API tools faq
paste
paladin316

Exes_7c1afa86dc70aa9b7bc68ac53e88917f_exe.json

paladin316
Jun 19th, 2019
2,178
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 48.25 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_7c1afa86dc70aa9b7bc68ac53e88917f.exe"
  7. [*] File Size: 300032
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "6b63bd02dd4d041e240fd3bbe0ab917e43b46fbe57a0b9eda7ae7bcdcb9f6b42"
  10. [*] MD5: "7c1afa86dc70aa9b7bc68ac53e88917f"
  11. [*] SHA1: "76fd8653556b876dc847181d2b89a0d1abf42d61"
  12. [*] SHA512: "14abf6ca00201c66af6ac213f39f7f884fa88d46e03e8c572f2ff3cf65bb727ba67991aad92dcfa9b055c32d99092384b9178f0bb1cbf521a694e3250057cde4"
  13. [*] CRC32: "CBCDFD47"
  14. [*] SSDEEP: "6144:wZ3bjSSY57LvjlghTyMbTf4mPJDnSd2nFAuGlrDRc7h:wZSSsLWhTpb5JGdSFAuMD"
  15.  
  16. [*] Process Execution: [
  17. "Exes_7c1afa86dc70aa9b7bc68ac53e88917f.exe",
  18. "RegAsm.exe"
  19. ]
  20.  
  21. [*] Signatures Detected: [
  22. {
  23. "Description": "Creates RWX memory",
  24. "Details": []
  25. },
  26. {
  27. "Description": "The binary likely contains encrypted or compressed data.",
  28. "Details": [
  29. {
  30. "section": "name: .text, entropy: 7.91, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00045800, virtual_size: 0x00045724"
  31. }
  32. ]
  33. },
  34. {
  35. "Description": "Executed a process and injected code into it, probably while unpacking",
  36. "Details": [
  37. {
  38. "Injection": "Exes_7c1afa86dc70aa9b7bc68ac53e88917f.exe(2400) -> RegAsm.exe(2648)"
  39. }
  40. ]
  41. },
  42. {
  43. "Description": "File has been identified by 16 Antiviruses on VirusTotal as malicious",
  44. "Details": [
  45. {
  46. "Cylance": "Unsafe"
  47. },
  48. {
  49. "Symantec": "ML.Attribute.HighConfidence"
  50. },
  51. {
  52. "APEX": "Malicious"
  53. },
  54. {
  55. "Endgame": "malicious (high confidence)"
  56. },
  57. {
  58. "Invincea": "heuristic"
  59. },
  60. {
  61. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.dc"
  62. },
  63. {
  64. "Trapmine": "malicious.high.ml.score"
  65. },
  66. {
  67. "FireEye": "Generic.mg.7c1afa86dc70aa9b"
  68. },
  69. {
  70. "SentinelOne": "DFI - Malicious PE"
  71. },
  72. {
  73. "ESET-NOD32": "a variant of MSIL/Kryptik.SAP"
  74. },
  75. {
  76. "Avira": "TR/Dropper.Gen"
  77. },
  78. {
  79. "Microsoft": "Trojan:Win32/Fuerboos.A!cl"
  80. },
  81. {
  82. "Acronis": "suspicious"
  83. },
  84. {
  85. "VBA32": "CIL.StupidCryptor.Heur"
  86. },
  87. {
  88. "Cybereason": "malicious.3556b8"
  89. },
  90. {
  91. "CrowdStrike": "win/malicious_confidence_100% (W)"
  92. }
  93. ]
  94. }
  95. ]
  96.  
  97. [*] Started Service: []
  98.  
  99. [*] Executed Commands: [
  100. "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe\""
  101. ]
  102.  
  103. [*] Mutexes: [
  104. "Global\\CLR_CASOFF_MUTEX"
  105. ]
  106.  
  107. [*] Modified Files: []
  108.  
  109. [*] Deleted Files: [
  110. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2400.24136687",
  111. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2400.24136687",
  112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2400.24136703"
  113. ]
  114.  
  115. [*] Modified Registry Keys: []
  116.  
  117. [*] Deleted Registry Keys: []
  118.  
  119. [*] DNS Communications: []
  120.  
  121. [*] Domains: []
  122.  
  123. [*] Network Communication - ICMP: []
  124.  
  125. [*] Network Communication - HTTP: []
  126.  
  127. [*] Network Communication - SMTP: []
  128.  
  129. [*] Network Communication - Hosts: []
  130.  
  131. [*] Network Communication - IRC: []
  132.  
  133. [*] Static Analysis: {
  134. "dotnet": {
  135. "customattrs": null,
  136. "assemblyinfo": {
  137. "version": "13.15.18.17",
  138. "name": "TYRu0jd44n7gDzItdKEHexCUP"
  139. },
  140. "assemblyrefs": [
  141. {
  142. "version": "2.0.0.0",
  143. "name": "mscorlib"
  144. },
  145. {
  146. "version": "2.0.0.0",
  147. "name": "System.Drawing"
  148. },
  149. {
  150. "version": "2.0.0.0",
  151. "name": "System"
  152. },
  153. {
  154. "version": "2.0.0.0",
  155. "name": "System.Windows.Forms"
  156. },
  157. {
  158. "version": "8.0.0.0",
  159. "name": "Microsoft.VisualBasic"
  160. }
  161. ],
  162. "typerefs": [
  163. {
  164. "typename": "Microsoft.VisualBasic.CallType",
  165. "assembly": "Microsoft.VisualBasic"
  166. },
  167. {
  168. "typename": "Microsoft.VisualBasic.Interaction",
  169. "assembly": "Microsoft.VisualBasic"
  170. },
  171. {
  172. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  173. "assembly": "System"
  174. },
  175. {
  176. "typename": "System.ComponentModel.BrowsableAttribute",
  177. "assembly": "System"
  178. },
  179. {
  180. "typename": "System.ComponentModel.CategoryAttribute",
  181. "assembly": "System"
  182. },
  183. {
  184. "typename": "System.ComponentModel.DefaultEventAttribute",
  185. "assembly": "System"
  186. },
  187. {
  188. "typename": "System.ComponentModel.DefaultValueAttribute",
  189. "assembly": "System"
  190. },
  191. {
  192. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  193. "assembly": "System"
  194. },
  195. {
  196. "typename": "System.ComponentModel.EditorBrowsableState",
  197. "assembly": "System"
  198. },
  199. {
  200. "typename": "System.ComponentModel.IContainer",
  201. "assembly": "System"
  202. },
  203. {
  204. "typename": "System.ComponentModel.ISupportInitialize",
  205. "assembly": "System"
  206. },
  207. {
  208. "typename": "System.Configuration.ApplicationSettingsBase",
  209. "assembly": "System"
  210. },
  211. {
  212. "typename": "System.Configuration.SettingsBase",
  213. "assembly": "System"
  214. },
  215. {
  216. "typename": "System.Diagnostics.Process",
  217. "assembly": "System"
  218. },
  219. {
  220. "typename": "System.Drawing.Bitmap",
  221. "assembly": "System.Drawing"
  222. },
  223. {
  224. "typename": "System.Drawing.Brush",
  225. "assembly": "System.Drawing"
  226. },
  227. {
  228. "typename": "System.Drawing.Color",
  229. "assembly": "System.Drawing"
  230. },
  231. {
  232. "typename": "System.Drawing.Drawing2D.GraphicsPath",
  233. "assembly": "System.Drawing"
  234. },
  235. {
  236. "typename": "System.Drawing.Drawing2D.LinearGradientBrush",
  237. "assembly": "System.Drawing"
  238. },
  239. {
  240. "typename": "System.Drawing.Drawing2D.Matrix",
  241. "assembly": "System.Drawing"
  242. },
  243. {
  244. "typename": "System.Drawing.Drawing2D.PixelOffsetMode",
  245. "assembly": "System.Drawing"
  246. },
  247. {
  248. "typename": "System.Drawing.Drawing2D.SmoothingMode",
  249. "assembly": "System.Drawing"
  250. },
  251. {
  252. "typename": "System.Drawing.Drawing2D.WrapMode",
  253. "assembly": "System.Drawing"
  254. },
  255. {
  256. "typename": "System.Drawing.Font",
  257. "assembly": "System.Drawing"
  258. },
  259. {
  260. "typename": "System.Drawing.FontFamily",
  261. "assembly": "System.Drawing"
  262. },
  263. {
  264. "typename": "System.Drawing.FontStyle",
  265. "assembly": "System.Drawing"
  266. },
  267. {
  268. "typename": "System.Drawing.Graphics",
  269. "assembly": "System.Drawing"
  270. },
  271. {
  272. "typename": "System.Drawing.GraphicsUnit",
  273. "assembly": "System.Drawing"
  274. },
  275. {
  276. "typename": "System.Drawing.Icon",
  277. "assembly": "System.Drawing"
  278. },
  279. {
  280. "typename": "System.Drawing.Image",
  281. "assembly": "System.Drawing"
  282. },
  283. {
  284. "typename": "System.Drawing.Imaging.ColorMatrix",
  285. "assembly": "System.Drawing"
  286. },
  287. {
  288. "typename": "System.Drawing.Imaging.ImageAttributes",
  289. "assembly": "System.Drawing"
  290. },
  291. {
  292. "typename": "System.Drawing.Pen",
  293. "assembly": "System.Drawing"
  294. },
  295. {
  296. "typename": "System.Drawing.Point",
  297. "assembly": "System.Drawing"
  298. },
  299. {
  300. "typename": "System.Drawing.PointF",
  301. "assembly": "System.Drawing"
  302. },
  303. {
  304. "typename": "System.Drawing.Rectangle",
  305. "assembly": "System.Drawing"
  306. },
  307. {
  308. "typename": "System.Drawing.RectangleF",
  309. "assembly": "System.Drawing"
  310. },
  311. {
  312. "typename": "System.Drawing.Size",
  313. "assembly": "System.Drawing"
  314. },
  315. {
  316. "typename": "System.Drawing.SizeF",
  317. "assembly": "System.Drawing"
  318. },
  319. {
  320. "typename": "System.Drawing.SolidBrush",
  321. "assembly": "System.Drawing"
  322. },
  323. {
  324. "typename": "System.Drawing.SystemColors",
  325. "assembly": "System.Drawing"
  326. },
  327. {
  328. "typename": "System.Drawing.SystemIcons",
  329. "assembly": "System.Drawing"
  330. },
  331. {
  332. "typename": "System.Drawing.Text.TextRenderingHint",
  333. "assembly": "System.Drawing"
  334. },
  335. {
  336. "typename": "System.Windows.Forms.AnchorStyles",
  337. "assembly": "System.Windows.Forms"
  338. },
  339. {
  340. "typename": "System.Windows.Forms.AutoScaleMode",
  341. "assembly": "System.Windows.Forms"
  342. },
  343. {
  344. "typename": "System.Windows.Forms.Button",
  345. "assembly": "System.Windows.Forms"
  346. },
  347. {
  348. "typename": "System.Windows.Forms.ButtonBase",
  349. "assembly": "System.Windows.Forms"
  350. },
  351. {
  352. "typename": "System.Windows.Forms.ContainerControl",
  353. "assembly": "System.Windows.Forms"
  354. },
  355. {
  356. "typename": "System.Windows.Forms.Control",
  357. "assembly": "System.Windows.Forms"
  358. },
  359. {
  360. "typename": "System.Windows.Forms.Control/ControlCollection",
  361. "assembly": "System.Windows.Forms"
  362. },
  363. {
  364. "typename": "System.Windows.Forms.Cursor",
  365. "assembly": "System.Windows.Forms"
  366. },
  367. {
  368. "typename": "System.Windows.Forms.DialogResult",
  369. "assembly": "System.Windows.Forms"
  370. },
  371. {
  372. "typename": "System.Windows.Forms.Form",
  373. "assembly": "System.Windows.Forms"
  374. },
  375. {
  376. "typename": "System.Windows.Forms.FormBorderStyle",
  377. "assembly": "System.Windows.Forms"
  378. },
  379. {
  380. "typename": "System.Windows.Forms.FormStartPosition",
  381. "assembly": "System.Windows.Forms"
  382. },
  383. {
  384. "typename": "System.Windows.Forms.KeyPressEventArgs",
  385. "assembly": "System.Windows.Forms"
  386. },
  387. {
  388. "typename": "System.Windows.Forms.Keys",
  389. "assembly": "System.Windows.Forms"
  390. },
  391. {
  392. "typename": "System.Windows.Forms.Label",
  393. "assembly": "System.Windows.Forms"
  394. },
  395. {
  396. "typename": "System.Windows.Forms.LinkLabel",
  397. "assembly": "System.Windows.Forms"
  398. },
  399. {
  400. "typename": "System.Windows.Forms.LinkLabelLinkClickedEventArgs",
  401. "assembly": "System.Windows.Forms"
  402. },
  403. {
  404. "typename": "System.Windows.Forms.LinkLabelLinkClickedEventHandler",
  405. "assembly": "System.Windows.Forms"
  406. },
  407. {
  408. "typename": "System.Windows.Forms.MessageBox",
  409. "assembly": "System.Windows.Forms"
  410. },
  411. {
  412. "typename": "System.Windows.Forms.MouseEventArgs",
  413. "assembly": "System.Windows.Forms"
  414. },
  415. {
  416. "typename": "System.Windows.Forms.PaintEventArgs",
  417. "assembly": "System.Windows.Forms"
  418. },
  419. {
  420. "typename": "System.Windows.Forms.PictureBox",
  421. "assembly": "System.Windows.Forms"
  422. },
  423. {
  424. "typename": "System.Windows.Forms.PictureBoxSizeMode",
  425. "assembly": "System.Windows.Forms"
  426. },
  427. {
  428. "typename": "System.Windows.Forms.UserControl",
  429. "assembly": "System.Windows.Forms"
  430. },
  431. {
  432. "typename": "System.Array",
  433. "assembly": "mscorlib"
  434. },
  435. {
  436. "typename": "System.Buffer",
  437. "assembly": "mscorlib"
  438. },
  439. {
  440. "typename": "System.Byte",
  441. "assembly": "mscorlib"
  442. },
  443. {
  444. "typename": "System.Collections.Generic.IEnumerable`1",
  445. "assembly": "mscorlib"
  446. },
  447. {
  448. "typename": "System.Collections.Generic.List`1",
  449. "assembly": "mscorlib"
  450. },
  451. {
  452. "typename": "System.Convert",
  453. "assembly": "mscorlib"
  454. },
  455. {
  456. "typename": "System.Diagnostics.DebuggableAttribute",
  457. "assembly": "mscorlib"
  458. },
  459. {
  460. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  461. "assembly": "mscorlib"
  462. },
  463. {
  464. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  465. "assembly": "mscorlib"
  466. },
  467. {
  468. "typename": "System.Enum",
  469. "assembly": "mscorlib"
  470. },
  471. {
  472. "typename": "System.EventArgs",
  473. "assembly": "mscorlib"
  474. },
  475. {
  476. "typename": "System.EventHandler",
  477. "assembly": "mscorlib"
  478. },
  479. {
  480. "typename": "System.Globalization.CultureInfo",
  481. "assembly": "mscorlib"
  482. },
  483. {
  484. "typename": "System.IDisposable",
  485. "assembly": "mscorlib"
  486. },
  487. {
  488. "typename": "System.Math",
  489. "assembly": "mscorlib"
  490. },
  491. {
  492. "typename": "System.Object",
  493. "assembly": "mscorlib"
  494. },
  495. {
  496. "typename": "System.Reflection.Assembly",
  497. "assembly": "mscorlib"
  498. },
  499. {
  500. "typename": "System.Reflection.AssemblyCompanyAttribute",
  501. "assembly": "mscorlib"
  502. },
  503. {
  504. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  505. "assembly": "mscorlib"
  506. },
  507. {
  508. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  509. "assembly": "mscorlib"
  510. },
  511. {
  512. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  513. "assembly": "mscorlib"
  514. },
  515. {
  516. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  517. "assembly": "mscorlib"
  518. },
  519. {
  520. "typename": "System.Reflection.AssemblyProductAttribute",
  521. "assembly": "mscorlib"
  522. },
  523. {
  524. "typename": "System.Reflection.AssemblyTitleAttribute",
  525. "assembly": "mscorlib"
  526. },
  527. {
  528. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  529. "assembly": "mscorlib"
  530. },
  531. {
  532. "typename": "System.Resources.ResourceManager",
  533. "assembly": "mscorlib"
  534. },
  535. {
  536. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  537. "assembly": "mscorlib"
  538. },
  539. {
  540. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  541. "assembly": "mscorlib"
  542. },
  543. {
  544. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  545. "assembly": "mscorlib"
  546. },
  547. {
  548. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  549. "assembly": "mscorlib"
  550. },
  551. {
  552. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  553. "assembly": "mscorlib"
  554. },
  555. {
  556. "typename": "System.Runtime.InteropServices.GuidAttribute",
  557. "assembly": "mscorlib"
  558. },
  559. {
  560. "typename": "System.RuntimeFieldHandle",
  561. "assembly": "mscorlib"
  562. },
  563. {
  564. "typename": "System.RuntimeTypeHandle",
  565. "assembly": "mscorlib"
  566. },
  567. {
  568. "typename": "System.Single",
  569. "assembly": "mscorlib"
  570. },
  571. {
  572. "typename": "System.String",
  573. "assembly": "mscorlib"
  574. },
  575. {
  576. "typename": "System.Text.Encoding",
  577. "assembly": "mscorlib"
  578. },
  579. {
  580. "typename": "System.Type",
  581. "assembly": "mscorlib"
  582. },
  583. {
  584. "typename": "System.ValueType",
  585. "assembly": "mscorlib"
  586. }
  587. ]
  588. },
  589. "pe": {
  590. "peid_signatures": null,
  591. "imports": [
  592. {
  593. "imports": [
  594. {
  595. "name": "_CorExeMain",
  596. "address": "0x402000"
  597. }
  598. ],
  599. "dll": "mscoree.dll"
  600. }
  601. ],
  602. "digital_signers": null,
  603. "exported_dll_name": null,
  604. "actual_checksum": "0x000577c8",
  605. "overlay": {
  606. "size": "0x00003200",
  607. "offset": "0x00046200"
  608. },
  609. "imagebase": "0x00400000",
  610. "reported_checksum": "0x00000000",
  611. "icon_hash": null,
  612. "entrypoint": "0x0044771e",
  613. "timestamp": "2019-06-18 13:44:12",
  614. "osversion": "4.0",
  615. "sections": [
  616. {
  617. "name": ".text",
  618. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  619. "virtual_address": "0x00002000",
  620. "size_of_data": "0x00045800",
  621. "entropy": "7.91",
  622. "raw_address": "0x00000200",
  623. "virtual_size": "0x00045724",
  624. "characteristics_raw": "0x60000020"
  625. },
  626. {
  627. "name": ".rsrc",
  628. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  629. "virtual_address": "0x00048000",
  630. "size_of_data": "0x00000600",
  631. "entropy": "4.12",
  632. "raw_address": "0x00045a00",
  633. "virtual_size": "0x000005b6",
  634. "characteristics_raw": "0x40000040"
  635. },
  636. {
  637. "name": ".reloc",
  638. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  639. "virtual_address": "0x0004a000",
  640. "size_of_data": "0x00000200",
  641. "entropy": "0.10",
  642. "raw_address": "0x00046000",
  643. "virtual_size": "0x0000000c",
  644. "characteristics_raw": "0x42000040"
  645. }
  646. ],
  647. "resources": [],
  648. "dirents": [
  649. {
  650. "virtual_address": "0x00000000",
  651. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  652. "size": "0x00000000"
  653. },
  654. {
  655. "virtual_address": "0x000476cc",
  656. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  657. "size": "0x0000004f"
  658. },
  659. {
  660. "virtual_address": "0x00048000",
  661. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  662. "size": "0x000005b6"
  663. },
  664. {
  665. "virtual_address": "0x00000000",
  666. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  667. "size": "0x00000000"
  668. },
  669. {
  670. "virtual_address": "0x00000000",
  671. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  672. "size": "0x00000000"
  673. },
  674. {
  675. "virtual_address": "0x0004a000",
  676. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  677. "size": "0x0000000c"
  678. },
  679. {
  680. "virtual_address": "0x00000000",
  681. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  682. "size": "0x00000000"
  683. },
  684. {
  685. "virtual_address": "0x00000000",
  686. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  687. "size": "0x00000000"
  688. },
  689. {
  690. "virtual_address": "0x00000000",
  691. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  692. "size": "0x00000000"
  693. },
  694. {
  695. "virtual_address": "0x00000000",
  696. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  697. "size": "0x00000000"
  698. },
  699. {
  700. "virtual_address": "0x00000000",
  701. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  702. "size": "0x00000000"
  703. },
  704. {
  705. "virtual_address": "0x00000000",
  706. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  707. "size": "0x00000000"
  708. },
  709. {
  710. "virtual_address": "0x00002000",
  711. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  712. "size": "0x00000008"
  713. },
  714. {
  715. "virtual_address": "0x00000000",
  716. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  717. "size": "0x00000000"
  718. },
  719. {
  720. "virtual_address": "0x00002008",
  721. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  722. "size": "0x00000048"
  723. },
  724. {
  725. "virtual_address": "0x00000000",
  726. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  727. "size": "0x00000000"
  728. }
  729. ],
  730. "exports": [],
  731. "guest_signers": {},
  732. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  733. "icon_fuzzy": null,
  734. "icon": null,
  735. "pdbpath": null,
  736. "imported_dll_count": 1,
  737. "versioninfo": []
  738. }
  739. }
  740.  
  741. [*] Resolved APIs: [
  742. "advapi32.dll.RegOpenKeyExW",
  743. "advapi32.dll.RegQueryInfoKeyW",
  744. "advapi32.dll.RegEnumKeyExW",
  745. "advapi32.dll.RegEnumValueW",
  746. "advapi32.dll.RegCloseKey",
  747. "advapi32.dll.RegQueryValueExW",
  748. "kernel32.dll.QueryActCtxW",
  749. "shlwapi.dll.UrlIsW",
  750. "kernel32.dll.FlsAlloc",
  751. "kernel32.dll.FlsGetValue",
  752. "kernel32.dll.FlsSetValue",
  753. "kernel32.dll.FlsFree",
  754. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  755. "kernel32.dll.IsProcessorFeaturePresent",
  756. "msvcrt.dll._set_error_mode",
  757. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  758. "kernel32.dll.FindActCtxSectionStringW",
  759. "kernel32.dll.GetSystemWindowsDirectoryW",
  760. "mscoree.dll.GetProcessExecutableHeap",
  761. "mscorwks.dll._CorExeMain",
  762. "mscorwks.dll.GetCLRFunction",
  763. "advapi32.dll.RegisterTraceGuidsW",
  764. "advapi32.dll.UnregisterTraceGuids",
  765. "advapi32.dll.GetTraceLoggerHandle",
  766. "advapi32.dll.GetTraceEnableLevel",
  767. "advapi32.dll.GetTraceEnableFlags",
  768. "advapi32.dll.TraceEvent",
  769. "mscoree.dll.IEE",
  770. "mscorwks.dll.IEE",
  771. "mscoree.dll.GetStartupFlags",
  772. "mscoree.dll.GetHostConfigurationFile",
  773. "mscoree.dll.GetCORSystemDirectory",
  774. "ntdll.dll.RtlUnwind",
  775. "kernel32.dll.IsWow64Process",
  776. "advapi32.dll.AllocateAndInitializeSid",
  777. "advapi32.dll.OpenProcessToken",
  778. "advapi32.dll.GetTokenInformation",
  779. "advapi32.dll.InitializeAcl",
  780. "advapi32.dll.AddAccessAllowedAce",
  781. "advapi32.dll.FreeSid",
  782. "kernel32.dll.SetThreadStackGuarantee",
  783. "kernel32.dll.AddVectoredContinueHandler",
  784. "kernel32.dll.RemoveVectoredContinueHandler",
  785. "advapi32.dll.ConvertSidToStringSidW",
  786. "shell32.dll.SHGetFolderPathW",
  787. "kernel32.dll.FlushProcessWriteBuffers",
  788. "kernel32.dll.GetWriteWatch",
  789. "kernel32.dll.ResetWriteWatch",
  790. "kernel32.dll.CreateMemoryResourceNotification",
  791. "kernel32.dll.QueryMemoryResourceNotification",
  792. "ole32.dll.CoInitializeEx",
  793. "cryptbase.dll.SystemFunction036",
  794. "ole32.dll.CoGetContextToken",
  795. "kernel32.dll.GetFullPathNameW",
  796. "kernel32.dll.GetVersionExW",
  797. "advapi32.dll.CryptAcquireContextA",
  798. "advapi32.dll.CryptReleaseContext",
  799. "advapi32.dll.CryptCreateHash",
  800. "advapi32.dll.CryptDestroyHash",
  801. "advapi32.dll.CryptHashData",
  802. "advapi32.dll.CryptGetHashParam",
  803. "advapi32.dll.CryptImportKey",
  804. "advapi32.dll.CryptExportKey",
  805. "advapi32.dll.CryptGenKey",
  806. "advapi32.dll.CryptGetKeyParam",
  807. "advapi32.dll.CryptDestroyKey",
  808. "advapi32.dll.CryptVerifySignatureA",
  809. "advapi32.dll.CryptSignHashA",
  810. "advapi32.dll.CryptGetProvParam",
  811. "advapi32.dll.CryptGetUserKey",
  812. "advapi32.dll.CryptEnumProvidersA",
  813. "mscoree.dll.GetMetaDataInternalInterface",
  814. "mscorwks.dll.GetMetaDataInternalInterface",
  815. "mscorjit.dll.getJit",
  816. "kernel32.dll.GetACP",
  817. "kernel32.dll.GetUserDefaultUILanguage",
  818. "kernel32.dll.UnmapViewOfFile",
  819. "kernel32.dll.CloseHandle",
  820. "kernel32.dll.SetErrorMode",
  821. "kernel32.dll.GetFileAttributesExW",
  822. "culture.dll.ConvertLangIdToCultureName",
  823. "kernel32.dll.GetCurrentProcessId",
  824. "kernel32.dll.FindAtomW",
  825. "kernel32.dll.AddAtomW",
  826. "mscoree.dll.LoadLibraryShim",
  827. "gdiplus.dll.GdiplusStartup",
  828. "user32.dll.GetWindowInfo",
  829. "user32.dll.GetAncestor",
  830. "user32.dll.GetMonitorInfoA",
  831. "user32.dll.EnumDisplayMonitors",
  832. "user32.dll.EnumDisplayDevicesA",
  833. "gdi32.dll.ExtTextOutW",
  834. "gdi32.dll.GdiIsMetaPrintDC",
  835. "gdiplus.dll.GdipLoadImageFromStream",
  836. "windowscodecs.dll.DllGetClassObject",
  837. "kernel32.dll.WerRegisterMemoryBlock",
  838. "gdiplus.dll.GdipImageForceValidation",
  839. "gdiplus.dll.GdipGetImageType",
  840. "gdiplus.dll.GdipGetImageRawFormat",
  841. "gdiplus.dll.GdipGetImageWidth",
  842. "gdiplus.dll.GdipGetImageHeight",
  843. "gdiplus.dll.GdipBitmapGetPixel",
  844. "gdiplus.dll.GdipDisposeImage",
  845. "kernel32.dll.GlobalMemoryStatusEx",
  846. "kernel32.dll.SwitchToThread",
  847. "advapi32.dll.LookupPrivilegeValueW",
  848. "kernel32.dll.GetCurrentProcess",
  849. "advapi32.dll.AdjustTokenPrivileges",
  850. "kernel32.dll.OpenProcess",
  851. "kernel32.dll.GetExitCodeProcess",
  852. "advapi32.dll.GetKernelObjectSecurity",
  853. "advapi32.dll.CreateWellKnownSid",
  854. "advapi32.dll.SetKernelObjectSecurity",
  855. "kernel32.dll.IsDebuggerPresent",
  856. "kernel32.dll.CreateProcessW",
  857. "kernel32.dll.GetThreadContext",
  858. "kernel32.dll.ReadProcessMemory",
  859. "kernel32.dll.VirtualAllocEx",
  860. "kernel32.dll.WriteProcessMemory",
  861. "kernel32.dll.SetThreadContext",
  862. "kernel32.dll.ResumeThread",
  863. "psapi.dll.EnumProcesses",
  864. "kernel32.dll.DeleteAtom",
  865. "ole32.dll.CoUninitialize",
  866. "kernel32.dll.CreateActCtxW",
  867. "kernel32.dll.AddRefActCtx",
  868. "kernel32.dll.ReleaseActCtx",
  869. "kernel32.dll.ActivateActCtx",
  870. "kernel32.dll.DeactivateActCtx",
  871. "kernel32.dll.GetCurrentActCtx"
  872. ]
  873.  
  874. [*] Static Analysis: {
  875. "dotnet": {
  876. "customattrs": null,
  877. "assemblyinfo": {
  878. "version": "13.15.18.17",
  879. "name": "TYRu0jd44n7gDzItdKEHexCUP"
  880. },
  881. "assemblyrefs": [
  882. {
  883. "version": "2.0.0.0",
  884. "name": "mscorlib"
  885. },
  886. {
  887. "version": "2.0.0.0",
  888. "name": "System.Drawing"
  889. },
  890. {
  891. "version": "2.0.0.0",
  892. "name": "System"
  893. },
  894. {
  895. "version": "2.0.0.0",
  896. "name": "System.Windows.Forms"
  897. },
  898. {
  899. "version": "8.0.0.0",
  900. "name": "Microsoft.VisualBasic"
  901. }
  902. ],
  903. "typerefs": [
  904. {
  905. "typename": "Microsoft.VisualBasic.CallType",
  906. "assembly": "Microsoft.VisualBasic"
  907. },
  908. {
  909. "typename": "Microsoft.VisualBasic.Interaction",
  910. "assembly": "Microsoft.VisualBasic"
  911. },
  912. {
  913. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  914. "assembly": "System"
  915. },
  916. {
  917. "typename": "System.ComponentModel.BrowsableAttribute",
  918. "assembly": "System"
  919. },
  920. {
  921. "typename": "System.ComponentModel.CategoryAttribute",
  922. "assembly": "System"
  923. },
  924. {
  925. "typename": "System.ComponentModel.DefaultEventAttribute",
  926. "assembly": "System"
  927. },
  928. {
  929. "typename": "System.ComponentModel.DefaultValueAttribute",
  930. "assembly": "System"
  931. },
  932. {
  933. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  934. "assembly": "System"
  935. },
  936. {
  937. "typename": "System.ComponentModel.EditorBrowsableState",
  938. "assembly": "System"
  939. },
  940. {
  941. "typename": "System.ComponentModel.IContainer",
  942. "assembly": "System"
  943. },
  944. {
  945. "typename": "System.ComponentModel.ISupportInitialize",
  946. "assembly": "System"
  947. },
  948. {
  949. "typename": "System.Configuration.ApplicationSettingsBase",
  950. "assembly": "System"
  951. },
  952. {
  953. "typename": "System.Configuration.SettingsBase",
  954. "assembly": "System"
  955. },
  956. {
  957. "typename": "System.Diagnostics.Process",
  958. "assembly": "System"
  959. },
  960. {
  961. "typename": "System.Drawing.Bitmap",
  962. "assembly": "System.Drawing"
  963. },
  964. {
  965. "typename": "System.Drawing.Brush",
  966. "assembly": "System.Drawing"
  967. },
  968. {
  969. "typename": "System.Drawing.Color",
  970. "assembly": "System.Drawing"
  971. },
  972. {
  973. "typename": "System.Drawing.Drawing2D.GraphicsPath",
  974. "assembly": "System.Drawing"
  975. },
  976. {
  977. "typename": "System.Drawing.Drawing2D.LinearGradientBrush",
  978. "assembly": "System.Drawing"
  979. },
  980. {
  981. "typename": "System.Drawing.Drawing2D.Matrix",
  982. "assembly": "System.Drawing"
  983. },
  984. {
  985. "typename": "System.Drawing.Drawing2D.PixelOffsetMode",
  986. "assembly": "System.Drawing"
  987. },
  988. {
  989. "typename": "System.Drawing.Drawing2D.SmoothingMode",
  990. "assembly": "System.Drawing"
  991. },
  992. {
  993. "typename": "System.Drawing.Drawing2D.WrapMode",
  994. "assembly": "System.Drawing"
  995. },
  996. {
  997. "typename": "System.Drawing.Font",
  998. "assembly": "System.Drawing"
  999. },
  1000. {
  1001. "typename": "System.Drawing.FontFamily",
  1002. "assembly": "System.Drawing"
  1003. },
  1004. {
  1005. "typename": "System.Drawing.FontStyle",
  1006. "assembly": "System.Drawing"
  1007. },
  1008. {
  1009. "typename": "System.Drawing.Graphics",
  1010. "assembly": "System.Drawing"
  1011. },
  1012. {
  1013. "typename": "System.Drawing.GraphicsUnit",
  1014. "assembly": "System.Drawing"
  1015. },
  1016. {
  1017. "typename": "System.Drawing.Icon",
  1018. "assembly": "System.Drawing"
  1019. },
  1020. {
  1021. "typename": "System.Drawing.Image",
  1022. "assembly": "System.Drawing"
  1023. },
  1024. {
  1025. "typename": "System.Drawing.Imaging.ColorMatrix",
  1026. "assembly": "System.Drawing"
  1027. },
  1028. {
  1029. "typename": "System.Drawing.Imaging.ImageAttributes",
  1030. "assembly": "System.Drawing"
  1031. },
  1032. {
  1033. "typename": "System.Drawing.Pen",
  1034. "assembly": "System.Drawing"
  1035. },
  1036. {
  1037. "typename": "System.Drawing.Point",
  1038. "assembly": "System.Drawing"
  1039. },
  1040. {
  1041. "typename": "System.Drawing.PointF",
  1042. "assembly": "System.Drawing"
  1043. },
  1044. {
  1045. "typename": "System.Drawing.Rectangle",
  1046. "assembly": "System.Drawing"
  1047. },
  1048. {
  1049. "typename": "System.Drawing.RectangleF",
  1050. "assembly": "System.Drawing"
  1051. },
  1052. {
  1053. "typename": "System.Drawing.Size",
  1054. "assembly": "System.Drawing"
  1055. },
  1056. {
  1057. "typename": "System.Drawing.SizeF",
  1058. "assembly": "System.Drawing"
  1059. },
  1060. {
  1061. "typename": "System.Drawing.SolidBrush",
  1062. "assembly": "System.Drawing"
  1063. },
  1064. {
  1065. "typename": "System.Drawing.SystemColors",
  1066. "assembly": "System.Drawing"
  1067. },
  1068. {
  1069. "typename": "System.Drawing.SystemIcons",
  1070. "assembly": "System.Drawing"
  1071. },
  1072. {
  1073. "typename": "System.Drawing.Text.TextRenderingHint",
  1074. "assembly": "System.Drawing"
  1075. },
  1076. {
  1077. "typename": "System.Windows.Forms.AnchorStyles",
  1078. "assembly": "System.Windows.Forms"
  1079. },
  1080. {
  1081. "typename": "System.Windows.Forms.AutoScaleMode",
  1082. "assembly": "System.Windows.Forms"
  1083. },
  1084. {
  1085. "typename": "System.Windows.Forms.Button",
  1086. "assembly": "System.Windows.Forms"
  1087. },
  1088. {
  1089. "typename": "System.Windows.Forms.ButtonBase",
  1090. "assembly": "System.Windows.Forms"
  1091. },
  1092. {
  1093. "typename": "System.Windows.Forms.ContainerControl",
  1094. "assembly": "System.Windows.Forms"
  1095. },
  1096. {
  1097. "typename": "System.Windows.Forms.Control",
  1098. "assembly": "System.Windows.Forms"
  1099. },
  1100. {
  1101. "typename": "System.Windows.Forms.Control/ControlCollection",
  1102. "assembly": "System.Windows.Forms"
  1103. },
  1104. {
  1105. "typename": "System.Windows.Forms.Cursor",
  1106. "assembly": "System.Windows.Forms"
  1107. },
  1108. {
  1109. "typename": "System.Windows.Forms.DialogResult",
  1110. "assembly": "System.Windows.Forms"
  1111. },
  1112. {
  1113. "typename": "System.Windows.Forms.Form",
  1114. "assembly": "System.Windows.Forms"
  1115. },
  1116. {
  1117. "typename": "System.Windows.Forms.FormBorderStyle",
  1118. "assembly": "System.Windows.Forms"
  1119. },
  1120. {
  1121. "typename": "System.Windows.Forms.FormStartPosition",
  1122. "assembly": "System.Windows.Forms"
  1123. },
  1124. {
  1125. "typename": "System.Windows.Forms.KeyPressEventArgs",
  1126. "assembly": "System.Windows.Forms"
  1127. },
  1128. {
  1129. "typename": "System.Windows.Forms.Keys",
  1130. "assembly": "System.Windows.Forms"
  1131. },
  1132. {
  1133. "typename": "System.Windows.Forms.Label",
  1134. "assembly": "System.Windows.Forms"
  1135. },
  1136. {
  1137. "typename": "System.Windows.Forms.LinkLabel",
  1138. "assembly": "System.Windows.Forms"
  1139. },
  1140. {
  1141. "typename": "System.Windows.Forms.LinkLabelLinkClickedEventArgs",
  1142. "assembly": "System.Windows.Forms"
  1143. },
  1144. {
  1145. "typename": "System.Windows.Forms.LinkLabelLinkClickedEventHandler",
  1146. "assembly": "System.Windows.Forms"
  1147. },
  1148. {
  1149. "typename": "System.Windows.Forms.MessageBox",
  1150. "assembly": "System.Windows.Forms"
  1151. },
  1152. {
  1153. "typename": "System.Windows.Forms.MouseEventArgs",
  1154. "assembly": "System.Windows.Forms"
  1155. },
  1156. {
  1157. "typename": "System.Windows.Forms.PaintEventArgs",
  1158. "assembly": "System.Windows.Forms"
  1159. },
  1160. {
  1161. "typename": "System.Windows.Forms.PictureBox",
  1162. "assembly": "System.Windows.Forms"
  1163. },
  1164. {
  1165. "typename": "System.Windows.Forms.PictureBoxSizeMode",
  1166. "assembly": "System.Windows.Forms"
  1167. },
  1168. {
  1169. "typename": "System.Windows.Forms.UserControl",
  1170. "assembly": "System.Windows.Forms"
  1171. },
  1172. {
  1173. "typename": "System.Array",
  1174. "assembly": "mscorlib"
  1175. },
  1176. {
  1177. "typename": "System.Buffer",
  1178. "assembly": "mscorlib"
  1179. },
  1180. {
  1181. "typename": "System.Byte",
  1182. "assembly": "mscorlib"
  1183. },
  1184. {
  1185. "typename": "System.Collections.Generic.IEnumerable`1",
  1186. "assembly": "mscorlib"
  1187. },
  1188. {
  1189. "typename": "System.Collections.Generic.List`1",
  1190. "assembly": "mscorlib"
  1191. },
  1192. {
  1193. "typename": "System.Convert",
  1194. "assembly": "mscorlib"
  1195. },
  1196. {
  1197. "typename": "System.Diagnostics.DebuggableAttribute",
  1198. "assembly": "mscorlib"
  1199. },
  1200. {
  1201. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  1202. "assembly": "mscorlib"
  1203. },
  1204. {
  1205. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  1206. "assembly": "mscorlib"
  1207. },
  1208. {
  1209. "typename": "System.Enum",
  1210. "assembly": "mscorlib"
  1211. },
  1212. {
  1213. "typename": "System.EventArgs",
  1214. "assembly": "mscorlib"
  1215. },
  1216. {
  1217. "typename": "System.EventHandler",
  1218. "assembly": "mscorlib"
  1219. },
  1220. {
  1221. "typename": "System.Globalization.CultureInfo",
  1222. "assembly": "mscorlib"
  1223. },
  1224. {
  1225. "typename": "System.IDisposable",
  1226. "assembly": "mscorlib"
  1227. },
  1228. {
  1229. "typename": "System.Math",
  1230. "assembly": "mscorlib"
  1231. },
  1232. {
  1233. "typename": "System.Object",
  1234. "assembly": "mscorlib"
  1235. },
  1236. {
  1237. "typename": "System.Reflection.Assembly",
  1238. "assembly": "mscorlib"
  1239. },
  1240. {
  1241. "typename": "System.Reflection.AssemblyCompanyAttribute",
  1242. "assembly": "mscorlib"
  1243. },
  1244. {
  1245. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  1246. "assembly": "mscorlib"
  1247. },
  1248. {
  1249. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  1250. "assembly": "mscorlib"
  1251. },
  1252. {
  1253. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  1254. "assembly": "mscorlib"
  1255. },
  1256. {
  1257. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  1258. "assembly": "mscorlib"
  1259. },
  1260. {
  1261. "typename": "System.Reflection.AssemblyProductAttribute",
  1262. "assembly": "mscorlib"
  1263. },
  1264. {
  1265. "typename": "System.Reflection.AssemblyTitleAttribute",
  1266. "assembly": "mscorlib"
  1267. },
  1268. {
  1269. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  1270. "assembly": "mscorlib"
  1271. },
  1272. {
  1273. "typename": "System.Resources.ResourceManager",
  1274. "assembly": "mscorlib"
  1275. },
  1276. {
  1277. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  1278. "assembly": "mscorlib"
  1279. },
  1280. {
  1281. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  1282. "assembly": "mscorlib"
  1283. },
  1284. {
  1285. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  1286. "assembly": "mscorlib"
  1287. },
  1288. {
  1289. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  1290. "assembly": "mscorlib"
  1291. },
  1292. {
  1293. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  1294. "assembly": "mscorlib"
  1295. },
  1296. {
  1297. "typename": "System.Runtime.InteropServices.GuidAttribute",
  1298. "assembly": "mscorlib"
  1299. },
  1300. {
  1301. "typename": "System.RuntimeFieldHandle",
  1302. "assembly": "mscorlib"
  1303. },
  1304. {
  1305. "typename": "System.RuntimeTypeHandle",
  1306. "assembly": "mscorlib"
  1307. },
  1308. {
  1309. "typename": "System.Single",
  1310. "assembly": "mscorlib"
  1311. },
  1312. {
  1313. "typename": "System.String",
  1314. "assembly": "mscorlib"
  1315. },
  1316. {
  1317. "typename": "System.Text.Encoding",
  1318. "assembly": "mscorlib"
  1319. },
  1320. {
  1321. "typename": "System.Type",
  1322. "assembly": "mscorlib"
  1323. },
  1324. {
  1325. "typename": "System.ValueType",
  1326. "assembly": "mscorlib"
  1327. }
  1328. ]
  1329. },
  1330. "pe": {
  1331. "peid_signatures": null,
  1332. "imports": [
  1333. {
  1334. "imports": [
  1335. {
  1336. "name": "_CorExeMain",
  1337. "address": "0x402000"
  1338. }
  1339. ],
  1340. "dll": "mscoree.dll"
  1341. }
  1342. ],
  1343. "digital_signers": null,
  1344. "exported_dll_name": null,
  1345. "actual_checksum": "0x000577c8",
  1346. "overlay": {
  1347. "size": "0x00003200",
  1348. "offset": "0x00046200"
  1349. },
  1350. "imagebase": "0x00400000",
  1351. "reported_checksum": "0x00000000",
  1352. "icon_hash": null,
  1353. "entrypoint": "0x0044771e",
  1354. "timestamp": "2019-06-18 13:44:12",
  1355. "osversion": "4.0",
  1356. "sections": [
  1357. {
  1358. "name": ".text",
  1359. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1360. "virtual_address": "0x00002000",
  1361. "size_of_data": "0x00045800",
  1362. "entropy": "7.91",
  1363. "raw_address": "0x00000200",
  1364. "virtual_size": "0x00045724",
  1365. "characteristics_raw": "0x60000020"
  1366. },
  1367. {
  1368. "name": ".rsrc",
  1369. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1370. "virtual_address": "0x00048000",
  1371. "size_of_data": "0x00000600",
  1372. "entropy": "4.12",
  1373. "raw_address": "0x00045a00",
  1374. "virtual_size": "0x000005b6",
  1375. "characteristics_raw": "0x40000040"
  1376. },
  1377. {
  1378. "name": ".reloc",
  1379. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1380. "virtual_address": "0x0004a000",
  1381. "size_of_data": "0x00000200",
  1382. "entropy": "0.10",
  1383. "raw_address": "0x00046000",
  1384. "virtual_size": "0x0000000c",
  1385. "characteristics_raw": "0x42000040"
  1386. }
  1387. ],
  1388. "resources": [],
  1389. "dirents": [
  1390. {
  1391. "virtual_address": "0x00000000",
  1392. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1393. "size": "0x00000000"
  1394. },
  1395. {
  1396. "virtual_address": "0x000476cc",
  1397. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1398. "size": "0x0000004f"
  1399. },
  1400. {
  1401. "virtual_address": "0x00048000",
  1402. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1403. "size": "0x000005b6"
  1404. },
  1405. {
  1406. "virtual_address": "0x00000000",
  1407. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1408. "size": "0x00000000"
  1409. },
  1410. {
  1411. "virtual_address": "0x00000000",
  1412. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1413. "size": "0x00000000"
  1414. },
  1415. {
  1416. "virtual_address": "0x0004a000",
  1417. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1418. "size": "0x0000000c"
  1419. },
  1420. {
  1421. "virtual_address": "0x00000000",
  1422. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1423. "size": "0x00000000"
  1424. },
  1425. {
  1426. "virtual_address": "0x00000000",
  1427. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1428. "size": "0x00000000"
  1429. },
  1430. {
  1431. "virtual_address": "0x00000000",
  1432. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1433. "size": "0x00000000"
  1434. },
  1435. {
  1436. "virtual_address": "0x00000000",
  1437. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1438. "size": "0x00000000"
  1439. },
  1440. {
  1441. "virtual_address": "0x00000000",
  1442. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1443. "size": "0x00000000"
  1444. },
  1445. {
  1446. "virtual_address": "0x00000000",
  1447. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1448. "size": "0x00000000"
  1449. },
  1450. {
  1451. "virtual_address": "0x00002000",
  1452. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1453. "size": "0x00000008"
  1454. },
  1455. {
  1456. "virtual_address": "0x00000000",
  1457. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1458. "size": "0x00000000"
  1459. },
  1460. {
  1461. "virtual_address": "0x00002008",
  1462. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1463. "size": "0x00000048"
  1464. },
  1465. {
  1466. "virtual_address": "0x00000000",
  1467. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1468. "size": "0x00000000"
  1469. }
  1470. ],
  1471. "exports": [],
  1472. "guest_signers": {},
  1473. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1474. "icon_fuzzy": null,
  1475. "icon": null,
  1476. "pdbpath": null,
  1477. "imported_dll_count": 1,
  1478. "versioninfo": []
  1479. }
  1480. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!