API tools faq
paste
paladin316

Exes_ab5b3a1700a53ed51c100164170c0618_exe_2019-07-03_20_30.json

paladin316
Jul 3rd, 2019
2,150
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 44.93 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_ab5b3a1700a53ed51c100164170c0618.exe"
  7. [*] File Size: 292352
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "b1650c6085710bd89fdec14ce9a1a5f52d7199ab98671d994181b1e7116a0a86"
  10. [*] MD5: "ab5b3a1700a53ed51c100164170c0618"
  11. [*] SHA1: "520343b191770e871857b54b5e583b96d1dbf256"
  12. [*] SHA512: "50920085def1b5a1b7ee0d9ded3ab11d58338661919bf88355920203ed4295844e1189d9a0fbb86e6bdbc8947dd84639e270f164c3c374911e3074a6b888568c"
  13. [*] CRC32: "713A2B81"
  14. [*] SSDEEP: "3072:AhNHY7VCAUN+3RHAavhpkKaB819+iBNCzbnvnpTSF7Vg4rUcDXEQx3fgSy:As7s+3RJZ59HEvpTS1V/rUcDXRY"
  15.  
  16. [*] Process Execution: [
  17. "Exes_ab5b3a1700a53ed51c100164170c0618.exe",
  18. "winidel.exe"
  19. ]
  20.  
  21. [*] Signatures Detected: [
  22. {
  23. "Description": "Drops a binary and executes it",
  24. "Details": [
  25. {
  26. "binary": "C:\\Windows\\4328901210112693\\winidel.exe"
  27. }
  28. ]
  29. },
  30. {
  31. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  32. "Details": [
  33. {
  34. "Spam": "winidel.exe (2060) called API GlobalMemoryStatus 4132258 times"
  35. },
  36. {
  37. "Spam": "Exes_ab5b3a1700a53ed51c100164170c0618.exe (2788) called API GlobalMemoryStatus 4113122 times"
  38. }
  39. ]
  40. },
  41. {
  42. "Description": "Network activity detected but not expressed in API logs",
  43. "Details": []
  44. },
  45. {
  46. "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
  47. "Details": [
  48. {
  49. "FireEye": "Generic.mg.ab5b3a1700a53ed5"
  50. },
  51. {
  52. "McAfee": "RDN/Autorun.worm.gen"
  53. },
  54. {
  55. "Cylance": "Unsafe"
  56. },
  57. {
  58. "Cybereason": "malicious.191770"
  59. },
  60. {
  61. "Invincea": "heuristic"
  62. },
  63. {
  64. "Symantec": "ML.Attribute.HighConfidence"
  65. },
  66. {
  67. "APEX": "Malicious"
  68. },
  69. {
  70. "Paloalto": "generic.ml"
  71. },
  72. {
  73. "Kaspersky": "Trojan.Win32.Scar.sjyu"
  74. },
  75. {
  76. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  77. },
  78. {
  79. "AegisLab": "Trojan.Multi.Generic.4!c"
  80. },
  81. {
  82. "Avast": "Win32:Trojan-gen"
  83. },
  84. {
  85. "McAfee-GW-Edition": "Artemis!Trojan"
  86. },
  87. {
  88. "Trapmine": "malicious.high.ml.score"
  89. },
  90. {
  91. "Ikarus": "Trojan.Win32.Krypt"
  92. },
  93. {
  94. "Microsoft": "Worm:Win32/Autorun.AJA!bit"
  95. },
  96. {
  97. "Endgame": "malicious (high confidence)"
  98. },
  99. {
  100. "ZoneAlarm": "Trojan.Win32.Scar.sjyu"
  101. },
  102. {
  103. "GData": "Win32.Packed.Kryptik.3KF43D"
  104. },
  105. {
  106. "Acronis": "suspicious"
  107. },
  108. {
  109. "VBA32": "BScope.Trojan.Fuerboos"
  110. },
  111. {
  112. "ESET-NOD32": "a variant of Win32/GenKryptik.DMIB"
  113. },
  114. {
  115. "Rising": "Worm.Autorun!8.50 (CLOUD)"
  116. },
  117. {
  118. "SentinelOne": "DFI - Suspicious PE"
  119. },
  120. {
  121. "Fortinet": "W32/GenKryptik.DMGW!tr"
  122. },
  123. {
  124. "MaxSecure": "Ransomeware.CRAB.gen"
  125. },
  126. {
  127. "AVG": "Win32:Trojan-gen"
  128. },
  129. {
  130. "CrowdStrike": "win/malicious_confidence_100% (W)"
  131. },
  132. {
  133. "Qihoo-360": "HEUR/QVM10.2.437F.Malware.Gen"
  134. }
  135. ]
  136. },
  137. {
  138. "Description": "Creates a copy of itself",
  139. "Details": [
  140. {
  141. "copy": "C:\\Windows\\4328901210112693\\winidel.exe"
  142. }
  143. ]
  144. },
  145. {
  146. "Description": "Created network traffic indicative of malicious activity",
  147. "Details": [
  148. {
  149. "signature": "ET DNS Query for .su TLD (Soviet Union) Often Malware Related"
  150. }
  151. ]
  152. }
  153. ]
  154.  
  155. [*] Started Service: []
  156.  
  157. [*] Executed Commands: []
  158.  
  159. [*] Mutexes: []
  160.  
  161. [*] Modified Files: []
  162.  
  163. [*] Deleted Files: []
  164.  
  165. [*] Modified Registry Keys: []
  166.  
  167. [*] Deleted Registry Keys: []
  168.  
  169. [*] DNS Communications: [
  170. {
  171. "type": "A",
  172. "request": "soruuoooshfrohue.su",
  173. "answers": []
  174. }
  175. ]
  176.  
  177. [*] Domains: [
  178. {
  179. "ip": "",
  180. "domain": "soruuoooshfrohue.su"
  181. }
  182. ]
  183.  
  184. [*] Network Communication - ICMP: []
  185.  
  186. [*] Network Communication - HTTP: []
  187.  
  188. [*] Network Communication - SMTP: []
  189.  
  190. [*] Network Communication - Hosts: []
  191.  
  192. [*] Network Communication - IRC: []
  193.  
  194. [*] Static Analysis: {
  195. "pe": {
  196. "peid_signatures": null,
  197. "imports": [
  198. {
  199. "imports": [
  200. {
  201. "name": "GetProcAddress",
  202. "address": "0x425000"
  203. },
  204. {
  205. "name": "GlobalAlloc",
  206. "address": "0x425004"
  207. },
  208. {
  209. "name": "GlobalMemoryStatus",
  210. "address": "0x425008"
  211. },
  212. {
  213. "name": "GetBinaryTypeA",
  214. "address": "0x42500c"
  215. },
  216. {
  217. "name": "GetLastError",
  218. "address": "0x425010"
  219. },
  220. {
  221. "name": "DebugActiveProcess",
  222. "address": "0x425014"
  223. },
  224. {
  225. "name": "GetHandleInformation",
  226. "address": "0x425018"
  227. },
  228. {
  229. "name": "lstrlenW",
  230. "address": "0x42501c"
  231. },
  232. {
  233. "name": "GetModuleHandleW",
  234. "address": "0x425020"
  235. },
  236. {
  237. "name": "GetFileAttributesExA",
  238. "address": "0x425024"
  239. },
  240. {
  241. "name": "GetNumberFormatA",
  242. "address": "0x425028"
  243. },
  244. {
  245. "name": "PeekConsoleInputA",
  246. "address": "0x42502c"
  247. },
  248. {
  249. "name": "ScrollConsoleScreenBufferA",
  250. "address": "0x425030"
  251. },
  252. {
  253. "name": "WriteConsoleW",
  254. "address": "0x425034"
  255. },
  256. {
  257. "name": "SetFilePointerEx",
  258. "address": "0x425038"
  259. },
  260. {
  261. "name": "GetStringTypeW",
  262. "address": "0x42503c"
  263. },
  264. {
  265. "name": "OutputDebugStringW",
  266. "address": "0x425040"
  267. },
  268. {
  269. "name": "GetConsoleMode",
  270. "address": "0x425044"
  271. },
  272. {
  273. "name": "GetConsoleCP",
  274. "address": "0x425048"
  275. },
  276. {
  277. "name": "FlushFileBuffers",
  278. "address": "0x42504c"
  279. },
  280. {
  281. "name": "SetStdHandle",
  282. "address": "0x425050"
  283. },
  284. {
  285. "name": "HeapReAlloc",
  286. "address": "0x425054"
  287. },
  288. {
  289. "name": "GetCPInfo",
  290. "address": "0x425058"
  291. },
  292. {
  293. "name": "GetOEMCP",
  294. "address": "0x42505c"
  295. },
  296. {
  297. "name": "GetACP",
  298. "address": "0x425060"
  299. },
  300. {
  301. "name": "EncodePointer",
  302. "address": "0x425064"
  303. },
  304. {
  305. "name": "DecodePointer",
  306. "address": "0x425068"
  307. },
  308. {
  309. "name": "RaiseException",
  310. "address": "0x42506c"
  311. },
  312. {
  313. "name": "RtlUnwind",
  314. "address": "0x425070"
  315. },
  316. {
  317. "name": "GetCommandLineA",
  318. "address": "0x425074"
  319. },
  320. {
  321. "name": "IsProcessorFeaturePresent",
  322. "address": "0x425078"
  323. },
  324. {
  325. "name": "HeapAlloc",
  326. "address": "0x42507c"
  327. },
  328. {
  329. "name": "HeapFree",
  330. "address": "0x425080"
  331. },
  332. {
  333. "name": "ExitProcess",
  334. "address": "0x425084"
  335. },
  336. {
  337. "name": "GetModuleHandleExW",
  338. "address": "0x425088"
  339. },
  340. {
  341. "name": "AreFileApisANSI",
  342. "address": "0x42508c"
  343. },
  344. {
  345. "name": "MultiByteToWideChar",
  346. "address": "0x425090"
  347. },
  348. {
  349. "name": "WideCharToMultiByte",
  350. "address": "0x425094"
  351. },
  352. {
  353. "name": "HeapSize",
  354. "address": "0x425098"
  355. },
  356. {
  357. "name": "IsDebuggerPresent",
  358. "address": "0x42509c"
  359. },
  360. {
  361. "name": "EnterCriticalSection",
  362. "address": "0x4250a0"
  363. },
  364. {
  365. "name": "LeaveCriticalSection",
  366. "address": "0x4250a4"
  367. },
  368. {
  369. "name": "CloseHandle",
  370. "address": "0x4250a8"
  371. },
  372. {
  373. "name": "SetLastError",
  374. "address": "0x4250ac"
  375. },
  376. {
  377. "name": "GetCurrentThread",
  378. "address": "0x4250b0"
  379. },
  380. {
  381. "name": "GetCurrentThreadId",
  382. "address": "0x4250b4"
  383. },
  384. {
  385. "name": "GetProcessHeap",
  386. "address": "0x4250b8"
  387. },
  388. {
  389. "name": "GetStdHandle",
  390. "address": "0x4250bc"
  391. },
  392. {
  393. "name": "GetFileType",
  394. "address": "0x4250c0"
  395. },
  396. {
  397. "name": "DeleteCriticalSection",
  398. "address": "0x4250c4"
  399. },
  400. {
  401. "name": "GetStartupInfoW",
  402. "address": "0x4250c8"
  403. },
  404. {
  405. "name": "GetModuleFileNameA",
  406. "address": "0x4250cc"
  407. },
  408. {
  409. "name": "WriteFile",
  410. "address": "0x4250d0"
  411. },
  412. {
  413. "name": "GetModuleFileNameW",
  414. "address": "0x4250d4"
  415. },
  416. {
  417. "name": "QueryPerformanceCounter",
  418. "address": "0x4250d8"
  419. },
  420. {
  421. "name": "GetCurrentProcessId",
  422. "address": "0x4250dc"
  423. },
  424. {
  425. "name": "GetSystemTimeAsFileTime",
  426. "address": "0x4250e0"
  427. },
  428. {
  429. "name": "GetEnvironmentStringsW",
  430. "address": "0x4250e4"
  431. },
  432. {
  433. "name": "FreeEnvironmentStringsW",
  434. "address": "0x4250e8"
  435. },
  436. {
  437. "name": "UnhandledExceptionFilter",
  438. "address": "0x4250ec"
  439. },
  440. {
  441. "name": "SetUnhandledExceptionFilter",
  442. "address": "0x4250f0"
  443. },
  444. {
  445. "name": "InitializeCriticalSectionAndSpinCount",
  446. "address": "0x4250f4"
  447. },
  448. {
  449. "name": "CreateEventW",
  450. "address": "0x4250f8"
  451. },
  452. {
  453. "name": "Sleep",
  454. "address": "0x4250fc"
  455. },
  456. {
  457. "name": "GetCurrentProcess",
  458. "address": "0x425100"
  459. },
  460. {
  461. "name": "TerminateProcess",
  462. "address": "0x425104"
  463. },
  464. {
  465. "name": "TlsAlloc",
  466. "address": "0x425108"
  467. },
  468. {
  469. "name": "TlsGetValue",
  470. "address": "0x42510c"
  471. },
  472. {
  473. "name": "TlsSetValue",
  474. "address": "0x425110"
  475. },
  476. {
  477. "name": "TlsFree",
  478. "address": "0x425114"
  479. },
  480. {
  481. "name": "GetTickCount",
  482. "address": "0x425118"
  483. },
  484. {
  485. "name": "CreateSemaphoreW",
  486. "address": "0x42511c"
  487. },
  488. {
  489. "name": "SetConsoleCtrlHandler",
  490. "address": "0x425120"
  491. },
  492. {
  493. "name": "GetDateFormatW",
  494. "address": "0x425124"
  495. },
  496. {
  497. "name": "GetTimeFormatW",
  498. "address": "0x425128"
  499. },
  500. {
  501. "name": "CompareStringW",
  502. "address": "0x42512c"
  503. },
  504. {
  505. "name": "LCMapStringW",
  506. "address": "0x425130"
  507. },
  508. {
  509. "name": "GetLocaleInfoW",
  510. "address": "0x425134"
  511. },
  512. {
  513. "name": "IsValidLocale",
  514. "address": "0x425138"
  515. },
  516. {
  517. "name": "GetUserDefaultLCID",
  518. "address": "0x42513c"
  519. },
  520. {
  521. "name": "EnumSystemLocalesW",
  522. "address": "0x425140"
  523. },
  524. {
  525. "name": "FatalAppExitA",
  526. "address": "0x425144"
  527. },
  528. {
  529. "name": "FreeLibrary",
  530. "address": "0x425148"
  531. },
  532. {
  533. "name": "LoadLibraryExW",
  534. "address": "0x42514c"
  535. },
  536. {
  537. "name": "IsValidCodePage",
  538. "address": "0x425150"
  539. },
  540. {
  541. "name": "CreateFileW",
  542. "address": "0x425154"
  543. }
  544. ],
  545. "dll": "KERNEL32.dll"
  546. },
  547. {
  548. "imports": [
  549. {
  550. "name": "LoadStringW",
  551. "address": "0x42515c"
  552. },
  553. {
  554. "name": "GetMonitorInfoA",
  555. "address": "0x425160"
  556. },
  557. {
  558. "name": "GetGUIThreadInfo",
  559. "address": "0x425164"
  560. },
  561. {
  562. "name": "SetWindowsHookExA",
  563. "address": "0x425168"
  564. }
  565. ],
  566. "dll": "USER32.dll"
  567. },
  568. {
  569. "imports": [
  570. {
  571. "name": "WinHttpCloseHandle",
  572. "address": "0x425170"
  573. },
  574. {
  575. "name": "WinHttpQueryDataAvailable",
  576. "address": "0x425174"
  577. },
  578. {
  579. "name": "WinHttpSetCredentials",
  580. "address": "0x425178"
  581. },
  582. {
  583. "name": "WinHttpDetectAutoProxyConfigUrl",
  584. "address": "0x42517c"
  585. },
  586. {
  587. "name": "WinHttpTimeFromSystemTime",
  588. "address": "0x425180"
  589. },
  590. {
  591. "name": "WinHttpSetDefaultProxyConfiguration",
  592. "address": "0x425184"
  593. }
  594. ],
  595. "dll": "WINHTTP.dll"
  596. }
  597. ],
  598. "digital_signers": null,
  599. "exported_dll_name": null,
  600. "actual_checksum": "0x00050480",
  601. "overlay": null,
  602. "imagebase": "0x00400000",
  603. "reported_checksum": "0x00050480",
  604. "icon_hash": null,
  605. "entrypoint": "0x004061c0",
  606. "timestamp": "2018-05-08 13:41:01",
  607. "osversion": "5.1",
  608. "sections": [
  609. {
  610. "name": ".text",
  611. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  612. "virtual_address": "0x00001000",
  613. "size_of_data": "0x00023a00",
  614. "entropy": "6.71",
  615. "raw_address": "0x00000400",
  616. "virtual_size": "0x00023826",
  617. "characteristics_raw": "0x60000020"
  618. },
  619. {
  620. "name": ".rdata",
  621. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  622. "virtual_address": "0x00025000",
  623. "size_of_data": "0x0000b200",
  624. "entropy": "5.53",
  625. "raw_address": "0x00023e00",
  626. "virtual_size": "0x0000b0a4",
  627. "characteristics_raw": "0x40000040"
  628. },
  629. {
  630. "name": ".data",
  631. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  632. "virtual_address": "0x00031000",
  633. "size_of_data": "0x0000c800",
  634. "entropy": "6.06",
  635. "raw_address": "0x0002f000",
  636. "virtual_size": "0x04e695e0",
  637. "characteristics_raw": "0xc0000040"
  638. },
  639. {
  640. "name": ".rsrc",
  641. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  642. "virtual_address": "0x04e9b000",
  643. "size_of_data": "0x00009c00",
  644. "entropy": "5.85",
  645. "raw_address": "0x0003b800",
  646. "virtual_size": "0x00009b68",
  647. "characteristics_raw": "0x40000040"
  648. },
  649. {
  650. "name": ".reloc",
  651. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  652. "virtual_address": "0x04ea5000",
  653. "size_of_data": "0x00002200",
  654. "entropy": "6.51",
  655. "raw_address": "0x00045400",
  656. "virtual_size": "0x00002030",
  657. "characteristics_raw": "0x42000040"
  658. }
  659. ],
  660. "resources": [],
  661. "dirents": [
  662. {
  663. "virtual_address": "0x00000000",
  664. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  665. "size": "0x00000000"
  666. },
  667. {
  668. "virtual_address": "0x0002f764",
  669. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  670. "size": "0x00000050"
  671. },
  672. {
  673. "virtual_address": "0x04e9b000",
  674. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  675. "size": "0x00009b68"
  676. },
  677. {
  678. "virtual_address": "0x00000000",
  679. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  680. "size": "0x00000000"
  681. },
  682. {
  683. "virtual_address": "0x00000000",
  684. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  685. "size": "0x00000000"
  686. },
  687. {
  688. "virtual_address": "0x04ea5000",
  689. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  690. "size": "0x00002030"
  691. },
  692. {
  693. "virtual_address": "0x000251e0",
  694. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  695. "size": "0x00000038"
  696. },
  697. {
  698. "virtual_address": "0x00000000",
  699. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  700. "size": "0x00000000"
  701. },
  702. {
  703. "virtual_address": "0x00000000",
  704. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  705. "size": "0x00000000"
  706. },
  707. {
  708. "virtual_address": "0x00000000",
  709. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  710. "size": "0x00000000"
  711. },
  712. {
  713. "virtual_address": "0x00000000",
  714. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  715. "size": "0x00000000"
  716. },
  717. {
  718. "virtual_address": "0x00000000",
  719. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  720. "size": "0x00000000"
  721. },
  722. {
  723. "virtual_address": "0x00025000",
  724. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  725. "size": "0x0000018c"
  726. },
  727. {
  728. "virtual_address": "0x00000000",
  729. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  730. "size": "0x00000000"
  731. },
  732. {
  733. "virtual_address": "0x00000000",
  734. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  735. "size": "0x00000000"
  736. },
  737. {
  738. "virtual_address": "0x00000000",
  739. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  740. "size": "0x00000000"
  741. }
  742. ],
  743. "exports": [],
  744. "guest_signers": {},
  745. "imphash": "4f12f6bd5d25d34eb38557a16be20152",
  746. "icon_fuzzy": null,
  747. "icon": null,
  748. "pdbpath": "C:\\digemohet vuyanerujehow32\\sadogani.pdb\\x00_1477070473\\bin\\howipulumi.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9b\\x00\\x00\\x00\\x9b",
  749. "imported_dll_count": 3,
  750. "versioninfo": []
  751. }
  752. }
  753.  
  754. [*] Resolved APIs: [
  755. "kernel32.dll.FlsAlloc",
  756. "kernel32.dll.FlsFree",
  757. "kernel32.dll.FlsGetValue",
  758. "kernel32.dll.FlsSetValue",
  759. "kernel32.dll.InitializeCriticalSectionEx",
  760. "kernel32.dll.CreateEventExW",
  761. "kernel32.dll.CreateSemaphoreExW",
  762. "kernel32.dll.SetThreadStackGuarantee",
  763. "kernel32.dll.CreateThreadpoolTimer",
  764. "kernel32.dll.SetThreadpoolTimer",
  765. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  766. "kernel32.dll.CloseThreadpoolTimer",
  767. "kernel32.dll.CreateThreadpoolWait",
  768. "kernel32.dll.SetThreadpoolWait",
  769. "kernel32.dll.CloseThreadpoolWait",
  770. "kernel32.dll.FlushProcessWriteBuffers",
  771. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  772. "kernel32.dll.GetCurrentProcessorNumber",
  773. "kernel32.dll.GetLogicalProcessorInformation",
  774. "kernel32.dll.CreateSymbolicLinkW",
  775. "kernel32.dll.EnumSystemLocalesEx",
  776. "kernel32.dll.CompareStringEx",
  777. "kernel32.dll.GetDateFormatEx",
  778. "kernel32.dll.GetLocaleInfoEx",
  779. "kernel32.dll.GetTimeFormatEx",
  780. "kernel32.dll.GetUserDefaultLocaleName",
  781. "kernel32.dll.IsValidLocaleName",
  782. "kernel32.dll.LCMapStringEx",
  783. "kernel32.dll.GetTickCount64"
  784. ]
  785.  
  786. [*] Static Analysis: {
  787. "pe": {
  788. "peid_signatures": null,
  789. "imports": [
  790. {
  791. "imports": [
  792. {
  793. "name": "GetProcAddress",
  794. "address": "0x425000"
  795. },
  796. {
  797. "name": "GlobalAlloc",
  798. "address": "0x425004"
  799. },
  800. {
  801. "name": "GlobalMemoryStatus",
  802. "address": "0x425008"
  803. },
  804. {
  805. "name": "GetBinaryTypeA",
  806. "address": "0x42500c"
  807. },
  808. {
  809. "name": "GetLastError",
  810. "address": "0x425010"
  811. },
  812. {
  813. "name": "DebugActiveProcess",
  814. "address": "0x425014"
  815. },
  816. {
  817. "name": "GetHandleInformation",
  818. "address": "0x425018"
  819. },
  820. {
  821. "name": "lstrlenW",
  822. "address": "0x42501c"
  823. },
  824. {
  825. "name": "GetModuleHandleW",
  826. "address": "0x425020"
  827. },
  828. {
  829. "name": "GetFileAttributesExA",
  830. "address": "0x425024"
  831. },
  832. {
  833. "name": "GetNumberFormatA",
  834. "address": "0x425028"
  835. },
  836. {
  837. "name": "PeekConsoleInputA",
  838. "address": "0x42502c"
  839. },
  840. {
  841. "name": "ScrollConsoleScreenBufferA",
  842. "address": "0x425030"
  843. },
  844. {
  845. "name": "WriteConsoleW",
  846. "address": "0x425034"
  847. },
  848. {
  849. "name": "SetFilePointerEx",
  850. "address": "0x425038"
  851. },
  852. {
  853. "name": "GetStringTypeW",
  854. "address": "0x42503c"
  855. },
  856. {
  857. "name": "OutputDebugStringW",
  858. "address": "0x425040"
  859. },
  860. {
  861. "name": "GetConsoleMode",
  862. "address": "0x425044"
  863. },
  864. {
  865. "name": "GetConsoleCP",
  866. "address": "0x425048"
  867. },
  868. {
  869. "name": "FlushFileBuffers",
  870. "address": "0x42504c"
  871. },
  872. {
  873. "name": "SetStdHandle",
  874. "address": "0x425050"
  875. },
  876. {
  877. "name": "HeapReAlloc",
  878. "address": "0x425054"
  879. },
  880. {
  881. "name": "GetCPInfo",
  882. "address": "0x425058"
  883. },
  884. {
  885. "name": "GetOEMCP",
  886. "address": "0x42505c"
  887. },
  888. {
  889. "name": "GetACP",
  890. "address": "0x425060"
  891. },
  892. {
  893. "name": "EncodePointer",
  894. "address": "0x425064"
  895. },
  896. {
  897. "name": "DecodePointer",
  898. "address": "0x425068"
  899. },
  900. {
  901. "name": "RaiseException",
  902. "address": "0x42506c"
  903. },
  904. {
  905. "name": "RtlUnwind",
  906. "address": "0x425070"
  907. },
  908. {
  909. "name": "GetCommandLineA",
  910. "address": "0x425074"
  911. },
  912. {
  913. "name": "IsProcessorFeaturePresent",
  914. "address": "0x425078"
  915. },
  916. {
  917. "name": "HeapAlloc",
  918. "address": "0x42507c"
  919. },
  920. {
  921. "name": "HeapFree",
  922. "address": "0x425080"
  923. },
  924. {
  925. "name": "ExitProcess",
  926. "address": "0x425084"
  927. },
  928. {
  929. "name": "GetModuleHandleExW",
  930. "address": "0x425088"
  931. },
  932. {
  933. "name": "AreFileApisANSI",
  934. "address": "0x42508c"
  935. },
  936. {
  937. "name": "MultiByteToWideChar",
  938. "address": "0x425090"
  939. },
  940. {
  941. "name": "WideCharToMultiByte",
  942. "address": "0x425094"
  943. },
  944. {
  945. "name": "HeapSize",
  946. "address": "0x425098"
  947. },
  948. {
  949. "name": "IsDebuggerPresent",
  950. "address": "0x42509c"
  951. },
  952. {
  953. "name": "EnterCriticalSection",
  954. "address": "0x4250a0"
  955. },
  956. {
  957. "name": "LeaveCriticalSection",
  958. "address": "0x4250a4"
  959. },
  960. {
  961. "name": "CloseHandle",
  962. "address": "0x4250a8"
  963. },
  964. {
  965. "name": "SetLastError",
  966. "address": "0x4250ac"
  967. },
  968. {
  969. "name": "GetCurrentThread",
  970. "address": "0x4250b0"
  971. },
  972. {
  973. "name": "GetCurrentThreadId",
  974. "address": "0x4250b4"
  975. },
  976. {
  977. "name": "GetProcessHeap",
  978. "address": "0x4250b8"
  979. },
  980. {
  981. "name": "GetStdHandle",
  982. "address": "0x4250bc"
  983. },
  984. {
  985. "name": "GetFileType",
  986. "address": "0x4250c0"
  987. },
  988. {
  989. "name": "DeleteCriticalSection",
  990. "address": "0x4250c4"
  991. },
  992. {
  993. "name": "GetStartupInfoW",
  994. "address": "0x4250c8"
  995. },
  996. {
  997. "name": "GetModuleFileNameA",
  998. "address": "0x4250cc"
  999. },
  1000. {
  1001. "name": "WriteFile",
  1002. "address": "0x4250d0"
  1003. },
  1004. {
  1005. "name": "GetModuleFileNameW",
  1006. "address": "0x4250d4"
  1007. },
  1008. {
  1009. "name": "QueryPerformanceCounter",
  1010. "address": "0x4250d8"
  1011. },
  1012. {
  1013. "name": "GetCurrentProcessId",
  1014. "address": "0x4250dc"
  1015. },
  1016. {
  1017. "name": "GetSystemTimeAsFileTime",
  1018. "address": "0x4250e0"
  1019. },
  1020. {
  1021. "name": "GetEnvironmentStringsW",
  1022. "address": "0x4250e4"
  1023. },
  1024. {
  1025. "name": "FreeEnvironmentStringsW",
  1026. "address": "0x4250e8"
  1027. },
  1028. {
  1029. "name": "UnhandledExceptionFilter",
  1030. "address": "0x4250ec"
  1031. },
  1032. {
  1033. "name": "SetUnhandledExceptionFilter",
  1034. "address": "0x4250f0"
  1035. },
  1036. {
  1037. "name": "InitializeCriticalSectionAndSpinCount",
  1038. "address": "0x4250f4"
  1039. },
  1040. {
  1041. "name": "CreateEventW",
  1042. "address": "0x4250f8"
  1043. },
  1044. {
  1045. "name": "Sleep",
  1046. "address": "0x4250fc"
  1047. },
  1048. {
  1049. "name": "GetCurrentProcess",
  1050. "address": "0x425100"
  1051. },
  1052. {
  1053. "name": "TerminateProcess",
  1054. "address": "0x425104"
  1055. },
  1056. {
  1057. "name": "TlsAlloc",
  1058. "address": "0x425108"
  1059. },
  1060. {
  1061. "name": "TlsGetValue",
  1062. "address": "0x42510c"
  1063. },
  1064. {
  1065. "name": "TlsSetValue",
  1066. "address": "0x425110"
  1067. },
  1068. {
  1069. "name": "TlsFree",
  1070. "address": "0x425114"
  1071. },
  1072. {
  1073. "name": "GetTickCount",
  1074. "address": "0x425118"
  1075. },
  1076. {
  1077. "name": "CreateSemaphoreW",
  1078. "address": "0x42511c"
  1079. },
  1080. {
  1081. "name": "SetConsoleCtrlHandler",
  1082. "address": "0x425120"
  1083. },
  1084. {
  1085. "name": "GetDateFormatW",
  1086. "address": "0x425124"
  1087. },
  1088. {
  1089. "name": "GetTimeFormatW",
  1090. "address": "0x425128"
  1091. },
  1092. {
  1093. "name": "CompareStringW",
  1094. "address": "0x42512c"
  1095. },
  1096. {
  1097. "name": "LCMapStringW",
  1098. "address": "0x425130"
  1099. },
  1100. {
  1101. "name": "GetLocaleInfoW",
  1102. "address": "0x425134"
  1103. },
  1104. {
  1105. "name": "IsValidLocale",
  1106. "address": "0x425138"
  1107. },
  1108. {
  1109. "name": "GetUserDefaultLCID",
  1110. "address": "0x42513c"
  1111. },
  1112. {
  1113. "name": "EnumSystemLocalesW",
  1114. "address": "0x425140"
  1115. },
  1116. {
  1117. "name": "FatalAppExitA",
  1118. "address": "0x425144"
  1119. },
  1120. {
  1121. "name": "FreeLibrary",
  1122. "address": "0x425148"
  1123. },
  1124. {
  1125. "name": "LoadLibraryExW",
  1126. "address": "0x42514c"
  1127. },
  1128. {
  1129. "name": "IsValidCodePage",
  1130. "address": "0x425150"
  1131. },
  1132. {
  1133. "name": "CreateFileW",
  1134. "address": "0x425154"
  1135. }
  1136. ],
  1137. "dll": "KERNEL32.dll"
  1138. },
  1139. {
  1140. "imports": [
  1141. {
  1142. "name": "LoadStringW",
  1143. "address": "0x42515c"
  1144. },
  1145. {
  1146. "name": "GetMonitorInfoA",
  1147. "address": "0x425160"
  1148. },
  1149. {
  1150. "name": "GetGUIThreadInfo",
  1151. "address": "0x425164"
  1152. },
  1153. {
  1154. "name": "SetWindowsHookExA",
  1155. "address": "0x425168"
  1156. }
  1157. ],
  1158. "dll": "USER32.dll"
  1159. },
  1160. {
  1161. "imports": [
  1162. {
  1163. "name": "WinHttpCloseHandle",
  1164. "address": "0x425170"
  1165. },
  1166. {
  1167. "name": "WinHttpQueryDataAvailable",
  1168. "address": "0x425174"
  1169. },
  1170. {
  1171. "name": "WinHttpSetCredentials",
  1172. "address": "0x425178"
  1173. },
  1174. {
  1175. "name": "WinHttpDetectAutoProxyConfigUrl",
  1176. "address": "0x42517c"
  1177. },
  1178. {
  1179. "name": "WinHttpTimeFromSystemTime",
  1180. "address": "0x425180"
  1181. },
  1182. {
  1183. "name": "WinHttpSetDefaultProxyConfiguration",
  1184. "address": "0x425184"
  1185. }
  1186. ],
  1187. "dll": "WINHTTP.dll"
  1188. }
  1189. ],
  1190. "digital_signers": null,
  1191. "exported_dll_name": null,
  1192. "actual_checksum": "0x00050480",
  1193. "overlay": null,
  1194. "imagebase": "0x00400000",
  1195. "reported_checksum": "0x00050480",
  1196. "icon_hash": null,
  1197. "entrypoint": "0x004061c0",
  1198. "timestamp": "2018-05-08 13:41:01",
  1199. "osversion": "5.1",
  1200. "sections": [
  1201. {
  1202. "name": ".text",
  1203. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1204. "virtual_address": "0x00001000",
  1205. "size_of_data": "0x00023a00",
  1206. "entropy": "6.71",
  1207. "raw_address": "0x00000400",
  1208. "virtual_size": "0x00023826",
  1209. "characteristics_raw": "0x60000020"
  1210. },
  1211. {
  1212. "name": ".rdata",
  1213. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1214. "virtual_address": "0x00025000",
  1215. "size_of_data": "0x0000b200",
  1216. "entropy": "5.53",
  1217. "raw_address": "0x00023e00",
  1218. "virtual_size": "0x0000b0a4",
  1219. "characteristics_raw": "0x40000040"
  1220. },
  1221. {
  1222. "name": ".data",
  1223. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1224. "virtual_address": "0x00031000",
  1225. "size_of_data": "0x0000c800",
  1226. "entropy": "6.06",
  1227. "raw_address": "0x0002f000",
  1228. "virtual_size": "0x04e695e0",
  1229. "characteristics_raw": "0xc0000040"
  1230. },
  1231. {
  1232. "name": ".rsrc",
  1233. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1234. "virtual_address": "0x04e9b000",
  1235. "size_of_data": "0x00009c00",
  1236. "entropy": "5.85",
  1237. "raw_address": "0x0003b800",
  1238. "virtual_size": "0x00009b68",
  1239. "characteristics_raw": "0x40000040"
  1240. },
  1241. {
  1242. "name": ".reloc",
  1243. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1244. "virtual_address": "0x04ea5000",
  1245. "size_of_data": "0x00002200",
  1246. "entropy": "6.51",
  1247. "raw_address": "0x00045400",
  1248. "virtual_size": "0x00002030",
  1249. "characteristics_raw": "0x42000040"
  1250. }
  1251. ],
  1252. "resources": [],
  1253. "dirents": [
  1254. {
  1255. "virtual_address": "0x00000000",
  1256. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1257. "size": "0x00000000"
  1258. },
  1259. {
  1260. "virtual_address": "0x0002f764",
  1261. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1262. "size": "0x00000050"
  1263. },
  1264. {
  1265. "virtual_address": "0x04e9b000",
  1266. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1267. "size": "0x00009b68"
  1268. },
  1269. {
  1270. "virtual_address": "0x00000000",
  1271. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1272. "size": "0x00000000"
  1273. },
  1274. {
  1275. "virtual_address": "0x00000000",
  1276. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1277. "size": "0x00000000"
  1278. },
  1279. {
  1280. "virtual_address": "0x04ea5000",
  1281. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1282. "size": "0x00002030"
  1283. },
  1284. {
  1285. "virtual_address": "0x000251e0",
  1286. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1287. "size": "0x00000038"
  1288. },
  1289. {
  1290. "virtual_address": "0x00000000",
  1291. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1292. "size": "0x00000000"
  1293. },
  1294. {
  1295. "virtual_address": "0x00000000",
  1296. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1297. "size": "0x00000000"
  1298. },
  1299. {
  1300. "virtual_address": "0x00000000",
  1301. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1302. "size": "0x00000000"
  1303. },
  1304. {
  1305. "virtual_address": "0x00000000",
  1306. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1307. "size": "0x00000000"
  1308. },
  1309. {
  1310. "virtual_address": "0x00000000",
  1311. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1312. "size": "0x00000000"
  1313. },
  1314. {
  1315. "virtual_address": "0x00025000",
  1316. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1317. "size": "0x0000018c"
  1318. },
  1319. {
  1320. "virtual_address": "0x00000000",
  1321. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1322. "size": "0x00000000"
  1323. },
  1324. {
  1325. "virtual_address": "0x00000000",
  1326. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1327. "size": "0x00000000"
  1328. },
  1329. {
  1330. "virtual_address": "0x00000000",
  1331. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1332. "size": "0x00000000"
  1333. }
  1334. ],
  1335. "exports": [],
  1336. "guest_signers": {},
  1337. "imphash": "4f12f6bd5d25d34eb38557a16be20152",
  1338. "icon_fuzzy": null,
  1339. "icon": null,
  1340. "pdbpath": "C:\\digemohet vuyanerujehow32\\sadogani.pdb\\x00_1477070473\\bin\\howipulumi.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9b\\x00\\x00\\x00\\x9b",
  1341. "imported_dll_count": 3,
  1342. "versioninfo": []
  1343. }
  1344. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!