API tools faq
paste
paladin316

Exes_6d00cf9269657d685128c1ed57d7ea4e_exe_2019-06-28_12_30.json

paladin316
Jun 28th, 2019
2,139
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 33.49 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Ddsn"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_6d00cf9269657d685128c1ed57d7ea4e.exe"
  7. [*] File Size: 14336
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows"
  9. [*] SHA256: "fede4f6c60448e5852ce1fee1de24a7a5ccd831426eb4e4d9391835888249b9f"
  10. [*] MD5: "6d00cf9269657d685128c1ed57d7ea4e"
  11. [*] SHA1: "2f5436e60f2e959777999723ccc6e0bfcdd8266b"
  12. [*] SHA512: "a9cbcf94a1b7fae680ba227b603b3c04e3d8717b6dd4b06eeecdadba7b3afd96f575cb84718e41de9ba1bbd6fbc31430f2fff1c0161d344bf08e7c99331f63e7"
  13. [*] CRC32: "93AD6F52"
  14. [*] SSDEEP: "192:XHSykZahxHn9QgyBtX4SR4wefaN71oRK/SjN7AGY:3SykyDyLXrRwaN7nyAp"
  15.  
  16. [*] Process Execution: [
  17. "Exes_6d00cf9269657d685128c1ed57d7ea4e.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "File has been identified by 45 Antiviruses on VirusTotal as malicious",
  27. "Details": [
  28. {
  29. "MicroWorld-eScan": "Trojan.Agent.DDSN"
  30. },
  31. {
  32. "FireEye": "Generic.mg.6d00cf9269657d68"
  33. },
  34. {
  35. "McAfee": "BackDoor-FDRT!6D00CF926965"
  36. },
  37. {
  38. "K7AntiVirus": "Trojan ( 004cd8391 )"
  39. },
  40. {
  41. "K7GW": "Trojan ( 004cd8391 )"
  42. },
  43. {
  44. "NANO-Antivirus": "Trojan.Win32.TrjGen.eegfaz"
  45. },
  46. {
  47. "F-Prot": "W32/S-ad0d353a!Eldorado"
  48. },
  49. {
  50. "Symantec": "Backdoor.Rozena"
  51. },
  52. {
  53. "ESET-NOD32": "a variant of Win32/Rozena.WZ"
  54. },
  55. {
  56. "APEX": "Malicious"
  57. },
  58. {
  59. "Kaspersky": "Trojan.Win32.Cobalt.a"
  60. },
  61. {
  62. "BitDefender": "Trojan.Agent.DDSN"
  63. },
  64. {
  65. "AegisLab": "Trojan.Win32.Generic.lZpe"
  66. },
  67. {
  68. "Avast": "Win32:Malware-gen"
  69. },
  70. {
  71. "Rising": "Trojan.Swrort!8.296 (RDM+:cmRtazoZwqYhQM8kWsxMdpnOD6/N)"
  72. },
  73. {
  74. "Ad-Aware": "Trojan.Agent.DDSN"
  75. },
  76. {
  77. "Emsisoft": "Trojan.Agent.DDSN (B)"
  78. },
  79. {
  80. "Comodo": "TrojWare.Win32.Kryptik.BYGK@59ple7"
  81. },
  82. {
  83. "F-Secure": "Trojan.TR/Crypt.XPACK.Gen7"
  84. },
  85. {
  86. "DrWeb": "Trojan.Swrort.41"
  87. },
  88. {
  89. "Qihoo-360": "HEUR/QVM20.1.2A1F.Malware.Gen"
  90. },
  91. {
  92. "Invincea": "heuristic"
  93. },
  94. {
  95. "McAfee-GW-Edition": "BackDoor-FDRT!6D00CF926965"
  96. },
  97. {
  98. "Sophos": "Troj/Swrort-CG"
  99. },
  100. {
  101. "Cyren": "W32/S-ad0d353a!Eldorado"
  102. },
  103. {
  104. "Jiangmin": "Trojan.Generic.yke"
  105. },
  106. {
  107. "Avira": "TR/Crypt.XPACK.Gen7"
  108. },
  109. {
  110. "Fortinet": "W32/Rozena.WZ!tr"
  111. },
  112. {
  113. "Antiy-AVL": "Trojan/Win32.AGeneric"
  114. },
  115. {
  116. "Endgame": "malicious (high confidence)"
  117. },
  118. {
  119. "Arcabit": "Trojan.Agent.DDSN"
  120. },
  121. {
  122. "ViRobot": "Trojan.Win32.Agent.14336.DF"
  123. },
  124. {
  125. "ZoneAlarm": "Trojan.Win32.Cobalt.a"
  126. },
  127. {
  128. "Microsoft": "Trojan:Win32/Swrort.A"
  129. },
  130. {
  131. "AhnLab-V3": "Trojan/Win32.Swrort.R270227"
  132. },
  133. {
  134. "Acronis": "suspicious"
  135. },
  136. {
  137. "ALYac": "Trojan.Agent.DDSN"
  138. },
  139. {
  140. "TACHYON": "Trojan/W32.Agent.14336.UN"
  141. },
  142. {
  143. "VBA32": "Trojan.Cobalt"
  144. },
  145. {
  146. "Cylance": "Unsafe"
  147. },
  148. {
  149. "Zoner": "Trojan.Win32.69381"
  150. },
  151. {
  152. "MAX": "malware (ai score=84)"
  153. },
  154. {
  155. "GData": "Win32.Trojan.Mexec.B"
  156. },
  157. {
  158. "AVG": "Win32:Malware-gen"
  159. },
  160. {
  161. "CrowdStrike": "win/malicious_confidence_60% (D)"
  162. }
  163. ]
  164. }
  165. ]
  166.  
  167. [*] Started Service: []
  168.  
  169. [*] Executed Commands: []
  170.  
  171. [*] Mutexes: []
  172.  
  173. [*] Modified Files: []
  174.  
  175. [*] Deleted Files: []
  176.  
  177. [*] Modified Registry Keys: []
  178.  
  179. [*] Deleted Registry Keys: []
  180.  
  181. [*] DNS Communications: []
  182.  
  183. [*] Domains: []
  184.  
  185. [*] Network Communication - ICMP: []
  186.  
  187. [*] Network Communication - HTTP: []
  188.  
  189. [*] Network Communication - SMTP: []
  190.  
  191. [*] Network Communication - Hosts: []
  192.  
  193. [*] Network Communication - IRC: []
  194.  
  195. [*] Static Analysis: {
  196. "pe": {
  197. "peid_signatures": null,
  198. "imports": [
  199. {
  200. "imports": [
  201. {
  202. "name": "CreateThread",
  203. "address": "0x40611c"
  204. },
  205. {
  206. "name": "DeleteCriticalSection",
  207. "address": "0x406120"
  208. },
  209. {
  210. "name": "EnterCriticalSection",
  211. "address": "0x406124"
  212. },
  213. {
  214. "name": "FreeLibrary",
  215. "address": "0x406128"
  216. },
  217. {
  218. "name": "GetCurrentProcess",
  219. "address": "0x40612c"
  220. },
  221. {
  222. "name": "GetCurrentProcessId",
  223. "address": "0x406130"
  224. },
  225. {
  226. "name": "GetCurrentThreadId",
  227. "address": "0x406134"
  228. },
  229. {
  230. "name": "GetLastError",
  231. "address": "0x406138"
  232. },
  233. {
  234. "name": "GetModuleHandleA",
  235. "address": "0x40613c"
  236. },
  237. {
  238. "name": "GetProcAddress",
  239. "address": "0x406140"
  240. },
  241. {
  242. "name": "GetStartupInfoA",
  243. "address": "0x406144"
  244. },
  245. {
  246. "name": "GetSystemTimeAsFileTime",
  247. "address": "0x406148"
  248. },
  249. {
  250. "name": "GetTickCount",
  251. "address": "0x40614c"
  252. },
  253. {
  254. "name": "InitializeCriticalSection",
  255. "address": "0x406150"
  256. },
  257. {
  258. "name": "LeaveCriticalSection",
  259. "address": "0x406154"
  260. },
  261. {
  262. "name": "LoadLibraryA",
  263. "address": "0x406158"
  264. },
  265. {
  266. "name": "LoadLibraryW",
  267. "address": "0x40615c"
  268. },
  269. {
  270. "name": "QueryPerformanceCounter",
  271. "address": "0x406160"
  272. },
  273. {
  274. "name": "SetUnhandledExceptionFilter",
  275. "address": "0x406164"
  276. },
  277. {
  278. "name": "Sleep",
  279. "address": "0x406168"
  280. },
  281. {
  282. "name": "TerminateProcess",
  283. "address": "0x40616c"
  284. },
  285. {
  286. "name": "TlsGetValue",
  287. "address": "0x406170"
  288. },
  289. {
  290. "name": "UnhandledExceptionFilter",
  291. "address": "0x406174"
  292. },
  293. {
  294. "name": "VirtualAlloc",
  295. "address": "0x406178"
  296. },
  297. {
  298. "name": "VirtualProtect",
  299. "address": "0x40617c"
  300. },
  301. {
  302. "name": "VirtualQuery",
  303. "address": "0x406180"
  304. }
  305. ],
  306. "dll": "KERNEL32.dll"
  307. },
  308. {
  309. "imports": [
  310. {
  311. "name": "__dllonexit",
  312. "address": "0x406188"
  313. },
  314. {
  315. "name": "__getmainargs",
  316. "address": "0x40618c"
  317. },
  318. {
  319. "name": "__initenv",
  320. "address": "0x406190"
  321. },
  322. {
  323. "name": "__lconv_init",
  324. "address": "0x406194"
  325. },
  326. {
  327. "name": "__set_app_type",
  328. "address": "0x406198"
  329. },
  330. {
  331. "name": "__setusermatherr",
  332. "address": "0x40619c"
  333. },
  334. {
  335. "name": "_acmdln",
  336. "address": "0x4061a0"
  337. },
  338. {
  339. "name": "_amsg_exit",
  340. "address": "0x4061a4"
  341. },
  342. {
  343. "name": "_cexit",
  344. "address": "0x4061a8"
  345. },
  346. {
  347. "name": "_fmode",
  348. "address": "0x4061ac"
  349. },
  350. {
  351. "name": "_initterm",
  352. "address": "0x4061b0"
  353. },
  354. {
  355. "name": "_iob",
  356. "address": "0x4061b4"
  357. },
  358. {
  359. "name": "_lock",
  360. "address": "0x4061b8"
  361. },
  362. {
  363. "name": "_onexit",
  364. "address": "0x4061bc"
  365. },
  366. {
  367. "name": "_unlock",
  368. "address": "0x4061c0"
  369. },
  370. {
  371. "name": "_winmajor",
  372. "address": "0x4061c4"
  373. },
  374. {
  375. "name": "abort",
  376. "address": "0x4061c8"
  377. },
  378. {
  379. "name": "calloc",
  380. "address": "0x4061cc"
  381. },
  382. {
  383. "name": "exit",
  384. "address": "0x4061d0"
  385. },
  386. {
  387. "name": "fprintf",
  388. "address": "0x4061d4"
  389. },
  390. {
  391. "name": "free",
  392. "address": "0x4061d8"
  393. },
  394. {
  395. "name": "fwrite",
  396. "address": "0x4061dc"
  397. },
  398. {
  399. "name": "malloc",
  400. "address": "0x4061e0"
  401. },
  402. {
  403. "name": "memcpy",
  404. "address": "0x4061e4"
  405. },
  406. {
  407. "name": "signal",
  408. "address": "0x4061e8"
  409. },
  410. {
  411. "name": "strlen",
  412. "address": "0x4061ec"
  413. },
  414. {
  415. "name": "strncmp",
  416. "address": "0x4061f0"
  417. },
  418. {
  419. "name": "vfprintf",
  420. "address": "0x4061f4"
  421. }
  422. ],
  423. "dll": "msvcrt.dll"
  424. }
  425. ],
  426. "digital_signers": null,
  427. "exported_dll_name": null,
  428. "actual_checksum": "0x00013298",
  429. "overlay": null,
  430. "imagebase": "0x00400000",
  431. "reported_checksum": "0x00013298",
  432. "icon_hash": null,
  433. "entrypoint": "0x004014b0",
  434. "timestamp": "2016-05-17 01:12:02",
  435. "osversion": "4.0",
  436. "sections": [
  437. {
  438. "name": ".text",
  439. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES",
  440. "virtual_address": "0x00001000",
  441. "size_of_data": "0x00001c00",
  442. "entropy": "5.83",
  443. "raw_address": "0x00000400",
  444. "virtual_size": "0x00001ac4",
  445. "characteristics_raw": "0x60500060"
  446. },
  447. {
  448. "name": ".data",
  449. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  450. "virtual_address": "0x00003000",
  451. "size_of_data": "0x00000800",
  452. "entropy": "3.56",
  453. "raw_address": "0x00002000",
  454. "virtual_size": "0x00000624",
  455. "characteristics_raw": "0xc0600040"
  456. },
  457. {
  458. "name": ".rdata",
  459. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES",
  460. "virtual_address": "0x00004000",
  461. "size_of_data": "0x00000400",
  462. "entropy": "4.23",
  463. "raw_address": "0x00002800",
  464. "virtual_size": "0x000002d0",
  465. "characteristics_raw": "0x40300040"
  466. },
  467. {
  468. "name": ".bss",
  469. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  470. "virtual_address": "0x00005000",
  471. "size_of_data": "0x00000000",
  472. "entropy": "0.00",
  473. "raw_address": "0x00000000",
  474. "virtual_size": "0x0000041c",
  475. "characteristics_raw": "0xc0600080"
  476. },
  477. {
  478. "name": ".idata",
  479. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  480. "virtual_address": "0x00006000",
  481. "size_of_data": "0x00000800",
  482. "entropy": "3.91",
  483. "raw_address": "0x00002c00",
  484. "virtual_size": "0x00000630",
  485. "characteristics_raw": "0xc0300040"
  486. },
  487. {
  488. "name": ".CRT",
  489. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  490. "virtual_address": "0x00007000",
  491. "size_of_data": "0x00000200",
  492. "entropy": "0.27",
  493. "raw_address": "0x00003400",
  494. "virtual_size": "0x00000034",
  495. "characteristics_raw": "0xc0300040"
  496. },
  497. {
  498. "name": ".tls",
  499. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  500. "virtual_address": "0x00008000",
  501. "size_of_data": "0x00000200",
  502. "entropy": "0.22",
  503. "raw_address": "0x00003600",
  504. "virtual_size": "0x00000020",
  505. "characteristics_raw": "0xc0300040"
  506. }
  507. ],
  508. "resources": [],
  509. "dirents": [
  510. {
  511. "virtual_address": "0x00000000",
  512. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  513. "size": "0x00000000"
  514. },
  515. {
  516. "virtual_address": "0x00006000",
  517. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  518. "size": "0x00000630"
  519. },
  520. {
  521. "virtual_address": "0x00000000",
  522. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  523. "size": "0x00000000"
  524. },
  525. {
  526. "virtual_address": "0x00000000",
  527. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  528. "size": "0x00000000"
  529. },
  530. {
  531. "virtual_address": "0x00000000",
  532. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  533. "size": "0x00000000"
  534. },
  535. {
  536. "virtual_address": "0x00000000",
  537. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  538. "size": "0x00000000"
  539. },
  540. {
  541. "virtual_address": "0x00000000",
  542. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  543. "size": "0x00000000"
  544. },
  545. {
  546. "virtual_address": "0x00000000",
  547. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  548. "size": "0x00000000"
  549. },
  550. {
  551. "virtual_address": "0x00000000",
  552. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  553. "size": "0x00000000"
  554. },
  555. {
  556. "virtual_address": "0x00008000",
  557. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  558. "size": "0x00000018"
  559. },
  560. {
  561. "virtual_address": "0x00000000",
  562. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  563. "size": "0x00000000"
  564. },
  565. {
  566. "virtual_address": "0x00000000",
  567. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  568. "size": "0x00000000"
  569. },
  570. {
  571. "virtual_address": "0x0000611c",
  572. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  573. "size": "0x000000e0"
  574. },
  575. {
  576. "virtual_address": "0x00000000",
  577. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  578. "size": "0x00000000"
  579. },
  580. {
  581. "virtual_address": "0x00000000",
  582. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  583. "size": "0x00000000"
  584. },
  585. {
  586. "virtual_address": "0x00000000",
  587. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  588. "size": "0x00000000"
  589. }
  590. ],
  591. "exports": [],
  592. "guest_signers": {},
  593. "imphash": "829da329ce140d873b4a8bde2cbfaa7e",
  594. "icon_fuzzy": null,
  595. "icon": null,
  596. "pdbpath": null,
  597. "imported_dll_count": 2,
  598. "versioninfo": []
  599. }
  600. }
  601.  
  602. [*] Resolved APIs: [
  603. "rasapi32.dll.RasConnectionNotificationW",
  604. "sechost.dll.NotifyServiceStatusChangeA",
  605. "cryptbase.dll.SystemFunction036",
  606. "rpcrt4.dll.RpcBindingFree"
  607. ]
  608.  
  609. [*] Static Analysis: {
  610. "pe": {
  611. "peid_signatures": null,
  612. "imports": [
  613. {
  614. "imports": [
  615. {
  616. "name": "CreateThread",
  617. "address": "0x40611c"
  618. },
  619. {
  620. "name": "DeleteCriticalSection",
  621. "address": "0x406120"
  622. },
  623. {
  624. "name": "EnterCriticalSection",
  625. "address": "0x406124"
  626. },
  627. {
  628. "name": "FreeLibrary",
  629. "address": "0x406128"
  630. },
  631. {
  632. "name": "GetCurrentProcess",
  633. "address": "0x40612c"
  634. },
  635. {
  636. "name": "GetCurrentProcessId",
  637. "address": "0x406130"
  638. },
  639. {
  640. "name": "GetCurrentThreadId",
  641. "address": "0x406134"
  642. },
  643. {
  644. "name": "GetLastError",
  645. "address": "0x406138"
  646. },
  647. {
  648. "name": "GetModuleHandleA",
  649. "address": "0x40613c"
  650. },
  651. {
  652. "name": "GetProcAddress",
  653. "address": "0x406140"
  654. },
  655. {
  656. "name": "GetStartupInfoA",
  657. "address": "0x406144"
  658. },
  659. {
  660. "name": "GetSystemTimeAsFileTime",
  661. "address": "0x406148"
  662. },
  663. {
  664. "name": "GetTickCount",
  665. "address": "0x40614c"
  666. },
  667. {
  668. "name": "InitializeCriticalSection",
  669. "address": "0x406150"
  670. },
  671. {
  672. "name": "LeaveCriticalSection",
  673. "address": "0x406154"
  674. },
  675. {
  676. "name": "LoadLibraryA",
  677. "address": "0x406158"
  678. },
  679. {
  680. "name": "LoadLibraryW",
  681. "address": "0x40615c"
  682. },
  683. {
  684. "name": "QueryPerformanceCounter",
  685. "address": "0x406160"
  686. },
  687. {
  688. "name": "SetUnhandledExceptionFilter",
  689. "address": "0x406164"
  690. },
  691. {
  692. "name": "Sleep",
  693. "address": "0x406168"
  694. },
  695. {
  696. "name": "TerminateProcess",
  697. "address": "0x40616c"
  698. },
  699. {
  700. "name": "TlsGetValue",
  701. "address": "0x406170"
  702. },
  703. {
  704. "name": "UnhandledExceptionFilter",
  705. "address": "0x406174"
  706. },
  707. {
  708. "name": "VirtualAlloc",
  709. "address": "0x406178"
  710. },
  711. {
  712. "name": "VirtualProtect",
  713. "address": "0x40617c"
  714. },
  715. {
  716. "name": "VirtualQuery",
  717. "address": "0x406180"
  718. }
  719. ],
  720. "dll": "KERNEL32.dll"
  721. },
  722. {
  723. "imports": [
  724. {
  725. "name": "__dllonexit",
  726. "address": "0x406188"
  727. },
  728. {
  729. "name": "__getmainargs",
  730. "address": "0x40618c"
  731. },
  732. {
  733. "name": "__initenv",
  734. "address": "0x406190"
  735. },
  736. {
  737. "name": "__lconv_init",
  738. "address": "0x406194"
  739. },
  740. {
  741. "name": "__set_app_type",
  742. "address": "0x406198"
  743. },
  744. {
  745. "name": "__setusermatherr",
  746. "address": "0x40619c"
  747. },
  748. {
  749. "name": "_acmdln",
  750. "address": "0x4061a0"
  751. },
  752. {
  753. "name": "_amsg_exit",
  754. "address": "0x4061a4"
  755. },
  756. {
  757. "name": "_cexit",
  758. "address": "0x4061a8"
  759. },
  760. {
  761. "name": "_fmode",
  762. "address": "0x4061ac"
  763. },
  764. {
  765. "name": "_initterm",
  766. "address": "0x4061b0"
  767. },
  768. {
  769. "name": "_iob",
  770. "address": "0x4061b4"
  771. },
  772. {
  773. "name": "_lock",
  774. "address": "0x4061b8"
  775. },
  776. {
  777. "name": "_onexit",
  778. "address": "0x4061bc"
  779. },
  780. {
  781. "name": "_unlock",
  782. "address": "0x4061c0"
  783. },
  784. {
  785. "name": "_winmajor",
  786. "address": "0x4061c4"
  787. },
  788. {
  789. "name": "abort",
  790. "address": "0x4061c8"
  791. },
  792. {
  793. "name": "calloc",
  794. "address": "0x4061cc"
  795. },
  796. {
  797. "name": "exit",
  798. "address": "0x4061d0"
  799. },
  800. {
  801. "name": "fprintf",
  802. "address": "0x4061d4"
  803. },
  804. {
  805. "name": "free",
  806. "address": "0x4061d8"
  807. },
  808. {
  809. "name": "fwrite",
  810. "address": "0x4061dc"
  811. },
  812. {
  813. "name": "malloc",
  814. "address": "0x4061e0"
  815. },
  816. {
  817. "name": "memcpy",
  818. "address": "0x4061e4"
  819. },
  820. {
  821. "name": "signal",
  822. "address": "0x4061e8"
  823. },
  824. {
  825. "name": "strlen",
  826. "address": "0x4061ec"
  827. },
  828. {
  829. "name": "strncmp",
  830. "address": "0x4061f0"
  831. },
  832. {
  833. "name": "vfprintf",
  834. "address": "0x4061f4"
  835. }
  836. ],
  837. "dll": "msvcrt.dll"
  838. }
  839. ],
  840. "digital_signers": null,
  841. "exported_dll_name": null,
  842. "actual_checksum": "0x00013298",
  843. "overlay": null,
  844. "imagebase": "0x00400000",
  845. "reported_checksum": "0x00013298",
  846. "icon_hash": null,
  847. "entrypoint": "0x004014b0",
  848. "timestamp": "2016-05-17 01:12:02",
  849. "osversion": "4.0",
  850. "sections": [
  851. {
  852. "name": ".text",
  853. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES",
  854. "virtual_address": "0x00001000",
  855. "size_of_data": "0x00001c00",
  856. "entropy": "5.83",
  857. "raw_address": "0x00000400",
  858. "virtual_size": "0x00001ac4",
  859. "characteristics_raw": "0x60500060"
  860. },
  861. {
  862. "name": ".data",
  863. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  864. "virtual_address": "0x00003000",
  865. "size_of_data": "0x00000800",
  866. "entropy": "3.56",
  867. "raw_address": "0x00002000",
  868. "virtual_size": "0x00000624",
  869. "characteristics_raw": "0xc0600040"
  870. },
  871. {
  872. "name": ".rdata",
  873. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES",
  874. "virtual_address": "0x00004000",
  875. "size_of_data": "0x00000400",
  876. "entropy": "4.23",
  877. "raw_address": "0x00002800",
  878. "virtual_size": "0x000002d0",
  879. "characteristics_raw": "0x40300040"
  880. },
  881. {
  882. "name": ".bss",
  883. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  884. "virtual_address": "0x00005000",
  885. "size_of_data": "0x00000000",
  886. "entropy": "0.00",
  887. "raw_address": "0x00000000",
  888. "virtual_size": "0x0000041c",
  889. "characteristics_raw": "0xc0600080"
  890. },
  891. {
  892. "name": ".idata",
  893. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  894. "virtual_address": "0x00006000",
  895. "size_of_data": "0x00000800",
  896. "entropy": "3.91",
  897. "raw_address": "0x00002c00",
  898. "virtual_size": "0x00000630",
  899. "characteristics_raw": "0xc0300040"
  900. },
  901. {
  902. "name": ".CRT",
  903. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  904. "virtual_address": "0x00007000",
  905. "size_of_data": "0x00000200",
  906. "entropy": "0.27",
  907. "raw_address": "0x00003400",
  908. "virtual_size": "0x00000034",
  909. "characteristics_raw": "0xc0300040"
  910. },
  911. {
  912. "name": ".tls",
  913. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  914. "virtual_address": "0x00008000",
  915. "size_of_data": "0x00000200",
  916. "entropy": "0.22",
  917. "raw_address": "0x00003600",
  918. "virtual_size": "0x00000020",
  919. "characteristics_raw": "0xc0300040"
  920. }
  921. ],
  922. "resources": [],
  923. "dirents": [
  924. {
  925. "virtual_address": "0x00000000",
  926. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  927. "size": "0x00000000"
  928. },
  929. {
  930. "virtual_address": "0x00006000",
  931. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  932. "size": "0x00000630"
  933. },
  934. {
  935. "virtual_address": "0x00000000",
  936. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  937. "size": "0x00000000"
  938. },
  939. {
  940. "virtual_address": "0x00000000",
  941. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  942. "size": "0x00000000"
  943. },
  944. {
  945. "virtual_address": "0x00000000",
  946. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  947. "size": "0x00000000"
  948. },
  949. {
  950. "virtual_address": "0x00000000",
  951. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  952. "size": "0x00000000"
  953. },
  954. {
  955. "virtual_address": "0x00000000",
  956. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  957. "size": "0x00000000"
  958. },
  959. {
  960. "virtual_address": "0x00000000",
  961. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  962. "size": "0x00000000"
  963. },
  964. {
  965. "virtual_address": "0x00000000",
  966. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  967. "size": "0x00000000"
  968. },
  969. {
  970. "virtual_address": "0x00008000",
  971. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  972. "size": "0x00000018"
  973. },
  974. {
  975. "virtual_address": "0x00000000",
  976. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  977. "size": "0x00000000"
  978. },
  979. {
  980. "virtual_address": "0x00000000",
  981. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  982. "size": "0x00000000"
  983. },
  984. {
  985. "virtual_address": "0x0000611c",
  986. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  987. "size": "0x000000e0"
  988. },
  989. {
  990. "virtual_address": "0x00000000",
  991. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  992. "size": "0x00000000"
  993. },
  994. {
  995. "virtual_address": "0x00000000",
  996. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  997. "size": "0x00000000"
  998. },
  999. {
  1000. "virtual_address": "0x00000000",
  1001. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1002. "size": "0x00000000"
  1003. }
  1004. ],
  1005. "exports": [],
  1006. "guest_signers": {},
  1007. "imphash": "829da329ce140d873b4a8bde2cbfaa7e",
  1008. "icon_fuzzy": null,
  1009. "icon": null,
  1010. "pdbpath": null,
  1011. "imported_dll_count": 2,
  1012. "versioninfo": []
  1013. }
  1014. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!