API tools faq
paste
paladin316

Exes_40af159514e23e00ca5b7dc3595cae5c_exe_2019-06-30_15_30.json

paladin316
Jun 30th, 2019
3,749
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 44.37 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_40af159514e23e00ca5b7dc3595cae5c.exe"
  7. [*] File Size: 402432
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows"
  9. [*] SHA256: "23880ddd521e14b28a7b0ccae1030fbf0cdeb341102fc27f429953e6cf7ca563"
  10. [*] MD5: "40af159514e23e00ca5b7dc3595cae5c"
  11. [*] SHA1: "79963fae3a08818c1ed7d4e3ececa982a3a77a5f"
  12. [*] SHA512: "78599ab90006791f73dcc2bafdc291d625e8f79677a8b460a690ca57a3b63b680c569a2caaab42a26ff9c30df2908bad0e5e08da5641b56b585de6abc6c102e6"
  13. [*] CRC32: "FD35A016"
  14. [*] SSDEEP: "6144:lJXD+oaKU0uLm4fwxSW0ObbZA/CZ7o/iF9uhthLf2YDX:ld+oG3i4I0W0MZiiAinmLf"
  15.  
  16. [*] Process Execution: [
  17. "Exes_40af159514e23e00ca5b7dc3595cae5c.exe",
  18. "rundll32.exe",
  19. "chrome.exe"
  20. ]
  21.  
  22. [*] Signatures Detected: [
  23. {
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details": [
  26. {
  27. "process": "Exes_40af159514e23e00ca5b7dc3595cae5c.exe, PID 1380"
  28. }
  29. ]
  30. },
  31. {
  32. "Description": "A process created a hidden window",
  33. "Details": [
  34. {
  35. "Process": "Exes_40af159514e23e00ca5b7dc3595cae5c.exe -> rundll32.exe"
  36. },
  37. {
  38. "Process": "rundll32.exe -> http://193.112.91.174:1745/123.html"
  39. },
  40. {
  41. "Process": "rundll32.exe -> http://193.112.91.174:1745/123.html"
  42. }
  43. ]
  44. },
  45. {
  46. "Description": "File has been identified by 16 Antiviruses on VirusTotal as malicious",
  47. "Details": [
  48. {
  49. "MicroWorld-eScan": "Trojan.GenericKD.32077232"
  50. },
  51. {
  52. "McAfee": "Artemis!40AF159514E2"
  53. },
  54. {
  55. "Arcabit": "Trojan.Generic.D1E975B0"
  56. },
  57. {
  58. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  59. },
  60. {
  61. "BitDefender": "Trojan.GenericKD.32077232"
  62. },
  63. {
  64. "AegisLab": "Trojan.Multi.Generic.4!c"
  65. },
  66. {
  67. "Ad-Aware": "Trojan.GenericKD.32077232"
  68. },
  69. {
  70. "McAfee-GW-Edition": "BehavesLike.Win32.Ramnit.fm"
  71. },
  72. {
  73. "FireEye": "Trojan.GenericKD.32077232"
  74. },
  75. {
  76. "Emsisoft": "Trojan.GenericKD.32077232 (B)"
  77. },
  78. {
  79. "MAX": "malware (ai score=85)"
  80. },
  81. {
  82. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  83. },
  84. {
  85. "GData": "Trojan.GenericKD.32077232"
  86. },
  87. {
  88. "ALYac": "Trojan.GenericKD.32077232"
  89. },
  90. {
  91. "Cylance": "Unsafe"
  92. },
  93. {
  94. "Qihoo-360": "Trojan.Generic"
  95. }
  96. ]
  97. }
  98. ]
  99.  
  100. [*] Started Service: []
  101.  
  102. [*] Executed Commands: [
  103. "rundll32.exe url.dll,FileProtocolHandler http://193.112.91.174:1745/123.html",
  104. "http://193.112.91.174:1745/123.html "
  105. ]
  106.  
  107. [*] Mutexes: []
  108.  
  109. [*] Modified Files: [
  110. "C:\\Program Files (x86)\\Google\\Chrome\\Application\\debug.log"
  111. ]
  112.  
  113. [*] Deleted Files: []
  114.  
  115. [*] Modified Registry Keys: []
  116.  
  117. [*] Deleted Registry Keys: []
  118.  
  119. [*] DNS Communications: []
  120.  
  121. [*] Domains: []
  122.  
  123. [*] Network Communication - ICMP: []
  124.  
  125. [*] Network Communication - HTTP: []
  126.  
  127. [*] Network Communication - SMTP: []
  128.  
  129. [*] Network Communication - Hosts: []
  130.  
  131. [*] Network Communication - IRC: []
  132.  
  133. [*] Static Analysis: {
  134. "pe": {
  135. "peid_signatures": [
  136. [
  137. "Microsoft Visual C++ V8.0 (Debug)"
  138. ]
  139. ],
  140. "imports": [
  141. {
  142. "imports": [
  143. {
  144. "name": "ShellExecuteA",
  145. "address": "0x4863d4"
  146. }
  147. ],
  148. "dll": "SHELL32.dll"
  149. },
  150. {
  151. "imports": [
  152. {
  153. "name": "SetLastError",
  154. "address": "0x486220"
  155. },
  156. {
  157. "name": "FlushFileBuffers",
  158. "address": "0x486224"
  159. },
  160. {
  161. "name": "GetCommandLineA",
  162. "address": "0x486228"
  163. },
  164. {
  165. "name": "HeapSetInformation",
  166. "address": "0x48622c"
  167. },
  168. {
  169. "name": "InitializeCriticalSectionAndSpinCount",
  170. "address": "0x486230"
  171. },
  172. {
  173. "name": "DeleteCriticalSection",
  174. "address": "0x486234"
  175. },
  176. {
  177. "name": "EnterCriticalSection",
  178. "address": "0x486238"
  179. },
  180. {
  181. "name": "LeaveCriticalSection",
  182. "address": "0x48623c"
  183. },
  184. {
  185. "name": "FatalAppExitA",
  186. "address": "0x486240"
  187. },
  188. {
  189. "name": "HeapValidate",
  190. "address": "0x486244"
  191. },
  192. {
  193. "name": "IsBadReadPtr",
  194. "address": "0x486248"
  195. },
  196. {
  197. "name": "GetModuleFileNameW",
  198. "address": "0x48624c"
  199. },
  200. {
  201. "name": "WideCharToMultiByte",
  202. "address": "0x486250"
  203. },
  204. {
  205. "name": "IsDebuggerPresent",
  206. "address": "0x486254"
  207. },
  208. {
  209. "name": "MultiByteToWideChar",
  210. "address": "0x486258"
  211. },
  212. {
  213. "name": "RaiseException",
  214. "address": "0x48625c"
  215. },
  216. {
  217. "name": "lstrlenA",
  218. "address": "0x486260"
  219. },
  220. {
  221. "name": "GetProcAddress",
  222. "address": "0x486264"
  223. },
  224. {
  225. "name": "LoadLibraryW",
  226. "address": "0x486268"
  227. },
  228. {
  229. "name": "SetUnhandledExceptionFilter",
  230. "address": "0x48626c"
  231. },
  232. {
  233. "name": "QueryPerformanceCounter",
  234. "address": "0x486270"
  235. },
  236. {
  237. "name": "GetTickCount",
  238. "address": "0x486274"
  239. },
  240. {
  241. "name": "GetCurrentThreadId",
  242. "address": "0x486278"
  243. },
  244. {
  245. "name": "GetCurrentProcessId",
  246. "address": "0x48627c"
  247. },
  248. {
  249. "name": "GetSystemTimeAsFileTime",
  250. "address": "0x486280"
  251. },
  252. {
  253. "name": "InterlockedIncrement",
  254. "address": "0x486284"
  255. },
  256. {
  257. "name": "InterlockedDecrement",
  258. "address": "0x486288"
  259. },
  260. {
  261. "name": "DecodePointer",
  262. "address": "0x48628c"
  263. },
  264. {
  265. "name": "GetModuleHandleW",
  266. "address": "0x486290"
  267. },
  268. {
  269. "name": "ExitProcess",
  270. "address": "0x486294"
  271. },
  272. {
  273. "name": "GetModuleFileNameA",
  274. "address": "0x486298"
  275. },
  276. {
  277. "name": "FreeEnvironmentStringsW",
  278. "address": "0x48629c"
  279. },
  280. {
  281. "name": "GetEnvironmentStringsW",
  282. "address": "0x4862a0"
  283. },
  284. {
  285. "name": "SetHandleCount",
  286. "address": "0x4862a4"
  287. },
  288. {
  289. "name": "GetStdHandle",
  290. "address": "0x4862a8"
  291. },
  292. {
  293. "name": "GetFileType",
  294. "address": "0x4862ac"
  295. },
  296. {
  297. "name": "GetStartupInfoW",
  298. "address": "0x4862b0"
  299. },
  300. {
  301. "name": "EncodePointer",
  302. "address": "0x4862b4"
  303. },
  304. {
  305. "name": "TlsAlloc",
  306. "address": "0x4862b8"
  307. },
  308. {
  309. "name": "TlsGetValue",
  310. "address": "0x4862bc"
  311. },
  312. {
  313. "name": "TlsSetValue",
  314. "address": "0x4862c0"
  315. },
  316. {
  317. "name": "TlsFree",
  318. "address": "0x4862c4"
  319. },
  320. {
  321. "name": "GetLastError",
  322. "address": "0x4862c8"
  323. },
  324. {
  325. "name": "GetCurrentThread",
  326. "address": "0x4862cc"
  327. },
  328. {
  329. "name": "HeapCreate",
  330. "address": "0x4862d0"
  331. },
  332. {
  333. "name": "HeapDestroy",
  334. "address": "0x4862d4"
  335. },
  336. {
  337. "name": "WriteFile",
  338. "address": "0x4862d8"
  339. },
  340. {
  341. "name": "HeapAlloc",
  342. "address": "0x4862dc"
  343. },
  344. {
  345. "name": "HeapReAlloc",
  346. "address": "0x4862e0"
  347. },
  348. {
  349. "name": "HeapSize",
  350. "address": "0x4862e4"
  351. },
  352. {
  353. "name": "HeapQueryInformation",
  354. "address": "0x4862e8"
  355. },
  356. {
  357. "name": "TerminateProcess",
  358. "address": "0x4862ec"
  359. },
  360. {
  361. "name": "GetCurrentProcess",
  362. "address": "0x4862f0"
  363. },
  364. {
  365. "name": "UnhandledExceptionFilter",
  366. "address": "0x4862f4"
  367. },
  368. {
  369. "name": "HeapFree",
  370. "address": "0x4862f8"
  371. },
  372. {
  373. "name": "GetACP",
  374. "address": "0x4862fc"
  375. },
  376. {
  377. "name": "GetOEMCP",
  378. "address": "0x486300"
  379. },
  380. {
  381. "name": "GetCPInfo",
  382. "address": "0x486304"
  383. },
  384. {
  385. "name": "IsValidCodePage",
  386. "address": "0x486308"
  387. },
  388. {
  389. "name": "OutputDebugStringA",
  390. "address": "0x48630c"
  391. },
  392. {
  393. "name": "WriteConsoleW",
  394. "address": "0x486310"
  395. },
  396. {
  397. "name": "OutputDebugStringW",
  398. "address": "0x486314"
  399. },
  400. {
  401. "name": "SetConsoleCtrlHandler",
  402. "address": "0x486318"
  403. },
  404. {
  405. "name": "RtlUnwind",
  406. "address": "0x48631c"
  407. },
  408. {
  409. "name": "GetProcessHeap",
  410. "address": "0x486320"
  411. },
  412. {
  413. "name": "VirtualQuery",
  414. "address": "0x486324"
  415. },
  416. {
  417. "name": "FreeLibrary",
  418. "address": "0x486328"
  419. },
  420. {
  421. "name": "InterlockedExchange",
  422. "address": "0x48632c"
  423. },
  424. {
  425. "name": "GetLocaleInfoW",
  426. "address": "0x486330"
  427. },
  428. {
  429. "name": "IsProcessorFeaturePresent",
  430. "address": "0x486334"
  431. },
  432. {
  433. "name": "LCMapStringW",
  434. "address": "0x486338"
  435. },
  436. {
  437. "name": "GetStringTypeW",
  438. "address": "0x48633c"
  439. },
  440. {
  441. "name": "SetFilePointer",
  442. "address": "0x486340"
  443. },
  444. {
  445. "name": "GetConsoleCP",
  446. "address": "0x486344"
  447. },
  448. {
  449. "name": "GetConsoleMode",
  450. "address": "0x486348"
  451. },
  452. {
  453. "name": "GetLocaleInfoA",
  454. "address": "0x48634c"
  455. },
  456. {
  457. "name": "IsValidLocale",
  458. "address": "0x486350"
  459. },
  460. {
  461. "name": "EnumSystemLocalesA",
  462. "address": "0x486354"
  463. },
  464. {
  465. "name": "GetUserDefaultLCID",
  466. "address": "0x486358"
  467. },
  468. {
  469. "name": "SetStdHandle",
  470. "address": "0x48635c"
  471. },
  472. {
  473. "name": "CreateFileW",
  474. "address": "0x486360"
  475. },
  476. {
  477. "name": "CloseHandle",
  478. "address": "0x486364"
  479. }
  480. ],
  481. "dll": "KERNEL32.dll"
  482. }
  483. ],
  484. "digital_signers": null,
  485. "exported_dll_name": null,
  486. "actual_checksum": "0x00070298",
  487. "overlay": null,
  488. "imagebase": "0x00400000",
  489. "reported_checksum": "0x00000000",
  490. "icon_hash": null,
  491. "entrypoint": "0x00425a23",
  492. "timestamp": "2019-05-23 16:37:33",
  493. "osversion": "5.1",
  494. "sections": [
  495. {
  496. "name": ".textbss",
  497. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  498. "virtual_address": "0x00001000",
  499. "size_of_data": "0x00000000",
  500. "entropy": "0.00",
  501. "raw_address": "0x00000000",
  502. "virtual_size": "0x00023f1d",
  503. "characteristics_raw": "0xe00000a0"
  504. },
  505. {
  506. "name": ".text",
  507. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  508. "virtual_address": "0x00025000",
  509. "size_of_data": "0x0004cc00",
  510. "entropy": "5.51",
  511. "raw_address": "0x00000400",
  512. "virtual_size": "0x0004cb7d",
  513. "characteristics_raw": "0x60000020"
  514. },
  515. {
  516. "name": ".rdata",
  517. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  518. "virtual_address": "0x00072000",
  519. "size_of_data": "0x0000f800",
  520. "entropy": "3.58",
  521. "raw_address": "0x0004d000",
  522. "virtual_size": "0x0000f6cc",
  523. "characteristics_raw": "0x40000040"
  524. },
  525. {
  526. "name": ".data",
  527. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  528. "virtual_address": "0x00082000",
  529. "size_of_data": "0x00001400",
  530. "entropy": "2.10",
  531. "raw_address": "0x0005c800",
  532. "virtual_size": "0x00003918",
  533. "characteristics_raw": "0xc0000040"
  534. },
  535. {
  536. "name": ".idata",
  537. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  538. "virtual_address": "0x00086000",
  539. "size_of_data": "0x00000c00",
  540. "entropy": "4.46",
  541. "raw_address": "0x0005dc00",
  542. "virtual_size": "0x00000bbc",
  543. "characteristics_raw": "0xc0000040"
  544. },
  545. {
  546. "name": ".rsrc",
  547. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  548. "virtual_address": "0x00087000",
  549. "size_of_data": "0x00000600",
  550. "entropy": "3.29",
  551. "raw_address": "0x0005e800",
  552. "virtual_size": "0x00000596",
  553. "characteristics_raw": "0x40000040"
  554. },
  555. {
  556. "name": ".reloc",
  557. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  558. "virtual_address": "0x00088000",
  559. "size_of_data": "0x00003600",
  560. "entropy": "6.26",
  561. "raw_address": "0x0005ee00",
  562. "virtual_size": "0x000035f9",
  563. "characteristics_raw": "0x42000040"
  564. }
  565. ],
  566. "resources": [],
  567. "dirents": [
  568. {
  569. "virtual_address": "0x00000000",
  570. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  571. "size": "0x00000000"
  572. },
  573. {
  574. "virtual_address": "0x00086000",
  575. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  576. "size": "0x0000003c"
  577. },
  578. {
  579. "virtual_address": "0x00087000",
  580. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  581. "size": "0x00000596"
  582. },
  583. {
  584. "virtual_address": "0x00000000",
  585. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  586. "size": "0x00000000"
  587. },
  588. {
  589. "virtual_address": "0x00000000",
  590. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  591. "size": "0x00000000"
  592. },
  593. {
  594. "virtual_address": "0x00088000",
  595. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  596. "size": "0x00002ea8"
  597. },
  598. {
  599. "virtual_address": "0x00072d60",
  600. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  601. "size": "0x0000001c"
  602. },
  603. {
  604. "virtual_address": "0x00000000",
  605. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  606. "size": "0x00000000"
  607. },
  608. {
  609. "virtual_address": "0x00000000",
  610. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  611. "size": "0x00000000"
  612. },
  613. {
  614. "virtual_address": "0x00000000",
  615. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  616. "size": "0x00000000"
  617. },
  618. {
  619. "virtual_address": "0x00000000",
  620. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  621. "size": "0x00000000"
  622. },
  623. {
  624. "virtual_address": "0x00000000",
  625. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  626. "size": "0x00000000"
  627. },
  628. {
  629. "virtual_address": "0x00086220",
  630. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  631. "size": "0x000001e4"
  632. },
  633. {
  634. "virtual_address": "0x00000000",
  635. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  636. "size": "0x00000000"
  637. },
  638. {
  639. "virtual_address": "0x00000000",
  640. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  641. "size": "0x00000000"
  642. },
  643. {
  644. "virtual_address": "0x00000000",
  645. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  646. "size": "0x00000000"
  647. }
  648. ],
  649. "exports": [],
  650. "guest_signers": {},
  651. "imphash": "f0511018ed7de8ba155602b7972cb706",
  652. "icon_fuzzy": null,
  653. "icon": null,
  654. "pdbpath": "D:\\360\\xe6\\x9e\\x81\\xe9\\x80\\x9f\\xe6\\xb5\\x8f\\xe8\\xa7\\x88\\xe5\\x99\\xa8\\xe4\\xb8\\x8b\\xe8\\xbd\\xbd\\BPDownload-master\\Classes\\QQQQQQQQQQQQ\\Debug\\QQQQQQQQQQQQ.pdb",
  655. "imported_dll_count": 2,
  656. "versioninfo": []
  657. }
  658. }
  659.  
  660. [*] Resolved APIs: [
  661. "kernel32.dll.FlsAlloc",
  662. "kernel32.dll.FlsGetValue",
  663. "kernel32.dll.FlsSetValue",
  664. "kernel32.dll.FlsFree",
  665. "kernel32.dll.SortGetHandle",
  666. "kernel32.dll.SortCloseHandle",
  667. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  668. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  669. "comctl32.dll.#332",
  670. "comctl32.dll.#386",
  671. "advapi32.dll.UnregisterTraceGuids",
  672. "comctl32.dll.#321",
  673. "url.dll.FileProtocolHandlerA",
  674. "uxtheme.dll.ThemeInitApiHook",
  675. "user32.dll.IsProcessDPIAware",
  676. "dwmapi.dll.DwmIsCompositionEnabled",
  677. "ole32.dll.OleInitialize",
  678. "cryptbase.dll.SystemFunction036",
  679. "ole32.dll.CreateBindCtx",
  680. "ole32.dll.CoTaskMemAlloc",
  681. "propsys.dll.PSCreateMemoryPropertyStore",
  682. "propsys.dll.PSPropertyBag_WriteDWORD",
  683. "ole32.dll.CoGetApartmentType",
  684. "ole32.dll.CoRegisterInitializeSpy",
  685. "ole32.dll.CoTaskMemFree",
  686. "comctl32.dll.#236",
  687. "oleaut32.dll.#6",
  688. "ole32.dll.CoGetMalloc",
  689. "propsys.dll.PSPropertyBag_ReadDWORD",
  690. "propsys.dll.PSPropertyBag_ReadGUID",
  691. "comctl32.dll.#320",
  692. "comctl32.dll.#324",
  693. "comctl32.dll.#323",
  694. "advapi32.dll.RegEnumKeyW",
  695. "advapi32.dll.OpenThreadToken",
  696. "ole32.dll.StringFromGUID2",
  697. "apphelp.dll.ApphelpCheckShellObject",
  698. "ole32.dll.CoCreateInstance",
  699. "urlmon.dll.CreateUri",
  700. "kernel32.dll.InitializeSRWLock",
  701. "kernel32.dll.AcquireSRWLockExclusive",
  702. "kernel32.dll.AcquireSRWLockShared",
  703. "kernel32.dll.ReleaseSRWLockExclusive",
  704. "kernel32.dll.ReleaseSRWLockShared",
  705. "urlmon.dll.#397",
  706. "urlmon.dll.#441",
  707. "urlmon.dll.#395",
  708. "ole32.dll.OleUninitialize",
  709. "ole32.dll.CoRevokeInitializeSpy",
  710. "comctl32.dll.#388",
  711. "oleaut32.dll.#500",
  712. "kernel32.dll.InitializeCriticalSectionEx",
  713. "kernel32.dll.LCMapStringEx",
  714. "api-ms-win-core-synch-l1-2-0.dll.InitializeConditionVariable",
  715. "api-ms-win-core-synch-l1-2-0.dll.SleepConditionVariableCS",
  716. "api-ms-win-core-synch-l1-2-0.dll.WakeAllConditionVariable",
  717. "kernel32.dll.InitOnceExecuteOnce",
  718. "kernel32.dll.CreateEventExW",
  719. "kernel32.dll.CreateSemaphoreW",
  720. "kernel32.dll.CreateSemaphoreExW",
  721. "kernel32.dll.CreateThreadpoolTimer",
  722. "kernel32.dll.SetThreadpoolTimer",
  723. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  724. "kernel32.dll.CloseThreadpoolTimer",
  725. "kernel32.dll.CreateThreadpoolWait",
  726. "kernel32.dll.SetThreadpoolWait",
  727. "kernel32.dll.CloseThreadpoolWait",
  728. "kernel32.dll.FlushProcessWriteBuffers",
  729. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  730. "kernel32.dll.GetCurrentProcessorNumber",
  731. "kernel32.dll.CreateSymbolicLinkW",
  732. "kernel32.dll.GetTickCount64",
  733. "kernel32.dll.GetFileInformationByHandleEx",
  734. "kernel32.dll.SetFileInformationByHandle",
  735. "kernel32.dll.InitializeConditionVariable",
  736. "kernel32.dll.WakeConditionVariable",
  737. "kernel32.dll.WakeAllConditionVariable",
  738. "kernel32.dll.SleepConditionVariableCS",
  739. "kernel32.dll.TryAcquireSRWLockExclusive",
  740. "kernel32.dll.SleepConditionVariableSRW",
  741. "kernel32.dll.CreateThreadpoolWork",
  742. "kernel32.dll.SubmitThreadpoolWork",
  743. "kernel32.dll.CloseThreadpoolWork",
  744. "kernel32.dll.CompareStringEx",
  745. "kernel32.dll.GetLocaleInfoEx",
  746. "kernel32.dll.AreFileApisANSI",
  747. "kernel32.dll.EnumSystemLocalesEx",
  748. "kernel32.dll.GetDateFormatEx",
  749. "kernel32.dll.GetTimeFormatEx",
  750. "kernel32.dll.GetUserDefaultLocaleName",
  751. "kernel32.dll.IsValidLocaleName",
  752. "kernel32.dll.LCIDToLocaleName",
  753. "kernel32.dll.LocaleNameToLCID",
  754. "advapi32.dll.SystemFunction036",
  755. "cryptbase.dll.SystemFunction001",
  756. "cryptbase.dll.SystemFunction002",
  757. "cryptbase.dll.SystemFunction003",
  758. "cryptbase.dll.SystemFunction004",
  759. "cryptbase.dll.SystemFunction005",
  760. "cryptbase.dll.SystemFunction028",
  761. "cryptbase.dll.SystemFunction029",
  762. "cryptbase.dll.SystemFunction034",
  763. "cryptbase.dll.SystemFunction040",
  764. "cryptbase.dll.SystemFunction041"
  765. ]
  766.  
  767. [*] Static Analysis: {
  768. "pe": {
  769. "peid_signatures": [
  770. [
  771. "Microsoft Visual C++ V8.0 (Debug)"
  772. ]
  773. ],
  774. "imports": [
  775. {
  776. "imports": [
  777. {
  778. "name": "ShellExecuteA",
  779. "address": "0x4863d4"
  780. }
  781. ],
  782. "dll": "SHELL32.dll"
  783. },
  784. {
  785. "imports": [
  786. {
  787. "name": "SetLastError",
  788. "address": "0x486220"
  789. },
  790. {
  791. "name": "FlushFileBuffers",
  792. "address": "0x486224"
  793. },
  794. {
  795. "name": "GetCommandLineA",
  796. "address": "0x486228"
  797. },
  798. {
  799. "name": "HeapSetInformation",
  800. "address": "0x48622c"
  801. },
  802. {
  803. "name": "InitializeCriticalSectionAndSpinCount",
  804. "address": "0x486230"
  805. },
  806. {
  807. "name": "DeleteCriticalSection",
  808. "address": "0x486234"
  809. },
  810. {
  811. "name": "EnterCriticalSection",
  812. "address": "0x486238"
  813. },
  814. {
  815. "name": "LeaveCriticalSection",
  816. "address": "0x48623c"
  817. },
  818. {
  819. "name": "FatalAppExitA",
  820. "address": "0x486240"
  821. },
  822. {
  823. "name": "HeapValidate",
  824. "address": "0x486244"
  825. },
  826. {
  827. "name": "IsBadReadPtr",
  828. "address": "0x486248"
  829. },
  830. {
  831. "name": "GetModuleFileNameW",
  832. "address": "0x48624c"
  833. },
  834. {
  835. "name": "WideCharToMultiByte",
  836. "address": "0x486250"
  837. },
  838. {
  839. "name": "IsDebuggerPresent",
  840. "address": "0x486254"
  841. },
  842. {
  843. "name": "MultiByteToWideChar",
  844. "address": "0x486258"
  845. },
  846. {
  847. "name": "RaiseException",
  848. "address": "0x48625c"
  849. },
  850. {
  851. "name": "lstrlenA",
  852. "address": "0x486260"
  853. },
  854. {
  855. "name": "GetProcAddress",
  856. "address": "0x486264"
  857. },
  858. {
  859. "name": "LoadLibraryW",
  860. "address": "0x486268"
  861. },
  862. {
  863. "name": "SetUnhandledExceptionFilter",
  864. "address": "0x48626c"
  865. },
  866. {
  867. "name": "QueryPerformanceCounter",
  868. "address": "0x486270"
  869. },
  870. {
  871. "name": "GetTickCount",
  872. "address": "0x486274"
  873. },
  874. {
  875. "name": "GetCurrentThreadId",
  876. "address": "0x486278"
  877. },
  878. {
  879. "name": "GetCurrentProcessId",
  880. "address": "0x48627c"
  881. },
  882. {
  883. "name": "GetSystemTimeAsFileTime",
  884. "address": "0x486280"
  885. },
  886. {
  887. "name": "InterlockedIncrement",
  888. "address": "0x486284"
  889. },
  890. {
  891. "name": "InterlockedDecrement",
  892. "address": "0x486288"
  893. },
  894. {
  895. "name": "DecodePointer",
  896. "address": "0x48628c"
  897. },
  898. {
  899. "name": "GetModuleHandleW",
  900. "address": "0x486290"
  901. },
  902. {
  903. "name": "ExitProcess",
  904. "address": "0x486294"
  905. },
  906. {
  907. "name": "GetModuleFileNameA",
  908. "address": "0x486298"
  909. },
  910. {
  911. "name": "FreeEnvironmentStringsW",
  912. "address": "0x48629c"
  913. },
  914. {
  915. "name": "GetEnvironmentStringsW",
  916. "address": "0x4862a0"
  917. },
  918. {
  919. "name": "SetHandleCount",
  920. "address": "0x4862a4"
  921. },
  922. {
  923. "name": "GetStdHandle",
  924. "address": "0x4862a8"
  925. },
  926. {
  927. "name": "GetFileType",
  928. "address": "0x4862ac"
  929. },
  930. {
  931. "name": "GetStartupInfoW",
  932. "address": "0x4862b0"
  933. },
  934. {
  935. "name": "EncodePointer",
  936. "address": "0x4862b4"
  937. },
  938. {
  939. "name": "TlsAlloc",
  940. "address": "0x4862b8"
  941. },
  942. {
  943. "name": "TlsGetValue",
  944. "address": "0x4862bc"
  945. },
  946. {
  947. "name": "TlsSetValue",
  948. "address": "0x4862c0"
  949. },
  950. {
  951. "name": "TlsFree",
  952. "address": "0x4862c4"
  953. },
  954. {
  955. "name": "GetLastError",
  956. "address": "0x4862c8"
  957. },
  958. {
  959. "name": "GetCurrentThread",
  960. "address": "0x4862cc"
  961. },
  962. {
  963. "name": "HeapCreate",
  964. "address": "0x4862d0"
  965. },
  966. {
  967. "name": "HeapDestroy",
  968. "address": "0x4862d4"
  969. },
  970. {
  971. "name": "WriteFile",
  972. "address": "0x4862d8"
  973. },
  974. {
  975. "name": "HeapAlloc",
  976. "address": "0x4862dc"
  977. },
  978. {
  979. "name": "HeapReAlloc",
  980. "address": "0x4862e0"
  981. },
  982. {
  983. "name": "HeapSize",
  984. "address": "0x4862e4"
  985. },
  986. {
  987. "name": "HeapQueryInformation",
  988. "address": "0x4862e8"
  989. },
  990. {
  991. "name": "TerminateProcess",
  992. "address": "0x4862ec"
  993. },
  994. {
  995. "name": "GetCurrentProcess",
  996. "address": "0x4862f0"
  997. },
  998. {
  999. "name": "UnhandledExceptionFilter",
  1000. "address": "0x4862f4"
  1001. },
  1002. {
  1003. "name": "HeapFree",
  1004. "address": "0x4862f8"
  1005. },
  1006. {
  1007. "name": "GetACP",
  1008. "address": "0x4862fc"
  1009. },
  1010. {
  1011. "name": "GetOEMCP",
  1012. "address": "0x486300"
  1013. },
  1014. {
  1015. "name": "GetCPInfo",
  1016. "address": "0x486304"
  1017. },
  1018. {
  1019. "name": "IsValidCodePage",
  1020. "address": "0x486308"
  1021. },
  1022. {
  1023. "name": "OutputDebugStringA",
  1024. "address": "0x48630c"
  1025. },
  1026. {
  1027. "name": "WriteConsoleW",
  1028. "address": "0x486310"
  1029. },
  1030. {
  1031. "name": "OutputDebugStringW",
  1032. "address": "0x486314"
  1033. },
  1034. {
  1035. "name": "SetConsoleCtrlHandler",
  1036. "address": "0x486318"
  1037. },
  1038. {
  1039. "name": "RtlUnwind",
  1040. "address": "0x48631c"
  1041. },
  1042. {
  1043. "name": "GetProcessHeap",
  1044. "address": "0x486320"
  1045. },
  1046. {
  1047. "name": "VirtualQuery",
  1048. "address": "0x486324"
  1049. },
  1050. {
  1051. "name": "FreeLibrary",
  1052. "address": "0x486328"
  1053. },
  1054. {
  1055. "name": "InterlockedExchange",
  1056. "address": "0x48632c"
  1057. },
  1058. {
  1059. "name": "GetLocaleInfoW",
  1060. "address": "0x486330"
  1061. },
  1062. {
  1063. "name": "IsProcessorFeaturePresent",
  1064. "address": "0x486334"
  1065. },
  1066. {
  1067. "name": "LCMapStringW",
  1068. "address": "0x486338"
  1069. },
  1070. {
  1071. "name": "GetStringTypeW",
  1072. "address": "0x48633c"
  1073. },
  1074. {
  1075. "name": "SetFilePointer",
  1076. "address": "0x486340"
  1077. },
  1078. {
  1079. "name": "GetConsoleCP",
  1080. "address": "0x486344"
  1081. },
  1082. {
  1083. "name": "GetConsoleMode",
  1084. "address": "0x486348"
  1085. },
  1086. {
  1087. "name": "GetLocaleInfoA",
  1088. "address": "0x48634c"
  1089. },
  1090. {
  1091. "name": "IsValidLocale",
  1092. "address": "0x486350"
  1093. },
  1094. {
  1095. "name": "EnumSystemLocalesA",
  1096. "address": "0x486354"
  1097. },
  1098. {
  1099. "name": "GetUserDefaultLCID",
  1100. "address": "0x486358"
  1101. },
  1102. {
  1103. "name": "SetStdHandle",
  1104. "address": "0x48635c"
  1105. },
  1106. {
  1107. "name": "CreateFileW",
  1108. "address": "0x486360"
  1109. },
  1110. {
  1111. "name": "CloseHandle",
  1112. "address": "0x486364"
  1113. }
  1114. ],
  1115. "dll": "KERNEL32.dll"
  1116. }
  1117. ],
  1118. "digital_signers": null,
  1119. "exported_dll_name": null,
  1120. "actual_checksum": "0x00070298",
  1121. "overlay": null,
  1122. "imagebase": "0x00400000",
  1123. "reported_checksum": "0x00000000",
  1124. "icon_hash": null,
  1125. "entrypoint": "0x00425a23",
  1126. "timestamp": "2019-05-23 16:37:33",
  1127. "osversion": "5.1",
  1128. "sections": [
  1129. {
  1130. "name": ".textbss",
  1131. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1132. "virtual_address": "0x00001000",
  1133. "size_of_data": "0x00000000",
  1134. "entropy": "0.00",
  1135. "raw_address": "0x00000000",
  1136. "virtual_size": "0x00023f1d",
  1137. "characteristics_raw": "0xe00000a0"
  1138. },
  1139. {
  1140. "name": ".text",
  1141. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1142. "virtual_address": "0x00025000",
  1143. "size_of_data": "0x0004cc00",
  1144. "entropy": "5.51",
  1145. "raw_address": "0x00000400",
  1146. "virtual_size": "0x0004cb7d",
  1147. "characteristics_raw": "0x60000020"
  1148. },
  1149. {
  1150. "name": ".rdata",
  1151. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1152. "virtual_address": "0x00072000",
  1153. "size_of_data": "0x0000f800",
  1154. "entropy": "3.58",
  1155. "raw_address": "0x0004d000",
  1156. "virtual_size": "0x0000f6cc",
  1157. "characteristics_raw": "0x40000040"
  1158. },
  1159. {
  1160. "name": ".data",
  1161. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1162. "virtual_address": "0x00082000",
  1163. "size_of_data": "0x00001400",
  1164. "entropy": "2.10",
  1165. "raw_address": "0x0005c800",
  1166. "virtual_size": "0x00003918",
  1167. "characteristics_raw": "0xc0000040"
  1168. },
  1169. {
  1170. "name": ".idata",
  1171. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1172. "virtual_address": "0x00086000",
  1173. "size_of_data": "0x00000c00",
  1174. "entropy": "4.46",
  1175. "raw_address": "0x0005dc00",
  1176. "virtual_size": "0x00000bbc",
  1177. "characteristics_raw": "0xc0000040"
  1178. },
  1179. {
  1180. "name": ".rsrc",
  1181. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1182. "virtual_address": "0x00087000",
  1183. "size_of_data": "0x00000600",
  1184. "entropy": "3.29",
  1185. "raw_address": "0x0005e800",
  1186. "virtual_size": "0x00000596",
  1187. "characteristics_raw": "0x40000040"
  1188. },
  1189. {
  1190. "name": ".reloc",
  1191. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1192. "virtual_address": "0x00088000",
  1193. "size_of_data": "0x00003600",
  1194. "entropy": "6.26",
  1195. "raw_address": "0x0005ee00",
  1196. "virtual_size": "0x000035f9",
  1197. "characteristics_raw": "0x42000040"
  1198. }
  1199. ],
  1200. "resources": [],
  1201. "dirents": [
  1202. {
  1203. "virtual_address": "0x00000000",
  1204. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1205. "size": "0x00000000"
  1206. },
  1207. {
  1208. "virtual_address": "0x00086000",
  1209. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1210. "size": "0x0000003c"
  1211. },
  1212. {
  1213. "virtual_address": "0x00087000",
  1214. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1215. "size": "0x00000596"
  1216. },
  1217. {
  1218. "virtual_address": "0x00000000",
  1219. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1220. "size": "0x00000000"
  1221. },
  1222. {
  1223. "virtual_address": "0x00000000",
  1224. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1225. "size": "0x00000000"
  1226. },
  1227. {
  1228. "virtual_address": "0x00088000",
  1229. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1230. "size": "0x00002ea8"
  1231. },
  1232. {
  1233. "virtual_address": "0x00072d60",
  1234. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1235. "size": "0x0000001c"
  1236. },
  1237. {
  1238. "virtual_address": "0x00000000",
  1239. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1240. "size": "0x00000000"
  1241. },
  1242. {
  1243. "virtual_address": "0x00000000",
  1244. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1245. "size": "0x00000000"
  1246. },
  1247. {
  1248. "virtual_address": "0x00000000",
  1249. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1250. "size": "0x00000000"
  1251. },
  1252. {
  1253. "virtual_address": "0x00000000",
  1254. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1255. "size": "0x00000000"
  1256. },
  1257. {
  1258. "virtual_address": "0x00000000",
  1259. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1260. "size": "0x00000000"
  1261. },
  1262. {
  1263. "virtual_address": "0x00086220",
  1264. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1265. "size": "0x000001e4"
  1266. },
  1267. {
  1268. "virtual_address": "0x00000000",
  1269. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1270. "size": "0x00000000"
  1271. },
  1272. {
  1273. "virtual_address": "0x00000000",
  1274. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1275. "size": "0x00000000"
  1276. },
  1277. {
  1278. "virtual_address": "0x00000000",
  1279. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1280. "size": "0x00000000"
  1281. }
  1282. ],
  1283. "exports": [],
  1284. "guest_signers": {},
  1285. "imphash": "f0511018ed7de8ba155602b7972cb706",
  1286. "icon_fuzzy": null,
  1287. "icon": null,
  1288. "pdbpath": "D:\\360\\xe6\\x9e\\x81\\xe9\\x80\\x9f\\xe6\\xb5\\x8f\\xe8\\xa7\\x88\\xe5\\x99\\xa8\\xe4\\xb8\\x8b\\xe8\\xbd\\xbd\\BPDownload-master\\Classes\\QQQQQQQQQQQQ\\Debug\\QQQQQQQQQQQQ.pdb",
  1289. "imported_dll_count": 2,
  1290. "versioninfo": []
  1291. }
  1292. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!