API tools faq
paste
paladin316

Exes_b3317fbea3178225c9e8f508eb7a8741_exe_2019-07-03_05_30.json

paladin316
Jul 3rd, 2019
2,129
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 26.14 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Rdrhi"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_b3317fbea3178225c9e8f508eb7a8741.exe"
  7. [*] File Size: 1257175
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "1c630fc8334261d920a2d851e34e1c0d7d6fd5ca1690f1ec9183854a8d1b0a5a"
  10. [*] MD5: "b3317fbea3178225c9e8f508eb7a8741"
  11. [*] SHA1: "66b0b447ec28468df79eb8e5fe6b54e11681a4d7"
  12. [*] SHA512: "8ab13d0c8d7a53f996548b61ea4161c25c51943672eca27a0a6caaac733ce6c28247c3599b55ebd8fde1f485b77a269abcb5346ffc1e8f5dfc2317b120e8d9fb"
  13. [*] CRC32: "9842CC90"
  14. [*] SSDEEP: "24576:74N+pJpkLkr/JWlB22q+13OO/PT8y8YYKXKgOb9P12Br:M+pJpkOWlo2N1vX/Y4V09d25"
  15.  
  16. [*] Process Execution: [
  17. "Exes_b3317fbea3178225c9e8f508eb7a8741.exe",
  18. "svchost.exe",
  19. "cmd.exe",
  20. "PING.EXE"
  21. ]
  22.  
  23. [*] Signatures Detected: [
  24. {
  25. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  26. "Details": [
  27. {
  28. "IP": "134.175.107.117:80"
  29. },
  30. {
  31. "IP": "118.25.165.228:443"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "Creates RWX memory",
  37. "Details": []
  38. },
  39. {
  40. "Description": "Possible date expiration check, exits too soon after checking local time",
  41. "Details": [
  42. {
  43. "process": "Exes_b3317fbea3178225c9e8f508eb7a8741.exe, PID 1320"
  44. }
  45. ]
  46. },
  47. {
  48. "Description": "Network anomalies occured during the analysis.",
  49. "Details": [
  50. {
  51. "Anomaly": "'1.0.0.1' getaddrinfo with no actual connection to the IP."
  52. }
  53. ]
  54. },
  55. {
  56. "Description": "Starts servers listening on 127.0.0.1:54323",
  57. "Details": []
  58. },
  59. {
  60. "Description": "A process created a hidden window",
  61. "Details": [
  62. {
  63. "Process": "Exes_b3317fbea3178225c9e8f508eb7a8741.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\8344.bat"
  64. }
  65. ]
  66. },
  67. {
  68. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  69. "Details": [
  70. {
  71. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  72. },
  73. {
  74. "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"
  75. },
  76. {
  77. "suspicious_request": "http://aol.vready.cn/terminal/start-up"
  78. }
  79. ]
  80. },
  81. {
  82. "Description": "Performs some HTTP requests",
  83. "Details": [
  84. {
  85. "url": "http://aol.vready.cn/terminal/start-up"
  86. }
  87. ]
  88. },
  89. {
  90. "Description": "The binary likely contains encrypted or compressed data.",
  91. "Details": [
  92. {
  93. "section": "name: .rsrc, entropy: 8.00, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00132cd7, virtual_size: 0x0013a000"
  94. }
  95. ]
  96. },
  97. {
  98. "Description": "Deletes its original binary from disk",
  99. "Details": []
  100. },
  101. {
  102. "Description": "File has been identified by 53 Antiviruses on VirusTotal as malicious",
  103. "Details": [
  104. {
  105. "MicroWorld-eScan": "Gen:Win32.ExplorerHijack.mjGeae!RDrhi"
  106. },
  107. {
  108. "CAT-QuickHeal": "Trojan.Generic"
  109. },
  110. {
  111. "McAfee": "Artemis!B3317FBEA317"
  112. },
  113. {
  114. "VIPRE": "Packed.Win32.Upack (v)"
  115. },
  116. {
  117. "K7AntiVirus": "Trojan ( 005329b91 )"
  118. },
  119. {
  120. "Alibaba": "TrojanDropper:Win32/dropper.ali1003001"
  121. },
  122. {
  123. "K7GW": "Trojan ( 005329b91 )"
  124. },
  125. {
  126. "Cybereason": "malicious.ea3178"
  127. },
  128. {
  129. "Arcabit": "Gen:Win32.ExplorerHijack.mjGeae!RDrhi"
  130. },
  131. {
  132. "TrendMicro": "Cryp_Xed-12"
  133. },
  134. {
  135. "Symantec": "Trojan.Gen.MBT"
  136. },
  137. {
  138. "APEX": "Malicious"
  139. },
  140. {
  141. "Paloalto": "generic.ml"
  142. },
  143. {
  144. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  145. },
  146. {
  147. "BitDefender": "Gen:Win32.ExplorerHijack.mjGeae!RDrhi"
  148. },
  149. {
  150. "NANO-Antivirus": "Trojan.Win32.OnLineGames.frdpvr"
  151. },
  152. {
  153. "Avast": "Win32:Malware-gen"
  154. },
  155. {
  156. "Tencent": "Win32.Trojan-gamethief.Onlinegames.Pcrx"
  157. },
  158. {
  159. "Ad-Aware": "Gen:Win32.ExplorerHijack.mjGeae!RDrhi"
  160. },
  161. {
  162. "Emsisoft": "Gen:Win32.ExplorerHijack.mjGeae!RDrhi (B)"
  163. },
  164. {
  165. "Comodo": "Packed.Win32.Klone.~KMG@1knj1d"
  166. },
  167. {
  168. "F-Secure": "Trojan.TR/Downloader.Gen"
  169. },
  170. {
  171. "DrWeb": "Trojan.DownLoader27.44803"
  172. },
  173. {
  174. "Zillya": "Trojan.Generic.Win32.846498"
  175. },
  176. {
  177. "Invincea": "heuristic"
  178. },
  179. {
  180. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  181. },
  182. {
  183. "Trapmine": "malicious.high.ml.score"
  184. },
  185. {
  186. "FireEye": "Generic.mg.b3317fbea3178225"
  187. },
  188. {
  189. "Sophos": "Mal/EncPk-BW"
  190. },
  191. {
  192. "Ikarus": "Trojan-PSW.OnlineGames"
  193. },
  194. {
  195. "Jiangmin": "Trojan.PSW.Coins.ccb"
  196. },
  197. {
  198. "Avira": "TR/Downloader.Gen"
  199. },
  200. {
  201. "MAX": "malware (ai score=100)"
  202. },
  203. {
  204. "Microsoft": "Trojan:Win32/Occamy.C"
  205. },
  206. {
  207. "Endgame": "malicious (high confidence)"
  208. },
  209. {
  210. "AegisLab": "Trojan.Win32.Generic.4!c"
  211. },
  212. {
  213. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  214. },
  215. {
  216. "GData": "Gen:Win32.ExplorerHijack.mjGeae!RDrhi"
  217. },
  218. {
  219. "AhnLab-V3": "Packed/Upack"
  220. },
  221. {
  222. "Acronis": "suspicious"
  223. },
  224. {
  225. "VBA32": "BScope.Trojan.Downloader"
  226. },
  227. {
  228. "ALYac": "Gen:Win32.ExplorerHijack.mjGeae!RDrhi"
  229. },
  230. {
  231. "Cylance": "Unsafe"
  232. },
  233. {
  234. "ESET-NOD32": "a variant of Win32/PSW.OnLineGames.QZO"
  235. },
  236. {
  237. "TrendMicro-HouseCall": "Cryp_Xed-12"
  238. },
  239. {
  240. "Rising": "Stealer.OnLineGames!8.131 (CLOUD)"
  241. },
  242. {
  243. "Yandex": "Trojan.Agent!rf3MO3ebhrQ"
  244. },
  245. {
  246. "SentinelOne": "DFI - Malicious PE"
  247. },
  248. {
  249. "eGambit": "Unsafe.AI_Score_99%"
  250. },
  251. {
  252. "Fortinet": "W32/Onlinegames.QZO!tr"
  253. },
  254. {
  255. "MaxSecure": "Trojan.Malware.300983.susgen"
  256. },
  257. {
  258. "AVG": "Win32:Malware-gen"
  259. },
  260. {
  261. "Qihoo-360": "HEUR/QVM14.0.82F3.Malware.Gen"
  262. }
  263. ]
  264. }
  265. ]
  266.  
  267. [*] Started Service: []
  268.  
  269. [*] Executed Commands: [
  270. "C:\\Windows\\syswow64\\svchost.exe -k NetTimeSvc",
  271. "C:\\Users\\user\\AppData\\Local\\Temp\\8344.bat ",
  272. "C:\\Windows\\system32\\PING.EXE ping 1.0.0.1 -n"
  273. ]
  274.  
  275. [*] Mutexes: [
  276. "[Guid(\"0A5D06B2-E8F1-42D1-B3AA-37D7C7174633\")]",
  277. "{B8592103-AE8C-4D37-807F-F1CB76E62B7C}",
  278. "[Guid(\"7583B8C3-2691-4F51-A989-D622AAC8508A\")]",
  279. "DBWinMutex"
  280. ]
  281.  
  282. [*] Modified Files: [
  283. "C:\\Windows\\System32\\ejxve32.dll",
  284. "C:\\Users\\user\\AppData\\Local\\Temp\\8344.bat",
  285. "C:\\Users\\user\\AppData\\Local\\Temp\\pmtxun.dll",
  286. "C:\\Users\\user\\AppData\\Local\\Temp\\ztdqakuh.dll",
  287. "C:\\Users\\user\\AppData\\Local\\Temp\\RCX6284.tmp",
  288. "\\??\\nul"
  289. ]
  290.  
  291. [*] Deleted Files: [
  292. "C:\\Users\\user\\AppData\\Local\\Temp\\ztdqakuh.dll",
  293. "C:\\Users\\user\\AppData\\Local\\Temp\\RCX6284.tmp",
  294. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_b3317fbea3178225c9e8f508eb7a8741.exe",
  295. "C:\\Users\\user\\AppData\\Local\\Temp\\8344.bat"
  296. ]
  297.  
  298. [*] Modified Registry Keys: []
  299.  
  300. [*] Deleted Registry Keys: []
  301.  
  302. [*] DNS Communications: [
  303. {
  304. "type": "A",
  305. "request": "v2api.v6.cn",
  306. "answers": [
  307. {
  308. "data": "118.25.165.228",
  309. "type": "A"
  310. }
  311. ]
  312. },
  313. {
  314. "type": "A",
  315. "request": "aol.vready.cn",
  316. "answers": [
  317. {
  318. "data": "134.175.107.117",
  319. "type": "A"
  320. }
  321. ]
  322. }
  323. ]
  324.  
  325. [*] Domains: [
  326. {
  327. "ip": "134.175.107.117",
  328. "domain": "aol.vready.cn"
  329. },
  330. {
  331. "ip": "118.25.165.228",
  332. "domain": "v2api.v6.cn"
  333. }
  334. ]
  335.  
  336. [*] Network Communication - ICMP: []
  337.  
  338. [*] Network Communication - HTTP: [
  339. {
  340. "count": 1,
  341. "body": "channel_id=ttzxj2&mac=18-C0-86-CD-47-29&ip=169.254.255.254
  342. "uri": "http://aol.vready.cn/terminal/start-up",
  343. "user-agent": "",
  344. "method": "POST",
  345. "host": "aol.vready.cn",
  346. "version": "1.1",
  347. "path": "/terminal/start-up",
  348. "data": "POST /terminal/start-up HTTP/1.1\r\nHost: aol.vready.cn\r\nAccept: */*\r\nContent-Length: 57\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nchannel_id=ttzxj2&mac=18-C0-86-CD-47-29&ip=169.254.255.254
  349. "port": 80
  350. }
  351. ]
  352.  
  353. [*] Network Communication - SMTP: []
  354.  
  355. [*] Network Communication - Hosts: []
  356.  
  357. [*] Network Communication - IRC: []
  358.  
  359. [*] Static Analysis: {
  360. "pe": {
  361. "peid_signatures": [
  362. [
  363. "Upack V0.37 -> Dwing"
  364. ],
  365. [
  366. "Upack_Patch or any Version -> Dwing"
  367. ],
  368. [
  369. "WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)"
  370. ]
  371. ],
  372. "imports": [
  373. {
  374. "imports": [
  375. {
  376. "name": "LoadLibraryA",
  377. "address": "0x852ca7"
  378. },
  379. {
  380. "name": "GetProcAddress",
  381. "address": "0x852cab"
  382. }
  383. ],
  384. "dll": "KERNEL32.DLL"
  385. }
  386. ],
  387. "digital_signers": null,
  388. "exported_dll_name": null,
  389. "actual_checksum": "0x001391ad",
  390. "overlay": null,
  391. "imagebase": "0x00400000",
  392. "reported_checksum": "0x00000000",
  393. "icon_hash": null,
  394. "entrypoint": "0x008529fb",
  395. "timestamp": "1970-01-01 01:08:16",
  396. "osversion": "4.0",
  397. "sections": [
  398. {
  399. "name": ".Upack",
  400. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  401. "virtual_address": "0x00001000",
  402. "size_of_data": "0x00000000",
  403. "entropy": "0.00",
  404. "raw_address": "0x00000000",
  405. "virtual_size": "0x0031f000",
  406. "characteristics_raw": "0xe0000060"
  407. },
  408. {
  409. "name": ".rsrc",
  410. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  411. "virtual_address": "0x00320000",
  412. "size_of_data": "0x00132cd7",
  413. "entropy": "8.00",
  414. "raw_address": "0x00000200",
  415. "virtual_size": "0x0013a000",
  416. "characteristics_raw": "0xe0000060"
  417. }
  418. ],
  419. "resources": [],
  420. "dirents": [
  421. {
  422. "virtual_address": "0x00000000",
  423. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  424. "size": "0x00000000"
  425. },
  426. {
  427. "virtual_address": "0x00452caf",
  428. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  429. "size": "0x00000014"
  430. },
  431. {
  432. "virtual_address": "0x00320000",
  433. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  434. "size": "0x000001e0"
  435. },
  436. {
  437. "virtual_address": "0x00000000",
  438. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  439. "size": "0x00000000"
  440. },
  441. {
  442. "virtual_address": "0x00000000",
  443. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  444. "size": "0x00000000"
  445. },
  446. {
  447. "virtual_address": "0x00000048",
  448. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  449. "size": "0x00000008"
  450. },
  451. {
  452. "virtual_address": "0x00000000",
  453. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  454. "size": "0x00000000"
  455. },
  456. {
  457. "virtual_address": "0x00000000",
  458. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  459. "size": "0x00000000"
  460. },
  461. {
  462. "virtual_address": "0x00000000",
  463. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  464. "size": "0x00000000"
  465. },
  466. {
  467. "virtual_address": "0x00000000",
  468. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  469. "size": "0x00000000"
  470. },
  471. {
  472. "virtual_address": "0x00000000",
  473. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  474. "size": "0x00000000"
  475. },
  476. {
  477. "virtual_address": "0x00000000",
  478. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  479. "size": "0x00000000"
  480. },
  481. {
  482. "virtual_address": "0x00000000",
  483. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  484. "size": "0x00000000"
  485. },
  486. {
  487. "virtual_address": "0x00000000",
  488. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  489. "size": "0x00000000"
  490. },
  491. {
  492. "virtual_address": "0x00000000",
  493. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  494. "size": "0x00000000"
  495. },
  496. {
  497. "virtual_address": "0x00000000",
  498. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  499. "size": "0x00000000"
  500. }
  501. ],
  502. "exports": [],
  503. "guest_signers": {},
  504. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  505. "icon_fuzzy": null,
  506. "icon": null,
  507. "pdbpath": null,
  508. "imported_dll_count": 1,
  509. "versioninfo": []
  510. }
  511. }
  512.  
  513. [*] Resolved APIs: [
  514. "shlwapi.dll.PathFileExistsA",
  515. "shlwapi.dll.PathAppendA",
  516. "kernel32.dll.ResumeThread",
  517. "kernel32.dll.GetModuleHandleA",
  518. "kernel32.dll.GetProcAddress",
  519. "kernel32.dll.VirtualAllocEx",
  520. "kernel32.dll.CreateRemoteThread",
  521. "kernel32.dll.CloseHandle",
  522. "kernel32.dll.CreateProcessW",
  523. "kernel32.dll.GetModuleFileNameA",
  524. "kernel32.dll.VirtualAlloc",
  525. "kernel32.dll.WriteFile",
  526. "kernel32.dll.lstrlenA",
  527. "kernel32.dll.lstrcatA",
  528. "kernel32.dll.Sleep",
  529. "kernel32.dll.GetTempPathA",
  530. "kernel32.dll.CreateFileA",
  531. "kernel32.dll.GetSystemDirectoryA",
  532. "kernel32.dll.QueryPerformanceFrequency",
  533. "kernel32.dll.ExitProcess",
  534. "kernel32.dll.VerSetConditionMask",
  535. "kernel32.dll.VerifyVersionInfoW",
  536. "kernel32.dll.QueryPerformanceCounter",
  537. "kernel32.dll.GetTickCount",
  538. "kernel32.dll.ExpandEnvironmentStringsW",
  539. "kernel32.dll.SetFilePointerEx",
  540. "kernel32.dll.HeapReAlloc",
  541. "kernel32.dll.HeapSize",
  542. "kernel32.dll.WriteProcessMemory",
  543. "kernel32.dll.WriteConsoleW",
  544. "kernel32.dll.CreateFileW",
  545. "kernel32.dll.GetCurrentProcess",
  546. "kernel32.dll.GetModuleHandleW",
  547. "kernel32.dll.GetConsoleMode",
  548. "kernel32.dll.GetConsoleCP",
  549. "kernel32.dll.UnhandledExceptionFilter",
  550. "kernel32.dll.SetUnhandledExceptionFilter",
  551. "kernel32.dll.TerminateProcess",
  552. "kernel32.dll.IsProcessorFeaturePresent",
  553. "kernel32.dll.GetCurrentProcessId",
  554. "kernel32.dll.GetCurrentThreadId",
  555. "kernel32.dll.GetSystemTimeAsFileTime",
  556. "kernel32.dll.InitializeSListHead",
  557. "kernel32.dll.IsDebuggerPresent",
  558. "kernel32.dll.GetStartupInfoW",
  559. "kernel32.dll.RtlUnwind",
  560. "kernel32.dll.RaiseException",
  561. "kernel32.dll.GetLastError",
  562. "kernel32.dll.SetLastError",
  563. "kernel32.dll.EnterCriticalSection",
  564. "kernel32.dll.LeaveCriticalSection",
  565. "kernel32.dll.DeleteCriticalSection",
  566. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  567. "kernel32.dll.TlsAlloc",
  568. "kernel32.dll.TlsGetValue",
  569. "kernel32.dll.TlsSetValue",
  570. "kernel32.dll.TlsFree",
  571. "kernel32.dll.FreeLibrary",
  572. "kernel32.dll.LoadLibraryExW",
  573. "kernel32.dll.MultiByteToWideChar",
  574. "kernel32.dll.GetStdHandle",
  575. "kernel32.dll.WideCharToMultiByte",
  576. "kernel32.dll.GetModuleHandleExW",
  577. "kernel32.dll.GetACP",
  578. "kernel32.dll.HeapAlloc",
  579. "kernel32.dll.HeapFree",
  580. "kernel32.dll.LCMapStringW",
  581. "kernel32.dll.GetFileType",
  582. "kernel32.dll.MoveFileExW",
  583. "kernel32.dll.FindClose",
  584. "kernel32.dll.FindFirstFileExA",
  585. "kernel32.dll.FindNextFileA",
  586. "kernel32.dll.IsValidCodePage",
  587. "kernel32.dll.GetOEMCP",
  588. "kernel32.dll.GetCPInfo",
  589. "kernel32.dll.GetCommandLineA",
  590. "kernel32.dll.GetCommandLineW",
  591. "kernel32.dll.GetEnvironmentStringsW",
  592. "kernel32.dll.FreeEnvironmentStringsW",
  593. "kernel32.dll.SetStdHandle",
  594. "kernel32.dll.GetStringTypeW",
  595. "kernel32.dll.GetProcessHeap",
  596. "kernel32.dll.FlushFileBuffers",
  597. "user32.dll.wsprintfA",
  598. "advapi32.dll.AdjustTokenPrivileges",
  599. "advapi32.dll.LookupPrivilegeValueA",
  600. "advapi32.dll.OpenProcessToken",
  601. "shell32.dll.ShellExecuteA",
  602. "kernel32.dll.InitializeCriticalSectionEx",
  603. "kernel32.dll.FlsAlloc",
  604. "kernel32.dll.FlsSetValue",
  605. "kernel32.dll.FlsGetValue",
  606. "kernel32.dll.LCMapStringEx",
  607. "kernel32.dll.IsWow64Process",
  608. "kernel32.dll.SortGetHandle",
  609. "kernel32.dll.SortCloseHandle",
  610. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  611. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  612. "advapi32.dll.UnregisterTraceGuids",
  613. "comctl32.dll.#321",
  614. "ejxve32.dll.GO",
  615. "kernel32.dll.FlsFree",
  616. "kernel32.dll.InitOnceExecuteOnce",
  617. "kernel32.dll.CreateEventExW",
  618. "kernel32.dll.CreateSemaphoreW",
  619. "kernel32.dll.CreateSemaphoreExW",
  620. "kernel32.dll.CreateThreadpoolTimer",
  621. "kernel32.dll.SetThreadpoolTimer",
  622. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  623. "kernel32.dll.CloseThreadpoolTimer",
  624. "kernel32.dll.CreateThreadpoolWait",
  625. "kernel32.dll.SetThreadpoolWait",
  626. "kernel32.dll.CloseThreadpoolWait",
  627. "kernel32.dll.FlushProcessWriteBuffers",
  628. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  629. "kernel32.dll.GetCurrentProcessorNumber",
  630. "kernel32.dll.CreateSymbolicLinkW",
  631. "kernel32.dll.GetTickCount64",
  632. "kernel32.dll.GetFileInformationByHandleEx",
  633. "kernel32.dll.SetFileInformationByHandle",
  634. "kernel32.dll.InitializeConditionVariable",
  635. "kernel32.dll.WakeConditionVariable",
  636. "kernel32.dll.WakeAllConditionVariable",
  637. "kernel32.dll.SleepConditionVariableCS",
  638. "kernel32.dll.InitializeSRWLock",
  639. "kernel32.dll.AcquireSRWLockExclusive",
  640. "kernel32.dll.TryAcquireSRWLockExclusive",
  641. "kernel32.dll.ReleaseSRWLockExclusive",
  642. "kernel32.dll.SleepConditionVariableSRW",
  643. "kernel32.dll.CreateThreadpoolWork",
  644. "kernel32.dll.SubmitThreadpoolWork",
  645. "kernel32.dll.CloseThreadpoolWork",
  646. "kernel32.dll.CompareStringEx",
  647. "kernel32.dll.GetLocaleInfoEx",
  648. "api-ms-win-core-synch-l1-2-0.dll.InitializeConditionVariable",
  649. "api-ms-win-core-synch-l1-2-0.dll.SleepConditionVariableCS",
  650. "api-ms-win-core-synch-l1-2-0.dll.WakeAllConditionVariable",
  651. "kernel32.dll.AreFileApisANSI",
  652. "pmtxun.dll.Start",
  653. "cryptsp.dll.CryptAcquireContextW",
  654. "cryptsp.dll.CryptGenRandom",
  655. "cryptsp.dll.CryptReleaseContext",
  656. "kernel32.dll.EnumSystemLocalesEx",
  657. "kernel32.dll.GetDateFormatEx",
  658. "kernel32.dll.GetTimeFormatEx",
  659. "kernel32.dll.GetUserDefaultLocaleName",
  660. "kernel32.dll.IsValidLocaleName",
  661. "kernel32.dll.LCIDToLocaleName",
  662. "kernel32.dll.LocaleNameToLCID",
  663. "ztdqakuh.dll.Install",
  664. "ztdqakuh.dll.UnInstall",
  665. "ztdqakuh.dll.SetTargetUrlCString",
  666. "ztdqakuh.dll.SetRedirectUrlStatus",
  667. "uxtheme.dll.ThemeInitApiHook",
  668. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  669. "kernel32.dll.QueryFullProcessImageNameA",
  670. "ws2_32.dll.inet_pton",
  671. "kernel32.dll.SetThreadUILanguage",
  672. "kernel32.dll.CopyFileExW",
  673. "kernel32.dll.SetConsoleInputExeNameW",
  674. "advapi32.dll.SaferIdentifyLevel",
  675. "advapi32.dll.SaferComputeTokenFromLevel",
  676. "advapi32.dll.SaferCloseLevel"
  677. ]
  678.  
  679. [*] Static Analysis: {
  680. "pe": {
  681. "peid_signatures": [
  682. [
  683. "Upack V0.37 -> Dwing"
  684. ],
  685. [
  686. "Upack_Patch or any Version -> Dwing"
  687. ],
  688. [
  689. "WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)"
  690. ]
  691. ],
  692. "imports": [
  693. {
  694. "imports": [
  695. {
  696. "name": "LoadLibraryA",
  697. "address": "0x852ca7"
  698. },
  699. {
  700. "name": "GetProcAddress",
  701. "address": "0x852cab"
  702. }
  703. ],
  704. "dll": "KERNEL32.DLL"
  705. }
  706. ],
  707. "digital_signers": null,
  708. "exported_dll_name": null,
  709. "actual_checksum": "0x001391ad",
  710. "overlay": null,
  711. "imagebase": "0x00400000",
  712. "reported_checksum": "0x00000000",
  713. "icon_hash": null,
  714. "entrypoint": "0x008529fb",
  715. "timestamp": "1970-01-01 01:08:16",
  716. "osversion": "4.0",
  717. "sections": [
  718. {
  719. "name": ".Upack",
  720. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  721. "virtual_address": "0x00001000",
  722. "size_of_data": "0x00000000",
  723. "entropy": "0.00",
  724. "raw_address": "0x00000000",
  725. "virtual_size": "0x0031f000",
  726. "characteristics_raw": "0xe0000060"
  727. },
  728. {
  729. "name": ".rsrc",
  730. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  731. "virtual_address": "0x00320000",
  732. "size_of_data": "0x00132cd7",
  733. "entropy": "8.00",
  734. "raw_address": "0x00000200",
  735. "virtual_size": "0x0013a000",
  736. "characteristics_raw": "0xe0000060"
  737. }
  738. ],
  739. "resources": [],
  740. "dirents": [
  741. {
  742. "virtual_address": "0x00000000",
  743. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  744. "size": "0x00000000"
  745. },
  746. {
  747. "virtual_address": "0x00452caf",
  748. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  749. "size": "0x00000014"
  750. },
  751. {
  752. "virtual_address": "0x00320000",
  753. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  754. "size": "0x000001e0"
  755. },
  756. {
  757. "virtual_address": "0x00000000",
  758. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  759. "size": "0x00000000"
  760. },
  761. {
  762. "virtual_address": "0x00000000",
  763. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  764. "size": "0x00000000"
  765. },
  766. {
  767. "virtual_address": "0x00000048",
  768. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  769. "size": "0x00000008"
  770. },
  771. {
  772. "virtual_address": "0x00000000",
  773. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  774. "size": "0x00000000"
  775. },
  776. {
  777. "virtual_address": "0x00000000",
  778. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  779. "size": "0x00000000"
  780. },
  781. {
  782. "virtual_address": "0x00000000",
  783. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  784. "size": "0x00000000"
  785. },
  786. {
  787. "virtual_address": "0x00000000",
  788. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  789. "size": "0x00000000"
  790. },
  791. {
  792. "virtual_address": "0x00000000",
  793. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  794. "size": "0x00000000"
  795. },
  796. {
  797. "virtual_address": "0x00000000",
  798. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  799. "size": "0x00000000"
  800. },
  801. {
  802. "virtual_address": "0x00000000",
  803. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  804. "size": "0x00000000"
  805. },
  806. {
  807. "virtual_address": "0x00000000",
  808. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  809. "size": "0x00000000"
  810. },
  811. {
  812. "virtual_address": "0x00000000",
  813. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  814. "size": "0x00000000"
  815. },
  816. {
  817. "virtual_address": "0x00000000",
  818. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  819. "size": "0x00000000"
  820. }
  821. ],
  822. "exports": [],
  823. "guest_signers": {},
  824. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  825. "icon_fuzzy": null,
  826. "icon": null,
  827. "pdbpath": null,
  828. "imported_dll_count": 1,
  829. "versioninfo": []
  830. }
  831. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!