API tools faq
paste
paladin316

AZORult_7545388a6d2d84ce50400a795f4209af_exe_2019-06-25_07_30.json

paladin316
Jun 25th, 2019
2,405
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 45.14 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "AZORult_7545388a6d2d84ce50400a795f4209af.exe"
  7. [*] File Size: 330240
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "4f33d73b6fd8e730538b0838042408c5609ca535b61375fa5b6ee5733c1f6b75"
  10. [*] MD5: "7545388a6d2d84ce50400a795f4209af"
  11. [*] SHA1: "0c8197a5c13774a10372f5b648f413847a140287"
  12. [*] SHA512: "c9e5196c7bbcd7408a72c97d73335c16ffe8c16e264712848972d1ceb390a2a2c224c4b9101b674ebfe8b619bd439150453161a56db948f3d89918f47b6db54b"
  13. [*] CRC32: "75B22E63"
  14. [*] SSDEEP: "6144:GSowv7VaXAZ1Fx5B623Q6ki3tMA8uPZznKjp:jH7ViAbFx6j6dtMA8uPZzkp"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "File has been identified by 46 Antiviruses on VirusTotal as malicious",
  21. "Details": [
  22. {
  23. "MicroWorld-eScan": "Trojan.GenericKD.32064292"
  24. },
  25. {
  26. "FireEye": "Generic.mg.7545388a6d2d84ce"
  27. },
  28. {
  29. "McAfee": "GCrab-FNZ!7545388A6D2D"
  30. },
  31. {
  32. "Malwarebytes": "Trojan.MalPack.GS.Generic"
  33. },
  34. {
  35. "AegisLab": "Trojan.Multi.Generic.4!c"
  36. },
  37. {
  38. "Alibaba": "TrojanPSW:Win32/Azorult.6bd57377"
  39. },
  40. {
  41. "K7GW": "Trojan ( 005504581 )"
  42. },
  43. {
  44. "K7AntiVirus": "Trojan ( 005504581 )"
  45. },
  46. {
  47. "Arcabit": "Trojan.Generic.D1E94324"
  48. },
  49. {
  50. "TrendMicro": "Worm.Win32.WACATAC.USXVPFI19"
  51. },
  52. {
  53. "Cyren": "W32/Trojan.TGQQ-1169"
  54. },
  55. {
  56. "Symantec": "Trojan.Gen.2"
  57. },
  58. {
  59. "APEX": "Malicious"
  60. },
  61. {
  62. "Paloalto": "generic.ml"
  63. },
  64. {
  65. "Kaspersky": "Trojan-PSW.Win32.Azorult.vxd"
  66. },
  67. {
  68. "BitDefender": "Trojan.GenericKD.32064292"
  69. },
  70. {
  71. "Avast": "Win32:Trojan-gen"
  72. },
  73. {
  74. "Tencent": "Win32.Trojan-qqpass.Qqrob.Agbd"
  75. },
  76. {
  77. "Endgame": "malicious (high confidence)"
  78. },
  79. {
  80. "Emsisoft": "Trojan.GenericKD.32064292 (B)"
  81. },
  82. {
  83. "Comodo": "Malware@#3txnzvspr2k0y"
  84. },
  85. {
  86. "F-Secure": "Trojan.TR/Injector.yqzio"
  87. },
  88. {
  89. "DrWeb": "Trojan.PWS.Siggen2.18654"
  90. },
  91. {
  92. "Invincea": "heuristic"
  93. },
  94. {
  95. "McAfee-GW-Edition": "BehavesLike.Win32.MultiPlug.fh"
  96. },
  97. {
  98. "Sophos": "Mal/Generic-S"
  99. },
  100. {
  101. "Webroot": "W32.Azorult"
  102. },
  103. {
  104. "Avira": "TR/Injector.yqzio"
  105. },
  106. {
  107. "Microsoft": "Trojan:Win32/Gandcrab!rfn"
  108. },
  109. {
  110. "ZoneAlarm": "Trojan-PSW.Win32.Azorult.vxd"
  111. },
  112. {
  113. "GData": "Trojan.GenericKD.32064292"
  114. },
  115. {
  116. "AhnLab-V3": "Packed/Win32.RL_SuspiciousPacker.R276712"
  117. },
  118. {
  119. "Acronis": "suspicious"
  120. },
  121. {
  122. "VBA32": "BScope.Trojan.Wacatac"
  123. },
  124. {
  125. "Ad-Aware": "Trojan.GenericKD.32064292"
  126. },
  127. {
  128. "Cylance": "Unsafe"
  129. },
  130. {
  131. "ESET-NOD32": "a variant of Win32/Injector.EGBS"
  132. },
  133. {
  134. "TrendMicro-HouseCall": "Worm.Win32.WACATAC.USXVPFI19"
  135. },
  136. {
  137. "Rising": "Trojan.Injector!8.C4 (CLOUD)"
  138. },
  139. {
  140. "SentinelOne": "DFI - Suspicious PE"
  141. },
  142. {
  143. "Fortinet": "W32/GenKryptik.DKXT!tr"
  144. },
  145. {
  146. "AVG": "Win32:Trojan-gen"
  147. },
  148. {
  149. "Cybereason": "malicious.5c1377"
  150. },
  151. {
  152. "Panda": "Trj/GdSda.A"
  153. },
  154. {
  155. "CrowdStrike": "win/malicious_confidence_90% (W)"
  156. },
  157. {
  158. "Qihoo-360": "HEUR/QVM10.2.F03D.Malware.Gen"
  159. }
  160. ]
  161. }
  162. ]
  163.  
  164. [*] Started Service: []
  165.  
  166. [*] Executed Commands: []
  167.  
  168. [*] Mutexes: []
  169.  
  170. [*] Modified Files: []
  171.  
  172. [*] Deleted Files: []
  173.  
  174. [*] Modified Registry Keys: []
  175.  
  176. [*] Deleted Registry Keys: []
  177.  
  178. [*] DNS Communications: []
  179.  
  180. [*] Domains: []
  181.  
  182. [*] Network Communication - ICMP: []
  183.  
  184. [*] Network Communication - HTTP: []
  185.  
  186. [*] Network Communication - SMTP: []
  187.  
  188. [*] Network Communication - Hosts: []
  189.  
  190. [*] Network Communication - IRC: []
  191.  
  192. [*] Static Analysis: {
  193. "pe": {
  194. "peid_signatures": null,
  195. "imports": [
  196. {
  197. "imports": [
  198. {
  199. "name": "GetBinaryTypeW",
  200. "address": "0x424018"
  201. },
  202. {
  203. "name": "ExitProcess",
  204. "address": "0x42401c"
  205. },
  206. {
  207. "name": "DebugActiveProcess",
  208. "address": "0x424020"
  209. },
  210. {
  211. "name": "LockFile",
  212. "address": "0x424024"
  213. },
  214. {
  215. "name": "CloseHandle",
  216. "address": "0x424028"
  217. },
  218. {
  219. "name": "GetHandleInformation",
  220. "address": "0x42402c"
  221. },
  222. {
  223. "name": "GetTickCount",
  224. "address": "0x424030"
  225. },
  226. {
  227. "name": "lstrlenA",
  228. "address": "0x424034"
  229. },
  230. {
  231. "name": "HeapSize",
  232. "address": "0x424038"
  233. },
  234. {
  235. "name": "LoadLibraryW",
  236. "address": "0x42403c"
  237. },
  238. {
  239. "name": "GetProfileSectionA",
  240. "address": "0x424040"
  241. },
  242. {
  243. "name": "MapUserPhysicalPagesScatter",
  244. "address": "0x424044"
  245. },
  246. {
  247. "name": "GetNumberFormatA",
  248. "address": "0x424048"
  249. },
  250. {
  251. "name": "PeekConsoleInputW",
  252. "address": "0x42404c"
  253. },
  254. {
  255. "name": "CreateToolhelp32Snapshot",
  256. "address": "0x424050"
  257. },
  258. {
  259. "name": "Module32First",
  260. "address": "0x424054"
  261. },
  262. {
  263. "name": "VirtualProtect",
  264. "address": "0x424058"
  265. },
  266. {
  267. "name": "LocalAlloc",
  268. "address": "0x42405c"
  269. },
  270. {
  271. "name": "GlobalMemoryStatus",
  272. "address": "0x424060"
  273. },
  274. {
  275. "name": "GlobalFree",
  276. "address": "0x424064"
  277. },
  278. {
  279. "name": "GetLogicalDriveStringsA",
  280. "address": "0x424068"
  281. },
  282. {
  283. "name": "GetProcAddress",
  284. "address": "0x42406c"
  285. },
  286. {
  287. "name": "EncodePointer",
  288. "address": "0x424070"
  289. },
  290. {
  291. "name": "DecodePointer",
  292. "address": "0x424074"
  293. },
  294. {
  295. "name": "RaiseException",
  296. "address": "0x424078"
  297. },
  298. {
  299. "name": "RtlUnwind",
  300. "address": "0x42407c"
  301. },
  302. {
  303. "name": "GetCommandLineA",
  304. "address": "0x424080"
  305. },
  306. {
  307. "name": "IsProcessorFeaturePresent",
  308. "address": "0x424084"
  309. },
  310. {
  311. "name": "GetLastError",
  312. "address": "0x424088"
  313. },
  314. {
  315. "name": "HeapAlloc",
  316. "address": "0x42408c"
  317. },
  318. {
  319. "name": "HeapFree",
  320. "address": "0x424090"
  321. },
  322. {
  323. "name": "GetModuleHandleExW",
  324. "address": "0x424094"
  325. },
  326. {
  327. "name": "AreFileApisANSI",
  328. "address": "0x424098"
  329. },
  330. {
  331. "name": "MultiByteToWideChar",
  332. "address": "0x42409c"
  333. },
  334. {
  335. "name": "WideCharToMultiByte",
  336. "address": "0x4240a0"
  337. },
  338. {
  339. "name": "EnterCriticalSection",
  340. "address": "0x4240a4"
  341. },
  342. {
  343. "name": "LeaveCriticalSection",
  344. "address": "0x4240a8"
  345. },
  346. {
  347. "name": "FlushFileBuffers",
  348. "address": "0x4240ac"
  349. },
  350. {
  351. "name": "WriteFile",
  352. "address": "0x4240b0"
  353. },
  354. {
  355. "name": "GetConsoleCP",
  356. "address": "0x4240b4"
  357. },
  358. {
  359. "name": "GetConsoleMode",
  360. "address": "0x4240b8"
  361. },
  362. {
  363. "name": "DeleteCriticalSection",
  364. "address": "0x4240bc"
  365. },
  366. {
  367. "name": "FatalAppExitA",
  368. "address": "0x4240c0"
  369. },
  370. {
  371. "name": "IsDebuggerPresent",
  372. "address": "0x4240c4"
  373. },
  374. {
  375. "name": "SetLastError",
  376. "address": "0x4240c8"
  377. },
  378. {
  379. "name": "GetCurrentThread",
  380. "address": "0x4240cc"
  381. },
  382. {
  383. "name": "GetCurrentThreadId",
  384. "address": "0x4240d0"
  385. },
  386. {
  387. "name": "GetProcessHeap",
  388. "address": "0x4240d4"
  389. },
  390. {
  391. "name": "GetStdHandle",
  392. "address": "0x4240d8"
  393. },
  394. {
  395. "name": "GetFileType",
  396. "address": "0x4240dc"
  397. },
  398. {
  399. "name": "GetStartupInfoW",
  400. "address": "0x4240e0"
  401. },
  402. {
  403. "name": "GetModuleFileNameA",
  404. "address": "0x4240e4"
  405. },
  406. {
  407. "name": "GetModuleFileNameW",
  408. "address": "0x4240e8"
  409. },
  410. {
  411. "name": "QueryPerformanceCounter",
  412. "address": "0x4240ec"
  413. },
  414. {
  415. "name": "GetCurrentProcessId",
  416. "address": "0x4240f0"
  417. },
  418. {
  419. "name": "GetSystemTimeAsFileTime",
  420. "address": "0x4240f4"
  421. },
  422. {
  423. "name": "GetEnvironmentStringsW",
  424. "address": "0x4240f8"
  425. },
  426. {
  427. "name": "FreeEnvironmentStringsW",
  428. "address": "0x4240fc"
  429. },
  430. {
  431. "name": "UnhandledExceptionFilter",
  432. "address": "0x424100"
  433. },
  434. {
  435. "name": "SetUnhandledExceptionFilter",
  436. "address": "0x424104"
  437. },
  438. {
  439. "name": "InitializeCriticalSectionAndSpinCount",
  440. "address": "0x424108"
  441. },
  442. {
  443. "name": "CreateEventW",
  444. "address": "0x42410c"
  445. },
  446. {
  447. "name": "Sleep",
  448. "address": "0x424110"
  449. },
  450. {
  451. "name": "GetCurrentProcess",
  452. "address": "0x424114"
  453. },
  454. {
  455. "name": "TerminateProcess",
  456. "address": "0x424118"
  457. },
  458. {
  459. "name": "TlsAlloc",
  460. "address": "0x42411c"
  461. },
  462. {
  463. "name": "TlsGetValue",
  464. "address": "0x424120"
  465. },
  466. {
  467. "name": "TlsSetValue",
  468. "address": "0x424124"
  469. },
  470. {
  471. "name": "TlsFree",
  472. "address": "0x424128"
  473. },
  474. {
  475. "name": "GetModuleHandleW",
  476. "address": "0x42412c"
  477. },
  478. {
  479. "name": "CreateSemaphoreW",
  480. "address": "0x424130"
  481. },
  482. {
  483. "name": "SetConsoleCtrlHandler",
  484. "address": "0x424134"
  485. },
  486. {
  487. "name": "GetDateFormatW",
  488. "address": "0x424138"
  489. },
  490. {
  491. "name": "GetTimeFormatW",
  492. "address": "0x42413c"
  493. },
  494. {
  495. "name": "CompareStringW",
  496. "address": "0x424140"
  497. },
  498. {
  499. "name": "LCMapStringW",
  500. "address": "0x424144"
  501. },
  502. {
  503. "name": "GetLocaleInfoW",
  504. "address": "0x424148"
  505. },
  506. {
  507. "name": "IsValidLocale",
  508. "address": "0x42414c"
  509. },
  510. {
  511. "name": "GetUserDefaultLCID",
  512. "address": "0x424150"
  513. },
  514. {
  515. "name": "EnumSystemLocalesW",
  516. "address": "0x424154"
  517. },
  518. {
  519. "name": "FreeLibrary",
  520. "address": "0x424158"
  521. },
  522. {
  523. "name": "LoadLibraryExW",
  524. "address": "0x42415c"
  525. },
  526. {
  527. "name": "IsValidCodePage",
  528. "address": "0x424160"
  529. },
  530. {
  531. "name": "GetACP",
  532. "address": "0x424164"
  533. },
  534. {
  535. "name": "GetOEMCP",
  536. "address": "0x424168"
  537. },
  538. {
  539. "name": "GetCPInfo",
  540. "address": "0x42416c"
  541. },
  542. {
  543. "name": "HeapReAlloc",
  544. "address": "0x424170"
  545. },
  546. {
  547. "name": "SetStdHandle",
  548. "address": "0x424174"
  549. },
  550. {
  551. "name": "SetFilePointerEx",
  552. "address": "0x424178"
  553. },
  554. {
  555. "name": "WriteConsoleW",
  556. "address": "0x42417c"
  557. },
  558. {
  559. "name": "OutputDebugStringW",
  560. "address": "0x424180"
  561. },
  562. {
  563. "name": "GetStringTypeW",
  564. "address": "0x424184"
  565. },
  566. {
  567. "name": "CreateFileW",
  568. "address": "0x424188"
  569. }
  570. ],
  571. "dll": "KERNEL32.dll"
  572. },
  573. {
  574. "imports": [
  575. {
  576. "name": "RegReplaceKeyW",
  577. "address": "0x424000"
  578. },
  579. {
  580. "name": "RegCreateKeyExA",
  581. "address": "0x424004"
  582. },
  583. {
  584. "name": "LookupPrivilegeValueW",
  585. "address": "0x424008"
  586. },
  587. {
  588. "name": "LookupAccountSidA",
  589. "address": "0x42400c"
  590. },
  591. {
  592. "name": "CreateServiceW",
  593. "address": "0x424010"
  594. }
  595. ],
  596. "dll": "ADVAPI32.dll"
  597. }
  598. ],
  599. "digital_signers": null,
  600. "exported_dll_name": null,
  601. "actual_checksum": "0x0005d3ee",
  602. "overlay": null,
  603. "imagebase": "0x00400000",
  604. "reported_checksum": "0x0005d3ee",
  605. "icon_hash": null,
  606. "entrypoint": "0x00404fa0",
  607. "timestamp": "2018-10-20 05:34:58",
  608. "osversion": "5.1",
  609. "sections": [
  610. {
  611. "name": ".text",
  612. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  613. "virtual_address": "0x00001000",
  614. "size_of_data": "0x00022800",
  615. "entropy": "6.66",
  616. "raw_address": "0x00000400",
  617. "virtual_size": "0x0002262d",
  618. "characteristics_raw": "0x60000020"
  619. },
  620. {
  621. "name": ".rdata",
  622. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  623. "virtual_address": "0x00024000",
  624. "size_of_data": "0x00023000",
  625. "entropy": "6.27",
  626. "raw_address": "0x00022c00",
  627. "virtual_size": "0x00022e3e",
  628. "characteristics_raw": "0x40000040"
  629. },
  630. {
  631. "name": ".data",
  632. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  633. "virtual_address": "0x00047000",
  634. "size_of_data": "0x00001a00",
  635. "entropy": "3.38",
  636. "raw_address": "0x00045c00",
  637. "virtual_size": "0x00803ca0",
  638. "characteristics_raw": "0xc0000040"
  639. },
  640. {
  641. "name": ".nip",
  642. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  643. "virtual_address": "0x0084b000",
  644. "size_of_data": "0x00000600",
  645. "entropy": "0.00",
  646. "raw_address": "0x00047600",
  647. "virtual_size": "0x00001400",
  648. "characteristics_raw": "0xc0000040"
  649. },
  650. {
  651. "name": ".rsrc",
  652. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  653. "virtual_address": "0x0084d000",
  654. "size_of_data": "0x00006e00",
  655. "entropy": "4.65",
  656. "raw_address": "0x00047c00",
  657. "virtual_size": "0x00006c30",
  658. "characteristics_raw": "0x40000040"
  659. },
  660. {
  661. "name": ".reloc",
  662. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  663. "virtual_address": "0x00854000",
  664. "size_of_data": "0x00002000",
  665. "entropy": "6.60",
  666. "raw_address": "0x0004ea00",
  667. "virtual_size": "0x00001fe8",
  668. "characteristics_raw": "0x42000040"
  669. }
  670. ],
  671. "resources": [],
  672. "dirents": [
  673. {
  674. "virtual_address": "0x00000000",
  675. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  676. "size": "0x00000000"
  677. },
  678. {
  679. "virtual_address": "0x0004652c",
  680. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  681. "size": "0x0000003c"
  682. },
  683. {
  684. "virtual_address": "0x0084d000",
  685. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  686. "size": "0x00006c30"
  687. },
  688. {
  689. "virtual_address": "0x00000000",
  690. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  691. "size": "0x00000000"
  692. },
  693. {
  694. "virtual_address": "0x00000000",
  695. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  696. "size": "0x00000000"
  697. },
  698. {
  699. "virtual_address": "0x00854000",
  700. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  701. "size": "0x00001fe8"
  702. },
  703. {
  704. "virtual_address": "0x000241f0",
  705. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  706. "size": "0x00000038"
  707. },
  708. {
  709. "virtual_address": "0x00000000",
  710. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  711. "size": "0x00000000"
  712. },
  713. {
  714. "virtual_address": "0x00000000",
  715. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  716. "size": "0x00000000"
  717. },
  718. {
  719. "virtual_address": "0x00000000",
  720. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  721. "size": "0x00000000"
  722. },
  723. {
  724. "virtual_address": "0x00000000",
  725. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  726. "size": "0x00000000"
  727. },
  728. {
  729. "virtual_address": "0x00000000",
  730. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  731. "size": "0x00000000"
  732. },
  733. {
  734. "virtual_address": "0x00024000",
  735. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  736. "size": "0x00000190"
  737. },
  738. {
  739. "virtual_address": "0x00000000",
  740. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  741. "size": "0x00000000"
  742. },
  743. {
  744. "virtual_address": "0x00000000",
  745. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  746. "size": "0x00000000"
  747. },
  748. {
  749. "virtual_address": "0x00000000",
  750. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  751. "size": "0x00000000"
  752. }
  753. ],
  754. "exports": [],
  755. "guest_signers": {},
  756. "imphash": "b05baf3ec38384d515e7c3d154310350",
  757. "icon_fuzzy": null,
  758. "icon": null,
  759. "pdbpath": "C:\\ladorakavocey.pdb\\x00ver\\runtime\\crypt\\tmp_1874224851\\bin\\yibaj.pdb\\x00\\x00\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x86D\\x00\\xf4SD",
  760. "imported_dll_count": 2,
  761. "versioninfo": []
  762. }
  763. }
  764.  
  765. [*] Resolved APIs: []
  766.  
  767. [*] Static Analysis: {
  768. "pe": {
  769. "peid_signatures": null,
  770. "imports": [
  771. {
  772. "imports": [
  773. {
  774. "name": "GetBinaryTypeW",
  775. "address": "0x424018"
  776. },
  777. {
  778. "name": "ExitProcess",
  779. "address": "0x42401c"
  780. },
  781. {
  782. "name": "DebugActiveProcess",
  783. "address": "0x424020"
  784. },
  785. {
  786. "name": "LockFile",
  787. "address": "0x424024"
  788. },
  789. {
  790. "name": "CloseHandle",
  791. "address": "0x424028"
  792. },
  793. {
  794. "name": "GetHandleInformation",
  795. "address": "0x42402c"
  796. },
  797. {
  798. "name": "GetTickCount",
  799. "address": "0x424030"
  800. },
  801. {
  802. "name": "lstrlenA",
  803. "address": "0x424034"
  804. },
  805. {
  806. "name": "HeapSize",
  807. "address": "0x424038"
  808. },
  809. {
  810. "name": "LoadLibraryW",
  811. "address": "0x42403c"
  812. },
  813. {
  814. "name": "GetProfileSectionA",
  815. "address": "0x424040"
  816. },
  817. {
  818. "name": "MapUserPhysicalPagesScatter",
  819. "address": "0x424044"
  820. },
  821. {
  822. "name": "GetNumberFormatA",
  823. "address": "0x424048"
  824. },
  825. {
  826. "name": "PeekConsoleInputW",
  827. "address": "0x42404c"
  828. },
  829. {
  830. "name": "CreateToolhelp32Snapshot",
  831. "address": "0x424050"
  832. },
  833. {
  834. "name": "Module32First",
  835. "address": "0x424054"
  836. },
  837. {
  838. "name": "VirtualProtect",
  839. "address": "0x424058"
  840. },
  841. {
  842. "name": "LocalAlloc",
  843. "address": "0x42405c"
  844. },
  845. {
  846. "name": "GlobalMemoryStatus",
  847. "address": "0x424060"
  848. },
  849. {
  850. "name": "GlobalFree",
  851. "address": "0x424064"
  852. },
  853. {
  854. "name": "GetLogicalDriveStringsA",
  855. "address": "0x424068"
  856. },
  857. {
  858. "name": "GetProcAddress",
  859. "address": "0x42406c"
  860. },
  861. {
  862. "name": "EncodePointer",
  863. "address": "0x424070"
  864. },
  865. {
  866. "name": "DecodePointer",
  867. "address": "0x424074"
  868. },
  869. {
  870. "name": "RaiseException",
  871. "address": "0x424078"
  872. },
  873. {
  874. "name": "RtlUnwind",
  875. "address": "0x42407c"
  876. },
  877. {
  878. "name": "GetCommandLineA",
  879. "address": "0x424080"
  880. },
  881. {
  882. "name": "IsProcessorFeaturePresent",
  883. "address": "0x424084"
  884. },
  885. {
  886. "name": "GetLastError",
  887. "address": "0x424088"
  888. },
  889. {
  890. "name": "HeapAlloc",
  891. "address": "0x42408c"
  892. },
  893. {
  894. "name": "HeapFree",
  895. "address": "0x424090"
  896. },
  897. {
  898. "name": "GetModuleHandleExW",
  899. "address": "0x424094"
  900. },
  901. {
  902. "name": "AreFileApisANSI",
  903. "address": "0x424098"
  904. },
  905. {
  906. "name": "MultiByteToWideChar",
  907. "address": "0x42409c"
  908. },
  909. {
  910. "name": "WideCharToMultiByte",
  911. "address": "0x4240a0"
  912. },
  913. {
  914. "name": "EnterCriticalSection",
  915. "address": "0x4240a4"
  916. },
  917. {
  918. "name": "LeaveCriticalSection",
  919. "address": "0x4240a8"
  920. },
  921. {
  922. "name": "FlushFileBuffers",
  923. "address": "0x4240ac"
  924. },
  925. {
  926. "name": "WriteFile",
  927. "address": "0x4240b0"
  928. },
  929. {
  930. "name": "GetConsoleCP",
  931. "address": "0x4240b4"
  932. },
  933. {
  934. "name": "GetConsoleMode",
  935. "address": "0x4240b8"
  936. },
  937. {
  938. "name": "DeleteCriticalSection",
  939. "address": "0x4240bc"
  940. },
  941. {
  942. "name": "FatalAppExitA",
  943. "address": "0x4240c0"
  944. },
  945. {
  946. "name": "IsDebuggerPresent",
  947. "address": "0x4240c4"
  948. },
  949. {
  950. "name": "SetLastError",
  951. "address": "0x4240c8"
  952. },
  953. {
  954. "name": "GetCurrentThread",
  955. "address": "0x4240cc"
  956. },
  957. {
  958. "name": "GetCurrentThreadId",
  959. "address": "0x4240d0"
  960. },
  961. {
  962. "name": "GetProcessHeap",
  963. "address": "0x4240d4"
  964. },
  965. {
  966. "name": "GetStdHandle",
  967. "address": "0x4240d8"
  968. },
  969. {
  970. "name": "GetFileType",
  971. "address": "0x4240dc"
  972. },
  973. {
  974. "name": "GetStartupInfoW",
  975. "address": "0x4240e0"
  976. },
  977. {
  978. "name": "GetModuleFileNameA",
  979. "address": "0x4240e4"
  980. },
  981. {
  982. "name": "GetModuleFileNameW",
  983. "address": "0x4240e8"
  984. },
  985. {
  986. "name": "QueryPerformanceCounter",
  987. "address": "0x4240ec"
  988. },
  989. {
  990. "name": "GetCurrentProcessId",
  991. "address": "0x4240f0"
  992. },
  993. {
  994. "name": "GetSystemTimeAsFileTime",
  995. "address": "0x4240f4"
  996. },
  997. {
  998. "name": "GetEnvironmentStringsW",
  999. "address": "0x4240f8"
  1000. },
  1001. {
  1002. "name": "FreeEnvironmentStringsW",
  1003. "address": "0x4240fc"
  1004. },
  1005. {
  1006. "name": "UnhandledExceptionFilter",
  1007. "address": "0x424100"
  1008. },
  1009. {
  1010. "name": "SetUnhandledExceptionFilter",
  1011. "address": "0x424104"
  1012. },
  1013. {
  1014. "name": "InitializeCriticalSectionAndSpinCount",
  1015. "address": "0x424108"
  1016. },
  1017. {
  1018. "name": "CreateEventW",
  1019. "address": "0x42410c"
  1020. },
  1021. {
  1022. "name": "Sleep",
  1023. "address": "0x424110"
  1024. },
  1025. {
  1026. "name": "GetCurrentProcess",
  1027. "address": "0x424114"
  1028. },
  1029. {
  1030. "name": "TerminateProcess",
  1031. "address": "0x424118"
  1032. },
  1033. {
  1034. "name": "TlsAlloc",
  1035. "address": "0x42411c"
  1036. },
  1037. {
  1038. "name": "TlsGetValue",
  1039. "address": "0x424120"
  1040. },
  1041. {
  1042. "name": "TlsSetValue",
  1043. "address": "0x424124"
  1044. },
  1045. {
  1046. "name": "TlsFree",
  1047. "address": "0x424128"
  1048. },
  1049. {
  1050. "name": "GetModuleHandleW",
  1051. "address": "0x42412c"
  1052. },
  1053. {
  1054. "name": "CreateSemaphoreW",
  1055. "address": "0x424130"
  1056. },
  1057. {
  1058. "name": "SetConsoleCtrlHandler",
  1059. "address": "0x424134"
  1060. },
  1061. {
  1062. "name": "GetDateFormatW",
  1063. "address": "0x424138"
  1064. },
  1065. {
  1066. "name": "GetTimeFormatW",
  1067. "address": "0x42413c"
  1068. },
  1069. {
  1070. "name": "CompareStringW",
  1071. "address": "0x424140"
  1072. },
  1073. {
  1074. "name": "LCMapStringW",
  1075. "address": "0x424144"
  1076. },
  1077. {
  1078. "name": "GetLocaleInfoW",
  1079. "address": "0x424148"
  1080. },
  1081. {
  1082. "name": "IsValidLocale",
  1083. "address": "0x42414c"
  1084. },
  1085. {
  1086. "name": "GetUserDefaultLCID",
  1087. "address": "0x424150"
  1088. },
  1089. {
  1090. "name": "EnumSystemLocalesW",
  1091. "address": "0x424154"
  1092. },
  1093. {
  1094. "name": "FreeLibrary",
  1095. "address": "0x424158"
  1096. },
  1097. {
  1098. "name": "LoadLibraryExW",
  1099. "address": "0x42415c"
  1100. },
  1101. {
  1102. "name": "IsValidCodePage",
  1103. "address": "0x424160"
  1104. },
  1105. {
  1106. "name": "GetACP",
  1107. "address": "0x424164"
  1108. },
  1109. {
  1110. "name": "GetOEMCP",
  1111. "address": "0x424168"
  1112. },
  1113. {
  1114. "name": "GetCPInfo",
  1115. "address": "0x42416c"
  1116. },
  1117. {
  1118. "name": "HeapReAlloc",
  1119. "address": "0x424170"
  1120. },
  1121. {
  1122. "name": "SetStdHandle",
  1123. "address": "0x424174"
  1124. },
  1125. {
  1126. "name": "SetFilePointerEx",
  1127. "address": "0x424178"
  1128. },
  1129. {
  1130. "name": "WriteConsoleW",
  1131. "address": "0x42417c"
  1132. },
  1133. {
  1134. "name": "OutputDebugStringW",
  1135. "address": "0x424180"
  1136. },
  1137. {
  1138. "name": "GetStringTypeW",
  1139. "address": "0x424184"
  1140. },
  1141. {
  1142. "name": "CreateFileW",
  1143. "address": "0x424188"
  1144. }
  1145. ],
  1146. "dll": "KERNEL32.dll"
  1147. },
  1148. {
  1149. "imports": [
  1150. {
  1151. "name": "RegReplaceKeyW",
  1152. "address": "0x424000"
  1153. },
  1154. {
  1155. "name": "RegCreateKeyExA",
  1156. "address": "0x424004"
  1157. },
  1158. {
  1159. "name": "LookupPrivilegeValueW",
  1160. "address": "0x424008"
  1161. },
  1162. {
  1163. "name": "LookupAccountSidA",
  1164. "address": "0x42400c"
  1165. },
  1166. {
  1167. "name": "CreateServiceW",
  1168. "address": "0x424010"
  1169. }
  1170. ],
  1171. "dll": "ADVAPI32.dll"
  1172. }
  1173. ],
  1174. "digital_signers": null,
  1175. "exported_dll_name": null,
  1176. "actual_checksum": "0x0005d3ee",
  1177. "overlay": null,
  1178. "imagebase": "0x00400000",
  1179. "reported_checksum": "0x0005d3ee",
  1180. "icon_hash": null,
  1181. "entrypoint": "0x00404fa0",
  1182. "timestamp": "2018-10-20 05:34:58",
  1183. "osversion": "5.1",
  1184. "sections": [
  1185. {
  1186. "name": ".text",
  1187. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1188. "virtual_address": "0x00001000",
  1189. "size_of_data": "0x00022800",
  1190. "entropy": "6.66",
  1191. "raw_address": "0x00000400",
  1192. "virtual_size": "0x0002262d",
  1193. "characteristics_raw": "0x60000020"
  1194. },
  1195. {
  1196. "name": ".rdata",
  1197. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1198. "virtual_address": "0x00024000",
  1199. "size_of_data": "0x00023000",
  1200. "entropy": "6.27",
  1201. "raw_address": "0x00022c00",
  1202. "virtual_size": "0x00022e3e",
  1203. "characteristics_raw": "0x40000040"
  1204. },
  1205. {
  1206. "name": ".data",
  1207. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1208. "virtual_address": "0x00047000",
  1209. "size_of_data": "0x00001a00",
  1210. "entropy": "3.38",
  1211. "raw_address": "0x00045c00",
  1212. "virtual_size": "0x00803ca0",
  1213. "characteristics_raw": "0xc0000040"
  1214. },
  1215. {
  1216. "name": ".nip",
  1217. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1218. "virtual_address": "0x0084b000",
  1219. "size_of_data": "0x00000600",
  1220. "entropy": "0.00",
  1221. "raw_address": "0x00047600",
  1222. "virtual_size": "0x00001400",
  1223. "characteristics_raw": "0xc0000040"
  1224. },
  1225. {
  1226. "name": ".rsrc",
  1227. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1228. "virtual_address": "0x0084d000",
  1229. "size_of_data": "0x00006e00",
  1230. "entropy": "4.65",
  1231. "raw_address": "0x00047c00",
  1232. "virtual_size": "0x00006c30",
  1233. "characteristics_raw": "0x40000040"
  1234. },
  1235. {
  1236. "name": ".reloc",
  1237. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1238. "virtual_address": "0x00854000",
  1239. "size_of_data": "0x00002000",
  1240. "entropy": "6.60",
  1241. "raw_address": "0x0004ea00",
  1242. "virtual_size": "0x00001fe8",
  1243. "characteristics_raw": "0x42000040"
  1244. }
  1245. ],
  1246. "resources": [],
  1247. "dirents": [
  1248. {
  1249. "virtual_address": "0x00000000",
  1250. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1251. "size": "0x00000000"
  1252. },
  1253. {
  1254. "virtual_address": "0x0004652c",
  1255. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1256. "size": "0x0000003c"
  1257. },
  1258. {
  1259. "virtual_address": "0x0084d000",
  1260. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1261. "size": "0x00006c30"
  1262. },
  1263. {
  1264. "virtual_address": "0x00000000",
  1265. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1266. "size": "0x00000000"
  1267. },
  1268. {
  1269. "virtual_address": "0x00000000",
  1270. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1271. "size": "0x00000000"
  1272. },
  1273. {
  1274. "virtual_address": "0x00854000",
  1275. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1276. "size": "0x00001fe8"
  1277. },
  1278. {
  1279. "virtual_address": "0x000241f0",
  1280. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1281. "size": "0x00000038"
  1282. },
  1283. {
  1284. "virtual_address": "0x00000000",
  1285. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1286. "size": "0x00000000"
  1287. },
  1288. {
  1289. "virtual_address": "0x00000000",
  1290. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1291. "size": "0x00000000"
  1292. },
  1293. {
  1294. "virtual_address": "0x00000000",
  1295. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1296. "size": "0x00000000"
  1297. },
  1298. {
  1299. "virtual_address": "0x00000000",
  1300. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1301. "size": "0x00000000"
  1302. },
  1303. {
  1304. "virtual_address": "0x00000000",
  1305. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1306. "size": "0x00000000"
  1307. },
  1308. {
  1309. "virtual_address": "0x00024000",
  1310. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1311. "size": "0x00000190"
  1312. },
  1313. {
  1314. "virtual_address": "0x00000000",
  1315. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1316. "size": "0x00000000"
  1317. },
  1318. {
  1319. "virtual_address": "0x00000000",
  1320. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1321. "size": "0x00000000"
  1322. },
  1323. {
  1324. "virtual_address": "0x00000000",
  1325. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1326. "size": "0x00000000"
  1327. }
  1328. ],
  1329. "exports": [],
  1330. "guest_signers": {},
  1331. "imphash": "b05baf3ec38384d515e7c3d154310350",
  1332. "icon_fuzzy": null,
  1333. "icon": null,
  1334. "pdbpath": "C:\\ladorakavocey.pdb\\x00ver\\runtime\\crypt\\tmp_1874224851\\bin\\yibaj.pdb\\x00\\x00\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x86D\\x00\\xf4SD",
  1335. "imported_dll_count": 2,
  1336. "versioninfo": []
  1337. }
  1338. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!