API tools faq
paste
paladin316

NanoCore_5c5416c159ad621ee7df99a254409d30_exe_2019-07-03_16_30.json

paladin316
Jul 3rd, 2019
2,098
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.47 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "NanoCore_5c5416c159ad621ee7df99a254409d30.exe"
  7. [*] File Size: 569344
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "9c4c9a93070e1ccf92aba66ea57c161059f715f13584eca714b03ddff2df7eac"
  10. [*] MD5: "5c5416c159ad621ee7df99a254409d30"
  11. [*] SHA1: "b6dc7bce272a7b7235f1873e45b0802ebf08818f"
  12. [*] SHA512: "c71367e1a40752ed786556cb22ff1bb245bd71b0c430b38b44cd11d2c2b8fb0f9cd88427f2c913237dd295a8eeb23094457e253e3c6619d44b8ef356ad5ec10d"
  13. [*] CRC32: "7B6B6012"
  14. [*] SSDEEP: "12288:afn5Ss99JUIs7qxglU/AsIXr0/k+llKl:05Si9JUIGqxglUdI7IFllK"
  15.  
  16. [*] Process Execution: [
  17. "NanoCore_5c5416c159ad621ee7df99a254409d30.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "The binary likely contains encrypted or compressed data.",
  27. "Details": [
  28. {
  29. "section": "name: .text, entropy: 6.98, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00087000, virtual_size: 0x000869c4"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  35. "Details": [
  36. {
  37. "Spam": "NanoCore_5c5416c159ad621ee7df99a254409d30.exe (2236) called API CreateProcessInternalW 41505 times"
  38. }
  39. ]
  40. },
  41. {
  42. "Description": "File has been identified by 18 Antiviruses on VirusTotal as malicious",
  43. "Details": [
  44. {
  45. "FireEye": "Generic.mg.5c5416c159ad621e"
  46. },
  47. {
  48. "Cylance": "Unsafe"
  49. },
  50. {
  51. "CrowdStrike": "win/malicious_confidence_90% (D)"
  52. },
  53. {
  54. "F-Prot": "W32/VBKrypt.SB.gen!Eldorado"
  55. },
  56. {
  57. "APEX": "Malicious"
  58. },
  59. {
  60. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  61. },
  62. {
  63. "Paloalto": "generic.ml"
  64. },
  65. {
  66. "Endgame": "malicious (high confidence)"
  67. },
  68. {
  69. "DrWeb": "Trojan.PWS.Siggen2.20630"
  70. },
  71. {
  72. "Invincea": "heuristic"
  73. },
  74. {
  75. "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.hh"
  76. },
  77. {
  78. "Trapmine": "malicious.high.ml.score"
  79. },
  80. {
  81. "SentinelOne": "DFI - Malicious PE"
  82. },
  83. {
  84. "Cyren": "W32/VBKrypt.SB.gen!Eldorado"
  85. },
  86. {
  87. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  88. },
  89. {
  90. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  91. },
  92. {
  93. "AVG": "FileRepMalware"
  94. },
  95. {
  96. "Cybereason": "malicious.e272a7"
  97. }
  98. ]
  99. }
  100. ]
  101.  
  102. [*] Started Service: []
  103.  
  104. [*] Executed Commands: [
  105. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\NanoCore_5c5416c159ad621ee7df99a254409d30.exe\""
  106. ]
  107.  
  108. [*] Mutexes: []
  109.  
  110. [*] Modified Files: []
  111.  
  112. [*] Deleted Files: []
  113.  
  114. [*] Modified Registry Keys: []
  115.  
  116. [*] Deleted Registry Keys: []
  117.  
  118. [*] DNS Communications: []
  119.  
  120. [*] Domains: []
  121.  
  122. [*] Network Communication - ICMP: []
  123.  
  124. [*] Network Communication - HTTP: []
  125.  
  126. [*] Network Communication - SMTP: []
  127.  
  128. [*] Network Communication - Hosts: []
  129.  
  130. [*] Network Communication - IRC: []
  131.  
  132. [*] Static Analysis: {
  133. "pe": {
  134. "peid_signatures": null,
  135. "imports": [
  136. {
  137. "imports": [
  138. {
  139. "name": null,
  140. "address": "0x401000"
  141. },
  142. {
  143. "name": null,
  144. "address": "0x401004"
  145. },
  146. {
  147. "name": "MethCallEngine",
  148. "address": "0x401008"
  149. },
  150. {
  151. "name": null,
  152. "address": "0x40100c"
  153. },
  154. {
  155. "name": null,
  156. "address": "0x401010"
  157. },
  158. {
  159. "name": null,
  160. "address": "0x401014"
  161. },
  162. {
  163. "name": null,
  164. "address": "0x401018"
  165. },
  166. {
  167. "name": null,
  168. "address": "0x40101c"
  169. },
  170. {
  171. "name": null,
  172. "address": "0x401020"
  173. },
  174. {
  175. "name": null,
  176. "address": "0x401024"
  177. },
  178. {
  179. "name": null,
  180. "address": "0x401028"
  181. },
  182. {
  183. "name": null,
  184. "address": "0x40102c"
  185. },
  186. {
  187. "name": "EVENT_SINK_AddRef",
  188. "address": "0x401030"
  189. },
  190. {
  191. "name": null,
  192. "address": "0x401034"
  193. },
  194. {
  195. "name": null,
  196. "address": "0x401038"
  197. },
  198. {
  199. "name": null,
  200. "address": "0x40103c"
  201. },
  202. {
  203. "name": null,
  204. "address": "0x401040"
  205. },
  206. {
  207. "name": null,
  208. "address": "0x401044"
  209. },
  210. {
  211. "name": null,
  212. "address": "0x401048"
  213. },
  214. {
  215. "name": null,
  216. "address": "0x40104c"
  217. },
  218. {
  219. "name": "EVENT_SINK_Release",
  220. "address": "0x401050"
  221. },
  222. {
  223. "name": null,
  224. "address": "0x401054"
  225. },
  226. {
  227. "name": null,
  228. "address": "0x401058"
  229. },
  230. {
  231. "name": "EVENT_SINK_QueryInterface",
  232. "address": "0x40105c"
  233. },
  234. {
  235. "name": "__vbaExceptHandler",
  236. "address": "0x401060"
  237. },
  238. {
  239. "name": null,
  240. "address": "0x401064"
  241. },
  242. {
  243. "name": null,
  244. "address": "0x401068"
  245. },
  246. {
  247. "name": null,
  248. "address": "0x40106c"
  249. },
  250. {
  251. "name": null,
  252. "address": "0x401070"
  253. },
  254. {
  255. "name": null,
  256. "address": "0x401074"
  257. },
  258. {
  259. "name": null,
  260. "address": "0x401078"
  261. },
  262. {
  263. "name": null,
  264. "address": "0x40107c"
  265. },
  266. {
  267. "name": null,
  268. "address": "0x401080"
  269. },
  270. {
  271. "name": null,
  272. "address": "0x401084"
  273. },
  274. {
  275. "name": null,
  276. "address": "0x401088"
  277. },
  278. {
  279. "name": null,
  280. "address": "0x40108c"
  281. },
  282. {
  283. "name": null,
  284. "address": "0x401090"
  285. },
  286. {
  287. "name": null,
  288. "address": "0x401094"
  289. },
  290. {
  291. "name": null,
  292. "address": "0x401098"
  293. },
  294. {
  295. "name": null,
  296. "address": "0x40109c"
  297. },
  298. {
  299. "name": null,
  300. "address": "0x4010a0"
  301. },
  302. {
  303. "name": null,
  304. "address": "0x4010a4"
  305. }
  306. ],
  307. "dll": "MSVBVM60.DLL"
  308. }
  309. ],
  310. "digital_signers": null,
  311. "exported_dll_name": null,
  312. "actual_checksum": "0x00097633",
  313. "overlay": null,
  314. "imagebase": "0x00400000",
  315. "reported_checksum": "0x00097633",
  316. "icon_hash": null,
  317. "entrypoint": "0x004011ac",
  318. "timestamp": "2019-07-03 07:00:05",
  319. "osversion": "4.0",
  320. "sections": [
  321. {
  322. "name": ".text",
  323. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  324. "virtual_address": "0x00001000",
  325. "size_of_data": "0x00087000",
  326. "entropy": "6.98",
  327. "raw_address": "0x00001000",
  328. "virtual_size": "0x000869c4",
  329. "characteristics_raw": "0x60000020"
  330. },
  331. {
  332. "name": ".data",
  333. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  334. "virtual_address": "0x00088000",
  335. "size_of_data": "0x00000000",
  336. "entropy": "0.00",
  337. "raw_address": "0x00000000",
  338. "virtual_size": "0x00002fc4",
  339. "characteristics_raw": "0xc0000040"
  340. },
  341. {
  342. "name": ".rsrc",
  343. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  344. "virtual_address": "0x0008b000",
  345. "size_of_data": "0x00003000",
  346. "entropy": "4.44",
  347. "raw_address": "0x00088000",
  348. "virtual_size": "0x00002eb4",
  349. "characteristics_raw": "0x40000040"
  350. }
  351. ],
  352. "resources": [],
  353. "dirents": [
  354. {
  355. "virtual_address": "0x00000000",
  356. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  357. "size": "0x00000000"
  358. },
  359. {
  360. "virtual_address": "0x00087874",
  361. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  362. "size": "0x00000028"
  363. },
  364. {
  365. "virtual_address": "0x0008b000",
  366. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  367. "size": "0x00002eb4"
  368. },
  369. {
  370. "virtual_address": "0x00000000",
  371. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  372. "size": "0x00000000"
  373. },
  374. {
  375. "virtual_address": "0x00000000",
  376. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  377. "size": "0x00000000"
  378. },
  379. {
  380. "virtual_address": "0x00000000",
  381. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  382. "size": "0x00000000"
  383. },
  384. {
  385. "virtual_address": "0x00000000",
  386. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  387. "size": "0x00000000"
  388. },
  389. {
  390. "virtual_address": "0x00000000",
  391. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  392. "size": "0x00000000"
  393. },
  394. {
  395. "virtual_address": "0x00000000",
  396. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  397. "size": "0x00000000"
  398. },
  399. {
  400. "virtual_address": "0x00000000",
  401. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  402. "size": "0x00000000"
  403. },
  404. {
  405. "virtual_address": "0x00000000",
  406. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  407. "size": "0x00000000"
  408. },
  409. {
  410. "virtual_address": "0x00000220",
  411. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  412. "size": "0x00000020"
  413. },
  414. {
  415. "virtual_address": "0x00001000",
  416. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  417. "size": "0x000000ac"
  418. },
  419. {
  420. "virtual_address": "0x00000000",
  421. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  422. "size": "0x00000000"
  423. },
  424. {
  425. "virtual_address": "0x00000000",
  426. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  427. "size": "0x00000000"
  428. },
  429. {
  430. "virtual_address": "0x00000000",
  431. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  432. "size": "0x00000000"
  433. }
  434. ],
  435. "exports": [],
  436. "guest_signers": {},
  437. "imphash": "67ee17dfc1cccc33fe61aab671311a70",
  438. "icon_fuzzy": null,
  439. "icon": null,
  440. "pdbpath": null,
  441. "imported_dll_count": 1,
  442. "versioninfo": []
  443. }
  444. }
  445.  
  446. [*] Resolved APIs: [
  447. "cryptbase.dll.SystemFunction036",
  448. "uxtheme.dll.ThemeInitApiHook",
  449. "user32.dll.IsProcessDPIAware",
  450. "oleaut32.dll.OleLoadPictureEx",
  451. "oleaut32.dll.DispCallFunc",
  452. "oleaut32.dll.LoadTypeLibEx",
  453. "oleaut32.dll.UnRegisterTypeLib",
  454. "oleaut32.dll.CreateTypeLib2",
  455. "oleaut32.dll.VarDateFromUdate",
  456. "oleaut32.dll.VarUdateFromDate",
  457. "oleaut32.dll.GetAltMonthNames",
  458. "oleaut32.dll.VarNumFromParseNum",
  459. "oleaut32.dll.VarParseNumFromStr",
  460. "oleaut32.dll.VarDecFromR4",
  461. "oleaut32.dll.VarDecFromR8",
  462. "oleaut32.dll.VarDecFromDate",
  463. "oleaut32.dll.VarDecFromI4",
  464. "oleaut32.dll.VarDecFromCy",
  465. "oleaut32.dll.VarR4FromDec",
  466. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  467. "oleaut32.dll.GetRecordInfoFromGuids",
  468. "oleaut32.dll.SafeArrayGetRecordInfo",
  469. "oleaut32.dll.SafeArraySetRecordInfo",
  470. "oleaut32.dll.SafeArrayGetIID",
  471. "oleaut32.dll.SafeArraySetIID",
  472. "oleaut32.dll.SafeArrayCopyData",
  473. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  474. "oleaut32.dll.SafeArrayCreateEx",
  475. "oleaut32.dll.VarFormat",
  476. "oleaut32.dll.VarFormatDateTime",
  477. "oleaut32.dll.VarFormatNumber",
  478. "oleaut32.dll.VarFormatPercent",
  479. "oleaut32.dll.VarFormatCurrency",
  480. "oleaut32.dll.VarWeekdayName",
  481. "oleaut32.dll.VarMonthName",
  482. "oleaut32.dll.VarAdd",
  483. "oleaut32.dll.VarAnd",
  484. "oleaut32.dll.VarCat",
  485. "oleaut32.dll.VarDiv",
  486. "oleaut32.dll.VarEqv",
  487. "oleaut32.dll.VarIdiv",
  488. "oleaut32.dll.VarImp",
  489. "oleaut32.dll.VarMod",
  490. "oleaut32.dll.VarMul",
  491. "oleaut32.dll.VarOr",
  492. "oleaut32.dll.VarPow",
  493. "oleaut32.dll.VarSub",
  494. "oleaut32.dll.VarXor",
  495. "oleaut32.dll.VarAbs",
  496. "oleaut32.dll.VarFix",
  497. "oleaut32.dll.VarInt",
  498. "oleaut32.dll.VarNeg",
  499. "oleaut32.dll.VarNot",
  500. "oleaut32.dll.VarRound",
  501. "oleaut32.dll.VarCmp",
  502. "oleaut32.dll.VarDecAdd",
  503. "oleaut32.dll.VarDecCmp",
  504. "oleaut32.dll.VarBstrCat",
  505. "oleaut32.dll.VarCyMulI4",
  506. "oleaut32.dll.VarBstrCmp",
  507. "ole32.dll.CoCreateInstanceEx",
  508. "ole32.dll.CLSIDFromProgIDEx",
  509. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  510. "user32.dll.GetSystemMetrics",
  511. "user32.dll.MonitorFromWindow",
  512. "user32.dll.MonitorFromRect",
  513. "user32.dll.MonitorFromPoint",
  514. "user32.dll.EnumDisplayMonitors",
  515. "user32.dll.GetMonitorInfoA",
  516. "dwmapi.dll.DwmIsCompositionEnabled",
  517. "gdi32.dll.GetLayout",
  518. "gdi32.dll.GdiRealizationInfo",
  519. "gdi32.dll.FontIsLinked",
  520. "advapi32.dll.RegOpenKeyExW",
  521. "advapi32.dll.RegQueryInfoKeyW",
  522. "gdi32.dll.GetTextFaceAliasW",
  523. "advapi32.dll.RegEnumValueW",
  524. "advapi32.dll.RegCloseKey",
  525. "advapi32.dll.RegQueryValueExW",
  526. "gdi32.dll.GetFontAssocStatus",
  527. "advapi32.dll.RegQueryValueExA",
  528. "advapi32.dll.RegEnumKeyExW",
  529. "gdi32.dll.GdiIsMetaPrintDC",
  530. "kernel32.dll.NlsGetCacheUpdateCount",
  531. "kernel32.dll.GetCalendarInfoW",
  532. "kernel32.dll.GetTickCount",
  533. "kernel32.dll.Sleep",
  534. "user32.dll.GetCursorPos",
  535. "user32.dll.EnumWindows",
  536. "kernel32.dll.SetErrorMode",
  537. "kernel32.dll.SetLastError",
  538. "kernel32.dll.VirtualAllocEx",
  539. "kernel32.dll.CloseHandle",
  540. "shell32.dll.ShellExecuteW",
  541. "kernel32.dll.WriteFile",
  542. "kernel32.dll.UnmapViewOfFile",
  543. "kernel32.dll.CreateFileW",
  544. "kernel32.dll.TerminateProcess",
  545. "kernel32.dll.VirtualProtectEx",
  546. "kernel32.dll.CreateProcessInternalW",
  547. "kernel32.dll.GetTempPathW",
  548. "kernel32.dll.GetLongPathNameW",
  549. "kernel32.dll.GetFileSize",
  550. "kernel32.dll.ReadFile",
  551. "ntdll.dll.NtProtectVirtualMemory",
  552. "kernel32.dll.GetCommandLineW"
  553. ]
  554.  
  555. [*] Static Analysis: {
  556. "pe": {
  557. "peid_signatures": null,
  558. "imports": [
  559. {
  560. "imports": [
  561. {
  562. "name": null,
  563. "address": "0x401000"
  564. },
  565. {
  566. "name": null,
  567. "address": "0x401004"
  568. },
  569. {
  570. "name": "MethCallEngine",
  571. "address": "0x401008"
  572. },
  573. {
  574. "name": null,
  575. "address": "0x40100c"
  576. },
  577. {
  578. "name": null,
  579. "address": "0x401010"
  580. },
  581. {
  582. "name": null,
  583. "address": "0x401014"
  584. },
  585. {
  586. "name": null,
  587. "address": "0x401018"
  588. },
  589. {
  590. "name": null,
  591. "address": "0x40101c"
  592. },
  593. {
  594. "name": null,
  595. "address": "0x401020"
  596. },
  597. {
  598. "name": null,
  599. "address": "0x401024"
  600. },
  601. {
  602. "name": null,
  603. "address": "0x401028"
  604. },
  605. {
  606. "name": null,
  607. "address": "0x40102c"
  608. },
  609. {
  610. "name": "EVENT_SINK_AddRef",
  611. "address": "0x401030"
  612. },
  613. {
  614. "name": null,
  615. "address": "0x401034"
  616. },
  617. {
  618. "name": null,
  619. "address": "0x401038"
  620. },
  621. {
  622. "name": null,
  623. "address": "0x40103c"
  624. },
  625. {
  626. "name": null,
  627. "address": "0x401040"
  628. },
  629. {
  630. "name": null,
  631. "address": "0x401044"
  632. },
  633. {
  634. "name": null,
  635. "address": "0x401048"
  636. },
  637. {
  638. "name": null,
  639. "address": "0x40104c"
  640. },
  641. {
  642. "name": "EVENT_SINK_Release",
  643. "address": "0x401050"
  644. },
  645. {
  646. "name": null,
  647. "address": "0x401054"
  648. },
  649. {
  650. "name": null,
  651. "address": "0x401058"
  652. },
  653. {
  654. "name": "EVENT_SINK_QueryInterface",
  655. "address": "0x40105c"
  656. },
  657. {
  658. "name": "__vbaExceptHandler",
  659. "address": "0x401060"
  660. },
  661. {
  662. "name": null,
  663. "address": "0x401064"
  664. },
  665. {
  666. "name": null,
  667. "address": "0x401068"
  668. },
  669. {
  670. "name": null,
  671. "address": "0x40106c"
  672. },
  673. {
  674. "name": null,
  675. "address": "0x401070"
  676. },
  677. {
  678. "name": null,
  679. "address": "0x401074"
  680. },
  681. {
  682. "name": null,
  683. "address": "0x401078"
  684. },
  685. {
  686. "name": null,
  687. "address": "0x40107c"
  688. },
  689. {
  690. "name": null,
  691. "address": "0x401080"
  692. },
  693. {
  694. "name": null,
  695. "address": "0x401084"
  696. },
  697. {
  698. "name": null,
  699. "address": "0x401088"
  700. },
  701. {
  702. "name": null,
  703. "address": "0x40108c"
  704. },
  705. {
  706. "name": null,
  707. "address": "0x401090"
  708. },
  709. {
  710. "name": null,
  711. "address": "0x401094"
  712. },
  713. {
  714. "name": null,
  715. "address": "0x401098"
  716. },
  717. {
  718. "name": null,
  719. "address": "0x40109c"
  720. },
  721. {
  722. "name": null,
  723. "address": "0x4010a0"
  724. },
  725. {
  726. "name": null,
  727. "address": "0x4010a4"
  728. }
  729. ],
  730. "dll": "MSVBVM60.DLL"
  731. }
  732. ],
  733. "digital_signers": null,
  734. "exported_dll_name": null,
  735. "actual_checksum": "0x00097633",
  736. "overlay": null,
  737. "imagebase": "0x00400000",
  738. "reported_checksum": "0x00097633",
  739. "icon_hash": null,
  740. "entrypoint": "0x004011ac",
  741. "timestamp": "2019-07-03 07:00:05",
  742. "osversion": "4.0",
  743. "sections": [
  744. {
  745. "name": ".text",
  746. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  747. "virtual_address": "0x00001000",
  748. "size_of_data": "0x00087000",
  749. "entropy": "6.98",
  750. "raw_address": "0x00001000",
  751. "virtual_size": "0x000869c4",
  752. "characteristics_raw": "0x60000020"
  753. },
  754. {
  755. "name": ".data",
  756. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  757. "virtual_address": "0x00088000",
  758. "size_of_data": "0x00000000",
  759. "entropy": "0.00",
  760. "raw_address": "0x00000000",
  761. "virtual_size": "0x00002fc4",
  762. "characteristics_raw": "0xc0000040"
  763. },
  764. {
  765. "name": ".rsrc",
  766. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  767. "virtual_address": "0x0008b000",
  768. "size_of_data": "0x00003000",
  769. "entropy": "4.44",
  770. "raw_address": "0x00088000",
  771. "virtual_size": "0x00002eb4",
  772. "characteristics_raw": "0x40000040"
  773. }
  774. ],
  775. "resources": [],
  776. "dirents": [
  777. {
  778. "virtual_address": "0x00000000",
  779. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  780. "size": "0x00000000"
  781. },
  782. {
  783. "virtual_address": "0x00087874",
  784. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  785. "size": "0x00000028"
  786. },
  787. {
  788. "virtual_address": "0x0008b000",
  789. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  790. "size": "0x00002eb4"
  791. },
  792. {
  793. "virtual_address": "0x00000000",
  794. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  795. "size": "0x00000000"
  796. },
  797. {
  798. "virtual_address": "0x00000000",
  799. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  800. "size": "0x00000000"
  801. },
  802. {
  803. "virtual_address": "0x00000000",
  804. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  805. "size": "0x00000000"
  806. },
  807. {
  808. "virtual_address": "0x00000000",
  809. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  810. "size": "0x00000000"
  811. },
  812. {
  813. "virtual_address": "0x00000000",
  814. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  815. "size": "0x00000000"
  816. },
  817. {
  818. "virtual_address": "0x00000000",
  819. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  820. "size": "0x00000000"
  821. },
  822. {
  823. "virtual_address": "0x00000000",
  824. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  825. "size": "0x00000000"
  826. },
  827. {
  828. "virtual_address": "0x00000000",
  829. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  830. "size": "0x00000000"
  831. },
  832. {
  833. "virtual_address": "0x00000220",
  834. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  835. "size": "0x00000020"
  836. },
  837. {
  838. "virtual_address": "0x00001000",
  839. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  840. "size": "0x000000ac"
  841. },
  842. {
  843. "virtual_address": "0x00000000",
  844. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  845. "size": "0x00000000"
  846. },
  847. {
  848. "virtual_address": "0x00000000",
  849. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  850. "size": "0x00000000"
  851. },
  852. {
  853. "virtual_address": "0x00000000",
  854. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  855. "size": "0x00000000"
  856. }
  857. ],
  858. "exports": [],
  859. "guest_signers": {},
  860. "imphash": "67ee17dfc1cccc33fe61aab671311a70",
  861. "icon_fuzzy": null,
  862. "icon": null,
  863. "pdbpath": null,
  864. "imported_dll_count": 1,
  865. "versioninfo": []
  866. }
  867. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!