API tools faq
paste
paladin316

Exes_3819928d14afb3e39907f945abf034d4_exe_2019-07-02_13_30.json

paladin316
Jul 2nd, 2019
2,183
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 49.87 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_3819928d14afb3e39907f945abf034d4.exe"
  7. [*] File Size: 892416
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "db88c790a9a9bc5678ac7bd1128710ec71ba77bbc363394bb82314fccc3e30dd"
  10. [*] MD5: "3819928d14afb3e39907f945abf034d4"
  11. [*] SHA1: "a022efe4df94dfcdb4818a59edc169b889b92a60"
  12. [*] SHA512: "e1f5e016ff57352fbdc0df766845f3150c17d7e8921a0ce174b8b199d50399c083c4f299cf2a143497ea7da31b243e4596713508aaf0cd2484a3c25fd9d9a3cf"
  13. [*] CRC32: "E8404824"
  14. [*] SSDEEP: "6144:InhQkebZpn/zt2Gts38GJdr0hSvHedq5SXmo+MwObDTTg2Lztqwzq1G3QIQGGI5:InyD/z3gdwkH5M+xOb/1tqwzBHQGGI"
  15.  
  16. [*] Process Execution: [
  17. "Exes_3819928d14afb3e39907f945abf034d4.exe",
  18. "schtasks.exe",
  19. "RegAsm.exe",
  20. "reg.exe",
  21. "services.exe",
  22. "svchost.exe",
  23. "svchost.exe",
  24. "WmiPrvSE.exe",
  25. "WmiPrvSE.exe",
  26. "lsass.exe",
  27. "taskhost.exe",
  28. "WMIADAP.exe"
  29. ]
  30.  
  31. [*] Signatures Detected: [
  32. {
  33. "Description": "Creates RWX memory",
  34. "Details": []
  35. },
  36. {
  37. "Description": "A process attempted to delay the analysis task.",
  38. "Details": [
  39. {
  40. "Process": "RegAsm.exe tried to sleep 889 seconds, actually delayed analysis time by 0 seconds"
  41. }
  42. ]
  43. },
  44. {
  45. "Description": "A process created a hidden window",
  46. "Details": [
  47. {
  48. "Process": "Exes_3819928d14afb3e39907f945abf034d4.exe -> schtasks.exe"
  49. }
  50. ]
  51. },
  52. {
  53. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  54. "Details": [
  55. {
  56. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  57. },
  58. {
  59. "suspicious_request": "http://checkip.amazonaws.com/"
  60. }
  61. ]
  62. },
  63. {
  64. "Description": "Performs some HTTP requests",
  65. "Details": [
  66. {
  67. "url": "http://checkip.amazonaws.com/"
  68. }
  69. ]
  70. },
  71. {
  72. "Description": "Executed a process and injected code into it, probably while unpacking",
  73. "Details": [
  74. {
  75. "Injection": "Exes_3819928d14afb3e39907f945abf034d4.exe(1812) -> RegAsm.exe(2464)"
  76. }
  77. ]
  78. },
  79. {
  80. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  81. "Details": [
  82. {
  83. "file": "C:\\Users\\user\\AppData\\Roaming\\eAdobe\\eAdobe.exe:Zone.Identifier"
  84. }
  85. ]
  86. },
  87. {
  88. "Description": "Attempts to restart the guest VM",
  89. "Details": []
  90. },
  91. {
  92. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  93. "Details": [
  94. {
  95. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 11741259 times"
  96. }
  97. ]
  98. },
  99. {
  100. "Description": "Steals private information from local Internet browsers",
  101. "Details": [
  102. {
  103. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  104. }
  105. ]
  106. },
  107. {
  108. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  109. "Details": [
  110. {
  111. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  112. }
  113. ]
  114. },
  115. {
  116. "Description": "Installs itself for autorun at Windows startup",
  117. "Details": [
  118. {
  119. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\eAdobe"
  120. },
  121. {
  122. "data": "C:\\Users\\user\\AppData\\Roaming\\eAdobe\\eAdobe.exe"
  123. }
  124. ]
  125. },
  126. {
  127. "Description": "Creates a hidden or system file",
  128. "Details": [
  129. {
  130. "file": "C:\\Users\\user\\AppData\\Roaming\\UIsPifekVUETTr.exe"
  131. },
  132. {
  133. "file": "C:\\Users\\user\\AppData\\Roaming\\eAdobe\\eAdobe.exe"
  134. }
  135. ]
  136. },
  137. {
  138. "Description": "Retrieves Windows ProductID, probably to fingerprint the sandbox",
  139. "Details": []
  140. },
  141. {
  142. "Description": "File has been identified by 34 Antiviruses on VirusTotal as malicious",
  143. "Details": [
  144. {
  145. "MicroWorld-eScan": "Trojan.GenericKD.41420332"
  146. },
  147. {
  148. "FireEye": "Generic.mg.3819928d14afb3e3"
  149. },
  150. {
  151. "ALYac": "Trojan.GenericKD.41420332"
  152. },
  153. {
  154. "TrendMicro": "TROJ_GEN.R011C0WG219"
  155. },
  156. {
  157. "Symantec": "ML.Attribute.HighConfidence"
  158. },
  159. {
  160. "Paloalto": "generic.ml"
  161. },
  162. {
  163. "Kaspersky": "HEUR:Trojan.MSIL.Llac.gen"
  164. },
  165. {
  166. "BitDefender": "Trojan.GenericKD.41420332"
  167. },
  168. {
  169. "AegisLab": "Trojan.Multi.Generic.4!c"
  170. },
  171. {
  172. "Avast": "Win32:Malware-gen"
  173. },
  174. {
  175. "Rising": "Spyware.Agent!8.C6 (CLOUD)"
  176. },
  177. {
  178. "Ad-Aware": "Trojan.GenericKD.41420332"
  179. },
  180. {
  181. "Emsisoft": "Trojan.GenericKD.41420332 (B)"
  182. },
  183. {
  184. "F-Secure": "Trojan.TR/AD.LimeRansom.TU"
  185. },
  186. {
  187. "Invincea": "heuristic"
  188. },
  189. {
  190. "McAfee-GW-Edition": "Artemis!Trojan"
  191. },
  192. {
  193. "Sophos": "Mal/Generic-S"
  194. },
  195. {
  196. "Ikarus": "Win32.Outbreak"
  197. },
  198. {
  199. "Avira": "TR/AD.LimeRansom.TU"
  200. },
  201. {
  202. "Microsoft": "PWS:Win32/AgentTesla.YB!MTB"
  203. },
  204. {
  205. "Endgame": "malicious (high confidence)"
  206. },
  207. {
  208. "ZoneAlarm": "HEUR:Trojan.MSIL.Llac.gen"
  209. },
  210. {
  211. "GData": "Win32.Malware.Bucaspys.0BCTEQ"
  212. },
  213. {
  214. "McAfee": "RDN/Generic.grp"
  215. },
  216. {
  217. "ESET-NOD32": "MSIL/Spy.Agent.AES"
  218. },
  219. {
  220. "TrendMicro-HouseCall": "TROJ_GEN.R011C0WG219"
  221. },
  222. {
  223. "Tencent": "Win32.Trojan.Inject.Auto"
  224. },
  225. {
  226. "SentinelOne": "DFI - Suspicious PE"
  227. },
  228. {
  229. "Fortinet": "MSIL/GenKryptik.DMDI!tr"
  230. },
  231. {
  232. "Webroot": "W32.Trojan.Gen"
  233. },
  234. {
  235. "AVG": "Win32:Malware-gen"
  236. },
  237. {
  238. "Cybereason": "malicious.4df94d"
  239. },
  240. {
  241. "CrowdStrike": "win/malicious_confidence_100% (W)"
  242. },
  243. {
  244. "Qihoo-360": "HEUR/QVM03.0.3A79.Malware.Gen"
  245. }
  246. ]
  247. },
  248. {
  249. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  250. "Details": []
  251. },
  252. {
  253. "Description": "Creates a copy of itself",
  254. "Details": [
  255. {
  256. "copy": "C:\\Users\\user\\AppData\\Roaming\\UIsPifekVUETTr.exe"
  257. }
  258. ]
  259. },
  260. {
  261. "Description": "Attempts to disable System Restore",
  262. "Details": []
  263. },
  264. {
  265. "Description": "Harvests information related to installed mail clients",
  266. "Details": [
  267. {
  268. "file": "C:\\Users\\user\\AppData\\Roaming\\Thunderbird\\profiles.ini"
  269. },
  270. {
  271. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
  272. },
  273. {
  274. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  275. },
  276. {
  277. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
  278. },
  279. {
  280. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  281. },
  282. {
  283. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
  284. },
  285. {
  286. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  287. },
  288. {
  289. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
  290. },
  291. {
  292. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  293. },
  294. {
  295. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
  296. },
  297. {
  298. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  299. },
  300. {
  301. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
  302. },
  303. {
  304. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
  305. },
  306. {
  307. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  308. },
  309. {
  310. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
  311. },
  312. {
  313. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
  314. },
  315. {
  316. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  317. }
  318. ]
  319. },
  320. {
  321. "Description": "Collects information to fingerprint the system",
  322. "Details": []
  323. }
  324. ]
  325.  
  326. [*] Started Service: [
  327. "VaultSvc"
  328. ]
  329.  
  330. [*] Executed Commands: [
  331. "schtasks.exe /Create /TN \"Updates\\UIsPifekVUETTr\" /XML \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp4CDA.tmp\"",
  332. "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe\"",
  333. "REG add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f",
  334. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  335. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  336. "C:\\Windows\\system32\\lsass.exe"
  337. ]
  338.  
  339. [*] Mutexes: [
  340. "Global\\CLR_CASOFF_MUTEX",
  341. "Local\\_!MSFTHISTORY!_",
  342. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  343. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  344. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
  345. "Global\\.net clr networking",
  346. "CicLoadWinStaWinSta0",
  347. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  348. "Global\\ADAP_WMI_ENTRY",
  349. "Global\\RefreshRA_Mutex",
  350. "Global\\RefreshRA_Mutex_Lib",
  351. "Global\\RefreshRA_Mutex_Flag"
  352. ]
  353.  
  354. [*] Modified Files: [
  355. "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
  356. "C:\\Users\\user\\AppData\\Roaming\\UIsPifekVUETTr.exe",
  357. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp4CDA.tmp",
  358. "C:\\Windows\\sysnative\\Tasks\\Updates\\UIsPifekVUETTr",
  359. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  360. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  361. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  362. "C:\\Users\\user\\AppData\\Roaming\\eAdobe\\eAdobe.exe",
  363. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  364. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  365. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  366. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  367. "\\??\\WMIDataDevice",
  368. "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
  369. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  370. ]
  371.  
  372. [*] Deleted Files: [
  373. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp4CDA.tmp",
  374. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1812.7057515",
  375. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1812.7057515",
  376. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1812.7057531",
  377. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  378. "C:\\Users\\user\\AppData\\Roaming\\eAdobe\\eAdobe.exe:Zone.Identifier"
  379. ]
  380.  
  381. [*] Modified Registry Keys: [
  382. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{BC740735-C23D-47F5-B288-6437B14C3923}\\Path",
  383. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{BC740735-C23D-47F5-B288-6437B14C3923}\\Hash",
  384. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Updates\\UIsPifekVUETTr\\Id",
  385. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Updates\\UIsPifekVUETTr\\Index",
  386. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{BC740735-C23D-47F5-B288-6437B14C3923}\\Triggers",
  387. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{BC740735-C23D-47F5-B288-6437B14C3923}\\DynamicInfo",
  388. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  389. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  390. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\eAdobe",
  392. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR",
  393. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RegAsm_RASAPI32",
  394. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\EnableFileTracing",
  395. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\EnableConsoleTracing",
  396. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\FileTracingMask",
  397. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\ConsoleTracingMask",
  398. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\MaxFileSize",
  399. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegAsm_RASAPI32\\FileDirectory",
  400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
  401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
  402. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-{00000000-0000-0000-0000-000000000000}",
  403. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dll[MofResourceName]",
  404. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.mui[MofResourceName]",
  405. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sys[ACPIMOFResource]",
  406. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
  407. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
  408. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
  409. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sys[MofResource]",
  410. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui[MofResource]",
  411. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sys[HDAudioMofName]",
  412. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui[HDAudioMofName]",
  413. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sys[PROCESSORWMI]",
  414. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.mui[PROCESSORWMI]",
  415. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYS[PortclsMof]",
  416. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.mui[PortclsMof]",
  417. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  418. ]
  419.  
  420. [*] Deleted Registry Keys: [
  421. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  422. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  423. ]
  424.  
  425. [*] DNS Communications: [
  426. {
  427. "type": "A",
  428. "request": "checkip.amazonaws.com",
  429. "answers": [
  430. {
  431. "data": "52.206.161.133",
  432. "type": "A"
  433. },
  434. {
  435. "data": "52.200.125.74",
  436. "type": "A"
  437. },
  438. {
  439. "data": "checkip.check-ip.aws.a2z.com",
  440. "type": "CNAME"
  441. },
  442. {
  443. "data": "52.6.79.229",
  444. "type": "A"
  445. },
  446. {
  447. "data": "checkip.us-east-1.prod.check-ip.aws.a2z.com",
  448. "type": "CNAME"
  449. },
  450. {
  451. "data": "34.233.102.38",
  452. "type": "A"
  453. },
  454. {
  455. "data": "52.202.139.131",
  456. "type": "A"
  457. },
  458. {
  459. "data": "18.211.215.84",
  460. "type": "A"
  461. }
  462. ]
  463. }
  464. ]
  465.  
  466. [*] Domains: [
  467. {
  468. "ip": "52.200.125.74",
  469. "domain": "checkip.amazonaws.com"
  470. }
  471. ]
  472.  
  473. [*] Network Communication - ICMP: []
  474.  
  475. [*] Network Communication - HTTP: [
  476. {
  477. "count": 2,
  478. "body": "",
  479. "uri": "http://checkip.amazonaws.com/",
  480. "user-agent": "",
  481. "method": "GET",
  482. "host": "checkip.amazonaws.com",
  483. "version": "1.1",
  484. "path": "/",
  485. "data": "GET / HTTP/1.1\r\nHost: checkip.amazonaws.com\r\nConnection: Keep-Alive\r\n\r\n",
  486. "port": 80
  487. }
  488. ]
  489.  
  490. [*] Network Communication - SMTP: []
  491.  
  492. [*] Network Communication - Hosts: []
  493.  
  494. [*] Network Communication - IRC: []
  495.  
  496. [*] Static Analysis: {
  497. "dotnet": {
  498. "customattrs": [],
  499. "assemblyinfo": {},
  500. "assemblyrefs": [],
  501. "typerefs": []
  502. },
  503. "pe": {
  504. "peid_signatures": null,
  505. "imports": [
  506. {
  507. "imports": [
  508. {
  509. "name": "_CorExeMain",
  510. "address": "0x402000"
  511. }
  512. ],
  513. "dll": "mscoree.dll"
  514. }
  515. ],
  516. "digital_signers": null,
  517. "exported_dll_name": null,
  518. "actual_checksum": "0x000e147c",
  519. "overlay": null,
  520. "imagebase": "0x00400000",
  521. "reported_checksum": "0x00000000",
  522. "icon_hash": null,
  523. "entrypoint": "0x00480b4e",
  524. "timestamp": "2019-07-01 07:17:42",
  525. "osversion": "4.0",
  526. "sections": [
  527. {
  528. "name": ".text",
  529. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  530. "virtual_address": "0x00002000",
  531. "size_of_data": "0x0007ec00",
  532. "entropy": "6.50",
  533. "raw_address": "0x00000200",
  534. "virtual_size": "0x0007eb54",
  535. "characteristics_raw": "0x60000020"
  536. },
  537. {
  538. "name": ".rsrc",
  539. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  540. "virtual_address": "0x00082000",
  541. "size_of_data": "0x0005ae00",
  542. "entropy": "3.29",
  543. "raw_address": "0x0007ee00",
  544. "virtual_size": "0x0005ad10",
  545. "characteristics_raw": "0x40000040"
  546. },
  547. {
  548. "name": ".reloc",
  549. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  550. "virtual_address": "0x000de000",
  551. "size_of_data": "0x00000200",
  552. "entropy": "0.08",
  553. "raw_address": "0x000d9c00",
  554. "virtual_size": "0x0000000c",
  555. "characteristics_raw": "0x42000040"
  556. }
  557. ],
  558. "resources": [],
  559. "dirents": [
  560. {
  561. "virtual_address": "0x00000000",
  562. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  563. "size": "0x00000000"
  564. },
  565. {
  566. "virtual_address": "0x00080b00",
  567. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  568. "size": "0x0000004b"
  569. },
  570. {
  571. "virtual_address": "0x00082000",
  572. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  573. "size": "0x0005ad10"
  574. },
  575. {
  576. "virtual_address": "0x00000000",
  577. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  578. "size": "0x00000000"
  579. },
  580. {
  581. "virtual_address": "0x00000000",
  582. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  583. "size": "0x00000000"
  584. },
  585. {
  586. "virtual_address": "0x000de000",
  587. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  588. "size": "0x0000000c"
  589. },
  590. {
  591. "virtual_address": "0x00000000",
  592. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  593. "size": "0x00000000"
  594. },
  595. {
  596. "virtual_address": "0x00000000",
  597. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  598. "size": "0x00000000"
  599. },
  600. {
  601. "virtual_address": "0x00000000",
  602. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  603. "size": "0x00000000"
  604. },
  605. {
  606. "virtual_address": "0x00000000",
  607. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  608. "size": "0x00000000"
  609. },
  610. {
  611. "virtual_address": "0x00000000",
  612. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  613. "size": "0x00000000"
  614. },
  615. {
  616. "virtual_address": "0x00000000",
  617. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  618. "size": "0x00000000"
  619. },
  620. {
  621. "virtual_address": "0x00002000",
  622. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  623. "size": "0x00000008"
  624. },
  625. {
  626. "virtual_address": "0x00000000",
  627. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  628. "size": "0x00000000"
  629. },
  630. {
  631. "virtual_address": "0x00002008",
  632. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  633. "size": "0x00000048"
  634. },
  635. {
  636. "virtual_address": "0x00000000",
  637. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  638. "size": "0x00000000"
  639. }
  640. ],
  641. "exports": [],
  642. "guest_signers": {},
  643. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  644. "icon_fuzzy": null,
  645. "icon": null,
  646. "pdbpath": null,
  647. "imported_dll_count": 1,
  648. "versioninfo": []
  649. }
  650. }
  651.  
  652. [*] Resolved APIs: [
  653. "advapi32.dll.RegOpenKeyExW",
  654. "advapi32.dll.RegQueryInfoKeyW",
  655. "advapi32.dll.RegEnumKeyExW",
  656. "advapi32.dll.RegEnumValueW",
  657. "advapi32.dll.RegCloseKey",
  658. "advapi32.dll.RegQueryValueExW",
  659. "kernel32.dll.QueryActCtxW",
  660. "shlwapi.dll.UrlIsW",
  661. "kernel32.dll.FlsAlloc",
  662. "kernel32.dll.FlsGetValue",
  663. "kernel32.dll.FlsSetValue",
  664. "kernel32.dll.FlsFree",
  665. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  666. "kernel32.dll.IsProcessorFeaturePresent",
  667. "msvcrt.dll._set_error_mode",
  668. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  669. "kernel32.dll.FindActCtxSectionStringW",
  670. "kernel32.dll.GetSystemWindowsDirectoryW",
  671. "mscoree.dll.GetProcessExecutableHeap",
  672. "mscorwks.dll._CorExeMain",
  673. "mscorwks.dll.GetCLRFunction",
  674. "advapi32.dll.RegisterTraceGuidsW",
  675. "advapi32.dll.UnregisterTraceGuids",
  676. "advapi32.dll.GetTraceLoggerHandle",
  677. "advapi32.dll.GetTraceEnableLevel",
  678. "advapi32.dll.GetTraceEnableFlags",
  679. "advapi32.dll.TraceEvent",
  680. "mscoree.dll.IEE",
  681. "mscorwks.dll.IEE",
  682. "mscoree.dll.GetStartupFlags",
  683. "mscoree.dll.GetHostConfigurationFile",
  684. "mscoree.dll.GetCORSystemDirectory",
  685. "ntdll.dll.RtlUnwind",
  686. "kernel32.dll.IsWow64Process",
  687. "advapi32.dll.AllocateAndInitializeSid",
  688. "advapi32.dll.OpenProcessToken",
  689. "advapi32.dll.GetTokenInformation",
  690. "advapi32.dll.InitializeAcl",
  691. "advapi32.dll.AddAccessAllowedAce",
  692. "advapi32.dll.FreeSid",
  693. "kernel32.dll.SetThreadStackGuarantee",
  694. "kernel32.dll.AddVectoredContinueHandler",
  695. "kernel32.dll.RemoveVectoredContinueHandler",
  696. "advapi32.dll.ConvertSidToStringSidW",
  697. "shell32.dll.SHGetFolderPathW",
  698. "kernel32.dll.FlushProcessWriteBuffers",
  699. "kernel32.dll.GetWriteWatch",
  700. "kernel32.dll.ResetWriteWatch",
  701. "kernel32.dll.CreateMemoryResourceNotification",
  702. "kernel32.dll.QueryMemoryResourceNotification",
  703. "ole32.dll.CoInitializeEx",
  704. "cryptbase.dll.SystemFunction036",
  705. "uxtheme.dll.ThemeInitApiHook",
  706. "user32.dll.IsProcessDPIAware",
  707. "ole32.dll.CoGetContextToken",
  708. "kernel32.dll.GetFullPathNameW",
  709. "kernel32.dll.GetVersionExW",
  710. "advapi32.dll.CryptAcquireContextA",
  711. "advapi32.dll.CryptReleaseContext",
  712. "advapi32.dll.CryptCreateHash",
  713. "advapi32.dll.CryptDestroyHash",
  714. "advapi32.dll.CryptHashData",
  715. "advapi32.dll.CryptGetHashParam",
  716. "advapi32.dll.CryptImportKey",
  717. "advapi32.dll.CryptExportKey",
  718. "advapi32.dll.CryptGenKey",
  719. "advapi32.dll.CryptGetKeyParam",
  720. "advapi32.dll.CryptDestroyKey",
  721. "advapi32.dll.CryptVerifySignatureA",
  722. "advapi32.dll.CryptSignHashA",
  723. "advapi32.dll.CryptGetProvParam",
  724. "advapi32.dll.CryptGetUserKey",
  725. "advapi32.dll.CryptEnumProvidersA",
  726. "mscoree.dll.GetMetaDataInternalInterface",
  727. "mscorwks.dll.GetMetaDataInternalInterface",
  728. "mscorjit.dll.getJit",
  729. "user32.dll.RegisterWindowMessageW",
  730. "user32.dll.GetSystemMetrics",
  731. "user32.dll.AdjustWindowRectEx",
  732. "kernel32.dll.GetCurrentProcess",
  733. "kernel32.dll.GetCurrentThread",
  734. "kernel32.dll.DuplicateHandle",
  735. "kernel32.dll.GetCurrentThreadId",
  736. "kernel32.dll.lstrlen",
  737. "kernel32.dll.lstrlenW",
  738. "kernel32.dll.GetModuleHandleW",
  739. "kernel32.dll.GetProcAddress",
  740. "user32.dll.DefWindowProcW",
  741. "gdi32.dll.GetStockObject",
  742. "kernel32.dll.GetUserDefaultUILanguage",
  743. "user32.dll.RegisterClassW",
  744. "ole32.dll.CoTaskMemAlloc",
  745. "ole32.dll.CoTaskMemFree",
  746. "user32.dll.CreateWindowExW",
  747. "user32.dll.SetWindowLongW",
  748. "user32.dll.GetWindowLongW",
  749. "user32.dll.CallWindowProcW",
  750. "user32.dll.GetClientRect",
  751. "user32.dll.GetWindowRect",
  752. "user32.dll.GetParent",
  753. "kernel32.dll.GetSystemDefaultLCID",
  754. "gdi32.dll.GetObjectW",
  755. "user32.dll.GetDC",
  756. "kernel32.dll.GetCurrentProcessId",
  757. "kernel32.dll.FindAtomW",
  758. "kernel32.dll.AddAtomW",
  759. "mscoree.dll.LoadLibraryShim",
  760. "gdiplus.dll.GdiplusStartup",
  761. "user32.dll.GetWindowInfo",
  762. "user32.dll.GetAncestor",
  763. "user32.dll.GetMonitorInfoA",
  764. "user32.dll.EnumDisplayMonitors",
  765. "user32.dll.EnumDisplayDevicesA",
  766. "gdi32.dll.ExtTextOutW",
  767. "gdi32.dll.GdiIsMetaPrintDC",
  768. "gdiplus.dll.GdipCreateFontFromLogfontW",
  769. "kernel32.dll.RegOpenKeyExW",
  770. "kernel32.dll.RegQueryInfoKeyA",
  771. "kernel32.dll.RegCloseKey",
  772. "kernel32.dll.RegCreateKeyExW",
  773. "kernel32.dll.RegQueryValueExW",
  774. "kernel32.dll.RegEnumValueW",
  775. "kernel32.dll.RegQueryInfoKeyW",
  776. "mscoree.dll.ND_RI2",
  777. "mscoree.dll.ND_RU1",
  778. "gdiplus.dll.GdipGetFontUnit",
  779. "gdiplus.dll.GdipGetFontSize",
  780. "gdiplus.dll.GdipGetFontStyle",
  781. "gdiplus.dll.GdipGetFamily",
  782. "user32.dll.ReleaseDC",
  783. "gdiplus.dll.GdipCreateFromHDC",
  784. "gdiplus.dll.GdipGetDpiY",
  785. "gdiplus.dll.GdipGetFontHeight",
  786. "gdiplus.dll.GdipGetEmHeight",
  787. "gdiplus.dll.GdipGetLineSpacing",
  788. "gdiplus.dll.GdipDeleteGraphics",
  789. "gdiplus.dll.GdipCreateFont",
  790. "gdiplus.dll.GdipDeleteFont",
  791. "ole32.dll.OleInitialize",
  792. "user32.dll.GetProcessWindowStation",
  793. "user32.dll.GetUserObjectInformationA",
  794. "kernel32.dll.SetConsoleCtrlHandler",
  795. "user32.dll.GetClassInfoW",
  796. "kernel32.dll.LoadLibraryW",
  797. "kernel32.dll.FreeLibrary",
  798. "user32.dll.SystemParametersInfoW",
  799. "user32.dll.GetSysColor",
  800. "kernel32.dll.SetErrorMode",
  801. "kernel32.dll.GetFileAttributesExW",
  802. "culture.dll.ConvertLangIdToCultureName",
  803. "gdiplus.dll.GdipLoadImageFromStream",
  804. "windowscodecs.dll.DllGetClassObject",
  805. "kernel32.dll.WerRegisterMemoryBlock",
  806. "gdiplus.dll.GdipImageForceValidation",
  807. "gdiplus.dll.GdipGetImageType",
  808. "gdiplus.dll.GdipGetImageRawFormat",
  809. "gdiplus.dll.GdipGetImageFlags",
  810. "gdiplus.dll.GdipImageGetFrameDimensionsCount",
  811. "kernel32.dll.LocalAlloc",
  812. "gdiplus.dll.GdipImageGetFrameDimensionsList",
  813. "kernel32.dll.LocalFree",
  814. "gdiplus.dll.GdipGetImageWidth",
  815. "gdiplus.dll.GdipGetImageHeight",
  816. "gdiplus.dll.GdipCreateBitmapFromScan0",
  817. "gdiplus.dll.GdipGetImagePixelFormat",
  818. "gdiplus.dll.GdipGetImageGraphicsContext",
  819. "gdiplus.dll.GdipGraphicsClear",
  820. "gdiplus.dll.GdipCreateImageAttributes",
  821. "gdiplus.dll.GdipSetImageAttributesColorKeys",
  822. "gdiplus.dll.GdipDrawImageRectRectI",
  823. "gdiplus.dll.GdipDisposeImageAttributes",
  824. "gdiplus.dll.GdipDisposeImage",
  825. "gdiplus.dll.GdipGetFamilyName",
  826. "gdi32.dll.CreateCompatibleDC",
  827. "gdi32.dll.GetCurrentObject",
  828. "gdi32.dll.SaveDC",
  829. "gdi32.dll.GetDeviceCaps",
  830. "gdi32.dll.CreateFontIndirectW",
  831. "gdi32.dll.SelectObject",
  832. "gdi32.dll.GetTextExtentPoint32W",
  833. "gdiplus.dll.GdipCreateStringFormat",
  834. "gdiplus.dll.GdipSetStringFormatAlign",
  835. "gdiplus.dll.GdipSetStringFormatLineAlign",
  836. "gdiplus.dll.GdipSetStringFormatHotkeyPrefix",
  837. "gdiplus.dll.GdipGetStringFormatFlags",
  838. "gdiplus.dll.GdipSetStringFormatFlags",
  839. "gdiplus.dll.GdipMeasureString",
  840. "gdiplus.dll.GdipDeleteStringFormat",
  841. "gdiplus.dll.GdipGetLogFontW",
  842. "mscoree.dll.ND_WU1",
  843. "gdi32.dll.GetTextMetricsW",
  844. "gdi32.dll.DeleteDC",
  845. "gdi32.dll.DeleteObject",
  846. "kernel32.dll.GlobalMemoryStatusEx",
  847. "kernel32.dll.SwitchToThread",
  848. "kernel32.dll.CloseHandle",
  849. "advapi32.dll.LookupPrivilegeValueW",
  850. "advapi32.dll.AdjustTokenPrivileges",
  851. "kernel32.dll.OpenProcess",
  852. "kernel32.dll.GetExitCodeProcess",
  853. "advapi32.dll.GetKernelObjectSecurity",
  854. "advapi32.dll.CreateWellKnownSid",
  855. "advapi32.dll.SetKernelObjectSecurity",
  856. "kernel32.dll.IsDebuggerPresent",
  857. "shfolder.dll.SHGetFolderPathW",
  858. "advapi32.dll.SetNamedSecurityInfoW",
  859. "ntmarta.dll.GetMartaExtensionInterface",
  860. "kernel32.dll.CopyFileW",
  861. "advapi32.dll.GetUserNameW",
  862. "kernel32.dll.SetFileAttributesW",
  863. "advapi32.dll.LsaClose",
  864. "advapi32.dll.LsaFreeMemory",
  865. "advapi32.dll.LsaOpenPolicy",
  866. "advapi32.dll.LsaLookupNames2",
  867. "mscoree.dll.ND_RI4",
  868. "advapi32.dll.LsaLookupSids",
  869. "kernel32.dll.GetTempPathW",
  870. "kernel32.dll.GetTempFileNameW",
  871. "kernel32.dll.CreateFileW",
  872. "kernel32.dll.GetFileType",
  873. "kernel32.dll.WriteFile",
  874. "kernel32.dll.RtlMoveMemory",
  875. "shell32.dll.ShellExecuteEx",
  876. "shell32.dll.ShellExecuteExW",
  877. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  878. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  879. "comctl32.dll.#332",
  880. "comctl32.dll.#386",
  881. "ole32.dll.CoWaitForMultipleHandles",
  882. "sechost.dll.LookupAccountNameLocalW",
  883. "advapi32.dll.LookupAccountSidW",
  884. "sechost.dll.LookupAccountSidLocalW",
  885. "cryptsp.dll.CryptAcquireContextW",
  886. "cryptsp.dll.CryptGenRandom",
  887. "ole32.dll.NdrOleInitializeExtension",
  888. "ole32.dll.CoGetClassObject",
  889. "ole32.dll.CoGetMarshalSizeMax",
  890. "ole32.dll.CoMarshalInterface",
  891. "ole32.dll.CoUnmarshalInterface",
  892. "ole32.dll.StringFromIID",
  893. "ole32.dll.CoGetPSClsid",
  894. "ole32.dll.CoCreateInstance",
  895. "ole32.dll.CoReleaseMarshalData",
  896. "ole32.dll.DcomChannelSetHResult",
  897. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  898. "kernel32.dll.DeleteFileW",
  899. "kernel32.dll.CreateProcessW",
  900. "kernel32.dll.GetThreadContext",
  901. "kernel32.dll.ReadProcessMemory",
  902. "kernel32.dll.VirtualAllocEx",
  903. "kernel32.dll.WriteProcessMemory",
  904. "kernel32.dll.SetThreadContext",
  905. "kernel32.dll.ResumeThread",
  906. "psapi.dll.EnumProcesses",
  907. "uxtheme.dll.IsAppThemed",
  908. "kernel32.dll.CreateActCtxA",
  909. "user32.dll.SetClassLongW",
  910. "user32.dll.PostMessageW",
  911. "user32.dll.UnregisterClassW",
  912. "kernel32.dll.DeleteAtom",
  913. "user32.dll.IsWindow",
  914. "user32.dll.DestroyWindow",
  915. "gdi32.dll.RestoreDC",
  916. "comctl32.dll.#321",
  917. "kernel32.dll.CreateActCtxW",
  918. "kernel32.dll.AddRefActCtx",
  919. "kernel32.dll.ReleaseActCtx",
  920. "kernel32.dll.ActivateActCtx",
  921. "kernel32.dll.DeactivateActCtx",
  922. "kernel32.dll.GetCurrentActCtx",
  923. "cryptsp.dll.CryptReleaseContext",
  924. "version.dll.GetFileVersionInfoSizeW",
  925. "version.dll.GetFileVersionInfoW",
  926. "version.dll.VerQueryValueW",
  927. "kernel32.dll.SortGetHandle",
  928. "kernel32.dll.SortCloseHandle",
  929. "sspicli.dll.GetUserNameExW",
  930. "advapi32.dll.WmiCloseBlock",
  931. "propsys.dll.PropVariantToVariant",
  932. "wbemcore.dll.Shutdown",
  933. "ole32.dll.CoUninitialize",
  934. "cryptsp.dll.CryptAcquireContextA",
  935. "cryptsp.dll.CryptImportKey",
  936. "cryptsp.dll.CryptCreateHash",
  937. "cryptsp.dll.CryptHashData",
  938. "cryptsp.dll.CryptVerifySignatureA",
  939. "cryptsp.dll.CryptDestroyHash",
  940. "cryptsp.dll.CryptDestroyKey",
  941. "bcrypt.dll.BCryptGetFipsAlgorithmMode",
  942. "kernel32.dll.GetEnvironmentVariableW",
  943. "ole32.dll.CreateBindCtx",
  944. "ole32.dll.CoGetObjectContext",
  945. "ole32.dll.MkParseDisplayName",
  946. "oleaut32.dll.#2",
  947. "oleaut32.dll.#6",
  948. "kernel32.dll.GetThreadPreferredUILanguages",
  949. "kernel32.dll.SetThreadPreferredUILanguages",
  950. "kernel32.dll.LocaleNameToLCID",
  951. "kernel32.dll.GetLocaleInfoEx",
  952. "kernel32.dll.LCIDToLocaleName",
  953. "kernel32.dll.GetSystemDefaultLocaleName",
  954. "ole32.dll.BindMoniker",
  955. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  956. "advapi32.dll.RegOpenKeyW",
  957. "advapi32.dll.RegEnumKeyW",
  958. "advapi32.dll.RegQueryValueW",
  959. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  960. "sxs.dll.SxsLookupClrGuid",
  961. "oleaut32.dll.#9",
  962. "oleaut32.dll.#4",
  963. "oleaut32.dll.#283",
  964. "oleaut32.dll.#284",
  965. "mscoree.dll.GetTokenForVTableEntry",
  966. "mscoree.dll.SetTargetForVTableEntry",
  967. "mscoree.dll.GetTargetForVTableEntry",
  968. "kernel32.dll.GetLastError",
  969. "oleaut32.dll.VariantInit",
  970. "oleaut32.dll.VariantClear",
  971. "oleaut32.dll.#7",
  972. "kernel32.dll.CreateEventW",
  973. "kernel32.dll.SetEvent",
  974. "ole32.dll.IIDFromString",
  975. "kernel32.dll.LoadLibraryA",
  976. "wminet_utils.dll.ResetSecurity",
  977. "wminet_utils.dll.SetSecurity",
  978. "wminet_utils.dll.BlessIWbemServices",
  979. "wminet_utils.dll.BlessIWbemServicesObject",
  980. "wminet_utils.dll.GetPropertyHandle",
  981. "wminet_utils.dll.WritePropertyValue",
  982. "wminet_utils.dll.Clone",
  983. "wminet_utils.dll.VerifyClientKey",
  984. "wminet_utils.dll.GetQualifierSet",
  985. "wminet_utils.dll.Get",
  986. "wminet_utils.dll.Put",
  987. "wminet_utils.dll.Delete",
  988. "wminet_utils.dll.GetNames",
  989. "wminet_utils.dll.BeginEnumeration",
  990. "wminet_utils.dll.Next",
  991. "wminet_utils.dll.EndEnumeration",
  992. "wminet_utils.dll.GetPropertyQualifierSet",
  993. "wminet_utils.dll.GetObjectText",
  994. "wminet_utils.dll.SpawnDerivedClass",
  995. "wminet_utils.dll.SpawnInstance",
  996. "wminet_utils.dll.CompareTo",
  997. "wminet_utils.dll.GetPropertyOrigin",
  998. "wminet_utils.dll.InheritsFrom",
  999. "wminet_utils.dll.GetMethod",
  1000. "wminet_utils.dll.PutMethod",
  1001. "wminet_utils.dll.DeleteMethod",
  1002. "wminet_utils.dll.BeginMethodEnumeration",
  1003. "wminet_utils.dll.NextMethod",
  1004. "wminet_utils.dll.EndMethodEnumeration",
  1005. "wminet_utils.dll.GetMethodQualifierSet",
  1006. "wminet_utils.dll.GetMethodOrigin",
  1007. "wminet_utils.dll.QualifierSet_Get",
  1008. "wminet_utils.dll.QualifierSet_Put",
  1009. "wminet_utils.dll.QualifierSet_Delete",
  1010. "wminet_utils.dll.QualifierSet_GetNames",
  1011. "wminet_utils.dll.QualifierSet_BeginEnumeration",
  1012. "wminet_utils.dll.QualifierSet_Next",
  1013. "wminet_utils.dll.QualifierSet_EndEnumeration",
  1014. "wminet_utils.dll.GetCurrentApartmentType",
  1015. "wminet_utils.dll.GetDemultiplexedStub",
  1016. "wminet_utils.dll.CreateInstanceEnumWmi",
  1017. "wminet_utils.dll.CreateClassEnumWmi",
  1018. "wminet_utils.dll.ExecQueryWmi",
  1019. "wminet_utils.dll.ExecNotificationQueryWmi",
  1020. "wminet_utils.dll.PutInstanceWmi",
  1021. "wminet_utils.dll.PutClassWmi",
  1022. "wminet_utils.dll.CloneEnumWbemClassObject",
  1023. "wminet_utils.dll.ConnectServerWmi",
  1024. "oleaut32.dll.#500",
  1025. "oleaut32.dll.SysStringLen",
  1026. "kernel32.dll.RtlZeroMemory",
  1027. "kernel32.dll.GetComputerNameW",
  1028. "dwmapi.dll.DwmIsCompositionEnabled",
  1029. "ntdll.dll.NtQuerySystemInformation",
  1030. "kernel32.dll.CreateDirectoryW",
  1031. "advapi32.dll.RegSetValueExW",
  1032. "kernel32.dll.GetStartupInfoW",
  1033. "kernel32.dll.CreateIoCompletionPort",
  1034. "kernel32.dll.PostQueuedCompletionStatus",
  1035. "ntdll.dll.NtQueryInformationThread",
  1036. "ntdll.dll.NtGetCurrentProcessorNumber",
  1037. "kernel32.dll.FindFirstFileW",
  1038. "kernel32.dll.FindClose",
  1039. "kernel32.dll.FindNextFileW",
  1040. "kernel32.dll.GetACP",
  1041. "kernel32.dll.UnmapViewOfFile",
  1042. "kernel32.dll.GetFileSize",
  1043. "kernel32.dll.ReadFile",
  1044. "oleaut32.dll.#204",
  1045. "oleaut32.dll.#203",
  1046. "mlang.dll.#112",
  1047. "wininet.dll.FindFirstUrlCacheEntryA",
  1048. "kernel32.dll.SetFileInformationByHandle",
  1049. "user32.dll.WaitForInputIdle",
  1050. "urlmon.dll.CreateUri",
  1051. "kernel32.dll.InitializeSRWLock",
  1052. "kernel32.dll.AcquireSRWLockExclusive",
  1053. "kernel32.dll.AcquireSRWLockShared",
  1054. "kernel32.dll.ReleaseSRWLockExclusive",
  1055. "kernel32.dll.ReleaseSRWLockShared",
  1056. "wininet.dll.FindNextUrlCacheEntryA",
  1057. "urlmon.dll.CreateIUriBuilder",
  1058. "urlmon.dll.IntlPercentEncodeNormalize",
  1059. "wininet.dll.FindCloseUrlCache",
  1060. "cryptsp.dll.CryptGetHashParam",
  1061. "vaultcli.dll.VaultEnumerateVaults",
  1062. "kernel32.dll.GetSystemTimeAsFileTime",
  1063. "user32.dll.GetLastInputInfo",
  1064. "ole32.dll.CoRegisterMessageFilter",
  1065. "user32.dll.PeekMessageW",
  1066. "user32.dll.WaitMessage",
  1067. "rasapi32.dll.RasEnumConnectionsW",
  1068. "rtutils.dll.TraceRegisterExA",
  1069. "rtutils.dll.TracePrintfExA",
  1070. "sechost.dll.OpenSCManagerW",
  1071. "sechost.dll.OpenServiceW",
  1072. "sechost.dll.QueryServiceStatus",
  1073. "sechost.dll.CloseServiceHandle",
  1074. "ws2_32.dll.WSAStartup",
  1075. "ws2_32.dll.WSASocketW",
  1076. "ws2_32.dll.setsockopt",
  1077. "ws2_32.dll.WSAEventSelect",
  1078. "ws2_32.dll.ioctlsocket",
  1079. "ws2_32.dll.closesocket",
  1080. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1081. "kernel32.dll.CreateFileMappingW",
  1082. "kernel32.dll.MapViewOfFile",
  1083. "kernel32.dll.VirtualQuery",
  1084. "kernel32.dll.ReleaseMutex",
  1085. "kernel32.dll.CreateMutexW",
  1086. "kernel32.dll.WaitForSingleObject",
  1087. "kernel32.dll.OpenMutexW",
  1088. "kernel32.dll.GetProcessTimes",
  1089. "ws2_32.dll.WSAIoctl",
  1090. "kernel32.dll.FormatMessageW",
  1091. "rasapi32.dll.RasConnectionNotificationW",
  1092. "advapi32.dll.RegOpenCurrentUser",
  1093. "sechost.dll.NotifyServiceStatusChangeA",
  1094. "advapi32.dll.RegNotifyChangeKeyValue",
  1095. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1096. "iphlpapi.dll.GetNetworkParams",
  1097. "dnsapi.dll.DnsQueryConfig",
  1098. "iphlpapi.dll.GetAdaptersAddresses",
  1099. "kernel32.dll.ResetEvent",
  1100. "iphlpapi.dll.GetIpInterfaceEntry",
  1101. "iphlpapi.dll.GetBestInterfaceEx",
  1102. "ws2_32.dll.inet_addr",
  1103. "ws2_32.dll.getaddrinfo",
  1104. "ws2_32.dll.freeaddrinfo",
  1105. "ws2_32.dll.WSAConnect",
  1106. "ws2_32.dll.send",
  1107. "ws2_32.dll.recv",
  1108. "ws2_32.dll.shutdown",
  1109. "user32.dll.IsWindowUnicode",
  1110. "user32.dll.GetMessageW",
  1111. "user32.dll.TranslateMessage",
  1112. "user32.dll.DispatchMessageW",
  1113. "fastprox.dll.DllGetClassObject",
  1114. "fastprox.dll.DllCanUnloadNow",
  1115. "oleaut32.dll.#289",
  1116. "oleaut32.dll.#287",
  1117. "oleaut32.dll.#288",
  1118. "oleaut32.dll.#290",
  1119. "oleaut32.dll.#285",
  1120. "wmi.dll.WmiQueryAllDataW",
  1121. "wmi.dll.WmiQuerySingleInstanceW",
  1122. "wmi.dll.WmiSetSingleItemW",
  1123. "wmi.dll.WmiSetSingleInstanceW",
  1124. "wmi.dll.WmiExecuteMethodW",
  1125. "wmi.dll.WmiNotificationRegistrationW",
  1126. "wmi.dll.WmiMofEnumerateResourcesW",
  1127. "wmi.dll.WmiFileHandleToInstanceNameW",
  1128. "wmi.dll.WmiDevInstToInstanceNameW",
  1129. "wmi.dll.WmiQueryGuidInformation",
  1130. "wmi.dll.WmiOpenBlock",
  1131. "wmi.dll.WmiCloseBlock",
  1132. "wmi.dll.WmiFreeBuffer",
  1133. "wmi.dll.WmiEnumerateGuids",
  1134. "oleaut32.dll.#286",
  1135. "advapi32.dll.InitiateSystemShutdownExW",
  1136. "rpcrt4.dll.UuidFromStringW",
  1137. "radarrs.dll.WdiDiagnosticModuleMain",
  1138. "radarrs.dll.WdiHandleInstance",
  1139. "radarrs.dll.WdiGetDiagnosticModuleInterfaceVersion",
  1140. "advapi32.dll.RegGetValueW",
  1141. "advapi32.dll.DuplicateToken",
  1142. "advapi32.dll.CheckTokenMembership",
  1143. "comctl32.dll.LoadIconWithScaleDown",
  1144. "ntdll.dll.RtlRunEncodeUnicodeString",
  1145. "ntdll.dll.RtlInitUnicodeString",
  1146. "ntdll.dll.RtlRunDecodeUnicodeString",
  1147. "duser.dll.InitGadgets",
  1148. "user32.dll.RegisterMessagePumpHook",
  1149. "uxtheme.dll.IsThemeActive",
  1150. "duser.dll.CreateGadget",
  1151. "duser.dll.SetGadgetMessageFilter",
  1152. "duser.dll.SetGadgetStyle",
  1153. "duser.dll.SetGadgetRootInfo",
  1154. "uxtheme.dll.GetThemeAppProperties",
  1155. "ole32.dll.CreateStreamOnHGlobal",
  1156. "xmllite.dll.CreateXmlReader",
  1157. "xmllite.dll.CreateXmlReaderInputWithEncodingName",
  1158. "uxtheme.dll.OpenThemeData",
  1159. "uxtheme.dll.GetThemeMargins",
  1160. "uxtheme.dll.GetThemeFont",
  1161. "uxtheme.dll.GetThemeColor",
  1162. "uxtheme.dll.GetThemeMetric",
  1163. "duser.dll.SetGadgetParent",
  1164. "duser.dll.GetDUserModule",
  1165. "duser.dll.FindStdColor",
  1166. "duser.dll.AttachWndProcW",
  1167. "comctl32.dll.RegisterClassNameW",
  1168. "duser.dll.GetGadgetRect",
  1169. "duser.dll.GetGadgetRgn",
  1170. "duser.dll.GetGadgetTicket",
  1171. "gdi32.dll.GetLayout",
  1172. "gdi32.dll.GdiRealizationInfo",
  1173. "gdi32.dll.FontIsLinked",
  1174. "gdi32.dll.GetTextFaceAliasW",
  1175. "gdi32.dll.GetFontAssocStatus",
  1176. "advapi32.dll.RegQueryValueExA",
  1177. "uxtheme.dll.EnableThemeDialogTexture",
  1178. "uxtheme.dll.GetThemeBool",
  1179. "duser.dll.InvalidateGadget",
  1180. "duser.dll.GetGadgetFocus",
  1181. "uxtheme.dll.GetThemeBackgroundContentRect",
  1182. "uxtheme.dll.GetThemeTextExtent",
  1183. "uxtheme.dll.GetThemeBackgroundExtent",
  1184. "uxtheme.dll.CloseThemeData",
  1185. "ole32.dll.CoRegisterInitializeSpy",
  1186. "ole32.dll.CoRevokeInitializeSpy",
  1187. "duser.dll.SetGadgetFocus",
  1188. "duser.dll.DUserSendEvent",
  1189. "duser.dll.SetGadgetRect",
  1190. "uxtheme.dll.#47",
  1191. "uxtheme.dll.BufferedPaintInit",
  1192. "uxtheme.dll.BeginBufferedPaint",
  1193. "uxtheme.dll.BufferedPaintRenderAnimation",
  1194. "uxtheme.dll.GetThemeTransitionDuration",
  1195. "uxtheme.dll.BeginBufferedAnimation",
  1196. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  1197. "uxtheme.dll.DrawThemeParentBackground",
  1198. "uxtheme.dll.DrawThemeBackground",
  1199. "uxtheme.dll.DrawThemeText",
  1200. "uxtheme.dll.EndBufferedAnimation",
  1201. "uxtheme.dll.GetBufferedPaintDC",
  1202. "uxtheme.dll.GetBufferedPaintTargetDC",
  1203. "uxtheme.dll.EndBufferedPaint",
  1204. "duser.dll.ForwardGadgetMessage",
  1205. "duser.dll.SetGadgetFocusEx",
  1206. "uxtheme.dll.BufferedPaintStopAllAnimations",
  1207. "uxtheme.dll.BufferedPaintUnInit",
  1208. "duser.dll.DisableContainerHwnd",
  1209. "duser.dll.DUserFlushMessages",
  1210. "duser.dll.DUserFlushDeferredMessages",
  1211. "duser.dll.DeleteHandle",
  1212. "user32.dll.UnregisterMessagePumpHook",
  1213. "psapi.dll.EnumProcessModules",
  1214. "psapi.dll.GetModuleBaseNameW",
  1215. "ole32.dll.CLSIDFromString",
  1216. "oleaut32.dll.#8",
  1217. "ole32.dll.CoGetCallContext"
  1218. ]
  1219.  
  1220. [*] Static Analysis: {
  1221. "dotnet": {
  1222. "customattrs": [],
  1223. "assemblyinfo": {},
  1224. "assemblyrefs": [],
  1225. "typerefs": []
  1226. },
  1227. "pe": {
  1228. "peid_signatures": null,
  1229. "imports": [
  1230. {
  1231. "imports": [
  1232. {
  1233. "name": "_CorExeMain",
  1234. "address": "0x402000"
  1235. }
  1236. ],
  1237. "dll": "mscoree.dll"
  1238. }
  1239. ],
  1240. "digital_signers": null,
  1241. "exported_dll_name": null,
  1242. "actual_checksum": "0x000e147c",
  1243. "overlay": null,
  1244. "imagebase": "0x00400000",
  1245. "reported_checksum": "0x00000000",
  1246. "icon_hash": null,
  1247. "entrypoint": "0x00480b4e",
  1248. "timestamp": "2019-07-01 07:17:42",
  1249. "osversion": "4.0",
  1250. "sections": [
  1251. {
  1252. "name": ".text",
  1253. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1254. "virtual_address": "0x00002000",
  1255. "size_of_data": "0x0007ec00",
  1256. "entropy": "6.50",
  1257. "raw_address": "0x00000200",
  1258. "virtual_size": "0x0007eb54",
  1259. "characteristics_raw": "0x60000020"
  1260. },
  1261. {
  1262. "name": ".rsrc",
  1263. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1264. "virtual_address": "0x00082000",
  1265. "size_of_data": "0x0005ae00",
  1266. "entropy": "3.29",
  1267. "raw_address": "0x0007ee00",
  1268. "virtual_size": "0x0005ad10",
  1269. "characteristics_raw": "0x40000040"
  1270. },
  1271. {
  1272. "name": ".reloc",
  1273. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1274. "virtual_address": "0x000de000",
  1275. "size_of_data": "0x00000200",
  1276. "entropy": "0.08",
  1277. "raw_address": "0x000d9c00",
  1278. "virtual_size": "0x0000000c",
  1279. "characteristics_raw": "0x42000040"
  1280. }
  1281. ],
  1282. "resources": [],
  1283. "dirents": [
  1284. {
  1285. "virtual_address": "0x00000000",
  1286. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1287. "size": "0x00000000"
  1288. },
  1289. {
  1290. "virtual_address": "0x00080b00",
  1291. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1292. "size": "0x0000004b"
  1293. },
  1294. {
  1295. "virtual_address": "0x00082000",
  1296. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1297. "size": "0x0005ad10"
  1298. },
  1299. {
  1300. "virtual_address": "0x00000000",
  1301. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1302. "size": "0x00000000"
  1303. },
  1304. {
  1305. "virtual_address": "0x00000000",
  1306. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1307. "size": "0x00000000"
  1308. },
  1309. {
  1310. "virtual_address": "0x000de000",
  1311. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1312. "size": "0x0000000c"
  1313. },
  1314. {
  1315. "virtual_address": "0x00000000",
  1316. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1317. "size": "0x00000000"
  1318. },
  1319. {
  1320. "virtual_address": "0x00000000",
  1321. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1322. "size": "0x00000000"
  1323. },
  1324. {
  1325. "virtual_address": "0x00000000",
  1326. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1327. "size": "0x00000000"
  1328. },
  1329. {
  1330. "virtual_address": "0x00000000",
  1331. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1332. "size": "0x00000000"
  1333. },
  1334. {
  1335. "virtual_address": "0x00000000",
  1336. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1337. "size": "0x00000000"
  1338. },
  1339. {
  1340. "virtual_address": "0x00000000",
  1341. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1342. "size": "0x00000000"
  1343. },
  1344. {
  1345. "virtual_address": "0x00002000",
  1346. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1347. "size": "0x00000008"
  1348. },
  1349. {
  1350. "virtual_address": "0x00000000",
  1351. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1352. "size": "0x00000000"
  1353. },
  1354. {
  1355. "virtual_address": "0x00002008",
  1356. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1357. "size": "0x00000048"
  1358. },
  1359. {
  1360. "virtual_address": "0x00000000",
  1361. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1362. "size": "0x00000000"
  1363. }
  1364. ],
  1365. "exports": [],
  1366. "guest_signers": {},
  1367. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1368. "icon_fuzzy": null,
  1369. "icon": null,
  1370. "pdbpath": null,
  1371. "imported_dll_count": 1,
  1372. "versioninfo": []
  1373. }
  1374. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!