Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- [*] MalFamily: ""
- [*] MalScore: 10.0
- [*] File Name: "Exes_f9dd4bbd.exe"
- [*] File Size: 3734809
- [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- [*] SHA256: "7f5fbfd053d1e45a40c306a9ad0e0f06fa0ad05aeced3ad33fd89cc475058a48"
- [*] MD5: "90e441e430c784a46042cb8c28381e74"
- [*] SHA1: "216e0b067ddfc972e123f8fcf8b68131fd78e7c9"
- [*] SHA512: "25715201381a050f1aa20cfb3888dfc94248ecc8a5102eaec066b9bd4cfbc3493ba7c2e2fc9f3806f784a2d3c09ad4508c6ab1600c9f3e1bf3b2c992b4ffc03f"
- [*] CRC32: "F9DD4BBD"
- [*] SSDEEP: "98304:fF7UNnfsY111sidcvSLhLDWRGiGONeChvh78//17r:0fsY1ruoW4UA//17r"
- [*] Process Execution: [
- "Exes_f9dd4bbd.exe"
- ]
- [*] Signatures Detected: [
- {
- "Description": "Creates RWX memory",
- "Details": []
- },
- {
- "Description": "Reads data out of its own binary image",
- "Details": [
- {
- "self_read": "process: Exes_f9dd4bbd.exe, pid: 612, offset: 0x0002c000, length: 0x000001ef"
- },
- {
- "self_read": "process: Exes_f9dd4bbd.exe, pid: 612, offset: 0x0002c216, length: 0x000000af"
- },
- {
- "self_read": "process: Exes_f9dd4bbd.exe, pid: 612, offset: 0x0002c31c, length: 0x00000365"
- },
- {
- "self_read": "process: Exes_f9dd4bbd.exe, pid: 612, offset: 0x000387fe, length: 0x00000409"
- },
- {
- "self_read": "process: Exes_f9dd4bbd.exe, pid: 612, offset: 0x00038db9, length: 0x00356f60"
- }
- ]
- },
- {
- "Description": "Performs some HTTP requests",
- "Details": [
- {
- "url": "http://xss777.free.fr/inv_dom/inv_dom_suppr.php?sn_c=-1044007345"
- },
- {
- "url": "http://xss777.free.fr/inv_dom/inv_dom_log.php?sn_c=-1044007345&Session=user&Action=SUPPR"
- }
- ]
- },
- {
- "Description": "File has been identified by 36 Antiviruses on VirusTotal as malicious",
- "Details": [
- {
- "MicroWorld-eScan": "Trojan.Generic.1566286"
- },
- {
- "CMC": "Trojan-Downloader.Win32.Agent!O"
- },
- {
- "McAfee": "Artemis!90E441E430C7"
- },
- {
- "Cylance": "Unsafe"
- },
- {
- "BitDefender": "Trojan.Generic.1566286"
- },
- {
- "K7GW": "Riskware ( 0040eff71 )"
- },
- {
- "K7AntiVirus": "Riskware ( 0040eff71 )"
- },
- {
- "NANO-Antivirus": "Trojan.Win32.Agent.cvtmgu"
- },
- {
- "F-Prot": "W32/DldrX.CSNE"
- },
- {
- "Paloalto": "generic.ml"
- },
- {
- "GData": "Trojan.Generic.1566286"
- },
- {
- "Alibaba": "Trojan:Application/Generic.a45b7fa1"
- },
- {
- "AegisLab": "Trojan.Win32.Agent.a!c"
- },
- {
- "Avast": "FileRepMetagen [Malware]"
- },
- {
- "Comodo": "Malware@#18hpag33g5kqa"
- },
- {
- "F-Secure": "Trojan.TR/Dldr.Agent.bijt"
- },
- {
- "DrWeb": "Trojan.DownLoad1.10204"
- },
- {
- "Qihoo-360": "Win32/Trojan.Downloader.545"
- },
- {
- "McAfee-GW-Edition": "Artemis!Trojan"
- },
- {
- "Emsisoft": "Trojan.Generic.1566286 (B)"
- },
- {
- "Cyren": "W32/Downloader.SXPC-0365"
- },
- {
- "Webroot": "W32.Malware.Gen"
- },
- {
- "Avira": "TR/Dldr.Agent.bijt"
- },
- {
- "Microsoft": "Trojan:Win32/Vigorf.A"
- },
- {
- "Arcabit": "Trojan.Generic.D17E64E"
- },
- {
- "VBA32": "TrojanDownloader.Agent"
- },
- {
- "ALYac": "Trojan.Generic.1566286"
- },
- {
- "MAX": "malware (ai score=99)"
- },
- {
- "Ad-Aware": "Trojan.Generic.1566286"
- },
- {
- "Yandex": "Trojan.DL.Troxen!fIUPQXZLRR4"
- },
- {
- "eGambit": "Generic.Downloader"
- },
- {
- "Fortinet": "W32/Agent.BIJT!tr.dldr"
- },
- {
- "AVG": "FileRepMetagen [Malware]"
- },
- {
- "Cybereason": "malicious.430c78"
- },
- {
- "Panda": "Generic Malware"
- },
- {
- "MaxSecure": "Trojan.Malware.11581628.susgen"
- }
- ]
- }
- ]
- [*] Started Service: []
- [*] Created Services: []
- [*] Mutexes: [
- "WD_EXTERN_DBG_EXES_F9DD4BBD_Mutex"
- ]
- [*] Modified Files: [
- "C:\\Users\\user\\AppData\\Local\\Temp\\WD120VM.DLL",
- "C:\\Users\\user\\AppData\\Local\\Temp\\WD120COM.DLL",
- "C:\\Users\\user\\AppData\\Local\\Temp\\WD120STD.DLL",
- "C:\\Users\\user\\AppData\\Local\\Temp\\WD120CPL.DLL",
- "C:\\Users\\user\\AppData\\Local\\Temp\\WD120IMG.DLL",
- "C:\\Users\\user\\AppData\\Local\\Temp\\WD120IMG2.DLL",
- "C:\\Users\\user\\AppData\\Local\\Temp\\WD120TEST.DLL"
- ]
- [*] Deleted Files: [
- "C:\\Windows\\spoolsv.exe"
- ]
- [*] Modified Registry Keys: []
- [*] Deleted Registry Keys: []
- [*] DNS Communications: [
- {
- "type": "A",
- "request": "xss777.free.fr",
- "answers": [
- {
- "data": "perso136-g5.free.fr",
- "type": "CNAME"
- },
- {
- "data": "212.27.63.136",
- "type": "A"
- }
- ]
- }
- ]
- [*] Domains: [
- {
- "ip": "212.27.63.136",
- "domain": "xss777.free.fr"
- }
- ]
- [*] Network Communication - ICMP: []
- [*] Network Communication - HTTP: [
- {
- "count": 1,
- "body": "",
- "uri": "http://xss777.free.fr/inv_dom/inv_dom_suppr.php?sn_c=-1044007345",
- "user-agent": "PC SOFT Framework",
- "method": "GET",
- "host": "xss777.free.fr",
- "version": "1.1",
- "path": "/inv_dom/inv_dom_suppr.php?sn_c=-1044007345",
- "data": "GET /inv_dom/inv_dom_suppr.php?sn_c=-1044007345 HTTP/1.1\r\nUser-Agent: PC SOFT Framework\r\nHost: xss777.free.fr\r\nAccept: */*\r\nConnection: close\r\n\r\n\r\n",
- "port": 80
- },
- {
- "count": 1,
- "body": "",
- "uri": "http://xss777.free.fr/inv_dom/inv_dom_log.php?sn_c=-1044007345&Session=user&Action=SUPPR",
- "user-agent": "1.00Ab",
- "method": "GET",
- "host": "xss777.free.fr",
- "version": "1.1",
- "path": "/inv_dom/inv_dom_log.php?sn_c=-1044007345&Session=user&Action=SUPPR",
- "data": "GET /inv_dom/inv_dom_log.php?sn_c=-1044007345&Session=user&Action=SUPPR HTTP/1.1\r\nUser-Agent: 1.00Ab\r\nHost: xss777.free.fr\r\nAccept: */*\r\nConnection: close\r\n\r\n\r\n",
- "port": 80
- }
- ]
- [*] Network Communication - SMTP: []
- [*] Network Communication - Hosts: []
- [*] Network Communication - IRC: []
- [*] Static Analysis: {
- "pe": {
- "peid_signatures": null,
- "imports": [
- {
- "imports": [
- {
- "name": "_controlfp",
- "address": "0x411168"
- },
- {
- "name": "_except_handler3",
- "address": "0x41116c"
- },
- {
- "name": "__set_app_type",
- "address": "0x411170"
- },
- {
- "name": "__p__fmode",
- "address": "0x411174"
- },
- {
- "name": "__p__commode",
- "address": "0x411178"
- },
- {
- "name": "_adjust_fdiv",
- "address": "0x41117c"
- },
- {
- "name": "__setusermatherr",
- "address": "0x411180"
- },
- {
- "name": "_initterm",
- "address": "0x411184"
- },
- {
- "name": "__getmainargs",
- "address": "0x411188"
- },
- {
- "name": "_acmdln",
- "address": "0x41118c"
- },
- {
- "name": "exit",
- "address": "0x411190"
- },
- {
- "name": "_XcptFilter",
- "address": "0x411194"
- },
- {
- "name": "_exit",
- "address": "0x411198"
- },
- {
- "name": "??1type_info@@UAE@XZ",
- "address": "0x41119c"
- },
- {
- "name": "_onexit",
- "address": "0x4111a0"
- },
- {
- "name": "__dllonexit",
- "address": "0x4111a4"
- },
- {
- "name": "isdigit",
- "address": "0x4111a8"
- },
- {
- "name": "vsprintf",
- "address": "0x4111ac"
- },
- {
- "name": "_mbclen",
- "address": "0x4111b0"
- },
- {
- "name": "_mbsinc",
- "address": "0x4111b4"
- },
- {
- "name": "_ismbcspace",
- "address": "0x4111b8"
- },
- {
- "name": "atoi",
- "address": "0x4111bc"
- },
- {
- "name": "realloc",
- "address": "0x4111c0"
- },
- {
- "name": "_mbctoupper",
- "address": "0x4111c4"
- },
- {
- "name": "_mbspbrk",
- "address": "0x4111c8"
- },
- {
- "name": "_mbsrchr",
- "address": "0x4111cc"
- },
- {
- "name": "_makepath",
- "address": "0x4111d0"
- },
- {
- "name": "_stati64",
- "address": "0x4111d4"
- },
- {
- "name": "memmove",
- "address": "0x4111d8"
- },
- {
- "name": "_mbsstr",
- "address": "0x4111dc"
- },
- {
- "name": "wcscat",
- "address": "0x4111e0"
- },
- {
- "name": "wcschr",
- "address": "0x4111e4"
- },
- {
- "name": "_mbschr",
- "address": "0x4111e8"
- },
- {
- "name": "memchr",
- "address": "0x4111ec"
- },
- {
- "name": "_vsnprintf",
- "address": "0x4111f0"
- },
- {
- "name": "wcslen",
- "address": "0x4111f4"
- },
- {
- "name": "_stricmp",
- "address": "0x4111f8"
- },
- {
- "name": "_mbscmp",
- "address": "0x4111fc"
- },
- {
- "name": "gmtime",
- "address": "0x411200"
- },
- {
- "name": "time",
- "address": "0x411204"
- },
- {
- "name": "free",
- "address": "0x411208"
- },
- {
- "name": "malloc",
- "address": "0x41120c"
- },
- {
- "name": "_mbsnbicmp",
- "address": "0x411210"
- },
- {
- "name": "_mbsnbcpy",
- "address": "0x411214"
- },
- {
- "name": "sprintf",
- "address": "0x411218"
- },
- {
- "name": "memset",
- "address": "0x41121c"
- },
- {
- "name": "strlen",
- "address": "0x411220"
- },
- {
- "name": "strncmp",
- "address": "0x411224"
- },
- {
- "name": "memcpy",
- "address": "0x411228"
- },
- {
- "name": "_mbsicmp",
- "address": "0x41122c"
- },
- {
- "name": "strcat",
- "address": "0x411230"
- },
- {
- "name": "strcpy",
- "address": "0x411234"
- },
- {
- "name": "??3@YAXPAX@Z",
- "address": "0x411238"
- },
- {
- "name": "??2@YAPAXI@Z",
- "address": "0x41123c"
- },
- {
- "name": "__CxxFrameHandler",
- "address": "0x411240"
- },
- {
- "name": "_CxxThrowException",
- "address": "0x411244"
- }
- ],
- "dll": "MSVCRT.dll"
- },
- {
- "imports": [
- {
- "name": "UnmapViewOfFile",
- "address": "0x411000"
- },
- {
- "name": "RaiseException",
- "address": "0x411004"
- },
- {
- "name": "CreateThread",
- "address": "0x411008"
- },
- {
- "name": "TerminateThread",
- "address": "0x41100c"
- },
- {
- "name": "ResumeThread",
- "address": "0x411010"
- },
- {
- "name": "CreateProcessA",
- "address": "0x411014"
- },
- {
- "name": "InterlockedExchange",
- "address": "0x411018"
- },
- {
- "name": "MultiByteToWideChar",
- "address": "0x41101c"
- },
- {
- "name": "CompareStringA",
- "address": "0x411020"
- },
- {
- "name": "GetCurrentThreadId",
- "address": "0x411024"
- },
- {
- "name": "TlsFree",
- "address": "0x411028"
- },
- {
- "name": "TlsAlloc",
- "address": "0x41102c"
- },
- {
- "name": "VirtualProtect",
- "address": "0x411030"
- },
- {
- "name": "VirtualQuery",
- "address": "0x411034"
- },
- {
- "name": "TlsGetValue",
- "address": "0x411038"
- },
- {
- "name": "TlsSetValue",
- "address": "0x41103c"
- },
- {
- "name": "GetFullPathNameA",
- "address": "0x411040"
- },
- {
- "name": "FileTimeToSystemTime",
- "address": "0x411044"
- },
- {
- "name": "FileTimeToLocalFileTime",
- "address": "0x411048"
- },
- {
- "name": "FindNextFileA",
- "address": "0x41104c"
- },
- {
- "name": "SetFileAttributesA",
- "address": "0x411050"
- },
- {
- "name": "GetFileAttributesA",
- "address": "0x411054"
- },
- {
- "name": "FindClose",
- "address": "0x411058"
- },
- {
- "name": "FindFirstFileA",
- "address": "0x41105c"
- },
- {
- "name": "CreateDirectoryA",
- "address": "0x411060"
- },
- {
- "name": "CopyFileA",
- "address": "0x411064"
- },
- {
- "name": "MoveFileA",
- "address": "0x411068"
- },
- {
- "name": "DeleteFileA",
- "address": "0x41106c"
- },
- {
- "name": "GetVersion",
- "address": "0x411070"
- },
- {
- "name": "SetEndOfFile",
- "address": "0x411074"
- },
- {
- "name": "FlushFileBuffers",
- "address": "0x411078"
- },
- {
- "name": "UnlockFile",
- "address": "0x41107c"
- },
- {
- "name": "LockFile",
- "address": "0x411080"
- },
- {
- "name": "SetFilePointer",
- "address": "0x411084"
- },
- {
- "name": "WriteFile",
- "address": "0x411088"
- },
- {
- "name": "SetLastError",
- "address": "0x41108c"
- },
- {
- "name": "CreateFileA",
- "address": "0x411090"
- },
- {
- "name": "SetErrorMode",
- "address": "0x411094"
- },
- {
- "name": "WideCharToMultiByte",
- "address": "0x411098"
- },
- {
- "name": "GetDriveTypeA",
- "address": "0x41109c"
- },
- {
- "name": "GetVolumeInformationA",
- "address": "0x4110a0"
- },
- {
- "name": "GetLogicalDriveStringsA",
- "address": "0x4110a4"
- },
- {
- "name": "GetFileInformationByHandle",
- "address": "0x4110a8"
- },
- {
- "name": "lstrlenA",
- "address": "0x4110ac"
- },
- {
- "name": "LocalAlloc",
- "address": "0x4110b0"
- },
- {
- "name": "LeaveCriticalSection",
- "address": "0x4110b4"
- },
- {
- "name": "EnterCriticalSection",
- "address": "0x4110b8"
- },
- {
- "name": "DeleteCriticalSection",
- "address": "0x4110bc"
- },
- {
- "name": "InitializeCriticalSection",
- "address": "0x4110c0"
- },
- {
- "name": "CreateMailslotA",
- "address": "0x4110c4"
- },
- {
- "name": "ExpandEnvironmentStringsA",
- "address": "0x4110c8"
- },
- {
- "name": "GetLocalTime",
- "address": "0x4110cc"
- },
- {
- "name": "GetComputerNameA",
- "address": "0x4110d0"
- },
- {
- "name": "ReadFile",
- "address": "0x4110d4"
- },
- {
- "name": "GetMailslotInfo",
- "address": "0x4110d8"
- },
- {
- "name": "GetCommandLineA",
- "address": "0x4110dc"
- },
- {
- "name": "GetPrivateProfileStringA",
- "address": "0x4110e0"
- },
- {
- "name": "GetPrivateProfileIntA",
- "address": "0x4110e4"
- },
- {
- "name": "LocalFree",
- "address": "0x4110e8"
- },
- {
- "name": "FormatMessageA",
- "address": "0x4110ec"
- },
- {
- "name": "LoadLibraryA",
- "address": "0x4110f0"
- },
- {
- "name": "GetModuleFileNameA",
- "address": "0x4110f4"
- },
- {
- "name": "GetProcAddress",
- "address": "0x4110f8"
- },
- {
- "name": "FreeLibrary",
- "address": "0x4110fc"
- },
- {
- "name": "GetSystemDefaultLangID",
- "address": "0x411100"
- },
- {
- "name": "FindResourceA",
- "address": "0x411104"
- },
- {
- "name": "LoadResource",
- "address": "0x411108"
- },
- {
- "name": "LockResource",
- "address": "0x41110c"
- },
- {
- "name": "FreeResource",
- "address": "0x411110"
- },
- {
- "name": "GetProfileStringA",
- "address": "0x411114"
- },
- {
- "name": "Sleep",
- "address": "0x411118"
- },
- {
- "name": "GetExitCodeProcess",
- "address": "0x41111c"
- },
- {
- "name": "CloseHandle",
- "address": "0x411120"
- },
- {
- "name": "CreateFileMappingA",
- "address": "0x411124"
- },
- {
- "name": "GetLastError",
- "address": "0x411128"
- },
- {
- "name": "MapViewOfFile",
- "address": "0x41112c"
- },
- {
- "name": "OpenFileMappingA",
- "address": "0x411130"
- },
- {
- "name": "GetVersionExA",
- "address": "0x411134"
- },
- {
- "name": "GetModuleHandleA",
- "address": "0x411138"
- },
- {
- "name": "CreateEventA",
- "address": "0x41113c"
- },
- {
- "name": "GetStartupInfoA",
- "address": "0x411140"
- },
- {
- "name": "MulDiv",
- "address": "0x411144"
- },
- {
- "name": "SetEvent",
- "address": "0x411148"
- },
- {
- "name": "CreateMutexA",
- "address": "0x41114c"
- },
- {
- "name": "WaitForSingleObject",
- "address": "0x411150"
- },
- {
- "name": "ReleaseMutex",
- "address": "0x411154"
- },
- {
- "name": "GetCurrentProcessId",
- "address": "0x411158"
- },
- {
- "name": "GetTempPathA",
- "address": "0x41115c"
- },
- {
- "name": "GetTempFileNameA",
- "address": "0x411160"
- }
- ],
- "dll": "KERNEL32.dll"
- }
- ],
- "digital_signers": null,
- "exported_dll_name": "WDExe.exe",
- "actual_checksum": "0x00391286",
- "overlay": {
- "size": "0x00363d19",
- "offset": "0x0002c000"
- },
- "imagebase": "0x00400000",
- "reported_checksum": "0x00000000",
- "icon_hash": null,
- "entrypoint": "0x0040f626",
- "timestamp": "2008-05-15 13:50:19",
- "osversion": "4.0",
- "sections": [
- {
- "name": ".text",
- "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00001000",
- "size_of_data": "0x00010000",
- "entropy": "6.25",
- "raw_address": "0x00001000",
- "virtual_size": "0x0000f47a",
- "characteristics_raw": "0x60000020"
- },
- {
- "name": ".rdata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00011000",
- "size_of_data": "0x00006000",
- "entropy": "5.28",
- "raw_address": "0x00011000",
- "virtual_size": "0x0000568c",
- "characteristics_raw": "0x40000040"
- },
- {
- "name": ".data",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00017000",
- "size_of_data": "0x00001000",
- "entropy": "4.73",
- "raw_address": "0x00017000",
- "virtual_size": "0x00001278",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".rsrc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00019000",
- "size_of_data": "0x00014000",
- "entropy": "4.66",
- "raw_address": "0x00018000",
- "virtual_size": "0x000137d0",
- "characteristics_raw": "0x40000040"
- }
- ],
- "resources": [],
- "dirents": [
- {
- "virtual_address": "0x00016610",
- "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
- "size": "0x0000007c"
- },
- {
- "virtual_address": "0x00015a74",
- "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
- "size": "0x0000003c"
- },
- {
- "virtual_address": "0x00019000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
- "size": "0x000137d0"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00011250",
- "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
- "size": "0x0000001c"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_TLS",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00011000",
- "name": "IMAGE_DIRECTORY_ENTRY_IAT",
- "size": "0x0000024c"
- },
- {
- "virtual_address": "0x00015074",
- "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
- "size": "0x000000e0"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
- "size": "0x00000000"
- }
- ],
- "exports": [
- {
- "ordinal": 1,
- "name": "CommandeComposante",
- "address": "0x4050c2"
- },
- {
- "ordinal": 2,
- "name": "DeclareProxy",
- "address": "0x40949b"
- },
- {
- "ordinal": 3,
- "name": "LibereMutex",
- "address": "0x401085"
- }
- ],
- "guest_signers": {},
- "imphash": "59c7376aa79c0751a723274e8861dd12",
- "icon_fuzzy": null,
- "icon": null,
- "pdbpath": "b:\\source\\source.IC\\11758\\Release_WDExe_74\\Release\\WDExe.pdb",
- "imported_dll_count": 2,
- "versioninfo": []
- }
- }
- [*] Resolved APIs: [
- "user32.dll.CharUpperA",
- "user32.dll.PeekMessageA",
- "version.dll.GetFileVersionInfoSizeA",
- "version.dll.GetFileVersionInfoA",
- "version.dll.VerQueryValueA",
- "kernel32.dll.SortGetHandle",
- "kernel32.dll.SortCloseHandle",
- "wd120vm.dll.WL_Run_Res",
- "wd120vm.dll.WL_Run_Service",
- "wd120vm.dll.WL_Term_Service",
- "wd120vm.dll.WL_TestEx",
- "wd120vm.dll.WL_ListeDLL",
- "wd120vm.dll.WL_DonneWDL",
- "wd120vm.dll.WL_DonneREP",
- "wd120vm.dll.WL_DonneGPU",
- "wd120vm.dll.WL_DonneFinInit",
- "wd120vm.dll.WL_InitGoRequete",
- "wd120vm.dll.WL_ListeWDL",
- "wd120vm.dll.WL_SetParam",
- "wd120vm.dll.CommandeComposante",
- "user32.dll.SetWindowsHookExA",
- "wd120std.dll.pQueryProxy",
- "wd120std.dll.DeclareProxy",
- "wd120std.dll.CommandeComposante",
- "wd120std.dll.Execution",
- "wd120vm.dll.Execution",
- "wd120std.dll.bInitWLConvFromVM",
- "wd120vm.dll.nConversionDepassement",
- "wd120vm.dll.nConversionDepassementEx",
- "wd120vm.dll.FinConversion",
- "wd120vm.dll.pQueryProxy",
- "wd120std.dll.GeneralParam",
- "wd120std.dll.InfoComposante",
- "advapi32.dll.RegOpenKeyExA",
- "advapi32.dll.RegQueryValueExA",
- "advapi32.dll.RegCloseKey",
- "bthprops.cpl.BluetoothFindFirstRadio",
- "bthprops.cpl.BluetoothFindNextRadio",
- "bthprops.cpl.BluetoothFindRadioClose",
- "bthprops.cpl.BluetoothIsDiscoverable",
- "bthprops.cpl.BluetoothEnableDiscovery",
- "bthprops.cpl.BluetoothEnableIncomingConnections",
- "bthprops.cpl.BluetoothIsConnectable",
- "bthprops.cpl.BluetoothFindFirstDevice",
- "bthprops.cpl.BluetoothFindNextDevice",
- "bthprops.cpl.BluetoothFindDeviceClose",
- "bthprops.cpl.BluetoothUpdateDeviceRecord",
- "bthprops.cpl.BluetoothGetDeviceInfo",
- "bthprops.cpl.BluetoothRegisterForAuthentication",
- "bthprops.cpl.BluetoothUnregisterAuthentication",
- "bthprops.cpl.BluetoothSendAuthenticationResponse",
- "bthprops.cpl.BluetoothAuthenticateDevice",
- "bthprops.cpl.BluetoothRemoveDevice",
- "bthprops.cpl.BluetoothSelectDevices",
- "bthprops.cpl.BluetoothSelectDevicesFree",
- "bthprops.cpl.BluetoothSetServiceState",
- "bthprops.cpl.BluetoothEnumerateInstalledServices",
- "bthprops.cpl.BluetoothGetRadioInfo",
- "wd120com.dll.pQueryProxy",
- "wd120com.dll.CommandeComposante",
- "wd120com.dll.Execution",
- "wd120com.dll.bInitWLConvFromVM",
- "wd120com.dll.GeneralParam",
- "wd120com.dll.InfoComposante",
- "rasapi32.dll.RasDialA",
- "rasapi32.dll.RasHangUpA",
- "rasapi32.dll.RasGetEntryDialParamsA",
- "rasapi32.dll.RasGetLinkStatistics",
- "rasapi32.dll.RasGetConnectionStatistics",
- "rasapi32.dll.RasEnumEntriesA",
- "rasapi32.dll.RasEnumConnectionsA",
- "rasapi32.dll.RasGetErrorStringA",
- "ws2_32.dll.accept",
- "ws2_32.dll.bind",
- "ws2_32.dll.closesocket",
- "ws2_32.dll.connect",
- "ws2_32.dll.ioctlsocket",
- "ws2_32.dll.getpeername",
- "ws2_32.dll.getsockname",
- "ws2_32.dll.getsockopt",
- "ws2_32.dll.htonl",
- "ws2_32.dll.htons",
- "ws2_32.dll.inet_addr",
- "ws2_32.dll.inet_ntoa",
- "ws2_32.dll.listen",
- "ws2_32.dll.ntohl",
- "ws2_32.dll.ntohs",
- "ws2_32.dll.recv",
- "ws2_32.dll.recvfrom",
- "ws2_32.dll.select",
- "ws2_32.dll.send",
- "ws2_32.dll.sendto",
- "ws2_32.dll.setsockopt",
- "ws2_32.dll.shutdown",
- "ws2_32.dll.socket",
- "ws2_32.dll.gethostbyaddr",
- "ws2_32.dll.gethostbyname",
- "ws2_32.dll.gethostname",
- "ws2_32.dll.getservbyport",
- "ws2_32.dll.getservbyname",
- "ws2_32.dll.getprotobynumber",
- "ws2_32.dll.getprotobyname",
- "ws2_32.dll.WSAStartup",
- "ws2_32.dll.WSACleanup",
- "ws2_32.dll.WSASetLastError",
- "ws2_32.dll.WSAGetLastError",
- "ws2_32.dll.WSAIsBlocking",
- "ws2_32.dll.WSAUnhookBlockingHook",
- "ws2_32.dll.WSASetBlockingHook",
- "ws2_32.dll.WSACancelBlockingCall",
- "ws2_32.dll.WSAAsyncGetServByName",
- "ws2_32.dll.WSAAsyncGetServByPort",
- "ws2_32.dll.WSAAsyncGetProtoByName",
- "ws2_32.dll.WSAAsyncGetProtoByNumber",
- "ws2_32.dll.WSAAsyncGetHostByName",
- "ws2_32.dll.WSAAsyncGetHostByAddr",
- "ws2_32.dll.WSACancelAsyncRequest",
- "ws2_32.dll.WSAAsyncSelect",
- "ws2_32.dll.WSAAccept",
- "ws2_32.dll.WSACloseEvent",
- "ws2_32.dll.WSAConnect",
- "ws2_32.dll.WSACreateEvent",
- "ws2_32.dll.WSAEnumNetworkEvents",
- "ws2_32.dll.WSAEnumProtocolsW",
- "ws2_32.dll.WSAEventSelect",
- "ws2_32.dll.WSAGetOverlappedResult",
- "ws2_32.dll.WSAHtonl",
- "ws2_32.dll.WSAHtons",
- "ws2_32.dll.WSAIoctl",
- "ws2_32.dll.WSAJoinLeaf",
- "ws2_32.dll.WSANtohl",
- "ws2_32.dll.WSANtohs",
- "ws2_32.dll.WSARecv",
- "ws2_32.dll.WSARecvFrom",
- "ws2_32.dll.WSAResetEvent",
- "ws2_32.dll.WSASend",
- "ws2_32.dll.WSASendTo",
- "ws2_32.dll.WSASetEvent",
- "ws2_32.dll.WSASocketW",
- "ws2_32.dll.WSAAddressToStringW",
- "ws2_32.dll.WSAStringToAddressW",
- "ws2_32.dll.WSALookupServiceBeginW",
- "ws2_32.dll.WSALookupServiceNextW",
- "ws2_32.dll.WSALookupServiceEnd",
- "ws2_32.dll.WSASetServiceW",
- "ws2_32.dll.WSAEnumNameSpaceProvidersW",
- "ws2_32.dll.WSADuplicateSocketA",
- "ws2_32.dll.WSADuplicateSocketW",
- "ws2_32.dll.WSAGetQOSByName",
- "ws2_32.dll.WSASendDisconnect",
- "ws2_32.dll.WSARecvDisconnect",
- "ws2_32.dll.WSAWaitForMultipleEvents",
- "ws2_32.dll.WSAEnumProtocolsA",
- "ws2_32.dll.WSASetServiceA",
- "ws2_32.dll.WSAAddressToStringA",
- "ws2_32.dll.WSAStringToAddressA",
- "ws2_32.dll.WSALookupServiceBeginA",
- "ws2_32.dll.WSALookupServiceNextA",
- "ws2_32.dll.WSAEnumNameSpaceProvidersA",
- "ws2_32.dll.WSAInstallServiceClassA",
- "ws2_32.dll.WSAInstallServiceClassW",
- "ws2_32.dll.WSARemoveServiceClass",
- "ws2_32.dll.WSAGetServiceClassInfoA",
- "ws2_32.dll.WSAGetServiceClassInfoW",
- "ws2_32.dll.WSAGetServiceClassNameByClassIdA",
- "ws2_32.dll.WSAGetServiceClassNameByClassIdW",
- "ws2_32.dll.WSAProviderConfigChange",
- "ws2_32.dll.WSASocketA",
- "ws2_32.dll.__WSAFDIsSet",
- "ws2_32.dll.#3",
- "user32.dll.UnhookWindowsHookEx",
- "user32.dll.IsWindow",
- "user32.dll.CreateWindowExA",
- "uxtheme.dll.ThemeInitApiHook",
- "user32.dll.IsProcessDPIAware"
- ]
- [*] Static Analysis: {
- "pe": {
- "peid_signatures": null,
- "imports": [
- {
- "imports": [
- {
- "name": "_controlfp",
- "address": "0x411168"
- },
- {
- "name": "_except_handler3",
- "address": "0x41116c"
- },
- {
- "name": "__set_app_type",
- "address": "0x411170"
- },
- {
- "name": "__p__fmode",
- "address": "0x411174"
- },
- {
- "name": "__p__commode",
- "address": "0x411178"
- },
- {
- "name": "_adjust_fdiv",
- "address": "0x41117c"
- },
- {
- "name": "__setusermatherr",
- "address": "0x411180"
- },
- {
- "name": "_initterm",
- "address": "0x411184"
- },
- {
- "name": "__getmainargs",
- "address": "0x411188"
- },
- {
- "name": "_acmdln",
- "address": "0x41118c"
- },
- {
- "name": "exit",
- "address": "0x411190"
- },
- {
- "name": "_XcptFilter",
- "address": "0x411194"
- },
- {
- "name": "_exit",
- "address": "0x411198"
- },
- {
- "name": "??1type_info@@UAE@XZ",
- "address": "0x41119c"
- },
- {
- "name": "_onexit",
- "address": "0x4111a0"
- },
- {
- "name": "__dllonexit",
- "address": "0x4111a4"
- },
- {
- "name": "isdigit",
- "address": "0x4111a8"
- },
- {
- "name": "vsprintf",
- "address": "0x4111ac"
- },
- {
- "name": "_mbclen",
- "address": "0x4111b0"
- },
- {
- "name": "_mbsinc",
- "address": "0x4111b4"
- },
- {
- "name": "_ismbcspace",
- "address": "0x4111b8"
- },
- {
- "name": "atoi",
- "address": "0x4111bc"
- },
- {
- "name": "realloc",
- "address": "0x4111c0"
- },
- {
- "name": "_mbctoupper",
- "address": "0x4111c4"
- },
- {
- "name": "_mbspbrk",
- "address": "0x4111c8"
- },
- {
- "name": "_mbsrchr",
- "address": "0x4111cc"
- },
- {
- "name": "_makepath",
- "address": "0x4111d0"
- },
- {
- "name": "_stati64",
- "address": "0x4111d4"
- },
- {
- "name": "memmove",
- "address": "0x4111d8"
- },
- {
- "name": "_mbsstr",
- "address": "0x4111dc"
- },
- {
- "name": "wcscat",
- "address": "0x4111e0"
- },
- {
- "name": "wcschr",
- "address": "0x4111e4"
- },
- {
- "name": "_mbschr",
- "address": "0x4111e8"
- },
- {
- "name": "memchr",
- "address": "0x4111ec"
- },
- {
- "name": "_vsnprintf",
- "address": "0x4111f0"
- },
- {
- "name": "wcslen",
- "address": "0x4111f4"
- },
- {
- "name": "_stricmp",
- "address": "0x4111f8"
- },
- {
- "name": "_mbscmp",
- "address": "0x4111fc"
- },
- {
- "name": "gmtime",
- "address": "0x411200"
- },
- {
- "name": "time",
- "address": "0x411204"
- },
- {
- "name": "free",
- "address": "0x411208"
- },
- {
- "name": "malloc",
- "address": "0x41120c"
- },
- {
- "name": "_mbsnbicmp",
- "address": "0x411210"
- },
- {
- "name": "_mbsnbcpy",
- "address": "0x411214"
- },
- {
- "name": "sprintf",
- "address": "0x411218"
- },
- {
- "name": "memset",
- "address": "0x41121c"
- },
- {
- "name": "strlen",
- "address": "0x411220"
- },
- {
- "name": "strncmp",
- "address": "0x411224"
- },
- {
- "name": "memcpy",
- "address": "0x411228"
- },
- {
- "name": "_mbsicmp",
- "address": "0x41122c"
- },
- {
- "name": "strcat",
- "address": "0x411230"
- },
- {
- "name": "strcpy",
- "address": "0x411234"
- },
- {
- "name": "??3@YAXPAX@Z",
- "address": "0x411238"
- },
- {
- "name": "??2@YAPAXI@Z",
- "address": "0x41123c"
- },
- {
- "name": "__CxxFrameHandler",
- "address": "0x411240"
- },
- {
- "name": "_CxxThrowException",
- "address": "0x411244"
- }
- ],
- "dll": "MSVCRT.dll"
- },
- {
- "imports": [
- {
- "name": "UnmapViewOfFile",
- "address": "0x411000"
- },
- {
- "name": "RaiseException",
- "address": "0x411004"
- },
- {
- "name": "CreateThread",
- "address": "0x411008"
- },
- {
- "name": "TerminateThread",
- "address": "0x41100c"
- },
- {
- "name": "ResumeThread",
- "address": "0x411010"
- },
- {
- "name": "CreateProcessA",
- "address": "0x411014"
- },
- {
- "name": "InterlockedExchange",
- "address": "0x411018"
- },
- {
- "name": "MultiByteToWideChar",
- "address": "0x41101c"
- },
- {
- "name": "CompareStringA",
- "address": "0x411020"
- },
- {
- "name": "GetCurrentThreadId",
- "address": "0x411024"
- },
- {
- "name": "TlsFree",
- "address": "0x411028"
- },
- {
- "name": "TlsAlloc",
- "address": "0x41102c"
- },
- {
- "name": "VirtualProtect",
- "address": "0x411030"
- },
- {
- "name": "VirtualQuery",
- "address": "0x411034"
- },
- {
- "name": "TlsGetValue",
- "address": "0x411038"
- },
- {
- "name": "TlsSetValue",
- "address": "0x41103c"
- },
- {
- "name": "GetFullPathNameA",
- "address": "0x411040"
- },
- {
- "name": "FileTimeToSystemTime",
- "address": "0x411044"
- },
- {
- "name": "FileTimeToLocalFileTime",
- "address": "0x411048"
- },
- {
- "name": "FindNextFileA",
- "address": "0x41104c"
- },
- {
- "name": "SetFileAttributesA",
- "address": "0x411050"
- },
- {
- "name": "GetFileAttributesA",
- "address": "0x411054"
- },
- {
- "name": "FindClose",
- "address": "0x411058"
- },
- {
- "name": "FindFirstFileA",
- "address": "0x41105c"
- },
- {
- "name": "CreateDirectoryA",
- "address": "0x411060"
- },
- {
- "name": "CopyFileA",
- "address": "0x411064"
- },
- {
- "name": "MoveFileA",
- "address": "0x411068"
- },
- {
- "name": "DeleteFileA",
- "address": "0x41106c"
- },
- {
- "name": "GetVersion",
- "address": "0x411070"
- },
- {
- "name": "SetEndOfFile",
- "address": "0x411074"
- },
- {
- "name": "FlushFileBuffers",
- "address": "0x411078"
- },
- {
- "name": "UnlockFile",
- "address": "0x41107c"
- },
- {
- "name": "LockFile",
- "address": "0x411080"
- },
- {
- "name": "SetFilePointer",
- "address": "0x411084"
- },
- {
- "name": "WriteFile",
- "address": "0x411088"
- },
- {
- "name": "SetLastError",
- "address": "0x41108c"
- },
- {
- "name": "CreateFileA",
- "address": "0x411090"
- },
- {
- "name": "SetErrorMode",
- "address": "0x411094"
- },
- {
- "name": "WideCharToMultiByte",
- "address": "0x411098"
- },
- {
- "name": "GetDriveTypeA",
- "address": "0x41109c"
- },
- {
- "name": "GetVolumeInformationA",
- "address": "0x4110a0"
- },
- {
- "name": "GetLogicalDriveStringsA",
- "address": "0x4110a4"
- },
- {
- "name": "GetFileInformationByHandle",
- "address": "0x4110a8"
- },
- {
- "name": "lstrlenA",
- "address": "0x4110ac"
- },
- {
- "name": "LocalAlloc",
- "address": "0x4110b0"
- },
- {
- "name": "LeaveCriticalSection",
- "address": "0x4110b4"
- },
- {
- "name": "EnterCriticalSection",
- "address": "0x4110b8"
- },
- {
- "name": "DeleteCriticalSection",
- "address": "0x4110bc"
- },
- {
- "name": "InitializeCriticalSection",
- "address": "0x4110c0"
- },
- {
- "name": "CreateMailslotA",
- "address": "0x4110c4"
- },
- {
- "name": "ExpandEnvironmentStringsA",
- "address": "0x4110c8"
- },
- {
- "name": "GetLocalTime",
- "address": "0x4110cc"
- },
- {
- "name": "GetComputerNameA",
- "address": "0x4110d0"
- },
- {
- "name": "ReadFile",
- "address": "0x4110d4"
- },
- {
- "name": "GetMailslotInfo",
- "address": "0x4110d8"
- },
- {
- "name": "GetCommandLineA",
- "address": "0x4110dc"
- },
- {
- "name": "GetPrivateProfileStringA",
- "address": "0x4110e0"
- },
- {
- "name": "GetPrivateProfileIntA",
- "address": "0x4110e4"
- },
- {
- "name": "LocalFree",
- "address": "0x4110e8"
- },
- {
- "name": "FormatMessageA",
- "address": "0x4110ec"
- },
- {
- "name": "LoadLibraryA",
- "address": "0x4110f0"
- },
- {
- "name": "GetModuleFileNameA",
- "address": "0x4110f4"
- },
- {
- "name": "GetProcAddress",
- "address": "0x4110f8"
- },
- {
- "name": "FreeLibrary",
- "address": "0x4110fc"
- },
- {
- "name": "GetSystemDefaultLangID",
- "address": "0x411100"
- },
- {
- "name": "FindResourceA",
- "address": "0x411104"
- },
- {
- "name": "LoadResource",
- "address": "0x411108"
- },
- {
- "name": "LockResource",
- "address": "0x41110c"
- },
- {
- "name": "FreeResource",
- "address": "0x411110"
- },
- {
- "name": "GetProfileStringA",
- "address": "0x411114"
- },
- {
- "name": "Sleep",
- "address": "0x411118"
- },
- {
- "name": "GetExitCodeProcess",
- "address": "0x41111c"
- },
- {
- "name": "CloseHandle",
- "address": "0x411120"
- },
- {
- "name": "CreateFileMappingA",
- "address": "0x411124"
- },
- {
- "name": "GetLastError",
- "address": "0x411128"
- },
- {
- "name": "MapViewOfFile",
- "address": "0x41112c"
- },
- {
- "name": "OpenFileMappingA",
- "address": "0x411130"
- },
- {
- "name": "GetVersionExA",
- "address": "0x411134"
- },
- {
- "name": "GetModuleHandleA",
- "address": "0x411138"
- },
- {
- "name": "CreateEventA",
- "address": "0x41113c"
- },
- {
- "name": "GetStartupInfoA",
- "address": "0x411140"
- },
- {
- "name": "MulDiv",
- "address": "0x411144"
- },
- {
- "name": "SetEvent",
- "address": "0x411148"
- },
- {
- "name": "CreateMutexA",
- "address": "0x41114c"
- },
- {
- "name": "WaitForSingleObject",
- "address": "0x411150"
- },
- {
- "name": "ReleaseMutex",
- "address": "0x411154"
- },
- {
- "name": "GetCurrentProcessId",
- "address": "0x411158"
- },
- {
- "name": "GetTempPathA",
- "address": "0x41115c"
- },
- {
- "name": "GetTempFileNameA",
- "address": "0x411160"
- }
- ],
- "dll": "KERNEL32.dll"
- }
- ],
- "digital_signers": null,
- "exported_dll_name": "WDExe.exe",
- "actual_checksum": "0x00391286",
- "overlay": {
- "size": "0x00363d19",
- "offset": "0x0002c000"
- },
- "imagebase": "0x00400000",
- "reported_checksum": "0x00000000",
- "icon_hash": null,
- "entrypoint": "0x0040f626",
- "timestamp": "2008-05-15 13:50:19",
- "osversion": "4.0",
- "sections": [
- {
- "name": ".text",
- "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00001000",
- "size_of_data": "0x00010000",
- "entropy": "6.25",
- "raw_address": "0x00001000",
- "virtual_size": "0x0000f47a",
- "characteristics_raw": "0x60000020"
- },
- {
- "name": ".rdata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00011000",
- "size_of_data": "0x00006000",
- "entropy": "5.28",
- "raw_address": "0x00011000",
- "virtual_size": "0x0000568c",
- "characteristics_raw": "0x40000040"
- },
- {
- "name": ".data",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00017000",
- "size_of_data": "0x00001000",
- "entropy": "4.73",
- "raw_address": "0x00017000",
- "virtual_size": "0x00001278",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".rsrc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00019000",
- "size_of_data": "0x00014000",
- "entropy": "4.66",
- "raw_address": "0x00018000",
- "virtual_size": "0x000137d0",
- "characteristics_raw": "0x40000040"
- }
- ],
- "resources": [],
- "dirents": [
- {
- "virtual_address": "0x00016610",
- "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
- "size": "0x0000007c"
- },
- {
- "virtual_address": "0x00015a74",
- "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
- "size": "0x0000003c"
- },
- {
- "virtual_address": "0x00019000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
- "size": "0x000137d0"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00011250",
- "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
- "size": "0x0000001c"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_TLS",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00011000",
- "name": "IMAGE_DIRECTORY_ENTRY_IAT",
- "size": "0x0000024c"
- },
- {
- "virtual_address": "0x00015074",
- "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
- "size": "0x000000e0"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
- "size": "0x00000000"
- }
- ],
- "exports": [
- {
- "ordinal": 1,
- "name": "CommandeComposante",
- "address": "0x4050c2"
- },
- {
- "ordinal": 2,
- "name": "DeclareProxy",
- "address": "0x40949b"
- },
- {
- "ordinal": 3,
- "name": "LibereMutex",
- "address": "0x401085"
- }
- ],
- "guest_signers": {},
- "imphash": "59c7376aa79c0751a723274e8861dd12",
- "icon_fuzzy": null,
- "icon": null,
- "pdbpath": "b:\\source\\source.IC\\11758\\Release_WDExe_74\\Release\\WDExe.pdb",
- "imported_dll_count": 2,
- "versioninfo": []
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement