API tools faq
paste
paladin316

Exes_824459aeeff2591da2723a6ab61e13ab_exe.json

paladin316
Jun 20th, 2019
2,182
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 40.69 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_824459aeeff2591da2723a6ab61e13ab.exe"
  7. [*] File Size: 409600
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows"
  9. [*] SHA256: "fc07a155207a18b114f91ddd97132988a24b1e57dd739a58864cbd0bb38c8b80"
  10. [*] MD5: "824459aeeff2591da2723a6ab61e13ab"
  11. [*] SHA1: "2135c5c7863f2425dc4760e830eb1f13df4af162"
  12. [*] SHA512: "febf8d51a7072b2744bee7760923602c04ec4de7b821ef9783dc692940ddb055924615812a7c05ec661b7df010eadd5ad4f3ec27db3bf8e82b6d1f9b3a0f5409"
  13. [*] CRC32: "0950B31A"
  14. [*] SSDEEP: "6144:2MTEZW5jcHz1T+CMw8Y5BqMXcwgufYUKP8V0Hk218xKUbiC1HLuq:2MTEZWudX+MX88VR5bNL"
  15.  
  16. [*] Process Execution: [
  17. "Exes_824459aeeff2591da2723a6ab61e13ab.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Performs some HTTP requests",
  27. "Details": [
  28. {
  29. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  30. },
  31. {
  32. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  33. },
  34. {
  35. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  36. }
  37. ]
  38. },
  39. {
  40. "Description": "The binary likely contains encrypted or compressed data.",
  41. "Details": [
  42. {
  43. "section": "name: .rsrc, entropy: 7.17, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00046c00, virtual_size: 0x00046ad4"
  44. }
  45. ]
  46. },
  47. {
  48. "Description": "File has been identified by 21 Antiviruses on VirusTotal as malicious",
  49. "Details": [
  50. {
  51. "FireEye": "Generic.mg.824459aeeff2591d"
  52. },
  53. {
  54. "Invincea": "heuristic"
  55. },
  56. {
  57. "APEX": "Malicious"
  58. },
  59. {
  60. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  61. },
  62. {
  63. "Endgame": "malicious (high confidence)"
  64. },
  65. {
  66. "Sophos": "Mal/FormBoo-A"
  67. },
  68. {
  69. "F-Secure": "Trojan.TR/Dropper.Gen"
  70. },
  71. {
  72. "Trapmine": "malicious.high.ml.score"
  73. },
  74. {
  75. "Avira": "TR/Dropper.Gen"
  76. },
  77. {
  78. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  79. },
  80. {
  81. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  82. },
  83. {
  84. "Acronis": "suspicious"
  85. },
  86. {
  87. "VBA32": "BScope.Trojan.Fuerboos"
  88. },
  89. {
  90. "Cylance": "Unsafe"
  91. },
  92. {
  93. "ESET-NOD32": "a variant of Win32/Kryptik.GUEE"
  94. },
  95. {
  96. "SentinelOne": "DFI - Malicious PE"
  97. },
  98. {
  99. "AVG": "FileRepMalware"
  100. },
  101. {
  102. "Cybereason": "malicious.7863f2"
  103. },
  104. {
  105. "Paloalto": "generic.ml"
  106. },
  107. {
  108. "CrowdStrike": "win/malicious_confidence_90% (W)"
  109. },
  110. {
  111. "Qihoo-360": "HEUR/QVM10.1.FF21.Malware.Gen"
  112. }
  113. ]
  114. }
  115. ]
  116.  
  117. [*] Started Service: []
  118.  
  119. [*] Executed Commands: []
  120.  
  121. [*] Mutexes: [
  122. "DBWinMutex"
  123. ]
  124.  
  125. [*] Modified Files: []
  126.  
  127. [*] Deleted Files: []
  128.  
  129. [*] Modified Registry Keys: []
  130.  
  131. [*] Deleted Registry Keys: []
  132.  
  133. [*] DNS Communications: []
  134.  
  135. [*] Domains: []
  136.  
  137. [*] Network Communication - ICMP: []
  138.  
  139. [*] Network Communication - HTTP: [
  140. {
  141. "count": 1,
  142. "body": "",
  143. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  144. "user-agent": "Microsoft-CryptoAPI/6.1",
  145. "method": "GET",
  146. "host": "ocsp.digicert.com",
  147. "version": "1.1",
  148. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  149. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  150. "port": 80
  151. },
  152. {
  153. "count": 1,
  154. "body": "",
  155. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  156. "user-agent": "Microsoft-CryptoAPI/6.1",
  157. "method": "GET",
  158. "host": "ocsp.digicert.com",
  159. "version": "1.1",
  160. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  161. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  162. "port": 80
  163. },
  164. {
  165. "count": 1,
  166. "body": "",
  167. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  168. "user-agent": "Microsoft-CryptoAPI/6.1",
  169. "method": "GET",
  170. "host": "ocsp.digicert.com",
  171. "version": "1.1",
  172. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  173. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  174. "port": 80
  175. }
  176. ]
  177.  
  178. [*] Network Communication - SMTP: []
  179.  
  180. [*] Network Communication - Hosts: []
  181.  
  182. [*] Network Communication - IRC: []
  183.  
  184. [*] Static Analysis: {
  185. "pe": {
  186. "peid_signatures": null,
  187. "imports": [
  188. {
  189. "imports": [
  190. {
  191. "name": "LoadLibraryA",
  192. "address": "0x413000"
  193. },
  194. {
  195. "name": "CompareStringW",
  196. "address": "0x413004"
  197. },
  198. {
  199. "name": "CompareStringA",
  200. "address": "0x413008"
  201. },
  202. {
  203. "name": "GetTimeZoneInformation",
  204. "address": "0x41300c"
  205. },
  206. {
  207. "name": "IsValidLocale",
  208. "address": "0x413010"
  209. },
  210. {
  211. "name": "EnumSystemLocalesA",
  212. "address": "0x413014"
  213. },
  214. {
  215. "name": "GetUserDefaultLCID",
  216. "address": "0x413018"
  217. },
  218. {
  219. "name": "GetDateFormatA",
  220. "address": "0x41301c"
  221. },
  222. {
  223. "name": "GetTimeFormatA",
  224. "address": "0x413020"
  225. },
  226. {
  227. "name": "GetLastError",
  228. "address": "0x413024"
  229. },
  230. {
  231. "name": "HeapFree",
  232. "address": "0x413028"
  233. },
  234. {
  235. "name": "HeapAlloc",
  236. "address": "0x41302c"
  237. },
  238. {
  239. "name": "GetCommandLineA",
  240. "address": "0x413030"
  241. },
  242. {
  243. "name": "HeapCreate",
  244. "address": "0x413034"
  245. },
  246. {
  247. "name": "HeapDestroy",
  248. "address": "0x413038"
  249. },
  250. {
  251. "name": "VirtualFree",
  252. "address": "0x41303c"
  253. },
  254. {
  255. "name": "DeleteCriticalSection",
  256. "address": "0x413040"
  257. },
  258. {
  259. "name": "LeaveCriticalSection",
  260. "address": "0x413044"
  261. },
  262. {
  263. "name": "FatalAppExitA",
  264. "address": "0x413048"
  265. },
  266. {
  267. "name": "EnterCriticalSection",
  268. "address": "0x41304c"
  269. },
  270. {
  271. "name": "VirtualAlloc",
  272. "address": "0x413050"
  273. },
  274. {
  275. "name": "HeapReAlloc",
  276. "address": "0x413054"
  277. },
  278. {
  279. "name": "GetModuleHandleW",
  280. "address": "0x413058"
  281. },
  282. {
  283. "name": "Sleep",
  284. "address": "0x41305c"
  285. },
  286. {
  287. "name": "GetProcAddress",
  288. "address": "0x413060"
  289. },
  290. {
  291. "name": "ExitProcess",
  292. "address": "0x413064"
  293. },
  294. {
  295. "name": "WriteFile",
  296. "address": "0x413068"
  297. },
  298. {
  299. "name": "GetStdHandle",
  300. "address": "0x41306c"
  301. },
  302. {
  303. "name": "GetModuleFileNameA",
  304. "address": "0x413070"
  305. },
  306. {
  307. "name": "SetUnhandledExceptionFilter",
  308. "address": "0x413074"
  309. },
  310. {
  311. "name": "FreeEnvironmentStringsA",
  312. "address": "0x413078"
  313. },
  314. {
  315. "name": "GetEnvironmentStrings",
  316. "address": "0x41307c"
  317. },
  318. {
  319. "name": "FreeEnvironmentStringsW",
  320. "address": "0x413080"
  321. },
  322. {
  323. "name": "WideCharToMultiByte",
  324. "address": "0x413084"
  325. },
  326. {
  327. "name": "GetEnvironmentStringsW",
  328. "address": "0x413088"
  329. },
  330. {
  331. "name": "SetHandleCount",
  332. "address": "0x41308c"
  333. },
  334. {
  335. "name": "GetFileType",
  336. "address": "0x413090"
  337. },
  338. {
  339. "name": "GetStartupInfoA",
  340. "address": "0x413094"
  341. },
  342. {
  343. "name": "TlsGetValue",
  344. "address": "0x413098"
  345. },
  346. {
  347. "name": "TlsAlloc",
  348. "address": "0x41309c"
  349. },
  350. {
  351. "name": "TlsSetValue",
  352. "address": "0x4130a0"
  353. },
  354. {
  355. "name": "TlsFree",
  356. "address": "0x4130a4"
  357. },
  358. {
  359. "name": "InterlockedIncrement",
  360. "address": "0x4130a8"
  361. },
  362. {
  363. "name": "SetLastError",
  364. "address": "0x4130ac"
  365. },
  366. {
  367. "name": "GetCurrentThreadId",
  368. "address": "0x4130b0"
  369. },
  370. {
  371. "name": "InterlockedDecrement",
  372. "address": "0x4130b4"
  373. },
  374. {
  375. "name": "GetCurrentThread",
  376. "address": "0x4130b8"
  377. },
  378. {
  379. "name": "QueryPerformanceCounter",
  380. "address": "0x4130bc"
  381. },
  382. {
  383. "name": "GetTickCount",
  384. "address": "0x4130c0"
  385. },
  386. {
  387. "name": "GetCurrentProcessId",
  388. "address": "0x4130c4"
  389. },
  390. {
  391. "name": "GetSystemTimeAsFileTime",
  392. "address": "0x4130c8"
  393. },
  394. {
  395. "name": "TerminateProcess",
  396. "address": "0x4130cc"
  397. },
  398. {
  399. "name": "GetCurrentProcess",
  400. "address": "0x4130d0"
  401. },
  402. {
  403. "name": "UnhandledExceptionFilter",
  404. "address": "0x4130d4"
  405. },
  406. {
  407. "name": "IsDebuggerPresent",
  408. "address": "0x4130d8"
  409. },
  410. {
  411. "name": "InitializeCriticalSectionAndSpinCount",
  412. "address": "0x4130dc"
  413. },
  414. {
  415. "name": "RtlUnwind",
  416. "address": "0x4130e0"
  417. },
  418. {
  419. "name": "SetConsoleCtrlHandler",
  420. "address": "0x4130e4"
  421. },
  422. {
  423. "name": "FreeLibrary",
  424. "address": "0x4130e8"
  425. },
  426. {
  427. "name": "InterlockedExchange",
  428. "address": "0x4130ec"
  429. },
  430. {
  431. "name": "GetCPInfo",
  432. "address": "0x4130f0"
  433. },
  434. {
  435. "name": "GetACP",
  436. "address": "0x4130f4"
  437. },
  438. {
  439. "name": "GetOEMCP",
  440. "address": "0x4130f8"
  441. },
  442. {
  443. "name": "IsValidCodePage",
  444. "address": "0x4130fc"
  445. },
  446. {
  447. "name": "HeapSize",
  448. "address": "0x413100"
  449. },
  450. {
  451. "name": "GetLocaleInfoW",
  452. "address": "0x413104"
  453. },
  454. {
  455. "name": "GetLocaleInfoA",
  456. "address": "0x413108"
  457. },
  458. {
  459. "name": "LCMapStringA",
  460. "address": "0x41310c"
  461. },
  462. {
  463. "name": "MultiByteToWideChar",
  464. "address": "0x413110"
  465. },
  466. {
  467. "name": "LCMapStringW",
  468. "address": "0x413114"
  469. },
  470. {
  471. "name": "GetStringTypeA",
  472. "address": "0x413118"
  473. },
  474. {
  475. "name": "GetStringTypeW",
  476. "address": "0x41311c"
  477. },
  478. {
  479. "name": "SetEnvironmentVariableA",
  480. "address": "0x413120"
  481. }
  482. ],
  483. "dll": "KERNEL32.dll"
  484. },
  485. {
  486. "imports": [
  487. {
  488. "name": "SymGetSymFromName",
  489. "address": "0x413128"
  490. },
  491. {
  492. "name": "MapFileAndCheckSumW",
  493. "address": "0x41312c"
  494. },
  495. {
  496. "name": "GetTimestampForLoadedLibrary",
  497. "address": "0x413130"
  498. },
  499. {
  500. "name": "ImagehlpApiVersion",
  501. "address": "0x413134"
  502. },
  503. {
  504. "name": "SymInitialize",
  505. "address": "0x413138"
  506. },
  507. {
  508. "name": "FindDebugInfoFile",
  509. "address": "0x41313c"
  510. },
  511. {
  512. "name": "GetImageConfigInformation",
  513. "address": "0x413140"
  514. }
  515. ],
  516. "dll": "imagehlp.dll"
  517. }
  518. ],
  519. "digital_signers": null,
  520. "exported_dll_name": null,
  521. "actual_checksum": "0x00065d49",
  522. "overlay": null,
  523. "imagebase": "0x00400000",
  524. "reported_checksum": "0x00000000",
  525. "icon_hash": null,
  526. "entrypoint": "0x0040212c",
  527. "timestamp": "2019-06-19 23:15:32",
  528. "osversion": "5.0",
  529. "sections": [
  530. {
  531. "name": ".text",
  532. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  533. "virtual_address": "0x00001000",
  534. "size_of_data": "0x00011800",
  535. "entropy": "6.61",
  536. "raw_address": "0x00000400",
  537. "virtual_size": "0x000116ae",
  538. "characteristics_raw": "0x60000020"
  539. },
  540. {
  541. "name": ".rdata",
  542. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  543. "virtual_address": "0x00013000",
  544. "size_of_data": "0x00002a00",
  545. "entropy": "5.50",
  546. "raw_address": "0x00011c00",
  547. "virtual_size": "0x0000294c",
  548. "characteristics_raw": "0x40000040"
  549. },
  550. {
  551. "name": ".data",
  552. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  553. "virtual_address": "0x00016000",
  554. "size_of_data": "0x00007800",
  555. "entropy": "6.53",
  556. "raw_address": "0x00014600",
  557. "virtual_size": "0x000083e4",
  558. "characteristics_raw": "0xc0000040"
  559. },
  560. {
  561. "name": ".rsrc",
  562. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  563. "virtual_address": "0x0001f000",
  564. "size_of_data": "0x00046c00",
  565. "entropy": "7.17",
  566. "raw_address": "0x0001be00",
  567. "virtual_size": "0x00046ad4",
  568. "characteristics_raw": "0x40000040"
  569. },
  570. {
  571. "name": ".reloc",
  572. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  573. "virtual_address": "0x00066000",
  574. "size_of_data": "0x00001600",
  575. "entropy": "6.48",
  576. "raw_address": "0x00062a00",
  577. "virtual_size": "0x000014fe",
  578. "characteristics_raw": "0x42000040"
  579. }
  580. ],
  581. "resources": [],
  582. "dirents": [
  583. {
  584. "virtual_address": "0x00000000",
  585. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  586. "size": "0x00000000"
  587. },
  588. {
  589. "virtual_address": "0x000151b4",
  590. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  591. "size": "0x0000003c"
  592. },
  593. {
  594. "virtual_address": "0x0001f000",
  595. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  596. "size": "0x00046ad4"
  597. },
  598. {
  599. "virtual_address": "0x00000000",
  600. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  601. "size": "0x00000000"
  602. },
  603. {
  604. "virtual_address": "0x00000000",
  605. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  606. "size": "0x00000000"
  607. },
  608. {
  609. "virtual_address": "0x00066000",
  610. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  611. "size": "0x000014ac"
  612. },
  613. {
  614. "virtual_address": "0x00000000",
  615. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  616. "size": "0x00000000"
  617. },
  618. {
  619. "virtual_address": "0x00000000",
  620. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  621. "size": "0x00000000"
  622. },
  623. {
  624. "virtual_address": "0x00000000",
  625. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  626. "size": "0x00000000"
  627. },
  628. {
  629. "virtual_address": "0x00000000",
  630. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  631. "size": "0x00000000"
  632. },
  633. {
  634. "virtual_address": "0x00014cf0",
  635. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  636. "size": "0x00000040"
  637. },
  638. {
  639. "virtual_address": "0x00000000",
  640. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  641. "size": "0x00000000"
  642. },
  643. {
  644. "virtual_address": "0x00013000",
  645. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  646. "size": "0x00000148"
  647. },
  648. {
  649. "virtual_address": "0x00000000",
  650. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  651. "size": "0x00000000"
  652. },
  653. {
  654. "virtual_address": "0x00000000",
  655. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  656. "size": "0x00000000"
  657. },
  658. {
  659. "virtual_address": "0x00000000",
  660. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  661. "size": "0x00000000"
  662. }
  663. ],
  664. "exports": [],
  665. "guest_signers": {},
  666. "imphash": "3656671b39fb07039d665176129b6c1f",
  667. "icon_fuzzy": null,
  668. "icon": null,
  669. "pdbpath": null,
  670. "imported_dll_count": 2,
  671. "versioninfo": []
  672. }
  673. }
  674.  
  675. [*] Resolved APIs: [
  676. "kernel32.dll.FlsAlloc",
  677. "kernel32.dll.FlsGetValue",
  678. "kernel32.dll.FlsSetValue",
  679. "kernel32.dll.FlsFree"
  680. ]
  681.  
  682. [*] Static Analysis: {
  683. "pe": {
  684. "peid_signatures": null,
  685. "imports": [
  686. {
  687. "imports": [
  688. {
  689. "name": "LoadLibraryA",
  690. "address": "0x413000"
  691. },
  692. {
  693. "name": "CompareStringW",
  694. "address": "0x413004"
  695. },
  696. {
  697. "name": "CompareStringA",
  698. "address": "0x413008"
  699. },
  700. {
  701. "name": "GetTimeZoneInformation",
  702. "address": "0x41300c"
  703. },
  704. {
  705. "name": "IsValidLocale",
  706. "address": "0x413010"
  707. },
  708. {
  709. "name": "EnumSystemLocalesA",
  710. "address": "0x413014"
  711. },
  712. {
  713. "name": "GetUserDefaultLCID",
  714. "address": "0x413018"
  715. },
  716. {
  717. "name": "GetDateFormatA",
  718. "address": "0x41301c"
  719. },
  720. {
  721. "name": "GetTimeFormatA",
  722. "address": "0x413020"
  723. },
  724. {
  725. "name": "GetLastError",
  726. "address": "0x413024"
  727. },
  728. {
  729. "name": "HeapFree",
  730. "address": "0x413028"
  731. },
  732. {
  733. "name": "HeapAlloc",
  734. "address": "0x41302c"
  735. },
  736. {
  737. "name": "GetCommandLineA",
  738. "address": "0x413030"
  739. },
  740. {
  741. "name": "HeapCreate",
  742. "address": "0x413034"
  743. },
  744. {
  745. "name": "HeapDestroy",
  746. "address": "0x413038"
  747. },
  748. {
  749. "name": "VirtualFree",
  750. "address": "0x41303c"
  751. },
  752. {
  753. "name": "DeleteCriticalSection",
  754. "address": "0x413040"
  755. },
  756. {
  757. "name": "LeaveCriticalSection",
  758. "address": "0x413044"
  759. },
  760. {
  761. "name": "FatalAppExitA",
  762. "address": "0x413048"
  763. },
  764. {
  765. "name": "EnterCriticalSection",
  766. "address": "0x41304c"
  767. },
  768. {
  769. "name": "VirtualAlloc",
  770. "address": "0x413050"
  771. },
  772. {
  773. "name": "HeapReAlloc",
  774. "address": "0x413054"
  775. },
  776. {
  777. "name": "GetModuleHandleW",
  778. "address": "0x413058"
  779. },
  780. {
  781. "name": "Sleep",
  782. "address": "0x41305c"
  783. },
  784. {
  785. "name": "GetProcAddress",
  786. "address": "0x413060"
  787. },
  788. {
  789. "name": "ExitProcess",
  790. "address": "0x413064"
  791. },
  792. {
  793. "name": "WriteFile",
  794. "address": "0x413068"
  795. },
  796. {
  797. "name": "GetStdHandle",
  798. "address": "0x41306c"
  799. },
  800. {
  801. "name": "GetModuleFileNameA",
  802. "address": "0x413070"
  803. },
  804. {
  805. "name": "SetUnhandledExceptionFilter",
  806. "address": "0x413074"
  807. },
  808. {
  809. "name": "FreeEnvironmentStringsA",
  810. "address": "0x413078"
  811. },
  812. {
  813. "name": "GetEnvironmentStrings",
  814. "address": "0x41307c"
  815. },
  816. {
  817. "name": "FreeEnvironmentStringsW",
  818. "address": "0x413080"
  819. },
  820. {
  821. "name": "WideCharToMultiByte",
  822. "address": "0x413084"
  823. },
  824. {
  825. "name": "GetEnvironmentStringsW",
  826. "address": "0x413088"
  827. },
  828. {
  829. "name": "SetHandleCount",
  830. "address": "0x41308c"
  831. },
  832. {
  833. "name": "GetFileType",
  834. "address": "0x413090"
  835. },
  836. {
  837. "name": "GetStartupInfoA",
  838. "address": "0x413094"
  839. },
  840. {
  841. "name": "TlsGetValue",
  842. "address": "0x413098"
  843. },
  844. {
  845. "name": "TlsAlloc",
  846. "address": "0x41309c"
  847. },
  848. {
  849. "name": "TlsSetValue",
  850. "address": "0x4130a0"
  851. },
  852. {
  853. "name": "TlsFree",
  854. "address": "0x4130a4"
  855. },
  856. {
  857. "name": "InterlockedIncrement",
  858. "address": "0x4130a8"
  859. },
  860. {
  861. "name": "SetLastError",
  862. "address": "0x4130ac"
  863. },
  864. {
  865. "name": "GetCurrentThreadId",
  866. "address": "0x4130b0"
  867. },
  868. {
  869. "name": "InterlockedDecrement",
  870. "address": "0x4130b4"
  871. },
  872. {
  873. "name": "GetCurrentThread",
  874. "address": "0x4130b8"
  875. },
  876. {
  877. "name": "QueryPerformanceCounter",
  878. "address": "0x4130bc"
  879. },
  880. {
  881. "name": "GetTickCount",
  882. "address": "0x4130c0"
  883. },
  884. {
  885. "name": "GetCurrentProcessId",
  886. "address": "0x4130c4"
  887. },
  888. {
  889. "name": "GetSystemTimeAsFileTime",
  890. "address": "0x4130c8"
  891. },
  892. {
  893. "name": "TerminateProcess",
  894. "address": "0x4130cc"
  895. },
  896. {
  897. "name": "GetCurrentProcess",
  898. "address": "0x4130d0"
  899. },
  900. {
  901. "name": "UnhandledExceptionFilter",
  902. "address": "0x4130d4"
  903. },
  904. {
  905. "name": "IsDebuggerPresent",
  906. "address": "0x4130d8"
  907. },
  908. {
  909. "name": "InitializeCriticalSectionAndSpinCount",
  910. "address": "0x4130dc"
  911. },
  912. {
  913. "name": "RtlUnwind",
  914. "address": "0x4130e0"
  915. },
  916. {
  917. "name": "SetConsoleCtrlHandler",
  918. "address": "0x4130e4"
  919. },
  920. {
  921. "name": "FreeLibrary",
  922. "address": "0x4130e8"
  923. },
  924. {
  925. "name": "InterlockedExchange",
  926. "address": "0x4130ec"
  927. },
  928. {
  929. "name": "GetCPInfo",
  930. "address": "0x4130f0"
  931. },
  932. {
  933. "name": "GetACP",
  934. "address": "0x4130f4"
  935. },
  936. {
  937. "name": "GetOEMCP",
  938. "address": "0x4130f8"
  939. },
  940. {
  941. "name": "IsValidCodePage",
  942. "address": "0x4130fc"
  943. },
  944. {
  945. "name": "HeapSize",
  946. "address": "0x413100"
  947. },
  948. {
  949. "name": "GetLocaleInfoW",
  950. "address": "0x413104"
  951. },
  952. {
  953. "name": "GetLocaleInfoA",
  954. "address": "0x413108"
  955. },
  956. {
  957. "name": "LCMapStringA",
  958. "address": "0x41310c"
  959. },
  960. {
  961. "name": "MultiByteToWideChar",
  962. "address": "0x413110"
  963. },
  964. {
  965. "name": "LCMapStringW",
  966. "address": "0x413114"
  967. },
  968. {
  969. "name": "GetStringTypeA",
  970. "address": "0x413118"
  971. },
  972. {
  973. "name": "GetStringTypeW",
  974. "address": "0x41311c"
  975. },
  976. {
  977. "name": "SetEnvironmentVariableA",
  978. "address": "0x413120"
  979. }
  980. ],
  981. "dll": "KERNEL32.dll"
  982. },
  983. {
  984. "imports": [
  985. {
  986. "name": "SymGetSymFromName",
  987. "address": "0x413128"
  988. },
  989. {
  990. "name": "MapFileAndCheckSumW",
  991. "address": "0x41312c"
  992. },
  993. {
  994. "name": "GetTimestampForLoadedLibrary",
  995. "address": "0x413130"
  996. },
  997. {
  998. "name": "ImagehlpApiVersion",
  999. "address": "0x413134"
  1000. },
  1001. {
  1002. "name": "SymInitialize",
  1003. "address": "0x413138"
  1004. },
  1005. {
  1006. "name": "FindDebugInfoFile",
  1007. "address": "0x41313c"
  1008. },
  1009. {
  1010. "name": "GetImageConfigInformation",
  1011. "address": "0x413140"
  1012. }
  1013. ],
  1014. "dll": "imagehlp.dll"
  1015. }
  1016. ],
  1017. "digital_signers": null,
  1018. "exported_dll_name": null,
  1019. "actual_checksum": "0x00065d49",
  1020. "overlay": null,
  1021. "imagebase": "0x00400000",
  1022. "reported_checksum": "0x00000000",
  1023. "icon_hash": null,
  1024. "entrypoint": "0x0040212c",
  1025. "timestamp": "2019-06-19 23:15:32",
  1026. "osversion": "5.0",
  1027. "sections": [
  1028. {
  1029. "name": ".text",
  1030. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1031. "virtual_address": "0x00001000",
  1032. "size_of_data": "0x00011800",
  1033. "entropy": "6.61",
  1034. "raw_address": "0x00000400",
  1035. "virtual_size": "0x000116ae",
  1036. "characteristics_raw": "0x60000020"
  1037. },
  1038. {
  1039. "name": ".rdata",
  1040. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1041. "virtual_address": "0x00013000",
  1042. "size_of_data": "0x00002a00",
  1043. "entropy": "5.50",
  1044. "raw_address": "0x00011c00",
  1045. "virtual_size": "0x0000294c",
  1046. "characteristics_raw": "0x40000040"
  1047. },
  1048. {
  1049. "name": ".data",
  1050. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1051. "virtual_address": "0x00016000",
  1052. "size_of_data": "0x00007800",
  1053. "entropy": "6.53",
  1054. "raw_address": "0x00014600",
  1055. "virtual_size": "0x000083e4",
  1056. "characteristics_raw": "0xc0000040"
  1057. },
  1058. {
  1059. "name": ".rsrc",
  1060. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1061. "virtual_address": "0x0001f000",
  1062. "size_of_data": "0x00046c00",
  1063. "entropy": "7.17",
  1064. "raw_address": "0x0001be00",
  1065. "virtual_size": "0x00046ad4",
  1066. "characteristics_raw": "0x40000040"
  1067. },
  1068. {
  1069. "name": ".reloc",
  1070. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1071. "virtual_address": "0x00066000",
  1072. "size_of_data": "0x00001600",
  1073. "entropy": "6.48",
  1074. "raw_address": "0x00062a00",
  1075. "virtual_size": "0x000014fe",
  1076. "characteristics_raw": "0x42000040"
  1077. }
  1078. ],
  1079. "resources": [],
  1080. "dirents": [
  1081. {
  1082. "virtual_address": "0x00000000",
  1083. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1084. "size": "0x00000000"
  1085. },
  1086. {
  1087. "virtual_address": "0x000151b4",
  1088. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1089. "size": "0x0000003c"
  1090. },
  1091. {
  1092. "virtual_address": "0x0001f000",
  1093. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1094. "size": "0x00046ad4"
  1095. },
  1096. {
  1097. "virtual_address": "0x00000000",
  1098. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1099. "size": "0x00000000"
  1100. },
  1101. {
  1102. "virtual_address": "0x00000000",
  1103. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1104. "size": "0x00000000"
  1105. },
  1106. {
  1107. "virtual_address": "0x00066000",
  1108. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1109. "size": "0x000014ac"
  1110. },
  1111. {
  1112. "virtual_address": "0x00000000",
  1113. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1114. "size": "0x00000000"
  1115. },
  1116. {
  1117. "virtual_address": "0x00000000",
  1118. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1119. "size": "0x00000000"
  1120. },
  1121. {
  1122. "virtual_address": "0x00000000",
  1123. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1124. "size": "0x00000000"
  1125. },
  1126. {
  1127. "virtual_address": "0x00000000",
  1128. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1129. "size": "0x00000000"
  1130. },
  1131. {
  1132. "virtual_address": "0x00014cf0",
  1133. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1134. "size": "0x00000040"
  1135. },
  1136. {
  1137. "virtual_address": "0x00000000",
  1138. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1139. "size": "0x00000000"
  1140. },
  1141. {
  1142. "virtual_address": "0x00013000",
  1143. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1144. "size": "0x00000148"
  1145. },
  1146. {
  1147. "virtual_address": "0x00000000",
  1148. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1149. "size": "0x00000000"
  1150. },
  1151. {
  1152. "virtual_address": "0x00000000",
  1153. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1154. "size": "0x00000000"
  1155. },
  1156. {
  1157. "virtual_address": "0x00000000",
  1158. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1159. "size": "0x00000000"
  1160. }
  1161. ],
  1162. "exports": [],
  1163. "guest_signers": {},
  1164. "imphash": "3656671b39fb07039d665176129b6c1f",
  1165. "icon_fuzzy": null,
  1166. "icon": null,
  1167. "pdbpath": null,
  1168. "imported_dll_count": 2,
  1169. "versioninfo": []
  1170. }
  1171. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!