API tools faq
paste
paladin316

Exes_5b02b9ea8aff89850a13b2515e8d2aad_exe_2019-07-03_19_30.json

paladin316
Jul 3rd, 2019
2,166
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.76 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_5b02b9ea8aff89850a13b2515e8d2aad.exe"
  7. [*] File Size: 25856
  8. [*] File Type: "MS-DOS executable, MZ for MS-DOS"
  9. [*] SHA256: "8d9f6a87317d55eb4d8d6614665f61fcb7626f6e18aa0def80508f45f5357e4d"
  10. [*] MD5: "5b02b9ea8aff89850a13b2515e8d2aad"
  11. [*] SHA1: "c60fac00ba1b23d1b71ef41b6c541d7bd5b3f51d"
  12. [*] SHA512: "fc37d9500b6cbd2af69247cb7ad7652375a3f3b8da8d833525edd4d41020c4a23a9237e0ac491632c6c1b5f5d2a217fc4a5dd23f9d238f3275d2ca6cb020a264"
  13. [*] CRC32: "93602871"
  14. [*] SSDEEP: "384:5vcTzy5HKrrP4imFRR3svyo21NonHET5nYygPkW04mQ7/menR560axflQgfdXshZ:5vkVroh8fqaHfyH4mQjRfotehk8"
  15.  
  16. [*] Process Execution: [
  17. "Exes_5b02b9ea8aff89850a13b2515e8d2aad.exe",
  18. "wininit.exe",
  19. "schtasks.exe",
  20. "svchost.exe"
  21. ]
  22.  
  23. [*] Signatures Detected: [
  24. {
  25. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  26. "Details": [
  27. {
  28. "IP": "109.171.35.217:1605"
  29. }
  30. ]
  31. },
  32. {
  33. "Description": "Creates RWX memory",
  34. "Details": []
  35. },
  36. {
  37. "Description": "Possible date expiration check, exits too soon after checking local time",
  38. "Details": [
  39. {
  40. "process": "schtasks.exe, PID 356"
  41. }
  42. ]
  43. },
  44. {
  45. "Description": "A process attempted to delay the analysis task.",
  46. "Details": [
  47. {
  48. "Process": "wininit.exe tried to sleep 528 seconds, actually delayed analysis time by 0 seconds"
  49. }
  50. ]
  51. },
  52. {
  53. "Description": "Reads data out of its own binary image",
  54. "Details": [
  55. {
  56. "self_read": "process: Exes_5b02b9ea8aff89850a13b2515e8d2aad.exe, pid: 2496, offset: 0x00000000, length: 0x00006500"
  57. },
  58. {
  59. "self_read": "process: Exes_5b02b9ea8aff89850a13b2515e8d2aad.exe, pid: 2496, offset: 0x0000003c, length: 0x00001000"
  60. },
  61. {
  62. "self_read": "process: Exes_5b02b9ea8aff89850a13b2515e8d2aad.exe, pid: 2496, offset: 0x00001610, length: 0x00004ef0"
  63. },
  64. {
  65. "self_read": "process: wininit.exe, pid: 3036, offset: 0x00000000, length: 0x00006500"
  66. },
  67. {
  68. "self_read": "process: wininit.exe, pid: 3036, offset: 0x0000003c, length: 0x00001000"
  69. },
  70. {
  71. "self_read": "process: wininit.exe, pid: 3036, offset: 0x00001610, length: 0x00004ef0"
  72. }
  73. ]
  74. },
  75. {
  76. "Description": "Drops a binary and executes it",
  77. "Details": [
  78. {
  79. "binary": "C:\\Users\\user\\AppData\\Roaming\\wininit.exe"
  80. }
  81. ]
  82. },
  83. {
  84. "Description": "Sniffs keystrokes",
  85. "Details": [
  86. {
  87. "GetAsyncKeyState": "Process: Exes_5b02b9ea8aff89850a13b2515e8d2aad.exe(2496)"
  88. }
  89. ]
  90. },
  91. {
  92. "Description": "A process was set to shut the system down when terminated",
  93. "Details": [
  94. {
  95. "process": "wininit.exe:3036"
  96. }
  97. ]
  98. },
  99. {
  100. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  101. "Details": [
  102. {
  103. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  104. }
  105. ]
  106. },
  107. {
  108. "Description": "Installs itself for autorun at Windows startup",
  109. "Details": [
  110. {
  111. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DriverStartup"
  112. },
  113. {
  114. "data": "\"C:\\Users\\user\\AppData\\Roaming\\wininit.exe\" .."
  115. },
  116. {
  117. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\DriverStartup"
  118. },
  119. {
  120. "data": "\"C:\\Users\\user\\AppData\\Roaming\\wininit.exe\" .."
  121. },
  122. {
  123. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ChromeUpdate.exe"
  124. },
  125. {
  126. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ChromeUpdate.exe"
  127. },
  128. {
  129. "task": "schtasks /create /sc minute /mo 1 /tn Server /tr C:\\Users\\user\\AppData\\Local\\Temp/Server.exe"
  130. }
  131. ]
  132. },
  133. {
  134. "Description": "Creates a hidden or system file",
  135. "Details": [
  136. {
  137. "file": "C:\\Users\\user\\AppData\\Roaming\\wininit.exe"
  138. }
  139. ]
  140. },
  141. {
  142. "Description": "File has been identified by 39 Antiviruses on VirusTotal as malicious",
  143. "Details": [
  144. {
  145. "Bkav": "W32.HusmotarLTV.Trojan"
  146. },
  147. {
  148. "MicroWorld-eScan": "Generic.Malware.SL!bg.34AB5AFB"
  149. },
  150. {
  151. "Cylance": "Unsafe"
  152. },
  153. {
  154. "SUPERAntiSpyware": "Trojan.Agent/Gen-Dropper"
  155. },
  156. {
  157. "Arcabit": "Generic.Malware.SL!bg.34AB5AFB"
  158. },
  159. {
  160. "F-Prot": "W32/MSIL_Bladabindi.BO.gen!Eldorado"
  161. },
  162. {
  163. "Symantec": "ML.Attribute.HighConfidence"
  164. },
  165. {
  166. "APEX": "Malicious"
  167. },
  168. {
  169. "Avast": "Win32:Evo-gen [Susp]"
  170. },
  171. {
  172. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  173. },
  174. {
  175. "BitDefender": "Generic.Malware.SL!bg.34AB5AFB"
  176. },
  177. {
  178. "Endgame": "malicious (high confidence)"
  179. },
  180. {
  181. "Emsisoft": "Generic.Malware.SL!bg.34AB5AFB (B)"
  182. },
  183. {
  184. "F-Secure": "Trojan.TR/Dropper.Gen"
  185. },
  186. {
  187. "Invincea": "heuristic"
  188. },
  189. {
  190. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.mc"
  191. },
  192. {
  193. "Trapmine": "malicious.high.ml.score"
  194. },
  195. {
  196. "FireEye": "Generic.mg.5b02b9ea8aff8985"
  197. },
  198. {
  199. "Ikarus": "Trojan.Win32.Agent"
  200. },
  201. {
  202. "Cyren": "W32/MSIL_Bladabindi.BO.gen!Eldorado"
  203. },
  204. {
  205. "Avira": "TR/Dropper.Gen"
  206. },
  207. {
  208. "MAX": "malware (ai score=83)"
  209. },
  210. {
  211. "Antiy-AVL": "Trojan/Win32.AGeneric"
  212. },
  213. {
  214. "Microsoft": "Backdoor:MSIL/Bladabindi.BT!bit"
  215. },
  216. {
  217. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  218. },
  219. {
  220. "GData": "Generic.Malware.SL!bg.34AB5AFB"
  221. },
  222. {
  223. "AhnLab-V3": "Trojan/Win32.Agent.C195594"
  224. },
  225. {
  226. "Acronis": "suspicious"
  227. },
  228. {
  229. "VBA32": "Trojan.MSIL.DOTHETUK"
  230. },
  231. {
  232. "ALYac": "Generic.Malware.SL!bg.34AB5AFB"
  233. },
  234. {
  235. "Ad-Aware": "Generic.Malware.SL!bg.34AB5AFB"
  236. },
  237. {
  238. "Malwarebytes": "Backdoor.Bladabindi"
  239. },
  240. {
  241. "ESET-NOD32": "a variant of MSIL/Bladabindi.BB"
  242. },
  243. {
  244. "SentinelOne": "DFI - Malicious PE"
  245. },
  246. {
  247. "Fortinet": "MSIL/Bladabindi.BO!tr"
  248. },
  249. {
  250. "AVG": "Win32:Evo-gen [Susp]"
  251. },
  252. {
  253. "Cybereason": "malicious.a8aff8"
  254. },
  255. {
  256. "CrowdStrike": "win/malicious_confidence_100% (D)"
  257. },
  258. {
  259. "Qihoo-360": "HEUR/QVM03.0.FC1D.Malware.Gen"
  260. }
  261. ]
  262. },
  263. {
  264. "Description": "Creates a copy of itself",
  265. "Details": [
  266. {
  267. "copy": "C:\\Users\\user\\AppData\\Roaming\\wininit.exe"
  268. },
  269. {
  270. "copy": "C:\\Users\\user\\AppData\\Local\\Temp\\Server.exe"
  271. },
  272. {
  273. "copy": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ChromeUpdate.exe"
  274. }
  275. ]
  276. }
  277. ]
  278.  
  279. [*] Started Service: []
  280.  
  281. [*] Executed Commands: [
  282. "C:\\Users\\user\\AppData\\Roaming\\wininit.exe ",
  283. "Hassan firewall add allowedprogram \"C:\\Users\\user\\AppData\\Roaming\\wininit.exe\" \"wininit.exe\" ENABLE",
  284. "schtasks /create /sc minute /mo 1 /tn Server /tr C:\\Users\\user\\AppData\\Local\\Temp/Server.exe"
  285. ]
  286.  
  287. [*] Mutexes: [
  288. "Global\\CLR_CASOFF_MUTEX",
  289. "DriverStartup",
  290. "Global\\.net clr networking"
  291. ]
  292.  
  293. [*] Modified Files: [
  294. "C:\\Users\\user\\AppData\\Roaming\\wininit.exe",
  295. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ChromeUpdate.exe",
  296. "C:\\Users\\user\\AppData\\Local\\Temp\\Server.exe",
  297. "C:\\Windows\\sysnative\\Tasks\\Server",
  298. "\\Device\\LanmanDatagramReceiver",
  299. "\\??\\PIPE\\srvsvc"
  300. ]
  301.  
  302. [*] Deleted Files: [
  303. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2496.28663000",
  304. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2496.28663000",
  305. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2496.28663015",
  306. "C:\\Windows\\Tasks\\Server.job"
  307. ]
  308.  
  309. [*] Modified Registry Keys: [
  310. "HKEY_CURRENT_USER\\di",
  311. "HKEY_CURRENT_USER\\Environment\\SEE_MASK_NOZONECHECKS",
  312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DriverStartup",
  313. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\DriverStartup",
  314. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4}\\Path",
  315. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4}\\Hash",
  316. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Server\\Id",
  317. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Server\\Index",
  318. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4}\\Triggers",
  319. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4}\\DynamicInfo"
  320. ]
  321.  
  322. [*] Deleted Registry Keys: [
  323. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Server.job",
  324. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Server.job.fp"
  325. ]
  326.  
  327. [*] DNS Communications: []
  328.  
  329. [*] Domains: []
  330.  
  331. [*] Network Communication - ICMP: []
  332.  
  333. [*] Network Communication - HTTP: []
  334.  
  335. [*] Network Communication - SMTP: []
  336.  
  337. [*] Network Communication - Hosts: []
  338.  
  339. [*] Network Communication - IRC: []
  340.  
  341. [*] Static Analysis: {
  342. "pe": {
  343. "peid_signatures": null,
  344. "imports": [
  345. {
  346. "imports": [
  347. {
  348. "name": "_CorExeMain",
  349. "address": "0x402000"
  350. }
  351. ],
  352. "dll": "mscoree.dll"
  353. }
  354. ],
  355. "digital_signers": null,
  356. "exported_dll_name": null,
  357. "actual_checksum": "0x00007002",
  358. "overlay": {
  359. "size": "0x00004d00",
  360. "offset": "0x00001800"
  361. },
  362. "imagebase": "0x00400000",
  363. "reported_checksum": "0x00000000",
  364. "icon_hash": null,
  365. "entrypoint": "0x00402e5e",
  366. "timestamp": "2010-12-09 18:58:19",
  367. "osversion": "4.0",
  368. "sections": [
  369. {
  370. "name": ".text",
  371. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  372. "virtual_address": "0x00002000",
  373. "size_of_data": "0x00001000",
  374. "entropy": "5.25",
  375. "raw_address": "0x00000200",
  376. "virtual_size": "0x00000e64",
  377. "characteristics_raw": "0x60000020"
  378. },
  379. {
  380. "name": ".rsrc",
  381. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  382. "virtual_address": "0x00004000",
  383. "size_of_data": "0x00000400",
  384. "entropy": "3.52",
  385. "raw_address": "0x00001200",
  386. "virtual_size": "0x00000400",
  387. "characteristics_raw": "0x40000040"
  388. },
  389. {
  390. "name": ".reloc",
  391. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  392. "virtual_address": "0x00006000",
  393. "size_of_data": "0x00000200",
  394. "entropy": "6.52",
  395. "raw_address": "0x00001600",
  396. "virtual_size": "0x0000000c",
  397. "characteristics_raw": "0x42000040"
  398. }
  399. ],
  400. "resources": [],
  401. "dirents": [
  402. {
  403. "virtual_address": "0x00000000",
  404. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  405. "size": "0x00000000"
  406. },
  407. {
  408. "virtual_address": "0x00002e0c",
  409. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  410. "size": "0x0000004f"
  411. },
  412. {
  413. "virtual_address": "0x00004000",
  414. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  415. "size": "0x00000400"
  416. },
  417. {
  418. "virtual_address": "0x00000000",
  419. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  420. "size": "0x00000000"
  421. },
  422. {
  423. "virtual_address": "0x00000000",
  424. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  425. "size": "0x00000000"
  426. },
  427. {
  428. "virtual_address": "0x00006000",
  429. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  430. "size": "0x0000000c"
  431. },
  432. {
  433. "virtual_address": "0x00000000",
  434. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  435. "size": "0x00000000"
  436. },
  437. {
  438. "virtual_address": "0x00000000",
  439. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  440. "size": "0x00000000"
  441. },
  442. {
  443. "virtual_address": "0x00000000",
  444. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  445. "size": "0x00000000"
  446. },
  447. {
  448. "virtual_address": "0x00000000",
  449. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  450. "size": "0x00000000"
  451. },
  452. {
  453. "virtual_address": "0x00000000",
  454. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  455. "size": "0x00000000"
  456. },
  457. {
  458. "virtual_address": "0x00000000",
  459. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  460. "size": "0x00000000"
  461. },
  462. {
  463. "virtual_address": "0x00002000",
  464. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  465. "size": "0x00000008"
  466. },
  467. {
  468. "virtual_address": "0x00000000",
  469. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  470. "size": "0x00000000"
  471. },
  472. {
  473. "virtual_address": "0x00002008",
  474. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  475. "size": "0x00000048"
  476. },
  477. {
  478. "virtual_address": "0x00000000",
  479. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  480. "size": "0x00000000"
  481. }
  482. ],
  483. "exports": [],
  484. "guest_signers": {},
  485. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  486. "icon_fuzzy": null,
  487. "icon": null,
  488. "pdbpath": null,
  489. "imported_dll_count": 1,
  490. "versioninfo": []
  491. }
  492. }
  493.  
  494. [*] Resolved APIs: [
  495. "advapi32.dll.RegOpenKeyExW",
  496. "advapi32.dll.RegQueryInfoKeyW",
  497. "advapi32.dll.RegEnumKeyExW",
  498. "advapi32.dll.RegEnumValueW",
  499. "advapi32.dll.RegCloseKey",
  500. "advapi32.dll.RegQueryValueExW",
  501. "shlwapi.dll.UrlIsW",
  502. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  503. "msvcrt.dll._set_error_mode",
  504. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  505. "kernel32.dll.FindActCtxSectionStringW",
  506. "kernel32.dll.GetSystemWindowsDirectoryW",
  507. "mscoree.dll.GetProcessExecutableHeap",
  508. "mscorwks.dll._CorExeMain",
  509. "mscorwks.dll.GetCLRFunction",
  510. "advapi32.dll.RegisterTraceGuidsW",
  511. "advapi32.dll.UnregisterTraceGuids",
  512. "advapi32.dll.GetTraceLoggerHandle",
  513. "advapi32.dll.GetTraceEnableLevel",
  514. "advapi32.dll.GetTraceEnableFlags",
  515. "advapi32.dll.TraceEvent",
  516. "mscoree.dll.IEE",
  517. "mscorwks.dll.IEE",
  518. "mscoree.dll.GetStartupFlags",
  519. "mscoree.dll.GetHostConfigurationFile",
  520. "mscoree.dll.GetCORSystemDirectory",
  521. "ntdll.dll.RtlVirtualUnwind",
  522. "kernel32.dll.IsWow64Process",
  523. "advapi32.dll.AllocateAndInitializeSid",
  524. "advapi32.dll.OpenProcessToken",
  525. "advapi32.dll.GetTokenInformation",
  526. "advapi32.dll.InitializeAcl",
  527. "advapi32.dll.AddAccessAllowedAce",
  528. "advapi32.dll.FreeSid",
  529. "kernel32.dll.SetThreadStackGuarantee",
  530. "kernel32.dll.FlsSetValue",
  531. "kernel32.dll.FlsGetValue",
  532. "kernel32.dll.FlsAlloc",
  533. "kernel32.dll.FlsFree",
  534. "kernel32.dll.AddVectoredContinueHandler",
  535. "kernel32.dll.RemoveVectoredContinueHandler",
  536. "advapi32.dll.ConvertSidToStringSidW",
  537. "shell32.dll.SHGetFolderPathW",
  538. "kernel32.dll.FlushProcessWriteBuffers",
  539. "kernel32.dll.GetWriteWatch",
  540. "kernel32.dll.ResetWriteWatch",
  541. "kernel32.dll.CreateMemoryResourceNotification",
  542. "kernel32.dll.QueryMemoryResourceNotification",
  543. "kernel32.dll.GlobalMemoryStatusEx",
  544. "ole32.dll.CoInitializeEx",
  545. "cryptbase.dll.SystemFunction036",
  546. "uxtheme.dll.ThemeInitApiHook",
  547. "user32.dll.IsProcessDPIAware",
  548. "ole32.dll.CoGetContextToken",
  549. "kernel32.dll.GetFullPathNameW",
  550. "kernel32.dll.GetVersionExW",
  551. "advapi32.dll.CryptAcquireContextA",
  552. "advapi32.dll.CryptReleaseContext",
  553. "advapi32.dll.CryptCreateHash",
  554. "advapi32.dll.CryptDestroyHash",
  555. "advapi32.dll.CryptHashData",
  556. "advapi32.dll.CryptGetHashParam",
  557. "advapi32.dll.CryptImportKey",
  558. "advapi32.dll.CryptExportKey",
  559. "advapi32.dll.CryptGenKey",
  560. "advapi32.dll.CryptGetKeyParam",
  561. "advapi32.dll.CryptDestroyKey",
  562. "advapi32.dll.CryptVerifySignatureA",
  563. "advapi32.dll.CryptSignHashA",
  564. "advapi32.dll.CryptGetProvParam",
  565. "advapi32.dll.CryptGetUserKey",
  566. "advapi32.dll.CryptEnumProvidersA",
  567. "mscoree.dll.GetMetaDataInternalInterface",
  568. "mscorwks.dll.GetMetaDataInternalInterface",
  569. "mscorjit.dll.getJit",
  570. "kernel32.dll.lstrlen",
  571. "kernel32.dll.lstrlenW",
  572. "kernel32.dll.SetErrorMode",
  573. "kernel32.dll.CreateFileW",
  574. "kernel32.dll.CloseHandle",
  575. "kernel32.dll.GetFileType",
  576. "kernel32.dll.GetFileSize",
  577. "kernel32.dll.SetFilePointer",
  578. "kernel32.dll.ReadFile",
  579. "user32.dll.GetForegroundWindow",
  580. "user32.dll.GetWindowTextA",
  581. "ole32.dll.CoTaskMemAlloc",
  582. "kernel32.dll.GetACP",
  583. "kernel32.dll.GetUserDefaultUILanguage",
  584. "kernel32.dll.UnmapViewOfFile",
  585. "ole32.dll.CoTaskMemFree",
  586. "advapi32.dll.RegSetValueExW",
  587. "user32.dll.GetAsyncKeyState",
  588. "user32.dll.GetKeyState",
  589. "kernel32.dll.ReleaseMutex",
  590. "kernel32.dll.CreateMutexW",
  591. "kernel32.dll.GetEnvironmentVariableW",
  592. "kernel32.dll.GetFileAttributesExW",
  593. "kernel32.dll.WriteFile",
  594. "kernel32.dll.LocalAlloc",
  595. "kernel32.dll.RtlMoveMemory",
  596. "shell32.dll.ShellExecuteEx",
  597. "shell32.dll.ShellExecuteExW",
  598. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  599. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  600. "comctl32.dll.#386",
  601. "kernel32.dll.LocalFree",
  602. "ole32.dll.CoWaitForMultipleHandles",
  603. "sechost.dll.LookupAccountNameLocalW",
  604. "advapi32.dll.LookupAccountSidW",
  605. "sechost.dll.LookupAccountSidLocalW",
  606. "cryptsp.dll.CryptAcquireContextW",
  607. "cryptsp.dll.CryptGenRandom",
  608. "ole32.dll.NdrOleInitializeExtension",
  609. "ole32.dll.CoGetClassObject",
  610. "ole32.dll.CoGetMarshalSizeMax",
  611. "ole32.dll.CoMarshalInterface",
  612. "ole32.dll.CoUnmarshalInterface",
  613. "ole32.dll.StringFromIID",
  614. "ole32.dll.CoGetPSClsid",
  615. "ole32.dll.CoCreateInstance",
  616. "ole32.dll.CoReleaseMarshalData",
  617. "ole32.dll.DcomChannelSetHResult",
  618. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  619. "comctl32.dll.#321",
  620. "kernel32.dll.CreateActCtxW",
  621. "kernel32.dll.AddRefActCtx",
  622. "kernel32.dll.ReleaseActCtx",
  623. "kernel32.dll.ActivateActCtx",
  624. "kernel32.dll.DeactivateActCtx",
  625. "kernel32.dll.GetCurrentActCtx",
  626. "kernel32.dll.QueryActCtxW",
  627. "cryptsp.dll.CryptReleaseContext",
  628. "user32.dll.SendMessageTimeoutA",
  629. "kernel32.dll.GetStartupInfoW",
  630. "kernel32.dll.CreateProcessW",
  631. "shfolder.dll.SHGetFolderPathW",
  632. "kernel32.dll.CopyFileW",
  633. "kernel32.dll.GetTempPathW",
  634. "kernel32.dll.FindFirstFileW",
  635. "kernel32.dll.FindClose",
  636. "kernel32.dll.FindNextFileW",
  637. "user32.dll.WaitForInputIdle",
  638. "kernel32.dll.SetFileAttributesW",
  639. "user32.dll.GetProcessWindowStation",
  640. "user32.dll.GetUserObjectInformationA",
  641. "kernel32.dll.SetConsoleCtrlHandler",
  642. "kernel32.dll.GetModuleHandleW",
  643. "user32.dll.GetClassInfoW",
  644. "user32.dll.RegisterClassW",
  645. "user32.dll.CreateWindowExW",
  646. "user32.dll.DefWindowProcW",
  647. "kernel32.dll.GetCurrentProcessId",
  648. "advapi32.dll.LookupPrivilegeValueW",
  649. "kernel32.dll.GetCurrentProcess",
  650. "advapi32.dll.AdjustTokenPrivileges",
  651. "kernel32.dll.OpenProcess",
  652. "kernel32.dll.GetExitCodeProcess",
  653. "ntdll.dll.NtSetInformationProcess",
  654. "kernel32.dll.GetCurrentThread",
  655. "kernel32.dll.DuplicateHandle",
  656. "kernel32.dll.GetCurrentThreadId",
  657. "user32.dll.RegisterWindowMessageW",
  658. "user32.dll.GetSystemMetrics",
  659. "kernel32.dll.GetProcAddress",
  660. "gdi32.dll.GetStockObject",
  661. "user32.dll.SetWindowLongPtrW",
  662. "user32.dll.GetWindowLongPtrW",
  663. "user32.dll.CallWindowProcW",
  664. "user32.dll.GetClientRect",
  665. "user32.dll.GetWindowRect",
  666. "user32.dll.GetParent",
  667. "ole32.dll.OleInitialize",
  668. "ole32.dll.CoRegisterMessageFilter",
  669. "user32.dll.PeekMessageW",
  670. "mscoree.dll.ND_RI2",
  671. "ws2_32.dll.WSAStartup",
  672. "ws2_32.dll.WSASocketW",
  673. "ws2_32.dll.setsockopt",
  674. "ws2_32.dll.WSAEventSelect",
  675. "ws2_32.dll.ioctlsocket",
  676. "ws2_32.dll.closesocket",
  677. "kernel32.dll.GetComputerNameW",
  678. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  679. "kernel32.dll.CreateFileMappingW",
  680. "kernel32.dll.MapViewOfFile",
  681. "kernel32.dll.VirtualQuery",
  682. "advapi32.dll.CreateWellKnownSid",
  683. "kernel32.dll.WaitForSingleObject",
  684. "kernel32.dll.OpenMutexW",
  685. "kernel32.dll.GetProcessTimes",
  686. "ws2_32.dll.inet_addr",
  687. "ws2_32.dll.WSAConnect",
  688. "kernel32.dll.GetProcessWorkingSetSize",
  689. "kernel32.dll.SetProcessWorkingSetSize",
  690. "user32.dll.GetWindowTextLengthA",
  691. "kernel32.dll.FormatMessageW",
  692. "ws2_32.dll.shutdown",
  693. "version.dll.GetFileVersionInfoSizeW",
  694. "version.dll.GetFileVersionInfoW",
  695. "version.dll.VerQueryValueW",
  696. "kernel32.dll.SortGetHandle",
  697. "kernel32.dll.SortCloseHandle",
  698. "sspicli.dll.GetUserNameExW",
  699. "advapi32.dll.GetUserNameW",
  700. "xmllite.dll.CreateXmlWriter",
  701. "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
  702. "ole32.dll.CoUninitialize"
  703. ]
  704.  
  705. [*] Static Analysis: {
  706. "pe": {
  707. "peid_signatures": null,
  708. "imports": [
  709. {
  710. "imports": [
  711. {
  712. "name": "_CorExeMain",
  713. "address": "0x402000"
  714. }
  715. ],
  716. "dll": "mscoree.dll"
  717. }
  718. ],
  719. "digital_signers": null,
  720. "exported_dll_name": null,
  721. "actual_checksum": "0x00007002",
  722. "overlay": {
  723. "size": "0x00004d00",
  724. "offset": "0x00001800"
  725. },
  726. "imagebase": "0x00400000",
  727. "reported_checksum": "0x00000000",
  728. "icon_hash": null,
  729. "entrypoint": "0x00402e5e",
  730. "timestamp": "2010-12-09 18:58:19",
  731. "osversion": "4.0",
  732. "sections": [
  733. {
  734. "name": ".text",
  735. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  736. "virtual_address": "0x00002000",
  737. "size_of_data": "0x00001000",
  738. "entropy": "5.25",
  739. "raw_address": "0x00000200",
  740. "virtual_size": "0x00000e64",
  741. "characteristics_raw": "0x60000020"
  742. },
  743. {
  744. "name": ".rsrc",
  745. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  746. "virtual_address": "0x00004000",
  747. "size_of_data": "0x00000400",
  748. "entropy": "3.52",
  749. "raw_address": "0x00001200",
  750. "virtual_size": "0x00000400",
  751. "characteristics_raw": "0x40000040"
  752. },
  753. {
  754. "name": ".reloc",
  755. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  756. "virtual_address": "0x00006000",
  757. "size_of_data": "0x00000200",
  758. "entropy": "6.52",
  759. "raw_address": "0x00001600",
  760. "virtual_size": "0x0000000c",
  761. "characteristics_raw": "0x42000040"
  762. }
  763. ],
  764. "resources": [],
  765. "dirents": [
  766. {
  767. "virtual_address": "0x00000000",
  768. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  769. "size": "0x00000000"
  770. },
  771. {
  772. "virtual_address": "0x00002e0c",
  773. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  774. "size": "0x0000004f"
  775. },
  776. {
  777. "virtual_address": "0x00004000",
  778. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  779. "size": "0x00000400"
  780. },
  781. {
  782. "virtual_address": "0x00000000",
  783. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  784. "size": "0x00000000"
  785. },
  786. {
  787. "virtual_address": "0x00000000",
  788. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  789. "size": "0x00000000"
  790. },
  791. {
  792. "virtual_address": "0x00006000",
  793. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  794. "size": "0x0000000c"
  795. },
  796. {
  797. "virtual_address": "0x00000000",
  798. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  799. "size": "0x00000000"
  800. },
  801. {
  802. "virtual_address": "0x00000000",
  803. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  804. "size": "0x00000000"
  805. },
  806. {
  807. "virtual_address": "0x00000000",
  808. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  809. "size": "0x00000000"
  810. },
  811. {
  812. "virtual_address": "0x00000000",
  813. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  814. "size": "0x00000000"
  815. },
  816. {
  817. "virtual_address": "0x00000000",
  818. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  819. "size": "0x00000000"
  820. },
  821. {
  822. "virtual_address": "0x00000000",
  823. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  824. "size": "0x00000000"
  825. },
  826. {
  827. "virtual_address": "0x00002000",
  828. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  829. "size": "0x00000008"
  830. },
  831. {
  832. "virtual_address": "0x00000000",
  833. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  834. "size": "0x00000000"
  835. },
  836. {
  837. "virtual_address": "0x00002008",
  838. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  839. "size": "0x00000048"
  840. },
  841. {
  842. "virtual_address": "0x00000000",
  843. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  844. "size": "0x00000000"
  845. }
  846. ],
  847. "exports": [],
  848. "guest_signers": {},
  849. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  850. "icon_fuzzy": null,
  851. "icon": null,
  852. "pdbpath": null,
  853. "imported_dll_count": 1,
  854. "versioninfo": []
  855. }
  856. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!