API tools faq
paste
paladin316

fservice_exe_2019-07-01_05_30.json

paladin316
Jul 1st, 2019
2,279
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 52.56 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Prorat"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "fservice.exe"
  7. [*] File Size: 350764
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  9. [*] SHA256: "a87e93161d82238e9ed10a82eddc4fadb74c1f42c0ac0329f8e78342a5c9c92b"
  10. [*] MD5: "39b052bbdb9934e2f6395301b66669b1"
  11. [*] SHA1: "4b28e0112a4a08abb59462efcd4d1a8ea63038e8"
  12. [*] SHA512: "78d74ca9a98cf8ad1375303cc05eee669e69332b54511a3a856954ff90a5be24209d1f728dc8a12dfdc4896ba95e7037a2dc6e7a7ab352ba1185dc40a9a529a3"
  13. [*] CRC32: "BAAAFCD9"
  14. [*] SSDEEP: "6144:ERqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4y1QPC:wqmpplpGoGL3etQoMiXM8gxf/Sj4yQC"
  15.  
  16. [*] Process Execution: [
  17. "fservice.exe",
  18. "fservice.exe",
  19. "services.exe",
  20. "net.exe",
  21. "net1.exe",
  22. "net.exe",
  23. "net1.exe",
  24. "cmd.exe"
  25. ]
  26.  
  27. [*] Signatures Detected: [
  28. {
  29. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  30. "Details": [
  31. {
  32. "IP": "74.6.137.63:25"
  33. }
  34. ]
  35. },
  36. {
  37. "Description": "Creates RWX memory",
  38. "Details": []
  39. },
  40. {
  41. "Description": "Starts servers listening on 0.0.0.0:5110, 0.0.0.0:5112, 0.0.0.0:51100",
  42. "Details": []
  43. },
  44. {
  45. "Description": "Expresses interest in specific running processes",
  46. "Details": [
  47. {
  48. "process": "armsvc.exe"
  49. }
  50. ]
  51. },
  52. {
  53. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  54. "Details": []
  55. },
  56. {
  57. "Description": "Reads data out of its own binary image",
  58. "Details": [
  59. {
  60. "self_read": "process: services.exe, pid: 1828, offset: 0x00000000, length: 0x00055a00"
  61. }
  62. ]
  63. },
  64. {
  65. "Description": "Drops a binary and executes it",
  66. "Details": [
  67. {
  68. "binary": "C:\\Windows\\services.exe"
  69. }
  70. ]
  71. },
  72. {
  73. "Description": "The binary likely contains encrypted or compressed data.",
  74. "Details": [
  75. {
  76. "section": "name: UPX1, entropy: 7.91, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00054800, virtual_size: 0x00055000"
  77. }
  78. ]
  79. },
  80. {
  81. "Description": "The executable is compressed using UPX",
  82. "Details": [
  83. {
  84. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x001a5000"
  85. }
  86. ]
  87. },
  88. {
  89. "Description": "Sniffs keystrokes",
  90. "Details": [
  91. {
  92. "SetWindowsHookExA": "Process: services.exe(1828)"
  93. }
  94. ]
  95. },
  96. {
  97. "Description": "Deletes its original binary from disk",
  98. "Details": []
  99. },
  100. {
  101. "Description": "Attempts to stop active services",
  102. "Details": [
  103. {
  104. "servicename": "wscsvc"
  105. },
  106. {
  107. "servicename": "SharedAccess"
  108. }
  109. ]
  110. },
  111. {
  112. "Description": "Installs itself for autorun at Windows startup",
  113. "Details": [
  114. {
  115. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\DirectX For Microsoft\\xef\\xbe\\xae Windows"
  116. },
  117. {
  118. "data": "C:\\Windows\\system32\\fservice.exe"
  119. },
  120. {
  121. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Active Setup\\Installed Components\\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\\StubPath"
  122. },
  123. {
  124. "data": "C:\\Windows\\system\\sservice.exe"
  125. },
  126. {
  127. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}"
  128. },
  129. {
  130. "data": "unknown"
  131. },
  132. {
  133. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
  134. },
  135. {
  136. "data": "Explorer.exe C:\\Windows\\system32\\fservice.exe"
  137. }
  138. ]
  139. },
  140. {
  141. "Description": "Creates a hidden or system file",
  142. "Details": [
  143. {
  144. "file": "C:\\Windows\\System32\\fservice.exe"
  145. },
  146. {
  147. "file": "C:\\Windows\\system\\sservice.exe"
  148. },
  149. {
  150. "file": "C:\\Windows\\services.exe"
  151. }
  152. ]
  153. },
  154. {
  155. "Description": "Likely virus infection of existing system binary",
  156. "Details": [
  157. {
  158. "file": "c:\\windows\\system32\\fservice.exe"
  159. },
  160. {
  161. "file": "c:\\windows\\system\\sservice.exe"
  162. }
  163. ]
  164. },
  165. {
  166. "Description": "File has been identified by 38 Antiviruses on VirusTotal as malicious",
  167. "Details": [
  168. {
  169. "nProtect": "Backdoor/W32.Prorat.350764.G"
  170. },
  171. {
  172. "CAT-QuickHeal": "Backdoor.Prorat.19.i"
  173. },
  174. {
  175. "McAfee": "BackDoor-AVW"
  176. },
  177. {
  178. "VirusBuster": "Backdoor.Prorat.AR1"
  179. },
  180. {
  181. "NOD32": "Win32/Prorat.19"
  182. },
  183. {
  184. "F-Prot": "W32/ProratP.A"
  185. },
  186. {
  187. "Symantec": "Trojan Horse"
  188. },
  189. {
  190. "Norman": "Prorat.gen1"
  191. },
  192. {
  193. "TrendMicro-HouseCall": "BKDR_PRORAT.MF"
  194. },
  195. {
  196. "Avast": "Win32:Prorat-IR"
  197. },
  198. {
  199. "ClamAV": "Trojan.Prorat.19-55"
  200. },
  201. {
  202. "Kaspersky": "Backdoor.Win32.Prorat.19.i"
  203. },
  204. {
  205. "BitDefender": "Backdoor.Generic.80083"
  206. },
  207. {
  208. "Emsisoft": "Backdoor.Win32.Prorat!IK"
  209. },
  210. {
  211. "Comodo": "Backdoor.Win32.Agent.AVW85"
  212. },
  213. {
  214. "F-Secure": "Backdoor:W32/Prorat.GS"
  215. },
  216. {
  217. "DrWeb": "BackDoor.ProRat.2087"
  218. },
  219. {
  220. "AntiVir": "BDS/Prorat.19.I"
  221. },
  222. {
  223. "TrendMicro": "BKDR_PRORAT.MF"
  224. },
  225. {
  226. "McAfee-GW-Edition": "Heuristic.BehavesLike.Win32.Packed.A"
  227. },
  228. {
  229. "Sophos": "Troj/Prorat-19"
  230. },
  231. {
  232. "eTrust-Vet": "Win32/ProRat.L"
  233. },
  234. {
  235. "Authentium": "W32/ProratP.A"
  236. },
  237. {
  238. "Jiangmin": "Backdoor/Prorat.19.at"
  239. },
  240. {
  241. "Microsoft": "Backdoor:Win32/Prorat.L"
  242. },
  243. {
  244. "ViRobot": "Backdoor.Win32.Prorat.350764.I"
  245. },
  246. {
  247. "Prevx": "High Risk Cloaked Malware"
  248. },
  249. {
  250. "GData": "Backdoor.Generic.80083"
  251. },
  252. {
  253. "AhnLab-V3": "Win-Trojan/Prorat.350764.C"
  254. },
  255. {
  256. "VBA32": "Backdoor.Win32.VB.aoi"
  257. },
  258. {
  259. "Sunbelt": "BehavesLike.Win32.Malware (v)"
  260. },
  261. {
  262. "PCTools": "Trojan.Generic"
  263. },
  264. {
  265. "Rising": "Backdoor.ProRat.19.iv"
  266. },
  267. {
  268. "Ikarus": "Backdoor.Win32.Prorat"
  269. },
  270. {
  271. "Fortinet": "W32/Prorat.I!tr.bdr"
  272. },
  273. {
  274. "AVG": "BackDoor.Generic3.AWU"
  275. },
  276. {
  277. "Panda": "Bck/Prorat.X"
  278. },
  279. {
  280. "Avast5": "Win32:Prorat-IR"
  281. }
  282. ]
  283. },
  284. {
  285. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  286. "Details": [
  287. {
  288. "target": "clamav:Win.Trojan.Prorat-37, sha256:a87e93161d82238e9ed10a82eddc4fadb74c1f42c0ac0329f8e78342a5c9c92b, type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  289. },
  290. {
  291. "dropped": "clamav:Win.Trojan.Prorat-52, sha256:45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f , guest_paths:C:\\Windows\\System32\\winkey.dll, type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  292. },
  293. {
  294. "dropped": "clamav:Win.Trojan.Prorat-284, sha256:c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6 , guest_paths:C:\\Windows\\System32\\reginv.dll, type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  295. },
  296. {
  297. "dropped": "clamav:Win.Trojan.Prorat-37, sha256:a87e93161d82238e9ed10a82eddc4fadb74c1f42c0ac0329f8e78342a5c9c92b , guest_paths:C:\\Windows\\System32\\fservice.exe*C:\\Windows\\system\\sservice.exe*C:\\Windows\\services.exe, type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  298. }
  299. ]
  300. },
  301. {
  302. "Description": "Creates a copy of itself",
  303. "Details": [
  304. {
  305. "copy": "C:\\Windows\\System32\\fservice.exe"
  306. },
  307. {
  308. "copy": "C:\\Windows\\system\\sservice.exe"
  309. },
  310. {
  311. "copy": "C:\\Windows\\services.exe"
  312. }
  313. ]
  314. }
  315. ]
  316.  
  317. [*] Started Service: []
  318.  
  319. [*] Executed Commands: [
  320. "C:\\Windows\\system32\\fservice.exe",
  321. "C:\\Users\\user\\AppData\\Local\\Temp\\fservice.exe.bat",
  322. "C:\\Windows\\services.exe -XP",
  323. "NET STOP srservice",
  324. "NET STOP navapsvc",
  325. "C:\\Windows\\system32\\net1 STOP srservice",
  326. "C:\\Windows\\system32\\net1 STOP navapsvc"
  327. ]
  328.  
  329. [*] Mutexes: [
  330. "CicLoadWinStaWinSta0",
  331. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  332. "DBWinMutex"
  333. ]
  334.  
  335. [*] Modified Files: [
  336. "C:\\Windows\\System32\\fservice.exe",
  337. "C:\\Windows\\system\\sservice.exe",
  338. "C:\\Users\\user\\AppData\\Local\\Temp\\fservice.exe.bat",
  339. "C:\\Windows\\services.exe",
  340. "C:\\Windows\\System32\\winkey.dll",
  341. "\\Device\\Afd\\AsyncSelectHlp",
  342. "C:\\Windows\\System32\\reginv.dll"
  343. ]
  344.  
  345. [*] Deleted Files: [
  346. "C:\\Windows\\System32\\fservice.exe",
  347. "C:\\Windows\\system\\sservice.exe",
  348. "C:\\Windows\\services.exe",
  349. "C:\\Windows\\Pplugin4.exe",
  350. "C:\\Windows\\Pplugin8.exe",
  351. "C:\\Windows\\Pplugin10xa.exe",
  352. "C:\\Windows\\eimsn.exe",
  353. "C:\\Windows\\winp9.exe",
  354. "C:\\Windows\\PpluginCd.dll",
  355. "C:\\Users\\user\\AppData\\Local\\Temp\\fservice.exe",
  356. "C:\\Users\\user\\AppData\\Local\\Temp\\fservice.exe.bat"
  357. ]
  358.  
  359. [*] Modified Registry Keys: [
  360. "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings",
  361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Bulas",
  362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\FW_KILL",
  363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\XP_FW_Disable",
  364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\XP_SYS_Recovery",
  365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\ICQ_UIN",
  366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\ICQ_UIN2",
  367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Kurban_Ismi",
  368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Mail",
  369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Online_List",
  370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Port",
  371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Sifre",
  372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Hata",
  373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\KSil",
  374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\LanNotifie",
  375. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer\\Run",
  376. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\DirectX For Microsoft\\xef\\xbe\\xae Windows",
  377. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}",
  378. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Active Setup\\Installed Components\\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\\StubPath",
  379. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
  380. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\srservice",
  381. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\srservice\\Start",
  382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Tport",
  383. "Start",
  384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\ServerVersionInt"
  385. ]
  386.  
  387. [*] Deleted Registry Keys: []
  388.  
  389. [*] DNS Communications: [
  390. {
  391. "type": "A",
  392. "request": "proend.ifrance.com",
  393. "answers": []
  394. },
  395. {
  396. "type": "MX",
  397. "request": "yahoo.com",
  398. "answers": [
  399. {
  400. "data": "mta5.am0.yahoodns.net",
  401. "type": "MX"
  402. },
  403. {
  404. "data": "mta7.am0.yahoodns.net",
  405. "type": "MX"
  406. },
  407. {
  408. "data": "mta6.am0.yahoodns.net",
  409. "type": "MX"
  410. }
  411. ]
  412. },
  413. {
  414. "type": "A",
  415. "request": "mta7.am0.yahoodns.net",
  416. "answers": [
  417. {
  418. "data": "67.195.228.94",
  419. "type": "A"
  420. },
  421. {
  422. "data": "66.218.85.139",
  423. "type": "A"
  424. },
  425. {
  426. "data": "67.195.228.106",
  427. "type": "A"
  428. },
  429. {
  430. "data": "74.6.137.63",
  431. "type": "A"
  432. },
  433. {
  434. "data": "98.137.159.25",
  435. "type": "A"
  436. },
  437. {
  438. "data": "98.137.159.24",
  439. "type": "A"
  440. },
  441. {
  442. "data": "98.137.159.28",
  443. "type": "A"
  444. },
  445. {
  446. "data": "66.218.85.52",
  447. "type": "A"
  448. }
  449. ]
  450. }
  451. ]
  452.  
  453. [*] Domains: [
  454. {
  455. "ip": "",
  456. "domain": "proend.ifrance.com"
  457. },
  458. {
  459. "ip": "98.138.219.232",
  460. "domain": "yahoo.com"
  461. },
  462. {
  463. "ip": "74.6.137.64",
  464. "domain": "mta7.am0.yahoodns.net"
  465. }
  466. ]
  467.  
  468. [*] Network Communication - ICMP: []
  469.  
  470. [*] Network Communication - HTTP: []
  471.  
  472. [*] Network Communication - SMTP: []
  473.  
  474. [*] Network Communication - Hosts: []
  475.  
  476. [*] Network Communication - IRC: []
  477.  
  478. [*] Static Analysis: {
  479. "pe": {
  480. "peid_signatures": null,
  481. "imports": [
  482. {
  483. "imports": [
  484. {
  485. "name": "LoadLibraryA",
  486. "address": "0x5fbbfc"
  487. },
  488. {
  489. "name": "GetProcAddress",
  490. "address": "0x5fbc00"
  491. },
  492. {
  493. "name": "ExitProcess",
  494. "address": "0x5fbc04"
  495. }
  496. ],
  497. "dll": "KERNEL32.DLL"
  498. },
  499. {
  500. "imports": [
  501. {
  502. "name": "RegCloseKey",
  503. "address": "0x5fbc0c"
  504. }
  505. ],
  506. "dll": "ADVAPI32.DLL"
  507. },
  508. {
  509. "imports": [
  510. {
  511. "name": "capCreateCaptureWindowA",
  512. "address": "0x5fbc14"
  513. }
  514. ],
  515. "dll": "AVICAP32.DLL"
  516. },
  517. {
  518. "imports": [
  519. {
  520. "name": "ImageList_Add",
  521. "address": "0x5fbc1c"
  522. }
  523. ],
  524. "dll": "COMCTL32.DLL"
  525. },
  526. {
  527. "imports": [
  528. {
  529. "name": "BitBlt",
  530. "address": "0x5fbc24"
  531. }
  532. ],
  533. "dll": "GDI32.DLL"
  534. },
  535. {
  536. "imports": [
  537. {
  538. "name": "IsEqualGUID",
  539. "address": "0x5fbc2c"
  540. }
  541. ],
  542. "dll": "OLE32.DLL"
  543. },
  544. {
  545. "imports": [
  546. {
  547. "name": "SysStringLen",
  548. "address": "0x5fbc34"
  549. }
  550. ],
  551. "dll": "OLEAUT32.DLL"
  552. },
  553. {
  554. "imports": [
  555. {
  556. "name": "ShellExecuteA",
  557. "address": "0x5fbc3c"
  558. }
  559. ],
  560. "dll": "SHELL32.DLL"
  561. },
  562. {
  563. "imports": [
  564. {
  565. "name": "URLDownloadToFileA",
  566. "address": "0x5fbc44"
  567. }
  568. ],
  569. "dll": "URLMON.DLL"
  570. },
  571. {
  572. "imports": [
  573. {
  574. "name": "GetDC",
  575. "address": "0x5fbc4c"
  576. }
  577. ],
  578. "dll": "USER32.DLL"
  579. },
  580. {
  581. "imports": [
  582. {
  583. "name": "timeGetTime",
  584. "address": "0x5fbc54"
  585. }
  586. ],
  587. "dll": "WINMM.DLL"
  588. },
  589. {
  590. "imports": [
  591. {
  592. "name": "ClosePrinter",
  593. "address": "0x5fbc5c"
  594. }
  595. ],
  596. "dll": "WINSPOOL.DRV"
  597. },
  598. {
  599. "imports": [
  600. {
  601. "name": "WSACloseEvent",
  602. "address": "0x5fbc64"
  603. }
  604. ],
  605. "dll": "WS2_32.DLL"
  606. },
  607. {
  608. "imports": [
  609. {
  610. "name": "bind",
  611. "address": "0x5fbc6c"
  612. }
  613. ],
  614. "dll": "WSOCK32.DLL"
  615. }
  616. ],
  617. "digital_signers": null,
  618. "exported_dll_name": null,
  619. "actual_checksum": "0x00061241",
  620. "overlay": {
  621. "size": "0x0000002c",
  622. "offset": "0x00055a00"
  623. },
  624. "imagebase": "0x00400000",
  625. "reported_checksum": "0x00000000",
  626. "icon_hash": null,
  627. "entrypoint": "0x005fa490",
  628. "timestamp": "2004-11-19 12:19:18",
  629. "osversion": "4.0",
  630. "sections": [
  631. {
  632. "name": "UPX0",
  633. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  634. "virtual_address": "0x00001000",
  635. "size_of_data": "0x00000000",
  636. "entropy": "0.00",
  637. "raw_address": "0x00000400",
  638. "virtual_size": "0x001a5000",
  639. "characteristics_raw": "0xe0000080"
  640. },
  641. {
  642. "name": "UPX1",
  643. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  644. "virtual_address": "0x001a6000",
  645. "size_of_data": "0x00054800",
  646. "entropy": "7.91",
  647. "raw_address": "0x00000400",
  648. "virtual_size": "0x00055000",
  649. "characteristics_raw": "0xe0000040"
  650. },
  651. {
  652. "name": ".rsrc",
  653. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  654. "virtual_address": "0x001fb000",
  655. "size_of_data": "0x00000e00",
  656. "entropy": "2.83",
  657. "raw_address": "0x00054c00",
  658. "virtual_size": "0x00001000",
  659. "characteristics_raw": "0xc0000040"
  660. }
  661. ],
  662. "resources": [],
  663. "dirents": [
  664. {
  665. "virtual_address": "0x001e2000",
  666. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  667. "size": "0x00007408"
  668. },
  669. {
  670. "virtual_address": "0x001fbad0",
  671. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  672. "size": "0x00000328"
  673. },
  674. {
  675. "virtual_address": "0x001fb000",
  676. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  677. "size": "0x00000ad0"
  678. },
  679. {
  680. "virtual_address": "0x00000000",
  681. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  682. "size": "0x00000000"
  683. },
  684. {
  685. "virtual_address": "0x00000000",
  686. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  687. "size": "0x00000000"
  688. },
  689. {
  690. "virtual_address": "0x00000000",
  691. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  692. "size": "0x00000000"
  693. },
  694. {
  695. "virtual_address": "0x00000000",
  696. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  697. "size": "0x00000000"
  698. },
  699. {
  700. "virtual_address": "0x00000000",
  701. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  702. "size": "0x00000000"
  703. },
  704. {
  705. "virtual_address": "0x00000000",
  706. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  707. "size": "0x00000000"
  708. },
  709. {
  710. "virtual_address": "0x001fa60c",
  711. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  712. "size": "0x00000018"
  713. },
  714. {
  715. "virtual_address": "0x00000000",
  716. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  717. "size": "0x00000000"
  718. },
  719. {
  720. "virtual_address": "0x00000000",
  721. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  722. "size": "0x00000000"
  723. },
  724. {
  725. "virtual_address": "0x00000000",
  726. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  727. "size": "0x00000000"
  728. },
  729. {
  730. "virtual_address": "0x00000000",
  731. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  732. "size": "0x00000000"
  733. },
  734. {
  735. "virtual_address": "0x00000000",
  736. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  737. "size": "0x00000000"
  738. },
  739. {
  740. "virtual_address": "0x00000000",
  741. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  742. "size": "0x00000000"
  743. }
  744. ],
  745. "exports": [],
  746. "guest_signers": {},
  747. "imphash": "9612c82b4c865e0bf6797463aa91292a",
  748. "icon_fuzzy": null,
  749. "icon": null,
  750. "pdbpath": null,
  751. "imported_dll_count": 14,
  752. "versioninfo": []
  753. }
  754. }
  755.  
  756. [*] Resolved APIs: [
  757. "kernel32.dll.CloseHandle",
  758. "kernel32.dll.CompareStringA",
  759. "kernel32.dll.CopyFileA",
  760. "kernel32.dll.CreateDirectoryA",
  761. "kernel32.dll.CreateEventA",
  762. "kernel32.dll.CreateFileA",
  763. "kernel32.dll.CreateFileMappingA",
  764. "kernel32.dll.CreatePipe",
  765. "kernel32.dll.CreateProcessA",
  766. "kernel32.dll.CreateThread",
  767. "kernel32.dll.CreateToolhelp32Snapshot",
  768. "kernel32.dll.DeleteCriticalSection",
  769. "kernel32.dll.DeleteFileA",
  770. "kernel32.dll.EnterCriticalSection",
  771. "kernel32.dll.EnumCalendarInfoA",
  772. "kernel32.dll.ExitProcess",
  773. "kernel32.dll.ExitThread",
  774. "kernel32.dll.FileTimeToDosDateTime",
  775. "kernel32.dll.FileTimeToLocalFileTime",
  776. "kernel32.dll.FindClose",
  777. "kernel32.dll.FindFirstFileA",
  778. "kernel32.dll.FindNextFileA",
  779. "kernel32.dll.FindResourceA",
  780. "kernel32.dll.FormatMessageA",
  781. "kernel32.dll.FreeLibrary",
  782. "kernel32.dll.FreeResource",
  783. "kernel32.dll.GetACP",
  784. "kernel32.dll.GetCPInfo",
  785. "kernel32.dll.GetCommandLineA",
  786. "kernel32.dll.GetComputerNameA",
  787. "kernel32.dll.GetCurrentProcess",
  788. "kernel32.dll.GetCurrentProcessId",
  789. "kernel32.dll.GetCurrentThread",
  790. "kernel32.dll.GetCurrentThreadId",
  791. "kernel32.dll.GetDateFormatA",
  792. "kernel32.dll.GetDiskFreeSpaceA",
  793. "kernel32.dll.GetDriveTypeA",
  794. "kernel32.dll.GetEnvironmentStrings",
  795. "kernel32.dll.GetExitCodeThread",
  796. "kernel32.dll.GetFileAttributesA",
  797. "kernel32.dll.GetFileSize",
  798. "kernel32.dll.GetFileType",
  799. "kernel32.dll.GetLastError",
  800. "kernel32.dll.GetLocalTime",
  801. "kernel32.dll.GetLocaleInfoA",
  802. "kernel32.dll.GetModuleFileNameA",
  803. "kernel32.dll.GetModuleHandleA",
  804. "kernel32.dll.GetOEMCP",
  805. "kernel32.dll.GetPrivateProfileStringA",
  806. "kernel32.dll.GetProcAddress",
  807. "kernel32.dll.GetProcessHeap",
  808. "kernel32.dll.GetProfileStringA",
  809. "kernel32.dll.GetShortPathNameA",
  810. "kernel32.dll.GetStartupInfoA",
  811. "kernel32.dll.GetStdHandle",
  812. "kernel32.dll.GetStringTypeA",
  813. "kernel32.dll.GetStringTypeW",
  814. "kernel32.dll.GetSystemDefaultLangID",
  815. "kernel32.dll.GetSystemDirectoryA",
  816. "kernel32.dll.GetSystemInfo",
  817. "kernel32.dll.GetSystemTime",
  818. "kernel32.dll.GetTempPathA",
  819. "kernel32.dll.GetThreadLocale",
  820. "kernel32.dll.GetTickCount",
  821. "kernel32.dll.GetTimeZoneInformation",
  822. "kernel32.dll.GetUserDefaultLCID",
  823. "kernel32.dll.GetVersion",
  824. "kernel32.dll.GetVersionExA",
  825. "kernel32.dll.GetWindowsDirectoryA",
  826. "kernel32.dll.GlobalAddAtomA",
  827. "kernel32.dll.GlobalAlloc",
  828. "kernel32.dll.GlobalDeleteAtom",
  829. "kernel32.dll.GlobalFree",
  830. "kernel32.dll.GlobalHandle",
  831. "kernel32.dll.GlobalLock",
  832. "kernel32.dll.GlobalReAlloc",
  833. "kernel32.dll.GlobalUnlock",
  834. "kernel32.dll.HeapAlloc",
  835. "kernel32.dll.HeapFree",
  836. "kernel32.dll.InitializeCriticalSection",
  837. "kernel32.dll.InterlockedDecrement",
  838. "kernel32.dll.InterlockedIncrement",
  839. "kernel32.dll.IsValidLocale",
  840. "kernel32.dll.LCMapStringA",
  841. "kernel32.dll.LeaveCriticalSection",
  842. "kernel32.dll.LoadLibraryA",
  843. "kernel32.dll.LoadLibraryExA",
  844. "kernel32.dll.LoadResource",
  845. "kernel32.dll.LocalAlloc",
  846. "kernel32.dll.LocalFree",
  847. "kernel32.dll.LockResource",
  848. "kernel32.dll.MapViewOfFile",
  849. "kernel32.dll.MoveFileA",
  850. "kernel32.dll.MulDiv",
  851. "kernel32.dll.MultiByteToWideChar",
  852. "kernel32.dll.OpenProcess",
  853. "kernel32.dll.Process32First",
  854. "kernel32.dll.Process32Next",
  855. "kernel32.dll.RaiseException",
  856. "kernel32.dll.ReadFile",
  857. "kernel32.dll.RemoveDirectoryA",
  858. "kernel32.dll.ResetEvent",
  859. "kernel32.dll.ResumeThread",
  860. "kernel32.dll.RtlUnwind",
  861. "kernel32.dll.SetConsoleCtrlHandler",
  862. "kernel32.dll.SetCurrentDirectoryA",
  863. "kernel32.dll.SetEndOfFile",
  864. "kernel32.dll.SetErrorMode",
  865. "kernel32.dll.SetEvent",
  866. "kernel32.dll.SetFileAttributesA",
  867. "kernel32.dll.SetFilePointer",
  868. "kernel32.dll.SetHandleCount",
  869. "kernel32.dll.SetLastError",
  870. "kernel32.dll.SetSystemTime",
  871. "kernel32.dll.SetThreadLocale",
  872. "kernel32.dll.SetThreadPriority",
  873. "kernel32.dll.SizeofResource",
  874. "kernel32.dll.Sleep",
  875. "kernel32.dll.TerminateProcess",
  876. "kernel32.dll.TlsAlloc",
  877. "kernel32.dll.TlsFree",
  878. "kernel32.dll.TlsGetValue",
  879. "kernel32.dll.TlsSetValue",
  880. "kernel32.dll.UnhandledExceptionFilter",
  881. "kernel32.dll.UnmapViewOfFile",
  882. "kernel32.dll.VerLanguageNameA",
  883. "kernel32.dll.VirtualAlloc",
  884. "kernel32.dll.VirtualFree",
  885. "kernel32.dll.VirtualQuery",
  886. "kernel32.dll.WaitForMultipleObjects",
  887. "kernel32.dll.WaitForSingleObject",
  888. "kernel32.dll.WideCharToMultiByte",
  889. "kernel32.dll.WinExec",
  890. "kernel32.dll.WriteFile",
  891. "kernel32.dll.WritePrivateProfileStringA",
  892. "kernel32.dll.WriteProcessMemory",
  893. "kernel32.dll.lstrcatA",
  894. "kernel32.dll.lstrcmpA",
  895. "kernel32.dll.lstrcpyA",
  896. "kernel32.dll.lstrcpynA",
  897. "kernel32.dll.lstrlenA",
  898. "advapi32.dll.AdjustTokenPrivileges",
  899. "advapi32.dll.ChangeServiceConfigA",
  900. "advapi32.dll.CloseServiceHandle",
  901. "advapi32.dll.ControlService",
  902. "advapi32.dll.DeleteService",
  903. "advapi32.dll.EnumServicesStatusA",
  904. "advapi32.dll.GetUserNameA",
  905. "advapi32.dll.LookupPrivilegeValueA",
  906. "advapi32.dll.OpenProcessToken",
  907. "advapi32.dll.OpenSCManagerA",
  908. "advapi32.dll.OpenServiceA",
  909. "advapi32.dll.OpenThreadToken",
  910. "advapi32.dll.QueryServiceConfigA",
  911. "advapi32.dll.RegCloseKey",
  912. "advapi32.dll.RegCreateKeyExA",
  913. "advapi32.dll.RegDeleteKeyA",
  914. "advapi32.dll.RegDeleteValueA",
  915. "advapi32.dll.RegEnumKeyExA",
  916. "advapi32.dll.RegEnumValueA",
  917. "advapi32.dll.RegFlushKey",
  918. "advapi32.dll.RegOpenKeyExA",
  919. "advapi32.dll.RegQueryInfoKeyA",
  920. "advapi32.dll.RegQueryValueExA",
  921. "advapi32.dll.RegSetValueExA",
  922. "advapi32.dll.StartServiceA",
  923. "avicap32.dll.capCreateCaptureWindowA",
  924. "comctl32.dll.ImageList_Add",
  925. "comctl32.dll.ImageList_BeginDrag",
  926. "comctl32.dll.ImageList_Create",
  927. "comctl32.dll.ImageList_Destroy",
  928. "comctl32.dll.ImageList_DragEnter",
  929. "comctl32.dll.ImageList_DragLeave",
  930. "comctl32.dll.ImageList_DragMove",
  931. "comctl32.dll.ImageList_DragShowNolock",
  932. "comctl32.dll.ImageList_Draw",
  933. "comctl32.dll.ImageList_EndDrag",
  934. "comctl32.dll.ImageList_GetBkColor",
  935. "comctl32.dll.ImageList_GetDragImage",
  936. "comctl32.dll.ImageList_GetIconSize",
  937. "comctl32.dll.ImageList_GetImageCount",
  938. "comctl32.dll.ImageList_Read",
  939. "comctl32.dll.ImageList_Remove",
  940. "comctl32.dll.ImageList_ReplaceIcon",
  941. "comctl32.dll.ImageList_SetBkColor",
  942. "comctl32.dll.ImageList_SetDragCursorImage",
  943. "comctl32.dll.ImageList_SetIconSize",
  944. "comctl32.dll.ImageList_Write",
  945. "comctl32.dll.ImageList_DrawEx",
  946. "gdi32.dll.BitBlt",
  947. "gdi32.dll.CopyEnhMetaFileA",
  948. "gdi32.dll.CreateBitmap",
  949. "gdi32.dll.CreateBrushIndirect",
  950. "gdi32.dll.CreateCompatibleBitmap",
  951. "gdi32.dll.CreateCompatibleDC",
  952. "gdi32.dll.CreateDCA",
  953. "gdi32.dll.CreateDIBSection",
  954. "gdi32.dll.CreateDIBitmap",
  955. "gdi32.dll.CreateFontIndirectA",
  956. "gdi32.dll.CreateHalftonePalette",
  957. "gdi32.dll.CreateICA",
  958. "gdi32.dll.CreatePalette",
  959. "gdi32.dll.CreatePenIndirect",
  960. "gdi32.dll.CreateSolidBrush",
  961. "gdi32.dll.DeleteDC",
  962. "gdi32.dll.DeleteEnhMetaFile",
  963. "gdi32.dll.DeleteObject",
  964. "gdi32.dll.Ellipse",
  965. "gdi32.dll.EndDoc",
  966. "gdi32.dll.EndPage",
  967. "gdi32.dll.ExcludeClipRect",
  968. "gdi32.dll.ExtTextOutA",
  969. "gdi32.dll.GdiFlush",
  970. "gdi32.dll.GetBitmapBits",
  971. "gdi32.dll.GetBrushOrgEx",
  972. "gdi32.dll.GetClipBox",
  973. "gdi32.dll.GetCurrentPositionEx",
  974. "gdi32.dll.GetDCOrgEx",
  975. "gdi32.dll.GetDIBColorTable",
  976. "gdi32.dll.GetDIBits",
  977. "gdi32.dll.GetDeviceCaps",
  978. "gdi32.dll.GetEnhMetaFileBits",
  979. "gdi32.dll.GetEnhMetaFileHeader",
  980. "gdi32.dll.GetEnhMetaFilePaletteEntries",
  981. "gdi32.dll.GetObjectA",
  982. "gdi32.dll.GetPaletteEntries",
  983. "gdi32.dll.GetPixel",
  984. "gdi32.dll.GetStockObject",
  985. "gdi32.dll.GetSystemPaletteEntries",
  986. "gdi32.dll.GetTextExtentPoint32A",
  987. "gdi32.dll.GetTextMetricsA",
  988. "gdi32.dll.GetWinMetaFileBits",
  989. "gdi32.dll.GetWindowOrgEx",
  990. "gdi32.dll.IntersectClipRect",
  991. "gdi32.dll.LineTo",
  992. "gdi32.dll.MaskBlt",
  993. "gdi32.dll.MoveToEx",
  994. "gdi32.dll.PatBlt",
  995. "gdi32.dll.PlayEnhMetaFile",
  996. "gdi32.dll.Polyline",
  997. "gdi32.dll.RealizePalette",
  998. "gdi32.dll.RectVisible",
  999. "gdi32.dll.RestoreDC",
  1000. "gdi32.dll.SaveDC",
  1001. "gdi32.dll.SelectObject",
  1002. "gdi32.dll.SelectPalette",
  1003. "gdi32.dll.SetAbortProc",
  1004. "gdi32.dll.SetBkColor",
  1005. "gdi32.dll.SetBkMode",
  1006. "gdi32.dll.SetBrushOrgEx",
  1007. "gdi32.dll.SetDIBColorTable",
  1008. "gdi32.dll.SetEnhMetaFileBits",
  1009. "gdi32.dll.SetPixel",
  1010. "gdi32.dll.SetROP2",
  1011. "gdi32.dll.SetStretchBltMode",
  1012. "gdi32.dll.SetTextColor",
  1013. "gdi32.dll.SetViewportOrgEx",
  1014. "gdi32.dll.SetWinMetaFileBits",
  1015. "gdi32.dll.SetWindowOrgEx",
  1016. "gdi32.dll.StartDocA",
  1017. "gdi32.dll.StartPage",
  1018. "gdi32.dll.StretchBlt",
  1019. "gdi32.dll.UnrealizeObject",
  1020. "ole32.dll.IsEqualGUID",
  1021. "oleaut32.dll.SysAllocStringLen",
  1022. "oleaut32.dll.SysFreeString",
  1023. "oleaut32.dll.SysReAllocStringLen",
  1024. "oleaut32.dll.SysStringLen",
  1025. "oleaut32.dll.VariantChangeTypeEx",
  1026. "oleaut32.dll.VariantClear",
  1027. "oleaut32.dll.VariantCopyInd",
  1028. "shell32.dll.SHGetSpecialFolderLocation",
  1029. "shell32.dll.ShellExecuteA",
  1030. "shell32.dll.SHGetPathFromIDListA",
  1031. "urlmon.dll.URLDownloadToFileA",
  1032. "user32.dll.ActivateKeyboardLayout",
  1033. "user32.dll.AdjustWindowRectEx",
  1034. "user32.dll.BeginPaint",
  1035. "user32.dll.CallNextHookEx",
  1036. "user32.dll.CallWindowProcA",
  1037. "user32.dll.CharLowerA",
  1038. "user32.dll.CharLowerBuffA",
  1039. "user32.dll.CharNextA",
  1040. "user32.dll.CheckMenuItem",
  1041. "user32.dll.ClientToScreen",
  1042. "user32.dll.CloseClipboard",
  1043. "user32.dll.CreateIcon",
  1044. "user32.dll.CreateMenu",
  1045. "user32.dll.CreatePopupMenu",
  1046. "user32.dll.CreateWindowExA",
  1047. "user32.dll.DefFrameProcA",
  1048. "user32.dll.DefMDIChildProcA",
  1049. "user32.dll.DefWindowProcA",
  1050. "user32.dll.DeleteMenu",
  1051. "user32.dll.DestroyCursor",
  1052. "user32.dll.DestroyIcon",
  1053. "user32.dll.DestroyMenu",
  1054. "user32.dll.DestroyWindow",
  1055. "user32.dll.DispatchMessageA",
  1056. "user32.dll.DrawEdge",
  1057. "user32.dll.DrawFrameControl",
  1058. "user32.dll.DrawIcon",
  1059. "user32.dll.DrawIconEx",
  1060. "user32.dll.DrawMenuBar",
  1061. "user32.dll.DrawTextA",
  1062. "user32.dll.EnableMenuItem",
  1063. "user32.dll.EnableScrollBar",
  1064. "user32.dll.EnableWindow",
  1065. "user32.dll.EndPaint",
  1066. "user32.dll.EnumThreadWindows",
  1067. "user32.dll.EnumWindows",
  1068. "user32.dll.EqualRect",
  1069. "user32.dll.ExitWindowsEx",
  1070. "user32.dll.FillRect",
  1071. "user32.dll.FindWindowA",
  1072. "user32.dll.FindWindowExA",
  1073. "user32.dll.FrameRect",
  1074. "user32.dll.GetActiveWindow",
  1075. "user32.dll.GetCapture",
  1076. "user32.dll.GetClassInfoA",
  1077. "user32.dll.GetClientRect",
  1078. "user32.dll.GetClipboardData",
  1079. "user32.dll.GetCursor",
  1080. "user32.dll.GetCursorPos",
  1081. "user32.dll.GetDC",
  1082. "user32.dll.GetDCEx",
  1083. "user32.dll.GetDesktopWindow",
  1084. "user32.dll.GetFocus",
  1085. "user32.dll.GetForegroundWindow",
  1086. "user32.dll.GetIconInfo",
  1087. "user32.dll.GetKeyNameTextA",
  1088. "user32.dll.GetKeyState",
  1089. "user32.dll.GetKeyboardLayout",
  1090. "user32.dll.GetKeyboardLayoutList",
  1091. "user32.dll.GetKeyboardState",
  1092. "user32.dll.GetKeyboardType",
  1093. "user32.dll.GetLastActivePopup",
  1094. "user32.dll.GetMenu",
  1095. "user32.dll.GetMenuItemCount",
  1096. "user32.dll.GetMenuItemID",
  1097. "user32.dll.GetMenuItemInfoA",
  1098. "user32.dll.GetMenuState",
  1099. "user32.dll.GetMenuStringA",
  1100. "user32.dll.GetMessageA",
  1101. "user32.dll.GetParent",
  1102. "user32.dll.GetPropA",
  1103. "user32.dll.GetScrollInfo",
  1104. "user32.dll.GetScrollPos",
  1105. "user32.dll.GetScrollRange",
  1106. "user32.dll.GetSubMenu",
  1107. "user32.dll.GetSysColor",
  1108. "user32.dll.GetSystemMetrics",
  1109. "user32.dll.GetTopWindow",
  1110. "user32.dll.GetWindow",
  1111. "user32.dll.GetWindowDC",
  1112. "user32.dll.GetWindowLongA",
  1113. "user32.dll.GetWindowPlacement",
  1114. "user32.dll.GetWindowRect",
  1115. "user32.dll.GetWindowTextA",
  1116. "user32.dll.GetWindowThreadProcessId",
  1117. "user32.dll.InflateRect",
  1118. "user32.dll.InsertMenuA",
  1119. "user32.dll.InsertMenuItemA",
  1120. "user32.dll.IntersectRect",
  1121. "user32.dll.InvalidateRect",
  1122. "user32.dll.IsChild",
  1123. "user32.dll.IsDialogMessageA",
  1124. "user32.dll.IsIconic",
  1125. "user32.dll.IsRectEmpty",
  1126. "user32.dll.IsWindow",
  1127. "user32.dll.IsWindowEnabled",
  1128. "user32.dll.IsWindowVisible",
  1129. "user32.dll.IsZoomed",
  1130. "user32.dll.KillTimer",
  1131. "user32.dll.LoadBitmapA",
  1132. "user32.dll.LoadCursorA",
  1133. "user32.dll.LoadIconA",
  1134. "user32.dll.LoadKeyboardLayoutA",
  1135. "user32.dll.LoadStringA",
  1136. "user32.dll.MapVirtualKeyA",
  1137. "user32.dll.MapWindowPoints",
  1138. "user32.dll.MessageBoxA",
  1139. "user32.dll.MsgWaitForMultipleObjects",
  1140. "user32.dll.OemToCharA",
  1141. "user32.dll.OffsetRect",
  1142. "user32.dll.OpenClipboard",
  1143. "user32.dll.PeekMessageA",
  1144. "user32.dll.PostMessageA",
  1145. "user32.dll.PostQuitMessage",
  1146. "user32.dll.PtInRect",
  1147. "user32.dll.RegisterClassA",
  1148. "user32.dll.RegisterClipboardFormatA",
  1149. "user32.dll.RegisterWindowMessageA",
  1150. "user32.dll.ReleaseCapture",
  1151. "user32.dll.ReleaseDC",
  1152. "user32.dll.RemoveMenu",
  1153. "user32.dll.RemovePropA",
  1154. "user32.dll.ScreenToClient",
  1155. "user32.dll.ScrollWindow",
  1156. "user32.dll.SendMessageA",
  1157. "user32.dll.SetActiveWindow",
  1158. "user32.dll.SetCapture",
  1159. "user32.dll.SetClassLongA",
  1160. "user32.dll.SetCursor",
  1161. "user32.dll.SetCursorPos",
  1162. "user32.dll.SetFocus",
  1163. "user32.dll.SetForegroundWindow",
  1164. "user32.dll.SetMenu",
  1165. "user32.dll.SetMenuItemInfoA",
  1166. "user32.dll.SetPropA",
  1167. "user32.dll.SetRect",
  1168. "user32.dll.SetScrollInfo",
  1169. "user32.dll.SetScrollPos",
  1170. "user32.dll.SetScrollRange",
  1171. "user32.dll.SetTimer",
  1172. "user32.dll.SetWindowLongA",
  1173. "user32.dll.SetWindowPlacement",
  1174. "user32.dll.SetWindowPos",
  1175. "user32.dll.SetWindowTextA",
  1176. "user32.dll.SetWindowsHookExA",
  1177. "user32.dll.ShowCursor",
  1178. "user32.dll.ShowOwnedPopups",
  1179. "user32.dll.ShowScrollBar",
  1180. "user32.dll.ShowWindow",
  1181. "user32.dll.SystemParametersInfoA",
  1182. "user32.dll.TrackPopupMenu",
  1183. "user32.dll.TranslateMDISysAccel",
  1184. "user32.dll.TranslateMessage",
  1185. "user32.dll.UnhookWindowsHookEx",
  1186. "user32.dll.UnregisterClassA",
  1187. "user32.dll.UpdateWindow",
  1188. "user32.dll.WaitMessage",
  1189. "user32.dll.WinHelpA",
  1190. "user32.dll.WindowFromPoint",
  1191. "user32.dll.keybd_event",
  1192. "user32.dll.wsprintfA",
  1193. "user32.dll.GetSystemMenu",
  1194. "winmm.dll.mciSendStringA",
  1195. "winmm.dll.timeGetTime",
  1196. "winspool.drv.ClosePrinter",
  1197. "winspool.drv.DocumentPropertiesA",
  1198. "winspool.drv.EnumPrintersA",
  1199. "winspool.drv.OpenPrinterA",
  1200. "ws2_32.dll.WSACloseEvent",
  1201. "ws2_32.dll.WSACreateEvent",
  1202. "ws2_32.dll.WSAEventSelect",
  1203. "wsock32.dll.#103",
  1204. "wsock32.dll.#107",
  1205. "wsock32.dll.#101",
  1206. "wsock32.dll.#108",
  1207. "wsock32.dll.#116",
  1208. "wsock32.dll.#111",
  1209. "wsock32.dll.#115",
  1210. "wsock32.dll.#1",
  1211. "wsock32.dll.#3",
  1212. "wsock32.dll.#4",
  1213. "wsock32.dll.#52",
  1214. "wsock32.dll.#57",
  1215. "wsock32.dll.#5",
  1216. "wsock32.dll.#55",
  1217. "wsock32.dll.#6",
  1218. "wsock32.dll.#7",
  1219. "wsock32.dll.#9",
  1220. "wsock32.dll.#10",
  1221. "wsock32.dll.#11",
  1222. "wsock32.dll.#12",
  1223. "wsock32.dll.#13",
  1224. "wsock32.dll.#15",
  1225. "wsock32.dll.#16",
  1226. "wsock32.dll.#17",
  1227. "wsock32.dll.#18",
  1228. "wsock32.dll.#19",
  1229. "wsock32.dll.#20",
  1230. "wsock32.dll.#21",
  1231. "wsock32.dll.#23",
  1232. "wsock32.dll.#2",
  1233. "fservice.exe.___CPPdebugHook",
  1234. "kernel32.dll.GetDiskFreeSpaceExA",
  1235. "user32.dll.GetMonitorInfoA",
  1236. "user32.dll.EnumDisplayMonitors",
  1237. "dwmapi.dll.DwmIsCompositionEnabled",
  1238. "gdi32.dll.GetLayout",
  1239. "gdi32.dll.GdiRealizationInfo",
  1240. "gdi32.dll.FontIsLinked",
  1241. "advapi32.dll.RegOpenKeyExW",
  1242. "advapi32.dll.RegQueryInfoKeyW",
  1243. "gdi32.dll.GetTextFaceAliasW",
  1244. "advapi32.dll.RegEnumValueW",
  1245. "advapi32.dll.RegQueryValueExW",
  1246. "gdi32.dll.GetFontAssocStatus",
  1247. "advapi32.dll.RegEnumKeyExW",
  1248. "gdi32.dll.GdiIsMetaPrintDC",
  1249. "comctl32.dll.InitializeFlatSB",
  1250. "comctl32.dll.UninitializeFlatSB",
  1251. "comctl32.dll.FlatSB_GetScrollProp",
  1252. "comctl32.dll.FlatSB_SetScrollProp",
  1253. "comctl32.dll.FlatSB_EnableScrollBar",
  1254. "comctl32.dll.FlatSB_ShowScrollBar",
  1255. "comctl32.dll.FlatSB_GetScrollRange",
  1256. "comctl32.dll.FlatSB_GetScrollInfo",
  1257. "comctl32.dll.FlatSB_GetScrollPos",
  1258. "comctl32.dll.FlatSB_SetScrollPos",
  1259. "comctl32.dll.FlatSB_SetScrollInfo",
  1260. "comctl32.dll.FlatSB_SetScrollRange",
  1261. "kernel32.dll.SortGetHandle",
  1262. "kernel32.dll.SortCloseHandle",
  1263. "lpk.dll.LpkEditControl",
  1264. "comctl32.dll.HIMAGELIST_QueryInterface",
  1265. "comctl32.dll.DrawShadowText",
  1266. "comctl32.dll.DrawSizeBox",
  1267. "comctl32.dll.DrawScrollBar",
  1268. "comctl32.dll.SizeBoxHwnd",
  1269. "comctl32.dll.ScrollBar_MouseMove",
  1270. "comctl32.dll.ScrollBar_Menu",
  1271. "comctl32.dll.HandleScrollCmd",
  1272. "comctl32.dll.DetachScrollBars",
  1273. "comctl32.dll.AttachScrollBars",
  1274. "comctl32.dll.CCSetScrollInfo",
  1275. "comctl32.dll.CCGetScrollInfo",
  1276. "comctl32.dll.CCEnableScrollBar",
  1277. "comctl32.dll.QuerySystemGestureStatus",
  1278. "uxtheme.dll.#49",
  1279. "uxtheme.dll.CloseThemeData",
  1280. "uxtheme.dll.DrawThemeBackground",
  1281. "ole32.dll.CoInitializeEx",
  1282. "ole32.dll.CoUninitialize",
  1283. "cryptbase.dll.SystemFunction036",
  1284. "ole32.dll.CoRegisterInitializeSpy",
  1285. "ole32.dll.CoRevokeInitializeSpy",
  1286. "oleaut32.dll.#500",
  1287. "services.exe.___CPPdebugHook",
  1288. "mfc42.dll.#4486",
  1289. "mfc42.dll.#2554",
  1290. "mfc42.dll.#2512",
  1291. "mfc42.dll.#5731",
  1292. "mfc42.dll.#3922",
  1293. "mfc42.dll.#1089",
  1294. "mfc42.dll.#5199",
  1295. "mfc42.dll.#2396",
  1296. "mfc42.dll.#3346",
  1297. "mfc42.dll.#5300",
  1298. "mfc42.dll.#5302",
  1299. "mfc42.dll.#4079",
  1300. "mfc42.dll.#4698",
  1301. "mfc42.dll.#5307",
  1302. "mfc42.dll.#5289",
  1303. "mfc42.dll.#5714",
  1304. "mfc42.dll.#2982",
  1305. "mfc42.dll.#3147",
  1306. "mfc42.dll.#3259",
  1307. "mfc42.dll.#4465",
  1308. "mfc42.dll.#3136",
  1309. "mfc42.dll.#3262",
  1310. "mfc42.dll.#2985",
  1311. "mfc42.dll.#3081",
  1312. "mfc42.dll.#2976",
  1313. "mfc42.dll.#6375",
  1314. "mfc42.dll.#3831",
  1315. "mfc42.dll.#3825",
  1316. "mfc42.dll.#3079",
  1317. "mfc42.dll.#4080",
  1318. "mfc42.dll.#4622",
  1319. "mfc42.dll.#4424",
  1320. "mfc42.dll.#3738",
  1321. "mfc42.dll.#561",
  1322. "mfc42.dll.#825",
  1323. "mfc42.dll.#815",
  1324. "mfc42.dll.#1176",
  1325. "mfc42.dll.#1116",
  1326. "mfc42.dll.#1575",
  1327. "mfc42.dll.#1577",
  1328. "mfc42.dll.#1182",
  1329. "mfc42.dll.#342",
  1330. "mfc42.dll.#1243",
  1331. "mfc42.dll.#1197",
  1332. "mfc42.dll.#1570",
  1333. "mfc42.dll.#1253",
  1334. "mfc42.dll.#1255",
  1335. "mfc42.dll.#1578",
  1336. "mfc42.dll.#600",
  1337. "mfc42.dll.#826",
  1338. "mfc42.dll.#269",
  1339. "mfc42.dll.#6467",
  1340. "mfc42.dll.#1168",
  1341. "mfc42.dll.#3830",
  1342. "mfc42.dll.#4274",
  1343. "msvcrt.dll.malloc",
  1344. "msvcrt.dll.fclose",
  1345. "msvcrt.dll.fprintf",
  1346. "msvcrt.dll.fopen",
  1347. "msvcrt.dll.__CxxFrameHandler",
  1348. "msvcrt.dll._EH_prolog",
  1349. "msvcrt.dll.??2@YAPAXI@Z",
  1350. "msvcrt.dll.__dllonexit",
  1351. "msvcrt.dll._onexit",
  1352. "msvcrt.dll.??1type_info@@UAE@XZ",
  1353. "msvcrt.dll._adjust_fdiv",
  1354. "msvcrt.dll.fwrite",
  1355. "msvcrt.dll._initterm",
  1356. "msvcrt.dll.free",
  1357. "user32.dll.ToAscii",
  1358. "winkey.dll.installhook",
  1359. "wsock32.dll.WSAStartup",
  1360. "wsock32.dll.getprotobyname",
  1361. "wsock32.dll.htons",
  1362. "wsock32.dll.inet_addr",
  1363. "wsock32.dll.socket",
  1364. "wsock32.dll.bind",
  1365. "wsock32.dll.listen",
  1366. "wsock32.dll.WSAAsyncSelect",
  1367. "reginv.dll.InstallHook",
  1368. "iphlpapi.dll.GetNetworkParams",
  1369. "dnsapi.dll.DnsQueryConfig",
  1370. "iphlpapi.dll.GetAdaptersAddresses",
  1371. "iphlpapi.dll.GetIpInterfaceEntry",
  1372. "iphlpapi.dll.GetBestInterfaceEx",
  1373. "wsock32.dll.WSAAsyncGetHostByName",
  1374. "wsock32.dll.inet_ntoa",
  1375. "wsock32.dll.getservbyname",
  1376. "wsock32.dll.ntohs",
  1377. "wsock32.dll.setsockopt",
  1378. "wsock32.dll.connect",
  1379. "wsock32.dll.WSAGetLastError",
  1380. "wsock32.dll.shutdown",
  1381. "wsock32.dll.closesocket",
  1382. "rpcrt4.dll.I_RpcSNCHOption",
  1383. "sechost.dll.OpenSCManagerW",
  1384. "sechost.dll.OpenServiceW",
  1385. "sechost.dll.CloseServiceHandle",
  1386. "kernel32.dll.SetThreadUILanguage",
  1387. "kernel32.dll.CopyFileExW",
  1388. "kernel32.dll.IsDebuggerPresent",
  1389. "kernel32.dll.SetConsoleInputExeNameW",
  1390. "advapi32.dll.SaferIdentifyLevel",
  1391. "advapi32.dll.SaferComputeTokenFromLevel",
  1392. "advapi32.dll.SaferCloseLevel"
  1393. ]
  1394.  
  1395. [*] Static Analysis: {
  1396. "pe": {
  1397. "peid_signatures": null,
  1398. "imports": [
  1399. {
  1400. "imports": [
  1401. {
  1402. "name": "LoadLibraryA",
  1403. "address": "0x5fbbfc"
  1404. },
  1405. {
  1406. "name": "GetProcAddress",
  1407. "address": "0x5fbc00"
  1408. },
  1409. {
  1410. "name": "ExitProcess",
  1411. "address": "0x5fbc04"
  1412. }
  1413. ],
  1414. "dll": "KERNEL32.DLL"
  1415. },
  1416. {
  1417. "imports": [
  1418. {
  1419. "name": "RegCloseKey",
  1420. "address": "0x5fbc0c"
  1421. }
  1422. ],
  1423. "dll": "ADVAPI32.DLL"
  1424. },
  1425. {
  1426. "imports": [
  1427. {
  1428. "name": "capCreateCaptureWindowA",
  1429. "address": "0x5fbc14"
  1430. }
  1431. ],
  1432. "dll": "AVICAP32.DLL"
  1433. },
  1434. {
  1435. "imports": [
  1436. {
  1437. "name": "ImageList_Add",
  1438. "address": "0x5fbc1c"
  1439. }
  1440. ],
  1441. "dll": "COMCTL32.DLL"
  1442. },
  1443. {
  1444. "imports": [
  1445. {
  1446. "name": "BitBlt",
  1447. "address": "0x5fbc24"
  1448. }
  1449. ],
  1450. "dll": "GDI32.DLL"
  1451. },
  1452. {
  1453. "imports": [
  1454. {
  1455. "name": "IsEqualGUID",
  1456. "address": "0x5fbc2c"
  1457. }
  1458. ],
  1459. "dll": "OLE32.DLL"
  1460. },
  1461. {
  1462. "imports": [
  1463. {
  1464. "name": "SysStringLen",
  1465. "address": "0x5fbc34"
  1466. }
  1467. ],
  1468. "dll": "OLEAUT32.DLL"
  1469. },
  1470. {
  1471. "imports": [
  1472. {
  1473. "name": "ShellExecuteA",
  1474. "address": "0x5fbc3c"
  1475. }
  1476. ],
  1477. "dll": "SHELL32.DLL"
  1478. },
  1479. {
  1480. "imports": [
  1481. {
  1482. "name": "URLDownloadToFileA",
  1483. "address": "0x5fbc44"
  1484. }
  1485. ],
  1486. "dll": "URLMON.DLL"
  1487. },
  1488. {
  1489. "imports": [
  1490. {
  1491. "name": "GetDC",
  1492. "address": "0x5fbc4c"
  1493. }
  1494. ],
  1495. "dll": "USER32.DLL"
  1496. },
  1497. {
  1498. "imports": [
  1499. {
  1500. "name": "timeGetTime",
  1501. "address": "0x5fbc54"
  1502. }
  1503. ],
  1504. "dll": "WINMM.DLL"
  1505. },
  1506. {
  1507. "imports": [
  1508. {
  1509. "name": "ClosePrinter",
  1510. "address": "0x5fbc5c"
  1511. }
  1512. ],
  1513. "dll": "WINSPOOL.DRV"
  1514. },
  1515. {
  1516. "imports": [
  1517. {
  1518. "name": "WSACloseEvent",
  1519. "address": "0x5fbc64"
  1520. }
  1521. ],
  1522. "dll": "WS2_32.DLL"
  1523. },
  1524. {
  1525. "imports": [
  1526. {
  1527. "name": "bind",
  1528. "address": "0x5fbc6c"
  1529. }
  1530. ],
  1531. "dll": "WSOCK32.DLL"
  1532. }
  1533. ],
  1534. "digital_signers": null,
  1535. "exported_dll_name": null,
  1536. "actual_checksum": "0x00061241",
  1537. "overlay": {
  1538. "size": "0x0000002c",
  1539. "offset": "0x00055a00"
  1540. },
  1541. "imagebase": "0x00400000",
  1542. "reported_checksum": "0x00000000",
  1543. "icon_hash": null,
  1544. "entrypoint": "0x005fa490",
  1545. "timestamp": "2004-11-19 12:19:18",
  1546. "osversion": "4.0",
  1547. "sections": [
  1548. {
  1549. "name": "UPX0",
  1550. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1551. "virtual_address": "0x00001000",
  1552. "size_of_data": "0x00000000",
  1553. "entropy": "0.00",
  1554. "raw_address": "0x00000400",
  1555. "virtual_size": "0x001a5000",
  1556. "characteristics_raw": "0xe0000080"
  1557. },
  1558. {
  1559. "name": "UPX1",
  1560. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1561. "virtual_address": "0x001a6000",
  1562. "size_of_data": "0x00054800",
  1563. "entropy": "7.91",
  1564. "raw_address": "0x00000400",
  1565. "virtual_size": "0x00055000",
  1566. "characteristics_raw": "0xe0000040"
  1567. },
  1568. {
  1569. "name": ".rsrc",
  1570. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1571. "virtual_address": "0x001fb000",
  1572. "size_of_data": "0x00000e00",
  1573. "entropy": "2.83",
  1574. "raw_address": "0x00054c00",
  1575. "virtual_size": "0x00001000",
  1576. "characteristics_raw": "0xc0000040"
  1577. }
  1578. ],
  1579. "resources": [],
  1580. "dirents": [
  1581. {
  1582. "virtual_address": "0x001e2000",
  1583. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1584. "size": "0x00007408"
  1585. },
  1586. {
  1587. "virtual_address": "0x001fbad0",
  1588. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1589. "size": "0x00000328"
  1590. },
  1591. {
  1592. "virtual_address": "0x001fb000",
  1593. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1594. "size": "0x00000ad0"
  1595. },
  1596. {
  1597. "virtual_address": "0x00000000",
  1598. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1599. "size": "0x00000000"
  1600. },
  1601. {
  1602. "virtual_address": "0x00000000",
  1603. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1604. "size": "0x00000000"
  1605. },
  1606. {
  1607. "virtual_address": "0x00000000",
  1608. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1609. "size": "0x00000000"
  1610. },
  1611. {
  1612. "virtual_address": "0x00000000",
  1613. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1614. "size": "0x00000000"
  1615. },
  1616. {
  1617. "virtual_address": "0x00000000",
  1618. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1619. "size": "0x00000000"
  1620. },
  1621. {
  1622. "virtual_address": "0x00000000",
  1623. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1624. "size": "0x00000000"
  1625. },
  1626. {
  1627. "virtual_address": "0x001fa60c",
  1628. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1629. "size": "0x00000018"
  1630. },
  1631. {
  1632. "virtual_address": "0x00000000",
  1633. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1634. "size": "0x00000000"
  1635. },
  1636. {
  1637. "virtual_address": "0x00000000",
  1638. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1639. "size": "0x00000000"
  1640. },
  1641. {
  1642. "virtual_address": "0x00000000",
  1643. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1644. "size": "0x00000000"
  1645. },
  1646. {
  1647. "virtual_address": "0x00000000",
  1648. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1649. "size": "0x00000000"
  1650. },
  1651. {
  1652. "virtual_address": "0x00000000",
  1653. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1654. "size": "0x00000000"
  1655. },
  1656. {
  1657. "virtual_address": "0x00000000",
  1658. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1659. "size": "0x00000000"
  1660. }
  1661. ],
  1662. "exports": [],
  1663. "guest_signers": {},
  1664. "imphash": "9612c82b4c865e0bf6797463aa91292a",
  1665. "icon_fuzzy": null,
  1666. "icon": null,
  1667. "pdbpath": null,
  1668. "imported_dll_count": 14,
  1669. "versioninfo": []
  1670. }
  1671. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!