API tools faq
paste
paladin316

Microsoft_VisualStudio_Tools_Applications_Contract_v9_0_ni_dll_2019-06-26_10_30.json

paladin316
Jun 26th, 2019
2,179
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.59 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 1.6
  5.  
  6. [*] File Name: "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll"
  7. [*] File Size: 71680
  8. [*] File Type: "MS-DOS executable"
  9. [*] SHA256: "1d463e2857f1c82d9da6b5752082dd0c1ff9016344eb98181049094c91771a03"
  10. [*] MD5: "79302f738a0651401541b03fc7dada63"
  11. [*] SHA1: "3bfa5c7be66c849d8905995037eebcef80dedaa3"
  12. [*] SHA512: "8c58a4d897ec94684211dc12c56809c113a15105ca24b3c747fd5d096bbbab6e420d3e22f7d536e6490b71c0c7882d68a8ee73b9adea7a77ad588b1558102c32"
  13. [*] CRC32: "FEE4C66A"
  14. [*] SSDEEP: "768:dp3MVuuF2YvrGA5sRskS5AiIXrKhgEnG8FiJr23/apdS/IWTMdqZaqrl:n3MVuuF2YvrGA+RsRAikrc5G3xnmcmz"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "Anomalous binary characteristics",
  21. "Details": [
  22. {
  23. "anomaly": "Entrypoint of binary is located outside of any mapped sections"
  24. }
  25. ]
  26. }
  27. ]
  28.  
  29. [*] Started Service: []
  30.  
  31. [*] Executed Commands: []
  32.  
  33. [*] Mutexes: []
  34.  
  35. [*] Modified Files: []
  36.  
  37. [*] Deleted Files: []
  38.  
  39. [*] Modified Registry Keys: []
  40.  
  41. [*] Deleted Registry Keys: []
  42.  
  43. [*] DNS Communications: []
  44.  
  45. [*] Domains: []
  46.  
  47. [*] Network Communication - ICMP: []
  48.  
  49. [*] Network Communication - HTTP: []
  50.  
  51. [*] Network Communication - SMTP: []
  52.  
  53. [*] Network Communication - Hosts: []
  54.  
  55. [*] Network Communication - IRC: []
  56.  
  57. [*] Static Analysis: {
  58. "pe": {
  59. "peid_signatures": null,
  60. "imports": [],
  61. "digital_signers": null,
  62. "exported_dll_name": null,
  63. "actual_checksum": "0x0001cd59",
  64. "overlay": null,
  65. "imagebase": "0x642a0000000",
  66. "reported_checksum": "0x00000000",
  67. "icon_hash": null,
  68. "entrypoint": "0x642a0000000",
  69. "timestamp": "2012-04-04 10:18:32",
  70. "osversion": "5.2",
  71. "sections": [
  72. {
  73. "name": ".data",
  74. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  75. "virtual_address": "0x00001000",
  76. "size_of_data": "0x00005400",
  77. "entropy": "1.58",
  78. "raw_address": "0x00000400",
  79. "virtual_size": "0x000053a8",
  80. "characteristics_raw": "0xc0000040"
  81. },
  82. {
  83. "name": ".xdata",
  84. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  85. "virtual_address": "0x00007000",
  86. "size_of_data": "0x00002600",
  87. "entropy": "1.03",
  88. "raw_address": "0x00005800",
  89. "virtual_size": "0x00002500",
  90. "characteristics_raw": "0xe0000040"
  91. },
  92. {
  93. "name": ".text",
  94. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  95. "virtual_address": "0x0000a000",
  96. "size_of_data": "0x00009200",
  97. "entropy": "5.53",
  98. "raw_address": "0x00007e00",
  99. "virtual_size": "0x00009054",
  100. "characteristics_raw": "0x60000020"
  101. },
  102. {
  103. "name": ".extjmp",
  104. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  105. "virtual_address": "0x00014000",
  106. "size_of_data": "0x00000200",
  107. "entropy": "3.26",
  108. "raw_address": "0x00011000",
  109. "virtual_size": "0x00000150",
  110. "characteristics_raw": "0x60000020"
  111. },
  112. {
  113. "name": ".extrel",
  114. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  115. "virtual_address": "0x00015000",
  116. "size_of_data": "0x00000200",
  117. "entropy": "0.40",
  118. "raw_address": "0x00011200",
  119. "virtual_size": "0x00000015",
  120. "characteristics_raw": "0x40000040"
  121. },
  122. {
  123. "name": ".reloc",
  124. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  125. "virtual_address": "0x00016000",
  126. "size_of_data": "0x00000400",
  127. "entropy": "5.42",
  128. "raw_address": "0x00011400",
  129. "virtual_size": "0x000003dc",
  130. "characteristics_raw": "0x42000040"
  131. }
  132. ],
  133. "resources": [],
  134. "dirents": [
  135. {
  136. "virtual_address": "0x00000000",
  137. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  138. "size": "0x00000000"
  139. },
  140. {
  141. "virtual_address": "0x00000000",
  142. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  143. "size": "0x00000000"
  144. },
  145. {
  146. "virtual_address": "0x0000a000",
  147. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  148. "size": "0x00000590"
  149. },
  150. {
  151. "virtual_address": "0x0000ae64",
  152. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  153. "size": "0x0000027c"
  154. },
  155. {
  156. "virtual_address": "0x00000000",
  157. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  158. "size": "0x00000000"
  159. },
  160. {
  161. "virtual_address": "0x00016000",
  162. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  163. "size": "0x000003dc"
  164. },
  165. {
  166. "virtual_address": "0x00012fb4",
  167. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  168. "size": "0x0000001c"
  169. },
  170. {
  171. "virtual_address": "0x00000000",
  172. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  173. "size": "0x00000000"
  174. },
  175. {
  176. "virtual_address": "0x00000000",
  177. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  178. "size": "0x00000000"
  179. },
  180. {
  181. "virtual_address": "0x00000000",
  182. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  183. "size": "0x00000000"
  184. },
  185. {
  186. "virtual_address": "0x00000000",
  187. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  188. "size": "0x00000000"
  189. },
  190. {
  191. "virtual_address": "0x00000000",
  192. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  193. "size": "0x00000000"
  194. },
  195. {
  196. "virtual_address": "0x00000000",
  197. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  198. "size": "0x00000000"
  199. },
  200. {
  201. "virtual_address": "0x00000000",
  202. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  203. "size": "0x00000000"
  204. },
  205. {
  206. "virtual_address": "0x0000a590",
  207. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  208. "size": "0x00000048"
  209. },
  210. {
  211. "virtual_address": "0x00000000",
  212. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  213. "size": "0x00000000"
  214. }
  215. ],
  216. "exports": [],
  217. "guest_signers": {},
  218. "imphash": "",
  219. "icon_fuzzy": null,
  220. "icon": null,
  221. "pdbpath": "f:\\dd\\trinity\\vsta\\MAF\\vstacontracts2\\objr\\i386\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.pdb",
  222. "imported_dll_count": 0,
  223. "versioninfo": []
  224. }
  225. }
  226.  
  227. [*] Resolved APIs: []
  228.  
  229. [*] Static Analysis: {
  230. "pe": {
  231. "peid_signatures": null,
  232. "imports": [],
  233. "digital_signers": null,
  234. "exported_dll_name": null,
  235. "actual_checksum": "0x0001cd59",
  236. "overlay": null,
  237. "imagebase": "0x642a0000000",
  238. "reported_checksum": "0x00000000",
  239. "icon_hash": null,
  240. "entrypoint": "0x642a0000000",
  241. "timestamp": "2012-04-04 10:18:32",
  242. "osversion": "5.2",
  243. "sections": [
  244. {
  245. "name": ".data",
  246. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  247. "virtual_address": "0x00001000",
  248. "size_of_data": "0x00005400",
  249. "entropy": "1.58",
  250. "raw_address": "0x00000400",
  251. "virtual_size": "0x000053a8",
  252. "characteristics_raw": "0xc0000040"
  253. },
  254. {
  255. "name": ".xdata",
  256. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  257. "virtual_address": "0x00007000",
  258. "size_of_data": "0x00002600",
  259. "entropy": "1.03",
  260. "raw_address": "0x00005800",
  261. "virtual_size": "0x00002500",
  262. "characteristics_raw": "0xe0000040"
  263. },
  264. {
  265. "name": ".text",
  266. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  267. "virtual_address": "0x0000a000",
  268. "size_of_data": "0x00009200",
  269. "entropy": "5.53",
  270. "raw_address": "0x00007e00",
  271. "virtual_size": "0x00009054",
  272. "characteristics_raw": "0x60000020"
  273. },
  274. {
  275. "name": ".extjmp",
  276. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  277. "virtual_address": "0x00014000",
  278. "size_of_data": "0x00000200",
  279. "entropy": "3.26",
  280. "raw_address": "0x00011000",
  281. "virtual_size": "0x00000150",
  282. "characteristics_raw": "0x60000020"
  283. },
  284. {
  285. "name": ".extrel",
  286. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  287. "virtual_address": "0x00015000",
  288. "size_of_data": "0x00000200",
  289. "entropy": "0.40",
  290. "raw_address": "0x00011200",
  291. "virtual_size": "0x00000015",
  292. "characteristics_raw": "0x40000040"
  293. },
  294. {
  295. "name": ".reloc",
  296. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  297. "virtual_address": "0x00016000",
  298. "size_of_data": "0x00000400",
  299. "entropy": "5.42",
  300. "raw_address": "0x00011400",
  301. "virtual_size": "0x000003dc",
  302. "characteristics_raw": "0x42000040"
  303. }
  304. ],
  305. "resources": [],
  306. "dirents": [
  307. {
  308. "virtual_address": "0x00000000",
  309. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  310. "size": "0x00000000"
  311. },
  312. {
  313. "virtual_address": "0x00000000",
  314. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  315. "size": "0x00000000"
  316. },
  317. {
  318. "virtual_address": "0x0000a000",
  319. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  320. "size": "0x00000590"
  321. },
  322. {
  323. "virtual_address": "0x0000ae64",
  324. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  325. "size": "0x0000027c"
  326. },
  327. {
  328. "virtual_address": "0x00000000",
  329. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  330. "size": "0x00000000"
  331. },
  332. {
  333. "virtual_address": "0x00016000",
  334. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  335. "size": "0x000003dc"
  336. },
  337. {
  338. "virtual_address": "0x00012fb4",
  339. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  340. "size": "0x0000001c"
  341. },
  342. {
  343. "virtual_address": "0x00000000",
  344. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  345. "size": "0x00000000"
  346. },
  347. {
  348. "virtual_address": "0x00000000",
  349. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  350. "size": "0x00000000"
  351. },
  352. {
  353. "virtual_address": "0x00000000",
  354. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  355. "size": "0x00000000"
  356. },
  357. {
  358. "virtual_address": "0x00000000",
  359. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  360. "size": "0x00000000"
  361. },
  362. {
  363. "virtual_address": "0x00000000",
  364. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  365. "size": "0x00000000"
  366. },
  367. {
  368. "virtual_address": "0x00000000",
  369. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  370. "size": "0x00000000"
  371. },
  372. {
  373. "virtual_address": "0x00000000",
  374. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  375. "size": "0x00000000"
  376. },
  377. {
  378. "virtual_address": "0x0000a590",
  379. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  380. "size": "0x00000048"
  381. },
  382. {
  383. "virtual_address": "0x00000000",
  384. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  385. "size": "0x00000000"
  386. }
  387. ],
  388. "exports": [],
  389. "guest_signers": {},
  390. "imphash": "",
  391. "icon_fuzzy": null,
  392. "icon": null,
  393. "pdbpath": "f:\\dd\\trinity\\vsta\\MAF\\vstacontracts2\\objr\\i386\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.pdb",
  394. "imported_dll_count": 0,
  395. "versioninfo": []
  396. }
  397. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!