API tools faq
paste
paladin316

Exes_02cfa3e6fdb4301528e5152de76b2abf_exe_2019-07-02_13_30.json

paladin316
Jul 2nd, 2019
2,164
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 35.41 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Dridex"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_02cfa3e6fdb4301528e5152de76b2abf.exe"
  7. [*] File Size: 115712
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows"
  9. [*] SHA256: "7bcb0abcfbea20ecfe31d8dd65146b8b1ffd0d81479d11dc329b2f99e263bd78"
  10. [*] MD5: "02cfa3e6fdb4301528e5152de76b2abf"
  11. [*] SHA1: "ed205f958fc9a60f3396384d9e1c75feb5b76a91"
  12. [*] SHA512: "ca5599a5a1f6352f185fe3d373bfe01283137e1891b865072440f95b5d2b2f2e7433d765114ba82f4f28d116e95b8b8094504bb01c2a43dea7f592c09e7bc643"
  13. [*] CRC32: "C3057AED"
  14. [*] SSDEEP: "1536:TWTiBUYDoNS23i8RW5+nR/QXphe2Nd0/eoZ7Kls:TWTiqYMYz8RWMQXXxNdiHZ7Kls"
  15.  
  16. [*] Process Execution: [
  17. "Exes_02cfa3e6fdb4301528e5152de76b2abf.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Attempts to connect to a dead IP:Port (4 unique times)",
  23. "Details": [
  24. {
  25. "IP": "66.110.179.66:8080"
  26. },
  27. {
  28. "IP": "176.31.28.253:80"
  29. },
  30. {
  31. "IP": "50.31.1.21:8080"
  32. },
  33. {
  34. "IP": "202.44.54.5:8080"
  35. }
  36. ]
  37. },
  38. {
  39. "Description": "Creates RWX memory",
  40. "Details": []
  41. },
  42. {
  43. "Description": "A process attempted to delay the analysis task.",
  44. "Details": [
  45. {
  46. "Process": "Exes_02cfa3e6fdb4301528e5152de76b2abf.exe tried to sleep 913 seconds, actually delayed analysis time by 0 seconds"
  47. }
  48. ]
  49. },
  50. {
  51. "Description": "The binary likely contains encrypted or compressed data.",
  52. "Details": [
  53. {
  54. "section": "name: ?IEqZ@=0, entropy: 6.97, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00002c00, virtual_size: 0x00002b40"
  55. },
  56. {
  57. "section": "name: uW1, entropy: 6.92, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00002400, virtual_size: 0x00002316"
  58. },
  59. {
  60. "section": "name: .crt, entropy: 6.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00001e00, virtual_size: 0x00001da4"
  61. },
  62. {
  63. "section": "name: DATA, entropy: 7.07, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00002400, virtual_size: 0x000023fb"
  64. }
  65. ]
  66. },
  67. {
  68. "Description": "Exhibits behavior characteristic of Dridex malware",
  69. "Details": []
  70. },
  71. {
  72. "Description": "Collects information about installed applications",
  73. "Details": [
  74. {
  75. "Program": "Microsoft Office Shared 64-bit MUI 2013"
  76. },
  77. {
  78. },
  79. {
  80. "Program": "Microsoft Office 64-bit Components 2013"
  81. },
  82. {
  83. },
  84. {
  85. },
  86. {
  87. },
  88. {
  89. },
  90. {
  91. "Program": "Java 8 Update 201"
  92. },
  93. {
  94. },
  95. {
  96. },
  97. {
  98. "Program": "Oracle VM VirtualBox Guest Additions 6.0.2"
  99. },
  100. {
  101. "Program": "Microsoft Office Shared 64-bit Setup Metadata MUI 2013"
  102. },
  103. {
  104. "Program": "Notepad++"
  105. },
  106. {
  107. },
  108. {
  109. }
  110. ]
  111. },
  112. {
  113. "Description": "Attempts to identify installed AV products by registry key",
  114. "Details": [
  115. {
  116. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\ESET\\ESET Security\\CurrentVersion\\Info"
  117. },
  118. {
  119. "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\Avg\\SystemValues"
  120. }
  121. ]
  122. },
  123. {
  124. "Description": "File has been identified by 55 Antiviruses on VirusTotal as malicious",
  125. "Details": [
  126. {
  127. "K7AntiVirus": "Trojan ( 004ba95c1 )"
  128. },
  129. {
  130. "MicroWorld-eScan": "Trojan.GenericKD.2248653"
  131. },
  132. {
  133. "CAT-QuickHeal": "TrojanDownloader.Drixed.D6"
  134. },
  135. {
  136. "ALYac": "Trojan.GenericKD.2248653"
  137. },
  138. {
  139. "Malwarebytes": "Trojan.FakeMS.ED"
  140. },
  141. {
  142. "Zillya": "Worm.Cridex.Win32.452"
  143. },
  144. {
  145. "TheHacker": "Trojan/Kryptik.dczs"
  146. },
  147. {
  148. "K7GW": "Trojan ( 004ba95c1 )"
  149. },
  150. {
  151. "Arcabit": "Trojan.Generic.D224FCD"
  152. },
  153. {
  154. "TrendMicro": "TSPY_DRIDEX.EKW"
  155. },
  156. {
  157. "F-Prot": "W32/DridLd.BK"
  158. },
  159. {
  160. "Symantec": "Trojan Horse"
  161. },
  162. {
  163. "TrendMicro-HouseCall": "TSPY_DRIDEX.EKW"
  164. },
  165. {
  166. "Avast": "Win32:Malware-gen"
  167. },
  168. {
  169. "ClamAV": "Win.Trojan.Dridex-24"
  170. },
  171. {
  172. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  173. },
  174. {
  175. "BitDefender": "Trojan.GenericKD.2248653"
  176. },
  177. {
  178. "NANO-Antivirus": "Trojan.Win32.Cridex.dpttdb"
  179. },
  180. {
  181. "Tencent": "Win32.Trojan.Generic.Fil"
  182. },
  183. {
  184. "Ad-Aware": "Trojan.GenericKD.2248653"
  185. },
  186. {
  187. "Emsisoft": "Trojan.GenericKD.2248653 (B)"
  188. },
  189. {
  190. "Comodo": "Malware@#2jvf53zmpb2da"
  191. },
  192. {
  193. "F-Secure": "Trojan.GenericKD.2248653"
  194. },
  195. {
  196. "DrWeb": "Trojan.Dridex.75"
  197. },
  198. {
  199. "VIPRE": "Win32.Malware!Drop"
  200. },
  201. {
  202. "Invincea": "heuristic"
  203. },
  204. {
  205. "McAfee-GW-Edition": "BehavesLike.Win32.Virut.cm"
  206. },
  207. {
  208. "Trapmine": "malicious.high.ml.score"
  209. },
  210. {
  211. "Sophos": "Troj/Agent-AMFG"
  212. },
  213. {
  214. "Paloalto": "generic.ml"
  215. },
  216. {
  217. "Cyren": "W32/DridLd.ANXF-3312"
  218. },
  219. {
  220. "Jiangmin": "Worm/Cridex.km"
  221. },
  222. {
  223. "Webroot": "W32.Rogue.Gen"
  224. },
  225. {
  226. "Avira": "HEUR/AGEN.1024084"
  227. },
  228. {
  229. "MAX": "malware (ai score=100)"
  230. },
  231. {
  232. "Antiy-AVL": "Worm/Win32.Cridex"
  233. },
  234. {
  235. "Endgame": "malicious (high confidence)"
  236. },
  237. {
  238. "Microsoft": "Trojan:Win32/Occamy.C"
  239. },
  240. {
  241. "ViRobot": "Trojan.Win32.Z.Dridex.115712.A"
  242. },
  243. {
  244. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  245. },
  246. {
  247. "GData": "Trojan.GenericKD.2248653"
  248. },
  249. {
  250. "AhnLab-V3": "Trojan/Win32.Drixed.R140133"
  251. },
  252. {
  253. "McAfee": "Downloader-FAQM!02CFA3E6FDB4"
  254. },
  255. {
  256. "VBA32": "BScope.Malware-Cryptor.Drixed"
  257. },
  258. {
  259. "Cylance": "Unsafe"
  260. },
  261. {
  262. "ESET-NOD32": "a variant of Win32/Kryptik.DCZS"
  263. },
  264. {
  265. "Rising": "Worm.Cridex!8.BB3 (CLOUD)"
  266. },
  267. {
  268. "Yandex": "Worm.Cridex!Y+9l/6/pWD8"
  269. },
  270. {
  271. "SentinelOne": "static engine - malicious"
  272. },
  273. {
  274. "Fortinet": "W32/Dridex.P!tr"
  275. },
  276. {
  277. "AVG": "Win32:Malware-gen"
  278. },
  279. {
  280. "Cybereason": "malicious.6fdb43"
  281. },
  282. {
  283. "Panda": "Trj/Chgt.O"
  284. },
  285. {
  286. "CrowdStrike": "malicious_confidence_100% (W)"
  287. },
  288. {
  289. "Qihoo-360": "HEUR/QVM20.1.Malware.Gen"
  290. }
  291. ]
  292. },
  293. {
  294. "Description": "Detects VirtualBox through the presence of a registry key",
  295. "Details": []
  296. },
  297. {
  298. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  299. "Details": [
  300. {
  301. "target": "clamav:Win.Trojan.Dridex-24, sha256:7bcb0abcfbea20ecfe31d8dd65146b8b1ffd0d81479d11dc329b2f99e263bd78, type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows"
  302. }
  303. ]
  304. }
  305. ]
  306.  
  307. [*] Started Service: []
  308.  
  309. [*] Executed Commands: []
  310.  
  311. [*] Mutexes: []
  312.  
  313. [*] Modified Files: []
  314.  
  315. [*] Deleted Files: []
  316.  
  317. [*] Modified Registry Keys: []
  318.  
  319. [*] Deleted Registry Keys: []
  320.  
  321. [*] DNS Communications: []
  322.  
  323. [*] Domains: []
  324.  
  325. [*] Network Communication - ICMP: []
  326.  
  327. [*] Network Communication - HTTP: []
  328.  
  329. [*] Network Communication - SMTP: []
  330.  
  331. [*] Network Communication - Hosts: []
  332.  
  333. [*] Network Communication - IRC: []
  334.  
  335. [*] Static Analysis: {
  336. "pe": {
  337. "peid_signatures": [
  338. [
  339. "Microsoft Visual C++ V8.0 (Debug)"
  340. ]
  341. ],
  342. "imports": [
  343. {
  344. "imports": [
  345. {
  346. "name": "sin",
  347. "address": "0x414294"
  348. },
  349. {
  350. "name": "isalpha",
  351. "address": "0x414298"
  352. }
  353. ],
  354. "dll": "ntdll.dll"
  355. },
  356. {
  357. "imports": [
  358. {
  359. "name": "wcsftime",
  360. "address": "0x414260"
  361. },
  362. {
  363. "name": "ferror",
  364. "address": "0x414264"
  365. }
  366. ],
  367. "dll": "msvcrt.dll"
  368. },
  369. {
  370. "imports": [
  371. {
  372. "name": "SetupGetLineTextW",
  373. "address": "0x414230"
  374. }
  375. ],
  376. "dll": "SETUPAPI.dll"
  377. },
  378. {
  379. "imports": [
  380. {
  381. "name": "JetRestore2",
  382. "address": "0x4141a0"
  383. }
  384. ],
  385. "dll": "ESENT.dll"
  386. },
  387. {
  388. "imports": [
  389. {
  390. "name": "GetCurrentActCtx",
  391. "address": "0x4141d0"
  392. },
  393. {
  394. "name": "GetCommConfig",
  395. "address": "0x4141d4"
  396. },
  397. {
  398. "name": "SetSystemTimeAdjustment",
  399. "address": "0x4141d8"
  400. },
  401. {
  402. "name": "WritePrivateProfileStringW",
  403. "address": "0x4141dc"
  404. },
  405. {
  406. "name": "GlobalAddAtomA",
  407. "address": "0x4141e0"
  408. },
  409. {
  410. "name": "GetSystemTimes",
  411. "address": "0x4141e4"
  412. },
  413. {
  414. "name": "GetDateFormatA",
  415. "address": "0x4141e8"
  416. },
  417. {
  418. "name": "SetFilePointerEx",
  419. "address": "0x4141ec"
  420. },
  421. {
  422. "name": "ExitThread",
  423. "address": "0x4141f0"
  424. },
  425. {
  426. "name": "UnlockFileEx",
  427. "address": "0x4141f4"
  428. },
  429. {
  430. "name": "WideCharToMultiByte",
  431. "address": "0x4141f8"
  432. }
  433. ],
  434. "dll": "KERNEL32.dll"
  435. }
  436. ],
  437. "digital_signers": null,
  438. "exported_dll_name": null,
  439. "actual_checksum": "0x0001f568",
  440. "overlay": null,
  441. "imagebase": "0x00400000",
  442. "reported_checksum": "0x00000000",
  443. "icon_hash": null,
  444. "entrypoint": "0x00401073",
  445. "timestamp": "2015-03-25 09:51:58",
  446. "osversion": "4.0",
  447. "sections": [
  448. {
  449. "name": ".text",
  450. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  451. "virtual_address": "0x00001000",
  452. "size_of_data": "0x0000c000",
  453. "entropy": "4.42",
  454. "raw_address": "0x00000400",
  455. "virtual_size": "0x0000bfdc",
  456. "characteristics_raw": "0x60000020"
  457. },
  458. {
  459. "name": ".rdata",
  460. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  461. "virtual_address": "0x0000d000",
  462. "size_of_data": "0x00000400",
  463. "entropy": "0.49",
  464. "raw_address": "0x0000c400",
  465. "virtual_size": "0x0000029c",
  466. "characteristics_raw": "0x40000040"
  467. },
  468. {
  469. "name": ".data",
  470. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  471. "virtual_address": "0x0000e000",
  472. "size_of_data": "0x00000800",
  473. "entropy": "3.75",
  474. "raw_address": "0x0000c800",
  475. "virtual_size": "0x00005384",
  476. "characteristics_raw": "0xc0000040"
  477. },
  478. {
  479. "name": ".idata",
  480. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  481. "virtual_address": "0x00014000",
  482. "size_of_data": "0x00000600",
  483. "entropy": "2.58",
  484. "raw_address": "0x0000d000",
  485. "virtual_size": "0x0000055a",
  486. "characteristics_raw": "0xc0000040"
  487. },
  488. {
  489. "name": "?IEqZ@=0",
  490. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  491. "virtual_address": "0x00015000",
  492. "size_of_data": "0x00002c00",
  493. "entropy": "6.97",
  494. "raw_address": "0x0000d600",
  495. "virtual_size": "0x00002b40",
  496. "characteristics_raw": "0xc0000040"
  497. },
  498. {
  499. "name": "JBHCF",
  500. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  501. "virtual_address": "0x00018000",
  502. "size_of_data": "0x00001400",
  503. "entropy": "6.50",
  504. "raw_address": "0x00010200",
  505. "virtual_size": "0x00001266",
  506. "characteristics_raw": "0xc0000041"
  507. },
  508. {
  509. "name": "uW1",
  510. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  511. "virtual_address": "0x0001a000",
  512. "size_of_data": "0x00002400",
  513. "entropy": "6.92",
  514. "raw_address": "0x00011600",
  515. "virtual_size": "0x00002316",
  516. "characteristics_raw": "0xc0000040"
  517. },
  518. {
  519. "name": ".crt",
  520. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  521. "virtual_address": "0x0001d000",
  522. "size_of_data": "0x00001e00",
  523. "entropy": "6.94",
  524. "raw_address": "0x00013a00",
  525. "virtual_size": "0x00001da4",
  526. "characteristics_raw": "0xc0000040"
  527. },
  528. {
  529. "name": "AM",
  530. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  531. "virtual_address": "0x0001f000",
  532. "size_of_data": "0x00000800",
  533. "entropy": "5.72",
  534. "raw_address": "0x00015800",
  535. "virtual_size": "0x000006f7",
  536. "characteristics_raw": "0xc0000040"
  537. },
  538. {
  539. "name": "GmT?Qe",
  540. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  541. "virtual_address": "0x00020000",
  542. "size_of_data": "0x00000a00",
  543. "entropy": "6.44",
  544. "raw_address": "0x00016000",
  545. "virtual_size": "0x000009bb",
  546. "characteristics_raw": "0xc0000040"
  547. },
  548. {
  549. "name": "u",
  550. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  551. "virtual_address": "0x00021000",
  552. "size_of_data": "0x00000a00",
  553. "entropy": "5.96",
  554. "raw_address": "0x00016a00",
  555. "virtual_size": "0x000008d2",
  556. "characteristics_raw": "0xc0000040"
  557. },
  558. {
  559. "name": "DATA",
  560. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  561. "virtual_address": "0x00022000",
  562. "size_of_data": "0x00002400",
  563. "entropy": "7.07",
  564. "raw_address": "0x00017400",
  565. "virtual_size": "0x000023fb",
  566. "characteristics_raw": "0xc0000040"
  567. },
  568. {
  569. "name": "J6aV*rw=",
  570. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  571. "virtual_address": "0x00025000",
  572. "size_of_data": "0x00000800",
  573. "entropy": "5.23",
  574. "raw_address": "0x00019800",
  575. "virtual_size": "0x00000655",
  576. "characteristics_raw": "0xc0000040"
  577. },
  578. {
  579. "name": ".rsrc",
  580. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  581. "virtual_address": "0x00026000",
  582. "size_of_data": "0x00002400",
  583. "entropy": "3.60",
  584. "raw_address": "0x0001a000",
  585. "virtual_size": "0x0000236c",
  586. "characteristics_raw": "0x40000041"
  587. }
  588. ],
  589. "resources": [],
  590. "dirents": [
  591. {
  592. "virtual_address": "0x00000000",
  593. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  594. "size": "0x00000000"
  595. },
  596. {
  597. "virtual_address": "0x00014000",
  598. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  599. "size": "0x00000079"
  600. },
  601. {
  602. "virtual_address": "0x00026000",
  603. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  604. "size": "0x00001001"
  605. },
  606. {
  607. "virtual_address": "0x00000000",
  608. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  609. "size": "0x00000000"
  610. },
  611. {
  612. "virtual_address": "0x00000000",
  613. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  614. "size": "0x00000000"
  615. },
  616. {
  617. "virtual_address": "0x00000000",
  618. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  619. "size": "0x00000000"
  620. },
  621. {
  622. "virtual_address": "0x00000000",
  623. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  624. "size": "0x00000000"
  625. },
  626. {
  627. "virtual_address": "0x00000000",
  628. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  629. "size": "0x00000000"
  630. },
  631. {
  632. "virtual_address": "0x00000000",
  633. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  634. "size": "0x00000000"
  635. },
  636. {
  637. "virtual_address": "0x00000000",
  638. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  639. "size": "0x00000000"
  640. },
  641. {
  642. "virtual_address": "0x00000000",
  643. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  644. "size": "0x00000000"
  645. },
  646. {
  647. "virtual_address": "0x00000000",
  648. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  649. "size": "0x00000000"
  650. },
  651. {
  652. "virtual_address": "0x000141a0",
  653. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  654. "size": "0x00000128"
  655. },
  656. {
  657. "virtual_address": "0x00000000",
  658. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  659. "size": "0x00000000"
  660. },
  661. {
  662. "virtual_address": "0x00000000",
  663. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  664. "size": "0x00000000"
  665. },
  666. {
  667. "virtual_address": "0x00000000",
  668. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  669. "size": "0x00000000"
  670. }
  671. ],
  672. "exports": [],
  673. "guest_signers": {},
  674. "imphash": "b9c933a60d12e9559f65bc2b82f21159",
  675. "icon_fuzzy": null,
  676. "icon": null,
  677. "pdbpath": null,
  678. "imported_dll_count": 5,
  679. "versioninfo": []
  680. }
  681. }
  682.  
  683. [*] Resolved APIs: [
  684. "kernel32.dll.GetProcessHeap",
  685. "kernel32.dll.HeapAlloc",
  686. "kernel32.dll.VirtualAlloc",
  687. "kernel32.dll.VirtualProtect",
  688. "kernel32.dll.VirtualFree",
  689. "kernel32.dll.LoadLibraryA",
  690. "kernel32.dll.GetProcAddress",
  691. "kernel32.dll.UnmapViewOfFile",
  692. "user32.dll.GetClassNameA",
  693. "user32.dll.GetWindowTextA",
  694. "user32.dll.CharLowerA",
  695. "user32.dll.CharLowerW",
  696. "user32.dll.CharUpperA",
  697. "shlwapi.dll.wvnsprintfW",
  698. "shlwapi.dll.wvnsprintfA",
  699. "kernel32.dll.MultiByteToWideChar",
  700. "kernel32.dll.LocalFree",
  701. "kernel32.dll.HeapFree",
  702. "kernel32.dll.CompareStringA",
  703. "kernel32.dll.CompareStringW",
  704. "kernel32.dll.lstrlenA",
  705. "kernel32.dll.lstrlenW",
  706. "kernel32.dll.lstrcpynA",
  707. "kernel32.dll.lstrcpyA",
  708. "kernel32.dll.lstrcpynW",
  709. "kernel32.dll.lstrcpyW",
  710. "kernel32.dll.lstrcatA",
  711. "kernel32.dll.lstrcatW",
  712. "kernel32.dll.WideCharToMultiByte",
  713. "kernel32.dll.LoadLibraryW",
  714. "kernel32.dll.RtlFillMemory",
  715. "kernel32.dll.RtlMoveMemory",
  716. "kernel32.dll.SortGetHandle",
  717. "kernel32.dll.SortCloseHandle",
  718. "cryptsp.dll.CryptAcquireContextW",
  719. "cryptsp.dll.CryptCreateHash",
  720. "cryptsp.dll.CryptHashData",
  721. "cryptsp.dll.CryptGetHashParam",
  722. "cryptsp.dll.CryptDestroyHash",
  723. "cryptsp.dll.CryptReleaseContext"
  724. ]
  725.  
  726. [*] Static Analysis: {
  727. "pe": {
  728. "peid_signatures": [
  729. [
  730. "Microsoft Visual C++ V8.0 (Debug)"
  731. ]
  732. ],
  733. "imports": [
  734. {
  735. "imports": [
  736. {
  737. "name": "sin",
  738. "address": "0x414294"
  739. },
  740. {
  741. "name": "isalpha",
  742. "address": "0x414298"
  743. }
  744. ],
  745. "dll": "ntdll.dll"
  746. },
  747. {
  748. "imports": [
  749. {
  750. "name": "wcsftime",
  751. "address": "0x414260"
  752. },
  753. {
  754. "name": "ferror",
  755. "address": "0x414264"
  756. }
  757. ],
  758. "dll": "msvcrt.dll"
  759. },
  760. {
  761. "imports": [
  762. {
  763. "name": "SetupGetLineTextW",
  764. "address": "0x414230"
  765. }
  766. ],
  767. "dll": "SETUPAPI.dll"
  768. },
  769. {
  770. "imports": [
  771. {
  772. "name": "JetRestore2",
  773. "address": "0x4141a0"
  774. }
  775. ],
  776. "dll": "ESENT.dll"
  777. },
  778. {
  779. "imports": [
  780. {
  781. "name": "GetCurrentActCtx",
  782. "address": "0x4141d0"
  783. },
  784. {
  785. "name": "GetCommConfig",
  786. "address": "0x4141d4"
  787. },
  788. {
  789. "name": "SetSystemTimeAdjustment",
  790. "address": "0x4141d8"
  791. },
  792. {
  793. "name": "WritePrivateProfileStringW",
  794. "address": "0x4141dc"
  795. },
  796. {
  797. "name": "GlobalAddAtomA",
  798. "address": "0x4141e0"
  799. },
  800. {
  801. "name": "GetSystemTimes",
  802. "address": "0x4141e4"
  803. },
  804. {
  805. "name": "GetDateFormatA",
  806. "address": "0x4141e8"
  807. },
  808. {
  809. "name": "SetFilePointerEx",
  810. "address": "0x4141ec"
  811. },
  812. {
  813. "name": "ExitThread",
  814. "address": "0x4141f0"
  815. },
  816. {
  817. "name": "UnlockFileEx",
  818. "address": "0x4141f4"
  819. },
  820. {
  821. "name": "WideCharToMultiByte",
  822. "address": "0x4141f8"
  823. }
  824. ],
  825. "dll": "KERNEL32.dll"
  826. }
  827. ],
  828. "digital_signers": null,
  829. "exported_dll_name": null,
  830. "actual_checksum": "0x0001f568",
  831. "overlay": null,
  832. "imagebase": "0x00400000",
  833. "reported_checksum": "0x00000000",
  834. "icon_hash": null,
  835. "entrypoint": "0x00401073",
  836. "timestamp": "2015-03-25 09:51:58",
  837. "osversion": "4.0",
  838. "sections": [
  839. {
  840. "name": ".text",
  841. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  842. "virtual_address": "0x00001000",
  843. "size_of_data": "0x0000c000",
  844. "entropy": "4.42",
  845. "raw_address": "0x00000400",
  846. "virtual_size": "0x0000bfdc",
  847. "characteristics_raw": "0x60000020"
  848. },
  849. {
  850. "name": ".rdata",
  851. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  852. "virtual_address": "0x0000d000",
  853. "size_of_data": "0x00000400",
  854. "entropy": "0.49",
  855. "raw_address": "0x0000c400",
  856. "virtual_size": "0x0000029c",
  857. "characteristics_raw": "0x40000040"
  858. },
  859. {
  860. "name": ".data",
  861. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  862. "virtual_address": "0x0000e000",
  863. "size_of_data": "0x00000800",
  864. "entropy": "3.75",
  865. "raw_address": "0x0000c800",
  866. "virtual_size": "0x00005384",
  867. "characteristics_raw": "0xc0000040"
  868. },
  869. {
  870. "name": ".idata",
  871. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  872. "virtual_address": "0x00014000",
  873. "size_of_data": "0x00000600",
  874. "entropy": "2.58",
  875. "raw_address": "0x0000d000",
  876. "virtual_size": "0x0000055a",
  877. "characteristics_raw": "0xc0000040"
  878. },
  879. {
  880. "name": "?IEqZ@=0",
  881. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  882. "virtual_address": "0x00015000",
  883. "size_of_data": "0x00002c00",
  884. "entropy": "6.97",
  885. "raw_address": "0x0000d600",
  886. "virtual_size": "0x00002b40",
  887. "characteristics_raw": "0xc0000040"
  888. },
  889. {
  890. "name": "JBHCF",
  891. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  892. "virtual_address": "0x00018000",
  893. "size_of_data": "0x00001400",
  894. "entropy": "6.50",
  895. "raw_address": "0x00010200",
  896. "virtual_size": "0x00001266",
  897. "characteristics_raw": "0xc0000041"
  898. },
  899. {
  900. "name": "uW1",
  901. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  902. "virtual_address": "0x0001a000",
  903. "size_of_data": "0x00002400",
  904. "entropy": "6.92",
  905. "raw_address": "0x00011600",
  906. "virtual_size": "0x00002316",
  907. "characteristics_raw": "0xc0000040"
  908. },
  909. {
  910. "name": ".crt",
  911. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  912. "virtual_address": "0x0001d000",
  913. "size_of_data": "0x00001e00",
  914. "entropy": "6.94",
  915. "raw_address": "0x00013a00",
  916. "virtual_size": "0x00001da4",
  917. "characteristics_raw": "0xc0000040"
  918. },
  919. {
  920. "name": "AM",
  921. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  922. "virtual_address": "0x0001f000",
  923. "size_of_data": "0x00000800",
  924. "entropy": "5.72",
  925. "raw_address": "0x00015800",
  926. "virtual_size": "0x000006f7",
  927. "characteristics_raw": "0xc0000040"
  928. },
  929. {
  930. "name": "GmT?Qe",
  931. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  932. "virtual_address": "0x00020000",
  933. "size_of_data": "0x00000a00",
  934. "entropy": "6.44",
  935. "raw_address": "0x00016000",
  936. "virtual_size": "0x000009bb",
  937. "characteristics_raw": "0xc0000040"
  938. },
  939. {
  940. "name": "u",
  941. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  942. "virtual_address": "0x00021000",
  943. "size_of_data": "0x00000a00",
  944. "entropy": "5.96",
  945. "raw_address": "0x00016a00",
  946. "virtual_size": "0x000008d2",
  947. "characteristics_raw": "0xc0000040"
  948. },
  949. {
  950. "name": "DATA",
  951. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  952. "virtual_address": "0x00022000",
  953. "size_of_data": "0x00002400",
  954. "entropy": "7.07",
  955. "raw_address": "0x00017400",
  956. "virtual_size": "0x000023fb",
  957. "characteristics_raw": "0xc0000040"
  958. },
  959. {
  960. "name": "J6aV*rw=",
  961. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  962. "virtual_address": "0x00025000",
  963. "size_of_data": "0x00000800",
  964. "entropy": "5.23",
  965. "raw_address": "0x00019800",
  966. "virtual_size": "0x00000655",
  967. "characteristics_raw": "0xc0000040"
  968. },
  969. {
  970. "name": ".rsrc",
  971. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  972. "virtual_address": "0x00026000",
  973. "size_of_data": "0x00002400",
  974. "entropy": "3.60",
  975. "raw_address": "0x0001a000",
  976. "virtual_size": "0x0000236c",
  977. "characteristics_raw": "0x40000041"
  978. }
  979. ],
  980. "resources": [],
  981. "dirents": [
  982. {
  983. "virtual_address": "0x00000000",
  984. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  985. "size": "0x00000000"
  986. },
  987. {
  988. "virtual_address": "0x00014000",
  989. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  990. "size": "0x00000079"
  991. },
  992. {
  993. "virtual_address": "0x00026000",
  994. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  995. "size": "0x00001001"
  996. },
  997. {
  998. "virtual_address": "0x00000000",
  999. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1000. "size": "0x00000000"
  1001. },
  1002. {
  1003. "virtual_address": "0x00000000",
  1004. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1005. "size": "0x00000000"
  1006. },
  1007. {
  1008. "virtual_address": "0x00000000",
  1009. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1010. "size": "0x00000000"
  1011. },
  1012. {
  1013. "virtual_address": "0x00000000",
  1014. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1015. "size": "0x00000000"
  1016. },
  1017. {
  1018. "virtual_address": "0x00000000",
  1019. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1020. "size": "0x00000000"
  1021. },
  1022. {
  1023. "virtual_address": "0x00000000",
  1024. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1025. "size": "0x00000000"
  1026. },
  1027. {
  1028. "virtual_address": "0x00000000",
  1029. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1030. "size": "0x00000000"
  1031. },
  1032. {
  1033. "virtual_address": "0x00000000",
  1034. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1035. "size": "0x00000000"
  1036. },
  1037. {
  1038. "virtual_address": "0x00000000",
  1039. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1040. "size": "0x00000000"
  1041. },
  1042. {
  1043. "virtual_address": "0x000141a0",
  1044. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1045. "size": "0x00000128"
  1046. },
  1047. {
  1048. "virtual_address": "0x00000000",
  1049. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1050. "size": "0x00000000"
  1051. },
  1052. {
  1053. "virtual_address": "0x00000000",
  1054. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1055. "size": "0x00000000"
  1056. },
  1057. {
  1058. "virtual_address": "0x00000000",
  1059. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1060. "size": "0x00000000"
  1061. }
  1062. ],
  1063. "exports": [],
  1064. "guest_signers": {},
  1065. "imphash": "b9c933a60d12e9559f65bc2b82f21159",
  1066. "icon_fuzzy": null,
  1067. "icon": null,
  1068. "pdbpath": null,
  1069. "imported_dll_count": 5,
  1070. "versioninfo": []
  1071. }
  1072. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!