API tools faq
paste
paladin316

Exes_a7c2208f2ed98a6e7a6790af9d2f167d_exe_2019-06-25_23_30.json

paladin316
Jun 25th, 2019
2,180
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.18 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_a7c2208f2ed98a6e7a6790af9d2f167d.exe"
  7. [*] File Size: 299008
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows"
  9. [*] SHA256: "23590f8dd0fc059605ac01483c520cd5260366b5c8edb5c70e645dbfb53d21cd"
  10. [*] MD5: "a7c2208f2ed98a6e7a6790af9d2f167d"
  11. [*] SHA1: "28e936da571826c84bbb3301bc1ab622cf15ee56"
  12. [*] SHA512: "e6366c3f3b18f2b8e1bc4103fb0049f5a9fa9e7c4bec8afcdd492b936f0fca7fee23b129cb198bec4f3d01615fc2b0dd72663001f8a6eb3ecddae2f0a22d8fd5"
  13. [*] CRC32: "C6386780"
  14. [*] SSDEEP: "3072:CwYgB90CpYmxCJBgRGDcehmISHu0E65lJ7iGyEqNTLWOupDHRvxL6Wcpi8o6czU3:igB90CpYmxNmceQHnlWyOWrRvxs3"
  15.  
  16. [*] Process Execution: [
  17. "Exes_a7c2208f2ed98a6e7a6790af9d2f167d.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "The binary likely contains encrypted or compressed data.",
  27. "Details": [
  28. {
  29. "section": "name: .pdata5, entropy: 7.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0000b000, virtual_size: 0x00014752"
  30. },
  31. {
  32. "section": "name: .idata, entropy: 7.83, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00008000, virtual_size: 0x00007a30"
  33. },
  34. {
  35. "section": "name: .CRT, entropy: 7.82, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00010000, virtual_size: 0x0000f097"
  36. }
  37. ]
  38. },
  39. {
  40. "Description": "File has been identified by 17 Antiviruses on VirusTotal as malicious",
  41. "Details": [
  42. {
  43. "Bkav": "HW32.Packed."
  44. },
  45. {
  46. "FireEye": "Generic.mg.a7c2208f2ed98a6e"
  47. },
  48. {
  49. "Cybereason": "malicious.a57182"
  50. },
  51. {
  52. "Invincea": "heuristic"
  53. },
  54. {
  55. "Symantec": "Trojan.Emotet"
  56. },
  57. {
  58. "APEX": "Malicious"
  59. },
  60. {
  61. "Trapmine": "malicious.high.ml.score"
  62. },
  63. {
  64. "SentinelOne": "DFI - Malicious PE"
  65. },
  66. {
  67. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  68. },
  69. {
  70. "Endgame": "malicious (high confidence)"
  71. },
  72. {
  73. "AhnLab-V3": "Malware/Win32.RL_Generic.R277356"
  74. },
  75. {
  76. "Acronis": "suspicious"
  77. },
  78. {
  79. "Cylance": "Unsafe"
  80. },
  81. {
  82. "ESET-NOD32": "a variant of Win32/GenKryptik.DLPT"
  83. },
  84. {
  85. "eGambit": "Unsafe.AI_Score_59%"
  86. },
  87. {
  88. "CrowdStrike": "win/malicious_confidence_70% (D)"
  89. },
  90. {
  91. "Qihoo-360": "HEUR/QVM20.1.1C03.Malware.Gen"
  92. }
  93. ]
  94. }
  95. ]
  96.  
  97. [*] Started Service: []
  98.  
  99. [*] Executed Commands: []
  100.  
  101. [*] Mutexes: [
  102. "DBWinMutex"
  103. ]
  104.  
  105. [*] Modified Files: []
  106.  
  107. [*] Deleted Files: []
  108.  
  109. [*] Modified Registry Keys: []
  110.  
  111. [*] Deleted Registry Keys: []
  112.  
  113. [*] DNS Communications: []
  114.  
  115. [*] Domains: []
  116.  
  117. [*] Network Communication - ICMP: []
  118.  
  119. [*] Network Communication - HTTP: []
  120.  
  121. [*] Network Communication - SMTP: []
  122.  
  123. [*] Network Communication - Hosts: []
  124.  
  125. [*] Network Communication - IRC: []
  126.  
  127. [*] Static Analysis: {
  128. "pe": {
  129. "peid_signatures": null,
  130. "imports": [
  131. {
  132. "imports": [
  133. {
  134. "name": "GetExitCodeProcess",
  135. "address": "0xb018028"
  136. },
  137. {
  138. "name": "ReleaseMutex",
  139. "address": "0xb01802c"
  140. },
  141. {
  142. "name": "SetThreadPriorityBoost",
  143. "address": "0xb018030"
  144. },
  145. {
  146. "name": "GetSystemTimeAsFileTime",
  147. "address": "0xb018034"
  148. },
  149. {
  150. "name": "FindVolumeClose",
  151. "address": "0xb018038"
  152. },
  153. {
  154. "name": "GetLocalTime",
  155. "address": "0xb01803c"
  156. },
  157. {
  158. "name": "DebugBreak",
  159. "address": "0xb018040"
  160. }
  161. ],
  162. "dll": "KERNEL32.dll"
  163. },
  164. {
  165. "imports": [
  166. {
  167. "name": "GetNodeClusterState",
  168. "address": "0xb018008"
  169. }
  170. ],
  171. "dll": "CLUSAPI.dll"
  172. },
  173. {
  174. "imports": [
  175. {
  176. "name": "SCardLocateCardsW",
  177. "address": "0xb018088"
  178. }
  179. ],
  180. "dll": "WinSCard.dll"
  181. },
  182. {
  183. "imports": [
  184. {
  185. "name": "CryptCATEnumerateCatAttr",
  186. "address": "0xb018080"
  187. }
  188. ],
  189. "dll": "WINTRUST.dll"
  190. },
  191. {
  192. "imports": [
  193. {
  194. "name": "CertCreateCertificateChainEngine",
  195. "address": "0xb018010"
  196. }
  197. ],
  198. "dll": "CRYPT32.dll"
  199. },
  200. {
  201. "imports": [
  202. {
  203. "name": "GetScrollPos",
  204. "address": "0xb018058"
  205. },
  206. {
  207. "name": "ChildWindowFromPoint",
  208. "address": "0xb01805c"
  209. },
  210. {
  211. "name": "CopyIcon",
  212. "address": "0xb018060"
  213. },
  214. {
  215. "name": "GetCapture",
  216. "address": "0xb018064"
  217. },
  218. {
  219. "name": "GetMenu",
  220. "address": "0xb018068"
  221. },
  222. {
  223. "name": "RemoveMenu",
  224. "address": "0xb01806c"
  225. },
  226. {
  227. "name": "EnumWindowStationsW",
  228. "address": "0xb018070"
  229. },
  230. {
  231. "name": "RemovePropW",
  232. "address": "0xb018074"
  233. },
  234. {
  235. "name": "GetLastActivePopup",
  236. "address": "0xb018078"
  237. }
  238. ],
  239. "dll": "USER32.dll"
  240. },
  241. {
  242. "imports": [
  243. {
  244. "name": "SetPixel",
  245. "address": "0xb018018"
  246. }
  247. ],
  248. "dll": "GDI32.dll"
  249. },
  250. {
  251. "imports": [
  252. {
  253. "name": "ImmGetGuideLineW",
  254. "address": "0xb018020"
  255. }
  256. ],
  257. "dll": "IMM32.dll"
  258. },
  259. {
  260. "imports": [
  261. {
  262. "name": "CreateWellKnownSid",
  263. "address": "0xb018000"
  264. }
  265. ],
  266. "dll": "ADVAPI32.dll"
  267. },
  268. {
  269. "imports": [
  270. {
  271. "name": "VarI4FromR4",
  272. "address": "0xb018048"
  273. }
  274. ],
  275. "dll": "OLEAUT32.dll"
  276. },
  277. {
  278. "imports": [
  279. {
  280. "name": "PathIsPrefixA",
  281. "address": "0xb018050"
  282. }
  283. ],
  284. "dll": "SHLWAPI.dll"
  285. }
  286. ],
  287. "digital_signers": null,
  288. "exported_dll_name": null,
  289. "actual_checksum": "0x0004f9df",
  290. "overlay": null,
  291. "imagebase": "0x0b000000",
  292. "reported_checksum": "0x00000000",
  293. "icon_hash": null,
  294. "entrypoint": "0x0b001500",
  295. "timestamp": "2002-06-20 04:55:40",
  296. "osversion": "5.0",
  297. "sections": [
  298. {
  299. "name": ".text",
  300. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  301. "virtual_address": "0x00001000",
  302. "size_of_data": "0x00002000",
  303. "entropy": "6.20",
  304. "raw_address": "0x00001000",
  305. "virtual_size": "0x00001ed2",
  306. "characteristics_raw": "0x60000020"
  307. },
  308. {
  309. "name": ".pdata5",
  310. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  311. "virtual_address": "0x00003000",
  312. "size_of_data": "0x0000b000",
  313. "entropy": "7.94",
  314. "raw_address": "0x00003000",
  315. "virtual_size": "0x00014752",
  316. "characteristics_raw": "0xc0000040"
  317. },
  318. {
  319. "name": ".idata",
  320. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  321. "virtual_address": "0x00018000",
  322. "size_of_data": "0x00008000",
  323. "entropy": "7.83",
  324. "raw_address": "0x0000e000",
  325. "virtual_size": "0x00007a30",
  326. "characteristics_raw": "0x40000040"
  327. },
  328. {
  329. "name": ".CRT",
  330. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  331. "virtual_address": "0x00020000",
  332. "size_of_data": "0x00010000",
  333. "entropy": "7.82",
  334. "raw_address": "0x00016000",
  335. "virtual_size": "0x0000f097",
  336. "characteristics_raw": "0x40000041"
  337. },
  338. {
  339. "name": "CODE3",
  340. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  341. "virtual_address": "0x00030000",
  342. "size_of_data": "0x00022000",
  343. "entropy": "4.43",
  344. "raw_address": "0x00026000",
  345. "virtual_size": "0x00021208",
  346. "characteristics_raw": "0x40000040"
  347. },
  348. {
  349. "name": ".reloc",
  350. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  351. "virtual_address": "0x00052000",
  352. "size_of_data": "0x00001000",
  353. "entropy": "1.85",
  354. "raw_address": "0x00048000",
  355. "virtual_size": "0x00000340",
  356. "characteristics_raw": "0x42000040"
  357. }
  358. ],
  359. "resources": [],
  360. "dirents": [
  361. {
  362. "virtual_address": "0x00000000",
  363. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  364. "size": "0x00000000"
  365. },
  366. {
  367. "virtual_address": "0x0001f658",
  368. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  369. "size": "0x000000f0"
  370. },
  371. {
  372. "virtual_address": "0x00030000",
  373. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  374. "size": "0x00021208"
  375. },
  376. {
  377. "virtual_address": "0x00000000",
  378. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  379. "size": "0x00000000"
  380. },
  381. {
  382. "virtual_address": "0x00000000",
  383. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  384. "size": "0x00000000"
  385. },
  386. {
  387. "virtual_address": "0x00052000",
  388. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  389. "size": "0x00000340"
  390. },
  391. {
  392. "virtual_address": "0x00012000",
  393. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  394. "size": "0x00000000"
  395. },
  396. {
  397. "virtual_address": "0x00000000",
  398. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  399. "size": "0x00000000"
  400. },
  401. {
  402. "virtual_address": "0x00000000",
  403. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  404. "size": "0x00000000"
  405. },
  406. {
  407. "virtual_address": "0x00000000",
  408. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  409. "size": "0x00000000"
  410. },
  411. {
  412. "virtual_address": "0x00000000",
  413. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  414. "size": "0x00000000"
  415. },
  416. {
  417. "virtual_address": "0x00000000",
  418. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  419. "size": "0x00000000"
  420. },
  421. {
  422. "virtual_address": "0x00018000",
  423. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  424. "size": "0x00000090"
  425. },
  426. {
  427. "virtual_address": "0x00000000",
  428. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  429. "size": "0x00000000"
  430. },
  431. {
  432. "virtual_address": "0x00000000",
  433. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  434. "size": "0x00000000"
  435. },
  436. {
  437. "virtual_address": "0x00000000",
  438. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  439. "size": "0x00000000"
  440. }
  441. ],
  442. "exports": [],
  443. "guest_signers": {},
  444. "imphash": "4c6476de96b5d73f49173ecf8c7e5946",
  445. "icon_fuzzy": null,
  446. "icon": null,
  447. "pdbpath": null,
  448. "imported_dll_count": 11,
  449. "versioninfo": []
  450. }
  451. }
  452.  
  453. [*] Resolved APIs: [
  454. "kernel32.dll.GetModuleFileNameW",
  455. "kernel32.dll.VirtualAlloc",
  456. "kernel32.dll.VirtualProtect",
  457. "kernel32.dll.LoadLibraryA",
  458. "kernel32.dll.GetProcAddress",
  459. "kernel32.dll.FreeConsole",
  460. "kernel32.dll.Sleep",
  461. "kernel32.dll.OutputDebugStringW"
  462. ]
  463.  
  464. [*] Static Analysis: {
  465. "pe": {
  466. "peid_signatures": null,
  467. "imports": [
  468. {
  469. "imports": [
  470. {
  471. "name": "GetExitCodeProcess",
  472. "address": "0xb018028"
  473. },
  474. {
  475. "name": "ReleaseMutex",
  476. "address": "0xb01802c"
  477. },
  478. {
  479. "name": "SetThreadPriorityBoost",
  480. "address": "0xb018030"
  481. },
  482. {
  483. "name": "GetSystemTimeAsFileTime",
  484. "address": "0xb018034"
  485. },
  486. {
  487. "name": "FindVolumeClose",
  488. "address": "0xb018038"
  489. },
  490. {
  491. "name": "GetLocalTime",
  492. "address": "0xb01803c"
  493. },
  494. {
  495. "name": "DebugBreak",
  496. "address": "0xb018040"
  497. }
  498. ],
  499. "dll": "KERNEL32.dll"
  500. },
  501. {
  502. "imports": [
  503. {
  504. "name": "GetNodeClusterState",
  505. "address": "0xb018008"
  506. }
  507. ],
  508. "dll": "CLUSAPI.dll"
  509. },
  510. {
  511. "imports": [
  512. {
  513. "name": "SCardLocateCardsW",
  514. "address": "0xb018088"
  515. }
  516. ],
  517. "dll": "WinSCard.dll"
  518. },
  519. {
  520. "imports": [
  521. {
  522. "name": "CryptCATEnumerateCatAttr",
  523. "address": "0xb018080"
  524. }
  525. ],
  526. "dll": "WINTRUST.dll"
  527. },
  528. {
  529. "imports": [
  530. {
  531. "name": "CertCreateCertificateChainEngine",
  532. "address": "0xb018010"
  533. }
  534. ],
  535. "dll": "CRYPT32.dll"
  536. },
  537. {
  538. "imports": [
  539. {
  540. "name": "GetScrollPos",
  541. "address": "0xb018058"
  542. },
  543. {
  544. "name": "ChildWindowFromPoint",
  545. "address": "0xb01805c"
  546. },
  547. {
  548. "name": "CopyIcon",
  549. "address": "0xb018060"
  550. },
  551. {
  552. "name": "GetCapture",
  553. "address": "0xb018064"
  554. },
  555. {
  556. "name": "GetMenu",
  557. "address": "0xb018068"
  558. },
  559. {
  560. "name": "RemoveMenu",
  561. "address": "0xb01806c"
  562. },
  563. {
  564. "name": "EnumWindowStationsW",
  565. "address": "0xb018070"
  566. },
  567. {
  568. "name": "RemovePropW",
  569. "address": "0xb018074"
  570. },
  571. {
  572. "name": "GetLastActivePopup",
  573. "address": "0xb018078"
  574. }
  575. ],
  576. "dll": "USER32.dll"
  577. },
  578. {
  579. "imports": [
  580. {
  581. "name": "SetPixel",
  582. "address": "0xb018018"
  583. }
  584. ],
  585. "dll": "GDI32.dll"
  586. },
  587. {
  588. "imports": [
  589. {
  590. "name": "ImmGetGuideLineW",
  591. "address": "0xb018020"
  592. }
  593. ],
  594. "dll": "IMM32.dll"
  595. },
  596. {
  597. "imports": [
  598. {
  599. "name": "CreateWellKnownSid",
  600. "address": "0xb018000"
  601. }
  602. ],
  603. "dll": "ADVAPI32.dll"
  604. },
  605. {
  606. "imports": [
  607. {
  608. "name": "VarI4FromR4",
  609. "address": "0xb018048"
  610. }
  611. ],
  612. "dll": "OLEAUT32.dll"
  613. },
  614. {
  615. "imports": [
  616. {
  617. "name": "PathIsPrefixA",
  618. "address": "0xb018050"
  619. }
  620. ],
  621. "dll": "SHLWAPI.dll"
  622. }
  623. ],
  624. "digital_signers": null,
  625. "exported_dll_name": null,
  626. "actual_checksum": "0x0004f9df",
  627. "overlay": null,
  628. "imagebase": "0x0b000000",
  629. "reported_checksum": "0x00000000",
  630. "icon_hash": null,
  631. "entrypoint": "0x0b001500",
  632. "timestamp": "2002-06-20 04:55:40",
  633. "osversion": "5.0",
  634. "sections": [
  635. {
  636. "name": ".text",
  637. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  638. "virtual_address": "0x00001000",
  639. "size_of_data": "0x00002000",
  640. "entropy": "6.20",
  641. "raw_address": "0x00001000",
  642. "virtual_size": "0x00001ed2",
  643. "characteristics_raw": "0x60000020"
  644. },
  645. {
  646. "name": ".pdata5",
  647. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  648. "virtual_address": "0x00003000",
  649. "size_of_data": "0x0000b000",
  650. "entropy": "7.94",
  651. "raw_address": "0x00003000",
  652. "virtual_size": "0x00014752",
  653. "characteristics_raw": "0xc0000040"
  654. },
  655. {
  656. "name": ".idata",
  657. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  658. "virtual_address": "0x00018000",
  659. "size_of_data": "0x00008000",
  660. "entropy": "7.83",
  661. "raw_address": "0x0000e000",
  662. "virtual_size": "0x00007a30",
  663. "characteristics_raw": "0x40000040"
  664. },
  665. {
  666. "name": ".CRT",
  667. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  668. "virtual_address": "0x00020000",
  669. "size_of_data": "0x00010000",
  670. "entropy": "7.82",
  671. "raw_address": "0x00016000",
  672. "virtual_size": "0x0000f097",
  673. "characteristics_raw": "0x40000041"
  674. },
  675. {
  676. "name": "CODE3",
  677. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  678. "virtual_address": "0x00030000",
  679. "size_of_data": "0x00022000",
  680. "entropy": "4.43",
  681. "raw_address": "0x00026000",
  682. "virtual_size": "0x00021208",
  683. "characteristics_raw": "0x40000040"
  684. },
  685. {
  686. "name": ".reloc",
  687. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  688. "virtual_address": "0x00052000",
  689. "size_of_data": "0x00001000",
  690. "entropy": "1.85",
  691. "raw_address": "0x00048000",
  692. "virtual_size": "0x00000340",
  693. "characteristics_raw": "0x42000040"
  694. }
  695. ],
  696. "resources": [],
  697. "dirents": [
  698. {
  699. "virtual_address": "0x00000000",
  700. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  701. "size": "0x00000000"
  702. },
  703. {
  704. "virtual_address": "0x0001f658",
  705. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  706. "size": "0x000000f0"
  707. },
  708. {
  709. "virtual_address": "0x00030000",
  710. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  711. "size": "0x00021208"
  712. },
  713. {
  714. "virtual_address": "0x00000000",
  715. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  716. "size": "0x00000000"
  717. },
  718. {
  719. "virtual_address": "0x00000000",
  720. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  721. "size": "0x00000000"
  722. },
  723. {
  724. "virtual_address": "0x00052000",
  725. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  726. "size": "0x00000340"
  727. },
  728. {
  729. "virtual_address": "0x00012000",
  730. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  731. "size": "0x00000000"
  732. },
  733. {
  734. "virtual_address": "0x00000000",
  735. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  736. "size": "0x00000000"
  737. },
  738. {
  739. "virtual_address": "0x00000000",
  740. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  741. "size": "0x00000000"
  742. },
  743. {
  744. "virtual_address": "0x00000000",
  745. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  746. "size": "0x00000000"
  747. },
  748. {
  749. "virtual_address": "0x00000000",
  750. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  751. "size": "0x00000000"
  752. },
  753. {
  754. "virtual_address": "0x00000000",
  755. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  756. "size": "0x00000000"
  757. },
  758. {
  759. "virtual_address": "0x00018000",
  760. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  761. "size": "0x00000090"
  762. },
  763. {
  764. "virtual_address": "0x00000000",
  765. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  766. "size": "0x00000000"
  767. },
  768. {
  769. "virtual_address": "0x00000000",
  770. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  771. "size": "0x00000000"
  772. },
  773. {
  774. "virtual_address": "0x00000000",
  775. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  776. "size": "0x00000000"
  777. }
  778. ],
  779. "exports": [],
  780. "guest_signers": {},
  781. "imphash": "4c6476de96b5d73f49173ecf8c7e5946",
  782. "icon_fuzzy": null,
  783. "icon": null,
  784. "pdbpath": null,
  785. "imported_dll_count": 11,
  786. "versioninfo": []
  787. }
  788. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!