API tools faq
paste
paladin316

Exes_228e3e3e3965d5a581a5256a5490e1fb_exe_2019-06-28_06_30.json

paladin316
Jun 28th, 2019
2,185
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 78.16 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 0.6
  5.  
  6. [*] File Name: "Exes_228e3e3e3965d5a581a5256a5490e1fb.exe"
  7. [*] File Size: 293513
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive"
  9. [*] SHA256: "ae54efeef26be3e430ea51a1834bcd27e463683325e5cea215c548153a7b2907"
  10. [*] MD5: "228e3e3e3965d5a581a5256a5490e1fb"
  11. [*] SHA1: "2b66910fcdd93af4ae5943fc007eda9ab15d2350"
  12. [*] SHA512: "1c3fcd0ba268864db5f4b266db3bf4c1ce2aca4f5698b83644216d01cb9e9753b760117137357b842b839c5ab4e8729c1e021a35c746336599a71a572b9f075d"
  13. [*] CRC32: "820E0AF9"
  14. [*] SSDEEP: "6144:sZvuCYX6bmERmQ5J4jTYLj7I6V24t32luyKgklz67QqQ/FSXS:stlYXUyjv6V24tmlTK1F67RQMXS"
  15.  
  16. [*] Process Execution: [
  17. "Exes_228e3e3e3965d5a581a5256a5490e1fb.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Reads data out of its own binary image",
  23. "Details": [
  24. {
  25. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00000000, length: 0x00000007"
  26. },
  27. {
  28. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00000000, length: 0x00002000"
  29. },
  30. {
  31. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00000007, length: 0x00047a82"
  32. },
  33. {
  34. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00001ff0, length: 0x00002000"
  35. },
  36. {
  37. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00003fe0, length: 0x00002000"
  38. },
  39. {
  40. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00005fd0, length: 0x00002000"
  41. },
  42. {
  43. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00007fc0, length: 0x00002000"
  44. },
  45. {
  46. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00009fb0, length: 0x00002000"
  47. },
  48. {
  49. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x0000bfa0, length: 0x00002000"
  50. },
  51. {
  52. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x0000df90, length: 0x00002000"
  53. },
  54. {
  55. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x0000ff80, length: 0x00002000"
  56. },
  57. {
  58. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00011f70, length: 0x00002000"
  59. },
  60. {
  61. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00013f60, length: 0x00002000"
  62. },
  63. {
  64. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00015f50, length: 0x00002000"
  65. },
  66. {
  67. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00017f40, length: 0x00002000"
  68. },
  69. {
  70. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00018000, length: 0x00000037"
  71. },
  72. {
  73. "self_read": "process: Exes_228e3e3e3965d5a581a5256a5490e1fb.exe, pid: 1464, offset: 0x00018014, length: 0x000005f1"
  74. }
  75. ]
  76. },
  77. {
  78. "Description": "Performs some HTTP requests",
  79. "Details": [
  80. {
  81. "url": "http://www.bing.com/favicon.ico"
  82. },
  83. {
  84. "url": "http://www.uzzf.com/"
  85. },
  86. {
  87. "url": "http://www.uzzf.com/skin/uzzf2016/css/index2016.css"
  88. },
  89. {
  90. "url": "http://www.uzzf.com/skin/uzzf2016/css/reset.css"
  91. },
  92. {
  93. "url": "http://www.uzzf.com/inc/mredirect.js"
  94. },
  95. {
  96. "url": "http://www.uzzf.com/skin/ver2013_1/images/logo.png"
  97. },
  98. {
  99. "url": "http://pic.uzzf.com/up/2018-2/20182116468145.jpg"
  100. },
  101. {
  102. "url": "http://pic.uzzf.com/up/2017-11/20171130956194005.png"
  103. },
  104. {
  105. "url": "http://pic.uzzf.com/up/2018-2/2018211258338583.jpg"
  106. },
  107. {
  108. "url": "http://pic.uzzf.com/up/2017-12/20171211942544653.png"
  109. },
  110. {
  111. "url": "http://pic.uzzf.com/up/2017-7/2017761430165660.png"
  112. },
  113. {
  114. "url": "http://www.uzzf.com/up/2016-9/2016914103117130.png"
  115. },
  116. {
  117. "url": "http://pic.uzzf.com/up/2018-3/20183301740205506.jpg"
  118. },
  119. {
  120. "url": "http://pic.uzzf.com/up/2019-1/201914118197927.jpg"
  121. },
  122. {
  123. "url": "http://pic.uzzf.com/up/2018-11/20181126164428635.png"
  124. },
  125. {
  126. "url": "http://pic.uzzf.com/up/2019-1/2019131653396077.jpg"
  127. }
  128. ]
  129. }
  130. ]
  131.  
  132. [*] Started Service: []
  133.  
  134. [*] Executed Commands: []
  135.  
  136. [*] Mutexes: [
  137. "CicLoadWinStaWinSta0",
  138. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  139. "Local\\ZonesCounterMutex",
  140. "Local\\ZoneAttributeCacheCounterMutex",
  141. "Local\\ZonesCacheCounterMutex",
  142. "Local\\ZonesLockedCacheCounterMutex"
  143. ]
  144.  
  145. [*] Modified Files: []
  146.  
  147. [*] Deleted Files: []
  148.  
  149. [*] Modified Registry Keys: [
  150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect"
  152. ]
  153.  
  154. [*] Deleted Registry Keys: [
  155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  156. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  158. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFavoritesInitialSelection",
  160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFeedsInitialSelection"
  161. ]
  162.  
  163. [*] DNS Communications: [
  164. {
  165. "type": "A",
  166. "request": "www.bing.com",
  167. "answers": [
  168. {
  169. "data": "dual-a-0001.a-msedge.net",
  170. "type": "CNAME"
  171. },
  172. {
  173. "data": "a-0001.a-afdentry.net.trafficmanager.net",
  174. "type": "CNAME"
  175. },
  176. {
  177. "data": "204.79.197.200",
  178. "type": "A"
  179. },
  180. {
  181. "data": "13.107.21.200",
  182. "type": "A"
  183. }
  184. ]
  185. },
  186. {
  187. "type": "A",
  188. "request": "www.uzzf.com",
  189. "answers": [
  190. {
  191. "data": "www.uzzf.com.w.kunlunar.com",
  192. "type": "CNAME"
  193. },
  194. {
  195. "data": "171.8.242.181",
  196. "type": "A"
  197. }
  198. ]
  199. },
  200. {
  201. "type": "A",
  202. "request": "pic.uzzf.com",
  203. "answers": [
  204. {
  205. "data": "pic.uzzf.com.w.kunlunar.com",
  206. "type": "CNAME"
  207. },
  208. {
  209. "data": "171.8.242.181",
  210. "type": "A"
  211. },
  212. {
  213. "data": "61.184.215.223",
  214. "type": "A"
  215. }
  216. ]
  217. }
  218. ]
  219.  
  220. [*] Domains: [
  221. {
  222. "ip": "13.107.21.200",
  223. "domain": "www.bing.com"
  224. },
  225. {
  226. "ip": "171.8.242.181",
  227. "domain": "pic.uzzf.com"
  228. },
  229. {
  230. "ip": "171.8.242.181",
  231. "domain": "www.uzzf.com"
  232. }
  233. ]
  234.  
  235. [*] Network Communication - ICMP: []
  236.  
  237. [*] Network Communication - HTTP: [
  238. {
  239. "count": 1,
  240. "body": "",
  241. "uri": "http://www.bing.com/favicon.ico",
  242. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  243. "method": "GET",
  244. "host": "www.bing.com",
  245. "version": "1.1",
  246. "path": "/favicon.ico",
  247. "data": "GET /favicon.ico HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.bing.com\r\nConnection: Keep-Alive\r\nCookie: MUID=055643067C21678412144E247D39664A; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=5262DC06BBB54635AC9D8A0AD382875E&dmnchg=1; SRCHUSR=DOB=20190317\r\n\r\n",
  248. "port": 80
  249. },
  250. {
  251. "count": 1,
  252. "body": "",
  253. "uri": "http://www.uzzf.com/",
  254. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  255. "method": "GET",
  256. "host": "www.uzzf.com",
  257. "version": "1.1",
  258. "path": "/",
  259. "data": "GET / HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: www.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  260. "port": 80
  261. },
  262. {
  263. "count": 1,
  264. "body": "",
  265. "uri": "http://www.uzzf.com/skin/uzzf2016/css/index2016.css",
  266. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  267. "method": "GET",
  268. "host": "www.uzzf.com",
  269. "version": "1.1",
  270. "path": "/skin/uzzf2016/css/index2016.css",
  271. "data": "GET /skin/uzzf2016/css/index2016.css HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: www.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  272. "port": 80
  273. },
  274. {
  275. "count": 8,
  276. "body": "",
  277. "uri": "http://www.uzzf.com/skin/uzzf2016/css/reset.css",
  278. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  279. "method": "GET",
  280. "host": "www.uzzf.com",
  281. "version": "1.1",
  282. "path": "/skin/uzzf2016/css/reset.css",
  283. "data": "GET /skin/uzzf2016/css/reset.css HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: www.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  284. "port": 80
  285. },
  286. {
  287. "count": 6,
  288. "body": "",
  289. "uri": "http://www.uzzf.com/inc/mredirect.js",
  290. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  291. "method": "GET",
  292. "host": "www.uzzf.com",
  293. "version": "1.1",
  294. "path": "/inc/mredirect.js",
  295. "data": "GET /inc/mredirect.js HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: www.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  296. "port": 80
  297. },
  298. {
  299. "count": 6,
  300. "body": "",
  301. "uri": "http://www.uzzf.com/skin/ver2013_1/images/logo.png",
  302. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  303. "method": "GET",
  304. "host": "www.uzzf.com",
  305. "version": "1.1",
  306. "path": "/skin/ver2013_1/images/logo.png",
  307. "data": "GET /skin/ver2013_1/images/logo.png HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: www.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  308. "port": 80
  309. },
  310. {
  311. "count": 6,
  312. "body": "",
  313. "uri": "http://pic.uzzf.com/up/2018-2/20182116468145.jpg",
  314. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  315. "method": "GET",
  316. "host": "pic.uzzf.com",
  317. "version": "1.1",
  318. "path": "/up/2018-2/20182116468145.jpg",
  319. "data": "GET /up/2018-2/20182116468145.jpg HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: pic.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  320. "port": 80
  321. },
  322. {
  323. "count": 6,
  324. "body": "",
  325. "uri": "http://pic.uzzf.com/up/2017-11/20171130956194005.png",
  326. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  327. "method": "GET",
  328. "host": "pic.uzzf.com",
  329. "version": "1.1",
  330. "path": "/up/2017-11/20171130956194005.png",
  331. "data": "GET /up/2017-11/20171130956194005.png HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: pic.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  332. "port": 80
  333. },
  334. {
  335. "count": 6,
  336. "body": "",
  337. "uri": "http://pic.uzzf.com/up/2018-2/2018211258338583.jpg",
  338. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  339. "method": "GET",
  340. "host": "pic.uzzf.com",
  341. "version": "1.1",
  342. "path": "/up/2018-2/2018211258338583.jpg",
  343. "data": "GET /up/2018-2/2018211258338583.jpg HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: pic.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  344. "port": 80
  345. },
  346. {
  347. "count": 6,
  348. "body": "",
  349. "uri": "http://pic.uzzf.com/up/2017-12/20171211942544653.png",
  350. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  351. "method": "GET",
  352. "host": "pic.uzzf.com",
  353. "version": "1.1",
  354. "path": "/up/2017-12/20171211942544653.png",
  355. "data": "GET /up/2017-12/20171211942544653.png HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: pic.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  356. "port": 80
  357. },
  358. {
  359. "count": 6,
  360. "body": "",
  361. "uri": "http://pic.uzzf.com/up/2017-7/2017761430165660.png",
  362. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  363. "method": "GET",
  364. "host": "pic.uzzf.com",
  365. "version": "1.1",
  366. "path": "/up/2017-7/2017761430165660.png",
  367. "data": "GET /up/2017-7/2017761430165660.png HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: pic.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  368. "port": 80
  369. },
  370. {
  371. "count": 6,
  372. "body": "",
  373. "uri": "http://www.uzzf.com/up/2016-9/2016914103117130.png",
  374. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  375. "method": "GET",
  376. "host": "www.uzzf.com",
  377. "version": "1.1",
  378. "path": "/up/2016-9/2016914103117130.png",
  379. "data": "GET /up/2016-9/2016914103117130.png HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: www.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  380. "port": 80
  381. },
  382. {
  383. "count": 6,
  384. "body": "",
  385. "uri": "http://pic.uzzf.com/up/2018-3/20183301740205506.jpg",
  386. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  387. "method": "GET",
  388. "host": "pic.uzzf.com",
  389. "version": "1.1",
  390. "path": "/up/2018-3/20183301740205506.jpg",
  391. "data": "GET /up/2018-3/20183301740205506.jpg HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: pic.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  392. "port": 80
  393. },
  394. {
  395. "count": 4,
  396. "body": "",
  397. "uri": "http://pic.uzzf.com/up/2019-1/201914118197927.jpg",
  398. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  399. "method": "GET",
  400. "host": "pic.uzzf.com",
  401. "version": "1.1",
  402. "path": "/up/2019-1/201914118197927.jpg",
  403. "data": "GET /up/2019-1/201914118197927.jpg HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: pic.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  404. "port": 80
  405. },
  406. {
  407. "count": 2,
  408. "body": "",
  409. "uri": "http://pic.uzzf.com/up/2018-11/20181126164428635.png",
  410. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  411. "method": "GET",
  412. "host": "pic.uzzf.com",
  413. "version": "1.1",
  414. "path": "/up/2018-11/20181126164428635.png",
  415. "data": "GET /up/2018-11/20181126164428635.png HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: pic.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  416. "port": 80
  417. },
  418. {
  419. "count": 2,
  420. "body": "",
  421. "uri": "http://pic.uzzf.com/up/2019-1/2019131653396077.jpg",
  422. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  423. "method": "GET",
  424. "host": "pic.uzzf.com",
  425. "version": "1.1",
  426. "path": "/up/2019-1/2019131653396077.jpg",
  427. "data": "GET /up/2019-1/2019131653396077.jpg HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.uzzf.com/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nAccept-Encoding: gzip, deflate\r\nHost: pic.uzzf.com\r\nConnection: Keep-Alive\r\n\r\n",
  428. "port": 80
  429. }
  430. ]
  431.  
  432. [*] Network Communication - SMTP: []
  433.  
  434. [*] Network Communication - Hosts: []
  435.  
  436. [*] Network Communication - IRC: []
  437.  
  438. [*] Static Analysis: {
  439. "pe": {
  440. "peid_signatures": null,
  441. "imports": [
  442. {
  443. "imports": [
  444. {
  445. "name": "AdjustTokenPrivileges",
  446. "address": "0x41b0e0"
  447. },
  448. {
  449. "name": "LookupPrivilegeValueA",
  450. "address": "0x41b0e4"
  451. },
  452. {
  453. "name": "OpenProcessToken",
  454. "address": "0x41b0e8"
  455. },
  456. {
  457. "name": "RegCloseKey",
  458. "address": "0x41b0ec"
  459. },
  460. {
  461. "name": "RegCreateKeyExA",
  462. "address": "0x41b0f0"
  463. },
  464. {
  465. "name": "RegOpenKeyExA",
  466. "address": "0x41b0f4"
  467. },
  468. {
  469. "name": "RegQueryValueExA",
  470. "address": "0x41b0f8"
  471. },
  472. {
  473. "name": "RegSetValueExA",
  474. "address": "0x41b0fc"
  475. },
  476. {
  477. "name": "SetFileSecurityA",
  478. "address": "0x41b100"
  479. },
  480. {
  481. "name": "SetFileSecurityW",
  482. "address": "0x41b104"
  483. }
  484. ],
  485. "dll": "ADVAPI32.DLL"
  486. },
  487. {
  488. "imports": [
  489. {
  490. "name": "CloseHandle",
  491. "address": "0x41b21c"
  492. },
  493. {
  494. "name": "CompareStringA",
  495. "address": "0x41b220"
  496. },
  497. {
  498. "name": "CreateDirectoryA",
  499. "address": "0x41b224"
  500. },
  501. {
  502. "name": "CreateDirectoryW",
  503. "address": "0x41b228"
  504. },
  505. {
  506. "name": "CreateFileA",
  507. "address": "0x41b22c"
  508. },
  509. {
  510. "name": "CreateFileW",
  511. "address": "0x41b230"
  512. },
  513. {
  514. "name": "DeleteFileA",
  515. "address": "0x41b234"
  516. },
  517. {
  518. "name": "DeleteFileW",
  519. "address": "0x41b238"
  520. },
  521. {
  522. "name": "DosDateTimeToFileTime",
  523. "address": "0x41b23c"
  524. },
  525. {
  526. "name": "ExitProcess",
  527. "address": "0x41b240"
  528. },
  529. {
  530. "name": "ExpandEnvironmentStringsA",
  531. "address": "0x41b244"
  532. },
  533. {
  534. "name": "FileTimeToLocalFileTime",
  535. "address": "0x41b248"
  536. },
  537. {
  538. "name": "FileTimeToSystemTime",
  539. "address": "0x41b24c"
  540. },
  541. {
  542. "name": "FindClose",
  543. "address": "0x41b250"
  544. },
  545. {
  546. "name": "FindFirstFileA",
  547. "address": "0x41b254"
  548. },
  549. {
  550. "name": "FindFirstFileW",
  551. "address": "0x41b258"
  552. },
  553. {
  554. "name": "FindNextFileA",
  555. "address": "0x41b25c"
  556. },
  557. {
  558. "name": "FindNextFileW",
  559. "address": "0x41b260"
  560. },
  561. {
  562. "name": "FindResourceA",
  563. "address": "0x41b264"
  564. },
  565. {
  566. "name": "FreeLibrary",
  567. "address": "0x41b268"
  568. },
  569. {
  570. "name": "GetCPInfo",
  571. "address": "0x41b26c"
  572. },
  573. {
  574. "name": "GetCommandLineA",
  575. "address": "0x41b270"
  576. },
  577. {
  578. "name": "GetCurrentDirectoryA",
  579. "address": "0x41b274"
  580. },
  581. {
  582. "name": "GetCurrentProcess",
  583. "address": "0x41b278"
  584. },
  585. {
  586. "name": "GetDateFormatA",
  587. "address": "0x41b27c"
  588. },
  589. {
  590. "name": "GetFileAttributesA",
  591. "address": "0x41b280"
  592. },
  593. {
  594. "name": "GetFileAttributesW",
  595. "address": "0x41b284"
  596. },
  597. {
  598. "name": "GetFileType",
  599. "address": "0x41b288"
  600. },
  601. {
  602. "name": "GetFullPathNameA",
  603. "address": "0x41b28c"
  604. },
  605. {
  606. "name": "GetLastError",
  607. "address": "0x41b290"
  608. },
  609. {
  610. "name": "GetLocaleInfoA",
  611. "address": "0x41b294"
  612. },
  613. {
  614. "name": "GetModuleFileNameA",
  615. "address": "0x41b298"
  616. },
  617. {
  618. "name": "GetModuleHandleA",
  619. "address": "0x41b29c"
  620. },
  621. {
  622. "name": "GetNumberFormatA",
  623. "address": "0x41b2a0"
  624. },
  625. {
  626. "name": "GetProcAddress",
  627. "address": "0x41b2a4"
  628. },
  629. {
  630. "name": "GetProcessHeap",
  631. "address": "0x41b2a8"
  632. },
  633. {
  634. "name": "GetStdHandle",
  635. "address": "0x41b2ac"
  636. },
  637. {
  638. "name": "GetTempPathA",
  639. "address": "0x41b2b0"
  640. },
  641. {
  642. "name": "GetTickCount",
  643. "address": "0x41b2b4"
  644. },
  645. {
  646. "name": "GetTimeFormatA",
  647. "address": "0x41b2b8"
  648. },
  649. {
  650. "name": "GetVersionExA",
  651. "address": "0x41b2bc"
  652. },
  653. {
  654. "name": "GlobalAlloc",
  655. "address": "0x41b2c0"
  656. },
  657. {
  658. "name": "HeapAlloc",
  659. "address": "0x41b2c4"
  660. },
  661. {
  662. "name": "HeapFree",
  663. "address": "0x41b2c8"
  664. },
  665. {
  666. "name": "HeapReAlloc",
  667. "address": "0x41b2cc"
  668. },
  669. {
  670. "name": "IsDBCSLeadByte",
  671. "address": "0x41b2d0"
  672. },
  673. {
  674. "name": "LoadLibraryA",
  675. "address": "0x41b2d4"
  676. },
  677. {
  678. "name": "LocalFileTimeToFileTime",
  679. "address": "0x41b2d8"
  680. },
  681. {
  682. "name": "MoveFileA",
  683. "address": "0x41b2dc"
  684. },
  685. {
  686. "name": "MoveFileExA",
  687. "address": "0x41b2e0"
  688. },
  689. {
  690. "name": "MultiByteToWideChar",
  691. "address": "0x41b2e4"
  692. },
  693. {
  694. "name": "ReadFile",
  695. "address": "0x41b2e8"
  696. },
  697. {
  698. "name": "SetCurrentDirectoryA",
  699. "address": "0x41b2ec"
  700. },
  701. {
  702. "name": "SetEndOfFile",
  703. "address": "0x41b2f0"
  704. },
  705. {
  706. "name": "SetEnvironmentVariableA",
  707. "address": "0x41b2f4"
  708. },
  709. {
  710. "name": "SetFileAttributesA",
  711. "address": "0x41b2f8"
  712. },
  713. {
  714. "name": "SetFileAttributesW",
  715. "address": "0x41b2fc"
  716. },
  717. {
  718. "name": "SetFilePointer",
  719. "address": "0x41b300"
  720. },
  721. {
  722. "name": "SetFileTime",
  723. "address": "0x41b304"
  724. },
  725. {
  726. "name": "SetLastError",
  727. "address": "0x41b308"
  728. },
  729. {
  730. "name": "Sleep",
  731. "address": "0x41b30c"
  732. },
  733. {
  734. "name": "SystemTimeToFileTime",
  735. "address": "0x41b310"
  736. },
  737. {
  738. "name": "WaitForSingleObject",
  739. "address": "0x41b314"
  740. },
  741. {
  742. "name": "WideCharToMultiByte",
  743. "address": "0x41b318"
  744. },
  745. {
  746. "name": "WriteFile",
  747. "address": "0x41b31c"
  748. },
  749. {
  750. "name": "lstrcmpiA",
  751. "address": "0x41b320"
  752. },
  753. {
  754. "name": "lstrlenA",
  755. "address": "0x41b324"
  756. }
  757. ],
  758. "dll": "KERNEL32.DLL"
  759. },
  760. {
  761. "imports": [
  762. {
  763. "name": null,
  764. "address": "0x41b334"
  765. }
  766. ],
  767. "dll": "COMCTL32.DLL"
  768. },
  769. {
  770. "imports": [
  771. {
  772. "name": "CommDlgExtendedError",
  773. "address": "0x41b348"
  774. },
  775. {
  776. "name": "GetOpenFileNameA",
  777. "address": "0x41b34c"
  778. }
  779. ],
  780. "dll": "COMDLG32.DLL"
  781. },
  782. {
  783. "imports": [
  784. {
  785. "name": "DeleteObject",
  786. "address": "0x41b35c"
  787. }
  788. ],
  789. "dll": "GDI32.DLL"
  790. },
  791. {
  792. "imports": [
  793. {
  794. "name": "SHBrowseForFolderA",
  795. "address": "0x41b388"
  796. },
  797. {
  798. "name": "SHChangeNotify",
  799. "address": "0x41b38c"
  800. },
  801. {
  802. "name": "SHFileOperationA",
  803. "address": "0x41b390"
  804. },
  805. {
  806. "name": "SHGetFileInfoA",
  807. "address": "0x41b394"
  808. },
  809. {
  810. "name": "SHGetMalloc",
  811. "address": "0x41b398"
  812. },
  813. {
  814. "name": "SHGetSpecialFolderLocation",
  815. "address": "0x41b39c"
  816. },
  817. {
  818. "name": "ShellExecuteExA",
  819. "address": "0x41b3a0"
  820. },
  821. {
  822. "name": "SHGetPathFromIDListA",
  823. "address": "0x41b3a4"
  824. }
  825. ],
  826. "dll": "SHELL32.DLL"
  827. },
  828. {
  829. "imports": [
  830. {
  831. "name": "CharToOemA",
  832. "address": "0x41b480"
  833. },
  834. {
  835. "name": "CharToOemBuffA",
  836. "address": "0x41b484"
  837. },
  838. {
  839. "name": "CharUpperA",
  840. "address": "0x41b488"
  841. },
  842. {
  843. "name": "CopyRect",
  844. "address": "0x41b48c"
  845. },
  846. {
  847. "name": "CreateWindowExA",
  848. "address": "0x41b490"
  849. },
  850. {
  851. "name": "DefWindowProcA",
  852. "address": "0x41b494"
  853. },
  854. {
  855. "name": "DestroyIcon",
  856. "address": "0x41b498"
  857. },
  858. {
  859. "name": "DestroyWindow",
  860. "address": "0x41b49c"
  861. },
  862. {
  863. "name": "DialogBoxParamA",
  864. "address": "0x41b4a0"
  865. },
  866. {
  867. "name": "DispatchMessageA",
  868. "address": "0x41b4a4"
  869. },
  870. {
  871. "name": "EnableWindow",
  872. "address": "0x41b4a8"
  873. },
  874. {
  875. "name": "EndDialog",
  876. "address": "0x41b4ac"
  877. },
  878. {
  879. "name": "FindWindowExA",
  880. "address": "0x41b4b0"
  881. },
  882. {
  883. "name": "GetClassNameA",
  884. "address": "0x41b4b4"
  885. },
  886. {
  887. "name": "GetClientRect",
  888. "address": "0x41b4b8"
  889. },
  890. {
  891. "name": "GetDlgItem",
  892. "address": "0x41b4bc"
  893. },
  894. {
  895. "name": "GetDlgItemTextA",
  896. "address": "0x41b4c0"
  897. },
  898. {
  899. "name": "GetMessageA",
  900. "address": "0x41b4c4"
  901. },
  902. {
  903. "name": "GetParent",
  904. "address": "0x41b4c8"
  905. },
  906. {
  907. "name": "GetSysColor",
  908. "address": "0x41b4cc"
  909. },
  910. {
  911. "name": "GetSystemMetrics",
  912. "address": "0x41b4d0"
  913. },
  914. {
  915. "name": "GetWindow",
  916. "address": "0x41b4d4"
  917. },
  918. {
  919. "name": "GetWindowLongA",
  920. "address": "0x41b4d8"
  921. },
  922. {
  923. "name": "GetWindowRect",
  924. "address": "0x41b4dc"
  925. },
  926. {
  927. "name": "GetWindowTextA",
  928. "address": "0x41b4e0"
  929. },
  930. {
  931. "name": "IsWindow",
  932. "address": "0x41b4e4"
  933. },
  934. {
  935. "name": "IsWindowVisible",
  936. "address": "0x41b4e8"
  937. },
  938. {
  939. "name": "LoadBitmapA",
  940. "address": "0x41b4ec"
  941. },
  942. {
  943. "name": "LoadCursorA",
  944. "address": "0x41b4f0"
  945. },
  946. {
  947. "name": "LoadIconA",
  948. "address": "0x41b4f4"
  949. },
  950. {
  951. "name": "LoadStringA",
  952. "address": "0x41b4f8"
  953. },
  954. {
  955. "name": "MapWindowPoints",
  956. "address": "0x41b4fc"
  957. },
  958. {
  959. "name": "MessageBoxA",
  960. "address": "0x41b500"
  961. },
  962. {
  963. "name": "OemToCharA",
  964. "address": "0x41b504"
  965. },
  966. {
  967. "name": "OemToCharBuffA",
  968. "address": "0x41b508"
  969. },
  970. {
  971. "name": "PeekMessageA",
  972. "address": "0x41b50c"
  973. },
  974. {
  975. "name": "PostMessageA",
  976. "address": "0x41b510"
  977. },
  978. {
  979. "name": "RegisterClassExA",
  980. "address": "0x41b514"
  981. },
  982. {
  983. "name": "SendDlgItemMessageA",
  984. "address": "0x41b518"
  985. },
  986. {
  987. "name": "SendMessageA",
  988. "address": "0x41b51c"
  989. },
  990. {
  991. "name": "SetDlgItemTextA",
  992. "address": "0x41b520"
  993. },
  994. {
  995. "name": "SetFocus",
  996. "address": "0x41b524"
  997. },
  998. {
  999. "name": "SetMenu",
  1000. "address": "0x41b528"
  1001. },
  1002. {
  1003. "name": "SetWindowLongA",
  1004. "address": "0x41b52c"
  1005. },
  1006. {
  1007. "name": "SetWindowPos",
  1008. "address": "0x41b530"
  1009. },
  1010. {
  1011. "name": "SetWindowTextA",
  1012. "address": "0x41b534"
  1013. },
  1014. {
  1015. "name": "ShowWindow",
  1016. "address": "0x41b538"
  1017. },
  1018. {
  1019. "name": "TranslateMessage",
  1020. "address": "0x41b53c"
  1021. },
  1022. {
  1023. "name": "UpdateWindow",
  1024. "address": "0x41b540"
  1025. },
  1026. {
  1027. "name": "WaitForInputIdle",
  1028. "address": "0x41b544"
  1029. },
  1030. {
  1031. "name": "wsprintfA",
  1032. "address": "0x41b548"
  1033. },
  1034. {
  1035. "name": "wvsprintfA",
  1036. "address": "0x41b54c"
  1037. }
  1038. ],
  1039. "dll": "USER32.DLL"
  1040. },
  1041. {
  1042. "imports": [
  1043. {
  1044. "name": "CLSIDFromString",
  1045. "address": "0x41b56c"
  1046. },
  1047. {
  1048. "name": "CoCreateInstance",
  1049. "address": "0x41b570"
  1050. },
  1051. {
  1052. "name": "CreateStreamOnHGlobal",
  1053. "address": "0x41b574"
  1054. },
  1055. {
  1056. "name": "OleInitialize",
  1057. "address": "0x41b578"
  1058. },
  1059. {
  1060. "name": "OleUninitialize",
  1061. "address": "0x41b57c"
  1062. }
  1063. ],
  1064. "dll": "OLE32.DLL"
  1065. }
  1066. ],
  1067. "digital_signers": null,
  1068. "exported_dll_name": null,
  1069. "actual_checksum": "0x00051b6d",
  1070. "overlay": {
  1071. "size": "0x0002fa89",
  1072. "offset": "0x00018000"
  1073. },
  1074. "imagebase": "0x00400000",
  1075. "reported_checksum": "0x00000000",
  1076. "icon_hash": null,
  1077. "entrypoint": "0x00401000",
  1078. "timestamp": "2006-12-03 09:53:00",
  1079. "osversion": "4.0",
  1080. "sections": [
  1081. {
  1082. "name": ".text",
  1083. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1084. "virtual_address": "0x00001000",
  1085. "size_of_data": "0x00012e00",
  1086. "entropy": "6.46",
  1087. "raw_address": "0x00000600",
  1088. "virtual_size": "0x00013000",
  1089. "characteristics_raw": "0x60000020"
  1090. },
  1091. {
  1092. "name": ".data",
  1093. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1094. "virtual_address": "0x00014000",
  1095. "size_of_data": "0x00000a00",
  1096. "entropy": "4.76",
  1097. "raw_address": "0x00013400",
  1098. "virtual_size": "0x00007000",
  1099. "characteristics_raw": "0xc0000040"
  1100. },
  1101. {
  1102. "name": ".idata",
  1103. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1104. "virtual_address": "0x0001b000",
  1105. "size_of_data": "0x00001000",
  1106. "entropy": "5.11",
  1107. "raw_address": "0x00013e00",
  1108. "virtual_size": "0x00001000",
  1109. "characteristics_raw": "0x40000040"
  1110. },
  1111. {
  1112. "name": ".rsrc",
  1113. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1114. "virtual_address": "0x0001c000",
  1115. "size_of_data": "0x00003200",
  1116. "entropy": "5.15",
  1117. "raw_address": "0x00014e00",
  1118. "virtual_size": "0x000031e4",
  1119. "characteristics_raw": "0x40000040"
  1120. }
  1121. ],
  1122. "resources": [],
  1123. "dirents": [
  1124. {
  1125. "virtual_address": "0x00000000",
  1126. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1127. "size": "0x00000000"
  1128. },
  1129. {
  1130. "virtual_address": "0x0001b000",
  1131. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1132. "size": "0x00000fb5"
  1133. },
  1134. {
  1135. "virtual_address": "0x0001c000",
  1136. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1137. "size": "0x000031e4"
  1138. },
  1139. {
  1140. "virtual_address": "0x00000000",
  1141. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1142. "size": "0x00000000"
  1143. },
  1144. {
  1145. "virtual_address": "0x00000000",
  1146. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1147. "size": "0x00000000"
  1148. },
  1149. {
  1150. "virtual_address": "0x00000000",
  1151. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1152. "size": "0x00000000"
  1153. },
  1154. {
  1155. "virtual_address": "0x00000000",
  1156. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1157. "size": "0x00000000"
  1158. },
  1159. {
  1160. "virtual_address": "0x00000000",
  1161. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1162. "size": "0x00000000"
  1163. },
  1164. {
  1165. "virtual_address": "0x00000000",
  1166. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1167. "size": "0x00000000"
  1168. },
  1169. {
  1170. "virtual_address": "0x00000000",
  1171. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1172. "size": "0x00000000"
  1173. },
  1174. {
  1175. "virtual_address": "0x00000000",
  1176. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1177. "size": "0x00000000"
  1178. },
  1179. {
  1180. "virtual_address": "0x00000000",
  1181. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1182. "size": "0x00000000"
  1183. },
  1184. {
  1185. "virtual_address": "0x00000000",
  1186. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1187. "size": "0x00000000"
  1188. },
  1189. {
  1190. "virtual_address": "0x00000000",
  1191. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1192. "size": "0x00000000"
  1193. },
  1194. {
  1195. "virtual_address": "0x00000000",
  1196. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1197. "size": "0x00000000"
  1198. },
  1199. {
  1200. "virtual_address": "0x00000000",
  1201. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1202. "size": "0x00000000"
  1203. }
  1204. ],
  1205. "exports": [],
  1206. "guest_signers": {},
  1207. "imphash": "87b324a67e18fb2e1d12308b06fa8d4f",
  1208. "icon_fuzzy": null,
  1209. "icon": null,
  1210. "pdbpath": null,
  1211. "imported_dll_count": 8,
  1212. "versioninfo": []
  1213. }
  1214. }
  1215.  
  1216. [*] Resolved APIs: [
  1217. "comctl32.dll.InitCommonControlsEx",
  1218. "ole32.dll.CoGetMalloc",
  1219. "uxtheme.dll.ThemeInitApiHook",
  1220. "user32.dll.IsProcessDPIAware",
  1221. "dwmapi.dll.DwmIsCompositionEnabled",
  1222. "comctl32.dll.RegisterClassNameW",
  1223. "uxtheme.dll.EnableThemeDialogTexture",
  1224. "uxtheme.dll.OpenThemeData",
  1225. "uxtheme.dll.IsThemePartDefined",
  1226. "uxtheme.dll.GetThemeMargins",
  1227. "uxtheme.dll.GetThemeBool",
  1228. "uxtheme.dll.GetThemeInt",
  1229. "comctl32.dll.HIMAGELIST_QueryInterface",
  1230. "comctl32.dll.DrawShadowText",
  1231. "comctl32.dll.DrawSizeBox",
  1232. "comctl32.dll.DrawScrollBar",
  1233. "comctl32.dll.SizeBoxHwnd",
  1234. "comctl32.dll.ScrollBar_MouseMove",
  1235. "comctl32.dll.ScrollBar_Menu",
  1236. "comctl32.dll.HandleScrollCmd",
  1237. "comctl32.dll.DetachScrollBars",
  1238. "comctl32.dll.AttachScrollBars",
  1239. "comctl32.dll.CCSetScrollInfo",
  1240. "comctl32.dll.CCGetScrollInfo",
  1241. "comctl32.dll.CCEnableScrollBar",
  1242. "comctl32.dll.QuerySystemGestureStatus",
  1243. "uxtheme.dll.#49",
  1244. "uxtheme.dll.CloseThemeData",
  1245. "uxtheme.dll.SetWindowTheme",
  1246. "uxtheme.dll.GetThemeFont",
  1247. "uxtheme.dll.GetThemeColor",
  1248. "imm32.dll.ImmIsIME",
  1249. "gdi32.dll.GetLayout",
  1250. "gdi32.dll.GdiRealizationInfo",
  1251. "gdi32.dll.FontIsLinked",
  1252. "advapi32.dll.RegOpenKeyExW",
  1253. "advapi32.dll.RegQueryInfoKeyW",
  1254. "gdi32.dll.GetTextFaceAliasW",
  1255. "advapi32.dll.RegEnumValueW",
  1256. "advapi32.dll.RegCloseKey",
  1257. "advapi32.dll.RegQueryValueExW",
  1258. "gdi32.dll.GetFontAssocStatus",
  1259. "advapi32.dll.RegQueryValueExA",
  1260. "advapi32.dll.RegEnumKeyExW",
  1261. "gdi32.dll.GdiIsMetaPrintDC",
  1262. "shlwapi.dll.SHAutoComplete",
  1263. "ole32.dll.CoCreateInstance",
  1264. "cryptbase.dll.SystemFunction036",
  1265. "urlmon.dll.#414",
  1266. "ole32.dll.CoInitializeEx",
  1267. "ole32.dll.CoUninitialize",
  1268. "ole32.dll.CoRegisterInitializeSpy",
  1269. "ole32.dll.CoRevokeInitializeSpy",
  1270. "urlmon.dll.CreateUri",
  1271. "kernel32.dll.InitializeSRWLock",
  1272. "kernel32.dll.AcquireSRWLockExclusive",
  1273. "kernel32.dll.AcquireSRWLockShared",
  1274. "kernel32.dll.ReleaseSRWLockExclusive",
  1275. "kernel32.dll.ReleaseSRWLockShared",
  1276. "ole32.dll.CoTaskMemAlloc",
  1277. "ole32.dll.CoGetApartmentType",
  1278. "ole32.dll.CoTaskMemFree",
  1279. "comctl32.dll.#236",
  1280. "oleaut32.dll.#6",
  1281. "comctl32.dll.#320",
  1282. "ole32.dll.StringFromGUID2",
  1283. "comctl32.dll.#324",
  1284. "comctl32.dll.#323",
  1285. "apphelp.dll.ApphelpCheckShellObject",
  1286. "urlmon.dll.CreateURLMonikerEx",
  1287. "urlmon.dll.CreateAsyncBindCtxEx",
  1288. "urlmon.dll.RegisterBindStatusCallback",
  1289. "urlmon.dll.CreateFormatEnumerator",
  1290. "wininet.dll.InternetGetConnectedState",
  1291. "rasapi32.dll.RasConnectionNotificationW",
  1292. "sechost.dll.NotifyServiceStatusChangeA",
  1293. "urlmon.dll.UrlMkGetSessionOption",
  1294. "urlmon.dll.CoInternetCreateSecurityManager",
  1295. "oleaut32.dll.#201",
  1296. "urlmon.dll.CoInternetQueryInfo",
  1297. "oleaut32.dll.#7",
  1298. "urlmon.dll.CoInternetIsFeatureEnabled",
  1299. "iphlpapi.dll.GetAdaptersAddresses",
  1300. "oleaut32.dll.#8",
  1301. "ieframe.dll.#302",
  1302. "urlmon.dll.RegisterFormatEnumerator",
  1303. "urlmon.dll.RevokeBindStatusCallback",
  1304. "urlmon.dll.#101",
  1305. "ieframe.dll.#234",
  1306. "wininet.dll.InternetSetOptionW",
  1307. "imm32.dll.ImmGetContext",
  1308. "imm32.dll.ImmLockIMC",
  1309. "imm32.dll.ImmUnlockIMC",
  1310. "imm32.dll.ImmReleaseContext",
  1311. "imm32.dll.ImmSetCompositionFontW",
  1312. "gdi32.dll.GetTextExtentExPointWPri",
  1313. "imm32.dll.ImmGetCompositionWindow",
  1314. "imm32.dll.ImmSetCompositionWindow",
  1315. "imm32.dll.ImmNotifyIME",
  1316. "imm32.dll.ImmAssociateContext",
  1317. "uxtheme.dll.BufferedPaintInit",
  1318. "uxtheme.dll.BufferedPaintRenderAnimation",
  1319. "uxtheme.dll.GetThemeTransitionDuration",
  1320. "uxtheme.dll.BeginBufferedAnimation",
  1321. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  1322. "uxtheme.dll.DrawThemeParentBackground",
  1323. "uxtheme.dll.DrawThemeBackground",
  1324. "uxtheme.dll.GetThemeBackgroundContentRect",
  1325. "uxtheme.dll.DrawThemeText",
  1326. "uxtheme.dll.EndBufferedAnimation",
  1327. "oleaut32.dll.#2",
  1328. "oleaut32.dll.VariantClear",
  1329. "mlang.dll.#112",
  1330. "wininet.dll.GetUrlCacheEntryInfoA",
  1331. "ole32.dll.CoGetObjectContext",
  1332. "sechost.dll.LookupAccountNameLocalW",
  1333. "advapi32.dll.LookupAccountSidW",
  1334. "sechost.dll.LookupAccountSidLocalW",
  1335. "cryptsp.dll.CryptAcquireContextW",
  1336. "cryptsp.dll.CryptGenRandom",
  1337. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1338. "oleaut32.dll.#147",
  1339. "oleaut32.dll.#4",
  1340. "comctl32.dll.ImageList_Create",
  1341. "comctl32.dll.ImageList_ReplaceIcon",
  1342. "urlmon.dll.#330",
  1343. "wininet.dll.GetUrlCacheEntryInfoExW",
  1344. "uxtheme.dll.IsAppThemed",
  1345. "uxtheme.dll.#61",
  1346. "oleaut32.dll.#500"
  1347. ]
  1348.  
  1349. [*] Static Analysis: {
  1350. "pe": {
  1351. "peid_signatures": null,
  1352. "imports": [
  1353. {
  1354. "imports": [
  1355. {
  1356. "name": "AdjustTokenPrivileges",
  1357. "address": "0x41b0e0"
  1358. },
  1359. {
  1360. "name": "LookupPrivilegeValueA",
  1361. "address": "0x41b0e4"
  1362. },
  1363. {
  1364. "name": "OpenProcessToken",
  1365. "address": "0x41b0e8"
  1366. },
  1367. {
  1368. "name": "RegCloseKey",
  1369. "address": "0x41b0ec"
  1370. },
  1371. {
  1372. "name": "RegCreateKeyExA",
  1373. "address": "0x41b0f0"
  1374. },
  1375. {
  1376. "name": "RegOpenKeyExA",
  1377. "address": "0x41b0f4"
  1378. },
  1379. {
  1380. "name": "RegQueryValueExA",
  1381. "address": "0x41b0f8"
  1382. },
  1383. {
  1384. "name": "RegSetValueExA",
  1385. "address": "0x41b0fc"
  1386. },
  1387. {
  1388. "name": "SetFileSecurityA",
  1389. "address": "0x41b100"
  1390. },
  1391. {
  1392. "name": "SetFileSecurityW",
  1393. "address": "0x41b104"
  1394. }
  1395. ],
  1396. "dll": "ADVAPI32.DLL"
  1397. },
  1398. {
  1399. "imports": [
  1400. {
  1401. "name": "CloseHandle",
  1402. "address": "0x41b21c"
  1403. },
  1404. {
  1405. "name": "CompareStringA",
  1406. "address": "0x41b220"
  1407. },
  1408. {
  1409. "name": "CreateDirectoryA",
  1410. "address": "0x41b224"
  1411. },
  1412. {
  1413. "name": "CreateDirectoryW",
  1414. "address": "0x41b228"
  1415. },
  1416. {
  1417. "name": "CreateFileA",
  1418. "address": "0x41b22c"
  1419. },
  1420. {
  1421. "name": "CreateFileW",
  1422. "address": "0x41b230"
  1423. },
  1424. {
  1425. "name": "DeleteFileA",
  1426. "address": "0x41b234"
  1427. },
  1428. {
  1429. "name": "DeleteFileW",
  1430. "address": "0x41b238"
  1431. },
  1432. {
  1433. "name": "DosDateTimeToFileTime",
  1434. "address": "0x41b23c"
  1435. },
  1436. {
  1437. "name": "ExitProcess",
  1438. "address": "0x41b240"
  1439. },
  1440. {
  1441. "name": "ExpandEnvironmentStringsA",
  1442. "address": "0x41b244"
  1443. },
  1444. {
  1445. "name": "FileTimeToLocalFileTime",
  1446. "address": "0x41b248"
  1447. },
  1448. {
  1449. "name": "FileTimeToSystemTime",
  1450. "address": "0x41b24c"
  1451. },
  1452. {
  1453. "name": "FindClose",
  1454. "address": "0x41b250"
  1455. },
  1456. {
  1457. "name": "FindFirstFileA",
  1458. "address": "0x41b254"
  1459. },
  1460. {
  1461. "name": "FindFirstFileW",
  1462. "address": "0x41b258"
  1463. },
  1464. {
  1465. "name": "FindNextFileA",
  1466. "address": "0x41b25c"
  1467. },
  1468. {
  1469. "name": "FindNextFileW",
  1470. "address": "0x41b260"
  1471. },
  1472. {
  1473. "name": "FindResourceA",
  1474. "address": "0x41b264"
  1475. },
  1476. {
  1477. "name": "FreeLibrary",
  1478. "address": "0x41b268"
  1479. },
  1480. {
  1481. "name": "GetCPInfo",
  1482. "address": "0x41b26c"
  1483. },
  1484. {
  1485. "name": "GetCommandLineA",
  1486. "address": "0x41b270"
  1487. },
  1488. {
  1489. "name": "GetCurrentDirectoryA",
  1490. "address": "0x41b274"
  1491. },
  1492. {
  1493. "name": "GetCurrentProcess",
  1494. "address": "0x41b278"
  1495. },
  1496. {
  1497. "name": "GetDateFormatA",
  1498. "address": "0x41b27c"
  1499. },
  1500. {
  1501. "name": "GetFileAttributesA",
  1502. "address": "0x41b280"
  1503. },
  1504. {
  1505. "name": "GetFileAttributesW",
  1506. "address": "0x41b284"
  1507. },
  1508. {
  1509. "name": "GetFileType",
  1510. "address": "0x41b288"
  1511. },
  1512. {
  1513. "name": "GetFullPathNameA",
  1514. "address": "0x41b28c"
  1515. },
  1516. {
  1517. "name": "GetLastError",
  1518. "address": "0x41b290"
  1519. },
  1520. {
  1521. "name": "GetLocaleInfoA",
  1522. "address": "0x41b294"
  1523. },
  1524. {
  1525. "name": "GetModuleFileNameA",
  1526. "address": "0x41b298"
  1527. },
  1528. {
  1529. "name": "GetModuleHandleA",
  1530. "address": "0x41b29c"
  1531. },
  1532. {
  1533. "name": "GetNumberFormatA",
  1534. "address": "0x41b2a0"
  1535. },
  1536. {
  1537. "name": "GetProcAddress",
  1538. "address": "0x41b2a4"
  1539. },
  1540. {
  1541. "name": "GetProcessHeap",
  1542. "address": "0x41b2a8"
  1543. },
  1544. {
  1545. "name": "GetStdHandle",
  1546. "address": "0x41b2ac"
  1547. },
  1548. {
  1549. "name": "GetTempPathA",
  1550. "address": "0x41b2b0"
  1551. },
  1552. {
  1553. "name": "GetTickCount",
  1554. "address": "0x41b2b4"
  1555. },
  1556. {
  1557. "name": "GetTimeFormatA",
  1558. "address": "0x41b2b8"
  1559. },
  1560. {
  1561. "name": "GetVersionExA",
  1562. "address": "0x41b2bc"
  1563. },
  1564. {
  1565. "name": "GlobalAlloc",
  1566. "address": "0x41b2c0"
  1567. },
  1568. {
  1569. "name": "HeapAlloc",
  1570. "address": "0x41b2c4"
  1571. },
  1572. {
  1573. "name": "HeapFree",
  1574. "address": "0x41b2c8"
  1575. },
  1576. {
  1577. "name": "HeapReAlloc",
  1578. "address": "0x41b2cc"
  1579. },
  1580. {
  1581. "name": "IsDBCSLeadByte",
  1582. "address": "0x41b2d0"
  1583. },
  1584. {
  1585. "name": "LoadLibraryA",
  1586. "address": "0x41b2d4"
  1587. },
  1588. {
  1589. "name": "LocalFileTimeToFileTime",
  1590. "address": "0x41b2d8"
  1591. },
  1592. {
  1593. "name": "MoveFileA",
  1594. "address": "0x41b2dc"
  1595. },
  1596. {
  1597. "name": "MoveFileExA",
  1598. "address": "0x41b2e0"
  1599. },
  1600. {
  1601. "name": "MultiByteToWideChar",
  1602. "address": "0x41b2e4"
  1603. },
  1604. {
  1605. "name": "ReadFile",
  1606. "address": "0x41b2e8"
  1607. },
  1608. {
  1609. "name": "SetCurrentDirectoryA",
  1610. "address": "0x41b2ec"
  1611. },
  1612. {
  1613. "name": "SetEndOfFile",
  1614. "address": "0x41b2f0"
  1615. },
  1616. {
  1617. "name": "SetEnvironmentVariableA",
  1618. "address": "0x41b2f4"
  1619. },
  1620. {
  1621. "name": "SetFileAttributesA",
  1622. "address": "0x41b2f8"
  1623. },
  1624. {
  1625. "name": "SetFileAttributesW",
  1626. "address": "0x41b2fc"
  1627. },
  1628. {
  1629. "name": "SetFilePointer",
  1630. "address": "0x41b300"
  1631. },
  1632. {
  1633. "name": "SetFileTime",
  1634. "address": "0x41b304"
  1635. },
  1636. {
  1637. "name": "SetLastError",
  1638. "address": "0x41b308"
  1639. },
  1640. {
  1641. "name": "Sleep",
  1642. "address": "0x41b30c"
  1643. },
  1644. {
  1645. "name": "SystemTimeToFileTime",
  1646. "address": "0x41b310"
  1647. },
  1648. {
  1649. "name": "WaitForSingleObject",
  1650. "address": "0x41b314"
  1651. },
  1652. {
  1653. "name": "WideCharToMultiByte",
  1654. "address": "0x41b318"
  1655. },
  1656. {
  1657. "name": "WriteFile",
  1658. "address": "0x41b31c"
  1659. },
  1660. {
  1661. "name": "lstrcmpiA",
  1662. "address": "0x41b320"
  1663. },
  1664. {
  1665. "name": "lstrlenA",
  1666. "address": "0x41b324"
  1667. }
  1668. ],
  1669. "dll": "KERNEL32.DLL"
  1670. },
  1671. {
  1672. "imports": [
  1673. {
  1674. "name": null,
  1675. "address": "0x41b334"
  1676. }
  1677. ],
  1678. "dll": "COMCTL32.DLL"
  1679. },
  1680. {
  1681. "imports": [
  1682. {
  1683. "name": "CommDlgExtendedError",
  1684. "address": "0x41b348"
  1685. },
  1686. {
  1687. "name": "GetOpenFileNameA",
  1688. "address": "0x41b34c"
  1689. }
  1690. ],
  1691. "dll": "COMDLG32.DLL"
  1692. },
  1693. {
  1694. "imports": [
  1695. {
  1696. "name": "DeleteObject",
  1697. "address": "0x41b35c"
  1698. }
  1699. ],
  1700. "dll": "GDI32.DLL"
  1701. },
  1702. {
  1703. "imports": [
  1704. {
  1705. "name": "SHBrowseForFolderA",
  1706. "address": "0x41b388"
  1707. },
  1708. {
  1709. "name": "SHChangeNotify",
  1710. "address": "0x41b38c"
  1711. },
  1712. {
  1713. "name": "SHFileOperationA",
  1714. "address": "0x41b390"
  1715. },
  1716. {
  1717. "name": "SHGetFileInfoA",
  1718. "address": "0x41b394"
  1719. },
  1720. {
  1721. "name": "SHGetMalloc",
  1722. "address": "0x41b398"
  1723. },
  1724. {
  1725. "name": "SHGetSpecialFolderLocation",
  1726. "address": "0x41b39c"
  1727. },
  1728. {
  1729. "name": "ShellExecuteExA",
  1730. "address": "0x41b3a0"
  1731. },
  1732. {
  1733. "name": "SHGetPathFromIDListA",
  1734. "address": "0x41b3a4"
  1735. }
  1736. ],
  1737. "dll": "SHELL32.DLL"
  1738. },
  1739. {
  1740. "imports": [
  1741. {
  1742. "name": "CharToOemA",
  1743. "address": "0x41b480"
  1744. },
  1745. {
  1746. "name": "CharToOemBuffA",
  1747. "address": "0x41b484"
  1748. },
  1749. {
  1750. "name": "CharUpperA",
  1751. "address": "0x41b488"
  1752. },
  1753. {
  1754. "name": "CopyRect",
  1755. "address": "0x41b48c"
  1756. },
  1757. {
  1758. "name": "CreateWindowExA",
  1759. "address": "0x41b490"
  1760. },
  1761. {
  1762. "name": "DefWindowProcA",
  1763. "address": "0x41b494"
  1764. },
  1765. {
  1766. "name": "DestroyIcon",
  1767. "address": "0x41b498"
  1768. },
  1769. {
  1770. "name": "DestroyWindow",
  1771. "address": "0x41b49c"
  1772. },
  1773. {
  1774. "name": "DialogBoxParamA",
  1775. "address": "0x41b4a0"
  1776. },
  1777. {
  1778. "name": "DispatchMessageA",
  1779. "address": "0x41b4a4"
  1780. },
  1781. {
  1782. "name": "EnableWindow",
  1783. "address": "0x41b4a8"
  1784. },
  1785. {
  1786. "name": "EndDialog",
  1787. "address": "0x41b4ac"
  1788. },
  1789. {
  1790. "name": "FindWindowExA",
  1791. "address": "0x41b4b0"
  1792. },
  1793. {
  1794. "name": "GetClassNameA",
  1795. "address": "0x41b4b4"
  1796. },
  1797. {
  1798. "name": "GetClientRect",
  1799. "address": "0x41b4b8"
  1800. },
  1801. {
  1802. "name": "GetDlgItem",
  1803. "address": "0x41b4bc"
  1804. },
  1805. {
  1806. "name": "GetDlgItemTextA",
  1807. "address": "0x41b4c0"
  1808. },
  1809. {
  1810. "name": "GetMessageA",
  1811. "address": "0x41b4c4"
  1812. },
  1813. {
  1814. "name": "GetParent",
  1815. "address": "0x41b4c8"
  1816. },
  1817. {
  1818. "name": "GetSysColor",
  1819. "address": "0x41b4cc"
  1820. },
  1821. {
  1822. "name": "GetSystemMetrics",
  1823. "address": "0x41b4d0"
  1824. },
  1825. {
  1826. "name": "GetWindow",
  1827. "address": "0x41b4d4"
  1828. },
  1829. {
  1830. "name": "GetWindowLongA",
  1831. "address": "0x41b4d8"
  1832. },
  1833. {
  1834. "name": "GetWindowRect",
  1835. "address": "0x41b4dc"
  1836. },
  1837. {
  1838. "name": "GetWindowTextA",
  1839. "address": "0x41b4e0"
  1840. },
  1841. {
  1842. "name": "IsWindow",
  1843. "address": "0x41b4e4"
  1844. },
  1845. {
  1846. "name": "IsWindowVisible",
  1847. "address": "0x41b4e8"
  1848. },
  1849. {
  1850. "name": "LoadBitmapA",
  1851. "address": "0x41b4ec"
  1852. },
  1853. {
  1854. "name": "LoadCursorA",
  1855. "address": "0x41b4f0"
  1856. },
  1857. {
  1858. "name": "LoadIconA",
  1859. "address": "0x41b4f4"
  1860. },
  1861. {
  1862. "name": "LoadStringA",
  1863. "address": "0x41b4f8"
  1864. },
  1865. {
  1866. "name": "MapWindowPoints",
  1867. "address": "0x41b4fc"
  1868. },
  1869. {
  1870. "name": "MessageBoxA",
  1871. "address": "0x41b500"
  1872. },
  1873. {
  1874. "name": "OemToCharA",
  1875. "address": "0x41b504"
  1876. },
  1877. {
  1878. "name": "OemToCharBuffA",
  1879. "address": "0x41b508"
  1880. },
  1881. {
  1882. "name": "PeekMessageA",
  1883. "address": "0x41b50c"
  1884. },
  1885. {
  1886. "name": "PostMessageA",
  1887. "address": "0x41b510"
  1888. },
  1889. {
  1890. "name": "RegisterClassExA",
  1891. "address": "0x41b514"
  1892. },
  1893. {
  1894. "name": "SendDlgItemMessageA",
  1895. "address": "0x41b518"
  1896. },
  1897. {
  1898. "name": "SendMessageA",
  1899. "address": "0x41b51c"
  1900. },
  1901. {
  1902. "name": "SetDlgItemTextA",
  1903. "address": "0x41b520"
  1904. },
  1905. {
  1906. "name": "SetFocus",
  1907. "address": "0x41b524"
  1908. },
  1909. {
  1910. "name": "SetMenu",
  1911. "address": "0x41b528"
  1912. },
  1913. {
  1914. "name": "SetWindowLongA",
  1915. "address": "0x41b52c"
  1916. },
  1917. {
  1918. "name": "SetWindowPos",
  1919. "address": "0x41b530"
  1920. },
  1921. {
  1922. "name": "SetWindowTextA",
  1923. "address": "0x41b534"
  1924. },
  1925. {
  1926. "name": "ShowWindow",
  1927. "address": "0x41b538"
  1928. },
  1929. {
  1930. "name": "TranslateMessage",
  1931. "address": "0x41b53c"
  1932. },
  1933. {
  1934. "name": "UpdateWindow",
  1935. "address": "0x41b540"
  1936. },
  1937. {
  1938. "name": "WaitForInputIdle",
  1939. "address": "0x41b544"
  1940. },
  1941. {
  1942. "name": "wsprintfA",
  1943. "address": "0x41b548"
  1944. },
  1945. {
  1946. "name": "wvsprintfA",
  1947. "address": "0x41b54c"
  1948. }
  1949. ],
  1950. "dll": "USER32.DLL"
  1951. },
  1952. {
  1953. "imports": [
  1954. {
  1955. "name": "CLSIDFromString",
  1956. "address": "0x41b56c"
  1957. },
  1958. {
  1959. "name": "CoCreateInstance",
  1960. "address": "0x41b570"
  1961. },
  1962. {
  1963. "name": "CreateStreamOnHGlobal",
  1964. "address": "0x41b574"
  1965. },
  1966. {
  1967. "name": "OleInitialize",
  1968. "address": "0x41b578"
  1969. },
  1970. {
  1971. "name": "OleUninitialize",
  1972. "address": "0x41b57c"
  1973. }
  1974. ],
  1975. "dll": "OLE32.DLL"
  1976. }
  1977. ],
  1978. "digital_signers": null,
  1979. "exported_dll_name": null,
  1980. "actual_checksum": "0x00051b6d",
  1981. "overlay": {
  1982. "size": "0x0002fa89",
  1983. "offset": "0x00018000"
  1984. },
  1985. "imagebase": "0x00400000",
  1986. "reported_checksum": "0x00000000",
  1987. "icon_hash": null,
  1988. "entrypoint": "0x00401000",
  1989. "timestamp": "2006-12-03 09:53:00",
  1990. "osversion": "4.0",
  1991. "sections": [
  1992. {
  1993. "name": ".text",
  1994. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1995. "virtual_address": "0x00001000",
  1996. "size_of_data": "0x00012e00",
  1997. "entropy": "6.46",
  1998. "raw_address": "0x00000600",
  1999. "virtual_size": "0x00013000",
  2000. "characteristics_raw": "0x60000020"
  2001. },
  2002. {
  2003. "name": ".data",
  2004. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2005. "virtual_address": "0x00014000",
  2006. "size_of_data": "0x00000a00",
  2007. "entropy": "4.76",
  2008. "raw_address": "0x00013400",
  2009. "virtual_size": "0x00007000",
  2010. "characteristics_raw": "0xc0000040"
  2011. },
  2012. {
  2013. "name": ".idata",
  2014. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2015. "virtual_address": "0x0001b000",
  2016. "size_of_data": "0x00001000",
  2017. "entropy": "5.11",
  2018. "raw_address": "0x00013e00",
  2019. "virtual_size": "0x00001000",
  2020. "characteristics_raw": "0x40000040"
  2021. },
  2022. {
  2023. "name": ".rsrc",
  2024. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2025. "virtual_address": "0x0001c000",
  2026. "size_of_data": "0x00003200",
  2027. "entropy": "5.15",
  2028. "raw_address": "0x00014e00",
  2029. "virtual_size": "0x000031e4",
  2030. "characteristics_raw": "0x40000040"
  2031. }
  2032. ],
  2033. "resources": [],
  2034. "dirents": [
  2035. {
  2036. "virtual_address": "0x00000000",
  2037. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2038. "size": "0x00000000"
  2039. },
  2040. {
  2041. "virtual_address": "0x0001b000",
  2042. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2043. "size": "0x00000fb5"
  2044. },
  2045. {
  2046. "virtual_address": "0x0001c000",
  2047. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2048. "size": "0x000031e4"
  2049. },
  2050. {
  2051. "virtual_address": "0x00000000",
  2052. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2053. "size": "0x00000000"
  2054. },
  2055. {
  2056. "virtual_address": "0x00000000",
  2057. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2058. "size": "0x00000000"
  2059. },
  2060. {
  2061. "virtual_address": "0x00000000",
  2062. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2063. "size": "0x00000000"
  2064. },
  2065. {
  2066. "virtual_address": "0x00000000",
  2067. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2068. "size": "0x00000000"
  2069. },
  2070. {
  2071. "virtual_address": "0x00000000",
  2072. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2073. "size": "0x00000000"
  2074. },
  2075. {
  2076. "virtual_address": "0x00000000",
  2077. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2078. "size": "0x00000000"
  2079. },
  2080. {
  2081. "virtual_address": "0x00000000",
  2082. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2083. "size": "0x00000000"
  2084. },
  2085. {
  2086. "virtual_address": "0x00000000",
  2087. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2088. "size": "0x00000000"
  2089. },
  2090. {
  2091. "virtual_address": "0x00000000",
  2092. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2093. "size": "0x00000000"
  2094. },
  2095. {
  2096. "virtual_address": "0x00000000",
  2097. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2098. "size": "0x00000000"
  2099. },
  2100. {
  2101. "virtual_address": "0x00000000",
  2102. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2103. "size": "0x00000000"
  2104. },
  2105. {
  2106. "virtual_address": "0x00000000",
  2107. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2108. "size": "0x00000000"
  2109. },
  2110. {
  2111. "virtual_address": "0x00000000",
  2112. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2113. "size": "0x00000000"
  2114. }
  2115. ],
  2116. "exports": [],
  2117. "guest_signers": {},
  2118. "imphash": "87b324a67e18fb2e1d12308b06fa8d4f",
  2119. "icon_fuzzy": null,
  2120. "icon": null,
  2121. "pdbpath": null,
  2122. "imported_dll_count": 8,
  2123. "versioninfo": []
  2124. }
  2125. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!