API tools faq
paste
paladin316

Exes_cdfe5eeec1d30669f726c46f9e5b457e_exe.json

paladin316
Jun 20th, 2019
2,210
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 60.49 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Clipbanker"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_cdfe5eeec1d30669f726c46f9e5b457e.exe"
  7. [*] File Size: 133120
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "461add8a256e74ca872b6eccd281fc9026ff8a24900eaf4a27267e189ddec67b"
  10. [*] MD5: "cdfe5eeec1d30669f726c46f9e5b457e"
  11. [*] SHA1: "1233e7dea7b8672246c75fc740c722ea06e7857b"
  12. [*] SHA512: "61f96a2394f7fc6eacfae192f8acda0cff49115599492bac4bcb6f749d7fc55dc997db87f1643c35f0a77dc8cad823988de5d9a1ae572f1fef00aeb9ffdbe4c7"
  13. [*] CRC32: "606D5111"
  14. [*] SSDEEP: "3072:iNQa4VSzb+OAH4RaUwxCSF6HrZ1YEFMN5w:zKA6KytGEFMN"
  15.  
  16. [*] Process Execution: [
  17. "Exes_cdfe5eeec1d30669f726c46f9e5b457e.exe",
  18. "IntelRapid.exe",
  19. "svchost.exe"
  20. ]
  21.  
  22. [*] Signatures Detected: [
  23. {
  24. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  25. "Details": [
  26. {
  27. "IP": "74.125.0.123:80"
  28. }
  29. ]
  30. },
  31. {
  32. "Description": "Drops a binary and executes it",
  33. "Details": [
  34. {
  35. "binary": "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe"
  36. }
  37. ]
  38. },
  39. {
  40. "Description": "Performs some HTTP requests",
  41. "Details": [
  42. {
  43. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe"
  44. },
  45. {
  46. "url": "http://r5---sn-tt1eln7s.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7s&ms=nvh&mt=1561010676&mv=m&pl=24&shardbypass=yes"
  47. }
  48. ]
  49. },
  50. {
  51. "Description": "Installs itself for autorun at Windows startup",
  52. "Details": [
  53. {
  54. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IntelRapid.lnk"
  55. },
  56. {
  57. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IntelRapid.lnk"
  58. }
  59. ]
  60. },
  61. {
  62. "Description": "Creates a hidden or system file",
  63. "Details": [
  64. {
  65. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\BITA3C9.tmp"
  66. }
  67. ]
  68. },
  69. {
  70. "Description": "File has been identified by 51 Antiviruses on VirusTotal as malicious",
  71. "Details": [
  72. {
  73. "MicroWorld-eScan": "Gen:Variant.Ser.Mikey.426"
  74. },
  75. {
  76. "FireEye": "Generic.mg.cdfe5eeec1d30669"
  77. },
  78. {
  79. "McAfee": "RDN/Generic.grp"
  80. },
  81. {
  82. "Cylance": "Unsafe"
  83. },
  84. {
  85. "VIPRE": "Trojan.Win32.Generic!BT"
  86. },
  87. {
  88. "Alibaba": "Trojan:Win32/ClipBanker.ccbca245"
  89. },
  90. {
  91. "K7GW": "Trojan ( 0054ff151 )"
  92. },
  93. {
  94. "K7AntiVirus": "Trojan ( 0054ff151 )"
  95. },
  96. {
  97. "Arcabit": "Trojan.Ser.Mikey.426"
  98. },
  99. {
  100. "Invincea": "heuristic"
  101. },
  102. {
  103. "Symantec": "Trojan.Gen.MBT"
  104. },
  105. {
  106. "APEX": "Malicious"
  107. },
  108. {
  109. "Kaspersky": "Trojan-Banker.Win32.ClipBanker.cjk"
  110. },
  111. {
  112. "BitDefender": "Gen:Variant.Ser.Mikey.426"
  113. },
  114. {
  115. "NANO-Antivirus": "Trojan.Win32.ClipBanker.frhssa"
  116. },
  117. {
  118. "AegisLab": "Trojan.Win32.Mikey.4!c"
  119. },
  120. {
  121. "Avast": "Win32:Trojan-gen"
  122. },
  123. {
  124. "Rising": "Trojan.ClipBanker!8.5FB (CLOUD)"
  125. },
  126. {
  127. "Endgame": "malicious (high confidence)"
  128. },
  129. {
  130. "Emsisoft": "Gen:Variant.Ser.Mikey.426 (B)"
  131. },
  132. {
  133. "Comodo": "Malware@#2dexw9rfkrvru"
  134. },
  135. {
  136. "F-Secure": "Trojan.TR/ClipBanker.liuru"
  137. },
  138. {
  139. "DrWeb": "Trojan.MulDrop9.13536"
  140. },
  141. {
  142. "Zillya": "Trojan.ClipBanker.Win32.1287"
  143. },
  144. {
  145. "TrendMicro": "Trojan.MSIL.ZPEVDO.USXVPFJ19"
  146. },
  147. {
  148. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.ch"
  149. },
  150. {
  151. "Sophos": "Mal/Generic-S"
  152. },
  153. {
  154. "Ikarus": "Trojan.Win32.Clipbanker"
  155. },
  156. {
  157. "Cyren": "W32/Trojan.QXMU-4415"
  158. },
  159. {
  160. "Webroot": "W32.Trojan.Gen"
  161. },
  162. {
  163. "Avira": "TR/ClipBanker.liuru"
  164. },
  165. {
  166. "MAX": "malware (ai score=100)"
  167. },
  168. {
  169. "Microsoft": "Trojan:Win32/Occamy.C"
  170. },
  171. {
  172. "ViRobot": "Trojan.Win32.Z.Clipbanker.133120"
  173. },
  174. {
  175. "ZoneAlarm": "Trojan-Banker.Win32.ClipBanker.cjk"
  176. },
  177. {
  178. "GData": "Gen:Variant.Ser.Mikey.426"
  179. },
  180. {
  181. "AhnLab-V3": "Trojan/Win32.ClipBanker.C3292926"
  182. },
  183. {
  184. "VBA32": "BScope.TrojanDropper.Scrop"
  185. },
  186. {
  187. "ALYac": "Gen:Variant.Ser.Mikey.426"
  188. },
  189. {
  190. "Ad-Aware": "Gen:Variant.Ser.Mikey.426"
  191. },
  192. {
  193. "Malwarebytes": "Trojan.Banker"
  194. },
  195. {
  196. "ESET-NOD32": "a variant of Win32/ClipBanker.JD"
  197. },
  198. {
  199. "TrendMicro-HouseCall": "Trojan.MSIL.ZPEVDO.USXVPFJ19"
  200. },
  201. {
  202. "Tencent": "Win32.Trojan-banker.Clipbanker.Tdzq"
  203. },
  204. {
  205. "SentinelOne": "DFI - Suspicious PE"
  206. },
  207. {
  208. "Fortinet": "W32/ClipBanker.JD!tr"
  209. },
  210. {
  211. "AVG": "Win32:Trojan-gen"
  212. },
  213. {
  214. "Cybereason": "malicious.ec1d30"
  215. },
  216. {
  217. "Panda": "Trj/GdSda.A"
  218. },
  219. {
  220. "CrowdStrike": "win/malicious_confidence_60% (D)"
  221. },
  222. {
  223. "Qihoo-360": "Win32/Trojan.74f"
  224. }
  225. ]
  226. },
  227. {
  228. "Description": "Creates a copy of itself",
  229. "Details": [
  230. {
  231. "copy": "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe"
  232. }
  233. ]
  234. }
  235. ]
  236.  
  237. [*] Started Service: []
  238.  
  239. [*] Executed Commands: [
  240. "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe"
  241. ]
  242.  
  243. [*] Mutexes: [
  244. "{37529D08-A67E-40B3-B0F2-EB87331B47F5}"
  245. ]
  246.  
  247. [*] Modified Files: [
  248. "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe",
  249. "\\??\\PIPE\\srvsvc",
  250. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IntelRapid.lnk",
  251. "C:\\Windows\\sysnative\\Tasks\\Intel Rapid",
  252. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  253. "C:\\Users\\user\\AppData\\Local\\Temp\\BITA3C9.tmp",
  254. "C:\\Users\\user\\AppData\\Local\\Temp\\{882AF33D-308A-4EC1-A65F-D99AE9A7BD47}-75.0.3770.100_74.0.3729.169_chrome_updater.exe",
  255. "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
  256. "\\Device\\LanmanDatagramReceiver"
  257. ]
  258.  
  259. [*] Deleted Files: [
  260. "C:\\Windows\\Tasks\\Intel Rapid.job"
  261. ]
  262.  
  263. [*] Modified Registry Keys: [
  264. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{3B7462F5-8C3D-4EB2-A13D-C03C208199DB}\\Path",
  265. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{3B7462F5-8C3D-4EB2-A13D-C03C208199DB}\\Hash",
  266. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Intel Rapid\\Id",
  267. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Intel Rapid\\Index",
  268. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{3B7462F5-8C3D-4EB2-A13D-C03C208199DB}\\Triggers",
  269. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{3B7462F5-8C3D-4EB2-A13D-C03C208199DB}\\DynamicInfo",
  270. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{26CEE9A6-18F5-4F69-8C4D-2467328655EB}\\DynamicInfo",
  271. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05}\\DynamicInfo",
  272. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  273. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\BITS\\StateIndex",
  274. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Reporting\\RebootWatch",
  275. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\NextSqmReportTime"
  276. ]
  277.  
  278. [*] Deleted Registry Keys: [
  279. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Intel Rapid.job",
  280. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Intel Rapid.job.fp"
  281. ]
  282.  
  283. [*] DNS Communications: []
  284.  
  285. [*] Domains: []
  286.  
  287. [*] Network Communication - ICMP: []
  288.  
  289. [*] Network Communication - HTTP: [
  290. {
  291. "count": 1,
  292. "body": "",
  293. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe",
  294. "user-agent": "Microsoft BITS/7.5",
  295. "method": "HEAD",
  296. "host": "redirector.gvt1.com",
  297. "version": "1.1",
  298. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe",
  299. "data": "HEAD /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  300. "port": 80
  301. },
  302. {
  303. "count": 1,
  304. "body": "",
  305. "uri": "http://r5---sn-tt1eln7s.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7s&ms=nvh&mt=1561010676&mv=m&pl=24&shardbypass=yes",
  306. "user-agent": "Microsoft BITS/7.5",
  307. "method": "HEAD",
  308. "host": "r5---sn-tt1eln7s.gvt1.com",
  309. "version": "1.1",
  310. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7s&ms=nvh&mt=1561010676&mv=m&pl=24&shardbypass=yes",
  311. "data": "HEAD /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7s&ms=nvh&mt=1561010676&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7s.gvt1.com\r\n\r\n",
  312. "port": 80
  313. }
  314. ]
  315.  
  316. [*] Network Communication - SMTP: []
  317.  
  318. [*] Network Communication - Hosts: []
  319.  
  320. [*] Network Communication - IRC: []
  321.  
  322. [*] Static Analysis: {
  323. "pe": {
  324. "peid_signatures": null,
  325. "imports": [
  326. {
  327. "imports": [
  328. {
  329. "name": "CreateMutexW",
  330. "address": "0x414000"
  331. },
  332. {
  333. "name": "Sleep",
  334. "address": "0x414004"
  335. },
  336. {
  337. "name": "GetLastError",
  338. "address": "0x414008"
  339. },
  340. {
  341. "name": "CloseHandle",
  342. "address": "0x41400c"
  343. },
  344. {
  345. "name": "ExitProcess",
  346. "address": "0x414010"
  347. },
  348. {
  349. "name": "ReadProcessMemory",
  350. "address": "0x414014"
  351. },
  352. {
  353. "name": "SizeofResource",
  354. "address": "0x414018"
  355. },
  356. {
  357. "name": "EnumResourceNamesW",
  358. "address": "0x41401c"
  359. },
  360. {
  361. "name": "LockResource",
  362. "address": "0x414020"
  363. },
  364. {
  365. "name": "LoadResource",
  366. "address": "0x414024"
  367. },
  368. {
  369. "name": "FindResourceW",
  370. "address": "0x414028"
  371. },
  372. {
  373. "name": "CreateDirectoryW",
  374. "address": "0x41402c"
  375. },
  376. {
  377. "name": "GetModuleFileNameW",
  378. "address": "0x414030"
  379. },
  380. {
  381. "name": "GetFileAttributesW",
  382. "address": "0x414034"
  383. },
  384. {
  385. "name": "CreateProcessW",
  386. "address": "0x414038"
  387. },
  388. {
  389. "name": "CopyFileW",
  390. "address": "0x41403c"
  391. },
  392. {
  393. "name": "EnterCriticalSection",
  394. "address": "0x414040"
  395. },
  396. {
  397. "name": "LeaveCriticalSection",
  398. "address": "0x414044"
  399. },
  400. {
  401. "name": "InitializeCriticalSection",
  402. "address": "0x414048"
  403. },
  404. {
  405. "name": "DeleteCriticalSection",
  406. "address": "0x41404c"
  407. },
  408. {
  409. "name": "GlobalSize",
  410. "address": "0x414050"
  411. },
  412. {
  413. "name": "GlobalAlloc",
  414. "address": "0x414054"
  415. },
  416. {
  417. "name": "GlobalFree",
  418. "address": "0x414058"
  419. },
  420. {
  421. "name": "GlobalLock",
  422. "address": "0x41405c"
  423. },
  424. {
  425. "name": "GetTickCount",
  426. "address": "0x414060"
  427. },
  428. {
  429. "name": "GlobalUnlock",
  430. "address": "0x414064"
  431. },
  432. {
  433. "name": "SetLastError",
  434. "address": "0x414068"
  435. },
  436. {
  437. "name": "WaitForMultipleObjects",
  438. "address": "0x41406c"
  439. },
  440. {
  441. "name": "CreateEventW",
  442. "address": "0x414070"
  443. },
  444. {
  445. "name": "GetExitCodeThread",
  446. "address": "0x414074"
  447. },
  448. {
  449. "name": "SetEvent",
  450. "address": "0x414078"
  451. },
  452. {
  453. "name": "TerminateThread",
  454. "address": "0x41407c"
  455. },
  456. {
  457. "name": "CreateThread",
  458. "address": "0x414080"
  459. },
  460. {
  461. "name": "CreateFileW",
  462. "address": "0x414084"
  463. },
  464. {
  465. "name": "DecodePointer",
  466. "address": "0x414088"
  467. },
  468. {
  469. "name": "WriteConsoleW",
  470. "address": "0x41408c"
  471. },
  472. {
  473. "name": "SetFilePointerEx",
  474. "address": "0x414090"
  475. },
  476. {
  477. "name": "GetConsoleMode",
  478. "address": "0x414094"
  479. },
  480. {
  481. "name": "GetConsoleCP",
  482. "address": "0x414098"
  483. },
  484. {
  485. "name": "FlushFileBuffers",
  486. "address": "0x41409c"
  487. },
  488. {
  489. "name": "HeapReAlloc",
  490. "address": "0x4140a0"
  491. },
  492. {
  493. "name": "HeapSize",
  494. "address": "0x4140a4"
  495. },
  496. {
  497. "name": "GetProcessHeap",
  498. "address": "0x4140a8"
  499. },
  500. {
  501. "name": "GetStringTypeW",
  502. "address": "0x4140ac"
  503. },
  504. {
  505. "name": "GetFileType",
  506. "address": "0x4140b0"
  507. },
  508. {
  509. "name": "SetStdHandle",
  510. "address": "0x4140b4"
  511. },
  512. {
  513. "name": "LCMapStringW",
  514. "address": "0x4140b8"
  515. },
  516. {
  517. "name": "FreeEnvironmentStringsW",
  518. "address": "0x4140bc"
  519. },
  520. {
  521. "name": "GetEnvironmentStringsW",
  522. "address": "0x4140c0"
  523. },
  524. {
  525. "name": "GetCommandLineW",
  526. "address": "0x4140c4"
  527. },
  528. {
  529. "name": "GetCommandLineA",
  530. "address": "0x4140c8"
  531. },
  532. {
  533. "name": "GetCPInfo",
  534. "address": "0x4140cc"
  535. },
  536. {
  537. "name": "GetOEMCP",
  538. "address": "0x4140d0"
  539. },
  540. {
  541. "name": "IsValidCodePage",
  542. "address": "0x4140d4"
  543. },
  544. {
  545. "name": "QueryPerformanceCounter",
  546. "address": "0x4140d8"
  547. },
  548. {
  549. "name": "GetCurrentProcessId",
  550. "address": "0x4140dc"
  551. },
  552. {
  553. "name": "GetCurrentThreadId",
  554. "address": "0x4140e0"
  555. },
  556. {
  557. "name": "GetSystemTimeAsFileTime",
  558. "address": "0x4140e4"
  559. },
  560. {
  561. "name": "InitializeSListHead",
  562. "address": "0x4140e8"
  563. },
  564. {
  565. "name": "IsDebuggerPresent",
  566. "address": "0x4140ec"
  567. },
  568. {
  569. "name": "UnhandledExceptionFilter",
  570. "address": "0x4140f0"
  571. },
  572. {
  573. "name": "SetUnhandledExceptionFilter",
  574. "address": "0x4140f4"
  575. },
  576. {
  577. "name": "GetStartupInfoW",
  578. "address": "0x4140f8"
  579. },
  580. {
  581. "name": "IsProcessorFeaturePresent",
  582. "address": "0x4140fc"
  583. },
  584. {
  585. "name": "GetModuleHandleW",
  586. "address": "0x414100"
  587. },
  588. {
  589. "name": "GetCurrentProcess",
  590. "address": "0x414104"
  591. },
  592. {
  593. "name": "TerminateProcess",
  594. "address": "0x414108"
  595. },
  596. {
  597. "name": "LocalFree",
  598. "address": "0x41410c"
  599. },
  600. {
  601. "name": "EncodePointer",
  602. "address": "0x414110"
  603. },
  604. {
  605. "name": "RaiseException",
  606. "address": "0x414114"
  607. },
  608. {
  609. "name": "RtlUnwind",
  610. "address": "0x414118"
  611. },
  612. {
  613. "name": "InitializeCriticalSectionAndSpinCount",
  614. "address": "0x41411c"
  615. },
  616. {
  617. "name": "TlsAlloc",
  618. "address": "0x414120"
  619. },
  620. {
  621. "name": "TlsGetValue",
  622. "address": "0x414124"
  623. },
  624. {
  625. "name": "TlsSetValue",
  626. "address": "0x414128"
  627. },
  628. {
  629. "name": "TlsFree",
  630. "address": "0x41412c"
  631. },
  632. {
  633. "name": "FreeLibrary",
  634. "address": "0x414130"
  635. },
  636. {
  637. "name": "GetProcAddress",
  638. "address": "0x414134"
  639. },
  640. {
  641. "name": "LoadLibraryExW",
  642. "address": "0x414138"
  643. },
  644. {
  645. "name": "GetStdHandle",
  646. "address": "0x41413c"
  647. },
  648. {
  649. "name": "WriteFile",
  650. "address": "0x414140"
  651. },
  652. {
  653. "name": "GetModuleFileNameA",
  654. "address": "0x414144"
  655. },
  656. {
  657. "name": "MultiByteToWideChar",
  658. "address": "0x414148"
  659. },
  660. {
  661. "name": "WideCharToMultiByte",
  662. "address": "0x41414c"
  663. },
  664. {
  665. "name": "GetModuleHandleExW",
  666. "address": "0x414150"
  667. },
  668. {
  669. "name": "GetACP",
  670. "address": "0x414154"
  671. },
  672. {
  673. "name": "HeapFree",
  674. "address": "0x414158"
  675. },
  676. {
  677. "name": "HeapAlloc",
  678. "address": "0x41415c"
  679. },
  680. {
  681. "name": "FindClose",
  682. "address": "0x414160"
  683. },
  684. {
  685. "name": "FindFirstFileExA",
  686. "address": "0x414164"
  687. },
  688. {
  689. "name": "FindNextFileA",
  690. "address": "0x414168"
  691. }
  692. ],
  693. "dll": "KERNEL32.dll"
  694. },
  695. {
  696. "imports": [
  697. {
  698. "name": "GetMessageW",
  699. "address": "0x414188"
  700. },
  701. {
  702. "name": "DefWindowProcW",
  703. "address": "0x41418c"
  704. },
  705. {
  706. "name": "DestroyWindow",
  707. "address": "0x414190"
  708. },
  709. {
  710. "name": "CreateWindowExW",
  711. "address": "0x414194"
  712. },
  713. {
  714. "name": "GetClassInfoW",
  715. "address": "0x414198"
  716. },
  717. {
  718. "name": "CloseWindow",
  719. "address": "0x41419c"
  720. },
  721. {
  722. "name": "GetWindowLongW",
  723. "address": "0x4141a0"
  724. },
  725. {
  726. "name": "DispatchMessageW",
  727. "address": "0x4141a4"
  728. },
  729. {
  730. "name": "RegisterClassW",
  731. "address": "0x4141a8"
  732. },
  733. {
  734. "name": "TranslateMessage",
  735. "address": "0x4141ac"
  736. },
  737. {
  738. "name": "RemoveClipboardFormatListener",
  739. "address": "0x4141b0"
  740. },
  741. {
  742. "name": "SetWindowLongW",
  743. "address": "0x4141b4"
  744. },
  745. {
  746. "name": "AddClipboardFormatListener",
  747. "address": "0x4141b8"
  748. },
  749. {
  750. "name": "OpenClipboard",
  751. "address": "0x4141bc"
  752. },
  753. {
  754. "name": "CloseClipboard",
  755. "address": "0x4141c0"
  756. },
  757. {
  758. "name": "EmptyClipboard",
  759. "address": "0x4141c4"
  760. },
  761. {
  762. "name": "GetClipboardData",
  763. "address": "0x4141c8"
  764. },
  765. {
  766. "name": "SetClipboardData",
  767. "address": "0x4141cc"
  768. },
  769. {
  770. "name": "IsClipboardFormatAvailable",
  771. "address": "0x4141d0"
  772. },
  773. {
  774. "name": "GetKeyboardLayoutList",
  775. "address": "0x4141d4"
  776. },
  777. {
  778. "name": "IsWindow",
  779. "address": "0x4141d8"
  780. }
  781. ],
  782. "dll": "USER32.dll"
  783. },
  784. {
  785. "imports": [
  786. {
  787. "name": "SHGetSpecialFolderPathW",
  788. "address": "0x414180"
  789. }
  790. ],
  791. "dll": "SHELL32.dll"
  792. },
  793. {
  794. "imports": [
  795. {
  796. "name": "CoInitializeEx",
  797. "address": "0x4141e0"
  798. },
  799. {
  800. "name": "CoCreateInstance",
  801. "address": "0x4141e4"
  802. },
  803. {
  804. "name": "CoUninitialize",
  805. "address": "0x4141e8"
  806. }
  807. ],
  808. "dll": "ole32.dll"
  809. },
  810. {
  811. "imports": [
  812. {
  813. "name": "VariantInit",
  814. "address": "0x414170"
  815. },
  816. {
  817. "name": "SysFreeString",
  818. "address": "0x414174"
  819. },
  820. {
  821. "name": "SysAllocString",
  822. "address": "0x414178"
  823. }
  824. ],
  825. "dll": "OLEAUT32.dll"
  826. }
  827. ],
  828. "digital_signers": null,
  829. "exported_dll_name": null,
  830. "actual_checksum": "0x0002303d",
  831. "overlay": null,
  832. "imagebase": "0x00400000",
  833. "reported_checksum": "0x00000000",
  834. "icon_hash": null,
  835. "entrypoint": "0x00407c21",
  836. "timestamp": "2019-06-04 15:07:23",
  837. "osversion": "6.0",
  838. "sections": [
  839. {
  840. "name": ".text",
  841. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  842. "virtual_address": "0x00001000",
  843. "size_of_data": "0x00012c00",
  844. "entropy": "6.62",
  845. "raw_address": "0x00000400",
  846. "virtual_size": "0x00012b3b",
  847. "characteristics_raw": "0x60000020"
  848. },
  849. {
  850. "name": ".rdata",
  851. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  852. "virtual_address": "0x00014000",
  853. "size_of_data": "0x00009600",
  854. "entropy": "4.59",
  855. "raw_address": "0x00013000",
  856. "virtual_size": "0x000094f4",
  857. "characteristics_raw": "0x40000040"
  858. },
  859. {
  860. "name": ".data",
  861. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  862. "virtual_address": "0x0001e000",
  863. "size_of_data": "0x00002000",
  864. "entropy": "5.04",
  865. "raw_address": "0x0001c600",
  866. "virtual_size": "0x00002938",
  867. "characteristics_raw": "0xc0000040"
  868. },
  869. {
  870. "name": ".gfids",
  871. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  872. "virtual_address": "0x00021000",
  873. "size_of_data": "0x00000200",
  874. "entropy": "2.12",
  875. "raw_address": "0x0001e600",
  876. "virtual_size": "0x0000012c",
  877. "characteristics_raw": "0x40000040"
  878. },
  879. {
  880. "name": ".rsrc",
  881. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  882. "virtual_address": "0x00022000",
  883. "size_of_data": "0x00000200",
  884. "entropy": "4.63",
  885. "raw_address": "0x0001e800",
  886. "virtual_size": "0x0000016c",
  887. "characteristics_raw": "0x40000040"
  888. },
  889. {
  890. "name": ".reloc",
  891. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  892. "virtual_address": "0x00023000",
  893. "size_of_data": "0x00001e00",
  894. "entropy": "6.43",
  895. "raw_address": "0x0001ea00",
  896. "virtual_size": "0x00001dd0",
  897. "characteristics_raw": "0x42000040"
  898. }
  899. ],
  900. "resources": [],
  901. "dirents": [
  902. {
  903. "virtual_address": "0x00000000",
  904. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  905. "size": "0x00000000"
  906. },
  907. {
  908. "virtual_address": "0x0001c9fc",
  909. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  910. "size": "0x00000078"
  911. },
  912. {
  913. "virtual_address": "0x00022000",
  914. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  915. "size": "0x0000016c"
  916. },
  917. {
  918. "virtual_address": "0x00000000",
  919. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  920. "size": "0x00000000"
  921. },
  922. {
  923. "virtual_address": "0x00000000",
  924. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  925. "size": "0x00000000"
  926. },
  927. {
  928. "virtual_address": "0x00023000",
  929. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  930. "size": "0x00001dd0"
  931. },
  932. {
  933. "virtual_address": "0x000194b0",
  934. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  935. "size": "0x00000038"
  936. },
  937. {
  938. "virtual_address": "0x00000000",
  939. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  940. "size": "0x00000000"
  941. },
  942. {
  943. "virtual_address": "0x00000000",
  944. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  945. "size": "0x00000000"
  946. },
  947. {
  948. "virtual_address": "0x00000000",
  949. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  950. "size": "0x00000000"
  951. },
  952. {
  953. "virtual_address": "0x000194e8",
  954. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  955. "size": "0x00000040"
  956. },
  957. {
  958. "virtual_address": "0x00000000",
  959. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  960. "size": "0x00000000"
  961. },
  962. {
  963. "virtual_address": "0x00014000",
  964. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  965. "size": "0x000001f0"
  966. },
  967. {
  968. "virtual_address": "0x00000000",
  969. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  970. "size": "0x00000000"
  971. },
  972. {
  973. "virtual_address": "0x00000000",
  974. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  975. "size": "0x00000000"
  976. },
  977. {
  978. "virtual_address": "0x00000000",
  979. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  980. "size": "0x00000000"
  981. }
  982. ],
  983. "exports": [],
  984. "guest_signers": {},
  985. "imphash": "4dfd516b1461e570a523efd4ab8d77c8",
  986. "icon_fuzzy": null,
  987. "icon": null,
  988. "pdbpath": null,
  989. "imported_dll_count": 5,
  990. "versioninfo": []
  991. }
  992. }
  993.  
  994. [*] Resolved APIs: [
  995. "kernel32.dll.FlsAlloc",
  996. "kernel32.dll.FlsSetValue",
  997. "kernel32.dll.FlsGetValue",
  998. "kernel32.dll.LCMapStringEx",
  999. "cryptbase.dll.SystemFunction036",
  1000. "ole32.dll.CoTaskMemAlloc",
  1001. "propsys.dll.PSCreateMemoryPropertyStore",
  1002. "ole32.dll.CoGetApartmentType",
  1003. "comctl32.dll.#236",
  1004. "oleaut32.dll.#6",
  1005. "ole32.dll.CoGetMalloc",
  1006. "ole32.dll.CreateBindCtx",
  1007. "comctl32.dll.#320",
  1008. "comctl32.dll.#324",
  1009. "comctl32.dll.#323",
  1010. "comctl32.dll.#388",
  1011. "comctl32.dll.#328",
  1012. "comctl32.dll.#334",
  1013. "advapi32.dll.RegEnumKeyW",
  1014. "oleaut32.dll.#2",
  1015. "ole32.dll.CoCreateInstance",
  1016. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  1017. "advapi32.dll.InitializeSecurityDescriptor",
  1018. "advapi32.dll.SetEntriesInAclW",
  1019. "ntmarta.dll.GetMartaExtensionInterface",
  1020. "advapi32.dll.SetSecurityDescriptorDacl",
  1021. "advapi32.dll.IsTextUnicode",
  1022. "comctl32.dll.#332",
  1023. "comctl32.dll.#338",
  1024. "comctl32.dll.#339",
  1025. "shell32.dll.#102",
  1026. "ole32.dll.CoInitializeEx",
  1027. "ole32.dll.CoUninitialize",
  1028. "sechost.dll.ConvertSidToStringSidW",
  1029. "profapi.dll.#104",
  1030. "ole32.dll.PropVariantClear",
  1031. "oleaut32.dll.#9",
  1032. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  1033. "comctl32.dll.#386",
  1034. "ole32.dll.CoTaskMemFree",
  1035. "advapi32.dll.RegQueryValueW",
  1036. "apphelp.dll.ApphelpCheckShellObject",
  1037. "linkinfo.dll.CreateLinkInfoW",
  1038. "user32.dll.IsCharAlphaW",
  1039. "user32.dll.CharPrevW",
  1040. "ntshrui.dll.GetNetResourceFromLocalPathW",
  1041. "srvcli.dll.NetShareEnum",
  1042. "cscapi.dll.CscNetApiGetInterface",
  1043. "slc.dll.SLGetWindowsInformationDWORD",
  1044. "shlwapi.dll.PathRemoveFileSpecW",
  1045. "linkinfo.dll.DestroyLinkInfo",
  1046. "ole32.dll.NdrOleInitializeExtension",
  1047. "ole32.dll.CoGetClassObject",
  1048. "ole32.dll.CoGetMarshalSizeMax",
  1049. "ole32.dll.CoMarshalInterface",
  1050. "ole32.dll.CoUnmarshalInterface",
  1051. "ole32.dll.StringFromIID",
  1052. "ole32.dll.CoGetPSClsid",
  1053. "ole32.dll.CoReleaseMarshalData",
  1054. "ole32.dll.DcomChannelSetHResult",
  1055. "oleaut32.dll.#500",
  1056. "sspicli.dll.GetUserNameExW",
  1057. "xmllite.dll.CreateXmlWriter",
  1058. "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
  1059. "netutils.dll.NetApiBufferFree",
  1060. "advapi32.dll.UnregisterTraceGuids",
  1061. "comctl32.dll.#321",
  1062. "wbemcore.dll.Reinitialize",
  1063. "qmgrprxy.dll.DllGetClassObject",
  1064. "qmgrprxy.dll.DllCanUnloadNow",
  1065. "bitsprx4.dll.DllGetClassObject",
  1066. "bitsprx4.dll.DllCanUnloadNow",
  1067. "kernel32.dll.GetProductInfo",
  1068. "wer.dll.WerReportCreate",
  1069. "wer.dll.WerReportSubmit",
  1070. "wer.dll.WerReportCloseHandle",
  1071. "wer.dll.WerReportSetParameter",
  1072. "wmisvc.dll.IsShutDown",
  1073. "advapi32.dll.WmiMofEnumerateResourcesW",
  1074. "uxtheme.dll.ThemeInitApiHook",
  1075. "user32.dll.IsProcessDPIAware"
  1076. ]
  1077.  
  1078. [*] Static Analysis: {
  1079. "pe": {
  1080. "peid_signatures": null,
  1081. "imports": [
  1082. {
  1083. "imports": [
  1084. {
  1085. "name": "CreateMutexW",
  1086. "address": "0x414000"
  1087. },
  1088. {
  1089. "name": "Sleep",
  1090. "address": "0x414004"
  1091. },
  1092. {
  1093. "name": "GetLastError",
  1094. "address": "0x414008"
  1095. },
  1096. {
  1097. "name": "CloseHandle",
  1098. "address": "0x41400c"
  1099. },
  1100. {
  1101. "name": "ExitProcess",
  1102. "address": "0x414010"
  1103. },
  1104. {
  1105. "name": "ReadProcessMemory",
  1106. "address": "0x414014"
  1107. },
  1108. {
  1109. "name": "SizeofResource",
  1110. "address": "0x414018"
  1111. },
  1112. {
  1113. "name": "EnumResourceNamesW",
  1114. "address": "0x41401c"
  1115. },
  1116. {
  1117. "name": "LockResource",
  1118. "address": "0x414020"
  1119. },
  1120. {
  1121. "name": "LoadResource",
  1122. "address": "0x414024"
  1123. },
  1124. {
  1125. "name": "FindResourceW",
  1126. "address": "0x414028"
  1127. },
  1128. {
  1129. "name": "CreateDirectoryW",
  1130. "address": "0x41402c"
  1131. },
  1132. {
  1133. "name": "GetModuleFileNameW",
  1134. "address": "0x414030"
  1135. },
  1136. {
  1137. "name": "GetFileAttributesW",
  1138. "address": "0x414034"
  1139. },
  1140. {
  1141. "name": "CreateProcessW",
  1142. "address": "0x414038"
  1143. },
  1144. {
  1145. "name": "CopyFileW",
  1146. "address": "0x41403c"
  1147. },
  1148. {
  1149. "name": "EnterCriticalSection",
  1150. "address": "0x414040"
  1151. },
  1152. {
  1153. "name": "LeaveCriticalSection",
  1154. "address": "0x414044"
  1155. },
  1156. {
  1157. "name": "InitializeCriticalSection",
  1158. "address": "0x414048"
  1159. },
  1160. {
  1161. "name": "DeleteCriticalSection",
  1162. "address": "0x41404c"
  1163. },
  1164. {
  1165. "name": "GlobalSize",
  1166. "address": "0x414050"
  1167. },
  1168. {
  1169. "name": "GlobalAlloc",
  1170. "address": "0x414054"
  1171. },
  1172. {
  1173. "name": "GlobalFree",
  1174. "address": "0x414058"
  1175. },
  1176. {
  1177. "name": "GlobalLock",
  1178. "address": "0x41405c"
  1179. },
  1180. {
  1181. "name": "GetTickCount",
  1182. "address": "0x414060"
  1183. },
  1184. {
  1185. "name": "GlobalUnlock",
  1186. "address": "0x414064"
  1187. },
  1188. {
  1189. "name": "SetLastError",
  1190. "address": "0x414068"
  1191. },
  1192. {
  1193. "name": "WaitForMultipleObjects",
  1194. "address": "0x41406c"
  1195. },
  1196. {
  1197. "name": "CreateEventW",
  1198. "address": "0x414070"
  1199. },
  1200. {
  1201. "name": "GetExitCodeThread",
  1202. "address": "0x414074"
  1203. },
  1204. {
  1205. "name": "SetEvent",
  1206. "address": "0x414078"
  1207. },
  1208. {
  1209. "name": "TerminateThread",
  1210. "address": "0x41407c"
  1211. },
  1212. {
  1213. "name": "CreateThread",
  1214. "address": "0x414080"
  1215. },
  1216. {
  1217. "name": "CreateFileW",
  1218. "address": "0x414084"
  1219. },
  1220. {
  1221. "name": "DecodePointer",
  1222. "address": "0x414088"
  1223. },
  1224. {
  1225. "name": "WriteConsoleW",
  1226. "address": "0x41408c"
  1227. },
  1228. {
  1229. "name": "SetFilePointerEx",
  1230. "address": "0x414090"
  1231. },
  1232. {
  1233. "name": "GetConsoleMode",
  1234. "address": "0x414094"
  1235. },
  1236. {
  1237. "name": "GetConsoleCP",
  1238. "address": "0x414098"
  1239. },
  1240. {
  1241. "name": "FlushFileBuffers",
  1242. "address": "0x41409c"
  1243. },
  1244. {
  1245. "name": "HeapReAlloc",
  1246. "address": "0x4140a0"
  1247. },
  1248. {
  1249. "name": "HeapSize",
  1250. "address": "0x4140a4"
  1251. },
  1252. {
  1253. "name": "GetProcessHeap",
  1254. "address": "0x4140a8"
  1255. },
  1256. {
  1257. "name": "GetStringTypeW",
  1258. "address": "0x4140ac"
  1259. },
  1260. {
  1261. "name": "GetFileType",
  1262. "address": "0x4140b0"
  1263. },
  1264. {
  1265. "name": "SetStdHandle",
  1266. "address": "0x4140b4"
  1267. },
  1268. {
  1269. "name": "LCMapStringW",
  1270. "address": "0x4140b8"
  1271. },
  1272. {
  1273. "name": "FreeEnvironmentStringsW",
  1274. "address": "0x4140bc"
  1275. },
  1276. {
  1277. "name": "GetEnvironmentStringsW",
  1278. "address": "0x4140c0"
  1279. },
  1280. {
  1281. "name": "GetCommandLineW",
  1282. "address": "0x4140c4"
  1283. },
  1284. {
  1285. "name": "GetCommandLineA",
  1286. "address": "0x4140c8"
  1287. },
  1288. {
  1289. "name": "GetCPInfo",
  1290. "address": "0x4140cc"
  1291. },
  1292. {
  1293. "name": "GetOEMCP",
  1294. "address": "0x4140d0"
  1295. },
  1296. {
  1297. "name": "IsValidCodePage",
  1298. "address": "0x4140d4"
  1299. },
  1300. {
  1301. "name": "QueryPerformanceCounter",
  1302. "address": "0x4140d8"
  1303. },
  1304. {
  1305. "name": "GetCurrentProcessId",
  1306. "address": "0x4140dc"
  1307. },
  1308. {
  1309. "name": "GetCurrentThreadId",
  1310. "address": "0x4140e0"
  1311. },
  1312. {
  1313. "name": "GetSystemTimeAsFileTime",
  1314. "address": "0x4140e4"
  1315. },
  1316. {
  1317. "name": "InitializeSListHead",
  1318. "address": "0x4140e8"
  1319. },
  1320. {
  1321. "name": "IsDebuggerPresent",
  1322. "address": "0x4140ec"
  1323. },
  1324. {
  1325. "name": "UnhandledExceptionFilter",
  1326. "address": "0x4140f0"
  1327. },
  1328. {
  1329. "name": "SetUnhandledExceptionFilter",
  1330. "address": "0x4140f4"
  1331. },
  1332. {
  1333. "name": "GetStartupInfoW",
  1334. "address": "0x4140f8"
  1335. },
  1336. {
  1337. "name": "IsProcessorFeaturePresent",
  1338. "address": "0x4140fc"
  1339. },
  1340. {
  1341. "name": "GetModuleHandleW",
  1342. "address": "0x414100"
  1343. },
  1344. {
  1345. "name": "GetCurrentProcess",
  1346. "address": "0x414104"
  1347. },
  1348. {
  1349. "name": "TerminateProcess",
  1350. "address": "0x414108"
  1351. },
  1352. {
  1353. "name": "LocalFree",
  1354. "address": "0x41410c"
  1355. },
  1356. {
  1357. "name": "EncodePointer",
  1358. "address": "0x414110"
  1359. },
  1360. {
  1361. "name": "RaiseException",
  1362. "address": "0x414114"
  1363. },
  1364. {
  1365. "name": "RtlUnwind",
  1366. "address": "0x414118"
  1367. },
  1368. {
  1369. "name": "InitializeCriticalSectionAndSpinCount",
  1370. "address": "0x41411c"
  1371. },
  1372. {
  1373. "name": "TlsAlloc",
  1374. "address": "0x414120"
  1375. },
  1376. {
  1377. "name": "TlsGetValue",
  1378. "address": "0x414124"
  1379. },
  1380. {
  1381. "name": "TlsSetValue",
  1382. "address": "0x414128"
  1383. },
  1384. {
  1385. "name": "TlsFree",
  1386. "address": "0x41412c"
  1387. },
  1388. {
  1389. "name": "FreeLibrary",
  1390. "address": "0x414130"
  1391. },
  1392. {
  1393. "name": "GetProcAddress",
  1394. "address": "0x414134"
  1395. },
  1396. {
  1397. "name": "LoadLibraryExW",
  1398. "address": "0x414138"
  1399. },
  1400. {
  1401. "name": "GetStdHandle",
  1402. "address": "0x41413c"
  1403. },
  1404. {
  1405. "name": "WriteFile",
  1406. "address": "0x414140"
  1407. },
  1408. {
  1409. "name": "GetModuleFileNameA",
  1410. "address": "0x414144"
  1411. },
  1412. {
  1413. "name": "MultiByteToWideChar",
  1414. "address": "0x414148"
  1415. },
  1416. {
  1417. "name": "WideCharToMultiByte",
  1418. "address": "0x41414c"
  1419. },
  1420. {
  1421. "name": "GetModuleHandleExW",
  1422. "address": "0x414150"
  1423. },
  1424. {
  1425. "name": "GetACP",
  1426. "address": "0x414154"
  1427. },
  1428. {
  1429. "name": "HeapFree",
  1430. "address": "0x414158"
  1431. },
  1432. {
  1433. "name": "HeapAlloc",
  1434. "address": "0x41415c"
  1435. },
  1436. {
  1437. "name": "FindClose",
  1438. "address": "0x414160"
  1439. },
  1440. {
  1441. "name": "FindFirstFileExA",
  1442. "address": "0x414164"
  1443. },
  1444. {
  1445. "name": "FindNextFileA",
  1446. "address": "0x414168"
  1447. }
  1448. ],
  1449. "dll": "KERNEL32.dll"
  1450. },
  1451. {
  1452. "imports": [
  1453. {
  1454. "name": "GetMessageW",
  1455. "address": "0x414188"
  1456. },
  1457. {
  1458. "name": "DefWindowProcW",
  1459. "address": "0x41418c"
  1460. },
  1461. {
  1462. "name": "DestroyWindow",
  1463. "address": "0x414190"
  1464. },
  1465. {
  1466. "name": "CreateWindowExW",
  1467. "address": "0x414194"
  1468. },
  1469. {
  1470. "name": "GetClassInfoW",
  1471. "address": "0x414198"
  1472. },
  1473. {
  1474. "name": "CloseWindow",
  1475. "address": "0x41419c"
  1476. },
  1477. {
  1478. "name": "GetWindowLongW",
  1479. "address": "0x4141a0"
  1480. },
  1481. {
  1482. "name": "DispatchMessageW",
  1483. "address": "0x4141a4"
  1484. },
  1485. {
  1486. "name": "RegisterClassW",
  1487. "address": "0x4141a8"
  1488. },
  1489. {
  1490. "name": "TranslateMessage",
  1491. "address": "0x4141ac"
  1492. },
  1493. {
  1494. "name": "RemoveClipboardFormatListener",
  1495. "address": "0x4141b0"
  1496. },
  1497. {
  1498. "name": "SetWindowLongW",
  1499. "address": "0x4141b4"
  1500. },
  1501. {
  1502. "name": "AddClipboardFormatListener",
  1503. "address": "0x4141b8"
  1504. },
  1505. {
  1506. "name": "OpenClipboard",
  1507. "address": "0x4141bc"
  1508. },
  1509. {
  1510. "name": "CloseClipboard",
  1511. "address": "0x4141c0"
  1512. },
  1513. {
  1514. "name": "EmptyClipboard",
  1515. "address": "0x4141c4"
  1516. },
  1517. {
  1518. "name": "GetClipboardData",
  1519. "address": "0x4141c8"
  1520. },
  1521. {
  1522. "name": "SetClipboardData",
  1523. "address": "0x4141cc"
  1524. },
  1525. {
  1526. "name": "IsClipboardFormatAvailable",
  1527. "address": "0x4141d0"
  1528. },
  1529. {
  1530. "name": "GetKeyboardLayoutList",
  1531. "address": "0x4141d4"
  1532. },
  1533. {
  1534. "name": "IsWindow",
  1535. "address": "0x4141d8"
  1536. }
  1537. ],
  1538. "dll": "USER32.dll"
  1539. },
  1540. {
  1541. "imports": [
  1542. {
  1543. "name": "SHGetSpecialFolderPathW",
  1544. "address": "0x414180"
  1545. }
  1546. ],
  1547. "dll": "SHELL32.dll"
  1548. },
  1549. {
  1550. "imports": [
  1551. {
  1552. "name": "CoInitializeEx",
  1553. "address": "0x4141e0"
  1554. },
  1555. {
  1556. "name": "CoCreateInstance",
  1557. "address": "0x4141e4"
  1558. },
  1559. {
  1560. "name": "CoUninitialize",
  1561. "address": "0x4141e8"
  1562. }
  1563. ],
  1564. "dll": "ole32.dll"
  1565. },
  1566. {
  1567. "imports": [
  1568. {
  1569. "name": "VariantInit",
  1570. "address": "0x414170"
  1571. },
  1572. {
  1573. "name": "SysFreeString",
  1574. "address": "0x414174"
  1575. },
  1576. {
  1577. "name": "SysAllocString",
  1578. "address": "0x414178"
  1579. }
  1580. ],
  1581. "dll": "OLEAUT32.dll"
  1582. }
  1583. ],
  1584. "digital_signers": null,
  1585. "exported_dll_name": null,
  1586. "actual_checksum": "0x0002303d",
  1587. "overlay": null,
  1588. "imagebase": "0x00400000",
  1589. "reported_checksum": "0x00000000",
  1590. "icon_hash": null,
  1591. "entrypoint": "0x00407c21",
  1592. "timestamp": "2019-06-04 15:07:23",
  1593. "osversion": "6.0",
  1594. "sections": [
  1595. {
  1596. "name": ".text",
  1597. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1598. "virtual_address": "0x00001000",
  1599. "size_of_data": "0x00012c00",
  1600. "entropy": "6.62",
  1601. "raw_address": "0x00000400",
  1602. "virtual_size": "0x00012b3b",
  1603. "characteristics_raw": "0x60000020"
  1604. },
  1605. {
  1606. "name": ".rdata",
  1607. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1608. "virtual_address": "0x00014000",
  1609. "size_of_data": "0x00009600",
  1610. "entropy": "4.59",
  1611. "raw_address": "0x00013000",
  1612. "virtual_size": "0x000094f4",
  1613. "characteristics_raw": "0x40000040"
  1614. },
  1615. {
  1616. "name": ".data",
  1617. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1618. "virtual_address": "0x0001e000",
  1619. "size_of_data": "0x00002000",
  1620. "entropy": "5.04",
  1621. "raw_address": "0x0001c600",
  1622. "virtual_size": "0x00002938",
  1623. "characteristics_raw": "0xc0000040"
  1624. },
  1625. {
  1626. "name": ".gfids",
  1627. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1628. "virtual_address": "0x00021000",
  1629. "size_of_data": "0x00000200",
  1630. "entropy": "2.12",
  1631. "raw_address": "0x0001e600",
  1632. "virtual_size": "0x0000012c",
  1633. "characteristics_raw": "0x40000040"
  1634. },
  1635. {
  1636. "name": ".rsrc",
  1637. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1638. "virtual_address": "0x00022000",
  1639. "size_of_data": "0x00000200",
  1640. "entropy": "4.63",
  1641. "raw_address": "0x0001e800",
  1642. "virtual_size": "0x0000016c",
  1643. "characteristics_raw": "0x40000040"
  1644. },
  1645. {
  1646. "name": ".reloc",
  1647. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1648. "virtual_address": "0x00023000",
  1649. "size_of_data": "0x00001e00",
  1650. "entropy": "6.43",
  1651. "raw_address": "0x0001ea00",
  1652. "virtual_size": "0x00001dd0",
  1653. "characteristics_raw": "0x42000040"
  1654. }
  1655. ],
  1656. "resources": [],
  1657. "dirents": [
  1658. {
  1659. "virtual_address": "0x00000000",
  1660. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1661. "size": "0x00000000"
  1662. },
  1663. {
  1664. "virtual_address": "0x0001c9fc",
  1665. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1666. "size": "0x00000078"
  1667. },
  1668. {
  1669. "virtual_address": "0x00022000",
  1670. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1671. "size": "0x0000016c"
  1672. },
  1673. {
  1674. "virtual_address": "0x00000000",
  1675. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1676. "size": "0x00000000"
  1677. },
  1678. {
  1679. "virtual_address": "0x00000000",
  1680. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1681. "size": "0x00000000"
  1682. },
  1683. {
  1684. "virtual_address": "0x00023000",
  1685. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1686. "size": "0x00001dd0"
  1687. },
  1688. {
  1689. "virtual_address": "0x000194b0",
  1690. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1691. "size": "0x00000038"
  1692. },
  1693. {
  1694. "virtual_address": "0x00000000",
  1695. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1696. "size": "0x00000000"
  1697. },
  1698. {
  1699. "virtual_address": "0x00000000",
  1700. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1701. "size": "0x00000000"
  1702. },
  1703. {
  1704. "virtual_address": "0x00000000",
  1705. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1706. "size": "0x00000000"
  1707. },
  1708. {
  1709. "virtual_address": "0x000194e8",
  1710. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1711. "size": "0x00000040"
  1712. },
  1713. {
  1714. "virtual_address": "0x00000000",
  1715. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1716. "size": "0x00000000"
  1717. },
  1718. {
  1719. "virtual_address": "0x00014000",
  1720. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1721. "size": "0x000001f0"
  1722. },
  1723. {
  1724. "virtual_address": "0x00000000",
  1725. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1726. "size": "0x00000000"
  1727. },
  1728. {
  1729. "virtual_address": "0x00000000",
  1730. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1731. "size": "0x00000000"
  1732. },
  1733. {
  1734. "virtual_address": "0x00000000",
  1735. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1736. "size": "0x00000000"
  1737. }
  1738. ],
  1739. "exports": [],
  1740. "guest_signers": {},
  1741. "imphash": "4dfd516b1461e570a523efd4ab8d77c8",
  1742. "icon_fuzzy": null,
  1743. "icon": null,
  1744. "pdbpath": null,
  1745. "imported_dll_count": 5,
  1746. "versioninfo": []
  1747. }
  1748. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!