API tools faq
paste
paladin316

Exes_154faec2f2ac9c0fb028680e0e0ee78c_exe_2019-07-02_13_30.json

paladin316
Jul 2nd, 2019
2,130
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 36.44 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Andromeda"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_154faec2f2ac9c0fb028680e0e0ee78c.exe"
  7. [*] File Size: 62976
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "205201a73bd0253b4b3b99640cfed9452e049c026a94b11e6ae0a3e3de0e34c9"
  10. [*] MD5: "154faec2f2ac9c0fb028680e0e0ee78c"
  11. [*] SHA1: "043085240055befcb690f0f5936f60e89d4b2587"
  12. [*] SHA512: "b5393ee3b43e96dfffdfddf33ef987ebf683bf21f2ddff764025cdc82e22792d0900c001abce871f80125c23ef3b8c7442d86d9c23d39f136016582fb0204702"
  13. [*] CRC32: "EA8770A0"
  14. [*] SSDEEP: "768:7cZ6Zv77gTGVM25SWKB2MrXZ52cCeC8A0POv9KFH2sXUvuZeUFGG5r7+SBAwys:0jSKB2AZIcCTwOv9YH2sXB3GG5riEys"
  15.  
  16. [*] Process Execution: [
  17. "Exes_154faec2f2ac9c0fb028680e0e0ee78c.exe",
  18. "Exes_154faec2f2ac9c0fb028680e0e0ee78c.exe",
  19. "msiexec.exe"
  20. ]
  21.  
  22. [*] Signatures Detected: [
  23. {
  24. "Description": "Creates RWX memory",
  25. "Details": []
  26. },
  27. {
  28. "Description": "A process attempted to delay the analysis task.",
  29. "Details": [
  30. {
  31. "Process": "msiexec.exe tried to sleep 1200 seconds, actually delayed analysis time by 0 seconds"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "Reads data out of its own binary image",
  37. "Details": [
  38. {
  39. "self_read": "process: Exes_154faec2f2ac9c0fb028680e0e0ee78c.exe, pid: 2272, offset: 0x00000000, length: 0x0000f600"
  40. }
  41. ]
  42. },
  43. {
  44. "Description": "The binary likely contains encrypted or compressed data.",
  45. "Details": [
  46. {
  47. "section": "name: .text, entropy: 7.21, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0000a800, virtual_size: 0x0000a744"
  48. }
  49. ]
  50. },
  51. {
  52. "Description": "Anomalous .NET characteristics",
  53. "Details": [
  54. {
  55. "anomalous_version": "Assembly version is set to 0"
  56. }
  57. ]
  58. },
  59. {
  60. "Description": "Executed a process and injected code into it, probably while unpacking",
  61. "Details": [
  62. {
  63. "Injection": "Exes_154faec2f2ac9c0fb028680e0e0ee78c.exe(2272) -> Exes_154faec2f2ac9c0fb028680e0e0ee78c.exe(2916)"
  64. }
  65. ]
  66. },
  67. {
  68. "Description": "Exhibits behavior characteristic of Andromeda/Gamarue malware",
  69. "Details": []
  70. },
  71. {
  72. "Description": "Tries to unhook or modify Windows functions monitored by Cuckoo",
  73. "Details": [
  74. {
  75. "unhook": "function_name: GetAddrInfoW, type: modification"
  76. }
  77. ]
  78. },
  79. {
  80. "Description": "Mimics the file times of a Windows system file",
  81. "Details": [
  82. {
  83. "mimic_dest": "C:\\ProgramData\\msobuqe.exe",
  84. "mimic_source": "C:\\Windows\\SysWOW64\\msiexec.exe"
  85. }
  86. ]
  87. },
  88. {
  89. "Description": "Installs itself for autorun at Windows startup",
  90. "Details": [
  91. {
  92. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\1166353670"
  93. },
  94. {
  95. "data": "C:\\ProgramData\\msobuqe.exe"
  96. },
  97. {
  98. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load"
  99. },
  100. {
  101. "data": ""
  102. }
  103. ]
  104. },
  105. {
  106. "Description": "Creates a hidden or system file",
  107. "Details": [
  108. {
  109. "file": "C:\\ProgramData\\msobuqe.exe"
  110. }
  111. ]
  112. },
  113. {
  114. "Description": "File has been identified by 51 Antiviruses on VirusTotal as malicious",
  115. "Details": [
  116. {
  117. "MicroWorld-eScan": "Trojan.GenericKD.2214390"
  118. },
  119. {
  120. "CAT-QuickHeal": "Trojan.Msilobfuscator.WR3"
  121. },
  122. {
  123. "McAfee": "Generic.ux"
  124. },
  125. {
  126. "Cylance": "Unsafe"
  127. },
  128. {
  129. "Zillya": "Trojan.Inject.Win32.161291"
  130. },
  131. {
  132. "K7GW": "Trojan ( 004b7df31 )"
  133. },
  134. {
  135. "K7AntiVirus": "Trojan ( 004b7df31 )"
  136. },
  137. {
  138. "Arcabit": "Trojan.Generic.D21C9F6"
  139. },
  140. {
  141. "TrendMicro": "TROJ_MSIL.WJTD"
  142. },
  143. {
  144. "SymantecMobileInsight": "AppRisk:Generisk"
  145. },
  146. {
  147. "Symantec": "Backdoor.Trojan"
  148. },
  149. {
  150. "TrendMicro-HouseCall": "TROJ_MSIL.WJTD"
  151. },
  152. {
  153. "Paloalto": "generic.ml"
  154. },
  155. {
  156. "ClamAV": "Win.Trojan.Gamarue-411"
  157. },
  158. {
  159. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  160. },
  161. {
  162. "BitDefender": "Trojan.GenericKD.2214390"
  163. },
  164. {
  165. "NANO-Antivirus": "Trojan.Win32.Inject.dpcpkx"
  166. },
  167. {
  168. "Tencent": "Win32.Trojan.Inject.Auto"
  169. },
  170. {
  171. "Ad-Aware": "Trojan.GenericKD.2214390"
  172. },
  173. {
  174. "Emsisoft": "Trojan.GenericKD.2214390 (B)"
  175. },
  176. {
  177. "F-Secure": "Trojan.GenericKD.2214390"
  178. },
  179. {
  180. "DrWeb": "BackDoor.Andromeda.614"
  181. },
  182. {
  183. "VIPRE": "Win32.Malware!Drop"
  184. },
  185. {
  186. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.kh"
  187. },
  188. {
  189. "Sophos": "Troj/MSIL-CAZ"
  190. },
  191. {
  192. "Ikarus": "Trojan.MSIL.Inject"
  193. },
  194. {
  195. "Cyren": "W32/Trojan.ARUZ-6868"
  196. },
  197. {
  198. "Jiangmin": "Trojan/MSIL.fbwj"
  199. },
  200. {
  201. "Webroot": "W32.Malware.Gen"
  202. },
  203. {
  204. "Avira": "TR/Dropper.MSIL.Gen"
  205. },
  206. {
  207. "MAX": "malware (ai score=99)"
  208. },
  209. {
  210. "Antiy-AVL": "Trojan/MSIL.Inject"
  211. },
  212. {
  213. "Endgame": "malicious (high confidence)"
  214. },
  215. {
  216. "Microsoft": "Worm:Win32/Gamarue.AR"
  217. },
  218. {
  219. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  220. },
  221. {
  222. "GData": "Win32.Trojan.Netryoshka.D"
  223. },
  224. {
  225. "AhnLab-V3": "Worm/Win32.Gamarue.C784663"
  226. },
  227. {
  228. "VBA32": "Trojan.MSIL.18111A"
  229. },
  230. {
  231. "ALYac": "Trojan.MSIL.Inject"
  232. },
  233. {
  234. "Malwarebytes": "Trojan.Agent.ED"
  235. },
  236. {
  237. "Panda": "Trj/CI.A"
  238. },
  239. {
  240. "ESET-NOD32": "a variant of MSIL/Injector.IMF"
  241. },
  242. {
  243. "Rising": "Worm.Gamarue!8.13B (TFE:C:YmKiHvsVWqP)"
  244. },
  245. {
  246. "Yandex": "Trojan.Inject!QURtwJoVXwE"
  247. },
  248. {
  249. "SentinelOne": "static engine - malicious"
  250. },
  251. {
  252. "Fortinet": "MSIL/Injector.IJV!tr"
  253. },
  254. {
  255. "AVG": "MSIL:GenMalicious-DYH [Trj]"
  256. },
  257. {
  258. "Cybereason": "malicious.2f2ac9"
  259. },
  260. {
  261. "Avast": "MSIL:GenMalicious-DYH [Trj]"
  262. },
  263. {
  264. "CrowdStrike": "malicious_confidence_100% (W)"
  265. },
  266. {
  267. "Qihoo-360": "HEUR/QVM03.0.Malware.Gen"
  268. }
  269. ]
  270. },
  271. {
  272. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  273. "Details": [
  274. {
  275. "target": "clamav:Win.Trojan.Gamarue-411, sha256:205201a73bd0253b4b3b99640cfed9452e049c026a94b11e6ae0a3e3de0e34c9, type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  276. },
  277. {
  278. "dropped": "clamav:Win.Trojan.Gamarue-411, sha256:205201a73bd0253b4b3b99640cfed9452e049c026a94b11e6ae0a3e3de0e34c9 , guest_paths:C:\\ProgramData\\msobuqe.exe, type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  279. }
  280. ]
  281. },
  282. {
  283. "Description": "Creates a copy of itself",
  284. "Details": [
  285. {
  286. "copy": "C:\\ProgramData\\msobuqe.exe"
  287. }
  288. ]
  289. },
  290. {
  291. "Description": "Attempts to disable UAC",
  292. "Details": []
  293. },
  294. {
  295. "Description": "Attempts to modify Explorer settings to prevent hidden files from being displayed",
  296. "Details": []
  297. },
  298. {
  299. "Description": "Created network traffic indicative of malicious activity",
  300. "Details": [
  301. {
  302. "signature": "ET DNS Query for .su TLD (Soviet Union) Often Malware Related"
  303. }
  304. ]
  305. }
  306. ]
  307.  
  308. [*] Started Service: []
  309.  
  310. [*] Executed Commands: [
  311. "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_154faec2f2ac9c0fb028680e0e0ee78c.exe\""
  312. ]
  313.  
  314. [*] Mutexes: [
  315. "Global\\CLR_CASOFF_MUTEX"
  316. ]
  317.  
  318. [*] Modified Files: [
  319. "C:\\ProgramData\\~",
  320. "C:\\ProgramData\\msobuqe.exe"
  321. ]
  322.  
  323. [*] Deleted Files: [
  324. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2272.7423468",
  325. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2272.7423468",
  326. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2272.7423468",
  327. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_154faec2f2ac9c0fb028680e0e0ee78c.exe"
  328. ]
  329.  
  330. [*] Modified Registry Keys: [
  331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
  332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
  333. "HKEY_LOCAL_MACHINE\\software\\microsoft\\windows\\currentversion\\Policies\\Explorer\\Run",
  334. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\1166353670",
  335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
  336. "HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\windows\\Run",
  337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\windows",
  338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\windows\\Run",
  339. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA"
  340. ]
  341.  
  342. [*] Deleted Registry Keys: [
  343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\windows\\Run\\1166353670"
  344. ]
  345.  
  346. [*] DNS Communications: [
  347. {
  348. "type": "A",
  349. "request": "cosmeticvet.su",
  350. "answers": [
  351. {
  352. "data": "",
  353. "type": "NXDOMAIN"
  354. }
  355. ]
  356. },
  357. {
  358. "type": "A",
  359. "request": "casteast.su",
  360. "answers": [
  361. {
  362. "data": "",
  363. "type": "NXDOMAIN"
  364. }
  365. ]
  366. },
  367. {
  368. "type": "A",
  369. "request": "religiousblogger.su",
  370. "answers": [
  371. {
  372. "data": "",
  373. "type": "NXDOMAIN"
  374. }
  375. ]
  376. }
  377. ]
  378.  
  379. [*] Domains: [
  380. {
  381. "ip": "",
  382. "domain": "casteast.su"
  383. },
  384. {
  385. "ip": "",
  386. "domain": "religiousblogger.su"
  387. },
  388. {
  389. "ip": "",
  390. "domain": "cosmeticvet.su"
  391. }
  392. ]
  393.  
  394. [*] Network Communication - ICMP: []
  395.  
  396. [*] Network Communication - HTTP: []
  397.  
  398. [*] Network Communication - SMTP: []
  399.  
  400. [*] Network Communication - Hosts: []
  401.  
  402. [*] Network Communication - IRC: []
  403.  
  404. [*] Static Analysis: {
  405. "dotnet": {
  406. "customattrs": null,
  407. "assemblyinfo": {
  408. "version": "0.0.0.0",
  409. "name": "StuffinessVertex"
  410. },
  411. "assemblyrefs": [
  412. {
  413. "version": "2.0.0.0",
  414. "name": "mscorlib"
  415. },
  416. {
  417. "version": "2.0.0.0",
  418. "name": "System"
  419. },
  420. {
  421. "version": "2.0.0.0",
  422. "name": "System.Drawing"
  423. }
  424. ],
  425. "typerefs": [
  426. {
  427. "typename": "Microsoft.VisualBasic.VBCodeProvider",
  428. "assembly": "System"
  429. },
  430. {
  431. "typename": "System.CodeDom.CodeCommentStatementCollection",
  432. "assembly": "System"
  433. },
  434. {
  435. "typename": "System.CodeDom.CodeNamespace",
  436. "assembly": "System"
  437. },
  438. {
  439. "typename": "System.CodeDom.CodeNamespaceCollection",
  440. "assembly": "System"
  441. },
  442. {
  443. "typename": "System.CodeDom.CodeTypeParameterCollection",
  444. "assembly": "System"
  445. },
  446. {
  447. "typename": "System.CodeDom.Compiler.CodeDomProvider",
  448. "assembly": "System"
  449. },
  450. {
  451. "typename": "System.Timers.Timer",
  452. "assembly": "System"
  453. },
  454. {
  455. "typename": "System.Uri",
  456. "assembly": "System"
  457. },
  458. {
  459. "typename": "System.Drawing.Bitmap",
  460. "assembly": "System.Drawing"
  461. },
  462. {
  463. "typename": "System.Drawing.Color",
  464. "assembly": "System.Drawing"
  465. },
  466. {
  467. "typename": "System.Drawing.Design.UITypeEditor",
  468. "assembly": "System.Drawing"
  469. },
  470. {
  471. "typename": "System.Drawing.Design.UITypeEditorEditStyle",
  472. "assembly": "System.Drawing"
  473. },
  474. {
  475. "typename": "System.Drawing.Graphics",
  476. "assembly": "System.Drawing"
  477. },
  478. {
  479. "typename": "System.Drawing.Printing.PrintingPermission",
  480. "assembly": "System.Drawing"
  481. },
  482. {
  483. "typename": "System.ActivationContext",
  484. "assembly": "mscorlib"
  485. },
  486. {
  487. "typename": "System.Array",
  488. "assembly": "mscorlib"
  489. },
  490. {
  491. "typename": "System.Byte",
  492. "assembly": "mscorlib"
  493. },
  494. {
  495. "typename": "System.Char",
  496. "assembly": "mscorlib"
  497. },
  498. {
  499. "typename": "System.Collections.CollectionBase",
  500. "assembly": "mscorlib"
  501. },
  502. {
  503. "typename": "System.Object",
  504. "assembly": "mscorlib"
  505. },
  506. {
  507. "typename": "System.Reflection.Assembly",
  508. "assembly": "mscorlib"
  509. },
  510. {
  511. "typename": "System.Reflection.MethodBase",
  512. "assembly": "mscorlib"
  513. },
  514. {
  515. "typename": "System.Reflection.MethodInfo",
  516. "assembly": "mscorlib"
  517. },
  518. {
  519. "typename": "System.Resources.ResourceManager",
  520. "assembly": "mscorlib"
  521. },
  522. {
  523. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  524. "assembly": "mscorlib"
  525. },
  526. {
  527. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  528. "assembly": "mscorlib"
  529. },
  530. {
  531. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  532. "assembly": "mscorlib"
  533. },
  534. {
  535. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  536. "assembly": "mscorlib"
  537. },
  538. {
  539. "typename": "System.Runtime.Hosting.ApplicationActivator",
  540. "assembly": "mscorlib"
  541. },
  542. {
  543. "typename": "System.Runtime.Remoting.Channels.BaseChannelObjectWithProperties",
  544. "assembly": "mscorlib"
  545. },
  546. {
  547. "typename": "System.Runtime.Remoting.Channels.BaseChannelSinkWithProperties",
  548. "assembly": "mscorlib"
  549. },
  550. {
  551. "typename": "System.Runtime.Remoting.ObjectHandle",
  552. "assembly": "mscorlib"
  553. },
  554. {
  555. "typename": "System.RuntimeFieldHandle",
  556. "assembly": "mscorlib"
  557. },
  558. {
  559. "typename": "System.RuntimeTypeHandle",
  560. "assembly": "mscorlib"
  561. },
  562. {
  563. "typename": "System.String",
  564. "assembly": "mscorlib"
  565. },
  566. {
  567. "typename": "System.Type",
  568. "assembly": "mscorlib"
  569. },
  570. {
  571. "typename": "System.ValueType",
  572. "assembly": "mscorlib"
  573. }
  574. ]
  575. },
  576. "pe": {
  577. "peid_signatures": null,
  578. "imports": [
  579. {
  580. "imports": [
  581. {
  582. "name": "_CorExeMain",
  583. "address": "0x402000"
  584. }
  585. ],
  586. "dll": "mscoree.dll"
  587. }
  588. ],
  589. "digital_signers": null,
  590. "exported_dll_name": null,
  591. "actual_checksum": "0x0001bf89",
  592. "overlay": null,
  593. "imagebase": "0x00400000",
  594. "reported_checksum": "0x00000000",
  595. "icon_hash": null,
  596. "entrypoint": "0x0040c73e",
  597. "timestamp": "2008-09-11 03:43:57",
  598. "osversion": "4.0",
  599. "sections": [
  600. {
  601. "name": ".text",
  602. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  603. "virtual_address": "0x00002000",
  604. "size_of_data": "0x0000a800",
  605. "entropy": "7.21",
  606. "raw_address": "0x00000200",
  607. "virtual_size": "0x0000a744",
  608. "characteristics_raw": "0x60000020"
  609. },
  610. {
  611. "name": ".rsrc",
  612. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  613. "virtual_address": "0x0000e000",
  614. "size_of_data": "0x00004a00",
  615. "entropy": "4.54",
  616. "raw_address": "0x0000aa00",
  617. "virtual_size": "0x00004868",
  618. "characteristics_raw": "0x40000040"
  619. },
  620. {
  621. "name": ".reloc",
  622. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  623. "virtual_address": "0x00014000",
  624. "size_of_data": "0x00000200",
  625. "entropy": "0.08",
  626. "raw_address": "0x0000f400",
  627. "virtual_size": "0x0000000c",
  628. "characteristics_raw": "0x42000040"
  629. }
  630. ],
  631. "resources": [],
  632. "dirents": [
  633. {
  634. "virtual_address": "0x00000000",
  635. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  636. "size": "0x00000000"
  637. },
  638. {
  639. "virtual_address": "0x0000c6f0",
  640. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  641. "size": "0x0000004b"
  642. },
  643. {
  644. "virtual_address": "0x0000e000",
  645. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  646. "size": "0x00004868"
  647. },
  648. {
  649. "virtual_address": "0x00000000",
  650. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  651. "size": "0x00000000"
  652. },
  653. {
  654. "virtual_address": "0x00000000",
  655. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  656. "size": "0x00000000"
  657. },
  658. {
  659. "virtual_address": "0x00014000",
  660. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  661. "size": "0x0000000c"
  662. },
  663. {
  664. "virtual_address": "0x00000000",
  665. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  666. "size": "0x00000000"
  667. },
  668. {
  669. "virtual_address": "0x00000000",
  670. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  671. "size": "0x00000000"
  672. },
  673. {
  674. "virtual_address": "0x00000000",
  675. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  676. "size": "0x00000000"
  677. },
  678. {
  679. "virtual_address": "0x00000000",
  680. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  681. "size": "0x00000000"
  682. },
  683. {
  684. "virtual_address": "0x00000000",
  685. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  686. "size": "0x00000000"
  687. },
  688. {
  689. "virtual_address": "0x00000000",
  690. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  691. "size": "0x00000000"
  692. },
  693. {
  694. "virtual_address": "0x00002000",
  695. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  696. "size": "0x00000008"
  697. },
  698. {
  699. "virtual_address": "0x00000000",
  700. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  701. "size": "0x00000000"
  702. },
  703. {
  704. "virtual_address": "0x00002008",
  705. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  706. "size": "0x00000048"
  707. },
  708. {
  709. "virtual_address": "0x00000000",
  710. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  711. "size": "0x00000000"
  712. }
  713. ],
  714. "exports": [],
  715. "guest_signers": {},
  716. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  717. "icon_fuzzy": null,
  718. "icon": null,
  719. "pdbpath": null,
  720. "imported_dll_count": 1,
  721. "versioninfo": []
  722. }
  723. }
  724.  
  725. [*] Resolved APIs: [
  726. "advapi32.dll.RegOpenKeyExW",
  727. "advapi32.dll.RegQueryInfoKeyW",
  728. "advapi32.dll.RegEnumKeyExW",
  729. "advapi32.dll.RegEnumValueW",
  730. "advapi32.dll.RegCloseKey",
  731. "advapi32.dll.RegQueryValueExW",
  732. "kernel32.dll.QueryActCtxW",
  733. "shlwapi.dll.UrlIsW",
  734. "kernel32.dll.FlsAlloc",
  735. "kernel32.dll.FlsGetValue",
  736. "kernel32.dll.FlsSetValue",
  737. "kernel32.dll.FlsFree",
  738. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  739. "kernel32.dll.IsProcessorFeaturePresent",
  740. "msvcrt.dll._set_error_mode",
  741. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  742. "kernel32.dll.FindActCtxSectionStringW",
  743. "kernel32.dll.GetSystemWindowsDirectoryW",
  744. "mscoree.dll.GetProcessExecutableHeap",
  745. "mscorwks.dll._CorExeMain",
  746. "mscorwks.dll.GetCLRFunction",
  747. "advapi32.dll.RegisterTraceGuidsW",
  748. "advapi32.dll.UnregisterTraceGuids",
  749. "advapi32.dll.GetTraceLoggerHandle",
  750. "advapi32.dll.GetTraceEnableLevel",
  751. "advapi32.dll.GetTraceEnableFlags",
  752. "advapi32.dll.TraceEvent",
  753. "mscoree.dll.IEE",
  754. "mscorwks.dll.IEE",
  755. "mscoree.dll.GetStartupFlags",
  756. "mscoree.dll.GetHostConfigurationFile",
  757. "mscoree.dll.GetCORSystemDirectory",
  758. "ntdll.dll.RtlUnwind",
  759. "kernel32.dll.IsWow64Process",
  760. "advapi32.dll.AllocateAndInitializeSid",
  761. "advapi32.dll.OpenProcessToken",
  762. "advapi32.dll.GetTokenInformation",
  763. "advapi32.dll.InitializeAcl",
  764. "advapi32.dll.AddAccessAllowedAce",
  765. "advapi32.dll.FreeSid",
  766. "kernel32.dll.SetThreadStackGuarantee",
  767. "kernel32.dll.AddVectoredContinueHandler",
  768. "kernel32.dll.RemoveVectoredContinueHandler",
  769. "advapi32.dll.ConvertSidToStringSidW",
  770. "shell32.dll.SHGetFolderPathW",
  771. "kernel32.dll.FlushProcessWriteBuffers",
  772. "kernel32.dll.GetWriteWatch",
  773. "kernel32.dll.ResetWriteWatch",
  774. "kernel32.dll.CreateMemoryResourceNotification",
  775. "kernel32.dll.QueryMemoryResourceNotification",
  776. "kernel32.dll.GetVersionExW",
  777. "kernel32.dll.GetFullPathNameW",
  778. "ole32.dll.CoInitializeEx",
  779. "cryptbase.dll.SystemFunction036",
  780. "ole32.dll.CoGetContextToken",
  781. "advapi32.dll.CryptAcquireContextA",
  782. "advapi32.dll.CryptReleaseContext",
  783. "advapi32.dll.CryptCreateHash",
  784. "advapi32.dll.CryptDestroyHash",
  785. "advapi32.dll.CryptHashData",
  786. "advapi32.dll.CryptGetHashParam",
  787. "advapi32.dll.CryptImportKey",
  788. "advapi32.dll.CryptExportKey",
  789. "advapi32.dll.CryptGenKey",
  790. "advapi32.dll.CryptGetKeyParam",
  791. "advapi32.dll.CryptDestroyKey",
  792. "advapi32.dll.CryptVerifySignatureA",
  793. "advapi32.dll.CryptSignHashA",
  794. "advapi32.dll.CryptGetProvParam",
  795. "advapi32.dll.CryptGetUserKey",
  796. "advapi32.dll.CryptEnumProvidersA",
  797. "mscoree.dll.GetMetaDataInternalInterface",
  798. "mscorwks.dll.GetMetaDataInternalInterface",
  799. "mscorjit.dll.getJit",
  800. "kernel32.dll.GetUserDefaultUILanguage",
  801. "kernel32.dll.SetErrorMode",
  802. "kernel32.dll.GetFileAttributesExW",
  803. "culture.dll.ConvertLangIdToCultureName",
  804. "kernel32.dll.GetCurrentProcessId",
  805. "kernel32.dll.FindAtomW",
  806. "kernel32.dll.AddAtomW",
  807. "mscoree.dll.LoadLibraryShim",
  808. "gdiplus.dll.GdiplusStartup",
  809. "user32.dll.GetWindowInfo",
  810. "user32.dll.GetAncestor",
  811. "user32.dll.GetMonitorInfoA",
  812. "user32.dll.EnumDisplayMonitors",
  813. "user32.dll.EnumDisplayDevicesA",
  814. "gdi32.dll.ExtTextOutW",
  815. "gdi32.dll.GdiIsMetaPrintDC",
  816. "gdiplus.dll.GdipLoadImageFromStream",
  817. "windowscodecs.dll.DllGetClassObject",
  818. "kernel32.dll.WerRegisterMemoryBlock",
  819. "gdiplus.dll.GdipImageForceValidation",
  820. "gdiplus.dll.GdipGetImageType",
  821. "gdiplus.dll.GdipGetImageRawFormat",
  822. "gdiplus.dll.GdipGetImageWidth",
  823. "gdiplus.dll.GdipGetImageHeight",
  824. "gdiplus.dll.GdipBitmapGetPixel",
  825. "kernel32.dll.lstrlen",
  826. "kernel32.dll.lstrlenW",
  827. "kernel32.dll.VirtualAlloc",
  828. "kernel32.dll.CreateActCtxW",
  829. "kernel32.dll.AddRefActCtx",
  830. "kernel32.dll.ReleaseActCtx",
  831. "kernel32.dll.ActivateActCtx",
  832. "kernel32.dll.DeactivateActCtx",
  833. "kernel32.dll.GetCurrentActCtx",
  834. "uxtheme.dll.ThemeInitApiHook",
  835. "user32.dll.IsProcessDPIAware",
  836. "ws2_32.dll.GetAddrInfoW",
  837. "shlwapi.dll.StrCmpNW",
  838. "rpcrt4.dll.RpcBindingFree",
  839. "ws2_32.dll.#116"
  840. ]
  841.  
  842. [*] Static Analysis: {
  843. "dotnet": {
  844. "customattrs": null,
  845. "assemblyinfo": {
  846. "version": "0.0.0.0",
  847. "name": "StuffinessVertex"
  848. },
  849. "assemblyrefs": [
  850. {
  851. "version": "2.0.0.0",
  852. "name": "mscorlib"
  853. },
  854. {
  855. "version": "2.0.0.0",
  856. "name": "System"
  857. },
  858. {
  859. "version": "2.0.0.0",
  860. "name": "System.Drawing"
  861. }
  862. ],
  863. "typerefs": [
  864. {
  865. "typename": "Microsoft.VisualBasic.VBCodeProvider",
  866. "assembly": "System"
  867. },
  868. {
  869. "typename": "System.CodeDom.CodeCommentStatementCollection",
  870. "assembly": "System"
  871. },
  872. {
  873. "typename": "System.CodeDom.CodeNamespace",
  874. "assembly": "System"
  875. },
  876. {
  877. "typename": "System.CodeDom.CodeNamespaceCollection",
  878. "assembly": "System"
  879. },
  880. {
  881. "typename": "System.CodeDom.CodeTypeParameterCollection",
  882. "assembly": "System"
  883. },
  884. {
  885. "typename": "System.CodeDom.Compiler.CodeDomProvider",
  886. "assembly": "System"
  887. },
  888. {
  889. "typename": "System.Timers.Timer",
  890. "assembly": "System"
  891. },
  892. {
  893. "typename": "System.Uri",
  894. "assembly": "System"
  895. },
  896. {
  897. "typename": "System.Drawing.Bitmap",
  898. "assembly": "System.Drawing"
  899. },
  900. {
  901. "typename": "System.Drawing.Color",
  902. "assembly": "System.Drawing"
  903. },
  904. {
  905. "typename": "System.Drawing.Design.UITypeEditor",
  906. "assembly": "System.Drawing"
  907. },
  908. {
  909. "typename": "System.Drawing.Design.UITypeEditorEditStyle",
  910. "assembly": "System.Drawing"
  911. },
  912. {
  913. "typename": "System.Drawing.Graphics",
  914. "assembly": "System.Drawing"
  915. },
  916. {
  917. "typename": "System.Drawing.Printing.PrintingPermission",
  918. "assembly": "System.Drawing"
  919. },
  920. {
  921. "typename": "System.ActivationContext",
  922. "assembly": "mscorlib"
  923. },
  924. {
  925. "typename": "System.Array",
  926. "assembly": "mscorlib"
  927. },
  928. {
  929. "typename": "System.Byte",
  930. "assembly": "mscorlib"
  931. },
  932. {
  933. "typename": "System.Char",
  934. "assembly": "mscorlib"
  935. },
  936. {
  937. "typename": "System.Collections.CollectionBase",
  938. "assembly": "mscorlib"
  939. },
  940. {
  941. "typename": "System.Object",
  942. "assembly": "mscorlib"
  943. },
  944. {
  945. "typename": "System.Reflection.Assembly",
  946. "assembly": "mscorlib"
  947. },
  948. {
  949. "typename": "System.Reflection.MethodBase",
  950. "assembly": "mscorlib"
  951. },
  952. {
  953. "typename": "System.Reflection.MethodInfo",
  954. "assembly": "mscorlib"
  955. },
  956. {
  957. "typename": "System.Resources.ResourceManager",
  958. "assembly": "mscorlib"
  959. },
  960. {
  961. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  962. "assembly": "mscorlib"
  963. },
  964. {
  965. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  966. "assembly": "mscorlib"
  967. },
  968. {
  969. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  970. "assembly": "mscorlib"
  971. },
  972. {
  973. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  974. "assembly": "mscorlib"
  975. },
  976. {
  977. "typename": "System.Runtime.Hosting.ApplicationActivator",
  978. "assembly": "mscorlib"
  979. },
  980. {
  981. "typename": "System.Runtime.Remoting.Channels.BaseChannelObjectWithProperties",
  982. "assembly": "mscorlib"
  983. },
  984. {
  985. "typename": "System.Runtime.Remoting.Channels.BaseChannelSinkWithProperties",
  986. "assembly": "mscorlib"
  987. },
  988. {
  989. "typename": "System.Runtime.Remoting.ObjectHandle",
  990. "assembly": "mscorlib"
  991. },
  992. {
  993. "typename": "System.RuntimeFieldHandle",
  994. "assembly": "mscorlib"
  995. },
  996. {
  997. "typename": "System.RuntimeTypeHandle",
  998. "assembly": "mscorlib"
  999. },
  1000. {
  1001. "typename": "System.String",
  1002. "assembly": "mscorlib"
  1003. },
  1004. {
  1005. "typename": "System.Type",
  1006. "assembly": "mscorlib"
  1007. },
  1008. {
  1009. "typename": "System.ValueType",
  1010. "assembly": "mscorlib"
  1011. }
  1012. ]
  1013. },
  1014. "pe": {
  1015. "peid_signatures": null,
  1016. "imports": [
  1017. {
  1018. "imports": [
  1019. {
  1020. "name": "_CorExeMain",
  1021. "address": "0x402000"
  1022. }
  1023. ],
  1024. "dll": "mscoree.dll"
  1025. }
  1026. ],
  1027. "digital_signers": null,
  1028. "exported_dll_name": null,
  1029. "actual_checksum": "0x0001bf89",
  1030. "overlay": null,
  1031. "imagebase": "0x00400000",
  1032. "reported_checksum": "0x00000000",
  1033. "icon_hash": null,
  1034. "entrypoint": "0x0040c73e",
  1035. "timestamp": "2008-09-11 03:43:57",
  1036. "osversion": "4.0",
  1037. "sections": [
  1038. {
  1039. "name": ".text",
  1040. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1041. "virtual_address": "0x00002000",
  1042. "size_of_data": "0x0000a800",
  1043. "entropy": "7.21",
  1044. "raw_address": "0x00000200",
  1045. "virtual_size": "0x0000a744",
  1046. "characteristics_raw": "0x60000020"
  1047. },
  1048. {
  1049. "name": ".rsrc",
  1050. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1051. "virtual_address": "0x0000e000",
  1052. "size_of_data": "0x00004a00",
  1053. "entropy": "4.54",
  1054. "raw_address": "0x0000aa00",
  1055. "virtual_size": "0x00004868",
  1056. "characteristics_raw": "0x40000040"
  1057. },
  1058. {
  1059. "name": ".reloc",
  1060. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1061. "virtual_address": "0x00014000",
  1062. "size_of_data": "0x00000200",
  1063. "entropy": "0.08",
  1064. "raw_address": "0x0000f400",
  1065. "virtual_size": "0x0000000c",
  1066. "characteristics_raw": "0x42000040"
  1067. }
  1068. ],
  1069. "resources": [],
  1070. "dirents": [
  1071. {
  1072. "virtual_address": "0x00000000",
  1073. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1074. "size": "0x00000000"
  1075. },
  1076. {
  1077. "virtual_address": "0x0000c6f0",
  1078. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1079. "size": "0x0000004b"
  1080. },
  1081. {
  1082. "virtual_address": "0x0000e000",
  1083. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1084. "size": "0x00004868"
  1085. },
  1086. {
  1087. "virtual_address": "0x00000000",
  1088. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1089. "size": "0x00000000"
  1090. },
  1091. {
  1092. "virtual_address": "0x00000000",
  1093. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1094. "size": "0x00000000"
  1095. },
  1096. {
  1097. "virtual_address": "0x00014000",
  1098. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1099. "size": "0x0000000c"
  1100. },
  1101. {
  1102. "virtual_address": "0x00000000",
  1103. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1104. "size": "0x00000000"
  1105. },
  1106. {
  1107. "virtual_address": "0x00000000",
  1108. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1109. "size": "0x00000000"
  1110. },
  1111. {
  1112. "virtual_address": "0x00000000",
  1113. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1114. "size": "0x00000000"
  1115. },
  1116. {
  1117. "virtual_address": "0x00000000",
  1118. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1119. "size": "0x00000000"
  1120. },
  1121. {
  1122. "virtual_address": "0x00000000",
  1123. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1124. "size": "0x00000000"
  1125. },
  1126. {
  1127. "virtual_address": "0x00000000",
  1128. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1129. "size": "0x00000000"
  1130. },
  1131. {
  1132. "virtual_address": "0x00002000",
  1133. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1134. "size": "0x00000008"
  1135. },
  1136. {
  1137. "virtual_address": "0x00000000",
  1138. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1139. "size": "0x00000000"
  1140. },
  1141. {
  1142. "virtual_address": "0x00002008",
  1143. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1144. "size": "0x00000048"
  1145. },
  1146. {
  1147. "virtual_address": "0x00000000",
  1148. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1149. "size": "0x00000000"
  1150. }
  1151. ],
  1152. "exports": [],
  1153. "guest_signers": {},
  1154. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1155. "icon_fuzzy": null,
  1156. "icon": null,
  1157. "pdbpath": null,
  1158. "imported_dll_count": 1,
  1159. "versioninfo": []
  1160. }
  1161. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!