API tools faq
paste
paladin316

Exes_a7a9bb1aedc2742cee2b49fecd0e9d1d_exe_2019-06-24_13_30.json

paladin316
Jun 24th, 2019
2,295
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 35.09 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_a7a9bb1aedc2742cee2b49fecd0e9d1d.exe"
  7. [*] File Size: 400896
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "68eb74661680b54ae6b3c341be060b10bcebd5477faf4f339aafcfe588de4a84"
  10. [*] MD5: "a7a9bb1aedc2742cee2b49fecd0e9d1d"
  11. [*] SHA1: "816637b3945c2b666b7c9b8a82a0bb737f2427fe"
  12. [*] SHA512: "7bde5821a874e43e64aaaa2f9f4dca4845d6a213f037474d95d4ffa5022b1a14c2f97de5708d261db9e204958788c9c728fe89c1beac36559563a6bb95df110d"
  13. [*] CRC32: "79C648E5"
  14. [*] SSDEEP: "12288:uAEDl012fHdcmDCj5w4OF+Y6TU2i7WGZsJqwnySmL/+UmjYp:uAEDr3d6glwnySKmUmjY"
  15.  
  16. [*] Process Execution: [
  17. "Exes_a7a9bb1aedc2742cee2b49fecd0e9d1d.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: .text, entropy: 7.73, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00061400, virtual_size: 0x000612a4"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "File has been identified by 23 Antiviruses on VirusTotal as malicious",
  31. "Details": [
  32. {
  33. "FireEye": "Generic.mg.a7a9bb1aedc2742c"
  34. },
  35. {
  36. "McAfee": "Packed-FTF!A7A9BB1AEDC2"
  37. },
  38. {
  39. "Malwarebytes": "Trojan.PCrypt.MSIL.Generic"
  40. },
  41. {
  42. "Alibaba": "Trojan:Win32/Malmail.ali1000112"
  43. },
  44. {
  45. "F-Prot": "W32/Trojan.SW.gen!Eldorado"
  46. },
  47. {
  48. "Symantec": "ML.Attribute.HighConfidence"
  49. },
  50. {
  51. "APEX": "Malicious"
  52. },
  53. {
  54. "Kaspersky": "HEUR:Backdoor.MSIL.Bladabindi.gen"
  55. },
  56. {
  57. "Invincea": "heuristic"
  58. },
  59. {
  60. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  61. },
  62. {
  63. "Trapmine": "malicious.high.ml.score"
  64. },
  65. {
  66. "Ikarus": "Trojan.MSIL.Inject"
  67. },
  68. {
  69. "Cyren": "W32/Trojan.SW.gen!Eldorado"
  70. },
  71. {
  72. "Endgame": "malicious (high confidence)"
  73. },
  74. {
  75. "ZoneAlarm": "HEUR:Backdoor.MSIL.Bladabindi.gen"
  76. },
  77. {
  78. "Acronis": "suspicious"
  79. },
  80. {
  81. "Cylance": "Unsafe"
  82. },
  83. {
  84. "ESET-NOD32": "a variant of MSIL/Kryptik.RZC"
  85. },
  86. {
  87. "SentinelOne": "DFI - Suspicious PE"
  88. },
  89. {
  90. "Fortinet": "MSIL/Kryptik.RZC!tr"
  91. },
  92. {
  93. "Cybereason": "malicious.3945c2"
  94. },
  95. {
  96. "CrowdStrike": "win/malicious_confidence_90% (W)"
  97. },
  98. {
  99. "Qihoo-360": "Win32/Backdoor.633"
  100. }
  101. ]
  102. },
  103. {
  104. "Description": "Anomalous binary characteristics",
  105. "Details": [
  106. {
  107. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  108. }
  109. ]
  110. }
  111. ]
  112.  
  113. [*] Started Service: []
  114.  
  115. [*] Executed Commands: []
  116.  
  117. [*] Mutexes: []
  118.  
  119. [*] Modified Files: []
  120.  
  121. [*] Deleted Files: []
  122.  
  123. [*] Modified Registry Keys: []
  124.  
  125. [*] Deleted Registry Keys: []
  126.  
  127. [*] DNS Communications: []
  128.  
  129. [*] Domains: []
  130.  
  131. [*] Network Communication - ICMP: []
  132.  
  133. [*] Network Communication - HTTP: []
  134.  
  135. [*] Network Communication - SMTP: []
  136.  
  137. [*] Network Communication - Hosts: []
  138.  
  139. [*] Network Communication - IRC: []
  140.  
  141. [*] Static Analysis: {
  142. "dotnet": {
  143. "customattrs": [
  144. {
  145. "type": "Assembly",
  146. "name": "[mscorlib]System.Reflection.AssemblyProductAttribute",
  147. "value": "ucupuciy"
  148. },
  149. {
  150. "type": "Assembly",
  151. "name": "[mscorlib]System.Reflection.AssemblyTitleAttribute",
  152. "value": "ucupuciy"
  153. },
  154. {
  155. "type": "Assembly",
  156. "name": "[mscorlib]System.Reflection.AssemblyDescriptionAttribute",
  157. "value": "awebomog"
  158. },
  159. {
  160. "type": "Assembly",
  161. "name": "[mscorlib]System.Runtime.InteropServices.GuidAttribute",
  162. "value": "090a7a12-a7c3-4c44-9032-953e8b79d0"
  163. },
  164. {
  165. "type": "Assembly",
  166. "name": "[mscorlib]System.Reflection.AssemblyFileVersionAttribute",
  167. "value": "4.6.8."
  168. }
  169. ],
  170. "assemblyinfo": {
  171. "version": "1.0.0.0",
  172. "name": "Pi9baJMHRinqzCV/DkuPgG5q"
  173. },
  174. "assemblyrefs": [
  175. {
  176. "version": "4.0.0.0",
  177. "name": "mscorlib"
  178. },
  179. {
  180. "version": "4.0.0.0",
  181. "name": "System"
  182. },
  183. {
  184. "version": "1.0.0.1",
  185. "name": "gdi32"
  186. }
  187. ],
  188. "typerefs": [
  189. {
  190. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  191. "assembly": "System"
  192. },
  193. {
  194. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  195. "assembly": "System"
  196. },
  197. {
  198. "typename": "System.ComponentModel.EditorBrowsableState",
  199. "assembly": "System"
  200. },
  201. {
  202. "typename": "System.Configuration.ApplicationSettingsBase",
  203. "assembly": "System"
  204. },
  205. {
  206. "typename": "System.Configuration.SettingsBase",
  207. "assembly": "System"
  208. },
  209. {
  210. "typename": "System.Diagnostics.Stopwatch",
  211. "assembly": "System"
  212. },
  213. {
  214. "typename": "gdi32.Program",
  215. "assembly": "gdi32"
  216. },
  217. {
  218. "typename": "System.AppDomain",
  219. "assembly": "mscorlib"
  220. },
  221. {
  222. "typename": "System.Array",
  223. "assembly": "mscorlib"
  224. },
  225. {
  226. "typename": "System.Boolean",
  227. "assembly": "mscorlib"
  228. },
  229. {
  230. "typename": "System.Buffer",
  231. "assembly": "mscorlib"
  232. },
  233. {
  234. "typename": "System.Byte",
  235. "assembly": "mscorlib"
  236. },
  237. {
  238. "typename": "System.Char",
  239. "assembly": "mscorlib"
  240. },
  241. {
  242. "typename": "System.Console",
  243. "assembly": "mscorlib"
  244. },
  245. {
  246. "typename": "System.DBNull",
  247. "assembly": "mscorlib"
  248. },
  249. {
  250. "typename": "System.DateTime",
  251. "assembly": "mscorlib"
  252. },
  253. {
  254. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  255. "assembly": "mscorlib"
  256. },
  257. {
  258. "typename": "System.Enum",
  259. "assembly": "mscorlib"
  260. },
  261. {
  262. "typename": "System.Exception",
  263. "assembly": "mscorlib"
  264. },
  265. {
  266. "typename": "System.Globalization.CultureInfo",
  267. "assembly": "mscorlib"
  268. },
  269. {
  270. "typename": "System.Globalization.NumberStyles",
  271. "assembly": "mscorlib"
  272. },
  273. {
  274. "typename": "System.IComparable",
  275. "assembly": "mscorlib"
  276. },
  277. {
  278. "typename": "System.IComparable`1",
  279. "assembly": "mscorlib"
  280. },
  281. {
  282. "typename": "System.IEquatable`1",
  283. "assembly": "mscorlib"
  284. },
  285. {
  286. "typename": "System.IFormatProvider",
  287. "assembly": "mscorlib"
  288. },
  289. {
  290. "typename": "System.Int16",
  291. "assembly": "mscorlib"
  292. },
  293. {
  294. "typename": "System.Int32",
  295. "assembly": "mscorlib"
  296. },
  297. {
  298. "typename": "System.Int64",
  299. "assembly": "mscorlib"
  300. },
  301. {
  302. "typename": "System.NotSupportedException",
  303. "assembly": "mscorlib"
  304. },
  305. {
  306. "typename": "System.Object",
  307. "assembly": "mscorlib"
  308. },
  309. {
  310. "typename": "System.Reflection.Assembly",
  311. "assembly": "mscorlib"
  312. },
  313. {
  314. "typename": "System.Reflection.AssemblyCompanyAttribute",
  315. "assembly": "mscorlib"
  316. },
  317. {
  318. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  319. "assembly": "mscorlib"
  320. },
  321. {
  322. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  323. "assembly": "mscorlib"
  324. },
  325. {
  326. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  327. "assembly": "mscorlib"
  328. },
  329. {
  330. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  331. "assembly": "mscorlib"
  332. },
  333. {
  334. "typename": "System.Reflection.AssemblyProductAttribute",
  335. "assembly": "mscorlib"
  336. },
  337. {
  338. "typename": "System.Reflection.AssemblyTitleAttribute",
  339. "assembly": "mscorlib"
  340. },
  341. {
  342. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  343. "assembly": "mscorlib"
  344. },
  345. {
  346. "typename": "System.Reflection.BindingFlags",
  347. "assembly": "mscorlib"
  348. },
  349. {
  350. "typename": "System.Reflection.CallingConventions",
  351. "assembly": "mscorlib"
  352. },
  353. {
  354. "typename": "System.Reflection.IReflect",
  355. "assembly": "mscorlib"
  356. },
  357. {
  358. "typename": "System.Reflection.MemberInfo",
  359. "assembly": "mscorlib"
  360. },
  361. {
  362. "typename": "System.Reflection.MethodBase",
  363. "assembly": "mscorlib"
  364. },
  365. {
  366. "typename": "System.Reflection.ParameterInfo",
  367. "assembly": "mscorlib"
  368. },
  369. {
  370. "typename": "System.Reflection.ParameterModifier",
  371. "assembly": "mscorlib"
  372. },
  373. {
  374. "typename": "System.Reflection.PropertyInfo",
  375. "assembly": "mscorlib"
  376. },
  377. {
  378. "typename": "System.ResolveEventArgs",
  379. "assembly": "mscorlib"
  380. },
  381. {
  382. "typename": "System.ResolveEventHandler",
  383. "assembly": "mscorlib"
  384. },
  385. {
  386. "typename": "System.Resources.ResourceManager",
  387. "assembly": "mscorlib"
  388. },
  389. {
  390. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  391. "assembly": "mscorlib"
  392. },
  393. {
  394. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  395. "assembly": "mscorlib"
  396. },
  397. {
  398. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  399. "assembly": "mscorlib"
  400. },
  401. {
  402. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  403. "assembly": "mscorlib"
  404. },
  405. {
  406. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  407. "assembly": "mscorlib"
  408. },
  409. {
  410. "typename": "System.Runtime.InteropServices.GuidAttribute",
  411. "assembly": "mscorlib"
  412. },
  413. {
  414. "typename": "System.Runtime.InteropServices._Type",
  415. "assembly": "mscorlib"
  416. },
  417. {
  418. "typename": "System.Runtime.Remoting.ObjectHandle",
  419. "assembly": "mscorlib"
  420. },
  421. {
  422. "typename": "System.Runtime.Versioning.TargetFrameworkAttribute",
  423. "assembly": "mscorlib"
  424. },
  425. {
  426. "typename": "System.RuntimeFieldHandle",
  427. "assembly": "mscorlib"
  428. },
  429. {
  430. "typename": "System.RuntimeTypeHandle",
  431. "assembly": "mscorlib"
  432. },
  433. {
  434. "typename": "System.SByte",
  435. "assembly": "mscorlib"
  436. },
  437. {
  438. "typename": "System.STAThreadAttribute",
  439. "assembly": "mscorlib"
  440. },
  441. {
  442. "typename": "System.String",
  443. "assembly": "mscorlib"
  444. },
  445. {
  446. "typename": "System.Text.StringBuilder",
  447. "assembly": "mscorlib"
  448. },
  449. {
  450. "typename": "System.TimeSpan",
  451. "assembly": "mscorlib"
  452. },
  453. {
  454. "typename": "System.Type",
  455. "assembly": "mscorlib"
  456. },
  457. {
  458. "typename": "System.TypeCode",
  459. "assembly": "mscorlib"
  460. },
  461. {
  462. "typename": "System.UInt16",
  463. "assembly": "mscorlib"
  464. },
  465. {
  466. "typename": "System.UInt32",
  467. "assembly": "mscorlib"
  468. },
  469. {
  470. "typename": "System.UInt64",
  471. "assembly": "mscorlib"
  472. },
  473. {
  474. "typename": "System.ValueType",
  475. "assembly": "mscorlib"
  476. },
  477. {
  478. "typename": "System.Void",
  479. "assembly": "mscorlib"
  480. }
  481. ]
  482. },
  483. "pe": {
  484. "peid_signatures": null,
  485. "imports": [
  486. {
  487. "imports": [
  488. {
  489. "name": "_CorExeMain",
  490. "address": "0x402000"
  491. }
  492. ],
  493. "dll": "mscoree.dll"
  494. }
  495. ],
  496. "digital_signers": null,
  497. "exported_dll_name": null,
  498. "actual_checksum": "0x0006a2c5",
  499. "overlay": null,
  500. "imagebase": "0x00400000",
  501. "reported_checksum": "0x00000000",
  502. "icon_hash": null,
  503. "entrypoint": "0x0046329e",
  504. "timestamp": "1993-01-12 03:15:01",
  505. "osversion": "4.0",
  506. "sections": [
  507. {
  508. "name": ".text",
  509. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  510. "virtual_address": "0x00002000",
  511. "size_of_data": "0x00061400",
  512. "entropy": "7.73",
  513. "raw_address": "0x00000200",
  514. "virtual_size": "0x000612a4",
  515. "characteristics_raw": "0x60000020"
  516. },
  517. {
  518. "name": ".rsrc",
  519. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  520. "virtual_address": "0x00064000",
  521. "size_of_data": "0x00000600",
  522. "entropy": "4.62",
  523. "raw_address": "0x00061600",
  524. "virtual_size": "0x00000600",
  525. "characteristics_raw": "0x40000040"
  526. },
  527. {
  528. "name": ".reloc",
  529. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  530. "virtual_address": "0x00066000",
  531. "size_of_data": "0x00000200",
  532. "entropy": "0.10",
  533. "raw_address": "0x00061c00",
  534. "virtual_size": "0x0000000c",
  535. "characteristics_raw": "0x42000040"
  536. }
  537. ],
  538. "resources": [],
  539. "dirents": [
  540. {
  541. "virtual_address": "0x00000000",
  542. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  543. "size": "0x00000000"
  544. },
  545. {
  546. "virtual_address": "0x00063244",
  547. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  548. "size": "0x00000057"
  549. },
  550. {
  551. "virtual_address": "0x00064000",
  552. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  553. "size": "0x00000600"
  554. },
  555. {
  556. "virtual_address": "0x00000000",
  557. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  558. "size": "0x00000000"
  559. },
  560. {
  561. "virtual_address": "0x00000000",
  562. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  563. "size": "0x00000000"
  564. },
  565. {
  566. "virtual_address": "0x00066000",
  567. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  568. "size": "0x0000000c"
  569. },
  570. {
  571. "virtual_address": "0x00000000",
  572. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  573. "size": "0x00000000"
  574. },
  575. {
  576. "virtual_address": "0x00000000",
  577. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  578. "size": "0x00000000"
  579. },
  580. {
  581. "virtual_address": "0x00000000",
  582. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  583. "size": "0x00000000"
  584. },
  585. {
  586. "virtual_address": "0x00000000",
  587. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  588. "size": "0x00000000"
  589. },
  590. {
  591. "virtual_address": "0x00000000",
  592. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  593. "size": "0x00000000"
  594. },
  595. {
  596. "virtual_address": "0x00000000",
  597. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  598. "size": "0x00000000"
  599. },
  600. {
  601. "virtual_address": "0x00002000",
  602. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  603. "size": "0x00000008"
  604. },
  605. {
  606. "virtual_address": "0x00000000",
  607. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  608. "size": "0x00000000"
  609. },
  610. {
  611. "virtual_address": "0x00002008",
  612. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  613. "size": "0x00000048"
  614. },
  615. {
  616. "virtual_address": "0x00000000",
  617. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  618. "size": "0x00000000"
  619. }
  620. ],
  621. "exports": [],
  622. "guest_signers": {},
  623. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  624. "icon_fuzzy": null,
  625. "icon": null,
  626. "pdbpath": null,
  627. "imported_dll_count": 1,
  628. "versioninfo": []
  629. }
  630. }
  631.  
  632. [*] Resolved APIs: [
  633. "advapi32.dll.RegOpenKeyExW",
  634. "advapi32.dll.RegQueryInfoKeyW",
  635. "advapi32.dll.RegEnumKeyExW",
  636. "advapi32.dll.RegEnumValueW",
  637. "advapi32.dll.RegCloseKey",
  638. "advapi32.dll.RegQueryValueExW",
  639. "kernel32.dll.QueryActCtxW",
  640. "shlwapi.dll.UrlIsW"
  641. ]
  642.  
  643. [*] Static Analysis: {
  644. "dotnet": {
  645. "customattrs": [
  646. {
  647. "type": "Assembly",
  648. "name": "[mscorlib]System.Reflection.AssemblyProductAttribute",
  649. "value": "ucupuciy"
  650. },
  651. {
  652. "type": "Assembly",
  653. "name": "[mscorlib]System.Reflection.AssemblyTitleAttribute",
  654. "value": "ucupuciy"
  655. },
  656. {
  657. "type": "Assembly",
  658. "name": "[mscorlib]System.Reflection.AssemblyDescriptionAttribute",
  659. "value": "awebomog"
  660. },
  661. {
  662. "type": "Assembly",
  663. "name": "[mscorlib]System.Runtime.InteropServices.GuidAttribute",
  664. "value": "090a7a12-a7c3-4c44-9032-953e8b79d0"
  665. },
  666. {
  667. "type": "Assembly",
  668. "name": "[mscorlib]System.Reflection.AssemblyFileVersionAttribute",
  669. "value": "4.6.8."
  670. }
  671. ],
  672. "assemblyinfo": {
  673. "version": "1.0.0.0",
  674. "name": "Pi9baJMHRinqzCV/DkuPgG5q"
  675. },
  676. "assemblyrefs": [
  677. {
  678. "version": "4.0.0.0",
  679. "name": "mscorlib"
  680. },
  681. {
  682. "version": "4.0.0.0",
  683. "name": "System"
  684. },
  685. {
  686. "version": "1.0.0.1",
  687. "name": "gdi32"
  688. }
  689. ],
  690. "typerefs": [
  691. {
  692. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  693. "assembly": "System"
  694. },
  695. {
  696. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  697. "assembly": "System"
  698. },
  699. {
  700. "typename": "System.ComponentModel.EditorBrowsableState",
  701. "assembly": "System"
  702. },
  703. {
  704. "typename": "System.Configuration.ApplicationSettingsBase",
  705. "assembly": "System"
  706. },
  707. {
  708. "typename": "System.Configuration.SettingsBase",
  709. "assembly": "System"
  710. },
  711. {
  712. "typename": "System.Diagnostics.Stopwatch",
  713. "assembly": "System"
  714. },
  715. {
  716. "typename": "gdi32.Program",
  717. "assembly": "gdi32"
  718. },
  719. {
  720. "typename": "System.AppDomain",
  721. "assembly": "mscorlib"
  722. },
  723. {
  724. "typename": "System.Array",
  725. "assembly": "mscorlib"
  726. },
  727. {
  728. "typename": "System.Boolean",
  729. "assembly": "mscorlib"
  730. },
  731. {
  732. "typename": "System.Buffer",
  733. "assembly": "mscorlib"
  734. },
  735. {
  736. "typename": "System.Byte",
  737. "assembly": "mscorlib"
  738. },
  739. {
  740. "typename": "System.Char",
  741. "assembly": "mscorlib"
  742. },
  743. {
  744. "typename": "System.Console",
  745. "assembly": "mscorlib"
  746. },
  747. {
  748. "typename": "System.DBNull",
  749. "assembly": "mscorlib"
  750. },
  751. {
  752. "typename": "System.DateTime",
  753. "assembly": "mscorlib"
  754. },
  755. {
  756. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  757. "assembly": "mscorlib"
  758. },
  759. {
  760. "typename": "System.Enum",
  761. "assembly": "mscorlib"
  762. },
  763. {
  764. "typename": "System.Exception",
  765. "assembly": "mscorlib"
  766. },
  767. {
  768. "typename": "System.Globalization.CultureInfo",
  769. "assembly": "mscorlib"
  770. },
  771. {
  772. "typename": "System.Globalization.NumberStyles",
  773. "assembly": "mscorlib"
  774. },
  775. {
  776. "typename": "System.IComparable",
  777. "assembly": "mscorlib"
  778. },
  779. {
  780. "typename": "System.IComparable`1",
  781. "assembly": "mscorlib"
  782. },
  783. {
  784. "typename": "System.IEquatable`1",
  785. "assembly": "mscorlib"
  786. },
  787. {
  788. "typename": "System.IFormatProvider",
  789. "assembly": "mscorlib"
  790. },
  791. {
  792. "typename": "System.Int16",
  793. "assembly": "mscorlib"
  794. },
  795. {
  796. "typename": "System.Int32",
  797. "assembly": "mscorlib"
  798. },
  799. {
  800. "typename": "System.Int64",
  801. "assembly": "mscorlib"
  802. },
  803. {
  804. "typename": "System.NotSupportedException",
  805. "assembly": "mscorlib"
  806. },
  807. {
  808. "typename": "System.Object",
  809. "assembly": "mscorlib"
  810. },
  811. {
  812. "typename": "System.Reflection.Assembly",
  813. "assembly": "mscorlib"
  814. },
  815. {
  816. "typename": "System.Reflection.AssemblyCompanyAttribute",
  817. "assembly": "mscorlib"
  818. },
  819. {
  820. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  821. "assembly": "mscorlib"
  822. },
  823. {
  824. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  825. "assembly": "mscorlib"
  826. },
  827. {
  828. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  829. "assembly": "mscorlib"
  830. },
  831. {
  832. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  833. "assembly": "mscorlib"
  834. },
  835. {
  836. "typename": "System.Reflection.AssemblyProductAttribute",
  837. "assembly": "mscorlib"
  838. },
  839. {
  840. "typename": "System.Reflection.AssemblyTitleAttribute",
  841. "assembly": "mscorlib"
  842. },
  843. {
  844. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  845. "assembly": "mscorlib"
  846. },
  847. {
  848. "typename": "System.Reflection.BindingFlags",
  849. "assembly": "mscorlib"
  850. },
  851. {
  852. "typename": "System.Reflection.CallingConventions",
  853. "assembly": "mscorlib"
  854. },
  855. {
  856. "typename": "System.Reflection.IReflect",
  857. "assembly": "mscorlib"
  858. },
  859. {
  860. "typename": "System.Reflection.MemberInfo",
  861. "assembly": "mscorlib"
  862. },
  863. {
  864. "typename": "System.Reflection.MethodBase",
  865. "assembly": "mscorlib"
  866. },
  867. {
  868. "typename": "System.Reflection.ParameterInfo",
  869. "assembly": "mscorlib"
  870. },
  871. {
  872. "typename": "System.Reflection.ParameterModifier",
  873. "assembly": "mscorlib"
  874. },
  875. {
  876. "typename": "System.Reflection.PropertyInfo",
  877. "assembly": "mscorlib"
  878. },
  879. {
  880. "typename": "System.ResolveEventArgs",
  881. "assembly": "mscorlib"
  882. },
  883. {
  884. "typename": "System.ResolveEventHandler",
  885. "assembly": "mscorlib"
  886. },
  887. {
  888. "typename": "System.Resources.ResourceManager",
  889. "assembly": "mscorlib"
  890. },
  891. {
  892. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  893. "assembly": "mscorlib"
  894. },
  895. {
  896. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  897. "assembly": "mscorlib"
  898. },
  899. {
  900. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  901. "assembly": "mscorlib"
  902. },
  903. {
  904. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  905. "assembly": "mscorlib"
  906. },
  907. {
  908. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  909. "assembly": "mscorlib"
  910. },
  911. {
  912. "typename": "System.Runtime.InteropServices.GuidAttribute",
  913. "assembly": "mscorlib"
  914. },
  915. {
  916. "typename": "System.Runtime.InteropServices._Type",
  917. "assembly": "mscorlib"
  918. },
  919. {
  920. "typename": "System.Runtime.Remoting.ObjectHandle",
  921. "assembly": "mscorlib"
  922. },
  923. {
  924. "typename": "System.Runtime.Versioning.TargetFrameworkAttribute",
  925. "assembly": "mscorlib"
  926. },
  927. {
  928. "typename": "System.RuntimeFieldHandle",
  929. "assembly": "mscorlib"
  930. },
  931. {
  932. "typename": "System.RuntimeTypeHandle",
  933. "assembly": "mscorlib"
  934. },
  935. {
  936. "typename": "System.SByte",
  937. "assembly": "mscorlib"
  938. },
  939. {
  940. "typename": "System.STAThreadAttribute",
  941. "assembly": "mscorlib"
  942. },
  943. {
  944. "typename": "System.String",
  945. "assembly": "mscorlib"
  946. },
  947. {
  948. "typename": "System.Text.StringBuilder",
  949. "assembly": "mscorlib"
  950. },
  951. {
  952. "typename": "System.TimeSpan",
  953. "assembly": "mscorlib"
  954. },
  955. {
  956. "typename": "System.Type",
  957. "assembly": "mscorlib"
  958. },
  959. {
  960. "typename": "System.TypeCode",
  961. "assembly": "mscorlib"
  962. },
  963. {
  964. "typename": "System.UInt16",
  965. "assembly": "mscorlib"
  966. },
  967. {
  968. "typename": "System.UInt32",
  969. "assembly": "mscorlib"
  970. },
  971. {
  972. "typename": "System.UInt64",
  973. "assembly": "mscorlib"
  974. },
  975. {
  976. "typename": "System.ValueType",
  977. "assembly": "mscorlib"
  978. },
  979. {
  980. "typename": "System.Void",
  981. "assembly": "mscorlib"
  982. }
  983. ]
  984. },
  985. "pe": {
  986. "peid_signatures": null,
  987. "imports": [
  988. {
  989. "imports": [
  990. {
  991. "name": "_CorExeMain",
  992. "address": "0x402000"
  993. }
  994. ],
  995. "dll": "mscoree.dll"
  996. }
  997. ],
  998. "digital_signers": null,
  999. "exported_dll_name": null,
  1000. "actual_checksum": "0x0006a2c5",
  1001. "overlay": null,
  1002. "imagebase": "0x00400000",
  1003. "reported_checksum": "0x00000000",
  1004. "icon_hash": null,
  1005. "entrypoint": "0x0046329e",
  1006. "timestamp": "1993-01-12 03:15:01",
  1007. "osversion": "4.0",
  1008. "sections": [
  1009. {
  1010. "name": ".text",
  1011. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1012. "virtual_address": "0x00002000",
  1013. "size_of_data": "0x00061400",
  1014. "entropy": "7.73",
  1015. "raw_address": "0x00000200",
  1016. "virtual_size": "0x000612a4",
  1017. "characteristics_raw": "0x60000020"
  1018. },
  1019. {
  1020. "name": ".rsrc",
  1021. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1022. "virtual_address": "0x00064000",
  1023. "size_of_data": "0x00000600",
  1024. "entropy": "4.62",
  1025. "raw_address": "0x00061600",
  1026. "virtual_size": "0x00000600",
  1027. "characteristics_raw": "0x40000040"
  1028. },
  1029. {
  1030. "name": ".reloc",
  1031. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1032. "virtual_address": "0x00066000",
  1033. "size_of_data": "0x00000200",
  1034. "entropy": "0.10",
  1035. "raw_address": "0x00061c00",
  1036. "virtual_size": "0x0000000c",
  1037. "characteristics_raw": "0x42000040"
  1038. }
  1039. ],
  1040. "resources": [],
  1041. "dirents": [
  1042. {
  1043. "virtual_address": "0x00000000",
  1044. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1045. "size": "0x00000000"
  1046. },
  1047. {
  1048. "virtual_address": "0x00063244",
  1049. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1050. "size": "0x00000057"
  1051. },
  1052. {
  1053. "virtual_address": "0x00064000",
  1054. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1055. "size": "0x00000600"
  1056. },
  1057. {
  1058. "virtual_address": "0x00000000",
  1059. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1060. "size": "0x00000000"
  1061. },
  1062. {
  1063. "virtual_address": "0x00000000",
  1064. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1065. "size": "0x00000000"
  1066. },
  1067. {
  1068. "virtual_address": "0x00066000",
  1069. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1070. "size": "0x0000000c"
  1071. },
  1072. {
  1073. "virtual_address": "0x00000000",
  1074. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1075. "size": "0x00000000"
  1076. },
  1077. {
  1078. "virtual_address": "0x00000000",
  1079. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1080. "size": "0x00000000"
  1081. },
  1082. {
  1083. "virtual_address": "0x00000000",
  1084. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1085. "size": "0x00000000"
  1086. },
  1087. {
  1088. "virtual_address": "0x00000000",
  1089. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1090. "size": "0x00000000"
  1091. },
  1092. {
  1093. "virtual_address": "0x00000000",
  1094. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1095. "size": "0x00000000"
  1096. },
  1097. {
  1098. "virtual_address": "0x00000000",
  1099. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1100. "size": "0x00000000"
  1101. },
  1102. {
  1103. "virtual_address": "0x00002000",
  1104. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1105. "size": "0x00000008"
  1106. },
  1107. {
  1108. "virtual_address": "0x00000000",
  1109. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1110. "size": "0x00000000"
  1111. },
  1112. {
  1113. "virtual_address": "0x00002008",
  1114. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1115. "size": "0x00000048"
  1116. },
  1117. {
  1118. "virtual_address": "0x00000000",
  1119. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1120. "size": "0x00000000"
  1121. }
  1122. ],
  1123. "exports": [],
  1124. "guest_signers": {},
  1125. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1126. "icon_fuzzy": null,
  1127. "icon": null,
  1128. "pdbpath": null,
  1129. "imported_dll_count": 1,
  1130. "versioninfo": []
  1131. }
  1132. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!