API tools faq
paste
paladin316

NetWire_6f4ba42f8202789c34ee0f037de67a8d_exe_2019-06-24_12_30.json

paladin316
Jun 24th, 2019
2,301
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 26.94 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "NetWire_6f4ba42f8202789c34ee0f037de67a8d.exe"
  7. [*] File Size: 334336
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "4e3f66bb2fc5fc5c5d3b59f3fae3833f4ddf43132a014729f7c5061e056a81bc"
  10. [*] MD5: "6f4ba42f8202789c34ee0f037de67a8d"
  11. [*] SHA1: "52b37aa38ddeccbc57a5c9656cf4baa76136f57f"
  12. [*] SHA512: "261185f654263a4632bc2a7b10f20b19131e32f8fa32e5ac3d7609a4815c5e56982bfc1e738da034efa00e54f4b6c5de5738b7165e2cc38eac254e13c1dfcc2b"
  13. [*] CRC32: "18248301"
  14. [*] SSDEEP: "6144:CSXg7+EEGZZX8q2nRdMmm8J3bqv4Z2p95zZ1:CUg7+E7ZXB228J3b+Nf7"
  15.  
  16. [*] Process Execution: [
  17. "NetWire_6f4ba42f8202789c34ee0f037de67a8d.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: .text, entropy: 7.75, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00028e00, virtual_size: 0x00028c14"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "Anomalous .NET characteristics",
  31. "Details": [
  32. {
  33. "anomalous_version": "Assembly version is set to 0"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
  39. "Details": [
  40. {
  41. "FireEye": "Generic.mg.6f4ba42f8202789c"
  42. },
  43. {
  44. "McAfee": "Artemis!6F4BA42F8202"
  45. },
  46. {
  47. "Cylance": "Unsafe"
  48. },
  49. {
  50. "Symantec": "ML.Attribute.HighConfidence"
  51. },
  52. {
  53. "APEX": "Malicious"
  54. },
  55. {
  56. "Kaspersky": "HEUR:Backdoor.MSIL.NetWiredRC.gen"
  57. },
  58. {
  59. "Endgame": "malicious (high confidence)"
  60. },
  61. {
  62. "Comodo": "Application.MSIL.Amonetize.AF@67z1tc"
  63. },
  64. {
  65. "Invincea": "heuristic"
  66. },
  67. {
  68. "McAfee-GW-Edition": "BehavesLike.Win32.Trojan.fh"
  69. },
  70. {
  71. "Trapmine": "malicious.high.ml.score"
  72. },
  73. {
  74. "ZoneAlarm": "HEUR:Backdoor.MSIL.NetWiredRC.gen"
  75. },
  76. {
  77. "Acronis": "suspicious"
  78. },
  79. {
  80. "ESET-NOD32": "a variant of MSIL/TrojanDropper.Agent.EGH"
  81. },
  82. {
  83. "SentinelOne": "DFI - Suspicious PE"
  84. },
  85. {
  86. "Fortinet": "MSIL/GenKryptik.DLAJ!tr"
  87. },
  88. {
  89. "Cybereason": "malicious.38ddec"
  90. },
  91. {
  92. "CrowdStrike": "win/malicious_confidence_70% (D)"
  93. },
  94. {
  95. "Qihoo-360": "HEUR/QVM03.0.139F.Malware.Gen"
  96. }
  97. ]
  98. }
  99. ]
  100.  
  101. [*] Started Service: []
  102.  
  103. [*] Executed Commands: []
  104.  
  105. [*] Mutexes: []
  106.  
  107. [*] Modified Files: []
  108.  
  109. [*] Deleted Files: []
  110.  
  111. [*] Modified Registry Keys: []
  112.  
  113. [*] Deleted Registry Keys: []
  114.  
  115. [*] DNS Communications: []
  116.  
  117. [*] Domains: []
  118.  
  119. [*] Network Communication - ICMP: []
  120.  
  121. [*] Network Communication - HTTP: []
  122.  
  123. [*] Network Communication - SMTP: []
  124.  
  125. [*] Network Communication - Hosts: []
  126.  
  127. [*] Network Communication - IRC: []
  128.  
  129. [*] Static Analysis: {
  130. "dotnet": {
  131. "customattrs": [],
  132. "assemblyinfo": {
  133. "version": "0.0.0.0",
  134. "name": "mEpYaldnVF"
  135. },
  136. "assemblyrefs": [
  137. {
  138. "version": "4.0.0.0",
  139. "name": "mscorlib"
  140. },
  141. {
  142. "version": "0.0.0.0",
  143. "name": "KmuIHaseHf"
  144. },
  145. {
  146. "version": "4.0.0.0",
  147. "name": "System"
  148. }
  149. ],
  150. "typerefs": [
  151. {
  152. "typename": "BorderType.IsContentKindMatch",
  153. "assembly": "KmuIHaseHf"
  154. },
  155. {
  156. "typename": "System.Diagnostics.Trace",
  157. "assembly": "System"
  158. },
  159. {
  160. "typename": "System.IO.Compression.CompressionMode",
  161. "assembly": "System"
  162. },
  163. {
  164. "typename": "System.IO.Compression.DeflateStream",
  165. "assembly": "System"
  166. },
  167. {
  168. "typename": "System.Text.RegularExpressions.Capture",
  169. "assembly": "System"
  170. },
  171. {
  172. "typename": "System.Text.RegularExpressions.Group",
  173. "assembly": "System"
  174. },
  175. {
  176. "typename": "System.Text.RegularExpressions.GroupCollection",
  177. "assembly": "System"
  178. },
  179. {
  180. "typename": "System.Text.RegularExpressions.Match",
  181. "assembly": "System"
  182. },
  183. {
  184. "typename": "System.Text.RegularExpressions.Regex",
  185. "assembly": "System"
  186. },
  187. {
  188. "typename": "System.Text.RegularExpressions.RegexOptions",
  189. "assembly": "System"
  190. },
  191. {
  192. "typename": "Microsoft.Win32.Registry",
  193. "assembly": "mscorlib"
  194. },
  195. {
  196. "typename": "Microsoft.Win32.RegistryKey",
  197. "assembly": "mscorlib"
  198. },
  199. {
  200. "typename": "System.AppDomain",
  201. "assembly": "mscorlib"
  202. },
  203. {
  204. "typename": "System.AsyncCallback",
  205. "assembly": "mscorlib"
  206. },
  207. {
  208. "typename": "System.Byte",
  209. "assembly": "mscorlib"
  210. },
  211. {
  212. "typename": "System.Collections.Concurrent.ConcurrentDictionary`2",
  213. "assembly": "mscorlib"
  214. },
  215. {
  216. "typename": "System.Collections.Generic.Dictionary`2",
  217. "assembly": "mscorlib"
  218. },
  219. {
  220. "typename": "System.Convert",
  221. "assembly": "mscorlib"
  222. },
  223. {
  224. "typename": "System.Exception",
  225. "assembly": "mscorlib"
  226. },
  227. {
  228. "typename": "System.Guid",
  229. "assembly": "mscorlib"
  230. },
  231. {
  232. "typename": "System.IAsyncResult",
  233. "assembly": "mscorlib"
  234. },
  235. {
  236. "typename": "System.IDisposable",
  237. "assembly": "mscorlib"
  238. },
  239. {
  240. "typename": "System.IO.Directory",
  241. "assembly": "mscorlib"
  242. },
  243. {
  244. "typename": "System.IO.DirectoryInfo",
  245. "assembly": "mscorlib"
  246. },
  247. {
  248. "typename": "System.IO.File",
  249. "assembly": "mscorlib"
  250. },
  251. {
  252. "typename": "System.IO.FileInfo",
  253. "assembly": "mscorlib"
  254. },
  255. {
  256. "typename": "System.IO.FileSystemInfo",
  257. "assembly": "mscorlib"
  258. },
  259. {
  260. "typename": "System.IO.Path",
  261. "assembly": "mscorlib"
  262. },
  263. {
  264. "typename": "System.IO.Stream",
  265. "assembly": "mscorlib"
  266. },
  267. {
  268. "typename": "System.Int32",
  269. "assembly": "mscorlib"
  270. },
  271. {
  272. "typename": "System.IntPtr",
  273. "assembly": "mscorlib"
  274. },
  275. {
  276. "typename": "System.MulticastDelegate",
  277. "assembly": "mscorlib"
  278. },
  279. {
  280. "typename": "System.Nullable`1",
  281. "assembly": "mscorlib"
  282. },
  283. {
  284. "typename": "System.Object",
  285. "assembly": "mscorlib"
  286. },
  287. {
  288. "typename": "System.Reflection.Assembly",
  289. "assembly": "mscorlib"
  290. },
  291. {
  292. "typename": "System.Reflection.AssemblyName",
  293. "assembly": "mscorlib"
  294. },
  295. {
  296. "typename": "System.Reflection.MemberInfo",
  297. "assembly": "mscorlib"
  298. },
  299. {
  300. "typename": "System.ResolveEventArgs",
  301. "assembly": "mscorlib"
  302. },
  303. {
  304. "typename": "System.ResolveEventHandler",
  305. "assembly": "mscorlib"
  306. },
  307. {
  308. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  309. "assembly": "mscorlib"
  310. },
  311. {
  312. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  313. "assembly": "mscorlib"
  314. },
  315. {
  316. "typename": "System.RuntimeTypeHandle",
  317. "assembly": "mscorlib"
  318. },
  319. {
  320. "typename": "System.STAThreadAttribute",
  321. "assembly": "mscorlib"
  322. },
  323. {
  324. "typename": "System.Security.Cryptography.HashAlgorithm",
  325. "assembly": "mscorlib"
  326. },
  327. {
  328. "typename": "System.Security.Cryptography.MD5",
  329. "assembly": "mscorlib"
  330. },
  331. {
  332. "typename": "System.String",
  333. "assembly": "mscorlib"
  334. },
  335. {
  336. "typename": "System.Text.Encoding",
  337. "assembly": "mscorlib"
  338. },
  339. {
  340. "typename": "System.Threading.Interlocked",
  341. "assembly": "mscorlib"
  342. },
  343. {
  344. "typename": "System.Threading.Monitor",
  345. "assembly": "mscorlib"
  346. },
  347. {
  348. "typename": "System.Type",
  349. "assembly": "mscorlib"
  350. }
  351. ]
  352. },
  353. "pe": {
  354. "peid_signatures": null,
  355. "imports": [
  356. {
  357. "imports": [
  358. {
  359. "name": "_CorExeMain",
  360. "address": "0x402000"
  361. }
  362. ],
  363. "dll": "mscoree.dll"
  364. }
  365. ],
  366. "digital_signers": null,
  367. "exported_dll_name": null,
  368. "actual_checksum": "0x00060bb0",
  369. "overlay": null,
  370. "imagebase": "0x00400000",
  371. "reported_checksum": "0x00000000",
  372. "icon_hash": null,
  373. "entrypoint": "0x0042ac0e",
  374. "timestamp": "2019-06-23 21:31:13",
  375. "osversion": "4.0",
  376. "sections": [
  377. {
  378. "name": ".text",
  379. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  380. "virtual_address": "0x00002000",
  381. "size_of_data": "0x00028e00",
  382. "entropy": "7.75",
  383. "raw_address": "0x00000200",
  384. "virtual_size": "0x00028c14",
  385. "characteristics_raw": "0x60000020"
  386. },
  387. {
  388. "name": ".rsrc",
  389. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  390. "virtual_address": "0x0002c000",
  391. "size_of_data": "0x00028800",
  392. "entropy": "2.90",
  393. "raw_address": "0x00029000",
  394. "virtual_size": "0x0002878c",
  395. "characteristics_raw": "0x40000040"
  396. },
  397. {
  398. "name": ".reloc",
  399. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  400. "virtual_address": "0x00056000",
  401. "size_of_data": "0x00000200",
  402. "entropy": "0.10",
  403. "raw_address": "0x00051800",
  404. "virtual_size": "0x0000000c",
  405. "characteristics_raw": "0x42000040"
  406. }
  407. ],
  408. "resources": [],
  409. "dirents": [
  410. {
  411. "virtual_address": "0x00000000",
  412. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  413. "size": "0x00000000"
  414. },
  415. {
  416. "virtual_address": "0x0002abc0",
  417. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  418. "size": "0x0000004b"
  419. },
  420. {
  421. "virtual_address": "0x0002c000",
  422. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  423. "size": "0x0002878c"
  424. },
  425. {
  426. "virtual_address": "0x00000000",
  427. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  428. "size": "0x00000000"
  429. },
  430. {
  431. "virtual_address": "0x00000000",
  432. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  433. "size": "0x00000000"
  434. },
  435. {
  436. "virtual_address": "0x00056000",
  437. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  438. "size": "0x0000000c"
  439. },
  440. {
  441. "virtual_address": "0x00000000",
  442. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  443. "size": "0x00000000"
  444. },
  445. {
  446. "virtual_address": "0x00000000",
  447. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  448. "size": "0x00000000"
  449. },
  450. {
  451. "virtual_address": "0x00000000",
  452. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  453. "size": "0x00000000"
  454. },
  455. {
  456. "virtual_address": "0x00000000",
  457. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  458. "size": "0x00000000"
  459. },
  460. {
  461. "virtual_address": "0x00000000",
  462. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  463. "size": "0x00000000"
  464. },
  465. {
  466. "virtual_address": "0x00000000",
  467. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  468. "size": "0x00000000"
  469. },
  470. {
  471. "virtual_address": "0x00002000",
  472. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  473. "size": "0x00000008"
  474. },
  475. {
  476. "virtual_address": "0x00000000",
  477. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  478. "size": "0x00000000"
  479. },
  480. {
  481. "virtual_address": "0x00002008",
  482. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  483. "size": "0x00000048"
  484. },
  485. {
  486. "virtual_address": "0x00000000",
  487. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  488. "size": "0x00000000"
  489. }
  490. ],
  491. "exports": [],
  492. "guest_signers": {},
  493. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  494. "icon_fuzzy": null,
  495. "icon": null,
  496. "pdbpath": null,
  497. "imported_dll_count": 1,
  498. "versioninfo": []
  499. }
  500. }
  501.  
  502. [*] Resolved APIs: [
  503. "advapi32.dll.RegOpenKeyExW",
  504. "advapi32.dll.RegQueryInfoKeyW",
  505. "advapi32.dll.RegEnumKeyExW",
  506. "advapi32.dll.RegEnumValueW",
  507. "advapi32.dll.RegCloseKey",
  508. "advapi32.dll.RegQueryValueExW",
  509. "kernel32.dll.QueryActCtxW",
  510. "shlwapi.dll.UrlIsW"
  511. ]
  512.  
  513. [*] Static Analysis: {
  514. "dotnet": {
  515. "customattrs": [],
  516. "assemblyinfo": {
  517. "version": "0.0.0.0",
  518. "name": "mEpYaldnVF"
  519. },
  520. "assemblyrefs": [
  521. {
  522. "version": "4.0.0.0",
  523. "name": "mscorlib"
  524. },
  525. {
  526. "version": "0.0.0.0",
  527. "name": "KmuIHaseHf"
  528. },
  529. {
  530. "version": "4.0.0.0",
  531. "name": "System"
  532. }
  533. ],
  534. "typerefs": [
  535. {
  536. "typename": "BorderType.IsContentKindMatch",
  537. "assembly": "KmuIHaseHf"
  538. },
  539. {
  540. "typename": "System.Diagnostics.Trace",
  541. "assembly": "System"
  542. },
  543. {
  544. "typename": "System.IO.Compression.CompressionMode",
  545. "assembly": "System"
  546. },
  547. {
  548. "typename": "System.IO.Compression.DeflateStream",
  549. "assembly": "System"
  550. },
  551. {
  552. "typename": "System.Text.RegularExpressions.Capture",
  553. "assembly": "System"
  554. },
  555. {
  556. "typename": "System.Text.RegularExpressions.Group",
  557. "assembly": "System"
  558. },
  559. {
  560. "typename": "System.Text.RegularExpressions.GroupCollection",
  561. "assembly": "System"
  562. },
  563. {
  564. "typename": "System.Text.RegularExpressions.Match",
  565. "assembly": "System"
  566. },
  567. {
  568. "typename": "System.Text.RegularExpressions.Regex",
  569. "assembly": "System"
  570. },
  571. {
  572. "typename": "System.Text.RegularExpressions.RegexOptions",
  573. "assembly": "System"
  574. },
  575. {
  576. "typename": "Microsoft.Win32.Registry",
  577. "assembly": "mscorlib"
  578. },
  579. {
  580. "typename": "Microsoft.Win32.RegistryKey",
  581. "assembly": "mscorlib"
  582. },
  583. {
  584. "typename": "System.AppDomain",
  585. "assembly": "mscorlib"
  586. },
  587. {
  588. "typename": "System.AsyncCallback",
  589. "assembly": "mscorlib"
  590. },
  591. {
  592. "typename": "System.Byte",
  593. "assembly": "mscorlib"
  594. },
  595. {
  596. "typename": "System.Collections.Concurrent.ConcurrentDictionary`2",
  597. "assembly": "mscorlib"
  598. },
  599. {
  600. "typename": "System.Collections.Generic.Dictionary`2",
  601. "assembly": "mscorlib"
  602. },
  603. {
  604. "typename": "System.Convert",
  605. "assembly": "mscorlib"
  606. },
  607. {
  608. "typename": "System.Exception",
  609. "assembly": "mscorlib"
  610. },
  611. {
  612. "typename": "System.Guid",
  613. "assembly": "mscorlib"
  614. },
  615. {
  616. "typename": "System.IAsyncResult",
  617. "assembly": "mscorlib"
  618. },
  619. {
  620. "typename": "System.IDisposable",
  621. "assembly": "mscorlib"
  622. },
  623. {
  624. "typename": "System.IO.Directory",
  625. "assembly": "mscorlib"
  626. },
  627. {
  628. "typename": "System.IO.DirectoryInfo",
  629. "assembly": "mscorlib"
  630. },
  631. {
  632. "typename": "System.IO.File",
  633. "assembly": "mscorlib"
  634. },
  635. {
  636. "typename": "System.IO.FileInfo",
  637. "assembly": "mscorlib"
  638. },
  639. {
  640. "typename": "System.IO.FileSystemInfo",
  641. "assembly": "mscorlib"
  642. },
  643. {
  644. "typename": "System.IO.Path",
  645. "assembly": "mscorlib"
  646. },
  647. {
  648. "typename": "System.IO.Stream",
  649. "assembly": "mscorlib"
  650. },
  651. {
  652. "typename": "System.Int32",
  653. "assembly": "mscorlib"
  654. },
  655. {
  656. "typename": "System.IntPtr",
  657. "assembly": "mscorlib"
  658. },
  659. {
  660. "typename": "System.MulticastDelegate",
  661. "assembly": "mscorlib"
  662. },
  663. {
  664. "typename": "System.Nullable`1",
  665. "assembly": "mscorlib"
  666. },
  667. {
  668. "typename": "System.Object",
  669. "assembly": "mscorlib"
  670. },
  671. {
  672. "typename": "System.Reflection.Assembly",
  673. "assembly": "mscorlib"
  674. },
  675. {
  676. "typename": "System.Reflection.AssemblyName",
  677. "assembly": "mscorlib"
  678. },
  679. {
  680. "typename": "System.Reflection.MemberInfo",
  681. "assembly": "mscorlib"
  682. },
  683. {
  684. "typename": "System.ResolveEventArgs",
  685. "assembly": "mscorlib"
  686. },
  687. {
  688. "typename": "System.ResolveEventHandler",
  689. "assembly": "mscorlib"
  690. },
  691. {
  692. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  693. "assembly": "mscorlib"
  694. },
  695. {
  696. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  697. "assembly": "mscorlib"
  698. },
  699. {
  700. "typename": "System.RuntimeTypeHandle",
  701. "assembly": "mscorlib"
  702. },
  703. {
  704. "typename": "System.STAThreadAttribute",
  705. "assembly": "mscorlib"
  706. },
  707. {
  708. "typename": "System.Security.Cryptography.HashAlgorithm",
  709. "assembly": "mscorlib"
  710. },
  711. {
  712. "typename": "System.Security.Cryptography.MD5",
  713. "assembly": "mscorlib"
  714. },
  715. {
  716. "typename": "System.String",
  717. "assembly": "mscorlib"
  718. },
  719. {
  720. "typename": "System.Text.Encoding",
  721. "assembly": "mscorlib"
  722. },
  723. {
  724. "typename": "System.Threading.Interlocked",
  725. "assembly": "mscorlib"
  726. },
  727. {
  728. "typename": "System.Threading.Monitor",
  729. "assembly": "mscorlib"
  730. },
  731. {
  732. "typename": "System.Type",
  733. "assembly": "mscorlib"
  734. }
  735. ]
  736. },
  737. "pe": {
  738. "peid_signatures": null,
  739. "imports": [
  740. {
  741. "imports": [
  742. {
  743. "name": "_CorExeMain",
  744. "address": "0x402000"
  745. }
  746. ],
  747. "dll": "mscoree.dll"
  748. }
  749. ],
  750. "digital_signers": null,
  751. "exported_dll_name": null,
  752. "actual_checksum": "0x00060bb0",
  753. "overlay": null,
  754. "imagebase": "0x00400000",
  755. "reported_checksum": "0x00000000",
  756. "icon_hash": null,
  757. "entrypoint": "0x0042ac0e",
  758. "timestamp": "2019-06-23 21:31:13",
  759. "osversion": "4.0",
  760. "sections": [
  761. {
  762. "name": ".text",
  763. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  764. "virtual_address": "0x00002000",
  765. "size_of_data": "0x00028e00",
  766. "entropy": "7.75",
  767. "raw_address": "0x00000200",
  768. "virtual_size": "0x00028c14",
  769. "characteristics_raw": "0x60000020"
  770. },
  771. {
  772. "name": ".rsrc",
  773. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  774. "virtual_address": "0x0002c000",
  775. "size_of_data": "0x00028800",
  776. "entropy": "2.90",
  777. "raw_address": "0x00029000",
  778. "virtual_size": "0x0002878c",
  779. "characteristics_raw": "0x40000040"
  780. },
  781. {
  782. "name": ".reloc",
  783. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  784. "virtual_address": "0x00056000",
  785. "size_of_data": "0x00000200",
  786. "entropy": "0.10",
  787. "raw_address": "0x00051800",
  788. "virtual_size": "0x0000000c",
  789. "characteristics_raw": "0x42000040"
  790. }
  791. ],
  792. "resources": [],
  793. "dirents": [
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  797. "size": "0x00000000"
  798. },
  799. {
  800. "virtual_address": "0x0002abc0",
  801. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  802. "size": "0x0000004b"
  803. },
  804. {
  805. "virtual_address": "0x0002c000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  807. "size": "0x0002878c"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  812. "size": "0x00000000"
  813. },
  814. {
  815. "virtual_address": "0x00000000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  817. "size": "0x00000000"
  818. },
  819. {
  820. "virtual_address": "0x00056000",
  821. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  822. "size": "0x0000000c"
  823. },
  824. {
  825. "virtual_address": "0x00000000",
  826. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  827. "size": "0x00000000"
  828. },
  829. {
  830. "virtual_address": "0x00000000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  832. "size": "0x00000000"
  833. },
  834. {
  835. "virtual_address": "0x00000000",
  836. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  837. "size": "0x00000000"
  838. },
  839. {
  840. "virtual_address": "0x00000000",
  841. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  842. "size": "0x00000000"
  843. },
  844. {
  845. "virtual_address": "0x00000000",
  846. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  847. "size": "0x00000000"
  848. },
  849. {
  850. "virtual_address": "0x00000000",
  851. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  852. "size": "0x00000000"
  853. },
  854. {
  855. "virtual_address": "0x00002000",
  856. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  857. "size": "0x00000008"
  858. },
  859. {
  860. "virtual_address": "0x00000000",
  861. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  862. "size": "0x00000000"
  863. },
  864. {
  865. "virtual_address": "0x00002008",
  866. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  867. "size": "0x00000048"
  868. },
  869. {
  870. "virtual_address": "0x00000000",
  871. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  872. "size": "0x00000000"
  873. }
  874. ],
  875. "exports": [],
  876. "guest_signers": {},
  877. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  878. "icon_fuzzy": null,
  879. "icon": null,
  880. "pdbpath": null,
  881. "imported_dll_count": 1,
  882. "versioninfo": []
  883. }
  884. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!