUTEX",
  327. "aae90034-4d5f-413f-b009-237e1e0bc2d6"
  328. ]
  329.  
  330. [*] Modified Files: [
  331. "C:\\Users\\user\\bootsect\\mshta.exe",
  332. "C:\\Users\\user\\bootsect\\systray.vbs",
  333. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\systray.url",
  334. "\\??\\PIPE\\samr",
  335. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  336. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  337. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  338. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  339. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  340. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  341. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  342. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  343. "\\??\\WMIDataDevice",
  344. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data",
  345. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data",
  346. "C:\\Users\\user\\AppData\\Local\\Temp\\tmpFA22.tmp"
  347. ]
  348.  
  349. [*] Deleted Files: []
  350.  
  351. [*] Modified Registry Keys: [
  352. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  353. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  354. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  355. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  356. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  357. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  358. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  359. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
  360. ]
  361.  
  362. [*] Deleted Registry Keys: []
  363.  
  364. [*] DNS Communications: []
  365.  
  366. [*] Domains: []
  367.  
  368. [*] Network Communication - ICMP: []
  369.  
  370. [*] Network Communication - HTTP: []
  371.  
  372. [*] Network Communication - SMTP: []
  373.  
  374. [*] Network Communication - Hosts: []
  375.  
  376. [*] Network Communication - IRC: []
  377.  
  378. [*] Static Analysis: {
  379. "pe": {
  380. "peid_signatures": null,
  381. "imports": [
  382. {
  383. "imports": [
  384. {
  385. "name": "LoadLibraryA",
  386. "address": "0x63c914"
  387. },
  388. {
  389. "name": "GetProcAddress",
  390. "address": "0x63c918"
  391. },
  392. {
  393. "name": "VirtualProtect",
  394. "address": "0x63c91c"
  395. },
  396. {
  397. "name": "VirtualAlloc",
  398. "address": "0x63c920"
  399. },
  400. {
  401. "name": "VirtualFree",
  402. "address": "0x63c924"
  403. },
  404. {
  405. "name": "ExitProcess",
  406. "address": "0x63c928"
  407. }
  408. ],
  409. "dll": "KERNEL32.DLL"
  410. },
  411. {
  412. "imports": [
  413. {
  414. "name": "GetAce",
  415. "address": "0x63c930"
  416. }
  417. ],
  418. "dll": "ADVAPI32.dll"
  419. },
  420. {
  421. "imports": [
  422. {
  423. "name": "ImageList_Remove",
  424. "address": "0x63c938"
  425. }
  426. ],
  427. "dll": "COMCTL32.dll"
  428. },
  429. {
  430. "imports": [
  431. {
  432. "name": "GetOpenFileNameW",
  433. "address": "0x63c940"
  434. }
  435. ],
  436. "dll": "COMDLG32.dll"
  437. },
  438. {
  439. "imports": [
  440. {
  441. "name": "LineTo",
  442. "address": "0x63c948"
  443. }
  444. ],
  445. "dll": "GDI32.dll"
  446. },
  447. {
  448. "imports": [
  449. {
  450. "name": "IcmpSendEcho",
  451. "address": "0x63c950"
  452. }
  453. ],
  454. "dll": "IPHLPAPI.DLL"
  455. },
  456. {
  457. "imports": [
  458. {
  459. "name": "WNetUseConnectionW",
  460. "address": "0x63c958"
  461. }
  462. ],
  463. "dll": "MPR.dll"
  464. },
  465. {
  466. "imports": [
  467. {
  468. "name": "CoGetObject",
  469. "address": "0x63c960"
  470. }
  471. ],
  472. "dll": "ole32.dll"
  473. },
  474. {
  475. "imports": [
  476. {
  477. "name": "VariantInit",
  478. "address": "0x63c968"
  479. }
  480. ],
  481. "dll": "OLEAUT32.dll"
  482. },
  483. {
  484. "imports": [
  485. {
  486. "name": "GetProcessMemoryInfo",
  487. "address": "0x63c970"
  488. }
  489. ],
  490. "dll": "PSAPI.DLL"
  491. },
  492. {
  493. "imports": [
  494. {
  495. "name": "DragFinish",
  496. "address": "0x63c978"
  497. }
  498. ],
  499. "dll": "SHELL32.dll"
  500. },
  501. {
  502. "imports": [
  503. {
  504. "name": "GetDC",
  505. "address": "0x63c980"
  506. }
  507. ],
  508. "dll": "USER32.dll"
  509. },
  510. {
  511. "imports": [
  512. {
  513. "name": "LoadUserProfileW",
  514. "address": "0x63c988"
  515. }
  516. ],
  517. "dll": "USERENV.dll"
  518. },
  519. {
  520. "imports": [
  521. {
  522. "name": "IsThemeActive",
  523. "address": "0x63c990"
  524. }
  525. ],
  526. "dll": "UxTheme.dll"
  527. },
  528. {
  529. "imports": [
  530. {
  531. "name": "VerQueryValueW",
  532. "address": "0x63c998"
  533. }
  534. ],
  535. "dll": "VERSION.dll"
  536. },
  537. {
  538. "imports": [
  539. {
  540. "name": "FtpOpenFileW",
  541. "address": "0x63c9a0"
  542. }
  543. ],
  544. "dll": "WININET.dll"
  545. },
  546. {
  547. "imports": [
  548. {
  549. "name": "timeGetTime",
  550. "address": "0x63c9a8"
  551. }
  552. ],
  553. "dll": "WINMM.dll"
  554. },
  555. {
  556. "imports": [
  557. {
  558. "name": "connect",
  559. "address": "0x63c9b0"
  560. }
  561. ],
  562. "dll": "WSOCK32.dll"
  563. }
  564. ],
  565. "digital_signers": null,
  566. "exported_dll_name": null,
  567. "actual_checksum": "0x00109826",
  568. "overlay": null,
  569. "imagebase": "0x00400000",
  570. "reported_checksum": "0x00000000",
  571. "icon_hash": null,
  572. "entrypoint": "0x00589980",
  573. "timestamp": "2019-05-03 22:14:25",
  574. "osversion": "5.1",
  575. "sections": [
  576. {
  577. "name": "UPX0",
  578. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  579. "virtual_address": "0x00001000",
  580. "size_of_data": "0x00000000",
  581. "entropy": "0.00",
  582. "raw_address": "0x00000400",
  583. "virtual_size": "0x00133000",
  584. "characteristics_raw": "0xe0000080"
  585. },
  586. {
  587. "name": "UPX1",
  588. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  589. "virtual_address": "0x00134000",
  590. "size_of_data": "0x00055c00",
  591. "entropy": "7.94",
  592. "raw_address": "0x00000400",
  593. "virtual_size": "0x00056000",
  594. "characteristics_raw": "0xe0000040"
  595. },
  596. {
  597. "name": ".rsrc",
  598. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  599. "virtual_address": "0x0018a000",
  600. "size_of_data": "0x000b2c00",
  601. "entropy": "7.96",
  602. "raw_address": "0x00056000",
  603. "virtual_size": "0x000b3000",
  604. "characteristics_raw": "0xc0000040"
  605. }
  606. ],
  607. "resources": [],
  608. "dirents": [
  609. {
  610. "virtual_address": "0x00000000",
  611. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  612. "size": "0x00000000"
  613. },
  614. {
  615. "virtual_address": "0x0023c798",
  616. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  617. "size": "0x00000424"
  618. },
  619. {
  620. "virtual_address": "0x0018a000",
  621. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  622. "size": "0x000b2798"
  623. },
  624. {
  625. "virtual_address": "0x00000000",
  626. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  627. "size": "0x00000000"
  628. },
  629. {
  630. "virtual_address": "0x00000000",
  631. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  632. "size": "0x00000000"
  633. },
  634. {
  635. "virtual_address": "0x0023cbbc",
  636. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  637. "size": "0x0000000c"
  638. },
  639. {
  640. "virtual_address": "0x00000000",
  641. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  642. "size": "0x00000000"
  643. },
  644. {
  645. "virtual_address": "0x00000000",
  646. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  647. "size": "0x00000000"
  648. },
  649. {
  650. "virtual_address": "0x00000000",
  651. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  652. "size": "0x00000000"
  653. },
  654. {
  655. "virtual_address": "0x00000000",
  656. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  657. "size": "0x00000000"
  658. },
  659. {
  660. "virtual_address": "0x00189b64",
  661. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  662. "size": "0x00000048"
  663. },
  664. {
  665. "virtual_address": "0x00000000",
  666. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  667. "size": "0x00000000"
  668. },
  669. {
  670. "virtual_address": "0x00000000",
  671. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  672. "size": "0x00000000"
  673. },
  674. {
  675. "virtual_address": "0x00000000",
  676. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  677. "size": "0x00000000"
  678. },
  679. {
  680. "virtual_address": "0x00000000",
  681. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  682. "size": "0x00000000"
  683. },
  684. {
  685. "virtual_address": "0x00000000",
  686. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  687. "size": "0x00000000"
  688. }
  689. ],
  690. "exports": [],
  691. "guest_signers": {},
  692. "imphash": "fc6683d30d9f25244a50fd5357825e79",
  693. "icon_fuzzy": null,
  694. "icon": null,
  695. "pdbpath": null,
  696. "imported_dll_count": 18,
  697. "versioninfo": []
  698. }
  699. }
  700.  
  701. [*] Resolved APIs: [
  702. "kernel32.dll.DuplicateHandle",
  703. "kernel32.dll.CreateThread",
  704. "kernel32.dll.WaitForSingleObject",
  705. "kernel32.dll.HeapAlloc",
  706. "kernel32.dll.GetProcessHeap",
  707. "kernel32.dll.HeapFree",
  708. "kernel32.dll.Sleep",
  709. "kernel32.dll.GetCurrentThreadId",
  710. "kernel32.dll.MultiByteToWideChar",
  711. "kernel32.dll.MulDiv",
  712. "kernel32.dll.GetVersionExW",
  713. "kernel32.dll.IsWow64Process",
  714. "kernel32.dll.GetSystemInfo",
  715. "kernel32.dll.FreeLibrary",
  716. "kernel32.dll.LoadLibraryA",
  717. "kernel32.dll.GetProcAddress",
  718. "kernel32.dll.SetErrorMode",
  719. "kernel32.dll.GetModuleFileNameW",
  720. "kernel32.dll.WideCharToMultiByte",
  721. "kernel32.dll.lstrcpyW",
  722. "kernel32.dll.lstrlenW",
  723. "kernel32.dll.GetModuleHandleW",
  724. "kernel32.dll.QueryPerformanceCounter",
  725. "kernel32.dll.VirtualFreeEx",
  726. "kernel32.dll.OpenProcess",
  727. "kernel32.dll.VirtualAllocEx",
  728. "kernel32.dll.WriteProcessMemory",
  729. "kernel32.dll.ReadProcessMemory",
  730. "kernel32.dll.CreateFileW",
  731. "kernel32.dll.SetFilePointerEx",
  732. "kernel32.dll.SetEndOfFile",
  733. "kernel32.dll.ReadFile",
  734. "kernel32.dll.WriteFile",
  735. "kernel32.dll.FlushFileBuffers",
  736. "kernel32.dll.TerminateProcess",
  737. "kernel32.dll.CreateToolhelp32Snapshot",
  738. "kernel32.dll.Process32FirstW",
  739. "kernel32.dll.Process32NextW",
  740. "kernel32.dll.SetFileTime",
  741. "kernel32.dll.GetFileAttributesW",
  742. "kernel32.dll.FindFirstFileW",
  743. "kernel32.dll.SetCurrentDirectoryW",
  744. "kernel32.dll.GetLongPathNameW",
  745. "kernel32.dll.GetShortPathNameW",
  746. "kernel32.dll.DeleteFileW",
  747. "kernel32.dll.FindNextFileW",
  748. "kernel32.dll.CopyFileExW",
  749. "kernel32.dll.MoveFileW",
  750. "kernel32.dll.CreateDirectoryW",
  751. "kernel32.dll.RemoveDirectoryW",
  752. "kernel32.dll.SetSystemPowerState",
  753. "kernel32.dll.QueryPerformanceFrequency",
  754. "kernel32.dll.FindResourceW",
  755. "kernel32.dll.LoadResource",
  756. "kernel32.dll.LockResource",
  757. "kernel32.dll.SizeofResource",
  758. "kernel32.dll.EnumResourceNamesW",
  759. "kernel32.dll.OutputDebugStringW",
  760. "kernel32.dll.GetTempPathW",
  761. "kernel32.dll.GetTempFileNameW",
  762. "kernel32.dll.DeviceIoControl",
  763. "kernel32.dll.GetLocalTime",
  764. "kernel32.dll.CompareStringW",
  765. "kernel32.dll.GetCurrentProcess",
  766. "kernel32.dll.EnterCriticalSection",
  767. "kernel32.dll.LeaveCriticalSection",
  768. "kernel32.dll.GetStdHandle",
  769. "kernel32.dll.CreatePipe",
  770. "kernel32.dll.InterlockedExchange",
  771. "kernel32.dll.TerminateThread",
  772. "kernel32.dll.LoadLibraryExW",
  773. "kernel32.dll.FindResourceExW",
  774. "kernel32.dll.CopyFileW",
  775. "kernel32.dll.VirtualFree",
  776. "kernel32.dll.FormatMessageW",
  777. "kernel32.dll.GetExitCodeProcess",
  778. "kernel32.dll.GetPrivateProfileStringW",
  779. "kernel32.dll.WritePrivateProfileStringW",
  780. "kernel32.dll.GetPrivateProfileSectionW",
  781. "kernel32.dll.WritePrivateProfileSectionW",
  782. "kernel32.dll.GetPrivateProfileSectionNamesW",
  783. "kernel32.dll.FileTimeToLocalFileTime",
  784. "kernel32.dll.FileTimeToSystemTime",
  785. "kernel32.dll.SystemTimeToFileTime",
  786. "kernel32.dll.LocalFileTimeToFileTime",
  787. "kernel32.dll.GetDriveTypeW",
  788. "kernel32.dll.GetDiskFreeSpaceExW",
  789. "kernel32.dll.GetDiskFreeSpaceW",
  790. "kernel32.dll.GetVolumeInformationW",
  791. "kernel32.dll.SetVolumeLabelW",
  792. "kernel32.dll.CreateHardLinkW",
  793. "kernel32.dll.SetFileAttributesW",
  794. "kernel32.dll.CreateEventW",
  795. "kernel32.dll.SetEvent",
  796. "kernel32.dll.GetEnvironmentVariableW",
  797. "kernel32.dll.SetEnvironmentVariableW",
  798. "kernel32.dll.GlobalLock",
  799. "kernel32.dll.GlobalUnlock",
  800. "kernel32.dll.GlobalAlloc",
  801. "kernel32.dll.GetFileSize",
  802. "kernel32.dll.GlobalFree",
  803. "kernel32.dll.GlobalMemoryStatusEx",
  804. "kernel32.dll.Beep",
  805. "kernel32.dll.GetSystemDirectoryW",
  806. "kernel32.dll.HeapReAlloc",
  807. "kernel32.dll.HeapSize",
  808. "kernel32.dll.GetComputerNameW",
  809. "kernel32.dll.GetWindowsDirectoryW",
  810. "kernel32.dll.GetCurrentProcessId",
  811. "kernel32.dll.GetProcessIoCounters",
  812. "kernel32.dll.CreateProcessW",
  813. "kernel32.dll.GetProcessId",
  814. "kernel32.dll.SetPriorityClass",
  815. "kernel32.dll.LoadLibraryW",
  816. "kernel32.dll.VirtualAlloc",
  817. "kernel32.dll.IsDebuggerPresent",
  818. "kernel32.dll.GetCurrentDirectoryW",
  819. "kernel32.dll.lstrcmpiW",
  820. "kernel32.dll.GetLastError",
  821. "kernel32.dll.RaiseException",
  822. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  823. "kernel32.dll.DeleteCriticalSection",
  824. "kernel32.dll.InterlockedDecrement",
  825. "kernel32.dll.InterlockedIncrement",
  826. "kernel32.dll.GetCurrentThread",
  827. "kernel32.dll.CloseHandle",
  828. "kernel32.dll.GetFullPathNameW",
  829. "kernel32.dll.ExitProcess",
  830. "kernel32.dll.GetModuleHandleExW",
  831. "kernel32.dll.ExitThread",
  832. "kernel32.dll.GetSystemTimeAsFileTime",
  833. "kernel32.dll.ResumeThread",
  834. "kernel32.dll.GetCommandLineW",
  835. "kernel32.dll.IsProcessorFeaturePresent",
  836. "kernel32.dll.IsValidCodePage",
  837. "kernel32.dll.GetACP",
  838. "kernel32.dll.GetOEMCP",
  839. "kernel32.dll.GetCPInfo",
  840. "kernel32.dll.SetLastError",
  841. "kernel32.dll.UnhandledExceptionFilter",
  842. "kernel32.dll.SetUnhandledExceptionFilter",
  843. "kernel32.dll.TlsAlloc",
  844. "kernel32.dll.TlsGetValue",
  845. "kernel32.dll.TlsSetValue",
  846. "kernel32.dll.TlsFree",
  847. "kernel32.dll.GetStartupInfoW",
  848. "kernel32.dll.GetStringTypeW",
  849. "kernel32.dll.SetStdHandle",
  850. "kernel32.dll.GetFileType",
  851. "kernel32.dll.GetConsoleCP",
  852. "kernel32.dll.GetConsoleMode",
  853. "kernel32.dll.RtlUnwind",
  854. "kernel32.dll.ReadConsoleW",
  855. "kernel32.dll.GetTimeZoneInformation",
  856. "kernel32.dll.GetDateFormatW",
  857. "kernel32.dll.GetTimeFormatW",
  858. "kernel32.dll.LCMapStringW",
  859. "kernel32.dll.GetEnvironmentStringsW",
  860. "kernel32.dll.FreeEnvironmentStringsW",
  861. "kernel32.dll.WriteConsoleW",
  862. "kernel32.dll.FindClose",
  863. "kernel32.dll.SetEnvironmentVariableA",
  864. "advapi32.dll.GetAce",
  865. "advapi32.dll.RegEnumValueW",
  866. "advapi32.dll.RegDeleteValueW",
  867. "advapi32.dll.RegDeleteKeyW",
  868. "advapi32.dll.RegEnumKeyExW",
  869. "advapi32.dll.RegSetValueExW",
  870. "advapi32.dll.RegOpenKeyExW",
  871. "advapi32.dll.RegCloseKey",
  872. "advapi32.dll.RegQueryValueExW",
  873. "advapi32.dll.RegConnectRegistryW",
  874. "advapi32.dll.InitializeSecurityDescriptor",
  875. "advapi32.dll.InitializeAcl",
  876. "advapi32.dll.AdjustTokenPrivileges",
  877. "advapi32.dll.OpenThreadToken",
  878. "advapi32.dll.OpenProcessToken",
  879. "advapi32.dll.LookupPrivilegeValueW",
  880. "advapi32.dll.DuplicateTokenEx",
  881. "advapi32.dll.CreateProcessAsUserW",
  882. "advapi32.dll.CreateProcessWithLogonW",
  883. "advapi32.dll.GetLengthSid",
  884. "advapi32.dll.CopySid",
  885. "advapi32.dll.LogonUserW",
  886. "advapi32.dll.AllocateAndInitializeSid",
  887. "advapi32.dll.CheckTokenMembership",
  888. "advapi32.dll.RegCreateKeyExW",
  889. "advapi32.dll.FreeSid",
  890. "advapi32.dll.GetTokenInformation",
  891. "advapi32.dll.GetSecurityDescriptorDacl",
  892. "advapi32.dll.GetAclInformation",
  893. "advapi32.dll.AddAce",
  894. "advapi32.dll.SetSecurityDescriptorDacl",
  895. "advapi32.dll.GetUserNameW",
  896. "advapi32.dll.InitiateSystemShutdownExW",
  897. "comctl32.dll.ImageList_ReplaceIcon",
  898. "comctl32.dll.ImageList_Destroy",
  899. "comctl32.dll.ImageList_Remove",
  900. "comctl32.dll.ImageList_SetDragCursorImage",
  901. "comctl32.dll.ImageList_BeginDrag",
  902. "comctl32.dll.ImageList_DragEnter",
  903. "comctl32.dll.ImageList_DragLeave",
  904. "comctl32.dll.ImageList_EndDrag",
  905. "comctl32.dll.ImageList_DragMove",
  906. "comctl32.dll.InitCommonControlsEx",
  907. "comctl32.dll.ImageList_Create",
  908. "comdlg32.dll.GetOpenFileNameW",
  909. "comdlg32.dll.GetSaveFileNameW",
  910. "gdi32.dll.StrokePath",
  911. "gdi32.dll.DeleteObject",
  912. "gdi32.dll.GetTextExtentPoint32W",
  913. "gdi32.dll.ExtCreatePen",
  914. "gdi32.dll.GetDeviceCaps",
  915. "gdi32.dll.EndPath",
  916. "gdi32.dll.SetPixel",
  917. "gdi32.dll.CloseFigure",
  918. "gdi32.dll.CreateCompatibleBitmap",
  919. "gdi32.dll.CreateCompatibleDC",
  920. "gdi32.dll.SelectObject",
  921. "gdi32.dll.StretchBlt",
  922. "gdi32.dll.GetDIBits",
  923. "gdi32.dll.LineTo",
  924. "gdi32.dll.AngleArc",
  925. "gdi32.dll.MoveToEx",
  926. "gdi32.dll.Ellipse",
  927. "gdi32.dll.DeleteDC",
  928. "gdi32.dll.GetPixel",
  929. "gdi32.dll.CreateDCW",
  930. "gdi32.dll.GetStockObject",
  931. "gdi32.dll.GetTextFaceW",
  932. "gdi32.dll.CreateFontW",
  933. "gdi32.dll.SetTextColor",
  934. "gdi32.dll.PolyDraw",
  935. "gdi32.dll.BeginPath",
  936. "gdi32.dll.Rectangle",
  937. "gdi32.dll.SetViewportOrgEx",
  938. "gdi32.dll.GetObjectW",
  939. "gdi32.dll.SetBkMode",
  940. "gdi32.dll.RoundRect",
  941. "gdi32.dll.SetBkColor",
  942. "gdi32.dll.CreatePen",
  943. "gdi32.dll.CreateSolidBrush",
  944. "gdi32.dll.StrokeAndFillPath",
  945. "iphlpapi.dll.IcmpCreateFile",
  946. "iphlpapi.dll.IcmpCloseHandle",
  947. "iphlpapi.dll.IcmpSendEcho",
  948. "mpr.dll.WNetUseConnectionW",
  949. "mpr.dll.WNetCancelConnection2W",
  950. "mpr.dll.WNetGetConnectionW",
  951. "mpr.dll.WNetAddConnection2W",
  952. "ole32.dll.CoTaskMemAlloc",
  953. "ole32.dll.CoTaskMemFree",
  954. "ole32.dll.CLSIDFromString",
  955. "ole32.dll.ProgIDFromCLSID",
  956. "ole32.dll.CLSIDFromProgID",
  957. "ole32.dll.OleSetMenuDescriptor",
  958. "ole32.dll.MkParseDisplayName",
  959. "ole32.dll.OleSetContainedObject",
  960. "ole32.dll.CoCreateInstance",
  961. "ole32.dll.IIDFromString",
  962. "ole32.dll.StringFromGUID2",
  963. "ole32.dll.CreateStreamOnHGlobal",
  964. "ole32.dll.OleInitialize",
  965. "ole32.dll.OleUninitialize",
  966. "ole32.dll.CoInitialize",
  967. "ole32.dll.CoUninitialize",
  968. "ole32.dll.GetRunningObjectTable",
  969. "ole32.dll.CoGetInstanceFromFile",
  970. "ole32.dll.CoGetObject",
  971. "ole32.dll.CoSetProxyBlanket",
  972. "ole32.dll.CoCreateInstanceEx",
  973. "ole32.dll.CoInitializeSecurity",
  974. "oleaut32.dll.#183",
  975. "oleaut32.dll.#11",
  976. "oleaut32.dll.#3",
  977. "oleaut32.dll.#6",
  978. "oleaut32.dll.#38",
  979. "oleaut32.dll.#39",
  980. "oleaut32.dll.#24",
  981. "oleaut32.dll.#23",
  982. "oleaut32.dll.#37",
  983. "oleaut32.dll.#41",
  984. "oleaut32.dll.#411",
  985. "oleaut32.dll.#163",
  986. "oleaut32.dll.#32",
  987. "oleaut32.dll.#146",
  988. "oleaut32.dll.#12",
  989. "oleaut32.dll.#7",
  990. "oleaut32.dll.#185",
  991. "oleaut32.dll.#220",
  992. "oleaut32.dll.#77",
  993. "oleaut32.dll.#10",
  994. "oleaut32.dll.#9",
  995. "oleaut32.dll.#418",
  996. "oleaut32.dll.#164",
  997. "oleaut32.dll.#442",
  998. "oleaut32.dll.#443",
  999. "oleaut32.dll.#186",
  1000. "oleaut32.dll.#31",
  1001. "oleaut32.dll.#2",
  1002. "oleaut32.dll.#8",
  1003. "psapi.dll.GetProcessMemoryInfo",
  1004. "shell32.dll.DragQueryPoint",
  1005. "shell32.dll.ShellExecuteExW",
  1006. "shell32.dll.DragQueryFileW",
  1007. "shell32.dll.SHEmptyRecycleBinW",
  1008. "shell32.dll.SHGetPathFromIDListW",
  1009. "shell32.dll.SHBrowseForFolderW",
  1010. "shell32.dll.SHCreateShellItem",
  1011. "shell32.dll.SHGetDesktopFolder",
  1012. "shell32.dll.SHGetSpecialFolderLocation",
  1013. "shell32.dll.SHGetFolderPathW",
  1014. "shell32.dll.SHFileOperationW",
  1015. "shell32.dll.ExtractIconExW",
  1016. "shell32.dll.Shell_NotifyIconW",
  1017. "shell32.dll.ShellExecuteW",
  1018. "shell32.dll.DragFinish",
  1019. "user32.dll.AdjustWindowRectEx",
  1020. "user32.dll.CopyImage",
  1021. "user32.dll.SetWindowPos",
  1022. "user32.dll.GetCursorInfo",
  1023. "user32.dll.RegisterHotKey",
  1024. "user32.dll.ClientToScreen",
  1025. "user32.dll.GetKeyboardLayoutNameW",
  1026. "user32.dll.IsCharAlphaW",
  1027. "user32.dll.IsCharAlphaNumericW",
  1028. "user32.dll.IsCharLowerW",
  1029. "user32.dll.IsCharUpperW",
  1030. "user32.dll.GetMenuStringW",
  1031. "user32.dll.GetSubMenu",
  1032. "user32.dll.GetCaretPos",
  1033. "user32.dll.IsZoomed",
  1034. "user32.dll.MonitorFromPoint",
  1035. "user32.dll.GetMonitorInfoW",
  1036. "user32.dll.SetWindowLongW",
  1037. "user32.dll.SetLayeredWindowAttributes",
  1038. "user32.dll.FlashWindow",
  1039. "user32.dll.GetClassLongW",
  1040. "user32.dll.TranslateAcceleratorW",
  1041. "user32.dll.IsDialogMessageW",
  1042. "user32.dll.GetSysColor",
  1043. "user32.dll.InflateRect",
  1044. "user32.dll.DrawFocusRect",
  1045. "user32.dll.DrawTextW",
  1046. "user32.dll.FrameRect",
  1047. "user32.dll.DrawFrameControl",
  1048. "user32.dll.FillRect",
  1049. "user32.dll.PtInRect",
  1050. "user32.dll.DestroyAcceleratorTable",
  1051. "user32.dll.CreateAcceleratorTableW",
  1052. "user32.dll.SetCursor",
  1053. "user32.dll.GetWindowDC",
  1054. "user32.dll.GetSystemMetrics",
  1055. "user32.dll.GetActiveWindow",
  1056. "user32.dll.CharNextW",
  1057. "user32.dll.wsprintfW",
  1058. "user32.dll.RedrawWindow",
  1059. "user32.dll.DrawMenuBar",
  1060. "user32.dll.DestroyMenu",
  1061. "user32.dll.SetMenu",
  1062. "user32.dll.GetWindowTextLengthW",
  1063. "user32.dll.CreateMenu",
  1064. "user32.dll.IsDlgButtonChecked",
  1065. "user32.dll.DefDlgProcW",
  1066. "user32.dll.CallWindowProcW",
  1067. "user32.dll.ReleaseCapture",
  1068. "user32.dll.SetCapture",
  1069. "user32.dll.CreateIconFromResourceEx",
  1070. "user32.dll.mouse_event",
  1071. "user32.dll.ExitWindowsEx",
  1072. "user32.dll.SetActiveWindow",
  1073. "user32.dll.FindWindowExW",
  1074. "user32.dll.EnumThreadWindows",
  1075. "user32.dll.SetMenuDefaultItem",
  1076. "user32.dll.InsertMenuItemW",
  1077. "user32.dll.IsMenu",
  1078. "user32.dll.TrackPopupMenuEx",
  1079. "user32.dll.GetCursorPos",
  1080. "user32.dll.DeleteMenu",
  1081. "user32.dll.SetRect",
  1082. "user32.dll.GetMenuItemID",
  1083. "user32.dll.GetMenuItemCount",
  1084. "user32.dll.SetMenuItemInfoW",
  1085. "user32.dll.GetMenuItemInfoW",
  1086. "user32.dll.SetForegroundWindow",
  1087. "user32.dll.IsIconic",
  1088. "user32.dll.FindWindowW",
  1089. "user32.dll.MonitorFromRect",
  1090. "user32.dll.keybd_event",
  1091. "user32.dll.SendInput",
  1092. "user32.dll.GetAsyncKeyState",
  1093. "user32.dll.SetKeyboardState",
  1094. "user32.dll.GetKeyboardState",
  1095. "user32.dll.GetKeyState",
  1096. "user32.dll.VkKeyScanW",
  1097. "user32.dll.LoadStringW",
  1098. "user32.dll.DialogBoxParamW",
  1099. "user32.dll.MessageBeep",
  1100. "user32.dll.EndDialog",
  1101. "user32.dll.SendDlgItemMessageW",
  1102. "user32.dll.GetDlgItem",
  1103. "user32.dll.SetWindowTextW",
  1104. "user32.dll.CopyRect",
  1105. "user32.dll.ReleaseDC",
  1106. "user32.dll.GetDC",
  1107. "user32.dll.EndPaint",
  1108. "user32.dll.BeginPaint",
  1109. "user32.dll.GetClientRect",
  1110. "user32.dll.GetMenu",
  1111. "user32.dll.DestroyWindow",
  1112. "user32.dll.EnumWindows",
  1113. "user32.dll.GetDesktopWindow",
  1114. "user32.dll.IsWindow",
  1115. "user32.dll.IsWindowEnabled",
  1116. "user32.dll.IsWindowVisible",
  1117. "user32.dll.EnableWindow",
  1118. "user32.dll.InvalidateRect",
  1119. "user32.dll.GetWindowLongW",
  1120. "user32.dll.GetWindowThreadProcessId",
  1121. "user32.dll.AttachThreadInput",
  1122. "user32.dll.GetFocus",
  1123. "user32.dll.GetWindowTextW",
  1124. "user32.dll.ScreenToClient",
  1125. "user32.dll.SendMessageTimeoutW",
  1126. "user32.dll.EnumChildWindows",
  1127. "user32.dll.CharUpperBuffW",
  1128. "user32.dll.GetParent",
  1129. "user32.dll.GetDlgCtrlID",
  1130. "user32.dll.SendMessageW",
  1131. "user32.dll.MapVirtualKeyW",
  1132. "user32.dll.PostMessageW",
  1133. "user32.dll.GetWindowRect",
  1134. "user32.dll.SetUserObjectSecurity",
  1135. "user32.dll.CloseDesktop",
  1136. "user32.dll.CloseWindowStation",
  1137. "user32.dll.OpenDesktopW",
  1138. "user32.dll.SetProcessWindowStation",
  1139. "user32.dll.GetProcessWindowStation",
  1140. "user32.dll.OpenWindowStationW",
  1141. "user32.dll.GetUserObjectSecurity",
  1142. "user32.dll.MessageBoxW",
  1143. "user32.dll.DefWindowProcW",
  1144. "user32.dll.SetClipboardData",
  1145. "user32.dll.EmptyClipboard",
  1146. "user32.dll.CountClipboardFormats",
  1147. "user32.dll.CloseClipboard",
  1148. "user32.dll.GetClipboardData",
  1149. "user32.dll.IsClipboardFormatAvailable",
  1150. "user32.dll.OpenClipboard",
  1151. "user32.dll.BlockInput",
  1152. "user32.dll.GetMessageW",
  1153. "user32.dll.LockWindowUpdate",
  1154. "user32.dll.DispatchMessageW",
  1155. "user32.dll.TranslateMessage",
  1156. "user32.dll.PeekMessageW",
  1157. "user32.dll.UnregisterHotKey",
  1158. "user32.dll.CheckMenuRadioItem",
  1159. "user32.dll.CharLowerBuffW",
  1160. "user32.dll.MoveWindow",
  1161. "user32.dll.SetFocus",
  1162. "user32.dll.PostQuitMessage",
  1163. "user32.dll.KillTimer",
  1164. "user32.dll.CreatePopupMenu",
  1165. "user32.dll.RegisterWindowMessageW",
  1166. "user32.dll.SetTimer",
  1167. "user32.dll.ShowWindow",
  1168. "user32.dll.CreateWindowExW",
  1169. "user32.dll.RegisterClassExW",
  1170. "user32.dll.LoadIconW",
  1171. "user32.dll.LoadCursorW",
  1172. "user32.dll.GetSysColorBrush",
  1173. "user32.dll.GetForegroundWindow",
  1174. "user32.dll.MessageBoxA",
  1175. "user32.dll.DestroyIcon",
  1176. "user32.dll.SystemParametersInfoW",
  1177. "user32.dll.LoadImageW",
  1178. "user32.dll.GetClassNameW",
  1179. "userenv.dll.DestroyEnvironmentBlock",
  1180. "userenv.dll.UnloadUserProfile",
  1181. "userenv.dll.CreateEnvironmentBlock",
  1182. "userenv.dll.LoadUserProfileW",
  1183. "uxtheme.dll.IsThemeActive",
  1184. "version.dll.GetFileVersionInfoW",
  1185. "version.dll.GetFileVersionInfoSizeW",
  1186. "version.dll.VerQueryValueW",
  1187. "wininet.dll.InternetQueryDataAvailable",
  1188. "wininet.dll.InternetCloseHandle",
  1189. "wininet.dll.InternetOpenW",
  1190. "wininet.dll.InternetSetOptionW",
  1191. "wininet.dll.InternetCrackUrlW",
  1192. "wininet.dll.HttpQueryInfoW",
  1193. "wininet.dll.InternetQueryOptionW",
  1194. "wininet.dll.HttpOpenRequestW",
  1195. "wininet.dll.HttpSendRequestW",
  1196. "wininet.dll.FtpOpenFileW",
  1197. "wininet.dll.FtpGetFileSize",
  1198. "wininet.dll.InternetOpenUrlW",
  1199. "wininet.dll.InternetReadFile",
  1200. "wininet.dll.InternetConnectW",
  1201. "winmm.dll.timeGetTime",
  1202. "winmm.dll.waveOutSetVolume",
  1203. "winmm.dll.mciSendStringW",
  1204. "wsock32.dll.#116",
  1205. "wsock32.dll.#23",
  1206. "wsock32.dll.#12",
  1207. "wsock32.dll.#21",
  1208. "wsock32.dll.#15",
  1209. "wsock32.dll.#17",
  1210. "wsock32.dll.#10",
  1211. "wsock32.dll.#9",
  1212. "wsock32.dll.#115",
  1213. "wsock32.dll.#151",
  1214. "wsock32.dll.#18",
  1215. "wsock32.dll.#1",
  1216. "wsock32.dll.#13",
  1217. "wsock32.dll.#2",
  1218. "wsock32.dll.#3",
  1219. "wsock32.dll.#111",
  1220. "wsock32.dll.#16",
  1221. "wsock32.dll.#20",
  1222. "wsock32.dll.#19",
  1223. "wsock32.dll.#11",
  1224. "wsock32.dll.#52",
  1225. "wsock32.dll.#57",
  1226. "wsock32.dll.#4",
  1227. "kernel32.dll.FlsAlloc",
  1228. "kernel32.dll.FlsFree",
  1229. "kernel32.dll.FlsGetValue",
  1230. "kernel32.dll.FlsSetValue",
  1231. "kernel32.dll.InitializeCriticalSectionEx",
  1232. "kernel32.dll.CreateEventExW",
  1233. "kernel32.dll.CreateSemaphoreExW",
  1234. "kernel32.dll.SetThreadStackGuarantee",
  1235. "kernel32.dll.CreateThreadpoolTimer",
  1236. "kernel32.dll.SetThreadpoolTimer",
  1237. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1238. "kernel32.dll.CloseThreadpoolTimer",
  1239. "kernel32.dll.CreateThreadpoolWait",
  1240. "kernel32.dll.SetThreadpoolWait",
  1241. "kernel32.dll.CloseThreadpoolWait",
  1242. "kernel32.dll.FlushProcessWriteBuffers",
  1243. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1244. "kernel32.dll.GetCurrentProcessorNumber",
  1245. "kernel32.dll.GetLogicalProcessorInformation",
  1246. "kernel32.dll.CreateSymbolicLinkW",
  1247. "kernel32.dll.EnumSystemLocalesEx",
  1248. "kernel32.dll.CompareStringEx",
  1249. "kernel32.dll.GetDateFormatEx",
  1250. "kernel32.dll.GetLocaleInfoEx",
  1251. "kernel32.dll.GetTimeFormatEx",
  1252. "kernel32.dll.GetUserDefaultLocaleName",
  1253. "kernel32.dll.IsValidLocaleName",
  1254. "kernel32.dll.LCMapStringEx",
  1255. "kernel32.dll.GetTickCount64",
  1256. "kernel32.dll.GetNativeSystemInfo",
  1257. "cryptbase.dll.SystemFunction036",
  1258. "uxtheme.dll.ThemeInitApiHook",
  1259. "user32.dll.IsProcessDPIAware",
  1260. "kernel32.dll.Wow64DisableWow64FsRedirection",
  1261. "kernel32.dll.Wow64RevertWow64FsRedirection",
  1262. "dwmapi.dll.DwmIsCompositionEnabled",
  1263. "comctl32.dll.RegisterClassNameW",
  1264. "kernel32.dll.SortGetHandle",
  1265. "kernel32.dll.SortCloseHandle",
  1266. "uxtheme.dll.OpenThemeData",
  1267. "uxtheme.dll.GetThemeBool",
  1268. "imm32.dll.ImmGetContext",
  1269. "imm32.dll.ImmReleaseContext",
  1270. "imm32.dll.ImmAssociateContext",
  1271. "imm32.dll.ImmIsIME",
  1272. "comctl32.dll.HIMAGELIST_QueryInterface",
  1273. "comctl32.dll.DrawShadowText",
  1274. "comctl32.dll.DrawSizeBox",
  1275. "comctl32.dll.DrawScrollBar",
  1276. "comctl32.dll.SizeBoxHwnd",
  1277. "comctl32.dll.ScrollBar_MouseMove",
  1278. "comctl32.dll.ScrollBar_Menu",
  1279. "comctl32.dll.HandleScrollCmd",
  1280. "comctl32.dll.DetachScrollBars",
  1281. "comctl32.dll.AttachScrollBars",
  1282. "comctl32.dll.CCSetScrollInfo",
  1283. "comctl32.dll.CCGetScrollInfo",
  1284. "comctl32.dll.CCEnableScrollBar",
  1285. "comctl32.dll.QuerySystemGestureStatus",
  1286. "uxtheme.dll.#49",
  1287. "shell32.dll.#66",
  1288. "oleaut32.dll.#162",
  1289. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  1290. "advapi32.dll.RegOpenKeyW",
  1291. "advapi32.dll.RegQueryValueW",
  1292. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  1293. "oleaut32.dll.#201",
  1294. "advapi32.dll.CryptAcquireContextA",
  1295. "cryptsp.dll.CryptAcquireContextA",
  1296. "advapi32.dll.CryptCreateHash",
  1297. "cryptsp.dll.CryptCreateHash",
  1298. "advapi32.dll.CryptHashData",
  1299. "cryptsp.dll.CryptHashData",
  1300. "advapi32.dll.CryptDeriveKey",
  1301. "cryptsp.dll.CryptDeriveKey",
  1302. "advapi32.dll.CryptDestroyHash",
  1303. "cryptsp.dll.CryptDestroyHash",
  1304. "advapi32.dll.CryptDecrypt",
  1305. "cryptsp.dll.CryptDecrypt",
  1306. "advapi32.dll.CryptDestroyKey",
  1307. "cryptsp.dll.CryptDestroyKey",
  1308. "advapi32.dll.CryptReleaseContext",
  1309. "cryptsp.dll.CryptReleaseContext",
  1310. "ntdll.dll.RtlDecompressBuffer",
  1311. "advapi32.dll.SetKernelObjectSecurity",
  1312. "uxtheme.dll.CloseThemeData",
  1313. "oleaut32.dll.#500",
  1314. "advapi32.dll.RegQueryInfoKeyW",
  1315. "kernel32.dll.QueryActCtxW",
  1316. "shlwapi.dll.UrlIsW",
  1317. "msvcrt.dll._set_error_mode",
  1318. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  1319. "kernel32.dll.FindActCtxSectionStringW",
  1320. "kernel32.dll.GetSystemWindowsDirectoryW",
  1321. "mscoree.dll.GetProcessExecutableHeap",
  1322. "mscorwks.dll._CorExeMain",
  1323. "mscorwks.dll.GetCLRFunction",
  1324. "advapi32.dll.RegisterTraceGuidsW",
  1325. "advapi32.dll.UnregisterTraceGuids",
  1326. "advapi32.dll.GetTraceLoggerHandle",
  1327. "advapi32.dll.GetTraceEnableLevel",
  1328. "advapi32.dll.GetTraceEnableFlags",
  1329. "advapi32.dll.TraceEvent",
  1330. "mscoree.dll.IEE",
  1331. "mscorwks.dll.IEE",
  1332. "mscoree.dll.GetStartupFlags",
  1333. "mscoree.dll.GetHostConfigurationFile",
  1334. "mscoree.dll.GetCORSystemDirectory",
  1335. "ntdll.dll.RtlUnwind",
  1336. "advapi32.dll.AddAccessAllowedAce",
  1337. "kernel32.dll.AddVectoredContinueHandler",
  1338. "kernel32.dll.RemoveVectoredContinueHandler",
  1339. "advapi32.dll.ConvertSidToStringSidW",
  1340. "kernel32.dll.GetWriteWatch",
  1341. "kernel32.dll.ResetWriteWatch",
  1342. "kernel32.dll.CreateMemoryResourceNotification",
  1343. "kernel32.dll.QueryMemoryResourceNotification",
  1344. "ole32.dll.CoInitializeEx",
  1345. "ole32.dll.CoGetContextToken",
  1346. "advapi32.dll.CryptGetHashParam",
  1347. "advapi32.dll.CryptImportKey",
  1348. "advapi32.dll.CryptExportKey",
  1349. "advapi32.dll.CryptGenKey",
  1350. "advapi32.dll.CryptGetKeyParam",
  1351. "advapi32.dll.CryptVerifySignatureA",
  1352. "advapi32.dll.CryptSignHashA",
  1353. "advapi32.dll.CryptGetProvParam",
  1354. "advapi32.dll.CryptGetUserKey",
  1355. "advapi32.dll.CryptEnumProvidersA",
  1356. "mscoree.dll.GetMetaDataInternalInterface",
  1357. "mscorwks.dll.GetMetaDataInternalInterface",
  1358. "cryptsp.dll.CryptImportKey",
  1359. "cryptsp.dll.CryptVerifySignatureA",
  1360. "mscorjit.dll.getJit",
  1361. "kernel32.dll.SwitchToThread",
  1362. "kernel32.dll.EnumResourceTypesW",
  1363. "kernel32.dll.lstrlen",
  1364. "kernel32.dll.RtlMoveMemory",
  1365. "kernel32.dll.GetUserDefaultUILanguage",
  1366. "cryptsp.dll.CryptAcquireContextW",
  1367. "bcrypt.dll.BCryptGetFipsAlgorithmMode",
  1368. "cryptsp.dll.CryptGenRandom",
  1369. "cryptsp.dll.CryptGetHashParam",
  1370. "kernel32.dll.ReleaseMutex",
  1371. "kernel32.dll.CreateMutexW",
  1372. "ole32.dll.CoWaitForMultipleHandles",
  1373. "sechost.dll.LookupAccountNameLocalW",
  1374. "ole32.dll.CoGetClassObject",
  1375. "advapi32.dll.LookupAccountSidW",
  1376. "sechost.dll.LookupAccountSidLocalW",
  1377. "ole32.dll.CoCreateFreeThreadedMarshaler",
  1378. "ole32.dll.CoGetObjectContext",
  1379. "ole32.dll.NdrOleInitializeExtension",
  1380. "ole32.dll.CoGetMarshalSizeMax",
  1381. "ole32.dll.CoMarshalInterface",
  1382. "ole32.dll.CoUnmarshalInterface",
  1383. "ole32.dll.StringFromIID",
  1384. "ole32.dll.CoGetPSClsid",
  1385. "ole32.dll.CoReleaseMarshalData",
  1386. "ole32.dll.DcomChannelSetHResult",
  1387. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1388. "wminet_utils.dll.ResetSecurity",
  1389. "wminet_utils.dll.SetSecurity",
  1390. "wminet_utils.dll.BlessIWbemServices",
  1391. "wminet_utils.dll.BlessIWbemServicesObject",
  1392. "wminet_utils.dll.GetPropertyHandle",
  1393. "wminet_utils.dll.WritePropertyValue",
  1394. "wminet_utils.dll.Clone",
  1395. "wminet_utils.dll.VerifyClientKey",
  1396. "wminet_utils.dll.GetQualifierSet",
  1397. "wminet_utils.dll.Get",
  1398. "wminet_utils.dll.Put",
  1399. "wminet_utils.dll.Delete",
  1400. "wminet_utils.dll.GetNames",
  1401. "wminet_utils.dll.BeginEnumeration",
  1402. "wminet_utils.dll.Next",
  1403. "wminet_utils.dll.EndEnumeration",
  1404. "wminet_utils.dll.GetPropertyQualifierSet",
  1405. "wminet_utils.dll.GetObjectText",
  1406. "wminet_utils.dll.SpawnDerivedClass",
  1407. "wminet_utils.dll.SpawnInstance",
  1408. "wminet_utils.dll.CompareTo",
  1409. "wminet_utils.dll.GetPropertyOrigin",
  1410. "wminet_utils.dll.InheritsFrom",
  1411. "wminet_utils.dll.GetMethod",
  1412. "wminet_utils.dll.PutMethod",
  1413. "wminet_utils.dll.DeleteMethod",
  1414. "wminet_utils.dll.BeginMethodEnumeration",
  1415. "wminet_utils.dll.NextMethod",
  1416. "wminet_utils.dll.EndMethodEnumeration",
  1417. "wminet_utils.dll.GetMethodQualifierSet",
  1418. "wminet_utils.dll.GetMethodOrigin",
  1419. "wminet_utils.dll.QualifierSet_Get",
  1420. "wminet_utils.dll.QualifierSet_Put",
  1421. "wminet_utils.dll.QualifierSet_Delete",
  1422. "wminet_utils.dll.QualifierSet_GetNames",
  1423. "wminet_utils.dll.QualifierSet_BeginEnumeration",
  1424. "wminet_utils.dll.QualifierSet_Next",
  1425. "wminet_utils.dll.QualifierSet_EndEnumeration",
  1426. "wminet_utils.dll.GetCurrentApartmentType",
  1427. "wminet_utils.dll.GetDemultiplexedStub",
  1428. "wminet_utils.dll.CreateInstanceEnumWmi",
  1429. "wminet_utils.dll.CreateClassEnumWmi",
  1430. "wminet_utils.dll.ExecQueryWmi",
  1431. "wminet_utils.dll.ExecNotificationQueryWmi",
  1432. "wminet_utils.dll.PutInstanceWmi",
  1433. "wminet_utils.dll.PutClassWmi",
  1434. "wminet_utils.dll.CloneEnumWbemClassObject",
  1435. "wminet_utils.dll.ConnectServerWmi",
  1436. "kernel32.dll.GetThreadPreferredUILanguages",
  1437. "kernel32.dll.SetThreadPreferredUILanguages",
  1438. "kernel32.dll.LocaleNameToLCID",
  1439. "kernel32.dll.LCIDToLocaleName",
  1440. "kernel32.dll.GetSystemDefaultLocaleName",
  1441. "oleaut32.dll.SysStringLen",
  1442. "kernel32.dll.RtlZeroMemory",
  1443. "oleaut32.dll.#283",
  1444. "oleaut32.dll.#284",
  1445. "oleaut32.dll.GetErrorInfo",
  1446. "oleaut32.dll.#149",
  1447. "kernel32.dll.GetFileAttributesExW",
  1448. "vssapi.dll.CreateWriter",
  1449. "advapi32.dll.LookupAccountNameW",
  1450. "samcli.dll.NetLocalGroupGetMembers",
  1451. "samlib.dll.SamConnect",
  1452. "rpcrt4.dll.NdrClientCall3",
  1453. "rpcrt4.dll.RpcStringBindingComposeW",
  1454. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1455. "rpcrt4.dll.RpcStringFreeW",
  1456. "rpcrt4.dll.RpcBindingFree",
  1457. "samlib.dll.SamOpenDomain",
  1458. "samlib.dll.SamLookupNamesInDomain",
  1459. "samlib.dll.SamOpenAlias",
  1460. "samlib.dll.SamFreeMemory",
  1461. "samlib.dll.SamCloseHandle",
  1462. "samlib.dll.SamGetMembersInAlias",
  1463. "netutils.dll.NetApiBufferFree",
  1464. "samlib.dll.SamEnumerateDomainsInSamServer",
  1465. "samlib.dll.SamLookupDomainInSamServer",
  1466. "ole32.dll.CoCreateGuid",
  1467. "ole32.dll.StringFromCLSID",
  1468. "oleaut32.dll.#4",
  1469. "propsys.dll.VariantToPropVariant",
  1470. "wbemcore.dll.Reinitialize",
  1471. "wbemsvc.dll.DllGetClassObject",
  1472. "wbemsvc.dll.DllCanUnloadNow",
  1473. "authz.dll.AuthzInitializeContextFromToken",
  1474. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  1475. "authz.dll.AuthzAccessCheck",
  1476. "authz.dll.AuthzFreeAuditEvent",
  1477. "authz.dll.AuthzFreeContext",
  1478. "authz.dll.AuthzInitializeResourceManager",
  1479. "authz.dll.AuthzFreeResourceManager",
  1480. "rpcrt4.dll.RpcBindingCreateW",
  1481. "rpcrt4.dll.RpcBindingBind",
  1482. "rpcrt4.dll.I_RpcMapWin32Status",
  1483. "advapi32.dll.EventRegister",
  1484. "advapi32.dll.EventUnregister",
  1485. "advapi32.dll.EventWrite",
  1486. "kernel32.dll.RegCloseKey",
  1487. "kernel32.dll.RegSetValueExW",
  1488. "kernel32.dll.RegOpenKeyExW",
  1489. "kernel32.dll.RegQueryValueExW",
  1490. "wmisvc.dll.IsImproperShutdownDetected",
  1491. "wevtapi.dll.EvtRender",
  1492. "wevtapi.dll.EvtNext",
  1493. "wevtapi.dll.EvtClose",
  1494. "wevtapi.dll.EvtQuery",
  1495. "wevtapi.dll.EvtCreateRenderContext",
  1496. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1497. "rpcrt4.dll.RpcBindingSetOption",
  1498. "kernelbase.dll.InitializeAcl",
  1499. "kernelbase.dll.AddAce",
  1500. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1501. "kernel32.dll.IsThreadAFiber",
  1502. "kernel32.dll.OpenProcessToken",
  1503. "kernelbase.dll.GetTokenInformation",
  1504. "kernelbase.dll.DuplicateTokenEx",
  1505. "kernelbase.dll.AdjustTokenPrivileges",
  1506. "kernelbase.dll.AllocateAndInitializeSid",
  1507. "kernelbase.dll.CheckTokenMembership",
  1508. "kernel32.dll.SetThreadToken",
  1509. "oleaut32.dll.#285",
  1510. "oleaut32.dll.#286",
  1511. "oleaut32.dll.#17",
  1512. "oleaut32.dll.#20",
  1513. "oleaut32.dll.#19",
  1514. "oleaut32.dll.#25",
  1515. "authz.dll.AuthzInitializeContextFromSid",
  1516. "ole32.dll.CoRevertToSelf",
  1517. "advapi32.dll.LogonUserExExW",
  1518. "sspicli.dll.LogonUserExExW",
  1519. "ole32.dll.CoGetCallContext",
  1520. "ole32.dll.CoImpersonateClient",
  1521. "ole32.dll.CoSwitchCallContext",
  1522. "oleaut32.dll.#287",
  1523. "oleaut32.dll.#288",
  1524. "oleaut32.dll.#289",
  1525. "ntmarta.dll.GetMartaExtensionInterface",
  1526. "fastprox.dll.DllGetClassObject",
  1527. "fastprox.dll.DllCanUnloadNow",
  1528. "oleaut32.dll.#290",
  1529. "wmi.dll.WmiQueryAllDataW",
  1530. "wmi.dll.WmiQuerySingleInstanceW",
  1531. "wmi.dll.WmiSetSingleItemW",
  1532. "wmi.dll.WmiSetSingleInstanceW",
  1533. "wmi.dll.WmiExecuteMethodW",
  1534. "wmi.dll.WmiNotificationRegistrationW",
  1535. "wmi.dll.WmiMofEnumerateResourcesW",
  1536. "wmi.dll.WmiFileHandleToInstanceNameW",
  1537. "wmi.dll.WmiDevInstToInstanceNameW",
  1538. "wmi.dll.WmiQueryGuidInformation",
  1539. "wmi.dll.WmiOpenBlock",
  1540. "wmi.dll.WmiCloseBlock",
  1541. "wmi.dll.WmiFreeBuffer",
  1542. "wmi.dll.WmiEnumerateGuids",
  1543. "iphlpapi.dll.GetAdaptersAddresses",
  1544. "iphlpapi.dll.GetIpForwardTable2",
  1545. "iphlpapi.dll.ConvertLengthToIpv4Mask",
  1546. "iphlpapi.dll.FreeMibTable",
  1547. "advapi32.dll.RegEnumKeyW",
  1548. "iphlpapi.dll.GetAdapterIndex",
  1549. "oleaut32.dll.#15",
  1550. "oleaut32.dll.#26",
  1551. "oleaut32.dll.#16",
  1552. "dnsapi.dll.DnsQueryConfigAllocEx",
  1553. "iphlpapi.dll.GetCurrentThreadCompartmentId",
  1554. "dnsapi.dll.DnsFreeConfigStructure",
  1555. "dnsapi.dll.DnsQueryConfigDword",
  1556. "shell32.dll.SHGetSpecialFolderPathW",
  1557. "advapi32.dll.CredReadA",
  1558. "advapi32.dll.CredFree",
  1559. "advapi32.dll.CredDeleteA",
  1560. "advapi32.dll.CredEnumerateA",
  1561. "advapi32.dll.CredEnumerateW",
  1562. "pstorec.dll.PStoreCreateInstance",
  1563. "vaultcli.dll.VaultOpenVault",
  1564. "vaultcli.dll.VaultCloseVault",
  1565. "vaultcli.dll.VaultEnumerateItems",
  1566. "vaultcli.dll.VaultFree",
  1567. "vaultcli.dll.VaultGetInformation",
  1568. "vaultcli.dll.VaultGetItem",
  1569. "psapi.dll.GetModuleBaseNameW",
  1570. "psapi.dll.EnumProcessModules",
  1571. "psapi.dll.GetModuleFileNameExW",
  1572. "psapi.dll.EnumProcesses",
  1573. "psapi.dll.GetModuleInformation",
  1574. "kernel32.dll.QueryFullProcessImageNameW",
  1575. "kernel32.dll.GetProcessTimes"
  1576. ]
  1577.  
  1578. [*] Static Analysis: {
  1579. "pe": {
  1580. "peid_signatures": null,
  1581. "imports": [
  1582. {
  1583. "imports": [
  1584. {
  1585. "name": "LoadLibraryA",
  1586. "address": "0x63c914"
  1587. },
  1588. {
  1589. "name": "GetProcAddress",
  1590. "address": "0x63c918"
  1591. },
  1592. {
  1593. "name": "VirtualProtect",
  1594. "address": "0x63c91c"
  1595. },
  1596. {
  1597. "name": "VirtualAlloc",
  1598. "address": "0x63c920"
  1599. },
  1600. {
  1601. "name": "VirtualFree",
  1602. "address": "0x63c924"
  1603. },
  1604. {
  1605. "name": "ExitProcess",
  1606. "address": "0x63c928"
  1607. }
  1608. ],
  1609. "dll": "KERNEL32.DLL"
  1610. },
  1611. {
  1612. "imports": [
  1613. {
  1614. "name": "GetAce",
  1615. "address": "0x63c930"
  1616. }
  1617. ],
  1618. "dll": "ADVAPI32.dll"
  1619. },
  1620. {
  1621. "imports": [
  1622. {
  1623. "name": "ImageList_Remove",
  1624. "address": "0x63c938"
  1625. }
  1626. ],
  1627. "dll": "COMCTL32.dll"
  1628. },
  1629. {
  1630. "imports": [
  1631. {
  1632. "name": "GetOpenFileNameW",
  1633. "address": "0x63c940"
  1634. }
  1635. ],
  1636. "dll": "COMDLG32.dll"
  1637. },
  1638. {
  1639. "imports": [
  1640. {
  1641. "name": "LineTo",
  1642. "address": "0x63c948"
  1643. }
  1644. ],
  1645. "dll": "GDI32.dll"
  1646. },
  1647. {
  1648. "imports": [
  1649. {
  1650. "name": "IcmpSendEcho",
  1651. "address": "0x63c950"
  1652. }
  1653. ],
  1654. "dll": "IPHLPAPI.DLL"
  1655. },
  1656. {
  1657. "imports": [
  1658. {
  1659. "name": "WNetUseConnectionW",
  1660. "address": "0x63c958"
  1661. }
  1662. ],
  1663. "dll": "MPR.dll"
  1664. },
  1665. {
  1666. "imports": [
  1667. {
  1668. "name": "CoGetObject",
  1669. "address": "0x63c960"
  1670. }
  1671. ],
  1672. "dll": "ole32.dll"
  1673. },
  1674. {
  1675. "imports": [
  1676. {
  1677. "name": "VariantInit",
  1678. "address": "0x63c968"
  1679. }
  1680. ],
  1681. "dll": "OLEAUT32.dll"
  1682. },
  1683. {
  1684. "imports": [
  1685. {
  1686. "name": "GetProcessMemoryInfo",
  1687. "address": "0x63c970"
  1688. }
  1689. ],
  1690. "dll": "PSAPI.DLL"
  1691. },
  1692. {
  1693. "imports": [
  1694. {
  1695. "name": "DragFinish",
  1696. "address": "0x63c978"
  1697. }
  1698. ],
  1699. "dll": "SHELL32.dll"
  1700. },
  1701. {
  1702. "imports": [
  1703. {
  1704. "name": "GetDC",
  1705. "address": "0x63c980"
  1706. }
  1707. ],
  1708. "dll": "USER32.dll"
  1709. },
  1710. {
  1711. "imports": [
  1712. {
  1713. "name": "LoadUserProfileW",
  1714. "address": "0x63c988"
  1715. }
  1716. ],
  1717. "dll": "USERENV.dll"
  1718. },
  1719. {
  1720. "imports": [
  1721. {
  1722. "name": "IsThemeActive",
  1723. "address": "0x63c990"
  1724. }
  1725. ],
  1726. "dll": "UxTheme.dll"
  1727. },
  1728. {
  1729. "imports": [
  1730. {
  1731. "name": "VerQueryValueW",
  1732. "address": "0x63c998"
  1733. }
  1734. ],
  1735. "dll": "VERSION.dll"
  1736. },
  1737. {
  1738. "imports": [
  1739. {
  1740. "name": "FtpOpenFileW",
  1741. "address": "0x63c9a0"
  1742. }
  1743. ],
  1744. "dll": "WININET.dll"
  1745. },
  1746. {
  1747. "imports": [
  1748. {
  1749. "name": "timeGetTime",
  1750. "address": "0x63c9a8"
  1751. }
  1752. ],
  1753. "dll": "WINMM.dll"
  1754. },
  1755. {
  1756. "imports": [
  1757. {
  1758. "name": "connect",
  1759. "address": "0x63c9b0"
  1760. }
  1761. ],
  1762. "dll": "WSOCK32.dll"
  1763. }
  1764. ],
  1765. "digital_signers": null,
  1766. "exported_dll_name": null,
  1767. "actual_checksum": "0x00109826",
  1768. "overlay": null,
  1769. "imagebase": "0x00400000",
  1770. "reported_checksum": "0x00000000",
  1771. "icon_hash": null,
  1772. "entrypoint": "0x00589980",
  1773. "timestamp": "2019-05-03 22:14:25",
  1774. "osversion": "5.1",
  1775. "sections": [
  1776. {
  1777. "name": "UPX0",
  1778. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1779. "virtual_address": "0x00001000",
  1780. "size_of_data": "0x00000000",
  1781. "entropy": "0.00",
  1782. "raw_address": "0x00000400",
  1783. "virtual_size": "0x00133000",
  1784. "characteristics_raw": "0xe0000080"
  1785. },
  1786. {
  1787. "name": "UPX1",
  1788. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1789. "virtual_address": "0x00134000",
  1790. "size_of_data": "0x00055c00",
  1791. "entropy": "7.94",
  1792. "raw_address": "0x00000400",
  1793. "virtual_size": "0x00056000",
  1794. "characteristics_raw": "0xe0000040"
  1795. },
  1796. {
  1797. "name": ".rsrc",
  1798. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1799. "virtual_address": "0x0018a000",
  1800. "size_of_data": "0x000b2c00",
  1801. "entropy": "7.96",
  1802. "raw_address": "0x00056000",
  1803. "virtual_size": "0x000b3000",
  1804. "characteristics_raw": "0xc0000040"
  1805. }
  1806. ],
  1807. "resources": [],
  1808. "dirents": [
  1809. {
  1810. "virtual_address": "0x00000000",
  1811. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1812. "size": "0x00000000"
  1813. },
  1814. {
  1815. "virtual_address": "0x0023c798",
  1816. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1817. "size": "0x00000424"
  1818. },
  1819. {
  1820. "virtual_address": "0x0018a000",
  1821. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1822. "size": "0x000b2798"
  1823. },
  1824. {
  1825. "virtual_address": "0x00000000",
  1826. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1827. "size": "0x00000000"
  1828. },
  1829. {
  1830. "virtual_address": "0x00000000",
  1831. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1832. "size": "0x00000000"
  1833. },
  1834. {
  1835. "virtual_address": "0x0023cbbc",
  1836. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1837. "size": "0x0000000c"
  1838. },
  1839. {
  1840. "virtual_address": "0x00000000",
  1841. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1842. "size": "0x00000000"
  1843. },
  1844. {
  1845. "virtual_address": "0x00000000",
  1846. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1847. "size": "0x00000000"
  1848. },
  1849. {
  1850. "virtual_address": "0x00000000",
  1851. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1852. "size": "0x00000000"
  1853. },
  1854. {
  1855. "virtual_address": "0x00000000",
  1856. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1857. "size": "0x00000000"
  1858. },
  1859. {
  1860. "virtual_address": "0x00189b64",
  1861. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1862. "size": "0x00000048"
  1863. },
  1864. {
  1865. "virtual_address": "0x00000000",
  1866. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1867. "size": "0x00000000"
  1868. },
  1869. {
  1870. "virtual_address": "0x00000000",
  1871. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1872. "size": "0x00000000"
  1873. },
  1874. {
  1875. "virtual_address": "0x00000000",
  1876. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1877. "size": "0x00000000"
  1878. },
  1879. {
  1880. "virtual_address": "0x00000000",
  1881. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1882. "size": "0x00000000"
  1883. },
  1884. {
  1885. "virtual_address": "0x00000000",
  1886. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1887. "size": "0x00000000"
  1888. }
  1889. ],
  1890. "exports": [],
  1891. "guest_signers": {},
  1892. "imphash": "fc6683d30d9f25244a50fd5357825e79",
  1893. "icon_fuzzy": null,
  1894. "icon": null,
  1895. "pdbpath": null,
  1896. "imported_dll_count": 18,
  1897. "versioninfo": []
  1898. }
  1899. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!