API tools faq
paste
paladin316

Exes_27d3c2c11e4b00652fd278d4b0ab5eab_exe_2019-06-30_15_30.json

paladin316
Jun 30th, 2019
2,157
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.50 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_27d3c2c11e4b00652fd278d4b0ab5eab.exe"
  7. [*] File Size: 684032
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "acf211e0762b1c684c6611d48ce196398763a7852525ee488ecae2f93000992e"
  10. [*] MD5: "27d3c2c11e4b00652fd278d4b0ab5eab"
  11. [*] SHA1: "db3d02950a79b03392b4723b0218b17b9d8777e5"
  12. [*] SHA512: "3fd6c64a394f867745d0528fc165e21efadcd33df3f0410e4e5ed258f9494128c6110985cacc80cb7c57f370996b1a65470e89957a61ea86912ce1f64a4617a4"
  13. [*] CRC32: "EFED38F9"
  14. [*] SSDEEP: "12288:7UAFe34rckidR3jVPeCMJ6n7OAI0jjlzgSAShgbyzDF6NhiPgFLh:jFeIQz3p2CMQn7OElzgSAygOS0u"
  15.  
  16. [*] Process Execution: [
  17. "Exes_27d3c2c11e4b00652fd278d4b0ab5eab.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "Exes_27d3c2c11e4b00652fd278d4b0ab5eab.exe (1640) called API CreateProcessInternalW 45594 times"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 23 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "McAfee": "Artemis!27D3C2C11E4B"
  38. },
  39. {
  40. "Cylance": "Unsafe"
  41. },
  42. {
  43. "CrowdStrike": "win/malicious_confidence_100% (W)"
  44. },
  45. {
  46. "Symantec": "ML.Attribute.HighConfidence"
  47. },
  48. {
  49. "ESET-NOD32": "a variant of Win32/Injector.EGIR"
  50. },
  51. {
  52. "APEX": "Malicious"
  53. },
  54. {
  55. "Avast": "Win32:Malware-gen"
  56. },
  57. {
  58. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  59. },
  60. {
  61. "Alibaba": "Trojan:Win32/Injector.812e3dca"
  62. },
  63. {
  64. "Paloalto": "generic.ml"
  65. },
  66. {
  67. "Endgame": "malicious (high confidence)"
  68. },
  69. {
  70. "Sophos": "Mal/Generic-S"
  71. },
  72. {
  73. "DrWeb": "Trojan.DownLoader29.9918"
  74. },
  75. {
  76. "Invincea": "heuristic"
  77. },
  78. {
  79. "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.jt"
  80. },
  81. {
  82. "Trapmine": "malicious.moderate.ml.score"
  83. },
  84. {
  85. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  86. },
  87. {
  88. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  89. },
  90. {
  91. "Rising": "Trojan.Wacatac!8.10C01 (CLOUD)"
  92. },
  93. {
  94. "Ikarus": "Trojan.Win32.Injector"
  95. },
  96. {
  97. "Fortinet": "W32/Injector.EGIR!tr"
  98. },
  99. {
  100. "AVG": "Win32:Malware-gen"
  101. },
  102. {
  103. "Panda": "Trj/Genetic.gen"
  104. }
  105. ]
  106. }
  107. ]
  108.  
  109. [*] Started Service: []
  110.  
  111. [*] Executed Commands: [
  112. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\Exes_27d3c2c11e4b00652fd278d4b0ab5eab.exe\""
  113. ]
  114.  
  115. [*] Mutexes: [
  116. "CicLoadWinStaWinSta0",
  117. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  118. ]
  119.  
  120. [*] Modified Files: []
  121.  
  122. [*] Deleted Files: []
  123.  
  124. [*] Modified Registry Keys: [
  125. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\TMe0X1444168993\\tI2C82138740738",
  126. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\TMe0X1444168993\\tI2C82138740738\\w5iY8166182260"
  127. ]
  128.  
  129. [*] Deleted Registry Keys: []
  130.  
  131. [*] DNS Communications: []
  132.  
  133. [*] Domains: []
  134.  
  135. [*] Network Communication - ICMP: []
  136.  
  137. [*] Network Communication - HTTP: []
  138.  
  139. [*] Network Communication - SMTP: []
  140.  
  141. [*] Network Communication - Hosts: []
  142.  
  143. [*] Network Communication - IRC: []
  144.  
  145. [*] Static Analysis: {
  146. "pe": {
  147. "peid_signatures": null,
  148. "imports": [
  149. {
  150. "imports": [
  151. {
  152. "name": null,
  153. "address": "0x401000"
  154. },
  155. {
  156. "name": null,
  157. "address": "0x401004"
  158. },
  159. {
  160. "name": null,
  161. "address": "0x401008"
  162. },
  163. {
  164. "name": null,
  165. "address": "0x40100c"
  166. },
  167. {
  168. "name": null,
  169. "address": "0x401010"
  170. },
  171. {
  172. "name": "MethCallEngine",
  173. "address": "0x401014"
  174. },
  175. {
  176. "name": null,
  177. "address": "0x401018"
  178. },
  179. {
  180. "name": null,
  181. "address": "0x40101c"
  182. },
  183. {
  184. "name": null,
  185. "address": "0x401020"
  186. },
  187. {
  188. "name": null,
  189. "address": "0x401024"
  190. },
  191. {
  192. "name": null,
  193. "address": "0x401028"
  194. },
  195. {
  196. "name": null,
  197. "address": "0x40102c"
  198. },
  199. {
  200. "name": null,
  201. "address": "0x401030"
  202. },
  203. {
  204. "name": null,
  205. "address": "0x401034"
  206. },
  207. {
  208. "name": null,
  209. "address": "0x401038"
  210. },
  211. {
  212. "name": null,
  213. "address": "0x40103c"
  214. },
  215. {
  216. "name": null,
  217. "address": "0x401040"
  218. },
  219. {
  220. "name": null,
  221. "address": "0x401044"
  222. },
  223. {
  224. "name": "EVENT_SINK_AddRef",
  225. "address": "0x401048"
  226. },
  227. {
  228. "name": null,
  229. "address": "0x40104c"
  230. },
  231. {
  232. "name": null,
  233. "address": "0x401050"
  234. },
  235. {
  236. "name": null,
  237. "address": "0x401054"
  238. },
  239. {
  240. "name": null,
  241. "address": "0x401058"
  242. },
  243. {
  244. "name": "EVENT_SINK_Release",
  245. "address": "0x40105c"
  246. },
  247. {
  248. "name": null,
  249. "address": "0x401060"
  250. },
  251. {
  252. "name": "EVENT_SINK_QueryInterface",
  253. "address": "0x401064"
  254. },
  255. {
  256. "name": "__vbaExceptHandler",
  257. "address": "0x401068"
  258. },
  259. {
  260. "name": null,
  261. "address": "0x40106c"
  262. },
  263. {
  264. "name": null,
  265. "address": "0x401070"
  266. },
  267. {
  268. "name": null,
  269. "address": "0x401074"
  270. },
  271. {
  272. "name": null,
  273. "address": "0x401078"
  274. },
  275. {
  276. "name": null,
  277. "address": "0x40107c"
  278. },
  279. {
  280. "name": null,
  281. "address": "0x401080"
  282. },
  283. {
  284. "name": null,
  285. "address": "0x401084"
  286. },
  287. {
  288. "name": null,
  289. "address": "0x401088"
  290. },
  291. {
  292. "name": null,
  293. "address": "0x40108c"
  294. },
  295. {
  296. "name": null,
  297. "address": "0x401090"
  298. },
  299. {
  300. "name": null,
  301. "address": "0x401094"
  302. },
  303. {
  304. "name": null,
  305. "address": "0x401098"
  306. },
  307. {
  308. "name": null,
  309. "address": "0x40109c"
  310. }
  311. ],
  312. "dll": "MSVBVM60.DLL"
  313. }
  314. ],
  315. "digital_signers": null,
  316. "exported_dll_name": null,
  317. "actual_checksum": "0x000b1fae",
  318. "overlay": null,
  319. "imagebase": "0x00400000",
  320. "reported_checksum": "0x000b1fae",
  321. "icon_hash": null,
  322. "entrypoint": "0x004011a0",
  323. "timestamp": "2019-06-28 22:32:33",
  324. "osversion": "4.0",
  325. "sections": [
  326. {
  327. "name": ".text",
  328. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  329. "virtual_address": "0x00001000",
  330. "size_of_data": "0x000a0000",
  331. "entropy": "4.73",
  332. "raw_address": "0x00001000",
  333. "virtual_size": "0x0009f44c",
  334. "characteristics_raw": "0x60000020"
  335. },
  336. {
  337. "name": ".data",
  338. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  339. "virtual_address": "0x000a1000",
  340. "size_of_data": "0x00000000",
  341. "entropy": "0.00",
  342. "raw_address": "0x00000000",
  343. "virtual_size": "0x0000631c",
  344. "characteristics_raw": "0xc0000040"
  345. },
  346. {
  347. "name": ".rsrc",
  348. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  349. "virtual_address": "0x000a8000",
  350. "size_of_data": "0x00006000",
  351. "entropy": "4.20",
  352. "raw_address": "0x000a1000",
  353. "virtual_size": "0x00005948",
  354. "characteristics_raw": "0x40000040"
  355. }
  356. ],
  357. "resources": [],
  358. "dirents": [
  359. {
  360. "virtual_address": "0x00000000",
  361. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  362. "size": "0x00000000"
  363. },
  364. {
  365. "virtual_address": "0x000a0304",
  366. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  367. "size": "0x00000028"
  368. },
  369. {
  370. "virtual_address": "0x000a8000",
  371. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  372. "size": "0x00005948"
  373. },
  374. {
  375. "virtual_address": "0x00000000",
  376. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  377. "size": "0x00000000"
  378. },
  379. {
  380. "virtual_address": "0x00000000",
  381. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  382. "size": "0x00000000"
  383. },
  384. {
  385. "virtual_address": "0x00000000",
  386. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  387. "size": "0x00000000"
  388. },
  389. {
  390. "virtual_address": "0x00000000",
  391. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  392. "size": "0x00000000"
  393. },
  394. {
  395. "virtual_address": "0x00000000",
  396. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  397. "size": "0x00000000"
  398. },
  399. {
  400. "virtual_address": "0x00000000",
  401. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  402. "size": "0x00000000"
  403. },
  404. {
  405. "virtual_address": "0x00000000",
  406. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  407. "size": "0x00000000"
  408. },
  409. {
  410. "virtual_address": "0x00000000",
  411. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  412. "size": "0x00000000"
  413. },
  414. {
  415. "virtual_address": "0x00000220",
  416. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  417. "size": "0x00000020"
  418. },
  419. {
  420. "virtual_address": "0x00001000",
  421. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  422. "size": "0x000000a4"
  423. },
  424. {
  425. "virtual_address": "0x00000000",
  426. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  427. "size": "0x00000000"
  428. },
  429. {
  430. "virtual_address": "0x00000000",
  431. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  432. "size": "0x00000000"
  433. },
  434. {
  435. "virtual_address": "0x00000000",
  436. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  437. "size": "0x00000000"
  438. }
  439. ],
  440. "exports": [],
  441. "guest_signers": {},
  442. "imphash": "e4b426c4998f12fa3cecdd6c36ef6fe0",
  443. "icon_fuzzy": null,
  444. "icon": null,
  445. "pdbpath": null,
  446. "imported_dll_count": 1,
  447. "versioninfo": []
  448. }
  449. }
  450.  
  451. [*] Resolved APIs: [
  452. "cryptbase.dll.SystemFunction036",
  453. "uxtheme.dll.ThemeInitApiHook",
  454. "user32.dll.IsProcessDPIAware",
  455. "oleaut32.dll.OleLoadPictureEx",
  456. "oleaut32.dll.DispCallFunc",
  457. "oleaut32.dll.LoadTypeLibEx",
  458. "oleaut32.dll.UnRegisterTypeLib",
  459. "oleaut32.dll.CreateTypeLib2",
  460. "oleaut32.dll.VarDateFromUdate",
  461. "oleaut32.dll.VarUdateFromDate",
  462. "oleaut32.dll.GetAltMonthNames",
  463. "oleaut32.dll.VarNumFromParseNum",
  464. "oleaut32.dll.VarParseNumFromStr",
  465. "oleaut32.dll.VarDecFromR4",
  466. "oleaut32.dll.VarDecFromR8",
  467. "oleaut32.dll.VarDecFromDate",
  468. "oleaut32.dll.VarDecFromI4",
  469. "oleaut32.dll.VarDecFromCy",
  470. "oleaut32.dll.VarR4FromDec",
  471. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  472. "oleaut32.dll.GetRecordInfoFromGuids",
  473. "oleaut32.dll.SafeArrayGetRecordInfo",
  474. "oleaut32.dll.SafeArraySetRecordInfo",
  475. "oleaut32.dll.SafeArrayGetIID",
  476. "oleaut32.dll.SafeArraySetIID",
  477. "oleaut32.dll.SafeArrayCopyData",
  478. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  479. "oleaut32.dll.SafeArrayCreateEx",
  480. "oleaut32.dll.VarFormat",
  481. "oleaut32.dll.VarFormatDateTime",
  482. "oleaut32.dll.VarFormatNumber",
  483. "oleaut32.dll.VarFormatPercent",
  484. "oleaut32.dll.VarFormatCurrency",
  485. "oleaut32.dll.VarWeekdayName",
  486. "oleaut32.dll.VarMonthName",
  487. "oleaut32.dll.VarAdd",
  488. "oleaut32.dll.VarAnd",
  489. "oleaut32.dll.VarCat",
  490. "oleaut32.dll.VarDiv",
  491. "oleaut32.dll.VarEqv",
  492. "oleaut32.dll.VarIdiv",
  493. "oleaut32.dll.VarImp",
  494. "oleaut32.dll.VarMod",
  495. "oleaut32.dll.VarMul",
  496. "oleaut32.dll.VarOr",
  497. "oleaut32.dll.VarPow",
  498. "oleaut32.dll.VarSub",
  499. "oleaut32.dll.VarXor",
  500. "oleaut32.dll.VarAbs",
  501. "oleaut32.dll.VarFix",
  502. "oleaut32.dll.VarInt",
  503. "oleaut32.dll.VarNeg",
  504. "oleaut32.dll.VarNot",
  505. "oleaut32.dll.VarRound",
  506. "oleaut32.dll.VarCmp",
  507. "oleaut32.dll.VarDecAdd",
  508. "oleaut32.dll.VarDecCmp",
  509. "oleaut32.dll.VarBstrCat",
  510. "oleaut32.dll.VarCyMulI4",
  511. "oleaut32.dll.VarBstrCmp",
  512. "ole32.dll.CoCreateInstanceEx",
  513. "ole32.dll.CLSIDFromProgIDEx",
  514. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  515. "user32.dll.GetSystemMetrics",
  516. "user32.dll.MonitorFromWindow",
  517. "user32.dll.MonitorFromRect",
  518. "user32.dll.MonitorFromPoint",
  519. "user32.dll.EnumDisplayMonitors",
  520. "user32.dll.GetMonitorInfoA",
  521. "dwmapi.dll.DwmIsCompositionEnabled",
  522. "gdi32.dll.GetLayout",
  523. "gdi32.dll.GdiRealizationInfo",
  524. "gdi32.dll.FontIsLinked",
  525. "advapi32.dll.RegOpenKeyExW",
  526. "advapi32.dll.RegQueryInfoKeyW",
  527. "gdi32.dll.GetTextFaceAliasW",
  528. "advapi32.dll.RegEnumValueW",
  529. "advapi32.dll.RegCloseKey",
  530. "advapi32.dll.RegQueryValueExW",
  531. "gdi32.dll.GetFontAssocStatus",
  532. "advapi32.dll.RegQueryValueExA",
  533. "advapi32.dll.RegEnumKeyExW",
  534. "gdi32.dll.GdiIsMetaPrintDC",
  535. "ole32.dll.CoInitializeEx",
  536. "ole32.dll.CoUninitialize",
  537. "ole32.dll.CoRegisterInitializeSpy",
  538. "ole32.dll.CoRevokeInitializeSpy",
  539. "gdi32.dll.GetTextExtentExPointWPri",
  540. "kernel32.dll.NlsGetCacheUpdateCount",
  541. "kernel32.dll.GetCalendarInfoW",
  542. "kernel32.dll.GetTickCount",
  543. "kernel32.dll.Sleep",
  544. "user32.dll.GetCursorPos",
  545. "user32.dll.EnumWindows",
  546. "kernel32.dll.SetErrorMode",
  547. "kernel32.dll.SetLastError",
  548. "kernel32.dll.VirtualAllocEx",
  549. "kernel32.dll.CloseHandle",
  550. "shell32.dll.ShellExecuteW",
  551. "kernel32.dll.WriteFile",
  552. "kernel32.dll.UnmapViewOfFile",
  553. "kernel32.dll.CreateFileW",
  554. "kernel32.dll.TerminateProcess",
  555. "kernel32.dll.VirtualProtectEx",
  556. "kernel32.dll.CreateProcessInternalW",
  557. "kernel32.dll.GetTempPathW",
  558. "kernel32.dll.GetLongPathNameW",
  559. "kernel32.dll.GetFileSize",
  560. "kernel32.dll.ReadFile",
  561. "ntdll.dll.NtProtectVirtualMemory",
  562. "kernel32.dll.GetCommandLineW"
  563. ]
  564.  
  565. [*] Static Analysis: {
  566. "pe": {
  567. "peid_signatures": null,
  568. "imports": [
  569. {
  570. "imports": [
  571. {
  572. "name": null,
  573. "address": "0x401000"
  574. },
  575. {
  576. "name": null,
  577. "address": "0x401004"
  578. },
  579. {
  580. "name": null,
  581. "address": "0x401008"
  582. },
  583. {
  584. "name": null,
  585. "address": "0x40100c"
  586. },
  587. {
  588. "name": null,
  589. "address": "0x401010"
  590. },
  591. {
  592. "name": "MethCallEngine",
  593. "address": "0x401014"
  594. },
  595. {
  596. "name": null,
  597. "address": "0x401018"
  598. },
  599. {
  600. "name": null,
  601. "address": "0x40101c"
  602. },
  603. {
  604. "name": null,
  605. "address": "0x401020"
  606. },
  607. {
  608. "name": null,
  609. "address": "0x401024"
  610. },
  611. {
  612. "name": null,
  613. "address": "0x401028"
  614. },
  615. {
  616. "name": null,
  617. "address": "0x40102c"
  618. },
  619. {
  620. "name": null,
  621. "address": "0x401030"
  622. },
  623. {
  624. "name": null,
  625. "address": "0x401034"
  626. },
  627. {
  628. "name": null,
  629. "address": "0x401038"
  630. },
  631. {
  632. "name": null,
  633. "address": "0x40103c"
  634. },
  635. {
  636. "name": null,
  637. "address": "0x401040"
  638. },
  639. {
  640. "name": null,
  641. "address": "0x401044"
  642. },
  643. {
  644. "name": "EVENT_SINK_AddRef",
  645. "address": "0x401048"
  646. },
  647. {
  648. "name": null,
  649. "address": "0x40104c"
  650. },
  651. {
  652. "name": null,
  653. "address": "0x401050"
  654. },
  655. {
  656. "name": null,
  657. "address": "0x401054"
  658. },
  659. {
  660. "name": null,
  661. "address": "0x401058"
  662. },
  663. {
  664. "name": "EVENT_SINK_Release",
  665. "address": "0x40105c"
  666. },
  667. {
  668. "name": null,
  669. "address": "0x401060"
  670. },
  671. {
  672. "name": "EVENT_SINK_QueryInterface",
  673. "address": "0x401064"
  674. },
  675. {
  676. "name": "__vbaExceptHandler",
  677. "address": "0x401068"
  678. },
  679. {
  680. "name": null,
  681. "address": "0x40106c"
  682. },
  683. {
  684. "name": null,
  685. "address": "0x401070"
  686. },
  687. {
  688. "name": null,
  689. "address": "0x401074"
  690. },
  691. {
  692. "name": null,
  693. "address": "0x401078"
  694. },
  695. {
  696. "name": null,
  697. "address": "0x40107c"
  698. },
  699. {
  700. "name": null,
  701. "address": "0x401080"
  702. },
  703. {
  704. "name": null,
  705. "address": "0x401084"
  706. },
  707. {
  708. "name": null,
  709. "address": "0x401088"
  710. },
  711. {
  712. "name": null,
  713. "address": "0x40108c"
  714. },
  715. {
  716. "name": null,
  717. "address": "0x401090"
  718. },
  719. {
  720. "name": null,
  721. "address": "0x401094"
  722. },
  723. {
  724. "name": null,
  725. "address": "0x401098"
  726. },
  727. {
  728. "name": null,
  729. "address": "0x40109c"
  730. }
  731. ],
  732. "dll": "MSVBVM60.DLL"
  733. }
  734. ],
  735. "digital_signers": null,
  736. "exported_dll_name": null,
  737. "actual_checksum": "0x000b1fae",
  738. "overlay": null,
  739. "imagebase": "0x00400000",
  740. "reported_checksum": "0x000b1fae",
  741. "icon_hash": null,
  742. "entrypoint": "0x004011a0",
  743. "timestamp": "2019-06-28 22:32:33",
  744. "osversion": "4.0",
  745. "sections": [
  746. {
  747. "name": ".text",
  748. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  749. "virtual_address": "0x00001000",
  750. "size_of_data": "0x000a0000",
  751. "entropy": "4.73",
  752. "raw_address": "0x00001000",
  753. "virtual_size": "0x0009f44c",
  754. "characteristics_raw": "0x60000020"
  755. },
  756. {
  757. "name": ".data",
  758. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  759. "virtual_address": "0x000a1000",
  760. "size_of_data": "0x00000000",
  761. "entropy": "0.00",
  762. "raw_address": "0x00000000",
  763. "virtual_size": "0x0000631c",
  764. "characteristics_raw": "0xc0000040"
  765. },
  766. {
  767. "name": ".rsrc",
  768. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  769. "virtual_address": "0x000a8000",
  770. "size_of_data": "0x00006000",
  771. "entropy": "4.20",
  772. "raw_address": "0x000a1000",
  773. "virtual_size": "0x00005948",
  774. "characteristics_raw": "0x40000040"
  775. }
  776. ],
  777. "resources": [],
  778. "dirents": [
  779. {
  780. "virtual_address": "0x00000000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  782. "size": "0x00000000"
  783. },
  784. {
  785. "virtual_address": "0x000a0304",
  786. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  787. "size": "0x00000028"
  788. },
  789. {
  790. "virtual_address": "0x000a8000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  792. "size": "0x00005948"
  793. },
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  797. "size": "0x00000000"
  798. },
  799. {
  800. "virtual_address": "0x00000000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  802. "size": "0x00000000"
  803. },
  804. {
  805. "virtual_address": "0x00000000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  807. "size": "0x00000000"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  812. "size": "0x00000000"
  813. },
  814. {
  815. "virtual_address": "0x00000000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  817. "size": "0x00000000"
  818. },
  819. {
  820. "virtual_address": "0x00000000",
  821. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  822. "size": "0x00000000"
  823. },
  824. {
  825. "virtual_address": "0x00000000",
  826. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  827. "size": "0x00000000"
  828. },
  829. {
  830. "virtual_address": "0x00000000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  832. "size": "0x00000000"
  833. },
  834. {
  835. "virtual_address": "0x00000220",
  836. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  837. "size": "0x00000020"
  838. },
  839. {
  840. "virtual_address": "0x00001000",
  841. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  842. "size": "0x000000a4"
  843. },
  844. {
  845. "virtual_address": "0x00000000",
  846. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  847. "size": "0x00000000"
  848. },
  849. {
  850. "virtual_address": "0x00000000",
  851. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  852. "size": "0x00000000"
  853. },
  854. {
  855. "virtual_address": "0x00000000",
  856. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  857. "size": "0x00000000"
  858. }
  859. ],
  860. "exports": [],
  861. "guest_signers": {},
  862. "imphash": "e4b426c4998f12fa3cecdd6c36ef6fe0",
  863. "icon_fuzzy": null,
  864. "icon": null,
  865. "pdbpath": null,
  866. "imported_dll_count": 1,
  867. "versioninfo": []
  868. }
  869. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!