API tools faq
paste
paladin316

Exes_5857859fe3131fa253b1ae734c65cd3f_exe_2019-06-24_13_30.json

paladin316
Jun 24th, 2019
2,266
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 44.87 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_5857859fe3131fa253b1ae734c65cd3f.exe"
  7. [*] File Size: 235520
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "1fbc8c313f7bba8dc6073db8243321b9d6d7fa7b776123f8036a588ef84c9cf3"
  10. [*] MD5: "5857859fe3131fa253b1ae734c65cd3f"
  11. [*] SHA1: "5dfcbed9a4a35ec3c78306185cb880ce134129df"
  12. [*] SHA512: "531d098ea3b73f186007ee8885d2ff214ae0efcb4ed9cd7d69475883e9346a27698fa787ef02649ad2d253bc55991961330acc6c5f83e1b6a65ab00b265a7d20"
  13. [*] CRC32: "752F6B92"
  14. [*] SSDEEP: "6144:wx+Epxxwwxz8svh7NSK3wEaLXLMtxg+T9R:HEpzwwxH+v/MDN5"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .text, entropy: 7.84, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00039000, virtual_size: 0x00038f18"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "Anomalous .NET characteristics",
  29. "Details": [
  30. {
  31. "anomalous_version": "Assembly version is set to 0"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "File has been identified by 27 Antiviruses on VirusTotal as malicious",
  37. "Details": [
  38. {
  39. "Cylance": "Unsafe"
  40. },
  41. {
  42. "Cybereason": "malicious.9a4a35"
  43. },
  44. {
  45. "Invincea": "heuristic"
  46. },
  47. {
  48. "Symantec": "ML.Attribute.HighConfidence"
  49. },
  50. {
  51. "APEX": "Malicious"
  52. },
  53. {
  54. "Paloalto": "generic.ml"
  55. },
  56. {
  57. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  58. },
  59. {
  60. "Alibaba": "Trojan:MSIL/Generic.b158a88f"
  61. },
  62. {
  63. "Avast": "Win32:CrypterX-gen [Trj]"
  64. },
  65. {
  66. "Tencent": "Win32.Trojan.Generic.Svrj"
  67. },
  68. {
  69. "Endgame": "malicious (high confidence)"
  70. },
  71. {
  72. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.dc"
  73. },
  74. {
  75. "Trapmine": "malicious.high.ml.score"
  76. },
  77. {
  78. "FireEye": "Generic.mg.5857859fe3131fa2"
  79. },
  80. {
  81. "Fortinet": "PossibleThreat"
  82. },
  83. {
  84. "Microsoft": "Trojan:Win32/Fuerboos.C!cl"
  85. },
  86. {
  87. "AegisLab": "Trojan.Win32.Generic.4!c"
  88. },
  89. {
  90. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  91. },
  92. {
  93. "Acronis": "suspicious"
  94. },
  95. {
  96. "McAfee": "RDN/Generic.dx"
  97. },
  98. {
  99. "ESET-NOD32": "a variant of MSIL/Packed.SmartAssembly.AX"
  100. },
  101. {
  102. "Rising": "Trojan.Fuerboos!8.EFC8 (CLOUD)"
  103. },
  104. {
  105. "SentinelOne": "DFI - Malicious PE"
  106. },
  107. {
  108. "eGambit": "Unsafe.AI_Score_51%"
  109. },
  110. {
  111. "AVG": "Win32:CrypterX-gen [Trj]"
  112. },
  113. {
  114. "CrowdStrike": "win/malicious_confidence_100% (W)"
  115. },
  116. {
  117. "Qihoo-360": "HEUR/QVM03.0.FAB9.Malware.Gen"
  118. }
  119. ]
  120. }
  121. ]
  122.  
  123. [*] Started Service: []
  124.  
  125. [*] Executed Commands: []
  126.  
  127. [*] Mutexes: []
  128.  
  129. [*] Modified Files: []
  130.  
  131. [*] Deleted Files: []
  132.  
  133. [*] Modified Registry Keys: []
  134.  
  135. [*] Deleted Registry Keys: []
  136.  
  137. [*] DNS Communications: []
  138.  
  139. [*] Domains: []
  140.  
  141. [*] Network Communication - ICMP: []
  142.  
  143. [*] Network Communication - HTTP: []
  144.  
  145. [*] Network Communication - SMTP: []
  146.  
  147. [*] Network Communication - Hosts: []
  148.  
  149. [*] Network Communication - IRC: []
  150.  
  151. [*] Static Analysis: {
  152. "dotnet": {
  153. "customattrs": null,
  154. "assemblyinfo": {
  155. "version": "0.0.0.0",
  156. "name": "ey7oh"
  157. },
  158. "assemblyrefs": [
  159. {
  160. "version": "2.0.0.0",
  161. "name": "mscorlib"
  162. },
  163. {
  164. "version": "8.0.0.0",
  165. "name": "Microsoft.VisualBasic"
  166. },
  167. {
  168. "version": "2.0.0.0",
  169. "name": "System"
  170. },
  171. {
  172. "version": "2.0.0.0",
  173. "name": "System.Web.Services"
  174. },
  175. {
  176. "version": "2.0.0.0",
  177. "name": "System.Xml"
  178. }
  179. ],
  180. "typerefs": [
  181. {
  182. "typename": "Microsoft.VisualBasic.ApplicationServices.ApplicationBase",
  183. "assembly": "Microsoft.VisualBasic"
  184. },
  185. {
  186. "typename": "Microsoft.VisualBasic.ApplicationServices.User",
  187. "assembly": "Microsoft.VisualBasic"
  188. },
  189. {
  190. "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
  191. "assembly": "Microsoft.VisualBasic"
  192. },
  193. {
  194. "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
  195. "assembly": "Microsoft.VisualBasic"
  196. },
  197. {
  198. "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
  199. "assembly": "Microsoft.VisualBasic"
  200. },
  201. {
  202. "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
  203. "assembly": "Microsoft.VisualBasic"
  204. },
  205. {
  206. "typename": "Microsoft.VisualBasic.Devices.Computer",
  207. "assembly": "Microsoft.VisualBasic"
  208. },
  209. {
  210. "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
  211. "assembly": "Microsoft.VisualBasic"
  212. },
  213. {
  214. "typename": "Microsoft.VisualBasic.Interaction",
  215. "assembly": "Microsoft.VisualBasic"
  216. },
  217. {
  218. "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
  219. "assembly": "Microsoft.VisualBasic"
  220. },
  221. {
  222. "typename": "Microsoft.VisualBasic.MyServices.Internal.ContextValue`1",
  223. "assembly": "Microsoft.VisualBasic"
  224. },
  225. {
  226. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  227. "assembly": "System"
  228. },
  229. {
  230. "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
  231. "assembly": "System"
  232. },
  233. {
  234. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  235. "assembly": "System"
  236. },
  237. {
  238. "typename": "System.ComponentModel.EditorBrowsableState",
  239. "assembly": "System"
  240. },
  241. {
  242. "typename": "System.Configuration.ApplicationSettingsBase",
  243. "assembly": "System"
  244. },
  245. {
  246. "typename": "System.Configuration.SettingsBase",
  247. "assembly": "System"
  248. },
  249. {
  250. "typename": "System.Diagnostics.Process",
  251. "assembly": "System"
  252. },
  253. {
  254. "typename": "System.Diagnostics.ProcessModule",
  255. "assembly": "System"
  256. },
  257. {
  258. "typename": "System.Diagnostics.ProcessModuleCollection",
  259. "assembly": "System"
  260. },
  261. {
  262. "typename": "System.Net.HttpWebRequest",
  263. "assembly": "System"
  264. },
  265. {
  266. "typename": "System.Net.ServicePoint",
  267. "assembly": "System"
  268. },
  269. {
  270. "typename": "System.Net.WebRequest",
  271. "assembly": "System"
  272. },
  273. {
  274. "typename": "System.Uri",
  275. "assembly": "System"
  276. },
  277. {
  278. "typename": "System.Web.Services.Protocols.SoapDocumentMethodAttribute",
  279. "assembly": "System.Web.Services"
  280. },
  281. {
  282. "typename": "System.Web.Services.Protocols.SoapHttpClientProtocol",
  283. "assembly": "System.Web.Services"
  284. },
  285. {
  286. "typename": "System.Web.Services.Protocols.WebClientProtocol",
  287. "assembly": "System.Web.Services"
  288. },
  289. {
  290. "typename": "System.Web.Services.WebServiceBindingAttribute",
  291. "assembly": "System.Web.Services"
  292. },
  293. {
  294. "typename": "System.Xml.Serialization.XmlElementAttribute",
  295. "assembly": "System.Xml"
  296. },
  297. {
  298. "typename": "System.Activator",
  299. "assembly": "mscorlib"
  300. },
  301. {
  302. "typename": "System.AppDomain",
  303. "assembly": "mscorlib"
  304. },
  305. {
  306. "typename": "System.ArgumentOutOfRangeException",
  307. "assembly": "mscorlib"
  308. },
  309. {
  310. "typename": "System.Array",
  311. "assembly": "mscorlib"
  312. },
  313. {
  314. "typename": "System.AsyncCallback",
  315. "assembly": "mscorlib"
  316. },
  317. {
  318. "typename": "System.Attribute",
  319. "assembly": "mscorlib"
  320. },
  321. {
  322. "typename": "System.AttributeTargets",
  323. "assembly": "mscorlib"
  324. },
  325. {
  326. "typename": "System.AttributeUsageAttribute",
  327. "assembly": "mscorlib"
  328. },
  329. {
  330. "typename": "System.BadImageFormatException",
  331. "assembly": "mscorlib"
  332. },
  333. {
  334. "typename": "System.BitConverter",
  335. "assembly": "mscorlib"
  336. },
  337. {
  338. "typename": "System.Boolean",
  339. "assembly": "mscorlib"
  340. },
  341. {
  342. "typename": "System.Buffer",
  343. "assembly": "mscorlib"
  344. },
  345. {
  346. "typename": "System.Byte",
  347. "assembly": "mscorlib"
  348. },
  349. {
  350. "typename": "System.Char",
  351. "assembly": "mscorlib"
  352. },
  353. {
  354. "typename": "System.Collections.Generic.Dictionary`2",
  355. "assembly": "mscorlib"
  356. },
  357. {
  358. "typename": "System.Collections.IEnumerator",
  359. "assembly": "mscorlib"
  360. },
  361. {
  362. "typename": "System.Collections.ReadOnlyCollectionBase",
  363. "assembly": "mscorlib"
  364. },
  365. {
  366. "typename": "System.Convert",
  367. "assembly": "mscorlib"
  368. },
  369. {
  370. "typename": "System.Delegate",
  371. "assembly": "mscorlib"
  372. },
  373. {
  374. "typename": "System.Diagnostics.DebuggerDisplayAttribute",
  375. "assembly": "mscorlib"
  376. },
  377. {
  378. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  379. "assembly": "mscorlib"
  380. },
  381. {
  382. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  383. "assembly": "mscorlib"
  384. },
  385. {
  386. "typename": "System.Diagnostics.StackFrame",
  387. "assembly": "mscorlib"
  388. },
  389. {
  390. "typename": "System.Diagnostics.StackTrace",
  391. "assembly": "mscorlib"
  392. },
  393. {
  394. "typename": "System.Enum",
  395. "assembly": "mscorlib"
  396. },
  397. {
  398. "typename": "System.Exception",
  399. "assembly": "mscorlib"
  400. },
  401. {
  402. "typename": "System.FlagsAttribute",
  403. "assembly": "mscorlib"
  404. },
  405. {
  406. "typename": "System.FormatException",
  407. "assembly": "mscorlib"
  408. },
  409. {
  410. "typename": "System.GC",
  411. "assembly": "mscorlib"
  412. },
  413. {
  414. "typename": "System.Globalization.CultureInfo",
  415. "assembly": "mscorlib"
  416. },
  417. {
  418. "typename": "System.IAsyncResult",
  419. "assembly": "mscorlib"
  420. },
  421. {
  422. "typename": "System.IDisposable",
  423. "assembly": "mscorlib"
  424. },
  425. {
  426. "typename": "System.IO.Directory",
  427. "assembly": "mscorlib"
  428. },
  429. {
  430. "typename": "System.IO.DirectoryInfo",
  431. "assembly": "mscorlib"
  432. },
  433. {
  434. "typename": "System.IO.File",
  435. "assembly": "mscorlib"
  436. },
  437. {
  438. "typename": "System.IO.FileLoadException",
  439. "assembly": "mscorlib"
  440. },
  441. {
  442. "typename": "System.IO.FileStream",
  443. "assembly": "mscorlib"
  444. },
  445. {
  446. "typename": "System.IO.MemoryStream",
  447. "assembly": "mscorlib"
  448. },
  449. {
  450. "typename": "System.IO.Path",
  451. "assembly": "mscorlib"
  452. },
  453. {
  454. "typename": "System.IO.Stream",
  455. "assembly": "mscorlib"
  456. },
  457. {
  458. "typename": "System.Int16",
  459. "assembly": "mscorlib"
  460. },
  461. {
  462. "typename": "System.Int32",
  463. "assembly": "mscorlib"
  464. },
  465. {
  466. "typename": "System.IntPtr",
  467. "assembly": "mscorlib"
  468. },
  469. {
  470. "typename": "System.InvalidOperationException",
  471. "assembly": "mscorlib"
  472. },
  473. {
  474. "typename": "System.Math",
  475. "assembly": "mscorlib"
  476. },
  477. {
  478. "typename": "System.MulticastDelegate",
  479. "assembly": "mscorlib"
  480. },
  481. {
  482. "typename": "System.Object",
  483. "assembly": "mscorlib"
  484. },
  485. {
  486. "typename": "System.Reflection.Assembly",
  487. "assembly": "mscorlib"
  488. },
  489. {
  490. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  491. "assembly": "mscorlib"
  492. },
  493. {
  494. "typename": "System.Reflection.AssemblyName",
  495. "assembly": "mscorlib"
  496. },
  497. {
  498. "typename": "System.Reflection.MemberInfo",
  499. "assembly": "mscorlib"
  500. },
  501. {
  502. "typename": "System.Reflection.MethodBase",
  503. "assembly": "mscorlib"
  504. },
  505. {
  506. "typename": "System.Reflection.Module",
  507. "assembly": "mscorlib"
  508. },
  509. {
  510. "typename": "System.ResolveEventArgs",
  511. "assembly": "mscorlib"
  512. },
  513. {
  514. "typename": "System.ResolveEventHandler",
  515. "assembly": "mscorlib"
  516. },
  517. {
  518. "typename": "System.Resources.ResourceManager",
  519. "assembly": "mscorlib"
  520. },
  521. {
  522. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  523. "assembly": "mscorlib"
  524. },
  525. {
  526. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  527. "assembly": "mscorlib"
  528. },
  529. {
  530. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  531. "assembly": "mscorlib"
  532. },
  533. {
  534. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  535. "assembly": "mscorlib"
  536. },
  537. {
  538. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  539. "assembly": "mscorlib"
  540. },
  541. {
  542. "typename": "System.Runtime.InteropServices.Marshal",
  543. "assembly": "mscorlib"
  544. },
  545. {
  546. "typename": "System.RuntimeFieldHandle",
  547. "assembly": "mscorlib"
  548. },
  549. {
  550. "typename": "System.RuntimeTypeHandle",
  551. "assembly": "mscorlib"
  552. },
  553. {
  554. "typename": "System.STAThreadAttribute",
  555. "assembly": "mscorlib"
  556. },
  557. {
  558. "typename": "System.Security.Cryptography.CipherMode",
  559. "assembly": "mscorlib"
  560. },
  561. {
  562. "typename": "System.Security.Cryptography.CryptoStream",
  563. "assembly": "mscorlib"
  564. },
  565. {
  566. "typename": "System.Security.Cryptography.CryptoStreamMode",
  567. "assembly": "mscorlib"
  568. },
  569. {
  570. "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
  571. "assembly": "mscorlib"
  572. },
  573. {
  574. "typename": "System.Security.Cryptography.HashAlgorithm",
  575. "assembly": "mscorlib"
  576. },
  577. {
  578. "typename": "System.Security.Cryptography.ICryptoTransform",
  579. "assembly": "mscorlib"
  580. },
  581. {
  582. "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
  583. "assembly": "mscorlib"
  584. },
  585. {
  586. "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
  587. "assembly": "mscorlib"
  588. },
  589. {
  590. "typename": "System.Security.Cryptography.RijndaelManaged",
  591. "assembly": "mscorlib"
  592. },
  593. {
  594. "typename": "System.Security.Cryptography.SymmetricAlgorithm",
  595. "assembly": "mscorlib"
  596. },
  597. {
  598. "typename": "System.Security.SecurityException",
  599. "assembly": "mscorlib"
  600. },
  601. {
  602. "typename": "System.String",
  603. "assembly": "mscorlib"
  604. },
  605. {
  606. "typename": "System.Text.Encoding",
  607. "assembly": "mscorlib"
  608. },
  609. {
  610. "typename": "System.Text.StringBuilder",
  611. "assembly": "mscorlib"
  612. },
  613. {
  614. "typename": "System.Threading.Monitor",
  615. "assembly": "mscorlib"
  616. },
  617. {
  618. "typename": "System.Threading.Thread",
  619. "assembly": "mscorlib"
  620. },
  621. {
  622. "typename": "System.Threading.ThreadStart",
  623. "assembly": "mscorlib"
  624. },
  625. {
  626. "typename": "System.Type",
  627. "assembly": "mscorlib"
  628. },
  629. {
  630. "typename": "System.ValueType",
  631. "assembly": "mscorlib"
  632. },
  633. {
  634. "typename": "System.Version",
  635. "assembly": "mscorlib"
  636. }
  637. ]
  638. },
  639. "pe": {
  640. "peid_signatures": null,
  641. "imports": [
  642. {
  643. "imports": [
  644. {
  645. "name": "_CorExeMain",
  646. "address": "0x402000"
  647. }
  648. ],
  649. "dll": "mscoree.dll"
  650. }
  651. ],
  652. "digital_signers": null,
  653. "exported_dll_name": null,
  654. "actual_checksum": "0x00045752",
  655. "overlay": null,
  656. "imagebase": "0x00400000",
  657. "reported_checksum": "0x00000000",
  658. "icon_hash": null,
  659. "entrypoint": "0x0043af12",
  660. "timestamp": "2019-06-18 08:29:39",
  661. "osversion": "4.0",
  662. "sections": [
  663. {
  664. "name": ".text",
  665. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  666. "virtual_address": "0x00002000",
  667. "size_of_data": "0x00039000",
  668. "entropy": "7.84",
  669. "raw_address": "0x00000200",
  670. "virtual_size": "0x00038f18",
  671. "characteristics_raw": "0x60000020"
  672. },
  673. {
  674. "name": ".rsrc",
  675. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  676. "virtual_address": "0x0003c000",
  677. "size_of_data": "0x00000400",
  678. "entropy": "4.43",
  679. "raw_address": "0x00039200",
  680. "virtual_size": "0x00000394",
  681. "characteristics_raw": "0x40000040"
  682. },
  683. {
  684. "name": ".reloc",
  685. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  686. "virtual_address": "0x0003e000",
  687. "size_of_data": "0x00000200",
  688. "entropy": "0.10",
  689. "raw_address": "0x00039600",
  690. "virtual_size": "0x0000000c",
  691. "characteristics_raw": "0x42000040"
  692. }
  693. ],
  694. "resources": [],
  695. "dirents": [
  696. {
  697. "virtual_address": "0x00000000",
  698. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  699. "size": "0x00000000"
  700. },
  701. {
  702. "virtual_address": "0x0003aec8",
  703. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  704. "size": "0x0000004a"
  705. },
  706. {
  707. "virtual_address": "0x0003c000",
  708. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  709. "size": "0x00000394"
  710. },
  711. {
  712. "virtual_address": "0x00000000",
  713. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  714. "size": "0x00000000"
  715. },
  716. {
  717. "virtual_address": "0x00000000",
  718. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  719. "size": "0x00000000"
  720. },
  721. {
  722. "virtual_address": "0x0003e000",
  723. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  724. "size": "0x0000000c"
  725. },
  726. {
  727. "virtual_address": "0x00000000",
  728. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  729. "size": "0x00000000"
  730. },
  731. {
  732. "virtual_address": "0x00000000",
  733. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  734. "size": "0x00000000"
  735. },
  736. {
  737. "virtual_address": "0x00000000",
  738. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  739. "size": "0x00000000"
  740. },
  741. {
  742. "virtual_address": "0x00000000",
  743. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  744. "size": "0x00000000"
  745. },
  746. {
  747. "virtual_address": "0x00000000",
  748. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  749. "size": "0x00000000"
  750. },
  751. {
  752. "virtual_address": "0x00000000",
  753. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  754. "size": "0x00000000"
  755. },
  756. {
  757. "virtual_address": "0x00002000",
  758. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  759. "size": "0x00000008"
  760. },
  761. {
  762. "virtual_address": "0x00000000",
  763. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  764. "size": "0x00000000"
  765. },
  766. {
  767. "virtual_address": "0x00002008",
  768. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  769. "size": "0x00000048"
  770. },
  771. {
  772. "virtual_address": "0x00000000",
  773. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  774. "size": "0x00000000"
  775. }
  776. ],
  777. "exports": [],
  778. "guest_signers": {},
  779. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  780. "icon_fuzzy": null,
  781. "icon": null,
  782. "pdbpath": null,
  783. "imported_dll_count": 1,
  784. "versioninfo": []
  785. }
  786. }
  787.  
  788. [*] Resolved APIs: []
  789.  
  790. [*] Static Analysis: {
  791. "dotnet": {
  792. "customattrs": null,
  793. "assemblyinfo": {
  794. "version": "0.0.0.0",
  795. "name": "ey7oh"
  796. },
  797. "assemblyrefs": [
  798. {
  799. "version": "2.0.0.0",
  800. "name": "mscorlib"
  801. },
  802. {
  803. "version": "8.0.0.0",
  804. "name": "Microsoft.VisualBasic"
  805. },
  806. {
  807. "version": "2.0.0.0",
  808. "name": "System"
  809. },
  810. {
  811. "version": "2.0.0.0",
  812. "name": "System.Web.Services"
  813. },
  814. {
  815. "version": "2.0.0.0",
  816. "name": "System.Xml"
  817. }
  818. ],
  819. "typerefs": [
  820. {
  821. "typename": "Microsoft.VisualBasic.ApplicationServices.ApplicationBase",
  822. "assembly": "Microsoft.VisualBasic"
  823. },
  824. {
  825. "typename": "Microsoft.VisualBasic.ApplicationServices.User",
  826. "assembly": "Microsoft.VisualBasic"
  827. },
  828. {
  829. "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
  830. "assembly": "Microsoft.VisualBasic"
  831. },
  832. {
  833. "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
  834. "assembly": "Microsoft.VisualBasic"
  835. },
  836. {
  837. "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
  838. "assembly": "Microsoft.VisualBasic"
  839. },
  840. {
  841. "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
  842. "assembly": "Microsoft.VisualBasic"
  843. },
  844. {
  845. "typename": "Microsoft.VisualBasic.Devices.Computer",
  846. "assembly": "Microsoft.VisualBasic"
  847. },
  848. {
  849. "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
  850. "assembly": "Microsoft.VisualBasic"
  851. },
  852. {
  853. "typename": "Microsoft.VisualBasic.Interaction",
  854. "assembly": "Microsoft.VisualBasic"
  855. },
  856. {
  857. "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
  858. "assembly": "Microsoft.VisualBasic"
  859. },
  860. {
  861. "typename": "Microsoft.VisualBasic.MyServices.Internal.ContextValue`1",
  862. "assembly": "Microsoft.VisualBasic"
  863. },
  864. {
  865. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  866. "assembly": "System"
  867. },
  868. {
  869. "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
  870. "assembly": "System"
  871. },
  872. {
  873. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  874. "assembly": "System"
  875. },
  876. {
  877. "typename": "System.ComponentModel.EditorBrowsableState",
  878. "assembly": "System"
  879. },
  880. {
  881. "typename": "System.Configuration.ApplicationSettingsBase",
  882. "assembly": "System"
  883. },
  884. {
  885. "typename": "System.Configuration.SettingsBase",
  886. "assembly": "System"
  887. },
  888. {
  889. "typename": "System.Diagnostics.Process",
  890. "assembly": "System"
  891. },
  892. {
  893. "typename": "System.Diagnostics.ProcessModule",
  894. "assembly": "System"
  895. },
  896. {
  897. "typename": "System.Diagnostics.ProcessModuleCollection",
  898. "assembly": "System"
  899. },
  900. {
  901. "typename": "System.Net.HttpWebRequest",
  902. "assembly": "System"
  903. },
  904. {
  905. "typename": "System.Net.ServicePoint",
  906. "assembly": "System"
  907. },
  908. {
  909. "typename": "System.Net.WebRequest",
  910. "assembly": "System"
  911. },
  912. {
  913. "typename": "System.Uri",
  914. "assembly": "System"
  915. },
  916. {
  917. "typename": "System.Web.Services.Protocols.SoapDocumentMethodAttribute",
  918. "assembly": "System.Web.Services"
  919. },
  920. {
  921. "typename": "System.Web.Services.Protocols.SoapHttpClientProtocol",
  922. "assembly": "System.Web.Services"
  923. },
  924. {
  925. "typename": "System.Web.Services.Protocols.WebClientProtocol",
  926. "assembly": "System.Web.Services"
  927. },
  928. {
  929. "typename": "System.Web.Services.WebServiceBindingAttribute",
  930. "assembly": "System.Web.Services"
  931. },
  932. {
  933. "typename": "System.Xml.Serialization.XmlElementAttribute",
  934. "assembly": "System.Xml"
  935. },
  936. {
  937. "typename": "System.Activator",
  938. "assembly": "mscorlib"
  939. },
  940. {
  941. "typename": "System.AppDomain",
  942. "assembly": "mscorlib"
  943. },
  944. {
  945. "typename": "System.ArgumentOutOfRangeException",
  946. "assembly": "mscorlib"
  947. },
  948. {
  949. "typename": "System.Array",
  950. "assembly": "mscorlib"
  951. },
  952. {
  953. "typename": "System.AsyncCallback",
  954. "assembly": "mscorlib"
  955. },
  956. {
  957. "typename": "System.Attribute",
  958. "assembly": "mscorlib"
  959. },
  960. {
  961. "typename": "System.AttributeTargets",
  962. "assembly": "mscorlib"
  963. },
  964. {
  965. "typename": "System.AttributeUsageAttribute",
  966. "assembly": "mscorlib"
  967. },
  968. {
  969. "typename": "System.BadImageFormatException",
  970. "assembly": "mscorlib"
  971. },
  972. {
  973. "typename": "System.BitConverter",
  974. "assembly": "mscorlib"
  975. },
  976. {
  977. "typename": "System.Boolean",
  978. "assembly": "mscorlib"
  979. },
  980. {
  981. "typename": "System.Buffer",
  982. "assembly": "mscorlib"
  983. },
  984. {
  985. "typename": "System.Byte",
  986. "assembly": "mscorlib"
  987. },
  988. {
  989. "typename": "System.Char",
  990. "assembly": "mscorlib"
  991. },
  992. {
  993. "typename": "System.Collections.Generic.Dictionary`2",
  994. "assembly": "mscorlib"
  995. },
  996. {
  997. "typename": "System.Collections.IEnumerator",
  998. "assembly": "mscorlib"
  999. },
  1000. {
  1001. "typename": "System.Collections.ReadOnlyCollectionBase",
  1002. "assembly": "mscorlib"
  1003. },
  1004. {
  1005. "typename": "System.Convert",
  1006. "assembly": "mscorlib"
  1007. },
  1008. {
  1009. "typename": "System.Delegate",
  1010. "assembly": "mscorlib"
  1011. },
  1012. {
  1013. "typename": "System.Diagnostics.DebuggerDisplayAttribute",
  1014. "assembly": "mscorlib"
  1015. },
  1016. {
  1017. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  1018. "assembly": "mscorlib"
  1019. },
  1020. {
  1021. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  1022. "assembly": "mscorlib"
  1023. },
  1024. {
  1025. "typename": "System.Diagnostics.StackFrame",
  1026. "assembly": "mscorlib"
  1027. },
  1028. {
  1029. "typename": "System.Diagnostics.StackTrace",
  1030. "assembly": "mscorlib"
  1031. },
  1032. {
  1033. "typename": "System.Enum",
  1034. "assembly": "mscorlib"
  1035. },
  1036. {
  1037. "typename": "System.Exception",
  1038. "assembly": "mscorlib"
  1039. },
  1040. {
  1041. "typename": "System.FlagsAttribute",
  1042. "assembly": "mscorlib"
  1043. },
  1044. {
  1045. "typename": "System.FormatException",
  1046. "assembly": "mscorlib"
  1047. },
  1048. {
  1049. "typename": "System.GC",
  1050. "assembly": "mscorlib"
  1051. },
  1052. {
  1053. "typename": "System.Globalization.CultureInfo",
  1054. "assembly": "mscorlib"
  1055. },
  1056. {
  1057. "typename": "System.IAsyncResult",
  1058. "assembly": "mscorlib"
  1059. },
  1060. {
  1061. "typename": "System.IDisposable",
  1062. "assembly": "mscorlib"
  1063. },
  1064. {
  1065. "typename": "System.IO.Directory",
  1066. "assembly": "mscorlib"
  1067. },
  1068. {
  1069. "typename": "System.IO.DirectoryInfo",
  1070. "assembly": "mscorlib"
  1071. },
  1072. {
  1073. "typename": "System.IO.File",
  1074. "assembly": "mscorlib"
  1075. },
  1076. {
  1077. "typename": "System.IO.FileLoadException",
  1078. "assembly": "mscorlib"
  1079. },
  1080. {
  1081. "typename": "System.IO.FileStream",
  1082. "assembly": "mscorlib"
  1083. },
  1084. {
  1085. "typename": "System.IO.MemoryStream",
  1086. "assembly": "mscorlib"
  1087. },
  1088. {
  1089. "typename": "System.IO.Path",
  1090. "assembly": "mscorlib"
  1091. },
  1092. {
  1093. "typename": "System.IO.Stream",
  1094. "assembly": "mscorlib"
  1095. },
  1096. {
  1097. "typename": "System.Int16",
  1098. "assembly": "mscorlib"
  1099. },
  1100. {
  1101. "typename": "System.Int32",
  1102. "assembly": "mscorlib"
  1103. },
  1104. {
  1105. "typename": "System.IntPtr",
  1106. "assembly": "mscorlib"
  1107. },
  1108. {
  1109. "typename": "System.InvalidOperationException",
  1110. "assembly": "mscorlib"
  1111. },
  1112. {
  1113. "typename": "System.Math",
  1114. "assembly": "mscorlib"
  1115. },
  1116. {
  1117. "typename": "System.MulticastDelegate",
  1118. "assembly": "mscorlib"
  1119. },
  1120. {
  1121. "typename": "System.Object",
  1122. "assembly": "mscorlib"
  1123. },
  1124. {
  1125. "typename": "System.Reflection.Assembly",
  1126. "assembly": "mscorlib"
  1127. },
  1128. {
  1129. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  1130. "assembly": "mscorlib"
  1131. },
  1132. {
  1133. "typename": "System.Reflection.AssemblyName",
  1134. "assembly": "mscorlib"
  1135. },
  1136. {
  1137. "typename": "System.Reflection.MemberInfo",
  1138. "assembly": "mscorlib"
  1139. },
  1140. {
  1141. "typename": "System.Reflection.MethodBase",
  1142. "assembly": "mscorlib"
  1143. },
  1144. {
  1145. "typename": "System.Reflection.Module",
  1146. "assembly": "mscorlib"
  1147. },
  1148. {
  1149. "typename": "System.ResolveEventArgs",
  1150. "assembly": "mscorlib"
  1151. },
  1152. {
  1153. "typename": "System.ResolveEventHandler",
  1154. "assembly": "mscorlib"
  1155. },
  1156. {
  1157. "typename": "System.Resources.ResourceManager",
  1158. "assembly": "mscorlib"
  1159. },
  1160. {
  1161. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  1162. "assembly": "mscorlib"
  1163. },
  1164. {
  1165. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  1166. "assembly": "mscorlib"
  1167. },
  1168. {
  1169. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  1170. "assembly": "mscorlib"
  1171. },
  1172. {
  1173. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  1174. "assembly": "mscorlib"
  1175. },
  1176. {
  1177. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  1178. "assembly": "mscorlib"
  1179. },
  1180. {
  1181. "typename": "System.Runtime.InteropServices.Marshal",
  1182. "assembly": "mscorlib"
  1183. },
  1184. {
  1185. "typename": "System.RuntimeFieldHandle",
  1186. "assembly": "mscorlib"
  1187. },
  1188. {
  1189. "typename": "System.RuntimeTypeHandle",
  1190. "assembly": "mscorlib"
  1191. },
  1192. {
  1193. "typename": "System.STAThreadAttribute",
  1194. "assembly": "mscorlib"
  1195. },
  1196. {
  1197. "typename": "System.Security.Cryptography.CipherMode",
  1198. "assembly": "mscorlib"
  1199. },
  1200. {
  1201. "typename": "System.Security.Cryptography.CryptoStream",
  1202. "assembly": "mscorlib"
  1203. },
  1204. {
  1205. "typename": "System.Security.Cryptography.CryptoStreamMode",
  1206. "assembly": "mscorlib"
  1207. },
  1208. {
  1209. "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
  1210. "assembly": "mscorlib"
  1211. },
  1212. {
  1213. "typename": "System.Security.Cryptography.HashAlgorithm",
  1214. "assembly": "mscorlib"
  1215. },
  1216. {
  1217. "typename": "System.Security.Cryptography.ICryptoTransform",
  1218. "assembly": "mscorlib"
  1219. },
  1220. {
  1221. "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
  1222. "assembly": "mscorlib"
  1223. },
  1224. {
  1225. "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
  1226. "assembly": "mscorlib"
  1227. },
  1228. {
  1229. "typename": "System.Security.Cryptography.RijndaelManaged",
  1230. "assembly": "mscorlib"
  1231. },
  1232. {
  1233. "typename": "System.Security.Cryptography.SymmetricAlgorithm",
  1234. "assembly": "mscorlib"
  1235. },
  1236. {
  1237. "typename": "System.Security.SecurityException",
  1238. "assembly": "mscorlib"
  1239. },
  1240. {
  1241. "typename": "System.String",
  1242. "assembly": "mscorlib"
  1243. },
  1244. {
  1245. "typename": "System.Text.Encoding",
  1246. "assembly": "mscorlib"
  1247. },
  1248. {
  1249. "typename": "System.Text.StringBuilder",
  1250. "assembly": "mscorlib"
  1251. },
  1252. {
  1253. "typename": "System.Threading.Monitor",
  1254. "assembly": "mscorlib"
  1255. },
  1256. {
  1257. "typename": "System.Threading.Thread",
  1258. "assembly": "mscorlib"
  1259. },
  1260. {
  1261. "typename": "System.Threading.ThreadStart",
  1262. "assembly": "mscorlib"
  1263. },
  1264. {
  1265. "typename": "System.Type",
  1266. "assembly": "mscorlib"
  1267. },
  1268. {
  1269. "typename": "System.ValueType",
  1270. "assembly": "mscorlib"
  1271. },
  1272. {
  1273. "typename": "System.Version",
  1274. "assembly": "mscorlib"
  1275. }
  1276. ]
  1277. },
  1278. "pe": {
  1279. "peid_signatures": null,
  1280. "imports": [
  1281. {
  1282. "imports": [
  1283. {
  1284. "name": "_CorExeMain",
  1285. "address": "0x402000"
  1286. }
  1287. ],
  1288. "dll": "mscoree.dll"
  1289. }
  1290. ],
  1291. "digital_signers": null,
  1292. "exported_dll_name": null,
  1293. "actual_checksum": "0x00045752",
  1294. "overlay": null,
  1295. "imagebase": "0x00400000",
  1296. "reported_checksum": "0x00000000",
  1297. "icon_hash": null,
  1298. "entrypoint": "0x0043af12",
  1299. "timestamp": "2019-06-18 08:29:39",
  1300. "osversion": "4.0",
  1301. "sections": [
  1302. {
  1303. "name": ".text",
  1304. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1305. "virtual_address": "0x00002000",
  1306. "size_of_data": "0x00039000",
  1307. "entropy": "7.84",
  1308. "raw_address": "0x00000200",
  1309. "virtual_size": "0x00038f18",
  1310. "characteristics_raw": "0x60000020"
  1311. },
  1312. {
  1313. "name": ".rsrc",
  1314. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1315. "virtual_address": "0x0003c000",
  1316. "size_of_data": "0x00000400",
  1317. "entropy": "4.43",
  1318. "raw_address": "0x00039200",
  1319. "virtual_size": "0x00000394",
  1320. "characteristics_raw": "0x40000040"
  1321. },
  1322. {
  1323. "name": ".reloc",
  1324. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1325. "virtual_address": "0x0003e000",
  1326. "size_of_data": "0x00000200",
  1327. "entropy": "0.10",
  1328. "raw_address": "0x00039600",
  1329. "virtual_size": "0x0000000c",
  1330. "characteristics_raw": "0x42000040"
  1331. }
  1332. ],
  1333. "resources": [],
  1334. "dirents": [
  1335. {
  1336. "virtual_address": "0x00000000",
  1337. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1338. "size": "0x00000000"
  1339. },
  1340. {
  1341. "virtual_address": "0x0003aec8",
  1342. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1343. "size": "0x0000004a"
  1344. },
  1345. {
  1346. "virtual_address": "0x0003c000",
  1347. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1348. "size": "0x00000394"
  1349. },
  1350. {
  1351. "virtual_address": "0x00000000",
  1352. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1353. "size": "0x00000000"
  1354. },
  1355. {
  1356. "virtual_address": "0x00000000",
  1357. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1358. "size": "0x00000000"
  1359. },
  1360. {
  1361. "virtual_address": "0x0003e000",
  1362. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1363. "size": "0x0000000c"
  1364. },
  1365. {
  1366. "virtual_address": "0x00000000",
  1367. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1368. "size": "0x00000000"
  1369. },
  1370. {
  1371. "virtual_address": "0x00000000",
  1372. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1373. "size": "0x00000000"
  1374. },
  1375. {
  1376. "virtual_address": "0x00000000",
  1377. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1378. "size": "0x00000000"
  1379. },
  1380. {
  1381. "virtual_address": "0x00000000",
  1382. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1383. "size": "0x00000000"
  1384. },
  1385. {
  1386. "virtual_address": "0x00000000",
  1387. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1388. "size": "0x00000000"
  1389. },
  1390. {
  1391. "virtual_address": "0x00000000",
  1392. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1393. "size": "0x00000000"
  1394. },
  1395. {
  1396. "virtual_address": "0x00002000",
  1397. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1398. "size": "0x00000008"
  1399. },
  1400. {
  1401. "virtual_address": "0x00000000",
  1402. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1403. "size": "0x00000000"
  1404. },
  1405. {
  1406. "virtual_address": "0x00002008",
  1407. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1408. "size": "0x00000048"
  1409. },
  1410. {
  1411. "virtual_address": "0x00000000",
  1412. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1413. "size": "0x00000000"
  1414. }
  1415. ],
  1416. "exports": [],
  1417. "guest_signers": {},
  1418. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1419. "icon_fuzzy": null,
  1420. "icon": null,
  1421. "pdbpath": null,
  1422. "imported_dll_count": 1,
  1423. "versioninfo": []
  1424. }
  1425. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!