API tools faq
paste
paladin316

rat_5bdae7fa758e88db953e5e1de0a539fd_exe_2019-07-03_13_30.json

paladin316
Jul 3rd, 2019
2,123
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.09 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "rat_5bdae7fa758e88db953e5e1de0a539fd.exe"
  7. [*] File Size: 606208
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "62a6113866c1891e15a5dac0afd62171066801d4c53bac6a8f080c99424e6305"
  10. [*] MD5: "5bdae7fa758e88db953e5e1de0a539fd"
  11. [*] SHA1: "7e8b4c3ba654181a32c77f5b86a169e72ae92f9c"
  12. [*] SHA512: "21f645e801ed73ac60efee00f1be3b651a8909649244423c4fed8da2c84eef5971c48b310e5060ff1000ee51ea3699b2098ed9052f9febdc888728124960d89a"
  13. [*] CRC32: "26B4E3BA"
  14. [*] SSDEEP: "12288:IbAsCzvHPD7KzDXYJB97twXEhJTt26xNUKjuxIGWpTfHK/t315:EAsC7vv+XYf97twXIjOWNfHs"
  15.  
  16. [*] Process Execution: [
  17. "rat_5bdae7fa758e88db953e5e1de0a539fd.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "rat_5bdae7fa758e88db953e5e1de0a539fd.exe (1204) called API CreateProcessInternalW 41019 times"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "FireEye": "Generic.mg.5bdae7fa758e88db"
  38. },
  39. {
  40. "McAfee": "Artemis!5BDAE7FA758E"
  41. },
  42. {
  43. "Invincea": "heuristic"
  44. },
  45. {
  46. "F-Prot": "W32/VBKrypt.SB.gen!Eldorado"
  47. },
  48. {
  49. "Symantec": "ML.Attribute.HighConfidence"
  50. },
  51. {
  52. "APEX": "Malicious"
  53. },
  54. {
  55. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  56. },
  57. {
  58. "AegisLab": "Trojan.Multi.Generic.4!c"
  59. },
  60. {
  61. "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.hm"
  62. },
  63. {
  64. "Trapmine": "suspicious.low.ml.score"
  65. },
  66. {
  67. "SentinelOne": "DFI - Malicious PE"
  68. },
  69. {
  70. "Cyren": "W32/VBKrypt.SB.gen!Eldorado"
  71. },
  72. {
  73. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  74. },
  75. {
  76. "Endgame": "malicious (moderate confidence)"
  77. },
  78. {
  79. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  80. },
  81. {
  82. "Cylance": "Unsafe"
  83. },
  84. {
  85. "ESET-NOD32": "a variant of Win32/Injector.EGJZ"
  86. },
  87. {
  88. "Rising": "Trojan.Wacatac!8.10C01 (CLOUD)"
  89. },
  90. {
  91. "Cybereason": "malicious.ba6541"
  92. },
  93. {
  94. "CrowdStrike": "win/malicious_confidence_90% (W)"
  95. }
  96. ]
  97. }
  98. ]
  99.  
  100. [*] Started Service: []
  101.  
  102. [*] Executed Commands: [
  103. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\rat_5bdae7fa758e88db953e5e1de0a539fd.exe\""
  104. ]
  105.  
  106. [*] Mutexes: []
  107.  
  108. [*] Modified Files: []
  109.  
  110. [*] Deleted Files: []
  111.  
  112. [*] Modified Registry Keys: []
  113.  
  114. [*] Deleted Registry Keys: []
  115.  
  116. [*] DNS Communications: []
  117.  
  118. [*] Domains: []
  119.  
  120. [*] Network Communication - ICMP: []
  121.  
  122. [*] Network Communication - HTTP: []
  123.  
  124. [*] Network Communication - SMTP: []
  125.  
  126. [*] Network Communication - Hosts: []
  127.  
  128. [*] Network Communication - IRC: []
  129.  
  130. [*] Static Analysis: {
  131. "pe": {
  132. "peid_signatures": null,
  133. "imports": [
  134. {
  135. "imports": [
  136. {
  137. "name": null,
  138. "address": "0x401000"
  139. },
  140. {
  141. "name": null,
  142. "address": "0x401004"
  143. },
  144. {
  145. "name": "MethCallEngine",
  146. "address": "0x401008"
  147. },
  148. {
  149. "name": null,
  150. "address": "0x40100c"
  151. },
  152. {
  153. "name": null,
  154. "address": "0x401010"
  155. },
  156. {
  157. "name": null,
  158. "address": "0x401014"
  159. },
  160. {
  161. "name": null,
  162. "address": "0x401018"
  163. },
  164. {
  165. "name": null,
  166. "address": "0x40101c"
  167. },
  168. {
  169. "name": null,
  170. "address": "0x401020"
  171. },
  172. {
  173. "name": null,
  174. "address": "0x401024"
  175. },
  176. {
  177. "name": null,
  178. "address": "0x401028"
  179. },
  180. {
  181. "name": null,
  182. "address": "0x40102c"
  183. },
  184. {
  185. "name": null,
  186. "address": "0x401030"
  187. },
  188. {
  189. "name": null,
  190. "address": "0x401034"
  191. },
  192. {
  193. "name": null,
  194. "address": "0x401038"
  195. },
  196. {
  197. "name": "EVENT_SINK_AddRef",
  198. "address": "0x40103c"
  199. },
  200. {
  201. "name": null,
  202. "address": "0x401040"
  203. },
  204. {
  205. "name": null,
  206. "address": "0x401044"
  207. },
  208. {
  209. "name": null,
  210. "address": "0x401048"
  211. },
  212. {
  213. "name": null,
  214. "address": "0x40104c"
  215. },
  216. {
  217. "name": null,
  218. "address": "0x401050"
  219. },
  220. {
  221. "name": "EVENT_SINK_Release",
  222. "address": "0x401054"
  223. },
  224. {
  225. "name": null,
  226. "address": "0x401058"
  227. },
  228. {
  229. "name": "EVENT_SINK_QueryInterface",
  230. "address": "0x40105c"
  231. },
  232. {
  233. "name": "__vbaExceptHandler",
  234. "address": "0x401060"
  235. },
  236. {
  237. "name": null,
  238. "address": "0x401064"
  239. },
  240. {
  241. "name": null,
  242. "address": "0x401068"
  243. },
  244. {
  245. "name": null,
  246. "address": "0x40106c"
  247. },
  248. {
  249. "name": null,
  250. "address": "0x401070"
  251. },
  252. {
  253. "name": null,
  254. "address": "0x401074"
  255. },
  256. {
  257. "name": null,
  258. "address": "0x401078"
  259. },
  260. {
  261. "name": null,
  262. "address": "0x40107c"
  263. },
  264. {
  265. "name": null,
  266. "address": "0x401080"
  267. },
  268. {
  269. "name": null,
  270. "address": "0x401084"
  271. },
  272. {
  273. "name": null,
  274. "address": "0x401088"
  275. },
  276. {
  277. "name": null,
  278. "address": "0x40108c"
  279. },
  280. {
  281. "name": null,
  282. "address": "0x401090"
  283. },
  284. {
  285. "name": null,
  286. "address": "0x401094"
  287. },
  288. {
  289. "name": null,
  290. "address": "0x401098"
  291. },
  292. {
  293. "name": null,
  294. "address": "0x40109c"
  295. },
  296. {
  297. "name": null,
  298. "address": "0x4010a0"
  299. }
  300. ],
  301. "dll": "MSVBVM60.DLL"
  302. }
  303. ],
  304. "digital_signers": null,
  305. "exported_dll_name": null,
  306. "actual_checksum": "0x00098038",
  307. "overlay": null,
  308. "imagebase": "0x00400000",
  309. "reported_checksum": "0x00098038",
  310. "icon_hash": null,
  311. "entrypoint": "0x004011a8",
  312. "timestamp": "2019-07-03 06:30:38",
  313. "osversion": "4.0",
  314. "sections": [
  315. {
  316. "name": ".text",
  317. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  318. "virtual_address": "0x00001000",
  319. "size_of_data": "0x00090000",
  320. "entropy": "5.46",
  321. "raw_address": "0x00001000",
  322. "virtual_size": "0x0008fb30",
  323. "characteristics_raw": "0x60000020"
  324. },
  325. {
  326. "name": ".data",
  327. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  328. "virtual_address": "0x00091000",
  329. "size_of_data": "0x00000000",
  330. "entropy": "0.00",
  331. "raw_address": "0x00000000",
  332. "virtual_size": "0x00002fc4",
  333. "characteristics_raw": "0xc0000040"
  334. },
  335. {
  336. "name": ".rsrc",
  337. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  338. "virtual_address": "0x00094000",
  339. "size_of_data": "0x00003000",
  340. "entropy": "4.45",
  341. "raw_address": "0x00091000",
  342. "virtual_size": "0x00002ea8",
  343. "characteristics_raw": "0x40000040"
  344. }
  345. ],
  346. "resources": [],
  347. "dirents": [
  348. {
  349. "virtual_address": "0x00000000",
  350. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  351. "size": "0x00000000"
  352. },
  353. {
  354. "virtual_address": "0x000909e4",
  355. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  356. "size": "0x00000028"
  357. },
  358. {
  359. "virtual_address": "0x00094000",
  360. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  361. "size": "0x00002ea8"
  362. },
  363. {
  364. "virtual_address": "0x00000000",
  365. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  366. "size": "0x00000000"
  367. },
  368. {
  369. "virtual_address": "0x00000000",
  370. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  371. "size": "0x00000000"
  372. },
  373. {
  374. "virtual_address": "0x00000000",
  375. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  376. "size": "0x00000000"
  377. },
  378. {
  379. "virtual_address": "0x00000000",
  380. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  381. "size": "0x00000000"
  382. },
  383. {
  384. "virtual_address": "0x00000000",
  385. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  386. "size": "0x00000000"
  387. },
  388. {
  389. "virtual_address": "0x00000000",
  390. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  391. "size": "0x00000000"
  392. },
  393. {
  394. "virtual_address": "0x00000000",
  395. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  396. "size": "0x00000000"
  397. },
  398. {
  399. "virtual_address": "0x00000000",
  400. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  401. "size": "0x00000000"
  402. },
  403. {
  404. "virtual_address": "0x00000220",
  405. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  406. "size": "0x00000020"
  407. },
  408. {
  409. "virtual_address": "0x00001000",
  410. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  411. "size": "0x000000a8"
  412. },
  413. {
  414. "virtual_address": "0x00000000",
  415. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  416. "size": "0x00000000"
  417. },
  418. {
  419. "virtual_address": "0x00000000",
  420. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  421. "size": "0x00000000"
  422. },
  423. {
  424. "virtual_address": "0x00000000",
  425. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  426. "size": "0x00000000"
  427. }
  428. ],
  429. "exports": [],
  430. "guest_signers": {},
  431. "imphash": "a3b026fe9ab66fe30f185836f6068c4f",
  432. "icon_fuzzy": null,
  433. "icon": null,
  434. "pdbpath": null,
  435. "imported_dll_count": 1,
  436. "versioninfo": []
  437. }
  438. }
  439.  
  440. [*] Resolved APIs: [
  441. "cryptbase.dll.SystemFunction036",
  442. "uxtheme.dll.ThemeInitApiHook",
  443. "user32.dll.IsProcessDPIAware",
  444. "oleaut32.dll.OleLoadPictureEx",
  445. "oleaut32.dll.DispCallFunc",
  446. "oleaut32.dll.LoadTypeLibEx",
  447. "oleaut32.dll.UnRegisterTypeLib",
  448. "oleaut32.dll.CreateTypeLib2",
  449. "oleaut32.dll.VarDateFromUdate",
  450. "oleaut32.dll.VarUdateFromDate",
  451. "oleaut32.dll.GetAltMonthNames",
  452. "oleaut32.dll.VarNumFromParseNum",
  453. "oleaut32.dll.VarParseNumFromStr",
  454. "oleaut32.dll.VarDecFromR4",
  455. "oleaut32.dll.VarDecFromR8",
  456. "oleaut32.dll.VarDecFromDate",
  457. "oleaut32.dll.VarDecFromI4",
  458. "oleaut32.dll.VarDecFromCy",
  459. "oleaut32.dll.VarR4FromDec",
  460. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  461. "oleaut32.dll.GetRecordInfoFromGuids",
  462. "oleaut32.dll.SafeArrayGetRecordInfo",
  463. "oleaut32.dll.SafeArraySetRecordInfo",
  464. "oleaut32.dll.SafeArrayGetIID",
  465. "oleaut32.dll.SafeArraySetIID",
  466. "oleaut32.dll.SafeArrayCopyData",
  467. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  468. "oleaut32.dll.SafeArrayCreateEx",
  469. "oleaut32.dll.VarFormat",
  470. "oleaut32.dll.VarFormatDateTime",
  471. "oleaut32.dll.VarFormatNumber",
  472. "oleaut32.dll.VarFormatPercent",
  473. "oleaut32.dll.VarFormatCurrency",
  474. "oleaut32.dll.VarWeekdayName",
  475. "oleaut32.dll.VarMonthName",
  476. "oleaut32.dll.VarAdd",
  477. "oleaut32.dll.VarAnd",
  478. "oleaut32.dll.VarCat",
  479. "oleaut32.dll.VarDiv",
  480. "oleaut32.dll.VarEqv",
  481. "oleaut32.dll.VarIdiv",
  482. "oleaut32.dll.VarImp",
  483. "oleaut32.dll.VarMod",
  484. "oleaut32.dll.VarMul",
  485. "oleaut32.dll.VarOr",
  486. "oleaut32.dll.VarPow",
  487. "oleaut32.dll.VarSub",
  488. "oleaut32.dll.VarXor",
  489. "oleaut32.dll.VarAbs",
  490. "oleaut32.dll.VarFix",
  491. "oleaut32.dll.VarInt",
  492. "oleaut32.dll.VarNeg",
  493. "oleaut32.dll.VarNot",
  494. "oleaut32.dll.VarRound",
  495. "oleaut32.dll.VarCmp",
  496. "oleaut32.dll.VarDecAdd",
  497. "oleaut32.dll.VarDecCmp",
  498. "oleaut32.dll.VarBstrCat",
  499. "oleaut32.dll.VarCyMulI4",
  500. "oleaut32.dll.VarBstrCmp",
  501. "ole32.dll.CoCreateInstanceEx",
  502. "ole32.dll.CLSIDFromProgIDEx",
  503. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  504. "user32.dll.GetSystemMetrics",
  505. "user32.dll.MonitorFromWindow",
  506. "user32.dll.MonitorFromRect",
  507. "user32.dll.MonitorFromPoint",
  508. "user32.dll.EnumDisplayMonitors",
  509. "user32.dll.GetMonitorInfoA",
  510. "dwmapi.dll.DwmIsCompositionEnabled",
  511. "gdi32.dll.GetLayout",
  512. "gdi32.dll.GdiRealizationInfo",
  513. "gdi32.dll.FontIsLinked",
  514. "advapi32.dll.RegOpenKeyExW",
  515. "advapi32.dll.RegQueryInfoKeyW",
  516. "gdi32.dll.GetTextFaceAliasW",
  517. "advapi32.dll.RegEnumValueW",
  518. "advapi32.dll.RegCloseKey",
  519. "advapi32.dll.RegQueryValueExW",
  520. "gdi32.dll.GetFontAssocStatus",
  521. "advapi32.dll.RegQueryValueExA",
  522. "advapi32.dll.RegEnumKeyExW",
  523. "gdi32.dll.GdiIsMetaPrintDC",
  524. "kernel32.dll.NlsGetCacheUpdateCount",
  525. "kernel32.dll.GetCalendarInfoW",
  526. "kernel32.dll.GetTickCount",
  527. "kernel32.dll.Sleep",
  528. "user32.dll.GetCursorPos",
  529. "user32.dll.EnumWindows",
  530. "kernel32.dll.SetErrorMode",
  531. "kernel32.dll.SetLastError",
  532. "kernel32.dll.VirtualAllocEx",
  533. "kernel32.dll.CloseHandle",
  534. "shell32.dll.ShellExecuteW",
  535. "kernel32.dll.WriteFile",
  536. "kernel32.dll.UnmapViewOfFile",
  537. "kernel32.dll.CreateFileW",
  538. "kernel32.dll.TerminateProcess",
  539. "kernel32.dll.VirtualProtectEx",
  540. "kernel32.dll.CreateProcessInternalW",
  541. "kernel32.dll.GetTempPathW",
  542. "kernel32.dll.GetLongPathNameW",
  543. "kernel32.dll.GetFileSize",
  544. "kernel32.dll.ReadFile",
  545. "ntdll.dll.NtProtectVirtualMemory",
  546. "kernel32.dll.GetCommandLineW"
  547. ]
  548.  
  549. [*] Static Analysis: {
  550. "pe": {
  551. "peid_signatures": null,
  552. "imports": [
  553. {
  554. "imports": [
  555. {
  556. "name": null,
  557. "address": "0x401000"
  558. },
  559. {
  560. "name": null,
  561. "address": "0x401004"
  562. },
  563. {
  564. "name": "MethCallEngine",
  565. "address": "0x401008"
  566. },
  567. {
  568. "name": null,
  569. "address": "0x40100c"
  570. },
  571. {
  572. "name": null,
  573. "address": "0x401010"
  574. },
  575. {
  576. "name": null,
  577. "address": "0x401014"
  578. },
  579. {
  580. "name": null,
  581. "address": "0x401018"
  582. },
  583. {
  584. "name": null,
  585. "address": "0x40101c"
  586. },
  587. {
  588. "name": null,
  589. "address": "0x401020"
  590. },
  591. {
  592. "name": null,
  593. "address": "0x401024"
  594. },
  595. {
  596. "name": null,
  597. "address": "0x401028"
  598. },
  599. {
  600. "name": null,
  601. "address": "0x40102c"
  602. },
  603. {
  604. "name": null,
  605. "address": "0x401030"
  606. },
  607. {
  608. "name": null,
  609. "address": "0x401034"
  610. },
  611. {
  612. "name": null,
  613. "address": "0x401038"
  614. },
  615. {
  616. "name": "EVENT_SINK_AddRef",
  617. "address": "0x40103c"
  618. },
  619. {
  620. "name": null,
  621. "address": "0x401040"
  622. },
  623. {
  624. "name": null,
  625. "address": "0x401044"
  626. },
  627. {
  628. "name": null,
  629. "address": "0x401048"
  630. },
  631. {
  632. "name": null,
  633. "address": "0x40104c"
  634. },
  635. {
  636. "name": null,
  637. "address": "0x401050"
  638. },
  639. {
  640. "name": "EVENT_SINK_Release",
  641. "address": "0x401054"
  642. },
  643. {
  644. "name": null,
  645. "address": "0x401058"
  646. },
  647. {
  648. "name": "EVENT_SINK_QueryInterface",
  649. "address": "0x40105c"
  650. },
  651. {
  652. "name": "__vbaExceptHandler",
  653. "address": "0x401060"
  654. },
  655. {
  656. "name": null,
  657. "address": "0x401064"
  658. },
  659. {
  660. "name": null,
  661. "address": "0x401068"
  662. },
  663. {
  664. "name": null,
  665. "address": "0x40106c"
  666. },
  667. {
  668. "name": null,
  669. "address": "0x401070"
  670. },
  671. {
  672. "name": null,
  673. "address": "0x401074"
  674. },
  675. {
  676. "name": null,
  677. "address": "0x401078"
  678. },
  679. {
  680. "name": null,
  681. "address": "0x40107c"
  682. },
  683. {
  684. "name": null,
  685. "address": "0x401080"
  686. },
  687. {
  688. "name": null,
  689. "address": "0x401084"
  690. },
  691. {
  692. "name": null,
  693. "address": "0x401088"
  694. },
  695. {
  696. "name": null,
  697. "address": "0x40108c"
  698. },
  699. {
  700. "name": null,
  701. "address": "0x401090"
  702. },
  703. {
  704. "name": null,
  705. "address": "0x401094"
  706. },
  707. {
  708. "name": null,
  709. "address": "0x401098"
  710. },
  711. {
  712. "name": null,
  713. "address": "0x40109c"
  714. },
  715. {
  716. "name": null,
  717. "address": "0x4010a0"
  718. }
  719. ],
  720. "dll": "MSVBVM60.DLL"
  721. }
  722. ],
  723. "digital_signers": null,
  724. "exported_dll_name": null,
  725. "actual_checksum": "0x00098038",
  726. "overlay": null,
  727. "imagebase": "0x00400000",
  728. "reported_checksum": "0x00098038",
  729. "icon_hash": null,
  730. "entrypoint": "0x004011a8",
  731. "timestamp": "2019-07-03 06:30:38",
  732. "osversion": "4.0",
  733. "sections": [
  734. {
  735. "name": ".text",
  736. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  737. "virtual_address": "0x00001000",
  738. "size_of_data": "0x00090000",
  739. "entropy": "5.46",
  740. "raw_address": "0x00001000",
  741. "virtual_size": "0x0008fb30",
  742. "characteristics_raw": "0x60000020"
  743. },
  744. {
  745. "name": ".data",
  746. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  747. "virtual_address": "0x00091000",
  748. "size_of_data": "0x00000000",
  749. "entropy": "0.00",
  750. "raw_address": "0x00000000",
  751. "virtual_size": "0x00002fc4",
  752. "characteristics_raw": "0xc0000040"
  753. },
  754. {
  755. "name": ".rsrc",
  756. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  757. "virtual_address": "0x00094000",
  758. "size_of_data": "0x00003000",
  759. "entropy": "4.45",
  760. "raw_address": "0x00091000",
  761. "virtual_size": "0x00002ea8",
  762. "characteristics_raw": "0x40000040"
  763. }
  764. ],
  765. "resources": [],
  766. "dirents": [
  767. {
  768. "virtual_address": "0x00000000",
  769. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  770. "size": "0x00000000"
  771. },
  772. {
  773. "virtual_address": "0x000909e4",
  774. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  775. "size": "0x00000028"
  776. },
  777. {
  778. "virtual_address": "0x00094000",
  779. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  780. "size": "0x00002ea8"
  781. },
  782. {
  783. "virtual_address": "0x00000000",
  784. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  785. "size": "0x00000000"
  786. },
  787. {
  788. "virtual_address": "0x00000000",
  789. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  790. "size": "0x00000000"
  791. },
  792. {
  793. "virtual_address": "0x00000000",
  794. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  795. "size": "0x00000000"
  796. },
  797. {
  798. "virtual_address": "0x00000000",
  799. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  800. "size": "0x00000000"
  801. },
  802. {
  803. "virtual_address": "0x00000000",
  804. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  805. "size": "0x00000000"
  806. },
  807. {
  808. "virtual_address": "0x00000000",
  809. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  810. "size": "0x00000000"
  811. },
  812. {
  813. "virtual_address": "0x00000000",
  814. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  815. "size": "0x00000000"
  816. },
  817. {
  818. "virtual_address": "0x00000000",
  819. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  820. "size": "0x00000000"
  821. },
  822. {
  823. "virtual_address": "0x00000220",
  824. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  825. "size": "0x00000020"
  826. },
  827. {
  828. "virtual_address": "0x00001000",
  829. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  830. "size": "0x000000a8"
  831. },
  832. {
  833. "virtual_address": "0x00000000",
  834. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  835. "size": "0x00000000"
  836. },
  837. {
  838. "virtual_address": "0x00000000",
  839. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  840. "size": "0x00000000"
  841. },
  842. {
  843. "virtual_address": "0x00000000",
  844. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  845. "size": "0x00000000"
  846. }
  847. ],
  848. "exports": [],
  849. "guest_signers": {},
  850. "imphash": "a3b026fe9ab66fe30f185836f6068c4f",
  851. "icon_fuzzy": null,
  852. "icon": null,
  853. "pdbpath": null,
  854. "imported_dll_count": 1,
  855. "versioninfo": []
  856. }
  857. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!