API tools faq
paste
paladin316

Exes_a9792f7d5a7350a4aa94bc753b866923_exe_2019-06-27_02_30.json

paladin316
Jun 26th, 2019
2,163
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 91.27 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Ursu"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_a9792f7d5a7350a4aa94bc753b866923.exe"
  7. [*] File Size: 1644544
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "14aae51fc0731441dff67ed4f58b710063ae6f2e4ab8e03ede77c373a2c7dcfc"
  10. [*] MD5: "a9792f7d5a7350a4aa94bc753b866923"
  11. [*] SHA1: "38cdc93b35a57c8765b638002ef377c0c578967b"
  12. [*] SHA512: "7cd64717bc0bde40f9405b0aa4b5fde8c717af9b0e58493cf5f774bb3f7378e08cd7f38c1c1bb0d489c5514f5c8821f89612ba7200a6d32815c667d002124389"
  13. [*] CRC32: "B7A09086"
  14. [*] SSDEEP: "49152:gATCURlmMhkulBaElfTZ2gKpiMN1aN0asTDdZU:goRUiPlBa8TEtxHaN0aIDdZ"
  15.  
  16. [*] Process Execution: [
  17. "Exes_a9792f7d5a7350a4aa94bc753b866923.exe",
  18. "blG99Kf.exe",
  19. "explorer.exe"
  20. ]
  21.  
  22. [*] Signatures Detected: [
  23. {
  24. "Description": "Creates RWX memory",
  25. "Details": []
  26. },
  27. {
  28. "Description": "Possible date expiration check, exits too soon after checking local time",
  29. "Details": [
  30. {
  31. "process": "Exes_a9792f7d5a7350a4aa94bc753b866923.exe, PID 1524"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "Expresses interest in specific running processes",
  37. "Details": [
  38. {
  39. "process": "explorer.exe"
  40. }
  41. ]
  42. },
  43. {
  44. "Description": "Drops a binary and executes it",
  45. "Details": [
  46. {
  47. "binary": "C:\\Windows\\c887c3\\blG99Kf.exe"
  48. }
  49. ]
  50. },
  51. {
  52. "Description": "The binary likely contains encrypted or compressed data.",
  53. "Details": [
  54. {
  55. "section": "name: .vmp0, entropy: 7.86, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00155800, virtual_size: 0x001556a4"
  56. },
  57. {
  58. "section": "name: .vmp1, entropy: 7.48, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00011400, virtual_size: 0x00011252"
  59. }
  60. ]
  61. },
  62. {
  63. "Description": "The executable is likely packed with VMProtect",
  64. "Details": [
  65. {
  66. "section": {
  67. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  68. "characteristics_raw": "0xe0000060",
  69. "entropy": "7.86",
  70. "name": ".vmp0",
  71. "raw_address": "0x00028000",
  72. "size_of_data": "0x00155800",
  73. "virtual_address": "0x0002c000",
  74. "virtual_size": "0x001556a4"
  75. }
  76. }
  77. ]
  78. },
  79. {
  80. "Description": "Detects Sandboxie through the presence of a library",
  81. "Details": []
  82. },
  83. {
  84. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  85. "Details": [
  86. {
  87. "Process": "Exes_a9792f7d5a7350a4aa94bc753b866923.exe (1524)"
  88. }
  89. ]
  90. },
  91. {
  92. "Description": "Code injection with CreateRemoteThread in a remote process",
  93. "Details": [
  94. {
  95. "Injection": "blG99Kf.exe(848) -> explorer.exe(1960)"
  96. }
  97. ]
  98. },
  99. {
  100. "Description": "Creates a hidden or system file",
  101. "Details": [
  102. {
  103. "file": "C:\\Windows\\System32\\lz_scby.txt"
  104. }
  105. ]
  106. },
  107. {
  108. "Description": "File has been identified by 47 Antiviruses on VirusTotal as malicious",
  109. "Details": [
  110. {
  111. "Bkav": "HW32.Packed."
  112. },
  113. {
  114. "MicroWorld-eScan": "Gen:Variant.Ursu.227819"
  115. },
  116. {
  117. "FireEye": "Generic.mg.a9792f7d5a7350a4"
  118. },
  119. {
  120. "McAfee": "Artemis!A9792F7D5A73"
  121. },
  122. {
  123. "Cylance": "Unsafe"
  124. },
  125. {
  126. "Alibaba": "Trojan:Win32/VMProtBad.0966da16"
  127. },
  128. {
  129. "Arcabit": "Trojan.Ursu.D379EB"
  130. },
  131. {
  132. "Invincea": "heuristic"
  133. },
  134. {
  135. "Baidu": "Win32.Packed.VMProtect.a"
  136. },
  137. {
  138. "Symantec": "ML.Attribute.HighConfidence"
  139. },
  140. {
  141. "APEX": "Malicious"
  142. },
  143. {
  144. "Avast": "Win32:Trojan-gen"
  145. },
  146. {
  147. "Kaspersky": "Backdoor.Win32.Agent.mytost"
  148. },
  149. {
  150. "BitDefender": "Gen:Variant.Ursu.227819"
  151. },
  152. {
  153. "NANO-Antivirus": "Trojan.Win32.Ursu.fruyjp"
  154. },
  155. {
  156. "Paloalto": "generic.ml"
  157. },
  158. {
  159. "AegisLab": "Trojan.Multi.Generic.4!c"
  160. },
  161. {
  162. "Tencent": "Win32.Backdoor.Agent.Lnob"
  163. },
  164. {
  165. "Ad-Aware": "Gen:Variant.Ursu.227819"
  166. },
  167. {
  168. "Emsisoft": "Gen:Variant.Ursu.227819 (B)"
  169. },
  170. {
  171. "F-Secure": "Trojan.TR/Agent.hwwke"
  172. },
  173. {
  174. "DrWeb": "Trojan.MulDrop7.3471"
  175. },
  176. {
  177. "TrendMicro": "TROJ_GEN.R03FC0RFQ19"
  178. },
  179. {
  180. "McAfee-GW-Edition": "BehavesLike.Win32.Virut.tc"
  181. },
  182. {
  183. "Sophos": "Mal/VMProtBad-A"
  184. },
  185. {
  186. "SentinelOne": "DFI - Malicious PE"
  187. },
  188. {
  189. "Avira": "TR/Agent.hwwke"
  190. },
  191. {
  192. "MAX": "malware (ai score=96)"
  193. },
  194. {
  195. "Microsoft": "Trojan:Win32/Pynamer.A!ac"
  196. },
  197. {
  198. "Endgame": "malicious (high confidence)"
  199. },
  200. {
  201. "ViRobot": "Trojan.Win32.Z.Ursu.1644544"
  202. },
  203. {
  204. "ZoneAlarm": "Backdoor.Win32.Agent.mytost"
  205. },
  206. {
  207. "GData": "Gen:Variant.Ursu.227819"
  208. },
  209. {
  210. "AhnLab-V3": "Malware/Win32.Generic.C3121731"
  211. },
  212. {
  213. "Acronis": "suspicious"
  214. },
  215. {
  216. "VBA32": "TrojanPSW.Coins"
  217. },
  218. {
  219. "ALYac": "Gen:Variant.Ursu.227819"
  220. },
  221. {
  222. "Malwarebytes": "Trojan.VMProtect"
  223. },
  224. {
  225. "ESET-NOD32": "a variant of Win32/Agent.YKQ"
  226. },
  227. {
  228. "TrendMicro-HouseCall": "TROJ_GEN.R03FC0RFQ19"
  229. },
  230. {
  231. "Rising": "Backdoor.Zegost!8.177 (CLOUD)"
  232. },
  233. {
  234. "Ikarus": "Trojan.Win32.Agent"
  235. },
  236. {
  237. "Fortinet": "W32/Agent.A!tr.bdr"
  238. },
  239. {
  240. "AVG": "Win32:Trojan-gen"
  241. },
  242. {
  243. "Cybereason": "malicious.d5a735"
  244. },
  245. {
  246. "Panda": "Generic Suspicious"
  247. },
  248. {
  249. "CrowdStrike": "win/malicious_confidence_90% (W)"
  250. }
  251. ]
  252. },
  253. {
  254. "Description": "Checks the presence of disk drives in the registry, possibly for anti-virtualization",
  255. "Details": []
  256. }
  257. ]
  258.  
  259. [*] Started Service: []
  260.  
  261. [*] Executed Commands: [
  262. "C:/Windows/c887c3/blG99Kf.exe /runp2p:C:/Windows/c887c3/n9huw8O.dll"
  263. ]
  264.  
  265. [*] Mutexes: [
  266. "e91db4ec7f217a55ebcc47b56e42e2ee",
  267. "19f46277b625a9d36d1f948fd357097e",
  268. "8c4ab3d03888446a81787da1a8862c4f",
  269. "a01d46e817b2a8c7dd6af4ed6f9c1323"
  270. ]
  271.  
  272. [*] Modified Files: [
  273. "C:\\Windows\\System32\\lz_scby.txt",
  274. "C:\\Windows\\c887c3\\ce070904adc09a1f77098be9eb713cf0",
  275. "C:\\Windows\\c887c3\\n9huw8O.dll",
  276. "C:\\Windows\\c887c3\\blG99Kf.exe"
  277. ]
  278.  
  279. [*] Deleted Files: [
  280. "C:\\Windows\\System32\\lz_scby.txt",
  281. "C:\\Windows\\c887c3\\blG99Kf.exe",
  282. "C:\\Windows\\c887c3\\mg2rALE.d"
  283. ]
  284.  
  285. [*] Modified Registry Keys: []
  286.  
  287. [*] Deleted Registry Keys: []
  288.  
  289. [*] DNS Communications: []
  290.  
  291. [*] Domains: []
  292.  
  293. [*] Network Communication - ICMP: []
  294.  
  295. [*] Network Communication - HTTP: []
  296.  
  297. [*] Network Communication - SMTP: []
  298.  
  299. [*] Network Communication - Hosts: []
  300.  
  301. [*] Network Communication - IRC: []
  302.  
  303. [*] Static Analysis: {
  304. "pe": {
  305. "peid_signatures": null,
  306. "imports": [
  307. {
  308. "imports": [
  309. {
  310. "name": "FindResourceA",
  311. "address": "0x58d000"
  312. },
  313. {
  314. "name": "FreeResource",
  315. "address": "0x58d004"
  316. },
  317. {
  318. "name": "LoadResource",
  319. "address": "0x58d008"
  320. },
  321. {
  322. "name": "HeapAlloc",
  323. "address": "0x58d00c"
  324. },
  325. {
  326. "name": "SetUnhandledExceptionFilter",
  327. "address": "0x58d010"
  328. },
  329. {
  330. "name": "GetCurrentProcess",
  331. "address": "0x58d014"
  332. },
  333. {
  334. "name": "HeapFree",
  335. "address": "0x58d018"
  336. },
  337. {
  338. "name": "GetTickCount",
  339. "address": "0x58d01c"
  340. },
  341. {
  342. "name": "GetProcessHeap",
  343. "address": "0x58d020"
  344. },
  345. {
  346. "name": "WideCharToMultiByte",
  347. "address": "0x58d024"
  348. },
  349. {
  350. "name": "SizeofResource",
  351. "address": "0x58d028"
  352. },
  353. {
  354. "name": "GetVersionExW",
  355. "address": "0x58d02c"
  356. },
  357. {
  358. "name": "MultiByteToWideChar",
  359. "address": "0x58d030"
  360. },
  361. {
  362. "name": "OpenMutexA",
  363. "address": "0x58d034"
  364. },
  365. {
  366. "name": "LockResource",
  367. "address": "0x58d038"
  368. },
  369. {
  370. "name": "GetCurrentThreadId",
  371. "address": "0x58d03c"
  372. },
  373. {
  374. "name": "ReleaseMutex",
  375. "address": "0x58d040"
  376. },
  377. {
  378. "name": "GetCurrentProcessId",
  379. "address": "0x58d044"
  380. },
  381. {
  382. "name": "Sleep",
  383. "address": "0x58d048"
  384. },
  385. {
  386. "name": "TerminateProcess",
  387. "address": "0x58d04c"
  388. },
  389. {
  390. "name": "SetFileAttributesA",
  391. "address": "0x58d050"
  392. },
  393. {
  394. "name": "HeapSize",
  395. "address": "0x58d054"
  396. },
  397. {
  398. "name": "SetEnvironmentVariableA",
  399. "address": "0x58d058"
  400. },
  401. {
  402. "name": "CompareStringW",
  403. "address": "0x58d05c"
  404. },
  405. {
  406. "name": "CompareStringA",
  407. "address": "0x58d060"
  408. },
  409. {
  410. "name": "DeleteFileA",
  411. "address": "0x58d064"
  412. },
  413. {
  414. "name": "CloseHandle",
  415. "address": "0x58d068"
  416. },
  417. {
  418. "name": "GetModuleFileNameA",
  419. "address": "0x58d06c"
  420. },
  421. {
  422. "name": "GetLastError",
  423. "address": "0x58d070"
  424. },
  425. {
  426. "name": "ReadFile",
  427. "address": "0x58d074"
  428. },
  429. {
  430. "name": "WriteFile",
  431. "address": "0x58d078"
  432. },
  433. {
  434. "name": "SetFilePointer",
  435. "address": "0x58d07c"
  436. },
  437. {
  438. "name": "GetFileSize",
  439. "address": "0x58d080"
  440. },
  441. {
  442. "name": "CreateFileA",
  443. "address": "0x58d084"
  444. },
  445. {
  446. "name": "VirtualProtect",
  447. "address": "0x58d088"
  448. },
  449. {
  450. "name": "InitializeCriticalSection",
  451. "address": "0x58d08c"
  452. },
  453. {
  454. "name": "GetModuleHandleA",
  455. "address": "0x58d090"
  456. },
  457. {
  458. "name": "LoadLibraryA",
  459. "address": "0x58d094"
  460. },
  461. {
  462. "name": "VirtualAlloc",
  463. "address": "0x58d098"
  464. },
  465. {
  466. "name": "GetProcAddress",
  467. "address": "0x58d09c"
  468. },
  469. {
  470. "name": "VirtualFree",
  471. "address": "0x58d0a0"
  472. },
  473. {
  474. "name": "DeleteCriticalSection",
  475. "address": "0x58d0a4"
  476. },
  477. {
  478. "name": "EnterCriticalSection",
  479. "address": "0x58d0a8"
  480. },
  481. {
  482. "name": "SetStdHandle",
  483. "address": "0x58d0ac"
  484. },
  485. {
  486. "name": "WriteConsoleW",
  487. "address": "0x58d0b0"
  488. },
  489. {
  490. "name": "GetConsoleOutputCP",
  491. "address": "0x58d0b4"
  492. },
  493. {
  494. "name": "WriteConsoleA",
  495. "address": "0x58d0b8"
  496. },
  497. {
  498. "name": "GetLocaleInfoA",
  499. "address": "0x58d0bc"
  500. },
  501. {
  502. "name": "GetStringTypeW",
  503. "address": "0x58d0c0"
  504. },
  505. {
  506. "name": "GetStringTypeA",
  507. "address": "0x58d0c4"
  508. },
  509. {
  510. "name": "LCMapStringW",
  511. "address": "0x58d0c8"
  512. },
  513. {
  514. "name": "LCMapStringA",
  515. "address": "0x58d0cc"
  516. },
  517. {
  518. "name": "QueryPerformanceCounter",
  519. "address": "0x58d0d0"
  520. },
  521. {
  522. "name": "GetEnvironmentStringsW",
  523. "address": "0x58d0d4"
  524. },
  525. {
  526. "name": "FreeEnvironmentStringsW",
  527. "address": "0x58d0d8"
  528. },
  529. {
  530. "name": "GetEnvironmentStrings",
  531. "address": "0x58d0dc"
  532. },
  533. {
  534. "name": "FreeEnvironmentStringsA",
  535. "address": "0x58d0e0"
  536. },
  537. {
  538. "name": "InitializeCriticalSectionAndSpinCount",
  539. "address": "0x58d0e4"
  540. },
  541. {
  542. "name": "GetTimeZoneInformation",
  543. "address": "0x58d0e8"
  544. },
  545. {
  546. "name": "RtlUnwind",
  547. "address": "0x58d0ec"
  548. },
  549. {
  550. "name": "FlushFileBuffers",
  551. "address": "0x58d0f0"
  552. },
  553. {
  554. "name": "GetConsoleMode",
  555. "address": "0x58d0f4"
  556. },
  557. {
  558. "name": "GetConsoleCP",
  559. "address": "0x58d0f8"
  560. },
  561. {
  562. "name": "GetStartupInfoA",
  563. "address": "0x58d0fc"
  564. },
  565. {
  566. "name": "GetFileType",
  567. "address": "0x58d100"
  568. },
  569. {
  570. "name": "SetHandleCount",
  571. "address": "0x58d104"
  572. },
  573. {
  574. "name": "SetLastError",
  575. "address": "0x58d108"
  576. },
  577. {
  578. "name": "TlsFree",
  579. "address": "0x58d10c"
  580. },
  581. {
  582. "name": "TlsSetValue",
  583. "address": "0x58d110"
  584. },
  585. {
  586. "name": "TlsAlloc",
  587. "address": "0x58d114"
  588. },
  589. {
  590. "name": "TlsGetValue",
  591. "address": "0x58d118"
  592. },
  593. {
  594. "name": "IsValidCodePage",
  595. "address": "0x58d11c"
  596. },
  597. {
  598. "name": "GetOEMCP",
  599. "address": "0x58d120"
  600. },
  601. {
  602. "name": "GetACP",
  603. "address": "0x58d124"
  604. },
  605. {
  606. "name": "InterlockedDecrement",
  607. "address": "0x58d128"
  608. },
  609. {
  610. "name": "LeaveCriticalSection",
  611. "address": "0x58d12c"
  612. },
  613. {
  614. "name": "InterlockedIncrement",
  615. "address": "0x58d130"
  616. },
  617. {
  618. "name": "GetCPInfo",
  619. "address": "0x58d134"
  620. },
  621. {
  622. "name": "GetStdHandle",
  623. "address": "0x58d138"
  624. },
  625. {
  626. "name": "HeapReAlloc",
  627. "address": "0x58d13c"
  628. },
  629. {
  630. "name": "GetSystemTimeAsFileTime",
  631. "address": "0x58d140"
  632. },
  633. {
  634. "name": "GetModuleHandleW",
  635. "address": "0x58d144"
  636. },
  637. {
  638. "name": "ExitProcess",
  639. "address": "0x58d148"
  640. },
  641. {
  642. "name": "GetCommandLineA",
  643. "address": "0x58d14c"
  644. },
  645. {
  646. "name": "UnhandledExceptionFilter",
  647. "address": "0x58d150"
  648. },
  649. {
  650. "name": "IsDebuggerPresent",
  651. "address": "0x58d154"
  652. },
  653. {
  654. "name": "HeapCreate",
  655. "address": "0x58d158"
  656. },
  657. {
  658. "name": "SetEndOfFile",
  659. "address": "0x58d15c"
  660. }
  661. ],
  662. "dll": "KERNEL32.dll"
  663. },
  664. {
  665. "imports": [
  666. {
  667. "name": "GetInputState",
  668. "address": "0x58d164"
  669. },
  670. {
  671. "name": "PostThreadMessageW",
  672. "address": "0x58d168"
  673. },
  674. {
  675. "name": "GetMessageA",
  676. "address": "0x58d16c"
  677. },
  678. {
  679. "name": "PostThreadMessageA",
  680. "address": "0x58d170"
  681. }
  682. ],
  683. "dll": "USER32.dll"
  684. },
  685. {
  686. "imports": [
  687. {
  688. "name": "RegQueryInfoKeyA",
  689. "address": "0x58d178"
  690. },
  691. {
  692. "name": "RegCloseKey",
  693. "address": "0x58d17c"
  694. },
  695. {
  696. "name": "RegOpenKeyExA",
  697. "address": "0x58d180"
  698. },
  699. {
  700. "name": "RegEnumKeyExA",
  701. "address": "0x58d184"
  702. },
  703. {
  704. "name": "RegQueryValueExA",
  705. "address": "0x58d188"
  706. }
  707. ],
  708. "dll": "ADVAPI32.dll"
  709. },
  710. {
  711. "imports": [
  712. {
  713. "name": "inet_addr",
  714. "address": "0x58d190"
  715. },
  716. {
  717. "name": "gethostbyname",
  718. "address": "0x58d194"
  719. },
  720. {
  721. "name": "WSAStartup",
  722. "address": "0x58d198"
  723. },
  724. {
  725. "name": "gethostname",
  726. "address": "0x58d19c"
  727. },
  728. {
  729. "name": "inet_ntoa",
  730. "address": "0x58d1a0"
  731. },
  732. {
  733. "name": "WSAGetLastError",
  734. "address": "0x58d1a4"
  735. }
  736. ],
  737. "dll": "WS2_32.dll"
  738. },
  739. {
  740. "imports": [
  741. {
  742. "name": "GetAdaptersInfo",
  743. "address": "0x58d1ac"
  744. }
  745. ],
  746. "dll": "IPHLPAPI.DLL"
  747. },
  748. {
  749. "imports": [
  750. {
  751. "name": "GetFileVersionInfoA",
  752. "address": "0x58d1b4"
  753. },
  754. {
  755. "name": "GetFileVersionInfoSizeA",
  756. "address": "0x58d1b8"
  757. },
  758. {
  759. "name": "VerQueryValueA",
  760. "address": "0x58d1bc"
  761. }
  762. ],
  763. "dll": "VERSION.dll"
  764. },
  765. {
  766. "imports": [
  767. {
  768. "name": "LoadLibraryA",
  769. "address": "0x58d1c4"
  770. },
  771. {
  772. "name": "GetProcAddress",
  773. "address": "0x58d1c8"
  774. },
  775. {
  776. "name": "GetLastError",
  777. "address": "0x58d1cc"
  778. },
  779. {
  780. "name": "FreeLibrary",
  781. "address": "0x58d1d0"
  782. },
  783. {
  784. "name": "InitializeCriticalSection",
  785. "address": "0x58d1d4"
  786. },
  787. {
  788. "name": "GetModuleFileNameW",
  789. "address": "0x58d1d8"
  790. },
  791. {
  792. "name": "GetModuleHandleW",
  793. "address": "0x58d1dc"
  794. },
  795. {
  796. "name": "TerminateProcess",
  797. "address": "0x58d1e0"
  798. },
  799. {
  800. "name": "GetCurrentProcess",
  801. "address": "0x58d1e4"
  802. },
  803. {
  804. "name": "DeleteCriticalSection",
  805. "address": "0x58d1e8"
  806. },
  807. {
  808. "name": "LoadLibraryW",
  809. "address": "0x58d1ec"
  810. },
  811. {
  812. "name": "CreateEventW",
  813. "address": "0x58d1f0"
  814. },
  815. {
  816. "name": "CompareStringW",
  817. "address": "0x58d1f4"
  818. },
  819. {
  820. "name": "SetLastError",
  821. "address": "0x58d1f8"
  822. },
  823. {
  824. "name": "GetModuleHandleA",
  825. "address": "0x58d1fc"
  826. },
  827. {
  828. "name": "VirtualProtect",
  829. "address": "0x58d200"
  830. },
  831. {
  832. "name": "GetTickCount",
  833. "address": "0x58d204"
  834. },
  835. {
  836. "name": "EnterCriticalSection",
  837. "address": "0x58d208"
  838. },
  839. {
  840. "name": "LeaveCriticalSection",
  841. "address": "0x58d20c"
  842. },
  843. {
  844. "name": "VirtualFree",
  845. "address": "0x58d210"
  846. },
  847. {
  848. "name": "VirtualAlloc",
  849. "address": "0x58d214"
  850. },
  851. {
  852. "name": "WriteProcessMemory",
  853. "address": "0x58d218"
  854. },
  855. {
  856. "name": "CreateToolhelp32Snapshot",
  857. "address": "0x58d21c"
  858. },
  859. {
  860. "name": "GetCurrentProcessId",
  861. "address": "0x58d220"
  862. },
  863. {
  864. "name": "GetCurrentThreadId",
  865. "address": "0x58d224"
  866. },
  867. {
  868. "name": "Thread32First",
  869. "address": "0x58d228"
  870. },
  871. {
  872. "name": "OpenThread",
  873. "address": "0x58d22c"
  874. },
  875. {
  876. "name": "Thread32Next",
  877. "address": "0x58d230"
  878. },
  879. {
  880. "name": "CloseHandle",
  881. "address": "0x58d234"
  882. },
  883. {
  884. "name": "SuspendThread",
  885. "address": "0x58d238"
  886. },
  887. {
  888. "name": "ResumeThread",
  889. "address": "0x58d23c"
  890. },
  891. {
  892. "name": "GetSystemInfo",
  893. "address": "0x58d240"
  894. },
  895. {
  896. "name": "LoadResource",
  897. "address": "0x58d244"
  898. },
  899. {
  900. "name": "MultiByteToWideChar",
  901. "address": "0x58d248"
  902. },
  903. {
  904. "name": "WideCharToMultiByte",
  905. "address": "0x58d24c"
  906. },
  907. {
  908. "name": "FindResourceExW",
  909. "address": "0x58d250"
  910. },
  911. {
  912. "name": "FindResourceExA",
  913. "address": "0x58d254"
  914. },
  915. {
  916. "name": "GetThreadLocale",
  917. "address": "0x58d258"
  918. },
  919. {
  920. "name": "GetUserDefaultLCID",
  921. "address": "0x58d25c"
  922. },
  923. {
  924. "name": "GetSystemDefaultLCID",
  925. "address": "0x58d260"
  926. },
  927. {
  928. "name": "EnumResourceNamesA",
  929. "address": "0x58d264"
  930. },
  931. {
  932. "name": "EnumResourceNamesW",
  933. "address": "0x58d268"
  934. },
  935. {
  936. "name": "EnumResourceLanguagesA",
  937. "address": "0x58d26c"
  938. },
  939. {
  940. "name": "EnumResourceLanguagesW",
  941. "address": "0x58d270"
  942. },
  943. {
  944. "name": "EnumResourceTypesA",
  945. "address": "0x58d274"
  946. },
  947. {
  948. "name": "EnumResourceTypesW",
  949. "address": "0x58d278"
  950. },
  951. {
  952. "name": "HeapAlloc",
  953. "address": "0x58d27c"
  954. },
  955. {
  956. "name": "HeapFree",
  957. "address": "0x58d280"
  958. },
  959. {
  960. "name": "HeapDestroy",
  961. "address": "0x58d284"
  962. },
  963. {
  964. "name": "HeapCreate",
  965. "address": "0x58d288"
  966. },
  967. {
  968. "name": "GetSystemTime",
  969. "address": "0x58d28c"
  970. },
  971. {
  972. "name": "GetLocalTime",
  973. "address": "0x58d290"
  974. },
  975. {
  976. "name": "SystemTimeToFileTime",
  977. "address": "0x58d294"
  978. },
  979. {
  980. "name": "CompareFileTime",
  981. "address": "0x58d298"
  982. },
  983. {
  984. "name": "GetCommandLineA",
  985. "address": "0x58d29c"
  986. },
  987. {
  988. "name": "GetCPInfo",
  989. "address": "0x58d2a0"
  990. },
  991. {
  992. "name": "InterlockedIncrement",
  993. "address": "0x58d2a4"
  994. },
  995. {
  996. "name": "InterlockedDecrement",
  997. "address": "0x58d2a8"
  998. },
  999. {
  1000. "name": "GetACP",
  1001. "address": "0x58d2ac"
  1002. },
  1003. {
  1004. "name": "GetOEMCP",
  1005. "address": "0x58d2b0"
  1006. },
  1007. {
  1008. "name": "IsValidCodePage",
  1009. "address": "0x58d2b4"
  1010. },
  1011. {
  1012. "name": "TlsGetValue",
  1013. "address": "0x58d2b8"
  1014. },
  1015. {
  1016. "name": "TlsAlloc",
  1017. "address": "0x58d2bc"
  1018. },
  1019. {
  1020. "name": "TlsSetValue",
  1021. "address": "0x58d2c0"
  1022. },
  1023. {
  1024. "name": "TlsFree",
  1025. "address": "0x58d2c4"
  1026. },
  1027. {
  1028. "name": "LCMapStringA",
  1029. "address": "0x58d2c8"
  1030. },
  1031. {
  1032. "name": "LCMapStringW",
  1033. "address": "0x58d2cc"
  1034. },
  1035. {
  1036. "name": "UnhandledExceptionFilter",
  1037. "address": "0x58d2d0"
  1038. },
  1039. {
  1040. "name": "SetUnhandledExceptionFilter",
  1041. "address": "0x58d2d4"
  1042. },
  1043. {
  1044. "name": "IsDebuggerPresent",
  1045. "address": "0x58d2d8"
  1046. },
  1047. {
  1048. "name": "WriteFile",
  1049. "address": "0x58d2dc"
  1050. },
  1051. {
  1052. "name": "GetStdHandle",
  1053. "address": "0x58d2e0"
  1054. },
  1055. {
  1056. "name": "GetModuleFileNameA",
  1057. "address": "0x58d2e4"
  1058. },
  1059. {
  1060. "name": "RaiseException",
  1061. "address": "0x58d2e8"
  1062. },
  1063. {
  1064. "name": "Sleep",
  1065. "address": "0x58d2ec"
  1066. },
  1067. {
  1068. "name": "ExitProcess",
  1069. "address": "0x58d2f0"
  1070. },
  1071. {
  1072. "name": "SetHandleCount",
  1073. "address": "0x58d2f4"
  1074. },
  1075. {
  1076. "name": "GetFileType",
  1077. "address": "0x58d2f8"
  1078. },
  1079. {
  1080. "name": "GetStartupInfoA",
  1081. "address": "0x58d2fc"
  1082. },
  1083. {
  1084. "name": "FreeEnvironmentStringsA",
  1085. "address": "0x58d300"
  1086. },
  1087. {
  1088. "name": "GetEnvironmentStrings",
  1089. "address": "0x58d304"
  1090. },
  1091. {
  1092. "name": "FreeEnvironmentStringsW",
  1093. "address": "0x58d308"
  1094. },
  1095. {
  1096. "name": "GetEnvironmentStringsW",
  1097. "address": "0x58d30c"
  1098. },
  1099. {
  1100. "name": "QueryPerformanceCounter",
  1101. "address": "0x58d310"
  1102. },
  1103. {
  1104. "name": "GetSystemTimeAsFileTime",
  1105. "address": "0x58d314"
  1106. },
  1107. {
  1108. "name": "HeapReAlloc",
  1109. "address": "0x58d318"
  1110. },
  1111. {
  1112. "name": "GetStringTypeA",
  1113. "address": "0x58d31c"
  1114. },
  1115. {
  1116. "name": "GetStringTypeW",
  1117. "address": "0x58d320"
  1118. },
  1119. {
  1120. "name": "GetLocaleInfoA",
  1121. "address": "0x58d324"
  1122. },
  1123. {
  1124. "name": "RtlUnwind",
  1125. "address": "0x58d328"
  1126. },
  1127. {
  1128. "name": "HeapSize",
  1129. "address": "0x58d32c"
  1130. },
  1131. {
  1132. "name": "SetFilePointer",
  1133. "address": "0x58d330"
  1134. },
  1135. {
  1136. "name": "GetConsoleCP",
  1137. "address": "0x58d334"
  1138. },
  1139. {
  1140. "name": "GetConsoleMode",
  1141. "address": "0x58d338"
  1142. },
  1143. {
  1144. "name": "InitializeCriticalSectionAndSpinCount",
  1145. "address": "0x58d33c"
  1146. },
  1147. {
  1148. "name": "SetStdHandle",
  1149. "address": "0x58d340"
  1150. },
  1151. {
  1152. "name": "WriteConsoleA",
  1153. "address": "0x58d344"
  1154. },
  1155. {
  1156. "name": "GetConsoleOutputCP",
  1157. "address": "0x58d348"
  1158. },
  1159. {
  1160. "name": "WriteConsoleW",
  1161. "address": "0x58d34c"
  1162. },
  1163. {
  1164. "name": "CreateFileA",
  1165. "address": "0x58d350"
  1166. },
  1167. {
  1168. "name": "FlushFileBuffers",
  1169. "address": "0x58d354"
  1170. },
  1171. {
  1172. "name": "VirtualQuery",
  1173. "address": "0x58d358"
  1174. }
  1175. ],
  1176. "dll": "KERNEL32.dll"
  1177. },
  1178. {
  1179. "imports": [
  1180. {
  1181. "name": "MessageBoxW",
  1182. "address": "0x58d360"
  1183. },
  1184. {
  1185. "name": "CharUpperBuffW",
  1186. "address": "0x58d364"
  1187. }
  1188. ],
  1189. "dll": "USER32.dll"
  1190. },
  1191. {
  1192. "imports": [
  1193. {
  1194. "name": "GetModuleFileNameW",
  1195. "address": "0x58d36c"
  1196. }
  1197. ],
  1198. "dll": "KERNEL32.dll"
  1199. },
  1200. {
  1201. "imports": [
  1202. {
  1203. "name": "GetModuleHandleA",
  1204. "address": "0x58d374"
  1205. },
  1206. {
  1207. "name": "LoadLibraryA",
  1208. "address": "0x58d378"
  1209. },
  1210. {
  1211. "name": "LocalAlloc",
  1212. "address": "0x58d37c"
  1213. },
  1214. {
  1215. "name": "LocalFree",
  1216. "address": "0x58d380"
  1217. },
  1218. {
  1219. "name": "GetModuleFileNameA",
  1220. "address": "0x58d384"
  1221. },
  1222. {
  1223. "name": "ExitProcess",
  1224. "address": "0x58d388"
  1225. }
  1226. ],
  1227. "dll": "KERNEL32.dll"
  1228. }
  1229. ],
  1230. "digital_signers": null,
  1231. "exported_dll_name": "",
  1232. "actual_checksum": "0x0019ebac",
  1233. "overlay": null,
  1234. "imagebase": "0x00400000",
  1235. "reported_checksum": "0x0019ebac",
  1236. "icon_hash": null,
  1237. "entrypoint": "0x00583a27",
  1238. "timestamp": "2018-11-24 02:02:51",
  1239. "osversion": "5.0",
  1240. "sections": [
  1241. {
  1242. "name": ".text",
  1243. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1244. "virtual_address": "0x00001000",
  1245. "size_of_data": "0x0001e000",
  1246. "entropy": "6.52",
  1247. "raw_address": "0x00000400",
  1248. "virtual_size": "0x0001de52",
  1249. "characteristics_raw": "0x60000020"
  1250. },
  1251. {
  1252. "name": ".rdata",
  1253. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1254. "virtual_address": "0x0001f000",
  1255. "size_of_data": "0x00008200",
  1256. "entropy": "6.61",
  1257. "raw_address": "0x0001e400",
  1258. "virtual_size": "0x000081b2",
  1259. "characteristics_raw": "0x40000040"
  1260. },
  1261. {
  1262. "name": ".data",
  1263. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1264. "virtual_address": "0x00028000",
  1265. "size_of_data": "0x00001a00",
  1266. "entropy": "3.74",
  1267. "raw_address": "0x00026600",
  1268. "virtual_size": "0x000036c4",
  1269. "characteristics_raw": "0xc0000040"
  1270. },
  1271. {
  1272. "name": ".vmp0",
  1273. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1274. "virtual_address": "0x0002c000",
  1275. "size_of_data": "0x00155800",
  1276. "entropy": "7.86",
  1277. "raw_address": "0x00028000",
  1278. "virtual_size": "0x001556a4",
  1279. "characteristics_raw": "0xe0000060"
  1280. },
  1281. {
  1282. "name": ".tls",
  1283. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1284. "virtual_address": "0x00182000",
  1285. "size_of_data": "0x00000200",
  1286. "entropy": "0.00",
  1287. "raw_address": "0x0017d800",
  1288. "virtual_size": "0x00000018",
  1289. "characteristics_raw": "0xc0000040"
  1290. },
  1291. {
  1292. "name": ".vmp1",
  1293. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1294. "virtual_address": "0x00183000",
  1295. "size_of_data": "0x00011400",
  1296. "entropy": "7.48",
  1297. "raw_address": "0x0017da00",
  1298. "virtual_size": "0x00011252",
  1299. "characteristics_raw": "0xe0000060"
  1300. },
  1301. {
  1302. "name": ".reloc",
  1303. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1304. "virtual_address": "0x00195000",
  1305. "size_of_data": "0x00002600",
  1306. "entropy": "6.45",
  1307. "raw_address": "0x0018ee00",
  1308. "virtual_size": "0x00002514",
  1309. "characteristics_raw": "0x40000040"
  1310. },
  1311. {
  1312. "name": ".rsrc",
  1313. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1314. "virtual_address": "0x00198000",
  1315. "size_of_data": "0x00000400",
  1316. "entropy": "3.91",
  1317. "raw_address": "0x00191400",
  1318. "virtual_size": "0x00000352",
  1319. "characteristics_raw": "0x40000040"
  1320. }
  1321. ],
  1322. "resources": [],
  1323. "dirents": [
  1324. {
  1325. "virtual_address": "0x00180a54",
  1326. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1327. "size": "0x00000c50"
  1328. },
  1329. {
  1330. "virtual_address": "0x00185090",
  1331. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1332. "size": "0x000000dc"
  1333. },
  1334. {
  1335. "virtual_address": "0x00198000",
  1336. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1337. "size": "0x00000352"
  1338. },
  1339. {
  1340. "virtual_address": "0x00000000",
  1341. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1342. "size": "0x00000000"
  1343. },
  1344. {
  1345. "virtual_address": "0x00000000",
  1346. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1347. "size": "0x00000000"
  1348. },
  1349. {
  1350. "virtual_address": "0x00195000",
  1351. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1352. "size": "0x00002514"
  1353. },
  1354. {
  1355. "virtual_address": "0x00000000",
  1356. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1357. "size": "0x00000000"
  1358. },
  1359. {
  1360. "virtual_address": "0x00000000",
  1361. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1362. "size": "0x00000000"
  1363. },
  1364. {
  1365. "virtual_address": "0x00000000",
  1366. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1367. "size": "0x00000000"
  1368. },
  1369. {
  1370. "virtual_address": "0x00186458",
  1371. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1372. "size": "0x00000020"
  1373. },
  1374. {
  1375. "virtual_address": "0x00026270",
  1376. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1377. "size": "0x00000040"
  1378. },
  1379. {
  1380. "virtual_address": "0x00000000",
  1381. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1382. "size": "0x00000000"
  1383. },
  1384. {
  1385. "virtual_address": "0x0018d000",
  1386. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1387. "size": "0x00000390"
  1388. },
  1389. {
  1390. "virtual_address": "0x00000000",
  1391. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1392. "size": "0x00000000"
  1393. },
  1394. {
  1395. "virtual_address": "0x00000000",
  1396. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1397. "size": "0x00000000"
  1398. },
  1399. {
  1400. "virtual_address": "0x00000000",
  1401. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1402. "size": "0x00000000"
  1403. }
  1404. ],
  1405. "exports": [],
  1406. "guest_signers": {},
  1407. "imphash": "2c4b653e617da18516332d4c0ab46237",
  1408. "icon_fuzzy": null,
  1409. "icon": null,
  1410. "pdbpath": null,
  1411. "imported_dll_count": 10,
  1412. "versioninfo": []
  1413. }
  1414. }
  1415.  
  1416. [*] Resolved APIs: [
  1417. "kernel32.dll.FlsAlloc",
  1418. "kernel32.dll.FlsGetValue",
  1419. "kernel32.dll.FlsSetValue",
  1420. "kernel32.dll.FlsFree",
  1421. "kernel32.dll.IsProcessorFeaturePresent",
  1422. "kernel32.dll.DeleteProcThreadAttributeList",
  1423. "kernel32.dll.FindResourceA",
  1424. "kernel32.dll.FreeResource",
  1425. "kernel32.dll.LoadResource",
  1426. "kernel32.dll.HeapAlloc",
  1427. "kernel32.dll.SetUnhandledExceptionFilter",
  1428. "kernel32.dll.GetCurrentProcess",
  1429. "kernel32.dll.UpdateProcThreadAttribute",
  1430. "kernel32.dll.HeapFree",
  1431. "kernel32.dll.GetModuleHandleW",
  1432. "kernel32.dll.GetProcessHeap",
  1433. "kernel32.dll.GetWindowsDirectoryA",
  1434. "kernel32.dll.OpenProcess",
  1435. "kernel32.dll.WideCharToMultiByte",
  1436. "kernel32.dll.LoadLibraryW",
  1437. "kernel32.dll.SizeofResource",
  1438. "kernel32.dll.GetFileAttributesA",
  1439. "kernel32.dll.CreateProcessA",
  1440. "kernel32.dll.GetSystemDirectoryA",
  1441. "kernel32.dll.MultiByteToWideChar",
  1442. "kernel32.dll.CreateDirectoryA",
  1443. "kernel32.dll.Process32FirstW",
  1444. "kernel32.dll.OpenMutexA",
  1445. "kernel32.dll.MoveFileA",
  1446. "kernel32.dll.LockResource",
  1447. "kernel32.dll.DeviceIoControl",
  1448. "kernel32.dll.Process32NextW",
  1449. "kernel32.dll.CreateMutexA",
  1450. "kernel32.dll.CreateToolhelp32Snapshot",
  1451. "kernel32.dll.GetCurrentThreadId",
  1452. "kernel32.dll.ReleaseMutex",
  1453. "kernel32.dll.WinExec",
  1454. "kernel32.dll.InitializeProcThreadAttributeList",
  1455. "kernel32.dll.GetCurrentProcessId",
  1456. "kernel32.dll.OpenFileMappingA",
  1457. "kernel32.dll.Sleep",
  1458. "kernel32.dll.CreateFileW",
  1459. "kernel32.dll.SetProcessWorkingSetSize",
  1460. "kernel32.dll.CreateRemoteThread",
  1461. "kernel32.dll.VirtualFreeEx",
  1462. "kernel32.dll.SetFileAttributesA",
  1463. "kernel32.dll.VirtualAllocEx",
  1464. "kernel32.dll.VirtualQueryEx",
  1465. "kernel32.dll.TerminateProcess",
  1466. "kernel32.dll.GetModuleFileNameW",
  1467. "kernel32.dll.FreeLibraryAndExitThread",
  1468. "kernel32.dll.SetEnvironmentVariableA",
  1469. "kernel32.dll.CompareStringW",
  1470. "kernel32.dll.CompareStringA",
  1471. "kernel32.dll.WriteConsoleW",
  1472. "kernel32.dll.GetConsoleOutputCP",
  1473. "kernel32.dll.WriteConsoleA",
  1474. "kernel32.dll.CreateThread",
  1475. "kernel32.dll.DeleteFileA",
  1476. "kernel32.dll.ResumeThread",
  1477. "kernel32.dll.GetModuleFileNameA",
  1478. "kernel32.dll.GetLastError",
  1479. "kernel32.dll.ReadFile",
  1480. "kernel32.dll.WriteFile",
  1481. "kernel32.dll.WaitForSingleObject",
  1482. "kernel32.dll.SetFilePointer",
  1483. "kernel32.dll.CloseHandle",
  1484. "kernel32.dll.CreateFileMappingA",
  1485. "kernel32.dll.GetTickCount",
  1486. "kernel32.dll.MapViewOfFile",
  1487. "kernel32.dll.GetFileSize",
  1488. "kernel32.dll.CreateFileA",
  1489. "kernel32.dll.InitializeCriticalSection",
  1490. "kernel32.dll.VirtualProtect",
  1491. "kernel32.dll.GetModuleHandleA",
  1492. "kernel32.dll.LoadLibraryA",
  1493. "kernel32.dll.VirtualAlloc",
  1494. "kernel32.dll.GetProcAddress",
  1495. "kernel32.dll.VirtualFree",
  1496. "kernel32.dll.DeleteCriticalSection",
  1497. "kernel32.dll.EnterCriticalSection",
  1498. "kernel32.dll.SetStdHandle",
  1499. "kernel32.dll.GetLocaleInfoA",
  1500. "kernel32.dll.GetStringTypeW",
  1501. "kernel32.dll.GetStringTypeA",
  1502. "kernel32.dll.LCMapStringA",
  1503. "kernel32.dll.QueryPerformanceCounter",
  1504. "kernel32.dll.GetEnvironmentStringsW",
  1505. "kernel32.dll.FreeEnvironmentStringsW",
  1506. "kernel32.dll.GetEnvironmentStrings",
  1507. "kernel32.dll.FreeEnvironmentStringsA",
  1508. "kernel32.dll.LCMapStringW",
  1509. "kernel32.dll.HeapSize",
  1510. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  1511. "kernel32.dll.GetTimeZoneInformation",
  1512. "kernel32.dll.FlushFileBuffers",
  1513. "kernel32.dll.RaiseException",
  1514. "kernel32.dll.GetConsoleMode",
  1515. "kernel32.dll.GetConsoleCP",
  1516. "kernel32.dll.RtlUnwind",
  1517. "kernel32.dll.GetStartupInfoA",
  1518. "kernel32.dll.GetFileType",
  1519. "kernel32.dll.SetHandleCount",
  1520. "kernel32.dll.SetLastError",
  1521. "kernel32.dll.TlsFree",
  1522. "kernel32.dll.TlsSetValue",
  1523. "kernel32.dll.TlsAlloc",
  1524. "kernel32.dll.TlsGetValue",
  1525. "kernel32.dll.IsValidCodePage",
  1526. "kernel32.dll.GetOEMCP",
  1527. "kernel32.dll.GetACP",
  1528. "kernel32.dll.InterlockedDecrement",
  1529. "kernel32.dll.InterlockedIncrement",
  1530. "kernel32.dll.GetCPInfo",
  1531. "kernel32.dll.GetStdHandle",
  1532. "kernel32.dll.HeapReAlloc",
  1533. "kernel32.dll.HeapDestroy",
  1534. "kernel32.dll.HeapCreate",
  1535. "kernel32.dll.IsDebuggerPresent",
  1536. "kernel32.dll.UnhandledExceptionFilter",
  1537. "kernel32.dll.GetCommandLineA",
  1538. "kernel32.dll.ExitProcess",
  1539. "kernel32.dll.GetSystemTimeAsFileTime",
  1540. "kernel32.dll.LeaveCriticalSection",
  1541. "kernel32.dll.WriteProcessMemory",
  1542. "kernel32.dll.SetEndOfFile",
  1543. "user32.dll.GetWindowThreadProcessId",
  1544. "user32.dll.FindWindowA",
  1545. "advapi32.dll.RegCloseKey",
  1546. "advapi32.dll.AdjustTokenPrivileges",
  1547. "advapi32.dll.OpenSCManagerA",
  1548. "advapi32.dll.RegQueryInfoKeyA",
  1549. "advapi32.dll.RegOpenKeyExA",
  1550. "advapi32.dll.LookupPrivilegeValueW",
  1551. "advapi32.dll.StartServiceA",
  1552. "advapi32.dll.RegEnumKeyExA",
  1553. "advapi32.dll.CreateServiceA",
  1554. "advapi32.dll.RegQueryValueExA",
  1555. "advapi32.dll.OpenProcessToken",
  1556. "advapi32.dll.CloseServiceHandle",
  1557. "advapi32.dll.OpenServiceA",
  1558. "advapi32.dll.CreateProcessAsUserA",
  1559. "shell32.dll.SHGetSpecialFolderPathA",
  1560. "ole32.dll.CoInitialize",
  1561. "ole32.dll.CoCreateGuid",
  1562. "ws2_32.dll.#17",
  1563. "ws2_32.dll.#11",
  1564. "ws2_32.dll.#115",
  1565. "ws2_32.dll.#9",
  1566. "ws2_32.dll.#22",
  1567. "ws2_32.dll.#21",
  1568. "ws2_32.dll.#20",
  1569. "ws2_32.dll.#16",
  1570. "ws2_32.dll.#12",
  1571. "ws2_32.dll.#23",
  1572. "ws2_32.dll.#151",
  1573. "ws2_32.dll.#3",
  1574. "ws2_32.dll.#52",
  1575. "ws2_32.dll.#19",
  1576. "ws2_32.dll.#13",
  1577. "ws2_32.dll.#1",
  1578. "ws2_32.dll.#8",
  1579. "ws2_32.dll.#4",
  1580. "ws2_32.dll.#116",
  1581. "ws2_32.dll.#111",
  1582. "ws2_32.dll.#2",
  1583. "ws2_32.dll.#57",
  1584. "ws2_32.dll.#18",
  1585. "ws2_32.dll.#5",
  1586. "imagehlp.dll.CheckSumMappedFile",
  1587. "urlmon.dll.URLDownloadToFileA",
  1588. "userenv.dll.CreateEnvironmentBlock",
  1589. "userenv.dll.DestroyEnvironmentBlock",
  1590. "iphlpapi.dll.GetAdaptersInfo",
  1591. "shlwapi.dll.StrStrIA",
  1592. "psapi.dll.GetModuleFileNameExW",
  1593. "psapi.dll.EnumProcessModules",
  1594. "psapi.dll.EnumProcesses",
  1595. "cryptbase.dll.SystemFunction036",
  1596. "uxtheme.dll.ThemeInitApiHook",
  1597. "user32.dll.IsProcessDPIAware",
  1598. "sechost.dll.ConvertSidToStringSidW",
  1599. "sspicli.dll.GetUserNameExW",
  1600. "n9huw8o.dll.R0010002",
  1601. "kernel32.dll.RtlPcToFileHeader",
  1602. "kernel32.dll.RtlUnwindEx",
  1603. "kernel32.dll.HeapSetInformation",
  1604. "kernel32.dll.RtlCaptureContext",
  1605. "kernel32.dll.RtlLookupFunctionEntry",
  1606. "kernel32.dll.RtlVirtualUnwind"
  1607. ]
  1608.  
  1609. [*] Static Analysis: {
  1610. "pe": {
  1611. "peid_signatures": null,
  1612. "imports": [
  1613. {
  1614. "imports": [
  1615. {
  1616. "name": "FindResourceA",
  1617. "address": "0x58d000"
  1618. },
  1619. {
  1620. "name": "FreeResource",
  1621. "address": "0x58d004"
  1622. },
  1623. {
  1624. "name": "LoadResource",
  1625. "address": "0x58d008"
  1626. },
  1627. {
  1628. "name": "HeapAlloc",
  1629. "address": "0x58d00c"
  1630. },
  1631. {
  1632. "name": "SetUnhandledExceptionFilter",
  1633. "address": "0x58d010"
  1634. },
  1635. {
  1636. "name": "GetCurrentProcess",
  1637. "address": "0x58d014"
  1638. },
  1639. {
  1640. "name": "HeapFree",
  1641. "address": "0x58d018"
  1642. },
  1643. {
  1644. "name": "GetTickCount",
  1645. "address": "0x58d01c"
  1646. },
  1647. {
  1648. "name": "GetProcessHeap",
  1649. "address": "0x58d020"
  1650. },
  1651. {
  1652. "name": "WideCharToMultiByte",
  1653. "address": "0x58d024"
  1654. },
  1655. {
  1656. "name": "SizeofResource",
  1657. "address": "0x58d028"
  1658. },
  1659. {
  1660. "name": "GetVersionExW",
  1661. "address": "0x58d02c"
  1662. },
  1663. {
  1664. "name": "MultiByteToWideChar",
  1665. "address": "0x58d030"
  1666. },
  1667. {
  1668. "name": "OpenMutexA",
  1669. "address": "0x58d034"
  1670. },
  1671. {
  1672. "name": "LockResource",
  1673. "address": "0x58d038"
  1674. },
  1675. {
  1676. "name": "GetCurrentThreadId",
  1677. "address": "0x58d03c"
  1678. },
  1679. {
  1680. "name": "ReleaseMutex",
  1681. "address": "0x58d040"
  1682. },
  1683. {
  1684. "name": "GetCurrentProcessId",
  1685. "address": "0x58d044"
  1686. },
  1687. {
  1688. "name": "Sleep",
  1689. "address": "0x58d048"
  1690. },
  1691. {
  1692. "name": "TerminateProcess",
  1693. "address": "0x58d04c"
  1694. },
  1695. {
  1696. "name": "SetFileAttributesA",
  1697. "address": "0x58d050"
  1698. },
  1699. {
  1700. "name": "HeapSize",
  1701. "address": "0x58d054"
  1702. },
  1703. {
  1704. "name": "SetEnvironmentVariableA",
  1705. "address": "0x58d058"
  1706. },
  1707. {
  1708. "name": "CompareStringW",
  1709. "address": "0x58d05c"
  1710. },
  1711. {
  1712. "name": "CompareStringA",
  1713. "address": "0x58d060"
  1714. },
  1715. {
  1716. "name": "DeleteFileA",
  1717. "address": "0x58d064"
  1718. },
  1719. {
  1720. "name": "CloseHandle",
  1721. "address": "0x58d068"
  1722. },
  1723. {
  1724. "name": "GetModuleFileNameA",
  1725. "address": "0x58d06c"
  1726. },
  1727. {
  1728. "name": "GetLastError",
  1729. "address": "0x58d070"
  1730. },
  1731. {
  1732. "name": "ReadFile",
  1733. "address": "0x58d074"
  1734. },
  1735. {
  1736. "name": "WriteFile",
  1737. "address": "0x58d078"
  1738. },
  1739. {
  1740. "name": "SetFilePointer",
  1741. "address": "0x58d07c"
  1742. },
  1743. {
  1744. "name": "GetFileSize",
  1745. "address": "0x58d080"
  1746. },
  1747. {
  1748. "name": "CreateFileA",
  1749. "address": "0x58d084"
  1750. },
  1751. {
  1752. "name": "VirtualProtect",
  1753. "address": "0x58d088"
  1754. },
  1755. {
  1756. "name": "InitializeCriticalSection",
  1757. "address": "0x58d08c"
  1758. },
  1759. {
  1760. "name": "GetModuleHandleA",
  1761. "address": "0x58d090"
  1762. },
  1763. {
  1764. "name": "LoadLibraryA",
  1765. "address": "0x58d094"
  1766. },
  1767. {
  1768. "name": "VirtualAlloc",
  1769. "address": "0x58d098"
  1770. },
  1771. {
  1772. "name": "GetProcAddress",
  1773. "address": "0x58d09c"
  1774. },
  1775. {
  1776. "name": "VirtualFree",
  1777. "address": "0x58d0a0"
  1778. },
  1779. {
  1780. "name": "DeleteCriticalSection",
  1781. "address": "0x58d0a4"
  1782. },
  1783. {
  1784. "name": "EnterCriticalSection",
  1785. "address": "0x58d0a8"
  1786. },
  1787. {
  1788. "name": "SetStdHandle",
  1789. "address": "0x58d0ac"
  1790. },
  1791. {
  1792. "name": "WriteConsoleW",
  1793. "address": "0x58d0b0"
  1794. },
  1795. {
  1796. "name": "GetConsoleOutputCP",
  1797. "address": "0x58d0b4"
  1798. },
  1799. {
  1800. "name": "WriteConsoleA",
  1801. "address": "0x58d0b8"
  1802. },
  1803. {
  1804. "name": "GetLocaleInfoA",
  1805. "address": "0x58d0bc"
  1806. },
  1807. {
  1808. "name": "GetStringTypeW",
  1809. "address": "0x58d0c0"
  1810. },
  1811. {
  1812. "name": "GetStringTypeA",
  1813. "address": "0x58d0c4"
  1814. },
  1815. {
  1816. "name": "LCMapStringW",
  1817. "address": "0x58d0c8"
  1818. },
  1819. {
  1820. "name": "LCMapStringA",
  1821. "address": "0x58d0cc"
  1822. },
  1823. {
  1824. "name": "QueryPerformanceCounter",
  1825. "address": "0x58d0d0"
  1826. },
  1827. {
  1828. "name": "GetEnvironmentStringsW",
  1829. "address": "0x58d0d4"
  1830. },
  1831. {
  1832. "name": "FreeEnvironmentStringsW",
  1833. "address": "0x58d0d8"
  1834. },
  1835. {
  1836. "name": "GetEnvironmentStrings",
  1837. "address": "0x58d0dc"
  1838. },
  1839. {
  1840. "name": "FreeEnvironmentStringsA",
  1841. "address": "0x58d0e0"
  1842. },
  1843. {
  1844. "name": "InitializeCriticalSectionAndSpinCount",
  1845. "address": "0x58d0e4"
  1846. },
  1847. {
  1848. "name": "GetTimeZoneInformation",
  1849. "address": "0x58d0e8"
  1850. },
  1851. {
  1852. "name": "RtlUnwind",
  1853. "address": "0x58d0ec"
  1854. },
  1855. {
  1856. "name": "FlushFileBuffers",
  1857. "address": "0x58d0f0"
  1858. },
  1859. {
  1860. "name": "GetConsoleMode",
  1861. "address": "0x58d0f4"
  1862. },
  1863. {
  1864. "name": "GetConsoleCP",
  1865. "address": "0x58d0f8"
  1866. },
  1867. {
  1868. "name": "GetStartupInfoA",
  1869. "address": "0x58d0fc"
  1870. },
  1871. {
  1872. "name": "GetFileType",
  1873. "address": "0x58d100"
  1874. },
  1875. {
  1876. "name": "SetHandleCount",
  1877. "address": "0x58d104"
  1878. },
  1879. {
  1880. "name": "SetLastError",
  1881. "address": "0x58d108"
  1882. },
  1883. {
  1884. "name": "TlsFree",
  1885. "address": "0x58d10c"
  1886. },
  1887. {
  1888. "name": "TlsSetValue",
  1889. "address": "0x58d110"
  1890. },
  1891. {
  1892. "name": "TlsAlloc",
  1893. "address": "0x58d114"
  1894. },
  1895. {
  1896. "name": "TlsGetValue",
  1897. "address": "0x58d118"
  1898. },
  1899. {
  1900. "name": "IsValidCodePage",
  1901. "address": "0x58d11c"
  1902. },
  1903. {
  1904. "name": "GetOEMCP",
  1905. "address": "0x58d120"
  1906. },
  1907. {
  1908. "name": "GetACP",
  1909. "address": "0x58d124"
  1910. },
  1911. {
  1912. "name": "InterlockedDecrement",
  1913. "address": "0x58d128"
  1914. },
  1915. {
  1916. "name": "LeaveCriticalSection",
  1917. "address": "0x58d12c"
  1918. },
  1919. {
  1920. "name": "InterlockedIncrement",
  1921. "address": "0x58d130"
  1922. },
  1923. {
  1924. "name": "GetCPInfo",
  1925. "address": "0x58d134"
  1926. },
  1927. {
  1928. "name": "GetStdHandle",
  1929. "address": "0x58d138"
  1930. },
  1931. {
  1932. "name": "HeapReAlloc",
  1933. "address": "0x58d13c"
  1934. },
  1935. {
  1936. "name": "GetSystemTimeAsFileTime",
  1937. "address": "0x58d140"
  1938. },
  1939. {
  1940. "name": "GetModuleHandleW",
  1941. "address": "0x58d144"
  1942. },
  1943. {
  1944. "name": "ExitProcess",
  1945. "address": "0x58d148"
  1946. },
  1947. {
  1948. "name": "GetCommandLineA",
  1949. "address": "0x58d14c"
  1950. },
  1951. {
  1952. "name": "UnhandledExceptionFilter",
  1953. "address": "0x58d150"
  1954. },
  1955. {
  1956. "name": "IsDebuggerPresent",
  1957. "address": "0x58d154"
  1958. },
  1959. {
  1960. "name": "HeapCreate",
  1961. "address": "0x58d158"
  1962. },
  1963. {
  1964. "name": "SetEndOfFile",
  1965. "address": "0x58d15c"
  1966. }
  1967. ],
  1968. "dll": "KERNEL32.dll"
  1969. },
  1970. {
  1971. "imports": [
  1972. {
  1973. "name": "GetInputState",
  1974. "address": "0x58d164"
  1975. },
  1976. {
  1977. "name": "PostThreadMessageW",
  1978. "address": "0x58d168"
  1979. },
  1980. {
  1981. "name": "GetMessageA",
  1982. "address": "0x58d16c"
  1983. },
  1984. {
  1985. "name": "PostThreadMessageA",
  1986. "address": "0x58d170"
  1987. }
  1988. ],
  1989. "dll": "USER32.dll"
  1990. },
  1991. {
  1992. "imports": [
  1993. {
  1994. "name": "RegQueryInfoKeyA",
  1995. "address": "0x58d178"
  1996. },
  1997. {
  1998. "name": "RegCloseKey",
  1999. "address": "0x58d17c"
  2000. },
  2001. {
  2002. "name": "RegOpenKeyExA",
  2003. "address": "0x58d180"
  2004. },
  2005. {
  2006. "name": "RegEnumKeyExA",
  2007. "address": "0x58d184"
  2008. },
  2009. {
  2010. "name": "RegQueryValueExA",
  2011. "address": "0x58d188"
  2012. }
  2013. ],
  2014. "dll": "ADVAPI32.dll"
  2015. },
  2016. {
  2017. "imports": [
  2018. {
  2019. "name": "inet_addr",
  2020. "address": "0x58d190"
  2021. },
  2022. {
  2023. "name": "gethostbyname",
  2024. "address": "0x58d194"
  2025. },
  2026. {
  2027. "name": "WSAStartup",
  2028. "address": "0x58d198"
  2029. },
  2030. {
  2031. "name": "gethostname",
  2032. "address": "0x58d19c"
  2033. },
  2034. {
  2035. "name": "inet_ntoa",
  2036. "address": "0x58d1a0"
  2037. },
  2038. {
  2039. "name": "WSAGetLastError",
  2040. "address": "0x58d1a4"
  2041. }
  2042. ],
  2043. "dll": "WS2_32.dll"
  2044. },
  2045. {
  2046. "imports": [
  2047. {
  2048. "name": "GetAdaptersInfo",
  2049. "address": "0x58d1ac"
  2050. }
  2051. ],
  2052. "dll": "IPHLPAPI.DLL"
  2053. },
  2054. {
  2055. "imports": [
  2056. {
  2057. "name": "GetFileVersionInfoA",
  2058. "address": "0x58d1b4"
  2059. },
  2060. {
  2061. "name": "GetFileVersionInfoSizeA",
  2062. "address": "0x58d1b8"
  2063. },
  2064. {
  2065. "name": "VerQueryValueA",
  2066. "address": "0x58d1bc"
  2067. }
  2068. ],
  2069. "dll": "VERSION.dll"
  2070. },
  2071. {
  2072. "imports": [
  2073. {
  2074. "name": "LoadLibraryA",
  2075. "address": "0x58d1c4"
  2076. },
  2077. {
  2078. "name": "GetProcAddress",
  2079. "address": "0x58d1c8"
  2080. },
  2081. {
  2082. "name": "GetLastError",
  2083. "address": "0x58d1cc"
  2084. },
  2085. {
  2086. "name": "FreeLibrary",
  2087. "address": "0x58d1d0"
  2088. },
  2089. {
  2090. "name": "InitializeCriticalSection",
  2091. "address": "0x58d1d4"
  2092. },
  2093. {
  2094. "name": "GetModuleFileNameW",
  2095. "address": "0x58d1d8"
  2096. },
  2097. {
  2098. "name": "GetModuleHandleW",
  2099. "address": "0x58d1dc"
  2100. },
  2101. {
  2102. "name": "TerminateProcess",
  2103. "address": "0x58d1e0"
  2104. },
  2105. {
  2106. "name": "GetCurrentProcess",
  2107. "address": "0x58d1e4"
  2108. },
  2109. {
  2110. "name": "DeleteCriticalSection",
  2111. "address": "0x58d1e8"
  2112. },
  2113. {
  2114. "name": "LoadLibraryW",
  2115. "address": "0x58d1ec"
  2116. },
  2117. {
  2118. "name": "CreateEventW",
  2119. "address": "0x58d1f0"
  2120. },
  2121. {
  2122. "name": "CompareStringW",
  2123. "address": "0x58d1f4"
  2124. },
  2125. {
  2126. "name": "SetLastError",
  2127. "address": "0x58d1f8"
  2128. },
  2129. {
  2130. "name": "GetModuleHandleA",
  2131. "address": "0x58d1fc"
  2132. },
  2133. {
  2134. "name": "VirtualProtect",
  2135. "address": "0x58d200"
  2136. },
  2137. {
  2138. "name": "GetTickCount",
  2139. "address": "0x58d204"
  2140. },
  2141. {
  2142. "name": "EnterCriticalSection",
  2143. "address": "0x58d208"
  2144. },
  2145. {
  2146. "name": "LeaveCriticalSection",
  2147. "address": "0x58d20c"
  2148. },
  2149. {
  2150. "name": "VirtualFree",
  2151. "address": "0x58d210"
  2152. },
  2153. {
  2154. "name": "VirtualAlloc",
  2155. "address": "0x58d214"
  2156. },
  2157. {
  2158. "name": "WriteProcessMemory",
  2159. "address": "0x58d218"
  2160. },
  2161. {
  2162. "name": "CreateToolhelp32Snapshot",
  2163. "address": "0x58d21c"
  2164. },
  2165. {
  2166. "name": "GetCurrentProcessId",
  2167. "address": "0x58d220"
  2168. },
  2169. {
  2170. "name": "GetCurrentThreadId",
  2171. "address": "0x58d224"
  2172. },
  2173. {
  2174. "name": "Thread32First",
  2175. "address": "0x58d228"
  2176. },
  2177. {
  2178. "name": "OpenThread",
  2179. "address": "0x58d22c"
  2180. },
  2181. {
  2182. "name": "Thread32Next",
  2183. "address": "0x58d230"
  2184. },
  2185. {
  2186. "name": "CloseHandle",
  2187. "address": "0x58d234"
  2188. },
  2189. {
  2190. "name": "SuspendThread",
  2191. "address": "0x58d238"
  2192. },
  2193. {
  2194. "name": "ResumeThread",
  2195. "address": "0x58d23c"
  2196. },
  2197. {
  2198. "name": "GetSystemInfo",
  2199. "address": "0x58d240"
  2200. },
  2201. {
  2202. "name": "LoadResource",
  2203. "address": "0x58d244"
  2204. },
  2205. {
  2206. "name": "MultiByteToWideChar",
  2207. "address": "0x58d248"
  2208. },
  2209. {
  2210. "name": "WideCharToMultiByte",
  2211. "address": "0x58d24c"
  2212. },
  2213. {
  2214. "name": "FindResourceExW",
  2215. "address": "0x58d250"
  2216. },
  2217. {
  2218. "name": "FindResourceExA",
  2219. "address": "0x58d254"
  2220. },
  2221. {
  2222. "name": "GetThreadLocale",
  2223. "address": "0x58d258"
  2224. },
  2225. {
  2226. "name": "GetUserDefaultLCID",
  2227. "address": "0x58d25c"
  2228. },
  2229. {
  2230. "name": "GetSystemDefaultLCID",
  2231. "address": "0x58d260"
  2232. },
  2233. {
  2234. "name": "EnumResourceNamesA",
  2235. "address": "0x58d264"
  2236. },
  2237. {
  2238. "name": "EnumResourceNamesW",
  2239. "address": "0x58d268"
  2240. },
  2241. {
  2242. "name": "EnumResourceLanguagesA",
  2243. "address": "0x58d26c"
  2244. },
  2245. {
  2246. "name": "EnumResourceLanguagesW",
  2247. "address": "0x58d270"
  2248. },
  2249. {
  2250. "name": "EnumResourceTypesA",
  2251. "address": "0x58d274"
  2252. },
  2253. {
  2254. "name": "EnumResourceTypesW",
  2255. "address": "0x58d278"
  2256. },
  2257. {
  2258. "name": "HeapAlloc",
  2259. "address": "0x58d27c"
  2260. },
  2261. {
  2262. "name": "HeapFree",
  2263. "address": "0x58d280"
  2264. },
  2265. {
  2266. "name": "HeapDestroy",
  2267. "address": "0x58d284"
  2268. },
  2269. {
  2270. "name": "HeapCreate",
  2271. "address": "0x58d288"
  2272. },
  2273. {
  2274. "name": "GetSystemTime",
  2275. "address": "0x58d28c"
  2276. },
  2277. {
  2278. "name": "GetLocalTime",
  2279. "address": "0x58d290"
  2280. },
  2281. {
  2282. "name": "SystemTimeToFileTime",
  2283. "address": "0x58d294"
  2284. },
  2285. {
  2286. "name": "CompareFileTime",
  2287. "address": "0x58d298"
  2288. },
  2289. {
  2290. "name": "GetCommandLineA",
  2291. "address": "0x58d29c"
  2292. },
  2293. {
  2294. "name": "GetCPInfo",
  2295. "address": "0x58d2a0"
  2296. },
  2297. {
  2298. "name": "InterlockedIncrement",
  2299. "address": "0x58d2a4"
  2300. },
  2301. {
  2302. "name": "InterlockedDecrement",
  2303. "address": "0x58d2a8"
  2304. },
  2305. {
  2306. "name": "GetACP",
  2307. "address": "0x58d2ac"
  2308. },
  2309. {
  2310. "name": "GetOEMCP",
  2311. "address": "0x58d2b0"
  2312. },
  2313. {
  2314. "name": "IsValidCodePage",
  2315. "address": "0x58d2b4"
  2316. },
  2317. {
  2318. "name": "TlsGetValue",
  2319. "address": "0x58d2b8"
  2320. },
  2321. {
  2322. "name": "TlsAlloc",
  2323. "address": "0x58d2bc"
  2324. },
  2325. {
  2326. "name": "TlsSetValue",
  2327. "address": "0x58d2c0"
  2328. },
  2329. {
  2330. "name": "TlsFree",
  2331. "address": "0x58d2c4"
  2332. },
  2333. {
  2334. "name": "LCMapStringA",
  2335. "address": "0x58d2c8"
  2336. },
  2337. {
  2338. "name": "LCMapStringW",
  2339. "address": "0x58d2cc"
  2340. },
  2341. {
  2342. "name": "UnhandledExceptionFilter",
  2343. "address": "0x58d2d0"
  2344. },
  2345. {
  2346. "name": "SetUnhandledExceptionFilter",
  2347. "address": "0x58d2d4"
  2348. },
  2349. {
  2350. "name": "IsDebuggerPresent",
  2351. "address": "0x58d2d8"
  2352. },
  2353. {
  2354. "name": "WriteFile",
  2355. "address": "0x58d2dc"
  2356. },
  2357. {
  2358. "name": "GetStdHandle",
  2359. "address": "0x58d2e0"
  2360. },
  2361. {
  2362. "name": "GetModuleFileNameA",
  2363. "address": "0x58d2e4"
  2364. },
  2365. {
  2366. "name": "RaiseException",
  2367. "address": "0x58d2e8"
  2368. },
  2369. {
  2370. "name": "Sleep",
  2371. "address": "0x58d2ec"
  2372. },
  2373. {
  2374. "name": "ExitProcess",
  2375. "address": "0x58d2f0"
  2376. },
  2377. {
  2378. "name": "SetHandleCount",
  2379. "address": "0x58d2f4"
  2380. },
  2381. {
  2382. "name": "GetFileType",
  2383. "address": "0x58d2f8"
  2384. },
  2385. {
  2386. "name": "GetStartupInfoA",
  2387. "address": "0x58d2fc"
  2388. },
  2389. {
  2390. "name": "FreeEnvironmentStringsA",
  2391. "address": "0x58d300"
  2392. },
  2393. {
  2394. "name": "GetEnvironmentStrings",
  2395. "address": "0x58d304"
  2396. },
  2397. {
  2398. "name": "FreeEnvironmentStringsW",
  2399. "address": "0x58d308"
  2400. },
  2401. {
  2402. "name": "GetEnvironmentStringsW",
  2403. "address": "0x58d30c"
  2404. },
  2405. {
  2406. "name": "QueryPerformanceCounter",
  2407. "address": "0x58d310"
  2408. },
  2409. {
  2410. "name": "GetSystemTimeAsFileTime",
  2411. "address": "0x58d314"
  2412. },
  2413. {
  2414. "name": "HeapReAlloc",
  2415. "address": "0x58d318"
  2416. },
  2417. {
  2418. "name": "GetStringTypeA",
  2419. "address": "0x58d31c"
  2420. },
  2421. {
  2422. "name": "GetStringTypeW",
  2423. "address": "0x58d320"
  2424. },
  2425. {
  2426. "name": "GetLocaleInfoA",
  2427. "address": "0x58d324"
  2428. },
  2429. {
  2430. "name": "RtlUnwind",
  2431. "address": "0x58d328"
  2432. },
  2433. {
  2434. "name": "HeapSize",
  2435. "address": "0x58d32c"
  2436. },
  2437. {
  2438. "name": "SetFilePointer",
  2439. "address": "0x58d330"
  2440. },
  2441. {
  2442. "name": "GetConsoleCP",
  2443. "address": "0x58d334"
  2444. },
  2445. {
  2446. "name": "GetConsoleMode",
  2447. "address": "0x58d338"
  2448. },
  2449. {
  2450. "name": "InitializeCriticalSectionAndSpinCount",
  2451. "address": "0x58d33c"
  2452. },
  2453. {
  2454. "name": "SetStdHandle",
  2455. "address": "0x58d340"
  2456. },
  2457. {
  2458. "name": "WriteConsoleA",
  2459. "address": "0x58d344"
  2460. },
  2461. {
  2462. "name": "GetConsoleOutputCP",
  2463. "address": "0x58d348"
  2464. },
  2465. {
  2466. "name": "WriteConsoleW",
  2467. "address": "0x58d34c"
  2468. },
  2469. {
  2470. "name": "CreateFileA",
  2471. "address": "0x58d350"
  2472. },
  2473. {
  2474. "name": "FlushFileBuffers",
  2475. "address": "0x58d354"
  2476. },
  2477. {
  2478. "name": "VirtualQuery",
  2479. "address": "0x58d358"
  2480. }
  2481. ],
  2482. "dll": "KERNEL32.dll"
  2483. },
  2484. {
  2485. "imports": [
  2486. {
  2487. "name": "MessageBoxW",
  2488. "address": "0x58d360"
  2489. },
  2490. {
  2491. "name": "CharUpperBuffW",
  2492. "address": "0x58d364"
  2493. }
  2494. ],
  2495. "dll": "USER32.dll"
  2496. },
  2497. {
  2498. "imports": [
  2499. {
  2500. "name": "GetModuleFileNameW",
  2501. "address": "0x58d36c"
  2502. }
  2503. ],
  2504. "dll": "KERNEL32.dll"
  2505. },
  2506. {
  2507. "imports": [
  2508. {
  2509. "name": "GetModuleHandleA",
  2510. "address": "0x58d374"
  2511. },
  2512. {
  2513. "name": "LoadLibraryA",
  2514. "address": "0x58d378"
  2515. },
  2516. {
  2517. "name": "LocalAlloc",
  2518. "address": "0x58d37c"
  2519. },
  2520. {
  2521. "name": "LocalFree",
  2522. "address": "0x58d380"
  2523. },
  2524. {
  2525. "name": "GetModuleFileNameA",
  2526. "address": "0x58d384"
  2527. },
  2528. {
  2529. "name": "ExitProcess",
  2530. "address": "0x58d388"
  2531. }
  2532. ],
  2533. "dll": "KERNEL32.dll"
  2534. }
  2535. ],
  2536. "digital_signers": null,
  2537. "exported_dll_name": "",
  2538. "actual_checksum": "0x0019ebac",
  2539. "overlay": null,
  2540. "imagebase": "0x00400000",
  2541. "reported_checksum": "0x0019ebac",
  2542. "icon_hash": null,
  2543. "entrypoint": "0x00583a27",
  2544. "timestamp": "2018-11-24 02:02:51",
  2545. "osversion": "5.0",
  2546. "sections": [
  2547. {
  2548. "name": ".text",
  2549. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2550. "virtual_address": "0x00001000",
  2551. "size_of_data": "0x0001e000",
  2552. "entropy": "6.52",
  2553. "raw_address": "0x00000400",
  2554. "virtual_size": "0x0001de52",
  2555. "characteristics_raw": "0x60000020"
  2556. },
  2557. {
  2558. "name": ".rdata",
  2559. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2560. "virtual_address": "0x0001f000",
  2561. "size_of_data": "0x00008200",
  2562. "entropy": "6.61",
  2563. "raw_address": "0x0001e400",
  2564. "virtual_size": "0x000081b2",
  2565. "characteristics_raw": "0x40000040"
  2566. },
  2567. {
  2568. "name": ".data",
  2569. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2570. "virtual_address": "0x00028000",
  2571. "size_of_data": "0x00001a00",
  2572. "entropy": "3.74",
  2573. "raw_address": "0x00026600",
  2574. "virtual_size": "0x000036c4",
  2575. "characteristics_raw": "0xc0000040"
  2576. },
  2577. {
  2578. "name": ".vmp0",
  2579. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2580. "virtual_address": "0x0002c000",
  2581. "size_of_data": "0x00155800",
  2582. "entropy": "7.86",
  2583. "raw_address": "0x00028000",
  2584. "virtual_size": "0x001556a4",
  2585. "characteristics_raw": "0xe0000060"
  2586. },
  2587. {
  2588. "name": ".tls",
  2589. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2590. "virtual_address": "0x00182000",
  2591. "size_of_data": "0x00000200",
  2592. "entropy": "0.00",
  2593. "raw_address": "0x0017d800",
  2594. "virtual_size": "0x00000018",
  2595. "characteristics_raw": "0xc0000040"
  2596. },
  2597. {
  2598. "name": ".vmp1",
  2599. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2600. "virtual_address": "0x00183000",
  2601. "size_of_data": "0x00011400",
  2602. "entropy": "7.48",
  2603. "raw_address": "0x0017da00",
  2604. "virtual_size": "0x00011252",
  2605. "characteristics_raw": "0xe0000060"
  2606. },
  2607. {
  2608. "name": ".reloc",
  2609. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2610. "virtual_address": "0x00195000",
  2611. "size_of_data": "0x00002600",
  2612. "entropy": "6.45",
  2613. "raw_address": "0x0018ee00",
  2614. "virtual_size": "0x00002514",
  2615. "characteristics_raw": "0x40000040"
  2616. },
  2617. {
  2618. "name": ".rsrc",
  2619. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2620. "virtual_address": "0x00198000",
  2621. "size_of_data": "0x00000400",
  2622. "entropy": "3.91",
  2623. "raw_address": "0x00191400",
  2624. "virtual_size": "0x00000352",
  2625. "characteristics_raw": "0x40000040"
  2626. }
  2627. ],
  2628. "resources": [],
  2629. "dirents": [
  2630. {
  2631. "virtual_address": "0x00180a54",
  2632. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2633. "size": "0x00000c50"
  2634. },
  2635. {
  2636. "virtual_address": "0x00185090",
  2637. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2638. "size": "0x000000dc"
  2639. },
  2640. {
  2641. "virtual_address": "0x00198000",
  2642. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2643. "size": "0x00000352"
  2644. },
  2645. {
  2646. "virtual_address": "0x00000000",
  2647. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2648. "size": "0x00000000"
  2649. },
  2650. {
  2651. "virtual_address": "0x00000000",
  2652. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2653. "size": "0x00000000"
  2654. },
  2655. {
  2656. "virtual_address": "0x00195000",
  2657. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2658. "size": "0x00002514"
  2659. },
  2660. {
  2661. "virtual_address": "0x00000000",
  2662. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2663. "size": "0x00000000"
  2664. },
  2665. {
  2666. "virtual_address": "0x00000000",
  2667. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2668. "size": "0x00000000"
  2669. },
  2670. {
  2671. "virtual_address": "0x00000000",
  2672. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2673. "size": "0x00000000"
  2674. },
  2675. {
  2676. "virtual_address": "0x00186458",
  2677. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2678. "size": "0x00000020"
  2679. },
  2680. {
  2681. "virtual_address": "0x00026270",
  2682. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2683. "size": "0x00000040"
  2684. },
  2685. {
  2686. "virtual_address": "0x00000000",
  2687. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2688. "size": "0x00000000"
  2689. },
  2690. {
  2691. "virtual_address": "0x0018d000",
  2692. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2693. "size": "0x00000390"
  2694. },
  2695. {
  2696. "virtual_address": "0x00000000",
  2697. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2698. "size": "0x00000000"
  2699. },
  2700. {
  2701. "virtual_address": "0x00000000",
  2702. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2703. "size": "0x00000000"
  2704. },
  2705. {
  2706. "virtual_address": "0x00000000",
  2707. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2708. "size": "0x00000000"
  2709. }
  2710. ],
  2711. "exports": [],
  2712. "guest_signers": {},
  2713. "imphash": "2c4b653e617da18516332d4c0ab46237",
  2714. "icon_fuzzy": null,
  2715. "icon": null,
  2716. "pdbpath": null,
  2717. "imported_dll_count": 10,
  2718. "versioninfo": []
  2719. }
  2720. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!