API tools faq
paste
paladin316

Exes_b8d0524db093501174a84dc52b3a19af_jpg_2019-06-27_21_30.json

paladin316
Jun 27th, 2019
2,203
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 82.68 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Icedid"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_b8d0524db093501174a84dc52b3a19af.jpg"
  7. [*] File Size: 65536
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "9b1c90323b54b569f99a5395ffc7b0b3df880a5ac49a3fbaa85d793cb8a2b649"
  10. [*] MD5: "b8d0524db093501174a84dc52b3a19af"
  11. [*] SHA1: "8c95dd6428e5f16dc5c1b2d8f70b07d796db846c"
  12. [*] SHA512: "85efb603e48c28f3286eb8fdfb00021fa8e14d0969d511c2fe50e5ec654eaab500a7938f2bb6559a456683d4b2ff87feab60517d472dc3610cdf09fe80d86fe1"
  13. [*] CRC32: "E6964A5A"
  14. [*] SSDEEP: "1536:ItpCkwcp6zZ8G6I1OGYKsTDecmIeP3Xlm85ppmsc1OMk:ID6F3N1DYKsPUIOXlmgXOOMk"
  15.  
  16. [*] Process Execution: [
  17. "Exes_b8d0524db093501174a84dc52b3a19af.jpg",
  18. "Exes_b8d0524db093501174a84dc52b3a19af.jpg",
  19. "Exes_b8d0524db093501174a84dc52b3a19af.jpg",
  20. "Exes_b8d0524db093501174a84dc52b3a19af.jpg",
  21. "svchost.exe",
  22. "svchost.exe",
  23. "svchost.exe",
  24. "svchost.exe",
  25. "svchost.exe",
  26. "taskeng.exe",
  27. "taskeng.exe",
  28. "msoia.exe",
  29. "msoia.exe",
  30. "taskeng.exe",
  31. "WMIADAP.exe",
  32. "taskeng.exe",
  33. "taskeng.exe",
  34. "svchost.exe",
  35. "WmiPrvSE.exe",
  36. "svchost.exe"
  37. ]
  38.  
  39. [*] Signatures Detected: [
  40. {
  41. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  42. "Details": [
  43. {
  44. "IP": "141.255.166.157:443"
  45. },
  46. {
  47. "IP": "93.189.149.176:443"
  48. }
  49. ]
  50. },
  51. {
  52. "Description": "Creates RWX memory",
  53. "Details": []
  54. },
  55. {
  56. "Description": "A process attempted to delay the analysis task.",
  57. "Details": [
  58. {
  59. "Process": "taskeng.exe tried to sleep 600 seconds, actually delayed analysis time by 0 seconds"
  60. },
  61. {
  62. "Process": "svchost.exe tried to sleep 748 seconds, actually delayed analysis time by 0 seconds"
  63. }
  64. ]
  65. },
  66. {
  67. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  68. "Details": [
  69. {
  70. "ioc": "mechangerous.space"
  71. },
  72. {
  73. "ioc": "bandstreat.pro"
  74. },
  75. {
  76. "ioc": "rolescene.xyz"
  77. },
  78. {
  79. "ioc": "therlanding.xyz"
  80. },
  81. {
  82. "ioc": "saudienter.pw"
  83. },
  84. {
  85. "ioc": "forsynanchyv.com"
  86. },
  87. {
  88. "ioc": "hipponexunam.org"
  89. },
  90. {
  91. "ioc": "charactic.pro"
  92. },
  93. {
  94. "ioc": "egainvisit.pw"
  95. },
  96. {
  97. "ioc": "thussailled.pw"
  98. },
  99. {
  100. "ioc": "tradication.pw"
  101. },
  102. {
  103. "ioc": "minoriticipal.pw"
  104. },
  105. {
  106. "ioc": "seconominist.com"
  107. },
  108. {
  109. "ioc": "importional.com"
  110. }
  111. ]
  112. },
  113. {
  114. "Description": "Starts servers listening on 127.0.0.1:63953",
  115. "Details": []
  116. },
  117. {
  118. "Description": "A process created a hidden window",
  119. "Details": [
  120. {
  121. "Process": "Exes_b8d0524db093501174a84dc52b3a19af.jpg -> C:\\Users\\user\\AppData\\Local\\Temp\\Exes_b8d0524db093501174a84dc52b3a19af.jpg"
  122. },
  123. {
  124. "Process": "Exes_b8d0524db093501174a84dc52b3a19af.jpg -> C:\\Users\\user\\AppData\\Local\\Temp\\Exes_b8d0524db093501174a84dc52b3a19af.jpg"
  125. },
  126. {
  127. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  128. }
  129. ]
  130. },
  131. {
  132. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  133. "Details": [
  134. {
  135. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  136. },
  137. {
  138. "suspicious_request": "http://thussailled.pw/data2.php?AC4DF4415831AF68"
  139. }
  140. ]
  141. },
  142. {
  143. "Description": "Performs some HTTP requests",
  144. "Details": [
  145. {
  146. "url": "http://thussailled.pw/data2.php?AC4DF4415831AF68"
  147. }
  148. ]
  149. },
  150. {
  151. "Description": "Executed a process and injected code into it, probably while unpacking",
  152. "Details": [
  153. {
  154. "Injection": "Exes_b8d0524db093501174a84dc52b3a19af.jpg(2600) -> Exes_b8d0524db093501174a84dc52b3a19af.jpg(1348)"
  155. }
  156. ]
  157. },
  158. {
  159. "Description": "File has been identified by 34 Antiviruses on VirusTotal as malicious",
  160. "Details": [
  161. {
  162. "FireEye": "Generic.mg.b8d0524db0935011"
  163. },
  164. {
  165. "Alibaba": "TrojanBanker:Win32/IcedID.a984d4e3"
  166. },
  167. {
  168. "Symantec": "Trojan.Gen.MBT"
  169. },
  170. {
  171. "APEX": "Malicious"
  172. },
  173. {
  174. "Paloalto": "generic.ml"
  175. },
  176. {
  177. "Kaspersky": "Trojan-Banker.Win32.IcedID.tszs"
  178. },
  179. {
  180. "Avast": "Win32:Malware-gen"
  181. },
  182. {
  183. "Tencent": "Win32.Trojan.Inject.Auto"
  184. },
  185. {
  186. "Emsisoft": "Trojan-Banker.Trickster (A)"
  187. },
  188. {
  189. "F-Secure": "Trojan.TR/AD.IcedId.wqqyt"
  190. },
  191. {
  192. "DrWeb": "Trojan.Inject3.17371"
  193. },
  194. {
  195. "TrendMicro": "TROJ_GEN.R004C0PFL19"
  196. },
  197. {
  198. "McAfee-GW-Edition": "RDN/Generic.grp"
  199. },
  200. {
  201. "Sophos": "Mal/Generic-S"
  202. },
  203. {
  204. "Ikarus": "Trojan.Win32.Trickbot"
  205. },
  206. {
  207. "Jiangmin": "Trojan.Banker.IcedID.id"
  208. },
  209. {
  210. "Webroot": "W32.Adware.Gen"
  211. },
  212. {
  213. "Avira": "TR/AD.IcedId.wqqyt"
  214. },
  215. {
  216. "Antiy-AVL": "Trojan[Banker]/Win32.IcedID"
  217. },
  218. {
  219. "Microsoft": "Trojan:Win32/Tiggre!plock"
  220. },
  221. {
  222. "Endgame": "malicious (high confidence)"
  223. },
  224. {
  225. "ZoneAlarm": "Trojan-Banker.Win32.IcedID.tszs"
  226. },
  227. {
  228. "GData": "Win32.Trojan.Agent.ZF8LEN"
  229. },
  230. {
  231. "AhnLab-V3": "Malware/Win32.Generic.C3294845"
  232. },
  233. {
  234. "Acronis": "suspicious"
  235. },
  236. {
  237. "McAfee": "RDN/Generic.grp"
  238. },
  239. {
  240. "VBA32": "BScope.Trojan.Iceid"
  241. },
  242. {
  243. "Malwarebytes": "Trojan.Banker"
  244. },
  245. {
  246. "ESET-NOD32": "a variant of Win32/GenKryptik.DLAC"
  247. },
  248. {
  249. "TrendMicro-HouseCall": "TROJ_GEN.R004C0PFL19"
  250. },
  251. {
  252. "Rising": "Trojan.GenKryptik!8.AA55 (CLOUD)"
  253. },
  254. {
  255. "Fortinet": "W32/Kryptik.GUBD!tr"
  256. },
  257. {
  258. "AVG": "Win32:Malware-gen"
  259. },
  260. {
  261. "Panda": "Trj/GdSda.A"
  262. }
  263. ]
  264. },
  265. {
  266. "Description": "Creates a slightly modified copy of itself",
  267. "Details": [
  268. {
  269. "file": "C:\\ProgramData\\{D62673F0-37F0-46DA-BFC0-5B9596B01F09}\\{562673F1-37F1-46DA-BFC1-5B959AB01F09}\\jaykd.exe"
  270. },
  271. {
  272. "percent_match": 97
  273. }
  274. ]
  275. },
  276. {
  277. "Description": "Created network traffic indicative of malicious activity",
  278. "Details": [
  279. {
  280. "signature": "ET DNS Query to a *.pw domain - Likely Hostile"
  281. },
  282. {
  283. "signature": "ET TROJAN Observed Malicious SSL Cert (IcedID CnC)"
  284. },
  285. {
  286. "signature": "ET TROJAN IcedID WebSocket Request"
  287. }
  288. ]
  289. }
  290. ]
  291.  
  292. [*] Started Service: []
  293.  
  294. [*] Executed Commands: [
  295. "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_b8d0524db093501174a84dc52b3a19af.jpg\"",
  296. "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_b8d0524db093501174a84dc52b3a19af.jpg\" -q=281519786",
  297. "C:\\Windows\\system32\\svchost.exe",
  298. "svchost.exe",
  299. "taskeng.exe {044FD4D0-11A1-471A-82D4-7320B745E508} S-1-5-18:NT AUTHORITY\\System:Service:",
  300. "taskeng.exe {B559C5DD-6F71-48C0-A0E4-32099BAC87D3} S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:[1]",
  301. "taskeng.exe {A8E66533-BAB9-4115-820F-7B5CF9CAE827} S-1-5-18:NT AUTHORITY\\System:Service:",
  302. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  303. "taskeng.exe {4AAC2808-44BE-4979-B59C-A41D4AE9D75D} S-1-5-18:NT AUTHORITY\\System:Service:",
  304. "taskeng.exe {3C3C7ACD-CF94-477A-A5A0-ABDC8554BBDA} S-1-5-18:NT AUTHORITY\\System:Service:",
  305. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\"",
  306. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload mininterval:2880",
  307. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload",
  308. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
  309. ]
  310.  
  311. [*] Mutexes: [
  312. "Global\\ADAP_WMI_ENTRY",
  313. "Global\\RefreshRA_Mutex",
  314. "Global\\RefreshRA_Mutex_Lib",
  315. "Global\\RefreshRA_Mutex_Flag"
  316. ]
  317.  
  318. [*] Modified Files: [
  319. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-0000000000-0000000000-0000000000-1000\\00000000-0000-0000-0000-000000000000b_00000000-0000-0000-0000-000000000000",
  320. "C:\\ProgramData\\{D62673F0-37F0-46DA-BFC0-5B9596B01F09}\\{562673F1-37F1-46DA-BFC1-5B959AB01F09}\\jaykd.exe",
  321. "\\??\\PIPE\\wkssvc",
  322. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF2EF.tmp",
  323. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF2F0.tmp",
  324. "C:\\ProgramData\\xuicz\\bwwwjneb.dat",
  325. "C:\\ProgramData\\xuicz\\zicmrrbc.dat",
  326. "C:\\ProgramData\\xuicz\\losuvtcc.dat",
  327. "C:\\ProgramData\\xuicz\\vgoshzcb.dat",
  328. "C:\\ProgramData\\xuicz\\pqgoflgc.dat",
  329. "C:\\ProgramData\\xuicz\\hmealbdb.dat",
  330. "C:\\ProgramData\\xuicz\\reayxhec.dat",
  331. "C:\\Windows\\sysnative\\Tasks\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}",
  332. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  333. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  334. "C:\\Users\\user\\AppData\\Local\\Temp\\AC4DF441.tmp",
  335. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  336. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  337. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  338. "\\??\\PIPE\\samr",
  339. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  340. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  341. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  342. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  343. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  344. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  345. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  346. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  347. "\\??\\WMIDataDevice"
  348. ]
  349.  
  350. [*] Deleted Files: [
  351. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF2EF.tmp",
  352. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF2F0.tmp",
  353. "C:\\Windows\\Tasks\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}.job",
  354. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  355. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  356. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  357. ]
  358.  
  359. [*] Modified Registry Keys: [
  360. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  361. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{50A3CAE6-9C3E-4D0A-9833-FF4E22E36FA6}\\Path",
  362. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{50A3CAE6-9C3E-4D0A-9833-FF4E22E36FA6}\\Hash",
  363. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}\\Id",
  364. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}\\Index",
  365. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{50A3CAE6-9C3E-4D0A-9833-FF4E22E36FA6}\\Triggers",
  366. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{50A3CAE6-9C3E-4D0A-9833-FF4E22E36FA6}\\DynamicInfo",
  367. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05}\\DynamicInfo",
  368. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{044FD4D0-11A1-471A-82D4-7320B745E508}",
  369. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{B17E070E-57E3-43F6-96F5-A9A9C921DEBF}\\DynamicInfo",
  370. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{B559C5DD-6F71-48C0-A0E4-32099BAC87D3}",
  371. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{DF000DCA-3FA2-48A6-9E59-C0606F9F8D73}\\DynamicInfo",
  372. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{A8E66533-BAB9-4115-820F-7B5CF9CAE827}",
  373. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  374. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  375. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  376. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{4AAC2808-44BE-4979-B59C-A41D4AE9D75D}",
  377. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{3C3C7ACD-CF94-477A-A5A0-ABDC8554BBDA}",
  378. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{044FD4D0-11A1-471A-82D4-7320B745E508}\\data",
  379. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{B559C5DD-6F71-48C0-A0E4-32099BAC87D3}\\data",
  380. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{A8E66533-BAB9-4115-820F-7B5CF9CAE827}\\data",
  381. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  382. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  383. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  384. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  385. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  386. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  387. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  388. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{4AAC2808-44BE-4979-B59C-A41D4AE9D75D}\\data",
  389. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-{00000000-0000-0000-0000-000000000000}",
  390. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dll[MofResourceName]",
  391. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.mui[MofResourceName]",
  392. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sys[ACPIMOFResource]",
  393. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
  394. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
  395. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
  396. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sys[MofResource]",
  397. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui[MofResource]",
  398. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sys[HDAudioMofName]",
  399. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui[HDAudioMofName]",
  400. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sys[PROCESSORWMI]",
  401. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.mui[PROCESSORWMI]",
  402. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYS[PortclsMof]",
  403. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.mui[PortclsMof]",
  404. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]",
  405. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{3C3C7ACD-CF94-477A-A5A0-ABDC8554BBDA}\\data"
  406. ]
  407.  
  408. [*] Deleted Registry Keys: [
  409. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}.job",
  410. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}.job.fp",
  411. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  412. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  413. ]
  414.  
  415. [*] DNS Communications: [
  416. {
  417. "type": "A",
  418. "request": "mozambiquest.pw",
  419. "answers": []
  420. },
  421. {
  422. "type": "A",
  423. "request": "ransmittend.club",
  424. "answers": [
  425. {
  426. "data": "",
  427. "type": "NXDOMAIN"
  428. }
  429. ]
  430. },
  431. {
  432. "type": "A",
  433. "request": "summerch.xyz",
  434. "answers": [
  435. {
  436. "data": "",
  437. "type": "NXDOMAIN"
  438. }
  439. ]
  440. },
  441. {
  442. "type": "A",
  443. "request": "ignorepairs.pro",
  444. "answers": [
  445. {
  446. "data": "",
  447. "type": "NXDOMAIN"
  448. }
  449. ]
  450. },
  451. {
  452. "type": "A",
  453. "request": "consequencycle.pw",
  454. "answers": [
  455. {
  456. "data": "141.255.166.157",
  457. "type": "A"
  458. }
  459. ]
  460. },
  461. {
  462. "type": "A",
  463. "request": "harbournal.club",
  464. "answers": [
  465. {
  466. "data": "141.255.166.157",
  467. "type": "A"
  468. }
  469. ]
  470. },
  471. {
  472. "type": "A",
  473. "request": "thussailled.pw",
  474. "answers": [
  475. {
  476. "data": "141.255.166.157",
  477. "type": "A"
  478. }
  479. ]
  480. },
  481. {
  482. "type": "A",
  483. "request": "tradication.pw",
  484. "answers": [
  485. {
  486. "data": "141.255.166.157",
  487. "type": "A"
  488. }
  489. ]
  490. },
  491. {
  492. "type": "A",
  493. "request": "minoriticipal.pw",
  494. "answers": [
  495. {
  496. "data": "141.255.166.157",
  497. "type": "A"
  498. }
  499. ]
  500. },
  501. {
  502. "type": "A",
  503. "request": "seconominist.com",
  504. "answers": [
  505. {
  506. "data": "93.189.149.176",
  507. "type": "A"
  508. }
  509. ]
  510. }
  511. ]
  512.  
  513. [*] Domains: [
  514. {
  515. "ip": "141.255.166.157",
  516. "domain": "consequencycle.pw"
  517. },
  518. {
  519. "ip": "141.255.166.157",
  520. "domain": "minoriticipal.pw"
  521. },
  522. {
  523. "ip": "141.255.166.157",
  524. "domain": "tradication.pw"
  525. },
  526. {
  527. "ip": "141.255.166.157",
  528. "domain": "harbournal.club"
  529. },
  530. {
  531. "ip": "141.255.166.157",
  532. "domain": "thussailled.pw"
  533. },
  534. {
  535. "ip": "",
  536. "domain": "summerch.xyz"
  537. },
  538. {
  539. "ip": "93.189.149.176",
  540. "domain": "seconominist.com"
  541. },
  542. {
  543. "ip": "",
  544. "domain": "ignorepairs.pro"
  545. },
  546. {
  547. "ip": "",
  548. "domain": "mozambiquest.pw"
  549. },
  550. {
  551. "ip": "",
  552. "domain": "ransmittend.club"
  553. }
  554. ]
  555.  
  556. [*] Network Communication - ICMP: []
  557.  
  558. [*] Network Communication - HTTP: [
  559. {
  560. "count": 1,
  561. "body": "",
  562. "uri": "http://thussailled.pw/data2.php?AC4DF4415831AF68",
  563. "user-agent": "",
  564. "method": "GET",
  565. "host": "thussailled.pw",
  566. "version": "1.1",
  567. "path": "/data2.php?AC4DF4415831AF68",
  568. "data": "GET /data2.php?AC4DF4415831AF68 HTTP/1.1\r\nHost: thussailled.pw\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n",
  569. "port": 80
  570. }
  571. ]
  572.  
  573. [*] Network Communication - SMTP: []
  574.  
  575. [*] Network Communication - Hosts: []
  576.  
  577. [*] Network Communication - IRC: []
  578.  
  579. [*] Static Analysis: {
  580. "pe": {
  581. "peid_signatures": null,
  582. "imports": [
  583. {
  584. "imports": [
  585. {
  586. "name": "InterlockedExchange",
  587. "address": "0x40505c"
  588. },
  589. {
  590. "name": "Sleep",
  591. "address": "0x405060"
  592. },
  593. {
  594. "name": "InterlockedCompareExchange",
  595. "address": "0x405064"
  596. },
  597. {
  598. "name": "GetStartupInfoA",
  599. "address": "0x405068"
  600. },
  601. {
  602. "name": "TerminateProcess",
  603. "address": "0x40506c"
  604. },
  605. {
  606. "name": "GetCurrentProcess",
  607. "address": "0x405070"
  608. },
  609. {
  610. "name": "UnhandledExceptionFilter",
  611. "address": "0x405074"
  612. },
  613. {
  614. "name": "SetUnhandledExceptionFilter",
  615. "address": "0x405078"
  616. },
  617. {
  618. "name": "IsDebuggerPresent",
  619. "address": "0x40507c"
  620. },
  621. {
  622. "name": "QueryPerformanceCounter",
  623. "address": "0x405080"
  624. },
  625. {
  626. "name": "GetTickCount",
  627. "address": "0x405084"
  628. },
  629. {
  630. "name": "GetCurrentThreadId",
  631. "address": "0x405088"
  632. },
  633. {
  634. "name": "GetCurrentProcessId",
  635. "address": "0x40508c"
  636. },
  637. {
  638. "name": "GetCurrentDirectoryA",
  639. "address": "0x405090"
  640. },
  641. {
  642. "name": "GetModuleHandleA",
  643. "address": "0x405094"
  644. },
  645. {
  646. "name": "LoadLibraryW",
  647. "address": "0x405098"
  648. },
  649. {
  650. "name": "GetProcAddress",
  651. "address": "0x40509c"
  652. },
  653. {
  654. "name": "CreateFileMappingW",
  655. "address": "0x4050a0"
  656. },
  657. {
  658. "name": "MapViewOfFile",
  659. "address": "0x4050a4"
  660. },
  661. {
  662. "name": "VirtualAlloc",
  663. "address": "0x4050a8"
  664. },
  665. {
  666. "name": "GetSystemTimeAsFileTime",
  667. "address": "0x4050ac"
  668. }
  669. ],
  670. "dll": "KERNEL32.dll"
  671. },
  672. {
  673. "imports": [
  674. {
  675. "name": "GetDC",
  676. "address": "0x405174"
  677. },
  678. {
  679. "name": "UpdateWindow",
  680. "address": "0x405178"
  681. },
  682. {
  683. "name": "SetWindowRgn",
  684. "address": "0x40517c"
  685. },
  686. {
  687. "name": "MoveWindow",
  688. "address": "0x405180"
  689. },
  690. {
  691. "name": "GetWindowRgn",
  692. "address": "0x405184"
  693. },
  694. {
  695. "name": "DrawIconEx",
  696. "address": "0x405188"
  697. },
  698. {
  699. "name": "GetClientRect",
  700. "address": "0x40518c"
  701. },
  702. {
  703. "name": "GetWindowTextA",
  704. "address": "0x405190"
  705. },
  706. {
  707. "name": "DestroyIcon",
  708. "address": "0x405194"
  709. },
  710. {
  711. "name": "EndPaint",
  712. "address": "0x405198"
  713. },
  714. {
  715. "name": "BeginPaint",
  716. "address": "0x40519c"
  717. },
  718. {
  719. "name": "SetCapture",
  720. "address": "0x4051a0"
  721. },
  722. {
  723. "name": "SendMessageA",
  724. "address": "0x4051a4"
  725. },
  726. {
  727. "name": "GetParent",
  728. "address": "0x4051a8"
  729. },
  730. {
  731. "name": "GetWindowLongA",
  732. "address": "0x4051ac"
  733. },
  734. {
  735. "name": "ReleaseCapture",
  736. "address": "0x4051b0"
  737. },
  738. {
  739. "name": "GetWindowRect",
  740. "address": "0x4051b4"
  741. },
  742. {
  743. "name": "SetWindowLongA",
  744. "address": "0x4051b8"
  745. },
  746. {
  747. "name": "CreateDialogParamA",
  748. "address": "0x4051bc"
  749. },
  750. {
  751. "name": "GetDlgItem",
  752. "address": "0x4051c0"
  753. },
  754. {
  755. "name": "LoadImageA",
  756. "address": "0x4051c4"
  757. },
  758. {
  759. "name": "ReleaseDC",
  760. "address": "0x4051c8"
  761. },
  762. {
  763. "name": "PostQuitMessage",
  764. "address": "0x4051cc"
  765. },
  766. {
  767. "name": "MessageBoxA",
  768. "address": "0x4051d0"
  769. },
  770. {
  771. "name": "DefWindowProcA",
  772. "address": "0x4051d4"
  773. },
  774. {
  775. "name": "LoadCursorA",
  776. "address": "0x4051d8"
  777. },
  778. {
  779. "name": "LoadIconA",
  780. "address": "0x4051dc"
  781. },
  782. {
  783. "name": "RegisterClassA",
  784. "address": "0x4051e0"
  785. },
  786. {
  787. "name": "CreateWindowExA",
  788. "address": "0x4051e4"
  789. },
  790. {
  791. "name": "ShowWindow",
  792. "address": "0x4051e8"
  793. },
  794. {
  795. "name": "GetMessageA",
  796. "address": "0x4051ec"
  797. },
  798. {
  799. "name": "TranslateMessage",
  800. "address": "0x4051f0"
  801. },
  802. {
  803. "name": "DispatchMessageA",
  804. "address": "0x4051f4"
  805. }
  806. ],
  807. "dll": "USER32.dll"
  808. },
  809. {
  810. "imports": [
  811. {
  812. "name": "PtInRegion",
  813. "address": "0x405000"
  814. },
  815. {
  816. "name": "GetStockObject",
  817. "address": "0x405004"
  818. },
  819. {
  820. "name": "DeleteDC",
  821. "address": "0x405008"
  822. },
  823. {
  824. "name": "DeleteObject",
  825. "address": "0x40500c"
  826. },
  827. {
  828. "name": "CombineRgn",
  829. "address": "0x405010"
  830. },
  831. {
  832. "name": "CreateRectRgn",
  833. "address": "0x405014"
  834. },
  835. {
  836. "name": "GetPixel",
  837. "address": "0x405018"
  838. },
  839. {
  840. "name": "SelectObject",
  841. "address": "0x40501c"
  842. },
  843. {
  844. "name": "SaveDC",
  845. "address": "0x405020"
  846. },
  847. {
  848. "name": "GetObjectA",
  849. "address": "0x405024"
  850. },
  851. {
  852. "name": "CreateCompatibleDC",
  853. "address": "0x405028"
  854. },
  855. {
  856. "name": "GetRgnBox",
  857. "address": "0x40502c"
  858. },
  859. {
  860. "name": "CreateRectRgnIndirect",
  861. "address": "0x405030"
  862. },
  863. {
  864. "name": "BitBlt",
  865. "address": "0x405034"
  866. },
  867. {
  868. "name": "FrameRgn",
  869. "address": "0x405038"
  870. },
  871. {
  872. "name": "TextOutA",
  873. "address": "0x40503c"
  874. },
  875. {
  876. "name": "SetTextColor",
  877. "address": "0x405040"
  878. },
  879. {
  880. "name": "GetTextExtentPoint32A",
  881. "address": "0x405044"
  882. },
  883. {
  884. "name": "SetBkMode",
  885. "address": "0x405048"
  886. },
  887. {
  888. "name": "CreateFontA",
  889. "address": "0x40504c"
  890. },
  891. {
  892. "name": "CreateCompatibleBitmap",
  893. "address": "0x405050"
  894. },
  895. {
  896. "name": "GetRegionData",
  897. "address": "0x405054"
  898. }
  899. ],
  900. "dll": "GDI32.dll"
  901. },
  902. {
  903. "imports": [
  904. {
  905. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  906. "address": "0x4050b4"
  907. },
  908. {
  909. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  910. "address": "0x4050b8"
  911. },
  912. {
  913. "name": "??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z",
  914. "address": "0x4050bc"
  915. },
  916. {
  917. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z",
  918. "address": "0x4050c0"
  919. },
  920. {
  921. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  922. "address": "0x4050c4"
  923. },
  924. {
  925. "name": "?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ",
  926. "address": "0x4050c8"
  927. },
  928. {
  929. "name": "?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ",
  930. "address": "0x4050cc"
  931. }
  932. ],
  933. "dll": "MSVCP90.dll"
  934. },
  935. {
  936. "imports": [
  937. {
  938. "name": "__p__fmode",
  939. "address": "0x4050d4"
  940. },
  941. {
  942. "name": "__p__commode",
  943. "address": "0x4050d8"
  944. },
  945. {
  946. "name": "_adjust_fdiv",
  947. "address": "0x4050dc"
  948. },
  949. {
  950. "name": "__setusermatherr",
  951. "address": "0x4050e0"
  952. },
  953. {
  954. "name": "_configthreadlocale",
  955. "address": "0x4050e4"
  956. },
  957. {
  958. "name": "__set_app_type",
  959. "address": "0x4050e8"
  960. },
  961. {
  962. "name": "_initterm",
  963. "address": "0x4050ec"
  964. },
  965. {
  966. "name": "_acmdln",
  967. "address": "0x4050f0"
  968. },
  969. {
  970. "name": "exit",
  971. "address": "0x4050f4"
  972. },
  973. {
  974. "name": "_ismbblead",
  975. "address": "0x4050f8"
  976. },
  977. {
  978. "name": "_XcptFilter",
  979. "address": "0x4050fc"
  980. },
  981. {
  982. "name": "_exit",
  983. "address": "0x405100"
  984. },
  985. {
  986. "name": "_crt_debugger_hook",
  987. "address": "0x405104"
  988. },
  989. {
  990. "name": "_except_handler4_common",
  991. "address": "0x405108"
  992. },
  993. {
  994. "name": "?terminate@@YAXXZ",
  995. "address": "0x40510c"
  996. },
  997. {
  998. "name": "?_type_info_dtor_internal_method@type_info@@QAEXXZ",
  999. "address": "0x405110"
  1000. },
  1001. {
  1002. "name": "_invoke_watson",
  1003. "address": "0x405114"
  1004. },
  1005. {
  1006. "name": "_controlfp_s",
  1007. "address": "0x405118"
  1008. },
  1009. {
  1010. "name": "_initterm_e",
  1011. "address": "0x40511c"
  1012. },
  1013. {
  1014. "name": "malloc",
  1015. "address": "0x405120"
  1016. },
  1017. {
  1018. "name": "strlen",
  1019. "address": "0x405124"
  1020. },
  1021. {
  1022. "name": "fclose",
  1023. "address": "0x405128"
  1024. },
  1025. {
  1026. "name": "fwrite",
  1027. "address": "0x40512c"
  1028. },
  1029. {
  1030. "name": "fopen",
  1031. "address": "0x405130"
  1032. },
  1033. {
  1034. "name": "free",
  1035. "address": "0x405134"
  1036. },
  1037. {
  1038. "name": "??3@YAXPAX@Z",
  1039. "address": "0x405138"
  1040. },
  1041. {
  1042. "name": "strcat",
  1043. "address": "0x40513c"
  1044. },
  1045. {
  1046. "name": "fread",
  1047. "address": "0x405140"
  1048. },
  1049. {
  1050. "name": "feof",
  1051. "address": "0x405144"
  1052. },
  1053. {
  1054. "name": "strcmp",
  1055. "address": "0x405148"
  1056. },
  1057. {
  1058. "name": "_unlock",
  1059. "address": "0x40514c"
  1060. },
  1061. {
  1062. "name": "__dllonexit",
  1063. "address": "0x405150"
  1064. },
  1065. {
  1066. "name": "_encode_pointer",
  1067. "address": "0x405154"
  1068. },
  1069. {
  1070. "name": "_lock",
  1071. "address": "0x405158"
  1072. },
  1073. {
  1074. "name": "_onexit",
  1075. "address": "0x40515c"
  1076. },
  1077. {
  1078. "name": "_decode_pointer",
  1079. "address": "0x405160"
  1080. },
  1081. {
  1082. "name": "_amsg_exit",
  1083. "address": "0x405164"
  1084. },
  1085. {
  1086. "name": "__getmainargs",
  1087. "address": "0x405168"
  1088. },
  1089. {
  1090. "name": "_cexit",
  1091. "address": "0x40516c"
  1092. }
  1093. ],
  1094. "dll": "MSVCR90.dll"
  1095. }
  1096. ],
  1097. "digital_signers": null,
  1098. "exported_dll_name": null,
  1099. "actual_checksum": "0x00010a65",
  1100. "overlay": null,
  1101. "imagebase": "0x00400000",
  1102. "reported_checksum": "0x00010a65",
  1103. "icon_hash": null,
  1104. "entrypoint": "0x00403cd5",
  1105. "timestamp": "2019-06-18 14:06:01",
  1106. "osversion": "5.0",
  1107. "sections": [
  1108. {
  1109. "name": ".text",
  1110. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1111. "virtual_address": "0x00001000",
  1112. "size_of_data": "0x00003400",
  1113. "entropy": "5.91",
  1114. "raw_address": "0x00000400",
  1115. "virtual_size": "0x0000338f",
  1116. "characteristics_raw": "0x60000020"
  1117. },
  1118. {
  1119. "name": ".rdata",
  1120. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1121. "virtual_address": "0x00005000",
  1122. "size_of_data": "0x0000c200",
  1123. "entropy": "6.18",
  1124. "raw_address": "0x00003800",
  1125. "virtual_size": "0x0000c1c8",
  1126. "characteristics_raw": "0x40000040"
  1127. },
  1128. {
  1129. "name": ".data",
  1130. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1131. "virtual_address": "0x00012000",
  1132. "size_of_data": "0x00000200",
  1133. "entropy": "1.51",
  1134. "raw_address": "0x0000fa00",
  1135. "virtual_size": "0x000004b4",
  1136. "characteristics_raw": "0xc0000040"
  1137. },
  1138. {
  1139. "name": ".rsrc",
  1140. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1141. "virtual_address": "0x00013000",
  1142. "size_of_data": "0x00000400",
  1143. "entropy": "5.19",
  1144. "raw_address": "0x0000fc00",
  1145. "virtual_size": "0x000002b0",
  1146. "characteristics_raw": "0x40000040"
  1147. }
  1148. ],
  1149. "resources": [],
  1150. "dirents": [
  1151. {
  1152. "virtual_address": "0x00000000",
  1153. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1154. "size": "0x00000000"
  1155. },
  1156. {
  1157. "virtual_address": "0x0001057c",
  1158. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1159. "size": "0x00000078"
  1160. },
  1161. {
  1162. "virtual_address": "0x00013000",
  1163. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1164. "size": "0x000002b0"
  1165. },
  1166. {
  1167. "virtual_address": "0x00000000",
  1168. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1169. "size": "0x00000000"
  1170. },
  1171. {
  1172. "virtual_address": "0x00000000",
  1173. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1174. "size": "0x00000000"
  1175. },
  1176. {
  1177. "virtual_address": "0x00000000",
  1178. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1179. "size": "0x00000000"
  1180. },
  1181. {
  1182. "virtual_address": "0x00005230",
  1183. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1184. "size": "0x0000001c"
  1185. },
  1186. {
  1187. "virtual_address": "0x00000000",
  1188. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1189. "size": "0x00000000"
  1190. },
  1191. {
  1192. "virtual_address": "0x00000000",
  1193. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1194. "size": "0x00000000"
  1195. },
  1196. {
  1197. "virtual_address": "0x00000000",
  1198. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1199. "size": "0x00000000"
  1200. },
  1201. {
  1202. "virtual_address": "0x00010330",
  1203. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1204. "size": "0x00000040"
  1205. },
  1206. {
  1207. "virtual_address": "0x00000000",
  1208. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1209. "size": "0x00000000"
  1210. },
  1211. {
  1212. "virtual_address": "0x00005000",
  1213. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1214. "size": "0x000001fc"
  1215. },
  1216. {
  1217. "virtual_address": "0x00000000",
  1218. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1219. "size": "0x00000000"
  1220. },
  1221. {
  1222. "virtual_address": "0x00000000",
  1223. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1224. "size": "0x00000000"
  1225. },
  1226. {
  1227. "virtual_address": "0x00000000",
  1228. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1229. "size": "0x00000000"
  1230. }
  1231. ],
  1232. "exports": [],
  1233. "guest_signers": {},
  1234. "imphash": "2858b9d144e229425988477b02aba6f7",
  1235. "icon_fuzzy": null,
  1236. "icon": null,
  1237. "pdbpath": "c:\\Users\\User\\Desktop\\DReY_Shape1667871152003\\Release\\ShapeGradientButton.pdb",
  1238. "imported_dll_count": 5,
  1239. "versioninfo": []
  1240. }
  1241. }
  1242.  
  1243. [*] Resolved APIs: [
  1244. "uxtheme.dll.ThemeInitApiHook",
  1245. "user32.dll.IsProcessDPIAware",
  1246. "dwmapi.dll.DwmIsCompositionEnabled",
  1247. "advapi32.dll.CryptAcquireContextA",
  1248. "cryptsp.dll.CryptAcquireContextA",
  1249. "advapi32.dll.CryptImportKey",
  1250. "advapi32.dll.CryptEncrypt",
  1251. "cryptsp.dll.CryptImportKey",
  1252. "cryptbase.dll.SystemFunction040",
  1253. "cryptbase.dll.SystemFunction041",
  1254. "cryptsp.dll.CryptEncrypt",
  1255. "kernel32.dll.SortGetHandle",
  1256. "kernel32.dll.SortCloseHandle",
  1257. "crypt32.dll.CryptProtectData",
  1258. "kernel32.dll.LoadLibraryA",
  1259. "kernel32.dll.GetProcAddress",
  1260. "secur32.dll.GetUserNameExW",
  1261. "userenv.dll.CreateEnvironmentBlock",
  1262. "user32.dll.wsprintfA",
  1263. "user32.dll.wsprintfW",
  1264. "wtsapi32.dll.WTSQueryUserToken",
  1265. "shlwapi.dll.StrStrA",
  1266. "shlwapi.dll.StrStrIW",
  1267. "shlwapi.dll.StrChrA",
  1268. "shlwapi.dll.StrStrIA",
  1269. "netapi32.dll.NetApiBufferFree",
  1270. "netapi32.dll.NetWkstaGetInfo",
  1271. "netapi32.dll.NetGetDCName",
  1272. "dnsapi.dll.DnsFree",
  1273. "dnsapi.dll.DnsQuery_A",
  1274. "msvcrt.dll.memcpy",
  1275. "msvcrt.dll.memset",
  1276. "msvcrt.dll._vsnprintf",
  1277. "kernel32.dll.lstrcpyA",
  1278. "kernel32.dll.Sleep",
  1279. "kernel32.dll.CreateThread",
  1280. "kernel32.dll.SetErrorMode",
  1281. "kernel32.dll.SetEvent",
  1282. "kernel32.dll.WaitForSingleObject",
  1283. "kernel32.dll.CreateEventW",
  1284. "kernel32.dll.GetComputerNameExW",
  1285. "kernel32.dll.lstrlenW",
  1286. "kernel32.dll.CreateProcessA",
  1287. "kernel32.dll.OpenEventW",
  1288. "kernel32.dll.lstrcpyW",
  1289. "kernel32.dll.SetUnhandledExceptionFilter",
  1290. "kernel32.dll.ExitProcess",
  1291. "kernel32.dll.CreateProcessW",
  1292. "kernel32.dll.GetSystemTimeAsFileTime",
  1293. "kernel32.dll.lstrcatW",
  1294. "kernel32.dll.CopyFileW",
  1295. "kernel32.dll.ExpandEnvironmentStringsA",
  1296. "kernel32.dll.CreateFileA",
  1297. "kernel32.dll.CreateFileW",
  1298. "kernel32.dll.GetFileSize",
  1299. "kernel32.dll.ReadFile",
  1300. "kernel32.dll.WriteFile",
  1301. "kernel32.dll.HeapReAlloc",
  1302. "kernel32.dll.QueryPerformanceCounter",
  1303. "kernel32.dll.QueryPerformanceFrequency",
  1304. "kernel32.dll.GetTickCount",
  1305. "kernel32.dll.GetNativeSystemInfo",
  1306. "kernel32.dll.GetCurrentProcessId",
  1307. "kernel32.dll.GetLocalTime",
  1308. "kernel32.dll.GetCurrentProcess",
  1309. "kernel32.dll.WTSGetActiveConsoleSessionId",
  1310. "kernel32.dll.WideCharToMultiByte",
  1311. "kernel32.dll.CreateFileMappingW",
  1312. "kernel32.dll.MapViewOfFile",
  1313. "kernel32.dll.UnmapViewOfFile",
  1314. "kernel32.dll.MultiByteToWideChar",
  1315. "kernel32.dll.GetExitCodeProcess",
  1316. "kernel32.dll.ResumeThread",
  1317. "kernel32.dll.DeleteFileW",
  1318. "kernel32.dll.CreateDirectoryW",
  1319. "kernel32.dll.GetTempPathA",
  1320. "kernel32.dll.HeapAlloc",
  1321. "kernel32.dll.CloseHandle",
  1322. "kernel32.dll.lstrlenA",
  1323. "kernel32.dll.GetProcessHeap",
  1324. "kernel32.dll.HeapFree",
  1325. "kernel32.dll.lstrcatA",
  1326. "kernel32.dll.GetLastError",
  1327. "ws2_32.dll.#12",
  1328. "ntdll.dll.RtlGetVersion",
  1329. "ntdll.dll.ZwQuerySystemInformation",
  1330. "ntdll.dll.RtlLargeIntegerDivide",
  1331. "shell32.dll.SHGetFolderPathW",
  1332. "iphlpapi.dll.GetAdaptersInfo",
  1333. "ole32.dll.CoCreateInstance",
  1334. "ole32.dll.CoInitializeEx",
  1335. "winhttp.dll.WinHttpOpen",
  1336. "winhttp.dll.WinHttpCrackUrl",
  1337. "winhttp.dll.WinHttpReceiveResponse",
  1338. "winhttp.dll.WinHttpCloseHandle",
  1339. "winhttp.dll.WinHttpSendRequest",
  1340. "winhttp.dll.WinHttpConnect",
  1341. "winhttp.dll.WinHttpOpenRequest",
  1342. "winhttp.dll.WinHttpSetOption",
  1343. "winhttp.dll.WinHttpQueryDataAvailable",
  1344. "winhttp.dll.WinHttpReadData",
  1345. "winhttp.dll.WinHttpQueryHeaders",
  1346. "advapi32.dll.GetSidSubAuthority",
  1347. "advapi32.dll.RegSetValueExA",
  1348. "advapi32.dll.RegQueryValueExA",
  1349. "advapi32.dll.RegOpenKeyA",
  1350. "advapi32.dll.RegDeleteKeyA",
  1351. "advapi32.dll.RegCreateKeyA",
  1352. "advapi32.dll.RegCloseKey",
  1353. "advapi32.dll.CryptVerifySignatureA",
  1354. "advapi32.dll.CryptDestroyKey",
  1355. "advapi32.dll.LookupPrivilegeValueA",
  1356. "advapi32.dll.AdjustTokenPrivileges",
  1357. "advapi32.dll.CreateProcessAsUserW",
  1358. "advapi32.dll.GetTokenInformation",
  1359. "advapi32.dll.GetSidSubAuthorityCount",
  1360. "advapi32.dll.CryptReleaseContext",
  1361. "advapi32.dll.GetSidIdentifierAuthority",
  1362. "advapi32.dll.OpenProcessToken",
  1363. "advapi32.dll.CryptAcquireContextW",
  1364. "advapi32.dll.LookupAccountNameW",
  1365. "advapi32.dll.GetUserNameW",
  1366. "advapi32.dll.CryptDestroyHash",
  1367. "advapi32.dll.CryptHashData",
  1368. "advapi32.dll.CryptCreateHash",
  1369. "advapi32.dll.CryptGetHashParam",
  1370. "advapi32.dll.InitiateSystemShutdownExA",
  1371. "sechost.dll.LookupAccountNameLocalW",
  1372. "advapi32.dll.LsaOpenPolicy",
  1373. "advapi32.dll.LsaQueryInformationPolicy",
  1374. "netutils.dll.NetApiBufferAllocate",
  1375. "advapi32.dll.LsaFreeMemory",
  1376. "advapi32.dll.LsaClose",
  1377. "netutils.dll.NetApiBufferFree",
  1378. "cryptbase.dll.SystemFunction036",
  1379. "sspicli.dll.GetUserNameExW",
  1380. "xmllite.dll.CreateXmlWriter",
  1381. "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
  1382. "oleaut32.dll.#500",
  1383. "wkscli.dll.NetWkstaGetInfo",
  1384. "cscapi.dll.CscNetApiGetInterface",
  1385. "ws2_32.dll.GetAddrInfoW",
  1386. "rpcrt4.dll.RpcBindingFree",
  1387. "ws2_32.dll.WSASocketW",
  1388. "ws2_32.dll.#2",
  1389. "ws2_32.dll.#21",
  1390. "ws2_32.dll.#9",
  1391. "ws2_32.dll.WSAIoctl",
  1392. "ws2_32.dll.FreeAddrInfoW",
  1393. "ws2_32.dll.WSAGetOverlappedResult",
  1394. "ws2_32.dll.#6",
  1395. "ws2_32.dll.#5",
  1396. "schannel.dll.SpUserModeInitialize",
  1397. "advapi32.dll.RegCreateKeyExW",
  1398. "advapi32.dll.RegQueryValueExW",
  1399. "ws2_32.dll.WSASend",
  1400. "ws2_32.dll.WSARecv",
  1401. "secur32.dll.FreeContextBuffer",
  1402. "ncrypt.dll.SslOpenProvider",
  1403. "ncrypt.dll.GetSChannelInterface",
  1404. "bcryptprimitives.dll.GetHashInterface",
  1405. "ncrypt.dll.SslIncrementProviderReferenceCount",
  1406. "ncrypt.dll.SslImportKey",
  1407. "bcryptprimitives.dll.GetCipherInterface",
  1408. "ncrypt.dll.SslLookupCipherSuiteInfo",
  1409. "user32.dll.LoadStringW",
  1410. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  1411. "ncrypt.dll.BCryptGetProperty",
  1412. "ncrypt.dll.BCryptCreateHash",
  1413. "ncrypt.dll.BCryptHashData",
  1414. "ncrypt.dll.BCryptFinishHash",
  1415. "ncrypt.dll.BCryptDestroyHash",
  1416. "crypt32.dll.CertGetCertificateChain",
  1417. "userenv.dll.GetUserProfileDirectoryW",
  1418. "sechost.dll.ConvertSidToStringSidW",
  1419. "sechost.dll.ConvertStringSidToSidW",
  1420. "userenv.dll.RegisterGPNotification",
  1421. "gpapi.dll.RegisterGPNotificationInternal",
  1422. "sechost.dll.OpenSCManagerW",
  1423. "sechost.dll.OpenServiceW",
  1424. "sechost.dll.CloseServiceHandle",
  1425. "sechost.dll.QueryServiceConfigW",
  1426. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  1427. "ncrypt.dll.BCryptImportKeyPair",
  1428. "ncrypt.dll.BCryptVerifySignature",
  1429. "ncrypt.dll.BCryptDestroyKey",
  1430. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  1431. "setupapi.dll.SetupIterateCabinetW",
  1432. "kernel32.dll.RegOpenKeyExW",
  1433. "kernel32.dll.RegCloseKey",
  1434. "cabinet.dll.#20",
  1435. "cabinet.dll.#22",
  1436. "devrtl.dll.DevRtlGetThreadLogToken",
  1437. "cabinet.dll.#23",
  1438. "cryptsp.dll.CryptCreateHash",
  1439. "cryptsp.dll.CryptSetHashParam",
  1440. "cryptsp.dll.CryptVerifySignatureA",
  1441. "cryptsp.dll.CryptDestroyKey",
  1442. "cryptsp.dll.CryptDestroyHash",
  1443. "cryptsp.dll.CryptHashData",
  1444. "crypt32.dll.CertVerifyCertificateChainPolicy",
  1445. "crypt32.dll.CertFreeCertificateChain",
  1446. "crypt32.dll.CertDuplicateCertificateContext",
  1447. "ncrypt.dll.SslEncryptPacket",
  1448. "ncrypt.dll.SslDecryptPacket",
  1449. "crypt32.dll.CertFreeCertificateContext",
  1450. "ncrypt.dll.SslDecrementProviderReferenceCount",
  1451. "ncrypt.dll.SslFreeObject",
  1452. "cryptsp.dll.CryptAcquireContextW",
  1453. "cryptsp.dll.CryptReleaseContext",
  1454. "ws2_32.dll.#116",
  1455. "tschannel.dll.DllGetClassObject",
  1456. "tschannel.dll.DllCanUnloadNow",
  1457. "advapi32.dll.WmiMofEnumerateResourcesW",
  1458. "advapi32.dll.WmiFreeBuffer",
  1459. "advapi32.dll.WmiCloseBlock",
  1460. "propsys.dll.PropVariantToVariant",
  1461. "wbemcore.dll.Shutdown",
  1462. "ole32.dll.CoUninitialize",
  1463. "advapi32.dll.UnregisterTraceGuids",
  1464. "advapi32.dll.LookupAccountSidW",
  1465. "sechost.dll.LookupAccountSidLocalW",
  1466. "shlwapi.dll.PathIsDirectoryW",
  1467. "advapi32.dll.RegNotifyChangeKeyValue",
  1468. "cryptsp.dll.CryptGenRandom",
  1469. "ole32.dll.NdrOleInitializeExtension",
  1470. "ole32.dll.CoGetClassObject",
  1471. "ole32.dll.CoGetMarshalSizeMax",
  1472. "ole32.dll.CoMarshalInterface",
  1473. "ole32.dll.CoUnmarshalInterface",
  1474. "ole32.dll.StringFromIID",
  1475. "ole32.dll.CoGetPSClsid",
  1476. "ole32.dll.CoTaskMemAlloc",
  1477. "ole32.dll.CoTaskMemFree",
  1478. "ole32.dll.CoReleaseMarshalData",
  1479. "ole32.dll.DcomChannelSetHResult",
  1480. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1481. "ole32.dll.CLSIDFromOle1Class",
  1482. "clbcatq.dll.GetCatalogObject",
  1483. "clbcatq.dll.GetCatalogObject2",
  1484. "advapi32.dll.RegOpenKeyExW",
  1485. "advapi32.dll.RegSetValueExW",
  1486. "shlwapi.dll.PathIsPrefixW",
  1487. "cryptsp.dll.CryptGetHashParam",
  1488. "xmllite.dll.CreateXmlReader",
  1489. "kernel32.dll.WerRegisterMemoryBlock",
  1490. "advapi32.dll.EventWrite",
  1491. "advapi32.dll.EventRegister",
  1492. "advapi32.dll.EventUnregister",
  1493. "advapi32.dll.CryptGenKey",
  1494. "shlwapi.dll.StrCmpNIA",
  1495. "shlwapi.dll.StrToIntA",
  1496. "shlwapi.dll.PathFindFileNameA",
  1497. "shlwapi.dll.StrToIntExA",
  1498. "oleaut32.dll.#4",
  1499. "oleaut32.dll.#7",
  1500. "oleaut32.dll.#6",
  1501. "gdi32.dll.SelectObject",
  1502. "gdi32.dll.GetStockObject",
  1503. "gdi32.dll.Ellipse",
  1504. "gdi32.dll.DeleteObject",
  1505. "gdi32.dll.DeleteDC",
  1506. "gdi32.dll.CreatePen",
  1507. "gdi32.dll.CreateCompatibleDC",
  1508. "gdi32.dll.BitBlt",
  1509. "gdi32.dll.CreateCompatibleBitmap",
  1510. "crypt32.dll.CryptSignAndEncodeCertificate",
  1511. "crypt32.dll.CertGetCertificateContextProperty",
  1512. "crypt32.dll.CertSetCertificateContextProperty",
  1513. "crypt32.dll.CertCreateCertificateContext",
  1514. "crypt32.dll.CertStrToNameA",
  1515. "crypt32.dll.CryptExportPublicKeyInfoEx",
  1516. "crypt32.dll.CryptEncodeObject",
  1517. "crypt32.dll.CertCreateSelfSignCertificate",
  1518. "crypt32.dll.CertGetNameStringA",
  1519. "crypt32.dll.CertGetIntendedKeyUsage",
  1520. "crypt32.dll.CertControlStore",
  1521. "crypt32.dll.CertAddCertificateContextToStore",
  1522. "crypt32.dll.CertEnumCertificatesInStore",
  1523. "crypt32.dll.CertCloseStore",
  1524. "crypt32.dll.CertOpenStore",
  1525. "ws2_32.dll.WSACreateEvent",
  1526. "ws2_32.dll.#111",
  1527. "ws2_32.dll.#23",
  1528. "ws2_32.dll.#19",
  1529. "ws2_32.dll.#13",
  1530. "ws2_32.dll.#10",
  1531. "ws2_32.dll.#4",
  1532. "ws2_32.dll.#3",
  1533. "ws2_32.dll.#1",
  1534. "ws2_32.dll.#52",
  1535. "ws2_32.dll.#16",
  1536. "ws2_32.dll.#11",
  1537. "ws2_32.dll.WSAEnumNetworkEvents",
  1538. "ws2_32.dll.WSAEventSelect",
  1539. "ws2_32.dll.#115",
  1540. "ntdll.dll.RtlTimeToSecondsSince1970",
  1541. "ntdll.dll.NtQueryInformationProcess",
  1542. "user32.dll.GetWindowRect",
  1543. "user32.dll.GetDesktopWindow",
  1544. "user32.dll.GetForegroundWindow",
  1545. "user32.dll.GetCursorPos",
  1546. "user32.dll.ReleaseDC",
  1547. "user32.dll.GetWindowDC",
  1548. "user32.dll.CharLowerA",
  1549. "kernel32.dll.OpenProcess",
  1550. "kernel32.dll.lstrcmpiA",
  1551. "kernel32.dll.TerminateProcess",
  1552. "kernel32.dll.OpenEventA",
  1553. "kernel32.dll.SystemTimeToFileTime",
  1554. "kernel32.dll.SleepEx",
  1555. "kernel32.dll.QueueUserAPC",
  1556. "kernel32.dll.RegisterWaitForSingleObject",
  1557. "kernel32.dll.UnregisterWait",
  1558. "kernel32.dll.GetTickCount64",
  1559. "kernel32.dll.OpenFileMappingW",
  1560. "kernel32.dll.GetSystemTime",
  1561. "kernel32.dll.GetTempPathW",
  1562. "kernel32.dll.GetModuleHandleA",
  1563. "kernel32.dll.TerminateThread",
  1564. "kernel32.dll.CreateEventA",
  1565. "kernel32.dll.DeleteCriticalSection",
  1566. "kernel32.dll.LeaveCriticalSection",
  1567. "kernel32.dll.EnterCriticalSection",
  1568. "kernel32.dll.InitializeCriticalSection",
  1569. "kernel32.dll.IsWow64Process",
  1570. "kernel32.dll.ReadProcessMemory",
  1571. "gdiplus.dll.GdipDisposeImage",
  1572. "gdiplus.dll.GdipSaveImageToFile",
  1573. "gdiplus.dll.GdipCreateBitmapFromHBITMAP",
  1574. "gdiplus.dll.GdiplusStartup",
  1575. "secur32.dll.InitSecurityInterfaceA",
  1576. "cryptsp.dll.CryptGenKey",
  1577. "vbscript.dll.DllGetClassObject",
  1578. "vbscript.dll.DllCanUnloadNow",
  1579. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  1580. "advapi32.dll.RegOpenKeyW",
  1581. "advapi32.dll.RegQueryValueW",
  1582. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  1583. "oleaut32.dll.DllGetClassObject",
  1584. "oleaut32.dll.DllCanUnloadNow",
  1585. "sxs.dll.SxsOleAut32MapIIDToProxyStubCLSID",
  1586. "oleaut32.dll.BSTR_UserSize",
  1587. "oleaut32.dll.BSTR_UserMarshal",
  1588. "oleaut32.dll.BSTR_UserUnmarshal",
  1589. "oleaut32.dll.BSTR_UserFree",
  1590. "oleaut32.dll.VARIANT_UserSize",
  1591. "oleaut32.dll.VARIANT_UserMarshal",
  1592. "oleaut32.dll.VARIANT_UserUnmarshal",
  1593. "oleaut32.dll.VARIANT_UserFree",
  1594. "oleaut32.dll.LPSAFEARRAY_UserSize",
  1595. "oleaut32.dll.LPSAFEARRAY_UserMarshal",
  1596. "oleaut32.dll.LPSAFEARRAY_UserUnmarshal",
  1597. "oleaut32.dll.LPSAFEARRAY_UserFree",
  1598. "cryptsp.dll.CryptGetUserKey",
  1599. "ncrypt.dll.NCryptIsKeyHandle",
  1600. "cryptsp.dll.CryptExportKey",
  1601. "rpcrt4.dll.UuidCreate",
  1602. "cryptsp.dll.CryptSignHashA",
  1603. "ws2_32.dll.#22",
  1604. "ws2_32.dll.#18",
  1605. "ws2_32.dll.#112",
  1606. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorA",
  1607. "kernel32.dll.WaitForMultipleObjects",
  1608. "kernel32.dll.SetEnvironmentVariableA",
  1609. "kernel32.dll.CreatePipe",
  1610. "kernel32.dll.VirtualFree",
  1611. "kernel32.dll.VirtualAlloc",
  1612. "kernel32.dll.VirtualProtect",
  1613. "kernel32.dll.GetThreadPreferredUILanguages",
  1614. "kernel32.dll.SetThreadPreferredUILanguages",
  1615. "kernel32.dll.LocaleNameToLCID",
  1616. "kernel32.dll.GetLocaleInfoEx",
  1617. "kernel32.dll.LCIDToLocaleName",
  1618. "kernel32.dll.GetSystemDefaultLocaleName",
  1619. "fastprox.dll.DllGetClassObject",
  1620. "fastprox.dll.DllCanUnloadNow",
  1621. "oleaut32.dll.#283",
  1622. "oleaut32.dll.#284",
  1623. "psapi.dll.EnumProcesses",
  1624. "psapi.dll.EnumProcessModules",
  1625. "psapi.dll.GetModuleBaseNameW",
  1626. "ntdll.dll.NtQuerySystemInformation",
  1627. "vssapi.dll.CreateWriter",
  1628. "oleaut32.dll.#2",
  1629. "samcli.dll.NetLocalGroupGetMembers",
  1630. "samlib.dll.SamConnect",
  1631. "rpcrt4.dll.NdrClientCall3",
  1632. "rpcrt4.dll.RpcStringBindingComposeW",
  1633. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1634. "rpcrt4.dll.RpcStringFreeW",
  1635. "samlib.dll.SamOpenDomain",
  1636. "samlib.dll.SamLookupNamesInDomain",
  1637. "samlib.dll.SamOpenAlias",
  1638. "samlib.dll.SamFreeMemory",
  1639. "samlib.dll.SamCloseHandle",
  1640. "samlib.dll.SamGetMembersInAlias",
  1641. "ole32.dll.CoCreateGuid",
  1642. "ole32.dll.StringFromCLSID",
  1643. "propsys.dll.VariantToPropVariant",
  1644. "wbemcore.dll.Reinitialize",
  1645. "wbemsvc.dll.DllGetClassObject",
  1646. "wbemsvc.dll.DllCanUnloadNow",
  1647. "authz.dll.AuthzInitializeContextFromToken",
  1648. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  1649. "authz.dll.AuthzAccessCheck",
  1650. "authz.dll.AuthzFreeAuditEvent",
  1651. "authz.dll.AuthzFreeContext",
  1652. "authz.dll.AuthzInitializeResourceManager",
  1653. "authz.dll.AuthzFreeResourceManager",
  1654. "rpcrt4.dll.RpcBindingCreateW",
  1655. "rpcrt4.dll.RpcBindingBind",
  1656. "rpcrt4.dll.I_RpcMapWin32Status",
  1657. "kernel32.dll.RegSetValueExW",
  1658. "kernel32.dll.RegQueryValueExW",
  1659. "wmisvc.dll.IsImproperShutdownDetected",
  1660. "wevtapi.dll.EvtRender",
  1661. "wevtapi.dll.EvtNext",
  1662. "wevtapi.dll.EvtClose",
  1663. "wevtapi.dll.EvtQuery",
  1664. "wevtapi.dll.EvtCreateRenderContext",
  1665. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1666. "rpcrt4.dll.RpcBindingSetOption",
  1667. "ole32.dll.CoCreateFreeThreadedMarshaler",
  1668. "ole32.dll.CreateStreamOnHGlobal",
  1669. "kernelbase.dll.InitializeAcl",
  1670. "kernelbase.dll.AddAce",
  1671. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1672. "kernel32.dll.IsThreadAFiber",
  1673. "kernel32.dll.OpenProcessToken",
  1674. "kernelbase.dll.GetTokenInformation",
  1675. "kernelbase.dll.DuplicateTokenEx",
  1676. "kernelbase.dll.AdjustTokenPrivileges",
  1677. "kernelbase.dll.AllocateAndInitializeSid",
  1678. "kernelbase.dll.CheckTokenMembership",
  1679. "oleaut32.dll.#285",
  1680. "kernel32.dll.SetThreadToken",
  1681. "ole32.dll.CLSIDFromString",
  1682. "oleaut32.dll.#17",
  1683. "oleaut32.dll.#20",
  1684. "oleaut32.dll.#19",
  1685. "oleaut32.dll.#25",
  1686. "oleaut32.dll.#286",
  1687. "authz.dll.AuthzInitializeContextFromSid",
  1688. "ole32.dll.CoGetCallContext",
  1689. "ole32.dll.CoImpersonateClient",
  1690. "advapi32.dll.OpenThreadToken",
  1691. "ole32.dll.CoRevertToSelf",
  1692. "oleaut32.dll.#8",
  1693. "oleaut32.dll.#9",
  1694. "ole32.dll.CoSwitchCallContext",
  1695. "ntmarta.dll.GetMartaExtensionInterface"
  1696. ]
  1697.  
  1698. [*] Static Analysis: {
  1699. "pe": {
  1700. "peid_signatures": null,
  1701. "imports": [
  1702. {
  1703. "imports": [
  1704. {
  1705. "name": "InterlockedExchange",
  1706. "address": "0x40505c"
  1707. },
  1708. {
  1709. "name": "Sleep",
  1710. "address": "0x405060"
  1711. },
  1712. {
  1713. "name": "InterlockedCompareExchange",
  1714. "address": "0x405064"
  1715. },
  1716. {
  1717. "name": "GetStartupInfoA",
  1718. "address": "0x405068"
  1719. },
  1720. {
  1721. "name": "TerminateProcess",
  1722. "address": "0x40506c"
  1723. },
  1724. {
  1725. "name": "GetCurrentProcess",
  1726. "address": "0x405070"
  1727. },
  1728. {
  1729. "name": "UnhandledExceptionFilter",
  1730. "address": "0x405074"
  1731. },
  1732. {
  1733. "name": "SetUnhandledExceptionFilter",
  1734. "address": "0x405078"
  1735. },
  1736. {
  1737. "name": "IsDebuggerPresent",
  1738. "address": "0x40507c"
  1739. },
  1740. {
  1741. "name": "QueryPerformanceCounter",
  1742. "address": "0x405080"
  1743. },
  1744. {
  1745. "name": "GetTickCount",
  1746. "address": "0x405084"
  1747. },
  1748. {
  1749. "name": "GetCurrentThreadId",
  1750. "address": "0x405088"
  1751. },
  1752. {
  1753. "name": "GetCurrentProcessId",
  1754. "address": "0x40508c"
  1755. },
  1756. {
  1757. "name": "GetCurrentDirectoryA",
  1758. "address": "0x405090"
  1759. },
  1760. {
  1761. "name": "GetModuleHandleA",
  1762. "address": "0x405094"
  1763. },
  1764. {
  1765. "name": "LoadLibraryW",
  1766. "address": "0x405098"
  1767. },
  1768. {
  1769. "name": "GetProcAddress",
  1770. "address": "0x40509c"
  1771. },
  1772. {
  1773. "name": "CreateFileMappingW",
  1774. "address": "0x4050a0"
  1775. },
  1776. {
  1777. "name": "MapViewOfFile",
  1778. "address": "0x4050a4"
  1779. },
  1780. {
  1781. "name": "VirtualAlloc",
  1782. "address": "0x4050a8"
  1783. },
  1784. {
  1785. "name": "GetSystemTimeAsFileTime",
  1786. "address": "0x4050ac"
  1787. }
  1788. ],
  1789. "dll": "KERNEL32.dll"
  1790. },
  1791. {
  1792. "imports": [
  1793. {
  1794. "name": "GetDC",
  1795. "address": "0x405174"
  1796. },
  1797. {
  1798. "name": "UpdateWindow",
  1799. "address": "0x405178"
  1800. },
  1801. {
  1802. "name": "SetWindowRgn",
  1803. "address": "0x40517c"
  1804. },
  1805. {
  1806. "name": "MoveWindow",
  1807. "address": "0x405180"
  1808. },
  1809. {
  1810. "name": "GetWindowRgn",
  1811. "address": "0x405184"
  1812. },
  1813. {
  1814. "name": "DrawIconEx",
  1815. "address": "0x405188"
  1816. },
  1817. {
  1818. "name": "GetClientRect",
  1819. "address": "0x40518c"
  1820. },
  1821. {
  1822. "name": "GetWindowTextA",
  1823. "address": "0x405190"
  1824. },
  1825. {
  1826. "name": "DestroyIcon",
  1827. "address": "0x405194"
  1828. },
  1829. {
  1830. "name": "EndPaint",
  1831. "address": "0x405198"
  1832. },
  1833. {
  1834. "name": "BeginPaint",
  1835. "address": "0x40519c"
  1836. },
  1837. {
  1838. "name": "SetCapture",
  1839. "address": "0x4051a0"
  1840. },
  1841. {
  1842. "name": "SendMessageA",
  1843. "address": "0x4051a4"
  1844. },
  1845. {
  1846. "name": "GetParent",
  1847. "address": "0x4051a8"
  1848. },
  1849. {
  1850. "name": "GetWindowLongA",
  1851. "address": "0x4051ac"
  1852. },
  1853. {
  1854. "name": "ReleaseCapture",
  1855. "address": "0x4051b0"
  1856. },
  1857. {
  1858. "name": "GetWindowRect",
  1859. "address": "0x4051b4"
  1860. },
  1861. {
  1862. "name": "SetWindowLongA",
  1863. "address": "0x4051b8"
  1864. },
  1865. {
  1866. "name": "CreateDialogParamA",
  1867. "address": "0x4051bc"
  1868. },
  1869. {
  1870. "name": "GetDlgItem",
  1871. "address": "0x4051c0"
  1872. },
  1873. {
  1874. "name": "LoadImageA",
  1875. "address": "0x4051c4"
  1876. },
  1877. {
  1878. "name": "ReleaseDC",
  1879. "address": "0x4051c8"
  1880. },
  1881. {
  1882. "name": "PostQuitMessage",
  1883. "address": "0x4051cc"
  1884. },
  1885. {
  1886. "name": "MessageBoxA",
  1887. "address": "0x4051d0"
  1888. },
  1889. {
  1890. "name": "DefWindowProcA",
  1891. "address": "0x4051d4"
  1892. },
  1893. {
  1894. "name": "LoadCursorA",
  1895. "address": "0x4051d8"
  1896. },
  1897. {
  1898. "name": "LoadIconA",
  1899. "address": "0x4051dc"
  1900. },
  1901. {
  1902. "name": "RegisterClassA",
  1903. "address": "0x4051e0"
  1904. },
  1905. {
  1906. "name": "CreateWindowExA",
  1907. "address": "0x4051e4"
  1908. },
  1909. {
  1910. "name": "ShowWindow",
  1911. "address": "0x4051e8"
  1912. },
  1913. {
  1914. "name": "GetMessageA",
  1915. "address": "0x4051ec"
  1916. },
  1917. {
  1918. "name": "TranslateMessage",
  1919. "address": "0x4051f0"
  1920. },
  1921. {
  1922. "name": "DispatchMessageA",
  1923. "address": "0x4051f4"
  1924. }
  1925. ],
  1926. "dll": "USER32.dll"
  1927. },
  1928. {
  1929. "imports": [
  1930. {
  1931. "name": "PtInRegion",
  1932. "address": "0x405000"
  1933. },
  1934. {
  1935. "name": "GetStockObject",
  1936. "address": "0x405004"
  1937. },
  1938. {
  1939. "name": "DeleteDC",
  1940. "address": "0x405008"
  1941. },
  1942. {
  1943. "name": "DeleteObject",
  1944. "address": "0x40500c"
  1945. },
  1946. {
  1947. "name": "CombineRgn",
  1948. "address": "0x405010"
  1949. },
  1950. {
  1951. "name": "CreateRectRgn",
  1952. "address": "0x405014"
  1953. },
  1954. {
  1955. "name": "GetPixel",
  1956. "address": "0x405018"
  1957. },
  1958. {
  1959. "name": "SelectObject",
  1960. "address": "0x40501c"
  1961. },
  1962. {
  1963. "name": "SaveDC",
  1964. "address": "0x405020"
  1965. },
  1966. {
  1967. "name": "GetObjectA",
  1968. "address": "0x405024"
  1969. },
  1970. {
  1971. "name": "CreateCompatibleDC",
  1972. "address": "0x405028"
  1973. },
  1974. {
  1975. "name": "GetRgnBox",
  1976. "address": "0x40502c"
  1977. },
  1978. {
  1979. "name": "CreateRectRgnIndirect",
  1980. "address": "0x405030"
  1981. },
  1982. {
  1983. "name": "BitBlt",
  1984. "address": "0x405034"
  1985. },
  1986. {
  1987. "name": "FrameRgn",
  1988. "address": "0x405038"
  1989. },
  1990. {
  1991. "name": "TextOutA",
  1992. "address": "0x40503c"
  1993. },
  1994. {
  1995. "name": "SetTextColor",
  1996. "address": "0x405040"
  1997. },
  1998. {
  1999. "name": "GetTextExtentPoint32A",
  2000. "address": "0x405044"
  2001. },
  2002. {
  2003. "name": "SetBkMode",
  2004. "address": "0x405048"
  2005. },
  2006. {
  2007. "name": "CreateFontA",
  2008. "address": "0x40504c"
  2009. },
  2010. {
  2011. "name": "CreateCompatibleBitmap",
  2012. "address": "0x405050"
  2013. },
  2014. {
  2015. "name": "GetRegionData",
  2016. "address": "0x405054"
  2017. }
  2018. ],
  2019. "dll": "GDI32.dll"
  2020. },
  2021. {
  2022. "imports": [
  2023. {
  2024. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  2025. "address": "0x4050b4"
  2026. },
  2027. {
  2028. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  2029. "address": "0x4050b8"
  2030. },
  2031. {
  2032. "name": "??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z",
  2033. "address": "0x4050bc"
  2034. },
  2035. {
  2036. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z",
  2037. "address": "0x4050c0"
  2038. },
  2039. {
  2040. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  2041. "address": "0x4050c4"
  2042. },
  2043. {
  2044. "name": "?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ",
  2045. "address": "0x4050c8"
  2046. },
  2047. {
  2048. "name": "?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ",
  2049. "address": "0x4050cc"
  2050. }
  2051. ],
  2052. "dll": "MSVCP90.dll"
  2053. },
  2054. {
  2055. "imports": [
  2056. {
  2057. "name": "__p__fmode",
  2058. "address": "0x4050d4"
  2059. },
  2060. {
  2061. "name": "__p__commode",
  2062. "address": "0x4050d8"
  2063. },
  2064. {
  2065. "name": "_adjust_fdiv",
  2066. "address": "0x4050dc"
  2067. },
  2068. {
  2069. "name": "__setusermatherr",
  2070. "address": "0x4050e0"
  2071. },
  2072. {
  2073. "name": "_configthreadlocale",
  2074. "address": "0x4050e4"
  2075. },
  2076. {
  2077. "name": "__set_app_type",
  2078. "address": "0x4050e8"
  2079. },
  2080. {
  2081. "name": "_initterm",
  2082. "address": "0x4050ec"
  2083. },
  2084. {
  2085. "name": "_acmdln",
  2086. "address": "0x4050f0"
  2087. },
  2088. {
  2089. "name": "exit",
  2090. "address": "0x4050f4"
  2091. },
  2092. {
  2093. "name": "_ismbblead",
  2094. "address": "0x4050f8"
  2095. },
  2096. {
  2097. "name": "_XcptFilter",
  2098. "address": "0x4050fc"
  2099. },
  2100. {
  2101. "name": "_exit",
  2102. "address": "0x405100"
  2103. },
  2104. {
  2105. "name": "_crt_debugger_hook",
  2106. "address": "0x405104"
  2107. },
  2108. {
  2109. "name": "_except_handler4_common",
  2110. "address": "0x405108"
  2111. },
  2112. {
  2113. "name": "?terminate@@YAXXZ",
  2114. "address": "0x40510c"
  2115. },
  2116. {
  2117. "name": "?_type_info_dtor_internal_method@type_info@@QAEXXZ",
  2118. "address": "0x405110"
  2119. },
  2120. {
  2121. "name": "_invoke_watson",
  2122. "address": "0x405114"
  2123. },
  2124. {
  2125. "name": "_controlfp_s",
  2126. "address": "0x405118"
  2127. },
  2128. {
  2129. "name": "_initterm_e",
  2130. "address": "0x40511c"
  2131. },
  2132. {
  2133. "name": "malloc",
  2134. "address": "0x405120"
  2135. },
  2136. {
  2137. "name": "strlen",
  2138. "address": "0x405124"
  2139. },
  2140. {
  2141. "name": "fclose",
  2142. "address": "0x405128"
  2143. },
  2144. {
  2145. "name": "fwrite",
  2146. "address": "0x40512c"
  2147. },
  2148. {
  2149. "name": "fopen",
  2150. "address": "0x405130"
  2151. },
  2152. {
  2153. "name": "free",
  2154. "address": "0x405134"
  2155. },
  2156. {
  2157. "name": "??3@YAXPAX@Z",
  2158. "address": "0x405138"
  2159. },
  2160. {
  2161. "name": "strcat",
  2162. "address": "0x40513c"
  2163. },
  2164. {
  2165. "name": "fread",
  2166. "address": "0x405140"
  2167. },
  2168. {
  2169. "name": "feof",
  2170. "address": "0x405144"
  2171. },
  2172. {
  2173. "name": "strcmp",
  2174. "address": "0x405148"
  2175. },
  2176. {
  2177. "name": "_unlock",
  2178. "address": "0x40514c"
  2179. },
  2180. {
  2181. "name": "__dllonexit",
  2182. "address": "0x405150"
  2183. },
  2184. {
  2185. "name": "_encode_pointer",
  2186. "address": "0x405154"
  2187. },
  2188. {
  2189. "name": "_lock",
  2190. "address": "0x405158"
  2191. },
  2192. {
  2193. "name": "_onexit",
  2194. "address": "0x40515c"
  2195. },
  2196. {
  2197. "name": "_decode_pointer",
  2198. "address": "0x405160"
  2199. },
  2200. {
  2201. "name": "_amsg_exit",
  2202. "address": "0x405164"
  2203. },
  2204. {
  2205. "name": "__getmainargs",
  2206. "address": "0x405168"
  2207. },
  2208. {
  2209. "name": "_cexit",
  2210. "address": "0x40516c"
  2211. }
  2212. ],
  2213. "dll": "MSVCR90.dll"
  2214. }
  2215. ],
  2216. "digital_signers": null,
  2217. "exported_dll_name": null,
  2218. "actual_checksum": "0x00010a65",
  2219. "overlay": null,
  2220. "imagebase": "0x00400000",
  2221. "reported_checksum": "0x00010a65",
  2222. "icon_hash": null,
  2223. "entrypoint": "0x00403cd5",
  2224. "timestamp": "2019-06-18 14:06:01",
  2225. "osversion": "5.0",
  2226. "sections": [
  2227. {
  2228. "name": ".text",
  2229. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2230. "virtual_address": "0x00001000",
  2231. "size_of_data": "0x00003400",
  2232. "entropy": "5.91",
  2233. "raw_address": "0x00000400",
  2234. "virtual_size": "0x0000338f",
  2235. "characteristics_raw": "0x60000020"
  2236. },
  2237. {
  2238. "name": ".rdata",
  2239. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2240. "virtual_address": "0x00005000",
  2241. "size_of_data": "0x0000c200",
  2242. "entropy": "6.18",
  2243. "raw_address": "0x00003800",
  2244. "virtual_size": "0x0000c1c8",
  2245. "characteristics_raw": "0x40000040"
  2246. },
  2247. {
  2248. "name": ".data",
  2249. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2250. "virtual_address": "0x00012000",
  2251. "size_of_data": "0x00000200",
  2252. "entropy": "1.51",
  2253. "raw_address": "0x0000fa00",
  2254. "virtual_size": "0x000004b4",
  2255. "characteristics_raw": "0xc0000040"
  2256. },
  2257. {
  2258. "name": ".rsrc",
  2259. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2260. "virtual_address": "0x00013000",
  2261. "size_of_data": "0x00000400",
  2262. "entropy": "5.19",
  2263. "raw_address": "0x0000fc00",
  2264. "virtual_size": "0x000002b0",
  2265. "characteristics_raw": "0x40000040"
  2266. }
  2267. ],
  2268. "resources": [],
  2269. "dirents": [
  2270. {
  2271. "virtual_address": "0x00000000",
  2272. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2273. "size": "0x00000000"
  2274. },
  2275. {
  2276. "virtual_address": "0x0001057c",
  2277. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2278. "size": "0x00000078"
  2279. },
  2280. {
  2281. "virtual_address": "0x00013000",
  2282. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2283. "size": "0x000002b0"
  2284. },
  2285. {
  2286. "virtual_address": "0x00000000",
  2287. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2288. "size": "0x00000000"
  2289. },
  2290. {
  2291. "virtual_address": "0x00000000",
  2292. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2293. "size": "0x00000000"
  2294. },
  2295. {
  2296. "virtual_address": "0x00000000",
  2297. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2298. "size": "0x00000000"
  2299. },
  2300. {
  2301. "virtual_address": "0x00005230",
  2302. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2303. "size": "0x0000001c"
  2304. },
  2305. {
  2306. "virtual_address": "0x00000000",
  2307. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2308. "size": "0x00000000"
  2309. },
  2310. {
  2311. "virtual_address": "0x00000000",
  2312. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2313. "size": "0x00000000"
  2314. },
  2315. {
  2316. "virtual_address": "0x00000000",
  2317. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2318. "size": "0x00000000"
  2319. },
  2320. {
  2321. "virtual_address": "0x00010330",
  2322. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2323. "size": "0x00000040"
  2324. },
  2325. {
  2326. "virtual_address": "0x00000000",
  2327. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2328. "size": "0x00000000"
  2329. },
  2330. {
  2331. "virtual_address": "0x00005000",
  2332. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2333. "size": "0x000001fc"
  2334. },
  2335. {
  2336. "virtual_address": "0x00000000",
  2337. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2338. "size": "0x00000000"
  2339. },
  2340. {
  2341. "virtual_address": "0x00000000",
  2342. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2343. "size": "0x00000000"
  2344. },
  2345. {
  2346. "virtual_address": "0x00000000",
  2347. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2348. "size": "0x00000000"
  2349. }
  2350. ],
  2351. "exports": [],
  2352. "guest_signers": {},
  2353. "imphash": "2858b9d144e229425988477b02aba6f7",
  2354. "icon_fuzzy": null,
  2355. "icon": null,
  2356. "pdbpath": "c:\\Users\\User\\Desktop\\DReY_Shape1667871152003\\Release\\ShapeGradientButton.pdb",
  2357. "imported_dll_count": 5,
  2358. "versioninfo": []
  2359. }
  2360. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!