API tools faq
paste
paladin316

Exes_9b04f4e437e1025cf6302fc750eb1b20_1.json

paladin316
Jun 19th, 2019
2,283
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 71.37 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Mokes"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_9b04f4e437e1025cf6302fc750eb1b20.1"
  7. [*] File Size: 502784
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "5feb7f9c114ccdc2f71f5ba935b21f202808291f5dc1480dc80d25bace1208e1"
  10. [*] MD5: "9b04f4e437e1025cf6302fc750eb1b20"
  11. [*] SHA1: "b118c99fb7b3ee7c1ef7aec2517f451ddf9d74ad"
  12. [*] SHA512: "1573c94399ea224918c86dcb4d3bf6b496660b86db2023198a608b4aa6bd3bea6f339c174718031e577f32f71b6591bca93619fa6c9e99376d6bdfb4474b2d24"
  13. [*] CRC32: "DE33A8EE"
  14. [*] SSDEEP: "12288:nh9VwKh2B3YLcD0LWn6m72HBgbRKKL6rwmiDSDw+t0c5:nWUqnDUKLCwmiWDw+Cc"
  15.  
  16. [*] Process Execution: [
  17. "Exes_9b04f4e437e1025cf6302fc750eb1b20.1"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Performs some HTTP requests",
  23. "Details": [
  24. {
  25. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  26. },
  27. {
  28. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  29. },
  30. {
  31. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  37. "Details": [
  38. {
  39. "Spam": "Exes_9b04f4e437e1025cf6302fc750eb1b20.1 (1668) called API CryptEnumProvidersA 53884 times"
  40. }
  41. ]
  42. },
  43. {
  44. "Description": "File has been identified by 43 Antiviruses on VirusTotal as malicious",
  45. "Details": [
  46. {
  47. "MicroWorld-eScan": "Trojan.GenericKD.32056294"
  48. },
  49. {
  50. "FireEye": "Generic.mg.9b04f4e437e1025c"
  51. },
  52. {
  53. "McAfee": "Artemis!9B04F4E437E1"
  54. },
  55. {
  56. "SUPERAntiSpyware": "Trojan.Agent/Gen-JFake"
  57. },
  58. {
  59. "Alibaba": "Backdoor:Win32/Mokes.71a382f0"
  60. },
  61. {
  62. "K7GW": "Riskware ( 0040eff71 )"
  63. },
  64. {
  65. "K7AntiVirus": "Riskware ( 0040eff71 )"
  66. },
  67. {
  68. "Symantec": "Trojan.Gen.2"
  69. },
  70. {
  71. "APEX": "Malicious"
  72. },
  73. {
  74. "Avast": "Win32:Trojan-gen"
  75. },
  76. {
  77. "Kaspersky": "Backdoor.Win32.Mokes.agox"
  78. },
  79. {
  80. "BitDefender": "Trojan.GenericKD.32056294"
  81. },
  82. {
  83. "Paloalto": "generic.ml"
  84. },
  85. {
  86. "AegisLab": "Trojan.Multi.Generic.4!c"
  87. },
  88. {
  89. "Rising": "Backdoor.Mokes!8.619 (CLOUD)"
  90. },
  91. {
  92. "Endgame": "malicious (high confidence)"
  93. },
  94. {
  95. "Emsisoft": "Trojan.GenericKD.32056294 (B)"
  96. },
  97. {
  98. "Comodo": "Malware@#xoft8dmrt0us"
  99. },
  100. {
  101. "DrWeb": "Trojan.DownLoader28.57632"
  102. },
  103. {
  104. "Invincea": "heuristic"
  105. },
  106. {
  107. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.gh"
  108. },
  109. {
  110. "Sophos": "Mal/Generic-S"
  111. },
  112. {
  113. "SentinelOne": "DFI - Suspicious PE"
  114. },
  115. {
  116. "Cyren": "W32/Trojan.BRNJ-2247"
  117. },
  118. {
  119. "ESET-NOD32": "a variant of Generik.CELEOFT"
  120. },
  121. {
  122. "eGambit": "Unsafe.AI_Score_79%"
  123. },
  124. {
  125. "Microsoft": "Trojan:Win32/Bitrep.A"
  126. },
  127. {
  128. "Arcabit": "Trojan.Generic.D1E923E6"
  129. },
  130. {
  131. "ZoneAlarm": "Backdoor.Win32.Mokes.agox"
  132. },
  133. {
  134. "GData": "Trojan.GenericKD.32056294"
  135. },
  136. {
  137. "AhnLab-V3": "Trojan/Win32.Agent.C3289662"
  138. },
  139. {
  140. "Acronis": "suspicious"
  141. },
  142. {
  143. "ALYac": "Trojan.GenericKD.32056294"
  144. },
  145. {
  146. "Ad-Aware": "Trojan.GenericKD.32056294"
  147. },
  148. {
  149. "Malwarebytes": "Trojan.Crypt"
  150. },
  151. {
  152. "TrendMicro-HouseCall": "TROJ_GEN.R002H09FE19"
  153. },
  154. {
  155. "Tencent": "Win32.Backdoor.Mokes.Hssa"
  156. },
  157. {
  158. "Ikarus": "Trojan-Ransom.GandCrab"
  159. },
  160. {
  161. "Fortinet": "W32/Mokes.AGOX!tr.bdr"
  162. },
  163. {
  164. "AVG": "Win32:Trojan-gen"
  165. },
  166. {
  167. "Panda": "Trj/CI.A"
  168. },
  169. {
  170. "CrowdStrike": "win/malicious_confidence_90% (W)"
  171. },
  172. {
  173. "Qihoo-360": "HEUR/QVM10.2.D84F.Malware.Gen"
  174. }
  175. ]
  176. }
  177. ]
  178.  
  179. [*] Started Service: []
  180.  
  181. [*] Executed Commands: []
  182.  
  183. [*] Mutexes: []
  184.  
  185. [*] Modified Files: [
  186. "C:\\Users\\user\\AppData\\Local\\Temp\\4470240"
  187. ]
  188.  
  189. [*] Deleted Files: []
  190.  
  191. [*] Modified Registry Keys: []
  192.  
  193. [*] Deleted Registry Keys: []
  194.  
  195. [*] DNS Communications: []
  196.  
  197. [*] Domains: []
  198.  
  199. [*] Network Communication - ICMP: []
  200.  
  201. [*] Network Communication - HTTP: [
  202. {
  203. "count": 1,
  204. "body": "",
  205. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  206. "user-agent": "Microsoft-CryptoAPI/6.1",
  207. "method": "GET",
  208. "host": "ocsp.digicert.com",
  209. "version": "1.1",
  210. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  211. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  212. "port": 80
  213. },
  214. {
  215. "count": 1,
  216. "body": "",
  217. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  218. "user-agent": "Microsoft-CryptoAPI/6.1",
  219. "method": "GET",
  220. "host": "ocsp.digicert.com",
  221. "version": "1.1",
  222. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  223. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  224. "port": 80
  225. },
  226. {
  227. "count": 1,
  228. "body": "",
  229. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  230. "user-agent": "Microsoft-CryptoAPI/6.1",
  231. "method": "GET",
  232. "host": "ocsp.digicert.com",
  233. "version": "1.1",
  234. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  235. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  236. "port": 80
  237. }
  238. ]
  239.  
  240. [*] Network Communication - SMTP: []
  241.  
  242. [*] Network Communication - Hosts: []
  243.  
  244. [*] Network Communication - IRC: []
  245.  
  246. [*] Static Analysis: {
  247. "pe": {
  248. "peid_signatures": null,
  249. "imports": [
  250. {
  251. "imports": [
  252. {
  253. "name": "SetStdHandle",
  254. "address": "0x43a080"
  255. },
  256. {
  257. "name": "FreeEnvironmentStringsW",
  258. "address": "0x43a084"
  259. },
  260. {
  261. "name": "GetEnvironmentStringsW",
  262. "address": "0x43a088"
  263. },
  264. {
  265. "name": "GetCommandLineW",
  266. "address": "0x43a08c"
  267. },
  268. {
  269. "name": "GetCommandLineA",
  270. "address": "0x43a090"
  271. },
  272. {
  273. "name": "GetOEMCP",
  274. "address": "0x43a094"
  275. },
  276. {
  277. "name": "GetACP",
  278. "address": "0x43a098"
  279. },
  280. {
  281. "name": "IsValidCodePage",
  282. "address": "0x43a09c"
  283. },
  284. {
  285. "name": "FindNextFileW",
  286. "address": "0x43a0a0"
  287. },
  288. {
  289. "name": "FindFirstFileExW",
  290. "address": "0x43a0a4"
  291. },
  292. {
  293. "name": "FindClose",
  294. "address": "0x43a0a8"
  295. },
  296. {
  297. "name": "EnumSystemLocalesW",
  298. "address": "0x43a0ac"
  299. },
  300. {
  301. "name": "GetUserDefaultLCID",
  302. "address": "0x43a0b0"
  303. },
  304. {
  305. "name": "GetFileSizeEx",
  306. "address": "0x43a0b4"
  307. },
  308. {
  309. "name": "GetConsoleCP",
  310. "address": "0x43a0b8"
  311. },
  312. {
  313. "name": "ReadConsoleW",
  314. "address": "0x43a0bc"
  315. },
  316. {
  317. "name": "GetFileAttributesExW",
  318. "address": "0x43a0c0"
  319. },
  320. {
  321. "name": "SetFilePointerEx",
  322. "address": "0x43a0c4"
  323. },
  324. {
  325. "name": "OutputDebugStringW",
  326. "address": "0x43a0c8"
  327. },
  328. {
  329. "name": "CloseHandle",
  330. "address": "0x43a0cc"
  331. },
  332. {
  333. "name": "HeapFree",
  334. "address": "0x43a0d0"
  335. },
  336. {
  337. "name": "HeapReAlloc",
  338. "address": "0x43a0d4"
  339. },
  340. {
  341. "name": "ExitProcess",
  342. "address": "0x43a0d8"
  343. },
  344. {
  345. "name": "ReadFile",
  346. "address": "0x43a0dc"
  347. },
  348. {
  349. "name": "WriteConsoleW",
  350. "address": "0x43a0e0"
  351. },
  352. {
  353. "name": "HeapSize",
  354. "address": "0x43a0e4"
  355. },
  356. {
  357. "name": "FlushFileBuffers",
  358. "address": "0x43a0e8"
  359. },
  360. {
  361. "name": "SetCommState",
  362. "address": "0x43a0ec"
  363. },
  364. {
  365. "name": "WideCharToMultiByte",
  366. "address": "0x43a0f0"
  367. },
  368. {
  369. "name": "GetProcessHeap",
  370. "address": "0x43a0f4"
  371. },
  372. {
  373. "name": "GetCurrentProcessId",
  374. "address": "0x43a0f8"
  375. },
  376. {
  377. "name": "LocalFree",
  378. "address": "0x43a0fc"
  379. },
  380. {
  381. "name": "GetProcAddress",
  382. "address": "0x43a100"
  383. },
  384. {
  385. "name": "GetOverlappedResult",
  386. "address": "0x43a104"
  387. },
  388. {
  389. "name": "HeapAlloc",
  390. "address": "0x43a108"
  391. },
  392. {
  393. "name": "IsValidLocale",
  394. "address": "0x43a10c"
  395. },
  396. {
  397. "name": "LoadLibraryW",
  398. "address": "0x43a110"
  399. },
  400. {
  401. "name": "GetConsoleTitleA",
  402. "address": "0x43a114"
  403. },
  404. {
  405. "name": "DeleteFileW",
  406. "address": "0x43a118"
  407. },
  408. {
  409. "name": "GetCommState",
  410. "address": "0x43a11c"
  411. },
  412. {
  413. "name": "GetLastError",
  414. "address": "0x43a120"
  415. },
  416. {
  417. "name": "CreateEventW",
  418. "address": "0x43a124"
  419. },
  420. {
  421. "name": "GetModuleHandleA",
  422. "address": "0x43a128"
  423. },
  424. {
  425. "name": "GetCurrentThreadId",
  426. "address": "0x43a12c"
  427. },
  428. {
  429. "name": "CreateFileW",
  430. "address": "0x43a130"
  431. },
  432. {
  433. "name": "LocalAlloc",
  434. "address": "0x43a134"
  435. },
  436. {
  437. "name": "WaitForSingleObject",
  438. "address": "0x43a138"
  439. },
  440. {
  441. "name": "GetTempPathW",
  442. "address": "0x43a13c"
  443. },
  444. {
  445. "name": "GetCompressedFileSizeW",
  446. "address": "0x43a140"
  447. },
  448. {
  449. "name": "VirtualAlloc",
  450. "address": "0x43a144"
  451. },
  452. {
  453. "name": "WriteFile",
  454. "address": "0x43a148"
  455. },
  456. {
  457. "name": "GetModuleHandleExW",
  458. "address": "0x43a14c"
  459. },
  460. {
  461. "name": "GetModuleFileNameW",
  462. "address": "0x43a150"
  463. },
  464. {
  465. "name": "GetFileType",
  466. "address": "0x43a154"
  467. },
  468. {
  469. "name": "GetStdHandle",
  470. "address": "0x43a158"
  471. },
  472. {
  473. "name": "SetEndOfFile",
  474. "address": "0x43a15c"
  475. },
  476. {
  477. "name": "RtlUnwind",
  478. "address": "0x43a160"
  479. },
  480. {
  481. "name": "RaiseException",
  482. "address": "0x43a164"
  483. },
  484. {
  485. "name": "LoadLibraryA",
  486. "address": "0x43a168"
  487. },
  488. {
  489. "name": "LoadLibraryExW",
  490. "address": "0x43a16c"
  491. },
  492. {
  493. "name": "FreeLibrary",
  494. "address": "0x43a170"
  495. },
  496. {
  497. "name": "GetCPInfo",
  498. "address": "0x43a174"
  499. },
  500. {
  501. "name": "GetCurrentProcess",
  502. "address": "0x43a178"
  503. },
  504. {
  505. "name": "GetConsoleMode",
  506. "address": "0x43a17c"
  507. },
  508. {
  509. "name": "FindFirstFileA",
  510. "address": "0x43a180"
  511. },
  512. {
  513. "name": "GetStringTypeW",
  514. "address": "0x43a184"
  515. },
  516. {
  517. "name": "GetLocaleInfoW",
  518. "address": "0x43a188"
  519. },
  520. {
  521. "name": "LCMapStringW",
  522. "address": "0x43a18c"
  523. },
  524. {
  525. "name": "EnterCriticalSection",
  526. "address": "0x43a190"
  527. },
  528. {
  529. "name": "LeaveCriticalSection",
  530. "address": "0x43a194"
  531. },
  532. {
  533. "name": "DeleteCriticalSection",
  534. "address": "0x43a198"
  535. },
  536. {
  537. "name": "SetEvent",
  538. "address": "0x43a19c"
  539. },
  540. {
  541. "name": "ResetEvent",
  542. "address": "0x43a1a0"
  543. },
  544. {
  545. "name": "WaitForSingleObjectEx",
  546. "address": "0x43a1a4"
  547. },
  548. {
  549. "name": "GetModuleHandleW",
  550. "address": "0x43a1a8"
  551. },
  552. {
  553. "name": "UnhandledExceptionFilter",
  554. "address": "0x43a1ac"
  555. },
  556. {
  557. "name": "SetUnhandledExceptionFilter",
  558. "address": "0x43a1b0"
  559. },
  560. {
  561. "name": "TerminateProcess",
  562. "address": "0x43a1b4"
  563. },
  564. {
  565. "name": "IsProcessorFeaturePresent",
  566. "address": "0x43a1b8"
  567. },
  568. {
  569. "name": "IsDebuggerPresent",
  570. "address": "0x43a1bc"
  571. },
  572. {
  573. "name": "GetStartupInfoW",
  574. "address": "0x43a1c0"
  575. },
  576. {
  577. "name": "QueryPerformanceCounter",
  578. "address": "0x43a1c4"
  579. },
  580. {
  581. "name": "GetSystemTimeAsFileTime",
  582. "address": "0x43a1c8"
  583. },
  584. {
  585. "name": "InitializeSListHead",
  586. "address": "0x43a1cc"
  587. },
  588. {
  589. "name": "EncodePointer",
  590. "address": "0x43a1d0"
  591. },
  592. {
  593. "name": "DecodePointer",
  594. "address": "0x43a1d4"
  595. },
  596. {
  597. "name": "MultiByteToWideChar",
  598. "address": "0x43a1d8"
  599. },
  600. {
  601. "name": "SetLastError",
  602. "address": "0x43a1dc"
  603. },
  604. {
  605. "name": "InitializeCriticalSectionAndSpinCount",
  606. "address": "0x43a1e0"
  607. },
  608. {
  609. "name": "TlsAlloc",
  610. "address": "0x43a1e4"
  611. },
  612. {
  613. "name": "TlsGetValue",
  614. "address": "0x43a1e8"
  615. },
  616. {
  617. "name": "TlsSetValue",
  618. "address": "0x43a1ec"
  619. },
  620. {
  621. "name": "TlsFree",
  622. "address": "0x43a1f0"
  623. }
  624. ],
  625. "dll": "KERNEL32.dll"
  626. },
  627. {
  628. "imports": [
  629. {
  630. "name": "GetUserObjectSecurity",
  631. "address": "0x43a21c"
  632. },
  633. {
  634. "name": "RegisterClassW",
  635. "address": "0x43a220"
  636. },
  637. {
  638. "name": "SendMessageW",
  639. "address": "0x43a224"
  640. },
  641. {
  642. "name": "CreateWindowExW",
  643. "address": "0x43a228"
  644. },
  645. {
  646. "name": "LoadImageW",
  647. "address": "0x43a22c"
  648. },
  649. {
  650. "name": "CreateMenu",
  651. "address": "0x43a230"
  652. },
  653. {
  654. "name": "AppendMenuA",
  655. "address": "0x43a234"
  656. },
  657. {
  658. "name": "DefWindowProcW",
  659. "address": "0x43a238"
  660. },
  661. {
  662. "name": "DestroyWindow",
  663. "address": "0x43a23c"
  664. },
  665. {
  666. "name": "GetDC",
  667. "address": "0x43a240"
  668. },
  669. {
  670. "name": "EndDialog",
  671. "address": "0x43a244"
  672. },
  673. {
  674. "name": "SetWindowTextW",
  675. "address": "0x43a248"
  676. },
  677. {
  678. "name": "GetMenuCheckMarkDimensions",
  679. "address": "0x43a24c"
  680. },
  681. {
  682. "name": "SetWindowLongA",
  683. "address": "0x43a250"
  684. },
  685. {
  686. "name": "LoadCursorA",
  687. "address": "0x43a254"
  688. },
  689. {
  690. "name": "IsDlgButtonChecked",
  691. "address": "0x43a258"
  692. },
  693. {
  694. "name": "DefWindowProcA",
  695. "address": "0x43a25c"
  696. },
  697. {
  698. "name": "SendMessageA",
  699. "address": "0x43a260"
  700. },
  701. {
  702. "name": "wsprintfW",
  703. "address": "0x43a264"
  704. },
  705. {
  706. "name": "GetClientRect",
  707. "address": "0x43a268"
  708. },
  709. {
  710. "name": "PostQuitMessage",
  711. "address": "0x43a26c"
  712. },
  713. {
  714. "name": "InvalidateRect",
  715. "address": "0x43a270"
  716. },
  717. {
  718. "name": "ReleaseDC",
  719. "address": "0x43a274"
  720. },
  721. {
  722. "name": "SetUserObjectSecurity",
  723. "address": "0x43a278"
  724. },
  725. {
  726. "name": "GetWindowTextA",
  727. "address": "0x43a27c"
  728. },
  729. {
  730. "name": "GetWindowTextLengthA",
  731. "address": "0x43a280"
  732. },
  733. {
  734. "name": "SetWindowTextA",
  735. "address": "0x43a284"
  736. },
  737. {
  738. "name": "GetMessageA",
  739. "address": "0x43a288"
  740. },
  741. {
  742. "name": "DispatchMessageA",
  743. "address": "0x43a28c"
  744. },
  745. {
  746. "name": "TranslateMessage",
  747. "address": "0x43a290"
  748. },
  749. {
  750. "name": "SetMenu",
  751. "address": "0x43a294"
  752. }
  753. ],
  754. "dll": "USER32.dll"
  755. },
  756. {
  757. "imports": [
  758. {
  759. "name": "SelectObject",
  760. "address": "0x43a04c"
  761. },
  762. {
  763. "name": "CreateDIBSection",
  764. "address": "0x43a050"
  765. },
  766. {
  767. "name": "SetDIBColorTable",
  768. "address": "0x43a054"
  769. },
  770. {
  771. "name": "CreateCompatibleDC",
  772. "address": "0x43a058"
  773. },
  774. {
  775. "name": "GetPaletteEntries",
  776. "address": "0x43a05c"
  777. },
  778. {
  779. "name": "EnumFontsA",
  780. "address": "0x43a060"
  781. },
  782. {
  783. "name": "DeleteDC",
  784. "address": "0x43a064"
  785. },
  786. {
  787. "name": "SetBkColor",
  788. "address": "0x43a068"
  789. },
  790. {
  791. "name": "DeleteObject",
  792. "address": "0x43a06c"
  793. },
  794. {
  795. "name": "GetCurrentObject",
  796. "address": "0x43a070"
  797. },
  798. {
  799. "name": "GetObjectA",
  800. "address": "0x43a074"
  801. },
  802. {
  803. "name": "BitBlt",
  804. "address": "0x43a078"
  805. }
  806. ],
  807. "dll": "GDI32.dll"
  808. },
  809. {
  810. "imports": [
  811. {
  812. "name": "GetSaveFileNameA",
  813. "address": "0x43a038"
  814. },
  815. {
  816. "name": "GetOpenFileNameA",
  817. "address": "0x43a03c"
  818. }
  819. ],
  820. "dll": "COMDLG32.dll"
  821. },
  822. {
  823. "imports": [
  824. {
  825. "name": "GetAclInformation",
  826. "address": "0x43a000"
  827. },
  828. {
  829. "name": "AddAccessAllowedAce",
  830. "address": "0x43a004"
  831. },
  832. {
  833. "name": "SetSecurityDescriptorDacl",
  834. "address": "0x43a008"
  835. },
  836. {
  837. "name": "GetSecurityDescriptorDacl",
  838. "address": "0x43a00c"
  839. },
  840. {
  841. "name": "CryptEnumProvidersA",
  842. "address": "0x43a010"
  843. },
  844. {
  845. "name": "LookupAccountNameW",
  846. "address": "0x43a014"
  847. },
  848. {
  849. "name": "GetAce",
  850. "address": "0x43a018"
  851. },
  852. {
  853. "name": "AddAce",
  854. "address": "0x43a01c"
  855. },
  856. {
  857. "name": "InitializeSecurityDescriptor",
  858. "address": "0x43a020"
  859. },
  860. {
  861. "name": "InitializeAcl",
  862. "address": "0x43a024"
  863. }
  864. ],
  865. "dll": "ADVAPI32.dll"
  866. },
  867. {
  868. "imports": [
  869. {
  870. "name": "CoCreateInstance",
  871. "address": "0x43a2a4"
  872. },
  873. {
  874. "name": "CoCreateGuid",
  875. "address": "0x43a2a8"
  876. },
  877. {
  878. "name": "StringFromGUID2",
  879. "address": "0x43a2ac"
  880. },
  881. {
  882. "name": "CoUninitialize",
  883. "address": "0x43a2b0"
  884. },
  885. {
  886. "name": "CoInitialize",
  887. "address": "0x43a2b4"
  888. }
  889. ],
  890. "dll": "ole32.dll"
  891. },
  892. {
  893. "imports": [
  894. {
  895. "name": "acmDriverDetailsA",
  896. "address": "0x43a1f8"
  897. },
  898. {
  899. "name": "acmDriverID",
  900. "address": "0x43a1fc"
  901. }
  902. ],
  903. "dll": "MSACM32.dll"
  904. },
  905. {
  906. "imports": [
  907. {
  908. "name": "CryptGetMessageSignerCount",
  909. "address": "0x43a044"
  910. }
  911. ],
  912. "dll": "CRYPT32.dll"
  913. },
  914. {
  915. "imports": [
  916. {
  917. "name": "StrChrA",
  918. "address": "0x43a204"
  919. },
  920. {
  921. "name": "ColorRGBToHLS",
  922. "address": "0x43a208"
  923. }
  924. ],
  925. "dll": "SHLWAPI.dll"
  926. },
  927. {
  928. "imports": [
  929. {
  930. "name": null,
  931. "address": "0x43a02c"
  932. },
  933. {
  934. "name": "ImageList_GetIconSize",
  935. "address": "0x43a030"
  936. }
  937. ],
  938. "dll": "COMCTL32.dll"
  939. },
  940. {
  941. "imports": [
  942. {
  943. "name": "AcquireCredentialsHandleW",
  944. "address": "0x43a210"
  945. },
  946. {
  947. "name": "QuerySecurityPackageInfoW",
  948. "address": "0x43a214"
  949. }
  950. ],
  951. "dll": "Secur32.dll"
  952. },
  953. {
  954. "imports": [
  955. {
  956. "name": "OpenThemeData",
  957. "address": "0x43a29c"
  958. }
  959. ],
  960. "dll": "UxTheme.dll"
  961. }
  962. ],
  963. "digital_signers": null,
  964. "exported_dll_name": null,
  965. "actual_checksum": "0x0007e12d",
  966. "overlay": null,
  967. "imagebase": "0x00400000",
  968. "reported_checksum": "0x0007e12d",
  969. "icon_hash": null,
  970. "entrypoint": "0x00413046",
  971. "timestamp": "2019-06-13 13:06:32",
  972. "osversion": "6.0",
  973. "sections": [
  974. {
  975. "name": ".text",
  976. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  977. "virtual_address": "0x00001000",
  978. "size_of_data": "0x00038e00",
  979. "entropy": "6.65",
  980. "raw_address": "0x00000400",
  981. "virtual_size": "0x00038c16",
  982. "characteristics_raw": "0x60000020"
  983. },
  984. {
  985. "name": ".rdata",
  986. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  987. "virtual_address": "0x0003a000",
  988. "size_of_data": "0x00014200",
  989. "entropy": "5.73",
  990. "raw_address": "0x00039200",
  991. "virtual_size": "0x00014018",
  992. "characteristics_raw": "0x40000040"
  993. },
  994. {
  995. "name": ".data",
  996. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  997. "virtual_address": "0x0004f000",
  998. "size_of_data": "0x00001200",
  999. "entropy": "3.36",
  1000. "raw_address": "0x0004d400",
  1001. "virtual_size": "0x00005040",
  1002. "characteristics_raw": "0xc0000040"
  1003. },
  1004. {
  1005. "name": ".tls",
  1006. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1007. "virtual_address": "0x00055000",
  1008. "size_of_data": "0x00000200",
  1009. "entropy": "0.02",
  1010. "raw_address": "0x0004e600",
  1011. "virtual_size": "0x00000009",
  1012. "characteristics_raw": "0xc0000040"
  1013. },
  1014. {
  1015. "name": ".gfids",
  1016. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1017. "virtual_address": "0x00056000",
  1018. "size_of_data": "0x00000400",
  1019. "entropy": "1.95",
  1020. "raw_address": "0x0004e800",
  1021. "virtual_size": "0x00000260",
  1022. "characteristics_raw": "0x40000040"
  1023. },
  1024. {
  1025. "name": ".rsrc",
  1026. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1027. "virtual_address": "0x00057000",
  1028. "size_of_data": "0x00028e00",
  1029. "entropy": "6.71",
  1030. "raw_address": "0x0004ec00",
  1031. "virtual_size": "0x00028dc4",
  1032. "characteristics_raw": "0x40000040"
  1033. },
  1034. {
  1035. "name": ".reloc",
  1036. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1037. "virtual_address": "0x00080000",
  1038. "size_of_data": "0x00003200",
  1039. "entropy": "6.63",
  1040. "raw_address": "0x00077a00",
  1041. "virtual_size": "0x0000312c",
  1042. "characteristics_raw": "0x42000040"
  1043. }
  1044. ],
  1045. "resources": [],
  1046. "dirents": [
  1047. {
  1048. "virtual_address": "0x00000000",
  1049. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1050. "size": "0x00000000"
  1051. },
  1052. {
  1053. "virtual_address": "0x0004d044",
  1054. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1055. "size": "0x00000104"
  1056. },
  1057. {
  1058. "virtual_address": "0x00057000",
  1059. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1060. "size": "0x00028dc4"
  1061. },
  1062. {
  1063. "virtual_address": "0x00000000",
  1064. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1065. "size": "0x00000000"
  1066. },
  1067. {
  1068. "virtual_address": "0x00000000",
  1069. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1070. "size": "0x00000000"
  1071. },
  1072. {
  1073. "virtual_address": "0x00080000",
  1074. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1075. "size": "0x0000312c"
  1076. },
  1077. {
  1078. "virtual_address": "0x0004a5b0",
  1079. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1080. "size": "0x00000038"
  1081. },
  1082. {
  1083. "virtual_address": "0x00000000",
  1084. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1085. "size": "0x00000000"
  1086. },
  1087. {
  1088. "virtual_address": "0x00000000",
  1089. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1090. "size": "0x00000000"
  1091. },
  1092. {
  1093. "virtual_address": "0x0004a644",
  1094. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1095. "size": "0x00000018"
  1096. },
  1097. {
  1098. "virtual_address": "0x0004a5e8",
  1099. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1100. "size": "0x00000040"
  1101. },
  1102. {
  1103. "virtual_address": "0x00000000",
  1104. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1105. "size": "0x00000000"
  1106. },
  1107. {
  1108. "virtual_address": "0x0003a000",
  1109. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1110. "size": "0x000002bc"
  1111. },
  1112. {
  1113. "virtual_address": "0x00000000",
  1114. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1115. "size": "0x00000000"
  1116. },
  1117. {
  1118. "virtual_address": "0x00000000",
  1119. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1120. "size": "0x00000000"
  1121. },
  1122. {
  1123. "virtual_address": "0x00000000",
  1124. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1125. "size": "0x00000000"
  1126. }
  1127. ],
  1128. "exports": [],
  1129. "guest_signers": {},
  1130. "imphash": "6e7166ad07b46236fb8633afe0b33e2e",
  1131. "icon_fuzzy": null,
  1132. "icon": null,
  1133. "pdbpath": null,
  1134. "imported_dll_count": 12,
  1135. "versioninfo": []
  1136. }
  1137. }
  1138.  
  1139. [*] Resolved APIs: [
  1140. "kernel32.dll.FlsAlloc",
  1141. "kernel32.dll.FlsSetValue",
  1142. "kernel32.dll.InitializeCriticalSectionEx",
  1143. "kernel32.dll.FlsGetValue",
  1144. "kernel32.dll.LCMapStringEx",
  1145. "kernel32.dll.AreFileApisANSI",
  1146. "kernel32.dll.InitializeConditionVariable",
  1147. "kernel32.dll.SleepConditionVariableCS",
  1148. "kernel32.dll.WakeAllConditionVariable",
  1149. "kernel32.dll.FlsFree",
  1150. "kernel32.dll.InitOnceExecuteOnce",
  1151. "kernel32.dll.CreateEventExW",
  1152. "kernel32.dll.CreateSemaphoreW",
  1153. "kernel32.dll.CreateSemaphoreExW",
  1154. "kernel32.dll.CreateThreadpoolTimer",
  1155. "kernel32.dll.SetThreadpoolTimer",
  1156. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1157. "kernel32.dll.CloseThreadpoolTimer",
  1158. "kernel32.dll.CreateThreadpoolWait",
  1159. "kernel32.dll.SetThreadpoolWait",
  1160. "kernel32.dll.CloseThreadpoolWait",
  1161. "kernel32.dll.FlushProcessWriteBuffers",
  1162. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1163. "kernel32.dll.GetCurrentProcessorNumber",
  1164. "kernel32.dll.CreateSymbolicLinkW",
  1165. "kernel32.dll.GetTickCount64",
  1166. "kernel32.dll.GetFileInformationByHandleEx",
  1167. "kernel32.dll.SetFileInformationByHandle",
  1168. "kernel32.dll.WakeConditionVariable",
  1169. "kernel32.dll.InitializeSRWLock",
  1170. "kernel32.dll.AcquireSRWLockExclusive",
  1171. "kernel32.dll.TryAcquireSRWLockExclusive",
  1172. "kernel32.dll.ReleaseSRWLockExclusive",
  1173. "kernel32.dll.SleepConditionVariableSRW",
  1174. "kernel32.dll.CreateThreadpoolWork",
  1175. "kernel32.dll.SubmitThreadpoolWork",
  1176. "kernel32.dll.CloseThreadpoolWork",
  1177. "kernel32.dll.CompareStringEx",
  1178. "kernel32.dll.GetLocaleInfoEx",
  1179. "cryptbase.dll.SystemFunction036",
  1180. "uxtheme.dll.ThemeInitApiHook",
  1181. "user32.dll.IsProcessDPIAware",
  1182. "ole32.dll.CoTaskMemAlloc",
  1183. "ole32.dll.PropVariantClear",
  1184. "ole32.dll.CoTaskMemFree",
  1185. "kernel32.dll.EnumSystemLocalesEx",
  1186. "kernel32.dll.GetDateFormatEx",
  1187. "kernel32.dll.GetTimeFormatEx",
  1188. "kernel32.dll.GetUserDefaultLocaleName",
  1189. "kernel32.dll.IsValidLocaleName",
  1190. "kernel32.dll.LCIDToLocaleName",
  1191. "kernel32.dll.LocaleNameToLCID",
  1192. "cryptsp.dll.SystemFunction035",
  1193. "msv1_0.dll.SpUserModeInitialize",
  1194. "dwmapi.dll.DwmIsCompositionEnabled",
  1195. "kernel32.dll.IsWow64Process",
  1196. "cryptsp.dll.CryptEnumProvidersA",
  1197. "setupapi.dll.SetupDiDestroyDeviceInfoList",
  1198. "kernel32.dll.SortGetHandle",
  1199. "kernel32.dll.SortCloseHandle",
  1200. "wintrust.dll.WinVerifyTrust",
  1201. "oleaut32.dll.#500",
  1202. "sechost.dll.LookupAccountNameLocalW"
  1203. ]
  1204.  
  1205. [*] Static Analysis: {
  1206. "pe": {
  1207. "peid_signatures": null,
  1208. "imports": [
  1209. {
  1210. "imports": [
  1211. {
  1212. "name": "SetStdHandle",
  1213. "address": "0x43a080"
  1214. },
  1215. {
  1216. "name": "FreeEnvironmentStringsW",
  1217. "address": "0x43a084"
  1218. },
  1219. {
  1220. "name": "GetEnvironmentStringsW",
  1221. "address": "0x43a088"
  1222. },
  1223. {
  1224. "name": "GetCommandLineW",
  1225. "address": "0x43a08c"
  1226. },
  1227. {
  1228. "name": "GetCommandLineA",
  1229. "address": "0x43a090"
  1230. },
  1231. {
  1232. "name": "GetOEMCP",
  1233. "address": "0x43a094"
  1234. },
  1235. {
  1236. "name": "GetACP",
  1237. "address": "0x43a098"
  1238. },
  1239. {
  1240. "name": "IsValidCodePage",
  1241. "address": "0x43a09c"
  1242. },
  1243. {
  1244. "name": "FindNextFileW",
  1245. "address": "0x43a0a0"
  1246. },
  1247. {
  1248. "name": "FindFirstFileExW",
  1249. "address": "0x43a0a4"
  1250. },
  1251. {
  1252. "name": "FindClose",
  1253. "address": "0x43a0a8"
  1254. },
  1255. {
  1256. "name": "EnumSystemLocalesW",
  1257. "address": "0x43a0ac"
  1258. },
  1259. {
  1260. "name": "GetUserDefaultLCID",
  1261. "address": "0x43a0b0"
  1262. },
  1263. {
  1264. "name": "GetFileSizeEx",
  1265. "address": "0x43a0b4"
  1266. },
  1267. {
  1268. "name": "GetConsoleCP",
  1269. "address": "0x43a0b8"
  1270. },
  1271. {
  1272. "name": "ReadConsoleW",
  1273. "address": "0x43a0bc"
  1274. },
  1275. {
  1276. "name": "GetFileAttributesExW",
  1277. "address": "0x43a0c0"
  1278. },
  1279. {
  1280. "name": "SetFilePointerEx",
  1281. "address": "0x43a0c4"
  1282. },
  1283. {
  1284. "name": "OutputDebugStringW",
  1285. "address": "0x43a0c8"
  1286. },
  1287. {
  1288. "name": "CloseHandle",
  1289. "address": "0x43a0cc"
  1290. },
  1291. {
  1292. "name": "HeapFree",
  1293. "address": "0x43a0d0"
  1294. },
  1295. {
  1296. "name": "HeapReAlloc",
  1297. "address": "0x43a0d4"
  1298. },
  1299. {
  1300. "name": "ExitProcess",
  1301. "address": "0x43a0d8"
  1302. },
  1303. {
  1304. "name": "ReadFile",
  1305. "address": "0x43a0dc"
  1306. },
  1307. {
  1308. "name": "WriteConsoleW",
  1309. "address": "0x43a0e0"
  1310. },
  1311. {
  1312. "name": "HeapSize",
  1313. "address": "0x43a0e4"
  1314. },
  1315. {
  1316. "name": "FlushFileBuffers",
  1317. "address": "0x43a0e8"
  1318. },
  1319. {
  1320. "name": "SetCommState",
  1321. "address": "0x43a0ec"
  1322. },
  1323. {
  1324. "name": "WideCharToMultiByte",
  1325. "address": "0x43a0f0"
  1326. },
  1327. {
  1328. "name": "GetProcessHeap",
  1329. "address": "0x43a0f4"
  1330. },
  1331. {
  1332. "name": "GetCurrentProcessId",
  1333. "address": "0x43a0f8"
  1334. },
  1335. {
  1336. "name": "LocalFree",
  1337. "address": "0x43a0fc"
  1338. },
  1339. {
  1340. "name": "GetProcAddress",
  1341. "address": "0x43a100"
  1342. },
  1343. {
  1344. "name": "GetOverlappedResult",
  1345. "address": "0x43a104"
  1346. },
  1347. {
  1348. "name": "HeapAlloc",
  1349. "address": "0x43a108"
  1350. },
  1351. {
  1352. "name": "IsValidLocale",
  1353. "address": "0x43a10c"
  1354. },
  1355. {
  1356. "name": "LoadLibraryW",
  1357. "address": "0x43a110"
  1358. },
  1359. {
  1360. "name": "GetConsoleTitleA",
  1361. "address": "0x43a114"
  1362. },
  1363. {
  1364. "name": "DeleteFileW",
  1365. "address": "0x43a118"
  1366. },
  1367. {
  1368. "name": "GetCommState",
  1369. "address": "0x43a11c"
  1370. },
  1371. {
  1372. "name": "GetLastError",
  1373. "address": "0x43a120"
  1374. },
  1375. {
  1376. "name": "CreateEventW",
  1377. "address": "0x43a124"
  1378. },
  1379. {
  1380. "name": "GetModuleHandleA",
  1381. "address": "0x43a128"
  1382. },
  1383. {
  1384. "name": "GetCurrentThreadId",
  1385. "address": "0x43a12c"
  1386. },
  1387. {
  1388. "name": "CreateFileW",
  1389. "address": "0x43a130"
  1390. },
  1391. {
  1392. "name": "LocalAlloc",
  1393. "address": "0x43a134"
  1394. },
  1395. {
  1396. "name": "WaitForSingleObject",
  1397. "address": "0x43a138"
  1398. },
  1399. {
  1400. "name": "GetTempPathW",
  1401. "address": "0x43a13c"
  1402. },
  1403. {
  1404. "name": "GetCompressedFileSizeW",
  1405. "address": "0x43a140"
  1406. },
  1407. {
  1408. "name": "VirtualAlloc",
  1409. "address": "0x43a144"
  1410. },
  1411. {
  1412. "name": "WriteFile",
  1413. "address": "0x43a148"
  1414. },
  1415. {
  1416. "name": "GetModuleHandleExW",
  1417. "address": "0x43a14c"
  1418. },
  1419. {
  1420. "name": "GetModuleFileNameW",
  1421. "address": "0x43a150"
  1422. },
  1423. {
  1424. "name": "GetFileType",
  1425. "address": "0x43a154"
  1426. },
  1427. {
  1428. "name": "GetStdHandle",
  1429. "address": "0x43a158"
  1430. },
  1431. {
  1432. "name": "SetEndOfFile",
  1433. "address": "0x43a15c"
  1434. },
  1435. {
  1436. "name": "RtlUnwind",
  1437. "address": "0x43a160"
  1438. },
  1439. {
  1440. "name": "RaiseException",
  1441. "address": "0x43a164"
  1442. },
  1443. {
  1444. "name": "LoadLibraryA",
  1445. "address": "0x43a168"
  1446. },
  1447. {
  1448. "name": "LoadLibraryExW",
  1449. "address": "0x43a16c"
  1450. },
  1451. {
  1452. "name": "FreeLibrary",
  1453. "address": "0x43a170"
  1454. },
  1455. {
  1456. "name": "GetCPInfo",
  1457. "address": "0x43a174"
  1458. },
  1459. {
  1460. "name": "GetCurrentProcess",
  1461. "address": "0x43a178"
  1462. },
  1463. {
  1464. "name": "GetConsoleMode",
  1465. "address": "0x43a17c"
  1466. },
  1467. {
  1468. "name": "FindFirstFileA",
  1469. "address": "0x43a180"
  1470. },
  1471. {
  1472. "name": "GetStringTypeW",
  1473. "address": "0x43a184"
  1474. },
  1475. {
  1476. "name": "GetLocaleInfoW",
  1477. "address": "0x43a188"
  1478. },
  1479. {
  1480. "name": "LCMapStringW",
  1481. "address": "0x43a18c"
  1482. },
  1483. {
  1484. "name": "EnterCriticalSection",
  1485. "address": "0x43a190"
  1486. },
  1487. {
  1488. "name": "LeaveCriticalSection",
  1489. "address": "0x43a194"
  1490. },
  1491. {
  1492. "name": "DeleteCriticalSection",
  1493. "address": "0x43a198"
  1494. },
  1495. {
  1496. "name": "SetEvent",
  1497. "address": "0x43a19c"
  1498. },
  1499. {
  1500. "name": "ResetEvent",
  1501. "address": "0x43a1a0"
  1502. },
  1503. {
  1504. "name": "WaitForSingleObjectEx",
  1505. "address": "0x43a1a4"
  1506. },
  1507. {
  1508. "name": "GetModuleHandleW",
  1509. "address": "0x43a1a8"
  1510. },
  1511. {
  1512. "name": "UnhandledExceptionFilter",
  1513. "address": "0x43a1ac"
  1514. },
  1515. {
  1516. "name": "SetUnhandledExceptionFilter",
  1517. "address": "0x43a1b0"
  1518. },
  1519. {
  1520. "name": "TerminateProcess",
  1521. "address": "0x43a1b4"
  1522. },
  1523. {
  1524. "name": "IsProcessorFeaturePresent",
  1525. "address": "0x43a1b8"
  1526. },
  1527. {
  1528. "name": "IsDebuggerPresent",
  1529. "address": "0x43a1bc"
  1530. },
  1531. {
  1532. "name": "GetStartupInfoW",
  1533. "address": "0x43a1c0"
  1534. },
  1535. {
  1536. "name": "QueryPerformanceCounter",
  1537. "address": "0x43a1c4"
  1538. },
  1539. {
  1540. "name": "GetSystemTimeAsFileTime",
  1541. "address": "0x43a1c8"
  1542. },
  1543. {
  1544. "name": "InitializeSListHead",
  1545. "address": "0x43a1cc"
  1546. },
  1547. {
  1548. "name": "EncodePointer",
  1549. "address": "0x43a1d0"
  1550. },
  1551. {
  1552. "name": "DecodePointer",
  1553. "address": "0x43a1d4"
  1554. },
  1555. {
  1556. "name": "MultiByteToWideChar",
  1557. "address": "0x43a1d8"
  1558. },
  1559. {
  1560. "name": "SetLastError",
  1561. "address": "0x43a1dc"
  1562. },
  1563. {
  1564. "name": "InitializeCriticalSectionAndSpinCount",
  1565. "address": "0x43a1e0"
  1566. },
  1567. {
  1568. "name": "TlsAlloc",
  1569. "address": "0x43a1e4"
  1570. },
  1571. {
  1572. "name": "TlsGetValue",
  1573. "address": "0x43a1e8"
  1574. },
  1575. {
  1576. "name": "TlsSetValue",
  1577. "address": "0x43a1ec"
  1578. },
  1579. {
  1580. "name": "TlsFree",
  1581. "address": "0x43a1f0"
  1582. }
  1583. ],
  1584. "dll": "KERNEL32.dll"
  1585. },
  1586. {
  1587. "imports": [
  1588. {
  1589. "name": "GetUserObjectSecurity",
  1590. "address": "0x43a21c"
  1591. },
  1592. {
  1593. "name": "RegisterClassW",
  1594. "address": "0x43a220"
  1595. },
  1596. {
  1597. "name": "SendMessageW",
  1598. "address": "0x43a224"
  1599. },
  1600. {
  1601. "name": "CreateWindowExW",
  1602. "address": "0x43a228"
  1603. },
  1604. {
  1605. "name": "LoadImageW",
  1606. "address": "0x43a22c"
  1607. },
  1608. {
  1609. "name": "CreateMenu",
  1610. "address": "0x43a230"
  1611. },
  1612. {
  1613. "name": "AppendMenuA",
  1614. "address": "0x43a234"
  1615. },
  1616. {
  1617. "name": "DefWindowProcW",
  1618. "address": "0x43a238"
  1619. },
  1620. {
  1621. "name": "DestroyWindow",
  1622. "address": "0x43a23c"
  1623. },
  1624. {
  1625. "name": "GetDC",
  1626. "address": "0x43a240"
  1627. },
  1628. {
  1629. "name": "EndDialog",
  1630. "address": "0x43a244"
  1631. },
  1632. {
  1633. "name": "SetWindowTextW",
  1634. "address": "0x43a248"
  1635. },
  1636. {
  1637. "name": "GetMenuCheckMarkDimensions",
  1638. "address": "0x43a24c"
  1639. },
  1640. {
  1641. "name": "SetWindowLongA",
  1642. "address": "0x43a250"
  1643. },
  1644. {
  1645. "name": "LoadCursorA",
  1646. "address": "0x43a254"
  1647. },
  1648. {
  1649. "name": "IsDlgButtonChecked",
  1650. "address": "0x43a258"
  1651. },
  1652. {
  1653. "name": "DefWindowProcA",
  1654. "address": "0x43a25c"
  1655. },
  1656. {
  1657. "name": "SendMessageA",
  1658. "address": "0x43a260"
  1659. },
  1660. {
  1661. "name": "wsprintfW",
  1662. "address": "0x43a264"
  1663. },
  1664. {
  1665. "name": "GetClientRect",
  1666. "address": "0x43a268"
  1667. },
  1668. {
  1669. "name": "PostQuitMessage",
  1670. "address": "0x43a26c"
  1671. },
  1672. {
  1673. "name": "InvalidateRect",
  1674. "address": "0x43a270"
  1675. },
  1676. {
  1677. "name": "ReleaseDC",
  1678. "address": "0x43a274"
  1679. },
  1680. {
  1681. "name": "SetUserObjectSecurity",
  1682. "address": "0x43a278"
  1683. },
  1684. {
  1685. "name": "GetWindowTextA",
  1686. "address": "0x43a27c"
  1687. },
  1688. {
  1689. "name": "GetWindowTextLengthA",
  1690. "address": "0x43a280"
  1691. },
  1692. {
  1693. "name": "SetWindowTextA",
  1694. "address": "0x43a284"
  1695. },
  1696. {
  1697. "name": "GetMessageA",
  1698. "address": "0x43a288"
  1699. },
  1700. {
  1701. "name": "DispatchMessageA",
  1702. "address": "0x43a28c"
  1703. },
  1704. {
  1705. "name": "TranslateMessage",
  1706. "address": "0x43a290"
  1707. },
  1708. {
  1709. "name": "SetMenu",
  1710. "address": "0x43a294"
  1711. }
  1712. ],
  1713. "dll": "USER32.dll"
  1714. },
  1715. {
  1716. "imports": [
  1717. {
  1718. "name": "SelectObject",
  1719. "address": "0x43a04c"
  1720. },
  1721. {
  1722. "name": "CreateDIBSection",
  1723. "address": "0x43a050"
  1724. },
  1725. {
  1726. "name": "SetDIBColorTable",
  1727. "address": "0x43a054"
  1728. },
  1729. {
  1730. "name": "CreateCompatibleDC",
  1731. "address": "0x43a058"
  1732. },
  1733. {
  1734. "name": "GetPaletteEntries",
  1735. "address": "0x43a05c"
  1736. },
  1737. {
  1738. "name": "EnumFontsA",
  1739. "address": "0x43a060"
  1740. },
  1741. {
  1742. "name": "DeleteDC",
  1743. "address": "0x43a064"
  1744. },
  1745. {
  1746. "name": "SetBkColor",
  1747. "address": "0x43a068"
  1748. },
  1749. {
  1750. "name": "DeleteObject",
  1751. "address": "0x43a06c"
  1752. },
  1753. {
  1754. "name": "GetCurrentObject",
  1755. "address": "0x43a070"
  1756. },
  1757. {
  1758. "name": "GetObjectA",
  1759. "address": "0x43a074"
  1760. },
  1761. {
  1762. "name": "BitBlt",
  1763. "address": "0x43a078"
  1764. }
  1765. ],
  1766. "dll": "GDI32.dll"
  1767. },
  1768. {
  1769. "imports": [
  1770. {
  1771. "name": "GetSaveFileNameA",
  1772. "address": "0x43a038"
  1773. },
  1774. {
  1775. "name": "GetOpenFileNameA",
  1776. "address": "0x43a03c"
  1777. }
  1778. ],
  1779. "dll": "COMDLG32.dll"
  1780. },
  1781. {
  1782. "imports": [
  1783. {
  1784. "name": "GetAclInformation",
  1785. "address": "0x43a000"
  1786. },
  1787. {
  1788. "name": "AddAccessAllowedAce",
  1789. "address": "0x43a004"
  1790. },
  1791. {
  1792. "name": "SetSecurityDescriptorDacl",
  1793. "address": "0x43a008"
  1794. },
  1795. {
  1796. "name": "GetSecurityDescriptorDacl",
  1797. "address": "0x43a00c"
  1798. },
  1799. {
  1800. "name": "CryptEnumProvidersA",
  1801. "address": "0x43a010"
  1802. },
  1803. {
  1804. "name": "LookupAccountNameW",
  1805. "address": "0x43a014"
  1806. },
  1807. {
  1808. "name": "GetAce",
  1809. "address": "0x43a018"
  1810. },
  1811. {
  1812. "name": "AddAce",
  1813. "address": "0x43a01c"
  1814. },
  1815. {
  1816. "name": "InitializeSecurityDescriptor",
  1817. "address": "0x43a020"
  1818. },
  1819. {
  1820. "name": "InitializeAcl",
  1821. "address": "0x43a024"
  1822. }
  1823. ],
  1824. "dll": "ADVAPI32.dll"
  1825. },
  1826. {
  1827. "imports": [
  1828. {
  1829. "name": "CoCreateInstance",
  1830. "address": "0x43a2a4"
  1831. },
  1832. {
  1833. "name": "CoCreateGuid",
  1834. "address": "0x43a2a8"
  1835. },
  1836. {
  1837. "name": "StringFromGUID2",
  1838. "address": "0x43a2ac"
  1839. },
  1840. {
  1841. "name": "CoUninitialize",
  1842. "address": "0x43a2b0"
  1843. },
  1844. {
  1845. "name": "CoInitialize",
  1846. "address": "0x43a2b4"
  1847. }
  1848. ],
  1849. "dll": "ole32.dll"
  1850. },
  1851. {
  1852. "imports": [
  1853. {
  1854. "name": "acmDriverDetailsA",
  1855. "address": "0x43a1f8"
  1856. },
  1857. {
  1858. "name": "acmDriverID",
  1859. "address": "0x43a1fc"
  1860. }
  1861. ],
  1862. "dll": "MSACM32.dll"
  1863. },
  1864. {
  1865. "imports": [
  1866. {
  1867. "name": "CryptGetMessageSignerCount",
  1868. "address": "0x43a044"
  1869. }
  1870. ],
  1871. "dll": "CRYPT32.dll"
  1872. },
  1873. {
  1874. "imports": [
  1875. {
  1876. "name": "StrChrA",
  1877. "address": "0x43a204"
  1878. },
  1879. {
  1880. "name": "ColorRGBToHLS",
  1881. "address": "0x43a208"
  1882. }
  1883. ],
  1884. "dll": "SHLWAPI.dll"
  1885. },
  1886. {
  1887. "imports": [
  1888. {
  1889. "name": null,
  1890. "address": "0x43a02c"
  1891. },
  1892. {
  1893. "name": "ImageList_GetIconSize",
  1894. "address": "0x43a030"
  1895. }
  1896. ],
  1897. "dll": "COMCTL32.dll"
  1898. },
  1899. {
  1900. "imports": [
  1901. {
  1902. "name": "AcquireCredentialsHandleW",
  1903. "address": "0x43a210"
  1904. },
  1905. {
  1906. "name": "QuerySecurityPackageInfoW",
  1907. "address": "0x43a214"
  1908. }
  1909. ],
  1910. "dll": "Secur32.dll"
  1911. },
  1912. {
  1913. "imports": [
  1914. {
  1915. "name": "OpenThemeData",
  1916. "address": "0x43a29c"
  1917. }
  1918. ],
  1919. "dll": "UxTheme.dll"
  1920. }
  1921. ],
  1922. "digital_signers": null,
  1923. "exported_dll_name": null,
  1924. "actual_checksum": "0x0007e12d",
  1925. "overlay": null,
  1926. "imagebase": "0x00400000",
  1927. "reported_checksum": "0x0007e12d",
  1928. "icon_hash": null,
  1929. "entrypoint": "0x00413046",
  1930. "timestamp": "2019-06-13 13:06:32",
  1931. "osversion": "6.0",
  1932. "sections": [
  1933. {
  1934. "name": ".text",
  1935. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1936. "virtual_address": "0x00001000",
  1937. "size_of_data": "0x00038e00",
  1938. "entropy": "6.65",
  1939. "raw_address": "0x00000400",
  1940. "virtual_size": "0x00038c16",
  1941. "characteristics_raw": "0x60000020"
  1942. },
  1943. {
  1944. "name": ".rdata",
  1945. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1946. "virtual_address": "0x0003a000",
  1947. "size_of_data": "0x00014200",
  1948. "entropy": "5.73",
  1949. "raw_address": "0x00039200",
  1950. "virtual_size": "0x00014018",
  1951. "characteristics_raw": "0x40000040"
  1952. },
  1953. {
  1954. "name": ".data",
  1955. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1956. "virtual_address": "0x0004f000",
  1957. "size_of_data": "0x00001200",
  1958. "entropy": "3.36",
  1959. "raw_address": "0x0004d400",
  1960. "virtual_size": "0x00005040",
  1961. "characteristics_raw": "0xc0000040"
  1962. },
  1963. {
  1964. "name": ".tls",
  1965. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1966. "virtual_address": "0x00055000",
  1967. "size_of_data": "0x00000200",
  1968. "entropy": "0.02",
  1969. "raw_address": "0x0004e600",
  1970. "virtual_size": "0x00000009",
  1971. "characteristics_raw": "0xc0000040"
  1972. },
  1973. {
  1974. "name": ".gfids",
  1975. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1976. "virtual_address": "0x00056000",
  1977. "size_of_data": "0x00000400",
  1978. "entropy": "1.95",
  1979. "raw_address": "0x0004e800",
  1980. "virtual_size": "0x00000260",
  1981. "characteristics_raw": "0x40000040"
  1982. },
  1983. {
  1984. "name": ".rsrc",
  1985. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1986. "virtual_address": "0x00057000",
  1987. "size_of_data": "0x00028e00",
  1988. "entropy": "6.71",
  1989. "raw_address": "0x0004ec00",
  1990. "virtual_size": "0x00028dc4",
  1991. "characteristics_raw": "0x40000040"
  1992. },
  1993. {
  1994. "name": ".reloc",
  1995. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1996. "virtual_address": "0x00080000",
  1997. "size_of_data": "0x00003200",
  1998. "entropy": "6.63",
  1999. "raw_address": "0x00077a00",
  2000. "virtual_size": "0x0000312c",
  2001. "characteristics_raw": "0x42000040"
  2002. }
  2003. ],
  2004. "resources": [],
  2005. "dirents": [
  2006. {
  2007. "virtual_address": "0x00000000",
  2008. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2009. "size": "0x00000000"
  2010. },
  2011. {
  2012. "virtual_address": "0x0004d044",
  2013. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2014. "size": "0x00000104"
  2015. },
  2016. {
  2017. "virtual_address": "0x00057000",
  2018. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2019. "size": "0x00028dc4"
  2020. },
  2021. {
  2022. "virtual_address": "0x00000000",
  2023. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2024. "size": "0x00000000"
  2025. },
  2026. {
  2027. "virtual_address": "0x00000000",
  2028. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2029. "size": "0x00000000"
  2030. },
  2031. {
  2032. "virtual_address": "0x00080000",
  2033. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2034. "size": "0x0000312c"
  2035. },
  2036. {
  2037. "virtual_address": "0x0004a5b0",
  2038. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2039. "size": "0x00000038"
  2040. },
  2041. {
  2042. "virtual_address": "0x00000000",
  2043. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2044. "size": "0x00000000"
  2045. },
  2046. {
  2047. "virtual_address": "0x00000000",
  2048. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2049. "size": "0x00000000"
  2050. },
  2051. {
  2052. "virtual_address": "0x0004a644",
  2053. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2054. "size": "0x00000018"
  2055. },
  2056. {
  2057. "virtual_address": "0x0004a5e8",
  2058. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2059. "size": "0x00000040"
  2060. },
  2061. {
  2062. "virtual_address": "0x00000000",
  2063. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2064. "size": "0x00000000"
  2065. },
  2066. {
  2067. "virtual_address": "0x0003a000",
  2068. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2069. "size": "0x000002bc"
  2070. },
  2071. {
  2072. "virtual_address": "0x00000000",
  2073. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2074. "size": "0x00000000"
  2075. },
  2076. {
  2077. "virtual_address": "0x00000000",
  2078. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2079. "size": "0x00000000"
  2080. },
  2081. {
  2082. "virtual_address": "0x00000000",
  2083. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2084. "size": "0x00000000"
  2085. }
  2086. ],
  2087. "exports": [],
  2088. "guest_signers": {},
  2089. "imphash": "6e7166ad07b46236fb8633afe0b33e2e",
  2090. "icon_fuzzy": null,
  2091. "icon": null,
  2092. "pdbpath": null,
  2093. "imported_dll_count": 12,
  2094. "versioninfo": []
  2095. }
  2096. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!