API tools faq
paste
paladin316

customconnector_dll_2019-06-24_20_30.json

paladin316
Jun 24th, 2019
2,203
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.93 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Spyeyes"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "customconnector.dll"
  7. [*] File Size: 6144
  8. [*] File Type: "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "32962c8844777b43117470729fce8bb289edf285c22b1b709e8276e7626fa012"
  10. [*] MD5: "1bebb83a6e5418935ef7c38efc56b983"
  11. [*] SHA1: "0235364327eea68f4b429627e759afafee060644"
  12. [*] SHA512: "dc571e52d96f070573b44e473d2ee1e62b17df9eaad087af75894fc2fc59d962341858b6dbc7ee198dccc98e13a82ab1c9e18098d68de2233e24fe6445145fbb"
  13. [*] CRC32: "A278B526"
  14. [*] SSDEEP: "96:blc3Ookp7GSvOZ6Yu6qR27jfltw5OaaJ/Hl4eazPzM0KE0:bl6OoJUzeqGjttb+eQPzM0KE"
  15.  
  16. [*] Process Execution: [
  17. "rundll32.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "File has been identified by 43 Antiviruses on VirusTotal as malicious",
  27. "Details": [
  28. {
  29. "Bkav": "W32.SpyGenFamVKSC.Trojan"
  30. },
  31. {
  32. "MicroWorld-eScan": "Gen:Variant.Buzy.4367"
  33. },
  34. {
  35. "nProtect": "Trojan/W32.Small.6144.DC"
  36. },
  37. {
  38. "CAT-QuickHeal": "Trojan.ZAgent.r4"
  39. },
  40. {
  41. "McAfee": "Artemis!1BEBB83A6E54"
  42. },
  43. {
  44. "Zillya": "Trojan.SpyEyes.Win32.1182"
  45. },
  46. {
  47. "TheHacker": "Trojan/Spy.SpyEyes.epb"
  48. },
  49. {
  50. "K7GW": "Spyware ( 001e277a1 )"
  51. },
  52. {
  53. "K7AntiVirus": "Spyware ( 001e277a1 )"
  54. },
  55. {
  56. "NANO-Antivirus": "Trojan.Win32.SpyEyes.diaij"
  57. },
  58. {
  59. "Symantec": "Infostealer"
  60. },
  61. {
  62. "ESET-NOD32": "Win32/Spy.SpyEye"
  63. },
  64. {
  65. "Avast": "Win32:SpyeyePlugin-D [Trj]"
  66. },
  67. {
  68. "GData": "Gen:Variant.Buzy.4367"
  69. },
  70. {
  71. "Kaspersky": "Trojan-Spy.Win32.SpyEyes.epb"
  72. },
  73. {
  74. "BitDefender": "Gen:Variant.Buzy.4367"
  75. },
  76. {
  77. "Agnitum": "TrojanSpy.SpyEyes!ndDuhdOynRM"
  78. },
  79. {
  80. "Tencent": "Win32.Trojan-Spy.Spyeyes.kox"
  81. },
  82. {
  83. "Ad-Aware": "Gen:Variant.Buzy.4367"
  84. },
  85. {
  86. "Emsisoft": "Gen:Variant.Buzy.4367 (B)"
  87. },
  88. {
  89. "Comodo": "UnclassifiedMalware"
  90. },
  91. {
  92. "F-Secure": "Gen:Variant.Buzy.4367"
  93. },
  94. {
  95. "DrWeb": "Trojan.PWS.SpySweep.60"
  96. },
  97. {
  98. "VIPRE": "Trojan.Win32.Generic!BT"
  99. },
  100. {
  101. "McAfee-GW-Edition": "Artemis!Trojan"
  102. },
  103. {
  104. "Sophos": "Troj/SpyEyeDl-A"
  105. },
  106. {
  107. "Jiangmin": "TrojanSpy.SpyEyes.doe"
  108. },
  109. {
  110. "Avira": "TR/Spy.SpyEyes.epb"
  111. },
  112. {
  113. "Antiy-AVL": "Trojan[Spy]/Win32.SpyEyes"
  114. },
  115. {
  116. "Kingsoft": "Win32.Troj.SpyEyes.(kcloud)"
  117. },
  118. {
  119. "Arcabit": "Trojan.Buzy.D110F"
  120. },
  121. {
  122. "ViRobot": "Trojan.Win32.A.SpyEyes.6144[h]"
  123. },
  124. {
  125. "Microsoft": "Trojan:Win32/EyeStye.plugin"
  126. },
  127. {
  128. "TotalDefense": "Win32/SpyEye.VH"
  129. },
  130. {
  131. "ALYac": "Gen:Variant.Buzy.4367"
  132. },
  133. {
  134. "AVware": "Trojan.Win32.Generic!BT"
  135. },
  136. {
  137. "VBA32": "TrojanSpy.SpyEyes"
  138. },
  139. {
  140. "Baidu-International": "Trojan.Win32.SpyEyes.epb"
  141. },
  142. {
  143. "Ikarus": "Trojan-Spy.Win32.SpyEyes"
  144. },
  145. {
  146. "Fortinet": "W32/SpyEyes.EPB!tr"
  147. },
  148. {
  149. "AVG": "PSW.Generic8.BCQL"
  150. },
  151. {
  152. "Panda": "Generic Malware"
  153. },
  154. {
  155. "Qihoo-360": "HEUR/Malware.QVM21.Gen"
  156. }
  157. ]
  158. }
  159. ]
  160.  
  161. [*] Started Service: []
  162.  
  163. [*] Executed Commands: []
  164.  
  165. [*] Mutexes: []
  166.  
  167. [*] Modified Files: []
  168.  
  169. [*] Deleted Files: []
  170.  
  171. [*] Modified Registry Keys: []
  172.  
  173. [*] Deleted Registry Keys: []
  174.  
  175. [*] DNS Communications: []
  176.  
  177. [*] Domains: []
  178.  
  179. [*] Network Communication - ICMP: []
  180.  
  181. [*] Network Communication - HTTP: []
  182.  
  183. [*] Network Communication - SMTP: []
  184.  
  185. [*] Network Communication - Hosts: []
  186.  
  187. [*] Network Communication - IRC: []
  188.  
  189. [*] Static Analysis: {
  190. "pe": {
  191. "peid_signatures": null,
  192. "imports": [
  193. {
  194. "imports": [
  195. {
  196. "name": "_snprintf",
  197. "address": "0x10002058"
  198. },
  199. {
  200. "name": "atoi",
  201. "address": "0x1000205c"
  202. },
  203. {
  204. "name": "memcpy",
  205. "address": "0x10002060"
  206. },
  207. {
  208. "name": "memset",
  209. "address": "0x10002064"
  210. }
  211. ],
  212. "dll": "ntdll.dll"
  213. },
  214. {
  215. "imports": [
  216. {
  217. "name": "SHGetValueA",
  218. "address": "0x10002050"
  219. }
  220. ],
  221. "dll": "SHLWAPI.dll"
  222. },
  223. {
  224. "imports": [
  225. {
  226. "name": "GetComputerNameA",
  227. "address": "0x10002014"
  228. },
  229. {
  230. "name": "HeapAlloc",
  231. "address": "0x10002018"
  232. },
  233. {
  234. "name": "HeapFree",
  235. "address": "0x1000201c"
  236. },
  237. {
  238. "name": "GetProcessHeap",
  239. "address": "0x10002020"
  240. },
  241. {
  242. "name": "IsBadReadPtr",
  243. "address": "0x10002024"
  244. },
  245. {
  246. "name": "TerminateThread",
  247. "address": "0x10002028"
  248. },
  249. {
  250. "name": "Sleep",
  251. "address": "0x1000202c"
  252. },
  253. {
  254. "name": "HeapValidate",
  255. "address": "0x10002030"
  256. },
  257. {
  258. "name": "GetProcAddress",
  259. "address": "0x10002034"
  260. },
  261. {
  262. "name": "CreateThread",
  263. "address": "0x10002038"
  264. },
  265. {
  266. "name": "LocalAlloc",
  267. "address": "0x1000203c"
  268. },
  269. {
  270. "name": "GetVersionExA",
  271. "address": "0x10002040"
  272. },
  273. {
  274. "name": "LocalFree",
  275. "address": "0x10002044"
  276. },
  277. {
  278. "name": "LoadLibraryA",
  279. "address": "0x10002048"
  280. }
  281. ],
  282. "dll": "KERNEL32.dll"
  283. },
  284. {
  285. "imports": [
  286. {
  287. "name": "CheckTokenMembership",
  288. "address": "0x10002000"
  289. },
  290. {
  291. "name": "FreeSid",
  292. "address": "0x10002004"
  293. },
  294. {
  295. "name": "AllocateAndInitializeSid",
  296. "address": "0x10002008"
  297. },
  298. {
  299. "name": "LookupAccountNameA",
  300. "address": "0x1000200c"
  301. }
  302. ],
  303. "dll": "ADVAPI32.dll"
  304. }
  305. ],
  306. "digital_signers": null,
  307. "exported_dll_name": "customconnector.dll",
  308. "actual_checksum": "0x0000a82f",
  309. "overlay": null,
  310. "imagebase": "0x10000000",
  311. "reported_checksum": "0x00000000",
  312. "icon_hash": null,
  313. "entrypoint": "0x10001057",
  314. "timestamp": "2011-01-11 08:05:20",
  315. "osversion": "5.1",
  316. "sections": [
  317. {
  318. "name": ".text",
  319. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  320. "virtual_address": "0x00001000",
  321. "size_of_data": "0x00000a00",
  322. "entropy": "5.94",
  323. "raw_address": "0x00000400",
  324. "virtual_size": "0x0000096c",
  325. "characteristics_raw": "0x60000020"
  326. },
  327. {
  328. "name": ".rdata",
  329. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  330. "virtual_address": "0x00002000",
  331. "size_of_data": "0x00000600",
  332. "entropy": "4.76",
  333. "raw_address": "0x00000e00",
  334. "virtual_size": "0x00000564",
  335. "characteristics_raw": "0x40000040"
  336. },
  337. {
  338. "name": ".data",
  339. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  340. "virtual_address": "0x00003000",
  341. "size_of_data": "0x00000200",
  342. "entropy": "0.06",
  343. "raw_address": "0x00001400",
  344. "virtual_size": "0x000005cd",
  345. "characteristics_raw": "0xc0000040"
  346. },
  347. {
  348. "name": ".reloc",
  349. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  350. "virtual_address": "0x00004000",
  351. "size_of_data": "0x00000200",
  352. "entropy": "3.21",
  353. "raw_address": "0x00001600",
  354. "virtual_size": "0x00000118",
  355. "characteristics_raw": "0x42000040"
  356. }
  357. ],
  358. "resources": [],
  359. "dirents": [
  360. {
  361. "virtual_address": "0x000023e0",
  362. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  363. "size": "0x00000184"
  364. },
  365. {
  366. "virtual_address": "0x00002180",
  367. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  368. "size": "0x00000064"
  369. },
  370. {
  371. "virtual_address": "0x00000000",
  372. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  373. "size": "0x00000000"
  374. },
  375. {
  376. "virtual_address": "0x00000000",
  377. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  378. "size": "0x00000000"
  379. },
  380. {
  381. "virtual_address": "0x00000000",
  382. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  383. "size": "0x00000000"
  384. },
  385. {
  386. "virtual_address": "0x00004000",
  387. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  388. "size": "0x000000d8"
  389. },
  390. {
  391. "virtual_address": "0x00000000",
  392. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  393. "size": "0x00000000"
  394. },
  395. {
  396. "virtual_address": "0x00000000",
  397. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  398. "size": "0x00000000"
  399. },
  400. {
  401. "virtual_address": "0x00000000",
  402. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  403. "size": "0x00000000"
  404. },
  405. {
  406. "virtual_address": "0x00000000",
  407. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  408. "size": "0x00000000"
  409. },
  410. {
  411. "virtual_address": "0x00000000",
  412. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  413. "size": "0x00000000"
  414. },
  415. {
  416. "virtual_address": "0x00000000",
  417. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  418. "size": "0x00000000"
  419. },
  420. {
  421. "virtual_address": "0x00002000",
  422. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  423. "size": "0x0000006c"
  424. },
  425. {
  426. "virtual_address": "0x00000000",
  427. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  428. "size": "0x00000000"
  429. },
  430. {
  431. "virtual_address": "0x00000000",
  432. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  433. "size": "0x00000000"
  434. },
  435. {
  436. "virtual_address": "0x00000000",
  437. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  438. "size": "0x00000000"
  439. }
  440. ],
  441. "exports": [
  442. {
  443. "ordinal": 1,
  444. "name": "Init",
  445. "address": "0x1000105d"
  446. },
  447. {
  448. "ordinal": 2,
  449. "name": "MainCpGateInput",
  450. "address": "0x100018b9"
  451. },
  452. {
  453. "ordinal": 3,
  454. "name": "Start",
  455. "address": "0x100010b5"
  456. },
  457. {
  458. "ordinal": 4,
  459. "name": "Stop",
  460. "address": "0x100010b9"
  461. },
  462. {
  463. "ordinal": 5,
  464. "name": "TakeBotExeMd5Callback",
  465. "address": "0x1000117e"
  466. },
  467. {
  468. "ordinal": 6,
  469. "name": "TakeBotGuid",
  470. "address": "0x100010d8"
  471. },
  472. {
  473. "ordinal": 7,
  474. "name": "TakeBotVersion",
  475. "address": "0x10001164"
  476. },
  477. {
  478. "ordinal": 8,
  479. "name": "TakeConfigCrc32Callback",
  480. "address": "0x10001171"
  481. },
  482. {
  483. "ordinal": 9,
  484. "name": "TakeFreeMem",
  485. "address": "0x10001157"
  486. },
  487. {
  488. "ordinal": 10,
  489. "name": "TakeGetPage2",
  490. "address": "0x100010cb"
  491. },
  492. {
  493. "ordinal": 11,
  494. "name": "TakeMainCpGateOutputCallback",
  495. "address": "0x10001198"
  496. },
  497. {
  498. "ordinal": 12,
  499. "name": "TakePluginsListCallback",
  500. "address": "0x1000118b"
  501. },
  502. {
  503. "ordinal": 13,
  504. "name": "Uncontrollable",
  505. "address": "0x100011a5"
  506. }
  507. ],
  508. "guest_signers": {},
  509. "imphash": "234746223e26b4a2254f7d92fc2318f7",
  510. "icon_fuzzy": null,
  511. "icon": null,
  512. "pdbpath": null,
  513. "imported_dll_count": 4,
  514. "versioninfo": []
  515. }
  516. }
  517.  
  518. [*] Resolved APIs: []
  519.  
  520. [*] Static Analysis: {
  521. "pe": {
  522. "peid_signatures": null,
  523. "imports": [
  524. {
  525. "imports": [
  526. {
  527. "name": "_snprintf",
  528. "address": "0x10002058"
  529. },
  530. {
  531. "name": "atoi",
  532. "address": "0x1000205c"
  533. },
  534. {
  535. "name": "memcpy",
  536. "address": "0x10002060"
  537. },
  538. {
  539. "name": "memset",
  540. "address": "0x10002064"
  541. }
  542. ],
  543. "dll": "ntdll.dll"
  544. },
  545. {
  546. "imports": [
  547. {
  548. "name": "SHGetValueA",
  549. "address": "0x10002050"
  550. }
  551. ],
  552. "dll": "SHLWAPI.dll"
  553. },
  554. {
  555. "imports": [
  556. {
  557. "name": "GetComputerNameA",
  558. "address": "0x10002014"
  559. },
  560. {
  561. "name": "HeapAlloc",
  562. "address": "0x10002018"
  563. },
  564. {
  565. "name": "HeapFree",
  566. "address": "0x1000201c"
  567. },
  568. {
  569. "name": "GetProcessHeap",
  570. "address": "0x10002020"
  571. },
  572. {
  573. "name": "IsBadReadPtr",
  574. "address": "0x10002024"
  575. },
  576. {
  577. "name": "TerminateThread",
  578. "address": "0x10002028"
  579. },
  580. {
  581. "name": "Sleep",
  582. "address": "0x1000202c"
  583. },
  584. {
  585. "name": "HeapValidate",
  586. "address": "0x10002030"
  587. },
  588. {
  589. "name": "GetProcAddress",
  590. "address": "0x10002034"
  591. },
  592. {
  593. "name": "CreateThread",
  594. "address": "0x10002038"
  595. },
  596. {
  597. "name": "LocalAlloc",
  598. "address": "0x1000203c"
  599. },
  600. {
  601. "name": "GetVersionExA",
  602. "address": "0x10002040"
  603. },
  604. {
  605. "name": "LocalFree",
  606. "address": "0x10002044"
  607. },
  608. {
  609. "name": "LoadLibraryA",
  610. "address": "0x10002048"
  611. }
  612. ],
  613. "dll": "KERNEL32.dll"
  614. },
  615. {
  616. "imports": [
  617. {
  618. "name": "CheckTokenMembership",
  619. "address": "0x10002000"
  620. },
  621. {
  622. "name": "FreeSid",
  623. "address": "0x10002004"
  624. },
  625. {
  626. "name": "AllocateAndInitializeSid",
  627. "address": "0x10002008"
  628. },
  629. {
  630. "name": "LookupAccountNameA",
  631. "address": "0x1000200c"
  632. }
  633. ],
  634. "dll": "ADVAPI32.dll"
  635. }
  636. ],
  637. "digital_signers": null,
  638. "exported_dll_name": "customconnector.dll",
  639. "actual_checksum": "0x0000a82f",
  640. "overlay": null,
  641. "imagebase": "0x10000000",
  642. "reported_checksum": "0x00000000",
  643. "icon_hash": null,
  644. "entrypoint": "0x10001057",
  645. "timestamp": "2011-01-11 08:05:20",
  646. "osversion": "5.1",
  647. "sections": [
  648. {
  649. "name": ".text",
  650. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  651. "virtual_address": "0x00001000",
  652. "size_of_data": "0x00000a00",
  653. "entropy": "5.94",
  654. "raw_address": "0x00000400",
  655. "virtual_size": "0x0000096c",
  656. "characteristics_raw": "0x60000020"
  657. },
  658. {
  659. "name": ".rdata",
  660. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  661. "virtual_address": "0x00002000",
  662. "size_of_data": "0x00000600",
  663. "entropy": "4.76",
  664. "raw_address": "0x00000e00",
  665. "virtual_size": "0x00000564",
  666. "characteristics_raw": "0x40000040"
  667. },
  668. {
  669. "name": ".data",
  670. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  671. "virtual_address": "0x00003000",
  672. "size_of_data": "0x00000200",
  673. "entropy": "0.06",
  674. "raw_address": "0x00001400",
  675. "virtual_size": "0x000005cd",
  676. "characteristics_raw": "0xc0000040"
  677. },
  678. {
  679. "name": ".reloc",
  680. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  681. "virtual_address": "0x00004000",
  682. "size_of_data": "0x00000200",
  683. "entropy": "3.21",
  684. "raw_address": "0x00001600",
  685. "virtual_size": "0x00000118",
  686. "characteristics_raw": "0x42000040"
  687. }
  688. ],
  689. "resources": [],
  690. "dirents": [
  691. {
  692. "virtual_address": "0x000023e0",
  693. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  694. "size": "0x00000184"
  695. },
  696. {
  697. "virtual_address": "0x00002180",
  698. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  699. "size": "0x00000064"
  700. },
  701. {
  702. "virtual_address": "0x00000000",
  703. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  704. "size": "0x00000000"
  705. },
  706. {
  707. "virtual_address": "0x00000000",
  708. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  709. "size": "0x00000000"
  710. },
  711. {
  712. "virtual_address": "0x00000000",
  713. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  714. "size": "0x00000000"
  715. },
  716. {
  717. "virtual_address": "0x00004000",
  718. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  719. "size": "0x000000d8"
  720. },
  721. {
  722. "virtual_address": "0x00000000",
  723. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  724. "size": "0x00000000"
  725. },
  726. {
  727. "virtual_address": "0x00000000",
  728. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  729. "size": "0x00000000"
  730. },
  731. {
  732. "virtual_address": "0x00000000",
  733. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  734. "size": "0x00000000"
  735. },
  736. {
  737. "virtual_address": "0x00000000",
  738. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  739. "size": "0x00000000"
  740. },
  741. {
  742. "virtual_address": "0x00000000",
  743. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  744. "size": "0x00000000"
  745. },
  746. {
  747. "virtual_address": "0x00000000",
  748. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  749. "size": "0x00000000"
  750. },
  751. {
  752. "virtual_address": "0x00002000",
  753. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  754. "size": "0x0000006c"
  755. },
  756. {
  757. "virtual_address": "0x00000000",
  758. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  759. "size": "0x00000000"
  760. },
  761. {
  762. "virtual_address": "0x00000000",
  763. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  764. "size": "0x00000000"
  765. },
  766. {
  767. "virtual_address": "0x00000000",
  768. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  769. "size": "0x00000000"
  770. }
  771. ],
  772. "exports": [
  773. {
  774. "ordinal": 1,
  775. "name": "Init",
  776. "address": "0x1000105d"
  777. },
  778. {
  779. "ordinal": 2,
  780. "name": "MainCpGateInput",
  781. "address": "0x100018b9"
  782. },
  783. {
  784. "ordinal": 3,
  785. "name": "Start",
  786. "address": "0x100010b5"
  787. },
  788. {
  789. "ordinal": 4,
  790. "name": "Stop",
  791. "address": "0x100010b9"
  792. },
  793. {
  794. "ordinal": 5,
  795. "name": "TakeBotExeMd5Callback",
  796. "address": "0x1000117e"
  797. },
  798. {
  799. "ordinal": 6,
  800. "name": "TakeBotGuid",
  801. "address": "0x100010d8"
  802. },
  803. {
  804. "ordinal": 7,
  805. "name": "TakeBotVersion",
  806. "address": "0x10001164"
  807. },
  808. {
  809. "ordinal": 8,
  810. "name": "TakeConfigCrc32Callback",
  811. "address": "0x10001171"
  812. },
  813. {
  814. "ordinal": 9,
  815. "name": "TakeFreeMem",
  816. "address": "0x10001157"
  817. },
  818. {
  819. "ordinal": 10,
  820. "name": "TakeGetPage2",
  821. "address": "0x100010cb"
  822. },
  823. {
  824. "ordinal": 11,
  825. "name": "TakeMainCpGateOutputCallback",
  826. "address": "0x10001198"
  827. },
  828. {
  829. "ordinal": 12,
  830. "name": "TakePluginsListCallback",
  831. "address": "0x1000118b"
  832. },
  833. {
  834. "ordinal": 13,
  835. "name": "Uncontrollable",
  836. "address": "0x100011a5"
  837. }
  838. ],
  839. "guest_signers": {},
  840. "imphash": "234746223e26b4a2254f7d92fc2318f7",
  841. "icon_fuzzy": null,
  842. "icon": null,
  843. "pdbpath": null,
  844. "imported_dll_count": 4,
  845. "versioninfo": []
  846. }
  847. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!