API tools faq
paste
paladin316

Exes_dd1db728514c0756883fa9bbca8a1d88_exe_2019-07-03_19_30.json

paladin316
Jul 3rd, 2019
2,415
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 53.73 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Injector"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_dd1db728514c0756883fa9bbca8a1d88.exe"
  7. [*] File Size: 2355200
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "b187141635df66338b517d407ad8ff0993fcefe3be4affb83e9225039672c587"
  10. [*] MD5: "dd1db728514c0756883fa9bbca8a1d88"
  11. [*] SHA1: "7ccccda9dc2c2436218ef5ff6b8323af7cfa5c59"
  12. [*] SHA512: "270d531932863323b2f584f05f4cf153f32ed8c2ca351f53994138dcfaededd27c8fdb111155f59853e6f0c70ff2b50e61683a26452e3c5b085d834d3e29c511"
  13. [*] CRC32: "B4917D48"
  14. [*] SSDEEP: "49152:uh+ZkldoPK8YaDpzr80QsuDOgWRJ2+0RxZ/qBp464T9uYVC:n2cPK8zzjQsoWR+P/w0TlC"
  15.  
  16. [*] Process Execution: [
  17. "Exes_dd1db728514c0756883fa9bbca8a1d88.exe",
  18. "Brute walmart.exe",
  19. "AudioEng.exe",
  20. "hydra.exe",
  21. "svchost.exe",
  22. "svchost.exe",
  23. "svchost.exe"
  24. ]
  25.  
  26. [*] Signatures Detected: [
  27. {
  28. "Description": "Possible date expiration check, exits too soon after checking local time",
  29. "Details": [
  30. {
  31. "process": "Exes_dd1db728514c0756883fa9bbca8a1d88.exe, PID 2508"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "Drops a binary and executes it",
  37. "Details": [
  38. {
  39. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\hydra.exe"
  40. },
  41. {
  42. "binary": "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\AudioEng.exe"
  43. }
  44. ]
  45. },
  46. {
  47. "Description": "The binary likely contains encrypted or compressed data.",
  48. "Details": [
  49. {
  50. "section": "name: .rsrc, entropy: 7.68, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ, raw_size: 0x0023ce00, virtual_size: 0x0023cd10"
  51. }
  52. ]
  53. },
  54. {
  55. "Description": "Steals private information from local Internet browsers",
  56. "Details": [
  57. {
  58. "file": "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\1\\Cookies\\Google Chrome (2).txt"
  59. },
  60. {
  61. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
  62. },
  63. {
  64. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
  65. },
  66. {
  67. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  68. }
  69. ]
  70. },
  71. {
  72. "Description": "Collects information about installed applications",
  73. "Details": [
  74. {
  75. "Program": "Google Update Helper"
  76. },
  77. {
  78. "Program": "Microsoft Excel MUI 2013"
  79. },
  80. {
  81. "Program": "Microsoft Outlook MUI 2013"
  82. },
  83. {
  84. },
  85. {
  86. "Program": "Google Chrome"
  87. },
  88. {
  89. "Program": "Adobe Flash Player 29 NPAPI"
  90. },
  91. {
  92. "Program": "Adobe Flash Player 29 ActiveX"
  93. },
  94. {
  95. "Program": "Microsoft DCF MUI 2013"
  96. },
  97. {
  98. "Program": "Microsoft Access MUI 2013"
  99. },
  100. {
  101. "Program": "Microsoft Office Proofing Tools 2013 - English"
  102. },
  103. {
  104. "Program": "Adobe Acrobat Reader DC"
  105. },
  106. {
  107. "Program": "Microsoft Publisher MUI 2013"
  108. },
  109. {
  110. "Program": "Microsoft Office Shared MUI 2013"
  111. },
  112. {
  113. "Program": "Microsoft Office OSM MUI 2013"
  114. },
  115. {
  116. "Program": "Microsoft InfoPath MUI 2013"
  117. },
  118. {
  119. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  120. },
  121. {
  122. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  123. },
  124. {
  125. "Program": "Microsoft Word MUI 2013"
  126. },
  127. {
  128. "Program": "Microsoft Groove MUI 2013"
  129. },
  130. {
  131. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  132. },
  133. {
  134. },
  135. {
  136. "Program": "Microsoft Access Setup Metadata MUI 2013"
  137. },
  138. {
  139. "Program": "Microsoft Office OSM UX MUI 2013"
  140. },
  141. {
  142. "Program": "Java Auto Updater"
  143. },
  144. {
  145. "Program": "Microsoft PowerPoint MUI 2013"
  146. },
  147. {
  148. "Program": "Microsoft Office Professional Plus 2013"
  149. },
  150. {
  151. "Program": "Adobe Refresh Manager"
  152. },
  153. {
  154. "Program": "Microsoft Office Proofing 2013"
  155. },
  156. {
  157. "Program": "Microsoft Lync MUI 2013"
  158. },
  159. {
  160. },
  161. {
  162. "Program": "Microsoft OneNote MUI 2013"
  163. }
  164. ]
  165. },
  166. {
  167. "Description": "Creates a hidden or system file",
  168. "Details": [
  169. {
  170. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\Brute walmart.exe"
  171. },
  172. {
  173. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\hydra.exe"
  174. },
  175. {
  176. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low"
  177. }
  178. ]
  179. },
  180. {
  181. "Description": "Attempts to identify installed AV products by installation directory",
  182. "Details": [
  183. {
  184. "file": "C:\\Users\\user\\AppData\\Local\\AVAST Software\\Browser\\User Data"
  185. }
  186. ]
  187. },
  188. {
  189. "Description": "File has been identified by 57 Antiviruses on VirusTotal as malicious",
  190. "Details": [
  191. {
  192. "MicroWorld-eScan": "Gen:Variant.Midie.6905"
  193. },
  194. {
  195. "McAfee": "GenericRXDR-OQ!DD1DB728514C"
  196. },
  197. {
  198. "Cylance": "Unsafe"
  199. },
  200. {
  201. "AegisLab": "Trojan.Win32.Delf.toJT"
  202. },
  203. {
  204. "CrowdStrike": "win/malicious_confidence_100% (W)"
  205. },
  206. {
  207. "BitDefender": "Gen:Variant.Midie.6905"
  208. },
  209. {
  210. "K7GW": "Trojan ( 004bdc281 )"
  211. },
  212. {
  213. "K7AntiVirus": "Trojan ( 004bdc281 )"
  214. },
  215. {
  216. "TrendMicro": "TROJ_BINDER.SMBD"
  217. },
  218. {
  219. "Baidu": "Win32.Trojan-Dropper.Delf.as"
  220. },
  221. {
  222. "NANO-Antivirus": "Trojan.Win32.Delf.flagce"
  223. },
  224. {
  225. "Cyren": "W32/Trojan.VVWT-8174"
  226. },
  227. {
  228. "Symantec": "SMG.Heur!gen"
  229. },
  230. {
  231. "TotalDefense": "Win32/Fynloski.ZHLKEDD"
  232. },
  233. {
  234. "APEX": "Malicious"
  235. },
  236. {
  237. "Avast": "Win32:Malware-gen"
  238. },
  239. {
  240. "ClamAV": "Win.Trojan.Injector-6297685-1"
  241. },
  242. {
  243. "Kaspersky": "Trojan-Banker.Win32.ClipBanker.czg"
  244. },
  245. {
  246. "Alibaba": "TrojanDropper:Win32/Dorv.ec31450a"
  247. },
  248. {
  249. "ViRobot": "Trojan.Win32.A.Scar.451584.A"
  250. },
  251. {
  252. "Ad-Aware": "Gen:Variant.Midie.6905"
  253. },
  254. {
  255. "Sophos": "Mal/Generic-S"
  256. },
  257. {
  258. "Comodo": "TrojWare.Win32.TrojanDropper.Delf.SOC@572vwy"
  259. },
  260. {
  261. "F-Secure": "Dropper.DR/Delphi.Gen"
  262. },
  263. {
  264. "DrWeb": "Trojan.Packed.20771"
  265. },
  266. {
  267. "Zillya": "Trojan.Fignotok.Win32.341"
  268. },
  269. {
  270. "Invincea": "heuristic"
  271. },
  272. {
  273. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.vc"
  274. },
  275. {
  276. "FireEye": "Generic.mg.dd1db728514c0756"
  277. },
  278. {
  279. "Emsisoft": "Gen:Variant.Midie.6905 (B)"
  280. },
  281. {
  282. "Ikarus": "Worm.Win32.Agent"
  283. },
  284. {
  285. "F-Prot": "W32/Trojan2.PZJI"
  286. },
  287. {
  288. "Jiangmin": "Trojan/Genome.bawa"
  289. },
  290. {
  291. "Avira": "DR/Delphi.Gen"
  292. },
  293. {
  294. "Fortinet": "W32/DROPPER.PAG!tr"
  295. },
  296. {
  297. "Antiy-AVL": "Trojan/Generic.ASVCS3S.1E5"
  298. },
  299. {
  300. "Endgame": "malicious (high confidence)"
  301. },
  302. {
  303. "Arcabit": "Trojan.Midie.D1AF9"
  304. },
  305. {
  306. "ZoneAlarm": "Trojan-Banker.Win32.ClipBanker.czg"
  307. },
  308. {
  309. "Microsoft": "Trojan:Win32/Dorv.A"
  310. },
  311. {
  312. "AhnLab-V3": "Trojan/Win32.Ruftar.R30190"
  313. },
  314. {
  315. "Acronis": "suspicious"
  316. },
  317. {
  318. "VBA32": "TrojanDropper.Delf"
  319. },
  320. {
  321. "ALYac": "Gen:Variant.Midie.6905"
  322. },
  323. {
  324. "MAX": "malware (ai score=100)"
  325. },
  326. {
  327. "Malwarebytes": "Trojan.Agent.DF"
  328. },
  329. {
  330. "Panda": "Trj/Genetic.gen"
  331. },
  332. {
  333. "ESET-NOD32": "Win32/TrojanDropper.Delf.OEF"
  334. },
  335. {
  336. "TrendMicro-HouseCall": "TROJ_BINDER.SMBD"
  337. },
  338. {
  339. "Rising": "Trojan.Win32.Agent_.sa (CLOUD)"
  340. },
  341. {
  342. "SentinelOne": "DFI - Malicious PE"
  343. },
  344. {
  345. "eGambit": "Unsafe.AI_Score_96%"
  346. },
  347. {
  348. "GData": "Gen:Variant.Midie.6905"
  349. },
  350. {
  351. "AVG": "Win32:Malware-gen"
  352. },
  353. {
  354. "Cybereason": "malicious.8514c0"
  355. },
  356. {
  357. "Paloalto": "generic.ml"
  358. },
  359. {
  360. "Qihoo-360": "Win32/Trojan.f89"
  361. }
  362. ]
  363. },
  364. {
  365. "Description": "Attempts to modify proxy settings",
  366. "Details": []
  367. },
  368. {
  369. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  370. "Details": [
  371. {
  372. "target": "clamav:Win.Trojan.Injector-6297685-1, sha256:b187141635df66338b517d407ad8ff0993fcefe3be4affb83e9225039672c587, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  373. },
  374. {
  375. "dropped": "clamav:Win.Malware.Agen-6962462-0, sha256:1d6c0ad56cbf295e2cc07a759fcbb358984045d28bedf241f99c2ca3f667a843 , guest_paths:C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\AudioEng.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  376. }
  377. ]
  378. },
  379. {
  380. "Description": "Harvests credentials from local FTP client softwares",
  381. "Details": [
  382. {
  383. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  384. }
  385. ]
  386. },
  387. {
  388. "Description": "Anomalous binary characteristics",
  389. "Details": [
  390. {
  391. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  392. }
  393. ]
  394. }
  395. ]
  396.  
  397. [*] Started Service: []
  398.  
  399. [*] Executed Commands: [
  400. "C:\\Users\\user\\AppData\\Local\\Temp\\Brute walmart.exe ",
  401. "C:\\Users\\user\\AppData\\Local\\Temp\\hydra.exe ",
  402. "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\AudioEng.exe",
  403. "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\syswow64\\WININET.dll\",DispatchAPICall 1"
  404. ]
  405.  
  406. [*] Mutexes: [
  407. "120595716ENU_94687FE9746877523523",
  408. "CicLoadWinStaWinSta0",
  409. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  410. ]
  411.  
  412. [*] Modified Files: [
  413. "C:\\Users\\user\\AppData\\Local\\Temp\\Brute walmart.exe",
  414. "C:\\Users\\user\\AppData\\Local\\Temp\\hydra.exe",
  415. "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\AudioEng.exe",
  416. "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\ENU_94687FE9746877523523",
  417. "\\??\\PIPE\\samr",
  418. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  419. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  420. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  421. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  422. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  423. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  424. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  425. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  426. "C:\\Windows\\sysnative\\Tasks\\L-3-8-77-1113328891-1273049804-1295877288-5697\\{4SUZKNSH-IQXU-CM5-FB58-KMHA1D26PMG}",
  427. "\\Device\\LanmanDatagramReceiver",
  428. "\\??\\PIPE\\srvsvc",
  429. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  430. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  431. "C:\\Users\\user\\AppData\\Local\\Temp\\aut7179.tmp",
  432. "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\AudioEng.sqlite3.module.dll.6",
  433. "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\AudioEng.sqlite3.module.dll",
  434. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies",
  435. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data",
  436. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data",
  437. "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\1\\Screen.jpg",
  438. "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\1\\Cookies\\Google Chrome (2).txt"
  439. ]
  440.  
  441. [*] Deleted Files: [
  442. "C:\\Users\\user\\AppData\\Local\\Temp\\Brute walmart.exe",
  443. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  444. "C:\\Users\\user\\AppData\\Local\\Temp\\aut7179.tmp",
  445. "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\AudioEng.sqlite3.module.dll.6",
  446. "C:\\Users\\user\\AppData\\Roaming\\amd64_microsoft-windows-wer-sdktools\\AudioEng.sqlite3.module.dll"
  447. ]
  448.  
  449. [*] Modified Registry Keys: [
  450. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  451. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  452. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  453. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  454. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  455. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  456. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  457. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  458. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{27CBBD4C-2511-4F84-9D74-BBCA9239EB94}\\Path",
  459. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{27CBBD4C-2511-4F84-9D74-BBCA9239EB94}\\Hash",
  460. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\L-3-8-77-1113328891-1273049804-1295877288-5697\\{4SUZKNSH-IQXU-CM5-FB58-KMHA1D26PMG}\\Id",
  461. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\L-3-8-77-1113328891-1273049804-1295877288-5697\\{4SUZKNSH-IQXU-CM5-FB58-KMHA1D26PMG}\\Index",
  462. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{27CBBD4C-2511-4F84-9D74-BBCA9239EB94}\\Triggers",
  463. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{27CBBD4C-2511-4F84-9D74-BBCA9239EB94}\\DynamicInfo",
  464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
  465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
  466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings"
  467. ]
  468.  
  469. [*] Deleted Registry Keys: [
  470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
  471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"
  472. ]
  473.  
  474. [*] DNS Communications: [
  475. {
  476. "type": "A",
  477. "request": "api.telegram.org",
  478. "answers": []
  479. }
  480. ]
  481.  
  482. [*] Domains: [
  483. {
  484. "ip": "149.154.167.220",
  485. "domain": "api.telegram.org"
  486. }
  487. ]
  488.  
  489. [*] Network Communication - ICMP: []
  490.  
  491. [*] Network Communication - HTTP: []
  492.  
  493. [*] Network Communication - SMTP: []
  494.  
  495. [*] Network Communication - Hosts: []
  496.  
  497. [*] Network Communication - IRC: []
  498.  
  499. [*] Static Analysis: {
  500. "pe": {
  501. "peid_signatures": null,
  502. "imports": [
  503. {
  504. "imports": [
  505. {
  506. "name": "GetCurrentThreadId",
  507. "address": "0x405064"
  508. },
  509. {
  510. "name": "SetCurrentDirectoryA",
  511. "address": "0x405068"
  512. },
  513. {
  514. "name": "GetCurrentDirectoryA",
  515. "address": "0x40506c"
  516. },
  517. {
  518. "name": "ExitProcess",
  519. "address": "0x405070"
  520. },
  521. {
  522. "name": "RtlUnwind",
  523. "address": "0x405074"
  524. },
  525. {
  526. "name": "RaiseException",
  527. "address": "0x405078"
  528. },
  529. {
  530. "name": "TlsSetValue",
  531. "address": "0x40507c"
  532. },
  533. {
  534. "name": "TlsGetValue",
  535. "address": "0x405080"
  536. },
  537. {
  538. "name": "LocalAlloc",
  539. "address": "0x405084"
  540. },
  541. {
  542. "name": "GetModuleHandleA",
  543. "address": "0x405088"
  544. },
  545. {
  546. "name": "FreeLibrary",
  547. "address": "0x40508c"
  548. },
  549. {
  550. "name": "HeapFree",
  551. "address": "0x405090"
  552. },
  553. {
  554. "name": "HeapReAlloc",
  555. "address": "0x405094"
  556. },
  557. {
  558. "name": "HeapAlloc",
  559. "address": "0x405098"
  560. },
  561. {
  562. "name": "GetProcessHeap",
  563. "address": "0x40509c"
  564. }
  565. ],
  566. "dll": "kernel32.dll"
  567. },
  568. {
  569. "imports": [
  570. {
  571. "name": "WriteFile",
  572. "address": "0x4050a4"
  573. },
  574. {
  575. "name": "SizeofResource",
  576. "address": "0x4050a8"
  577. },
  578. {
  579. "name": "SetFilePointer",
  580. "address": "0x4050ac"
  581. },
  582. {
  583. "name": "LockResource",
  584. "address": "0x4050b0"
  585. },
  586. {
  587. "name": "LoadResource",
  588. "address": "0x4050b4"
  589. },
  590. {
  591. "name": "GetWindowsDirectoryA",
  592. "address": "0x4050b8"
  593. },
  594. {
  595. "name": "GetTempPathA",
  596. "address": "0x4050bc"
  597. },
  598. {
  599. "name": "GetSystemDirectoryA",
  600. "address": "0x4050c0"
  601. },
  602. {
  603. "name": "FreeResource",
  604. "address": "0x4050c4"
  605. },
  606. {
  607. "name": "FindResourceA",
  608. "address": "0x4050c8"
  609. },
  610. {
  611. "name": "CreateFileA",
  612. "address": "0x4050cc"
  613. },
  614. {
  615. "name": "CloseHandle",
  616. "address": "0x4050d0"
  617. }
  618. ],
  619. "dll": "kernel32.dll"
  620. },
  621. {
  622. "imports": [
  623. {
  624. "name": "SHGetFolderPathA",
  625. "address": "0x4050d8"
  626. }
  627. ],
  628. "dll": "shfolder.dll"
  629. },
  630. {
  631. "imports": [
  632. {
  633. "name": "ShellExecuteA",
  634. "address": "0x4050e0"
  635. }
  636. ],
  637. "dll": "shell32.dll"
  638. }
  639. ],
  640. "digital_signers": null,
  641. "exported_dll_name": null,
  642. "actual_checksum": "0x00249bb4",
  643. "overlay": null,
  644. "imagebase": "0x00400000",
  645. "reported_checksum": "0x00000000",
  646. "icon_hash": null,
  647. "entrypoint": "0x004020cc",
  648. "timestamp": "1992-06-19 22:22:17",
  649. "osversion": "4.0",
  650. "sections": [
  651. {
  652. "name": "CODE",
  653. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  654. "virtual_address": "0x00001000",
  655. "size_of_data": "0x00001400",
  656. "entropy": "6.34",
  657. "raw_address": "0x00000400",
  658. "virtual_size": "0x000013b8",
  659. "characteristics_raw": "0x60000020"
  660. },
  661. {
  662. "name": "DATA",
  663. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  664. "virtual_address": "0x00003000",
  665. "size_of_data": "0x00000200",
  666. "entropy": "1.12",
  667. "raw_address": "0x00001800",
  668. "virtual_size": "0x0000007c",
  669. "characteristics_raw": "0xc0000040"
  670. },
  671. {
  672. "name": "BSS",
  673. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  674. "virtual_address": "0x00004000",
  675. "size_of_data": "0x00000000",
  676. "entropy": "0.00",
  677. "raw_address": "0x00001a00",
  678. "virtual_size": "0x00000695",
  679. "characteristics_raw": "0xc0000000"
  680. },
  681. {
  682. "name": ".idata",
  683. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  684. "virtual_address": "0x00005000",
  685. "size_of_data": "0x00000400",
  686. "entropy": "3.48",
  687. "raw_address": "0x00001a00",
  688. "virtual_size": "0x00000302",
  689. "characteristics_raw": "0xc0000040"
  690. },
  691. {
  692. "name": ".tls",
  693. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  694. "virtual_address": "0x00006000",
  695. "size_of_data": "0x00000000",
  696. "entropy": "0.00",
  697. "raw_address": "0x00001e00",
  698. "virtual_size": "0x00000004",
  699. "characteristics_raw": "0xc0000000"
  700. },
  701. {
  702. "name": ".rdata",
  703. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ",
  704. "virtual_address": "0x00007000",
  705. "size_of_data": "0x00000200",
  706. "entropy": "0.20",
  707. "raw_address": "0x00001e00",
  708. "virtual_size": "0x00000018",
  709. "characteristics_raw": "0x50000040"
  710. },
  711. {
  712. "name": ".reloc",
  713. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ",
  714. "virtual_address": "0x00008000",
  715. "size_of_data": "0x00000200",
  716. "entropy": "5.78",
  717. "raw_address": "0x00002000",
  718. "virtual_size": "0x000001c8",
  719. "characteristics_raw": "0x50000040"
  720. },
  721. {
  722. "name": ".rsrc",
  723. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ",
  724. "virtual_address": "0x00009000",
  725. "size_of_data": "0x0023ce00",
  726. "entropy": "7.68",
  727. "raw_address": "0x00002200",
  728. "virtual_size": "0x0023cd10",
  729. "characteristics_raw": "0x50000040"
  730. }
  731. ],
  732. "resources": [],
  733. "dirents": [
  734. {
  735. "virtual_address": "0x00000000",
  736. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  737. "size": "0x00000000"
  738. },
  739. {
  740. "virtual_address": "0x00005000",
  741. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  742. "size": "0x00000302"
  743. },
  744. {
  745. "virtual_address": "0x00009000",
  746. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  747. "size": "0x0023cd10"
  748. },
  749. {
  750. "virtual_address": "0x00000000",
  751. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  752. "size": "0x00000000"
  753. },
  754. {
  755. "virtual_address": "0x00000000",
  756. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  757. "size": "0x00000000"
  758. },
  759. {
  760. "virtual_address": "0x00008000",
  761. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  762. "size": "0x000001c8"
  763. },
  764. {
  765. "virtual_address": "0x00000000",
  766. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  767. "size": "0x00000000"
  768. },
  769. {
  770. "virtual_address": "0x00000000",
  771. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  772. "size": "0x00000000"
  773. },
  774. {
  775. "virtual_address": "0x00000000",
  776. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  777. "size": "0x00000000"
  778. },
  779. {
  780. "virtual_address": "0x00007000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  782. "size": "0x00000018"
  783. },
  784. {
  785. "virtual_address": "0x00000000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  787. "size": "0x00000000"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  797. "size": "0x00000000"
  798. },
  799. {
  800. "virtual_address": "0x00000000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  802. "size": "0x00000000"
  803. },
  804. {
  805. "virtual_address": "0x00000000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  807. "size": "0x00000000"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  812. "size": "0x00000000"
  813. }
  814. ],
  815. "exports": [],
  816. "guest_signers": {},
  817. "imphash": "d59a4a699610169663a929d37c90be43",
  818. "icon_fuzzy": null,
  819. "icon": null,
  820. "pdbpath": null,
  821. "imported_dll_count": 4,
  822. "versioninfo": []
  823. }
  824. }
  825.  
  826. [*] Resolved APIs: [
  827. "kernel32.dll.SortGetHandle",
  828. "kernel32.dll.SortCloseHandle",
  829. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  830. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  831. "advapi32.dll.UnregisterTraceGuids",
  832. "kernel32.dll.FlsAlloc",
  833. "kernel32.dll.FlsFree",
  834. "kernel32.dll.FlsGetValue",
  835. "kernel32.dll.FlsSetValue",
  836. "kernel32.dll.InitializeCriticalSectionEx",
  837. "kernel32.dll.CreateEventExW",
  838. "kernel32.dll.CreateSemaphoreExW",
  839. "kernel32.dll.SetThreadStackGuarantee",
  840. "kernel32.dll.CreateThreadpoolTimer",
  841. "kernel32.dll.SetThreadpoolTimer",
  842. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  843. "kernel32.dll.CloseThreadpoolTimer",
  844. "kernel32.dll.CreateThreadpoolWait",
  845. "kernel32.dll.SetThreadpoolWait",
  846. "kernel32.dll.CloseThreadpoolWait",
  847. "kernel32.dll.FlushProcessWriteBuffers",
  848. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  849. "kernel32.dll.GetCurrentProcessorNumber",
  850. "kernel32.dll.GetLogicalProcessorInformation",
  851. "kernel32.dll.CreateSymbolicLinkW",
  852. "kernel32.dll.EnumSystemLocalesEx",
  853. "kernel32.dll.CompareStringEx",
  854. "kernel32.dll.GetDateFormatEx",
  855. "kernel32.dll.GetLocaleInfoEx",
  856. "kernel32.dll.GetTimeFormatEx",
  857. "kernel32.dll.GetUserDefaultLocaleName",
  858. "kernel32.dll.IsValidLocaleName",
  859. "kernel32.dll.LCMapStringEx",
  860. "kernel32.dll.GetTickCount64",
  861. "kernel32.dll.GetNativeSystemInfo",
  862. "cryptbase.dll.SystemFunction036",
  863. "uxtheme.dll.ThemeInitApiHook",
  864. "user32.dll.IsProcessDPIAware",
  865. "kernel32.dll.Wow64DisableWow64FsRedirection",
  866. "kernel32.dll.Wow64RevertWow64FsRedirection",
  867. "dwmapi.dll.DwmIsCompositionEnabled",
  868. "comctl32.dll.RegisterClassNameW",
  869. "uxtheme.dll.OpenThemeData",
  870. "uxtheme.dll.GetThemeBool",
  871. "imm32.dll.ImmGetContext",
  872. "imm32.dll.ImmReleaseContext",
  873. "imm32.dll.ImmAssociateContext",
  874. "imm32.dll.ImmIsIME",
  875. "comctl32.dll.HIMAGELIST_QueryInterface",
  876. "comctl32.dll.DrawShadowText",
  877. "comctl32.dll.DrawSizeBox",
  878. "comctl32.dll.DrawScrollBar",
  879. "comctl32.dll.SizeBoxHwnd",
  880. "comctl32.dll.ScrollBar_MouseMove",
  881. "comctl32.dll.ScrollBar_Menu",
  882. "comctl32.dll.HandleScrollCmd",
  883. "comctl32.dll.DetachScrollBars",
  884. "comctl32.dll.AttachScrollBars",
  885. "comctl32.dll.CCSetScrollInfo",
  886. "comctl32.dll.CCGetScrollInfo",
  887. "comctl32.dll.CCEnableScrollBar",
  888. "comctl32.dll.QuerySystemGestureStatus",
  889. "uxtheme.dll.#49",
  890. "kernel32.dll.GetVersionExW",
  891. "kernel32.dll.GetLocaleInfoW",
  892. "oleaut32.dll.#2",
  893. "oleaut32.dll.#6",
  894. "kernel32.dll.GetThreadPreferredUILanguages",
  895. "kernel32.dll.SetThreadPreferredUILanguages",
  896. "kernel32.dll.LocaleNameToLCID",
  897. "kernel32.dll.LCIDToLocaleName",
  898. "kernel32.dll.GetSystemDefaultLocaleName",
  899. "dnsapi.dll.DnsApiFree",
  900. "kernel32.dll.CreateMutexW",
  901. "kernel32.dll.GetLastError",
  902. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  903. "advapi32.dll.RegOpenKeyW",
  904. "advapi32.dll.RegQueryValueW",
  905. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  906. "sspicli.dll.GetUserNameExW",
  907. "xmllite.dll.CreateXmlWriter",
  908. "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
  909. "uxtheme.dll.CloseThemeData",
  910. "ntdll.dll.EtwUnregisterTraceGuids",
  911. "oleaut32.dll.#500",
  912. "cryptsp.dll.CryptReleaseContext",
  913. "advapi32.dll.RegOpenKeyExW",
  914. "advapi32.dll.RegQueryInfoKeyW",
  915. "advapi32.dll.RegEnumKeyExW",
  916. "advapi32.dll.RegEnumValueW",
  917. "advapi32.dll.RegCloseKey",
  918. "advapi32.dll.RegQueryValueExW",
  919. "kernel32.dll.QueryActCtxW",
  920. "shlwapi.dll.UrlIsW",
  921. "kernel32.dll.GetUserDefaultUILanguage",
  922. "user32.dll.LoadStringW",
  923. "user32.dll.GetProcessWindowStation",
  924. "user32.dll.GetUserObjectInformationW",
  925. "user32.dll.MessageBoxW",
  926. "gdi32.dll.GetLayout",
  927. "gdi32.dll.GdiRealizationInfo",
  928. "gdi32.dll.FontIsLinked",
  929. "gdi32.dll.GetTextFaceAliasW",
  930. "gdi32.dll.GetFontAssocStatus",
  931. "advapi32.dll.RegQueryValueExA",
  932. "gdi32.dll.GdiIsMetaPrintDC",
  933. "ole32.dll.CoInitializeEx",
  934. "ole32.dll.CoUninitialize",
  935. "ole32.dll.CoRegisterInitializeSpy",
  936. "ole32.dll.CoRevokeInitializeSpy",
  937. "ole32.dll.CoGetClassObject",
  938. "ole32.dll.CoGetMarshalSizeMax",
  939. "ole32.dll.CoMarshalInterface",
  940. "ole32.dll.CoUnmarshalInterface",
  941. "ole32.dll.StringFromIID",
  942. "ole32.dll.CoGetPSClsid",
  943. "ole32.dll.CoTaskMemAlloc",
  944. "ole32.dll.CoTaskMemFree",
  945. "ole32.dll.CoCreateInstance",
  946. "ole32.dll.CoReleaseMarshalData",
  947. "ole32.dll.DcomChannelSetHResult",
  948. "vssapi.dll.CreateWriter",
  949. "advapi32.dll.LookupAccountNameW",
  950. "sechost.dll.LookupAccountNameLocalW",
  951. "advapi32.dll.LookupAccountSidW",
  952. "samcli.dll.NetLocalGroupGetMembers",
  953. "samlib.dll.SamConnect",
  954. "rpcrt4.dll.NdrClientCall3",
  955. "rpcrt4.dll.RpcStringBindingComposeW",
  956. "rpcrt4.dll.RpcBindingFromStringBindingW",
  957. "rpcrt4.dll.RpcStringFreeW",
  958. "rpcrt4.dll.RpcBindingFree",
  959. "samlib.dll.SamOpenDomain",
  960. "samlib.dll.SamLookupNamesInDomain",
  961. "samlib.dll.SamOpenAlias",
  962. "samlib.dll.SamFreeMemory",
  963. "samlib.dll.SamCloseHandle",
  964. "samlib.dll.SamGetMembersInAlias",
  965. "netutils.dll.NetApiBufferFree",
  966. "ole32.dll.CoCreateGuid",
  967. "ole32.dll.StringFromCLSID",
  968. "oleaut32.dll.#4",
  969. "oleaut32.dll.#7",
  970. "propsys.dll.VariantToPropVariant",
  971. "wbemcore.dll.Reinitialize",
  972. "wbemsvc.dll.DllGetClassObject",
  973. "wbemsvc.dll.DllCanUnloadNow",
  974. "authz.dll.AuthzInitializeContextFromToken",
  975. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  976. "authz.dll.AuthzAccessCheck",
  977. "authz.dll.AuthzFreeAuditEvent",
  978. "authz.dll.AuthzFreeContext",
  979. "authz.dll.AuthzInitializeResourceManager",
  980. "authz.dll.AuthzFreeResourceManager",
  981. "rpcrt4.dll.RpcBindingCreateW",
  982. "rpcrt4.dll.RpcBindingBind",
  983. "rpcrt4.dll.I_RpcMapWin32Status",
  984. "advapi32.dll.EventRegister",
  985. "advapi32.dll.EventUnregister",
  986. "advapi32.dll.EventWrite",
  987. "kernel32.dll.RegCloseKey",
  988. "kernel32.dll.RegSetValueExW",
  989. "kernel32.dll.RegOpenKeyExW",
  990. "kernel32.dll.RegQueryValueExW",
  991. "wmisvc.dll.IsImproperShutdownDetected",
  992. "wevtapi.dll.EvtRender",
  993. "wevtapi.dll.EvtNext",
  994. "wevtapi.dll.EvtClose",
  995. "wevtapi.dll.EvtQuery",
  996. "wevtapi.dll.EvtCreateRenderContext",
  997. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  998. "rpcrt4.dll.RpcBindingSetOption",
  999. "ole32.dll.CoCreateFreeThreadedMarshaler",
  1000. "ole32.dll.CreateStreamOnHGlobal",
  1001. "advapi32.dll.RegCreateKeyExW",
  1002. "advapi32.dll.RegSetValueExW",
  1003. "cryptsp.dll.CryptAcquireContextW",
  1004. "cryptsp.dll.CryptGenRandom",
  1005. "kernelbase.dll.InitializeAcl",
  1006. "kernelbase.dll.AddAce",
  1007. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1008. "kernel32.dll.IsThreadAFiber",
  1009. "kernel32.dll.OpenProcessToken",
  1010. "kernelbase.dll.GetTokenInformation",
  1011. "kernelbase.dll.DuplicateTokenEx",
  1012. "kernelbase.dll.AdjustTokenPrivileges",
  1013. "sechost.dll.LookupAccountSidLocalW",
  1014. "kernel32.dll.SetThreadToken",
  1015. "kernelbase.dll.CheckTokenMembership",
  1016. "kernelbase.dll.AllocateAndInitializeSid",
  1017. "ole32.dll.CLSIDFromString",
  1018. "oleaut32.dll.#17",
  1019. "oleaut32.dll.#20",
  1020. "oleaut32.dll.#19",
  1021. "oleaut32.dll.#25",
  1022. "authz.dll.AuthzInitializeContextFromSid",
  1023. "ole32.dll.CoGetCallContext",
  1024. "ole32.dll.CoImpersonateClient",
  1025. "advapi32.dll.OpenThreadToken",
  1026. "ole32.dll.CoRevertToSelf",
  1027. "oleaut32.dll.#8",
  1028. "oleaut32.dll.#9",
  1029. "ole32.dll.CoSwitchCallContext",
  1030. "sechost.dll.OpenSCManagerW",
  1031. "sechost.dll.OpenServiceW",
  1032. "sechost.dll.QueryServiceStatus",
  1033. "rasapi32.dll.RasEnumConnectionsW",
  1034. "rasapi32.dll.RasConnectionNotificationW",
  1035. "sechost.dll.NotifyServiceStatusChangeA",
  1036. "rasapi32.dll.RasEnumEntriesW",
  1037. "rtutils.dll.TracePrintfExA",
  1038. "sechost.dll.ConvertSidToStringSidW",
  1039. "profapi.dll.#104",
  1040. "shlwapi.dll.PathCanonicalizeW",
  1041. "shlwapi.dll.PathRemoveFileSpecW",
  1042. "shlwapi.dll.PathFindFileNameW",
  1043. "sensapi.dll.IsNetworkAlive",
  1044. "rpcrt4.dll.NdrClientCall2",
  1045. "kernel32.dll.OpenProcess",
  1046. "kernel32.dll.GetSystemWow64DirectoryW",
  1047. "psapi.dll.EmptyWorkingSet",
  1048. "shell32.dll.SHGetFolderPathW",
  1049. "shell32.dll.#165",
  1050. "advapi32.dll.CryptAcquireContextA",
  1051. "cryptsp.dll.CryptAcquireContextA",
  1052. "advapi32.dll.CryptCreateHash",
  1053. "cryptsp.dll.CryptCreateHash",
  1054. "advapi32.dll.CryptHashData",
  1055. "cryptsp.dll.CryptHashData",
  1056. "advapi32.dll.CryptDeriveKey",
  1057. "cryptsp.dll.CryptDeriveKey",
  1058. "advapi32.dll.CryptDestroyHash",
  1059. "cryptsp.dll.CryptDestroyHash",
  1060. "advapi32.dll.CryptGetKeyParam",
  1061. "cryptsp.dll.CryptGetKeyParam",
  1062. "advapi32.dll.CryptDecrypt",
  1063. "cryptsp.dll.CryptDecrypt",
  1064. "advapi32.dll.CryptDestroyKey",
  1065. "cryptsp.dll.CryptDestroyKey",
  1066. "advapi32.dll.CryptReleaseContext",
  1067. "kernel32.dll.AreFileApisANSI",
  1068. "kernel32.dll.CloseHandle",
  1069. "kernel32.dll.CreateFileA",
  1070. "kernel32.dll.CreateFileMappingA",
  1071. "kernel32.dll.CreateFileMappingW",
  1072. "kernel32.dll.CreateFileW",
  1073. "kernel32.dll.DeleteCriticalSection",
  1074. "kernel32.dll.DeleteFileA",
  1075. "kernel32.dll.DeleteFileW",
  1076. "kernel32.dll.EnterCriticalSection",
  1077. "kernel32.dll.FlushFileBuffers",
  1078. "kernel32.dll.FlushViewOfFile",
  1079. "kernel32.dll.FormatMessageA",
  1080. "kernel32.dll.FormatMessageW",
  1081. "kernel32.dll.FreeLibrary",
  1082. "kernel32.dll.GetCurrentProcess",
  1083. "kernel32.dll.GetCurrentProcessId",
  1084. "kernel32.dll.GetCurrentThreadId",
  1085. "kernel32.dll.GetDiskFreeSpaceA",
  1086. "kernel32.dll.GetDiskFreeSpaceW",
  1087. "kernel32.dll.GetFileAttributesA",
  1088. "kernel32.dll.GetFileAttributesExW",
  1089. "kernel32.dll.GetFileAttributesW",
  1090. "kernel32.dll.GetFileSize",
  1091. "kernel32.dll.GetFullPathNameA",
  1092. "kernel32.dll.GetFullPathNameW",
  1093. "kernel32.dll.GetModuleHandleA",
  1094. "kernel32.dll.GetProcAddress",
  1095. "kernel32.dll.GetProcessHeap",
  1096. "kernel32.dll.GetSystemInfo",
  1097. "kernel32.dll.GetSystemTime",
  1098. "kernel32.dll.GetSystemTimeAsFileTime",
  1099. "kernel32.dll.GetTempPathA",
  1100. "kernel32.dll.GetTempPathW",
  1101. "kernel32.dll.GetTickCount",
  1102. "kernel32.dll.GetVersionExA",
  1103. "kernel32.dll.HeapAlloc",
  1104. "kernel32.dll.HeapCompact",
  1105. "kernel32.dll.HeapCreate",
  1106. "kernel32.dll.HeapDestroy",
  1107. "kernel32.dll.HeapFree",
  1108. "kernel32.dll.HeapReAlloc",
  1109. "kernel32.dll.HeapSize",
  1110. "kernel32.dll.HeapValidate",
  1111. "kernel32.dll.InitializeCriticalSection",
  1112. "kernel32.dll.InterlockedCompareExchange",
  1113. "kernel32.dll.LeaveCriticalSection",
  1114. "kernel32.dll.LoadLibraryA",
  1115. "kernel32.dll.LoadLibraryW",
  1116. "kernel32.dll.LocalFree",
  1117. "kernel32.dll.LockFile",
  1118. "kernel32.dll.LockFileEx",
  1119. "kernel32.dll.MapViewOfFile",
  1120. "kernel32.dll.MultiByteToWideChar",
  1121. "kernel32.dll.OutputDebugStringA",
  1122. "kernel32.dll.OutputDebugStringW",
  1123. "kernel32.dll.QueryPerformanceCounter",
  1124. "kernel32.dll.ReadFile",
  1125. "kernel32.dll.SetEndOfFile",
  1126. "kernel32.dll.SetFilePointer",
  1127. "kernel32.dll.SetUnhandledExceptionFilter",
  1128. "kernel32.dll.Sleep",
  1129. "kernel32.dll.SystemTimeToFileTime",
  1130. "kernel32.dll.TerminateProcess",
  1131. "kernel32.dll.TlsGetValue",
  1132. "kernel32.dll.TryEnterCriticalSection",
  1133. "kernel32.dll.UnhandledExceptionFilter",
  1134. "kernel32.dll.UnlockFile",
  1135. "kernel32.dll.UnlockFileEx",
  1136. "kernel32.dll.UnmapViewOfFile",
  1137. "kernel32.dll.VirtualProtect",
  1138. "kernel32.dll.VirtualQuery",
  1139. "kernel32.dll.WaitForSingleObject",
  1140. "kernel32.dll.WaitForSingleObjectEx",
  1141. "kernel32.dll.WideCharToMultiByte",
  1142. "kernel32.dll.WriteFile",
  1143. "msvcrt.dll.__dllonexit",
  1144. "msvcrt.dll.__setusermatherr",
  1145. "msvcrt.dll._amsg_exit",
  1146. "msvcrt.dll._beginthreadex",
  1147. "msvcrt.dll._endthreadex",
  1148. "msvcrt.dll._errno",
  1149. "msvcrt.dll._initterm",
  1150. "msvcrt.dll._iob",
  1151. "msvcrt.dll._lock",
  1152. "msvcrt.dll._onexit",
  1153. "msvcrt.dll.localtime",
  1154. "msvcrt.dll.calloc",
  1155. "msvcrt.dll.fprintf",
  1156. "msvcrt.dll.free",
  1157. "msvcrt.dll.fwrite",
  1158. "msvcrt.dll.malloc",
  1159. "msvcrt.dll.memcmp",
  1160. "msvcrt.dll.memmove",
  1161. "msvcrt.dll.qsort",
  1162. "msvcrt.dll.realloc",
  1163. "msvcrt.dll.strcmp",
  1164. "msvcrt.dll.strcspn",
  1165. "msvcrt.dll.strlen",
  1166. "msvcrt.dll.strncmp",
  1167. "msvcrt.dll.strrchr",
  1168. "msvcrt.dll._unlock",
  1169. "msvcrt.dll.abort",
  1170. "msvcrt.dll.vfprintf",
  1171. "audioeng.sqlite3.module.dll.sqlite3_libversion",
  1172. "audioeng.sqlite3.module.dll.sqlite3_open_v2",
  1173. "audioeng.sqlite3.module.dll.sqlite3_prepare16_v2",
  1174. "audioeng.sqlite3.module.dll.sqlite3_step",
  1175. "audioeng.sqlite3.module.dll.sqlite3_reset",
  1176. "audioeng.sqlite3.module.dll.sqlite3_column_count",
  1177. "audioeng.sqlite3.module.dll.sqlite3_column_name16",
  1178. "audioeng.sqlite3.module.dll.sqlite3_column_type",
  1179. "audioeng.sqlite3.module.dll.sqlite3_column_text16",
  1180. "audioeng.sqlite3.module.dll.sqlite3_column_blob",
  1181. "audioeng.sqlite3.module.dll.sqlite3_column_bytes",
  1182. "audioeng.sqlite3.module.dll.sqlite3_finalize",
  1183. "kernel32.dll.LocalAlloc",
  1184. "crypt32.dll.CryptUnprotectData",
  1185. "cryptbase.dll.SystemFunction041",
  1186. "msvcrt.dll.wcslen",
  1187. "audioeng.sqlite3.module.dll.sqlite3_close",
  1188. "user32.dll.GetSystemMetrics",
  1189. "user32.dll.GetDesktopWindow",
  1190. "user32.dll.GetDC",
  1191. "gdi32.dll.CreateCompatibleDC",
  1192. "gdi32.dll.CreateCompatibleBitmap",
  1193. "gdi32.dll.SelectObject",
  1194. "gdi32.dll.BitBlt",
  1195. "user32.dll.GetCursorInfo",
  1196. "user32.dll.CopyIcon",
  1197. "user32.dll.GetIconInfo",
  1198. "gdi32.dll.DeleteObject",
  1199. "user32.dll.DrawIcon",
  1200. "user32.dll.DestroyIcon",
  1201. "user32.dll.ReleaseDC",
  1202. "gdi32.dll.DeleteDC",
  1203. "gdiplus.dll.GdiplusStartup",
  1204. "kernel32.dll.IsProcessorFeaturePresent",
  1205. "user32.dll.GetWindowInfo",
  1206. "user32.dll.GetAncestor",
  1207. "user32.dll.GetMonitorInfoA",
  1208. "user32.dll.EnumDisplayMonitors",
  1209. "user32.dll.EnumDisplayDevicesA",
  1210. "gdi32.dll.ExtTextOutW",
  1211. "gdiplus.dll.GdipGetImageEncodersSize",
  1212. "gdiplus.dll.GdipGetImageEncoders",
  1213. "ole32.dll.StringFromGUID2",
  1214. "gdiplus.dll.GdipCreateBitmapFromHBITMAP",
  1215. "gdiplus.dll.GdipSaveImageToFile",
  1216. "windowscodecs.dll.DllGetClassObject",
  1217. "kernel32.dll.WerRegisterMemoryBlock",
  1218. "oleaut32.dll.#10",
  1219. "gdiplus.dll.GdipDisposeImage",
  1220. "gdiplus.dll.GdiplusShutdown",
  1221. "advapi32.dll.RegEnumKeyW",
  1222. "oleaut32.dll.#283",
  1223. "oleaut32.dll.#284"
  1224. ]
  1225.  
  1226. [*] Static Analysis: {
  1227. "pe": {
  1228. "peid_signatures": null,
  1229. "imports": [
  1230. {
  1231. "imports": [
  1232. {
  1233. "name": "GetCurrentThreadId",
  1234. "address": "0x405064"
  1235. },
  1236. {
  1237. "name": "SetCurrentDirectoryA",
  1238. "address": "0x405068"
  1239. },
  1240. {
  1241. "name": "GetCurrentDirectoryA",
  1242. "address": "0x40506c"
  1243. },
  1244. {
  1245. "name": "ExitProcess",
  1246. "address": "0x405070"
  1247. },
  1248. {
  1249. "name": "RtlUnwind",
  1250. "address": "0x405074"
  1251. },
  1252. {
  1253. "name": "RaiseException",
  1254. "address": "0x405078"
  1255. },
  1256. {
  1257. "name": "TlsSetValue",
  1258. "address": "0x40507c"
  1259. },
  1260. {
  1261. "name": "TlsGetValue",
  1262. "address": "0x405080"
  1263. },
  1264. {
  1265. "name": "LocalAlloc",
  1266. "address": "0x405084"
  1267. },
  1268. {
  1269. "name": "GetModuleHandleA",
  1270. "address": "0x405088"
  1271. },
  1272. {
  1273. "name": "FreeLibrary",
  1274. "address": "0x40508c"
  1275. },
  1276. {
  1277. "name": "HeapFree",
  1278. "address": "0x405090"
  1279. },
  1280. {
  1281. "name": "HeapReAlloc",
  1282. "address": "0x405094"
  1283. },
  1284. {
  1285. "name": "HeapAlloc",
  1286. "address": "0x405098"
  1287. },
  1288. {
  1289. "name": "GetProcessHeap",
  1290. "address": "0x40509c"
  1291. }
  1292. ],
  1293. "dll": "kernel32.dll"
  1294. },
  1295. {
  1296. "imports": [
  1297. {
  1298. "name": "WriteFile",
  1299. "address": "0x4050a4"
  1300. },
  1301. {
  1302. "name": "SizeofResource",
  1303. "address": "0x4050a8"
  1304. },
  1305. {
  1306. "name": "SetFilePointer",
  1307. "address": "0x4050ac"
  1308. },
  1309. {
  1310. "name": "LockResource",
  1311. "address": "0x4050b0"
  1312. },
  1313. {
  1314. "name": "LoadResource",
  1315. "address": "0x4050b4"
  1316. },
  1317. {
  1318. "name": "GetWindowsDirectoryA",
  1319. "address": "0x4050b8"
  1320. },
  1321. {
  1322. "name": "GetTempPathA",
  1323. "address": "0x4050bc"
  1324. },
  1325. {
  1326. "name": "GetSystemDirectoryA",
  1327. "address": "0x4050c0"
  1328. },
  1329. {
  1330. "name": "FreeResource",
  1331. "address": "0x4050c4"
  1332. },
  1333. {
  1334. "name": "FindResourceA",
  1335. "address": "0x4050c8"
  1336. },
  1337. {
  1338. "name": "CreateFileA",
  1339. "address": "0x4050cc"
  1340. },
  1341. {
  1342. "name": "CloseHandle",
  1343. "address": "0x4050d0"
  1344. }
  1345. ],
  1346. "dll": "kernel32.dll"
  1347. },
  1348. {
  1349. "imports": [
  1350. {
  1351. "name": "SHGetFolderPathA",
  1352. "address": "0x4050d8"
  1353. }
  1354. ],
  1355. "dll": "shfolder.dll"
  1356. },
  1357. {
  1358. "imports": [
  1359. {
  1360. "name": "ShellExecuteA",
  1361. "address": "0x4050e0"
  1362. }
  1363. ],
  1364. "dll": "shell32.dll"
  1365. }
  1366. ],
  1367. "digital_signers": null,
  1368. "exported_dll_name": null,
  1369. "actual_checksum": "0x00249bb4",
  1370. "overlay": null,
  1371. "imagebase": "0x00400000",
  1372. "reported_checksum": "0x00000000",
  1373. "icon_hash": null,
  1374. "entrypoint": "0x004020cc",
  1375. "timestamp": "1992-06-19 22:22:17",
  1376. "osversion": "4.0",
  1377. "sections": [
  1378. {
  1379. "name": "CODE",
  1380. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1381. "virtual_address": "0x00001000",
  1382. "size_of_data": "0x00001400",
  1383. "entropy": "6.34",
  1384. "raw_address": "0x00000400",
  1385. "virtual_size": "0x000013b8",
  1386. "characteristics_raw": "0x60000020"
  1387. },
  1388. {
  1389. "name": "DATA",
  1390. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1391. "virtual_address": "0x00003000",
  1392. "size_of_data": "0x00000200",
  1393. "entropy": "1.12",
  1394. "raw_address": "0x00001800",
  1395. "virtual_size": "0x0000007c",
  1396. "characteristics_raw": "0xc0000040"
  1397. },
  1398. {
  1399. "name": "BSS",
  1400. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1401. "virtual_address": "0x00004000",
  1402. "size_of_data": "0x00000000",
  1403. "entropy": "0.00",
  1404. "raw_address": "0x00001a00",
  1405. "virtual_size": "0x00000695",
  1406. "characteristics_raw": "0xc0000000"
  1407. },
  1408. {
  1409. "name": ".idata",
  1410. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1411. "virtual_address": "0x00005000",
  1412. "size_of_data": "0x00000400",
  1413. "entropy": "3.48",
  1414. "raw_address": "0x00001a00",
  1415. "virtual_size": "0x00000302",
  1416. "characteristics_raw": "0xc0000040"
  1417. },
  1418. {
  1419. "name": ".tls",
  1420. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1421. "virtual_address": "0x00006000",
  1422. "size_of_data": "0x00000000",
  1423. "entropy": "0.00",
  1424. "raw_address": "0x00001e00",
  1425. "virtual_size": "0x00000004",
  1426. "characteristics_raw": "0xc0000000"
  1427. },
  1428. {
  1429. "name": ".rdata",
  1430. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ",
  1431. "virtual_address": "0x00007000",
  1432. "size_of_data": "0x00000200",
  1433. "entropy": "0.20",
  1434. "raw_address": "0x00001e00",
  1435. "virtual_size": "0x00000018",
  1436. "characteristics_raw": "0x50000040"
  1437. },
  1438. {
  1439. "name": ".reloc",
  1440. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ",
  1441. "virtual_address": "0x00008000",
  1442. "size_of_data": "0x00000200",
  1443. "entropy": "5.78",
  1444. "raw_address": "0x00002000",
  1445. "virtual_size": "0x000001c8",
  1446. "characteristics_raw": "0x50000040"
  1447. },
  1448. {
  1449. "name": ".rsrc",
  1450. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ",
  1451. "virtual_address": "0x00009000",
  1452. "size_of_data": "0x0023ce00",
  1453. "entropy": "7.68",
  1454. "raw_address": "0x00002200",
  1455. "virtual_size": "0x0023cd10",
  1456. "characteristics_raw": "0x50000040"
  1457. }
  1458. ],
  1459. "resources": [],
  1460. "dirents": [
  1461. {
  1462. "virtual_address": "0x00000000",
  1463. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1464. "size": "0x00000000"
  1465. },
  1466. {
  1467. "virtual_address": "0x00005000",
  1468. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1469. "size": "0x00000302"
  1470. },
  1471. {
  1472. "virtual_address": "0x00009000",
  1473. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1474. "size": "0x0023cd10"
  1475. },
  1476. {
  1477. "virtual_address": "0x00000000",
  1478. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1479. "size": "0x00000000"
  1480. },
  1481. {
  1482. "virtual_address": "0x00000000",
  1483. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1484. "size": "0x00000000"
  1485. },
  1486. {
  1487. "virtual_address": "0x00008000",
  1488. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1489. "size": "0x000001c8"
  1490. },
  1491. {
  1492. "virtual_address": "0x00000000",
  1493. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1494. "size": "0x00000000"
  1495. },
  1496. {
  1497. "virtual_address": "0x00000000",
  1498. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1499. "size": "0x00000000"
  1500. },
  1501. {
  1502. "virtual_address": "0x00000000",
  1503. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1504. "size": "0x00000000"
  1505. },
  1506. {
  1507. "virtual_address": "0x00007000",
  1508. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1509. "size": "0x00000018"
  1510. },
  1511. {
  1512. "virtual_address": "0x00000000",
  1513. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1514. "size": "0x00000000"
  1515. },
  1516. {
  1517. "virtual_address": "0x00000000",
  1518. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1519. "size": "0x00000000"
  1520. },
  1521. {
  1522. "virtual_address": "0x00000000",
  1523. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1524. "size": "0x00000000"
  1525. },
  1526. {
  1527. "virtual_address": "0x00000000",
  1528. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1529. "size": "0x00000000"
  1530. },
  1531. {
  1532. "virtual_address": "0x00000000",
  1533. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1534. "size": "0x00000000"
  1535. },
  1536. {
  1537. "virtual_address": "0x00000000",
  1538. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1539. "size": "0x00000000"
  1540. }
  1541. ],
  1542. "exports": [],
  1543. "guest_signers": {},
  1544. "imphash": "d59a4a699610169663a929d37c90be43",
  1545. "icon_fuzzy": null,
  1546. "icon": null,
  1547. "pdbpath": null,
  1548. "imported_dll_count": 4,
  1549. "versioninfo": []
  1550. }
  1551. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!