API tools faq
paste
paladin316

NanoCore_efdf40ad7499614bf3b42cde8a89a06f_exe_2019-06-28_21_30.json

paladin316
Jun 28th, 2019
2,150
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.52 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 2.5
  5.  
  6. [*] File Name: "NanoCore_efdf40ad7499614bf3b42cde8a89a06f.exe"
  7. [*] File Size: 651264
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "a72285f75b51922217e366818777ebce569e447a38ea7b1f88c0c147e420c322"
  10. [*] MD5: "efdf40ad7499614bf3b42cde8a89a06f"
  11. [*] SHA1: "556949433de10206981bb6e98530577ba181d728"
  12. [*] SHA512: "924905e18953d869522010dd5cd36782f01570cc4a09cddc1d655c617b80b9bb030af7ea21aaf52051b07f4e4f601819d76593f0f882024dc693187d65836649"
  13. [*] CRC32: "B4EA45D5"
  14. [*] SSDEEP: "12288:GFrx/uVBmhlEyiZEjVda6H+8GUJG+w3GLh:G2MhlETZERda6H+8GUJGv3"
  15.  
  16. [*] Process Execution: [
  17. "NanoCore_efdf40ad7499614bf3b42cde8a89a06f.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "NanoCore_efdf40ad7499614bf3b42cde8a89a06f.exe (2416) called API CreateProcessInternalW 35761 times"
  30. }
  31. ]
  32. }
  33. ]
  34.  
  35. [*] Started Service: []
  36.  
  37. [*] Executed Commands: [
  38. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\NanoCore_efdf40ad7499614bf3b42cde8a89a06f.exe\""
  39. ]
  40.  
  41. [*] Mutexes: [
  42. "CicLoadWinStaWinSta0",
  43. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  44. ]
  45.  
  46. [*] Modified Files: []
  47.  
  48. [*] Deleted Files: []
  49.  
  50. [*] Modified Registry Keys: [
  51. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\TMe0X1444168993\\tI2C82138740738",
  52. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\TMe0X1444168993\\tI2C82138740738\\w5iY8166182260"
  53. ]
  54.  
  55. [*] Deleted Registry Keys: []
  56.  
  57. [*] DNS Communications: []
  58.  
  59. [*] Domains: []
  60.  
  61. [*] Network Communication - ICMP: []
  62.  
  63. [*] Network Communication - HTTP: []
  64.  
  65. [*] Network Communication - SMTP: []
  66.  
  67. [*] Network Communication - Hosts: []
  68.  
  69. [*] Network Communication - IRC: []
  70.  
  71. [*] Static Analysis: {
  72. "pe": {
  73. "peid_signatures": null,
  74. "imports": [
  75. {
  76. "imports": [
  77. {
  78. "name": null,
  79. "address": "0x401000"
  80. },
  81. {
  82. "name": null,
  83. "address": "0x401004"
  84. },
  85. {
  86. "name": null,
  87. "address": "0x401008"
  88. },
  89. {
  90. "name": null,
  91. "address": "0x40100c"
  92. },
  93. {
  94. "name": null,
  95. "address": "0x401010"
  96. },
  97. {
  98. "name": "MethCallEngine",
  99. "address": "0x401014"
  100. },
  101. {
  102. "name": null,
  103. "address": "0x401018"
  104. },
  105. {
  106. "name": null,
  107. "address": "0x40101c"
  108. },
  109. {
  110. "name": null,
  111. "address": "0x401020"
  112. },
  113. {
  114. "name": null,
  115. "address": "0x401024"
  116. },
  117. {
  118. "name": null,
  119. "address": "0x401028"
  120. },
  121. {
  122. "name": null,
  123. "address": "0x40102c"
  124. },
  125. {
  126. "name": null,
  127. "address": "0x401030"
  128. },
  129. {
  130. "name": null,
  131. "address": "0x401034"
  132. },
  133. {
  134. "name": null,
  135. "address": "0x401038"
  136. },
  137. {
  138. "name": null,
  139. "address": "0x40103c"
  140. },
  141. {
  142. "name": null,
  143. "address": "0x401040"
  144. },
  145. {
  146. "name": null,
  147. "address": "0x401044"
  148. },
  149. {
  150. "name": "EVENT_SINK_AddRef",
  151. "address": "0x401048"
  152. },
  153. {
  154. "name": null,
  155. "address": "0x40104c"
  156. },
  157. {
  158. "name": null,
  159. "address": "0x401050"
  160. },
  161. {
  162. "name": null,
  163. "address": "0x401054"
  164. },
  165. {
  166. "name": null,
  167. "address": "0x401058"
  168. },
  169. {
  170. "name": "EVENT_SINK_Release",
  171. "address": "0x40105c"
  172. },
  173. {
  174. "name": null,
  175. "address": "0x401060"
  176. },
  177. {
  178. "name": "EVENT_SINK_QueryInterface",
  179. "address": "0x401064"
  180. },
  181. {
  182. "name": "__vbaExceptHandler",
  183. "address": "0x401068"
  184. },
  185. {
  186. "name": null,
  187. "address": "0x40106c"
  188. },
  189. {
  190. "name": null,
  191. "address": "0x401070"
  192. },
  193. {
  194. "name": null,
  195. "address": "0x401074"
  196. },
  197. {
  198. "name": null,
  199. "address": "0x401078"
  200. },
  201. {
  202. "name": null,
  203. "address": "0x40107c"
  204. },
  205. {
  206. "name": null,
  207. "address": "0x401080"
  208. },
  209. {
  210. "name": null,
  211. "address": "0x401084"
  212. },
  213. {
  214. "name": null,
  215. "address": "0x401088"
  216. },
  217. {
  218. "name": null,
  219. "address": "0x40108c"
  220. },
  221. {
  222. "name": null,
  223. "address": "0x401090"
  224. },
  225. {
  226. "name": null,
  227. "address": "0x401094"
  228. },
  229. {
  230. "name": null,
  231. "address": "0x401098"
  232. },
  233. {
  234. "name": null,
  235. "address": "0x40109c"
  236. }
  237. ],
  238. "dll": "MSVBVM60.DLL"
  239. }
  240. ],
  241. "digital_signers": null,
  242. "exported_dll_name": null,
  243. "actual_checksum": "0x000a9eca",
  244. "overlay": null,
  245. "imagebase": "0x00400000",
  246. "reported_checksum": "0x000a9eca",
  247. "icon_hash": null,
  248. "entrypoint": "0x004011a0",
  249. "timestamp": "2019-06-28 20:32:30",
  250. "osversion": "4.0",
  251. "sections": [
  252. {
  253. "name": ".text",
  254. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  255. "virtual_address": "0x00001000",
  256. "size_of_data": "0x00098000",
  257. "entropy": "6.71",
  258. "raw_address": "0x00001000",
  259. "virtual_size": "0x00097a0c",
  260. "characteristics_raw": "0x60000020"
  261. },
  262. {
  263. "name": ".data",
  264. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  265. "virtual_address": "0x00099000",
  266. "size_of_data": "0x00000000",
  267. "entropy": "0.00",
  268. "raw_address": "0x00000000",
  269. "virtual_size": "0x0000631c",
  270. "characteristics_raw": "0xc0000040"
  271. },
  272. {
  273. "name": ".rsrc",
  274. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  275. "virtual_address": "0x000a0000",
  276. "size_of_data": "0x00006000",
  277. "entropy": "4.22",
  278. "raw_address": "0x00099000",
  279. "virtual_size": "0x00005940",
  280. "characteristics_raw": "0x40000040"
  281. }
  282. ],
  283. "resources": [],
  284. "dirents": [
  285. {
  286. "virtual_address": "0x00000000",
  287. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  288. "size": "0x00000000"
  289. },
  290. {
  291. "virtual_address": "0x000988c4",
  292. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  293. "size": "0x00000028"
  294. },
  295. {
  296. "virtual_address": "0x000a0000",
  297. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  298. "size": "0x00005940"
  299. },
  300. {
  301. "virtual_address": "0x00000000",
  302. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  303. "size": "0x00000000"
  304. },
  305. {
  306. "virtual_address": "0x00000000",
  307. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  308. "size": "0x00000000"
  309. },
  310. {
  311. "virtual_address": "0x00000000",
  312. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  313. "size": "0x00000000"
  314. },
  315. {
  316. "virtual_address": "0x00000000",
  317. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  318. "size": "0x00000000"
  319. },
  320. {
  321. "virtual_address": "0x00000000",
  322. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  323. "size": "0x00000000"
  324. },
  325. {
  326. "virtual_address": "0x00000000",
  327. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  328. "size": "0x00000000"
  329. },
  330. {
  331. "virtual_address": "0x00000000",
  332. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  333. "size": "0x00000000"
  334. },
  335. {
  336. "virtual_address": "0x00000000",
  337. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  338. "size": "0x00000000"
  339. },
  340. {
  341. "virtual_address": "0x00000220",
  342. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  343. "size": "0x00000020"
  344. },
  345. {
  346. "virtual_address": "0x00001000",
  347. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  348. "size": "0x000000a4"
  349. },
  350. {
  351. "virtual_address": "0x00000000",
  352. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  353. "size": "0x00000000"
  354. },
  355. {
  356. "virtual_address": "0x00000000",
  357. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  358. "size": "0x00000000"
  359. },
  360. {
  361. "virtual_address": "0x00000000",
  362. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  363. "size": "0x00000000"
  364. }
  365. ],
  366. "exports": [],
  367. "guest_signers": {},
  368. "imphash": "e4b426c4998f12fa3cecdd6c36ef6fe0",
  369. "icon_fuzzy": null,
  370. "icon": null,
  371. "pdbpath": null,
  372. "imported_dll_count": 1,
  373. "versioninfo": []
  374. }
  375. }
  376.  
  377. [*] Resolved APIs: [
  378. "cryptbase.dll.SystemFunction036",
  379. "uxtheme.dll.ThemeInitApiHook",
  380. "user32.dll.IsProcessDPIAware",
  381. "oleaut32.dll.OleLoadPictureEx",
  382. "oleaut32.dll.DispCallFunc",
  383. "oleaut32.dll.LoadTypeLibEx",
  384. "oleaut32.dll.UnRegisterTypeLib",
  385. "oleaut32.dll.CreateTypeLib2",
  386. "oleaut32.dll.VarDateFromUdate",
  387. "oleaut32.dll.VarUdateFromDate",
  388. "oleaut32.dll.GetAltMonthNames",
  389. "oleaut32.dll.VarNumFromParseNum",
  390. "oleaut32.dll.VarParseNumFromStr",
  391. "oleaut32.dll.VarDecFromR4",
  392. "oleaut32.dll.VarDecFromR8",
  393. "oleaut32.dll.VarDecFromDate",
  394. "oleaut32.dll.VarDecFromI4",
  395. "oleaut32.dll.VarDecFromCy",
  396. "oleaut32.dll.VarR4FromDec",
  397. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  398. "oleaut32.dll.GetRecordInfoFromGuids",
  399. "oleaut32.dll.SafeArrayGetRecordInfo",
  400. "oleaut32.dll.SafeArraySetRecordInfo",
  401. "oleaut32.dll.SafeArrayGetIID",
  402. "oleaut32.dll.SafeArraySetIID",
  403. "oleaut32.dll.SafeArrayCopyData",
  404. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  405. "oleaut32.dll.SafeArrayCreateEx",
  406. "oleaut32.dll.VarFormat",
  407. "oleaut32.dll.VarFormatDateTime",
  408. "oleaut32.dll.VarFormatNumber",
  409. "oleaut32.dll.VarFormatPercent",
  410. "oleaut32.dll.VarFormatCurrency",
  411. "oleaut32.dll.VarWeekdayName",
  412. "oleaut32.dll.VarMonthName",
  413. "oleaut32.dll.VarAdd",
  414. "oleaut32.dll.VarAnd",
  415. "oleaut32.dll.VarCat",
  416. "oleaut32.dll.VarDiv",
  417. "oleaut32.dll.VarEqv",
  418. "oleaut32.dll.VarIdiv",
  419. "oleaut32.dll.VarImp",
  420. "oleaut32.dll.VarMod",
  421. "oleaut32.dll.VarMul",
  422. "oleaut32.dll.VarOr",
  423. "oleaut32.dll.VarPow",
  424. "oleaut32.dll.VarSub",
  425. "oleaut32.dll.VarXor",
  426. "oleaut32.dll.VarAbs",
  427. "oleaut32.dll.VarFix",
  428. "oleaut32.dll.VarInt",
  429. "oleaut32.dll.VarNeg",
  430. "oleaut32.dll.VarNot",
  431. "oleaut32.dll.VarRound",
  432. "oleaut32.dll.VarCmp",
  433. "oleaut32.dll.VarDecAdd",
  434. "oleaut32.dll.VarDecCmp",
  435. "oleaut32.dll.VarBstrCat",
  436. "oleaut32.dll.VarCyMulI4",
  437. "oleaut32.dll.VarBstrCmp",
  438. "ole32.dll.CoCreateInstanceEx",
  439. "ole32.dll.CLSIDFromProgIDEx",
  440. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  441. "user32.dll.GetSystemMetrics",
  442. "user32.dll.MonitorFromWindow",
  443. "user32.dll.MonitorFromRect",
  444. "user32.dll.MonitorFromPoint",
  445. "user32.dll.EnumDisplayMonitors",
  446. "user32.dll.GetMonitorInfoA",
  447. "dwmapi.dll.DwmIsCompositionEnabled",
  448. "gdi32.dll.GetLayout",
  449. "gdi32.dll.GdiRealizationInfo",
  450. "gdi32.dll.FontIsLinked",
  451. "advapi32.dll.RegOpenKeyExW",
  452. "advapi32.dll.RegQueryInfoKeyW",
  453. "gdi32.dll.GetTextFaceAliasW",
  454. "advapi32.dll.RegEnumValueW",
  455. "advapi32.dll.RegCloseKey",
  456. "advapi32.dll.RegQueryValueExW",
  457. "gdi32.dll.GetFontAssocStatus",
  458. "advapi32.dll.RegQueryValueExA",
  459. "advapi32.dll.RegEnumKeyExW",
  460. "gdi32.dll.GdiIsMetaPrintDC",
  461. "ole32.dll.CoInitializeEx",
  462. "ole32.dll.CoUninitialize",
  463. "ole32.dll.CoRegisterInitializeSpy",
  464. "ole32.dll.CoRevokeInitializeSpy",
  465. "gdi32.dll.GetTextExtentExPointWPri",
  466. "kernel32.dll.NlsGetCacheUpdateCount",
  467. "kernel32.dll.GetCalendarInfoW",
  468. "kernel32.dll.GetTickCount",
  469. "kernel32.dll.Sleep",
  470. "user32.dll.GetCursorPos",
  471. "user32.dll.EnumWindows",
  472. "kernel32.dll.SetErrorMode",
  473. "kernel32.dll.SetLastError",
  474. "kernel32.dll.VirtualAllocEx",
  475. "kernel32.dll.CloseHandle",
  476. "shell32.dll.ShellExecuteW",
  477. "kernel32.dll.WriteFile",
  478. "kernel32.dll.UnmapViewOfFile",
  479. "kernel32.dll.CreateFileW",
  480. "kernel32.dll.TerminateProcess",
  481. "kernel32.dll.VirtualProtectEx",
  482. "kernel32.dll.CreateProcessInternalW",
  483. "kernel32.dll.GetTempPathW",
  484. "kernel32.dll.GetLongPathNameW",
  485. "kernel32.dll.GetFileSize",
  486. "kernel32.dll.ReadFile",
  487. "ntdll.dll.NtProtectVirtualMemory",
  488. "kernel32.dll.GetCommandLineW"
  489. ]
  490.  
  491. [*] Static Analysis: {
  492. "pe": {
  493. "peid_signatures": null,
  494. "imports": [
  495. {
  496. "imports": [
  497. {
  498. "name": null,
  499. "address": "0x401000"
  500. },
  501. {
  502. "name": null,
  503. "address": "0x401004"
  504. },
  505. {
  506. "name": null,
  507. "address": "0x401008"
  508. },
  509. {
  510. "name": null,
  511. "address": "0x40100c"
  512. },
  513. {
  514. "name": null,
  515. "address": "0x401010"
  516. },
  517. {
  518. "name": "MethCallEngine",
  519. "address": "0x401014"
  520. },
  521. {
  522. "name": null,
  523. "address": "0x401018"
  524. },
  525. {
  526. "name": null,
  527. "address": "0x40101c"
  528. },
  529. {
  530. "name": null,
  531. "address": "0x401020"
  532. },
  533. {
  534. "name": null,
  535. "address": "0x401024"
  536. },
  537. {
  538. "name": null,
  539. "address": "0x401028"
  540. },
  541. {
  542. "name": null,
  543. "address": "0x40102c"
  544. },
  545. {
  546. "name": null,
  547. "address": "0x401030"
  548. },
  549. {
  550. "name": null,
  551. "address": "0x401034"
  552. },
  553. {
  554. "name": null,
  555. "address": "0x401038"
  556. },
  557. {
  558. "name": null,
  559. "address": "0x40103c"
  560. },
  561. {
  562. "name": null,
  563. "address": "0x401040"
  564. },
  565. {
  566. "name": null,
  567. "address": "0x401044"
  568. },
  569. {
  570. "name": "EVENT_SINK_AddRef",
  571. "address": "0x401048"
  572. },
  573. {
  574. "name": null,
  575. "address": "0x40104c"
  576. },
  577. {
  578. "name": null,
  579. "address": "0x401050"
  580. },
  581. {
  582. "name": null,
  583. "address": "0x401054"
  584. },
  585. {
  586. "name": null,
  587. "address": "0x401058"
  588. },
  589. {
  590. "name": "EVENT_SINK_Release",
  591. "address": "0x40105c"
  592. },
  593. {
  594. "name": null,
  595. "address": "0x401060"
  596. },
  597. {
  598. "name": "EVENT_SINK_QueryInterface",
  599. "address": "0x401064"
  600. },
  601. {
  602. "name": "__vbaExceptHandler",
  603. "address": "0x401068"
  604. },
  605. {
  606. "name": null,
  607. "address": "0x40106c"
  608. },
  609. {
  610. "name": null,
  611. "address": "0x401070"
  612. },
  613. {
  614. "name": null,
  615. "address": "0x401074"
  616. },
  617. {
  618. "name": null,
  619. "address": "0x401078"
  620. },
  621. {
  622. "name": null,
  623. "address": "0x40107c"
  624. },
  625. {
  626. "name": null,
  627. "address": "0x401080"
  628. },
  629. {
  630. "name": null,
  631. "address": "0x401084"
  632. },
  633. {
  634. "name": null,
  635. "address": "0x401088"
  636. },
  637. {
  638. "name": null,
  639. "address": "0x40108c"
  640. },
  641. {
  642. "name": null,
  643. "address": "0x401090"
  644. },
  645. {
  646. "name": null,
  647. "address": "0x401094"
  648. },
  649. {
  650. "name": null,
  651. "address": "0x401098"
  652. },
  653. {
  654. "name": null,
  655. "address": "0x40109c"
  656. }
  657. ],
  658. "dll": "MSVBVM60.DLL"
  659. }
  660. ],
  661. "digital_signers": null,
  662. "exported_dll_name": null,
  663. "actual_checksum": "0x000a9eca",
  664. "overlay": null,
  665. "imagebase": "0x00400000",
  666. "reported_checksum": "0x000a9eca",
  667. "icon_hash": null,
  668. "entrypoint": "0x004011a0",
  669. "timestamp": "2019-06-28 20:32:30",
  670. "osversion": "4.0",
  671. "sections": [
  672. {
  673. "name": ".text",
  674. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  675. "virtual_address": "0x00001000",
  676. "size_of_data": "0x00098000",
  677. "entropy": "6.71",
  678. "raw_address": "0x00001000",
  679. "virtual_size": "0x00097a0c",
  680. "characteristics_raw": "0x60000020"
  681. },
  682. {
  683. "name": ".data",
  684. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  685. "virtual_address": "0x00099000",
  686. "size_of_data": "0x00000000",
  687. "entropy": "0.00",
  688. "raw_address": "0x00000000",
  689. "virtual_size": "0x0000631c",
  690. "characteristics_raw": "0xc0000040"
  691. },
  692. {
  693. "name": ".rsrc",
  694. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  695. "virtual_address": "0x000a0000",
  696. "size_of_data": "0x00006000",
  697. "entropy": "4.22",
  698. "raw_address": "0x00099000",
  699. "virtual_size": "0x00005940",
  700. "characteristics_raw": "0x40000040"
  701. }
  702. ],
  703. "resources": [],
  704. "dirents": [
  705. {
  706. "virtual_address": "0x00000000",
  707. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  708. "size": "0x00000000"
  709. },
  710. {
  711. "virtual_address": "0x000988c4",
  712. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  713. "size": "0x00000028"
  714. },
  715. {
  716. "virtual_address": "0x000a0000",
  717. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  718. "size": "0x00005940"
  719. },
  720. {
  721. "virtual_address": "0x00000000",
  722. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  723. "size": "0x00000000"
  724. },
  725. {
  726. "virtual_address": "0x00000000",
  727. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  728. "size": "0x00000000"
  729. },
  730. {
  731. "virtual_address": "0x00000000",
  732. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  733. "size": "0x00000000"
  734. },
  735. {
  736. "virtual_address": "0x00000000",
  737. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  738. "size": "0x00000000"
  739. },
  740. {
  741. "virtual_address": "0x00000000",
  742. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  743. "size": "0x00000000"
  744. },
  745. {
  746. "virtual_address": "0x00000000",
  747. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  748. "size": "0x00000000"
  749. },
  750. {
  751. "virtual_address": "0x00000000",
  752. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  753. "size": "0x00000000"
  754. },
  755. {
  756. "virtual_address": "0x00000000",
  757. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  758. "size": "0x00000000"
  759. },
  760. {
  761. "virtual_address": "0x00000220",
  762. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  763. "size": "0x00000020"
  764. },
  765. {
  766. "virtual_address": "0x00001000",
  767. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  768. "size": "0x000000a4"
  769. },
  770. {
  771. "virtual_address": "0x00000000",
  772. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  773. "size": "0x00000000"
  774. },
  775. {
  776. "virtual_address": "0x00000000",
  777. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  778. "size": "0x00000000"
  779. },
  780. {
  781. "virtual_address": "0x00000000",
  782. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  783. "size": "0x00000000"
  784. }
  785. ],
  786. "exports": [],
  787. "guest_signers": {},
  788. "imphash": "e4b426c4998f12fa3cecdd6c36ef6fe0",
  789. "icon_fuzzy": null,
  790. "icon": null,
  791. "pdbpath": null,
  792. "imported_dll_count": 1,
  793. "versioninfo": []
  794. }
  795. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!