API tools faq
paste
paladin316

H7mp.json

paladin316
Jun 19th, 2019
2,210
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 77.19 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Cobaltstrike"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "H7mp"
  7. [*] File Size: 210944
  8. [*] File Type: "MS-DOS executable"
  9. [*] SHA256: "7e39ab47309c132628d0dd8c5e0f3f180bfa627fcb9147abe15293e95af086d2"
  10. [*] MD5: "aaa42893c3ae265ac08d5dbf2340a7df"
  11. [*] SHA1: "bbddc15cf6ca318bee3cdaf0711682504cba3df6"
  12. [*] SHA512: "e52ef752b9830340f2fb5758057789ad12e158fc8e86cf3202846713354419752dd11f0ee2cfa6a54443faaa9ac9f25363f82c6f3d6903fc3c47fe1c2fdc6b28"
  13. [*] CRC32: "DD547E1C"
  14. [*] SSDEEP: "3072:nryYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtfZoL5TuN:lXkiq4wfv4Kjnv+srwogay"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "File has been identified by 46 Antiviruses on VirusTotal as malicious",
  21. "Details": [
  22. {
  23. "MicroWorld-eScan": "Trojan.CobaltStrike.E"
  24. },
  25. {
  26. "FireEye": "Generic.mg.aaa42893c3ae265a"
  27. },
  28. {
  29. "CAT-QuickHeal": "Trojan.GenericPMF.S4808331"
  30. },
  31. {
  32. "McAfee": "CobaltStr-FDWE!AAA42893C3AE"
  33. },
  34. {
  35. "K7GW": "Riskware ( 0050f89b1 )"
  36. },
  37. {
  38. "K7AntiVirus": "Riskware ( 0050f89b1 )"
  39. },
  40. {
  41. "Arcabit": "Trojan.CobaltStrike.E"
  42. },
  43. {
  44. "F-Prot": "W32/S-2d1b851e!Eldorado"
  45. },
  46. {
  47. "Symantec": "ML.Attribute.HighConfidence"
  48. },
  49. {
  50. "APEX": "Malicious"
  51. },
  52. {
  53. "Avast": "Win32:Malware-gen"
  54. },
  55. {
  56. "Kaspersky": "HEUR:HackTool.Win32.Inject.heur"
  57. },
  58. {
  59. "BitDefender": "Trojan.CobaltStrike.E"
  60. },
  61. {
  62. "NANO-Antivirus": "Trojan.Win32.Inject.fiptsw"
  63. },
  64. {
  65. "Paloalto": "generic.ml"
  66. },
  67. {
  68. "Ad-Aware": "Trojan.CobaltStrike.E"
  69. },
  70. {
  71. "Emsisoft": "Trojan.CobaltStrike.E (B)"
  72. },
  73. {
  74. "F-Secure": "Trojan.TR/Proxy.Gen"
  75. },
  76. {
  77. "DrWeb": "BackDoor.Meterpreter.67"
  78. },
  79. {
  80. "Invincea": "heuristic"
  81. },
  82. {
  83. "McAfee-GW-Edition": "CobaltStr-FDWE!AAA42893C3AE"
  84. },
  85. {
  86. "Trapmine": "malicious.high.ml.score"
  87. },
  88. {
  89. "Sophos": "Mal/Swrort-Y"
  90. },
  91. {
  92. "SentinelOne": "DFI - Malicious PE"
  93. },
  94. {
  95. "Cyren": "W32/S-2d1b851e!Eldorado"
  96. },
  97. {
  98. "ESET-NOD32": "a variant of Win32/RiskWare.CobaltStrike.Beacon.A"
  99. },
  100. {
  101. "Avira": "TR/Proxy.Gen"
  102. },
  103. {
  104. "Antiy-AVL": "HackTool/Win32.Inject"
  105. },
  106. {
  107. "Microsoft": "VirTool:Win32/Atosev.A"
  108. },
  109. {
  110. "Endgame": "malicious (high confidence)"
  111. },
  112. {
  113. "ZoneAlarm": "HEUR:HackTool.Win32.Inject.heur"
  114. },
  115. {
  116. "GData": "Trojan.CobaltStrike.E"
  117. },
  118. {
  119. "AhnLab-V3": "HackTool/Win32.Cobalt.R218043"
  120. },
  121. {
  122. "Acronis": "suspicious"
  123. },
  124. {
  125. "VBA32": "BScope.Trojan.Cometer"
  126. },
  127. {
  128. "ALYac": "Trojan.CobaltStrike.E"
  129. },
  130. {
  131. "MAX": "malware (ai score=80)"
  132. },
  133. {
  134. "Cylance": "Unsafe"
  135. },
  136. {
  137. "Rising": "HackTool.Swrort!1.6477 (CLASSIC)"
  138. },
  139. {
  140. "Yandex": "RiskWare.CobaltStrike!"
  141. },
  142. {
  143. "Ikarus": "Virus.Win32.Atosev"
  144. },
  145. {
  146. "eGambit": "Trojan.Generic"
  147. },
  148. {
  149. "Fortinet": "Riskware/Inject"
  150. },
  151. {
  152. "AVG": "Win32:Malware-gen"
  153. },
  154. {
  155. "Panda": "Trj/Genetic.gen"
  156. },
  157. {
  158. "CrowdStrike": "win/malicious_confidence_100% (D)"
  159. }
  160. ]
  161. }
  162. ]
  163.  
  164. [*] Started Service: []
  165.  
  166. [*] Executed Commands: []
  167.  
  168. [*] Mutexes: []
  169.  
  170. [*] Modified Files: []
  171.  
  172. [*] Deleted Files: []
  173.  
  174. [*] Modified Registry Keys: []
  175.  
  176. [*] Deleted Registry Keys: []
  177.  
  178. [*] DNS Communications: []
  179.  
  180. [*] Domains: []
  181.  
  182. [*] Network Communication - ICMP: []
  183.  
  184. [*] Network Communication - HTTP: []
  185.  
  186. [*] Network Communication - SMTP: []
  187.  
  188. [*] Network Communication - Hosts: []
  189.  
  190. [*] Network Communication - IRC: []
  191.  
  192. [*] Static Analysis: {
  193. "pe": {
  194. "peid_signatures": null,
  195. "imports": [
  196. {
  197. "imports": [
  198. {
  199. "name": "UpdateProcThreadAttribute",
  200. "address": "0x100260b0"
  201. },
  202. {
  203. "name": "HeapFree",
  204. "address": "0x100260b4"
  205. },
  206. {
  207. "name": "GetProcessHeap",
  208. "address": "0x100260b8"
  209. },
  210. {
  211. "name": "CreateRemoteThread",
  212. "address": "0x100260bc"
  213. },
  214. {
  215. "name": "VirtualAlloc",
  216. "address": "0x100260c0"
  217. },
  218. {
  219. "name": "VirtualProtectEx",
  220. "address": "0x100260c4"
  221. },
  222. {
  223. "name": "VirtualAllocEx",
  224. "address": "0x100260c8"
  225. },
  226. {
  227. "name": "LoadLibraryA",
  228. "address": "0x100260cc"
  229. },
  230. {
  231. "name": "ProcessIdToSessionId",
  232. "address": "0x100260d0"
  233. },
  234. {
  235. "name": "DuplicateHandle",
  236. "address": "0x100260d4"
  237. },
  238. {
  239. "name": "InitializeProcThreadAttributeList",
  240. "address": "0x100260d8"
  241. },
  242. {
  243. "name": "WriteProcessMemory",
  244. "address": "0x100260dc"
  245. },
  246. {
  247. "name": "CreateThread",
  248. "address": "0x100260e0"
  249. },
  250. {
  251. "name": "GetThreadContext",
  252. "address": "0x100260e4"
  253. },
  254. {
  255. "name": "SetThreadContext",
  256. "address": "0x100260e8"
  257. },
  258. {
  259. "name": "FreeLibrary",
  260. "address": "0x100260ec"
  261. },
  262. {
  263. "name": "VirtualFree",
  264. "address": "0x100260f0"
  265. },
  266. {
  267. "name": "Thread32First",
  268. "address": "0x100260f4"
  269. },
  270. {
  271. "name": "Thread32Next",
  272. "address": "0x100260f8"
  273. },
  274. {
  275. "name": "SetLastError",
  276. "address": "0x100260fc"
  277. },
  278. {
  279. "name": "OpenThread",
  280. "address": "0x10026100"
  281. },
  282. {
  283. "name": "CreateToolhelp32Snapshot",
  284. "address": "0x10026104"
  285. },
  286. {
  287. "name": "GetVersionExA",
  288. "address": "0x10026108"
  289. },
  290. {
  291. "name": "SuspendThread",
  292. "address": "0x1002610c"
  293. },
  294. {
  295. "name": "ResumeThread",
  296. "address": "0x10026110"
  297. },
  298. {
  299. "name": "PeekNamedPipe",
  300. "address": "0x10026114"
  301. },
  302. {
  303. "name": "WaitNamedPipeA",
  304. "address": "0x10026118"
  305. },
  306. {
  307. "name": "SetNamedPipeHandleState",
  308. "address": "0x1002611c"
  309. },
  310. {
  311. "name": "LocalAlloc",
  312. "address": "0x10026120"
  313. },
  314. {
  315. "name": "LocalFree",
  316. "address": "0x10026124"
  317. },
  318. {
  319. "name": "GetComputerNameA",
  320. "address": "0x10026128"
  321. },
  322. {
  323. "name": "Process32First",
  324. "address": "0x1002612c"
  325. },
  326. {
  327. "name": "TerminateProcess",
  328. "address": "0x10026130"
  329. },
  330. {
  331. "name": "HeapAlloc",
  332. "address": "0x10026134"
  333. },
  334. {
  335. "name": "ExitProcess",
  336. "address": "0x10026138"
  337. },
  338. {
  339. "name": "DeleteProcThreadAttributeList",
  340. "address": "0x1002613c"
  341. },
  342. {
  343. "name": "VirtualProtect",
  344. "address": "0x10026140"
  345. },
  346. {
  347. "name": "FindNextFileA",
  348. "address": "0x10026144"
  349. },
  350. {
  351. "name": "MoveFileA",
  352. "address": "0x10026148"
  353. },
  354. {
  355. "name": "FindClose",
  356. "address": "0x1002614c"
  357. },
  358. {
  359. "name": "CopyFileA",
  360. "address": "0x10026150"
  361. },
  362. {
  363. "name": "FindFirstFileA",
  364. "address": "0x10026154"
  365. },
  366. {
  367. "name": "FileTimeToSystemTime",
  368. "address": "0x10026158"
  369. },
  370. {
  371. "name": "GetFileAttributesA",
  372. "address": "0x1002615c"
  373. },
  374. {
  375. "name": "ExpandEnvironmentStringsA",
  376. "address": "0x10026160"
  377. },
  378. {
  379. "name": "GetLogicalDrives",
  380. "address": "0x10026164"
  381. },
  382. {
  383. "name": "SystemTimeToTzSpecificLocalTime",
  384. "address": "0x10026168"
  385. },
  386. {
  387. "name": "GetFullPathNameA",
  388. "address": "0x1002616c"
  389. },
  390. {
  391. "name": "GetModuleHandleA",
  392. "address": "0x10026170"
  393. },
  394. {
  395. "name": "CreateNamedPipeA",
  396. "address": "0x10026174"
  397. },
  398. {
  399. "name": "GetProcAddress",
  400. "address": "0x10026178"
  401. },
  402. {
  403. "name": "ReadFile",
  404. "address": "0x1002617c"
  405. },
  406. {
  407. "name": "GetCurrentThread",
  408. "address": "0x10026180"
  409. },
  410. {
  411. "name": "ConnectNamedPipe",
  412. "address": "0x10026184"
  413. },
  414. {
  415. "name": "GetCurrentProcess",
  416. "address": "0x10026188"
  417. },
  418. {
  419. "name": "CloseHandle",
  420. "address": "0x1002618c"
  421. },
  422. {
  423. "name": "GetFileTime",
  424. "address": "0x10026190"
  425. },
  426. {
  427. "name": "GetCurrentDirectoryA",
  428. "address": "0x10026194"
  429. },
  430. {
  431. "name": "CreatePipe",
  432. "address": "0x10026198"
  433. },
  434. {
  435. "name": "GetCurrentDirectoryW",
  436. "address": "0x1002619c"
  437. },
  438. {
  439. "name": "GetLastError",
  440. "address": "0x100261a0"
  441. },
  442. {
  443. "name": "GetStartupInfoA",
  444. "address": "0x100261a4"
  445. },
  446. {
  447. "name": "SetCurrentDirectoryA",
  448. "address": "0x100261a8"
  449. },
  450. {
  451. "name": "FlushFileBuffers",
  452. "address": "0x100261ac"
  453. },
  454. {
  455. "name": "DisconnectNamedPipe",
  456. "address": "0x100261b0"
  457. },
  458. {
  459. "name": "MultiByteToWideChar",
  460. "address": "0x100261b4"
  461. },
  462. {
  463. "name": "CreateProcessA",
  464. "address": "0x100261b8"
  465. },
  466. {
  467. "name": "OpenProcess",
  468. "address": "0x100261bc"
  469. },
  470. {
  471. "name": "WriteFile",
  472. "address": "0x100261c0"
  473. },
  474. {
  475. "name": "SetFileTime",
  476. "address": "0x100261c4"
  477. },
  478. {
  479. "name": "WaitForSingleObject",
  480. "address": "0x100261c8"
  481. },
  482. {
  483. "name": "SetEnvironmentVariableW",
  484. "address": "0x100261cc"
  485. },
  486. {
  487. "name": "CreateFileA",
  488. "address": "0x100261d0"
  489. },
  490. {
  491. "name": "Sleep",
  492. "address": "0x100261d4"
  493. },
  494. {
  495. "name": "SetEnvironmentVariableA",
  496. "address": "0x100261d8"
  497. },
  498. {
  499. "name": "CompareStringW",
  500. "address": "0x100261dc"
  501. },
  502. {
  503. "name": "CompareStringA",
  504. "address": "0x100261e0"
  505. },
  506. {
  507. "name": "SetEndOfFile",
  508. "address": "0x100261e4"
  509. },
  510. {
  511. "name": "GetStringTypeW",
  512. "address": "0x100261e8"
  513. },
  514. {
  515. "name": "GetStringTypeA",
  516. "address": "0x100261ec"
  517. },
  518. {
  519. "name": "LCMapStringW",
  520. "address": "0x100261f0"
  521. },
  522. {
  523. "name": "LCMapStringA",
  524. "address": "0x100261f4"
  525. },
  526. {
  527. "name": "VirtualQuery",
  528. "address": "0x100261f8"
  529. },
  530. {
  531. "name": "GetModuleFileNameW",
  532. "address": "0x100261fc"
  533. },
  534. {
  535. "name": "SetStdHandle",
  536. "address": "0x10026200"
  537. },
  538. {
  539. "name": "WriteConsoleW",
  540. "address": "0x10026204"
  541. },
  542. {
  543. "name": "GetConsoleOutputCP",
  544. "address": "0x10026208"
  545. },
  546. {
  547. "name": "WriteConsoleA",
  548. "address": "0x1002620c"
  549. },
  550. {
  551. "name": "GetLocaleInfoA",
  552. "address": "0x10026210"
  553. },
  554. {
  555. "name": "HeapSize",
  556. "address": "0x10026214"
  557. },
  558. {
  559. "name": "IsValidCodePage",
  560. "address": "0x10026218"
  561. },
  562. {
  563. "name": "GetCPInfo",
  564. "address": "0x1002621c"
  565. },
  566. {
  567. "name": "DebugBreak",
  568. "address": "0x10026220"
  569. },
  570. {
  571. "name": "RaiseException",
  572. "address": "0x10026224"
  573. },
  574. {
  575. "name": "QueryPerformanceCounter",
  576. "address": "0x10026228"
  577. },
  578. {
  579. "name": "GetEnvironmentStringsW",
  580. "address": "0x1002622c"
  581. },
  582. {
  583. "name": "FreeEnvironmentStringsW",
  584. "address": "0x10026230"
  585. },
  586. {
  587. "name": "GetCurrentProcessId",
  588. "address": "0x10026234"
  589. },
  590. {
  591. "name": "GetOEMCP",
  592. "address": "0x10026238"
  593. },
  594. {
  595. "name": "GetLocalTime",
  596. "address": "0x1002623c"
  597. },
  598. {
  599. "name": "GetACP",
  600. "address": "0x10026240"
  601. },
  602. {
  603. "name": "Process32Next",
  604. "address": "0x10026244"
  605. },
  606. {
  607. "name": "GetTickCount",
  608. "address": "0x10026248"
  609. },
  610. {
  611. "name": "GetEnvironmentStrings",
  612. "address": "0x1002624c"
  613. },
  614. {
  615. "name": "FreeEnvironmentStringsA",
  616. "address": "0x10026250"
  617. },
  618. {
  619. "name": "SetFilePointer",
  620. "address": "0x10026254"
  621. },
  622. {
  623. "name": "GetFileType",
  624. "address": "0x10026258"
  625. },
  626. {
  627. "name": "GetModuleHandleW",
  628. "address": "0x1002625c"
  629. },
  630. {
  631. "name": "DeleteFileA",
  632. "address": "0x10026260"
  633. },
  634. {
  635. "name": "CreateDirectoryA",
  636. "address": "0x10026264"
  637. },
  638. {
  639. "name": "RemoveDirectoryA",
  640. "address": "0x10026268"
  641. },
  642. {
  643. "name": "GetCurrentThreadId",
  644. "address": "0x1002626c"
  645. },
  646. {
  647. "name": "GetCommandLineA",
  648. "address": "0x10026270"
  649. },
  650. {
  651. "name": "GetSystemTimeAsFileTime",
  652. "address": "0x10026274"
  653. },
  654. {
  655. "name": "UnhandledExceptionFilter",
  656. "address": "0x10026278"
  657. },
  658. {
  659. "name": "SetUnhandledExceptionFilter",
  660. "address": "0x1002627c"
  661. },
  662. {
  663. "name": "IsDebuggerPresent",
  664. "address": "0x10026280"
  665. },
  666. {
  667. "name": "HeapCreate",
  668. "address": "0x10026284"
  669. },
  670. {
  671. "name": "HeapDestroy",
  672. "address": "0x10026288"
  673. },
  674. {
  675. "name": "DeleteCriticalSection",
  676. "address": "0x1002628c"
  677. },
  678. {
  679. "name": "LeaveCriticalSection",
  680. "address": "0x10026290"
  681. },
  682. {
  683. "name": "EnterCriticalSection",
  684. "address": "0x10026294"
  685. },
  686. {
  687. "name": "HeapReAlloc",
  688. "address": "0x10026298"
  689. },
  690. {
  691. "name": "GetStdHandle",
  692. "address": "0x1002629c"
  693. },
  694. {
  695. "name": "GetModuleFileNameA",
  696. "address": "0x100262a0"
  697. },
  698. {
  699. "name": "TlsGetValue",
  700. "address": "0x100262a4"
  701. },
  702. {
  703. "name": "TlsAlloc",
  704. "address": "0x100262a8"
  705. },
  706. {
  707. "name": "TlsSetValue",
  708. "address": "0x100262ac"
  709. },
  710. {
  711. "name": "TlsFree",
  712. "address": "0x100262b0"
  713. },
  714. {
  715. "name": "InterlockedIncrement",
  716. "address": "0x100262b4"
  717. },
  718. {
  719. "name": "InterlockedDecrement",
  720. "address": "0x100262b8"
  721. },
  722. {
  723. "name": "InitializeCriticalSectionAndSpinCount",
  724. "address": "0x100262bc"
  725. },
  726. {
  727. "name": "RtlUnwind",
  728. "address": "0x100262c0"
  729. },
  730. {
  731. "name": "WideCharToMultiByte",
  732. "address": "0x100262c4"
  733. },
  734. {
  735. "name": "GetConsoleCP",
  736. "address": "0x100262c8"
  737. },
  738. {
  739. "name": "GetConsoleMode",
  740. "address": "0x100262cc"
  741. },
  742. {
  743. "name": "SetHandleCount",
  744. "address": "0x100262d0"
  745. }
  746. ],
  747. "dll": "KERNEL32.dll"
  748. },
  749. {
  750. "imports": [
  751. {
  752. "name": "RegEnumValueA",
  753. "address": "0x10026000"
  754. },
  755. {
  756. "name": "CloseServiceHandle",
  757. "address": "0x10026004"
  758. },
  759. {
  760. "name": "OpenProcessToken",
  761. "address": "0x10026008"
  762. },
  763. {
  764. "name": "CreateProcessWithLogonW",
  765. "address": "0x1002600c"
  766. },
  767. {
  768. "name": "DeleteService",
  769. "address": "0x10026010"
  770. },
  771. {
  772. "name": "CryptReleaseContext",
  773. "address": "0x10026014"
  774. },
  775. {
  776. "name": "CryptAcquireContextA",
  777. "address": "0x10026018"
  778. },
  779. {
  780. "name": "CryptGenRandom",
  781. "address": "0x1002601c"
  782. },
  783. {
  784. "name": "LogonUserA",
  785. "address": "0x10026020"
  786. },
  787. {
  788. "name": "CheckTokenMembership",
  789. "address": "0x10026024"
  790. },
  791. {
  792. "name": "FreeSid",
  793. "address": "0x10026028"
  794. },
  795. {
  796. "name": "RevertToSelf",
  797. "address": "0x1002602c"
  798. },
  799. {
  800. "name": "AllocateAndInitializeSid",
  801. "address": "0x10026030"
  802. },
  803. {
  804. "name": "DuplicateTokenEx",
  805. "address": "0x10026034"
  806. },
  807. {
  808. "name": "LookupAccountSidA",
  809. "address": "0x10026038"
  810. },
  811. {
  812. "name": "GetTokenInformation",
  813. "address": "0x1002603c"
  814. },
  815. {
  816. "name": "SetSecurityDescriptorDacl",
  817. "address": "0x10026040"
  818. },
  819. {
  820. "name": "InitializeSecurityDescriptor",
  821. "address": "0x10026044"
  822. },
  823. {
  824. "name": "RegCloseKey",
  825. "address": "0x10026048"
  826. },
  827. {
  828. "name": "RegEnumKeyA",
  829. "address": "0x1002604c"
  830. },
  831. {
  832. "name": "CreateProcessAsUserA",
  833. "address": "0x10026050"
  834. },
  835. {
  836. "name": "RegOpenCurrentUser",
  837. "address": "0x10026054"
  838. },
  839. {
  840. "name": "RegOpenKeyExA",
  841. "address": "0x10026058"
  842. },
  843. {
  844. "name": "GetUserNameA",
  845. "address": "0x1002605c"
  846. },
  847. {
  848. "name": "AdjustTokenPrivileges",
  849. "address": "0x10026060"
  850. },
  851. {
  852. "name": "ControlService",
  853. "address": "0x10026064"
  854. },
  855. {
  856. "name": "QueryServiceStatusEx",
  857. "address": "0x10026068"
  858. },
  859. {
  860. "name": "ImpersonateNamedPipeClient",
  861. "address": "0x1002606c"
  862. },
  863. {
  864. "name": "ImpersonateLoggedOnUser",
  865. "address": "0x10026070"
  866. },
  867. {
  868. "name": "LookupPrivilegeValueA",
  869. "address": "0x10026074"
  870. },
  871. {
  872. "name": "OpenThreadToken",
  873. "address": "0x10026078"
  874. },
  875. {
  876. "name": "OpenServiceA",
  877. "address": "0x1002607c"
  878. },
  879. {
  880. "name": "OpenSCManagerA",
  881. "address": "0x10026080"
  882. },
  883. {
  884. "name": "QueryServiceStatus",
  885. "address": "0x10026084"
  886. },
  887. {
  888. "name": "CreateProcessWithTokenW",
  889. "address": "0x10026088"
  890. },
  891. {
  892. "name": "StartServiceA",
  893. "address": "0x1002608c"
  894. },
  895. {
  896. "name": "CreateServiceA",
  897. "address": "0x10026090"
  898. }
  899. ],
  900. "dll": "ADVAPI32.dll"
  901. },
  902. {
  903. "imports": [
  904. {
  905. "name": "HttpQueryInfoA",
  906. "address": "0x100262e8"
  907. },
  908. {
  909. "name": "InternetQueryDataAvailable",
  910. "address": "0x100262ec"
  911. },
  912. {
  913. "name": "InternetReadFile",
  914. "address": "0x100262f0"
  915. },
  916. {
  917. "name": "InternetSetOptionA",
  918. "address": "0x100262f4"
  919. },
  920. {
  921. "name": "HttpOpenRequestA",
  922. "address": "0x100262f8"
  923. },
  924. {
  925. "name": "HttpSendRequestA",
  926. "address": "0x100262fc"
  927. },
  928. {
  929. "name": "InternetOpenA",
  930. "address": "0x10026300"
  931. },
  932. {
  933. "name": "InternetCloseHandle",
  934. "address": "0x10026304"
  935. },
  936. {
  937. "name": "InternetQueryOptionA",
  938. "address": "0x10026308"
  939. },
  940. {
  941. "name": "InternetConnectA",
  942. "address": "0x1002630c"
  943. }
  944. ],
  945. "dll": "WININET.dll"
  946. },
  947. {
  948. "imports": [
  949. {
  950. "name": "ntohs",
  951. "address": "0x10026314"
  952. },
  953. {
  954. "name": "connect",
  955. "address": "0x10026318"
  956. },
  957. {
  958. "name": "htons",
  959. "address": "0x1002631c"
  960. },
  961. {
  962. "name": "socket",
  963. "address": "0x10026320"
  964. },
  965. {
  966. "name": "accept",
  967. "address": "0x10026324"
  968. },
  969. {
  970. "name": "send",
  971. "address": "0x10026328"
  972. },
  973. {
  974. "name": "gethostname",
  975. "address": "0x1002632c"
  976. },
  977. {
  978. "name": "inet_ntoa",
  979. "address": "0x10026330"
  980. },
  981. {
  982. "name": "WSAStartup",
  983. "address": "0x10026334"
  984. },
  985. {
  986. "name": "WSACleanup",
  987. "address": "0x10026338"
  988. },
  989. {
  990. "name": "gethostbyname",
  991. "address": "0x1002633c"
  992. },
  993. {
  994. "name": "htonl",
  995. "address": "0x10026340"
  996. },
  997. {
  998. "name": "ntohl",
  999. "address": "0x10026344"
  1000. },
  1001. {
  1002. "name": "listen",
  1003. "address": "0x10026348"
  1004. },
  1005. {
  1006. "name": "__WSAFDIsSet",
  1007. "address": "0x1002634c"
  1008. },
  1009. {
  1010. "name": "bind",
  1011. "address": "0x10026350"
  1012. },
  1013. {
  1014. "name": "recv",
  1015. "address": "0x10026354"
  1016. },
  1017. {
  1018. "name": "shutdown",
  1019. "address": "0x10026358"
  1020. },
  1021. {
  1022. "name": "WSAGetLastError",
  1023. "address": "0x1002635c"
  1024. },
  1025. {
  1026. "name": "select",
  1027. "address": "0x10026360"
  1028. },
  1029. {
  1030. "name": "ioctlsocket",
  1031. "address": "0x10026364"
  1032. },
  1033. {
  1034. "name": "inet_addr",
  1035. "address": "0x10026368"
  1036. },
  1037. {
  1038. "name": "closesocket",
  1039. "address": "0x1002636c"
  1040. }
  1041. ],
  1042. "dll": "WS2_32.dll"
  1043. },
  1044. {
  1045. "imports": [
  1046. {
  1047. "name": "DnsFree",
  1048. "address": "0x10026098"
  1049. },
  1050. {
  1051. "name": "DnsQuery_A",
  1052. "address": "0x1002609c"
  1053. }
  1054. ],
  1055. "dll": "DNSAPI.dll"
  1056. },
  1057. {
  1058. "imports": [
  1059. {
  1060. "name": "GetIfEntry",
  1061. "address": "0x100260a4"
  1062. },
  1063. {
  1064. "name": "GetIpAddrTable",
  1065. "address": "0x100260a8"
  1066. }
  1067. ],
  1068. "dll": "IPHLPAPI.DLL"
  1069. },
  1070. {
  1071. "imports": [
  1072. {
  1073. "name": "LsaCallAuthenticationPackage",
  1074. "address": "0x100262d8"
  1075. },
  1076. {
  1077. "name": "LsaConnectUntrusted",
  1078. "address": "0x100262dc"
  1079. },
  1080. {
  1081. "name": "LsaLookupAuthenticationPackage",
  1082. "address": "0x100262e0"
  1083. }
  1084. ],
  1085. "dll": "Secur32.dll"
  1086. }
  1087. ],
  1088. "digital_signers": null,
  1089. "exported_dll_name": "beacon.dll",
  1090. "actual_checksum": "0x00042002",
  1091. "overlay": null,
  1092. "imagebase": "0x10000000",
  1093. "reported_checksum": "0x00000000",
  1094. "icon_hash": null,
  1095. "entrypoint": "0x10017771",
  1096. "timestamp": "2018-09-05 21:53:17",
  1097. "osversion": "5.0",
  1098. "sections": [
  1099. {
  1100. "name": ".text",
  1101. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1102. "virtual_address": "0x00001000",
  1103. "size_of_data": "0x00024e00",
  1104. "entropy": "6.64",
  1105. "raw_address": "0x00000400",
  1106. "virtual_size": "0x00024c0a",
  1107. "characteristics_raw": "0x60000020"
  1108. },
  1109. {
  1110. "name": ".rdata",
  1111. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1112. "virtual_address": "0x00026000",
  1113. "size_of_data": "0x0000a200",
  1114. "entropy": "6.81",
  1115. "raw_address": "0x00025200",
  1116. "virtual_size": "0x0000a1a1",
  1117. "characteristics_raw": "0x40000040"
  1118. },
  1119. {
  1120. "name": ".data",
  1121. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1122. "virtual_address": "0x00031000",
  1123. "size_of_data": "0x00002400",
  1124. "entropy": "3.02",
  1125. "raw_address": "0x0002f400",
  1126. "virtual_size": "0x0000ff40",
  1127. "characteristics_raw": "0xc0000040"
  1128. },
  1129. {
  1130. "name": ".reloc",
  1131. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1132. "virtual_address": "0x00041000",
  1133. "size_of_data": "0x00002000",
  1134. "entropy": "5.49",
  1135. "raw_address": "0x00031800",
  1136. "virtual_size": "0x00001e5a",
  1137. "characteristics_raw": "0x42000040"
  1138. }
  1139. ],
  1140. "resources": [],
  1141. "dirents": [
  1142. {
  1143. "virtual_address": "0x00030150",
  1144. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1145. "size": "0x00000051"
  1146. },
  1147. {
  1148. "virtual_address": "0x0002ee74",
  1149. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1150. "size": "0x000000a0"
  1151. },
  1152. {
  1153. "virtual_address": "0x00000000",
  1154. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1155. "size": "0x00000000"
  1156. },
  1157. {
  1158. "virtual_address": "0x00000000",
  1159. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1160. "size": "0x00000000"
  1161. },
  1162. {
  1163. "virtual_address": "0x00000000",
  1164. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1165. "size": "0x00000000"
  1166. },
  1167. {
  1168. "virtual_address": "0x00041000",
  1169. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1170. "size": "0x000016c0"
  1171. },
  1172. {
  1173. "virtual_address": "0x00000000",
  1174. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1175. "size": "0x00000000"
  1176. },
  1177. {
  1178. "virtual_address": "0x00000000",
  1179. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1180. "size": "0x00000000"
  1181. },
  1182. {
  1183. "virtual_address": "0x00000000",
  1184. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1185. "size": "0x00000000"
  1186. },
  1187. {
  1188. "virtual_address": "0x00000000",
  1189. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1190. "size": "0x00000000"
  1191. },
  1192. {
  1193. "virtual_address": "0x0002e8c0",
  1194. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1195. "size": "0x00000040"
  1196. },
  1197. {
  1198. "virtual_address": "0x00000000",
  1199. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1200. "size": "0x00000000"
  1201. },
  1202. {
  1203. "virtual_address": "0x00026000",
  1204. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1205. "size": "0x00000374"
  1206. },
  1207. {
  1208. "virtual_address": "0x00000000",
  1209. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1210. "size": "0x00000000"
  1211. },
  1212. {
  1213. "virtual_address": "0x00000000",
  1214. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1215. "size": "0x00000000"
  1216. },
  1217. {
  1218. "virtual_address": "0x00000000",
  1219. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1220. "size": "0x00000000"
  1221. }
  1222. ],
  1223. "exports": [
  1224. {
  1225. "ordinal": 1,
  1226. "name": "_ReflectiveLoader@4",
  1227. "address": "0x10008f2f"
  1228. }
  1229. ],
  1230. "guest_signers": {},
  1231. "imphash": "0bc418575efc832b308d227b31192688",
  1232. "icon_fuzzy": null,
  1233. "icon": null,
  1234. "pdbpath": null,
  1235. "imported_dll_count": 7,
  1236. "versioninfo": []
  1237. }
  1238. }
  1239.  
  1240. [*] Resolved APIs: []
  1241.  
  1242. [*] Static Analysis: {
  1243. "pe": {
  1244. "peid_signatures": null,
  1245. "imports": [
  1246. {
  1247. "imports": [
  1248. {
  1249. "name": "UpdateProcThreadAttribute",
  1250. "address": "0x100260b0"
  1251. },
  1252. {
  1253. "name": "HeapFree",
  1254. "address": "0x100260b4"
  1255. },
  1256. {
  1257. "name": "GetProcessHeap",
  1258. "address": "0x100260b8"
  1259. },
  1260. {
  1261. "name": "CreateRemoteThread",
  1262. "address": "0x100260bc"
  1263. },
  1264. {
  1265. "name": "VirtualAlloc",
  1266. "address": "0x100260c0"
  1267. },
  1268. {
  1269. "name": "VirtualProtectEx",
  1270. "address": "0x100260c4"
  1271. },
  1272. {
  1273. "name": "VirtualAllocEx",
  1274. "address": "0x100260c8"
  1275. },
  1276. {
  1277. "name": "LoadLibraryA",
  1278. "address": "0x100260cc"
  1279. },
  1280. {
  1281. "name": "ProcessIdToSessionId",
  1282. "address": "0x100260d0"
  1283. },
  1284. {
  1285. "name": "DuplicateHandle",
  1286. "address": "0x100260d4"
  1287. },
  1288. {
  1289. "name": "InitializeProcThreadAttributeList",
  1290. "address": "0x100260d8"
  1291. },
  1292. {
  1293. "name": "WriteProcessMemory",
  1294. "address": "0x100260dc"
  1295. },
  1296. {
  1297. "name": "CreateThread",
  1298. "address": "0x100260e0"
  1299. },
  1300. {
  1301. "name": "GetThreadContext",
  1302. "address": "0x100260e4"
  1303. },
  1304. {
  1305. "name": "SetThreadContext",
  1306. "address": "0x100260e8"
  1307. },
  1308. {
  1309. "name": "FreeLibrary",
  1310. "address": "0x100260ec"
  1311. },
  1312. {
  1313. "name": "VirtualFree",
  1314. "address": "0x100260f0"
  1315. },
  1316. {
  1317. "name": "Thread32First",
  1318. "address": "0x100260f4"
  1319. },
  1320. {
  1321. "name": "Thread32Next",
  1322. "address": "0x100260f8"
  1323. },
  1324. {
  1325. "name": "SetLastError",
  1326. "address": "0x100260fc"
  1327. },
  1328. {
  1329. "name": "OpenThread",
  1330. "address": "0x10026100"
  1331. },
  1332. {
  1333. "name": "CreateToolhelp32Snapshot",
  1334. "address": "0x10026104"
  1335. },
  1336. {
  1337. "name": "GetVersionExA",
  1338. "address": "0x10026108"
  1339. },
  1340. {
  1341. "name": "SuspendThread",
  1342. "address": "0x1002610c"
  1343. },
  1344. {
  1345. "name": "ResumeThread",
  1346. "address": "0x10026110"
  1347. },
  1348. {
  1349. "name": "PeekNamedPipe",
  1350. "address": "0x10026114"
  1351. },
  1352. {
  1353. "name": "WaitNamedPipeA",
  1354. "address": "0x10026118"
  1355. },
  1356. {
  1357. "name": "SetNamedPipeHandleState",
  1358. "address": "0x1002611c"
  1359. },
  1360. {
  1361. "name": "LocalAlloc",
  1362. "address": "0x10026120"
  1363. },
  1364. {
  1365. "name": "LocalFree",
  1366. "address": "0x10026124"
  1367. },
  1368. {
  1369. "name": "GetComputerNameA",
  1370. "address": "0x10026128"
  1371. },
  1372. {
  1373. "name": "Process32First",
  1374. "address": "0x1002612c"
  1375. },
  1376. {
  1377. "name": "TerminateProcess",
  1378. "address": "0x10026130"
  1379. },
  1380. {
  1381. "name": "HeapAlloc",
  1382. "address": "0x10026134"
  1383. },
  1384. {
  1385. "name": "ExitProcess",
  1386. "address": "0x10026138"
  1387. },
  1388. {
  1389. "name": "DeleteProcThreadAttributeList",
  1390. "address": "0x1002613c"
  1391. },
  1392. {
  1393. "name": "VirtualProtect",
  1394. "address": "0x10026140"
  1395. },
  1396. {
  1397. "name": "FindNextFileA",
  1398. "address": "0x10026144"
  1399. },
  1400. {
  1401. "name": "MoveFileA",
  1402. "address": "0x10026148"
  1403. },
  1404. {
  1405. "name": "FindClose",
  1406. "address": "0x1002614c"
  1407. },
  1408. {
  1409. "name": "CopyFileA",
  1410. "address": "0x10026150"
  1411. },
  1412. {
  1413. "name": "FindFirstFileA",
  1414. "address": "0x10026154"
  1415. },
  1416. {
  1417. "name": "FileTimeToSystemTime",
  1418. "address": "0x10026158"
  1419. },
  1420. {
  1421. "name": "GetFileAttributesA",
  1422. "address": "0x1002615c"
  1423. },
  1424. {
  1425. "name": "ExpandEnvironmentStringsA",
  1426. "address": "0x10026160"
  1427. },
  1428. {
  1429. "name": "GetLogicalDrives",
  1430. "address": "0x10026164"
  1431. },
  1432. {
  1433. "name": "SystemTimeToTzSpecificLocalTime",
  1434. "address": "0x10026168"
  1435. },
  1436. {
  1437. "name": "GetFullPathNameA",
  1438. "address": "0x1002616c"
  1439. },
  1440. {
  1441. "name": "GetModuleHandleA",
  1442. "address": "0x10026170"
  1443. },
  1444. {
  1445. "name": "CreateNamedPipeA",
  1446. "address": "0x10026174"
  1447. },
  1448. {
  1449. "name": "GetProcAddress",
  1450. "address": "0x10026178"
  1451. },
  1452. {
  1453. "name": "ReadFile",
  1454. "address": "0x1002617c"
  1455. },
  1456. {
  1457. "name": "GetCurrentThread",
  1458. "address": "0x10026180"
  1459. },
  1460. {
  1461. "name": "ConnectNamedPipe",
  1462. "address": "0x10026184"
  1463. },
  1464. {
  1465. "name": "GetCurrentProcess",
  1466. "address": "0x10026188"
  1467. },
  1468. {
  1469. "name": "CloseHandle",
  1470. "address": "0x1002618c"
  1471. },
  1472. {
  1473. "name": "GetFileTime",
  1474. "address": "0x10026190"
  1475. },
  1476. {
  1477. "name": "GetCurrentDirectoryA",
  1478. "address": "0x10026194"
  1479. },
  1480. {
  1481. "name": "CreatePipe",
  1482. "address": "0x10026198"
  1483. },
  1484. {
  1485. "name": "GetCurrentDirectoryW",
  1486. "address": "0x1002619c"
  1487. },
  1488. {
  1489. "name": "GetLastError",
  1490. "address": "0x100261a0"
  1491. },
  1492. {
  1493. "name": "GetStartupInfoA",
  1494. "address": "0x100261a4"
  1495. },
  1496. {
  1497. "name": "SetCurrentDirectoryA",
  1498. "address": "0x100261a8"
  1499. },
  1500. {
  1501. "name": "FlushFileBuffers",
  1502. "address": "0x100261ac"
  1503. },
  1504. {
  1505. "name": "DisconnectNamedPipe",
  1506. "address": "0x100261b0"
  1507. },
  1508. {
  1509. "name": "MultiByteToWideChar",
  1510. "address": "0x100261b4"
  1511. },
  1512. {
  1513. "name": "CreateProcessA",
  1514. "address": "0x100261b8"
  1515. },
  1516. {
  1517. "name": "OpenProcess",
  1518. "address": "0x100261bc"
  1519. },
  1520. {
  1521. "name": "WriteFile",
  1522. "address": "0x100261c0"
  1523. },
  1524. {
  1525. "name": "SetFileTime",
  1526. "address": "0x100261c4"
  1527. },
  1528. {
  1529. "name": "WaitForSingleObject",
  1530. "address": "0x100261c8"
  1531. },
  1532. {
  1533. "name": "SetEnvironmentVariableW",
  1534. "address": "0x100261cc"
  1535. },
  1536. {
  1537. "name": "CreateFileA",
  1538. "address": "0x100261d0"
  1539. },
  1540. {
  1541. "name": "Sleep",
  1542. "address": "0x100261d4"
  1543. },
  1544. {
  1545. "name": "SetEnvironmentVariableA",
  1546. "address": "0x100261d8"
  1547. },
  1548. {
  1549. "name": "CompareStringW",
  1550. "address": "0x100261dc"
  1551. },
  1552. {
  1553. "name": "CompareStringA",
  1554. "address": "0x100261e0"
  1555. },
  1556. {
  1557. "name": "SetEndOfFile",
  1558. "address": "0x100261e4"
  1559. },
  1560. {
  1561. "name": "GetStringTypeW",
  1562. "address": "0x100261e8"
  1563. },
  1564. {
  1565. "name": "GetStringTypeA",
  1566. "address": "0x100261ec"
  1567. },
  1568. {
  1569. "name": "LCMapStringW",
  1570. "address": "0x100261f0"
  1571. },
  1572. {
  1573. "name": "LCMapStringA",
  1574. "address": "0x100261f4"
  1575. },
  1576. {
  1577. "name": "VirtualQuery",
  1578. "address": "0x100261f8"
  1579. },
  1580. {
  1581. "name": "GetModuleFileNameW",
  1582. "address": "0x100261fc"
  1583. },
  1584. {
  1585. "name": "SetStdHandle",
  1586. "address": "0x10026200"
  1587. },
  1588. {
  1589. "name": "WriteConsoleW",
  1590. "address": "0x10026204"
  1591. },
  1592. {
  1593. "name": "GetConsoleOutputCP",
  1594. "address": "0x10026208"
  1595. },
  1596. {
  1597. "name": "WriteConsoleA",
  1598. "address": "0x1002620c"
  1599. },
  1600. {
  1601. "name": "GetLocaleInfoA",
  1602. "address": "0x10026210"
  1603. },
  1604. {
  1605. "name": "HeapSize",
  1606. "address": "0x10026214"
  1607. },
  1608. {
  1609. "name": "IsValidCodePage",
  1610. "address": "0x10026218"
  1611. },
  1612. {
  1613. "name": "GetCPInfo",
  1614. "address": "0x1002621c"
  1615. },
  1616. {
  1617. "name": "DebugBreak",
  1618. "address": "0x10026220"
  1619. },
  1620. {
  1621. "name": "RaiseException",
  1622. "address": "0x10026224"
  1623. },
  1624. {
  1625. "name": "QueryPerformanceCounter",
  1626. "address": "0x10026228"
  1627. },
  1628. {
  1629. "name": "GetEnvironmentStringsW",
  1630. "address": "0x1002622c"
  1631. },
  1632. {
  1633. "name": "FreeEnvironmentStringsW",
  1634. "address": "0x10026230"
  1635. },
  1636. {
  1637. "name": "GetCurrentProcessId",
  1638. "address": "0x10026234"
  1639. },
  1640. {
  1641. "name": "GetOEMCP",
  1642. "address": "0x10026238"
  1643. },
  1644. {
  1645. "name": "GetLocalTime",
  1646. "address": "0x1002623c"
  1647. },
  1648. {
  1649. "name": "GetACP",
  1650. "address": "0x10026240"
  1651. },
  1652. {
  1653. "name": "Process32Next",
  1654. "address": "0x10026244"
  1655. },
  1656. {
  1657. "name": "GetTickCount",
  1658. "address": "0x10026248"
  1659. },
  1660. {
  1661. "name": "GetEnvironmentStrings",
  1662. "address": "0x1002624c"
  1663. },
  1664. {
  1665. "name": "FreeEnvironmentStringsA",
  1666. "address": "0x10026250"
  1667. },
  1668. {
  1669. "name": "SetFilePointer",
  1670. "address": "0x10026254"
  1671. },
  1672. {
  1673. "name": "GetFileType",
  1674. "address": "0x10026258"
  1675. },
  1676. {
  1677. "name": "GetModuleHandleW",
  1678. "address": "0x1002625c"
  1679. },
  1680. {
  1681. "name": "DeleteFileA",
  1682. "address": "0x10026260"
  1683. },
  1684. {
  1685. "name": "CreateDirectoryA",
  1686. "address": "0x10026264"
  1687. },
  1688. {
  1689. "name": "RemoveDirectoryA",
  1690. "address": "0x10026268"
  1691. },
  1692. {
  1693. "name": "GetCurrentThreadId",
  1694. "address": "0x1002626c"
  1695. },
  1696. {
  1697. "name": "GetCommandLineA",
  1698. "address": "0x10026270"
  1699. },
  1700. {
  1701. "name": "GetSystemTimeAsFileTime",
  1702. "address": "0x10026274"
  1703. },
  1704. {
  1705. "name": "UnhandledExceptionFilter",
  1706. "address": "0x10026278"
  1707. },
  1708. {
  1709. "name": "SetUnhandledExceptionFilter",
  1710. "address": "0x1002627c"
  1711. },
  1712. {
  1713. "name": "IsDebuggerPresent",
  1714. "address": "0x10026280"
  1715. },
  1716. {
  1717. "name": "HeapCreate",
  1718. "address": "0x10026284"
  1719. },
  1720. {
  1721. "name": "HeapDestroy",
  1722. "address": "0x10026288"
  1723. },
  1724. {
  1725. "name": "DeleteCriticalSection",
  1726. "address": "0x1002628c"
  1727. },
  1728. {
  1729. "name": "LeaveCriticalSection",
  1730. "address": "0x10026290"
  1731. },
  1732. {
  1733. "name": "EnterCriticalSection",
  1734. "address": "0x10026294"
  1735. },
  1736. {
  1737. "name": "HeapReAlloc",
  1738. "address": "0x10026298"
  1739. },
  1740. {
  1741. "name": "GetStdHandle",
  1742. "address": "0x1002629c"
  1743. },
  1744. {
  1745. "name": "GetModuleFileNameA",
  1746. "address": "0x100262a0"
  1747. },
  1748. {
  1749. "name": "TlsGetValue",
  1750. "address": "0x100262a4"
  1751. },
  1752. {
  1753. "name": "TlsAlloc",
  1754. "address": "0x100262a8"
  1755. },
  1756. {
  1757. "name": "TlsSetValue",
  1758. "address": "0x100262ac"
  1759. },
  1760. {
  1761. "name": "TlsFree",
  1762. "address": "0x100262b0"
  1763. },
  1764. {
  1765. "name": "InterlockedIncrement",
  1766. "address": "0x100262b4"
  1767. },
  1768. {
  1769. "name": "InterlockedDecrement",
  1770. "address": "0x100262b8"
  1771. },
  1772. {
  1773. "name": "InitializeCriticalSectionAndSpinCount",
  1774. "address": "0x100262bc"
  1775. },
  1776. {
  1777. "name": "RtlUnwind",
  1778. "address": "0x100262c0"
  1779. },
  1780. {
  1781. "name": "WideCharToMultiByte",
  1782. "address": "0x100262c4"
  1783. },
  1784. {
  1785. "name": "GetConsoleCP",
  1786. "address": "0x100262c8"
  1787. },
  1788. {
  1789. "name": "GetConsoleMode",
  1790. "address": "0x100262cc"
  1791. },
  1792. {
  1793. "name": "SetHandleCount",
  1794. "address": "0x100262d0"
  1795. }
  1796. ],
  1797. "dll": "KERNEL32.dll"
  1798. },
  1799. {
  1800. "imports": [
  1801. {
  1802. "name": "RegEnumValueA",
  1803. "address": "0x10026000"
  1804. },
  1805. {
  1806. "name": "CloseServiceHandle",
  1807. "address": "0x10026004"
  1808. },
  1809. {
  1810. "name": "OpenProcessToken",
  1811. "address": "0x10026008"
  1812. },
  1813. {
  1814. "name": "CreateProcessWithLogonW",
  1815. "address": "0x1002600c"
  1816. },
  1817. {
  1818. "name": "DeleteService",
  1819. "address": "0x10026010"
  1820. },
  1821. {
  1822. "name": "CryptReleaseContext",
  1823. "address": "0x10026014"
  1824. },
  1825. {
  1826. "name": "CryptAcquireContextA",
  1827. "address": "0x10026018"
  1828. },
  1829. {
  1830. "name": "CryptGenRandom",
  1831. "address": "0x1002601c"
  1832. },
  1833. {
  1834. "name": "LogonUserA",
  1835. "address": "0x10026020"
  1836. },
  1837. {
  1838. "name": "CheckTokenMembership",
  1839. "address": "0x10026024"
  1840. },
  1841. {
  1842. "name": "FreeSid",
  1843. "address": "0x10026028"
  1844. },
  1845. {
  1846. "name": "RevertToSelf",
  1847. "address": "0x1002602c"
  1848. },
  1849. {
  1850. "name": "AllocateAndInitializeSid",
  1851. "address": "0x10026030"
  1852. },
  1853. {
  1854. "name": "DuplicateTokenEx",
  1855. "address": "0x10026034"
  1856. },
  1857. {
  1858. "name": "LookupAccountSidA",
  1859. "address": "0x10026038"
  1860. },
  1861. {
  1862. "name": "GetTokenInformation",
  1863. "address": "0x1002603c"
  1864. },
  1865. {
  1866. "name": "SetSecurityDescriptorDacl",
  1867. "address": "0x10026040"
  1868. },
  1869. {
  1870. "name": "InitializeSecurityDescriptor",
  1871. "address": "0x10026044"
  1872. },
  1873. {
  1874. "name": "RegCloseKey",
  1875. "address": "0x10026048"
  1876. },
  1877. {
  1878. "name": "RegEnumKeyA",
  1879. "address": "0x1002604c"
  1880. },
  1881. {
  1882. "name": "CreateProcessAsUserA",
  1883. "address": "0x10026050"
  1884. },
  1885. {
  1886. "name": "RegOpenCurrentUser",
  1887. "address": "0x10026054"
  1888. },
  1889. {
  1890. "name": "RegOpenKeyExA",
  1891. "address": "0x10026058"
  1892. },
  1893. {
  1894. "name": "GetUserNameA",
  1895. "address": "0x1002605c"
  1896. },
  1897. {
  1898. "name": "AdjustTokenPrivileges",
  1899. "address": "0x10026060"
  1900. },
  1901. {
  1902. "name": "ControlService",
  1903. "address": "0x10026064"
  1904. },
  1905. {
  1906. "name": "QueryServiceStatusEx",
  1907. "address": "0x10026068"
  1908. },
  1909. {
  1910. "name": "ImpersonateNamedPipeClient",
  1911. "address": "0x1002606c"
  1912. },
  1913. {
  1914. "name": "ImpersonateLoggedOnUser",
  1915. "address": "0x10026070"
  1916. },
  1917. {
  1918. "name": "LookupPrivilegeValueA",
  1919. "address": "0x10026074"
  1920. },
  1921. {
  1922. "name": "OpenThreadToken",
  1923. "address": "0x10026078"
  1924. },
  1925. {
  1926. "name": "OpenServiceA",
  1927. "address": "0x1002607c"
  1928. },
  1929. {
  1930. "name": "OpenSCManagerA",
  1931. "address": "0x10026080"
  1932. },
  1933. {
  1934. "name": "QueryServiceStatus",
  1935. "address": "0x10026084"
  1936. },
  1937. {
  1938. "name": "CreateProcessWithTokenW",
  1939. "address": "0x10026088"
  1940. },
  1941. {
  1942. "name": "StartServiceA",
  1943. "address": "0x1002608c"
  1944. },
  1945. {
  1946. "name": "CreateServiceA",
  1947. "address": "0x10026090"
  1948. }
  1949. ],
  1950. "dll": "ADVAPI32.dll"
  1951. },
  1952. {
  1953. "imports": [
  1954. {
  1955. "name": "HttpQueryInfoA",
  1956. "address": "0x100262e8"
  1957. },
  1958. {
  1959. "name": "InternetQueryDataAvailable",
  1960. "address": "0x100262ec"
  1961. },
  1962. {
  1963. "name": "InternetReadFile",
  1964. "address": "0x100262f0"
  1965. },
  1966. {
  1967. "name": "InternetSetOptionA",
  1968. "address": "0x100262f4"
  1969. },
  1970. {
  1971. "name": "HttpOpenRequestA",
  1972. "address": "0x100262f8"
  1973. },
  1974. {
  1975. "name": "HttpSendRequestA",
  1976. "address": "0x100262fc"
  1977. },
  1978. {
  1979. "name": "InternetOpenA",
  1980. "address": "0x10026300"
  1981. },
  1982. {
  1983. "name": "InternetCloseHandle",
  1984. "address": "0x10026304"
  1985. },
  1986. {
  1987. "name": "InternetQueryOptionA",
  1988. "address": "0x10026308"
  1989. },
  1990. {
  1991. "name": "InternetConnectA",
  1992. "address": "0x1002630c"
  1993. }
  1994. ],
  1995. "dll": "WININET.dll"
  1996. },
  1997. {
  1998. "imports": [
  1999. {
  2000. "name": "ntohs",
  2001. "address": "0x10026314"
  2002. },
  2003. {
  2004. "name": "connect",
  2005. "address": "0x10026318"
  2006. },
  2007. {
  2008. "name": "htons",
  2009. "address": "0x1002631c"
  2010. },
  2011. {
  2012. "name": "socket",
  2013. "address": "0x10026320"
  2014. },
  2015. {
  2016. "name": "accept",
  2017. "address": "0x10026324"
  2018. },
  2019. {
  2020. "name": "send",
  2021. "address": "0x10026328"
  2022. },
  2023. {
  2024. "name": "gethostname",
  2025. "address": "0x1002632c"
  2026. },
  2027. {
  2028. "name": "inet_ntoa",
  2029. "address": "0x10026330"
  2030. },
  2031. {
  2032. "name": "WSAStartup",
  2033. "address": "0x10026334"
  2034. },
  2035. {
  2036. "name": "WSACleanup",
  2037. "address": "0x10026338"
  2038. },
  2039. {
  2040. "name": "gethostbyname",
  2041. "address": "0x1002633c"
  2042. },
  2043. {
  2044. "name": "htonl",
  2045. "address": "0x10026340"
  2046. },
  2047. {
  2048. "name": "ntohl",
  2049. "address": "0x10026344"
  2050. },
  2051. {
  2052. "name": "listen",
  2053. "address": "0x10026348"
  2054. },
  2055. {
  2056. "name": "__WSAFDIsSet",
  2057. "address": "0x1002634c"
  2058. },
  2059. {
  2060. "name": "bind",
  2061. "address": "0x10026350"
  2062. },
  2063. {
  2064. "name": "recv",
  2065. "address": "0x10026354"
  2066. },
  2067. {
  2068. "name": "shutdown",
  2069. "address": "0x10026358"
  2070. },
  2071. {
  2072. "name": "WSAGetLastError",
  2073. "address": "0x1002635c"
  2074. },
  2075. {
  2076. "name": "select",
  2077. "address": "0x10026360"
  2078. },
  2079. {
  2080. "name": "ioctlsocket",
  2081. "address": "0x10026364"
  2082. },
  2083. {
  2084. "name": "inet_addr",
  2085. "address": "0x10026368"
  2086. },
  2087. {
  2088. "name": "closesocket",
  2089. "address": "0x1002636c"
  2090. }
  2091. ],
  2092. "dll": "WS2_32.dll"
  2093. },
  2094. {
  2095. "imports": [
  2096. {
  2097. "name": "DnsFree",
  2098. "address": "0x10026098"
  2099. },
  2100. {
  2101. "name": "DnsQuery_A",
  2102. "address": "0x1002609c"
  2103. }
  2104. ],
  2105. "dll": "DNSAPI.dll"
  2106. },
  2107. {
  2108. "imports": [
  2109. {
  2110. "name": "GetIfEntry",
  2111. "address": "0x100260a4"
  2112. },
  2113. {
  2114. "name": "GetIpAddrTable",
  2115. "address": "0x100260a8"
  2116. }
  2117. ],
  2118. "dll": "IPHLPAPI.DLL"
  2119. },
  2120. {
  2121. "imports": [
  2122. {
  2123. "name": "LsaCallAuthenticationPackage",
  2124. "address": "0x100262d8"
  2125. },
  2126. {
  2127. "name": "LsaConnectUntrusted",
  2128. "address": "0x100262dc"
  2129. },
  2130. {
  2131. "name": "LsaLookupAuthenticationPackage",
  2132. "address": "0x100262e0"
  2133. }
  2134. ],
  2135. "dll": "Secur32.dll"
  2136. }
  2137. ],
  2138. "digital_signers": null,
  2139. "exported_dll_name": "beacon.dll",
  2140. "actual_checksum": "0x00042002",
  2141. "overlay": null,
  2142. "imagebase": "0x10000000",
  2143. "reported_checksum": "0x00000000",
  2144. "icon_hash": null,
  2145. "entrypoint": "0x10017771",
  2146. "timestamp": "2018-09-05 21:53:17",
  2147. "osversion": "5.0",
  2148. "sections": [
  2149. {
  2150. "name": ".text",
  2151. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2152. "virtual_address": "0x00001000",
  2153. "size_of_data": "0x00024e00",
  2154. "entropy": "6.64",
  2155. "raw_address": "0x00000400",
  2156. "virtual_size": "0x00024c0a",
  2157. "characteristics_raw": "0x60000020"
  2158. },
  2159. {
  2160. "name": ".rdata",
  2161. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2162. "virtual_address": "0x00026000",
  2163. "size_of_data": "0x0000a200",
  2164. "entropy": "6.81",
  2165. "raw_address": "0x00025200",
  2166. "virtual_size": "0x0000a1a1",
  2167. "characteristics_raw": "0x40000040"
  2168. },
  2169. {
  2170. "name": ".data",
  2171. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2172. "virtual_address": "0x00031000",
  2173. "size_of_data": "0x00002400",
  2174. "entropy": "3.02",
  2175. "raw_address": "0x0002f400",
  2176. "virtual_size": "0x0000ff40",
  2177. "characteristics_raw": "0xc0000040"
  2178. },
  2179. {
  2180. "name": ".reloc",
  2181. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  2182. "virtual_address": "0x00041000",
  2183. "size_of_data": "0x00002000",
  2184. "entropy": "5.49",
  2185. "raw_address": "0x00031800",
  2186. "virtual_size": "0x00001e5a",
  2187. "characteristics_raw": "0x42000040"
  2188. }
  2189. ],
  2190. "resources": [],
  2191. "dirents": [
  2192. {
  2193. "virtual_address": "0x00030150",
  2194. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2195. "size": "0x00000051"
  2196. },
  2197. {
  2198. "virtual_address": "0x0002ee74",
  2199. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2200. "size": "0x000000a0"
  2201. },
  2202. {
  2203. "virtual_address": "0x00000000",
  2204. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2205. "size": "0x00000000"
  2206. },
  2207. {
  2208. "virtual_address": "0x00000000",
  2209. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2210. "size": "0x00000000"
  2211. },
  2212. {
  2213. "virtual_address": "0x00000000",
  2214. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2215. "size": "0x00000000"
  2216. },
  2217. {
  2218. "virtual_address": "0x00041000",
  2219. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2220. "size": "0x000016c0"
  2221. },
  2222. {
  2223. "virtual_address": "0x00000000",
  2224. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2225. "size": "0x00000000"
  2226. },
  2227. {
  2228. "virtual_address": "0x00000000",
  2229. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2230. "size": "0x00000000"
  2231. },
  2232. {
  2233. "virtual_address": "0x00000000",
  2234. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2235. "size": "0x00000000"
  2236. },
  2237. {
  2238. "virtual_address": "0x00000000",
  2239. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2240. "size": "0x00000000"
  2241. },
  2242. {
  2243. "virtual_address": "0x0002e8c0",
  2244. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2245. "size": "0x00000040"
  2246. },
  2247. {
  2248. "virtual_address": "0x00000000",
  2249. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2250. "size": "0x00000000"
  2251. },
  2252. {
  2253. "virtual_address": "0x00026000",
  2254. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2255. "size": "0x00000374"
  2256. },
  2257. {
  2258. "virtual_address": "0x00000000",
  2259. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2260. "size": "0x00000000"
  2261. },
  2262. {
  2263. "virtual_address": "0x00000000",
  2264. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2265. "size": "0x00000000"
  2266. },
  2267. {
  2268. "virtual_address": "0x00000000",
  2269. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2270. "size": "0x00000000"
  2271. }
  2272. ],
  2273. "exports": [
  2274. {
  2275. "ordinal": 1,
  2276. "name": "_ReflectiveLoader@4",
  2277. "address": "0x10008f2f"
  2278. }
  2279. ],
  2280. "guest_signers": {},
  2281. "imphash": "0bc418575efc832b308d227b31192688",
  2282. "icon_fuzzy": null,
  2283. "icon": null,
  2284. "pdbpath": null,
  2285. "imported_dll_count": 7,
  2286. "versioninfo": []
  2287. }
  2288. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!