API tools faq
paste
paladin316

wshbth_exe_2019-06-27_14_30.json

paladin316
Jun 27th, 2019
2,141
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 30.98 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 2.5
  5.  
  6. [*] File Name: "wshbth.exe"
  7. [*] File Size: 8260608
  8. [*] File Type: "PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows"
  9. [*] SHA256: "e56f40b6061b8f1e862e3030bfdf20ff562191e0239921209dc2e82577880940"
  10. [*] MD5: "6db67affef49c0676834265e82c76654"
  11. [*] SHA1: "bfcbb8e9a725fe6b16fa1186f6798e07fb293830"
  12. [*] SHA512: "8f1e5a3d862517a0c5e7a69f2adcf61b8d60ae910cde812b0ee4327d9ff63935b7deda61b52359b0a41719cec39f933d2cd18b7498a0ffbeb50f9bdb9a83c84d"
  13. [*] CRC32: "1A47C09A"
  14. [*] SSDEEP: "196608:CaZH7Y13X7EOb8x/DhQke4VCpc/wnwbP:hHslpbM/Kke4V/pP"
  15.  
  16. [*] Process Execution: [
  17. "wshbth.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "wshbth.exe, PID 2064"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "The binary likely contains encrypted or compressed data.",
  31. "Details": [
  32. {
  33. "section": "name: .vmp1, entropy: 7.94, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x007d7400, virtual_size: 0x007d72a0"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "The executable is likely packed with VMProtect",
  39. "Details": [
  40. {
  41. "section": {
  42. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  43. "characteristics_raw": "0x68000060",
  44. "entropy": "0.00",
  45. "name": ".vmp0",
  46. "raw_address": "0x00000000",
  47. "size_of_data": "0x00000000",
  48. "virtual_address": "0x0052b000",
  49. "virtual_size": "0x00490ca1"
  50. }
  51. }
  52. ]
  53. }
  54. ]
  55.  
  56. [*] Started Service: []
  57.  
  58. [*] Executed Commands: []
  59.  
  60. [*] Mutexes: []
  61.  
  62. [*] Modified Files: []
  63.  
  64. [*] Deleted Files: []
  65.  
  66. [*] Modified Registry Keys: []
  67.  
  68. [*] Deleted Registry Keys: []
  69.  
  70. [*] DNS Communications: []
  71.  
  72. [*] Domains: []
  73.  
  74. [*] Network Communication - ICMP: []
  75.  
  76. [*] Network Communication - HTTP: []
  77.  
  78. [*] Network Communication - SMTP: []
  79.  
  80. [*] Network Communication - Hosts: []
  81.  
  82. [*] Network Communication - IRC: []
  83.  
  84. [*] Static Analysis: {
  85. "pe": {
  86. "peid_signatures": null,
  87. "imports": [
  88. {
  89. "imports": [
  90. {
  91. "name": "AdjustTokenPrivileges",
  92. "address": "0x11a4000"
  93. }
  94. ],
  95. "dll": "ADVAPI32.dll"
  96. },
  97. {
  98. "imports": [
  99. {
  100. "name": "CertCloseStore",
  101. "address": "0x11a4010"
  102. }
  103. ],
  104. "dll": "CRYPT32.dll"
  105. },
  106. {
  107. "imports": [
  108. {
  109. "name": "ConvertInterfaceIndexToLuid",
  110. "address": "0x11a4020"
  111. }
  112. ],
  113. "dll": "IPHLPAPI.DLL"
  114. },
  115. {
  116. "imports": [
  117. {
  118. "name": "GetVersion",
  119. "address": "0x11a4030"
  120. },
  121. {
  122. "name": "GetVersionExW",
  123. "address": "0x11a4038"
  124. }
  125. ],
  126. "dll": "KERNEL32.dll"
  127. },
  128. {
  129. "imports": [
  130. {
  131. "name": "___lc_codepage_func",
  132. "address": "0x11a4048"
  133. }
  134. ],
  135. "dll": "msvcrt.dll"
  136. },
  137. {
  138. "imports": [
  139. {
  140. "name": "GetProcessMemoryInfo",
  141. "address": "0x11a4058"
  142. }
  143. ],
  144. "dll": "PSAPI.DLL"
  145. },
  146. {
  147. "imports": [
  148. {
  149. "name": "DispatchMessageA",
  150. "address": "0x11a4068"
  151. }
  152. ],
  153. "dll": "USER32.dll"
  154. },
  155. {
  156. "imports": [
  157. {
  158. "name": "GetUserProfileDirectoryW",
  159. "address": "0x11a4078"
  160. }
  161. ],
  162. "dll": "USERENV.dll"
  163. },
  164. {
  165. "imports": [
  166. {
  167. "name": "FreeAddrInfoW",
  168. "address": "0x11a4088"
  169. }
  170. ],
  171. "dll": "WS2_32.dll"
  172. },
  173. {
  174. "imports": [
  175. {
  176. "name": "WTSSendMessageW",
  177. "address": "0x11a4098"
  178. }
  179. ],
  180. "dll": "WTSAPI32.dll"
  181. },
  182. {
  183. "imports": [
  184. {
  185. "name": "FlsSetValue",
  186. "address": "0x11a40a8"
  187. }
  188. ],
  189. "dll": "KERNEL32.dll"
  190. },
  191. {
  192. "imports": [
  193. {
  194. "name": "GetProcessWindowStation",
  195. "address": "0x11a40b8"
  196. }
  197. ],
  198. "dll": "USER32.dll"
  199. },
  200. {
  201. "imports": [
  202. {
  203. "name": "LocalAlloc",
  204. "address": "0x11a40c8"
  205. },
  206. {
  207. "name": "LocalFree",
  208. "address": "0x11a40d0"
  209. },
  210. {
  211. "name": "GetModuleFileNameW",
  212. "address": "0x11a40d8"
  213. },
  214. {
  215. "name": "GetProcessAffinityMask",
  216. "address": "0x11a40e0"
  217. },
  218. {
  219. "name": "SetProcessAffinityMask",
  220. "address": "0x11a40e8"
  221. },
  222. {
  223. "name": "SetThreadAffinityMask",
  224. "address": "0x11a40f0"
  225. },
  226. {
  227. "name": "Sleep",
  228. "address": "0x11a40f8"
  229. },
  230. {
  231. "name": "ExitProcess",
  232. "address": "0x11a4100"
  233. },
  234. {
  235. "name": "FreeLibrary",
  236. "address": "0x11a4108"
  237. },
  238. {
  239. "name": "LoadLibraryA",
  240. "address": "0x11a4110"
  241. },
  242. {
  243. "name": "GetModuleHandleA",
  244. "address": "0x11a4118"
  245. },
  246. {
  247. "name": "GetProcAddress",
  248. "address": "0x11a4120"
  249. }
  250. ],
  251. "dll": "KERNEL32.dll"
  252. },
  253. {
  254. "imports": [
  255. {
  256. "name": "GetProcessWindowStation",
  257. "address": "0x11a4130"
  258. },
  259. {
  260. "name": "GetUserObjectInformationW",
  261. "address": "0x11a4138"
  262. }
  263. ],
  264. "dll": "USER32.dll"
  265. }
  266. ],
  267. "digital_signers": null,
  268. "exported_dll_name": null,
  269. "actual_checksum": "0x007eb774",
  270. "overlay": null,
  271. "imagebase": "0x00400000",
  272. "reported_checksum": "0x007eb774",
  273. "icon_hash": null,
  274. "entrypoint": "0x01223dae",
  275. "timestamp": "2019-06-25 07:50:53",
  276. "osversion": "5.2",
  277. "sections": [
  278. {
  279. "name": ".text",
  280. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4096BYTES",
  281. "virtual_address": "0x00001000",
  282. "size_of_data": "0x00000000",
  283. "entropy": "0.00",
  284. "raw_address": "0x00000000",
  285. "virtual_size": "0x0040e7f0",
  286. "characteristics_raw": "0x60d00060"
  287. },
  288. {
  289. "name": ".data",
  290. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  291. "virtual_address": "0x00410000",
  292. "size_of_data": "0x00000000",
  293. "entropy": "0.00",
  294. "raw_address": "0x00000000",
  295. "virtual_size": "0x00009ea0",
  296. "characteristics_raw": "0xc0600040"
  297. },
  298. {
  299. "name": ".rdata",
  300. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_64BYTES",
  301. "virtual_address": "0x0041a000",
  302. "size_of_data": "0x00000000",
  303. "entropy": "0.00",
  304. "raw_address": "0x00000000",
  305. "virtual_size": "0x000abfa0",
  306. "characteristics_raw": "0x40700040"
  307. },
  308. {
  309. "name": ".pdata",
  310. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES",
  311. "virtual_address": "0x004c6000",
  312. "size_of_data": "0x00000000",
  313. "entropy": "0.00",
  314. "raw_address": "0x00000000",
  315. "virtual_size": "0x00025a88",
  316. "characteristics_raw": "0x40300040"
  317. },
  318. {
  319. "name": ".xdata",
  320. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES",
  321. "virtual_address": "0x004ec000",
  322. "size_of_data": "0x00000000",
  323. "entropy": "0.00",
  324. "raw_address": "0x00000000",
  325. "virtual_size": "0x0002868c",
  326. "characteristics_raw": "0x40400040"
  327. },
  328. {
  329. "name": ".bss",
  330. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  331. "virtual_address": "0x00515000",
  332. "size_of_data": "0x00000000",
  333. "entropy": "0.00",
  334. "raw_address": "0x00000000",
  335. "virtual_size": "0x0000f5e0",
  336. "characteristics_raw": "0xc0600080"
  337. },
  338. {
  339. "name": ".idata",
  340. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  341. "virtual_address": "0x00525000",
  342. "size_of_data": "0x00000000",
  343. "entropy": "0.00",
  344. "raw_address": "0x00000000",
  345. "virtual_size": "0x00003f00",
  346. "characteristics_raw": "0xc0300040"
  347. },
  348. {
  349. "name": ".CRT",
  350. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES",
  351. "virtual_address": "0x00529000",
  352. "size_of_data": "0x00000000",
  353. "entropy": "0.00",
  354. "raw_address": "0x00000000",
  355. "virtual_size": "0x00000070",
  356. "characteristics_raw": "0xc0400040"
  357. },
  358. {
  359. "name": ".tls",
  360. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES",
  361. "virtual_address": "0x0052a000",
  362. "size_of_data": "0x00000000",
  363. "entropy": "0.00",
  364. "raw_address": "0x00000000",
  365. "virtual_size": "0x00000010",
  366. "characteristics_raw": "0xc0400040"
  367. },
  368. {
  369. "name": ".vmp0",
  370. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  371. "virtual_address": "0x0052b000",
  372. "size_of_data": "0x00000000",
  373. "entropy": "0.00",
  374. "raw_address": "0x00000000",
  375. "virtual_size": "0x00490ca1",
  376. "characteristics_raw": "0x68000060"
  377. },
  378. {
  379. "name": ".vmp1",
  380. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  381. "virtual_address": "0x009bc000",
  382. "size_of_data": "0x007d7400",
  383. "entropy": "7.94",
  384. "raw_address": "0x00001000",
  385. "virtual_size": "0x007d72a0",
  386. "characteristics_raw": "0x68000060"
  387. },
  388. {
  389. "name": ".rsrc",
  390. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  391. "virtual_address": "0x01194000",
  392. "size_of_data": "0x00008800",
  393. "entropy": "6.17",
  394. "raw_address": "0x007d8400",
  395. "virtual_size": "0x000086cf",
  396. "characteristics_raw": "0xc0300040"
  397. }
  398. ],
  399. "resources": [],
  400. "dirents": [
  401. {
  402. "virtual_address": "0x00000000",
  403. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  404. "size": "0x00000000"
  405. },
  406. {
  407. "virtual_address": "0x00e0d160",
  408. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  409. "size": "0x0000012c"
  410. },
  411. {
  412. "virtual_address": "0x01194000",
  413. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  414. "size": "0x000086cf"
  415. },
  416. {
  417. "virtual_address": "0x0116a740",
  418. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  419. "size": "0x00028b60"
  420. },
  421. {
  422. "virtual_address": "0x00000000",
  423. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  424. "size": "0x00000000"
  425. },
  426. {
  427. "virtual_address": "0x00000000",
  428. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  429. "size": "0x00000000"
  430. },
  431. {
  432. "virtual_address": "0x00000000",
  433. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  434. "size": "0x00000000"
  435. },
  436. {
  437. "virtual_address": "0x00000000",
  438. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  439. "size": "0x00000000"
  440. },
  441. {
  442. "virtual_address": "0x00000000",
  443. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  444. "size": "0x00000000"
  445. },
  446. {
  447. "virtual_address": "0x00dbc7a8",
  448. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  449. "size": "0x00000058"
  450. },
  451. {
  452. "virtual_address": "0x00000000",
  453. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  454. "size": "0x00000000"
  455. },
  456. {
  457. "virtual_address": "0x00000000",
  458. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  459. "size": "0x00000000"
  460. },
  461. {
  462. "virtual_address": "0x00da4000",
  463. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  464. "size": "0x00000148"
  465. },
  466. {
  467. "virtual_address": "0x00000000",
  468. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  469. "size": "0x00000000"
  470. },
  471. {
  472. "virtual_address": "0x00000000",
  473. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  474. "size": "0x00000000"
  475. },
  476. {
  477. "virtual_address": "0x00000000",
  478. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  479. "size": "0x00000000"
  480. }
  481. ],
  482. "exports": [],
  483. "guest_signers": {},
  484. "imphash": "ea2543a8a747d6925fcdd3c0e26b8f4f",
  485. "icon_fuzzy": null,
  486. "icon": null,
  487. "pdbpath": null,
  488. "imported_dll_count": 14,
  489. "versioninfo": []
  490. }
  491. }
  492.  
  493. [*] Resolved APIs: [
  494. "msvcrt.dll._localtime64_s"
  495. ]
  496.  
  497. [*] Static Analysis: {
  498. "pe": {
  499. "peid_signatures": null,
  500. "imports": [
  501. {
  502. "imports": [
  503. {
  504. "name": "AdjustTokenPrivileges",
  505. "address": "0x11a4000"
  506. }
  507. ],
  508. "dll": "ADVAPI32.dll"
  509. },
  510. {
  511. "imports": [
  512. {
  513. "name": "CertCloseStore",
  514. "address": "0x11a4010"
  515. }
  516. ],
  517. "dll": "CRYPT32.dll"
  518. },
  519. {
  520. "imports": [
  521. {
  522. "name": "ConvertInterfaceIndexToLuid",
  523. "address": "0x11a4020"
  524. }
  525. ],
  526. "dll": "IPHLPAPI.DLL"
  527. },
  528. {
  529. "imports": [
  530. {
  531. "name": "GetVersion",
  532. "address": "0x11a4030"
  533. },
  534. {
  535. "name": "GetVersionExW",
  536. "address": "0x11a4038"
  537. }
  538. ],
  539. "dll": "KERNEL32.dll"
  540. },
  541. {
  542. "imports": [
  543. {
  544. "name": "___lc_codepage_func",
  545. "address": "0x11a4048"
  546. }
  547. ],
  548. "dll": "msvcrt.dll"
  549. },
  550. {
  551. "imports": [
  552. {
  553. "name": "GetProcessMemoryInfo",
  554. "address": "0x11a4058"
  555. }
  556. ],
  557. "dll": "PSAPI.DLL"
  558. },
  559. {
  560. "imports": [
  561. {
  562. "name": "DispatchMessageA",
  563. "address": "0x11a4068"
  564. }
  565. ],
  566. "dll": "USER32.dll"
  567. },
  568. {
  569. "imports": [
  570. {
  571. "name": "GetUserProfileDirectoryW",
  572. "address": "0x11a4078"
  573. }
  574. ],
  575. "dll": "USERENV.dll"
  576. },
  577. {
  578. "imports": [
  579. {
  580. "name": "FreeAddrInfoW",
  581. "address": "0x11a4088"
  582. }
  583. ],
  584. "dll": "WS2_32.dll"
  585. },
  586. {
  587. "imports": [
  588. {
  589. "name": "WTSSendMessageW",
  590. "address": "0x11a4098"
  591. }
  592. ],
  593. "dll": "WTSAPI32.dll"
  594. },
  595. {
  596. "imports": [
  597. {
  598. "name": "FlsSetValue",
  599. "address": "0x11a40a8"
  600. }
  601. ],
  602. "dll": "KERNEL32.dll"
  603. },
  604. {
  605. "imports": [
  606. {
  607. "name": "GetProcessWindowStation",
  608. "address": "0x11a40b8"
  609. }
  610. ],
  611. "dll": "USER32.dll"
  612. },
  613. {
  614. "imports": [
  615. {
  616. "name": "LocalAlloc",
  617. "address": "0x11a40c8"
  618. },
  619. {
  620. "name": "LocalFree",
  621. "address": "0x11a40d0"
  622. },
  623. {
  624. "name": "GetModuleFileNameW",
  625. "address": "0x11a40d8"
  626. },
  627. {
  628. "name": "GetProcessAffinityMask",
  629. "address": "0x11a40e0"
  630. },
  631. {
  632. "name": "SetProcessAffinityMask",
  633. "address": "0x11a40e8"
  634. },
  635. {
  636. "name": "SetThreadAffinityMask",
  637. "address": "0x11a40f0"
  638. },
  639. {
  640. "name": "Sleep",
  641. "address": "0x11a40f8"
  642. },
  643. {
  644. "name": "ExitProcess",
  645. "address": "0x11a4100"
  646. },
  647. {
  648. "name": "FreeLibrary",
  649. "address": "0x11a4108"
  650. },
  651. {
  652. "name": "LoadLibraryA",
  653. "address": "0x11a4110"
  654. },
  655. {
  656. "name": "GetModuleHandleA",
  657. "address": "0x11a4118"
  658. },
  659. {
  660. "name": "GetProcAddress",
  661. "address": "0x11a4120"
  662. }
  663. ],
  664. "dll": "KERNEL32.dll"
  665. },
  666. {
  667. "imports": [
  668. {
  669. "name": "GetProcessWindowStation",
  670. "address": "0x11a4130"
  671. },
  672. {
  673. "name": "GetUserObjectInformationW",
  674. "address": "0x11a4138"
  675. }
  676. ],
  677. "dll": "USER32.dll"
  678. }
  679. ],
  680. "digital_signers": null,
  681. "exported_dll_name": null,
  682. "actual_checksum": "0x007eb774",
  683. "overlay": null,
  684. "imagebase": "0x00400000",
  685. "reported_checksum": "0x007eb774",
  686. "icon_hash": null,
  687. "entrypoint": "0x01223dae",
  688. "timestamp": "2019-06-25 07:50:53",
  689. "osversion": "5.2",
  690. "sections": [
  691. {
  692. "name": ".text",
  693. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4096BYTES",
  694. "virtual_address": "0x00001000",
  695. "size_of_data": "0x00000000",
  696. "entropy": "0.00",
  697. "raw_address": "0x00000000",
  698. "virtual_size": "0x0040e7f0",
  699. "characteristics_raw": "0x60d00060"
  700. },
  701. {
  702. "name": ".data",
  703. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  704. "virtual_address": "0x00410000",
  705. "size_of_data": "0x00000000",
  706. "entropy": "0.00",
  707. "raw_address": "0x00000000",
  708. "virtual_size": "0x00009ea0",
  709. "characteristics_raw": "0xc0600040"
  710. },
  711. {
  712. "name": ".rdata",
  713. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_64BYTES",
  714. "virtual_address": "0x0041a000",
  715. "size_of_data": "0x00000000",
  716. "entropy": "0.00",
  717. "raw_address": "0x00000000",
  718. "virtual_size": "0x000abfa0",
  719. "characteristics_raw": "0x40700040"
  720. },
  721. {
  722. "name": ".pdata",
  723. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES",
  724. "virtual_address": "0x004c6000",
  725. "size_of_data": "0x00000000",
  726. "entropy": "0.00",
  727. "raw_address": "0x00000000",
  728. "virtual_size": "0x00025a88",
  729. "characteristics_raw": "0x40300040"
  730. },
  731. {
  732. "name": ".xdata",
  733. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES",
  734. "virtual_address": "0x004ec000",
  735. "size_of_data": "0x00000000",
  736. "entropy": "0.00",
  737. "raw_address": "0x00000000",
  738. "virtual_size": "0x0002868c",
  739. "characteristics_raw": "0x40400040"
  740. },
  741. {
  742. "name": ".bss",
  743. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  744. "virtual_address": "0x00515000",
  745. "size_of_data": "0x00000000",
  746. "entropy": "0.00",
  747. "raw_address": "0x00000000",
  748. "virtual_size": "0x0000f5e0",
  749. "characteristics_raw": "0xc0600080"
  750. },
  751. {
  752. "name": ".idata",
  753. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  754. "virtual_address": "0x00525000",
  755. "size_of_data": "0x00000000",
  756. "entropy": "0.00",
  757. "raw_address": "0x00000000",
  758. "virtual_size": "0x00003f00",
  759. "characteristics_raw": "0xc0300040"
  760. },
  761. {
  762. "name": ".CRT",
  763. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES",
  764. "virtual_address": "0x00529000",
  765. "size_of_data": "0x00000000",
  766. "entropy": "0.00",
  767. "raw_address": "0x00000000",
  768. "virtual_size": "0x00000070",
  769. "characteristics_raw": "0xc0400040"
  770. },
  771. {
  772. "name": ".tls",
  773. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES",
  774. "virtual_address": "0x0052a000",
  775. "size_of_data": "0x00000000",
  776. "entropy": "0.00",
  777. "raw_address": "0x00000000",
  778. "virtual_size": "0x00000010",
  779. "characteristics_raw": "0xc0400040"
  780. },
  781. {
  782. "name": ".vmp0",
  783. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  784. "virtual_address": "0x0052b000",
  785. "size_of_data": "0x00000000",
  786. "entropy": "0.00",
  787. "raw_address": "0x00000000",
  788. "virtual_size": "0x00490ca1",
  789. "characteristics_raw": "0x68000060"
  790. },
  791. {
  792. "name": ".vmp1",
  793. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  794. "virtual_address": "0x009bc000",
  795. "size_of_data": "0x007d7400",
  796. "entropy": "7.94",
  797. "raw_address": "0x00001000",
  798. "virtual_size": "0x007d72a0",
  799. "characteristics_raw": "0x68000060"
  800. },
  801. {
  802. "name": ".rsrc",
  803. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  804. "virtual_address": "0x01194000",
  805. "size_of_data": "0x00008800",
  806. "entropy": "6.17",
  807. "raw_address": "0x007d8400",
  808. "virtual_size": "0x000086cf",
  809. "characteristics_raw": "0xc0300040"
  810. }
  811. ],
  812. "resources": [],
  813. "dirents": [
  814. {
  815. "virtual_address": "0x00000000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  817. "size": "0x00000000"
  818. },
  819. {
  820. "virtual_address": "0x00e0d160",
  821. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  822. "size": "0x0000012c"
  823. },
  824. {
  825. "virtual_address": "0x01194000",
  826. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  827. "size": "0x000086cf"
  828. },
  829. {
  830. "virtual_address": "0x0116a740",
  831. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  832. "size": "0x00028b60"
  833. },
  834. {
  835. "virtual_address": "0x00000000",
  836. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  837. "size": "0x00000000"
  838. },
  839. {
  840. "virtual_address": "0x00000000",
  841. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  842. "size": "0x00000000"
  843. },
  844. {
  845. "virtual_address": "0x00000000",
  846. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  847. "size": "0x00000000"
  848. },
  849. {
  850. "virtual_address": "0x00000000",
  851. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  852. "size": "0x00000000"
  853. },
  854. {
  855. "virtual_address": "0x00000000",
  856. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  857. "size": "0x00000000"
  858. },
  859. {
  860. "virtual_address": "0x00dbc7a8",
  861. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  862. "size": "0x00000058"
  863. },
  864. {
  865. "virtual_address": "0x00000000",
  866. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  867. "size": "0x00000000"
  868. },
  869. {
  870. "virtual_address": "0x00000000",
  871. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  872. "size": "0x00000000"
  873. },
  874. {
  875. "virtual_address": "0x00da4000",
  876. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  877. "size": "0x00000148"
  878. },
  879. {
  880. "virtual_address": "0x00000000",
  881. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  882. "size": "0x00000000"
  883. },
  884. {
  885. "virtual_address": "0x00000000",
  886. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  887. "size": "0x00000000"
  888. },
  889. {
  890. "virtual_address": "0x00000000",
  891. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  892. "size": "0x00000000"
  893. }
  894. ],
  895. "exports": [],
  896. "guest_signers": {},
  897. "imphash": "ea2543a8a747d6925fcdd3c0e26b8f4f",
  898. "icon_fuzzy": null,
  899. "icon": null,
  900. "pdbpath": null,
  901. "imported_dll_count": 14,
  902. "versioninfo": []
  903. }
  904. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!