API tools faq
paste
paladin316

GItXn_exe_2019-07-02_17_30.json

paladin316
Jul 2nd, 2019
2,407
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.14 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 2.6
  5.  
  6. [*] File Name: "GItXn.exe"
  7. [*] File Size: 348240
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "5198890b137e79fa7c8fb9cae537e7bffc197fb6068b03987b417fb9dc094984"
  10. [*] MD5: "f547b920355e22f2fd0e1deb2fe200a5"
  11. [*] SHA1: "f203cfcbbaeee2496f42e5e42bb069a4ce78b262"
  12. [*] SHA512: "d71d3ddae2186c70393a0278307016351614634074d0a7c17db108f64a1d0eeac4773a8a7127b4f1bae8a6fbd7afb6c39ecbf64e0cca0ffd640d6bba05c21c4a"
  13. [*] CRC32: "3DF03560"
  14. [*] SSDEEP: "6144:Lux+ZQcTHiCDMe1K7yXgiPa2OmRJdLUmxxi2jAURE8rTHqCd7NdSr4wC4ojxpb:U+ZvPMrEXX5Jd5xxi2MUS8nh7NRsgpb"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .data, entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00029a00, virtual_size: 0x00029f7c"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "Anomalous binary characteristics",
  29. "Details": [
  30. {
  31. "anomaly": "Actual checksum does not match that reported in PE header"
  32. }
  33. ]
  34. }
  35. ]
  36.  
  37. [*] Started Service: []
  38.  
  39. [*] Executed Commands: []
  40.  
  41. [*] Mutexes: []
  42.  
  43. [*] Modified Files: []
  44.  
  45. [*] Deleted Files: []
  46.  
  47. [*] Modified Registry Keys: []
  48.  
  49. [*] Deleted Registry Keys: []
  50.  
  51. [*] DNS Communications: []
  52.  
  53. [*] Domains: []
  54.  
  55. [*] Network Communication - ICMP: []
  56.  
  57. [*] Network Communication - HTTP: []
  58.  
  59. [*] Network Communication - SMTP: []
  60.  
  61. [*] Network Communication - Hosts: []
  62.  
  63. [*] Network Communication - IRC: []
  64.  
  65. [*] Static Analysis: {
  66. "pe": {
  67. "peid_signatures": null,
  68. "imports": [
  69. {
  70. "imports": [
  71. {
  72. "name": "GetTickCount",
  73. "address": "0x40402c"
  74. },
  75. {
  76. "name": "QueryPerformanceCounter",
  77. "address": "0x404030"
  78. },
  79. {
  80. "name": "IsDebuggerPresent",
  81. "address": "0x404034"
  82. },
  83. {
  84. "name": "SetUnhandledExceptionFilter",
  85. "address": "0x404038"
  86. },
  87. {
  88. "name": "UnhandledExceptionFilter",
  89. "address": "0x40403c"
  90. },
  91. {
  92. "name": "GetCurrentThreadId",
  93. "address": "0x404040"
  94. },
  95. {
  96. "name": "TerminateProcess",
  97. "address": "0x404044"
  98. },
  99. {
  100. "name": "GetStartupInfoA",
  101. "address": "0x404048"
  102. },
  103. {
  104. "name": "InterlockedCompareExchange",
  105. "address": "0x40404c"
  106. },
  107. {
  108. "name": "Sleep",
  109. "address": "0x404050"
  110. },
  111. {
  112. "name": "InterlockedExchange",
  113. "address": "0x404054"
  114. },
  115. {
  116. "name": "GetCurrentProcessId",
  117. "address": "0x404058"
  118. },
  119. {
  120. "name": "LoadLibraryW",
  121. "address": "0x40405c"
  122. },
  123. {
  124. "name": "CreateFileA",
  125. "address": "0x404060"
  126. },
  127. {
  128. "name": "GetFileSize",
  129. "address": "0x404064"
  130. },
  131. {
  132. "name": "CloseHandle",
  133. "address": "0x404068"
  134. },
  135. {
  136. "name": "ReadFile",
  137. "address": "0x40406c"
  138. },
  139. {
  140. "name": "GetModuleHandleW",
  141. "address": "0x404070"
  142. },
  143. {
  144. "name": "GetProcAddress",
  145. "address": "0x404074"
  146. },
  147. {
  148. "name": "GetCurrentProcess",
  149. "address": "0x404078"
  150. },
  151. {
  152. "name": "GetSystemTimeAsFileTime",
  153. "address": "0x40407c"
  154. }
  155. ],
  156. "dll": "KERNEL32.dll"
  157. },
  158. {
  159. "imports": [
  160. {
  161. "name": "CreateWindowExA",
  162. "address": "0x404110"
  163. },
  164. {
  165. "name": "EndDialog",
  166. "address": "0x404114"
  167. },
  168. {
  169. "name": "ReleaseCapture",
  170. "address": "0x404118"
  171. },
  172. {
  173. "name": "DefWindowProcA",
  174. "address": "0x40411c"
  175. },
  176. {
  177. "name": "SetCapture",
  178. "address": "0x404120"
  179. },
  180. {
  181. "name": "EndPaint",
  182. "address": "0x404124"
  183. },
  184. {
  185. "name": "BeginPaint",
  186. "address": "0x404128"
  187. },
  188. {
  189. "name": "SetWindowPos",
  190. "address": "0x40412c"
  191. },
  192. {
  193. "name": "DialogBoxParamA",
  194. "address": "0x404130"
  195. },
  196. {
  197. "name": "InvalidateRect",
  198. "address": "0x404134"
  199. },
  200. {
  201. "name": "ShowCursor",
  202. "address": "0x404138"
  203. },
  204. {
  205. "name": "SetCursor",
  206. "address": "0x40413c"
  207. },
  208. {
  209. "name": "GetMessageA",
  210. "address": "0x404140"
  211. },
  212. {
  213. "name": "TranslateMessage",
  214. "address": "0x404144"
  215. },
  216. {
  217. "name": "DispatchMessageA",
  218. "address": "0x404148"
  219. },
  220. {
  221. "name": "LoadIconA",
  222. "address": "0x40414c"
  223. },
  224. {
  225. "name": "RegisterClassA",
  226. "address": "0x404150"
  227. },
  228. {
  229. "name": "PostQuitMessage",
  230. "address": "0x404154"
  231. },
  232. {
  233. "name": "GetMenu",
  234. "address": "0x404158"
  235. },
  236. {
  237. "name": "DestroyWindow",
  238. "address": "0x40415c"
  239. },
  240. {
  241. "name": "ShowWindow",
  242. "address": "0x404160"
  243. },
  244. {
  245. "name": "UpdateWindow",
  246. "address": "0x404164"
  247. },
  248. {
  249. "name": "MessageBoxA",
  250. "address": "0x404168"
  251. },
  252. {
  253. "name": "GetClientRect",
  254. "address": "0x40416c"
  255. },
  256. {
  257. "name": "GetSystemMetrics",
  258. "address": "0x404170"
  259. },
  260. {
  261. "name": "ClientToScreen",
  262. "address": "0x404174"
  263. },
  264. {
  265. "name": "WindowFromPoint",
  266. "address": "0x404178"
  267. },
  268. {
  269. "name": "GetDlgCtrlID",
  270. "address": "0x40417c"
  271. },
  272. {
  273. "name": "GetParent",
  274. "address": "0x404180"
  275. },
  276. {
  277. "name": "ScreenToClient",
  278. "address": "0x404184"
  279. },
  280. {
  281. "name": "MoveWindow",
  282. "address": "0x404188"
  283. },
  284. {
  285. "name": "GetWindowRect",
  286. "address": "0x40418c"
  287. },
  288. {
  289. "name": "GetDlgItem",
  290. "address": "0x404190"
  291. },
  292. {
  293. "name": "LoadCursorA",
  294. "address": "0x404194"
  295. }
  296. ],
  297. "dll": "USER32.dll"
  298. },
  299. {
  300. "imports": [
  301. {
  302. "name": "CreateCompatibleDC",
  303. "address": "0x404008"
  304. },
  305. {
  306. "name": "SetStretchBltMode",
  307. "address": "0x40400c"
  308. },
  309. {
  310. "name": "GetStockObject",
  311. "address": "0x404010"
  312. },
  313. {
  314. "name": "SetDIBitsToDevice",
  315. "address": "0x404014"
  316. },
  317. {
  318. "name": "StretchDIBits",
  319. "address": "0x404018"
  320. },
  321. {
  322. "name": "CreateDIBitmap",
  323. "address": "0x40401c"
  324. },
  325. {
  326. "name": "SelectObject",
  327. "address": "0x404020"
  328. },
  329. {
  330. "name": "BitBlt",
  331. "address": "0x404024"
  332. }
  333. ],
  334. "dll": "GDI32.dll"
  335. },
  336. {
  337. "imports": [
  338. {
  339. "name": "GetOpenFileNameA",
  340. "address": "0x404000"
  341. }
  342. ],
  343. "dll": "COMDLG32.dll"
  344. },
  345. {
  346. "imports": [
  347. {
  348. "name": "_controlfp_s",
  349. "address": "0x404094"
  350. },
  351. {
  352. "name": "_invoke_watson",
  353. "address": "0x404098"
  354. },
  355. {
  356. "name": "_except_handler4_common",
  357. "address": "0x40409c"
  358. },
  359. {
  360. "name": "_decode_pointer",
  361. "address": "0x4040a0"
  362. },
  363. {
  364. "name": "_onexit",
  365. "address": "0x4040a4"
  366. },
  367. {
  368. "name": "_lock",
  369. "address": "0x4040a8"
  370. },
  371. {
  372. "name": "__dllonexit",
  373. "address": "0x4040ac"
  374. },
  375. {
  376. "name": "_unlock",
  377. "address": "0x4040b0"
  378. },
  379. {
  380. "name": "?terminate@@YAXXZ",
  381. "address": "0x4040b4"
  382. },
  383. {
  384. "name": "_crt_debugger_hook",
  385. "address": "0x4040b8"
  386. },
  387. {
  388. "name": "__set_app_type",
  389. "address": "0x4040bc"
  390. },
  391. {
  392. "name": "_encode_pointer",
  393. "address": "0x4040c0"
  394. },
  395. {
  396. "name": "__p__fmode",
  397. "address": "0x4040c4"
  398. },
  399. {
  400. "name": "__p__commode",
  401. "address": "0x4040c8"
  402. },
  403. {
  404. "name": "_adjust_fdiv",
  405. "address": "0x4040cc"
  406. },
  407. {
  408. "name": "__setusermatherr",
  409. "address": "0x4040d0"
  410. },
  411. {
  412. "name": "rand",
  413. "address": "0x4040d4"
  414. },
  415. {
  416. "name": "malloc",
  417. "address": "0x4040d8"
  418. },
  419. {
  420. "name": "free",
  421. "address": "0x4040dc"
  422. },
  423. {
  424. "name": "_amsg_exit",
  425. "address": "0x4040e0"
  426. },
  427. {
  428. "name": "__getmainargs",
  429. "address": "0x4040e4"
  430. },
  431. {
  432. "name": "_cexit",
  433. "address": "0x4040e8"
  434. },
  435. {
  436. "name": "_exit",
  437. "address": "0x4040ec"
  438. },
  439. {
  440. "name": "_XcptFilter",
  441. "address": "0x4040f0"
  442. },
  443. {
  444. "name": "_ismbblead",
  445. "address": "0x4040f4"
  446. },
  447. {
  448. "name": "exit",
  449. "address": "0x4040f8"
  450. },
  451. {
  452. "name": "_acmdln",
  453. "address": "0x4040fc"
  454. },
  455. {
  456. "name": "_initterm",
  457. "address": "0x404100"
  458. },
  459. {
  460. "name": "_initterm_e",
  461. "address": "0x404104"
  462. },
  463. {
  464. "name": "_configthreadlocale",
  465. "address": "0x404108"
  466. }
  467. ],
  468. "dll": "MSVCR90.dll"
  469. },
  470. {
  471. "imports": [
  472. {
  473. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  474. "address": "0x404084"
  475. },
  476. {
  477. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  478. "address": "0x404088"
  479. },
  480. {
  481. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  482. "address": "0x40408c"
  483. }
  484. ],
  485. "dll": "MSVCP90.dll"
  486. }
  487. ],
  488. "digital_signers": null,
  489. "exported_dll_name": null,
  490. "actual_checksum": "0x0005a4d1",
  491. "overlay": {
  492. "size": "0x0001f850",
  493. "offset": "0x00035800"
  494. },
  495. "imagebase": "0x00400000",
  496. "reported_checksum": "0x00036677",
  497. "icon_hash": null,
  498. "entrypoint": "0x00403477",
  499. "timestamp": "2019-07-02 06:27:52",
  500. "osversion": "5.0",
  501. "sections": [
  502. {
  503. "name": ".text",
  504. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  505. "virtual_address": "0x00001000",
  506. "size_of_data": "0x00002a00",
  507. "entropy": "6.25",
  508. "raw_address": "0x00000400",
  509. "virtual_size": "0x000029be",
  510. "characteristics_raw": "0x60000020"
  511. },
  512. {
  513. "name": ".rdata",
  514. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  515. "virtual_address": "0x00004000",
  516. "size_of_data": "0x00004200",
  517. "entropy": "6.10",
  518. "raw_address": "0x00002e00",
  519. "virtual_size": "0x000040b8",
  520. "characteristics_raw": "0x40000040"
  521. },
  522. {
  523. "name": ".data",
  524. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  525. "virtual_address": "0x00009000",
  526. "size_of_data": "0x00029a00",
  527. "entropy": "8.00",
  528. "raw_address": "0x00007000",
  529. "virtual_size": "0x00029f7c",
  530. "characteristics_raw": "0xc0000040"
  531. },
  532. {
  533. "name": ".rsrc",
  534. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  535. "virtual_address": "0x00033000",
  536. "size_of_data": "0x00004600",
  537. "entropy": "4.27",
  538. "raw_address": "0x00030a00",
  539. "virtual_size": "0x0000449a",
  540. "characteristics_raw": "0x40000040"
  541. },
  542. {
  543. "name": ".reloc",
  544. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  545. "virtual_address": "0x00038000",
  546. "size_of_data": "0x00000800",
  547. "entropy": "5.13",
  548. "raw_address": "0x00035000",
  549. "virtual_size": "0x000007b8",
  550. "characteristics_raw": "0x42000040"
  551. }
  552. ],
  553. "resources": [],
  554. "dirents": [
  555. {
  556. "virtual_address": "0x00000000",
  557. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  558. "size": "0x00000000"
  559. },
  560. {
  561. "virtual_address": "0x0000775c",
  562. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  563. "size": "0x0000008c"
  564. },
  565. {
  566. "virtual_address": "0x00033000",
  567. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  568. "size": "0x0000449a"
  569. },
  570. {
  571. "virtual_address": "0x00000000",
  572. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  573. "size": "0x00000000"
  574. },
  575. {
  576. "virtual_address": "0x00000000",
  577. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  578. "size": "0x00000000"
  579. },
  580. {
  581. "virtual_address": "0x00038000",
  582. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  583. "size": "0x0000052c"
  584. },
  585. {
  586. "virtual_address": "0x00000000",
  587. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  588. "size": "0x00000000"
  589. },
  590. {
  591. "virtual_address": "0x00000000",
  592. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  593. "size": "0x00000000"
  594. },
  595. {
  596. "virtual_address": "0x00000000",
  597. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  598. "size": "0x00000000"
  599. },
  600. {
  601. "virtual_address": "0x00000000",
  602. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  603. "size": "0x00000000"
  604. },
  605. {
  606. "virtual_address": "0x00007690",
  607. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  608. "size": "0x00000040"
  609. },
  610. {
  611. "virtual_address": "0x00000000",
  612. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  613. "size": "0x00000000"
  614. },
  615. {
  616. "virtual_address": "0x00004000",
  617. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  618. "size": "0x0000019c"
  619. },
  620. {
  621. "virtual_address": "0x00000000",
  622. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  623. "size": "0x00000000"
  624. },
  625. {
  626. "virtual_address": "0x00000000",
  627. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  628. "size": "0x00000000"
  629. },
  630. {
  631. "virtual_address": "0x00000000",
  632. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  633. "size": "0x00000000"
  634. }
  635. ],
  636. "exports": [],
  637. "guest_signers": {},
  638. "imphash": "5dc97b038fbb8734c9ececfe3e62c3a2",
  639. "icon_fuzzy": null,
  640. "icon": null,
  641. "pdbpath": null,
  642. "imported_dll_count": 6,
  643. "versioninfo": []
  644. }
  645. }
  646.  
  647. [*] Resolved APIs: []
  648.  
  649. [*] Static Analysis: {
  650. "pe": {
  651. "peid_signatures": null,
  652. "imports": [
  653. {
  654. "imports": [
  655. {
  656. "name": "GetTickCount",
  657. "address": "0x40402c"
  658. },
  659. {
  660. "name": "QueryPerformanceCounter",
  661. "address": "0x404030"
  662. },
  663. {
  664. "name": "IsDebuggerPresent",
  665. "address": "0x404034"
  666. },
  667. {
  668. "name": "SetUnhandledExceptionFilter",
  669. "address": "0x404038"
  670. },
  671. {
  672. "name": "UnhandledExceptionFilter",
  673. "address": "0x40403c"
  674. },
  675. {
  676. "name": "GetCurrentThreadId",
  677. "address": "0x404040"
  678. },
  679. {
  680. "name": "TerminateProcess",
  681. "address": "0x404044"
  682. },
  683. {
  684. "name": "GetStartupInfoA",
  685. "address": "0x404048"
  686. },
  687. {
  688. "name": "InterlockedCompareExchange",
  689. "address": "0x40404c"
  690. },
  691. {
  692. "name": "Sleep",
  693. "address": "0x404050"
  694. },
  695. {
  696. "name": "InterlockedExchange",
  697. "address": "0x404054"
  698. },
  699. {
  700. "name": "GetCurrentProcessId",
  701. "address": "0x404058"
  702. },
  703. {
  704. "name": "LoadLibraryW",
  705. "address": "0x40405c"
  706. },
  707. {
  708. "name": "CreateFileA",
  709. "address": "0x404060"
  710. },
  711. {
  712. "name": "GetFileSize",
  713. "address": "0x404064"
  714. },
  715. {
  716. "name": "CloseHandle",
  717. "address": "0x404068"
  718. },
  719. {
  720. "name": "ReadFile",
  721. "address": "0x40406c"
  722. },
  723. {
  724. "name": "GetModuleHandleW",
  725. "address": "0x404070"
  726. },
  727. {
  728. "name": "GetProcAddress",
  729. "address": "0x404074"
  730. },
  731. {
  732. "name": "GetCurrentProcess",
  733. "address": "0x404078"
  734. },
  735. {
  736. "name": "GetSystemTimeAsFileTime",
  737. "address": "0x40407c"
  738. }
  739. ],
  740. "dll": "KERNEL32.dll"
  741. },
  742. {
  743. "imports": [
  744. {
  745. "name": "CreateWindowExA",
  746. "address": "0x404110"
  747. },
  748. {
  749. "name": "EndDialog",
  750. "address": "0x404114"
  751. },
  752. {
  753. "name": "ReleaseCapture",
  754. "address": "0x404118"
  755. },
  756. {
  757. "name": "DefWindowProcA",
  758. "address": "0x40411c"
  759. },
  760. {
  761. "name": "SetCapture",
  762. "address": "0x404120"
  763. },
  764. {
  765. "name": "EndPaint",
  766. "address": "0x404124"
  767. },
  768. {
  769. "name": "BeginPaint",
  770. "address": "0x404128"
  771. },
  772. {
  773. "name": "SetWindowPos",
  774. "address": "0x40412c"
  775. },
  776. {
  777. "name": "DialogBoxParamA",
  778. "address": "0x404130"
  779. },
  780. {
  781. "name": "InvalidateRect",
  782. "address": "0x404134"
  783. },
  784. {
  785. "name": "ShowCursor",
  786. "address": "0x404138"
  787. },
  788. {
  789. "name": "SetCursor",
  790. "address": "0x40413c"
  791. },
  792. {
  793. "name": "GetMessageA",
  794. "address": "0x404140"
  795. },
  796. {
  797. "name": "TranslateMessage",
  798. "address": "0x404144"
  799. },
  800. {
  801. "name": "DispatchMessageA",
  802. "address": "0x404148"
  803. },
  804. {
  805. "name": "LoadIconA",
  806. "address": "0x40414c"
  807. },
  808. {
  809. "name": "RegisterClassA",
  810. "address": "0x404150"
  811. },
  812. {
  813. "name": "PostQuitMessage",
  814. "address": "0x404154"
  815. },
  816. {
  817. "name": "GetMenu",
  818. "address": "0x404158"
  819. },
  820. {
  821. "name": "DestroyWindow",
  822. "address": "0x40415c"
  823. },
  824. {
  825. "name": "ShowWindow",
  826. "address": "0x404160"
  827. },
  828. {
  829. "name": "UpdateWindow",
  830. "address": "0x404164"
  831. },
  832. {
  833. "name": "MessageBoxA",
  834. "address": "0x404168"
  835. },
  836. {
  837. "name": "GetClientRect",
  838. "address": "0x40416c"
  839. },
  840. {
  841. "name": "GetSystemMetrics",
  842. "address": "0x404170"
  843. },
  844. {
  845. "name": "ClientToScreen",
  846. "address": "0x404174"
  847. },
  848. {
  849. "name": "WindowFromPoint",
  850. "address": "0x404178"
  851. },
  852. {
  853. "name": "GetDlgCtrlID",
  854. "address": "0x40417c"
  855. },
  856. {
  857. "name": "GetParent",
  858. "address": "0x404180"
  859. },
  860. {
  861. "name": "ScreenToClient",
  862. "address": "0x404184"
  863. },
  864. {
  865. "name": "MoveWindow",
  866. "address": "0x404188"
  867. },
  868. {
  869. "name": "GetWindowRect",
  870. "address": "0x40418c"
  871. },
  872. {
  873. "name": "GetDlgItem",
  874. "address": "0x404190"
  875. },
  876. {
  877. "name": "LoadCursorA",
  878. "address": "0x404194"
  879. }
  880. ],
  881. "dll": "USER32.dll"
  882. },
  883. {
  884. "imports": [
  885. {
  886. "name": "CreateCompatibleDC",
  887. "address": "0x404008"
  888. },
  889. {
  890. "name": "SetStretchBltMode",
  891. "address": "0x40400c"
  892. },
  893. {
  894. "name": "GetStockObject",
  895. "address": "0x404010"
  896. },
  897. {
  898. "name": "SetDIBitsToDevice",
  899. "address": "0x404014"
  900. },
  901. {
  902. "name": "StretchDIBits",
  903. "address": "0x404018"
  904. },
  905. {
  906. "name": "CreateDIBitmap",
  907. "address": "0x40401c"
  908. },
  909. {
  910. "name": "SelectObject",
  911. "address": "0x404020"
  912. },
  913. {
  914. "name": "BitBlt",
  915. "address": "0x404024"
  916. }
  917. ],
  918. "dll": "GDI32.dll"
  919. },
  920. {
  921. "imports": [
  922. {
  923. "name": "GetOpenFileNameA",
  924. "address": "0x404000"
  925. }
  926. ],
  927. "dll": "COMDLG32.dll"
  928. },
  929. {
  930. "imports": [
  931. {
  932. "name": "_controlfp_s",
  933. "address": "0x404094"
  934. },
  935. {
  936. "name": "_invoke_watson",
  937. "address": "0x404098"
  938. },
  939. {
  940. "name": "_except_handler4_common",
  941. "address": "0x40409c"
  942. },
  943. {
  944. "name": "_decode_pointer",
  945. "address": "0x4040a0"
  946. },
  947. {
  948. "name": "_onexit",
  949. "address": "0x4040a4"
  950. },
  951. {
  952. "name": "_lock",
  953. "address": "0x4040a8"
  954. },
  955. {
  956. "name": "__dllonexit",
  957. "address": "0x4040ac"
  958. },
  959. {
  960. "name": "_unlock",
  961. "address": "0x4040b0"
  962. },
  963. {
  964. "name": "?terminate@@YAXXZ",
  965. "address": "0x4040b4"
  966. },
  967. {
  968. "name": "_crt_debugger_hook",
  969. "address": "0x4040b8"
  970. },
  971. {
  972. "name": "__set_app_type",
  973. "address": "0x4040bc"
  974. },
  975. {
  976. "name": "_encode_pointer",
  977. "address": "0x4040c0"
  978. },
  979. {
  980. "name": "__p__fmode",
  981. "address": "0x4040c4"
  982. },
  983. {
  984. "name": "__p__commode",
  985. "address": "0x4040c8"
  986. },
  987. {
  988. "name": "_adjust_fdiv",
  989. "address": "0x4040cc"
  990. },
  991. {
  992. "name": "__setusermatherr",
  993. "address": "0x4040d0"
  994. },
  995. {
  996. "name": "rand",
  997. "address": "0x4040d4"
  998. },
  999. {
  1000. "name": "malloc",
  1001. "address": "0x4040d8"
  1002. },
  1003. {
  1004. "name": "free",
  1005. "address": "0x4040dc"
  1006. },
  1007. {
  1008. "name": "_amsg_exit",
  1009. "address": "0x4040e0"
  1010. },
  1011. {
  1012. "name": "__getmainargs",
  1013. "address": "0x4040e4"
  1014. },
  1015. {
  1016. "name": "_cexit",
  1017. "address": "0x4040e8"
  1018. },
  1019. {
  1020. "name": "_exit",
  1021. "address": "0x4040ec"
  1022. },
  1023. {
  1024. "name": "_XcptFilter",
  1025. "address": "0x4040f0"
  1026. },
  1027. {
  1028. "name": "_ismbblead",
  1029. "address": "0x4040f4"
  1030. },
  1031. {
  1032. "name": "exit",
  1033. "address": "0x4040f8"
  1034. },
  1035. {
  1036. "name": "_acmdln",
  1037. "address": "0x4040fc"
  1038. },
  1039. {
  1040. "name": "_initterm",
  1041. "address": "0x404100"
  1042. },
  1043. {
  1044. "name": "_initterm_e",
  1045. "address": "0x404104"
  1046. },
  1047. {
  1048. "name": "_configthreadlocale",
  1049. "address": "0x404108"
  1050. }
  1051. ],
  1052. "dll": "MSVCR90.dll"
  1053. },
  1054. {
  1055. "imports": [
  1056. {
  1057. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1058. "address": "0x404084"
  1059. },
  1060. {
  1061. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  1062. "address": "0x404088"
  1063. },
  1064. {
  1065. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1066. "address": "0x40408c"
  1067. }
  1068. ],
  1069. "dll": "MSVCP90.dll"
  1070. }
  1071. ],
  1072. "digital_signers": null,
  1073. "exported_dll_name": null,
  1074. "actual_checksum": "0x0005a4d1",
  1075. "overlay": {
  1076. "size": "0x0001f850",
  1077. "offset": "0x00035800"
  1078. },
  1079. "imagebase": "0x00400000",
  1080. "reported_checksum": "0x00036677",
  1081. "icon_hash": null,
  1082. "entrypoint": "0x00403477",
  1083. "timestamp": "2019-07-02 06:27:52",
  1084. "osversion": "5.0",
  1085. "sections": [
  1086. {
  1087. "name": ".text",
  1088. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1089. "virtual_address": "0x00001000",
  1090. "size_of_data": "0x00002a00",
  1091. "entropy": "6.25",
  1092. "raw_address": "0x00000400",
  1093. "virtual_size": "0x000029be",
  1094. "characteristics_raw": "0x60000020"
  1095. },
  1096. {
  1097. "name": ".rdata",
  1098. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1099. "virtual_address": "0x00004000",
  1100. "size_of_data": "0x00004200",
  1101. "entropy": "6.10",
  1102. "raw_address": "0x00002e00",
  1103. "virtual_size": "0x000040b8",
  1104. "characteristics_raw": "0x40000040"
  1105. },
  1106. {
  1107. "name": ".data",
  1108. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1109. "virtual_address": "0x00009000",
  1110. "size_of_data": "0x00029a00",
  1111. "entropy": "8.00",
  1112. "raw_address": "0x00007000",
  1113. "virtual_size": "0x00029f7c",
  1114. "characteristics_raw": "0xc0000040"
  1115. },
  1116. {
  1117. "name": ".rsrc",
  1118. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1119. "virtual_address": "0x00033000",
  1120. "size_of_data": "0x00004600",
  1121. "entropy": "4.27",
  1122. "raw_address": "0x00030a00",
  1123. "virtual_size": "0x0000449a",
  1124. "characteristics_raw": "0x40000040"
  1125. },
  1126. {
  1127. "name": ".reloc",
  1128. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1129. "virtual_address": "0x00038000",
  1130. "size_of_data": "0x00000800",
  1131. "entropy": "5.13",
  1132. "raw_address": "0x00035000",
  1133. "virtual_size": "0x000007b8",
  1134. "characteristics_raw": "0x42000040"
  1135. }
  1136. ],
  1137. "resources": [],
  1138. "dirents": [
  1139. {
  1140. "virtual_address": "0x00000000",
  1141. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1142. "size": "0x00000000"
  1143. },
  1144. {
  1145. "virtual_address": "0x0000775c",
  1146. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1147. "size": "0x0000008c"
  1148. },
  1149. {
  1150. "virtual_address": "0x00033000",
  1151. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1152. "size": "0x0000449a"
  1153. },
  1154. {
  1155. "virtual_address": "0x00000000",
  1156. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1157. "size": "0x00000000"
  1158. },
  1159. {
  1160. "virtual_address": "0x00000000",
  1161. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1162. "size": "0x00000000"
  1163. },
  1164. {
  1165. "virtual_address": "0x00038000",
  1166. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1167. "size": "0x0000052c"
  1168. },
  1169. {
  1170. "virtual_address": "0x00000000",
  1171. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1172. "size": "0x00000000"
  1173. },
  1174. {
  1175. "virtual_address": "0x00000000",
  1176. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1177. "size": "0x00000000"
  1178. },
  1179. {
  1180. "virtual_address": "0x00000000",
  1181. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1182. "size": "0x00000000"
  1183. },
  1184. {
  1185. "virtual_address": "0x00000000",
  1186. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1187. "size": "0x00000000"
  1188. },
  1189. {
  1190. "virtual_address": "0x00007690",
  1191. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1192. "size": "0x00000040"
  1193. },
  1194. {
  1195. "virtual_address": "0x00000000",
  1196. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1197. "size": "0x00000000"
  1198. },
  1199. {
  1200. "virtual_address": "0x00004000",
  1201. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1202. "size": "0x0000019c"
  1203. },
  1204. {
  1205. "virtual_address": "0x00000000",
  1206. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1207. "size": "0x00000000"
  1208. },
  1209. {
  1210. "virtual_address": "0x00000000",
  1211. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1212. "size": "0x00000000"
  1213. },
  1214. {
  1215. "virtual_address": "0x00000000",
  1216. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1217. "size": "0x00000000"
  1218. }
  1219. ],
  1220. "exports": [],
  1221. "guest_signers": {},
  1222. "imphash": "5dc97b038fbb8734c9ececfe3e62c3a2",
  1223. "icon_fuzzy": null,
  1224. "icon": null,
  1225. "pdbpath": null,
  1226. "imported_dll_count": 6,
  1227. "versioninfo": []
  1228. }
  1229. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!