API tools faq
paste
paladin316

Exes_b675ec48f70adf64e944fe06e8c9cf59_exe_2019-06-28_12_30.json

paladin316
Jun 28th, 2019
4,061
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 59.96 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 6.5
  5.  
  6. [*] File Name: "Exes_b675ec48f70adf64e944fe06e8c9cf59.exe"
  7. [*] File Size: 135168
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "2f8ce0d8906873a70116dfd8bdfed06949458da580c0729302647a61b3d6484f"
  10. [*] MD5: "b675ec48f70adf64e944fe06e8c9cf59"
  11. [*] SHA1: "ed2dd704dda4fd2006ea0360fee9756af0dd097a"
  12. [*] SHA512: "fca17803047269ad5a4ea087a64d6bbb6be42d7d3e1d03e179852db8c8c498593943dc950aba3571cfd42146bc6e17059e5c4c4b1f0e044d2e8fdc2a0f064820"
  13. [*] CRC32: "CED461A5"
  14. [*] SSDEEP: "3072:+NQa4VSzb+OAH4RaUwxCSF6HrZ1Y/VN5w:vKA6KytGNN"
  15.  
  16. [*] Process Execution: [
  17. "Exes_b675ec48f70adf64e944fe06e8c9cf59.exe",
  18. "IntelRapid.exe",
  19. "svchost.exe",
  20. "WMIADAP.exe",
  21. "taskeng.exe",
  22. "svchost.exe",
  23. "WmiPrvSE.exe"
  24. ]
  25.  
  26. [*] Signatures Detected: [
  27. {
  28. "Description": "A process attempted to delay the analysis task.",
  29. "Details": [
  30. {
  31. "Process": "svchost.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "A process created a hidden window",
  37. "Details": [
  38. {
  39. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  40. }
  41. ]
  42. },
  43. {
  44. "Description": "Drops a binary and executes it",
  45. "Details": [
  46. {
  47. "binary": "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe"
  48. }
  49. ]
  50. },
  51. {
  52. "Description": "Installs itself for autorun at Windows startup",
  53. "Details": [
  54. {
  55. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IntelRapid.lnk"
  56. },
  57. {
  58. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IntelRapid.lnk"
  59. }
  60. ]
  61. },
  62. {
  63. "Description": "Creates a copy of itself",
  64. "Details": [
  65. {
  66. "copy": "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe"
  67. }
  68. ]
  69. }
  70. ]
  71.  
  72. [*] Started Service: []
  73.  
  74. [*] Executed Commands: [
  75. "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe",
  76. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  77. "taskeng.exe {D27BFC71-1ABD-4B1C-B8CA-0026D9CFA864} S-1-5-18:NT AUTHORITY\\System:Service:",
  78. "taskeng.exe {0779208E-B283-4111-9CC9-D1532B2A85E8} S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:[1]",
  79. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  80. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\""
  81. ]
  82.  
  83. [*] Mutexes: [
  84. "{37529D08-A67E-40B3-B0F2-EB87331B47F5}",
  85. "Global\\ADAP_WMI_ENTRY",
  86. "Global\\RefreshRA_Mutex",
  87. "Global\\RefreshRA_Mutex_Lib",
  88. "Global\\RefreshRA_Mutex_Flag"
  89. ]
  90.  
  91. [*] Modified Files: [
  92. "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe",
  93. "\\??\\PIPE\\srvsvc",
  94. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IntelRapid.lnk",
  95. "C:\\Windows\\sysnative\\Tasks\\Intel Rapid",
  96. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  97. "\\Device\\LanmanDatagramReceiver",
  98. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  99. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  100. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  101. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  102. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  103. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  104. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  105. "\\??\\WMIDataDevice"
  106. ]
  107.  
  108. [*] Deleted Files: [
  109. "C:\\Windows\\Tasks\\Intel Rapid.job",
  110. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  111. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  112. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  113. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  114. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  115. ]
  116.  
  117. [*] Modified Registry Keys: [
  118. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{94DE636A-CEDF-4E97-888F-46B0B9CAAB47}\\Path",
  119. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{94DE636A-CEDF-4E97-888F-46B0B9CAAB47}\\Hash",
  120. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Intel Rapid\\Id",
  121. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Intel Rapid\\Index",
  122. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{94DE636A-CEDF-4E97-888F-46B0B9CAAB47}\\Triggers",
  123. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{94DE636A-CEDF-4E97-888F-46B0B9CAAB47}\\DynamicInfo",
  124. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  125. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  126. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  127. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{844E0DFC-7472-4CA9-96DC-9859ED19B312}\\Path",
  128. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{844E0DFC-7472-4CA9-96DC-9859ED19B312}\\Hash",
  129. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  130. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  131. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{844E0DFC-7472-4CA9-96DC-9859ED19B312}\\Triggers",
  132. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{844E0DFC-7472-4CA9-96DC-9859ED19B312}\\DynamicInfo",
  133. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05}\\DynamicInfo",
  134. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{D27BFC71-1ABD-4B1C-B8CA-0026D9CFA864}",
  135. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{B17E070E-57E3-43F6-96F5-A9A9C921DEBF}\\DynamicInfo",
  136. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{0779208E-B283-4111-9CC9-D1532B2A85E8}",
  137. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{DF000DCA-3FA2-48A6-9E59-C0606F9F8D73}\\DynamicInfo",
  138. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-{00000000-0000-0000-0000-000000000000}",
  139. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dll[MofResourceName]",
  140. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.mui[MofResourceName]",
  141. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sys[ACPIMOFResource]",
  142. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
  143. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
  144. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
  145. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sys[MofResource]",
  146. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui[MofResource]",
  147. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sys[HDAudioMofName]",
  148. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui[HDAudioMofName]",
  149. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sys[PROCESSORWMI]",
  150. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.mui[PROCESSORWMI]",
  151. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYS[PortclsMof]",
  152. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.mui[PortclsMof]",
  153. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]",
  154. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{D27BFC71-1ABD-4B1C-B8CA-0026D9CFA864}\\data"
  155. ]
  156.  
  157. [*] Deleted Registry Keys: [
  158. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Intel Rapid.job",
  159. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Intel Rapid.job.fp",
  160. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  161. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  162. ]
  163.  
  164. [*] DNS Communications: []
  165.  
  166. [*] Domains: []
  167.  
  168. [*] Network Communication - ICMP: []
  169.  
  170. [*] Network Communication - HTTP: []
  171.  
  172. [*] Network Communication - SMTP: []
  173.  
  174. [*] Network Communication - Hosts: []
  175.  
  176. [*] Network Communication - IRC: []
  177.  
  178. [*] Static Analysis: {
  179. "pe": {
  180. "peid_signatures": null,
  181. "imports": [
  182. {
  183. "imports": [
  184. {
  185. "name": "CreateMutexW",
  186. "address": "0x414000"
  187. },
  188. {
  189. "name": "Sleep",
  190. "address": "0x414004"
  191. },
  192. {
  193. "name": "GetLastError",
  194. "address": "0x414008"
  195. },
  196. {
  197. "name": "CloseHandle",
  198. "address": "0x41400c"
  199. },
  200. {
  201. "name": "ExitProcess",
  202. "address": "0x414010"
  203. },
  204. {
  205. "name": "ReadProcessMemory",
  206. "address": "0x414014"
  207. },
  208. {
  209. "name": "SizeofResource",
  210. "address": "0x414018"
  211. },
  212. {
  213. "name": "EnumResourceNamesW",
  214. "address": "0x41401c"
  215. },
  216. {
  217. "name": "LockResource",
  218. "address": "0x414020"
  219. },
  220. {
  221. "name": "LoadResource",
  222. "address": "0x414024"
  223. },
  224. {
  225. "name": "FindResourceW",
  226. "address": "0x414028"
  227. },
  228. {
  229. "name": "CreateDirectoryW",
  230. "address": "0x41402c"
  231. },
  232. {
  233. "name": "GetModuleFileNameW",
  234. "address": "0x414030"
  235. },
  236. {
  237. "name": "GetFileAttributesW",
  238. "address": "0x414034"
  239. },
  240. {
  241. "name": "CreateProcessW",
  242. "address": "0x414038"
  243. },
  244. {
  245. "name": "CopyFileW",
  246. "address": "0x41403c"
  247. },
  248. {
  249. "name": "EnterCriticalSection",
  250. "address": "0x414040"
  251. },
  252. {
  253. "name": "LeaveCriticalSection",
  254. "address": "0x414044"
  255. },
  256. {
  257. "name": "InitializeCriticalSection",
  258. "address": "0x414048"
  259. },
  260. {
  261. "name": "DeleteCriticalSection",
  262. "address": "0x41404c"
  263. },
  264. {
  265. "name": "GlobalSize",
  266. "address": "0x414050"
  267. },
  268. {
  269. "name": "GlobalAlloc",
  270. "address": "0x414054"
  271. },
  272. {
  273. "name": "GlobalFree",
  274. "address": "0x414058"
  275. },
  276. {
  277. "name": "GlobalLock",
  278. "address": "0x41405c"
  279. },
  280. {
  281. "name": "GetTickCount",
  282. "address": "0x414060"
  283. },
  284. {
  285. "name": "GlobalUnlock",
  286. "address": "0x414064"
  287. },
  288. {
  289. "name": "SetLastError",
  290. "address": "0x414068"
  291. },
  292. {
  293. "name": "WaitForMultipleObjects",
  294. "address": "0x41406c"
  295. },
  296. {
  297. "name": "CreateEventW",
  298. "address": "0x414070"
  299. },
  300. {
  301. "name": "GetExitCodeThread",
  302. "address": "0x414074"
  303. },
  304. {
  305. "name": "SetEvent",
  306. "address": "0x414078"
  307. },
  308. {
  309. "name": "TerminateThread",
  310. "address": "0x41407c"
  311. },
  312. {
  313. "name": "CreateThread",
  314. "address": "0x414080"
  315. },
  316. {
  317. "name": "CreateFileW",
  318. "address": "0x414084"
  319. },
  320. {
  321. "name": "DecodePointer",
  322. "address": "0x414088"
  323. },
  324. {
  325. "name": "WriteConsoleW",
  326. "address": "0x41408c"
  327. },
  328. {
  329. "name": "SetFilePointerEx",
  330. "address": "0x414090"
  331. },
  332. {
  333. "name": "GetConsoleMode",
  334. "address": "0x414094"
  335. },
  336. {
  337. "name": "GetConsoleCP",
  338. "address": "0x414098"
  339. },
  340. {
  341. "name": "FlushFileBuffers",
  342. "address": "0x41409c"
  343. },
  344. {
  345. "name": "HeapReAlloc",
  346. "address": "0x4140a0"
  347. },
  348. {
  349. "name": "HeapSize",
  350. "address": "0x4140a4"
  351. },
  352. {
  353. "name": "GetProcessHeap",
  354. "address": "0x4140a8"
  355. },
  356. {
  357. "name": "GetStringTypeW",
  358. "address": "0x4140ac"
  359. },
  360. {
  361. "name": "GetFileType",
  362. "address": "0x4140b0"
  363. },
  364. {
  365. "name": "SetStdHandle",
  366. "address": "0x4140b4"
  367. },
  368. {
  369. "name": "LCMapStringW",
  370. "address": "0x4140b8"
  371. },
  372. {
  373. "name": "FreeEnvironmentStringsW",
  374. "address": "0x4140bc"
  375. },
  376. {
  377. "name": "GetEnvironmentStringsW",
  378. "address": "0x4140c0"
  379. },
  380. {
  381. "name": "GetCommandLineW",
  382. "address": "0x4140c4"
  383. },
  384. {
  385. "name": "GetCommandLineA",
  386. "address": "0x4140c8"
  387. },
  388. {
  389. "name": "GetCPInfo",
  390. "address": "0x4140cc"
  391. },
  392. {
  393. "name": "GetOEMCP",
  394. "address": "0x4140d0"
  395. },
  396. {
  397. "name": "IsValidCodePage",
  398. "address": "0x4140d4"
  399. },
  400. {
  401. "name": "QueryPerformanceCounter",
  402. "address": "0x4140d8"
  403. },
  404. {
  405. "name": "GetCurrentProcessId",
  406. "address": "0x4140dc"
  407. },
  408. {
  409. "name": "GetCurrentThreadId",
  410. "address": "0x4140e0"
  411. },
  412. {
  413. "name": "GetSystemTimeAsFileTime",
  414. "address": "0x4140e4"
  415. },
  416. {
  417. "name": "InitializeSListHead",
  418. "address": "0x4140e8"
  419. },
  420. {
  421. "name": "IsDebuggerPresent",
  422. "address": "0x4140ec"
  423. },
  424. {
  425. "name": "UnhandledExceptionFilter",
  426. "address": "0x4140f0"
  427. },
  428. {
  429. "name": "SetUnhandledExceptionFilter",
  430. "address": "0x4140f4"
  431. },
  432. {
  433. "name": "GetStartupInfoW",
  434. "address": "0x4140f8"
  435. },
  436. {
  437. "name": "IsProcessorFeaturePresent",
  438. "address": "0x4140fc"
  439. },
  440. {
  441. "name": "GetModuleHandleW",
  442. "address": "0x414100"
  443. },
  444. {
  445. "name": "GetCurrentProcess",
  446. "address": "0x414104"
  447. },
  448. {
  449. "name": "TerminateProcess",
  450. "address": "0x414108"
  451. },
  452. {
  453. "name": "LocalFree",
  454. "address": "0x41410c"
  455. },
  456. {
  457. "name": "EncodePointer",
  458. "address": "0x414110"
  459. },
  460. {
  461. "name": "RaiseException",
  462. "address": "0x414114"
  463. },
  464. {
  465. "name": "RtlUnwind",
  466. "address": "0x414118"
  467. },
  468. {
  469. "name": "InitializeCriticalSectionAndSpinCount",
  470. "address": "0x41411c"
  471. },
  472. {
  473. "name": "TlsAlloc",
  474. "address": "0x414120"
  475. },
  476. {
  477. "name": "TlsGetValue",
  478. "address": "0x414124"
  479. },
  480. {
  481. "name": "TlsSetValue",
  482. "address": "0x414128"
  483. },
  484. {
  485. "name": "TlsFree",
  486. "address": "0x41412c"
  487. },
  488. {
  489. "name": "FreeLibrary",
  490. "address": "0x414130"
  491. },
  492. {
  493. "name": "GetProcAddress",
  494. "address": "0x414134"
  495. },
  496. {
  497. "name": "LoadLibraryExW",
  498. "address": "0x414138"
  499. },
  500. {
  501. "name": "GetStdHandle",
  502. "address": "0x41413c"
  503. },
  504. {
  505. "name": "WriteFile",
  506. "address": "0x414140"
  507. },
  508. {
  509. "name": "GetModuleFileNameA",
  510. "address": "0x414144"
  511. },
  512. {
  513. "name": "MultiByteToWideChar",
  514. "address": "0x414148"
  515. },
  516. {
  517. "name": "WideCharToMultiByte",
  518. "address": "0x41414c"
  519. },
  520. {
  521. "name": "GetModuleHandleExW",
  522. "address": "0x414150"
  523. },
  524. {
  525. "name": "GetACP",
  526. "address": "0x414154"
  527. },
  528. {
  529. "name": "HeapFree",
  530. "address": "0x414158"
  531. },
  532. {
  533. "name": "HeapAlloc",
  534. "address": "0x41415c"
  535. },
  536. {
  537. "name": "FindClose",
  538. "address": "0x414160"
  539. },
  540. {
  541. "name": "FindFirstFileExA",
  542. "address": "0x414164"
  543. },
  544. {
  545. "name": "FindNextFileA",
  546. "address": "0x414168"
  547. }
  548. ],
  549. "dll": "KERNEL32.dll"
  550. },
  551. {
  552. "imports": [
  553. {
  554. "name": "GetMessageW",
  555. "address": "0x414188"
  556. },
  557. {
  558. "name": "DefWindowProcW",
  559. "address": "0x41418c"
  560. },
  561. {
  562. "name": "DestroyWindow",
  563. "address": "0x414190"
  564. },
  565. {
  566. "name": "CreateWindowExW",
  567. "address": "0x414194"
  568. },
  569. {
  570. "name": "GetClassInfoW",
  571. "address": "0x414198"
  572. },
  573. {
  574. "name": "CloseWindow",
  575. "address": "0x41419c"
  576. },
  577. {
  578. "name": "GetWindowLongW",
  579. "address": "0x4141a0"
  580. },
  581. {
  582. "name": "DispatchMessageW",
  583. "address": "0x4141a4"
  584. },
  585. {
  586. "name": "RegisterClassW",
  587. "address": "0x4141a8"
  588. },
  589. {
  590. "name": "TranslateMessage",
  591. "address": "0x4141ac"
  592. },
  593. {
  594. "name": "RemoveClipboardFormatListener",
  595. "address": "0x4141b0"
  596. },
  597. {
  598. "name": "SetWindowLongW",
  599. "address": "0x4141b4"
  600. },
  601. {
  602. "name": "AddClipboardFormatListener",
  603. "address": "0x4141b8"
  604. },
  605. {
  606. "name": "OpenClipboard",
  607. "address": "0x4141bc"
  608. },
  609. {
  610. "name": "CloseClipboard",
  611. "address": "0x4141c0"
  612. },
  613. {
  614. "name": "EmptyClipboard",
  615. "address": "0x4141c4"
  616. },
  617. {
  618. "name": "GetClipboardData",
  619. "address": "0x4141c8"
  620. },
  621. {
  622. "name": "SetClipboardData",
  623. "address": "0x4141cc"
  624. },
  625. {
  626. "name": "IsClipboardFormatAvailable",
  627. "address": "0x4141d0"
  628. },
  629. {
  630. "name": "GetKeyboardLayoutList",
  631. "address": "0x4141d4"
  632. },
  633. {
  634. "name": "IsWindow",
  635. "address": "0x4141d8"
  636. }
  637. ],
  638. "dll": "USER32.dll"
  639. },
  640. {
  641. "imports": [
  642. {
  643. "name": "SHGetSpecialFolderPathW",
  644. "address": "0x414180"
  645. }
  646. ],
  647. "dll": "SHELL32.dll"
  648. },
  649. {
  650. "imports": [
  651. {
  652. "name": "CoInitializeEx",
  653. "address": "0x4141e0"
  654. },
  655. {
  656. "name": "CoCreateInstance",
  657. "address": "0x4141e4"
  658. },
  659. {
  660. "name": "CoUninitialize",
  661. "address": "0x4141e8"
  662. }
  663. ],
  664. "dll": "ole32.dll"
  665. },
  666. {
  667. "imports": [
  668. {
  669. "name": "VariantInit",
  670. "address": "0x414170"
  671. },
  672. {
  673. "name": "SysFreeString",
  674. "address": "0x414174"
  675. },
  676. {
  677. "name": "SysAllocString",
  678. "address": "0x414178"
  679. }
  680. ],
  681. "dll": "OLEAUT32.dll"
  682. }
  683. ],
  684. "digital_signers": null,
  685. "exported_dll_name": null,
  686. "actual_checksum": "0x000229ba",
  687. "overlay": null,
  688. "imagebase": "0x00400000",
  689. "reported_checksum": "0x00000000",
  690. "icon_hash": null,
  691. "entrypoint": "0x00407c21",
  692. "timestamp": "2019-06-04 15:07:23",
  693. "osversion": "6.0",
  694. "sections": [
  695. {
  696. "name": ".text",
  697. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  698. "virtual_address": "0x00001000",
  699. "size_of_data": "0x00012c00",
  700. "entropy": "6.62",
  701. "raw_address": "0x00000400",
  702. "virtual_size": "0x00012b3b",
  703. "characteristics_raw": "0x60000020"
  704. },
  705. {
  706. "name": ".rdata",
  707. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  708. "virtual_address": "0x00014000",
  709. "size_of_data": "0x00009600",
  710. "entropy": "4.59",
  711. "raw_address": "0x00013000",
  712. "virtual_size": "0x000094f4",
  713. "characteristics_raw": "0x40000040"
  714. },
  715. {
  716. "name": ".data",
  717. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  718. "virtual_address": "0x0001e000",
  719. "size_of_data": "0x00002000",
  720. "entropy": "5.04",
  721. "raw_address": "0x0001c600",
  722. "virtual_size": "0x00002938",
  723. "characteristics_raw": "0xc0000040"
  724. },
  725. {
  726. "name": ".gfids",
  727. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  728. "virtual_address": "0x00021000",
  729. "size_of_data": "0x00000200",
  730. "entropy": "2.12",
  731. "raw_address": "0x0001e600",
  732. "virtual_size": "0x0000012c",
  733. "characteristics_raw": "0x40000040"
  734. },
  735. {
  736. "name": ".rsrc",
  737. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  738. "virtual_address": "0x00022000",
  739. "size_of_data": "0x00000a00",
  740. "entropy": "5.71",
  741. "raw_address": "0x0001e800",
  742. "virtual_size": "0x00000834",
  743. "characteristics_raw": "0x40000040"
  744. },
  745. {
  746. "name": ".reloc",
  747. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  748. "virtual_address": "0x00023000",
  749. "size_of_data": "0x00001e00",
  750. "entropy": "6.43",
  751. "raw_address": "0x0001f200",
  752. "virtual_size": "0x00001dd0",
  753. "characteristics_raw": "0x42000040"
  754. }
  755. ],
  756. "resources": [],
  757. "dirents": [
  758. {
  759. "virtual_address": "0x00000000",
  760. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  761. "size": "0x00000000"
  762. },
  763. {
  764. "virtual_address": "0x0001c9fc",
  765. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  766. "size": "0x00000078"
  767. },
  768. {
  769. "virtual_address": "0x00022000",
  770. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  771. "size": "0x00000834"
  772. },
  773. {
  774. "virtual_address": "0x00000000",
  775. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  776. "size": "0x00000000"
  777. },
  778. {
  779. "virtual_address": "0x00000000",
  780. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  781. "size": "0x00000000"
  782. },
  783. {
  784. "virtual_address": "0x00023000",
  785. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  786. "size": "0x00001dd0"
  787. },
  788. {
  789. "virtual_address": "0x000194b0",
  790. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  791. "size": "0x00000038"
  792. },
  793. {
  794. "virtual_address": "0x00000000",
  795. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  796. "size": "0x00000000"
  797. },
  798. {
  799. "virtual_address": "0x00000000",
  800. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  801. "size": "0x00000000"
  802. },
  803. {
  804. "virtual_address": "0x00000000",
  805. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  806. "size": "0x00000000"
  807. },
  808. {
  809. "virtual_address": "0x000194e8",
  810. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  811. "size": "0x00000040"
  812. },
  813. {
  814. "virtual_address": "0x00000000",
  815. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  816. "size": "0x00000000"
  817. },
  818. {
  819. "virtual_address": "0x00014000",
  820. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  821. "size": "0x000001f0"
  822. },
  823. {
  824. "virtual_address": "0x00000000",
  825. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  826. "size": "0x00000000"
  827. },
  828. {
  829. "virtual_address": "0x00000000",
  830. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  831. "size": "0x00000000"
  832. },
  833. {
  834. "virtual_address": "0x00000000",
  835. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  836. "size": "0x00000000"
  837. }
  838. ],
  839. "exports": [],
  840. "guest_signers": {},
  841. "imphash": "4dfd516b1461e570a523efd4ab8d77c8",
  842. "icon_fuzzy": null,
  843. "icon": null,
  844. "pdbpath": null,
  845. "imported_dll_count": 5,
  846. "versioninfo": []
  847. }
  848. }
  849.  
  850. [*] Resolved APIs: [
  851. "kernel32.dll.FlsAlloc",
  852. "kernel32.dll.FlsSetValue",
  853. "kernel32.dll.FlsGetValue",
  854. "kernel32.dll.LCMapStringEx",
  855. "cryptbase.dll.SystemFunction036",
  856. "ole32.dll.CoTaskMemAlloc",
  857. "propsys.dll.PSCreateMemoryPropertyStore",
  858. "ole32.dll.CoGetApartmentType",
  859. "comctl32.dll.#236",
  860. "oleaut32.dll.#6",
  861. "ole32.dll.CoGetMalloc",
  862. "ole32.dll.CreateBindCtx",
  863. "comctl32.dll.#320",
  864. "comctl32.dll.#324",
  865. "comctl32.dll.#323",
  866. "comctl32.dll.#388",
  867. "comctl32.dll.#328",
  868. "comctl32.dll.#334",
  869. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  870. "advapi32.dll.RegEnumKeyW",
  871. "oleaut32.dll.#2",
  872. "ole32.dll.CoCreateInstance",
  873. "advapi32.dll.InitializeSecurityDescriptor",
  874. "advapi32.dll.SetEntriesInAclW",
  875. "ntmarta.dll.GetMartaExtensionInterface",
  876. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  877. "advapi32.dll.SetSecurityDescriptorDacl",
  878. "advapi32.dll.IsTextUnicode",
  879. "comctl32.dll.#332",
  880. "comctl32.dll.#338",
  881. "comctl32.dll.#339",
  882. "shell32.dll.#102",
  883. "ole32.dll.CoInitializeEx",
  884. "ole32.dll.CoUninitialize",
  885. "sechost.dll.ConvertSidToStringSidW",
  886. "profapi.dll.#104",
  887. "ole32.dll.PropVariantClear",
  888. "oleaut32.dll.#9",
  889. "comctl32.dll.#386",
  890. "ole32.dll.CoTaskMemFree",
  891. "advapi32.dll.RegQueryValueW",
  892. "apphelp.dll.ApphelpCheckShellObject",
  893. "linkinfo.dll.CreateLinkInfoW",
  894. "user32.dll.IsCharAlphaW",
  895. "user32.dll.CharPrevW",
  896. "ntshrui.dll.GetNetResourceFromLocalPathW",
  897. "srvcli.dll.NetShareEnum",
  898. "cscapi.dll.CscNetApiGetInterface",
  899. "slc.dll.SLGetWindowsInformationDWORD",
  900. "shlwapi.dll.PathRemoveFileSpecW",
  901. "linkinfo.dll.DestroyLinkInfo",
  902. "ole32.dll.NdrOleInitializeExtension",
  903. "ole32.dll.CoGetClassObject",
  904. "ole32.dll.CoGetMarshalSizeMax",
  905. "ole32.dll.CoMarshalInterface",
  906. "ole32.dll.CoUnmarshalInterface",
  907. "ole32.dll.StringFromIID",
  908. "ole32.dll.CoGetPSClsid",
  909. "ole32.dll.CoReleaseMarshalData",
  910. "ole32.dll.DcomChannelSetHResult",
  911. "oleaut32.dll.#500",
  912. "sspicli.dll.GetUserNameExW",
  913. "xmllite.dll.CreateXmlWriter",
  914. "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
  915. "netutils.dll.NetApiBufferFree",
  916. "advapi32.dll.UnregisterTraceGuids",
  917. "comctl32.dll.#321",
  918. "advapi32.dll.WmiMofEnumerateResourcesW",
  919. "advapi32.dll.WmiFreeBuffer",
  920. "advapi32.dll.WmiCloseBlock",
  921. "propsys.dll.PropVariantToVariant",
  922. "wbemcore.dll.Shutdown",
  923. "tschannel.dll.DllGetClassObject",
  924. "tschannel.dll.DllCanUnloadNow",
  925. "uxtheme.dll.ThemeInitApiHook",
  926. "user32.dll.IsProcessDPIAware",
  927. "sechost.dll.LookupAccountNameLocalW",
  928. "advapi32.dll.LookupAccountSidW",
  929. "sechost.dll.LookupAccountSidLocalW",
  930. "kernel32.dll.GetThreadPreferredUILanguages",
  931. "kernel32.dll.SetThreadPreferredUILanguages",
  932. "kernel32.dll.LocaleNameToLCID",
  933. "kernel32.dll.GetLocaleInfoEx",
  934. "kernel32.dll.LCIDToLocaleName",
  935. "kernel32.dll.GetSystemDefaultLocaleName",
  936. "fastprox.dll.DllGetClassObject",
  937. "fastprox.dll.DllCanUnloadNow",
  938. "oleaut32.dll.#283",
  939. "oleaut32.dll.#284",
  940. "kernel32.dll.RegOpenKeyExW",
  941. "psapi.dll.EnumProcesses",
  942. "psapi.dll.EnumProcessModules",
  943. "psapi.dll.GetModuleBaseNameW",
  944. "ntdll.dll.NtQuerySystemInformation",
  945. "kernel32.dll.SortGetHandle",
  946. "kernel32.dll.SortCloseHandle",
  947. "ole32.dll.CLSIDFromString",
  948. "oleaut32.dll.#8",
  949. "ole32.dll.CoGetCallContext",
  950. "advapi32.dll.CryptAcquireContextW",
  951. "advapi32.dll.RegCreateKeyExW",
  952. "shlwapi.dll.PathIsDirectoryW",
  953. "advapi32.dll.RegQueryValueExW",
  954. "advapi32.dll.RegNotifyChangeKeyValue",
  955. "cryptsp.dll.CryptAcquireContextW",
  956. "cryptsp.dll.CryptGenRandom",
  957. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  958. "ole32.dll.CLSIDFromOle1Class",
  959. "clbcatq.dll.GetCatalogObject",
  960. "clbcatq.dll.GetCatalogObject2",
  961. "advapi32.dll.RegOpenKeyExW",
  962. "advapi32.dll.RegSetValueExW",
  963. "advapi32.dll.RegCloseKey",
  964. "shlwapi.dll.PathIsPrefixW",
  965. "advapi32.dll.CryptCreateHash",
  966. "advapi32.dll.CryptGetHashParam",
  967. "cryptsp.dll.CryptGetHashParam",
  968. "advapi32.dll.CryptHashData",
  969. "cryptsp.dll.CryptHashData",
  970. "advapi32.dll.CryptDestroyHash",
  971. "cryptsp.dll.CryptDestroyHash",
  972. "xmllite.dll.CreateXmlReader"
  973. ]
  974.  
  975. [*] Static Analysis: {
  976. "pe": {
  977. "peid_signatures": null,
  978. "imports": [
  979. {
  980. "imports": [
  981. {
  982. "name": "CreateMutexW",
  983. "address": "0x414000"
  984. },
  985. {
  986. "name": "Sleep",
  987. "address": "0x414004"
  988. },
  989. {
  990. "name": "GetLastError",
  991. "address": "0x414008"
  992. },
  993. {
  994. "name": "CloseHandle",
  995. "address": "0x41400c"
  996. },
  997. {
  998. "name": "ExitProcess",
  999. "address": "0x414010"
  1000. },
  1001. {
  1002. "name": "ReadProcessMemory",
  1003. "address": "0x414014"
  1004. },
  1005. {
  1006. "name": "SizeofResource",
  1007. "address": "0x414018"
  1008. },
  1009. {
  1010. "name": "EnumResourceNamesW",
  1011. "address": "0x41401c"
  1012. },
  1013. {
  1014. "name": "LockResource",
  1015. "address": "0x414020"
  1016. },
  1017. {
  1018. "name": "LoadResource",
  1019. "address": "0x414024"
  1020. },
  1021. {
  1022. "name": "FindResourceW",
  1023. "address": "0x414028"
  1024. },
  1025. {
  1026. "name": "CreateDirectoryW",
  1027. "address": "0x41402c"
  1028. },
  1029. {
  1030. "name": "GetModuleFileNameW",
  1031. "address": "0x414030"
  1032. },
  1033. {
  1034. "name": "GetFileAttributesW",
  1035. "address": "0x414034"
  1036. },
  1037. {
  1038. "name": "CreateProcessW",
  1039. "address": "0x414038"
  1040. },
  1041. {
  1042. "name": "CopyFileW",
  1043. "address": "0x41403c"
  1044. },
  1045. {
  1046. "name": "EnterCriticalSection",
  1047. "address": "0x414040"
  1048. },
  1049. {
  1050. "name": "LeaveCriticalSection",
  1051. "address": "0x414044"
  1052. },
  1053. {
  1054. "name": "InitializeCriticalSection",
  1055. "address": "0x414048"
  1056. },
  1057. {
  1058. "name": "DeleteCriticalSection",
  1059. "address": "0x41404c"
  1060. },
  1061. {
  1062. "name": "GlobalSize",
  1063. "address": "0x414050"
  1064. },
  1065. {
  1066. "name": "GlobalAlloc",
  1067. "address": "0x414054"
  1068. },
  1069. {
  1070. "name": "GlobalFree",
  1071. "address": "0x414058"
  1072. },
  1073. {
  1074. "name": "GlobalLock",
  1075. "address": "0x41405c"
  1076. },
  1077. {
  1078. "name": "GetTickCount",
  1079. "address": "0x414060"
  1080. },
  1081. {
  1082. "name": "GlobalUnlock",
  1083. "address": "0x414064"
  1084. },
  1085. {
  1086. "name": "SetLastError",
  1087. "address": "0x414068"
  1088. },
  1089. {
  1090. "name": "WaitForMultipleObjects",
  1091. "address": "0x41406c"
  1092. },
  1093. {
  1094. "name": "CreateEventW",
  1095. "address": "0x414070"
  1096. },
  1097. {
  1098. "name": "GetExitCodeThread",
  1099. "address": "0x414074"
  1100. },
  1101. {
  1102. "name": "SetEvent",
  1103. "address": "0x414078"
  1104. },
  1105. {
  1106. "name": "TerminateThread",
  1107. "address": "0x41407c"
  1108. },
  1109. {
  1110. "name": "CreateThread",
  1111. "address": "0x414080"
  1112. },
  1113. {
  1114. "name": "CreateFileW",
  1115. "address": "0x414084"
  1116. },
  1117. {
  1118. "name": "DecodePointer",
  1119. "address": "0x414088"
  1120. },
  1121. {
  1122. "name": "WriteConsoleW",
  1123. "address": "0x41408c"
  1124. },
  1125. {
  1126. "name": "SetFilePointerEx",
  1127. "address": "0x414090"
  1128. },
  1129. {
  1130. "name": "GetConsoleMode",
  1131. "address": "0x414094"
  1132. },
  1133. {
  1134. "name": "GetConsoleCP",
  1135. "address": "0x414098"
  1136. },
  1137. {
  1138. "name": "FlushFileBuffers",
  1139. "address": "0x41409c"
  1140. },
  1141. {
  1142. "name": "HeapReAlloc",
  1143. "address": "0x4140a0"
  1144. },
  1145. {
  1146. "name": "HeapSize",
  1147. "address": "0x4140a4"
  1148. },
  1149. {
  1150. "name": "GetProcessHeap",
  1151. "address": "0x4140a8"
  1152. },
  1153. {
  1154. "name": "GetStringTypeW",
  1155. "address": "0x4140ac"
  1156. },
  1157. {
  1158. "name": "GetFileType",
  1159. "address": "0x4140b0"
  1160. },
  1161. {
  1162. "name": "SetStdHandle",
  1163. "address": "0x4140b4"
  1164. },
  1165. {
  1166. "name": "LCMapStringW",
  1167. "address": "0x4140b8"
  1168. },
  1169. {
  1170. "name": "FreeEnvironmentStringsW",
  1171. "address": "0x4140bc"
  1172. },
  1173. {
  1174. "name": "GetEnvironmentStringsW",
  1175. "address": "0x4140c0"
  1176. },
  1177. {
  1178. "name": "GetCommandLineW",
  1179. "address": "0x4140c4"
  1180. },
  1181. {
  1182. "name": "GetCommandLineA",
  1183. "address": "0x4140c8"
  1184. },
  1185. {
  1186. "name": "GetCPInfo",
  1187. "address": "0x4140cc"
  1188. },
  1189. {
  1190. "name": "GetOEMCP",
  1191. "address": "0x4140d0"
  1192. },
  1193. {
  1194. "name": "IsValidCodePage",
  1195. "address": "0x4140d4"
  1196. },
  1197. {
  1198. "name": "QueryPerformanceCounter",
  1199. "address": "0x4140d8"
  1200. },
  1201. {
  1202. "name": "GetCurrentProcessId",
  1203. "address": "0x4140dc"
  1204. },
  1205. {
  1206. "name": "GetCurrentThreadId",
  1207. "address": "0x4140e0"
  1208. },
  1209. {
  1210. "name": "GetSystemTimeAsFileTime",
  1211. "address": "0x4140e4"
  1212. },
  1213. {
  1214. "name": "InitializeSListHead",
  1215. "address": "0x4140e8"
  1216. },
  1217. {
  1218. "name": "IsDebuggerPresent",
  1219. "address": "0x4140ec"
  1220. },
  1221. {
  1222. "name": "UnhandledExceptionFilter",
  1223. "address": "0x4140f0"
  1224. },
  1225. {
  1226. "name": "SetUnhandledExceptionFilter",
  1227. "address": "0x4140f4"
  1228. },
  1229. {
  1230. "name": "GetStartupInfoW",
  1231. "address": "0x4140f8"
  1232. },
  1233. {
  1234. "name": "IsProcessorFeaturePresent",
  1235. "address": "0x4140fc"
  1236. },
  1237. {
  1238. "name": "GetModuleHandleW",
  1239. "address": "0x414100"
  1240. },
  1241. {
  1242. "name": "GetCurrentProcess",
  1243. "address": "0x414104"
  1244. },
  1245. {
  1246. "name": "TerminateProcess",
  1247. "address": "0x414108"
  1248. },
  1249. {
  1250. "name": "LocalFree",
  1251. "address": "0x41410c"
  1252. },
  1253. {
  1254. "name": "EncodePointer",
  1255. "address": "0x414110"
  1256. },
  1257. {
  1258. "name": "RaiseException",
  1259. "address": "0x414114"
  1260. },
  1261. {
  1262. "name": "RtlUnwind",
  1263. "address": "0x414118"
  1264. },
  1265. {
  1266. "name": "InitializeCriticalSectionAndSpinCount",
  1267. "address": "0x41411c"
  1268. },
  1269. {
  1270. "name": "TlsAlloc",
  1271. "address": "0x414120"
  1272. },
  1273. {
  1274. "name": "TlsGetValue",
  1275. "address": "0x414124"
  1276. },
  1277. {
  1278. "name": "TlsSetValue",
  1279. "address": "0x414128"
  1280. },
  1281. {
  1282. "name": "TlsFree",
  1283. "address": "0x41412c"
  1284. },
  1285. {
  1286. "name": "FreeLibrary",
  1287. "address": "0x414130"
  1288. },
  1289. {
  1290. "name": "GetProcAddress",
  1291. "address": "0x414134"
  1292. },
  1293. {
  1294. "name": "LoadLibraryExW",
  1295. "address": "0x414138"
  1296. },
  1297. {
  1298. "name": "GetStdHandle",
  1299. "address": "0x41413c"
  1300. },
  1301. {
  1302. "name": "WriteFile",
  1303. "address": "0x414140"
  1304. },
  1305. {
  1306. "name": "GetModuleFileNameA",
  1307. "address": "0x414144"
  1308. },
  1309. {
  1310. "name": "MultiByteToWideChar",
  1311. "address": "0x414148"
  1312. },
  1313. {
  1314. "name": "WideCharToMultiByte",
  1315. "address": "0x41414c"
  1316. },
  1317. {
  1318. "name": "GetModuleHandleExW",
  1319. "address": "0x414150"
  1320. },
  1321. {
  1322. "name": "GetACP",
  1323. "address": "0x414154"
  1324. },
  1325. {
  1326. "name": "HeapFree",
  1327. "address": "0x414158"
  1328. },
  1329. {
  1330. "name": "HeapAlloc",
  1331. "address": "0x41415c"
  1332. },
  1333. {
  1334. "name": "FindClose",
  1335. "address": "0x414160"
  1336. },
  1337. {
  1338. "name": "FindFirstFileExA",
  1339. "address": "0x414164"
  1340. },
  1341. {
  1342. "name": "FindNextFileA",
  1343. "address": "0x414168"
  1344. }
  1345. ],
  1346. "dll": "KERNEL32.dll"
  1347. },
  1348. {
  1349. "imports": [
  1350. {
  1351. "name": "GetMessageW",
  1352. "address": "0x414188"
  1353. },
  1354. {
  1355. "name": "DefWindowProcW",
  1356. "address": "0x41418c"
  1357. },
  1358. {
  1359. "name": "DestroyWindow",
  1360. "address": "0x414190"
  1361. },
  1362. {
  1363. "name": "CreateWindowExW",
  1364. "address": "0x414194"
  1365. },
  1366. {
  1367. "name": "GetClassInfoW",
  1368. "address": "0x414198"
  1369. },
  1370. {
  1371. "name": "CloseWindow",
  1372. "address": "0x41419c"
  1373. },
  1374. {
  1375. "name": "GetWindowLongW",
  1376. "address": "0x4141a0"
  1377. },
  1378. {
  1379. "name": "DispatchMessageW",
  1380. "address": "0x4141a4"
  1381. },
  1382. {
  1383. "name": "RegisterClassW",
  1384. "address": "0x4141a8"
  1385. },
  1386. {
  1387. "name": "TranslateMessage",
  1388. "address": "0x4141ac"
  1389. },
  1390. {
  1391. "name": "RemoveClipboardFormatListener",
  1392. "address": "0x4141b0"
  1393. },
  1394. {
  1395. "name": "SetWindowLongW",
  1396. "address": "0x4141b4"
  1397. },
  1398. {
  1399. "name": "AddClipboardFormatListener",
  1400. "address": "0x4141b8"
  1401. },
  1402. {
  1403. "name": "OpenClipboard",
  1404. "address": "0x4141bc"
  1405. },
  1406. {
  1407. "name": "CloseClipboard",
  1408. "address": "0x4141c0"
  1409. },
  1410. {
  1411. "name": "EmptyClipboard",
  1412. "address": "0x4141c4"
  1413. },
  1414. {
  1415. "name": "GetClipboardData",
  1416. "address": "0x4141c8"
  1417. },
  1418. {
  1419. "name": "SetClipboardData",
  1420. "address": "0x4141cc"
  1421. },
  1422. {
  1423. "name": "IsClipboardFormatAvailable",
  1424. "address": "0x4141d0"
  1425. },
  1426. {
  1427. "name": "GetKeyboardLayoutList",
  1428. "address": "0x4141d4"
  1429. },
  1430. {
  1431. "name": "IsWindow",
  1432. "address": "0x4141d8"
  1433. }
  1434. ],
  1435. "dll": "USER32.dll"
  1436. },
  1437. {
  1438. "imports": [
  1439. {
  1440. "name": "SHGetSpecialFolderPathW",
  1441. "address": "0x414180"
  1442. }
  1443. ],
  1444. "dll": "SHELL32.dll"
  1445. },
  1446. {
  1447. "imports": [
  1448. {
  1449. "name": "CoInitializeEx",
  1450. "address": "0x4141e0"
  1451. },
  1452. {
  1453. "name": "CoCreateInstance",
  1454. "address": "0x4141e4"
  1455. },
  1456. {
  1457. "name": "CoUninitialize",
  1458. "address": "0x4141e8"
  1459. }
  1460. ],
  1461. "dll": "ole32.dll"
  1462. },
  1463. {
  1464. "imports": [
  1465. {
  1466. "name": "VariantInit",
  1467. "address": "0x414170"
  1468. },
  1469. {
  1470. "name": "SysFreeString",
  1471. "address": "0x414174"
  1472. },
  1473. {
  1474. "name": "SysAllocString",
  1475. "address": "0x414178"
  1476. }
  1477. ],
  1478. "dll": "OLEAUT32.dll"
  1479. }
  1480. ],
  1481. "digital_signers": null,
  1482. "exported_dll_name": null,
  1483. "actual_checksum": "0x000229ba",
  1484. "overlay": null,
  1485. "imagebase": "0x00400000",
  1486. "reported_checksum": "0x00000000",
  1487. "icon_hash": null,
  1488. "entrypoint": "0x00407c21",
  1489. "timestamp": "2019-06-04 15:07:23",
  1490. "osversion": "6.0",
  1491. "sections": [
  1492. {
  1493. "name": ".text",
  1494. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1495. "virtual_address": "0x00001000",
  1496. "size_of_data": "0x00012c00",
  1497. "entropy": "6.62",
  1498. "raw_address": "0x00000400",
  1499. "virtual_size": "0x00012b3b",
  1500. "characteristics_raw": "0x60000020"
  1501. },
  1502. {
  1503. "name": ".rdata",
  1504. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1505. "virtual_address": "0x00014000",
  1506. "size_of_data": "0x00009600",
  1507. "entropy": "4.59",
  1508. "raw_address": "0x00013000",
  1509. "virtual_size": "0x000094f4",
  1510. "characteristics_raw": "0x40000040"
  1511. },
  1512. {
  1513. "name": ".data",
  1514. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1515. "virtual_address": "0x0001e000",
  1516. "size_of_data": "0x00002000",
  1517. "entropy": "5.04",
  1518. "raw_address": "0x0001c600",
  1519. "virtual_size": "0x00002938",
  1520. "characteristics_raw": "0xc0000040"
  1521. },
  1522. {
  1523. "name": ".gfids",
  1524. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1525. "virtual_address": "0x00021000",
  1526. "size_of_data": "0x00000200",
  1527. "entropy": "2.12",
  1528. "raw_address": "0x0001e600",
  1529. "virtual_size": "0x0000012c",
  1530. "characteristics_raw": "0x40000040"
  1531. },
  1532. {
  1533. "name": ".rsrc",
  1534. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1535. "virtual_address": "0x00022000",
  1536. "size_of_data": "0x00000a00",
  1537. "entropy": "5.71",
  1538. "raw_address": "0x0001e800",
  1539. "virtual_size": "0x00000834",
  1540. "characteristics_raw": "0x40000040"
  1541. },
  1542. {
  1543. "name": ".reloc",
  1544. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1545. "virtual_address": "0x00023000",
  1546. "size_of_data": "0x00001e00",
  1547. "entropy": "6.43",
  1548. "raw_address": "0x0001f200",
  1549. "virtual_size": "0x00001dd0",
  1550. "characteristics_raw": "0x42000040"
  1551. }
  1552. ],
  1553. "resources": [],
  1554. "dirents": [
  1555. {
  1556. "virtual_address": "0x00000000",
  1557. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1558. "size": "0x00000000"
  1559. },
  1560. {
  1561. "virtual_address": "0x0001c9fc",
  1562. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1563. "size": "0x00000078"
  1564. },
  1565. {
  1566. "virtual_address": "0x00022000",
  1567. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1568. "size": "0x00000834"
  1569. },
  1570. {
  1571. "virtual_address": "0x00000000",
  1572. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1573. "size": "0x00000000"
  1574. },
  1575. {
  1576. "virtual_address": "0x00000000",
  1577. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1578. "size": "0x00000000"
  1579. },
  1580. {
  1581. "virtual_address": "0x00023000",
  1582. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1583. "size": "0x00001dd0"
  1584. },
  1585. {
  1586. "virtual_address": "0x000194b0",
  1587. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1588. "size": "0x00000038"
  1589. },
  1590. {
  1591. "virtual_address": "0x00000000",
  1592. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1593. "size": "0x00000000"
  1594. },
  1595. {
  1596. "virtual_address": "0x00000000",
  1597. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1598. "size": "0x00000000"
  1599. },
  1600. {
  1601. "virtual_address": "0x00000000",
  1602. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1603. "size": "0x00000000"
  1604. },
  1605. {
  1606. "virtual_address": "0x000194e8",
  1607. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1608. "size": "0x00000040"
  1609. },
  1610. {
  1611. "virtual_address": "0x00000000",
  1612. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1613. "size": "0x00000000"
  1614. },
  1615. {
  1616. "virtual_address": "0x00014000",
  1617. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1618. "size": "0x000001f0"
  1619. },
  1620. {
  1621. "virtual_address": "0x00000000",
  1622. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1623. "size": "0x00000000"
  1624. },
  1625. {
  1626. "virtual_address": "0x00000000",
  1627. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1628. "size": "0x00000000"
  1629. },
  1630. {
  1631. "virtual_address": "0x00000000",
  1632. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1633. "size": "0x00000000"
  1634. }
  1635. ],
  1636. "exports": [],
  1637. "guest_signers": {},
  1638. "imphash": "4dfd516b1461e570a523efd4ab8d77c8",
  1639. "icon_fuzzy": null,
  1640. "icon": null,
  1641. "pdbpath": null,
  1642. "imported_dll_count": 5,
  1643. "versioninfo": []
  1644. }
  1645. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!