API tools faq
paste
paladin316

Exes_68dc7f2d0ca5647b28945ce9b1b720c6_exe_2019-07-02_05_30.json

paladin316
Jul 2nd, 2019
2,148
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 31.61 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Small"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_68dc7f2d0ca5647b28945ce9b1b720c6.exe"
  7. [*] File Size: 37096
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "b0ca5b87bbdd4cbb12be21c62e0c589fe263192f2fa1a053981e27ac4fc03f3e"
  10. [*] MD5: "68dc7f2d0ca5647b28945ce9b1b720c6"
  11. [*] SHA1: "572adfd8461f1880475221f9220dd18d8b439fe3"
  12. [*] SHA512: "86fa5f201a572314d2c8c43f30450bfd2cf4e0bc17c96faedd01c93cef416ef72abe6e2d7f60383160311747afcc697e633f1ddc943cd6e40288b3b768cc9a79"
  13. [*] CRC32: "23F4DF0C"
  14. [*] SSDEEP: "384:q9Yr0Fyv4TsYSPXoml8UrYutfv+rhWuTGR6lx89DthncDk9EK6:IjFCSsYy+uU8uhv8ZtyAT6"
  15.  
  16. [*] Process Execution: [
  17. "Exes_68dc7f2d0ca5647b28945ce9b1b720c6.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  23. "Details": [
  24. {
  25. "Process": "Exes_68dc7f2d0ca5647b28945ce9b1b720c6.exe tried to sleep 5400 seconds, actually delayed analysis time by 0 seconds"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "File has been identified by 43 Antiviruses on VirusTotal as malicious",
  31. "Details": [
  32. {
  33. "MicroWorld-eScan": "Trojan.GenericKD.6139686"
  34. },
  35. {
  36. "CMC": "Backdoor.Win32.Small!O"
  37. },
  38. {
  39. "CAT-QuickHeal": "Trojan.Tiggre"
  40. },
  41. {
  42. "ALYac": "Trojan.GenericKD.6139686"
  43. },
  44. {
  45. "Zillya": "Backdoor.Small.Win32.10951"
  46. },
  47. {
  48. "BitDefender": "Trojan.GenericKD.6139686"
  49. },
  50. {
  51. "K7GW": "Trojan ( 0040f8b51 )"
  52. },
  53. {
  54. "K7AntiVirus": "Trojan ( 0040f8b51 )"
  55. },
  56. {
  57. "Invincea": "heuristic"
  58. },
  59. {
  60. "NANO-Antivirus": "Trojan.Win32.Rndseed.ejwzgr"
  61. },
  62. {
  63. "Cyren": "W32/Trojan.ZTBX-8389"
  64. },
  65. {
  66. "Symantec": "ML.Attribute.HighConfidence"
  67. },
  68. {
  69. "TrendMicro-HouseCall": "TROJ_GEN.R002C0PH218"
  70. },
  71. {
  72. "Kaspersky": "Backdoor.Win32.Small.lkc"
  73. },
  74. {
  75. "Ad-Aware": "Trojan.GenericKD.6139686"
  76. },
  77. {
  78. "Emsisoft": "Trojan.GenericKD.6139686 (B)"
  79. },
  80. {
  81. "F-Secure": "Trojan.GenericKD.6139686"
  82. },
  83. {
  84. "DrWeb": "BackDoor.Rndseed.17"
  85. },
  86. {
  87. "TrendMicro": "TROJ_GEN.R002C0PH218"
  88. },
  89. {
  90. "McAfee-GW-Edition": "GenericRXBV-HA!68DC7F2D0CA5"
  91. },
  92. {
  93. "Sophos": "Mal/Generic-S"
  94. },
  95. {
  96. "Ikarus": "Trojan.Win32.Agent"
  97. },
  98. {
  99. "Jiangmin": "Backdoor.Small.hs"
  100. },
  101. {
  102. "Avira": "BDS/Small.qciqd"
  103. },
  104. {
  105. "Fortinet": "W32/Generic.AC.3BBD59!tr"
  106. },
  107. {
  108. "Antiy-AVL": "Trojan/Win32.BTSGeneric"
  109. },
  110. {
  111. "Endgame": "malicious (high confidence)"
  112. },
  113. {
  114. "Arcabit": "Trojan.Generic.D5DAF26"
  115. },
  116. {
  117. "ZoneAlarm": "Backdoor.Win32.Small.lkc"
  118. },
  119. {
  120. "Microsoft": "Trojan:Win32/Occamy.C"
  121. },
  122. {
  123. "AhnLab-V3": "Backdoor/Win32.Small.C2651918"
  124. },
  125. {
  126. "McAfee": "GenericRXBV-HA!68DC7F2D0CA5"
  127. },
  128. {
  129. "MAX": "malware (ai score=100)"
  130. },
  131. {
  132. "VBA32": "Backdoor.Small"
  133. },
  134. {
  135. "Cylance": "Unsafe"
  136. },
  137. {
  138. "ESET-NOD32": "a variant of Win32/Agent.SOD"
  139. },
  140. {
  141. "Tencent": "Win32.Backdoor.Small.Wrqy"
  142. },
  143. {
  144. "Yandex": "Backdoor.Small!1kRB0ObuOI0"
  145. },
  146. {
  147. "GData": "Trojan.GenericKD.6139686"
  148. },
  149. {
  150. "Cybereason": "malicious.d0ca56"
  151. },
  152. {
  153. "Panda": "Trj/CI.A"
  154. },
  155. {
  156. "CrowdStrike": "malicious_confidence_90% (W)"
  157. },
  158. {
  159. "Qihoo-360": "Win32/Backdoor.34f"
  160. }
  161. ]
  162. }
  163. ]
  164.  
  165. [*] Started Service: []
  166.  
  167. [*] Executed Commands: []
  168.  
  169. [*] Mutexes: []
  170.  
  171. [*] Modified Files: []
  172.  
  173. [*] Deleted Files: []
  174.  
  175. [*] Modified Registry Keys: []
  176.  
  177. [*] Deleted Registry Keys: []
  178.  
  179. [*] DNS Communications: []
  180.  
  181. [*] Domains: []
  182.  
  183. [*] Network Communication - ICMP: []
  184.  
  185. [*] Network Communication - HTTP: []
  186.  
  187. [*] Network Communication - SMTP: []
  188.  
  189. [*] Network Communication - Hosts: []
  190.  
  191. [*] Network Communication - IRC: []
  192.  
  193. [*] Static Analysis: {
  194. "pe": {
  195. "peid_signatures": null,
  196. "imports": [
  197. {
  198. "imports": [
  199. {
  200. "name": "GetVersionExA",
  201. "address": "0x406000"
  202. },
  203. {
  204. "name": "GlobalMemoryStatus",
  205. "address": "0x406004"
  206. },
  207. {
  208. "name": "CreateProcessA",
  209. "address": "0x406008"
  210. },
  211. {
  212. "name": "Sleep",
  213. "address": "0x40600c"
  214. },
  215. {
  216. "name": "FlushFileBuffers",
  217. "address": "0x406010"
  218. },
  219. {
  220. "name": "LCMapStringW",
  221. "address": "0x406014"
  222. },
  223. {
  224. "name": "LCMapStringA",
  225. "address": "0x406018"
  226. },
  227. {
  228. "name": "SetStdHandle",
  229. "address": "0x40601c"
  230. },
  231. {
  232. "name": "LoadLibraryA",
  233. "address": "0x406020"
  234. },
  235. {
  236. "name": "GetProcAddress",
  237. "address": "0x406024"
  238. },
  239. {
  240. "name": "GetOEMCP",
  241. "address": "0x406028"
  242. },
  243. {
  244. "name": "GetACP",
  245. "address": "0x40602c"
  246. },
  247. {
  248. "name": "GetCPInfo",
  249. "address": "0x406030"
  250. },
  251. {
  252. "name": "GetStringTypeW",
  253. "address": "0x406034"
  254. },
  255. {
  256. "name": "GetStringTypeA",
  257. "address": "0x406038"
  258. },
  259. {
  260. "name": "MultiByteToWideChar",
  261. "address": "0x40603c"
  262. },
  263. {
  264. "name": "SetFilePointer",
  265. "address": "0x406040"
  266. },
  267. {
  268. "name": "GetLastError",
  269. "address": "0x406044"
  270. },
  271. {
  272. "name": "WriteFile",
  273. "address": "0x406048"
  274. },
  275. {
  276. "name": "RtlUnwind",
  277. "address": "0x40604c"
  278. },
  279. {
  280. "name": "HeapAlloc",
  281. "address": "0x406050"
  282. },
  283. {
  284. "name": "ExitProcess",
  285. "address": "0x406054"
  286. },
  287. {
  288. "name": "TerminateProcess",
  289. "address": "0x406058"
  290. },
  291. {
  292. "name": "GetCurrentProcess",
  293. "address": "0x40605c"
  294. },
  295. {
  296. "name": "GetModuleHandleA",
  297. "address": "0x406060"
  298. },
  299. {
  300. "name": "GetStartupInfoA",
  301. "address": "0x406064"
  302. },
  303. {
  304. "name": "GetCommandLineA",
  305. "address": "0x406068"
  306. },
  307. {
  308. "name": "GetVersion",
  309. "address": "0x40606c"
  310. },
  311. {
  312. "name": "HeapDestroy",
  313. "address": "0x406070"
  314. },
  315. {
  316. "name": "HeapCreate",
  317. "address": "0x406074"
  318. },
  319. {
  320. "name": "VirtualFree",
  321. "address": "0x406078"
  322. },
  323. {
  324. "name": "HeapFree",
  325. "address": "0x40607c"
  326. },
  327. {
  328. "name": "VirtualAlloc",
  329. "address": "0x406080"
  330. },
  331. {
  332. "name": "HeapReAlloc",
  333. "address": "0x406084"
  334. },
  335. {
  336. "name": "UnhandledExceptionFilter",
  337. "address": "0x406088"
  338. },
  339. {
  340. "name": "GetModuleFileNameA",
  341. "address": "0x40608c"
  342. },
  343. {
  344. "name": "FreeEnvironmentStringsA",
  345. "address": "0x406090"
  346. },
  347. {
  348. "name": "FreeEnvironmentStringsW",
  349. "address": "0x406094"
  350. },
  351. {
  352. "name": "WideCharToMultiByte",
  353. "address": "0x406098"
  354. },
  355. {
  356. "name": "GetEnvironmentStrings",
  357. "address": "0x40609c"
  358. },
  359. {
  360. "name": "GetEnvironmentStringsW",
  361. "address": "0x4060a0"
  362. },
  363. {
  364. "name": "SetHandleCount",
  365. "address": "0x4060a4"
  366. },
  367. {
  368. "name": "GetStdHandle",
  369. "address": "0x4060a8"
  370. },
  371. {
  372. "name": "GetFileType",
  373. "address": "0x4060ac"
  374. },
  375. {
  376. "name": "CloseHandle",
  377. "address": "0x4060b0"
  378. }
  379. ],
  380. "dll": "KERNEL32.dll"
  381. },
  382. {
  383. "imports": [
  384. {
  385. "name": "URLDownloadToFileA",
  386. "address": "0x4060f0"
  387. }
  388. ],
  389. "dll": "urlmon.dll"
  390. },
  391. {
  392. "imports": [
  393. {
  394. "name": "IcmpSendEcho2",
  395. "address": "0x4060e0"
  396. },
  397. {
  398. "name": "IcmpCloseHandle",
  399. "address": "0x4060e4"
  400. },
  401. {
  402. "name": "IcmpCreateFile",
  403. "address": "0x4060e8"
  404. }
  405. ],
  406. "dll": "iphlpapi.dll"
  407. },
  408. {
  409. "imports": [
  410. {
  411. "name": "inet_addr",
  412. "address": "0x4060d8"
  413. }
  414. ],
  415. "dll": "WS2_32.dll"
  416. },
  417. {
  418. "imports": [
  419. {
  420. "name": "HttpAddRequestHeadersA",
  421. "address": "0x4060b8"
  422. },
  423. {
  424. "name": "InternetReadFile",
  425. "address": "0x4060bc"
  426. },
  427. {
  428. "name": "InternetCloseHandle",
  429. "address": "0x4060c0"
  430. },
  431. {
  432. "name": "InternetOpenA",
  433. "address": "0x4060c4"
  434. },
  435. {
  436. "name": "InternetConnectA",
  437. "address": "0x4060c8"
  438. },
  439. {
  440. "name": "HttpOpenRequestA",
  441. "address": "0x4060cc"
  442. },
  443. {
  444. "name": "HttpSendRequestA",
  445. "address": "0x4060d0"
  446. }
  447. ],
  448. "dll": "WININET.dll"
  449. }
  450. ],
  451. "digital_signers": null,
  452. "exported_dll_name": null,
  453. "actual_checksum": "0x00014fb0",
  454. "overlay": {
  455. "size": "0x000000e8",
  456. "offset": "0x00009000"
  457. },
  458. "imagebase": "0x00400000",
  459. "reported_checksum": "0x00000000",
  460. "icon_hash": null,
  461. "entrypoint": "0x00401cd6",
  462. "timestamp": "2008-07-01 02:08:27",
  463. "osversion": "4.0",
  464. "sections": [
  465. {
  466. "name": ".text",
  467. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  468. "virtual_address": "0x00001000",
  469. "size_of_data": "0x00005000",
  470. "entropy": "6.03",
  471. "raw_address": "0x00001000",
  472. "virtual_size": "0x000044e8",
  473. "characteristics_raw": "0x60000020"
  474. },
  475. {
  476. "name": ".rdata",
  477. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  478. "virtual_address": "0x00006000",
  479. "size_of_data": "0x00001000",
  480. "entropy": "3.89",
  481. "raw_address": "0x00006000",
  482. "virtual_size": "0x00000a5e",
  483. "characteristics_raw": "0x40000040"
  484. },
  485. {
  486. "name": ".data",
  487. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  488. "virtual_address": "0x00007000",
  489. "size_of_data": "0x00002000",
  490. "entropy": "1.40",
  491. "raw_address": "0x00007000",
  492. "virtual_size": "0x00003038",
  493. "characteristics_raw": "0xc0000040"
  494. }
  495. ],
  496. "resources": [],
  497. "dirents": [
  498. {
  499. "virtual_address": "0x00000000",
  500. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  501. "size": "0x00000000"
  502. },
  503. {
  504. "virtual_address": "0x000064d0",
  505. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  506. "size": "0x00000078"
  507. },
  508. {
  509. "virtual_address": "0x00000000",
  510. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  511. "size": "0x00000000"
  512. },
  513. {
  514. "virtual_address": "0x00000000",
  515. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  516. "size": "0x00000000"
  517. },
  518. {
  519. "virtual_address": "0x00000000",
  520. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  521. "size": "0x00000000"
  522. },
  523. {
  524. "virtual_address": "0x00000000",
  525. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  526. "size": "0x00000000"
  527. },
  528. {
  529. "virtual_address": "0x00000000",
  530. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  531. "size": "0x00000000"
  532. },
  533. {
  534. "virtual_address": "0x00000000",
  535. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  536. "size": "0x00000000"
  537. },
  538. {
  539. "virtual_address": "0x00000000",
  540. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  541. "size": "0x00000000"
  542. },
  543. {
  544. "virtual_address": "0x00000000",
  545. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  546. "size": "0x00000000"
  547. },
  548. {
  549. "virtual_address": "0x00000000",
  550. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  551. "size": "0x00000000"
  552. },
  553. {
  554. "virtual_address": "0x00000000",
  555. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  556. "size": "0x00000000"
  557. },
  558. {
  559. "virtual_address": "0x00006000",
  560. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  561. "size": "0x000000f8"
  562. },
  563. {
  564. "virtual_address": "0x00000000",
  565. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  566. "size": "0x00000000"
  567. },
  568. {
  569. "virtual_address": "0x00000000",
  570. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  571. "size": "0x00000000"
  572. },
  573. {
  574. "virtual_address": "0x00000000",
  575. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  576. "size": "0x00000000"
  577. }
  578. ],
  579. "exports": [],
  580. "guest_signers": {},
  581. "imphash": "6397d644747a244a1136f6495b700a74",
  582. "icon_fuzzy": null,
  583. "icon": null,
  584. "pdbpath": null,
  585. "imported_dll_count": 5,
  586. "versioninfo": []
  587. }
  588. }
  589.  
  590. [*] Resolved APIs: [
  591. "rasapi32.dll.RasConnectionNotificationW",
  592. "sechost.dll.OpenServiceA",
  593. "sechost.dll.NotifyServiceStatusChangeA",
  594. "cryptbase.dll.SystemFunction036"
  595. ]
  596.  
  597. [*] Static Analysis: {
  598. "pe": {
  599. "peid_signatures": null,
  600. "imports": [
  601. {
  602. "imports": [
  603. {
  604. "name": "GetVersionExA",
  605. "address": "0x406000"
  606. },
  607. {
  608. "name": "GlobalMemoryStatus",
  609. "address": "0x406004"
  610. },
  611. {
  612. "name": "CreateProcessA",
  613. "address": "0x406008"
  614. },
  615. {
  616. "name": "Sleep",
  617. "address": "0x40600c"
  618. },
  619. {
  620. "name": "FlushFileBuffers",
  621. "address": "0x406010"
  622. },
  623. {
  624. "name": "LCMapStringW",
  625. "address": "0x406014"
  626. },
  627. {
  628. "name": "LCMapStringA",
  629. "address": "0x406018"
  630. },
  631. {
  632. "name": "SetStdHandle",
  633. "address": "0x40601c"
  634. },
  635. {
  636. "name": "LoadLibraryA",
  637. "address": "0x406020"
  638. },
  639. {
  640. "name": "GetProcAddress",
  641. "address": "0x406024"
  642. },
  643. {
  644. "name": "GetOEMCP",
  645. "address": "0x406028"
  646. },
  647. {
  648. "name": "GetACP",
  649. "address": "0x40602c"
  650. },
  651. {
  652. "name": "GetCPInfo",
  653. "address": "0x406030"
  654. },
  655. {
  656. "name": "GetStringTypeW",
  657. "address": "0x406034"
  658. },
  659. {
  660. "name": "GetStringTypeA",
  661. "address": "0x406038"
  662. },
  663. {
  664. "name": "MultiByteToWideChar",
  665. "address": "0x40603c"
  666. },
  667. {
  668. "name": "SetFilePointer",
  669. "address": "0x406040"
  670. },
  671. {
  672. "name": "GetLastError",
  673. "address": "0x406044"
  674. },
  675. {
  676. "name": "WriteFile",
  677. "address": "0x406048"
  678. },
  679. {
  680. "name": "RtlUnwind",
  681. "address": "0x40604c"
  682. },
  683. {
  684. "name": "HeapAlloc",
  685. "address": "0x406050"
  686. },
  687. {
  688. "name": "ExitProcess",
  689. "address": "0x406054"
  690. },
  691. {
  692. "name": "TerminateProcess",
  693. "address": "0x406058"
  694. },
  695. {
  696. "name": "GetCurrentProcess",
  697. "address": "0x40605c"
  698. },
  699. {
  700. "name": "GetModuleHandleA",
  701. "address": "0x406060"
  702. },
  703. {
  704. "name": "GetStartupInfoA",
  705. "address": "0x406064"
  706. },
  707. {
  708. "name": "GetCommandLineA",
  709. "address": "0x406068"
  710. },
  711. {
  712. "name": "GetVersion",
  713. "address": "0x40606c"
  714. },
  715. {
  716. "name": "HeapDestroy",
  717. "address": "0x406070"
  718. },
  719. {
  720. "name": "HeapCreate",
  721. "address": "0x406074"
  722. },
  723. {
  724. "name": "VirtualFree",
  725. "address": "0x406078"
  726. },
  727. {
  728. "name": "HeapFree",
  729. "address": "0x40607c"
  730. },
  731. {
  732. "name": "VirtualAlloc",
  733. "address": "0x406080"
  734. },
  735. {
  736. "name": "HeapReAlloc",
  737. "address": "0x406084"
  738. },
  739. {
  740. "name": "UnhandledExceptionFilter",
  741. "address": "0x406088"
  742. },
  743. {
  744. "name": "GetModuleFileNameA",
  745. "address": "0x40608c"
  746. },
  747. {
  748. "name": "FreeEnvironmentStringsA",
  749. "address": "0x406090"
  750. },
  751. {
  752. "name": "FreeEnvironmentStringsW",
  753. "address": "0x406094"
  754. },
  755. {
  756. "name": "WideCharToMultiByte",
  757. "address": "0x406098"
  758. },
  759. {
  760. "name": "GetEnvironmentStrings",
  761. "address": "0x40609c"
  762. },
  763. {
  764. "name": "GetEnvironmentStringsW",
  765. "address": "0x4060a0"
  766. },
  767. {
  768. "name": "SetHandleCount",
  769. "address": "0x4060a4"
  770. },
  771. {
  772. "name": "GetStdHandle",
  773. "address": "0x4060a8"
  774. },
  775. {
  776. "name": "GetFileType",
  777. "address": "0x4060ac"
  778. },
  779. {
  780. "name": "CloseHandle",
  781. "address": "0x4060b0"
  782. }
  783. ],
  784. "dll": "KERNEL32.dll"
  785. },
  786. {
  787. "imports": [
  788. {
  789. "name": "URLDownloadToFileA",
  790. "address": "0x4060f0"
  791. }
  792. ],
  793. "dll": "urlmon.dll"
  794. },
  795. {
  796. "imports": [
  797. {
  798. "name": "IcmpSendEcho2",
  799. "address": "0x4060e0"
  800. },
  801. {
  802. "name": "IcmpCloseHandle",
  803. "address": "0x4060e4"
  804. },
  805. {
  806. "name": "IcmpCreateFile",
  807. "address": "0x4060e8"
  808. }
  809. ],
  810. "dll": "iphlpapi.dll"
  811. },
  812. {
  813. "imports": [
  814. {
  815. "name": "inet_addr",
  816. "address": "0x4060d8"
  817. }
  818. ],
  819. "dll": "WS2_32.dll"
  820. },
  821. {
  822. "imports": [
  823. {
  824. "name": "HttpAddRequestHeadersA",
  825. "address": "0x4060b8"
  826. },
  827. {
  828. "name": "InternetReadFile",
  829. "address": "0x4060bc"
  830. },
  831. {
  832. "name": "InternetCloseHandle",
  833. "address": "0x4060c0"
  834. },
  835. {
  836. "name": "InternetOpenA",
  837. "address": "0x4060c4"
  838. },
  839. {
  840. "name": "InternetConnectA",
  841. "address": "0x4060c8"
  842. },
  843. {
  844. "name": "HttpOpenRequestA",
  845. "address": "0x4060cc"
  846. },
  847. {
  848. "name": "HttpSendRequestA",
  849. "address": "0x4060d0"
  850. }
  851. ],
  852. "dll": "WININET.dll"
  853. }
  854. ],
  855. "digital_signers": null,
  856. "exported_dll_name": null,
  857. "actual_checksum": "0x00014fb0",
  858. "overlay": {
  859. "size": "0x000000e8",
  860. "offset": "0x00009000"
  861. },
  862. "imagebase": "0x00400000",
  863. "reported_checksum": "0x00000000",
  864. "icon_hash": null,
  865. "entrypoint": "0x00401cd6",
  866. "timestamp": "2008-07-01 02:08:27",
  867. "osversion": "4.0",
  868. "sections": [
  869. {
  870. "name": ".text",
  871. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  872. "virtual_address": "0x00001000",
  873. "size_of_data": "0x00005000",
  874. "entropy": "6.03",
  875. "raw_address": "0x00001000",
  876. "virtual_size": "0x000044e8",
  877. "characteristics_raw": "0x60000020"
  878. },
  879. {
  880. "name": ".rdata",
  881. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  882. "virtual_address": "0x00006000",
  883. "size_of_data": "0x00001000",
  884. "entropy": "3.89",
  885. "raw_address": "0x00006000",
  886. "virtual_size": "0x00000a5e",
  887. "characteristics_raw": "0x40000040"
  888. },
  889. {
  890. "name": ".data",
  891. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  892. "virtual_address": "0x00007000",
  893. "size_of_data": "0x00002000",
  894. "entropy": "1.40",
  895. "raw_address": "0x00007000",
  896. "virtual_size": "0x00003038",
  897. "characteristics_raw": "0xc0000040"
  898. }
  899. ],
  900. "resources": [],
  901. "dirents": [
  902. {
  903. "virtual_address": "0x00000000",
  904. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  905. "size": "0x00000000"
  906. },
  907. {
  908. "virtual_address": "0x000064d0",
  909. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  910. "size": "0x00000078"
  911. },
  912. {
  913. "virtual_address": "0x00000000",
  914. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  915. "size": "0x00000000"
  916. },
  917. {
  918. "virtual_address": "0x00000000",
  919. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  920. "size": "0x00000000"
  921. },
  922. {
  923. "virtual_address": "0x00000000",
  924. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  925. "size": "0x00000000"
  926. },
  927. {
  928. "virtual_address": "0x00000000",
  929. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  930. "size": "0x00000000"
  931. },
  932. {
  933. "virtual_address": "0x00000000",
  934. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  935. "size": "0x00000000"
  936. },
  937. {
  938. "virtual_address": "0x00000000",
  939. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  940. "size": "0x00000000"
  941. },
  942. {
  943. "virtual_address": "0x00000000",
  944. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  945. "size": "0x00000000"
  946. },
  947. {
  948. "virtual_address": "0x00000000",
  949. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  950. "size": "0x00000000"
  951. },
  952. {
  953. "virtual_address": "0x00000000",
  954. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  955. "size": "0x00000000"
  956. },
  957. {
  958. "virtual_address": "0x00000000",
  959. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  960. "size": "0x00000000"
  961. },
  962. {
  963. "virtual_address": "0x00006000",
  964. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  965. "size": "0x000000f8"
  966. },
  967. {
  968. "virtual_address": "0x00000000",
  969. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  970. "size": "0x00000000"
  971. },
  972. {
  973. "virtual_address": "0x00000000",
  974. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  975. "size": "0x00000000"
  976. },
  977. {
  978. "virtual_address": "0x00000000",
  979. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  980. "size": "0x00000000"
  981. }
  982. ],
  983. "exports": [],
  984. "guest_signers": {},
  985. "imphash": "6397d644747a244a1136f6495b700a74",
  986. "icon_fuzzy": null,
  987. "icon": null,
  988. "pdbpath": null,
  989. "imported_dll_count": 5,
  990. "versioninfo": []
  991. }
  992. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!