API tools faq
paste
paladin316

RegDelNull64_exe.json

paladin316
Jun 19th, 2019
2,173
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 48.10 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 0.0
  5.  
  6. [*] File Name: "RegDelNull64.exe"
  7. [*] File Size: 164024
  8. [*] File Type: "PE32+ executable (console) x86-64, for MS Windows"
  9. [*] SHA256: "ae083578b4191f7d5b8b50114e26a2adccf669f90d5e766762c11bfa1b50002a"
  10. [*] MD5: "3829f2cf23461bcbbd6d0a6df50dae76"
  11. [*] SHA1: "bf45ad68effae2ae3e7f34fe09785a179fde6130"
  12. [*] SHA512: "da04ba34c91d064422fef78cf6dcbb822e846f9e1aa7ea897150befcb3a3371e7d172d56cb920b464ac5ddfd4a2625e27dee4a8bb29a38f5eb15b1f024820817"
  13. [*] CRC32: "29F32BB9"
  14. [*] SSDEEP: "3072:Fosp3aKA0/aAo16RsSaTEBxAE6i5UFLAmglxqFLfxu3E/:eIaKA6fTHaTEBOt3LAGLd"
  15.  
  16. [*] Process Execution: [
  17. "RegDelNull64.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: []
  21.  
  22. [*] Started Service: []
  23.  
  24. [*] Executed Commands: []
  25.  
  26. [*] Mutexes: [
  27. "CicLoadWinStaWinSta0",
  28. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  29. ]
  30.  
  31. [*] Modified Files: []
  32.  
  33. [*] Deleted Files: []
  34.  
  35. [*] Modified Registry Keys: [
  36. "HKEY_CURRENT_USER\\Software\\Sysinternals\\RegDelNull",
  37. "HKEY_CURRENT_USER\\Software\\Sysinternals\\RegDelNull\\EulaAccepted"
  38. ]
  39.  
  40. [*] Deleted Registry Keys: []
  41.  
  42. [*] DNS Communications: []
  43.  
  44. [*] Domains: []
  45.  
  46. [*] Network Communication - ICMP: []
  47.  
  48. [*] Network Communication - HTTP: []
  49.  
  50. [*] Network Communication - SMTP: []
  51.  
  52. [*] Network Communication - Hosts: []
  53.  
  54. [*] Network Communication - IRC: []
  55.  
  56. [*] Static Analysis: {
  57. "pe": {
  58. "peid_signatures": null,
  59. "imports": [
  60. {
  61. "imports": [
  62. {
  63. "name": "VerQueryValueW",
  64. "address": "0x140013370"
  65. },
  66. {
  67. "name": "GetFileVersionInfoW",
  68. "address": "0x140013378"
  69. },
  70. {
  71. "name": "GetFileVersionInfoSizeW",
  72. "address": "0x140013380"
  73. }
  74. ],
  75. "dll": "VERSION.dll"
  76. },
  77. {
  78. "imports": [
  79. {
  80. "name": "WriteConsoleW",
  81. "address": "0x1400130e8"
  82. },
  83. {
  84. "name": "ReadConsoleW",
  85. "address": "0x1400130f0"
  86. },
  87. {
  88. "name": "OutputDebugStringW",
  89. "address": "0x1400130f8"
  90. },
  91. {
  92. "name": "SetFilePointerEx",
  93. "address": "0x140013100"
  94. },
  95. {
  96. "name": "FormatMessageA",
  97. "address": "0x140013108"
  98. },
  99. {
  100. "name": "CloseHandle",
  101. "address": "0x140013110"
  102. },
  103. {
  104. "name": "WriteFile",
  105. "address": "0x140013118"
  106. },
  107. {
  108. "name": "SetLastError",
  109. "address": "0x140013120"
  110. },
  111. {
  112. "name": "GetLastError",
  113. "address": "0x140013128"
  114. },
  115. {
  116. "name": "GetCurrentProcess",
  117. "address": "0x140013130"
  118. },
  119. {
  120. "name": "GetCommandLineW",
  121. "address": "0x140013138"
  122. },
  123. {
  124. "name": "GetModuleHandleW",
  125. "address": "0x140013140"
  126. },
  127. {
  128. "name": "LoadLibraryW",
  129. "address": "0x140013148"
  130. },
  131. {
  132. "name": "GetStdHandle",
  133. "address": "0x140013150"
  134. },
  135. {
  136. "name": "LocalFree",
  137. "address": "0x140013158"
  138. },
  139. {
  140. "name": "LocalAlloc",
  141. "address": "0x140013160"
  142. },
  143. {
  144. "name": "GetProcAddress",
  145. "address": "0x140013168"
  146. },
  147. {
  148. "name": "GetModuleFileNameW",
  149. "address": "0x140013170"
  150. },
  151. {
  152. "name": "GetFileType",
  153. "address": "0x140013178"
  154. },
  155. {
  156. "name": "LCMapStringW",
  157. "address": "0x140013180"
  158. },
  159. {
  160. "name": "HeapReAlloc",
  161. "address": "0x140013188"
  162. },
  163. {
  164. "name": "ExitProcess",
  165. "address": "0x140013190"
  166. },
  167. {
  168. "name": "EnterCriticalSection",
  169. "address": "0x140013198"
  170. },
  171. {
  172. "name": "LeaveCriticalSection",
  173. "address": "0x1400131a0"
  174. },
  175. {
  176. "name": "SetStdHandle",
  177. "address": "0x1400131a8"
  178. },
  179. {
  180. "name": "HeapAlloc",
  181. "address": "0x1400131b0"
  182. },
  183. {
  184. "name": "EncodePointer",
  185. "address": "0x1400131b8"
  186. },
  187. {
  188. "name": "DecodePointer",
  189. "address": "0x1400131c0"
  190. },
  191. {
  192. "name": "HeapSize",
  193. "address": "0x1400131c8"
  194. },
  195. {
  196. "name": "GetModuleHandleExW",
  197. "address": "0x1400131d0"
  198. },
  199. {
  200. "name": "MultiByteToWideChar",
  201. "address": "0x1400131d8"
  202. },
  203. {
  204. "name": "WideCharToMultiByte",
  205. "address": "0x1400131e0"
  206. },
  207. {
  208. "name": "HeapFree",
  209. "address": "0x1400131e8"
  210. },
  211. {
  212. "name": "GetConsoleMode",
  213. "address": "0x1400131f0"
  214. },
  215. {
  216. "name": "ReadConsoleInputA",
  217. "address": "0x1400131f8"
  218. },
  219. {
  220. "name": "SetConsoleMode",
  221. "address": "0x140013200"
  222. },
  223. {
  224. "name": "DeleteCriticalSection",
  225. "address": "0x140013208"
  226. },
  227. {
  228. "name": "FlushFileBuffers",
  229. "address": "0x140013210"
  230. },
  231. {
  232. "name": "GetConsoleCP",
  233. "address": "0x140013218"
  234. },
  235. {
  236. "name": "RtlUnwindEx",
  237. "address": "0x140013220"
  238. },
  239. {
  240. "name": "IsDebuggerPresent",
  241. "address": "0x140013228"
  242. },
  243. {
  244. "name": "IsProcessorFeaturePresent",
  245. "address": "0x140013230"
  246. },
  247. {
  248. "name": "ReadFile",
  249. "address": "0x140013238"
  250. },
  251. {
  252. "name": "GetStartupInfoW",
  253. "address": "0x140013240"
  254. },
  255. {
  256. "name": "RtlCaptureContext",
  257. "address": "0x140013248"
  258. },
  259. {
  260. "name": "RtlLookupFunctionEntry",
  261. "address": "0x140013250"
  262. },
  263. {
  264. "name": "RtlVirtualUnwind",
  265. "address": "0x140013258"
  266. },
  267. {
  268. "name": "UnhandledExceptionFilter",
  269. "address": "0x140013260"
  270. },
  271. {
  272. "name": "SetUnhandledExceptionFilter",
  273. "address": "0x140013268"
  274. },
  275. {
  276. "name": "InitializeCriticalSectionAndSpinCount",
  277. "address": "0x140013270"
  278. },
  279. {
  280. "name": "Sleep",
  281. "address": "0x140013278"
  282. },
  283. {
  284. "name": "TerminateProcess",
  285. "address": "0x140013280"
  286. },
  287. {
  288. "name": "TlsAlloc",
  289. "address": "0x140013288"
  290. },
  291. {
  292. "name": "TlsGetValue",
  293. "address": "0x140013290"
  294. },
  295. {
  296. "name": "TlsSetValue",
  297. "address": "0x140013298"
  298. },
  299. {
  300. "name": "TlsFree",
  301. "address": "0x1400132a0"
  302. },
  303. {
  304. "name": "IsValidCodePage",
  305. "address": "0x1400132a8"
  306. },
  307. {
  308. "name": "GetACP",
  309. "address": "0x1400132b0"
  310. },
  311. {
  312. "name": "GetOEMCP",
  313. "address": "0x1400132b8"
  314. },
  315. {
  316. "name": "GetCPInfo",
  317. "address": "0x1400132c0"
  318. },
  319. {
  320. "name": "GetCurrentThreadId",
  321. "address": "0x1400132c8"
  322. },
  323. {
  324. "name": "GetProcessHeap",
  325. "address": "0x1400132d0"
  326. },
  327. {
  328. "name": "LoadLibraryExW",
  329. "address": "0x1400132d8"
  330. },
  331. {
  332. "name": "CreateFileW",
  333. "address": "0x1400132e0"
  334. },
  335. {
  336. "name": "GetStringTypeW",
  337. "address": "0x1400132e8"
  338. },
  339. {
  340. "name": "QueryPerformanceCounter",
  341. "address": "0x1400132f0"
  342. },
  343. {
  344. "name": "GetCurrentProcessId",
  345. "address": "0x1400132f8"
  346. },
  347. {
  348. "name": "GetSystemTimeAsFileTime",
  349. "address": "0x140013300"
  350. },
  351. {
  352. "name": "GetEnvironmentStringsW",
  353. "address": "0x140013308"
  354. },
  355. {
  356. "name": "FreeEnvironmentStringsW",
  357. "address": "0x140013310"
  358. }
  359. ],
  360. "dll": "KERNEL32.dll"
  361. },
  362. {
  363. "imports": [
  364. {
  365. "name": "LoadCursorW",
  366. "address": "0x140013320"
  367. },
  368. {
  369. "name": "InflateRect",
  370. "address": "0x140013328"
  371. },
  372. {
  373. "name": "GetSysColorBrush",
  374. "address": "0x140013330"
  375. },
  376. {
  377. "name": "SetCursor",
  378. "address": "0x140013338"
  379. },
  380. {
  381. "name": "SetWindowTextW",
  382. "address": "0x140013340"
  383. },
  384. {
  385. "name": "GetDlgItem",
  386. "address": "0x140013348"
  387. },
  388. {
  389. "name": "EndDialog",
  390. "address": "0x140013350"
  391. },
  392. {
  393. "name": "DialogBoxIndirectParamW",
  394. "address": "0x140013358"
  395. },
  396. {
  397. "name": "SendMessageW",
  398. "address": "0x140013360"
  399. }
  400. ],
  401. "dll": "USER32.dll"
  402. },
  403. {
  404. "imports": [
  405. {
  406. "name": "GetDeviceCaps",
  407. "address": "0x1400130b0"
  408. },
  409. {
  410. "name": "EndPage",
  411. "address": "0x1400130b8"
  412. },
  413. {
  414. "name": "StartPage",
  415. "address": "0x1400130c0"
  416. },
  417. {
  418. "name": "EndDoc",
  419. "address": "0x1400130c8"
  420. },
  421. {
  422. "name": "StartDocW",
  423. "address": "0x1400130d0"
  424. },
  425. {
  426. "name": "SetMapMode",
  427. "address": "0x1400130d8"
  428. }
  429. ],
  430. "dll": "GDI32.dll"
  431. },
  432. {
  433. "imports": [
  434. {
  435. "name": "PrintDlgW",
  436. "address": "0x1400130a0"
  437. }
  438. ],
  439. "dll": "COMDLG32.dll"
  440. },
  441. {
  442. "imports": [
  443. {
  444. "name": "RegSetKeySecurity",
  445. "address": "0x140013000"
  446. },
  447. {
  448. "name": "LookupPrivilegeValueW",
  449. "address": "0x140013008"
  450. },
  451. {
  452. "name": "SetSecurityDescriptorOwner",
  453. "address": "0x140013010"
  454. },
  455. {
  456. "name": "SetSecurityDescriptorDacl",
  457. "address": "0x140013018"
  458. },
  459. {
  460. "name": "InitializeSecurityDescriptor",
  461. "address": "0x140013020"
  462. },
  463. {
  464. "name": "GetSidSubAuthorityCount",
  465. "address": "0x140013028"
  466. },
  467. {
  468. "name": "GetSidSubAuthority",
  469. "address": "0x140013030"
  470. },
  471. {
  472. "name": "GetSidIdentifierAuthority",
  473. "address": "0x140013038"
  474. },
  475. {
  476. "name": "IsValidSid",
  477. "address": "0x140013040"
  478. },
  479. {
  480. "name": "AdjustTokenPrivileges",
  481. "address": "0x140013048"
  482. },
  483. {
  484. "name": "GetTokenInformation",
  485. "address": "0x140013050"
  486. },
  487. {
  488. "name": "OpenProcessToken",
  489. "address": "0x140013058"
  490. },
  491. {
  492. "name": "RegSetValueExW",
  493. "address": "0x140013060"
  494. },
  495. {
  496. "name": "RegQueryValueExW",
  497. "address": "0x140013068"
  498. },
  499. {
  500. "name": "RegOpenKeyExW",
  501. "address": "0x140013070"
  502. },
  503. {
  504. "name": "RegOpenKeyW",
  505. "address": "0x140013078"
  506. },
  507. {
  508. "name": "RegCreateKeyW",
  509. "address": "0x140013080"
  510. },
  511. {
  512. "name": "RegCloseKey",
  513. "address": "0x140013088"
  514. },
  515. {
  516. "name": "SetEntriesInAclW",
  517. "address": "0x140013090"
  518. }
  519. ],
  520. "dll": "ADVAPI32.dll"
  521. }
  522. ],
  523. "digital_signers": null,
  524. "exported_dll_name": null,
  525. "actual_checksum": "0x0002ff80",
  526. "overlay": {
  527. "size": "0x00003eb8",
  528. "offset": "0x00024200"
  529. },
  530. "imagebase": "0x140000000",
  531. "reported_checksum": "0x0002ff80",
  532. "icon_hash": null,
  533. "entrypoint": "0x140005a7c",
  534. "timestamp": "2016-05-28 18:53:38",
  535. "osversion": "5.2",
  536. "sections": [
  537. {
  538. "name": ".text",
  539. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  540. "virtual_address": "0x00001000",
  541. "size_of_data": "0x00012000",
  542. "entropy": "6.47",
  543. "raw_address": "0x00000400",
  544. "virtual_size": "0x00011fba",
  545. "characteristics_raw": "0x60000020"
  546. },
  547. {
  548. "name": ".rdata",
  549. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  550. "virtual_address": "0x00013000",
  551. "size_of_data": "0x0000e600",
  552. "entropy": "4.42",
  553. "raw_address": "0x00012400",
  554. "virtual_size": "0x0000e52e",
  555. "characteristics_raw": "0x40000040"
  556. },
  557. {
  558. "name": ".data",
  559. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  560. "virtual_address": "0x00022000",
  561. "size_of_data": "0x00001a00",
  562. "entropy": "2.90",
  563. "raw_address": "0x00020a00",
  564. "virtual_size": "0x00003da0",
  565. "characteristics_raw": "0xc0000040"
  566. },
  567. {
  568. "name": ".pdata",
  569. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  570. "virtual_address": "0x00026000",
  571. "size_of_data": "0x00001000",
  572. "entropy": "4.70",
  573. "raw_address": "0x00022400",
  574. "virtual_size": "0x00000e88",
  575. "characteristics_raw": "0x40000040"
  576. },
  577. {
  578. "name": ".rsrc",
  579. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  580. "virtual_address": "0x00027000",
  581. "size_of_data": "0x00000800",
  582. "entropy": "3.29",
  583. "raw_address": "0x00023400",
  584. "virtual_size": "0x00000608",
  585. "characteristics_raw": "0x40000040"
  586. },
  587. {
  588. "name": ".reloc",
  589. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  590. "virtual_address": "0x00028000",
  591. "size_of_data": "0x00000600",
  592. "entropy": "5.29",
  593. "raw_address": "0x00023c00",
  594. "virtual_size": "0x000005a0",
  595. "characteristics_raw": "0x42000040"
  596. }
  597. ],
  598. "resources": [],
  599. "dirents": [
  600. {
  601. "virtual_address": "0x00000000",
  602. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  603. "size": "0x00000000"
  604. },
  605. {
  606. "virtual_address": "0x00020900",
  607. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  608. "size": "0x0000008c"
  609. },
  610. {
  611. "virtual_address": "0x00027000",
  612. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  613. "size": "0x00000608"
  614. },
  615. {
  616. "virtual_address": "0x00026000",
  617. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  618. "size": "0x00000e88"
  619. },
  620. {
  621. "virtual_address": "0x00024200",
  622. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  623. "size": "0x00003eb8"
  624. },
  625. {
  626. "virtual_address": "0x00028000",
  627. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  628. "size": "0x000005a0"
  629. },
  630. {
  631. "virtual_address": "0x00000000",
  632. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  633. "size": "0x00000000"
  634. },
  635. {
  636. "virtual_address": "0x00000000",
  637. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  638. "size": "0x00000000"
  639. },
  640. {
  641. "virtual_address": "0x00000000",
  642. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  643. "size": "0x00000000"
  644. },
  645. {
  646. "virtual_address": "0x00000000",
  647. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  648. "size": "0x00000000"
  649. },
  650. {
  651. "virtual_address": "0x0001f810",
  652. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  653. "size": "0x00000070"
  654. },
  655. {
  656. "virtual_address": "0x00000000",
  657. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  658. "size": "0x00000000"
  659. },
  660. {
  661. "virtual_address": "0x00013000",
  662. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  663. "size": "0x00000390"
  664. },
  665. {
  666. "virtual_address": "0x00000000",
  667. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  668. "size": "0x00000000"
  669. },
  670. {
  671. "virtual_address": "0x00000000",
  672. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  673. "size": "0x00000000"
  674. },
  675. {
  676. "virtual_address": "0x00000000",
  677. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  678. "size": "0x00000000"
  679. }
  680. ],
  681. "exports": [],
  682. "guest_signers": {},
  683. "imphash": "b79370b1662052533fbdc0cbc7b56236",
  684. "icon_fuzzy": null,
  685. "icon": null,
  686. "pdbpath": null,
  687. "imported_dll_count": 6,
  688. "versioninfo": []
  689. }
  690. }
  691.  
  692. [*] Resolved APIs: [
  693. "kernel32.dll.FlsAlloc",
  694. "kernel32.dll.FlsFree",
  695. "kernel32.dll.FlsGetValue",
  696. "kernel32.dll.FlsSetValue",
  697. "kernel32.dll.InitializeCriticalSectionEx",
  698. "kernel32.dll.CreateEventExW",
  699. "kernel32.dll.CreateSemaphoreExW",
  700. "kernel32.dll.SetThreadStackGuarantee",
  701. "kernel32.dll.CreateThreadpoolTimer",
  702. "kernel32.dll.SetThreadpoolTimer",
  703. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  704. "kernel32.dll.CloseThreadpoolTimer",
  705. "kernel32.dll.CreateThreadpoolWait",
  706. "kernel32.dll.SetThreadpoolWait",
  707. "kernel32.dll.CloseThreadpoolWait",
  708. "kernel32.dll.FlushProcessWriteBuffers",
  709. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  710. "kernel32.dll.GetCurrentProcessorNumber",
  711. "kernel32.dll.GetLogicalProcessorInformation",
  712. "kernel32.dll.CreateSymbolicLinkW",
  713. "kernel32.dll.EnumSystemLocalesEx",
  714. "kernel32.dll.CompareStringEx",
  715. "kernel32.dll.GetDateFormatEx",
  716. "kernel32.dll.GetLocaleInfoEx",
  717. "kernel32.dll.GetTimeFormatEx",
  718. "kernel32.dll.GetUserDefaultLocaleName",
  719. "kernel32.dll.IsValidLocaleName",
  720. "kernel32.dll.LCMapStringEx",
  721. "kernel32.dll.GetTickCount64",
  722. "kernel32.dll.SortGetHandle",
  723. "kernel32.dll.SortCloseHandle",
  724. "uxtheme.dll.ThemeInitApiHook",
  725. "user32.dll.IsProcessDPIAware",
  726. "dwmapi.dll.DwmIsCompositionEnabled",
  727. "lpk.dll.LpkEditControl",
  728. "comctl32.dll.HIMAGELIST_QueryInterface",
  729. "comctl32.dll.DrawShadowText",
  730. "comctl32.dll.DrawSizeBox",
  731. "comctl32.dll.DrawScrollBar",
  732. "comctl32.dll.SizeBoxHwnd",
  733. "comctl32.dll.ScrollBar_MouseMove",
  734. "comctl32.dll.ScrollBar_Menu",
  735. "comctl32.dll.HandleScrollCmd",
  736. "comctl32.dll.DetachScrollBars",
  737. "comctl32.dll.AttachScrollBars",
  738. "comctl32.dll.CCSetScrollInfo",
  739. "comctl32.dll.CCGetScrollInfo",
  740. "comctl32.dll.CCEnableScrollBar",
  741. "comctl32.dll.QuerySystemGestureStatus",
  742. "uxtheme.dll.#49",
  743. "uxtheme.dll.CloseThemeData",
  744. "gdi32.dll.GetLayout",
  745. "gdi32.dll.GdiRealizationInfo",
  746. "gdi32.dll.FontIsLinked",
  747. "advapi32.dll.RegOpenKeyExW",
  748. "advapi32.dll.RegQueryInfoKeyW",
  749. "gdi32.dll.GetTextFaceAliasW",
  750. "advapi32.dll.RegEnumValueW",
  751. "advapi32.dll.RegCloseKey",
  752. "advapi32.dll.RegQueryValueExW",
  753. "gdi32.dll.GetFontAssocStatus",
  754. "advapi32.dll.RegQueryValueExA",
  755. "advapi32.dll.RegEnumKeyExW",
  756. "gdi32.dll.GdiIsMetaPrintDC",
  757. "ole32.dll.CoInitializeEx",
  758. "ole32.dll.CoUninitialize",
  759. "cryptbase.dll.SystemFunction036",
  760. "ole32.dll.CoRegisterInitializeSpy",
  761. "ole32.dll.CoRevokeInitializeSpy",
  762. "uxtheme.dll.DrawThemeBackground",
  763. "uxtheme.dll.GetThemeBackgroundContentRect",
  764. "uxtheme.dll.GetThemePartSize",
  765. "ntdll.dll.NtEnumerateKey",
  766. "ntdll.dll.NtDeleteKey",
  767. "ntdll.dll.RtlNtStatusToDosError",
  768. "ntdll.dll.NtOpenKey"
  769. ]
  770.  
  771. [*] Static Analysis: {
  772. "pe": {
  773. "peid_signatures": null,
  774. "imports": [
  775. {
  776. "imports": [
  777. {
  778. "name": "VerQueryValueW",
  779. "address": "0x140013370"
  780. },
  781. {
  782. "name": "GetFileVersionInfoW",
  783. "address": "0x140013378"
  784. },
  785. {
  786. "name": "GetFileVersionInfoSizeW",
  787. "address": "0x140013380"
  788. }
  789. ],
  790. "dll": "VERSION.dll"
  791. },
  792. {
  793. "imports": [
  794. {
  795. "name": "WriteConsoleW",
  796. "address": "0x1400130e8"
  797. },
  798. {
  799. "name": "ReadConsoleW",
  800. "address": "0x1400130f0"
  801. },
  802. {
  803. "name": "OutputDebugStringW",
  804. "address": "0x1400130f8"
  805. },
  806. {
  807. "name": "SetFilePointerEx",
  808. "address": "0x140013100"
  809. },
  810. {
  811. "name": "FormatMessageA",
  812. "address": "0x140013108"
  813. },
  814. {
  815. "name": "CloseHandle",
  816. "address": "0x140013110"
  817. },
  818. {
  819. "name": "WriteFile",
  820. "address": "0x140013118"
  821. },
  822. {
  823. "name": "SetLastError",
  824. "address": "0x140013120"
  825. },
  826. {
  827. "name": "GetLastError",
  828. "address": "0x140013128"
  829. },
  830. {
  831. "name": "GetCurrentProcess",
  832. "address": "0x140013130"
  833. },
  834. {
  835. "name": "GetCommandLineW",
  836. "address": "0x140013138"
  837. },
  838. {
  839. "name": "GetModuleHandleW",
  840. "address": "0x140013140"
  841. },
  842. {
  843. "name": "LoadLibraryW",
  844. "address": "0x140013148"
  845. },
  846. {
  847. "name": "GetStdHandle",
  848. "address": "0x140013150"
  849. },
  850. {
  851. "name": "LocalFree",
  852. "address": "0x140013158"
  853. },
  854. {
  855. "name": "LocalAlloc",
  856. "address": "0x140013160"
  857. },
  858. {
  859. "name": "GetProcAddress",
  860. "address": "0x140013168"
  861. },
  862. {
  863. "name": "GetModuleFileNameW",
  864. "address": "0x140013170"
  865. },
  866. {
  867. "name": "GetFileType",
  868. "address": "0x140013178"
  869. },
  870. {
  871. "name": "LCMapStringW",
  872. "address": "0x140013180"
  873. },
  874. {
  875. "name": "HeapReAlloc",
  876. "address": "0x140013188"
  877. },
  878. {
  879. "name": "ExitProcess",
  880. "address": "0x140013190"
  881. },
  882. {
  883. "name": "EnterCriticalSection",
  884. "address": "0x140013198"
  885. },
  886. {
  887. "name": "LeaveCriticalSection",
  888. "address": "0x1400131a0"
  889. },
  890. {
  891. "name": "SetStdHandle",
  892. "address": "0x1400131a8"
  893. },
  894. {
  895. "name": "HeapAlloc",
  896. "address": "0x1400131b0"
  897. },
  898. {
  899. "name": "EncodePointer",
  900. "address": "0x1400131b8"
  901. },
  902. {
  903. "name": "DecodePointer",
  904. "address": "0x1400131c0"
  905. },
  906. {
  907. "name": "HeapSize",
  908. "address": "0x1400131c8"
  909. },
  910. {
  911. "name": "GetModuleHandleExW",
  912. "address": "0x1400131d0"
  913. },
  914. {
  915. "name": "MultiByteToWideChar",
  916. "address": "0x1400131d8"
  917. },
  918. {
  919. "name": "WideCharToMultiByte",
  920. "address": "0x1400131e0"
  921. },
  922. {
  923. "name": "HeapFree",
  924. "address": "0x1400131e8"
  925. },
  926. {
  927. "name": "GetConsoleMode",
  928. "address": "0x1400131f0"
  929. },
  930. {
  931. "name": "ReadConsoleInputA",
  932. "address": "0x1400131f8"
  933. },
  934. {
  935. "name": "SetConsoleMode",
  936. "address": "0x140013200"
  937. },
  938. {
  939. "name": "DeleteCriticalSection",
  940. "address": "0x140013208"
  941. },
  942. {
  943. "name": "FlushFileBuffers",
  944. "address": "0x140013210"
  945. },
  946. {
  947. "name": "GetConsoleCP",
  948. "address": "0x140013218"
  949. },
  950. {
  951. "name": "RtlUnwindEx",
  952. "address": "0x140013220"
  953. },
  954. {
  955. "name": "IsDebuggerPresent",
  956. "address": "0x140013228"
  957. },
  958. {
  959. "name": "IsProcessorFeaturePresent",
  960. "address": "0x140013230"
  961. },
  962. {
  963. "name": "ReadFile",
  964. "address": "0x140013238"
  965. },
  966. {
  967. "name": "GetStartupInfoW",
  968. "address": "0x140013240"
  969. },
  970. {
  971. "name": "RtlCaptureContext",
  972. "address": "0x140013248"
  973. },
  974. {
  975. "name": "RtlLookupFunctionEntry",
  976. "address": "0x140013250"
  977. },
  978. {
  979. "name": "RtlVirtualUnwind",
  980. "address": "0x140013258"
  981. },
  982. {
  983. "name": "UnhandledExceptionFilter",
  984. "address": "0x140013260"
  985. },
  986. {
  987. "name": "SetUnhandledExceptionFilter",
  988. "address": "0x140013268"
  989. },
  990. {
  991. "name": "InitializeCriticalSectionAndSpinCount",
  992. "address": "0x140013270"
  993. },
  994. {
  995. "name": "Sleep",
  996. "address": "0x140013278"
  997. },
  998. {
  999. "name": "TerminateProcess",
  1000. "address": "0x140013280"
  1001. },
  1002. {
  1003. "name": "TlsAlloc",
  1004. "address": "0x140013288"
  1005. },
  1006. {
  1007. "name": "TlsGetValue",
  1008. "address": "0x140013290"
  1009. },
  1010. {
  1011. "name": "TlsSetValue",
  1012. "address": "0x140013298"
  1013. },
  1014. {
  1015. "name": "TlsFree",
  1016. "address": "0x1400132a0"
  1017. },
  1018. {
  1019. "name": "IsValidCodePage",
  1020. "address": "0x1400132a8"
  1021. },
  1022. {
  1023. "name": "GetACP",
  1024. "address": "0x1400132b0"
  1025. },
  1026. {
  1027. "name": "GetOEMCP",
  1028. "address": "0x1400132b8"
  1029. },
  1030. {
  1031. "name": "GetCPInfo",
  1032. "address": "0x1400132c0"
  1033. },
  1034. {
  1035. "name": "GetCurrentThreadId",
  1036. "address": "0x1400132c8"
  1037. },
  1038. {
  1039. "name": "GetProcessHeap",
  1040. "address": "0x1400132d0"
  1041. },
  1042. {
  1043. "name": "LoadLibraryExW",
  1044. "address": "0x1400132d8"
  1045. },
  1046. {
  1047. "name": "CreateFileW",
  1048. "address": "0x1400132e0"
  1049. },
  1050. {
  1051. "name": "GetStringTypeW",
  1052. "address": "0x1400132e8"
  1053. },
  1054. {
  1055. "name": "QueryPerformanceCounter",
  1056. "address": "0x1400132f0"
  1057. },
  1058. {
  1059. "name": "GetCurrentProcessId",
  1060. "address": "0x1400132f8"
  1061. },
  1062. {
  1063. "name": "GetSystemTimeAsFileTime",
  1064. "address": "0x140013300"
  1065. },
  1066. {
  1067. "name": "GetEnvironmentStringsW",
  1068. "address": "0x140013308"
  1069. },
  1070. {
  1071. "name": "FreeEnvironmentStringsW",
  1072. "address": "0x140013310"
  1073. }
  1074. ],
  1075. "dll": "KERNEL32.dll"
  1076. },
  1077. {
  1078. "imports": [
  1079. {
  1080. "name": "LoadCursorW",
  1081. "address": "0x140013320"
  1082. },
  1083. {
  1084. "name": "InflateRect",
  1085. "address": "0x140013328"
  1086. },
  1087. {
  1088. "name": "GetSysColorBrush",
  1089. "address": "0x140013330"
  1090. },
  1091. {
  1092. "name": "SetCursor",
  1093. "address": "0x140013338"
  1094. },
  1095. {
  1096. "name": "SetWindowTextW",
  1097. "address": "0x140013340"
  1098. },
  1099. {
  1100. "name": "GetDlgItem",
  1101. "address": "0x140013348"
  1102. },
  1103. {
  1104. "name": "EndDialog",
  1105. "address": "0x140013350"
  1106. },
  1107. {
  1108. "name": "DialogBoxIndirectParamW",
  1109. "address": "0x140013358"
  1110. },
  1111. {
  1112. "name": "SendMessageW",
  1113. "address": "0x140013360"
  1114. }
  1115. ],
  1116. "dll": "USER32.dll"
  1117. },
  1118. {
  1119. "imports": [
  1120. {
  1121. "name": "GetDeviceCaps",
  1122. "address": "0x1400130b0"
  1123. },
  1124. {
  1125. "name": "EndPage",
  1126. "address": "0x1400130b8"
  1127. },
  1128. {
  1129. "name": "StartPage",
  1130. "address": "0x1400130c0"
  1131. },
  1132. {
  1133. "name": "EndDoc",
  1134. "address": "0x1400130c8"
  1135. },
  1136. {
  1137. "name": "StartDocW",
  1138. "address": "0x1400130d0"
  1139. },
  1140. {
  1141. "name": "SetMapMode",
  1142. "address": "0x1400130d8"
  1143. }
  1144. ],
  1145. "dll": "GDI32.dll"
  1146. },
  1147. {
  1148. "imports": [
  1149. {
  1150. "name": "PrintDlgW",
  1151. "address": "0x1400130a0"
  1152. }
  1153. ],
  1154. "dll": "COMDLG32.dll"
  1155. },
  1156. {
  1157. "imports": [
  1158. {
  1159. "name": "RegSetKeySecurity",
  1160. "address": "0x140013000"
  1161. },
  1162. {
  1163. "name": "LookupPrivilegeValueW",
  1164. "address": "0x140013008"
  1165. },
  1166. {
  1167. "name": "SetSecurityDescriptorOwner",
  1168. "address": "0x140013010"
  1169. },
  1170. {
  1171. "name": "SetSecurityDescriptorDacl",
  1172. "address": "0x140013018"
  1173. },
  1174. {
  1175. "name": "InitializeSecurityDescriptor",
  1176. "address": "0x140013020"
  1177. },
  1178. {
  1179. "name": "GetSidSubAuthorityCount",
  1180. "address": "0x140013028"
  1181. },
  1182. {
  1183. "name": "GetSidSubAuthority",
  1184. "address": "0x140013030"
  1185. },
  1186. {
  1187. "name": "GetSidIdentifierAuthority",
  1188. "address": "0x140013038"
  1189. },
  1190. {
  1191. "name": "IsValidSid",
  1192. "address": "0x140013040"
  1193. },
  1194. {
  1195. "name": "AdjustTokenPrivileges",
  1196. "address": "0x140013048"
  1197. },
  1198. {
  1199. "name": "GetTokenInformation",
  1200. "address": "0x140013050"
  1201. },
  1202. {
  1203. "name": "OpenProcessToken",
  1204. "address": "0x140013058"
  1205. },
  1206. {
  1207. "name": "RegSetValueExW",
  1208. "address": "0x140013060"
  1209. },
  1210. {
  1211. "name": "RegQueryValueExW",
  1212. "address": "0x140013068"
  1213. },
  1214. {
  1215. "name": "RegOpenKeyExW",
  1216. "address": "0x140013070"
  1217. },
  1218. {
  1219. "name": "RegOpenKeyW",
  1220. "address": "0x140013078"
  1221. },
  1222. {
  1223. "name": "RegCreateKeyW",
  1224. "address": "0x140013080"
  1225. },
  1226. {
  1227. "name": "RegCloseKey",
  1228. "address": "0x140013088"
  1229. },
  1230. {
  1231. "name": "SetEntriesInAclW",
  1232. "address": "0x140013090"
  1233. }
  1234. ],
  1235. "dll": "ADVAPI32.dll"
  1236. }
  1237. ],
  1238. "digital_signers": null,
  1239. "exported_dll_name": null,
  1240. "actual_checksum": "0x0002ff80",
  1241. "overlay": {
  1242. "size": "0x00003eb8",
  1243. "offset": "0x00024200"
  1244. },
  1245. "imagebase": "0x140000000",
  1246. "reported_checksum": "0x0002ff80",
  1247. "icon_hash": null,
  1248. "entrypoint": "0x140005a7c",
  1249. "timestamp": "2016-05-28 18:53:38",
  1250. "osversion": "5.2",
  1251. "sections": [
  1252. {
  1253. "name": ".text",
  1254. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1255. "virtual_address": "0x00001000",
  1256. "size_of_data": "0x00012000",
  1257. "entropy": "6.47",
  1258. "raw_address": "0x00000400",
  1259. "virtual_size": "0x00011fba",
  1260. "characteristics_raw": "0x60000020"
  1261. },
  1262. {
  1263. "name": ".rdata",
  1264. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1265. "virtual_address": "0x00013000",
  1266. "size_of_data": "0x0000e600",
  1267. "entropy": "4.42",
  1268. "raw_address": "0x00012400",
  1269. "virtual_size": "0x0000e52e",
  1270. "characteristics_raw": "0x40000040"
  1271. },
  1272. {
  1273. "name": ".data",
  1274. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1275. "virtual_address": "0x00022000",
  1276. "size_of_data": "0x00001a00",
  1277. "entropy": "2.90",
  1278. "raw_address": "0x00020a00",
  1279. "virtual_size": "0x00003da0",
  1280. "characteristics_raw": "0xc0000040"
  1281. },
  1282. {
  1283. "name": ".pdata",
  1284. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1285. "virtual_address": "0x00026000",
  1286. "size_of_data": "0x00001000",
  1287. "entropy": "4.70",
  1288. "raw_address": "0x00022400",
  1289. "virtual_size": "0x00000e88",
  1290. "characteristics_raw": "0x40000040"
  1291. },
  1292. {
  1293. "name": ".rsrc",
  1294. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1295. "virtual_address": "0x00027000",
  1296. "size_of_data": "0x00000800",
  1297. "entropy": "3.29",
  1298. "raw_address": "0x00023400",
  1299. "virtual_size": "0x00000608",
  1300. "characteristics_raw": "0x40000040"
  1301. },
  1302. {
  1303. "name": ".reloc",
  1304. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1305. "virtual_address": "0x00028000",
  1306. "size_of_data": "0x00000600",
  1307. "entropy": "5.29",
  1308. "raw_address": "0x00023c00",
  1309. "virtual_size": "0x000005a0",
  1310. "characteristics_raw": "0x42000040"
  1311. }
  1312. ],
  1313. "resources": [],
  1314. "dirents": [
  1315. {
  1316. "virtual_address": "0x00000000",
  1317. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1318. "size": "0x00000000"
  1319. },
  1320. {
  1321. "virtual_address": "0x00020900",
  1322. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1323. "size": "0x0000008c"
  1324. },
  1325. {
  1326. "virtual_address": "0x00027000",
  1327. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1328. "size": "0x00000608"
  1329. },
  1330. {
  1331. "virtual_address": "0x00026000",
  1332. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1333. "size": "0x00000e88"
  1334. },
  1335. {
  1336. "virtual_address": "0x00024200",
  1337. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1338. "size": "0x00003eb8"
  1339. },
  1340. {
  1341. "virtual_address": "0x00028000",
  1342. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1343. "size": "0x000005a0"
  1344. },
  1345. {
  1346. "virtual_address": "0x00000000",
  1347. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1348. "size": "0x00000000"
  1349. },
  1350. {
  1351. "virtual_address": "0x00000000",
  1352. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1353. "size": "0x00000000"
  1354. },
  1355. {
  1356. "virtual_address": "0x00000000",
  1357. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1358. "size": "0x00000000"
  1359. },
  1360. {
  1361. "virtual_address": "0x00000000",
  1362. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1363. "size": "0x00000000"
  1364. },
  1365. {
  1366. "virtual_address": "0x0001f810",
  1367. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1368. "size": "0x00000070"
  1369. },
  1370. {
  1371. "virtual_address": "0x00000000",
  1372. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1373. "size": "0x00000000"
  1374. },
  1375. {
  1376. "virtual_address": "0x00013000",
  1377. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1378. "size": "0x00000390"
  1379. },
  1380. {
  1381. "virtual_address": "0x00000000",
  1382. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1383. "size": "0x00000000"
  1384. },
  1385. {
  1386. "virtual_address": "0x00000000",
  1387. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1388. "size": "0x00000000"
  1389. },
  1390. {
  1391. "virtual_address": "0x00000000",
  1392. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1393. "size": "0x00000000"
  1394. }
  1395. ],
  1396. "exports": [],
  1397. "guest_signers": {},
  1398. "imphash": "b79370b1662052533fbdc0cbc7b56236",
  1399. "icon_fuzzy": null,
  1400. "icon": null,
  1401. "pdbpath": null,
  1402. "imported_dll_count": 6,
  1403. "versioninfo": []
  1404. }
  1405. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!