API tools faq
paste
paladin316

Exes_e3638516b609eed8bfa8e5732e5eebba_exe_2019-07-02_14_30.json

paladin316
Jul 2nd, 2019
2,070
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.13 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_e3638516b609eed8bfa8e5732e5eebba.exe"
  7. [*] File Size: 569856
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482"
  10. [*] MD5: "e3638516b609eed8bfa8e5732e5eebba"
  11. [*] SHA1: "12c752d26dab93e1b10f81cca4c7bb5d45c7b654"
  12. [*] SHA512: "ef60515898834800b2b281bb3484591125c4e5f91487dd8e5f1c2e07226d64cb0739448d9a53f68a3e42ab5498cf721e4e55b0702135657f5d9974158d746984"
  13. [*] CRC32: "015EBB47"
  14. [*] SSDEEP: "12288:E5g7zmAPre5Jzkn3ZeIA+oigyvR3p1Eu3kj0qvuRn1yRAzvlR4TeXtZ:E5yzmwSkd553J0j0qM1yRALlW2Z"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .text, entropy: 7.96, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0008aa00, virtual_size: 0x0008a88c"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "Anomalous .NET characteristics",
  29. "Details": [
  30. {
  31. "anomalous_version": "Assembly version is set to 0"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
  37. "Details": [
  38. {
  39. "FireEye": "Generic.mg.e3638516b609eed8"
  40. },
  41. {
  42. "ESET-NOD32": "a variant of MSIL/Packed.SmartAssembly.AX"
  43. },
  44. {
  45. "APEX": "Malicious"
  46. },
  47. {
  48. "Kaspersky": "HEUR:Trojan.MSIL.DOTHETUK.gen"
  49. },
  50. {
  51. "Avast": "Win32:CrypterX-gen [Trj]"
  52. },
  53. {
  54. "Qihoo-360": "HEUR/QVM03.0.3F21.Malware.Gen"
  55. },
  56. {
  57. "Invincea": "heuristic"
  58. },
  59. {
  60. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.hc"
  61. },
  62. {
  63. "Trapmine": "malicious.high.ml.score"
  64. },
  65. {
  66. "Endgame": "malicious (high confidence)"
  67. },
  68. {
  69. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  70. },
  71. {
  72. "ZoneAlarm": "HEUR:Trojan.MSIL.DOTHETUK.gen"
  73. },
  74. {
  75. "Acronis": "suspicious"
  76. },
  77. {
  78. "Cylance": "Unsafe"
  79. },
  80. {
  81. "SentinelOne": "DFI - Malicious PE"
  82. },
  83. {
  84. "eGambit": "Unsafe.AI_Score_55%"
  85. },
  86. {
  87. "AVG": "Win32:CrypterX-gen [Trj]"
  88. },
  89. {
  90. "Cybereason": "malicious.26dab9"
  91. },
  92. {
  93. "CrowdStrike": "win/malicious_confidence_100% (D)"
  94. }
  95. ]
  96. }
  97. ]
  98.  
  99. [*] Started Service: []
  100.  
  101. [*] Executed Commands: []
  102.  
  103. [*] Mutexes: []
  104.  
  105. [*] Modified Files: []
  106.  
  107. [*] Deleted Files: []
  108.  
  109. [*] Modified Registry Keys: []
  110.  
  111. [*] Deleted Registry Keys: []
  112.  
  113. [*] DNS Communications: []
  114.  
  115. [*] Domains: []
  116.  
  117. [*] Network Communication - ICMP: []
  118.  
  119. [*] Network Communication - HTTP: []
  120.  
  121. [*] Network Communication - SMTP: []
  122.  
  123. [*] Network Communication - Hosts: []
  124.  
  125. [*] Network Communication - IRC: []
  126.  
  127. [*] Static Analysis: {
  128. "dotnet": {
  129. "customattrs": null,
  130. "assemblyinfo": {
  131. "version": "0.0.0.0",
  132. "name": "ovnk"
  133. },
  134. "assemblyrefs": [
  135. {
  136. "version": "2.0.0.0",
  137. "name": "mscorlib"
  138. },
  139. {
  140. "version": "8.0.0.0",
  141. "name": "Microsoft.VisualBasic"
  142. },
  143. {
  144. "version": "2.0.0.0",
  145. "name": "System"
  146. }
  147. ],
  148. "typerefs": [
  149. {
  150. "typename": "Microsoft.VisualBasic.ApplicationServices.ApplicationBase",
  151. "assembly": "Microsoft.VisualBasic"
  152. },
  153. {
  154. "typename": "Microsoft.VisualBasic.ApplicationServices.User",
  155. "assembly": "Microsoft.VisualBasic"
  156. },
  157. {
  158. "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
  159. "assembly": "Microsoft.VisualBasic"
  160. },
  161. {
  162. "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
  163. "assembly": "Microsoft.VisualBasic"
  164. },
  165. {
  166. "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
  167. "assembly": "Microsoft.VisualBasic"
  168. },
  169. {
  170. "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
  171. "assembly": "Microsoft.VisualBasic"
  172. },
  173. {
  174. "typename": "Microsoft.VisualBasic.Devices.Computer",
  175. "assembly": "Microsoft.VisualBasic"
  176. },
  177. {
  178. "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
  179. "assembly": "Microsoft.VisualBasic"
  180. },
  181. {
  182. "typename": "Microsoft.VisualBasic.Interaction",
  183. "assembly": "Microsoft.VisualBasic"
  184. },
  185. {
  186. "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
  187. "assembly": "Microsoft.VisualBasic"
  188. },
  189. {
  190. "typename": "Microsoft.VisualBasic.MyServices.Internal.ContextValue`1",
  191. "assembly": "Microsoft.VisualBasic"
  192. },
  193. {
  194. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  195. "assembly": "System"
  196. },
  197. {
  198. "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
  199. "assembly": "System"
  200. },
  201. {
  202. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  203. "assembly": "System"
  204. },
  205. {
  206. "typename": "System.ComponentModel.EditorBrowsableState",
  207. "assembly": "System"
  208. },
  209. {
  210. "typename": "System.Configuration.ApplicationSettingsBase",
  211. "assembly": "System"
  212. },
  213. {
  214. "typename": "System.Configuration.SettingsBase",
  215. "assembly": "System"
  216. },
  217. {
  218. "typename": "System.Diagnostics.Process",
  219. "assembly": "System"
  220. },
  221. {
  222. "typename": "System.Diagnostics.ProcessModule",
  223. "assembly": "System"
  224. },
  225. {
  226. "typename": "System.Diagnostics.ProcessModuleCollection",
  227. "assembly": "System"
  228. },
  229. {
  230. "typename": "System.Activator",
  231. "assembly": "mscorlib"
  232. },
  233. {
  234. "typename": "System.AppDomain",
  235. "assembly": "mscorlib"
  236. },
  237. {
  238. "typename": "System.ArgumentOutOfRangeException",
  239. "assembly": "mscorlib"
  240. },
  241. {
  242. "typename": "System.Array",
  243. "assembly": "mscorlib"
  244. },
  245. {
  246. "typename": "System.AsyncCallback",
  247. "assembly": "mscorlib"
  248. },
  249. {
  250. "typename": "System.Attribute",
  251. "assembly": "mscorlib"
  252. },
  253. {
  254. "typename": "System.AttributeTargets",
  255. "assembly": "mscorlib"
  256. },
  257. {
  258. "typename": "System.AttributeUsageAttribute",
  259. "assembly": "mscorlib"
  260. },
  261. {
  262. "typename": "System.BadImageFormatException",
  263. "assembly": "mscorlib"
  264. },
  265. {
  266. "typename": "System.BitConverter",
  267. "assembly": "mscorlib"
  268. },
  269. {
  270. "typename": "System.Boolean",
  271. "assembly": "mscorlib"
  272. },
  273. {
  274. "typename": "System.Buffer",
  275. "assembly": "mscorlib"
  276. },
  277. {
  278. "typename": "System.Byte",
  279. "assembly": "mscorlib"
  280. },
  281. {
  282. "typename": "System.Char",
  283. "assembly": "mscorlib"
  284. },
  285. {
  286. "typename": "System.Collections.Generic.Dictionary`2",
  287. "assembly": "mscorlib"
  288. },
  289. {
  290. "typename": "System.Collections.IEnumerator",
  291. "assembly": "mscorlib"
  292. },
  293. {
  294. "typename": "System.Collections.ReadOnlyCollectionBase",
  295. "assembly": "mscorlib"
  296. },
  297. {
  298. "typename": "System.Convert",
  299. "assembly": "mscorlib"
  300. },
  301. {
  302. "typename": "System.Delegate",
  303. "assembly": "mscorlib"
  304. },
  305. {
  306. "typename": "System.Diagnostics.DebuggerDisplayAttribute",
  307. "assembly": "mscorlib"
  308. },
  309. {
  310. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  311. "assembly": "mscorlib"
  312. },
  313. {
  314. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  315. "assembly": "mscorlib"
  316. },
  317. {
  318. "typename": "System.Diagnostics.StackFrame",
  319. "assembly": "mscorlib"
  320. },
  321. {
  322. "typename": "System.Diagnostics.StackTrace",
  323. "assembly": "mscorlib"
  324. },
  325. {
  326. "typename": "System.Enum",
  327. "assembly": "mscorlib"
  328. },
  329. {
  330. "typename": "System.Exception",
  331. "assembly": "mscorlib"
  332. },
  333. {
  334. "typename": "System.FlagsAttribute",
  335. "assembly": "mscorlib"
  336. },
  337. {
  338. "typename": "System.FormatException",
  339. "assembly": "mscorlib"
  340. },
  341. {
  342. "typename": "System.GC",
  343. "assembly": "mscorlib"
  344. },
  345. {
  346. "typename": "System.Globalization.CultureInfo",
  347. "assembly": "mscorlib"
  348. },
  349. {
  350. "typename": "System.IAsyncResult",
  351. "assembly": "mscorlib"
  352. },
  353. {
  354. "typename": "System.IDisposable",
  355. "assembly": "mscorlib"
  356. },
  357. {
  358. "typename": "System.IO.Directory",
  359. "assembly": "mscorlib"
  360. },
  361. {
  362. "typename": "System.IO.DirectoryInfo",
  363. "assembly": "mscorlib"
  364. },
  365. {
  366. "typename": "System.IO.File",
  367. "assembly": "mscorlib"
  368. },
  369. {
  370. "typename": "System.IO.FileLoadException",
  371. "assembly": "mscorlib"
  372. },
  373. {
  374. "typename": "System.IO.FileStream",
  375. "assembly": "mscorlib"
  376. },
  377. {
  378. "typename": "System.IO.MemoryStream",
  379. "assembly": "mscorlib"
  380. },
  381. {
  382. "typename": "System.IO.Path",
  383. "assembly": "mscorlib"
  384. },
  385. {
  386. "typename": "System.IO.Stream",
  387. "assembly": "mscorlib"
  388. },
  389. {
  390. "typename": "System.Int16",
  391. "assembly": "mscorlib"
  392. },
  393. {
  394. "typename": "System.Int32",
  395. "assembly": "mscorlib"
  396. },
  397. {
  398. "typename": "System.IntPtr",
  399. "assembly": "mscorlib"
  400. },
  401. {
  402. "typename": "System.InvalidOperationException",
  403. "assembly": "mscorlib"
  404. },
  405. {
  406. "typename": "System.Math",
  407. "assembly": "mscorlib"
  408. },
  409. {
  410. "typename": "System.MulticastDelegate",
  411. "assembly": "mscorlib"
  412. },
  413. {
  414. "typename": "System.Object",
  415. "assembly": "mscorlib"
  416. },
  417. {
  418. "typename": "System.Reflection.Assembly",
  419. "assembly": "mscorlib"
  420. },
  421. {
  422. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  423. "assembly": "mscorlib"
  424. },
  425. {
  426. "typename": "System.Reflection.AssemblyName",
  427. "assembly": "mscorlib"
  428. },
  429. {
  430. "typename": "System.Reflection.MemberInfo",
  431. "assembly": "mscorlib"
  432. },
  433. {
  434. "typename": "System.Reflection.MethodBase",
  435. "assembly": "mscorlib"
  436. },
  437. {
  438. "typename": "System.Reflection.Module",
  439. "assembly": "mscorlib"
  440. },
  441. {
  442. "typename": "System.ResolveEventArgs",
  443. "assembly": "mscorlib"
  444. },
  445. {
  446. "typename": "System.ResolveEventHandler",
  447. "assembly": "mscorlib"
  448. },
  449. {
  450. "typename": "System.Resources.ResourceManager",
  451. "assembly": "mscorlib"
  452. },
  453. {
  454. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  455. "assembly": "mscorlib"
  456. },
  457. {
  458. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  459. "assembly": "mscorlib"
  460. },
  461. {
  462. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  463. "assembly": "mscorlib"
  464. },
  465. {
  466. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  467. "assembly": "mscorlib"
  468. },
  469. {
  470. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  471. "assembly": "mscorlib"
  472. },
  473. {
  474. "typename": "System.Runtime.InteropServices.Marshal",
  475. "assembly": "mscorlib"
  476. },
  477. {
  478. "typename": "System.RuntimeFieldHandle",
  479. "assembly": "mscorlib"
  480. },
  481. {
  482. "typename": "System.RuntimeTypeHandle",
  483. "assembly": "mscorlib"
  484. },
  485. {
  486. "typename": "System.STAThreadAttribute",
  487. "assembly": "mscorlib"
  488. },
  489. {
  490. "typename": "System.Security.Cryptography.CipherMode",
  491. "assembly": "mscorlib"
  492. },
  493. {
  494. "typename": "System.Security.Cryptography.CryptoStream",
  495. "assembly": "mscorlib"
  496. },
  497. {
  498. "typename": "System.Security.Cryptography.CryptoStreamMode",
  499. "assembly": "mscorlib"
  500. },
  501. {
  502. "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
  503. "assembly": "mscorlib"
  504. },
  505. {
  506. "typename": "System.Security.Cryptography.HashAlgorithm",
  507. "assembly": "mscorlib"
  508. },
  509. {
  510. "typename": "System.Security.Cryptography.ICryptoTransform",
  511. "assembly": "mscorlib"
  512. },
  513. {
  514. "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
  515. "assembly": "mscorlib"
  516. },
  517. {
  518. "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
  519. "assembly": "mscorlib"
  520. },
  521. {
  522. "typename": "System.Security.Cryptography.RijndaelManaged",
  523. "assembly": "mscorlib"
  524. },
  525. {
  526. "typename": "System.Security.Cryptography.SymmetricAlgorithm",
  527. "assembly": "mscorlib"
  528. },
  529. {
  530. "typename": "System.String",
  531. "assembly": "mscorlib"
  532. },
  533. {
  534. "typename": "System.Text.Encoding",
  535. "assembly": "mscorlib"
  536. },
  537. {
  538. "typename": "System.Text.StringBuilder",
  539. "assembly": "mscorlib"
  540. },
  541. {
  542. "typename": "System.Threading.Monitor",
  543. "assembly": "mscorlib"
  544. },
  545. {
  546. "typename": "System.Threading.Thread",
  547. "assembly": "mscorlib"
  548. },
  549. {
  550. "typename": "System.Threading.ThreadStart",
  551. "assembly": "mscorlib"
  552. },
  553. {
  554. "typename": "System.Type",
  555. "assembly": "mscorlib"
  556. },
  557. {
  558. "typename": "System.ValueType",
  559. "assembly": "mscorlib"
  560. },
  561. {
  562. "typename": "System.Version",
  563. "assembly": "mscorlib"
  564. }
  565. ]
  566. },
  567. "pe": {
  568. "peid_signatures": null,
  569. "imports": [
  570. {
  571. "imports": [
  572. {
  573. "name": "_CorExeMain",
  574. "address": "0x402000"
  575. }
  576. ],
  577. "dll": "mscoree.dll"
  578. }
  579. ],
  580. "digital_signers": null,
  581. "exported_dll_name": null,
  582. "actual_checksum": "0x000943fe",
  583. "overlay": null,
  584. "imagebase": "0x00400000",
  585. "reported_checksum": "0x00000000",
  586. "icon_hash": null,
  587. "entrypoint": "0x0048c886",
  588. "timestamp": "2019-07-01 09:34:21",
  589. "osversion": "4.0",
  590. "sections": [
  591. {
  592. "name": ".text",
  593. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  594. "virtual_address": "0x00002000",
  595. "size_of_data": "0x0008aa00",
  596. "entropy": "7.96",
  597. "raw_address": "0x00000200",
  598. "virtual_size": "0x0008a88c",
  599. "characteristics_raw": "0x60000020"
  600. },
  601. {
  602. "name": ".rsrc",
  603. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  604. "virtual_address": "0x0008e000",
  605. "size_of_data": "0x00000400",
  606. "entropy": "4.46",
  607. "raw_address": "0x0008ac00",
  608. "virtual_size": "0x00000394",
  609. "characteristics_raw": "0x40000040"
  610. },
  611. {
  612. "name": ".reloc",
  613. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  614. "virtual_address": "0x00090000",
  615. "size_of_data": "0x00000200",
  616. "entropy": "0.10",
  617. "raw_address": "0x0008b000",
  618. "virtual_size": "0x0000000c",
  619. "characteristics_raw": "0x42000040"
  620. }
  621. ],
  622. "resources": [],
  623. "dirents": [
  624. {
  625. "virtual_address": "0x00000000",
  626. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  627. "size": "0x00000000"
  628. },
  629. {
  630. "virtual_address": "0x0008c83c",
  631. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  632. "size": "0x0000004a"
  633. },
  634. {
  635. "virtual_address": "0x0008e000",
  636. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  637. "size": "0x00000394"
  638. },
  639. {
  640. "virtual_address": "0x00000000",
  641. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  642. "size": "0x00000000"
  643. },
  644. {
  645. "virtual_address": "0x00000000",
  646. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  647. "size": "0x00000000"
  648. },
  649. {
  650. "virtual_address": "0x00090000",
  651. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  652. "size": "0x0000000c"
  653. },
  654. {
  655. "virtual_address": "0x00000000",
  656. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  657. "size": "0x00000000"
  658. },
  659. {
  660. "virtual_address": "0x00000000",
  661. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  662. "size": "0x00000000"
  663. },
  664. {
  665. "virtual_address": "0x00000000",
  666. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  667. "size": "0x00000000"
  668. },
  669. {
  670. "virtual_address": "0x00000000",
  671. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  672. "size": "0x00000000"
  673. },
  674. {
  675. "virtual_address": "0x00000000",
  676. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  677. "size": "0x00000000"
  678. },
  679. {
  680. "virtual_address": "0x00000000",
  681. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  682. "size": "0x00000000"
  683. },
  684. {
  685. "virtual_address": "0x00002000",
  686. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  687. "size": "0x00000008"
  688. },
  689. {
  690. "virtual_address": "0x00000000",
  691. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  692. "size": "0x00000000"
  693. },
  694. {
  695. "virtual_address": "0x00002008",
  696. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  697. "size": "0x00000048"
  698. },
  699. {
  700. "virtual_address": "0x00000000",
  701. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  702. "size": "0x00000000"
  703. }
  704. ],
  705. "exports": [],
  706. "guest_signers": {},
  707. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  708. "icon_fuzzy": null,
  709. "icon": null,
  710. "pdbpath": null,
  711. "imported_dll_count": 1,
  712. "versioninfo": []
  713. }
  714. }
  715.  
  716. [*] Resolved APIs: []
  717.  
  718. [*] Static Analysis: {
  719. "dotnet": {
  720. "customattrs": null,
  721. "assemblyinfo": {
  722. "version": "0.0.0.0",
  723. "name": "ovnk"
  724. },
  725. "assemblyrefs": [
  726. {
  727. "version": "2.0.0.0",
  728. "name": "mscorlib"
  729. },
  730. {
  731. "version": "8.0.0.0",
  732. "name": "Microsoft.VisualBasic"
  733. },
  734. {
  735. "version": "2.0.0.0",
  736. "name": "System"
  737. }
  738. ],
  739. "typerefs": [
  740. {
  741. "typename": "Microsoft.VisualBasic.ApplicationServices.ApplicationBase",
  742. "assembly": "Microsoft.VisualBasic"
  743. },
  744. {
  745. "typename": "Microsoft.VisualBasic.ApplicationServices.User",
  746. "assembly": "Microsoft.VisualBasic"
  747. },
  748. {
  749. "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
  750. "assembly": "Microsoft.VisualBasic"
  751. },
  752. {
  753. "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
  754. "assembly": "Microsoft.VisualBasic"
  755. },
  756. {
  757. "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
  758. "assembly": "Microsoft.VisualBasic"
  759. },
  760. {
  761. "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
  762. "assembly": "Microsoft.VisualBasic"
  763. },
  764. {
  765. "typename": "Microsoft.VisualBasic.Devices.Computer",
  766. "assembly": "Microsoft.VisualBasic"
  767. },
  768. {
  769. "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
  770. "assembly": "Microsoft.VisualBasic"
  771. },
  772. {
  773. "typename": "Microsoft.VisualBasic.Interaction",
  774. "assembly": "Microsoft.VisualBasic"
  775. },
  776. {
  777. "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
  778. "assembly": "Microsoft.VisualBasic"
  779. },
  780. {
  781. "typename": "Microsoft.VisualBasic.MyServices.Internal.ContextValue`1",
  782. "assembly": "Microsoft.VisualBasic"
  783. },
  784. {
  785. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  786. "assembly": "System"
  787. },
  788. {
  789. "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
  790. "assembly": "System"
  791. },
  792. {
  793. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  794. "assembly": "System"
  795. },
  796. {
  797. "typename": "System.ComponentModel.EditorBrowsableState",
  798. "assembly": "System"
  799. },
  800. {
  801. "typename": "System.Configuration.ApplicationSettingsBase",
  802. "assembly": "System"
  803. },
  804. {
  805. "typename": "System.Configuration.SettingsBase",
  806. "assembly": "System"
  807. },
  808. {
  809. "typename": "System.Diagnostics.Process",
  810. "assembly": "System"
  811. },
  812. {
  813. "typename": "System.Diagnostics.ProcessModule",
  814. "assembly": "System"
  815. },
  816. {
  817. "typename": "System.Diagnostics.ProcessModuleCollection",
  818. "assembly": "System"
  819. },
  820. {
  821. "typename": "System.Activator",
  822. "assembly": "mscorlib"
  823. },
  824. {
  825. "typename": "System.AppDomain",
  826. "assembly": "mscorlib"
  827. },
  828. {
  829. "typename": "System.ArgumentOutOfRangeException",
  830. "assembly": "mscorlib"
  831. },
  832. {
  833. "typename": "System.Array",
  834. "assembly": "mscorlib"
  835. },
  836. {
  837. "typename": "System.AsyncCallback",
  838. "assembly": "mscorlib"
  839. },
  840. {
  841. "typename": "System.Attribute",
  842. "assembly": "mscorlib"
  843. },
  844. {
  845. "typename": "System.AttributeTargets",
  846. "assembly": "mscorlib"
  847. },
  848. {
  849. "typename": "System.AttributeUsageAttribute",
  850. "assembly": "mscorlib"
  851. },
  852. {
  853. "typename": "System.BadImageFormatException",
  854. "assembly": "mscorlib"
  855. },
  856. {
  857. "typename": "System.BitConverter",
  858. "assembly": "mscorlib"
  859. },
  860. {
  861. "typename": "System.Boolean",
  862. "assembly": "mscorlib"
  863. },
  864. {
  865. "typename": "System.Buffer",
  866. "assembly": "mscorlib"
  867. },
  868. {
  869. "typename": "System.Byte",
  870. "assembly": "mscorlib"
  871. },
  872. {
  873. "typename": "System.Char",
  874. "assembly": "mscorlib"
  875. },
  876. {
  877. "typename": "System.Collections.Generic.Dictionary`2",
  878. "assembly": "mscorlib"
  879. },
  880. {
  881. "typename": "System.Collections.IEnumerator",
  882. "assembly": "mscorlib"
  883. },
  884. {
  885. "typename": "System.Collections.ReadOnlyCollectionBase",
  886. "assembly": "mscorlib"
  887. },
  888. {
  889. "typename": "System.Convert",
  890. "assembly": "mscorlib"
  891. },
  892. {
  893. "typename": "System.Delegate",
  894. "assembly": "mscorlib"
  895. },
  896. {
  897. "typename": "System.Diagnostics.DebuggerDisplayAttribute",
  898. "assembly": "mscorlib"
  899. },
  900. {
  901. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  902. "assembly": "mscorlib"
  903. },
  904. {
  905. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  906. "assembly": "mscorlib"
  907. },
  908. {
  909. "typename": "System.Diagnostics.StackFrame",
  910. "assembly": "mscorlib"
  911. },
  912. {
  913. "typename": "System.Diagnostics.StackTrace",
  914. "assembly": "mscorlib"
  915. },
  916. {
  917. "typename": "System.Enum",
  918. "assembly": "mscorlib"
  919. },
  920. {
  921. "typename": "System.Exception",
  922. "assembly": "mscorlib"
  923. },
  924. {
  925. "typename": "System.FlagsAttribute",
  926. "assembly": "mscorlib"
  927. },
  928. {
  929. "typename": "System.FormatException",
  930. "assembly": "mscorlib"
  931. },
  932. {
  933. "typename": "System.GC",
  934. "assembly": "mscorlib"
  935. },
  936. {
  937. "typename": "System.Globalization.CultureInfo",
  938. "assembly": "mscorlib"
  939. },
  940. {
  941. "typename": "System.IAsyncResult",
  942. "assembly": "mscorlib"
  943. },
  944. {
  945. "typename": "System.IDisposable",
  946. "assembly": "mscorlib"
  947. },
  948. {
  949. "typename": "System.IO.Directory",
  950. "assembly": "mscorlib"
  951. },
  952. {
  953. "typename": "System.IO.DirectoryInfo",
  954. "assembly": "mscorlib"
  955. },
  956. {
  957. "typename": "System.IO.File",
  958. "assembly": "mscorlib"
  959. },
  960. {
  961. "typename": "System.IO.FileLoadException",
  962. "assembly": "mscorlib"
  963. },
  964. {
  965. "typename": "System.IO.FileStream",
  966. "assembly": "mscorlib"
  967. },
  968. {
  969. "typename": "System.IO.MemoryStream",
  970. "assembly": "mscorlib"
  971. },
  972. {
  973. "typename": "System.IO.Path",
  974. "assembly": "mscorlib"
  975. },
  976. {
  977. "typename": "System.IO.Stream",
  978. "assembly": "mscorlib"
  979. },
  980. {
  981. "typename": "System.Int16",
  982. "assembly": "mscorlib"
  983. },
  984. {
  985. "typename": "System.Int32",
  986. "assembly": "mscorlib"
  987. },
  988. {
  989. "typename": "System.IntPtr",
  990. "assembly": "mscorlib"
  991. },
  992. {
  993. "typename": "System.InvalidOperationException",
  994. "assembly": "mscorlib"
  995. },
  996. {
  997. "typename": "System.Math",
  998. "assembly": "mscorlib"
  999. },
  1000. {
  1001. "typename": "System.MulticastDelegate",
  1002. "assembly": "mscorlib"
  1003. },
  1004. {
  1005. "typename": "System.Object",
  1006. "assembly": "mscorlib"
  1007. },
  1008. {
  1009. "typename": "System.Reflection.Assembly",
  1010. "assembly": "mscorlib"
  1011. },
  1012. {
  1013. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  1014. "assembly": "mscorlib"
  1015. },
  1016. {
  1017. "typename": "System.Reflection.AssemblyName",
  1018. "assembly": "mscorlib"
  1019. },
  1020. {
  1021. "typename": "System.Reflection.MemberInfo",
  1022. "assembly": "mscorlib"
  1023. },
  1024. {
  1025. "typename": "System.Reflection.MethodBase",
  1026. "assembly": "mscorlib"
  1027. },
  1028. {
  1029. "typename": "System.Reflection.Module",
  1030. "assembly": "mscorlib"
  1031. },
  1032. {
  1033. "typename": "System.ResolveEventArgs",
  1034. "assembly": "mscorlib"
  1035. },
  1036. {
  1037. "typename": "System.ResolveEventHandler",
  1038. "assembly": "mscorlib"
  1039. },
  1040. {
  1041. "typename": "System.Resources.ResourceManager",
  1042. "assembly": "mscorlib"
  1043. },
  1044. {
  1045. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  1046. "assembly": "mscorlib"
  1047. },
  1048. {
  1049. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  1050. "assembly": "mscorlib"
  1051. },
  1052. {
  1053. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  1054. "assembly": "mscorlib"
  1055. },
  1056. {
  1057. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  1058. "assembly": "mscorlib"
  1059. },
  1060. {
  1061. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  1062. "assembly": "mscorlib"
  1063. },
  1064. {
  1065. "typename": "System.Runtime.InteropServices.Marshal",
  1066. "assembly": "mscorlib"
  1067. },
  1068. {
  1069. "typename": "System.RuntimeFieldHandle",
  1070. "assembly": "mscorlib"
  1071. },
  1072. {
  1073. "typename": "System.RuntimeTypeHandle",
  1074. "assembly": "mscorlib"
  1075. },
  1076. {
  1077. "typename": "System.STAThreadAttribute",
  1078. "assembly": "mscorlib"
  1079. },
  1080. {
  1081. "typename": "System.Security.Cryptography.CipherMode",
  1082. "assembly": "mscorlib"
  1083. },
  1084. {
  1085. "typename": "System.Security.Cryptography.CryptoStream",
  1086. "assembly": "mscorlib"
  1087. },
  1088. {
  1089. "typename": "System.Security.Cryptography.CryptoStreamMode",
  1090. "assembly": "mscorlib"
  1091. },
  1092. {
  1093. "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
  1094. "assembly": "mscorlib"
  1095. },
  1096. {
  1097. "typename": "System.Security.Cryptography.HashAlgorithm",
  1098. "assembly": "mscorlib"
  1099. },
  1100. {
  1101. "typename": "System.Security.Cryptography.ICryptoTransform",
  1102. "assembly": "mscorlib"
  1103. },
  1104. {
  1105. "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
  1106. "assembly": "mscorlib"
  1107. },
  1108. {
  1109. "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
  1110. "assembly": "mscorlib"
  1111. },
  1112. {
  1113. "typename": "System.Security.Cryptography.RijndaelManaged",
  1114. "assembly": "mscorlib"
  1115. },
  1116. {
  1117. "typename": "System.Security.Cryptography.SymmetricAlgorithm",
  1118. "assembly": "mscorlib"
  1119. },
  1120. {
  1121. "typename": "System.String",
  1122. "assembly": "mscorlib"
  1123. },
  1124. {
  1125. "typename": "System.Text.Encoding",
  1126. "assembly": "mscorlib"
  1127. },
  1128. {
  1129. "typename": "System.Text.StringBuilder",
  1130. "assembly": "mscorlib"
  1131. },
  1132. {
  1133. "typename": "System.Threading.Monitor",
  1134. "assembly": "mscorlib"
  1135. },
  1136. {
  1137. "typename": "System.Threading.Thread",
  1138. "assembly": "mscorlib"
  1139. },
  1140. {
  1141. "typename": "System.Threading.ThreadStart",
  1142. "assembly": "mscorlib"
  1143. },
  1144. {
  1145. "typename": "System.Type",
  1146. "assembly": "mscorlib"
  1147. },
  1148. {
  1149. "typename": "System.ValueType",
  1150. "assembly": "mscorlib"
  1151. },
  1152. {
  1153. "typename": "System.Version",
  1154. "assembly": "mscorlib"
  1155. }
  1156. ]
  1157. },
  1158. "pe": {
  1159. "peid_signatures": null,
  1160. "imports": [
  1161. {
  1162. "imports": [
  1163. {
  1164. "name": "_CorExeMain",
  1165. "address": "0x402000"
  1166. }
  1167. ],
  1168. "dll": "mscoree.dll"
  1169. }
  1170. ],
  1171. "digital_signers": null,
  1172. "exported_dll_name": null,
  1173. "actual_checksum": "0x000943fe",
  1174. "overlay": null,
  1175. "imagebase": "0x00400000",
  1176. "reported_checksum": "0x00000000",
  1177. "icon_hash": null,
  1178. "entrypoint": "0x0048c886",
  1179. "timestamp": "2019-07-01 09:34:21",
  1180. "osversion": "4.0",
  1181. "sections": [
  1182. {
  1183. "name": ".text",
  1184. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1185. "virtual_address": "0x00002000",
  1186. "size_of_data": "0x0008aa00",
  1187. "entropy": "7.96",
  1188. "raw_address": "0x00000200",
  1189. "virtual_size": "0x0008a88c",
  1190. "characteristics_raw": "0x60000020"
  1191. },
  1192. {
  1193. "name": ".rsrc",
  1194. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1195. "virtual_address": "0x0008e000",
  1196. "size_of_data": "0x00000400",
  1197. "entropy": "4.46",
  1198. "raw_address": "0x0008ac00",
  1199. "virtual_size": "0x00000394",
  1200. "characteristics_raw": "0x40000040"
  1201. },
  1202. {
  1203. "name": ".reloc",
  1204. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1205. "virtual_address": "0x00090000",
  1206. "size_of_data": "0x00000200",
  1207. "entropy": "0.10",
  1208. "raw_address": "0x0008b000",
  1209. "virtual_size": "0x0000000c",
  1210. "characteristics_raw": "0x42000040"
  1211. }
  1212. ],
  1213. "resources": [],
  1214. "dirents": [
  1215. {
  1216. "virtual_address": "0x00000000",
  1217. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1218. "size": "0x00000000"
  1219. },
  1220. {
  1221. "virtual_address": "0x0008c83c",
  1222. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1223. "size": "0x0000004a"
  1224. },
  1225. {
  1226. "virtual_address": "0x0008e000",
  1227. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1228. "size": "0x00000394"
  1229. },
  1230. {
  1231. "virtual_address": "0x00000000",
  1232. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1233. "size": "0x00000000"
  1234. },
  1235. {
  1236. "virtual_address": "0x00000000",
  1237. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1238. "size": "0x00000000"
  1239. },
  1240. {
  1241. "virtual_address": "0x00090000",
  1242. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1243. "size": "0x0000000c"
  1244. },
  1245. {
  1246. "virtual_address": "0x00000000",
  1247. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1248. "size": "0x00000000"
  1249. },
  1250. {
  1251. "virtual_address": "0x00000000",
  1252. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1253. "size": "0x00000000"
  1254. },
  1255. {
  1256. "virtual_address": "0x00000000",
  1257. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1258. "size": "0x00000000"
  1259. },
  1260. {
  1261. "virtual_address": "0x00000000",
  1262. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1263. "size": "0x00000000"
  1264. },
  1265. {
  1266. "virtual_address": "0x00000000",
  1267. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1268. "size": "0x00000000"
  1269. },
  1270. {
  1271. "virtual_address": "0x00000000",
  1272. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1273. "size": "0x00000000"
  1274. },
  1275. {
  1276. "virtual_address": "0x00002000",
  1277. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1278. "size": "0x00000008"
  1279. },
  1280. {
  1281. "virtual_address": "0x00000000",
  1282. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1283. "size": "0x00000000"
  1284. },
  1285. {
  1286. "virtual_address": "0x00002008",
  1287. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1288. "size": "0x00000048"
  1289. },
  1290. {
  1291. "virtual_address": "0x00000000",
  1292. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1293. "size": "0x00000000"
  1294. }
  1295. ],
  1296. "exports": [],
  1297. "guest_signers": {},
  1298. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1299. "icon_fuzzy": null,
  1300. "icon": null,
  1301. "pdbpath": null,
  1302. "imported_dll_count": 1,
  1303. "versioninfo": []
  1304. }
  1305. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!