API tools faq
paste
paladin316

rat_787f1ee3546b56228298ad842fa8292b_exe_2019-07-02_18_30.json

paladin316
Jul 2nd, 2019
2,129
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 42.40 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "rat_787f1ee3546b56228298ad842fa8292b.exe"
  7. [*] File Size: 606208
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "fefb828cd7ad8bd02bcf6e390ddc3bd2f6f4786f238f83ca427b6fba8d29d735"
  10. [*] MD5: "787f1ee3546b56228298ad842fa8292b"
  11. [*] SHA1: "1a80d97e1b9a080d0e376f2273163c1daa620b34"
  12. [*] SHA512: "c1d5fb5d6db51cf46c7c06914760db142a66e1c4a857be7a8a3cffa33c77bc29681b9a6b61156d6f7ebbcbddd7179598220f7c01bff67518aff1c863f23a3199"
  13. [*] CRC32: "0574489C"
  14. [*] SSDEEP: "6144:ll0HvQ9IsoHdRq1CxOSpSF3zCyxqgRatMgRPSUQnEdG1YjQGL3YXo36rfFKkkDQx:T2I9sq14Slm8RwfdG+jQ4uo3mFmDQT"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .text, entropy: 7.53, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00090000, virtual_size: 0x0008f7d8"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "File has been identified by 24 Antiviruses on VirusTotal as malicious",
  29. "Details": [
  30. {
  31. "Bkav": "HW32.Packed."
  32. },
  33. {
  34. "MicroWorld-eScan": "Gen:Heur.PonyStealer.Lm0@geHBuMiG"
  35. },
  36. {
  37. "FireEye": "Generic.mg.787f1ee3546b5622"
  38. },
  39. {
  40. "Arcabit": "Trojan.PonyStealer.EA8D22"
  41. },
  42. {
  43. "Symantec": "ML.Attribute.HighConfidence"
  44. },
  45. {
  46. "APEX": "Malicious"
  47. },
  48. {
  49. "Paloalto": "generic.ml"
  50. },
  51. {
  52. "Kaspersky": "Trojan.Win32.VBKryjetor.bykw"
  53. },
  54. {
  55. "BitDefender": "Gen:Heur.PonyStealer.Lm0@geHBuMiG"
  56. },
  57. {
  58. "Tencent": "Win32.Trojan.Inject.Auto"
  59. },
  60. {
  61. "Emsisoft": "Gen:Heur.PonyStealer.Lm0@geHBuMiG (B)"
  62. },
  63. {
  64. "Invincea": "heuristic"
  65. },
  66. {
  67. "MAX": "malware (ai score=80)"
  68. },
  69. {
  70. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  71. },
  72. {
  73. "ZoneAlarm": "Trojan.Win32.VBKryjetor.bykw"
  74. },
  75. {
  76. "GData": "Gen:Heur.PonyStealer.Lm0@geHBuMiG"
  77. },
  78. {
  79. "ALYac": "Gen:Heur.PonyStealer.Lm0@geHBuMiG"
  80. },
  81. {
  82. "Ad-Aware": "Gen:Heur.PonyStealer.Lm0@geHBuMiG"
  83. },
  84. {
  85. "Cylance": "Unsafe"
  86. },
  87. {
  88. "Rising": "Trojan.Injector!1.B459 (CLASSIC)"
  89. },
  90. {
  91. "SentinelOne": "DFI - Suspicious PE"
  92. },
  93. {
  94. "Fortinet": "W32/GenKryptik.AWSE!tr"
  95. },
  96. {
  97. "Cybereason": "malicious.e1b9a0"
  98. },
  99. {
  100. "Qihoo-360": "HEUR/QVM03.0.422B.Malware.Gen"
  101. }
  102. ]
  103. }
  104. ]
  105.  
  106. [*] Started Service: []
  107.  
  108. [*] Executed Commands: []
  109.  
  110. [*] Mutexes: []
  111.  
  112. [*] Modified Files: []
  113.  
  114. [*] Deleted Files: []
  115.  
  116. [*] Modified Registry Keys: []
  117.  
  118. [*] Deleted Registry Keys: []
  119.  
  120. [*] DNS Communications: []
  121.  
  122. [*] Domains: []
  123.  
  124. [*] Network Communication - ICMP: []
  125.  
  126. [*] Network Communication - HTTP: []
  127.  
  128. [*] Network Communication - SMTP: []
  129.  
  130. [*] Network Communication - Hosts: []
  131.  
  132. [*] Network Communication - IRC: []
  133.  
  134. [*] Static Analysis: {
  135. "pe": {
  136. "peid_signatures": null,
  137. "imports": [
  138. {
  139. "imports": [
  140. {
  141. "name": "_CIcos",
  142. "address": "0x401000"
  143. },
  144. {
  145. "name": "_adj_fptan",
  146. "address": "0x401004"
  147. },
  148. {
  149. "name": "__vbaVarMove",
  150. "address": "0x401008"
  151. },
  152. {
  153. "name": null,
  154. "address": "0x40100c"
  155. },
  156. {
  157. "name": "__vbaFreeVar",
  158. "address": "0x401010"
  159. },
  160. {
  161. "name": null,
  162. "address": "0x401014"
  163. },
  164. {
  165. "name": "__vbaStrVarMove",
  166. "address": "0x401018"
  167. },
  168. {
  169. "name": null,
  170. "address": "0x40101c"
  171. },
  172. {
  173. "name": "__vbaFreeVarList",
  174. "address": "0x401020"
  175. },
  176. {
  177. "name": "__vbaEnd",
  178. "address": "0x401024"
  179. },
  180. {
  181. "name": "_adj_fdiv_m64",
  182. "address": "0x401028"
  183. },
  184. {
  185. "name": "__vbaFreeObjList",
  186. "address": "0x40102c"
  187. },
  188. {
  189. "name": null,
  190. "address": "0x401030"
  191. },
  192. {
  193. "name": "_adj_fprem1",
  194. "address": "0x401034"
  195. },
  196. {
  197. "name": null,
  198. "address": "0x401038"
  199. },
  200. {
  201. "name": null,
  202. "address": "0x40103c"
  203. },
  204. {
  205. "name": null,
  206. "address": "0x401040"
  207. },
  208. {
  209. "name": "__vbaSetSystemError",
  210. "address": "0x401044"
  211. },
  212. {
  213. "name": "__vbaHresultCheckObj",
  214. "address": "0x401048"
  215. },
  216. {
  217. "name": "__vbaLenBstrB",
  218. "address": "0x40104c"
  219. },
  220. {
  221. "name": null,
  222. "address": "0x401050"
  223. },
  224. {
  225. "name": null,
  226. "address": "0x401054"
  227. },
  228. {
  229. "name": "_adj_fdiv_m32",
  230. "address": "0x401058"
  231. },
  232. {
  233. "name": null,
  234. "address": "0x40105c"
  235. },
  236. {
  237. "name": null,
  238. "address": "0x401060"
  239. },
  240. {
  241. "name": "__vbaAryDestruct",
  242. "address": "0x401064"
  243. },
  244. {
  245. "name": null,
  246. "address": "0x401068"
  247. },
  248. {
  249. "name": null,
  250. "address": "0x40106c"
  251. },
  252. {
  253. "name": null,
  254. "address": "0x401070"
  255. },
  256. {
  257. "name": "__vbaObjSet",
  258. "address": "0x401074"
  259. },
  260. {
  261. "name": "__vbaOnError",
  262. "address": "0x401078"
  263. },
  264. {
  265. "name": "_adj_fdiv_m16i",
  266. "address": "0x40107c"
  267. },
  268. {
  269. "name": "__vbaObjSetAddref",
  270. "address": "0x401080"
  271. },
  272. {
  273. "name": "_adj_fdivr_m16i",
  274. "address": "0x401084"
  275. },
  276. {
  277. "name": null,
  278. "address": "0x401088"
  279. },
  280. {
  281. "name": null,
  282. "address": "0x40108c"
  283. },
  284. {
  285. "name": null,
  286. "address": "0x401090"
  287. },
  288. {
  289. "name": "__vbaFpR8",
  290. "address": "0x401094"
  291. },
  292. {
  293. "name": "_CIsin",
  294. "address": "0x401098"
  295. },
  296. {
  297. "name": "__vbaErase",
  298. "address": "0x40109c"
  299. },
  300. {
  301. "name": null,
  302. "address": "0x4010a0"
  303. },
  304. {
  305. "name": "__vbaChkstk",
  306. "address": "0x4010a4"
  307. },
  308. {
  309. "name": "EVENT_SINK_AddRef",
  310. "address": "0x4010a8"
  311. },
  312. {
  313. "name": "__vbaGenerateBoundsError",
  314. "address": "0x4010ac"
  315. },
  316. {
  317. "name": "__vbaStrCmp",
  318. "address": "0x4010b0"
  319. },
  320. {
  321. "name": "__vbaVarTstEq",
  322. "address": "0x4010b4"
  323. },
  324. {
  325. "name": "__vbaAryConstruct2",
  326. "address": "0x4010b8"
  327. },
  328. {
  329. "name": "__vbaI2I4",
  330. "address": "0x4010bc"
  331. },
  332. {
  333. "name": "__vbaObjVar",
  334. "address": "0x4010c0"
  335. },
  336. {
  337. "name": null,
  338. "address": "0x4010c4"
  339. },
  340. {
  341. "name": "DllFunctionCall",
  342. "address": "0x4010c8"
  343. },
  344. {
  345. "name": null,
  346. "address": "0x4010cc"
  347. },
  348. {
  349. "name": null,
  350. "address": "0x4010d0"
  351. },
  352. {
  353. "name": "_adj_fpatan",
  354. "address": "0x4010d4"
  355. },
  356. {
  357. "name": null,
  358. "address": "0x4010d8"
  359. },
  360. {
  361. "name": null,
  362. "address": "0x4010dc"
  363. },
  364. {
  365. "name": "__vbaRedim",
  366. "address": "0x4010e0"
  367. },
  368. {
  369. "name": "EVENT_SINK_Release",
  370. "address": "0x4010e4"
  371. },
  372. {
  373. "name": null,
  374. "address": "0x4010e8"
  375. },
  376. {
  377. "name": "_CIsqrt",
  378. "address": "0x4010ec"
  379. },
  380. {
  381. "name": "EVENT_SINK_QueryInterface",
  382. "address": "0x4010f0"
  383. },
  384. {
  385. "name": "__vbaExceptHandler",
  386. "address": "0x4010f4"
  387. },
  388. {
  389. "name": "_adj_fprem",
  390. "address": "0x4010f8"
  391. },
  392. {
  393. "name": "_adj_fdivr_m64",
  394. "address": "0x4010fc"
  395. },
  396. {
  397. "name": null,
  398. "address": "0x401100"
  399. },
  400. {
  401. "name": null,
  402. "address": "0x401104"
  403. },
  404. {
  405. "name": "__vbaFPException",
  406. "address": "0x401108"
  407. },
  408. {
  409. "name": null,
  410. "address": "0x40110c"
  411. },
  412. {
  413. "name": null,
  414. "address": "0x401110"
  415. },
  416. {
  417. "name": "_CIlog",
  418. "address": "0x401114"
  419. },
  420. {
  421. "name": "__vbaErrorOverflow",
  422. "address": "0x401118"
  423. },
  424. {
  425. "name": "__vbaFileOpen",
  426. "address": "0x40111c"
  427. },
  428. {
  429. "name": null,
  430. "address": "0x401120"
  431. },
  432. {
  433. "name": "__vbaNew2",
  434. "address": "0x401124"
  435. },
  436. {
  437. "name": "__vbaInStr",
  438. "address": "0x401128"
  439. },
  440. {
  441. "name": null,
  442. "address": "0x40112c"
  443. },
  444. {
  445. "name": "_adj_fdiv_m32i",
  446. "address": "0x401130"
  447. },
  448. {
  449. "name": null,
  450. "address": "0x401134"
  451. },
  452. {
  453. "name": "_adj_fdivr_m32i",
  454. "address": "0x401138"
  455. },
  456. {
  457. "name": "__vbaStrCopy",
  458. "address": "0x40113c"
  459. },
  460. {
  461. "name": null,
  462. "address": "0x401140"
  463. },
  464. {
  465. "name": null,
  466. "address": "0x401144"
  467. },
  468. {
  469. "name": "__vbaDerefAry1",
  470. "address": "0x401148"
  471. },
  472. {
  473. "name": "_adj_fdivr_m32",
  474. "address": "0x40114c"
  475. },
  476. {
  477. "name": "_adj_fdiv_r",
  478. "address": "0x401150"
  479. },
  480. {
  481. "name": null,
  482. "address": "0x401154"
  483. },
  484. {
  485. "name": null,
  486. "address": "0x401158"
  487. },
  488. {
  489. "name": "__vbaVarTstNe",
  490. "address": "0x40115c"
  491. },
  492. {
  493. "name": "__vbaI4Var",
  494. "address": "0x401160"
  495. },
  496. {
  497. "name": "__vbaLateMemCall",
  498. "address": "0x401164"
  499. },
  500. {
  501. "name": "__vbaInStrB",
  502. "address": "0x401168"
  503. },
  504. {
  505. "name": "__vbaVarDup",
  506. "address": "0x40116c"
  507. },
  508. {
  509. "name": null,
  510. "address": "0x401170"
  511. },
  512. {
  513. "name": "__vbaStrComp",
  514. "address": "0x401174"
  515. },
  516. {
  517. "name": null,
  518. "address": "0x401178"
  519. },
  520. {
  521. "name": "__vbaVarLateMemCallLd",
  522. "address": "0x40117c"
  523. },
  524. {
  525. "name": "__vbaFpI4",
  526. "address": "0x401180"
  527. },
  528. {
  529. "name": "__vbaVarCopy",
  530. "address": "0x401184"
  531. },
  532. {
  533. "name": "_CIatan",
  534. "address": "0x401188"
  535. },
  536. {
  537. "name": "__vbaCastObj",
  538. "address": "0x40118c"
  539. },
  540. {
  541. "name": "__vbaStrMove",
  542. "address": "0x401190"
  543. },
  544. {
  545. "name": null,
  546. "address": "0x401194"
  547. },
  548. {
  549. "name": null,
  550. "address": "0x401198"
  551. },
  552. {
  553. "name": "_allmul",
  554. "address": "0x40119c"
  555. },
  556. {
  557. "name": null,
  558. "address": "0x4011a0"
  559. },
  560. {
  561. "name": "_CItan",
  562. "address": "0x4011a4"
  563. },
  564. {
  565. "name": null,
  566. "address": "0x4011a8"
  567. },
  568. {
  569. "name": "_CIexp",
  570. "address": "0x4011ac"
  571. },
  572. {
  573. "name": "__vbaFreeStr",
  574. "address": "0x4011b0"
  575. },
  576. {
  577. "name": "__vbaFreeObj",
  578. "address": "0x4011b4"
  579. }
  580. ],
  581. "dll": "MSVBVM60.DLL"
  582. }
  583. ],
  584. "digital_signers": null,
  585. "exported_dll_name": null,
  586. "actual_checksum": "0x00098c5b",
  587. "overlay": null,
  588. "imagebase": "0x00400000",
  589. "reported_checksum": "0x00098c5b",
  590. "icon_hash": null,
  591. "entrypoint": "0x00401514",
  592. "timestamp": "2010-02-01 15:23:11",
  593. "osversion": "4.0",
  594. "sections": [
  595. {
  596. "name": ".text",
  597. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  598. "virtual_address": "0x00001000",
  599. "size_of_data": "0x00090000",
  600. "entropy": "7.53",
  601. "raw_address": "0x00001000",
  602. "virtual_size": "0x0008f7d8",
  603. "characteristics_raw": "0x60000020"
  604. },
  605. {
  606. "name": ".data",
  607. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  608. "virtual_address": "0x00091000",
  609. "size_of_data": "0x00001000",
  610. "entropy": "0.00",
  611. "raw_address": "0x00091000",
  612. "virtual_size": "0x000045ec",
  613. "characteristics_raw": "0xc0000040"
  614. },
  615. {
  616. "name": ".rsrc",
  617. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  618. "virtual_address": "0x00096000",
  619. "size_of_data": "0x00002000",
  620. "entropy": "3.33",
  621. "raw_address": "0x00092000",
  622. "virtual_size": "0x000010b8",
  623. "characteristics_raw": "0x40000040"
  624. }
  625. ],
  626. "resources": [],
  627. "dirents": [
  628. {
  629. "virtual_address": "0x00000000",
  630. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  631. "size": "0x00000000"
  632. },
  633. {
  634. "virtual_address": "0x00090184",
  635. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  636. "size": "0x00000028"
  637. },
  638. {
  639. "virtual_address": "0x00096000",
  640. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  641. "size": "0x000010b8"
  642. },
  643. {
  644. "virtual_address": "0x00000000",
  645. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  646. "size": "0x00000000"
  647. },
  648. {
  649. "virtual_address": "0x00000000",
  650. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  651. "size": "0x00000000"
  652. },
  653. {
  654. "virtual_address": "0x00000000",
  655. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  656. "size": "0x00000000"
  657. },
  658. {
  659. "virtual_address": "0x00000000",
  660. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  661. "size": "0x00000000"
  662. },
  663. {
  664. "virtual_address": "0x00000000",
  665. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  666. "size": "0x00000000"
  667. },
  668. {
  669. "virtual_address": "0x00000000",
  670. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  671. "size": "0x00000000"
  672. },
  673. {
  674. "virtual_address": "0x00000000",
  675. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  676. "size": "0x00000000"
  677. },
  678. {
  679. "virtual_address": "0x00000000",
  680. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  681. "size": "0x00000000"
  682. },
  683. {
  684. "virtual_address": "0x00000238",
  685. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  686. "size": "0x00000020"
  687. },
  688. {
  689. "virtual_address": "0x00001000",
  690. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  691. "size": "0x000001bc"
  692. },
  693. {
  694. "virtual_address": "0x00000000",
  695. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  696. "size": "0x00000000"
  697. },
  698. {
  699. "virtual_address": "0x00000000",
  700. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  701. "size": "0x00000000"
  702. },
  703. {
  704. "virtual_address": "0x00000000",
  705. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  706. "size": "0x00000000"
  707. }
  708. ],
  709. "exports": [],
  710. "guest_signers": {},
  711. "imphash": "cbfa0724a1832545a706c3b189e9cf41",
  712. "icon_fuzzy": null,
  713. "icon": null,
  714. "pdbpath": null,
  715. "imported_dll_count": 1,
  716. "versioninfo": []
  717. }
  718. }
  719.  
  720. [*] Resolved APIs: []
  721.  
  722. [*] Static Analysis: {
  723. "pe": {
  724. "peid_signatures": null,
  725. "imports": [
  726. {
  727. "imports": [
  728. {
  729. "name": "_CIcos",
  730. "address": "0x401000"
  731. },
  732. {
  733. "name": "_adj_fptan",
  734. "address": "0x401004"
  735. },
  736. {
  737. "name": "__vbaVarMove",
  738. "address": "0x401008"
  739. },
  740. {
  741. "name": null,
  742. "address": "0x40100c"
  743. },
  744. {
  745. "name": "__vbaFreeVar",
  746. "address": "0x401010"
  747. },
  748. {
  749. "name": null,
  750. "address": "0x401014"
  751. },
  752. {
  753. "name": "__vbaStrVarMove",
  754. "address": "0x401018"
  755. },
  756. {
  757. "name": null,
  758. "address": "0x40101c"
  759. },
  760. {
  761. "name": "__vbaFreeVarList",
  762. "address": "0x401020"
  763. },
  764. {
  765. "name": "__vbaEnd",
  766. "address": "0x401024"
  767. },
  768. {
  769. "name": "_adj_fdiv_m64",
  770. "address": "0x401028"
  771. },
  772. {
  773. "name": "__vbaFreeObjList",
  774. "address": "0x40102c"
  775. },
  776. {
  777. "name": null,
  778. "address": "0x401030"
  779. },
  780. {
  781. "name": "_adj_fprem1",
  782. "address": "0x401034"
  783. },
  784. {
  785. "name": null,
  786. "address": "0x401038"
  787. },
  788. {
  789. "name": null,
  790. "address": "0x40103c"
  791. },
  792. {
  793. "name": null,
  794. "address": "0x401040"
  795. },
  796. {
  797. "name": "__vbaSetSystemError",
  798. "address": "0x401044"
  799. },
  800. {
  801. "name": "__vbaHresultCheckObj",
  802. "address": "0x401048"
  803. },
  804. {
  805. "name": "__vbaLenBstrB",
  806. "address": "0x40104c"
  807. },
  808. {
  809. "name": null,
  810. "address": "0x401050"
  811. },
  812. {
  813. "name": null,
  814. "address": "0x401054"
  815. },
  816. {
  817. "name": "_adj_fdiv_m32",
  818. "address": "0x401058"
  819. },
  820. {
  821. "name": null,
  822. "address": "0x40105c"
  823. },
  824. {
  825. "name": null,
  826. "address": "0x401060"
  827. },
  828. {
  829. "name": "__vbaAryDestruct",
  830. "address": "0x401064"
  831. },
  832. {
  833. "name": null,
  834. "address": "0x401068"
  835. },
  836. {
  837. "name": null,
  838. "address": "0x40106c"
  839. },
  840. {
  841. "name": null,
  842. "address": "0x401070"
  843. },
  844. {
  845. "name": "__vbaObjSet",
  846. "address": "0x401074"
  847. },
  848. {
  849. "name": "__vbaOnError",
  850. "address": "0x401078"
  851. },
  852. {
  853. "name": "_adj_fdiv_m16i",
  854. "address": "0x40107c"
  855. },
  856. {
  857. "name": "__vbaObjSetAddref",
  858. "address": "0x401080"
  859. },
  860. {
  861. "name": "_adj_fdivr_m16i",
  862. "address": "0x401084"
  863. },
  864. {
  865. "name": null,
  866. "address": "0x401088"
  867. },
  868. {
  869. "name": null,
  870. "address": "0x40108c"
  871. },
  872. {
  873. "name": null,
  874. "address": "0x401090"
  875. },
  876. {
  877. "name": "__vbaFpR8",
  878. "address": "0x401094"
  879. },
  880. {
  881. "name": "_CIsin",
  882. "address": "0x401098"
  883. },
  884. {
  885. "name": "__vbaErase",
  886. "address": "0x40109c"
  887. },
  888. {
  889. "name": null,
  890. "address": "0x4010a0"
  891. },
  892. {
  893. "name": "__vbaChkstk",
  894. "address": "0x4010a4"
  895. },
  896. {
  897. "name": "EVENT_SINK_AddRef",
  898. "address": "0x4010a8"
  899. },
  900. {
  901. "name": "__vbaGenerateBoundsError",
  902. "address": "0x4010ac"
  903. },
  904. {
  905. "name": "__vbaStrCmp",
  906. "address": "0x4010b0"
  907. },
  908. {
  909. "name": "__vbaVarTstEq",
  910. "address": "0x4010b4"
  911. },
  912. {
  913. "name": "__vbaAryConstruct2",
  914. "address": "0x4010b8"
  915. },
  916. {
  917. "name": "__vbaI2I4",
  918. "address": "0x4010bc"
  919. },
  920. {
  921. "name": "__vbaObjVar",
  922. "address": "0x4010c0"
  923. },
  924. {
  925. "name": null,
  926. "address": "0x4010c4"
  927. },
  928. {
  929. "name": "DllFunctionCall",
  930. "address": "0x4010c8"
  931. },
  932. {
  933. "name": null,
  934. "address": "0x4010cc"
  935. },
  936. {
  937. "name": null,
  938. "address": "0x4010d0"
  939. },
  940. {
  941. "name": "_adj_fpatan",
  942. "address": "0x4010d4"
  943. },
  944. {
  945. "name": null,
  946. "address": "0x4010d8"
  947. },
  948. {
  949. "name": null,
  950. "address": "0x4010dc"
  951. },
  952. {
  953. "name": "__vbaRedim",
  954. "address": "0x4010e0"
  955. },
  956. {
  957. "name": "EVENT_SINK_Release",
  958. "address": "0x4010e4"
  959. },
  960. {
  961. "name": null,
  962. "address": "0x4010e8"
  963. },
  964. {
  965. "name": "_CIsqrt",
  966. "address": "0x4010ec"
  967. },
  968. {
  969. "name": "EVENT_SINK_QueryInterface",
  970. "address": "0x4010f0"
  971. },
  972. {
  973. "name": "__vbaExceptHandler",
  974. "address": "0x4010f4"
  975. },
  976. {
  977. "name": "_adj_fprem",
  978. "address": "0x4010f8"
  979. },
  980. {
  981. "name": "_adj_fdivr_m64",
  982. "address": "0x4010fc"
  983. },
  984. {
  985. "name": null,
  986. "address": "0x401100"
  987. },
  988. {
  989. "name": null,
  990. "address": "0x401104"
  991. },
  992. {
  993. "name": "__vbaFPException",
  994. "address": "0x401108"
  995. },
  996. {
  997. "name": null,
  998. "address": "0x40110c"
  999. },
  1000. {
  1001. "name": null,
  1002. "address": "0x401110"
  1003. },
  1004. {
  1005. "name": "_CIlog",
  1006. "address": "0x401114"
  1007. },
  1008. {
  1009. "name": "__vbaErrorOverflow",
  1010. "address": "0x401118"
  1011. },
  1012. {
  1013. "name": "__vbaFileOpen",
  1014. "address": "0x40111c"
  1015. },
  1016. {
  1017. "name": null,
  1018. "address": "0x401120"
  1019. },
  1020. {
  1021. "name": "__vbaNew2",
  1022. "address": "0x401124"
  1023. },
  1024. {
  1025. "name": "__vbaInStr",
  1026. "address": "0x401128"
  1027. },
  1028. {
  1029. "name": null,
  1030. "address": "0x40112c"
  1031. },
  1032. {
  1033. "name": "_adj_fdiv_m32i",
  1034. "address": "0x401130"
  1035. },
  1036. {
  1037. "name": null,
  1038. "address": "0x401134"
  1039. },
  1040. {
  1041. "name": "_adj_fdivr_m32i",
  1042. "address": "0x401138"
  1043. },
  1044. {
  1045. "name": "__vbaStrCopy",
  1046. "address": "0x40113c"
  1047. },
  1048. {
  1049. "name": null,
  1050. "address": "0x401140"
  1051. },
  1052. {
  1053. "name": null,
  1054. "address": "0x401144"
  1055. },
  1056. {
  1057. "name": "__vbaDerefAry1",
  1058. "address": "0x401148"
  1059. },
  1060. {
  1061. "name": "_adj_fdivr_m32",
  1062. "address": "0x40114c"
  1063. },
  1064. {
  1065. "name": "_adj_fdiv_r",
  1066. "address": "0x401150"
  1067. },
  1068. {
  1069. "name": null,
  1070. "address": "0x401154"
  1071. },
  1072. {
  1073. "name": null,
  1074. "address": "0x401158"
  1075. },
  1076. {
  1077. "name": "__vbaVarTstNe",
  1078. "address": "0x40115c"
  1079. },
  1080. {
  1081. "name": "__vbaI4Var",
  1082. "address": "0x401160"
  1083. },
  1084. {
  1085. "name": "__vbaLateMemCall",
  1086. "address": "0x401164"
  1087. },
  1088. {
  1089. "name": "__vbaInStrB",
  1090. "address": "0x401168"
  1091. },
  1092. {
  1093. "name": "__vbaVarDup",
  1094. "address": "0x40116c"
  1095. },
  1096. {
  1097. "name": null,
  1098. "address": "0x401170"
  1099. },
  1100. {
  1101. "name": "__vbaStrComp",
  1102. "address": "0x401174"
  1103. },
  1104. {
  1105. "name": null,
  1106. "address": "0x401178"
  1107. },
  1108. {
  1109. "name": "__vbaVarLateMemCallLd",
  1110. "address": "0x40117c"
  1111. },
  1112. {
  1113. "name": "__vbaFpI4",
  1114. "address": "0x401180"
  1115. },
  1116. {
  1117. "name": "__vbaVarCopy",
  1118. "address": "0x401184"
  1119. },
  1120. {
  1121. "name": "_CIatan",
  1122. "address": "0x401188"
  1123. },
  1124. {
  1125. "name": "__vbaCastObj",
  1126. "address": "0x40118c"
  1127. },
  1128. {
  1129. "name": "__vbaStrMove",
  1130. "address": "0x401190"
  1131. },
  1132. {
  1133. "name": null,
  1134. "address": "0x401194"
  1135. },
  1136. {
  1137. "name": null,
  1138. "address": "0x401198"
  1139. },
  1140. {
  1141. "name": "_allmul",
  1142. "address": "0x40119c"
  1143. },
  1144. {
  1145. "name": null,
  1146. "address": "0x4011a0"
  1147. },
  1148. {
  1149. "name": "_CItan",
  1150. "address": "0x4011a4"
  1151. },
  1152. {
  1153. "name": null,
  1154. "address": "0x4011a8"
  1155. },
  1156. {
  1157. "name": "_CIexp",
  1158. "address": "0x4011ac"
  1159. },
  1160. {
  1161. "name": "__vbaFreeStr",
  1162. "address": "0x4011b0"
  1163. },
  1164. {
  1165. "name": "__vbaFreeObj",
  1166. "address": "0x4011b4"
  1167. }
  1168. ],
  1169. "dll": "MSVBVM60.DLL"
  1170. }
  1171. ],
  1172. "digital_signers": null,
  1173. "exported_dll_name": null,
  1174. "actual_checksum": "0x00098c5b",
  1175. "overlay": null,
  1176. "imagebase": "0x00400000",
  1177. "reported_checksum": "0x00098c5b",
  1178. "icon_hash": null,
  1179. "entrypoint": "0x00401514",
  1180. "timestamp": "2010-02-01 15:23:11",
  1181. "osversion": "4.0",
  1182. "sections": [
  1183. {
  1184. "name": ".text",
  1185. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1186. "virtual_address": "0x00001000",
  1187. "size_of_data": "0x00090000",
  1188. "entropy": "7.53",
  1189. "raw_address": "0x00001000",
  1190. "virtual_size": "0x0008f7d8",
  1191. "characteristics_raw": "0x60000020"
  1192. },
  1193. {
  1194. "name": ".data",
  1195. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1196. "virtual_address": "0x00091000",
  1197. "size_of_data": "0x00001000",
  1198. "entropy": "0.00",
  1199. "raw_address": "0x00091000",
  1200. "virtual_size": "0x000045ec",
  1201. "characteristics_raw": "0xc0000040"
  1202. },
  1203. {
  1204. "name": ".rsrc",
  1205. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1206. "virtual_address": "0x00096000",
  1207. "size_of_data": "0x00002000",
  1208. "entropy": "3.33",
  1209. "raw_address": "0x00092000",
  1210. "virtual_size": "0x000010b8",
  1211. "characteristics_raw": "0x40000040"
  1212. }
  1213. ],
  1214. "resources": [],
  1215. "dirents": [
  1216. {
  1217. "virtual_address": "0x00000000",
  1218. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1219. "size": "0x00000000"
  1220. },
  1221. {
  1222. "virtual_address": "0x00090184",
  1223. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1224. "size": "0x00000028"
  1225. },
  1226. {
  1227. "virtual_address": "0x00096000",
  1228. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1229. "size": "0x000010b8"
  1230. },
  1231. {
  1232. "virtual_address": "0x00000000",
  1233. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1234. "size": "0x00000000"
  1235. },
  1236. {
  1237. "virtual_address": "0x00000000",
  1238. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1239. "size": "0x00000000"
  1240. },
  1241. {
  1242. "virtual_address": "0x00000000",
  1243. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1244. "size": "0x00000000"
  1245. },
  1246. {
  1247. "virtual_address": "0x00000000",
  1248. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1249. "size": "0x00000000"
  1250. },
  1251. {
  1252. "virtual_address": "0x00000000",
  1253. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1254. "size": "0x00000000"
  1255. },
  1256. {
  1257. "virtual_address": "0x00000000",
  1258. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1259. "size": "0x00000000"
  1260. },
  1261. {
  1262. "virtual_address": "0x00000000",
  1263. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1264. "size": "0x00000000"
  1265. },
  1266. {
  1267. "virtual_address": "0x00000000",
  1268. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1269. "size": "0x00000000"
  1270. },
  1271. {
  1272. "virtual_address": "0x00000238",
  1273. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1274. "size": "0x00000020"
  1275. },
  1276. {
  1277. "virtual_address": "0x00001000",
  1278. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1279. "size": "0x000001bc"
  1280. },
  1281. {
  1282. "virtual_address": "0x00000000",
  1283. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1284. "size": "0x00000000"
  1285. },
  1286. {
  1287. "virtual_address": "0x00000000",
  1288. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1289. "size": "0x00000000"
  1290. },
  1291. {
  1292. "virtual_address": "0x00000000",
  1293. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1294. "size": "0x00000000"
  1295. }
  1296. ],
  1297. "exports": [],
  1298. "guest_signers": {},
  1299. "imphash": "cbfa0724a1832545a706c3b189e9cf41",
  1300. "icon_fuzzy": null,
  1301. "icon": null,
  1302. "pdbpath": null,
  1303. "imported_dll_count": 1,
  1304. "versioninfo": []
  1305. }
  1306. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!