API tools faq
paste
paladin316

Exes_16163c934bc00ff0e5d25f8a39586c8a_exe_2019-06-27_15_30.json

paladin316
Jun 27th, 2019
2,139
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.15 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Windigo"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_16163c934bc00ff0e5d25f8a39586c8a.exe"
  7. [*] File Size: 1876992
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  9. [*] SHA256: "f9f4636363e45a600dba5a578c20be2ce2e2fe04800fe3efb9e7d18c85ab841d"
  10. [*] MD5: "16163c934bc00ff0e5d25f8a39586c8a"
  11. [*] SHA1: "394cf354034915a3e514ba87ed3217c73a389dd9"
  12. [*] SHA512: "c3d2736b48cb68142c63b4d248bb482e59408098f2fb3da64a694811373c0ea6368c99a19c5c203fe3ea3719905457be1bc8696887b801ef6394ae27f12cff7c"
  13. [*] CRC32: "E88C7C6A"
  14. [*] SSDEEP: "49152:gJy8/EDRBloYhtkNfzRQ9f07M/BKkf8vTqthz3xL6N:eEloykNfdQ96fvTehz3M"
  15.  
  16. [*] Process Execution: [
  17. "Exes_16163c934bc00ff0e5d25f8a39586c8a.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: UPX1, entropy: 7.88, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x001ca000, virtual_size: 0x001ca000"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "The executable is compressed using UPX",
  31. "Details": [
  32. {
  33. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x0029e000"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "File has been identified by 53 Antiviruses on VirusTotal as malicious",
  39. "Details": [
  40. {
  41. "MicroWorld-eScan": "Trojan.GenericKD.31994625"
  42. },
  43. {
  44. "FireEye": "Generic.mg.16163c934bc00ff0"
  45. },
  46. {
  47. "CAT-QuickHeal": "Trojandownloader.Windigo"
  48. },
  49. {
  50. "ALYac": "Trojan.GenericKD.31994625"
  51. },
  52. {
  53. "Malwarebytes": "Trojan.Downloader"
  54. },
  55. {
  56. "Alibaba": "TrojanDownloader:Win32/Windigo.018d3d48"
  57. },
  58. {
  59. "K7GW": "Trojan-Downloader ( 005472451 )"
  60. },
  61. {
  62. "K7AntiVirus": "Trojan-Downloader ( 005472451 )"
  63. },
  64. {
  65. "Arcabit": "Trojan.Generic.D1E83301"
  66. },
  67. {
  68. "TrendMicro": "TROJ_GEN.R03FC0WDH19"
  69. },
  70. {
  71. "NANO-Antivirus": "Trojan.Win32.Windigo.fpfslt"
  72. },
  73. {
  74. "Symantec": "Trojan Horse"
  75. },
  76. {
  77. "APEX": "Malicious"
  78. },
  79. {
  80. "Paloalto": "generic.ml"
  81. },
  82. {
  83. "Kaspersky": "Trojan-Downloader.Win32.Windigo.d"
  84. },
  85. {
  86. "BitDefender": "Trojan.GenericKD.31994625"
  87. },
  88. {
  89. "AegisLab": "Trojan.Win32.Windigo.4!c"
  90. },
  91. {
  92. "Avast": "Win32:Trojan-gen"
  93. },
  94. {
  95. "Rising": "Downloader.Agent!8.B23 (CLOUD)"
  96. },
  97. {
  98. "Ad-Aware": "Trojan.GenericKD.31994625"
  99. },
  100. {
  101. "Emsisoft": "Trojan.GenericKD.31994625 (B)"
  102. },
  103. {
  104. "Comodo": "Malware@#zhdvah6iz3gn"
  105. },
  106. {
  107. "F-Secure": "Trojan.TR/Dldr.Agent.owcre"
  108. },
  109. {
  110. "DrWeb": "Trojan.Siggen8.25683"
  111. },
  112. {
  113. "McAfee-GW-Edition": "BehavesLike.Win32.Sdbot.tc"
  114. },
  115. {
  116. "Trapmine": "suspicious.low.ml.score"
  117. },
  118. {
  119. "Sophos": "Troj/Agent-BBMM"
  120. },
  121. {
  122. "Ikarus": "Trojan-Downloader.Win32.Agent"
  123. },
  124. {
  125. "Cyren": "W32/Trojan.UZVI-0081"
  126. },
  127. {
  128. "Jiangmin": "TrojanDownloader.Windigo.b"
  129. },
  130. {
  131. "Webroot": "W32.Trojan.Gen"
  132. },
  133. {
  134. "Avira": "TR/Dldr.Agent.owcre"
  135. },
  136. {
  137. "MAX": "malware (ai score=94)"
  138. },
  139. {
  140. "Antiy-AVL": "Trojan[Downloader]/Win32.Windigo"
  141. },
  142. {
  143. "Microsoft": "Trojan:Win32/Tiggre!rfn"
  144. },
  145. {
  146. "Endgame": "malicious (moderate confidence)"
  147. },
  148. {
  149. "ZoneAlarm": "Trojan-Downloader.Win32.Windigo.d"
  150. },
  151. {
  152. "GData": "Trojan.GenericKD.31994625"
  153. },
  154. {
  155. "AhnLab-V3": "Trojan/Win32.Agent.R275670"
  156. },
  157. {
  158. "McAfee": "Trojan-FQXI!16163C934BC0"
  159. },
  160. {
  161. "VBA32": "TrojanDownloader.Windigo"
  162. },
  163. {
  164. "Cylance": "Unsafe"
  165. },
  166. {
  167. "ESET-NOD32": "a variant of Win32/TrojanDownloader.Agent.EJU"
  168. },
  169. {
  170. "TrendMicro-HouseCall": "TROJ_GEN.R03FC0WDH19"
  171. },
  172. {
  173. "Tencent": "Win32.Trojan-downloader.Windigo.Dvpu"
  174. },
  175. {
  176. "Yandex": "Trojan.DL.Windigo!"
  177. },
  178. {
  179. "MaxSecure": "Trojan.Malware.74249203.susgen"
  180. },
  181. {
  182. "Fortinet": "W32/Windigo.D!tr.dldr"
  183. },
  184. {
  185. "AVG": "Win32:Trojan-gen"
  186. },
  187. {
  188. "Cybereason": "malicious.34bc00"
  189. },
  190. {
  191. "Panda": "Trj/Genetic.gen"
  192. },
  193. {
  194. "CrowdStrike": "win/malicious_confidence_100% (W)"
  195. },
  196. {
  197. "Qihoo-360": "HEUR/QVM11.1.95B9.Malware.Gen"
  198. }
  199. ]
  200. }
  201. ]
  202.  
  203. [*] Started Service: []
  204.  
  205. [*] Executed Commands: []
  206.  
  207. [*] Mutexes: []
  208.  
  209. [*] Modified Files: []
  210.  
  211. [*] Deleted Files: []
  212.  
  213. [*] Modified Registry Keys: []
  214.  
  215. [*] Deleted Registry Keys: []
  216.  
  217. [*] DNS Communications: []
  218.  
  219. [*] Domains: []
  220.  
  221. [*] Network Communication - ICMP: []
  222.  
  223. [*] Network Communication - HTTP: []
  224.  
  225. [*] Network Communication - SMTP: []
  226.  
  227. [*] Network Communication - Hosts: []
  228.  
  229. [*] Network Communication - IRC: []
  230.  
  231. [*] Static Analysis: {
  232. "pe": {
  233. "peid_signatures": [
  234. [
  235. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  236. ]
  237. ],
  238. "imports": [
  239. {
  240. "imports": [
  241. {
  242. "name": "LoadLibraryA",
  243. "address": "0x869028"
  244. },
  245. {
  246. "name": "GetProcAddress",
  247. "address": "0x86902c"
  248. },
  249. {
  250. "name": "VirtualProtect",
  251. "address": "0x869030"
  252. },
  253. {
  254. "name": "VirtualAlloc",
  255. "address": "0x869034"
  256. },
  257. {
  258. "name": "VirtualFree",
  259. "address": "0x869038"
  260. },
  261. {
  262. "name": "ExitProcess",
  263. "address": "0x86903c"
  264. }
  265. ],
  266. "dll": "KERNEL32.DLL"
  267. }
  268. ],
  269. "digital_signers": null,
  270. "exported_dll_name": null,
  271. "actual_checksum": "0x001d1610",
  272. "overlay": null,
  273. "imagebase": "0x00400000",
  274. "reported_checksum": "0x00000000",
  275. "icon_hash": null,
  276. "entrypoint": "0x00868d60",
  277. "timestamp": "1970-01-01 00:00:00",
  278. "osversion": "4.0",
  279. "sections": [
  280. {
  281. "name": "UPX0",
  282. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  283. "virtual_address": "0x00001000",
  284. "size_of_data": "0x00000000",
  285. "entropy": "0.00",
  286. "raw_address": "0x00000200",
  287. "virtual_size": "0x0029e000",
  288. "characteristics_raw": "0xe0000080"
  289. },
  290. {
  291. "name": "UPX1",
  292. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  293. "virtual_address": "0x0029f000",
  294. "size_of_data": "0x001ca000",
  295. "entropy": "7.88",
  296. "raw_address": "0x00000200",
  297. "virtual_size": "0x001ca000",
  298. "characteristics_raw": "0xe0000040"
  299. },
  300. {
  301. "name": "UPX2",
  302. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  303. "virtual_address": "0x00469000",
  304. "size_of_data": "0x00000200",
  305. "entropy": "1.76",
  306. "raw_address": "0x001ca200",
  307. "virtual_size": "0x00001000",
  308. "characteristics_raw": "0xc0000040"
  309. }
  310. ],
  311. "resources": [],
  312. "dirents": [
  313. {
  314. "virtual_address": "0x00000000",
  315. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  316. "size": "0x00000000"
  317. },
  318. {
  319. "virtual_address": "0x00469000",
  320. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  321. "size": "0x000000ac"
  322. },
  323. {
  324. "virtual_address": "0x00000000",
  325. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  326. "size": "0x00000000"
  327. },
  328. {
  329. "virtual_address": "0x00000000",
  330. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  331. "size": "0x00000000"
  332. },
  333. {
  334. "virtual_address": "0x00000000",
  335. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  336. "size": "0x00000000"
  337. },
  338. {
  339. "virtual_address": "0x00000000",
  340. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  341. "size": "0x00000000"
  342. },
  343. {
  344. "virtual_address": "0x00000000",
  345. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  346. "size": "0x00000000"
  347. },
  348. {
  349. "virtual_address": "0x00000000",
  350. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  351. "size": "0x00000000"
  352. },
  353. {
  354. "virtual_address": "0x00000000",
  355. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  356. "size": "0x00000000"
  357. },
  358. {
  359. "virtual_address": "0x00000000",
  360. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  361. "size": "0x00000000"
  362. },
  363. {
  364. "virtual_address": "0x00000000",
  365. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  366. "size": "0x00000000"
  367. },
  368. {
  369. "virtual_address": "0x00000000",
  370. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  371. "size": "0x00000000"
  372. },
  373. {
  374. "virtual_address": "0x00000000",
  375. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  376. "size": "0x00000000"
  377. },
  378. {
  379. "virtual_address": "0x00000000",
  380. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  381. "size": "0x00000000"
  382. },
  383. {
  384. "virtual_address": "0x00000000",
  385. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  386. "size": "0x00000000"
  387. },
  388. {
  389. "virtual_address": "0x00000000",
  390. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  391. "size": "0x00000000"
  392. }
  393. ],
  394. "exports": [],
  395. "guest_signers": {},
  396. "imphash": "e58ab46f2a279ded0846d81bf0fa21f7",
  397. "icon_fuzzy": null,
  398. "icon": null,
  399. "pdbpath": null,
  400. "imported_dll_count": 1,
  401. "versioninfo": []
  402. }
  403. }
  404.  
  405. [*] Resolved APIs: [
  406. "kernel32.dll.WriteFile",
  407. "kernel32.dll.WriteConsoleW",
  408. "kernel32.dll.WaitForSingleObject",
  409. "kernel32.dll.VirtualQuery",
  410. "kernel32.dll.VirtualFree",
  411. "kernel32.dll.VirtualAlloc",
  412. "kernel32.dll.SwitchToThread",
  413. "kernel32.dll.SetWaitableTimer",
  414. "kernel32.dll.SetUnhandledExceptionFilter",
  415. "kernel32.dll.SetProcessPriorityBoost",
  416. "kernel32.dll.SetEvent",
  417. "kernel32.dll.SetErrorMode",
  418. "kernel32.dll.SetConsoleCtrlHandler",
  419. "kernel32.dll.LoadLibraryA",
  420. "kernel32.dll.LoadLibraryW",
  421. "kernel32.dll.GetSystemInfo",
  422. "kernel32.dll.GetSystemDirectoryA",
  423. "kernel32.dll.GetStdHandle",
  424. "kernel32.dll.GetQueuedCompletionStatus",
  425. "kernel32.dll.GetProcessAffinityMask",
  426. "kernel32.dll.GetProcAddress",
  427. "kernel32.dll.GetEnvironmentStringsW",
  428. "kernel32.dll.GetConsoleMode",
  429. "kernel32.dll.FreeEnvironmentStringsW",
  430. "kernel32.dll.ExitProcess",
  431. "kernel32.dll.DuplicateHandle",
  432. "kernel32.dll.CreateThread",
  433. "kernel32.dll.CreateIoCompletionPort",
  434. "kernel32.dll.CreateEventA",
  435. "kernel32.dll.CloseHandle",
  436. "kernel32.dll.AddVectoredExceptionHandler",
  437. "kernel32.dll.AddVectoredContinueHandler",
  438. "kernel32.dll.GetQueuedCompletionStatusEx",
  439. "kernel32.dll.LoadLibraryExA",
  440. "kernel32.dll.LoadLibraryExW",
  441. "advapi32.dll.SystemFunction036",
  442. "ntdll.dll.NtWaitForSingleObject",
  443. "winmm.dll.timeBeginPeriod",
  444. "winmm.dll.timeEndPeriod",
  445. "ws2_32.dll.WSAGetOverlappedResult",
  446. "cryptbase.dll.SystemFunction001",
  447. "cryptbase.dll.SystemFunction002",
  448. "cryptbase.dll.SystemFunction003",
  449. "cryptbase.dll.SystemFunction004",
  450. "cryptbase.dll.SystemFunction005",
  451. "cryptbase.dll.SystemFunction028",
  452. "cryptbase.dll.SystemFunction029",
  453. "cryptbase.dll.SystemFunction034",
  454. "cryptbase.dll.SystemFunction036",
  455. "cryptbase.dll.SystemFunction040",
  456. "cryptbase.dll.SystemFunction041",
  457. "kernel32.dll.SetHandleInformation",
  458. "kernel32.dll.GetSystemDirectoryW",
  459. "ws2_32.dll.WSAStartup",
  460. "kernel32.dll.CancelIoEx",
  461. "kernel32.dll.SetFileCompletionNotificationModes",
  462. "ws2_32.dll.WSAEnumProtocolsW",
  463. "kernel32.dll.GetCommandLineW",
  464. "kernel32.dll.GetEnvironmentVariableW",
  465. "kernel32.dll.GetCurrentProcess",
  466. "kernel32.dll.FormatMessageW",
  467. "advapi32.dll.OpenProcessToken",
  468. "advapi32.dll.GetTokenInformation",
  469. "advapi32.dll.ConvertSidToStringSidW",
  470. "kernel32.dll.LocalFree",
  471. "kernel32.dll.WTSGetActiveConsoleSessionId",
  472. "wtsapi32.dll.WTSQuerySessionInformationW",
  473. "winsta.dll.WinStationQueryInformationW",
  474. "advapi32.dll.LookupAccountSidW",
  475. "sechost.dll.LookupAccountSidLocalW",
  476. "advapi32.dll.CreateWellKnownSid",
  477. "rpcrt4.dll.RpcStringBindingComposeW",
  478. "rpcrt4.dll.RpcBindingFromStringBindingW",
  479. "rpcrt4.dll.RpcStringFreeW",
  480. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  481. "sechost.dll.LookupAccountNameLocalW",
  482. "rpcrt4.dll.NdrClientCall2",
  483. "rpcrt4.dll.I_RpcExceptionFilter",
  484. "rpcrt4.dll.RpcBindingFree",
  485. "advapi32.dll.LookupAccountNameW",
  486. "advapi32.dll.RegOpenKeyExW",
  487. "kernel32.dll.GetTimeZoneInformation"
  488. ]
  489.  
  490. [*] Static Analysis: {
  491. "pe": {
  492. "peid_signatures": [
  493. [
  494. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  495. ]
  496. ],
  497. "imports": [
  498. {
  499. "imports": [
  500. {
  501. "name": "LoadLibraryA",
  502. "address": "0x869028"
  503. },
  504. {
  505. "name": "GetProcAddress",
  506. "address": "0x86902c"
  507. },
  508. {
  509. "name": "VirtualProtect",
  510. "address": "0x869030"
  511. },
  512. {
  513. "name": "VirtualAlloc",
  514. "address": "0x869034"
  515. },
  516. {
  517. "name": "VirtualFree",
  518. "address": "0x869038"
  519. },
  520. {
  521. "name": "ExitProcess",
  522. "address": "0x86903c"
  523. }
  524. ],
  525. "dll": "KERNEL32.DLL"
  526. }
  527. ],
  528. "digital_signers": null,
  529. "exported_dll_name": null,
  530. "actual_checksum": "0x001d1610",
  531. "overlay": null,
  532. "imagebase": "0x00400000",
  533. "reported_checksum": "0x00000000",
  534. "icon_hash": null,
  535. "entrypoint": "0x00868d60",
  536. "timestamp": "1970-01-01 00:00:00",
  537. "osversion": "4.0",
  538. "sections": [
  539. {
  540. "name": "UPX0",
  541. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  542. "virtual_address": "0x00001000",
  543. "size_of_data": "0x00000000",
  544. "entropy": "0.00",
  545. "raw_address": "0x00000200",
  546. "virtual_size": "0x0029e000",
  547. "characteristics_raw": "0xe0000080"
  548. },
  549. {
  550. "name": "UPX1",
  551. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  552. "virtual_address": "0x0029f000",
  553. "size_of_data": "0x001ca000",
  554. "entropy": "7.88",
  555. "raw_address": "0x00000200",
  556. "virtual_size": "0x001ca000",
  557. "characteristics_raw": "0xe0000040"
  558. },
  559. {
  560. "name": "UPX2",
  561. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  562. "virtual_address": "0x00469000",
  563. "size_of_data": "0x00000200",
  564. "entropy": "1.76",
  565. "raw_address": "0x001ca200",
  566. "virtual_size": "0x00001000",
  567. "characteristics_raw": "0xc0000040"
  568. }
  569. ],
  570. "resources": [],
  571. "dirents": [
  572. {
  573. "virtual_address": "0x00000000",
  574. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  575. "size": "0x00000000"
  576. },
  577. {
  578. "virtual_address": "0x00469000",
  579. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  580. "size": "0x000000ac"
  581. },
  582. {
  583. "virtual_address": "0x00000000",
  584. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  585. "size": "0x00000000"
  586. },
  587. {
  588. "virtual_address": "0x00000000",
  589. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  590. "size": "0x00000000"
  591. },
  592. {
  593. "virtual_address": "0x00000000",
  594. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  595. "size": "0x00000000"
  596. },
  597. {
  598. "virtual_address": "0x00000000",
  599. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  600. "size": "0x00000000"
  601. },
  602. {
  603. "virtual_address": "0x00000000",
  604. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  605. "size": "0x00000000"
  606. },
  607. {
  608. "virtual_address": "0x00000000",
  609. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  610. "size": "0x00000000"
  611. },
  612. {
  613. "virtual_address": "0x00000000",
  614. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  615. "size": "0x00000000"
  616. },
  617. {
  618. "virtual_address": "0x00000000",
  619. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  620. "size": "0x00000000"
  621. },
  622. {
  623. "virtual_address": "0x00000000",
  624. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  625. "size": "0x00000000"
  626. },
  627. {
  628. "virtual_address": "0x00000000",
  629. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  630. "size": "0x00000000"
  631. },
  632. {
  633. "virtual_address": "0x00000000",
  634. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  635. "size": "0x00000000"
  636. },
  637. {
  638. "virtual_address": "0x00000000",
  639. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  640. "size": "0x00000000"
  641. },
  642. {
  643. "virtual_address": "0x00000000",
  644. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  645. "size": "0x00000000"
  646. },
  647. {
  648. "virtual_address": "0x00000000",
  649. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  650. "size": "0x00000000"
  651. }
  652. ],
  653. "exports": [],
  654. "guest_signers": {},
  655. "imphash": "e58ab46f2a279ded0846d81bf0fa21f7",
  656. "icon_fuzzy": null,
  657. "icon": null,
  658. "pdbpath": null,
  659. "imported_dll_count": 1,
  660. "versioninfo": []
  661. }
  662. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!