API tools faq
paste
paladin316

Exes_70a5e4589a73955f232f268b2f72afb1_exe_2019-07-02_00_30.json

paladin316
Jul 1st, 2019
2,184
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 24.76 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_70a5e4589a73955f232f268b2f72afb1.exe"
  7. [*] File Size: 643072
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "de535442beb49845644de71f520bcc701667178bbc96da39f84a653fa1750680"
  10. [*] MD5: "70a5e4589a73955f232f268b2f72afb1"
  11. [*] SHA1: "a8e6308a7a0d1f3a4345e2da4e9e563b1e26f18d"
  12. [*] SHA512: "fa03452e8d5cded476d737008a84695d845f76f45eb75ead1b0c8ac13fb460bbb088c70e2349581decff4bdf43991d3dd7ea3c1096165d9fd1f187ea90abb835"
  13. [*] CRC32: "6F02DE0C"
  14. [*] SSDEEP: "12288:RZsT8Ys+GgRQstXib3mAdGXYyYxFfyRcj/fhGv:Y4p+GaQstW33dsxrw3h"
  15.  
  16. [*] Process Execution: [
  17. "Exes_70a5e4589a73955f232f268b2f72afb1.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "Exes_70a5e4589a73955f232f268b2f72afb1.exe (200) called API CreateProcessInternalW 42655 times"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 26 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "McAfee": "Fareit-FPH!70A5E4589A73"
  38. },
  39. {
  40. "F-Prot": "W32/Wacatac.F.gen!Eldorado"
  41. },
  42. {
  43. "Symantec": "ML.Attribute.HighConfidence"
  44. },
  45. {
  46. "APEX": "Malicious"
  47. },
  48. {
  49. "Paloalto": "generic.ml"
  50. },
  51. {
  52. "Kaspersky": "Backdoor.Win32.NetWiredRC.hna"
  53. },
  54. {
  55. "AegisLab": "Trojan.Win32.NetWiredRC.4!c"
  56. },
  57. {
  58. "Avast": "Win32:Malware-gen"
  59. },
  60. {
  61. "Endgame": "malicious (high confidence)"
  62. },
  63. {
  64. "Sophos": "Mal/Generic-S"
  65. },
  66. {
  67. "DrWeb": "Trojan.PWS.Banker1.33239"
  68. },
  69. {
  70. "Invincea": "heuristic"
  71. },
  72. {
  73. "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.jm"
  74. },
  75. {
  76. "Trapmine": "malicious.moderate.ml.score"
  77. },
  78. {
  79. "FireEye": "Generic.mg.70a5e4589a73955f"
  80. },
  81. {
  82. "Cyren": "W32/Wacatac.F.gen!Eldorado"
  83. },
  84. {
  85. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  86. },
  87. {
  88. "ZoneAlarm": "Backdoor.Win32.NetWiredRC.hna"
  89. },
  90. {
  91. "Malwarebytes": "Trojan.MalPack.VB.Generic"
  92. },
  93. {
  94. "ESET-NOD32": "a variant of Win32/GenKryptik.DMBU"
  95. },
  96. {
  97. "Rising": "Trojan.Injector!8.C4 (CLOUD)"
  98. },
  99. {
  100. "Ikarus": "Trojan.VB.Crypt"
  101. },
  102. {
  103. "Fortinet": "W32/Injector.EGIR!tr"
  104. },
  105. {
  106. "AVG": "Win32:Malware-gen"
  107. },
  108. {
  109. "Cybereason": "malicious.a7a0d1"
  110. },
  111. {
  112. "CrowdStrike": "win/malicious_confidence_100% (W)"
  113. }
  114. ]
  115. }
  116. ]
  117.  
  118. [*] Started Service: []
  119.  
  120. [*] Executed Commands: [
  121. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\Exes_70a5e4589a73955f232f268b2f72afb1.exe\""
  122. ]
  123.  
  124. [*] Mutexes: [
  125. "CicLoadWinStaWinSta0",
  126. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  127. ]
  128.  
  129. [*] Modified Files: []
  130.  
  131. [*] Deleted Files: []
  132.  
  133. [*] Modified Registry Keys: []
  134.  
  135. [*] Deleted Registry Keys: []
  136.  
  137. [*] DNS Communications: []
  138.  
  139. [*] Domains: []
  140.  
  141. [*] Network Communication - ICMP: []
  142.  
  143. [*] Network Communication - HTTP: []
  144.  
  145. [*] Network Communication - SMTP: []
  146.  
  147. [*] Network Communication - Hosts: []
  148.  
  149. [*] Network Communication - IRC: []
  150.  
  151. [*] Static Analysis: {
  152. "pe": {
  153. "peid_signatures": null,
  154. "imports": [
  155. {
  156. "imports": [
  157. {
  158. "name": "MethCallEngine",
  159. "address": "0x401000"
  160. },
  161. {
  162. "name": null,
  163. "address": "0x401004"
  164. },
  165. {
  166. "name": null,
  167. "address": "0x401008"
  168. },
  169. {
  170. "name": null,
  171. "address": "0x40100c"
  172. },
  173. {
  174. "name": null,
  175. "address": "0x401010"
  176. },
  177. {
  178. "name": null,
  179. "address": "0x401014"
  180. },
  181. {
  182. "name": null,
  183. "address": "0x401018"
  184. },
  185. {
  186. "name": null,
  187. "address": "0x40101c"
  188. },
  189. {
  190. "name": null,
  191. "address": "0x401020"
  192. },
  193. {
  194. "name": null,
  195. "address": "0x401024"
  196. },
  197. {
  198. "name": null,
  199. "address": "0x401028"
  200. },
  201. {
  202. "name": null,
  203. "address": "0x40102c"
  204. },
  205. {
  206. "name": "EVENT_SINK_AddRef",
  207. "address": "0x401030"
  208. },
  209. {
  210. "name": null,
  211. "address": "0x401034"
  212. },
  213. {
  214. "name": null,
  215. "address": "0x401038"
  216. },
  217. {
  218. "name": "EVENT_SINK_Release",
  219. "address": "0x40103c"
  220. },
  221. {
  222. "name": null,
  223. "address": "0x401040"
  224. },
  225. {
  226. "name": "EVENT_SINK_QueryInterface",
  227. "address": "0x401044"
  228. },
  229. {
  230. "name": "__vbaExceptHandler",
  231. "address": "0x401048"
  232. },
  233. {
  234. "name": null,
  235. "address": "0x40104c"
  236. },
  237. {
  238. "name": null,
  239. "address": "0x401050"
  240. },
  241. {
  242. "name": null,
  243. "address": "0x401054"
  244. },
  245. {
  246. "name": null,
  247. "address": "0x401058"
  248. },
  249. {
  250. "name": null,
  251. "address": "0x40105c"
  252. },
  253. {
  254. "name": null,
  255. "address": "0x401060"
  256. },
  257. {
  258. "name": null,
  259. "address": "0x401064"
  260. },
  261. {
  262. "name": null,
  263. "address": "0x401068"
  264. },
  265. {
  266. "name": null,
  267. "address": "0x40106c"
  268. },
  269. {
  270. "name": null,
  271. "address": "0x401070"
  272. }
  273. ],
  274. "dll": "MSVBVM60.DLL"
  275. }
  276. ],
  277. "digital_signers": null,
  278. "exported_dll_name": null,
  279. "actual_checksum": "0x000a6a41",
  280. "overlay": null,
  281. "imagebase": "0x00400000",
  282. "reported_checksum": "0x000a6a41",
  283. "icon_hash": null,
  284. "entrypoint": "0x00401130",
  285. "timestamp": "2019-06-30 21:00:22",
  286. "osversion": "4.0",
  287. "sections": [
  288. {
  289. "name": ".text",
  290. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  291. "virtual_address": "0x00001000",
  292. "size_of_data": "0x00098000",
  293. "entropy": "5.48",
  294. "raw_address": "0x00001000",
  295. "virtual_size": "0x00097330",
  296. "characteristics_raw": "0x60000020"
  297. },
  298. {
  299. "name": ".data",
  300. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  301. "virtual_address": "0x00099000",
  302. "size_of_data": "0x00000000",
  303. "entropy": "0.00",
  304. "raw_address": "0x00000000",
  305. "virtual_size": "0x00005444",
  306. "characteristics_raw": "0xc0000040"
  307. },
  308. {
  309. "name": ".rsrc",
  310. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  311. "virtual_address": "0x0009f000",
  312. "size_of_data": "0x00004000",
  313. "entropy": "4.06",
  314. "raw_address": "0x00099000",
  315. "virtual_size": "0x0000396e",
  316. "characteristics_raw": "0x40000040"
  317. }
  318. ],
  319. "resources": [],
  320. "dirents": [
  321. {
  322. "virtual_address": "0x00000000",
  323. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  324. "size": "0x00000000"
  325. },
  326. {
  327. "virtual_address": "0x00098214",
  328. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  329. "size": "0x00000028"
  330. },
  331. {
  332. "virtual_address": "0x0009f000",
  333. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  334. "size": "0x0000396e"
  335. },
  336. {
  337. "virtual_address": "0x00000000",
  338. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  339. "size": "0x00000000"
  340. },
  341. {
  342. "virtual_address": "0x00000000",
  343. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  344. "size": "0x00000000"
  345. },
  346. {
  347. "virtual_address": "0x00000000",
  348. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  349. "size": "0x00000000"
  350. },
  351. {
  352. "virtual_address": "0x00000000",
  353. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  354. "size": "0x00000000"
  355. },
  356. {
  357. "virtual_address": "0x00000000",
  358. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  359. "size": "0x00000000"
  360. },
  361. {
  362. "virtual_address": "0x00000000",
  363. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  364. "size": "0x00000000"
  365. },
  366. {
  367. "virtual_address": "0x00000000",
  368. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  369. "size": "0x00000000"
  370. },
  371. {
  372. "virtual_address": "0x00000000",
  373. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  374. "size": "0x00000000"
  375. },
  376. {
  377. "virtual_address": "0x00000220",
  378. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  379. "size": "0x00000020"
  380. },
  381. {
  382. "virtual_address": "0x00001000",
  383. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  384. "size": "0x00000078"
  385. },
  386. {
  387. "virtual_address": "0x00000000",
  388. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  389. "size": "0x00000000"
  390. },
  391. {
  392. "virtual_address": "0x00000000",
  393. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  394. "size": "0x00000000"
  395. },
  396. {
  397. "virtual_address": "0x00000000",
  398. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  399. "size": "0x00000000"
  400. }
  401. ],
  402. "exports": [],
  403. "guest_signers": {},
  404. "imphash": "2977270fae1bfe1cc3a3258b5bc0e2ed",
  405. "icon_fuzzy": null,
  406. "icon": null,
  407. "pdbpath": null,
  408. "imported_dll_count": 1,
  409. "versioninfo": []
  410. }
  411. }
  412.  
  413. [*] Resolved APIs: [
  414. "cryptbase.dll.SystemFunction036",
  415. "uxtheme.dll.ThemeInitApiHook",
  416. "user32.dll.IsProcessDPIAware",
  417. "oleaut32.dll.OleLoadPictureEx",
  418. "oleaut32.dll.DispCallFunc",
  419. "oleaut32.dll.LoadTypeLibEx",
  420. "oleaut32.dll.UnRegisterTypeLib",
  421. "oleaut32.dll.CreateTypeLib2",
  422. "oleaut32.dll.VarDateFromUdate",
  423. "oleaut32.dll.VarUdateFromDate",
  424. "oleaut32.dll.GetAltMonthNames",
  425. "oleaut32.dll.VarNumFromParseNum",
  426. "oleaut32.dll.VarParseNumFromStr",
  427. "oleaut32.dll.VarDecFromR4",
  428. "oleaut32.dll.VarDecFromR8",
  429. "oleaut32.dll.VarDecFromDate",
  430. "oleaut32.dll.VarDecFromI4",
  431. "oleaut32.dll.VarDecFromCy",
  432. "oleaut32.dll.VarR4FromDec",
  433. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  434. "oleaut32.dll.GetRecordInfoFromGuids",
  435. "oleaut32.dll.SafeArrayGetRecordInfo",
  436. "oleaut32.dll.SafeArraySetRecordInfo",
  437. "oleaut32.dll.SafeArrayGetIID",
  438. "oleaut32.dll.SafeArraySetIID",
  439. "oleaut32.dll.SafeArrayCopyData",
  440. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  441. "oleaut32.dll.SafeArrayCreateEx",
  442. "oleaut32.dll.VarFormat",
  443. "oleaut32.dll.VarFormatDateTime",
  444. "oleaut32.dll.VarFormatNumber",
  445. "oleaut32.dll.VarFormatPercent",
  446. "oleaut32.dll.VarFormatCurrency",
  447. "oleaut32.dll.VarWeekdayName",
  448. "oleaut32.dll.VarMonthName",
  449. "oleaut32.dll.VarAdd",
  450. "oleaut32.dll.VarAnd",
  451. "oleaut32.dll.VarCat",
  452. "oleaut32.dll.VarDiv",
  453. "oleaut32.dll.VarEqv",
  454. "oleaut32.dll.VarIdiv",
  455. "oleaut32.dll.VarImp",
  456. "oleaut32.dll.VarMod",
  457. "oleaut32.dll.VarMul",
  458. "oleaut32.dll.VarOr",
  459. "oleaut32.dll.VarPow",
  460. "oleaut32.dll.VarSub",
  461. "oleaut32.dll.VarXor",
  462. "oleaut32.dll.VarAbs",
  463. "oleaut32.dll.VarFix",
  464. "oleaut32.dll.VarInt",
  465. "oleaut32.dll.VarNeg",
  466. "oleaut32.dll.VarNot",
  467. "oleaut32.dll.VarRound",
  468. "oleaut32.dll.VarCmp",
  469. "oleaut32.dll.VarDecAdd",
  470. "oleaut32.dll.VarDecCmp",
  471. "oleaut32.dll.VarBstrCat",
  472. "oleaut32.dll.VarCyMulI4",
  473. "oleaut32.dll.VarBstrCmp",
  474. "ole32.dll.CoCreateInstanceEx",
  475. "ole32.dll.CLSIDFromProgIDEx",
  476. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  477. "user32.dll.GetSystemMetrics",
  478. "user32.dll.MonitorFromWindow",
  479. "user32.dll.MonitorFromRect",
  480. "user32.dll.MonitorFromPoint",
  481. "user32.dll.EnumDisplayMonitors",
  482. "user32.dll.GetMonitorInfoA",
  483. "dwmapi.dll.DwmIsCompositionEnabled",
  484. "gdi32.dll.GetLayout",
  485. "gdi32.dll.GdiRealizationInfo",
  486. "gdi32.dll.FontIsLinked",
  487. "advapi32.dll.RegOpenKeyExW",
  488. "advapi32.dll.RegQueryInfoKeyW",
  489. "gdi32.dll.GetTextFaceAliasW",
  490. "advapi32.dll.RegEnumValueW",
  491. "advapi32.dll.RegCloseKey",
  492. "advapi32.dll.RegQueryValueExW",
  493. "gdi32.dll.GetFontAssocStatus",
  494. "advapi32.dll.RegQueryValueExA",
  495. "advapi32.dll.RegEnumKeyExW",
  496. "gdi32.dll.GdiIsMetaPrintDC",
  497. "ole32.dll.CoInitializeEx",
  498. "ole32.dll.CoUninitialize",
  499. "ole32.dll.CoRegisterInitializeSpy",
  500. "ole32.dll.CoRevokeInitializeSpy",
  501. "gdi32.dll.GetTextExtentExPointWPri",
  502. "kernel32.dll.NlsGetCacheUpdateCount",
  503. "kernel32.dll.GetCalendarInfoW",
  504. "kernel32.dll.GetTickCount",
  505. "kernel32.dll.Sleep",
  506. "user32.dll.GetCursorPos",
  507. "user32.dll.EnumWindows",
  508. "kernel32.dll.SetErrorMode",
  509. "kernel32.dll.SetLastError",
  510. "kernel32.dll.VirtualAllocEx",
  511. "kernel32.dll.CloseHandle",
  512. "shell32.dll.ShellExecuteW",
  513. "kernel32.dll.WriteFile",
  514. "kernel32.dll.UnmapViewOfFile",
  515. "kernel32.dll.CreateFileW",
  516. "kernel32.dll.TerminateProcess",
  517. "kernel32.dll.VirtualProtectEx",
  518. "kernel32.dll.CreateProcessInternalW",
  519. "kernel32.dll.GetTempPathW",
  520. "kernel32.dll.GetLongPathNameW",
  521. "kernel32.dll.GetFileSize",
  522. "kernel32.dll.ReadFile",
  523. "ntdll.dll.NtProtectVirtualMemory",
  524. "kernel32.dll.GetCommandLineW"
  525. ]
  526.  
  527. [*] Static Analysis: {
  528. "pe": {
  529. "peid_signatures": null,
  530. "imports": [
  531. {
  532. "imports": [
  533. {
  534. "name": "MethCallEngine",
  535. "address": "0x401000"
  536. },
  537. {
  538. "name": null,
  539. "address": "0x401004"
  540. },
  541. {
  542. "name": null,
  543. "address": "0x401008"
  544. },
  545. {
  546. "name": null,
  547. "address": "0x40100c"
  548. },
  549. {
  550. "name": null,
  551. "address": "0x401010"
  552. },
  553. {
  554. "name": null,
  555. "address": "0x401014"
  556. },
  557. {
  558. "name": null,
  559. "address": "0x401018"
  560. },
  561. {
  562. "name": null,
  563. "address": "0x40101c"
  564. },
  565. {
  566. "name": null,
  567. "address": "0x401020"
  568. },
  569. {
  570. "name": null,
  571. "address": "0x401024"
  572. },
  573. {
  574. "name": null,
  575. "address": "0x401028"
  576. },
  577. {
  578. "name": null,
  579. "address": "0x40102c"
  580. },
  581. {
  582. "name": "EVENT_SINK_AddRef",
  583. "address": "0x401030"
  584. },
  585. {
  586. "name": null,
  587. "address": "0x401034"
  588. },
  589. {
  590. "name": null,
  591. "address": "0x401038"
  592. },
  593. {
  594. "name": "EVENT_SINK_Release",
  595. "address": "0x40103c"
  596. },
  597. {
  598. "name": null,
  599. "address": "0x401040"
  600. },
  601. {
  602. "name": "EVENT_SINK_QueryInterface",
  603. "address": "0x401044"
  604. },
  605. {
  606. "name": "__vbaExceptHandler",
  607. "address": "0x401048"
  608. },
  609. {
  610. "name": null,
  611. "address": "0x40104c"
  612. },
  613. {
  614. "name": null,
  615. "address": "0x401050"
  616. },
  617. {
  618. "name": null,
  619. "address": "0x401054"
  620. },
  621. {
  622. "name": null,
  623. "address": "0x401058"
  624. },
  625. {
  626. "name": null,
  627. "address": "0x40105c"
  628. },
  629. {
  630. "name": null,
  631. "address": "0x401060"
  632. },
  633. {
  634. "name": null,
  635. "address": "0x401064"
  636. },
  637. {
  638. "name": null,
  639. "address": "0x401068"
  640. },
  641. {
  642. "name": null,
  643. "address": "0x40106c"
  644. },
  645. {
  646. "name": null,
  647. "address": "0x401070"
  648. }
  649. ],
  650. "dll": "MSVBVM60.DLL"
  651. }
  652. ],
  653. "digital_signers": null,
  654. "exported_dll_name": null,
  655. "actual_checksum": "0x000a6a41",
  656. "overlay": null,
  657. "imagebase": "0x00400000",
  658. "reported_checksum": "0x000a6a41",
  659. "icon_hash": null,
  660. "entrypoint": "0x00401130",
  661. "timestamp": "2019-06-30 21:00:22",
  662. "osversion": "4.0",
  663. "sections": [
  664. {
  665. "name": ".text",
  666. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  667. "virtual_address": "0x00001000",
  668. "size_of_data": "0x00098000",
  669. "entropy": "5.48",
  670. "raw_address": "0x00001000",
  671. "virtual_size": "0x00097330",
  672. "characteristics_raw": "0x60000020"
  673. },
  674. {
  675. "name": ".data",
  676. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  677. "virtual_address": "0x00099000",
  678. "size_of_data": "0x00000000",
  679. "entropy": "0.00",
  680. "raw_address": "0x00000000",
  681. "virtual_size": "0x00005444",
  682. "characteristics_raw": "0xc0000040"
  683. },
  684. {
  685. "name": ".rsrc",
  686. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  687. "virtual_address": "0x0009f000",
  688. "size_of_data": "0x00004000",
  689. "entropy": "4.06",
  690. "raw_address": "0x00099000",
  691. "virtual_size": "0x0000396e",
  692. "characteristics_raw": "0x40000040"
  693. }
  694. ],
  695. "resources": [],
  696. "dirents": [
  697. {
  698. "virtual_address": "0x00000000",
  699. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  700. "size": "0x00000000"
  701. },
  702. {
  703. "virtual_address": "0x00098214",
  704. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  705. "size": "0x00000028"
  706. },
  707. {
  708. "virtual_address": "0x0009f000",
  709. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  710. "size": "0x0000396e"
  711. },
  712. {
  713. "virtual_address": "0x00000000",
  714. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  715. "size": "0x00000000"
  716. },
  717. {
  718. "virtual_address": "0x00000000",
  719. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  720. "size": "0x00000000"
  721. },
  722. {
  723. "virtual_address": "0x00000000",
  724. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  725. "size": "0x00000000"
  726. },
  727. {
  728. "virtual_address": "0x00000000",
  729. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  730. "size": "0x00000000"
  731. },
  732. {
  733. "virtual_address": "0x00000000",
  734. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  735. "size": "0x00000000"
  736. },
  737. {
  738. "virtual_address": "0x00000000",
  739. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  740. "size": "0x00000000"
  741. },
  742. {
  743. "virtual_address": "0x00000000",
  744. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  745. "size": "0x00000000"
  746. },
  747. {
  748. "virtual_address": "0x00000000",
  749. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  750. "size": "0x00000000"
  751. },
  752. {
  753. "virtual_address": "0x00000220",
  754. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  755. "size": "0x00000020"
  756. },
  757. {
  758. "virtual_address": "0x00001000",
  759. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  760. "size": "0x00000078"
  761. },
  762. {
  763. "virtual_address": "0x00000000",
  764. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  765. "size": "0x00000000"
  766. },
  767. {
  768. "virtual_address": "0x00000000",
  769. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  770. "size": "0x00000000"
  771. },
  772. {
  773. "virtual_address": "0x00000000",
  774. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  775. "size": "0x00000000"
  776. }
  777. ],
  778. "exports": [],
  779. "guest_signers": {},
  780. "imphash": "2977270fae1bfe1cc3a3258b5bc0e2ed",
  781. "icon_fuzzy": null,
  782. "icon": null,
  783. "pdbpath": null,
  784. "imported_dll_count": 1,
  785. "versioninfo": []
  786. }
  787. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!