API tools faq
paste
paladin316

Exes_a7fd91aeb977945147b224a74fbafa38_jpg_2019-06-27_22_30.json

paladin316
Jun 27th, 2019
2,216
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 72.71 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Shade"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_a7fd91aeb977945147b224a74fbafa38.jpg"
  7. [*] File Size: 1443016
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "fa00b548595f34cc5f8c5a7c00fd65e353eb71849a006be3e4774f4af335cf3c"
  10. [*] MD5: "a7fd91aeb977945147b224a74fbafa38"
  11. [*] SHA1: "d8b6984c149d0ceecbbee77c4d43d39aa01e37d5"
  12. [*] SHA512: "3f2a0be44a2e15ffb5f34f9acdc6a0f9e7ed2e24788750b67a48dc7bcabdccc0a616be040b6f7984260e2c1c622d44e6025a11116162f20b2019dbbc122a0121"
  13. [*] CRC32: "8E0ED24C"
  14. [*] SSDEEP: "24576:DSVujyq46MrDjZiRVvSdrZVN24SH5M7k7CydRuVRd:WujyoyjZ0atZVBSZW7vb"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "File has been identified by 56 Antiviruses on VirusTotal as malicious",
  21. "Details": [
  22. {
  23. "MicroWorld-eScan": "Trojan.GenericKD.31722612"
  24. },
  25. {
  26. "CAT-QuickHeal": "TrojanRansom.Shade"
  27. },
  28. {
  29. "McAfee": "Trojan-FQRJ!A7FD91AEB977"
  30. },
  31. {
  32. "Cylance": "Unsafe"
  33. },
  34. {
  35. "AegisLab": "Trojan.Win32.Shade.4!c"
  36. },
  37. {
  38. "K7AntiVirus": "Riskware ( 0040eff71 )"
  39. },
  40. {
  41. "Alibaba": "Trojan:Win32/Emotet.c8b0dddd"
  42. },
  43. {
  44. "K7GW": "Riskware ( 0040eff71 )"
  45. },
  46. {
  47. "Cybereason": "malicious.eb9779"
  48. },
  49. {
  50. "TrendMicro": "Ransom.Win32.SHADE.THBBHAI"
  51. },
  52. {
  53. "Cyren": "W32/Trojan.KJPL-2293"
  54. },
  55. {
  56. "Symantec": "Ransom.Troldesh"
  57. },
  58. {
  59. "APEX": "Malicious"
  60. },
  61. {
  62. "Paloalto": "generic.ml"
  63. },
  64. {
  65. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  66. },
  67. {
  68. "BitDefender": "Trojan.GenericKD.31722612"
  69. },
  70. {
  71. "NANO-Antivirus": "Trojan.Win32.Shade.fnijef"
  72. },
  73. {
  74. "ViRobot": "Trojan.Win32.Ransom.1443016.A"
  75. },
  76. {
  77. "Rising": "Ransom.Shade!8.12CC (CLOUD)"
  78. },
  79. {
  80. "Endgame": "malicious (high confidence)"
  81. },
  82. {
  83. "Sophos": "Mal/Cerber-AL"
  84. },
  85. {
  86. "Comodo": "Malware@#38vim0lvki9ok"
  87. },
  88. {
  89. "F-Secure": "Trojan.TR/Kryptik.nwidl"
  90. },
  91. {
  92. "DrWeb": "Trojan.Encoder.27279"
  93. },
  94. {
  95. "VIPRE": "Trojan-Downloader.Tibs.gen (v)"
  96. },
  97. {
  98. "Invincea": "heuristic"
  99. },
  100. {
  101. "McAfee-GW-Edition": "Trojan-FQRJ!A7FD91AEB977"
  102. },
  103. {
  104. "Trapmine": "malicious.moderate.ml.score"
  105. },
  106. {
  107. "FireEye": "Generic.mg.a7fd91aeb9779451"
  108. },
  109. {
  110. "Emsisoft": "Trojan-Ransom.Shade (A)"
  111. },
  112. {
  113. "Ikarus": "Trojan-Banker.Emotet"
  114. },
  115. {
  116. "Webroot": "W32.Malware.Gen"
  117. },
  118. {
  119. "Avira": "TR/Kryptik.nwidl"
  120. },
  121. {
  122. "Antiy-AVL": "Trojan[Ransom]/Win32.Shade"
  123. },
  124. {
  125. "Microsoft": "Trojan:Win32/Emotet.PB"
  126. },
  127. {
  128. "Arcabit": "Trojan.Generic.D1E40C74"
  129. },
  130. {
  131. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  132. },
  133. {
  134. "GData": "Trojan.GenericKD.31722612"
  135. },
  136. {
  137. "AhnLab-V3": "Trojan/Win32.Fsysna.R256594"
  138. },
  139. {
  140. "Acronis": "suspicious"
  141. },
  142. {
  143. "VBA32": "BScope.Malware-Cryptor.Winlock.2014"
  144. },
  145. {
  146. "ALYac": "Trojan.Ransom.Shade"
  147. },
  148. {
  149. "Ad-Aware": "Trojan.GenericKD.31722612"
  150. },
  151. {
  152. "Malwarebytes": "Trojan.Agent"
  153. },
  154. {
  155. "Panda": "Trj/GdSda.A"
  156. },
  157. {
  158. "ESET-NOD32": "a variant of Win32/Kryptik.GQAI"
  159. },
  160. {
  161. "TrendMicro-HouseCall": "Ransom.Win32.SHADE.SM2.hp"
  162. },
  163. {
  164. "Tencent": "Win32.Trojan.Falsesign.Lpvh"
  165. },
  166. {
  167. "Yandex": "Trojan.Shade!"
  168. },
  169. {
  170. "SentinelOne": "DFI - Malicious PE"
  171. },
  172. {
  173. "eGambit": "PE.Heur.InvalidSig"
  174. },
  175. {
  176. "Fortinet": "W32/Kryptik.CPES!tr"
  177. },
  178. {
  179. "AVG": "Win32:Malware-gen"
  180. },
  181. {
  182. "Avast": "Win32:Malware-gen"
  183. },
  184. {
  185. "CrowdStrike": "win/malicious_confidence_70% (W)"
  186. },
  187. {
  188. "Qihoo-360": "Win32/Trojan.Ransom.495"
  189. }
  190. ]
  191. },
  192. {
  193. "Description": "Anomalous binary characteristics",
  194. "Details": [
  195. {
  196. "anomaly": "Actual checksum does not match that reported in PE header"
  197. }
  198. ]
  199. }
  200. ]
  201.  
  202. [*] Started Service: []
  203.  
  204. [*] Executed Commands: []
  205.  
  206. [*] Mutexes: []
  207.  
  208. [*] Modified Files: []
  209.  
  210. [*] Deleted Files: []
  211.  
  212. [*] Modified Registry Keys: []
  213.  
  214. [*] Deleted Registry Keys: []
  215.  
  216. [*] DNS Communications: []
  217.  
  218. [*] Domains: []
  219.  
  220. [*] Network Communication - ICMP: []
  221.  
  222. [*] Network Communication - HTTP: []
  223.  
  224. [*] Network Communication - SMTP: []
  225.  
  226. [*] Network Communication - Hosts: []
  227.  
  228. [*] Network Communication - IRC: []
  229.  
  230. [*] Static Analysis: {
  231. "pe": {
  232. "peid_signatures": null,
  233. "imports": [
  234. {
  235. "imports": [
  236. {
  237. "name": "LoadLibraryA",
  238. "address": "0x56030c"
  239. },
  240. {
  241. "name": "GetProcAddress",
  242. "address": "0x560310"
  243. },
  244. {
  245. "name": "GetModuleHandleA",
  246. "address": "0x560314"
  247. },
  248. {
  249. "name": "VirtualAllocEx",
  250. "address": "0x560318"
  251. },
  252. {
  253. "name": "RaiseException",
  254. "address": "0x56031c"
  255. },
  256. {
  257. "name": "InitializeCriticalSection",
  258. "address": "0x560320"
  259. },
  260. {
  261. "name": "DeleteCriticalSection",
  262. "address": "0x560324"
  263. },
  264. {
  265. "name": "InterlockedIncrement",
  266. "address": "0x560328"
  267. },
  268. {
  269. "name": "InterlockedDecrement",
  270. "address": "0x56032c"
  271. },
  272. {
  273. "name": "lstrlenW",
  274. "address": "0x560330"
  275. },
  276. {
  277. "name": "lstrcpyW",
  278. "address": "0x560334"
  279. },
  280. {
  281. "name": "GetModuleHandleW",
  282. "address": "0x560338"
  283. },
  284. {
  285. "name": "GetModuleFileNameW",
  286. "address": "0x56033c"
  287. },
  288. {
  289. "name": "GetLastError",
  290. "address": "0x560340"
  291. },
  292. {
  293. "name": "LeaveCriticalSection",
  294. "address": "0x560344"
  295. },
  296. {
  297. "name": "GetVersionExW",
  298. "address": "0x560348"
  299. },
  300. {
  301. "name": "FreeLibrary",
  302. "address": "0x56034c"
  303. },
  304. {
  305. "name": "MultiByteToWideChar",
  306. "address": "0x560350"
  307. },
  308. {
  309. "name": "SizeofResource",
  310. "address": "0x560354"
  311. },
  312. {
  313. "name": "LoadResource",
  314. "address": "0x560358"
  315. },
  316. {
  317. "name": "FindResourceW",
  318. "address": "0x56035c"
  319. },
  320. {
  321. "name": "LoadLibraryExW",
  322. "address": "0x560360"
  323. },
  324. {
  325. "name": "lstrcmpiW",
  326. "address": "0x560364"
  327. },
  328. {
  329. "name": "lstrcpynW",
  330. "address": "0x560368"
  331. },
  332. {
  333. "name": "DeviceIoControl",
  334. "address": "0x56036c"
  335. },
  336. {
  337. "name": "SetConsoleCtrlHandler",
  338. "address": "0x560370"
  339. },
  340. {
  341. "name": "GetVersionExA",
  342. "address": "0x560374"
  343. },
  344. {
  345. "name": "GetThreadLocale",
  346. "address": "0x560378"
  347. },
  348. {
  349. "name": "GetLocaleInfoA",
  350. "address": "0x56037c"
  351. },
  352. {
  353. "name": "ExitProcess",
  354. "address": "0x560380"
  355. },
  356. {
  357. "name": "QueryPerformanceCounter",
  358. "address": "0x560384"
  359. },
  360. {
  361. "name": "GetTickCount",
  362. "address": "0x560388"
  363. },
  364. {
  365. "name": "GetCurrentProcessId",
  366. "address": "0x56038c"
  367. },
  368. {
  369. "name": "GetACP",
  370. "address": "0x560390"
  371. },
  372. {
  373. "name": "InterlockedExchange",
  374. "address": "0x560394"
  375. },
  376. {
  377. "name": "EnterCriticalSection",
  378. "address": "0x560398"
  379. },
  380. {
  381. "name": "GetSystemTimeAsFileTime",
  382. "address": "0x56039c"
  383. },
  384. {
  385. "name": "CloseHandle",
  386. "address": "0x5603a0"
  387. },
  388. {
  389. "name": "GetCurrentThreadId",
  390. "address": "0x5603a4"
  391. },
  392. {
  393. "name": "GetCurrentProcess",
  394. "address": "0x5603a8"
  395. },
  396. {
  397. "name": "GetCurrentThread",
  398. "address": "0x5603ac"
  399. },
  400. {
  401. "name": "DuplicateHandle",
  402. "address": "0x5603b0"
  403. },
  404. {
  405. "name": "LockResource",
  406. "address": "0x5603b4"
  407. },
  408. {
  409. "name": "DeleteFileW",
  410. "address": "0x5603b8"
  411. },
  412. {
  413. "name": "LoadLibraryW",
  414. "address": "0x5603bc"
  415. },
  416. {
  417. "name": "LocalFree",
  418. "address": "0x5603c0"
  419. },
  420. {
  421. "name": "IsProcessorFeaturePresent",
  422. "address": "0x5603c4"
  423. },
  424. {
  425. "name": "CreateProcessW",
  426. "address": "0x5603c8"
  427. },
  428. {
  429. "name": "GetExitCodeProcess",
  430. "address": "0x5603cc"
  431. },
  432. {
  433. "name": "GetFileAttributesW",
  434. "address": "0x5603d0"
  435. },
  436. {
  437. "name": "SetLastError",
  438. "address": "0x5603d4"
  439. },
  440. {
  441. "name": "FindNextFileW",
  442. "address": "0x5603d8"
  443. },
  444. {
  445. "name": "Sleep",
  446. "address": "0x5603dc"
  447. },
  448. {
  449. "name": "SetFileAttributesW",
  450. "address": "0x5603e0"
  451. },
  452. {
  453. "name": "CopyFileW",
  454. "address": "0x5603e4"
  455. },
  456. {
  457. "name": "ReadFile",
  458. "address": "0x5603e8"
  459. },
  460. {
  461. "name": "FindClose",
  462. "address": "0x5603ec"
  463. },
  464. {
  465. "name": "WideCharToMultiByte",
  466. "address": "0x5603f0"
  467. },
  468. {
  469. "name": "FreeEnvironmentStringsW",
  470. "address": "0x5603f4"
  471. },
  472. {
  473. "name": "GetEnvironmentStringsW",
  474. "address": "0x5603f8"
  475. },
  476. {
  477. "name": "GetCommandLineA",
  478. "address": "0x5603fc"
  479. },
  480. {
  481. "name": "GetOEMCP",
  482. "address": "0x560400"
  483. },
  484. {
  485. "name": "IsValidCodePage",
  486. "address": "0x560404"
  487. },
  488. {
  489. "name": "OpenProcess",
  490. "address": "0x560408"
  491. },
  492. {
  493. "name": "FreeResource",
  494. "address": "0x56040c"
  495. },
  496. {
  497. "name": "ResumeThread",
  498. "address": "0x560410"
  499. },
  500. {
  501. "name": "CreateFileW",
  502. "address": "0x560414"
  503. },
  504. {
  505. "name": "WaitForSingleObject",
  506. "address": "0x560418"
  507. },
  508. {
  509. "name": "SetEndOfFile",
  510. "address": "0x56041c"
  511. },
  512. {
  513. "name": "WaitForMultipleObjects",
  514. "address": "0x560420"
  515. },
  516. {
  517. "name": "WriteFile",
  518. "address": "0x560424"
  519. },
  520. {
  521. "name": "HeapSize",
  522. "address": "0x560428"
  523. },
  524. {
  525. "name": "GetCommandLineW",
  526. "address": "0x56042c"
  527. },
  528. {
  529. "name": "SetStdHandle",
  530. "address": "0x560430"
  531. },
  532. {
  533. "name": "WriteConsoleW",
  534. "address": "0x560434"
  535. },
  536. {
  537. "name": "ReadConsoleW",
  538. "address": "0x560438"
  539. },
  540. {
  541. "name": "FlushFileBuffers",
  542. "address": "0x56043c"
  543. },
  544. {
  545. "name": "FindFirstFileExW",
  546. "address": "0x560440"
  547. },
  548. {
  549. "name": "GetProcessHeap",
  550. "address": "0x560444"
  551. },
  552. {
  553. "name": "SetFilePointerEx",
  554. "address": "0x560448"
  555. },
  556. {
  557. "name": "EnumSystemLocalesW",
  558. "address": "0x56044c"
  559. },
  560. {
  561. "name": "GetStringTypeW",
  562. "address": "0x560450"
  563. },
  564. {
  565. "name": "EncodePointer",
  566. "address": "0x560454"
  567. },
  568. {
  569. "name": "DecodePointer",
  570. "address": "0x560458"
  571. },
  572. {
  573. "name": "InitializeCriticalSectionAndSpinCount",
  574. "address": "0x56045c"
  575. },
  576. {
  577. "name": "TlsAlloc",
  578. "address": "0x560460"
  579. },
  580. {
  581. "name": "TlsGetValue",
  582. "address": "0x560464"
  583. },
  584. {
  585. "name": "TlsSetValue",
  586. "address": "0x560468"
  587. },
  588. {
  589. "name": "TlsFree",
  590. "address": "0x56046c"
  591. },
  592. {
  593. "name": "LCMapStringW",
  594. "address": "0x560470"
  595. },
  596. {
  597. "name": "GetLocaleInfoW",
  598. "address": "0x560474"
  599. },
  600. {
  601. "name": "GetCPInfo",
  602. "address": "0x560478"
  603. },
  604. {
  605. "name": "UnhandledExceptionFilter",
  606. "address": "0x56047c"
  607. },
  608. {
  609. "name": "SetUnhandledExceptionFilter",
  610. "address": "0x560480"
  611. },
  612. {
  613. "name": "TerminateProcess",
  614. "address": "0x560484"
  615. },
  616. {
  617. "name": "IsDebuggerPresent",
  618. "address": "0x560488"
  619. },
  620. {
  621. "name": "GetStartupInfoW",
  622. "address": "0x56048c"
  623. },
  624. {
  625. "name": "InitializeSListHead",
  626. "address": "0x560490"
  627. },
  628. {
  629. "name": "RtlUnwind",
  630. "address": "0x560494"
  631. },
  632. {
  633. "name": "HeapAlloc",
  634. "address": "0x560498"
  635. },
  636. {
  637. "name": "HeapReAlloc",
  638. "address": "0x56049c"
  639. },
  640. {
  641. "name": "HeapFree",
  642. "address": "0x5604a0"
  643. },
  644. {
  645. "name": "GetModuleHandleExW",
  646. "address": "0x5604a4"
  647. },
  648. {
  649. "name": "GetStdHandle",
  650. "address": "0x5604a8"
  651. },
  652. {
  653. "name": "GetConsoleCP",
  654. "address": "0x5604ac"
  655. },
  656. {
  657. "name": "GetConsoleMode",
  658. "address": "0x5604b0"
  659. },
  660. {
  661. "name": "GetFileType",
  662. "address": "0x5604b4"
  663. },
  664. {
  665. "name": "IsValidLocale",
  666. "address": "0x5604b8"
  667. },
  668. {
  669. "name": "GetUserDefaultLCID",
  670. "address": "0x5604bc"
  671. }
  672. ],
  673. "dll": "KERNEL32.dll"
  674. },
  675. {
  676. "imports": [
  677. {
  678. "name": "CharNextW",
  679. "address": "0x5604c4"
  680. },
  681. {
  682. "name": "PostThreadMessageW",
  683. "address": "0x5604c8"
  684. },
  685. {
  686. "name": "GetMessageW",
  687. "address": "0x5604cc"
  688. },
  689. {
  690. "name": "MsgWaitForMultipleObjects",
  691. "address": "0x5604d0"
  692. },
  693. {
  694. "name": "TranslateMessage",
  695. "address": "0x5604d4"
  696. },
  697. {
  698. "name": "DispatchMessageW",
  699. "address": "0x5604d8"
  700. },
  701. {
  702. "name": "PeekMessageW",
  703. "address": "0x5604dc"
  704. },
  705. {
  706. "name": "UnregisterClassA",
  707. "address": "0x5604e0"
  708. },
  709. {
  710. "name": "UnregisterClassW",
  711. "address": "0x5604e4"
  712. },
  713. {
  714. "name": "SetMenuItemInfoA",
  715. "address": "0x5604e8"
  716. },
  717. {
  718. "name": "GetUserObjectSecurity",
  719. "address": "0x5604ec"
  720. },
  721. {
  722. "name": "GetScrollPos",
  723. "address": "0x5604f0"
  724. },
  725. {
  726. "name": "LoadStringA",
  727. "address": "0x5604f4"
  728. },
  729. {
  730. "name": "EndPaint",
  731. "address": "0x5604f8"
  732. },
  733. {
  734. "name": "GetKeyboardLayoutList",
  735. "address": "0x5604fc"
  736. },
  737. {
  738. "name": "DefFrameProcA",
  739. "address": "0x560500"
  740. },
  741. {
  742. "name": "ShowWindow",
  743. "address": "0x560504"
  744. },
  745. {
  746. "name": "GetClassNameA",
  747. "address": "0x560508"
  748. },
  749. {
  750. "name": "LoadCursorA",
  751. "address": "0x56050c"
  752. },
  753. {
  754. "name": "DrawTextA",
  755. "address": "0x560510"
  756. },
  757. {
  758. "name": "IsCharLowerA",
  759. "address": "0x560514"
  760. },
  761. {
  762. "name": "SetDoubleClickTime",
  763. "address": "0x560518"
  764. },
  765. {
  766. "name": "GetWindowThreadProcessId",
  767. "address": "0x56051c"
  768. },
  769. {
  770. "name": "GetShellWindow",
  771. "address": "0x560520"
  772. },
  773. {
  774. "name": "GetThreadDesktop",
  775. "address": "0x560524"
  776. },
  777. {
  778. "name": "GetUserObjectInformationW",
  779. "address": "0x560528"
  780. },
  781. {
  782. "name": "GetDesktopWindow",
  783. "address": "0x56052c"
  784. },
  785. {
  786. "name": "GetProcessWindowStation",
  787. "address": "0x560530"
  788. },
  789. {
  790. "name": "GetKeyboardType",
  791. "address": "0x560534"
  792. },
  793. {
  794. "name": "MessageBoxA",
  795. "address": "0x560538"
  796. },
  797. {
  798. "name": "CharNextA",
  799. "address": "0x56053c"
  800. },
  801. {
  802. "name": "SetThreadDesktop",
  803. "address": "0x560540"
  804. },
  805. {
  806. "name": "ReleaseDC",
  807. "address": "0x560544"
  808. },
  809. {
  810. "name": "OpenInputDesktop",
  811. "address": "0x560548"
  812. },
  813. {
  814. "name": "LoadIconA",
  815. "address": "0x56054c"
  816. },
  817. {
  818. "name": "GetWindowRect",
  819. "address": "0x560550"
  820. },
  821. {
  822. "name": "GetWindowDC",
  823. "address": "0x560554"
  824. },
  825. {
  826. "name": "GetUserObjectInformationA",
  827. "address": "0x560558"
  828. },
  829. {
  830. "name": "GetSystemMetrics",
  831. "address": "0x56055c"
  832. },
  833. {
  834. "name": "GetSysColor",
  835. "address": "0x560560"
  836. },
  837. {
  838. "name": "GetIconInfo",
  839. "address": "0x560564"
  840. },
  841. {
  842. "name": "GetDC",
  843. "address": "0x560568"
  844. },
  845. {
  846. "name": "GetClipboardData",
  847. "address": "0x56056c"
  848. },
  849. {
  850. "name": "FillRect",
  851. "address": "0x560570"
  852. },
  853. {
  854. "name": "DrawIconEx",
  855. "address": "0x560574"
  856. },
  857. {
  858. "name": "DestroyIcon",
  859. "address": "0x560578"
  860. },
  861. {
  862. "name": "CreateIcon",
  863. "address": "0x56057c"
  864. },
  865. {
  866. "name": "CloseDesktop",
  867. "address": "0x560580"
  868. },
  869. {
  870. "name": "CharLowerBuffA",
  871. "address": "0x560584"
  872. },
  873. {
  874. "name": "CharToOemA",
  875. "address": "0x560588"
  876. }
  877. ],
  878. "dll": "USER32.dll"
  879. },
  880. {
  881. "imports": [
  882. {
  883. "name": "STROBJ_bEnumPositionsOnly",
  884. "address": "0x560590"
  885. },
  886. {
  887. "name": "GdiEndDocEMF",
  888. "address": "0x560594"
  889. },
  890. {
  891. "name": "STROBJ_vEnumStart",
  892. "address": "0x560598"
  893. },
  894. {
  895. "name": "GetRelAbs",
  896. "address": "0x56059c"
  897. },
  898. {
  899. "name": "GetGlyphIndicesW",
  900. "address": "0x5605a0"
  901. },
  902. {
  903. "name": "CreatePatternBrush",
  904. "address": "0x5605a4"
  905. },
  906. {
  907. "name": "GdiResetDCEMF",
  908. "address": "0x5605a8"
  909. },
  910. {
  911. "name": "EngCreateClip",
  912. "address": "0x5605ac"
  913. },
  914. {
  915. "name": "GdiGetCodePage",
  916. "address": "0x5605b0"
  917. },
  918. {
  919. "name": "DPtoLP",
  920. "address": "0x5605b4"
  921. },
  922. {
  923. "name": "GetCharacterPlacementA",
  924. "address": "0x5605b8"
  925. },
  926. {
  927. "name": "PlgBlt",
  928. "address": "0x5605bc"
  929. }
  930. ],
  931. "dll": "GDI32.dll"
  932. },
  933. {
  934. "imports": [
  935. {
  936. "name": "RegQueryValueExW",
  937. "address": "0x5605c4"
  938. },
  939. {
  940. "name": "RegDeleteKeyW",
  941. "address": "0x5605c8"
  942. },
  943. {
  944. "name": "RegDeleteValueW",
  945. "address": "0x5605cc"
  946. },
  947. {
  948. "name": "RegOpenKeyExW",
  949. "address": "0x5605d0"
  950. },
  951. {
  952. "name": "RegCloseKey",
  953. "address": "0x5605d4"
  954. },
  955. {
  956. "name": "RegQueryInfoKeyW",
  957. "address": "0x5605d8"
  958. },
  959. {
  960. "name": "RegEnumKeyExW",
  961. "address": "0x5605dc"
  962. },
  963. {
  964. "name": "RegSetValueExW",
  965. "address": "0x5605e0"
  966. },
  967. {
  968. "name": "RegCreateKeyExW",
  969. "address": "0x5605e4"
  970. },
  971. {
  972. "name": "LookupPrivilegeValueW",
  973. "address": "0x5605e8"
  974. },
  975. {
  976. "name": "AdjustTokenPrivileges",
  977. "address": "0x5605ec"
  978. },
  979. {
  980. "name": "RevertToSelf",
  981. "address": "0x5605f0"
  982. },
  983. {
  984. "name": "RegOpenCurrentUser",
  985. "address": "0x5605f4"
  986. },
  987. {
  988. "name": "SaferCloseLevel",
  989. "address": "0x5605f8"
  990. },
  991. {
  992. "name": "ImpersonateLoggedOnUser",
  993. "address": "0x5605fc"
  994. },
  995. {
  996. "name": "SaferCreateLevel",
  997. "address": "0x560600"
  998. },
  999. {
  1000. "name": "OpenProcessToken",
  1001. "address": "0x560604"
  1002. },
  1003. {
  1004. "name": "DuplicateToken",
  1005. "address": "0x560608"
  1006. },
  1007. {
  1008. "name": "DuplicateTokenEx",
  1009. "address": "0x56060c"
  1010. },
  1011. {
  1012. "name": "SaferComputeTokenFromLevel",
  1013. "address": "0x560610"
  1014. }
  1015. ],
  1016. "dll": "ADVAPI32.dll"
  1017. },
  1018. {
  1019. "imports": [
  1020. {
  1021. "name": "SHEmptyRecycleBinW",
  1022. "address": "0x560618"
  1023. },
  1024. {
  1025. "name": "SHGetSpecialFolderPathW",
  1026. "address": "0x56061c"
  1027. },
  1028. {
  1029. "name": "ShellExecuteExW",
  1030. "address": "0x560620"
  1031. },
  1032. {
  1033. "name": "CommandLineToArgvW",
  1034. "address": "0x560624"
  1035. }
  1036. ],
  1037. "dll": "SHELL32.dll"
  1038. },
  1039. {
  1040. "imports": [
  1041. {
  1042. "name": "CoUninitialize",
  1043. "address": "0x56062c"
  1044. },
  1045. {
  1046. "name": "CoInitializeEx",
  1047. "address": "0x560630"
  1048. },
  1049. {
  1050. "name": "CoTaskMemRealloc",
  1051. "address": "0x560634"
  1052. },
  1053. {
  1054. "name": "CoTaskMemAlloc",
  1055. "address": "0x560638"
  1056. },
  1057. {
  1058. "name": "CoTaskMemFree",
  1059. "address": "0x56063c"
  1060. },
  1061. {
  1062. "name": "CoCreateInstance",
  1063. "address": "0x560640"
  1064. },
  1065. {
  1066. "name": "StringFromIID",
  1067. "address": "0x560644"
  1068. }
  1069. ],
  1070. "dll": "ole32.dll"
  1071. }
  1072. ],
  1073. "digital_signers": null,
  1074. "exported_dll_name": null,
  1075. "actual_checksum": "0x0016d1b7",
  1076. "overlay": {
  1077. "size": "0x00000ac8",
  1078. "offset": "0x0015fa00"
  1079. },
  1080. "imagebase": "0x00400000",
  1081. "reported_checksum": "0x001611a3",
  1082. "icon_hash": null,
  1083. "entrypoint": "0x00401770",
  1084. "timestamp": "2019-02-22 00:01:24",
  1085. "osversion": "4.0",
  1086. "sections": [
  1087. {
  1088. "name": ".text",
  1089. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1090. "virtual_address": "0x00001000",
  1091. "size_of_data": "0x00142a00",
  1092. "entropy": "6.29",
  1093. "raw_address": "0x00000200",
  1094. "virtual_size": "0x0014293b",
  1095. "characteristics_raw": "0x60000020"
  1096. },
  1097. {
  1098. "name": ".rdata",
  1099. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1100. "virtual_address": "0x00144000",
  1101. "size_of_data": "0x00000800",
  1102. "entropy": "4.41",
  1103. "raw_address": "0x00142c00",
  1104. "virtual_size": "0x00000708",
  1105. "characteristics_raw": "0x40000040"
  1106. },
  1107. {
  1108. "name": ".data",
  1109. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1110. "virtual_address": "0x00145000",
  1111. "size_of_data": "0x0001c600",
  1112. "entropy": "5.15",
  1113. "raw_address": "0x00143400",
  1114. "virtual_size": "0x000c257c",
  1115. "characteristics_raw": "0xc0000040"
  1116. }
  1117. ],
  1118. "resources": [],
  1119. "dirents": [
  1120. {
  1121. "virtual_address": "0x00000000",
  1122. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1123. "size": "0x00000000"
  1124. },
  1125. {
  1126. "virtual_address": "0x0015ff40",
  1127. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1128. "size": "0x0000008c"
  1129. },
  1130. {
  1131. "virtual_address": "0x00000000",
  1132. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1133. "size": "0x00000000"
  1134. },
  1135. {
  1136. "virtual_address": "0x00000000",
  1137. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1138. "size": "0x00000000"
  1139. },
  1140. {
  1141. "virtual_address": "0x0015fa00",
  1142. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1143. "size": "0x00000ac8"
  1144. },
  1145. {
  1146. "virtual_address": "0x00000000",
  1147. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1148. "size": "0x00000000"
  1149. },
  1150. {
  1151. "virtual_address": "0x00000000",
  1152. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1153. "size": "0x00000000"
  1154. },
  1155. {
  1156. "virtual_address": "0x00000000",
  1157. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1158. "size": "0x00000000"
  1159. },
  1160. {
  1161. "virtual_address": "0x00000000",
  1162. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1163. "size": "0x00000000"
  1164. },
  1165. {
  1166. "virtual_address": "0x00000000",
  1167. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1168. "size": "0x00000000"
  1169. },
  1170. {
  1171. "virtual_address": "0x00000000",
  1172. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1173. "size": "0x00000000"
  1174. },
  1175. {
  1176. "virtual_address": "0x00000000",
  1177. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1178. "size": "0x00000000"
  1179. },
  1180. {
  1181. "virtual_address": "0x0016030c",
  1182. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1183. "size": "0x00000340"
  1184. },
  1185. {
  1186. "virtual_address": "0x00000000",
  1187. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1188. "size": "0x00000000"
  1189. },
  1190. {
  1191. "virtual_address": "0x00000000",
  1192. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1193. "size": "0x00000000"
  1194. },
  1195. {
  1196. "virtual_address": "0x00000000",
  1197. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1198. "size": "0x00000000"
  1199. }
  1200. ],
  1201. "exports": [],
  1202. "guest_signers": {},
  1203. "imphash": "67fbf7073cb9208667b33eb6568c525e",
  1204. "icon_fuzzy": null,
  1205. "icon": null,
  1206. "pdbpath": null,
  1207. "imported_dll_count": 6,
  1208. "versioninfo": []
  1209. }
  1210. }
  1211.  
  1212. [*] Resolved APIs: []
  1213.  
  1214. [*] Static Analysis: {
  1215. "pe": {
  1216. "peid_signatures": null,
  1217. "imports": [
  1218. {
  1219. "imports": [
  1220. {
  1221. "name": "LoadLibraryA",
  1222. "address": "0x56030c"
  1223. },
  1224. {
  1225. "name": "GetProcAddress",
  1226. "address": "0x560310"
  1227. },
  1228. {
  1229. "name": "GetModuleHandleA",
  1230. "address": "0x560314"
  1231. },
  1232. {
  1233. "name": "VirtualAllocEx",
  1234. "address": "0x560318"
  1235. },
  1236. {
  1237. "name": "RaiseException",
  1238. "address": "0x56031c"
  1239. },
  1240. {
  1241. "name": "InitializeCriticalSection",
  1242. "address": "0x560320"
  1243. },
  1244. {
  1245. "name": "DeleteCriticalSection",
  1246. "address": "0x560324"
  1247. },
  1248. {
  1249. "name": "InterlockedIncrement",
  1250. "address": "0x560328"
  1251. },
  1252. {
  1253. "name": "InterlockedDecrement",
  1254. "address": "0x56032c"
  1255. },
  1256. {
  1257. "name": "lstrlenW",
  1258. "address": "0x560330"
  1259. },
  1260. {
  1261. "name": "lstrcpyW",
  1262. "address": "0x560334"
  1263. },
  1264. {
  1265. "name": "GetModuleHandleW",
  1266. "address": "0x560338"
  1267. },
  1268. {
  1269. "name": "GetModuleFileNameW",
  1270. "address": "0x56033c"
  1271. },
  1272. {
  1273. "name": "GetLastError",
  1274. "address": "0x560340"
  1275. },
  1276. {
  1277. "name": "LeaveCriticalSection",
  1278. "address": "0x560344"
  1279. },
  1280. {
  1281. "name": "GetVersionExW",
  1282. "address": "0x560348"
  1283. },
  1284. {
  1285. "name": "FreeLibrary",
  1286. "address": "0x56034c"
  1287. },
  1288. {
  1289. "name": "MultiByteToWideChar",
  1290. "address": "0x560350"
  1291. },
  1292. {
  1293. "name": "SizeofResource",
  1294. "address": "0x560354"
  1295. },
  1296. {
  1297. "name": "LoadResource",
  1298. "address": "0x560358"
  1299. },
  1300. {
  1301. "name": "FindResourceW",
  1302. "address": "0x56035c"
  1303. },
  1304. {
  1305. "name": "LoadLibraryExW",
  1306. "address": "0x560360"
  1307. },
  1308. {
  1309. "name": "lstrcmpiW",
  1310. "address": "0x560364"
  1311. },
  1312. {
  1313. "name": "lstrcpynW",
  1314. "address": "0x560368"
  1315. },
  1316. {
  1317. "name": "DeviceIoControl",
  1318. "address": "0x56036c"
  1319. },
  1320. {
  1321. "name": "SetConsoleCtrlHandler",
  1322. "address": "0x560370"
  1323. },
  1324. {
  1325. "name": "GetVersionExA",
  1326. "address": "0x560374"
  1327. },
  1328. {
  1329. "name": "GetThreadLocale",
  1330. "address": "0x560378"
  1331. },
  1332. {
  1333. "name": "GetLocaleInfoA",
  1334. "address": "0x56037c"
  1335. },
  1336. {
  1337. "name": "ExitProcess",
  1338. "address": "0x560380"
  1339. },
  1340. {
  1341. "name": "QueryPerformanceCounter",
  1342. "address": "0x560384"
  1343. },
  1344. {
  1345. "name": "GetTickCount",
  1346. "address": "0x560388"
  1347. },
  1348. {
  1349. "name": "GetCurrentProcessId",
  1350. "address": "0x56038c"
  1351. },
  1352. {
  1353. "name": "GetACP",
  1354. "address": "0x560390"
  1355. },
  1356. {
  1357. "name": "InterlockedExchange",
  1358. "address": "0x560394"
  1359. },
  1360. {
  1361. "name": "EnterCriticalSection",
  1362. "address": "0x560398"
  1363. },
  1364. {
  1365. "name": "GetSystemTimeAsFileTime",
  1366. "address": "0x56039c"
  1367. },
  1368. {
  1369. "name": "CloseHandle",
  1370. "address": "0x5603a0"
  1371. },
  1372. {
  1373. "name": "GetCurrentThreadId",
  1374. "address": "0x5603a4"
  1375. },
  1376. {
  1377. "name": "GetCurrentProcess",
  1378. "address": "0x5603a8"
  1379. },
  1380. {
  1381. "name": "GetCurrentThread",
  1382. "address": "0x5603ac"
  1383. },
  1384. {
  1385. "name": "DuplicateHandle",
  1386. "address": "0x5603b0"
  1387. },
  1388. {
  1389. "name": "LockResource",
  1390. "address": "0x5603b4"
  1391. },
  1392. {
  1393. "name": "DeleteFileW",
  1394. "address": "0x5603b8"
  1395. },
  1396. {
  1397. "name": "LoadLibraryW",
  1398. "address": "0x5603bc"
  1399. },
  1400. {
  1401. "name": "LocalFree",
  1402. "address": "0x5603c0"
  1403. },
  1404. {
  1405. "name": "IsProcessorFeaturePresent",
  1406. "address": "0x5603c4"
  1407. },
  1408. {
  1409. "name": "CreateProcessW",
  1410. "address": "0x5603c8"
  1411. },
  1412. {
  1413. "name": "GetExitCodeProcess",
  1414. "address": "0x5603cc"
  1415. },
  1416. {
  1417. "name": "GetFileAttributesW",
  1418. "address": "0x5603d0"
  1419. },
  1420. {
  1421. "name": "SetLastError",
  1422. "address": "0x5603d4"
  1423. },
  1424. {
  1425. "name": "FindNextFileW",
  1426. "address": "0x5603d8"
  1427. },
  1428. {
  1429. "name": "Sleep",
  1430. "address": "0x5603dc"
  1431. },
  1432. {
  1433. "name": "SetFileAttributesW",
  1434. "address": "0x5603e0"
  1435. },
  1436. {
  1437. "name": "CopyFileW",
  1438. "address": "0x5603e4"
  1439. },
  1440. {
  1441. "name": "ReadFile",
  1442. "address": "0x5603e8"
  1443. },
  1444. {
  1445. "name": "FindClose",
  1446. "address": "0x5603ec"
  1447. },
  1448. {
  1449. "name": "WideCharToMultiByte",
  1450. "address": "0x5603f0"
  1451. },
  1452. {
  1453. "name": "FreeEnvironmentStringsW",
  1454. "address": "0x5603f4"
  1455. },
  1456. {
  1457. "name": "GetEnvironmentStringsW",
  1458. "address": "0x5603f8"
  1459. },
  1460. {
  1461. "name": "GetCommandLineA",
  1462. "address": "0x5603fc"
  1463. },
  1464. {
  1465. "name": "GetOEMCP",
  1466. "address": "0x560400"
  1467. },
  1468. {
  1469. "name": "IsValidCodePage",
  1470. "address": "0x560404"
  1471. },
  1472. {
  1473. "name": "OpenProcess",
  1474. "address": "0x560408"
  1475. },
  1476. {
  1477. "name": "FreeResource",
  1478. "address": "0x56040c"
  1479. },
  1480. {
  1481. "name": "ResumeThread",
  1482. "address": "0x560410"
  1483. },
  1484. {
  1485. "name": "CreateFileW",
  1486. "address": "0x560414"
  1487. },
  1488. {
  1489. "name": "WaitForSingleObject",
  1490. "address": "0x560418"
  1491. },
  1492. {
  1493. "name": "SetEndOfFile",
  1494. "address": "0x56041c"
  1495. },
  1496. {
  1497. "name": "WaitForMultipleObjects",
  1498. "address": "0x560420"
  1499. },
  1500. {
  1501. "name": "WriteFile",
  1502. "address": "0x560424"
  1503. },
  1504. {
  1505. "name": "HeapSize",
  1506. "address": "0x560428"
  1507. },
  1508. {
  1509. "name": "GetCommandLineW",
  1510. "address": "0x56042c"
  1511. },
  1512. {
  1513. "name": "SetStdHandle",
  1514. "address": "0x560430"
  1515. },
  1516. {
  1517. "name": "WriteConsoleW",
  1518. "address": "0x560434"
  1519. },
  1520. {
  1521. "name": "ReadConsoleW",
  1522. "address": "0x560438"
  1523. },
  1524. {
  1525. "name": "FlushFileBuffers",
  1526. "address": "0x56043c"
  1527. },
  1528. {
  1529. "name": "FindFirstFileExW",
  1530. "address": "0x560440"
  1531. },
  1532. {
  1533. "name": "GetProcessHeap",
  1534. "address": "0x560444"
  1535. },
  1536. {
  1537. "name": "SetFilePointerEx",
  1538. "address": "0x560448"
  1539. },
  1540. {
  1541. "name": "EnumSystemLocalesW",
  1542. "address": "0x56044c"
  1543. },
  1544. {
  1545. "name": "GetStringTypeW",
  1546. "address": "0x560450"
  1547. },
  1548. {
  1549. "name": "EncodePointer",
  1550. "address": "0x560454"
  1551. },
  1552. {
  1553. "name": "DecodePointer",
  1554. "address": "0x560458"
  1555. },
  1556. {
  1557. "name": "InitializeCriticalSectionAndSpinCount",
  1558. "address": "0x56045c"
  1559. },
  1560. {
  1561. "name": "TlsAlloc",
  1562. "address": "0x560460"
  1563. },
  1564. {
  1565. "name": "TlsGetValue",
  1566. "address": "0x560464"
  1567. },
  1568. {
  1569. "name": "TlsSetValue",
  1570. "address": "0x560468"
  1571. },
  1572. {
  1573. "name": "TlsFree",
  1574. "address": "0x56046c"
  1575. },
  1576. {
  1577. "name": "LCMapStringW",
  1578. "address": "0x560470"
  1579. },
  1580. {
  1581. "name": "GetLocaleInfoW",
  1582. "address": "0x560474"
  1583. },
  1584. {
  1585. "name": "GetCPInfo",
  1586. "address": "0x560478"
  1587. },
  1588. {
  1589. "name": "UnhandledExceptionFilter",
  1590. "address": "0x56047c"
  1591. },
  1592. {
  1593. "name": "SetUnhandledExceptionFilter",
  1594. "address": "0x560480"
  1595. },
  1596. {
  1597. "name": "TerminateProcess",
  1598. "address": "0x560484"
  1599. },
  1600. {
  1601. "name": "IsDebuggerPresent",
  1602. "address": "0x560488"
  1603. },
  1604. {
  1605. "name": "GetStartupInfoW",
  1606. "address": "0x56048c"
  1607. },
  1608. {
  1609. "name": "InitializeSListHead",
  1610. "address": "0x560490"
  1611. },
  1612. {
  1613. "name": "RtlUnwind",
  1614. "address": "0x560494"
  1615. },
  1616. {
  1617. "name": "HeapAlloc",
  1618. "address": "0x560498"
  1619. },
  1620. {
  1621. "name": "HeapReAlloc",
  1622. "address": "0x56049c"
  1623. },
  1624. {
  1625. "name": "HeapFree",
  1626. "address": "0x5604a0"
  1627. },
  1628. {
  1629. "name": "GetModuleHandleExW",
  1630. "address": "0x5604a4"
  1631. },
  1632. {
  1633. "name": "GetStdHandle",
  1634. "address": "0x5604a8"
  1635. },
  1636. {
  1637. "name": "GetConsoleCP",
  1638. "address": "0x5604ac"
  1639. },
  1640. {
  1641. "name": "GetConsoleMode",
  1642. "address": "0x5604b0"
  1643. },
  1644. {
  1645. "name": "GetFileType",
  1646. "address": "0x5604b4"
  1647. },
  1648. {
  1649. "name": "IsValidLocale",
  1650. "address": "0x5604b8"
  1651. },
  1652. {
  1653. "name": "GetUserDefaultLCID",
  1654. "address": "0x5604bc"
  1655. }
  1656. ],
  1657. "dll": "KERNEL32.dll"
  1658. },
  1659. {
  1660. "imports": [
  1661. {
  1662. "name": "CharNextW",
  1663. "address": "0x5604c4"
  1664. },
  1665. {
  1666. "name": "PostThreadMessageW",
  1667. "address": "0x5604c8"
  1668. },
  1669. {
  1670. "name": "GetMessageW",
  1671. "address": "0x5604cc"
  1672. },
  1673. {
  1674. "name": "MsgWaitForMultipleObjects",
  1675. "address": "0x5604d0"
  1676. },
  1677. {
  1678. "name": "TranslateMessage",
  1679. "address": "0x5604d4"
  1680. },
  1681. {
  1682. "name": "DispatchMessageW",
  1683. "address": "0x5604d8"
  1684. },
  1685. {
  1686. "name": "PeekMessageW",
  1687. "address": "0x5604dc"
  1688. },
  1689. {
  1690. "name": "UnregisterClassA",
  1691. "address": "0x5604e0"
  1692. },
  1693. {
  1694. "name": "UnregisterClassW",
  1695. "address": "0x5604e4"
  1696. },
  1697. {
  1698. "name": "SetMenuItemInfoA",
  1699. "address": "0x5604e8"
  1700. },
  1701. {
  1702. "name": "GetUserObjectSecurity",
  1703. "address": "0x5604ec"
  1704. },
  1705. {
  1706. "name": "GetScrollPos",
  1707. "address": "0x5604f0"
  1708. },
  1709. {
  1710. "name": "LoadStringA",
  1711. "address": "0x5604f4"
  1712. },
  1713. {
  1714. "name": "EndPaint",
  1715. "address": "0x5604f8"
  1716. },
  1717. {
  1718. "name": "GetKeyboardLayoutList",
  1719. "address": "0x5604fc"
  1720. },
  1721. {
  1722. "name": "DefFrameProcA",
  1723. "address": "0x560500"
  1724. },
  1725. {
  1726. "name": "ShowWindow",
  1727. "address": "0x560504"
  1728. },
  1729. {
  1730. "name": "GetClassNameA",
  1731. "address": "0x560508"
  1732. },
  1733. {
  1734. "name": "LoadCursorA",
  1735. "address": "0x56050c"
  1736. },
  1737. {
  1738. "name": "DrawTextA",
  1739. "address": "0x560510"
  1740. },
  1741. {
  1742. "name": "IsCharLowerA",
  1743. "address": "0x560514"
  1744. },
  1745. {
  1746. "name": "SetDoubleClickTime",
  1747. "address": "0x560518"
  1748. },
  1749. {
  1750. "name": "GetWindowThreadProcessId",
  1751. "address": "0x56051c"
  1752. },
  1753. {
  1754. "name": "GetShellWindow",
  1755. "address": "0x560520"
  1756. },
  1757. {
  1758. "name": "GetThreadDesktop",
  1759. "address": "0x560524"
  1760. },
  1761. {
  1762. "name": "GetUserObjectInformationW",
  1763. "address": "0x560528"
  1764. },
  1765. {
  1766. "name": "GetDesktopWindow",
  1767. "address": "0x56052c"
  1768. },
  1769. {
  1770. "name": "GetProcessWindowStation",
  1771. "address": "0x560530"
  1772. },
  1773. {
  1774. "name": "GetKeyboardType",
  1775. "address": "0x560534"
  1776. },
  1777. {
  1778. "name": "MessageBoxA",
  1779. "address": "0x560538"
  1780. },
  1781. {
  1782. "name": "CharNextA",
  1783. "address": "0x56053c"
  1784. },
  1785. {
  1786. "name": "SetThreadDesktop",
  1787. "address": "0x560540"
  1788. },
  1789. {
  1790. "name": "ReleaseDC",
  1791. "address": "0x560544"
  1792. },
  1793. {
  1794. "name": "OpenInputDesktop",
  1795. "address": "0x560548"
  1796. },
  1797. {
  1798. "name": "LoadIconA",
  1799. "address": "0x56054c"
  1800. },
  1801. {
  1802. "name": "GetWindowRect",
  1803. "address": "0x560550"
  1804. },
  1805. {
  1806. "name": "GetWindowDC",
  1807. "address": "0x560554"
  1808. },
  1809. {
  1810. "name": "GetUserObjectInformationA",
  1811. "address": "0x560558"
  1812. },
  1813. {
  1814. "name": "GetSystemMetrics",
  1815. "address": "0x56055c"
  1816. },
  1817. {
  1818. "name": "GetSysColor",
  1819. "address": "0x560560"
  1820. },
  1821. {
  1822. "name": "GetIconInfo",
  1823. "address": "0x560564"
  1824. },
  1825. {
  1826. "name": "GetDC",
  1827. "address": "0x560568"
  1828. },
  1829. {
  1830. "name": "GetClipboardData",
  1831. "address": "0x56056c"
  1832. },
  1833. {
  1834. "name": "FillRect",
  1835. "address": "0x560570"
  1836. },
  1837. {
  1838. "name": "DrawIconEx",
  1839. "address": "0x560574"
  1840. },
  1841. {
  1842. "name": "DestroyIcon",
  1843. "address": "0x560578"
  1844. },
  1845. {
  1846. "name": "CreateIcon",
  1847. "address": "0x56057c"
  1848. },
  1849. {
  1850. "name": "CloseDesktop",
  1851. "address": "0x560580"
  1852. },
  1853. {
  1854. "name": "CharLowerBuffA",
  1855. "address": "0x560584"
  1856. },
  1857. {
  1858. "name": "CharToOemA",
  1859. "address": "0x560588"
  1860. }
  1861. ],
  1862. "dll": "USER32.dll"
  1863. },
  1864. {
  1865. "imports": [
  1866. {
  1867. "name": "STROBJ_bEnumPositionsOnly",
  1868. "address": "0x560590"
  1869. },
  1870. {
  1871. "name": "GdiEndDocEMF",
  1872. "address": "0x560594"
  1873. },
  1874. {
  1875. "name": "STROBJ_vEnumStart",
  1876. "address": "0x560598"
  1877. },
  1878. {
  1879. "name": "GetRelAbs",
  1880. "address": "0x56059c"
  1881. },
  1882. {
  1883. "name": "GetGlyphIndicesW",
  1884. "address": "0x5605a0"
  1885. },
  1886. {
  1887. "name": "CreatePatternBrush",
  1888. "address": "0x5605a4"
  1889. },
  1890. {
  1891. "name": "GdiResetDCEMF",
  1892. "address": "0x5605a8"
  1893. },
  1894. {
  1895. "name": "EngCreateClip",
  1896. "address": "0x5605ac"
  1897. },
  1898. {
  1899. "name": "GdiGetCodePage",
  1900. "address": "0x5605b0"
  1901. },
  1902. {
  1903. "name": "DPtoLP",
  1904. "address": "0x5605b4"
  1905. },
  1906. {
  1907. "name": "GetCharacterPlacementA",
  1908. "address": "0x5605b8"
  1909. },
  1910. {
  1911. "name": "PlgBlt",
  1912. "address": "0x5605bc"
  1913. }
  1914. ],
  1915. "dll": "GDI32.dll"
  1916. },
  1917. {
  1918. "imports": [
  1919. {
  1920. "name": "RegQueryValueExW",
  1921. "address": "0x5605c4"
  1922. },
  1923. {
  1924. "name": "RegDeleteKeyW",
  1925. "address": "0x5605c8"
  1926. },
  1927. {
  1928. "name": "RegDeleteValueW",
  1929. "address": "0x5605cc"
  1930. },
  1931. {
  1932. "name": "RegOpenKeyExW",
  1933. "address": "0x5605d0"
  1934. },
  1935. {
  1936. "name": "RegCloseKey",
  1937. "address": "0x5605d4"
  1938. },
  1939. {
  1940. "name": "RegQueryInfoKeyW",
  1941. "address": "0x5605d8"
  1942. },
  1943. {
  1944. "name": "RegEnumKeyExW",
  1945. "address": "0x5605dc"
  1946. },
  1947. {
  1948. "name": "RegSetValueExW",
  1949. "address": "0x5605e0"
  1950. },
  1951. {
  1952. "name": "RegCreateKeyExW",
  1953. "address": "0x5605e4"
  1954. },
  1955. {
  1956. "name": "LookupPrivilegeValueW",
  1957. "address": "0x5605e8"
  1958. },
  1959. {
  1960. "name": "AdjustTokenPrivileges",
  1961. "address": "0x5605ec"
  1962. },
  1963. {
  1964. "name": "RevertToSelf",
  1965. "address": "0x5605f0"
  1966. },
  1967. {
  1968. "name": "RegOpenCurrentUser",
  1969. "address": "0x5605f4"
  1970. },
  1971. {
  1972. "name": "SaferCloseLevel",
  1973. "address": "0x5605f8"
  1974. },
  1975. {
  1976. "name": "ImpersonateLoggedOnUser",
  1977. "address": "0x5605fc"
  1978. },
  1979. {
  1980. "name": "SaferCreateLevel",
  1981. "address": "0x560600"
  1982. },
  1983. {
  1984. "name": "OpenProcessToken",
  1985. "address": "0x560604"
  1986. },
  1987. {
  1988. "name": "DuplicateToken",
  1989. "address": "0x560608"
  1990. },
  1991. {
  1992. "name": "DuplicateTokenEx",
  1993. "address": "0x56060c"
  1994. },
  1995. {
  1996. "name": "SaferComputeTokenFromLevel",
  1997. "address": "0x560610"
  1998. }
  1999. ],
  2000. "dll": "ADVAPI32.dll"
  2001. },
  2002. {
  2003. "imports": [
  2004. {
  2005. "name": "SHEmptyRecycleBinW",
  2006. "address": "0x560618"
  2007. },
  2008. {
  2009. "name": "SHGetSpecialFolderPathW",
  2010. "address": "0x56061c"
  2011. },
  2012. {
  2013. "name": "ShellExecuteExW",
  2014. "address": "0x560620"
  2015. },
  2016. {
  2017. "name": "CommandLineToArgvW",
  2018. "address": "0x560624"
  2019. }
  2020. ],
  2021. "dll": "SHELL32.dll"
  2022. },
  2023. {
  2024. "imports": [
  2025. {
  2026. "name": "CoUninitialize",
  2027. "address": "0x56062c"
  2028. },
  2029. {
  2030. "name": "CoInitializeEx",
  2031. "address": "0x560630"
  2032. },
  2033. {
  2034. "name": "CoTaskMemRealloc",
  2035. "address": "0x560634"
  2036. },
  2037. {
  2038. "name": "CoTaskMemAlloc",
  2039. "address": "0x560638"
  2040. },
  2041. {
  2042. "name": "CoTaskMemFree",
  2043. "address": "0x56063c"
  2044. },
  2045. {
  2046. "name": "CoCreateInstance",
  2047. "address": "0x560640"
  2048. },
  2049. {
  2050. "name": "StringFromIID",
  2051. "address": "0x560644"
  2052. }
  2053. ],
  2054. "dll": "ole32.dll"
  2055. }
  2056. ],
  2057. "digital_signers": null,
  2058. "exported_dll_name": null,
  2059. "actual_checksum": "0x0016d1b7",
  2060. "overlay": {
  2061. "size": "0x00000ac8",
  2062. "offset": "0x0015fa00"
  2063. },
  2064. "imagebase": "0x00400000",
  2065. "reported_checksum": "0x001611a3",
  2066. "icon_hash": null,
  2067. "entrypoint": "0x00401770",
  2068. "timestamp": "2019-02-22 00:01:24",
  2069. "osversion": "4.0",
  2070. "sections": [
  2071. {
  2072. "name": ".text",
  2073. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2074. "virtual_address": "0x00001000",
  2075. "size_of_data": "0x00142a00",
  2076. "entropy": "6.29",
  2077. "raw_address": "0x00000200",
  2078. "virtual_size": "0x0014293b",
  2079. "characteristics_raw": "0x60000020"
  2080. },
  2081. {
  2082. "name": ".rdata",
  2083. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2084. "virtual_address": "0x00144000",
  2085. "size_of_data": "0x00000800",
  2086. "entropy": "4.41",
  2087. "raw_address": "0x00142c00",
  2088. "virtual_size": "0x00000708",
  2089. "characteristics_raw": "0x40000040"
  2090. },
  2091. {
  2092. "name": ".data",
  2093. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2094. "virtual_address": "0x00145000",
  2095. "size_of_data": "0x0001c600",
  2096. "entropy": "5.15",
  2097. "raw_address": "0x00143400",
  2098. "virtual_size": "0x000c257c",
  2099. "characteristics_raw": "0xc0000040"
  2100. }
  2101. ],
  2102. "resources": [],
  2103. "dirents": [
  2104. {
  2105. "virtual_address": "0x00000000",
  2106. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2107. "size": "0x00000000"
  2108. },
  2109. {
  2110. "virtual_address": "0x0015ff40",
  2111. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2112. "size": "0x0000008c"
  2113. },
  2114. {
  2115. "virtual_address": "0x00000000",
  2116. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2117. "size": "0x00000000"
  2118. },
  2119. {
  2120. "virtual_address": "0x00000000",
  2121. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2122. "size": "0x00000000"
  2123. },
  2124. {
  2125. "virtual_address": "0x0015fa00",
  2126. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2127. "size": "0x00000ac8"
  2128. },
  2129. {
  2130. "virtual_address": "0x00000000",
  2131. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2132. "size": "0x00000000"
  2133. },
  2134. {
  2135. "virtual_address": "0x00000000",
  2136. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2137. "size": "0x00000000"
  2138. },
  2139. {
  2140. "virtual_address": "0x00000000",
  2141. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2142. "size": "0x00000000"
  2143. },
  2144. {
  2145. "virtual_address": "0x00000000",
  2146. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2147. "size": "0x00000000"
  2148. },
  2149. {
  2150. "virtual_address": "0x00000000",
  2151. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2152. "size": "0x00000000"
  2153. },
  2154. {
  2155. "virtual_address": "0x00000000",
  2156. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2157. "size": "0x00000000"
  2158. },
  2159. {
  2160. "virtual_address": "0x00000000",
  2161. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2162. "size": "0x00000000"
  2163. },
  2164. {
  2165. "virtual_address": "0x0016030c",
  2166. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2167. "size": "0x00000340"
  2168. },
  2169. {
  2170. "virtual_address": "0x00000000",
  2171. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2172. "size": "0x00000000"
  2173. },
  2174. {
  2175. "virtual_address": "0x00000000",
  2176. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2177. "size": "0x00000000"
  2178. },
  2179. {
  2180. "virtual_address": "0x00000000",
  2181. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2182. "size": "0x00000000"
  2183. }
  2184. ],
  2185. "exports": [],
  2186. "guest_signers": {},
  2187. "imphash": "67fbf7073cb9208667b33eb6568c525e",
  2188. "icon_fuzzy": null,
  2189. "icon": null,
  2190. "pdbpath": null,
  2191. "imported_dll_count": 6,
  2192. "versioninfo": []
  2193. }
  2194. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!