API tools faq
paste
paladin316

Exes_46ac01695e20bcdff31c056d9f5bf726_exe_2019-07-03_05_30.json

paladin316
Jul 3rd, 2019
2,243
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.52 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_46ac01695e20bcdff31c056d9f5bf726.exe"
  7. [*] File Size: 335872
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "78006c4f51062e202ce552879200f0d9dbf1417088ad97eba717e00cb9aec78c"
  10. [*] MD5: "46ac01695e20bcdff31c056d9f5bf726"
  11. [*] SHA1: "0adfe101260c0262a4e820e2d7ec12f0c7d6e09f"
  12. [*] SHA512: "a3c1be5307b4618f1e8e9f8eb5223c2c5dcfb909766c2d23186fee0901f7c659bfbaa4ffcd80705e6b5ad42abaab3d8cd240e51ba9eb098af073a000f8198f02"
  13. [*] CRC32: "1275A2D4"
  14. [*] SSDEEP: "6144:5Jh4P/HLL/wQ03yBVN3Du8qLNgzzcuzOmObjLjLz7IQ4w4Q1XOD08Hv7bVeL/xT2:5IPPLbtxBVgKZzOmObjLjLz7IQ4w4Q1l"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .text, entropy: 7.05, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0004c000, virtual_size: 0x0004b614"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  29. "Details": [
  30. {
  31. "MicroWorld-eScan": "Trojan.GenericKD.32107045"
  32. },
  33. {
  34. "McAfee": "RDN/Generic.grp"
  35. },
  36. {
  37. "BitDefender": "Trojan.GenericKD.32107045"
  38. },
  39. {
  40. "ESET-NOD32": "a variant of Generik.IRKQTQV"
  41. },
  42. {
  43. "APEX": "Malicious"
  44. },
  45. {
  46. "Paloalto": "generic.ml"
  47. },
  48. {
  49. "GData": "Trojan.GenericKD.32107045"
  50. },
  51. {
  52. "Kaspersky": "Trojan.Win32.VBKryjetor.byje"
  53. },
  54. {
  55. "NANO-Antivirus": "Trojan.Win32.VBKryjetor.fsdiyw"
  56. },
  57. {
  58. "Ad-Aware": "Trojan.GenericKD.32107045"
  59. },
  60. {
  61. "F-Secure": "Trojan.TR/AD.VBCryptor.oip"
  62. },
  63. {
  64. "Invincea": "heuristic"
  65. },
  66. {
  67. "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.fh"
  68. },
  69. {
  70. "Trapmine": "malicious.moderate.ml.score"
  71. },
  72. {
  73. "FireEye": "Generic.mg.46ac01695e20bcdf"
  74. },
  75. {
  76. "Emsisoft": "Trojan.GenericKD.32107045 (B)"
  77. },
  78. {
  79. "SentinelOne": "DFI - Suspicious PE"
  80. },
  81. {
  82. "Webroot": "W32.Trojan.Gen"
  83. },
  84. {
  85. "Avira": "TR/AD.VBCryptor.oip"
  86. },
  87. {
  88. "Antiy-AVL": "Trojan/Win32.Wacatac"
  89. },
  90. {
  91. "Endgame": "malicious (high confidence)"
  92. },
  93. {
  94. "Arcabit": "Trojan.Generic.D1E9EA25"
  95. },
  96. {
  97. "AegisLab": "Trojan.Win32.Generic.4!c"
  98. },
  99. {
  100. "ZoneAlarm": "Trojan.Win32.VBKryjetor.byje"
  101. },
  102. {
  103. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  104. },
  105. {
  106. "Acronis": "suspicious"
  107. },
  108. {
  109. "Rising": "Trojan.Wacatac!8.10C01 (CLOUD)"
  110. },
  111. {
  112. "Ikarus": "Trojan.SuspectCRC"
  113. },
  114. {
  115. "MaxSecure": "Trojan.Malware.300983.susgen"
  116. },
  117. {
  118. "Cybereason": "malicious.1260c0"
  119. },
  120. {
  121. "CrowdStrike": "win/malicious_confidence_100% (W)"
  122. }
  123. ]
  124. }
  125. ]
  126.  
  127. [*] Started Service: []
  128.  
  129. [*] Executed Commands: []
  130.  
  131. [*] Mutexes: []
  132.  
  133. [*] Modified Files: []
  134.  
  135. [*] Deleted Files: []
  136.  
  137. [*] Modified Registry Keys: []
  138.  
  139. [*] Deleted Registry Keys: []
  140.  
  141. [*] DNS Communications: []
  142.  
  143. [*] Domains: []
  144.  
  145. [*] Network Communication - ICMP: []
  146.  
  147. [*] Network Communication - HTTP: []
  148.  
  149. [*] Network Communication - SMTP: []
  150.  
  151. [*] Network Communication - Hosts: []
  152.  
  153. [*] Network Communication - IRC: []
  154.  
  155. [*] Static Analysis: {
  156. "pe": {
  157. "peid_signatures": null,
  158. "imports": [
  159. {
  160. "imports": [
  161. {
  162. "name": "_CIcos",
  163. "address": "0x401000"
  164. },
  165. {
  166. "name": "_adj_fptan",
  167. "address": "0x401004"
  168. },
  169. {
  170. "name": "__vbaVarMove",
  171. "address": "0x401008"
  172. },
  173. {
  174. "name": "__vbaFreeVar",
  175. "address": "0x40100c"
  176. },
  177. {
  178. "name": "__vbaStrVarMove",
  179. "address": "0x401010"
  180. },
  181. {
  182. "name": null,
  183. "address": "0x401014"
  184. },
  185. {
  186. "name": null,
  187. "address": "0x401018"
  188. },
  189. {
  190. "name": null,
  191. "address": "0x40101c"
  192. },
  193. {
  194. "name": "__vbaFreeVarList",
  195. "address": "0x401020"
  196. },
  197. {
  198. "name": "_adj_fdiv_m64",
  199. "address": "0x401024"
  200. },
  201. {
  202. "name": null,
  203. "address": "0x401028"
  204. },
  205. {
  206. "name": null,
  207. "address": "0x40102c"
  208. },
  209. {
  210. "name": "_adj_fprem1",
  211. "address": "0x401030"
  212. },
  213. {
  214. "name": null,
  215. "address": "0x401034"
  216. },
  217. {
  218. "name": null,
  219. "address": "0x401038"
  220. },
  221. {
  222. "name": "__vbaStrCat",
  223. "address": "0x40103c"
  224. },
  225. {
  226. "name": null,
  227. "address": "0x401040"
  228. },
  229. {
  230. "name": "__vbaSetSystemError",
  231. "address": "0x401044"
  232. },
  233. {
  234. "name": "__vbaHresultCheckObj",
  235. "address": "0x401048"
  236. },
  237. {
  238. "name": null,
  239. "address": "0x40104c"
  240. },
  241. {
  242. "name": null,
  243. "address": "0x401050"
  244. },
  245. {
  246. "name": null,
  247. "address": "0x401054"
  248. },
  249. {
  250. "name": "_adj_fdiv_m32",
  251. "address": "0x401058"
  252. },
  253. {
  254. "name": null,
  255. "address": "0x40105c"
  256. },
  257. {
  258. "name": null,
  259. "address": "0x401060"
  260. },
  261. {
  262. "name": "__vbaAryDestruct",
  263. "address": "0x401064"
  264. },
  265. {
  266. "name": null,
  267. "address": "0x401068"
  268. },
  269. {
  270. "name": null,
  271. "address": "0x40106c"
  272. },
  273. {
  274. "name": null,
  275. "address": "0x401070"
  276. },
  277. {
  278. "name": "__vbaOnError",
  279. "address": "0x401074"
  280. },
  281. {
  282. "name": null,
  283. "address": "0x401078"
  284. },
  285. {
  286. "name": "_adj_fdiv_m16i",
  287. "address": "0x40107c"
  288. },
  289. {
  290. "name": "__vbaObjSetAddref",
  291. "address": "0x401080"
  292. },
  293. {
  294. "name": null,
  295. "address": "0x401084"
  296. },
  297. {
  298. "name": "_adj_fdivr_m16i",
  299. "address": "0x401088"
  300. },
  301. {
  302. "name": "__vbaFpR8",
  303. "address": "0x40108c"
  304. },
  305. {
  306. "name": "_CIsin",
  307. "address": "0x401090"
  308. },
  309. {
  310. "name": "__vbaErase",
  311. "address": "0x401094"
  312. },
  313. {
  314. "name": "__vbaChkstk",
  315. "address": "0x401098"
  316. },
  317. {
  318. "name": null,
  319. "address": "0x40109c"
  320. },
  321. {
  322. "name": null,
  323. "address": "0x4010a0"
  324. },
  325. {
  326. "name": "EVENT_SINK_AddRef",
  327. "address": "0x4010a4"
  328. },
  329. {
  330. "name": null,
  331. "address": "0x4010a8"
  332. },
  333. {
  334. "name": "__vbaStrCmp",
  335. "address": "0x4010ac"
  336. },
  337. {
  338. "name": "__vbaAryConstruct2",
  339. "address": "0x4010b0"
  340. },
  341. {
  342. "name": "__vbaVarTstEq",
  343. "address": "0x4010b4"
  344. },
  345. {
  346. "name": "__vbaObjVar",
  347. "address": "0x4010b8"
  348. },
  349. {
  350. "name": "DllFunctionCall",
  351. "address": "0x4010bc"
  352. },
  353. {
  354. "name": null,
  355. "address": "0x4010c0"
  356. },
  357. {
  358. "name": null,
  359. "address": "0x4010c4"
  360. },
  361. {
  362. "name": "_adj_fpatan",
  363. "address": "0x4010c8"
  364. },
  365. {
  366. "name": null,
  367. "address": "0x4010cc"
  368. },
  369. {
  370. "name": null,
  371. "address": "0x4010d0"
  372. },
  373. {
  374. "name": null,
  375. "address": "0x4010d4"
  376. },
  377. {
  378. "name": "__vbaRedim",
  379. "address": "0x4010d8"
  380. },
  381. {
  382. "name": "EVENT_SINK_Release",
  383. "address": "0x4010dc"
  384. },
  385. {
  386. "name": null,
  387. "address": "0x4010e0"
  388. },
  389. {
  390. "name": "_CIsqrt",
  391. "address": "0x4010e4"
  392. },
  393. {
  394. "name": "EVENT_SINK_QueryInterface",
  395. "address": "0x4010e8"
  396. },
  397. {
  398. "name": "__vbaExceptHandler",
  399. "address": "0x4010ec"
  400. },
  401. {
  402. "name": "__vbaStrToUnicode",
  403. "address": "0x4010f0"
  404. },
  405. {
  406. "name": null,
  407. "address": "0x4010f4"
  408. },
  409. {
  410. "name": "_adj_fprem",
  411. "address": "0x4010f8"
  412. },
  413. {
  414. "name": "_adj_fdivr_m64",
  415. "address": "0x4010fc"
  416. },
  417. {
  418. "name": null,
  419. "address": "0x401100"
  420. },
  421. {
  422. "name": "__vbaVarErrI4",
  423. "address": "0x401104"
  424. },
  425. {
  426. "name": null,
  427. "address": "0x401108"
  428. },
  429. {
  430. "name": null,
  431. "address": "0x40110c"
  432. },
  433. {
  434. "name": "__vbaFPException",
  435. "address": "0x401110"
  436. },
  437. {
  438. "name": null,
  439. "address": "0x401114"
  440. },
  441. {
  442. "name": "__vbaStrVarVal",
  443. "address": "0x401118"
  444. },
  445. {
  446. "name": null,
  447. "address": "0x40111c"
  448. },
  449. {
  450. "name": "_CIlog",
  451. "address": "0x401120"
  452. },
  453. {
  454. "name": null,
  455. "address": "0x401124"
  456. },
  457. {
  458. "name": "__vbaFileOpen",
  459. "address": "0x401128"
  460. },
  461. {
  462. "name": "__vbaNew2",
  463. "address": "0x40112c"
  464. },
  465. {
  466. "name": null,
  467. "address": "0x401130"
  468. },
  469. {
  470. "name": "_adj_fdiv_m32i",
  471. "address": "0x401134"
  472. },
  473. {
  474. "name": "_adj_fdivr_m32i",
  475. "address": "0x401138"
  476. },
  477. {
  478. "name": null,
  479. "address": "0x40113c"
  480. },
  481. {
  482. "name": "__vbaI4Str",
  483. "address": "0x401140"
  484. },
  485. {
  486. "name": null,
  487. "address": "0x401144"
  488. },
  489. {
  490. "name": "_adj_fdivr_m32",
  491. "address": "0x401148"
  492. },
  493. {
  494. "name": "_adj_fdiv_r",
  495. "address": "0x40114c"
  496. },
  497. {
  498. "name": null,
  499. "address": "0x401150"
  500. },
  501. {
  502. "name": "__vbaVarTstNe",
  503. "address": "0x401154"
  504. },
  505. {
  506. "name": null,
  507. "address": "0x401158"
  508. },
  509. {
  510. "name": "__vbaLateMemCall",
  511. "address": "0x40115c"
  512. },
  513. {
  514. "name": "__vbaVarAdd",
  515. "address": "0x401160"
  516. },
  517. {
  518. "name": "__vbaVarDup",
  519. "address": "0x401164"
  520. },
  521. {
  522. "name": null,
  523. "address": "0x401168"
  524. },
  525. {
  526. "name": "__vbaStrToAnsi",
  527. "address": "0x40116c"
  528. },
  529. {
  530. "name": "__vbaVarLateMemCallLd",
  531. "address": "0x401170"
  532. },
  533. {
  534. "name": null,
  535. "address": "0x401174"
  536. },
  537. {
  538. "name": "_CIatan",
  539. "address": "0x401178"
  540. },
  541. {
  542. "name": "__vbaStrMove",
  543. "address": "0x40117c"
  544. },
  545. {
  546. "name": null,
  547. "address": "0x401180"
  548. },
  549. {
  550. "name": "_allmul",
  551. "address": "0x401184"
  552. },
  553. {
  554. "name": null,
  555. "address": "0x401188"
  556. },
  557. {
  558. "name": null,
  559. "address": "0x40118c"
  560. },
  561. {
  562. "name": null,
  563. "address": "0x401190"
  564. },
  565. {
  566. "name": "_CItan",
  567. "address": "0x401194"
  568. },
  569. {
  570. "name": "_CIexp",
  571. "address": "0x401198"
  572. },
  573. {
  574. "name": "__vbaFreeStr",
  575. "address": "0x40119c"
  576. },
  577. {
  578. "name": "__vbaFreeObj",
  579. "address": "0x4011a0"
  580. }
  581. ],
  582. "dll": "MSVBVM60.DLL"
  583. }
  584. ],
  585. "digital_signers": null,
  586. "exported_dll_name": null,
  587. "actual_checksum": "0x0005ee66",
  588. "overlay": null,
  589. "imagebase": "0x00400000",
  590. "reported_checksum": "0x0005ee66",
  591. "icon_hash": null,
  592. "entrypoint": "0x00403e58",
  593. "timestamp": "2019-06-26 16:43:16",
  594. "osversion": "4.0",
  595. "sections": [
  596. {
  597. "name": ".text",
  598. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  599. "virtual_address": "0x00001000",
  600. "size_of_data": "0x0004c000",
  601. "entropy": "7.05",
  602. "raw_address": "0x00001000",
  603. "virtual_size": "0x0004b614",
  604. "characteristics_raw": "0x60000020"
  605. },
  606. {
  607. "name": ".data",
  608. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  609. "virtual_address": "0x0004d000",
  610. "size_of_data": "0x00001000",
  611. "entropy": "0.00",
  612. "raw_address": "0x0004d000",
  613. "virtual_size": "0x00006370",
  614. "characteristics_raw": "0xc0000040"
  615. },
  616. {
  617. "name": ".rsrc",
  618. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  619. "virtual_address": "0x00054000",
  620. "size_of_data": "0x00004000",
  621. "entropy": "5.56",
  622. "raw_address": "0x0004e000",
  623. "virtual_size": "0x0000372a",
  624. "characteristics_raw": "0x40000040"
  625. }
  626. ],
  627. "resources": [],
  628. "dirents": [
  629. {
  630. "virtual_address": "0x00000000",
  631. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  632. "size": "0x00000000"
  633. },
  634. {
  635. "virtual_address": "0x0004c064",
  636. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  637. "size": "0x00000028"
  638. },
  639. {
  640. "virtual_address": "0x00054000",
  641. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  642. "size": "0x0000372a"
  643. },
  644. {
  645. "virtual_address": "0x00000000",
  646. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  647. "size": "0x00000000"
  648. },
  649. {
  650. "virtual_address": "0x00000000",
  651. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  652. "size": "0x00000000"
  653. },
  654. {
  655. "virtual_address": "0x00000000",
  656. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  657. "size": "0x00000000"
  658. },
  659. {
  660. "virtual_address": "0x00000000",
  661. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  662. "size": "0x00000000"
  663. },
  664. {
  665. "virtual_address": "0x00000000",
  666. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  667. "size": "0x00000000"
  668. },
  669. {
  670. "virtual_address": "0x00000000",
  671. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  672. "size": "0x00000000"
  673. },
  674. {
  675. "virtual_address": "0x00000000",
  676. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  677. "size": "0x00000000"
  678. },
  679. {
  680. "virtual_address": "0x00000000",
  681. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  682. "size": "0x00000000"
  683. },
  684. {
  685. "virtual_address": "0x00000228",
  686. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  687. "size": "0x00000020"
  688. },
  689. {
  690. "virtual_address": "0x00001000",
  691. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  692. "size": "0x000001a8"
  693. },
  694. {
  695. "virtual_address": "0x00000000",
  696. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  697. "size": "0x00000000"
  698. },
  699. {
  700. "virtual_address": "0x00000000",
  701. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  702. "size": "0x00000000"
  703. },
  704. {
  705. "virtual_address": "0x00000000",
  706. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  707. "size": "0x00000000"
  708. }
  709. ],
  710. "exports": [],
  711. "guest_signers": {},
  712. "imphash": "292da1a366d4d8a0bd918fea73efadae",
  713. "icon_fuzzy": null,
  714. "icon": null,
  715. "pdbpath": null,
  716. "imported_dll_count": 1,
  717. "versioninfo": []
  718. }
  719. }
  720.  
  721. [*] Resolved APIs: []
  722.  
  723. [*] Static Analysis: {
  724. "pe": {
  725. "peid_signatures": null,
  726. "imports": [
  727. {
  728. "imports": [
  729. {
  730. "name": "_CIcos",
  731. "address": "0x401000"
  732. },
  733. {
  734. "name": "_adj_fptan",
  735. "address": "0x401004"
  736. },
  737. {
  738. "name": "__vbaVarMove",
  739. "address": "0x401008"
  740. },
  741. {
  742. "name": "__vbaFreeVar",
  743. "address": "0x40100c"
  744. },
  745. {
  746. "name": "__vbaStrVarMove",
  747. "address": "0x401010"
  748. },
  749. {
  750. "name": null,
  751. "address": "0x401014"
  752. },
  753. {
  754. "name": null,
  755. "address": "0x401018"
  756. },
  757. {
  758. "name": null,
  759. "address": "0x40101c"
  760. },
  761. {
  762. "name": "__vbaFreeVarList",
  763. "address": "0x401020"
  764. },
  765. {
  766. "name": "_adj_fdiv_m64",
  767. "address": "0x401024"
  768. },
  769. {
  770. "name": null,
  771. "address": "0x401028"
  772. },
  773. {
  774. "name": null,
  775. "address": "0x40102c"
  776. },
  777. {
  778. "name": "_adj_fprem1",
  779. "address": "0x401030"
  780. },
  781. {
  782. "name": null,
  783. "address": "0x401034"
  784. },
  785. {
  786. "name": null,
  787. "address": "0x401038"
  788. },
  789. {
  790. "name": "__vbaStrCat",
  791. "address": "0x40103c"
  792. },
  793. {
  794. "name": null,
  795. "address": "0x401040"
  796. },
  797. {
  798. "name": "__vbaSetSystemError",
  799. "address": "0x401044"
  800. },
  801. {
  802. "name": "__vbaHresultCheckObj",
  803. "address": "0x401048"
  804. },
  805. {
  806. "name": null,
  807. "address": "0x40104c"
  808. },
  809. {
  810. "name": null,
  811. "address": "0x401050"
  812. },
  813. {
  814. "name": null,
  815. "address": "0x401054"
  816. },
  817. {
  818. "name": "_adj_fdiv_m32",
  819. "address": "0x401058"
  820. },
  821. {
  822. "name": null,
  823. "address": "0x40105c"
  824. },
  825. {
  826. "name": null,
  827. "address": "0x401060"
  828. },
  829. {
  830. "name": "__vbaAryDestruct",
  831. "address": "0x401064"
  832. },
  833. {
  834. "name": null,
  835. "address": "0x401068"
  836. },
  837. {
  838. "name": null,
  839. "address": "0x40106c"
  840. },
  841. {
  842. "name": null,
  843. "address": "0x401070"
  844. },
  845. {
  846. "name": "__vbaOnError",
  847. "address": "0x401074"
  848. },
  849. {
  850. "name": null,
  851. "address": "0x401078"
  852. },
  853. {
  854. "name": "_adj_fdiv_m16i",
  855. "address": "0x40107c"
  856. },
  857. {
  858. "name": "__vbaObjSetAddref",
  859. "address": "0x401080"
  860. },
  861. {
  862. "name": null,
  863. "address": "0x401084"
  864. },
  865. {
  866. "name": "_adj_fdivr_m16i",
  867. "address": "0x401088"
  868. },
  869. {
  870. "name": "__vbaFpR8",
  871. "address": "0x40108c"
  872. },
  873. {
  874. "name": "_CIsin",
  875. "address": "0x401090"
  876. },
  877. {
  878. "name": "__vbaErase",
  879. "address": "0x401094"
  880. },
  881. {
  882. "name": "__vbaChkstk",
  883. "address": "0x401098"
  884. },
  885. {
  886. "name": null,
  887. "address": "0x40109c"
  888. },
  889. {
  890. "name": null,
  891. "address": "0x4010a0"
  892. },
  893. {
  894. "name": "EVENT_SINK_AddRef",
  895. "address": "0x4010a4"
  896. },
  897. {
  898. "name": null,
  899. "address": "0x4010a8"
  900. },
  901. {
  902. "name": "__vbaStrCmp",
  903. "address": "0x4010ac"
  904. },
  905. {
  906. "name": "__vbaAryConstruct2",
  907. "address": "0x4010b0"
  908. },
  909. {
  910. "name": "__vbaVarTstEq",
  911. "address": "0x4010b4"
  912. },
  913. {
  914. "name": "__vbaObjVar",
  915. "address": "0x4010b8"
  916. },
  917. {
  918. "name": "DllFunctionCall",
  919. "address": "0x4010bc"
  920. },
  921. {
  922. "name": null,
  923. "address": "0x4010c0"
  924. },
  925. {
  926. "name": null,
  927. "address": "0x4010c4"
  928. },
  929. {
  930. "name": "_adj_fpatan",
  931. "address": "0x4010c8"
  932. },
  933. {
  934. "name": null,
  935. "address": "0x4010cc"
  936. },
  937. {
  938. "name": null,
  939. "address": "0x4010d0"
  940. },
  941. {
  942. "name": null,
  943. "address": "0x4010d4"
  944. },
  945. {
  946. "name": "__vbaRedim",
  947. "address": "0x4010d8"
  948. },
  949. {
  950. "name": "EVENT_SINK_Release",
  951. "address": "0x4010dc"
  952. },
  953. {
  954. "name": null,
  955. "address": "0x4010e0"
  956. },
  957. {
  958. "name": "_CIsqrt",
  959. "address": "0x4010e4"
  960. },
  961. {
  962. "name": "EVENT_SINK_QueryInterface",
  963. "address": "0x4010e8"
  964. },
  965. {
  966. "name": "__vbaExceptHandler",
  967. "address": "0x4010ec"
  968. },
  969. {
  970. "name": "__vbaStrToUnicode",
  971. "address": "0x4010f0"
  972. },
  973. {
  974. "name": null,
  975. "address": "0x4010f4"
  976. },
  977. {
  978. "name": "_adj_fprem",
  979. "address": "0x4010f8"
  980. },
  981. {
  982. "name": "_adj_fdivr_m64",
  983. "address": "0x4010fc"
  984. },
  985. {
  986. "name": null,
  987. "address": "0x401100"
  988. },
  989. {
  990. "name": "__vbaVarErrI4",
  991. "address": "0x401104"
  992. },
  993. {
  994. "name": null,
  995. "address": "0x401108"
  996. },
  997. {
  998. "name": null,
  999. "address": "0x40110c"
  1000. },
  1001. {
  1002. "name": "__vbaFPException",
  1003. "address": "0x401110"
  1004. },
  1005. {
  1006. "name": null,
  1007. "address": "0x401114"
  1008. },
  1009. {
  1010. "name": "__vbaStrVarVal",
  1011. "address": "0x401118"
  1012. },
  1013. {
  1014. "name": null,
  1015. "address": "0x40111c"
  1016. },
  1017. {
  1018. "name": "_CIlog",
  1019. "address": "0x401120"
  1020. },
  1021. {
  1022. "name": null,
  1023. "address": "0x401124"
  1024. },
  1025. {
  1026. "name": "__vbaFileOpen",
  1027. "address": "0x401128"
  1028. },
  1029. {
  1030. "name": "__vbaNew2",
  1031. "address": "0x40112c"
  1032. },
  1033. {
  1034. "name": null,
  1035. "address": "0x401130"
  1036. },
  1037. {
  1038. "name": "_adj_fdiv_m32i",
  1039. "address": "0x401134"
  1040. },
  1041. {
  1042. "name": "_adj_fdivr_m32i",
  1043. "address": "0x401138"
  1044. },
  1045. {
  1046. "name": null,
  1047. "address": "0x40113c"
  1048. },
  1049. {
  1050. "name": "__vbaI4Str",
  1051. "address": "0x401140"
  1052. },
  1053. {
  1054. "name": null,
  1055. "address": "0x401144"
  1056. },
  1057. {
  1058. "name": "_adj_fdivr_m32",
  1059. "address": "0x401148"
  1060. },
  1061. {
  1062. "name": "_adj_fdiv_r",
  1063. "address": "0x40114c"
  1064. },
  1065. {
  1066. "name": null,
  1067. "address": "0x401150"
  1068. },
  1069. {
  1070. "name": "__vbaVarTstNe",
  1071. "address": "0x401154"
  1072. },
  1073. {
  1074. "name": null,
  1075. "address": "0x401158"
  1076. },
  1077. {
  1078. "name": "__vbaLateMemCall",
  1079. "address": "0x40115c"
  1080. },
  1081. {
  1082. "name": "__vbaVarAdd",
  1083. "address": "0x401160"
  1084. },
  1085. {
  1086. "name": "__vbaVarDup",
  1087. "address": "0x401164"
  1088. },
  1089. {
  1090. "name": null,
  1091. "address": "0x401168"
  1092. },
  1093. {
  1094. "name": "__vbaStrToAnsi",
  1095. "address": "0x40116c"
  1096. },
  1097. {
  1098. "name": "__vbaVarLateMemCallLd",
  1099. "address": "0x401170"
  1100. },
  1101. {
  1102. "name": null,
  1103. "address": "0x401174"
  1104. },
  1105. {
  1106. "name": "_CIatan",
  1107. "address": "0x401178"
  1108. },
  1109. {
  1110. "name": "__vbaStrMove",
  1111. "address": "0x40117c"
  1112. },
  1113. {
  1114. "name": null,
  1115. "address": "0x401180"
  1116. },
  1117. {
  1118. "name": "_allmul",
  1119. "address": "0x401184"
  1120. },
  1121. {
  1122. "name": null,
  1123. "address": "0x401188"
  1124. },
  1125. {
  1126. "name": null,
  1127. "address": "0x40118c"
  1128. },
  1129. {
  1130. "name": null,
  1131. "address": "0x401190"
  1132. },
  1133. {
  1134. "name": "_CItan",
  1135. "address": "0x401194"
  1136. },
  1137. {
  1138. "name": "_CIexp",
  1139. "address": "0x401198"
  1140. },
  1141. {
  1142. "name": "__vbaFreeStr",
  1143. "address": "0x40119c"
  1144. },
  1145. {
  1146. "name": "__vbaFreeObj",
  1147. "address": "0x4011a0"
  1148. }
  1149. ],
  1150. "dll": "MSVBVM60.DLL"
  1151. }
  1152. ],
  1153. "digital_signers": null,
  1154. "exported_dll_name": null,
  1155. "actual_checksum": "0x0005ee66",
  1156. "overlay": null,
  1157. "imagebase": "0x00400000",
  1158. "reported_checksum": "0x0005ee66",
  1159. "icon_hash": null,
  1160. "entrypoint": "0x00403e58",
  1161. "timestamp": "2019-06-26 16:43:16",
  1162. "osversion": "4.0",
  1163. "sections": [
  1164. {
  1165. "name": ".text",
  1166. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1167. "virtual_address": "0x00001000",
  1168. "size_of_data": "0x0004c000",
  1169. "entropy": "7.05",
  1170. "raw_address": "0x00001000",
  1171. "virtual_size": "0x0004b614",
  1172. "characteristics_raw": "0x60000020"
  1173. },
  1174. {
  1175. "name": ".data",
  1176. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1177. "virtual_address": "0x0004d000",
  1178. "size_of_data": "0x00001000",
  1179. "entropy": "0.00",
  1180. "raw_address": "0x0004d000",
  1181. "virtual_size": "0x00006370",
  1182. "characteristics_raw": "0xc0000040"
  1183. },
  1184. {
  1185. "name": ".rsrc",
  1186. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1187. "virtual_address": "0x00054000",
  1188. "size_of_data": "0x00004000",
  1189. "entropy": "5.56",
  1190. "raw_address": "0x0004e000",
  1191. "virtual_size": "0x0000372a",
  1192. "characteristics_raw": "0x40000040"
  1193. }
  1194. ],
  1195. "resources": [],
  1196. "dirents": [
  1197. {
  1198. "virtual_address": "0x00000000",
  1199. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1200. "size": "0x00000000"
  1201. },
  1202. {
  1203. "virtual_address": "0x0004c064",
  1204. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1205. "size": "0x00000028"
  1206. },
  1207. {
  1208. "virtual_address": "0x00054000",
  1209. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1210. "size": "0x0000372a"
  1211. },
  1212. {
  1213. "virtual_address": "0x00000000",
  1214. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1215. "size": "0x00000000"
  1216. },
  1217. {
  1218. "virtual_address": "0x00000000",
  1219. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1220. "size": "0x00000000"
  1221. },
  1222. {
  1223. "virtual_address": "0x00000000",
  1224. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1225. "size": "0x00000000"
  1226. },
  1227. {
  1228. "virtual_address": "0x00000000",
  1229. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1230. "size": "0x00000000"
  1231. },
  1232. {
  1233. "virtual_address": "0x00000000",
  1234. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1235. "size": "0x00000000"
  1236. },
  1237. {
  1238. "virtual_address": "0x00000000",
  1239. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1240. "size": "0x00000000"
  1241. },
  1242. {
  1243. "virtual_address": "0x00000000",
  1244. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1245. "size": "0x00000000"
  1246. },
  1247. {
  1248. "virtual_address": "0x00000000",
  1249. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1250. "size": "0x00000000"
  1251. },
  1252. {
  1253. "virtual_address": "0x00000228",
  1254. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1255. "size": "0x00000020"
  1256. },
  1257. {
  1258. "virtual_address": "0x00001000",
  1259. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1260. "size": "0x000001a8"
  1261. },
  1262. {
  1263. "virtual_address": "0x00000000",
  1264. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1265. "size": "0x00000000"
  1266. },
  1267. {
  1268. "virtual_address": "0x00000000",
  1269. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1270. "size": "0x00000000"
  1271. },
  1272. {
  1273. "virtual_address": "0x00000000",
  1274. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1275. "size": "0x00000000"
  1276. }
  1277. ],
  1278. "exports": [],
  1279. "guest_signers": {},
  1280. "imphash": "292da1a366d4d8a0bd918fea73efadae",
  1281. "icon_fuzzy": null,
  1282. "icon": null,
  1283. "pdbpath": null,
  1284. "imported_dll_count": 1,
  1285. "versioninfo": []
  1286. }
  1287. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!