API tools faq
paste
paladin316

Dridex_5ba24e8b0f0a14a63337efb878a5de48_exe.json

paladin316
Jun 19th, 2019
2,183
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.45 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 3.5
  5.  
  6. [*] File Name: "Dridex_5ba24e8b0f0a14a63337efb878a5de48.exe"
  7. [*] File Size: 382976
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows"
  9. [*] SHA256: "f6b3f63e3ed571f04f6952df71d9ab14254d411b95cebe0e663babd714f6b5cd"
  10. [*] MD5: "5ba24e8b0f0a14a63337efb878a5de48"
  11. [*] SHA1: "4a8628e12a8fa1b48a26f7d8d535eb960f26269b"
  12. [*] SHA512: "fde763a0c0f518a08080881fecc9900ba46e64e8b70c84bc79396600047866e979a13c96165338822412bbf326f30a2d5eb67337ce54bcf9849025001a1a93f2"
  13. [*] CRC32: "E02A1F78"
  14. [*] SSDEEP: "6144:DvY3EfH1glYk/YpfP5Mmq/pWi5F323Hr22m519ijWBLUSPeNnNK:7YQH1glX/Y9RKEGF323i2c9ijtpnNK"
  15.  
  16. [*] Process Execution: [
  17. "Dridex_5ba24e8b0f0a14a63337efb878a5de48.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "File has been identified by 8 Antiviruses on VirusTotal as malicious",
  27. "Details": [
  28. {
  29. "FireEye": "Generic.mg.5ba24e8b0f0a14a6"
  30. },
  31. {
  32. "Invincea": "heuristic"
  33. },
  34. {
  35. "Rising": "Malware.Heuristic.MLite(80%) (AI-LITE:7nwLBlNcYnVGTONeDVsDbw)"
  36. },
  37. {
  38. "Trapmine": "malicious.high.ml.score"
  39. },
  40. {
  41. "Microsoft": "Trojan:Win32/Gandcrab.AF"
  42. },
  43. {
  44. "Endgame": "malicious (high confidence)"
  45. },
  46. {
  47. "Acronis": "suspicious"
  48. },
  49. {
  50. "Cylance": "Unsafe"
  51. }
  52. ]
  53. }
  54. ]
  55.  
  56. [*] Started Service: []
  57.  
  58. [*] Executed Commands: []
  59.  
  60. [*] Mutexes: [
  61. "DBWinMutex"
  62. ]
  63.  
  64. [*] Modified Files: []
  65.  
  66. [*] Deleted Files: []
  67.  
  68. [*] Modified Registry Keys: []
  69.  
  70. [*] Deleted Registry Keys: []
  71.  
  72. [*] DNS Communications: []
  73.  
  74. [*] Domains: []
  75.  
  76. [*] Network Communication - ICMP: []
  77.  
  78. [*] Network Communication - HTTP: []
  79.  
  80. [*] Network Communication - SMTP: []
  81.  
  82. [*] Network Communication - Hosts: []
  83.  
  84. [*] Network Communication - IRC: []
  85.  
  86. [*] Static Analysis: {
  87. "pe": {
  88. "peid_signatures": null,
  89. "imports": [
  90. {
  91. "imports": [
  92. {
  93. "name": "lstrlenA",
  94. "address": "0x42d000"
  95. },
  96. {
  97. "name": "DebugActiveProcessStop",
  98. "address": "0x42d004"
  99. },
  100. {
  101. "name": "GetCPInfo",
  102. "address": "0x42d008"
  103. },
  104. {
  105. "name": "SetConsoleTextAttribute",
  106. "address": "0x42d00c"
  107. },
  108. {
  109. "name": "LockFile",
  110. "address": "0x42d010"
  111. },
  112. {
  113. "name": "ConnectNamedPipe",
  114. "address": "0x42d014"
  115. },
  116. {
  117. "name": "GetModuleHandleW",
  118. "address": "0x42d018"
  119. },
  120. {
  121. "name": "GetTickCount",
  122. "address": "0x42d01c"
  123. },
  124. {
  125. "name": "EnumTimeFormatsA",
  126. "address": "0x42d020"
  127. },
  128. {
  129. "name": "TerminateProcess",
  130. "address": "0x42d024"
  131. },
  132. {
  133. "name": "GetBinaryTypeW",
  134. "address": "0x42d028"
  135. },
  136. {
  137. "name": "Module32First",
  138. "address": "0x42d02c"
  139. },
  140. {
  141. "name": "LocalAlloc",
  142. "address": "0x42d030"
  143. },
  144. {
  145. "name": "GetNumberFormatW",
  146. "address": "0x42d034"
  147. },
  148. {
  149. "name": "VirtualProtect",
  150. "address": "0x42d038"
  151. },
  152. {
  153. "name": "CreateToolhelp32Snapshot",
  154. "address": "0x42d03c"
  155. },
  156. {
  157. "name": "PeekConsoleInputA",
  158. "address": "0x42d040"
  159. },
  160. {
  161. "name": "WinExec",
  162. "address": "0x42d044"
  163. },
  164. {
  165. "name": "CloseHandle",
  166. "address": "0x42d048"
  167. },
  168. {
  169. "name": "EncodePointer",
  170. "address": "0x42d04c"
  171. },
  172. {
  173. "name": "DecodePointer",
  174. "address": "0x42d050"
  175. },
  176. {
  177. "name": "IsDebuggerPresent",
  178. "address": "0x42d054"
  179. },
  180. {
  181. "name": "IsProcessorFeaturePresent",
  182. "address": "0x42d058"
  183. },
  184. {
  185. "name": "GetCommandLineA",
  186. "address": "0x42d05c"
  187. },
  188. {
  189. "name": "RaiseException",
  190. "address": "0x42d060"
  191. },
  192. {
  193. "name": "RtlUnwind",
  194. "address": "0x42d064"
  195. },
  196. {
  197. "name": "EnterCriticalSection",
  198. "address": "0x42d068"
  199. },
  200. {
  201. "name": "LeaveCriticalSection",
  202. "address": "0x42d06c"
  203. },
  204. {
  205. "name": "GetLastError",
  206. "address": "0x42d070"
  207. },
  208. {
  209. "name": "ExitProcess",
  210. "address": "0x42d074"
  211. },
  212. {
  213. "name": "GetModuleHandleExW",
  214. "address": "0x42d078"
  215. },
  216. {
  217. "name": "GetProcAddress",
  218. "address": "0x42d07c"
  219. },
  220. {
  221. "name": "AreFileApisANSI",
  222. "address": "0x42d080"
  223. },
  224. {
  225. "name": "MultiByteToWideChar",
  226. "address": "0x42d084"
  227. },
  228. {
  229. "name": "WideCharToMultiByte",
  230. "address": "0x42d088"
  231. },
  232. {
  233. "name": "HeapSize",
  234. "address": "0x42d08c"
  235. },
  236. {
  237. "name": "HeapFree",
  238. "address": "0x42d090"
  239. },
  240. {
  241. "name": "UnhandledExceptionFilter",
  242. "address": "0x42d094"
  243. },
  244. {
  245. "name": "SetUnhandledExceptionFilter",
  246. "address": "0x42d098"
  247. },
  248. {
  249. "name": "SetLastError",
  250. "address": "0x42d09c"
  251. },
  252. {
  253. "name": "InitializeCriticalSectionAndSpinCount",
  254. "address": "0x42d0a0"
  255. },
  256. {
  257. "name": "CreateEventW",
  258. "address": "0x42d0a4"
  259. },
  260. {
  261. "name": "Sleep",
  262. "address": "0x42d0a8"
  263. },
  264. {
  265. "name": "GetCurrentProcess",
  266. "address": "0x42d0ac"
  267. },
  268. {
  269. "name": "TlsAlloc",
  270. "address": "0x42d0b0"
  271. },
  272. {
  273. "name": "TlsGetValue",
  274. "address": "0x42d0b4"
  275. },
  276. {
  277. "name": "TlsSetValue",
  278. "address": "0x42d0b8"
  279. },
  280. {
  281. "name": "TlsFree",
  282. "address": "0x42d0bc"
  283. },
  284. {
  285. "name": "GetStartupInfoW",
  286. "address": "0x42d0c0"
  287. },
  288. {
  289. "name": "CreateSemaphoreW",
  290. "address": "0x42d0c4"
  291. },
  292. {
  293. "name": "HeapAlloc",
  294. "address": "0x42d0c8"
  295. },
  296. {
  297. "name": "GetCurrentThread",
  298. "address": "0x42d0cc"
  299. },
  300. {
  301. "name": "GetCurrentThreadId",
  302. "address": "0x42d0d0"
  303. },
  304. {
  305. "name": "GetProcessHeap",
  306. "address": "0x42d0d4"
  307. },
  308. {
  309. "name": "GetStdHandle",
  310. "address": "0x42d0d8"
  311. },
  312. {
  313. "name": "GetFileType",
  314. "address": "0x42d0dc"
  315. },
  316. {
  317. "name": "DeleteCriticalSection",
  318. "address": "0x42d0e0"
  319. },
  320. {
  321. "name": "GetModuleFileNameA",
  322. "address": "0x42d0e4"
  323. },
  324. {
  325. "name": "WriteFile",
  326. "address": "0x42d0e8"
  327. },
  328. {
  329. "name": "GetModuleFileNameW",
  330. "address": "0x42d0ec"
  331. },
  332. {
  333. "name": "QueryPerformanceCounter",
  334. "address": "0x42d0f0"
  335. },
  336. {
  337. "name": "GetCurrentProcessId",
  338. "address": "0x42d0f4"
  339. },
  340. {
  341. "name": "GetSystemTimeAsFileTime",
  342. "address": "0x42d0f8"
  343. },
  344. {
  345. "name": "GetEnvironmentStringsW",
  346. "address": "0x42d0fc"
  347. },
  348. {
  349. "name": "FreeEnvironmentStringsW",
  350. "address": "0x42d100"
  351. },
  352. {
  353. "name": "GetConsoleCP",
  354. "address": "0x42d104"
  355. },
  356. {
  357. "name": "GetConsoleMode",
  358. "address": "0x42d108"
  359. },
  360. {
  361. "name": "SetFilePointerEx",
  362. "address": "0x42d10c"
  363. },
  364. {
  365. "name": "IsValidCodePage",
  366. "address": "0x42d110"
  367. },
  368. {
  369. "name": "GetACP",
  370. "address": "0x42d114"
  371. },
  372. {
  373. "name": "GetOEMCP",
  374. "address": "0x42d118"
  375. },
  376. {
  377. "name": "FatalAppExitA",
  378. "address": "0x42d11c"
  379. },
  380. {
  381. "name": "SetConsoleCtrlHandler",
  382. "address": "0x42d120"
  383. },
  384. {
  385. "name": "FreeLibrary",
  386. "address": "0x42d124"
  387. },
  388. {
  389. "name": "LoadLibraryExW",
  390. "address": "0x42d128"
  391. },
  392. {
  393. "name": "HeapReAlloc",
  394. "address": "0x42d12c"
  395. },
  396. {
  397. "name": "GetDateFormatW",
  398. "address": "0x42d130"
  399. },
  400. {
  401. "name": "GetTimeFormatW",
  402. "address": "0x42d134"
  403. },
  404. {
  405. "name": "CompareStringW",
  406. "address": "0x42d138"
  407. },
  408. {
  409. "name": "LCMapStringW",
  410. "address": "0x42d13c"
  411. },
  412. {
  413. "name": "GetLocaleInfoW",
  414. "address": "0x42d140"
  415. },
  416. {
  417. "name": "IsValidLocale",
  418. "address": "0x42d144"
  419. },
  420. {
  421. "name": "GetUserDefaultLCID",
  422. "address": "0x42d148"
  423. },
  424. {
  425. "name": "EnumSystemLocalesW",
  426. "address": "0x42d14c"
  427. },
  428. {
  429. "name": "OutputDebugStringW",
  430. "address": "0x42d150"
  431. },
  432. {
  433. "name": "SetStdHandle",
  434. "address": "0x42d154"
  435. },
  436. {
  437. "name": "WriteConsoleW",
  438. "address": "0x42d158"
  439. },
  440. {
  441. "name": "GetStringTypeW",
  442. "address": "0x42d15c"
  443. },
  444. {
  445. "name": "FlushFileBuffers",
  446. "address": "0x42d160"
  447. },
  448. {
  449. "name": "ReadFile",
  450. "address": "0x42d164"
  451. },
  452. {
  453. "name": "ReadConsoleW",
  454. "address": "0x42d168"
  455. },
  456. {
  457. "name": "CreateFileW",
  458. "address": "0x42d16c"
  459. }
  460. ],
  461. "dll": "KERNEL32.dll"
  462. }
  463. ],
  464. "digital_signers": null,
  465. "exported_dll_name": "pifazoyis.exe",
  466. "actual_checksum": "0x00063afc",
  467. "overlay": null,
  468. "imagebase": "0x00400000",
  469. "reported_checksum": "0x00063afc",
  470. "icon_hash": null,
  471. "entrypoint": "0x00403ad3",
  472. "timestamp": "2018-05-25 13:40:06",
  473. "osversion": "5.1",
  474. "sections": [
  475. {
  476. "name": ".text",
  477. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  478. "virtual_address": "0x00001000",
  479. "size_of_data": "0x0002bc00",
  480. "entropy": "6.68",
  481. "raw_address": "0x00000400",
  482. "virtual_size": "0x0002babd",
  483. "characteristics_raw": "0x60000020"
  484. },
  485. {
  486. "name": ".rdata",
  487. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  488. "virtual_address": "0x0002d000",
  489. "size_of_data": "0x00029a00",
  490. "entropy": "6.40",
  491. "raw_address": "0x0002c000",
  492. "virtual_size": "0x00029874",
  493. "characteristics_raw": "0x40000040"
  494. },
  495. {
  496. "name": ".data",
  497. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  498. "virtual_address": "0x00057000",
  499. "size_of_data": "0x00001e00",
  500. "entropy": "3.10",
  501. "raw_address": "0x00055a00",
  502. "virtual_size": "0x00804d8c",
  503. "characteristics_raw": "0xc0000040"
  504. },
  505. {
  506. "name": ".rsrc",
  507. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  508. "virtual_address": "0x0085c000",
  509. "size_of_data": "0x00003e00",
  510. "entropy": "5.98",
  511. "raw_address": "0x00057800",
  512. "virtual_size": "0x00003c48",
  513. "characteristics_raw": "0x40000040"
  514. },
  515. {
  516. "name": ".reloc",
  517. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  518. "virtual_address": "0x00860000",
  519. "size_of_data": "0x00002200",
  520. "entropy": "6.64",
  521. "raw_address": "0x0005b600",
  522. "virtual_size": "0x000021b8",
  523. "characteristics_raw": "0x42000040"
  524. }
  525. ],
  526. "resources": [],
  527. "dirents": [
  528. {
  529. "virtual_address": "0x00055fe0",
  530. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  531. "size": "0x0000004d"
  532. },
  533. {
  534. "virtual_address": "0x00056030",
  535. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  536. "size": "0x00000028"
  537. },
  538. {
  539. "virtual_address": "0x0085c000",
  540. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  541. "size": "0x00003c48"
  542. },
  543. {
  544. "virtual_address": "0x00000000",
  545. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  546. "size": "0x00000000"
  547. },
  548. {
  549. "virtual_address": "0x00000000",
  550. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  551. "size": "0x00000000"
  552. },
  553. {
  554. "virtual_address": "0x00860000",
  555. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  556. "size": "0x000021b8"
  557. },
  558. {
  559. "virtual_address": "0x0002d1d0",
  560. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  561. "size": "0x00000038"
  562. },
  563. {
  564. "virtual_address": "0x00000000",
  565. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  566. "size": "0x00000000"
  567. },
  568. {
  569. "virtual_address": "0x00000000",
  570. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  571. "size": "0x00000000"
  572. },
  573. {
  574. "virtual_address": "0x00000000",
  575. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  576. "size": "0x00000000"
  577. },
  578. {
  579. "virtual_address": "0x00000000",
  580. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  581. "size": "0x00000000"
  582. },
  583. {
  584. "virtual_address": "0x00000000",
  585. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  586. "size": "0x00000000"
  587. },
  588. {
  589. "virtual_address": "0x0002d000",
  590. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  591. "size": "0x00000174"
  592. },
  593. {
  594. "virtual_address": "0x00000000",
  595. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  596. "size": "0x00000000"
  597. },
  598. {
  599. "virtual_address": "0x00000000",
  600. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  601. "size": "0x00000000"
  602. },
  603. {
  604. "virtual_address": "0x00000000",
  605. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  606. "size": "0x00000000"
  607. }
  608. ],
  609. "exports": [
  610. {
  611. "ordinal": 1,
  612. "name": "MyFunc165@@4",
  613. "address": "0x42c510"
  614. }
  615. ],
  616. "guest_signers": {},
  617. "imphash": "1b8771b49f2c2ae4944092109e3b9ea5",
  618. "icon_fuzzy": null,
  619. "icon": null,
  620. "pdbpath": "C:\\xewovozisuxasay_kug.pdb\\x00ntime\\crypt\\tmp_496950139\\bin\\pifazoyis.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\xab\\x00\\x00\\x00\\xab\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x87E\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@",
  621. "imported_dll_count": 1,
  622. "versioninfo": []
  623. }
  624. }
  625.  
  626. [*] Resolved APIs: [
  627. "kernel32.dll.FlsAlloc",
  628. "kernel32.dll.FlsFree",
  629. "kernel32.dll.FlsGetValue",
  630. "kernel32.dll.FlsSetValue",
  631. "kernel32.dll.InitializeCriticalSectionEx",
  632. "kernel32.dll.CreateEventExW",
  633. "kernel32.dll.CreateSemaphoreExW",
  634. "kernel32.dll.SetThreadStackGuarantee",
  635. "kernel32.dll.CreateThreadpoolTimer",
  636. "kernel32.dll.SetThreadpoolTimer",
  637. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  638. "kernel32.dll.CloseThreadpoolTimer",
  639. "kernel32.dll.CreateThreadpoolWait",
  640. "kernel32.dll.SetThreadpoolWait",
  641. "kernel32.dll.CloseThreadpoolWait",
  642. "kernel32.dll.FlushProcessWriteBuffers",
  643. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  644. "kernel32.dll.GetCurrentProcessorNumber",
  645. "kernel32.dll.GetLogicalProcessorInformation",
  646. "kernel32.dll.CreateSymbolicLinkW",
  647. "kernel32.dll.EnumSystemLocalesEx",
  648. "kernel32.dll.CompareStringEx",
  649. "kernel32.dll.GetDateFormatEx",
  650. "kernel32.dll.GetLocaleInfoEx",
  651. "kernel32.dll.GetTimeFormatEx",
  652. "kernel32.dll.GetUserDefaultLocaleName",
  653. "kernel32.dll.IsValidLocaleName",
  654. "kernel32.dll.LCMapStringEx",
  655. "kernel32.dll.GetTickCount64",
  656. "kernel32.dll.GlobalAlloc",
  657. "kernel32.dll.GetLastError",
  658. "kernel32.dll.Sleep",
  659. "kernel32.dll.CreateToolhelp32Snapshot",
  660. "kernel32.dll.Module32First",
  661. "kernel32.dll.CloseHandle",
  662. "kernel32.dll.LoadLibraryA",
  663. "kernel32.dll.VirtualAlloc",
  664. "kernel32.dll.VirtualProtect",
  665. "kernel32.dll.VirtualFree",
  666. "kernel32.dll.GetVersionExA",
  667. "kernel32.dll.TerminateProcess",
  668. "kernel32.dll.ExitProcess",
  669. "kernel32.dll.SetErrorMode",
  670. "kernel32.dll.FreeConsole",
  671. "kernel32.dll.OutputDebugStringW",
  672. "msvcr100.dll.atexit"
  673. ]
  674.  
  675. [*] Static Analysis: {
  676. "pe": {
  677. "peid_signatures": null,
  678. "imports": [
  679. {
  680. "imports": [
  681. {
  682. "name": "lstrlenA",
  683. "address": "0x42d000"
  684. },
  685. {
  686. "name": "DebugActiveProcessStop",
  687. "address": "0x42d004"
  688. },
  689. {
  690. "name": "GetCPInfo",
  691. "address": "0x42d008"
  692. },
  693. {
  694. "name": "SetConsoleTextAttribute",
  695. "address": "0x42d00c"
  696. },
  697. {
  698. "name": "LockFile",
  699. "address": "0x42d010"
  700. },
  701. {
  702. "name": "ConnectNamedPipe",
  703. "address": "0x42d014"
  704. },
  705. {
  706. "name": "GetModuleHandleW",
  707. "address": "0x42d018"
  708. },
  709. {
  710. "name": "GetTickCount",
  711. "address": "0x42d01c"
  712. },
  713. {
  714. "name": "EnumTimeFormatsA",
  715. "address": "0x42d020"
  716. },
  717. {
  718. "name": "TerminateProcess",
  719. "address": "0x42d024"
  720. },
  721. {
  722. "name": "GetBinaryTypeW",
  723. "address": "0x42d028"
  724. },
  725. {
  726. "name": "Module32First",
  727. "address": "0x42d02c"
  728. },
  729. {
  730. "name": "LocalAlloc",
  731. "address": "0x42d030"
  732. },
  733. {
  734. "name": "GetNumberFormatW",
  735. "address": "0x42d034"
  736. },
  737. {
  738. "name": "VirtualProtect",
  739. "address": "0x42d038"
  740. },
  741. {
  742. "name": "CreateToolhelp32Snapshot",
  743. "address": "0x42d03c"
  744. },
  745. {
  746. "name": "PeekConsoleInputA",
  747. "address": "0x42d040"
  748. },
  749. {
  750. "name": "WinExec",
  751. "address": "0x42d044"
  752. },
  753. {
  754. "name": "CloseHandle",
  755. "address": "0x42d048"
  756. },
  757. {
  758. "name": "EncodePointer",
  759. "address": "0x42d04c"
  760. },
  761. {
  762. "name": "DecodePointer",
  763. "address": "0x42d050"
  764. },
  765. {
  766. "name": "IsDebuggerPresent",
  767. "address": "0x42d054"
  768. },
  769. {
  770. "name": "IsProcessorFeaturePresent",
  771. "address": "0x42d058"
  772. },
  773. {
  774. "name": "GetCommandLineA",
  775. "address": "0x42d05c"
  776. },
  777. {
  778. "name": "RaiseException",
  779. "address": "0x42d060"
  780. },
  781. {
  782. "name": "RtlUnwind",
  783. "address": "0x42d064"
  784. },
  785. {
  786. "name": "EnterCriticalSection",
  787. "address": "0x42d068"
  788. },
  789. {
  790. "name": "LeaveCriticalSection",
  791. "address": "0x42d06c"
  792. },
  793. {
  794. "name": "GetLastError",
  795. "address": "0x42d070"
  796. },
  797. {
  798. "name": "ExitProcess",
  799. "address": "0x42d074"
  800. },
  801. {
  802. "name": "GetModuleHandleExW",
  803. "address": "0x42d078"
  804. },
  805. {
  806. "name": "GetProcAddress",
  807. "address": "0x42d07c"
  808. },
  809. {
  810. "name": "AreFileApisANSI",
  811. "address": "0x42d080"
  812. },
  813. {
  814. "name": "MultiByteToWideChar",
  815. "address": "0x42d084"
  816. },
  817. {
  818. "name": "WideCharToMultiByte",
  819. "address": "0x42d088"
  820. },
  821. {
  822. "name": "HeapSize",
  823. "address": "0x42d08c"
  824. },
  825. {
  826. "name": "HeapFree",
  827. "address": "0x42d090"
  828. },
  829. {
  830. "name": "UnhandledExceptionFilter",
  831. "address": "0x42d094"
  832. },
  833. {
  834. "name": "SetUnhandledExceptionFilter",
  835. "address": "0x42d098"
  836. },
  837. {
  838. "name": "SetLastError",
  839. "address": "0x42d09c"
  840. },
  841. {
  842. "name": "InitializeCriticalSectionAndSpinCount",
  843. "address": "0x42d0a0"
  844. },
  845. {
  846. "name": "CreateEventW",
  847. "address": "0x42d0a4"
  848. },
  849. {
  850. "name": "Sleep",
  851. "address": "0x42d0a8"
  852. },
  853. {
  854. "name": "GetCurrentProcess",
  855. "address": "0x42d0ac"
  856. },
  857. {
  858. "name": "TlsAlloc",
  859. "address": "0x42d0b0"
  860. },
  861. {
  862. "name": "TlsGetValue",
  863. "address": "0x42d0b4"
  864. },
  865. {
  866. "name": "TlsSetValue",
  867. "address": "0x42d0b8"
  868. },
  869. {
  870. "name": "TlsFree",
  871. "address": "0x42d0bc"
  872. },
  873. {
  874. "name": "GetStartupInfoW",
  875. "address": "0x42d0c0"
  876. },
  877. {
  878. "name": "CreateSemaphoreW",
  879. "address": "0x42d0c4"
  880. },
  881. {
  882. "name": "HeapAlloc",
  883. "address": "0x42d0c8"
  884. },
  885. {
  886. "name": "GetCurrentThread",
  887. "address": "0x42d0cc"
  888. },
  889. {
  890. "name": "GetCurrentThreadId",
  891. "address": "0x42d0d0"
  892. },
  893. {
  894. "name": "GetProcessHeap",
  895. "address": "0x42d0d4"
  896. },
  897. {
  898. "name": "GetStdHandle",
  899. "address": "0x42d0d8"
  900. },
  901. {
  902. "name": "GetFileType",
  903. "address": "0x42d0dc"
  904. },
  905. {
  906. "name": "DeleteCriticalSection",
  907. "address": "0x42d0e0"
  908. },
  909. {
  910. "name": "GetModuleFileNameA",
  911. "address": "0x42d0e4"
  912. },
  913. {
  914. "name": "WriteFile",
  915. "address": "0x42d0e8"
  916. },
  917. {
  918. "name": "GetModuleFileNameW",
  919. "address": "0x42d0ec"
  920. },
  921. {
  922. "name": "QueryPerformanceCounter",
  923. "address": "0x42d0f0"
  924. },
  925. {
  926. "name": "GetCurrentProcessId",
  927. "address": "0x42d0f4"
  928. },
  929. {
  930. "name": "GetSystemTimeAsFileTime",
  931. "address": "0x42d0f8"
  932. },
  933. {
  934. "name": "GetEnvironmentStringsW",
  935. "address": "0x42d0fc"
  936. },
  937. {
  938. "name": "FreeEnvironmentStringsW",
  939. "address": "0x42d100"
  940. },
  941. {
  942. "name": "GetConsoleCP",
  943. "address": "0x42d104"
  944. },
  945. {
  946. "name": "GetConsoleMode",
  947. "address": "0x42d108"
  948. },
  949. {
  950. "name": "SetFilePointerEx",
  951. "address": "0x42d10c"
  952. },
  953. {
  954. "name": "IsValidCodePage",
  955. "address": "0x42d110"
  956. },
  957. {
  958. "name": "GetACP",
  959. "address": "0x42d114"
  960. },
  961. {
  962. "name": "GetOEMCP",
  963. "address": "0x42d118"
  964. },
  965. {
  966. "name": "FatalAppExitA",
  967. "address": "0x42d11c"
  968. },
  969. {
  970. "name": "SetConsoleCtrlHandler",
  971. "address": "0x42d120"
  972. },
  973. {
  974. "name": "FreeLibrary",
  975. "address": "0x42d124"
  976. },
  977. {
  978. "name": "LoadLibraryExW",
  979. "address": "0x42d128"
  980. },
  981. {
  982. "name": "HeapReAlloc",
  983. "address": "0x42d12c"
  984. },
  985. {
  986. "name": "GetDateFormatW",
  987. "address": "0x42d130"
  988. },
  989. {
  990. "name": "GetTimeFormatW",
  991. "address": "0x42d134"
  992. },
  993. {
  994. "name": "CompareStringW",
  995. "address": "0x42d138"
  996. },
  997. {
  998. "name": "LCMapStringW",
  999. "address": "0x42d13c"
  1000. },
  1001. {
  1002. "name": "GetLocaleInfoW",
  1003. "address": "0x42d140"
  1004. },
  1005. {
  1006. "name": "IsValidLocale",
  1007. "address": "0x42d144"
  1008. },
  1009. {
  1010. "name": "GetUserDefaultLCID",
  1011. "address": "0x42d148"
  1012. },
  1013. {
  1014. "name": "EnumSystemLocalesW",
  1015. "address": "0x42d14c"
  1016. },
  1017. {
  1018. "name": "OutputDebugStringW",
  1019. "address": "0x42d150"
  1020. },
  1021. {
  1022. "name": "SetStdHandle",
  1023. "address": "0x42d154"
  1024. },
  1025. {
  1026. "name": "WriteConsoleW",
  1027. "address": "0x42d158"
  1028. },
  1029. {
  1030. "name": "GetStringTypeW",
  1031. "address": "0x42d15c"
  1032. },
  1033. {
  1034. "name": "FlushFileBuffers",
  1035. "address": "0x42d160"
  1036. },
  1037. {
  1038. "name": "ReadFile",
  1039. "address": "0x42d164"
  1040. },
  1041. {
  1042. "name": "ReadConsoleW",
  1043. "address": "0x42d168"
  1044. },
  1045. {
  1046. "name": "CreateFileW",
  1047. "address": "0x42d16c"
  1048. }
  1049. ],
  1050. "dll": "KERNEL32.dll"
  1051. }
  1052. ],
  1053. "digital_signers": null,
  1054. "exported_dll_name": "pifazoyis.exe",
  1055. "actual_checksum": "0x00063afc",
  1056. "overlay": null,
  1057. "imagebase": "0x00400000",
  1058. "reported_checksum": "0x00063afc",
  1059. "icon_hash": null,
  1060. "entrypoint": "0x00403ad3",
  1061. "timestamp": "2018-05-25 13:40:06",
  1062. "osversion": "5.1",
  1063. "sections": [
  1064. {
  1065. "name": ".text",
  1066. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1067. "virtual_address": "0x00001000",
  1068. "size_of_data": "0x0002bc00",
  1069. "entropy": "6.68",
  1070. "raw_address": "0x00000400",
  1071. "virtual_size": "0x0002babd",
  1072. "characteristics_raw": "0x60000020"
  1073. },
  1074. {
  1075. "name": ".rdata",
  1076. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1077. "virtual_address": "0x0002d000",
  1078. "size_of_data": "0x00029a00",
  1079. "entropy": "6.40",
  1080. "raw_address": "0x0002c000",
  1081. "virtual_size": "0x00029874",
  1082. "characteristics_raw": "0x40000040"
  1083. },
  1084. {
  1085. "name": ".data",
  1086. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1087. "virtual_address": "0x00057000",
  1088. "size_of_data": "0x00001e00",
  1089. "entropy": "3.10",
  1090. "raw_address": "0x00055a00",
  1091. "virtual_size": "0x00804d8c",
  1092. "characteristics_raw": "0xc0000040"
  1093. },
  1094. {
  1095. "name": ".rsrc",
  1096. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1097. "virtual_address": "0x0085c000",
  1098. "size_of_data": "0x00003e00",
  1099. "entropy": "5.98",
  1100. "raw_address": "0x00057800",
  1101. "virtual_size": "0x00003c48",
  1102. "characteristics_raw": "0x40000040"
  1103. },
  1104. {
  1105. "name": ".reloc",
  1106. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1107. "virtual_address": "0x00860000",
  1108. "size_of_data": "0x00002200",
  1109. "entropy": "6.64",
  1110. "raw_address": "0x0005b600",
  1111. "virtual_size": "0x000021b8",
  1112. "characteristics_raw": "0x42000040"
  1113. }
  1114. ],
  1115. "resources": [],
  1116. "dirents": [
  1117. {
  1118. "virtual_address": "0x00055fe0",
  1119. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1120. "size": "0x0000004d"
  1121. },
  1122. {
  1123. "virtual_address": "0x00056030",
  1124. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1125. "size": "0x00000028"
  1126. },
  1127. {
  1128. "virtual_address": "0x0085c000",
  1129. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1130. "size": "0x00003c48"
  1131. },
  1132. {
  1133. "virtual_address": "0x00000000",
  1134. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1135. "size": "0x00000000"
  1136. },
  1137. {
  1138. "virtual_address": "0x00000000",
  1139. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1140. "size": "0x00000000"
  1141. },
  1142. {
  1143. "virtual_address": "0x00860000",
  1144. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1145. "size": "0x000021b8"
  1146. },
  1147. {
  1148. "virtual_address": "0x0002d1d0",
  1149. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1150. "size": "0x00000038"
  1151. },
  1152. {
  1153. "virtual_address": "0x00000000",
  1154. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1155. "size": "0x00000000"
  1156. },
  1157. {
  1158. "virtual_address": "0x00000000",
  1159. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1160. "size": "0x00000000"
  1161. },
  1162. {
  1163. "virtual_address": "0x00000000",
  1164. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1165. "size": "0x00000000"
  1166. },
  1167. {
  1168. "virtual_address": "0x00000000",
  1169. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1170. "size": "0x00000000"
  1171. },
  1172. {
  1173. "virtual_address": "0x00000000",
  1174. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1175. "size": "0x00000000"
  1176. },
  1177. {
  1178. "virtual_address": "0x0002d000",
  1179. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1180. "size": "0x00000174"
  1181. },
  1182. {
  1183. "virtual_address": "0x00000000",
  1184. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1185. "size": "0x00000000"
  1186. },
  1187. {
  1188. "virtual_address": "0x00000000",
  1189. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1190. "size": "0x00000000"
  1191. },
  1192. {
  1193. "virtual_address": "0x00000000",
  1194. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1195. "size": "0x00000000"
  1196. }
  1197. ],
  1198. "exports": [
  1199. {
  1200. "ordinal": 1,
  1201. "name": "MyFunc165@@4",
  1202. "address": "0x42c510"
  1203. }
  1204. ],
  1205. "guest_signers": {},
  1206. "imphash": "1b8771b49f2c2ae4944092109e3b9ea5",
  1207. "icon_fuzzy": null,
  1208. "icon": null,
  1209. "pdbpath": "C:\\xewovozisuxasay_kug.pdb\\x00ntime\\crypt\\tmp_496950139\\bin\\pifazoyis.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\xab\\x00\\x00\\x00\\xab\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x87E\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@",
  1210. "imported_dll_count": 1,
  1211. "versioninfo": []
  1212. }
  1213. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!