API tools faq
paste
paladin316

Exes_18a6e22d8f806f6757d5796fe08b37f0_exe_2019-07-03_15_30.json

paladin316
Jul 3rd, 2019
2,106
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 50.91 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 0.0
  5.  
  6. [*] File Name: "Exes_18a6e22d8f806f6757d5796fe08b37f0.exe"
  7. [*] File Size: 2731128
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "455b17124a474bfa512580ba9bcd275dc8e1119482ad604b83b3cb5611a6f73f"
  10. [*] MD5: "18a6e22d8f806f6757d5796fe08b37f0"
  11. [*] SHA1: "6a99d9bac7b24d1c7843e9e8ae6bff1968ad0fbe"
  12. [*] SHA512: "7a51e7762ab2e7f000d999b497106d4b0cbd724580097cffb902558249e3a017e1ef1f35ca2ce63502690683b3ecd3793b0c958c18c7a64565a2f7493d8ca14c"
  13. [*] CRC32: "4F8DEF7F"
  14. [*] SSDEEP: "49152:cZs5nVhJbEh/kstfItGWY1XF4msYrDvxDIskHUlx88vKdbUM:is5nVnbYMQAtGWonb5okeQMP"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: []
  19.  
  20. [*] Started Service: []
  21.  
  22. [*] Executed Commands: []
  23.  
  24. [*] Mutexes: []
  25.  
  26. [*] Modified Files: []
  27.  
  28. [*] Deleted Files: []
  29.  
  30. [*] Modified Registry Keys: []
  31.  
  32. [*] Deleted Registry Keys: []
  33.  
  34. [*] DNS Communications: []
  35.  
  36. [*] Domains: []
  37.  
  38. [*] Network Communication - ICMP: []
  39.  
  40. [*] Network Communication - HTTP: []
  41.  
  42. [*] Network Communication - SMTP: []
  43.  
  44. [*] Network Communication - Hosts: []
  45.  
  46. [*] Network Communication - IRC: []
  47.  
  48. [*] Static Analysis: {
  49. "pe": {
  50. "peid_signatures": null,
  51. "imports": [
  52. {
  53. "imports": [
  54. {
  55. "name": "SysFreeString",
  56. "address": "0x419304"
  57. },
  58. {
  59. "name": "SysReAllocStringLen",
  60. "address": "0x419308"
  61. },
  62. {
  63. "name": "SysAllocStringLen",
  64. "address": "0x41930c"
  65. }
  66. ],
  67. "dll": "oleaut32.dll"
  68. },
  69. {
  70. "imports": [
  71. {
  72. "name": "RegQueryValueExW",
  73. "address": "0x419314"
  74. },
  75. {
  76. "name": "RegOpenKeyExW",
  77. "address": "0x419318"
  78. },
  79. {
  80. "name": "RegCloseKey",
  81. "address": "0x41931c"
  82. }
  83. ],
  84. "dll": "advapi32.dll"
  85. },
  86. {
  87. "imports": [
  88. {
  89. "name": "GetKeyboardType",
  90. "address": "0x419324"
  91. },
  92. {
  93. "name": "LoadStringW",
  94. "address": "0x419328"
  95. },
  96. {
  97. "name": "MessageBoxA",
  98. "address": "0x41932c"
  99. },
  100. {
  101. "name": "CharNextW",
  102. "address": "0x419330"
  103. }
  104. ],
  105. "dll": "user32.dll"
  106. },
  107. {
  108. "imports": [
  109. {
  110. "name": "GetACP",
  111. "address": "0x419338"
  112. },
  113. {
  114. "name": "Sleep",
  115. "address": "0x41933c"
  116. },
  117. {
  118. "name": "VirtualFree",
  119. "address": "0x419340"
  120. },
  121. {
  122. "name": "VirtualAlloc",
  123. "address": "0x419344"
  124. },
  125. {
  126. "name": "GetSystemInfo",
  127. "address": "0x419348"
  128. },
  129. {
  130. "name": "GetTickCount",
  131. "address": "0x41934c"
  132. },
  133. {
  134. "name": "QueryPerformanceCounter",
  135. "address": "0x419350"
  136. },
  137. {
  138. "name": "GetVersion",
  139. "address": "0x419354"
  140. },
  141. {
  142. "name": "GetCurrentThreadId",
  143. "address": "0x419358"
  144. },
  145. {
  146. "name": "VirtualQuery",
  147. "address": "0x41935c"
  148. },
  149. {
  150. "name": "WideCharToMultiByte",
  151. "address": "0x419360"
  152. },
  153. {
  154. "name": "MultiByteToWideChar",
  155. "address": "0x419364"
  156. },
  157. {
  158. "name": "lstrlenW",
  159. "address": "0x419368"
  160. },
  161. {
  162. "name": "lstrcpynW",
  163. "address": "0x41936c"
  164. },
  165. {
  166. "name": "LoadLibraryExW",
  167. "address": "0x419370"
  168. },
  169. {
  170. "name": "GetThreadLocale",
  171. "address": "0x419374"
  172. },
  173. {
  174. "name": "GetStartupInfoA",
  175. "address": "0x419378"
  176. },
  177. {
  178. "name": "GetProcAddress",
  179. "address": "0x41937c"
  180. },
  181. {
  182. "name": "GetModuleHandleW",
  183. "address": "0x419380"
  184. },
  185. {
  186. "name": "GetModuleFileNameW",
  187. "address": "0x419384"
  188. },
  189. {
  190. "name": "GetLocaleInfoW",
  191. "address": "0x419388"
  192. },
  193. {
  194. "name": "GetCommandLineW",
  195. "address": "0x41938c"
  196. },
  197. {
  198. "name": "FreeLibrary",
  199. "address": "0x419390"
  200. },
  201. {
  202. "name": "FindFirstFileW",
  203. "address": "0x419394"
  204. },
  205. {
  206. "name": "FindClose",
  207. "address": "0x419398"
  208. },
  209. {
  210. "name": "ExitProcess",
  211. "address": "0x41939c"
  212. },
  213. {
  214. "name": "WriteFile",
  215. "address": "0x4193a0"
  216. },
  217. {
  218. "name": "UnhandledExceptionFilter",
  219. "address": "0x4193a4"
  220. },
  221. {
  222. "name": "RtlUnwind",
  223. "address": "0x4193a8"
  224. },
  225. {
  226. "name": "RaiseException",
  227. "address": "0x4193ac"
  228. },
  229. {
  230. "name": "GetStdHandle",
  231. "address": "0x4193b0"
  232. },
  233. {
  234. "name": "CloseHandle",
  235. "address": "0x4193b4"
  236. }
  237. ],
  238. "dll": "kernel32.dll"
  239. },
  240. {
  241. "imports": [
  242. {
  243. "name": "TlsSetValue",
  244. "address": "0x4193bc"
  245. },
  246. {
  247. "name": "TlsGetValue",
  248. "address": "0x4193c0"
  249. },
  250. {
  251. "name": "LocalAlloc",
  252. "address": "0x4193c4"
  253. },
  254. {
  255. "name": "GetModuleHandleW",
  256. "address": "0x4193c8"
  257. }
  258. ],
  259. "dll": "kernel32.dll"
  260. },
  261. {
  262. "imports": [
  263. {
  264. "name": "CreateWindowExW",
  265. "address": "0x4193d0"
  266. },
  267. {
  268. "name": "TranslateMessage",
  269. "address": "0x4193d4"
  270. },
  271. {
  272. "name": "SetWindowLongW",
  273. "address": "0x4193d8"
  274. },
  275. {
  276. "name": "PeekMessageW",
  277. "address": "0x4193dc"
  278. },
  279. {
  280. "name": "MsgWaitForMultipleObjects",
  281. "address": "0x4193e0"
  282. },
  283. {
  284. "name": "MessageBoxW",
  285. "address": "0x4193e4"
  286. },
  287. {
  288. "name": "LoadStringW",
  289. "address": "0x4193e8"
  290. },
  291. {
  292. "name": "GetSystemMetrics",
  293. "address": "0x4193ec"
  294. },
  295. {
  296. "name": "ExitWindowsEx",
  297. "address": "0x4193f0"
  298. },
  299. {
  300. "name": "DispatchMessageW",
  301. "address": "0x4193f4"
  302. },
  303. {
  304. "name": "DestroyWindow",
  305. "address": "0x4193f8"
  306. },
  307. {
  308. "name": "CharUpperBuffW",
  309. "address": "0x4193fc"
  310. },
  311. {
  312. "name": "CallWindowProcW",
  313. "address": "0x419400"
  314. }
  315. ],
  316. "dll": "user32.dll"
  317. },
  318. {
  319. "imports": [
  320. {
  321. "name": "WriteFile",
  322. "address": "0x419408"
  323. },
  324. {
  325. "name": "WideCharToMultiByte",
  326. "address": "0x41940c"
  327. },
  328. {
  329. "name": "WaitForSingleObject",
  330. "address": "0x419410"
  331. },
  332. {
  333. "name": "VirtualQuery",
  334. "address": "0x419414"
  335. },
  336. {
  337. "name": "VirtualProtect",
  338. "address": "0x419418"
  339. },
  340. {
  341. "name": "VirtualFree",
  342. "address": "0x41941c"
  343. },
  344. {
  345. "name": "VirtualAlloc",
  346. "address": "0x419420"
  347. },
  348. {
  349. "name": "SizeofResource",
  350. "address": "0x419424"
  351. },
  352. {
  353. "name": "SignalObjectAndWait",
  354. "address": "0x419428"
  355. },
  356. {
  357. "name": "SetLastError",
  358. "address": "0x41942c"
  359. },
  360. {
  361. "name": "SetFilePointer",
  362. "address": "0x419430"
  363. },
  364. {
  365. "name": "SetEvent",
  366. "address": "0x419434"
  367. },
  368. {
  369. "name": "SetErrorMode",
  370. "address": "0x419438"
  371. },
  372. {
  373. "name": "SetEndOfFile",
  374. "address": "0x41943c"
  375. },
  376. {
  377. "name": "ResetEvent",
  378. "address": "0x419440"
  379. },
  380. {
  381. "name": "RemoveDirectoryW",
  382. "address": "0x419444"
  383. },
  384. {
  385. "name": "ReadFile",
  386. "address": "0x419448"
  387. },
  388. {
  389. "name": "MultiByteToWideChar",
  390. "address": "0x41944c"
  391. },
  392. {
  393. "name": "LockResource",
  394. "address": "0x419450"
  395. },
  396. {
  397. "name": "LoadResource",
  398. "address": "0x419454"
  399. },
  400. {
  401. "name": "LoadLibraryW",
  402. "address": "0x419458"
  403. },
  404. {
  405. "name": "GetWindowsDirectoryW",
  406. "address": "0x41945c"
  407. },
  408. {
  409. "name": "GetVersionExW",
  410. "address": "0x419460"
  411. },
  412. {
  413. "name": "GetVersion",
  414. "address": "0x419464"
  415. },
  416. {
  417. "name": "GetUserDefaultLangID",
  418. "address": "0x419468"
  419. },
  420. {
  421. "name": "GetThreadLocale",
  422. "address": "0x41946c"
  423. },
  424. {
  425. "name": "GetSystemInfo",
  426. "address": "0x419470"
  427. },
  428. {
  429. "name": "GetSystemDirectoryW",
  430. "address": "0x419474"
  431. },
  432. {
  433. "name": "GetStdHandle",
  434. "address": "0x419478"
  435. },
  436. {
  437. "name": "GetProcAddress",
  438. "address": "0x41947c"
  439. },
  440. {
  441. "name": "GetModuleHandleW",
  442. "address": "0x419480"
  443. },
  444. {
  445. "name": "GetModuleFileNameW",
  446. "address": "0x419484"
  447. },
  448. {
  449. "name": "GetLocaleInfoW",
  450. "address": "0x419488"
  451. },
  452. {
  453. "name": "GetLastError",
  454. "address": "0x41948c"
  455. },
  456. {
  457. "name": "GetFullPathNameW",
  458. "address": "0x419490"
  459. },
  460. {
  461. "name": "GetFileSize",
  462. "address": "0x419494"
  463. },
  464. {
  465. "name": "GetFileAttributesW",
  466. "address": "0x419498"
  467. },
  468. {
  469. "name": "GetExitCodeProcess",
  470. "address": "0x41949c"
  471. },
  472. {
  473. "name": "GetEnvironmentVariableW",
  474. "address": "0x4194a0"
  475. },
  476. {
  477. "name": "GetDiskFreeSpaceW",
  478. "address": "0x4194a4"
  479. },
  480. {
  481. "name": "GetCurrentProcess",
  482. "address": "0x4194a8"
  483. },
  484. {
  485. "name": "GetCommandLineW",
  486. "address": "0x4194ac"
  487. },
  488. {
  489. "name": "GetCPInfo",
  490. "address": "0x4194b0"
  491. },
  492. {
  493. "name": "InterlockedExchange",
  494. "address": "0x4194b4"
  495. },
  496. {
  497. "name": "InterlockedCompareExchange",
  498. "address": "0x4194b8"
  499. },
  500. {
  501. "name": "FreeLibrary",
  502. "address": "0x4194bc"
  503. },
  504. {
  505. "name": "FormatMessageW",
  506. "address": "0x4194c0"
  507. },
  508. {
  509. "name": "FindResourceW",
  510. "address": "0x4194c4"
  511. },
  512. {
  513. "name": "EnumCalendarInfoW",
  514. "address": "0x4194c8"
  515. },
  516. {
  517. "name": "DeleteFileW",
  518. "address": "0x4194cc"
  519. },
  520. {
  521. "name": "CreateProcessW",
  522. "address": "0x4194d0"
  523. },
  524. {
  525. "name": "CreateFileW",
  526. "address": "0x4194d4"
  527. },
  528. {
  529. "name": "CreateEventW",
  530. "address": "0x4194d8"
  531. },
  532. {
  533. "name": "CreateDirectoryW",
  534. "address": "0x4194dc"
  535. },
  536. {
  537. "name": "CloseHandle",
  538. "address": "0x4194e0"
  539. }
  540. ],
  541. "dll": "kernel32.dll"
  542. },
  543. {
  544. "imports": [
  545. {
  546. "name": "RegQueryValueExW",
  547. "address": "0x4194e8"
  548. },
  549. {
  550. "name": "RegOpenKeyExW",
  551. "address": "0x4194ec"
  552. },
  553. {
  554. "name": "RegCloseKey",
  555. "address": "0x4194f0"
  556. },
  557. {
  558. "name": "OpenProcessToken",
  559. "address": "0x4194f4"
  560. },
  561. {
  562. "name": "LookupPrivilegeValueW",
  563. "address": "0x4194f8"
  564. }
  565. ],
  566. "dll": "advapi32.dll"
  567. },
  568. {
  569. "imports": [
  570. {
  571. "name": "InitCommonControls",
  572. "address": "0x419500"
  573. }
  574. ],
  575. "dll": "comctl32.dll"
  576. },
  577. {
  578. "imports": [
  579. {
  580. "name": "Sleep",
  581. "address": "0x419508"
  582. }
  583. ],
  584. "dll": "kernel32.dll"
  585. },
  586. {
  587. "imports": [
  588. {
  589. "name": "AdjustTokenPrivileges",
  590. "address": "0x419510"
  591. }
  592. ],
  593. "dll": "advapi32.dll"
  594. }
  595. ],
  596. "digital_signers": null,
  597. "exported_dll_name": null,
  598. "actual_checksum": "0x0029c4df",
  599. "overlay": {
  600. "size": "0x00223e78",
  601. "offset": "0x00076e00"
  602. },
  603. "imagebase": "0x00400000",
  604. "reported_checksum": "0x0029c4df",
  605. "icon_hash": null,
  606. "entrypoint": "0x004117dc",
  607. "timestamp": "2016-04-06 14:39:04",
  608. "osversion": "5.0",
  609. "sections": [
  610. {
  611. "name": ".text",
  612. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  613. "virtual_address": "0x00001000",
  614. "size_of_data": "0x0000f400",
  615. "entropy": "6.38",
  616. "raw_address": "0x00000400",
  617. "virtual_size": "0x0000f244",
  618. "characteristics_raw": "0x60000020"
  619. },
  620. {
  621. "name": ".itext",
  622. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  623. "virtual_address": "0x00011000",
  624. "size_of_data": "0x00001000",
  625. "entropy": "5.73",
  626. "raw_address": "0x0000f800",
  627. "virtual_size": "0x00000f64",
  628. "characteristics_raw": "0x60000020"
  629. },
  630. {
  631. "name": ".data",
  632. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  633. "virtual_address": "0x00012000",
  634. "size_of_data": "0x00000e00",
  635. "entropy": "2.30",
  636. "raw_address": "0x00010800",
  637. "virtual_size": "0x00000c88",
  638. "characteristics_raw": "0xc0000040"
  639. },
  640. {
  641. "name": ".bss",
  642. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  643. "virtual_address": "0x00013000",
  644. "size_of_data": "0x00000000",
  645. "entropy": "0.00",
  646. "raw_address": "0x00011600",
  647. "virtual_size": "0x000056bc",
  648. "characteristics_raw": "0xc0000000"
  649. },
  650. {
  651. "name": ".idata",
  652. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  653. "virtual_address": "0x00019000",
  654. "size_of_data": "0x00001000",
  655. "entropy": "4.60",
  656. "raw_address": "0x00011600",
  657. "virtual_size": "0x00000e04",
  658. "characteristics_raw": "0xc0000040"
  659. },
  660. {
  661. "name": ".tls",
  662. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  663. "virtual_address": "0x0001a000",
  664. "size_of_data": "0x00000000",
  665. "entropy": "0.00",
  666. "raw_address": "0x00012600",
  667. "virtual_size": "0x00000008",
  668. "characteristics_raw": "0xc0000000"
  669. },
  670. {
  671. "name": ".rdata",
  672. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  673. "virtual_address": "0x0001b000",
  674. "size_of_data": "0x00000200",
  675. "entropy": "0.20",
  676. "raw_address": "0x00012600",
  677. "virtual_size": "0x00000018",
  678. "characteristics_raw": "0x40000040"
  679. },
  680. {
  681. "name": ".rsrc",
  682. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  683. "virtual_address": "0x0001c000",
  684. "size_of_data": "0x00064600",
  685. "entropy": "4.91",
  686. "raw_address": "0x00012800",
  687. "virtual_size": "0x00064408",
  688. "characteristics_raw": "0x40000040"
  689. }
  690. ],
  691. "resources": [],
  692. "dirents": [
  693. {
  694. "virtual_address": "0x00000000",
  695. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  696. "size": "0x00000000"
  697. },
  698. {
  699. "virtual_address": "0x00019000",
  700. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  701. "size": "0x00000e04"
  702. },
  703. {
  704. "virtual_address": "0x0001c000",
  705. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  706. "size": "0x00064408"
  707. },
  708. {
  709. "virtual_address": "0x00000000",
  710. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  711. "size": "0x00000000"
  712. },
  713. {
  714. "virtual_address": "0x002995e0",
  715. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  716. "size": "0x00001698"
  717. },
  718. {
  719. "virtual_address": "0x00000000",
  720. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  721. "size": "0x00000000"
  722. },
  723. {
  724. "virtual_address": "0x00000000",
  725. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  726. "size": "0x00000000"
  727. },
  728. {
  729. "virtual_address": "0x00000000",
  730. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  731. "size": "0x00000000"
  732. },
  733. {
  734. "virtual_address": "0x00000000",
  735. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  736. "size": "0x00000000"
  737. },
  738. {
  739. "virtual_address": "0x0001b000",
  740. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  741. "size": "0x00000018"
  742. },
  743. {
  744. "virtual_address": "0x00000000",
  745. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  746. "size": "0x00000000"
  747. },
  748. {
  749. "virtual_address": "0x00000000",
  750. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  751. "size": "0x00000000"
  752. },
  753. {
  754. "virtual_address": "0x00019304",
  755. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  756. "size": "0x00000214"
  757. },
  758. {
  759. "virtual_address": "0x00000000",
  760. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  761. "size": "0x00000000"
  762. },
  763. {
  764. "virtual_address": "0x00000000",
  765. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  766. "size": "0x00000000"
  767. },
  768. {
  769. "virtual_address": "0x00000000",
  770. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  771. "size": "0x00000000"
  772. }
  773. ],
  774. "exports": [],
  775. "guest_signers": {},
  776. "imphash": "20dd26497880c05caed9305b3c8b9109",
  777. "icon_fuzzy": null,
  778. "icon": null,
  779. "pdbpath": null,
  780. "imported_dll_count": 11,
  781. "versioninfo": []
  782. }
  783. }
  784.  
  785. [*] Resolved APIs: []
  786.  
  787. [*] Static Analysis: {
  788. "pe": {
  789. "peid_signatures": null,
  790. "imports": [
  791. {
  792. "imports": [
  793. {
  794. "name": "SysFreeString",
  795. "address": "0x419304"
  796. },
  797. {
  798. "name": "SysReAllocStringLen",
  799. "address": "0x419308"
  800. },
  801. {
  802. "name": "SysAllocStringLen",
  803. "address": "0x41930c"
  804. }
  805. ],
  806. "dll": "oleaut32.dll"
  807. },
  808. {
  809. "imports": [
  810. {
  811. "name": "RegQueryValueExW",
  812. "address": "0x419314"
  813. },
  814. {
  815. "name": "RegOpenKeyExW",
  816. "address": "0x419318"
  817. },
  818. {
  819. "name": "RegCloseKey",
  820. "address": "0x41931c"
  821. }
  822. ],
  823. "dll": "advapi32.dll"
  824. },
  825. {
  826. "imports": [
  827. {
  828. "name": "GetKeyboardType",
  829. "address": "0x419324"
  830. },
  831. {
  832. "name": "LoadStringW",
  833. "address": "0x419328"
  834. },
  835. {
  836. "name": "MessageBoxA",
  837. "address": "0x41932c"
  838. },
  839. {
  840. "name": "CharNextW",
  841. "address": "0x419330"
  842. }
  843. ],
  844. "dll": "user32.dll"
  845. },
  846. {
  847. "imports": [
  848. {
  849. "name": "GetACP",
  850. "address": "0x419338"
  851. },
  852. {
  853. "name": "Sleep",
  854. "address": "0x41933c"
  855. },
  856. {
  857. "name": "VirtualFree",
  858. "address": "0x419340"
  859. },
  860. {
  861. "name": "VirtualAlloc",
  862. "address": "0x419344"
  863. },
  864. {
  865. "name": "GetSystemInfo",
  866. "address": "0x419348"
  867. },
  868. {
  869. "name": "GetTickCount",
  870. "address": "0x41934c"
  871. },
  872. {
  873. "name": "QueryPerformanceCounter",
  874. "address": "0x419350"
  875. },
  876. {
  877. "name": "GetVersion",
  878. "address": "0x419354"
  879. },
  880. {
  881. "name": "GetCurrentThreadId",
  882. "address": "0x419358"
  883. },
  884. {
  885. "name": "VirtualQuery",
  886. "address": "0x41935c"
  887. },
  888. {
  889. "name": "WideCharToMultiByte",
  890. "address": "0x419360"
  891. },
  892. {
  893. "name": "MultiByteToWideChar",
  894. "address": "0x419364"
  895. },
  896. {
  897. "name": "lstrlenW",
  898. "address": "0x419368"
  899. },
  900. {
  901. "name": "lstrcpynW",
  902. "address": "0x41936c"
  903. },
  904. {
  905. "name": "LoadLibraryExW",
  906. "address": "0x419370"
  907. },
  908. {
  909. "name": "GetThreadLocale",
  910. "address": "0x419374"
  911. },
  912. {
  913. "name": "GetStartupInfoA",
  914. "address": "0x419378"
  915. },
  916. {
  917. "name": "GetProcAddress",
  918. "address": "0x41937c"
  919. },
  920. {
  921. "name": "GetModuleHandleW",
  922. "address": "0x419380"
  923. },
  924. {
  925. "name": "GetModuleFileNameW",
  926. "address": "0x419384"
  927. },
  928. {
  929. "name": "GetLocaleInfoW",
  930. "address": "0x419388"
  931. },
  932. {
  933. "name": "GetCommandLineW",
  934. "address": "0x41938c"
  935. },
  936. {
  937. "name": "FreeLibrary",
  938. "address": "0x419390"
  939. },
  940. {
  941. "name": "FindFirstFileW",
  942. "address": "0x419394"
  943. },
  944. {
  945. "name": "FindClose",
  946. "address": "0x419398"
  947. },
  948. {
  949. "name": "ExitProcess",
  950. "address": "0x41939c"
  951. },
  952. {
  953. "name": "WriteFile",
  954. "address": "0x4193a0"
  955. },
  956. {
  957. "name": "UnhandledExceptionFilter",
  958. "address": "0x4193a4"
  959. },
  960. {
  961. "name": "RtlUnwind",
  962. "address": "0x4193a8"
  963. },
  964. {
  965. "name": "RaiseException",
  966. "address": "0x4193ac"
  967. },
  968. {
  969. "name": "GetStdHandle",
  970. "address": "0x4193b0"
  971. },
  972. {
  973. "name": "CloseHandle",
  974. "address": "0x4193b4"
  975. }
  976. ],
  977. "dll": "kernel32.dll"
  978. },
  979. {
  980. "imports": [
  981. {
  982. "name": "TlsSetValue",
  983. "address": "0x4193bc"
  984. },
  985. {
  986. "name": "TlsGetValue",
  987. "address": "0x4193c0"
  988. },
  989. {
  990. "name": "LocalAlloc",
  991. "address": "0x4193c4"
  992. },
  993. {
  994. "name": "GetModuleHandleW",
  995. "address": "0x4193c8"
  996. }
  997. ],
  998. "dll": "kernel32.dll"
  999. },
  1000. {
  1001. "imports": [
  1002. {
  1003. "name": "CreateWindowExW",
  1004. "address": "0x4193d0"
  1005. },
  1006. {
  1007. "name": "TranslateMessage",
  1008. "address": "0x4193d4"
  1009. },
  1010. {
  1011. "name": "SetWindowLongW",
  1012. "address": "0x4193d8"
  1013. },
  1014. {
  1015. "name": "PeekMessageW",
  1016. "address": "0x4193dc"
  1017. },
  1018. {
  1019. "name": "MsgWaitForMultipleObjects",
  1020. "address": "0x4193e0"
  1021. },
  1022. {
  1023. "name": "MessageBoxW",
  1024. "address": "0x4193e4"
  1025. },
  1026. {
  1027. "name": "LoadStringW",
  1028. "address": "0x4193e8"
  1029. },
  1030. {
  1031. "name": "GetSystemMetrics",
  1032. "address": "0x4193ec"
  1033. },
  1034. {
  1035. "name": "ExitWindowsEx",
  1036. "address": "0x4193f0"
  1037. },
  1038. {
  1039. "name": "DispatchMessageW",
  1040. "address": "0x4193f4"
  1041. },
  1042. {
  1043. "name": "DestroyWindow",
  1044. "address": "0x4193f8"
  1045. },
  1046. {
  1047. "name": "CharUpperBuffW",
  1048. "address": "0x4193fc"
  1049. },
  1050. {
  1051. "name": "CallWindowProcW",
  1052. "address": "0x419400"
  1053. }
  1054. ],
  1055. "dll": "user32.dll"
  1056. },
  1057. {
  1058. "imports": [
  1059. {
  1060. "name": "WriteFile",
  1061. "address": "0x419408"
  1062. },
  1063. {
  1064. "name": "WideCharToMultiByte",
  1065. "address": "0x41940c"
  1066. },
  1067. {
  1068. "name": "WaitForSingleObject",
  1069. "address": "0x419410"
  1070. },
  1071. {
  1072. "name": "VirtualQuery",
  1073. "address": "0x419414"
  1074. },
  1075. {
  1076. "name": "VirtualProtect",
  1077. "address": "0x419418"
  1078. },
  1079. {
  1080. "name": "VirtualFree",
  1081. "address": "0x41941c"
  1082. },
  1083. {
  1084. "name": "VirtualAlloc",
  1085. "address": "0x419420"
  1086. },
  1087. {
  1088. "name": "SizeofResource",
  1089. "address": "0x419424"
  1090. },
  1091. {
  1092. "name": "SignalObjectAndWait",
  1093. "address": "0x419428"
  1094. },
  1095. {
  1096. "name": "SetLastError",
  1097. "address": "0x41942c"
  1098. },
  1099. {
  1100. "name": "SetFilePointer",
  1101. "address": "0x419430"
  1102. },
  1103. {
  1104. "name": "SetEvent",
  1105. "address": "0x419434"
  1106. },
  1107. {
  1108. "name": "SetErrorMode",
  1109. "address": "0x419438"
  1110. },
  1111. {
  1112. "name": "SetEndOfFile",
  1113. "address": "0x41943c"
  1114. },
  1115. {
  1116. "name": "ResetEvent",
  1117. "address": "0x419440"
  1118. },
  1119. {
  1120. "name": "RemoveDirectoryW",
  1121. "address": "0x419444"
  1122. },
  1123. {
  1124. "name": "ReadFile",
  1125. "address": "0x419448"
  1126. },
  1127. {
  1128. "name": "MultiByteToWideChar",
  1129. "address": "0x41944c"
  1130. },
  1131. {
  1132. "name": "LockResource",
  1133. "address": "0x419450"
  1134. },
  1135. {
  1136. "name": "LoadResource",
  1137. "address": "0x419454"
  1138. },
  1139. {
  1140. "name": "LoadLibraryW",
  1141. "address": "0x419458"
  1142. },
  1143. {
  1144. "name": "GetWindowsDirectoryW",
  1145. "address": "0x41945c"
  1146. },
  1147. {
  1148. "name": "GetVersionExW",
  1149. "address": "0x419460"
  1150. },
  1151. {
  1152. "name": "GetVersion",
  1153. "address": "0x419464"
  1154. },
  1155. {
  1156. "name": "GetUserDefaultLangID",
  1157. "address": "0x419468"
  1158. },
  1159. {
  1160. "name": "GetThreadLocale",
  1161. "address": "0x41946c"
  1162. },
  1163. {
  1164. "name": "GetSystemInfo",
  1165. "address": "0x419470"
  1166. },
  1167. {
  1168. "name": "GetSystemDirectoryW",
  1169. "address": "0x419474"
  1170. },
  1171. {
  1172. "name": "GetStdHandle",
  1173. "address": "0x419478"
  1174. },
  1175. {
  1176. "name": "GetProcAddress",
  1177. "address": "0x41947c"
  1178. },
  1179. {
  1180. "name": "GetModuleHandleW",
  1181. "address": "0x419480"
  1182. },
  1183. {
  1184. "name": "GetModuleFileNameW",
  1185. "address": "0x419484"
  1186. },
  1187. {
  1188. "name": "GetLocaleInfoW",
  1189. "address": "0x419488"
  1190. },
  1191. {
  1192. "name": "GetLastError",
  1193. "address": "0x41948c"
  1194. },
  1195. {
  1196. "name": "GetFullPathNameW",
  1197. "address": "0x419490"
  1198. },
  1199. {
  1200. "name": "GetFileSize",
  1201. "address": "0x419494"
  1202. },
  1203. {
  1204. "name": "GetFileAttributesW",
  1205. "address": "0x419498"
  1206. },
  1207. {
  1208. "name": "GetExitCodeProcess",
  1209. "address": "0x41949c"
  1210. },
  1211. {
  1212. "name": "GetEnvironmentVariableW",
  1213. "address": "0x4194a0"
  1214. },
  1215. {
  1216. "name": "GetDiskFreeSpaceW",
  1217. "address": "0x4194a4"
  1218. },
  1219. {
  1220. "name": "GetCurrentProcess",
  1221. "address": "0x4194a8"
  1222. },
  1223. {
  1224. "name": "GetCommandLineW",
  1225. "address": "0x4194ac"
  1226. },
  1227. {
  1228. "name": "GetCPInfo",
  1229. "address": "0x4194b0"
  1230. },
  1231. {
  1232. "name": "InterlockedExchange",
  1233. "address": "0x4194b4"
  1234. },
  1235. {
  1236. "name": "InterlockedCompareExchange",
  1237. "address": "0x4194b8"
  1238. },
  1239. {
  1240. "name": "FreeLibrary",
  1241. "address": "0x4194bc"
  1242. },
  1243. {
  1244. "name": "FormatMessageW",
  1245. "address": "0x4194c0"
  1246. },
  1247. {
  1248. "name": "FindResourceW",
  1249. "address": "0x4194c4"
  1250. },
  1251. {
  1252. "name": "EnumCalendarInfoW",
  1253. "address": "0x4194c8"
  1254. },
  1255. {
  1256. "name": "DeleteFileW",
  1257. "address": "0x4194cc"
  1258. },
  1259. {
  1260. "name": "CreateProcessW",
  1261. "address": "0x4194d0"
  1262. },
  1263. {
  1264. "name": "CreateFileW",
  1265. "address": "0x4194d4"
  1266. },
  1267. {
  1268. "name": "CreateEventW",
  1269. "address": "0x4194d8"
  1270. },
  1271. {
  1272. "name": "CreateDirectoryW",
  1273. "address": "0x4194dc"
  1274. },
  1275. {
  1276. "name": "CloseHandle",
  1277. "address": "0x4194e0"
  1278. }
  1279. ],
  1280. "dll": "kernel32.dll"
  1281. },
  1282. {
  1283. "imports": [
  1284. {
  1285. "name": "RegQueryValueExW",
  1286. "address": "0x4194e8"
  1287. },
  1288. {
  1289. "name": "RegOpenKeyExW",
  1290. "address": "0x4194ec"
  1291. },
  1292. {
  1293. "name": "RegCloseKey",
  1294. "address": "0x4194f0"
  1295. },
  1296. {
  1297. "name": "OpenProcessToken",
  1298. "address": "0x4194f4"
  1299. },
  1300. {
  1301. "name": "LookupPrivilegeValueW",
  1302. "address": "0x4194f8"
  1303. }
  1304. ],
  1305. "dll": "advapi32.dll"
  1306. },
  1307. {
  1308. "imports": [
  1309. {
  1310. "name": "InitCommonControls",
  1311. "address": "0x419500"
  1312. }
  1313. ],
  1314. "dll": "comctl32.dll"
  1315. },
  1316. {
  1317. "imports": [
  1318. {
  1319. "name": "Sleep",
  1320. "address": "0x419508"
  1321. }
  1322. ],
  1323. "dll": "kernel32.dll"
  1324. },
  1325. {
  1326. "imports": [
  1327. {
  1328. "name": "AdjustTokenPrivileges",
  1329. "address": "0x419510"
  1330. }
  1331. ],
  1332. "dll": "advapi32.dll"
  1333. }
  1334. ],
  1335. "digital_signers": null,
  1336. "exported_dll_name": null,
  1337. "actual_checksum": "0x0029c4df",
  1338. "overlay": {
  1339. "size": "0x00223e78",
  1340. "offset": "0x00076e00"
  1341. },
  1342. "imagebase": "0x00400000",
  1343. "reported_checksum": "0x0029c4df",
  1344. "icon_hash": null,
  1345. "entrypoint": "0x004117dc",
  1346. "timestamp": "2016-04-06 14:39:04",
  1347. "osversion": "5.0",
  1348. "sections": [
  1349. {
  1350. "name": ".text",
  1351. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1352. "virtual_address": "0x00001000",
  1353. "size_of_data": "0x0000f400",
  1354. "entropy": "6.38",
  1355. "raw_address": "0x00000400",
  1356. "virtual_size": "0x0000f244",
  1357. "characteristics_raw": "0x60000020"
  1358. },
  1359. {
  1360. "name": ".itext",
  1361. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1362. "virtual_address": "0x00011000",
  1363. "size_of_data": "0x00001000",
  1364. "entropy": "5.73",
  1365. "raw_address": "0x0000f800",
  1366. "virtual_size": "0x00000f64",
  1367. "characteristics_raw": "0x60000020"
  1368. },
  1369. {
  1370. "name": ".data",
  1371. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1372. "virtual_address": "0x00012000",
  1373. "size_of_data": "0x00000e00",
  1374. "entropy": "2.30",
  1375. "raw_address": "0x00010800",
  1376. "virtual_size": "0x00000c88",
  1377. "characteristics_raw": "0xc0000040"
  1378. },
  1379. {
  1380. "name": ".bss",
  1381. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1382. "virtual_address": "0x00013000",
  1383. "size_of_data": "0x00000000",
  1384. "entropy": "0.00",
  1385. "raw_address": "0x00011600",
  1386. "virtual_size": "0x000056bc",
  1387. "characteristics_raw": "0xc0000000"
  1388. },
  1389. {
  1390. "name": ".idata",
  1391. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1392. "virtual_address": "0x00019000",
  1393. "size_of_data": "0x00001000",
  1394. "entropy": "4.60",
  1395. "raw_address": "0x00011600",
  1396. "virtual_size": "0x00000e04",
  1397. "characteristics_raw": "0xc0000040"
  1398. },
  1399. {
  1400. "name": ".tls",
  1401. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1402. "virtual_address": "0x0001a000",
  1403. "size_of_data": "0x00000000",
  1404. "entropy": "0.00",
  1405. "raw_address": "0x00012600",
  1406. "virtual_size": "0x00000008",
  1407. "characteristics_raw": "0xc0000000"
  1408. },
  1409. {
  1410. "name": ".rdata",
  1411. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1412. "virtual_address": "0x0001b000",
  1413. "size_of_data": "0x00000200",
  1414. "entropy": "0.20",
  1415. "raw_address": "0x00012600",
  1416. "virtual_size": "0x00000018",
  1417. "characteristics_raw": "0x40000040"
  1418. },
  1419. {
  1420. "name": ".rsrc",
  1421. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1422. "virtual_address": "0x0001c000",
  1423. "size_of_data": "0x00064600",
  1424. "entropy": "4.91",
  1425. "raw_address": "0x00012800",
  1426. "virtual_size": "0x00064408",
  1427. "characteristics_raw": "0x40000040"
  1428. }
  1429. ],
  1430. "resources": [],
  1431. "dirents": [
  1432. {
  1433. "virtual_address": "0x00000000",
  1434. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1435. "size": "0x00000000"
  1436. },
  1437. {
  1438. "virtual_address": "0x00019000",
  1439. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1440. "size": "0x00000e04"
  1441. },
  1442. {
  1443. "virtual_address": "0x0001c000",
  1444. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1445. "size": "0x00064408"
  1446. },
  1447. {
  1448. "virtual_address": "0x00000000",
  1449. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1450. "size": "0x00000000"
  1451. },
  1452. {
  1453. "virtual_address": "0x002995e0",
  1454. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1455. "size": "0x00001698"
  1456. },
  1457. {
  1458. "virtual_address": "0x00000000",
  1459. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1460. "size": "0x00000000"
  1461. },
  1462. {
  1463. "virtual_address": "0x00000000",
  1464. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1465. "size": "0x00000000"
  1466. },
  1467. {
  1468. "virtual_address": "0x00000000",
  1469. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1470. "size": "0x00000000"
  1471. },
  1472. {
  1473. "virtual_address": "0x00000000",
  1474. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1475. "size": "0x00000000"
  1476. },
  1477. {
  1478. "virtual_address": "0x0001b000",
  1479. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1480. "size": "0x00000018"
  1481. },
  1482. {
  1483. "virtual_address": "0x00000000",
  1484. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1485. "size": "0x00000000"
  1486. },
  1487. {
  1488. "virtual_address": "0x00000000",
  1489. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1490. "size": "0x00000000"
  1491. },
  1492. {
  1493. "virtual_address": "0x00019304",
  1494. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1495. "size": "0x00000214"
  1496. },
  1497. {
  1498. "virtual_address": "0x00000000",
  1499. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1500. "size": "0x00000000"
  1501. },
  1502. {
  1503. "virtual_address": "0x00000000",
  1504. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1505. "size": "0x00000000"
  1506. },
  1507. {
  1508. "virtual_address": "0x00000000",
  1509. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1510. "size": "0x00000000"
  1511. }
  1512. ],
  1513. "exports": [],
  1514. "guest_signers": {},
  1515. "imphash": "20dd26497880c05caed9305b3c8b9109",
  1516. "icon_fuzzy": null,
  1517. "icon": null,
  1518. "pdbpath": null,
  1519. "imported_dll_count": 11,
  1520. "versioninfo": []
  1521. }
  1522. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!