API tools faq
paste
paladin316

Exes_6aee8c2c9585d6e07c18ed59693b1fd1_exe_2019-06-27_15_30.json

paladin316
Jun 27th, 2019
2,138
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 24.38 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Agentb"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_6aee8c2c9585d6e07c18ed59693b1fd1.exe"
  7. [*] File Size: 2885120
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  9. [*] SHA256: "69c40f971402945d188a66e1fd9117965fd7c11af71514e3f8152a9c873b600d"
  10. [*] MD5: "6aee8c2c9585d6e07c18ed59693b1fd1"
  11. [*] SHA1: "f9da300e659ddff37cf9a9817dcecc23f8b82d62"
  12. [*] SHA512: "305dc30830839afb59b1fb4e4f9812f8ebab4e7671154c49e8661ed92a9b84d01d2ef18e2e5fc5d2d8843d23a599c809d1903320f245d3481921c8fee7a4a7d5"
  13. [*] CRC32: "FB52FB94"
  14. [*] SSDEEP: "49152:PizVll+0cxQBMnTdSd/tSGBc8E2vR/LdJkWUaETt9cUMSrVL3zJV1BF:PoSQBodw/oQcozdJkWUjtmUMSrVB"
  15.  
  16. [*] Process Execution: [
  17. "Exes_6aee8c2c9585d6e07c18ed59693b1fd1.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: UPX1, entropy: 7.88, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x002c0200, virtual_size: 0x002c1000"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "The executable is compressed using UPX",
  31. "Details": [
  32. {
  33. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x003d6000"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "File has been identified by 48 Antiviruses on VirusTotal as malicious",
  39. "Details": [
  40. {
  41. "MicroWorld-eScan": "Trojan.GenericKD.31995583"
  42. },
  43. {
  44. "CAT-QuickHeal": "Trojan.Zpevdo"
  45. },
  46. {
  47. "ALYac": "Trojan.GenericKD.31995583"
  48. },
  49. {
  50. "Alibaba": "TrojanPSW:Win32/Generic.527f4f81"
  51. },
  52. {
  53. "K7GW": "Password-Stealer ( 0054bdb01 )"
  54. },
  55. {
  56. "K7AntiVirus": "Password-Stealer ( 0054bdb01 )"
  57. },
  58. {
  59. "Arcabit": "Trojan.Generic.D1E836BF"
  60. },
  61. {
  62. "TrendMicro": "TROJ_FRS.0NA103EL19"
  63. },
  64. {
  65. "NANO-Antivirus": "Trojan.Win32.SpyBot.fratoo"
  66. },
  67. {
  68. "Cyren": "W32/Zbot.GH.gen!Eldorado"
  69. },
  70. {
  71. "Symantec": "Trojan.Gen.MBT"
  72. },
  73. {
  74. "Paloalto": "generic.ml"
  75. },
  76. {
  77. "Kaspersky": "Trojan.Win32.Agentb.jpnr"
  78. },
  79. {
  80. "BitDefender": "Trojan.GenericKD.31995583"
  81. },
  82. {
  83. "Avast": "Win32:Trojan-gen"
  84. },
  85. {
  86. "Rising": "Stealer.Agent!8.C2 (CLOUD)"
  87. },
  88. {
  89. "Ad-Aware": "Trojan.GenericKD.31995583"
  90. },
  91. {
  92. "Emsisoft": "Trojan.GenericKD.31995583 (B)"
  93. },
  94. {
  95. "Comodo": "Malware@#2ulkivmkav7a4"
  96. },
  97. {
  98. "DrWeb": "Trojan.SpyBot.795"
  99. },
  100. {
  101. "Zillya": "Trojan.Agent.Win32.1096976"
  102. },
  103. {
  104. "McAfee-GW-Edition": "BehavesLike.Win32.Trojan.vc"
  105. },
  106. {
  107. "FireEye": "Trojan.GenericKD.31995583"
  108. },
  109. {
  110. "Sophos": "Mal/Generic-S"
  111. },
  112. {
  113. "Ikarus": "Trojan-PSW.Agent"
  114. },
  115. {
  116. "F-Prot": "W32/Zbot.GH.gen!Eldorado"
  117. },
  118. {
  119. "Jiangmin": "Trojan.Agentb.euh"
  120. },
  121. {
  122. "Avira": "TR/PSW.Agent.bfgai"
  123. },
  124. {
  125. "Antiy-AVL": "Trojan/Win32.Tiggre"
  126. },
  127. {
  128. "Microsoft": "Trojan:Win32/Skeeyah.A!bit"
  129. },
  130. {
  131. "AegisLab": "Trojan.Win32.Agentb.4!c"
  132. },
  133. {
  134. "ZoneAlarm": "Trojan.Win32.Agentb.jpnr"
  135. },
  136. {
  137. "GData": "Win32.Trojan.Agent.OJ6TNS"
  138. },
  139. {
  140. "McAfee": "Artemis!6AEE8C2C9585"
  141. },
  142. {
  143. "VBA32": "Trojan.Agentb"
  144. },
  145. {
  146. "Cylance": "Unsafe"
  147. },
  148. {
  149. "ESET-NOD32": "a variant of Win32/PSW.Agent.OGL"
  150. },
  151. {
  152. "TrendMicro-HouseCall": "TROJ_FRS.0NA103EL19"
  153. },
  154. {
  155. "Tencent": "Win32.Trojan.Agentb.Wsuo"
  156. },
  157. {
  158. "Yandex": "Trojan.PWS.Agent!o8mmBlfGwKE"
  159. },
  160. {
  161. "MaxSecure": "Trojan.Malware.74347372.susgen"
  162. },
  163. {
  164. "Fortinet": "W32/Agent.OGL!tr"
  165. },
  166. {
  167. "Webroot": "W32.Trojan.Gen"
  168. },
  169. {
  170. "AVG": "Win32:Trojan-gen"
  171. },
  172. {
  173. "Cybereason": "malicious.c9585d"
  174. },
  175. {
  176. "Panda": "Trj/GdSda.A"
  177. },
  178. {
  179. "CrowdStrike": "win/malicious_confidence_100% (W)"
  180. },
  181. {
  182. "Qihoo-360": "HEUR/QVM11.1.4E0F.Malware.Gen"
  183. }
  184. ]
  185. }
  186. ]
  187.  
  188. [*] Started Service: []
  189.  
  190. [*] Executed Commands: []
  191.  
  192. [*] Mutexes: []
  193.  
  194. [*] Modified Files: []
  195.  
  196. [*] Deleted Files: []
  197.  
  198. [*] Modified Registry Keys: []
  199.  
  200. [*] Deleted Registry Keys: []
  201.  
  202. [*] DNS Communications: []
  203.  
  204. [*] Domains: []
  205.  
  206. [*] Network Communication - ICMP: []
  207.  
  208. [*] Network Communication - HTTP: []
  209.  
  210. [*] Network Communication - SMTP: []
  211.  
  212. [*] Network Communication - Hosts: []
  213.  
  214. [*] Network Communication - IRC: []
  215.  
  216. [*] Static Analysis: {
  217. "pe": {
  218. "peid_signatures": null,
  219. "imports": [
  220. {
  221. "imports": [
  222. {
  223. "name": "LoadLibraryA",
  224. "address": "0xa9803c"
  225. },
  226. {
  227. "name": "GetProcAddress",
  228. "address": "0xa98040"
  229. },
  230. {
  231. "name": "VirtualProtect",
  232. "address": "0xa98044"
  233. },
  234. {
  235. "name": "VirtualAlloc",
  236. "address": "0xa98048"
  237. },
  238. {
  239. "name": "VirtualFree",
  240. "address": "0xa9804c"
  241. },
  242. {
  243. "name": "ExitProcess",
  244. "address": "0xa98050"
  245. }
  246. ],
  247. "dll": "KERNEL32.DLL"
  248. },
  249. {
  250. "imports": [
  251. {
  252. "name": "_iob",
  253. "address": "0xa98058"
  254. }
  255. ],
  256. "dll": "msvcrt.dll"
  257. }
  258. ],
  259. "digital_signers": null,
  260. "exported_dll_name": null,
  261. "actual_checksum": "0x002cc9b4",
  262. "overlay": null,
  263. "imagebase": "0x00400000",
  264. "reported_checksum": "0x00000000",
  265. "icon_hash": null,
  266. "entrypoint": "0x00a96f80",
  267. "timestamp": "2019-05-20 06:13:33",
  268. "osversion": "4.0",
  269. "sections": [
  270. {
  271. "name": "UPX0",
  272. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  273. "virtual_address": "0x00001000",
  274. "size_of_data": "0x00000000",
  275. "entropy": "0.00",
  276. "raw_address": "0x00000200",
  277. "virtual_size": "0x003d6000",
  278. "characteristics_raw": "0xe0000080"
  279. },
  280. {
  281. "name": "UPX1",
  282. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  283. "virtual_address": "0x003d7000",
  284. "size_of_data": "0x002c0200",
  285. "entropy": "7.88",
  286. "raw_address": "0x00000200",
  287. "virtual_size": "0x002c1000",
  288. "characteristics_raw": "0xe0000040"
  289. },
  290. {
  291. "name": "UPX2",
  292. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  293. "virtual_address": "0x00698000",
  294. "size_of_data": "0x00000200",
  295. "entropy": "2.38",
  296. "raw_address": "0x002c0400",
  297. "virtual_size": "0x00001000",
  298. "characteristics_raw": "0xc0000040"
  299. }
  300. ],
  301. "resources": [],
  302. "dirents": [
  303. {
  304. "virtual_address": "0x00000000",
  305. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  306. "size": "0x00000000"
  307. },
  308. {
  309. "virtual_address": "0x00698000",
  310. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  311. "size": "0x000000d8"
  312. },
  313. {
  314. "virtual_address": "0x00000000",
  315. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  316. "size": "0x00000000"
  317. },
  318. {
  319. "virtual_address": "0x00000000",
  320. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  321. "size": "0x00000000"
  322. },
  323. {
  324. "virtual_address": "0x00000000",
  325. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  326. "size": "0x00000000"
  327. },
  328. {
  329. "virtual_address": "0x006980d8",
  330. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  331. "size": "0x00000020"
  332. },
  333. {
  334. "virtual_address": "0x00000000",
  335. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  336. "size": "0x00000000"
  337. },
  338. {
  339. "virtual_address": "0x00000000",
  340. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  341. "size": "0x00000000"
  342. },
  343. {
  344. "virtual_address": "0x00000000",
  345. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  346. "size": "0x00000000"
  347. },
  348. {
  349. "virtual_address": "0x00697170",
  350. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  351. "size": "0x00000018"
  352. },
  353. {
  354. "virtual_address": "0x00000000",
  355. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  356. "size": "0x00000000"
  357. },
  358. {
  359. "virtual_address": "0x00000000",
  360. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  361. "size": "0x00000000"
  362. },
  363. {
  364. "virtual_address": "0x00000000",
  365. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  366. "size": "0x00000000"
  367. },
  368. {
  369. "virtual_address": "0x00000000",
  370. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  371. "size": "0x00000000"
  372. },
  373. {
  374. "virtual_address": "0x00000000",
  375. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  376. "size": "0x00000000"
  377. },
  378. {
  379. "virtual_address": "0x00000000",
  380. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  381. "size": "0x00000000"
  382. }
  383. ],
  384. "exports": [],
  385. "guest_signers": {},
  386. "imphash": "4bfd1be901a4c0d571291552b2d7a34c",
  387. "icon_fuzzy": null,
  388. "icon": null,
  389. "pdbpath": null,
  390. "imported_dll_count": 2,
  391. "versioninfo": []
  392. }
  393. }
  394.  
  395. [*] Resolved APIs: [
  396. "kernel32.dll.AddVectoredExceptionHandler",
  397. "kernel32.dll.AreFileApisANSI",
  398. "kernel32.dll.CloseHandle",
  399. "kernel32.dll.CreateEventA",
  400. "kernel32.dll.CreateFileA",
  401. "kernel32.dll.CreateFileMappingA",
  402. "kernel32.dll.CreateFileMappingW",
  403. "kernel32.dll.CreateFileW",
  404. "kernel32.dll.CreateIoCompletionPort",
  405. "kernel32.dll.CreateMutexW",
  406. "kernel32.dll.CreateThread",
  407. "kernel32.dll.CreateWaitableTimerA",
  408. "kernel32.dll.DeleteCriticalSection",
  409. "kernel32.dll.DeleteFileA",
  410. "kernel32.dll.DeleteFileW",
  411. "kernel32.dll.DuplicateHandle",
  412. "kernel32.dll.EnterCriticalSection",
  413. "kernel32.dll.ExitProcess",
  414. "kernel32.dll.FlushFileBuffers",
  415. "kernel32.dll.FlushViewOfFile",
  416. "kernel32.dll.FormatMessageA",
  417. "kernel32.dll.FormatMessageW",
  418. "kernel32.dll.FreeEnvironmentStringsW",
  419. "kernel32.dll.FreeLibrary",
  420. "kernel32.dll.GetConsoleMode",
  421. "kernel32.dll.GetCurrentProcess",
  422. "kernel32.dll.GetCurrentProcessId",
  423. "kernel32.dll.GetCurrentThreadId",
  424. "kernel32.dll.GetDiskFreeSpaceA",
  425. "kernel32.dll.GetDiskFreeSpaceW",
  426. "kernel32.dll.GetEnvironmentStringsW",
  427. "kernel32.dll.GetFileAttributesA",
  428. "kernel32.dll.GetFileAttributesExW",
  429. "kernel32.dll.GetFileAttributesW",
  430. "kernel32.dll.GetFileSize",
  431. "kernel32.dll.GetFullPathNameA",
  432. "kernel32.dll.GetFullPathNameW",
  433. "kernel32.dll.GetLastError",
  434. "kernel32.dll.GetModuleHandleA",
  435. "kernel32.dll.GetProcAddress",
  436. "kernel32.dll.GetProcessAffinityMask",
  437. "kernel32.dll.GetProcessHeap",
  438. "kernel32.dll.GetQueuedCompletionStatus",
  439. "kernel32.dll.GetStartupInfoA",
  440. "kernel32.dll.GetStdHandle",
  441. "kernel32.dll.GetSystemDirectoryA",
  442. "kernel32.dll.GetSystemInfo",
  443. "kernel32.dll.GetSystemTime",
  444. "kernel32.dll.GetSystemTimeAsFileTime",
  445. "kernel32.dll.GetTempPathA",
  446. "kernel32.dll.GetTempPathW",
  447. "kernel32.dll.GetTickCount",
  448. "kernel32.dll.GetVersionExA",
  449. "kernel32.dll.GetVersionExW",
  450. "kernel32.dll.HeapAlloc",
  451. "kernel32.dll.HeapCompact",
  452. "kernel32.dll.HeapCreate",
  453. "kernel32.dll.HeapDestroy",
  454. "kernel32.dll.HeapFree",
  455. "kernel32.dll.HeapReAlloc",
  456. "kernel32.dll.HeapSize",
  457. "kernel32.dll.HeapValidate",
  458. "kernel32.dll.InitializeCriticalSection",
  459. "kernel32.dll.InterlockedCompareExchange",
  460. "kernel32.dll.LeaveCriticalSection",
  461. "kernel32.dll.LoadLibraryA",
  462. "kernel32.dll.LoadLibraryW",
  463. "kernel32.dll.LocalFree",
  464. "kernel32.dll.LockFile",
  465. "kernel32.dll.LockFileEx",
  466. "kernel32.dll.MapViewOfFile",
  467. "kernel32.dll.MultiByteToWideChar",
  468. "kernel32.dll.OutputDebugStringA",
  469. "kernel32.dll.OutputDebugStringW",
  470. "kernel32.dll.QueryPerformanceCounter",
  471. "kernel32.dll.ReadFile",
  472. "kernel32.dll.SetConsoleCtrlHandler",
  473. "kernel32.dll.SetEndOfFile",
  474. "kernel32.dll.SetErrorMode",
  475. "kernel32.dll.SetEvent",
  476. "kernel32.dll.SetFilePointer",
  477. "kernel32.dll.SetProcessPriorityBoost",
  478. "kernel32.dll.SetUnhandledExceptionFilter",
  479. "kernel32.dll.SetWaitableTimer",
  480. "kernel32.dll.Sleep",
  481. "kernel32.dll.SwitchToThread",
  482. "kernel32.dll.SystemTimeToFileTime",
  483. "kernel32.dll.TerminateProcess",
  484. "kernel32.dll.TlsGetValue",
  485. "kernel32.dll.TryEnterCriticalSection",
  486. "kernel32.dll.UnhandledExceptionFilter",
  487. "kernel32.dll.UnlockFile",
  488. "kernel32.dll.UnlockFileEx",
  489. "kernel32.dll.UnmapViewOfFile",
  490. "kernel32.dll.VirtualAlloc",
  491. "kernel32.dll.VirtualFree",
  492. "kernel32.dll.VirtualProtect",
  493. "kernel32.dll.VirtualQuery",
  494. "kernel32.dll.WaitForSingleObject",
  495. "kernel32.dll.WaitForSingleObjectEx",
  496. "kernel32.dll.WideCharToMultiByte",
  497. "kernel32.dll.WriteConsoleW",
  498. "kernel32.dll.WriteFile",
  499. "msvcrt.dll.__dllonexit",
  500. "msvcrt.dll.__getmainargs",
  501. "msvcrt.dll.__initenv",
  502. "msvcrt.dll.__lconv_init",
  503. "msvcrt.dll.__set_app_type",
  504. "msvcrt.dll.__setusermatherr",
  505. "msvcrt.dll._acmdln",
  506. "msvcrt.dll._amsg_exit",
  507. "msvcrt.dll._beginthread",
  508. "msvcrt.dll._beginthreadex",
  509. "msvcrt.dll._cexit",
  510. "msvcrt.dll._endthreadex",
  511. "msvcrt.dll._errno",
  512. "msvcrt.dll._fmode",
  513. "msvcrt.dll._initterm",
  514. "msvcrt.dll._iob",
  515. "msvcrt.dll._lock",
  516. "msvcrt.dll._onexit",
  517. "msvcrt.dll.localtime",
  518. "msvcrt.dll.exit",
  519. "msvcrt.dll.fprintf",
  520. "msvcrt.dll.free",
  521. "msvcrt.dll.fwrite",
  522. "msvcrt.dll.malloc",
  523. "msvcrt.dll.memcmp",
  524. "msvcrt.dll.memcpy",
  525. "msvcrt.dll.memmove",
  526. "msvcrt.dll.memset",
  527. "msvcrt.dll.qsort",
  528. "msvcrt.dll.realloc",
  529. "msvcrt.dll.signal",
  530. "msvcrt.dll.strcmp",
  531. "msvcrt.dll.strcspn",
  532. "msvcrt.dll.strlen",
  533. "msvcrt.dll.strncmp",
  534. "msvcrt.dll.strrchr",
  535. "msvcrt.dll._unlock",
  536. "msvcrt.dll.abort",
  537. "msvcrt.dll.vfprintf",
  538. "msvcrt.dll.calloc",
  539. "kernel32.dll.AddVectoredContinueHandler",
  540. "kernel32.dll.GetQueuedCompletionStatusEx",
  541. "kernel32.dll.LoadLibraryExA",
  542. "kernel32.dll.LoadLibraryExW",
  543. "advapi32.dll.SystemFunction036",
  544. "ntdll.dll.NtWaitForSingleObject",
  545. "winmm.dll.timeBeginPeriod",
  546. "winmm.dll.timeEndPeriod",
  547. "ws2_32.dll.WSAGetOverlappedResult",
  548. "cryptbase.dll.SystemFunction001",
  549. "cryptbase.dll.SystemFunction002",
  550. "cryptbase.dll.SystemFunction003",
  551. "cryptbase.dll.SystemFunction004",
  552. "cryptbase.dll.SystemFunction005",
  553. "cryptbase.dll.SystemFunction028",
  554. "cryptbase.dll.SystemFunction029",
  555. "cryptbase.dll.SystemFunction034",
  556. "cryptbase.dll.SystemFunction036",
  557. "cryptbase.dll.SystemFunction040",
  558. "cryptbase.dll.SystemFunction041",
  559. "kernel32.dll.SetHandleInformation",
  560. "kernel32.dll.GetSystemDirectoryW",
  561. "ws2_32.dll.WSAStartup",
  562. "kernel32.dll.CancelIoEx",
  563. "kernel32.dll.SetFileCompletionNotificationModes",
  564. "ws2_32.dll.WSAEnumProtocolsW",
  565. "kernel32.dll.GetCommandLineW",
  566. "kernel32.dll.GetEnvironmentVariableW",
  567. "advapi32.dll.OpenProcessToken",
  568. "advapi32.dll.GetTokenInformation",
  569. "advapi32.dll.ConvertSidToStringSidW",
  570. "kernel32.dll.WTSGetActiveConsoleSessionId",
  571. "wtsapi32.dll.WTSQuerySessionInformationW",
  572. "winsta.dll.WinStationQueryInformationW",
  573. "advapi32.dll.LookupAccountSidW",
  574. "sechost.dll.LookupAccountSidLocalW",
  575. "advapi32.dll.CreateWellKnownSid",
  576. "rpcrt4.dll.RpcStringBindingComposeW",
  577. "rpcrt4.dll.RpcBindingFromStringBindingW",
  578. "rpcrt4.dll.RpcStringFreeW",
  579. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  580. "sechost.dll.LookupAccountNameLocalW",
  581. "rpcrt4.dll.NdrClientCall2",
  582. "rpcrt4.dll.I_RpcExceptionFilter",
  583. "rpcrt4.dll.RpcBindingFree",
  584. "advapi32.dll.LookupAccountNameW",
  585. "advapi32.dll.RegOpenKeyExW",
  586. "kernel32.dll.GetTimeZoneInformation"
  587. ]
  588.  
  589. [*] Static Analysis: {
  590. "pe": {
  591. "peid_signatures": null,
  592. "imports": [
  593. {
  594. "imports": [
  595. {
  596. "name": "LoadLibraryA",
  597. "address": "0xa9803c"
  598. },
  599. {
  600. "name": "GetProcAddress",
  601. "address": "0xa98040"
  602. },
  603. {
  604. "name": "VirtualProtect",
  605. "address": "0xa98044"
  606. },
  607. {
  608. "name": "VirtualAlloc",
  609. "address": "0xa98048"
  610. },
  611. {
  612. "name": "VirtualFree",
  613. "address": "0xa9804c"
  614. },
  615. {
  616. "name": "ExitProcess",
  617. "address": "0xa98050"
  618. }
  619. ],
  620. "dll": "KERNEL32.DLL"
  621. },
  622. {
  623. "imports": [
  624. {
  625. "name": "_iob",
  626. "address": "0xa98058"
  627. }
  628. ],
  629. "dll": "msvcrt.dll"
  630. }
  631. ],
  632. "digital_signers": null,
  633. "exported_dll_name": null,
  634. "actual_checksum": "0x002cc9b4",
  635. "overlay": null,
  636. "imagebase": "0x00400000",
  637. "reported_checksum": "0x00000000",
  638. "icon_hash": null,
  639. "entrypoint": "0x00a96f80",
  640. "timestamp": "2019-05-20 06:13:33",
  641. "osversion": "4.0",
  642. "sections": [
  643. {
  644. "name": "UPX0",
  645. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  646. "virtual_address": "0x00001000",
  647. "size_of_data": "0x00000000",
  648. "entropy": "0.00",
  649. "raw_address": "0x00000200",
  650. "virtual_size": "0x003d6000",
  651. "characteristics_raw": "0xe0000080"
  652. },
  653. {
  654. "name": "UPX1",
  655. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  656. "virtual_address": "0x003d7000",
  657. "size_of_data": "0x002c0200",
  658. "entropy": "7.88",
  659. "raw_address": "0x00000200",
  660. "virtual_size": "0x002c1000",
  661. "characteristics_raw": "0xe0000040"
  662. },
  663. {
  664. "name": "UPX2",
  665. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  666. "virtual_address": "0x00698000",
  667. "size_of_data": "0x00000200",
  668. "entropy": "2.38",
  669. "raw_address": "0x002c0400",
  670. "virtual_size": "0x00001000",
  671. "characteristics_raw": "0xc0000040"
  672. }
  673. ],
  674. "resources": [],
  675. "dirents": [
  676. {
  677. "virtual_address": "0x00000000",
  678. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  679. "size": "0x00000000"
  680. },
  681. {
  682. "virtual_address": "0x00698000",
  683. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  684. "size": "0x000000d8"
  685. },
  686. {
  687. "virtual_address": "0x00000000",
  688. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  689. "size": "0x00000000"
  690. },
  691. {
  692. "virtual_address": "0x00000000",
  693. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  694. "size": "0x00000000"
  695. },
  696. {
  697. "virtual_address": "0x00000000",
  698. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  699. "size": "0x00000000"
  700. },
  701. {
  702. "virtual_address": "0x006980d8",
  703. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  704. "size": "0x00000020"
  705. },
  706. {
  707. "virtual_address": "0x00000000",
  708. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  709. "size": "0x00000000"
  710. },
  711. {
  712. "virtual_address": "0x00000000",
  713. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  714. "size": "0x00000000"
  715. },
  716. {
  717. "virtual_address": "0x00000000",
  718. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  719. "size": "0x00000000"
  720. },
  721. {
  722. "virtual_address": "0x00697170",
  723. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  724. "size": "0x00000018"
  725. },
  726. {
  727. "virtual_address": "0x00000000",
  728. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  729. "size": "0x00000000"
  730. },
  731. {
  732. "virtual_address": "0x00000000",
  733. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  734. "size": "0x00000000"
  735. },
  736. {
  737. "virtual_address": "0x00000000",
  738. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  739. "size": "0x00000000"
  740. },
  741. {
  742. "virtual_address": "0x00000000",
  743. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  744. "size": "0x00000000"
  745. },
  746. {
  747. "virtual_address": "0x00000000",
  748. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  749. "size": "0x00000000"
  750. },
  751. {
  752. "virtual_address": "0x00000000",
  753. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  754. "size": "0x00000000"
  755. }
  756. ],
  757. "exports": [],
  758. "guest_signers": {},
  759. "imphash": "4bfd1be901a4c0d571291552b2d7a34c",
  760. "icon_fuzzy": null,
  761. "icon": null,
  762. "pdbpath": null,
  763. "imported_dll_count": 2,
  764. "versioninfo": []
  765. }
  766. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!