API tools faq
paste
paladin316

Exes_cb95a8fc3e50377b222be0289b90a0f4_exe_2019-07-01_05_30.json

paladin316
Jul 1st, 2019
2,246
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 52.47 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Small"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_cb95a8fc3e50377b222be0289b90a0f4.exe"
  7. [*] File Size: 355280
  8. [*] File Type: "MS-DOS executable, MZ for MS-DOS"
  9. [*] SHA256: "31739ac593945cb154bb410bcaee57a2384c0aa69e097eca8c8c14244fb4f307"
  10. [*] MD5: "cb95a8fc3e50377b222be0289b90a0f4"
  11. [*] SHA1: "c3c60e075ec892eff9be1d79541d657c4e13093d"
  12. [*] SHA512: "4a68ba84b5c85d45a1a9161ac3a5a2d49be4ef9aa417ce7e1bd8b98169f0ea3ac1f9f1e9c9ec12ffb2487286cfebbb877a3970b0ef34e908b7e7d4e7afa9a91d"
  13. [*] CRC32: "BE826987"
  14. [*] SSDEEP: "6144:YRqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4y1QPf:cqmpplpGoGL3etQoMiXM8gxf/Sj4yQf"
  15.  
  16. [*] Process Execution: [
  17. "Exes_cb95a8fc3e50377b222be0289b90a0f4.exe",
  18. "cmd.exe",
  19. "chrome.exe",
  20. "lncom.exe",
  21. "fservice.exe",
  22. "services.exe",
  23. "net.exe",
  24. "net1.exe",
  25. "net.exe",
  26. "net1.exe",
  27. "cmd.exe",
  28. "cmd.exe"
  29. ]
  30.  
  31. [*] Signatures Detected: [
  32. {
  33. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  34. "Details": [
  35. {
  36. "IP": "66.218.85.52:25"
  37. }
  38. ]
  39. },
  40. {
  41. "Description": "Creates RWX memory",
  42. "Details": []
  43. },
  44. {
  45. "Description": "Starts servers listening on 0.0.0.0:5110, 0.0.0.0:5112, 0.0.0.0:51100",
  46. "Details": []
  47. },
  48. {
  49. "Description": "Expresses interest in specific running processes",
  50. "Details": [
  51. {
  52. "process": "services.exe"
  53. }
  54. ]
  55. },
  56. {
  57. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  58. "Details": []
  59. },
  60. {
  61. "Description": "Reads data out of its own binary image",
  62. "Details": [
  63. {
  64. "self_read": "process: Exes_cb95a8fc3e50377b222be0289b90a0f4.exe, pid: 2176, offset: 0x00001158, length: 0x00001000"
  65. },
  66. {
  67. "self_read": "process: Exes_cb95a8fc3e50377b222be0289b90a0f4.exe, pid: 2176, offset: 0x00001159, length: 0x00000200"
  68. },
  69. {
  70. "self_read": "process: Exes_cb95a8fc3e50377b222be0289b90a0f4.exe, pid: 2176, offset: 0x0000115a, length: 0x00000200"
  71. },
  72. {
  73. "self_read": "process: Exes_cb95a8fc3e50377b222be0289b90a0f4.exe, pid: 2176, offset: 0x0000115b, length: 0x00000200"
  74. },
  75. {
  76. "self_read": "process: Exes_cb95a8fc3e50377b222be0289b90a0f4.exe, pid: 2176, offset: 0x0000115c, length: 0x00000200"
  77. },
  78. {
  79. "self_read": "process: Exes_cb95a8fc3e50377b222be0289b90a0f4.exe, pid: 2176, offset: 0x0000115d, length: 0x00000200"
  80. },
  81. {
  82. "self_read": "process: Exes_cb95a8fc3e50377b222be0289b90a0f4.exe, pid: 2176, offset: 0x0000115e, length: 0x00055a72"
  83. },
  84. {
  85. "self_read": "process: services.exe, pid: 1112, offset: 0x00000000, length: 0x00055a00"
  86. }
  87. ]
  88. },
  89. {
  90. "Description": "Drops a binary and executes it",
  91. "Details": [
  92. {
  93. "binary": "C:\\Windows\\services.exe"
  94. }
  95. ]
  96. },
  97. {
  98. "Description": "Deletes its original binary from disk",
  99. "Details": []
  100. },
  101. {
  102. "Description": "Sniffs keystrokes",
  103. "Details": [
  104. {
  105. "SetWindowsHookExA": "Process: services.exe(1112)"
  106. }
  107. ]
  108. },
  109. {
  110. "Description": "Attempts to stop active services",
  111. "Details": [
  112. {
  113. "servicename": "wscsvc"
  114. },
  115. {
  116. "servicename": "SharedAccess"
  117. }
  118. ]
  119. },
  120. {
  121. "Description": "Installs itself for autorun at Windows startup",
  122. "Details": [
  123. {
  124. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\DirectX For Microsoft\\xef\\xbe\\xae Windows"
  125. },
  126. {
  127. "data": "C:\\Windows\\system32\\fservice.exe"
  128. },
  129. {
  130. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Active Setup\\Installed Components\\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\\StubPath"
  131. },
  132. {
  133. "data": "C:\\Windows\\system\\sservice.exe"
  134. },
  135. {
  136. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}"
  137. },
  138. {
  139. "data": "unknown"
  140. },
  141. {
  142. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
  143. },
  144. {
  145. "data": "Explorer.exe C:\\Windows\\system32\\fservice.exe"
  146. }
  147. ]
  148. },
  149. {
  150. "Description": "Creates a hidden or system file",
  151. "Details": [
  152. {
  153. "file": "C:\\Windows\\System32\\fservice.exe"
  154. },
  155. {
  156. "file": "C:\\Windows\\system\\sservice.exe"
  157. },
  158. {
  159. "file": "C:\\Windows\\services.exe"
  160. }
  161. ]
  162. },
  163. {
  164. "Description": "Likely virus infection of existing system binary",
  165. "Details": [
  166. {
  167. "file": "c:\\windows\\system32\\fservice.exe"
  168. },
  169. {
  170. "file": "c:\\windows\\system\\sservice.exe"
  171. }
  172. ]
  173. },
  174. {
  175. "Description": "File has been identified by 62 Antiviruses on VirusTotal as malicious",
  176. "Details": [
  177. {
  178. "Bkav": "W32.DownloadProratA.Trojan"
  179. },
  180. {
  181. "MicroWorld-eScan": "Trojan.Generic.7807554"
  182. },
  183. {
  184. "CMC": "Trojan-Dropper.Win32.Small!O"
  185. },
  186. {
  187. "CAT-QuickHeal": "Backdoor.Prorat.AZ2"
  188. },
  189. {
  190. "ALYac": "Trojan.Generic.7807554"
  191. },
  192. {
  193. "Cylance": "Unsafe"
  194. },
  195. {
  196. "Zillya": "Dropper.Agent.Win32.103592"
  197. },
  198. {
  199. "SUPERAntiSpyware": "Trojan.Agent/Gen-Small"
  200. },
  201. {
  202. "TheHacker": "Trojan/Dropper.Agent.bczn"
  203. },
  204. {
  205. "K7GW": "Trojan ( 0036e6f71 )"
  206. },
  207. {
  208. "K7AntiVirus": "Trojan ( 0036e6f71 )"
  209. },
  210. {
  211. "Arcabit": "Trojan.Generic.D772242"
  212. },
  213. {
  214. "TrendMicro": "TROJ_DROPPER.CKK"
  215. },
  216. {
  217. "Baidu": "Win32.Backdoor.Prorat.e"
  218. },
  219. {
  220. "NANO-Antivirus": "Trojan.Win32.Small.gnhm"
  221. },
  222. {
  223. "Cyren": "W32/ProratP.G"
  224. },
  225. {
  226. "Symantec": "Trojan Horse"
  227. },
  228. {
  229. "TotalDefense": "Win32/SillyDl.SR"
  230. },
  231. {
  232. "TrendMicro-HouseCall": "TROJ_DROPPER.CKK"
  233. },
  234. {
  235. "Avast": "Win32:Small-BHA [Trj]"
  236. },
  237. {
  238. "ClamAV": "Win.Trojan.Prorat-11"
  239. },
  240. {
  241. "Kaspersky": "Trojan-Dropper.Win32.Agent.bczn"
  242. },
  243. {
  244. "BitDefender": "Trojan.Generic.7807554"
  245. },
  246. {
  247. "Babable": "Malware.HighConfidence"
  248. },
  249. {
  250. "AegisLab": "Troj.Dropper.W32.Agent.bczn!c"
  251. },
  252. {
  253. "Rising": "Backdoor.Win32.ProRat.i (CLASSIC)"
  254. },
  255. {
  256. "Ad-Aware": "Trojan.Generic.7807554"
  257. },
  258. {
  259. "Emsisoft": "Trojan.Generic.7807554 (B)"
  260. },
  261. {
  262. "Comodo": "Backdoor.Win32.Prorat.~RJ"
  263. },
  264. {
  265. "F-Secure": "Trojan.Generic.7807554"
  266. },
  267. {
  268. "DrWeb": "Trojan.MulDrop.2765"
  269. },
  270. {
  271. "VIPRE": "Trojan.Win32.Small.E (v)"
  272. },
  273. {
  274. "Invincea": "heuristic"
  275. },
  276. {
  277. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  278. },
  279. {
  280. "Sophos": "Troj/Prorat-O"
  281. },
  282. {
  283. "SentinelOne": "static engine - malicious"
  284. },
  285. {
  286. "F-Prot": "W32/ProratP.G"
  287. },
  288. {
  289. "Jiangmin": "TrojanDropper.Small.bjq"
  290. },
  291. {
  292. "Webroot": "W32.Trojan.Gen"
  293. },
  294. {
  295. "Avira": "BDS/Prorat.19.N"
  296. },
  297. {
  298. "Antiy-AVL": "Trojan[Backdoor]/Win32.VB.aoi"
  299. },
  300. {
  301. "Kingsoft": "Win32.Troj.Agent.(kcloud)"
  302. },
  303. {
  304. "Microsoft": "TrojanDropper:Win32/Small"
  305. },
  306. {
  307. "Endgame": "malicious (high confidence)"
  308. },
  309. {
  310. "ViRobot": "Dropper.Small.372947"
  311. },
  312. {
  313. "ZoneAlarm": "Trojan-Dropper.Win32.Agent.bczn"
  314. },
  315. {
  316. "GData": "Trojan.Generic.7807554"
  317. },
  318. {
  319. "AhnLab-V3": "Dropper/Win32.Agent.R10217"
  320. },
  321. {
  322. "McAfee": "Artemis!CB95A8FC3E50"
  323. },
  324. {
  325. "AVware": "Trojan.Win32.Small.E (v)"
  326. },
  327. {
  328. "MAX": "malware (ai score=100)"
  329. },
  330. {
  331. "VBA32": "TrojanDropper.Agent"
  332. },
  333. {
  334. "ESET-NOD32": "Win32/Prorat"
  335. },
  336. {
  337. "Tencent": "Win32.Trojan-dropper.Agent.Tayn"
  338. },
  339. {
  340. "Yandex": "Trojan.DR.Small.AVF1"
  341. },
  342. {
  343. "Ikarus": "Trojan-Dropper.Agent"
  344. },
  345. {
  346. "Fortinet": "W32/Small.RC!tr"
  347. },
  348. {
  349. "AVG": "Win32:Small-BHA [Trj]"
  350. },
  351. {
  352. "Cybereason": "malicious.c3e503"
  353. },
  354. {
  355. "Panda": "Trj/Genetic.gen"
  356. },
  357. {
  358. "CrowdStrike": "malicious_confidence_100% (D)"
  359. },
  360. {
  361. "Qihoo-360": "Malware.Radar05.Gen"
  362. }
  363. ]
  364. },
  365. {
  366. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  367. "Details": [
  368. {
  369. "target": "clamav:Win.Trojan.Prorat-11, sha256:31739ac593945cb154bb410bcaee57a2384c0aa69e097eca8c8c14244fb4f307, type:MS-DOS executable, MZ for MS-DOS"
  370. },
  371. {
  372. "dropped": "clamav:Win.Trojan.Prorat-52, sha256:45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f , guest_paths:C:\\Windows\\System32\\winkey.dll, type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  373. },
  374. {
  375. "dropped": "clamav:Win.Trojan.Prorat-284, sha256:c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6 , guest_paths:C:\\Windows\\System32\\reginv.dll, type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  376. },
  377. {
  378. "dropped": "clamav:Win.Trojan.Prorat-37, sha256:a87e93161d82238e9ed10a82eddc4fadb74c1f42c0ac0329f8e78342a5c9c92b , guest_paths:C:\\Windows\\System32\\fservice.exe*C:\\Windows\\system\\sservice.exe*C:\\Windows\\services.exe, type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  379. }
  380. ]
  381. },
  382. {
  383. "Description": "Anomalous binary characteristics",
  384. "Details": [
  385. {
  386. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  387. },
  388. {
  389. "anomaly": "Entrypoint of binary points to a non-executable code section"
  390. }
  391. ]
  392. }
  393. ]
  394.  
  395. [*] Started Service: []
  396.  
  397. [*] Executed Commands: [
  398. "C:\\Windows\\System32\\lncom_.bat ",
  399. "C:\\Windows\\System32\\lncom.exe ",
  400. "C:\\Users\\user\\AppData\\Local\\Temp\\EXES_C~1.EXE.bat",
  401. "http://www.reza24.com/file.php?id=5186 ",
  402. "C:\\Windows\\system32\\fservice.exe",
  403. "C:\\Windows\\SysWOW64\\lncom.exe.bat",
  404. "C:\\Windows\\services.exe -XP",
  405. "NET STOP srservice",
  406. "NET STOP navapsvc",
  407. "C:\\Windows\\system32\\net1 STOP srservice",
  408. "C:\\Windows\\system32\\net1 STOP navapsvc"
  409. ]
  410.  
  411. [*] Mutexes: [
  412. "Local\\!IETld!Mutex",
  413. "CicLoadWinStaWinSta0",
  414. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  415. "DBWinMutex"
  416. ]
  417.  
  418. [*] Modified Files: [
  419. "C:\\Windows\\System32\\lncom.exe",
  420. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_cb95a8fc3e50377b222be0289b90a0f4.bat",
  421. "C:\\Users\\user\\AppData\\Local\\Temp\\EXES_C~1.EXE.bat",
  422. "C:\\Windows\\System32\\fservice.exe",
  423. "C:\\Windows\\system\\sservice.exe",
  424. "C:\\Windows\\SysWOW64\\lncom.exe.bat",
  425. "C:\\Program Files (x86)\\Google\\Chrome\\Application\\debug.log",
  426. "C:\\Windows\\services.exe",
  427. "C:\\Windows\\System32\\winkey.dll",
  428. "\\Device\\Afd\\AsyncSelectHlp",
  429. "C:\\Windows\\System32\\reginv.dll"
  430. ]
  431.  
  432. [*] Deleted Files: [
  433. "C:\\Windows\\System32\\fservice.exe",
  434. "C:\\Windows\\system\\sservice.exe",
  435. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_cb95a8fc3e50377b222be0289b90a0f4.exe",
  436. "C:\\Users\\user\\AppData\\Local\\Temp\\EXES_C~1.EXE.bat",
  437. "C:\\Windows\\services.exe",
  438. "C:\\Windows\\Pplugin4.exe",
  439. "C:\\Windows\\Pplugin8.exe",
  440. "C:\\Windows\\Pplugin10xa.exe",
  441. "C:\\Windows\\eimsn.exe",
  442. "C:\\Windows\\winp9.exe",
  443. "C:\\Windows\\PpluginCd.dll",
  444. "C:\\Windows\\SysWOW64\\lncom.exe",
  445. "C:\\Windows\\SysWOW64\\lncom.exe.bat"
  446. ]
  447.  
  448. [*] Modified Registry Keys: [
  449. "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings",
  450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Bulas",
  451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\FW_KILL",
  452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\XP_FW_Disable",
  453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\XP_SYS_Recovery",
  454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\ICQ_UIN",
  455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\ICQ_UIN2",
  456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Kurban_Ismi",
  457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Mail",
  458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Online_List",
  459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Port",
  460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Sifre",
  461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Hata",
  462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\KSil",
  463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\LanNotifie",
  464. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer\\Run",
  465. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\DirectX For Microsoft\\xef\\xbe\\xae Windows",
  466. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}",
  467. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Active Setup\\Installed Components\\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\\StubPath",
  468. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
  469. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\srservice",
  470. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\srservice\\Start",
  471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\Tport",
  472. "Start",
  473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT Script Host\\Microsoft DxDiag\\WinSettings\\ServerVersionInt"
  474. ]
  475.  
  476. [*] Deleted Registry Keys: []
  477.  
  478. [*] DNS Communications: [
  479. {
  480. "type": "A",
  481. "request": "proend.ifrance.com",
  482. "answers": []
  483. },
  484. {
  485. "type": "MX",
  486. "request": "yahoo.com",
  487. "answers": [
  488. {
  489. "data": "mta5.am0.yahoodns.net",
  490. "type": "MX"
  491. },
  492. {
  493. "data": "mta7.am0.yahoodns.net",
  494. "type": "MX"
  495. },
  496. {
  497. "data": "mta6.am0.yahoodns.net",
  498. "type": "MX"
  499. }
  500. ]
  501. },
  502. {
  503. "type": "A",
  504. "request": "mta5.am0.yahoodns.net",
  505. "answers": [
  506. {
  507. "data": "74.6.137.64",
  508. "type": "A"
  509. },
  510. {
  511. "data": "67.195.228.106",
  512. "type": "A"
  513. },
  514. {
  515. "data": "67.195.228.109",
  516. "type": "A"
  517. },
  518. {
  519. "data": "98.137.159.27",
  520. "type": "A"
  521. },
  522. {
  523. "data": "98.137.159.24",
  524. "type": "A"
  525. },
  526. {
  527. "data": "67.195.228.111",
  528. "type": "A"
  529. },
  530. {
  531. "data": "74.6.137.63",
  532. "type": "A"
  533. },
  534. {
  535. "data": "66.218.85.52",
  536. "type": "A"
  537. }
  538. ]
  539. }
  540. ]
  541.  
  542. [*] Domains: [
  543. {
  544. "ip": "67.195.228.111",
  545. "domain": "mta5.am0.yahoodns.net"
  546. },
  547. {
  548. "ip": "",
  549. "domain": "proend.ifrance.com"
  550. },
  551. {
  552. "ip": "98.138.219.231",
  553. "domain": "yahoo.com"
  554. }
  555. ]
  556.  
  557. [*] Network Communication - ICMP: []
  558.  
  559. [*] Network Communication - HTTP: []
  560.  
  561. [*] Network Communication - SMTP: []
  562.  
  563. [*] Network Communication - Hosts: []
  564.  
  565. [*] Network Communication - IRC: []
  566.  
  567. [*] Static Analysis: {
  568. "pe": {
  569. "peid_signatures": [
  570. [
  571. "FSG v1.33"
  572. ],
  573. [
  574. "FSG v1.33 (Eng) -> dulek/xt"
  575. ],
  576. [
  577. "FSG v1.33 (Eng) -> dulek/xt"
  578. ]
  579. ],
  580. "imports": [
  581. {
  582. "imports": [
  583. {
  584. "name": "LoadLibraryA",
  585. "address": "0x403f3b"
  586. },
  587. {
  588. "name": "GetProcAddress",
  589. "address": "0x403f3f"
  590. }
  591. ],
  592. "dll": "KERNEL32.dll"
  593. }
  594. ],
  595. "digital_signers": null,
  596. "exported_dll_name": null,
  597. "actual_checksum": "0x0006209e",
  598. "overlay": {
  599. "size": "0x00055a89",
  600. "offset": "0x00001147"
  601. },
  602. "imagebase": "0x00400000",
  603. "reported_checksum": "0x00000000",
  604. "icon_hash": null,
  605. "entrypoint": "0x00403e4e",
  606. "timestamp": "1987-09-11 01:35:02",
  607. "osversion": "4.0",
  608. "sections": [
  609. {
  610. "name": "t",
  611. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  612. "virtual_address": "0x00001000",
  613. "size_of_data": "0x00000000",
  614. "entropy": "0.00",
  615. "raw_address": "0x00000000",
  616. "virtual_size": "0x00002000",
  617. "characteristics_raw": "0xc00000e0"
  618. },
  619. {
  620. "name": "c",
  621. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  622. "virtual_address": "0x00003000",
  623. "size_of_data": "0x00000f47",
  624. "entropy": "5.92",
  625. "raw_address": "0x00000200",
  626. "virtual_size": "0x00001000",
  627. "characteristics_raw": "0xc00000e0"
  628. }
  629. ],
  630. "resources": [],
  631. "dirents": [
  632. {
  633. "virtual_address": "0x00000000",
  634. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  635. "size": "0x00000000"
  636. },
  637. {
  638. "virtual_address": "0x00003f13",
  639. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  640. "size": "0x00000034"
  641. },
  642. {
  643. "virtual_address": "0x00003000",
  644. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  645. "size": "0x00000960"
  646. },
  647. {
  648. "virtual_address": "0x00000000",
  649. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  650. "size": "0x00000000"
  651. },
  652. {
  653. "virtual_address": "0x00000000",
  654. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  655. "size": "0x00000000"
  656. },
  657. {
  658. "virtual_address": "0x00000000",
  659. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  660. "size": "0x00000000"
  661. },
  662. {
  663. "virtual_address": "0x00000000",
  664. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  665. "size": "0x00000000"
  666. },
  667. {
  668. "virtual_address": "0x00000000",
  669. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  670. "size": "0x00000000"
  671. },
  672. {
  673. "virtual_address": "0x00000000",
  674. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  675. "size": "0x00000000"
  676. },
  677. {
  678. "virtual_address": "0x00000000",
  679. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  680. "size": "0x00000000"
  681. },
  682. {
  683. "virtual_address": "0x00000000",
  684. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  685. "size": "0x00000000"
  686. },
  687. {
  688. "virtual_address": "0x00000000",
  689. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  690. "size": "0x00000000"
  691. },
  692. {
  693. "virtual_address": "0x00000000",
  694. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  695. "size": "0x00000000"
  696. },
  697. {
  698. "virtual_address": "0x00000000",
  699. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  700. "size": "0x00000000"
  701. },
  702. {
  703. "virtual_address": "0x00000000",
  704. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  705. "size": "0x00000000"
  706. },
  707. {
  708. "virtual_address": "0x00000000",
  709. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  710. "size": "0x00000000"
  711. }
  712. ],
  713. "exports": [],
  714. "guest_signers": {},
  715. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  716. "icon_fuzzy": null,
  717. "icon": null,
  718. "pdbpath": null,
  719. "imported_dll_count": 1,
  720. "versioninfo": []
  721. }
  722. }
  723.  
  724. [*] Resolved APIs: [
  725. "shell32.dll.ShellExecuteA",
  726. "kernel32.dll.GetShortPathNameA",
  727. "kernel32.dll.CopyFileA",
  728. "kernel32.dll.GetSystemDirectoryA",
  729. "kernel32.dll.GetModuleFileNameA",
  730. "kernel32.dll.WinExec",
  731. "msvcrt.dll.exit",
  732. "msvcrt.dll.rewind",
  733. "msvcrt.dll.fclose",
  734. "msvcrt.dll.getc",
  735. "msvcrt.dll.fopen",
  736. "msvcrt.dll.??2@YAPAXI@Z",
  737. "msvcrt.dll.putc",
  738. "msvcrt.dll.fseek",
  739. "msvcrt.dll.fprintf",
  740. "kernel32.dll.SortGetHandle",
  741. "kernel32.dll.SortCloseHandle",
  742. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  743. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  744. "comctl32.dll.#386",
  745. "advapi32.dll.UnregisterTraceGuids",
  746. "comctl32.dll.#321",
  747. "kernel32.dll.SetThreadUILanguage",
  748. "kernel32.dll.CopyFileExW",
  749. "kernel32.dll.IsDebuggerPresent",
  750. "kernel32.dll.SetConsoleInputExeNameW",
  751. "advapi32.dll.SaferIdentifyLevel",
  752. "advapi32.dll.SaferComputeTokenFromLevel",
  753. "advapi32.dll.SaferCloseLevel",
  754. "shell32.dll.ShellExecuteExW",
  755. "ole32.dll.OleInitialize",
  756. "cryptbase.dll.SystemFunction036",
  757. "uxtheme.dll.ThemeInitApiHook",
  758. "user32.dll.IsProcessDPIAware",
  759. "ole32.dll.CreateBindCtx",
  760. "ole32.dll.CoTaskMemAlloc",
  761. "propsys.dll.PSCreateMemoryPropertyStore",
  762. "propsys.dll.PSPropertyBag_WriteDWORD",
  763. "ole32.dll.CoGetApartmentType",
  764. "ole32.dll.CoRegisterInitializeSpy",
  765. "ole32.dll.CoTaskMemFree",
  766. "comctl32.dll.#236",
  767. "oleaut32.dll.#6",
  768. "ole32.dll.CoGetMalloc",
  769. "propsys.dll.PSPropertyBag_ReadDWORD",
  770. "propsys.dll.PSPropertyBag_ReadGUID",
  771. "comctl32.dll.#320",
  772. "comctl32.dll.#324",
  773. "comctl32.dll.#323",
  774. "advapi32.dll.RegEnumKeyW",
  775. "advapi32.dll.OpenThreadToken",
  776. "ole32.dll.StringFromGUID2",
  777. "apphelp.dll.ApphelpCheckShellObject",
  778. "ole32.dll.CoCreateInstance",
  779. "urlmon.dll.CreateUri",
  780. "kernel32.dll.InitializeSRWLock",
  781. "kernel32.dll.AcquireSRWLockExclusive",
  782. "kernel32.dll.AcquireSRWLockShared",
  783. "kernel32.dll.ReleaseSRWLockExclusive",
  784. "kernel32.dll.ReleaseSRWLockShared",
  785. "advapi32.dll.AddMandatoryAce",
  786. "ntmarta.dll.GetMartaExtensionInterface",
  787. "version.dll.GetFileVersionInfoSizeW",
  788. "version.dll.GetFileVersionInfoW",
  789. "version.dll.VerQueryValueW",
  790. "urlmon.dll.#397",
  791. "urlmon.dll.#441",
  792. "urlmon.dll.#395",
  793. "ole32.dll.OleUninitialize",
  794. "ole32.dll.CoRevokeInitializeSpy",
  795. "comctl32.dll.#388",
  796. "kernelbase.dll.SetThreadStackGuarantee",
  797. "oleaut32.dll.#500",
  798. "kernel32.dll.CloseHandle",
  799. "kernel32.dll.CompareStringA",
  800. "kernel32.dll.CreateDirectoryA",
  801. "kernel32.dll.CreateEventA",
  802. "kernel32.dll.CreateFileA",
  803. "kernel32.dll.CreateFileMappingA",
  804. "kernel32.dll.CreatePipe",
  805. "kernel32.dll.CreateProcessA",
  806. "kernel32.dll.CreateThread",
  807. "kernel32.dll.CreateToolhelp32Snapshot",
  808. "kernel32.dll.DeleteCriticalSection",
  809. "kernel32.dll.DeleteFileA",
  810. "kernel32.dll.EnterCriticalSection",
  811. "kernel32.dll.EnumCalendarInfoA",
  812. "kernel32.dll.ExitProcess",
  813. "kernel32.dll.ExitThread",
  814. "kernel32.dll.FileTimeToDosDateTime",
  815. "kernel32.dll.FileTimeToLocalFileTime",
  816. "kernel32.dll.FindClose",
  817. "kernel32.dll.FindFirstFileA",
  818. "kernel32.dll.FindNextFileA",
  819. "kernel32.dll.FindResourceA",
  820. "kernel32.dll.FormatMessageA",
  821. "kernel32.dll.FreeLibrary",
  822. "kernel32.dll.FreeResource",
  823. "kernel32.dll.GetACP",
  824. "kernel32.dll.GetCPInfo",
  825. "kernel32.dll.GetCommandLineA",
  826. "kernel32.dll.GetComputerNameA",
  827. "kernel32.dll.GetCurrentProcess",
  828. "kernel32.dll.GetCurrentProcessId",
  829. "kernel32.dll.GetCurrentThread",
  830. "kernel32.dll.GetCurrentThreadId",
  831. "kernel32.dll.GetDateFormatA",
  832. "kernel32.dll.GetDiskFreeSpaceA",
  833. "kernel32.dll.GetDriveTypeA",
  834. "kernel32.dll.GetEnvironmentStrings",
  835. "kernel32.dll.GetExitCodeThread",
  836. "kernel32.dll.GetFileAttributesA",
  837. "kernel32.dll.GetFileSize",
  838. "kernel32.dll.GetFileType",
  839. "kernel32.dll.GetLastError",
  840. "kernel32.dll.GetLocalTime",
  841. "kernel32.dll.GetLocaleInfoA",
  842. "kernel32.dll.GetModuleHandleA",
  843. "kernel32.dll.GetOEMCP",
  844. "kernel32.dll.GetPrivateProfileStringA",
  845. "kernel32.dll.GetProcAddress",
  846. "kernel32.dll.GetProcessHeap",
  847. "kernel32.dll.GetProfileStringA",
  848. "kernel32.dll.GetStartupInfoA",
  849. "kernel32.dll.GetStdHandle",
  850. "kernel32.dll.GetStringTypeA",
  851. "kernel32.dll.GetStringTypeW",
  852. "kernel32.dll.GetSystemDefaultLangID",
  853. "kernel32.dll.GetSystemInfo",
  854. "kernel32.dll.GetSystemTime",
  855. "kernel32.dll.GetTempPathA",
  856. "kernel32.dll.GetThreadLocale",
  857. "kernel32.dll.GetTickCount",
  858. "kernel32.dll.GetTimeZoneInformation",
  859. "kernel32.dll.GetUserDefaultLCID",
  860. "kernel32.dll.GetVersion",
  861. "kernel32.dll.GetVersionExA",
  862. "kernel32.dll.GetWindowsDirectoryA",
  863. "kernel32.dll.GlobalAddAtomA",
  864. "kernel32.dll.GlobalAlloc",
  865. "kernel32.dll.GlobalDeleteAtom",
  866. "kernel32.dll.GlobalFree",
  867. "kernel32.dll.GlobalHandle",
  868. "kernel32.dll.GlobalLock",
  869. "kernel32.dll.GlobalReAlloc",
  870. "kernel32.dll.GlobalUnlock",
  871. "kernel32.dll.HeapAlloc",
  872. "kernel32.dll.HeapFree",
  873. "kernel32.dll.InitializeCriticalSection",
  874. "kernel32.dll.InterlockedDecrement",
  875. "kernel32.dll.InterlockedIncrement",
  876. "kernel32.dll.IsValidLocale",
  877. "kernel32.dll.LCMapStringA",
  878. "kernel32.dll.LeaveCriticalSection",
  879. "kernel32.dll.LoadLibraryA",
  880. "kernel32.dll.LoadLibraryExA",
  881. "kernel32.dll.LoadResource",
  882. "kernel32.dll.LocalAlloc",
  883. "kernel32.dll.LocalFree",
  884. "kernel32.dll.LockResource",
  885. "kernel32.dll.MapViewOfFile",
  886. "kernel32.dll.MoveFileA",
  887. "kernel32.dll.MulDiv",
  888. "kernel32.dll.MultiByteToWideChar",
  889. "kernel32.dll.OpenProcess",
  890. "kernel32.dll.Process32First",
  891. "kernel32.dll.Process32Next",
  892. "kernel32.dll.RaiseException",
  893. "kernel32.dll.ReadFile",
  894. "kernel32.dll.RemoveDirectoryA",
  895. "kernel32.dll.ResetEvent",
  896. "kernel32.dll.ResumeThread",
  897. "kernel32.dll.RtlUnwind",
  898. "kernel32.dll.SetConsoleCtrlHandler",
  899. "kernel32.dll.SetCurrentDirectoryA",
  900. "kernel32.dll.SetEndOfFile",
  901. "kernel32.dll.SetErrorMode",
  902. "kernel32.dll.SetEvent",
  903. "kernel32.dll.SetFileAttributesA",
  904. "kernel32.dll.SetFilePointer",
  905. "kernel32.dll.SetHandleCount",
  906. "kernel32.dll.SetLastError",
  907. "kernel32.dll.SetSystemTime",
  908. "kernel32.dll.SetThreadLocale",
  909. "kernel32.dll.SetThreadPriority",
  910. "kernel32.dll.SizeofResource",
  911. "kernel32.dll.Sleep",
  912. "kernel32.dll.TerminateProcess",
  913. "kernel32.dll.TlsAlloc",
  914. "kernel32.dll.TlsFree",
  915. "kernel32.dll.TlsGetValue",
  916. "kernel32.dll.TlsSetValue",
  917. "kernel32.dll.UnhandledExceptionFilter",
  918. "kernel32.dll.UnmapViewOfFile",
  919. "kernel32.dll.VerLanguageNameA",
  920. "kernel32.dll.VirtualAlloc",
  921. "kernel32.dll.VirtualFree",
  922. "kernel32.dll.VirtualQuery",
  923. "kernel32.dll.WaitForMultipleObjects",
  924. "kernel32.dll.WaitForSingleObject",
  925. "kernel32.dll.WideCharToMultiByte",
  926. "kernel32.dll.WriteFile",
  927. "kernel32.dll.WritePrivateProfileStringA",
  928. "kernel32.dll.WriteProcessMemory",
  929. "kernel32.dll.lstrcatA",
  930. "kernel32.dll.lstrcmpA",
  931. "kernel32.dll.lstrcpyA",
  932. "kernel32.dll.lstrcpynA",
  933. "kernel32.dll.lstrlenA",
  934. "advapi32.dll.AdjustTokenPrivileges",
  935. "advapi32.dll.ChangeServiceConfigA",
  936. "advapi32.dll.CloseServiceHandle",
  937. "advapi32.dll.ControlService",
  938. "advapi32.dll.DeleteService",
  939. "advapi32.dll.EnumServicesStatusA",
  940. "advapi32.dll.GetUserNameA",
  941. "advapi32.dll.LookupPrivilegeValueA",
  942. "advapi32.dll.OpenProcessToken",
  943. "advapi32.dll.OpenSCManagerA",
  944. "advapi32.dll.OpenServiceA",
  945. "advapi32.dll.QueryServiceConfigA",
  946. "advapi32.dll.RegCloseKey",
  947. "advapi32.dll.RegCreateKeyExA",
  948. "advapi32.dll.RegDeleteKeyA",
  949. "advapi32.dll.RegDeleteValueA",
  950. "advapi32.dll.RegEnumKeyExA",
  951. "advapi32.dll.RegEnumValueA",
  952. "advapi32.dll.RegFlushKey",
  953. "advapi32.dll.RegOpenKeyExA",
  954. "advapi32.dll.RegQueryInfoKeyA",
  955. "advapi32.dll.RegQueryValueExA",
  956. "advapi32.dll.RegSetValueExA",
  957. "advapi32.dll.StartServiceA",
  958. "avicap32.dll.capCreateCaptureWindowA",
  959. "comctl32.dll.ImageList_Add",
  960. "comctl32.dll.ImageList_BeginDrag",
  961. "comctl32.dll.ImageList_Create",
  962. "comctl32.dll.ImageList_Destroy",
  963. "comctl32.dll.ImageList_DragEnter",
  964. "comctl32.dll.ImageList_DragLeave",
  965. "comctl32.dll.ImageList_DragMove",
  966. "comctl32.dll.ImageList_DragShowNolock",
  967. "comctl32.dll.ImageList_Draw",
  968. "comctl32.dll.ImageList_EndDrag",
  969. "comctl32.dll.ImageList_GetBkColor",
  970. "comctl32.dll.ImageList_GetDragImage",
  971. "comctl32.dll.ImageList_GetIconSize",
  972. "comctl32.dll.ImageList_GetImageCount",
  973. "comctl32.dll.ImageList_Read",
  974. "comctl32.dll.ImageList_Remove",
  975. "comctl32.dll.ImageList_ReplaceIcon",
  976. "comctl32.dll.ImageList_SetBkColor",
  977. "comctl32.dll.ImageList_SetDragCursorImage",
  978. "comctl32.dll.ImageList_SetIconSize",
  979. "comctl32.dll.ImageList_Write",
  980. "comctl32.dll.ImageList_DrawEx",
  981. "gdi32.dll.BitBlt",
  982. "gdi32.dll.CopyEnhMetaFileA",
  983. "gdi32.dll.CreateBitmap",
  984. "gdi32.dll.CreateBrushIndirect",
  985. "gdi32.dll.CreateCompatibleBitmap",
  986. "gdi32.dll.CreateCompatibleDC",
  987. "gdi32.dll.CreateDCA",
  988. "gdi32.dll.CreateDIBSection",
  989. "gdi32.dll.CreateDIBitmap",
  990. "gdi32.dll.CreateFontIndirectA",
  991. "gdi32.dll.CreateHalftonePalette",
  992. "gdi32.dll.CreateICA",
  993. "gdi32.dll.CreatePalette",
  994. "gdi32.dll.CreatePenIndirect",
  995. "gdi32.dll.CreateSolidBrush",
  996. "gdi32.dll.DeleteDC",
  997. "gdi32.dll.DeleteEnhMetaFile",
  998. "gdi32.dll.DeleteObject",
  999. "gdi32.dll.Ellipse",
  1000. "gdi32.dll.EndDoc",
  1001. "gdi32.dll.EndPage",
  1002. "gdi32.dll.ExcludeClipRect",
  1003. "gdi32.dll.ExtTextOutA",
  1004. "gdi32.dll.GdiFlush",
  1005. "gdi32.dll.GetBitmapBits",
  1006. "gdi32.dll.GetBrushOrgEx",
  1007. "gdi32.dll.GetClipBox",
  1008. "gdi32.dll.GetCurrentPositionEx",
  1009. "gdi32.dll.GetDCOrgEx",
  1010. "gdi32.dll.GetDIBColorTable",
  1011. "gdi32.dll.GetDIBits",
  1012. "gdi32.dll.GetDeviceCaps",
  1013. "gdi32.dll.GetEnhMetaFileBits",
  1014. "gdi32.dll.GetEnhMetaFileHeader",
  1015. "gdi32.dll.GetEnhMetaFilePaletteEntries",
  1016. "gdi32.dll.GetObjectA",
  1017. "gdi32.dll.GetPaletteEntries",
  1018. "gdi32.dll.GetPixel",
  1019. "gdi32.dll.GetStockObject",
  1020. "gdi32.dll.GetSystemPaletteEntries",
  1021. "gdi32.dll.GetTextExtentPoint32A",
  1022. "gdi32.dll.GetTextMetricsA",
  1023. "gdi32.dll.GetWinMetaFileBits",
  1024. "gdi32.dll.GetWindowOrgEx",
  1025. "gdi32.dll.IntersectClipRect",
  1026. "gdi32.dll.LineTo",
  1027. "gdi32.dll.MaskBlt",
  1028. "gdi32.dll.MoveToEx",
  1029. "gdi32.dll.PatBlt",
  1030. "gdi32.dll.PlayEnhMetaFile",
  1031. "gdi32.dll.Polyline",
  1032. "gdi32.dll.RealizePalette",
  1033. "gdi32.dll.RectVisible",
  1034. "gdi32.dll.RestoreDC",
  1035. "gdi32.dll.SaveDC",
  1036. "gdi32.dll.SelectObject",
  1037. "gdi32.dll.SelectPalette",
  1038. "gdi32.dll.SetAbortProc",
  1039. "gdi32.dll.SetBkColor",
  1040. "gdi32.dll.SetBkMode",
  1041. "gdi32.dll.SetBrushOrgEx",
  1042. "gdi32.dll.SetDIBColorTable",
  1043. "gdi32.dll.SetEnhMetaFileBits",
  1044. "gdi32.dll.SetPixel",
  1045. "gdi32.dll.SetROP2",
  1046. "gdi32.dll.SetStretchBltMode",
  1047. "gdi32.dll.SetTextColor",
  1048. "gdi32.dll.SetViewportOrgEx",
  1049. "gdi32.dll.SetWinMetaFileBits",
  1050. "gdi32.dll.SetWindowOrgEx",
  1051. "gdi32.dll.StartDocA",
  1052. "gdi32.dll.StartPage",
  1053. "gdi32.dll.StretchBlt",
  1054. "gdi32.dll.UnrealizeObject",
  1055. "ole32.dll.IsEqualGUID",
  1056. "oleaut32.dll.SysAllocStringLen",
  1057. "oleaut32.dll.SysFreeString",
  1058. "oleaut32.dll.SysReAllocStringLen",
  1059. "oleaut32.dll.SysStringLen",
  1060. "oleaut32.dll.VariantChangeTypeEx",
  1061. "oleaut32.dll.VariantClear",
  1062. "oleaut32.dll.VariantCopyInd",
  1063. "shell32.dll.SHGetSpecialFolderLocation",
  1064. "shell32.dll.SHGetPathFromIDListA",
  1065. "urlmon.dll.URLDownloadToFileA",
  1066. "user32.dll.ActivateKeyboardLayout",
  1067. "user32.dll.AdjustWindowRectEx",
  1068. "user32.dll.BeginPaint",
  1069. "user32.dll.CallNextHookEx",
  1070. "user32.dll.CallWindowProcA",
  1071. "user32.dll.CharLowerA",
  1072. "user32.dll.CharLowerBuffA",
  1073. "user32.dll.CharNextA",
  1074. "user32.dll.CheckMenuItem",
  1075. "user32.dll.ClientToScreen",
  1076. "user32.dll.CloseClipboard",
  1077. "user32.dll.CreateIcon",
  1078. "user32.dll.CreateMenu",
  1079. "user32.dll.CreatePopupMenu",
  1080. "user32.dll.CreateWindowExA",
  1081. "user32.dll.DefFrameProcA",
  1082. "user32.dll.DefMDIChildProcA",
  1083. "user32.dll.DefWindowProcA",
  1084. "user32.dll.DeleteMenu",
  1085. "user32.dll.DestroyCursor",
  1086. "user32.dll.DestroyIcon",
  1087. "user32.dll.DestroyMenu",
  1088. "user32.dll.DestroyWindow",
  1089. "user32.dll.DispatchMessageA",
  1090. "user32.dll.DrawEdge",
  1091. "user32.dll.DrawFrameControl",
  1092. "user32.dll.DrawIcon",
  1093. "user32.dll.DrawIconEx",
  1094. "user32.dll.DrawMenuBar",
  1095. "user32.dll.DrawTextA",
  1096. "user32.dll.EnableMenuItem",
  1097. "user32.dll.EnableScrollBar",
  1098. "user32.dll.EnableWindow",
  1099. "user32.dll.EndPaint",
  1100. "user32.dll.EnumThreadWindows",
  1101. "user32.dll.EnumWindows",
  1102. "user32.dll.EqualRect",
  1103. "user32.dll.ExitWindowsEx",
  1104. "user32.dll.FillRect",
  1105. "user32.dll.FindWindowA",
  1106. "user32.dll.FindWindowExA",
  1107. "user32.dll.FrameRect",
  1108. "user32.dll.GetActiveWindow",
  1109. "user32.dll.GetCapture",
  1110. "user32.dll.GetClassInfoA",
  1111. "user32.dll.GetClientRect",
  1112. "user32.dll.GetClipboardData",
  1113. "user32.dll.GetCursor",
  1114. "user32.dll.GetCursorPos",
  1115. "user32.dll.GetDC",
  1116. "user32.dll.GetDCEx",
  1117. "user32.dll.GetDesktopWindow",
  1118. "user32.dll.GetFocus",
  1119. "user32.dll.GetForegroundWindow",
  1120. "user32.dll.GetIconInfo",
  1121. "user32.dll.GetKeyNameTextA",
  1122. "user32.dll.GetKeyState",
  1123. "user32.dll.GetKeyboardLayout",
  1124. "user32.dll.GetKeyboardLayoutList",
  1125. "user32.dll.GetKeyboardState",
  1126. "user32.dll.GetKeyboardType",
  1127. "user32.dll.GetLastActivePopup",
  1128. "user32.dll.GetMenu",
  1129. "user32.dll.GetMenuItemCount",
  1130. "user32.dll.GetMenuItemID",
  1131. "user32.dll.GetMenuItemInfoA",
  1132. "user32.dll.GetMenuState",
  1133. "user32.dll.GetMenuStringA",
  1134. "user32.dll.GetMessageA",
  1135. "user32.dll.GetParent",
  1136. "user32.dll.GetPropA",
  1137. "user32.dll.GetScrollInfo",
  1138. "user32.dll.GetScrollPos",
  1139. "user32.dll.GetScrollRange",
  1140. "user32.dll.GetSubMenu",
  1141. "user32.dll.GetSysColor",
  1142. "user32.dll.GetSystemMetrics",
  1143. "user32.dll.GetTopWindow",
  1144. "user32.dll.GetWindow",
  1145. "user32.dll.GetWindowDC",
  1146. "user32.dll.GetWindowLongA",
  1147. "user32.dll.GetWindowPlacement",
  1148. "user32.dll.GetWindowRect",
  1149. "user32.dll.GetWindowTextA",
  1150. "user32.dll.GetWindowThreadProcessId",
  1151. "user32.dll.InflateRect",
  1152. "user32.dll.InsertMenuA",
  1153. "user32.dll.InsertMenuItemA",
  1154. "user32.dll.IntersectRect",
  1155. "user32.dll.InvalidateRect",
  1156. "user32.dll.IsChild",
  1157. "user32.dll.IsDialogMessageA",
  1158. "user32.dll.IsIconic",
  1159. "user32.dll.IsRectEmpty",
  1160. "user32.dll.IsWindow",
  1161. "user32.dll.IsWindowEnabled",
  1162. "user32.dll.IsWindowVisible",
  1163. "user32.dll.IsZoomed",
  1164. "user32.dll.KillTimer",
  1165. "user32.dll.LoadBitmapA",
  1166. "user32.dll.LoadCursorA",
  1167. "user32.dll.LoadIconA",
  1168. "user32.dll.LoadKeyboardLayoutA",
  1169. "user32.dll.LoadStringA",
  1170. "user32.dll.MapVirtualKeyA",
  1171. "user32.dll.MapWindowPoints",
  1172. "user32.dll.MessageBoxA",
  1173. "user32.dll.MsgWaitForMultipleObjects",
  1174. "user32.dll.OemToCharA",
  1175. "user32.dll.OffsetRect",
  1176. "user32.dll.OpenClipboard",
  1177. "user32.dll.PeekMessageA",
  1178. "user32.dll.PostMessageA",
  1179. "user32.dll.PostQuitMessage",
  1180. "user32.dll.PtInRect",
  1181. "user32.dll.RegisterClassA",
  1182. "user32.dll.RegisterClipboardFormatA",
  1183. "user32.dll.RegisterWindowMessageA",
  1184. "user32.dll.ReleaseCapture",
  1185. "user32.dll.ReleaseDC",
  1186. "user32.dll.RemoveMenu",
  1187. "user32.dll.RemovePropA",
  1188. "user32.dll.ScreenToClient",
  1189. "user32.dll.ScrollWindow",
  1190. "user32.dll.SendMessageA",
  1191. "user32.dll.SetActiveWindow",
  1192. "user32.dll.SetCapture",
  1193. "user32.dll.SetClassLongA",
  1194. "user32.dll.SetCursor",
  1195. "user32.dll.SetCursorPos",
  1196. "user32.dll.SetFocus",
  1197. "user32.dll.SetForegroundWindow",
  1198. "user32.dll.SetMenu",
  1199. "user32.dll.SetMenuItemInfoA",
  1200. "user32.dll.SetPropA",
  1201. "user32.dll.SetRect",
  1202. "user32.dll.SetScrollInfo",
  1203. "user32.dll.SetScrollPos",
  1204. "user32.dll.SetScrollRange",
  1205. "user32.dll.SetTimer",
  1206. "user32.dll.SetWindowLongA",
  1207. "user32.dll.SetWindowPlacement",
  1208. "user32.dll.SetWindowPos",
  1209. "user32.dll.SetWindowTextA",
  1210. "user32.dll.SetWindowsHookExA",
  1211. "user32.dll.ShowCursor",
  1212. "user32.dll.ShowOwnedPopups",
  1213. "user32.dll.ShowScrollBar",
  1214. "user32.dll.ShowWindow",
  1215. "user32.dll.SystemParametersInfoA",
  1216. "user32.dll.TrackPopupMenu",
  1217. "user32.dll.TranslateMDISysAccel",
  1218. "user32.dll.TranslateMessage",
  1219. "user32.dll.UnhookWindowsHookEx",
  1220. "user32.dll.UnregisterClassA",
  1221. "user32.dll.UpdateWindow",
  1222. "user32.dll.WaitMessage",
  1223. "user32.dll.WinHelpA",
  1224. "user32.dll.WindowFromPoint",
  1225. "user32.dll.keybd_event",
  1226. "user32.dll.wsprintfA",
  1227. "user32.dll.GetSystemMenu",
  1228. "winmm.dll.mciSendStringA",
  1229. "winmm.dll.timeGetTime",
  1230. "winspool.drv.ClosePrinter",
  1231. "winspool.drv.DocumentPropertiesA",
  1232. "winspool.drv.EnumPrintersA",
  1233. "winspool.drv.OpenPrinterA",
  1234. "ws2_32.dll.WSACloseEvent",
  1235. "ws2_32.dll.WSACreateEvent",
  1236. "ws2_32.dll.WSAEventSelect",
  1237. "wsock32.dll.#103",
  1238. "wsock32.dll.#107",
  1239. "wsock32.dll.#101",
  1240. "wsock32.dll.#108",
  1241. "wsock32.dll.#116",
  1242. "wsock32.dll.#111",
  1243. "wsock32.dll.#115",
  1244. "wsock32.dll.#1",
  1245. "wsock32.dll.#3",
  1246. "wsock32.dll.#4",
  1247. "wsock32.dll.#52",
  1248. "wsock32.dll.#57",
  1249. "wsock32.dll.#5",
  1250. "wsock32.dll.#55",
  1251. "wsock32.dll.#6",
  1252. "wsock32.dll.#7",
  1253. "wsock32.dll.#9",
  1254. "wsock32.dll.#10",
  1255. "wsock32.dll.#11",
  1256. "wsock32.dll.#12",
  1257. "wsock32.dll.#13",
  1258. "wsock32.dll.#15",
  1259. "wsock32.dll.#16",
  1260. "wsock32.dll.#17",
  1261. "wsock32.dll.#18",
  1262. "wsock32.dll.#19",
  1263. "wsock32.dll.#20",
  1264. "wsock32.dll.#21",
  1265. "wsock32.dll.#23",
  1266. "wsock32.dll.#2",
  1267. "lncom.exe.___CPPdebugHook",
  1268. "kernel32.dll.GetDiskFreeSpaceExA",
  1269. "user32.dll.GetMonitorInfoA",
  1270. "user32.dll.EnumDisplayMonitors",
  1271. "dwmapi.dll.DwmIsCompositionEnabled",
  1272. "gdi32.dll.GetLayout",
  1273. "gdi32.dll.GdiRealizationInfo",
  1274. "gdi32.dll.FontIsLinked",
  1275. "advapi32.dll.RegOpenKeyExW",
  1276. "advapi32.dll.RegQueryInfoKeyW",
  1277. "gdi32.dll.GetTextFaceAliasW",
  1278. "advapi32.dll.RegEnumValueW",
  1279. "advapi32.dll.RegQueryValueExW",
  1280. "gdi32.dll.GetFontAssocStatus",
  1281. "advapi32.dll.RegEnumKeyExW",
  1282. "gdi32.dll.GdiIsMetaPrintDC",
  1283. "comctl32.dll.InitializeFlatSB",
  1284. "comctl32.dll.UninitializeFlatSB",
  1285. "comctl32.dll.FlatSB_GetScrollProp",
  1286. "comctl32.dll.FlatSB_SetScrollProp",
  1287. "comctl32.dll.FlatSB_EnableScrollBar",
  1288. "comctl32.dll.FlatSB_ShowScrollBar",
  1289. "comctl32.dll.FlatSB_GetScrollRange",
  1290. "comctl32.dll.FlatSB_GetScrollInfo",
  1291. "comctl32.dll.FlatSB_GetScrollPos",
  1292. "comctl32.dll.FlatSB_SetScrollPos",
  1293. "comctl32.dll.FlatSB_SetScrollInfo",
  1294. "comctl32.dll.FlatSB_SetScrollRange",
  1295. "lpk.dll.LpkEditControl",
  1296. "comctl32.dll.HIMAGELIST_QueryInterface",
  1297. "comctl32.dll.DrawShadowText",
  1298. "comctl32.dll.DrawSizeBox",
  1299. "comctl32.dll.DrawScrollBar",
  1300. "comctl32.dll.SizeBoxHwnd",
  1301. "comctl32.dll.ScrollBar_MouseMove",
  1302. "comctl32.dll.ScrollBar_Menu",
  1303. "comctl32.dll.HandleScrollCmd",
  1304. "comctl32.dll.DetachScrollBars",
  1305. "comctl32.dll.AttachScrollBars",
  1306. "comctl32.dll.CCSetScrollInfo",
  1307. "comctl32.dll.CCGetScrollInfo",
  1308. "comctl32.dll.CCEnableScrollBar",
  1309. "comctl32.dll.QuerySystemGestureStatus",
  1310. "uxtheme.dll.#49",
  1311. "uxtheme.dll.CloseThemeData",
  1312. "uxtheme.dll.DrawThemeBackground",
  1313. "ole32.dll.CoInitializeEx",
  1314. "ole32.dll.CoUninitialize",
  1315. "kernel32.dll.FlsGetValue",
  1316. "kernel32.dll.InitializeCriticalSectionEx",
  1317. "kernel32.dll.FlsAlloc",
  1318. "kernel32.dll.FlsSetValue",
  1319. "kernel32.dll.LCMapStringEx",
  1320. "api-ms-win-core-synch-l1-2-0.dll.InitializeConditionVariable",
  1321. "api-ms-win-core-synch-l1-2-0.dll.SleepConditionVariableCS",
  1322. "api-ms-win-core-synch-l1-2-0.dll.WakeAllConditionVariable",
  1323. "kernel32.dll.FlsFree",
  1324. "kernel32.dll.InitOnceExecuteOnce",
  1325. "kernel32.dll.CreateEventExW",
  1326. "kernel32.dll.CreateSemaphoreW",
  1327. "kernel32.dll.CreateSemaphoreExW",
  1328. "kernel32.dll.CreateThreadpoolTimer",
  1329. "kernel32.dll.SetThreadpoolTimer",
  1330. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1331. "kernel32.dll.CloseThreadpoolTimer",
  1332. "kernel32.dll.CreateThreadpoolWait",
  1333. "kernel32.dll.SetThreadpoolWait",
  1334. "kernel32.dll.CloseThreadpoolWait",
  1335. "kernel32.dll.FlushProcessWriteBuffers",
  1336. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1337. "kernel32.dll.GetCurrentProcessorNumber",
  1338. "kernel32.dll.CreateSymbolicLinkW",
  1339. "kernel32.dll.GetTickCount64",
  1340. "kernel32.dll.GetFileInformationByHandleEx",
  1341. "kernel32.dll.SetFileInformationByHandle",
  1342. "kernel32.dll.InitializeConditionVariable",
  1343. "kernel32.dll.WakeConditionVariable",
  1344. "kernel32.dll.WakeAllConditionVariable",
  1345. "kernel32.dll.SleepConditionVariableCS",
  1346. "kernel32.dll.TryAcquireSRWLockExclusive",
  1347. "kernel32.dll.SleepConditionVariableSRW",
  1348. "kernel32.dll.CreateThreadpoolWork",
  1349. "kernel32.dll.SubmitThreadpoolWork",
  1350. "kernel32.dll.CloseThreadpoolWork",
  1351. "kernel32.dll.CompareStringEx",
  1352. "kernel32.dll.GetLocaleInfoEx",
  1353. "kernel32.dll.AreFileApisANSI",
  1354. "kernel32.dll.EnumSystemLocalesEx",
  1355. "kernel32.dll.GetDateFormatEx",
  1356. "kernel32.dll.GetTimeFormatEx",
  1357. "kernel32.dll.GetUserDefaultLocaleName",
  1358. "kernel32.dll.IsValidLocaleName",
  1359. "kernel32.dll.LCIDToLocaleName",
  1360. "kernel32.dll.LocaleNameToLCID",
  1361. "advapi32.dll.SystemFunction036",
  1362. "cryptbase.dll.SystemFunction001",
  1363. "cryptbase.dll.SystemFunction002",
  1364. "cryptbase.dll.SystemFunction003",
  1365. "cryptbase.dll.SystemFunction004",
  1366. "cryptbase.dll.SystemFunction005",
  1367. "cryptbase.dll.SystemFunction028",
  1368. "cryptbase.dll.SystemFunction029",
  1369. "cryptbase.dll.SystemFunction034",
  1370. "cryptbase.dll.SystemFunction040",
  1371. "cryptbase.dll.SystemFunction041",
  1372. "fservice.exe.___CPPdebugHook",
  1373. "services.exe.___CPPdebugHook",
  1374. "mfc42.dll.#4486",
  1375. "mfc42.dll.#2554",
  1376. "mfc42.dll.#2512",
  1377. "mfc42.dll.#5731",
  1378. "mfc42.dll.#3922",
  1379. "mfc42.dll.#1089",
  1380. "mfc42.dll.#5199",
  1381. "mfc42.dll.#2396",
  1382. "mfc42.dll.#3346",
  1383. "mfc42.dll.#5300",
  1384. "mfc42.dll.#5302",
  1385. "mfc42.dll.#4079",
  1386. "mfc42.dll.#4698",
  1387. "mfc42.dll.#5307",
  1388. "mfc42.dll.#5289",
  1389. "mfc42.dll.#5714",
  1390. "mfc42.dll.#2982",
  1391. "mfc42.dll.#3147",
  1392. "mfc42.dll.#3259",
  1393. "mfc42.dll.#4465",
  1394. "mfc42.dll.#3136",
  1395. "mfc42.dll.#3262",
  1396. "mfc42.dll.#2985",
  1397. "mfc42.dll.#3081",
  1398. "mfc42.dll.#2976",
  1399. "mfc42.dll.#6375",
  1400. "mfc42.dll.#3831",
  1401. "mfc42.dll.#3825",
  1402. "mfc42.dll.#3079",
  1403. "mfc42.dll.#4080",
  1404. "mfc42.dll.#4622",
  1405. "mfc42.dll.#4424",
  1406. "mfc42.dll.#3738",
  1407. "mfc42.dll.#561",
  1408. "mfc42.dll.#825",
  1409. "mfc42.dll.#815",
  1410. "mfc42.dll.#1176",
  1411. "mfc42.dll.#1116",
  1412. "mfc42.dll.#1575",
  1413. "mfc42.dll.#1577",
  1414. "mfc42.dll.#1182",
  1415. "mfc42.dll.#342",
  1416. "mfc42.dll.#1243",
  1417. "mfc42.dll.#1197",
  1418. "mfc42.dll.#1570",
  1419. "mfc42.dll.#1253",
  1420. "mfc42.dll.#1255",
  1421. "mfc42.dll.#1578",
  1422. "mfc42.dll.#600",
  1423. "mfc42.dll.#826",
  1424. "mfc42.dll.#269",
  1425. "mfc42.dll.#6467",
  1426. "mfc42.dll.#1168",
  1427. "mfc42.dll.#3830",
  1428. "mfc42.dll.#4274",
  1429. "msvcrt.dll.malloc",
  1430. "msvcrt.dll.__CxxFrameHandler",
  1431. "msvcrt.dll._EH_prolog",
  1432. "msvcrt.dll.__dllonexit",
  1433. "msvcrt.dll._onexit",
  1434. "msvcrt.dll.??1type_info@@UAE@XZ",
  1435. "msvcrt.dll._adjust_fdiv",
  1436. "msvcrt.dll.fwrite",
  1437. "msvcrt.dll._initterm",
  1438. "msvcrt.dll.free",
  1439. "user32.dll.ToAscii",
  1440. "winkey.dll.installhook",
  1441. "wsock32.dll.WSAStartup",
  1442. "wsock32.dll.getprotobyname",
  1443. "wsock32.dll.htons",
  1444. "wsock32.dll.inet_addr",
  1445. "wsock32.dll.socket",
  1446. "wsock32.dll.bind",
  1447. "wsock32.dll.listen",
  1448. "wsock32.dll.WSAAsyncSelect",
  1449. "reginv.dll.InstallHook",
  1450. "iphlpapi.dll.GetNetworkParams",
  1451. "dnsapi.dll.DnsQueryConfig",
  1452. "iphlpapi.dll.GetAdaptersAddresses",
  1453. "iphlpapi.dll.GetIpInterfaceEntry",
  1454. "iphlpapi.dll.GetBestInterfaceEx",
  1455. "wsock32.dll.WSAAsyncGetHostByName",
  1456. "wsock32.dll.inet_ntoa",
  1457. "wsock32.dll.getservbyname",
  1458. "wsock32.dll.ntohs",
  1459. "wsock32.dll.setsockopt",
  1460. "wsock32.dll.connect",
  1461. "wsock32.dll.WSAGetLastError",
  1462. "wsock32.dll.shutdown",
  1463. "wsock32.dll.closesocket",
  1464. "rpcrt4.dll.I_RpcSNCHOption",
  1465. "sechost.dll.OpenSCManagerW",
  1466. "sechost.dll.OpenServiceW",
  1467. "sechost.dll.CloseServiceHandle"
  1468. ]
  1469.  
  1470. [*] Static Analysis: {
  1471. "pe": {
  1472. "peid_signatures": [
  1473. [
  1474. "FSG v1.33"
  1475. ],
  1476. [
  1477. "FSG v1.33 (Eng) -> dulek/xt"
  1478. ],
  1479. [
  1480. "FSG v1.33 (Eng) -> dulek/xt"
  1481. ]
  1482. ],
  1483. "imports": [
  1484. {
  1485. "imports": [
  1486. {
  1487. "name": "LoadLibraryA",
  1488. "address": "0x403f3b"
  1489. },
  1490. {
  1491. "name": "GetProcAddress",
  1492. "address": "0x403f3f"
  1493. }
  1494. ],
  1495. "dll": "KERNEL32.dll"
  1496. }
  1497. ],
  1498. "digital_signers": null,
  1499. "exported_dll_name": null,
  1500. "actual_checksum": "0x0006209e",
  1501. "overlay": {
  1502. "size": "0x00055a89",
  1503. "offset": "0x00001147"
  1504. },
  1505. "imagebase": "0x00400000",
  1506. "reported_checksum": "0x00000000",
  1507. "icon_hash": null,
  1508. "entrypoint": "0x00403e4e",
  1509. "timestamp": "1987-09-11 01:35:02",
  1510. "osversion": "4.0",
  1511. "sections": [
  1512. {
  1513. "name": "t",
  1514. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1515. "virtual_address": "0x00001000",
  1516. "size_of_data": "0x00000000",
  1517. "entropy": "0.00",
  1518. "raw_address": "0x00000000",
  1519. "virtual_size": "0x00002000",
  1520. "characteristics_raw": "0xc00000e0"
  1521. },
  1522. {
  1523. "name": "c",
  1524. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1525. "virtual_address": "0x00003000",
  1526. "size_of_data": "0x00000f47",
  1527. "entropy": "5.92",
  1528. "raw_address": "0x00000200",
  1529. "virtual_size": "0x00001000",
  1530. "characteristics_raw": "0xc00000e0"
  1531. }
  1532. ],
  1533. "resources": [],
  1534. "dirents": [
  1535. {
  1536. "virtual_address": "0x00000000",
  1537. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1538. "size": "0x00000000"
  1539. },
  1540. {
  1541. "virtual_address": "0x00003f13",
  1542. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1543. "size": "0x00000034"
  1544. },
  1545. {
  1546. "virtual_address": "0x00003000",
  1547. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1548. "size": "0x00000960"
  1549. },
  1550. {
  1551. "virtual_address": "0x00000000",
  1552. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1553. "size": "0x00000000"
  1554. },
  1555. {
  1556. "virtual_address": "0x00000000",
  1557. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1558. "size": "0x00000000"
  1559. },
  1560. {
  1561. "virtual_address": "0x00000000",
  1562. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1563. "size": "0x00000000"
  1564. },
  1565. {
  1566. "virtual_address": "0x00000000",
  1567. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1568. "size": "0x00000000"
  1569. },
  1570. {
  1571. "virtual_address": "0x00000000",
  1572. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1573. "size": "0x00000000"
  1574. },
  1575. {
  1576. "virtual_address": "0x00000000",
  1577. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1578. "size": "0x00000000"
  1579. },
  1580. {
  1581. "virtual_address": "0x00000000",
  1582. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1583. "size": "0x00000000"
  1584. },
  1585. {
  1586. "virtual_address": "0x00000000",
  1587. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1588. "size": "0x00000000"
  1589. },
  1590. {
  1591. "virtual_address": "0x00000000",
  1592. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1593. "size": "0x00000000"
  1594. },
  1595. {
  1596. "virtual_address": "0x00000000",
  1597. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1598. "size": "0x00000000"
  1599. },
  1600. {
  1601. "virtual_address": "0x00000000",
  1602. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1603. "size": "0x00000000"
  1604. },
  1605. {
  1606. "virtual_address": "0x00000000",
  1607. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1608. "size": "0x00000000"
  1609. },
  1610. {
  1611. "virtual_address": "0x00000000",
  1612. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1613. "size": "0x00000000"
  1614. }
  1615. ],
  1616. "exports": [],
  1617. "guest_signers": {},
  1618. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  1619. "icon_fuzzy": null,
  1620. "icon": null,
  1621. "pdbpath": null,
  1622. "imported_dll_count": 1,
  1623. "versioninfo": []
  1624. }
  1625. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!