API tools faq
paste
paladin316

A89A_tmp_exe_2019-06-24_03_59.json

paladin316
Jun 23rd, 2019
2,164
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 44.10 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "A89A.tmp.exe"
  7. [*] File Size: 180224
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "f83374cd9f429c3f58b10b4333b4ceee28ba865895fbb338b449752b7407d452"
  10. [*] MD5: "b4cbe9ca40dc13c0869bf34daf8dfdbc"
  11. [*] SHA1: "a1fee72dcb459ea9fbf1ecbde22b420c6e77f0b9"
  12. [*] SHA512: "de69b74b5d79a9f6f5c8dadf04fc6c49ed4e41616216734056133388d2a93efd3f63229104cbc35e490ebb2f9c19278be3c8d3b90cd03d5712263d19ffbd7a54"
  13. [*] CRC32: "28153301"
  14. [*] SSDEEP: "3072:how6sONYFs9YZOmSoklW52Ho3IGzqf6BCz2QwJ6cX06jEHhkuA+Gmp:6whoFieW5j3Iwohwf0fUQ"
  15.  
  16. [*] Process Execution: [
  17. "A89A.tmp.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  27. "Details": []
  28. },
  29. {
  30. "Description": "Reads data out of its own binary image",
  31. "Details": [
  32. {
  33. "self_read": "process: A89A.tmp.exe, pid: 3028, offset: 0x00000000, length: 0x0002c000"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "A process created a hidden window",
  39. "Details": [
  40. {
  41. "Process": "A89A.tmp.exe -> C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
  42. }
  43. ]
  44. },
  45. {
  46. "Description": "Installs itself for autorun at Windows startup",
  47. "Details": [
  48. {
  49. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\kerneldriver.eu.url"
  50. },
  51. {
  52. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\kerneldriver.eu.url"
  53. }
  54. ]
  55. },
  56. {
  57. "Description": "Likely virus infection of existing system binary",
  58. "Details": [
  59. {
  60. "file": "c:\\users\\user\\appdata\\local\\temp\\a89a.tmp.exe"
  61. }
  62. ]
  63. },
  64. {
  65. "Description": "File has been identified by 26 Antiviruses on VirusTotal as malicious",
  66. "Details": [
  67. {
  68. "Cylance": "Unsafe"
  69. },
  70. {
  71. "K7AntiVirus": "Trojan ( 004f58c41 )"
  72. },
  73. {
  74. "K7GW": "Trojan ( 004f58c41 )"
  75. },
  76. {
  77. "Symantec": "ML.Attribute.HighConfidence"
  78. },
  79. {
  80. "APEX": "Malicious"
  81. },
  82. {
  83. "Paloalto": "generic.ml"
  84. },
  85. {
  86. "Kaspersky": "Trojan-Spy.Win32.Zbot.zpim"
  87. },
  88. {
  89. "Rising": "Malware.Heuristic.MLite(91%) (AI-LITE:qJF6DHRD+MGBL0s0c3Z7bA)"
  90. },
  91. {
  92. "Endgame": "malicious (high confidence)"
  93. },
  94. {
  95. "F-Secure": "Trojan.TR/AD.ShellcodeCrypter.kxxng"
  96. },
  97. {
  98. "DrWeb": "Trojan.Inject3.17464"
  99. },
  100. {
  101. "Trapmine": "malicious.moderate.ml.score"
  102. },
  103. {
  104. "FireEye": "Generic.mg.b4cbe9ca40dc13c0"
  105. },
  106. {
  107. "Jiangmin": "TrojanSpy.Zbot.foiv"
  108. },
  109. {
  110. "Avira": "TR/AD.ShellcodeCrypter.kxxng"
  111. },
  112. {
  113. "Microsoft": "Trojan:Win32/Zpevdo.B"
  114. },
  115. {
  116. "ZoneAlarm": "Trojan-Spy.Win32.Zbot.zpim"
  117. },
  118. {
  119. "Acronis": "suspicious"
  120. },
  121. {
  122. "ESET-NOD32": "a variant of Generik.JHJAPCU"
  123. },
  124. {
  125. "TrendMicro-HouseCall": "TROJ_GEN.R002H0DFM19"
  126. },
  127. {
  128. "Tencent": "Win32.Trojan-spy.Zbot.Pgmt"
  129. },
  130. {
  131. "SentinelOne": "DFI - Suspicious PE"
  132. },
  133. {
  134. "Fortinet": "W32/Zbot.JHJAPCU!tr"
  135. },
  136. {
  137. "AVG": "Win32:Trojan-gen"
  138. },
  139. {
  140. "Avast": "Win32:Trojan-gen"
  141. },
  142. {
  143. "CrowdStrike": "win/malicious_confidence_90% (W)"
  144. }
  145. ]
  146. },
  147. {
  148. "Description": "Creates a slightly modified copy of itself",
  149. "Details": [
  150. {
  151. "file": "C:\\Users\\user\\AppData\\Roaming\\kernelwindows\\kerneldriver.exe"
  152. },
  153. {
  154. "percent_match": 100
  155. }
  156. ]
  157. }
  158. ]
  159.  
  160. [*] Started Service: []
  161.  
  162. [*] Executed Commands: [
  163. "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe \"C:\\Users\\user\\AppData\\Local\\Temp\\A89A.tmp.exe\""
  164. ]
  165.  
  166. [*] Mutexes: [
  167. "DBWinMutex"
  168. ]
  169.  
  170. [*] Modified Files: [
  171. "C:\\Users\\user\\AppData\\Roaming\\kernelwindows\\kerneldriver.exe",
  172. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\kerneldriver.eu.url"
  173. ]
  174.  
  175. [*] Deleted Files: []
  176.  
  177. [*] Modified Registry Keys: []
  178.  
  179. [*] Deleted Registry Keys: []
  180.  
  181. [*] DNS Communications: []
  182.  
  183. [*] Domains: []
  184.  
  185. [*] Network Communication - ICMP: []
  186.  
  187. [*] Network Communication - HTTP: []
  188.  
  189. [*] Network Communication - SMTP: []
  190.  
  191. [*] Network Communication - Hosts: []
  192.  
  193. [*] Network Communication - IRC: []
  194.  
  195. [*] Static Analysis: {
  196. "pe": {
  197. "peid_signatures": null,
  198. "imports": [
  199. {
  200. "imports": [
  201. {
  202. "name": "CloseHandle",
  203. "address": "0x40b02c"
  204. },
  205. {
  206. "name": "CompareStringA",
  207. "address": "0x40b030"
  208. },
  209. {
  210. "name": "Module32FirstW",
  211. "address": "0x40b034"
  212. },
  213. {
  214. "name": "CompareStringW",
  215. "address": "0x40b038"
  216. },
  217. {
  218. "name": "Thread32First",
  219. "address": "0x40b03c"
  220. },
  221. {
  222. "name": "VirtualProtect",
  223. "address": "0x40b040"
  224. },
  225. {
  226. "name": "FlushFileBuffers",
  227. "address": "0x40b044"
  228. },
  229. {
  230. "name": "GetFileInformationByHandle",
  231. "address": "0x40b048"
  232. },
  233. {
  234. "name": "GetEnvironmentStrings",
  235. "address": "0x40b04c"
  236. },
  237. {
  238. "name": "GetConsoleKeyboardLayoutNameW",
  239. "address": "0x40b050"
  240. },
  241. {
  242. "name": "GetDiskFreeSpaceW",
  243. "address": "0x40b054"
  244. },
  245. {
  246. "name": "lstrcpynA",
  247. "address": "0x40b058"
  248. },
  249. {
  250. "name": "GetTimeZoneInformation",
  251. "address": "0x40b05c"
  252. },
  253. {
  254. "name": "LoadLibraryA",
  255. "address": "0x40b060"
  256. },
  257. {
  258. "name": "SetStdHandle",
  259. "address": "0x40b064"
  260. },
  261. {
  262. "name": "IsBadCodePtr",
  263. "address": "0x40b068"
  264. },
  265. {
  266. "name": "HeapAlloc",
  267. "address": "0x40b06c"
  268. },
  269. {
  270. "name": "HeapFree",
  271. "address": "0x40b070"
  272. },
  273. {
  274. "name": "VirtualFree",
  275. "address": "0x40b074"
  276. },
  277. {
  278. "name": "VirtualAlloc",
  279. "address": "0x40b078"
  280. },
  281. {
  282. "name": "HeapReAlloc",
  283. "address": "0x40b07c"
  284. },
  285. {
  286. "name": "GetLastError",
  287. "address": "0x40b080"
  288. },
  289. {
  290. "name": "FindNextFileW",
  291. "address": "0x40b084"
  292. },
  293. {
  294. "name": "GetFileAttributesW",
  295. "address": "0x40b088"
  296. },
  297. {
  298. "name": "GetCPInfo",
  299. "address": "0x40b08c"
  300. },
  301. {
  302. "name": "GetACP",
  303. "address": "0x40b090"
  304. },
  305. {
  306. "name": "GetOEMCP",
  307. "address": "0x40b094"
  308. },
  309. {
  310. "name": "DeleteFileW",
  311. "address": "0x40b098"
  312. },
  313. {
  314. "name": "RaiseException",
  315. "address": "0x40b09c"
  316. },
  317. {
  318. "name": "GetModuleHandleA",
  319. "address": "0x40b0a0"
  320. },
  321. {
  322. "name": "GetStartupInfoW",
  323. "address": "0x40b0a4"
  324. },
  325. {
  326. "name": "GetVersion",
  327. "address": "0x40b0a8"
  328. },
  329. {
  330. "name": "ExitProcess",
  331. "address": "0x40b0ac"
  332. },
  333. {
  334. "name": "HeapDestroy",
  335. "address": "0x40b0b0"
  336. },
  337. {
  338. "name": "HeapCreate",
  339. "address": "0x40b0b4"
  340. },
  341. {
  342. "name": "FileTimeToSystemTime",
  343. "address": "0x40b0b8"
  344. },
  345. {
  346. "name": "FileTimeToLocalFileTime",
  347. "address": "0x40b0bc"
  348. },
  349. {
  350. "name": "EnterCriticalSection",
  351. "address": "0x40b0c0"
  352. },
  353. {
  354. "name": "LeaveCriticalSection",
  355. "address": "0x40b0c4"
  356. },
  357. {
  358. "name": "InitializeCriticalSection",
  359. "address": "0x40b0c8"
  360. },
  361. {
  362. "name": "DeleteCriticalSection",
  363. "address": "0x40b0cc"
  364. },
  365. {
  366. "name": "WideCharToMultiByte",
  367. "address": "0x40b0d0"
  368. },
  369. {
  370. "name": "MultiByteToWideChar",
  371. "address": "0x40b0d4"
  372. },
  373. {
  374. "name": "LCMapStringA",
  375. "address": "0x40b0d8"
  376. },
  377. {
  378. "name": "LCMapStringW",
  379. "address": "0x40b0dc"
  380. },
  381. {
  382. "name": "GetStringTypeA",
  383. "address": "0x40b0e0"
  384. },
  385. {
  386. "name": "GetStringTypeW",
  387. "address": "0x40b0e4"
  388. },
  389. {
  390. "name": "TerminateProcess",
  391. "address": "0x40b0e8"
  392. },
  393. {
  394. "name": "GetCurrentProcess",
  395. "address": "0x40b0ec"
  396. },
  397. {
  398. "name": "GetCurrentThreadId",
  399. "address": "0x40b0f0"
  400. },
  401. {
  402. "name": "TlsSetValue",
  403. "address": "0x40b0f4"
  404. },
  405. {
  406. "name": "TlsAlloc",
  407. "address": "0x40b0f8"
  408. },
  409. {
  410. "name": "SetLastError",
  411. "address": "0x40b0fc"
  412. },
  413. {
  414. "name": "TlsGetValue",
  415. "address": "0x40b100"
  416. },
  417. {
  418. "name": "GetCurrentProcessId",
  419. "address": "0x40b104"
  420. },
  421. {
  422. "name": "SetUnhandledExceptionFilter",
  423. "address": "0x40b108"
  424. },
  425. {
  426. "name": "SetFilePointer",
  427. "address": "0x40b10c"
  428. },
  429. {
  430. "name": "SetHandleCount",
  431. "address": "0x40b110"
  432. },
  433. {
  434. "name": "GetStdHandle",
  435. "address": "0x40b114"
  436. },
  437. {
  438. "name": "GetFileType",
  439. "address": "0x40b118"
  440. },
  441. {
  442. "name": "GetStartupInfoA",
  443. "address": "0x40b11c"
  444. },
  445. {
  446. "name": "WriteFile",
  447. "address": "0x40b120"
  448. },
  449. {
  450. "name": "UnhandledExceptionFilter",
  451. "address": "0x40b124"
  452. },
  453. {
  454. "name": "GetModuleFileNameW",
  455. "address": "0x40b128"
  456. },
  457. {
  458. "name": "FreeEnvironmentStringsA",
  459. "address": "0x40b12c"
  460. },
  461. {
  462. "name": "FreeEnvironmentStringsW",
  463. "address": "0x40b130"
  464. },
  465. {
  466. "name": "GetEnvironmentStringsW",
  467. "address": "0x40b134"
  468. },
  469. {
  470. "name": "GetCommandLineW",
  471. "address": "0x40b138"
  472. },
  473. {
  474. "name": "GetCommandLineA",
  475. "address": "0x40b13c"
  476. },
  477. {
  478. "name": "RtlUnwind",
  479. "address": "0x40b140"
  480. },
  481. {
  482. "name": "GetModuleFileNameA",
  483. "address": "0x40b144"
  484. },
  485. {
  486. "name": "InterlockedDecrement",
  487. "address": "0x40b148"
  488. },
  489. {
  490. "name": "InterlockedIncrement",
  491. "address": "0x40b14c"
  492. },
  493. {
  494. "name": "GetProcAddress",
  495. "address": "0x40b150"
  496. },
  497. {
  498. "name": "SetEnvironmentVariableA",
  499. "address": "0x40b154"
  500. }
  501. ],
  502. "dll": "KERNEL32.dll"
  503. },
  504. {
  505. "imports": [
  506. {
  507. "name": "WindowFromDC",
  508. "address": "0x40b164"
  509. },
  510. {
  511. "name": "PeekMessageW",
  512. "address": "0x40b168"
  513. },
  514. {
  515. "name": "GetSysColor",
  516. "address": "0x40b16c"
  517. },
  518. {
  519. "name": "CreateIconIndirect",
  520. "address": "0x40b170"
  521. },
  522. {
  523. "name": "WINNLSGetEnableStatus",
  524. "address": "0x40b174"
  525. },
  526. {
  527. "name": "GetMessageExtraInfo",
  528. "address": "0x40b178"
  529. },
  530. {
  531. "name": "OemToCharBuffW",
  532. "address": "0x40b17c"
  533. }
  534. ],
  535. "dll": "USER32.dll"
  536. },
  537. {
  538. "imports": [
  539. {
  540. "name": "gdiPlaySpoolStream",
  541. "address": "0x40b018"
  542. },
  543. {
  544. "name": "CreateDCA",
  545. "address": "0x40b01c"
  546. },
  547. {
  548. "name": "GetObjectW",
  549. "address": "0x40b020"
  550. },
  551. {
  552. "name": "AbortPath",
  553. "address": "0x40b024"
  554. }
  555. ],
  556. "dll": "GDI32.dll"
  557. },
  558. {
  559. "imports": [
  560. {
  561. "name": "AddMonitorW",
  562. "address": "0x40b184"
  563. },
  564. {
  565. "name": "OpenPrinterW",
  566. "address": "0x40b188"
  567. },
  568. {
  569. "name": "DeletePrinterDriverA",
  570. "address": "0x40b18c"
  571. }
  572. ],
  573. "dll": "WINSPOOL.DRV"
  574. },
  575. {
  576. "imports": [
  577. {
  578. "name": "RegSaveKeyW",
  579. "address": "0x40b000"
  580. },
  581. {
  582. "name": "CryptDuplicateHash",
  583. "address": "0x40b004"
  584. },
  585. {
  586. "name": "GetServiceKeyNameW",
  587. "address": "0x40b008"
  588. },
  589. {
  590. "name": "SetEntriesInAccessListA",
  591. "address": "0x40b00c"
  592. },
  593. {
  594. "name": "SetFileSecurityA",
  595. "address": "0x40b010"
  596. }
  597. ],
  598. "dll": "ADVAPI32.dll"
  599. },
  600. {
  601. "imports": [
  602. {
  603. "name": "SheGetDirA",
  604. "address": "0x40b15c"
  605. }
  606. ],
  607. "dll": "SHELL32.dll"
  608. },
  609. {
  610. "imports": [
  611. {
  612. "name": "ReadOleStg",
  613. "address": "0x40b194"
  614. },
  615. {
  616. "name": "CoTaskMemAlloc",
  617. "address": "0x40b198"
  618. }
  619. ],
  620. "dll": "ole32.dll"
  621. }
  622. ],
  623. "digital_signers": null,
  624. "exported_dll_name": null,
  625. "actual_checksum": "0x0002ff0a",
  626. "overlay": null,
  627. "imagebase": "0x00400000",
  628. "reported_checksum": "0x00000000",
  629. "icon_hash": null,
  630. "entrypoint": "0x004038c4",
  631. "timestamp": "2019-06-18 03:17:34",
  632. "osversion": "4.0",
  633. "sections": [
  634. {
  635. "name": ".text",
  636. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  637. "virtual_address": "0x00001000",
  638. "size_of_data": "0x0000a000",
  639. "entropy": "6.64",
  640. "raw_address": "0x00001000",
  641. "virtual_size": "0x00009c28",
  642. "characteristics_raw": "0x60000020"
  643. },
  644. {
  645. "name": ".rdata",
  646. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  647. "virtual_address": "0x0000b000",
  648. "size_of_data": "0x00002000",
  649. "entropy": "3.54",
  650. "raw_address": "0x0000b000",
  651. "virtual_size": "0x000011d0",
  652. "characteristics_raw": "0x40000040"
  653. },
  654. {
  655. "name": ".data",
  656. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  657. "virtual_address": "0x0000d000",
  658. "size_of_data": "0x00009000",
  659. "entropy": "6.43",
  660. "raw_address": "0x0000d000",
  661. "virtual_size": "0x00009c00",
  662. "characteristics_raw": "0xc0000040"
  663. },
  664. {
  665. "name": ".rsrc",
  666. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  667. "virtual_address": "0x00017000",
  668. "size_of_data": "0x00016000",
  669. "entropy": "6.49",
  670. "raw_address": "0x00016000",
  671. "virtual_size": "0x00015b60",
  672. "characteristics_raw": "0x40000040"
  673. }
  674. ],
  675. "resources": [],
  676. "dirents": [
  677. {
  678. "virtual_address": "0x00000000",
  679. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  680. "size": "0x00000000"
  681. },
  682. {
  683. "virtual_address": "0x0000b828",
  684. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  685. "size": "0x000000a0"
  686. },
  687. {
  688. "virtual_address": "0x00017000",
  689. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  690. "size": "0x00015b60"
  691. },
  692. {
  693. "virtual_address": "0x00000000",
  694. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  695. "size": "0x00000000"
  696. },
  697. {
  698. "virtual_address": "0x00000000",
  699. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  700. "size": "0x00000000"
  701. },
  702. {
  703. "virtual_address": "0x00000000",
  704. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  705. "size": "0x00000000"
  706. },
  707. {
  708. "virtual_address": "0x00000000",
  709. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  710. "size": "0x00000000"
  711. },
  712. {
  713. "virtual_address": "0x00000000",
  714. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  715. "size": "0x00000000"
  716. },
  717. {
  718. "virtual_address": "0x00000000",
  719. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  720. "size": "0x00000000"
  721. },
  722. {
  723. "virtual_address": "0x00000000",
  724. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  725. "size": "0x00000000"
  726. },
  727. {
  728. "virtual_address": "0x00000000",
  729. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  730. "size": "0x00000000"
  731. },
  732. {
  733. "virtual_address": "0x00000000",
  734. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  735. "size": "0x00000000"
  736. },
  737. {
  738. "virtual_address": "0x0000b000",
  739. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  740. "size": "0x000001a0"
  741. },
  742. {
  743. "virtual_address": "0x00000000",
  744. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  745. "size": "0x00000000"
  746. },
  747. {
  748. "virtual_address": "0x00000000",
  749. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  750. "size": "0x00000000"
  751. },
  752. {
  753. "virtual_address": "0x00000000",
  754. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  755. "size": "0x00000000"
  756. }
  757. ],
  758. "exports": [],
  759. "guest_signers": {},
  760. "imphash": "7651bb6154beb262fc689e8016fc2b1b",
  761. "icon_fuzzy": null,
  762. "icon": null,
  763. "pdbpath": null,
  764. "imported_dll_count": 7,
  765. "versioninfo": []
  766. }
  767. }
  768.  
  769. [*] Resolved APIs: [
  770. "kernel32.dll.IsProcessorFeaturePresent"
  771. ]
  772.  
  773. [*] Static Analysis: {
  774. "pe": {
  775. "peid_signatures": null,
  776. "imports": [
  777. {
  778. "imports": [
  779. {
  780. "name": "CloseHandle",
  781. "address": "0x40b02c"
  782. },
  783. {
  784. "name": "CompareStringA",
  785. "address": "0x40b030"
  786. },
  787. {
  788. "name": "Module32FirstW",
  789. "address": "0x40b034"
  790. },
  791. {
  792. "name": "CompareStringW",
  793. "address": "0x40b038"
  794. },
  795. {
  796. "name": "Thread32First",
  797. "address": "0x40b03c"
  798. },
  799. {
  800. "name": "VirtualProtect",
  801. "address": "0x40b040"
  802. },
  803. {
  804. "name": "FlushFileBuffers",
  805. "address": "0x40b044"
  806. },
  807. {
  808. "name": "GetFileInformationByHandle",
  809. "address": "0x40b048"
  810. },
  811. {
  812. "name": "GetEnvironmentStrings",
  813. "address": "0x40b04c"
  814. },
  815. {
  816. "name": "GetConsoleKeyboardLayoutNameW",
  817. "address": "0x40b050"
  818. },
  819. {
  820. "name": "GetDiskFreeSpaceW",
  821. "address": "0x40b054"
  822. },
  823. {
  824. "name": "lstrcpynA",
  825. "address": "0x40b058"
  826. },
  827. {
  828. "name": "GetTimeZoneInformation",
  829. "address": "0x40b05c"
  830. },
  831. {
  832. "name": "LoadLibraryA",
  833. "address": "0x40b060"
  834. },
  835. {
  836. "name": "SetStdHandle",
  837. "address": "0x40b064"
  838. },
  839. {
  840. "name": "IsBadCodePtr",
  841. "address": "0x40b068"
  842. },
  843. {
  844. "name": "HeapAlloc",
  845. "address": "0x40b06c"
  846. },
  847. {
  848. "name": "HeapFree",
  849. "address": "0x40b070"
  850. },
  851. {
  852. "name": "VirtualFree",
  853. "address": "0x40b074"
  854. },
  855. {
  856. "name": "VirtualAlloc",
  857. "address": "0x40b078"
  858. },
  859. {
  860. "name": "HeapReAlloc",
  861. "address": "0x40b07c"
  862. },
  863. {
  864. "name": "GetLastError",
  865. "address": "0x40b080"
  866. },
  867. {
  868. "name": "FindNextFileW",
  869. "address": "0x40b084"
  870. },
  871. {
  872. "name": "GetFileAttributesW",
  873. "address": "0x40b088"
  874. },
  875. {
  876. "name": "GetCPInfo",
  877. "address": "0x40b08c"
  878. },
  879. {
  880. "name": "GetACP",
  881. "address": "0x40b090"
  882. },
  883. {
  884. "name": "GetOEMCP",
  885. "address": "0x40b094"
  886. },
  887. {
  888. "name": "DeleteFileW",
  889. "address": "0x40b098"
  890. },
  891. {
  892. "name": "RaiseException",
  893. "address": "0x40b09c"
  894. },
  895. {
  896. "name": "GetModuleHandleA",
  897. "address": "0x40b0a0"
  898. },
  899. {
  900. "name": "GetStartupInfoW",
  901. "address": "0x40b0a4"
  902. },
  903. {
  904. "name": "GetVersion",
  905. "address": "0x40b0a8"
  906. },
  907. {
  908. "name": "ExitProcess",
  909. "address": "0x40b0ac"
  910. },
  911. {
  912. "name": "HeapDestroy",
  913. "address": "0x40b0b0"
  914. },
  915. {
  916. "name": "HeapCreate",
  917. "address": "0x40b0b4"
  918. },
  919. {
  920. "name": "FileTimeToSystemTime",
  921. "address": "0x40b0b8"
  922. },
  923. {
  924. "name": "FileTimeToLocalFileTime",
  925. "address": "0x40b0bc"
  926. },
  927. {
  928. "name": "EnterCriticalSection",
  929. "address": "0x40b0c0"
  930. },
  931. {
  932. "name": "LeaveCriticalSection",
  933. "address": "0x40b0c4"
  934. },
  935. {
  936. "name": "InitializeCriticalSection",
  937. "address": "0x40b0c8"
  938. },
  939. {
  940. "name": "DeleteCriticalSection",
  941. "address": "0x40b0cc"
  942. },
  943. {
  944. "name": "WideCharToMultiByte",
  945. "address": "0x40b0d0"
  946. },
  947. {
  948. "name": "MultiByteToWideChar",
  949. "address": "0x40b0d4"
  950. },
  951. {
  952. "name": "LCMapStringA",
  953. "address": "0x40b0d8"
  954. },
  955. {
  956. "name": "LCMapStringW",
  957. "address": "0x40b0dc"
  958. },
  959. {
  960. "name": "GetStringTypeA",
  961. "address": "0x40b0e0"
  962. },
  963. {
  964. "name": "GetStringTypeW",
  965. "address": "0x40b0e4"
  966. },
  967. {
  968. "name": "TerminateProcess",
  969. "address": "0x40b0e8"
  970. },
  971. {
  972. "name": "GetCurrentProcess",
  973. "address": "0x40b0ec"
  974. },
  975. {
  976. "name": "GetCurrentThreadId",
  977. "address": "0x40b0f0"
  978. },
  979. {
  980. "name": "TlsSetValue",
  981. "address": "0x40b0f4"
  982. },
  983. {
  984. "name": "TlsAlloc",
  985. "address": "0x40b0f8"
  986. },
  987. {
  988. "name": "SetLastError",
  989. "address": "0x40b0fc"
  990. },
  991. {
  992. "name": "TlsGetValue",
  993. "address": "0x40b100"
  994. },
  995. {
  996. "name": "GetCurrentProcessId",
  997. "address": "0x40b104"
  998. },
  999. {
  1000. "name": "SetUnhandledExceptionFilter",
  1001. "address": "0x40b108"
  1002. },
  1003. {
  1004. "name": "SetFilePointer",
  1005. "address": "0x40b10c"
  1006. },
  1007. {
  1008. "name": "SetHandleCount",
  1009. "address": "0x40b110"
  1010. },
  1011. {
  1012. "name": "GetStdHandle",
  1013. "address": "0x40b114"
  1014. },
  1015. {
  1016. "name": "GetFileType",
  1017. "address": "0x40b118"
  1018. },
  1019. {
  1020. "name": "GetStartupInfoA",
  1021. "address": "0x40b11c"
  1022. },
  1023. {
  1024. "name": "WriteFile",
  1025. "address": "0x40b120"
  1026. },
  1027. {
  1028. "name": "UnhandledExceptionFilter",
  1029. "address": "0x40b124"
  1030. },
  1031. {
  1032. "name": "GetModuleFileNameW",
  1033. "address": "0x40b128"
  1034. },
  1035. {
  1036. "name": "FreeEnvironmentStringsA",
  1037. "address": "0x40b12c"
  1038. },
  1039. {
  1040. "name": "FreeEnvironmentStringsW",
  1041. "address": "0x40b130"
  1042. },
  1043. {
  1044. "name": "GetEnvironmentStringsW",
  1045. "address": "0x40b134"
  1046. },
  1047. {
  1048. "name": "GetCommandLineW",
  1049. "address": "0x40b138"
  1050. },
  1051. {
  1052. "name": "GetCommandLineA",
  1053. "address": "0x40b13c"
  1054. },
  1055. {
  1056. "name": "RtlUnwind",
  1057. "address": "0x40b140"
  1058. },
  1059. {
  1060. "name": "GetModuleFileNameA",
  1061. "address": "0x40b144"
  1062. },
  1063. {
  1064. "name": "InterlockedDecrement",
  1065. "address": "0x40b148"
  1066. },
  1067. {
  1068. "name": "InterlockedIncrement",
  1069. "address": "0x40b14c"
  1070. },
  1071. {
  1072. "name": "GetProcAddress",
  1073. "address": "0x40b150"
  1074. },
  1075. {
  1076. "name": "SetEnvironmentVariableA",
  1077. "address": "0x40b154"
  1078. }
  1079. ],
  1080. "dll": "KERNEL32.dll"
  1081. },
  1082. {
  1083. "imports": [
  1084. {
  1085. "name": "WindowFromDC",
  1086. "address": "0x40b164"
  1087. },
  1088. {
  1089. "name": "PeekMessageW",
  1090. "address": "0x40b168"
  1091. },
  1092. {
  1093. "name": "GetSysColor",
  1094. "address": "0x40b16c"
  1095. },
  1096. {
  1097. "name": "CreateIconIndirect",
  1098. "address": "0x40b170"
  1099. },
  1100. {
  1101. "name": "WINNLSGetEnableStatus",
  1102. "address": "0x40b174"
  1103. },
  1104. {
  1105. "name": "GetMessageExtraInfo",
  1106. "address": "0x40b178"
  1107. },
  1108. {
  1109. "name": "OemToCharBuffW",
  1110. "address": "0x40b17c"
  1111. }
  1112. ],
  1113. "dll": "USER32.dll"
  1114. },
  1115. {
  1116. "imports": [
  1117. {
  1118. "name": "gdiPlaySpoolStream",
  1119. "address": "0x40b018"
  1120. },
  1121. {
  1122. "name": "CreateDCA",
  1123. "address": "0x40b01c"
  1124. },
  1125. {
  1126. "name": "GetObjectW",
  1127. "address": "0x40b020"
  1128. },
  1129. {
  1130. "name": "AbortPath",
  1131. "address": "0x40b024"
  1132. }
  1133. ],
  1134. "dll": "GDI32.dll"
  1135. },
  1136. {
  1137. "imports": [
  1138. {
  1139. "name": "AddMonitorW",
  1140. "address": "0x40b184"
  1141. },
  1142. {
  1143. "name": "OpenPrinterW",
  1144. "address": "0x40b188"
  1145. },
  1146. {
  1147. "name": "DeletePrinterDriverA",
  1148. "address": "0x40b18c"
  1149. }
  1150. ],
  1151. "dll": "WINSPOOL.DRV"
  1152. },
  1153. {
  1154. "imports": [
  1155. {
  1156. "name": "RegSaveKeyW",
  1157. "address": "0x40b000"
  1158. },
  1159. {
  1160. "name": "CryptDuplicateHash",
  1161. "address": "0x40b004"
  1162. },
  1163. {
  1164. "name": "GetServiceKeyNameW",
  1165. "address": "0x40b008"
  1166. },
  1167. {
  1168. "name": "SetEntriesInAccessListA",
  1169. "address": "0x40b00c"
  1170. },
  1171. {
  1172. "name": "SetFileSecurityA",
  1173. "address": "0x40b010"
  1174. }
  1175. ],
  1176. "dll": "ADVAPI32.dll"
  1177. },
  1178. {
  1179. "imports": [
  1180. {
  1181. "name": "SheGetDirA",
  1182. "address": "0x40b15c"
  1183. }
  1184. ],
  1185. "dll": "SHELL32.dll"
  1186. },
  1187. {
  1188. "imports": [
  1189. {
  1190. "name": "ReadOleStg",
  1191. "address": "0x40b194"
  1192. },
  1193. {
  1194. "name": "CoTaskMemAlloc",
  1195. "address": "0x40b198"
  1196. }
  1197. ],
  1198. "dll": "ole32.dll"
  1199. }
  1200. ],
  1201. "digital_signers": null,
  1202. "exported_dll_name": null,
  1203. "actual_checksum": "0x0002ff0a",
  1204. "overlay": null,
  1205. "imagebase": "0x00400000",
  1206. "reported_checksum": "0x00000000",
  1207. "icon_hash": null,
  1208. "entrypoint": "0x004038c4",
  1209. "timestamp": "2019-06-18 03:17:34",
  1210. "osversion": "4.0",
  1211. "sections": [
  1212. {
  1213. "name": ".text",
  1214. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1215. "virtual_address": "0x00001000",
  1216. "size_of_data": "0x0000a000",
  1217. "entropy": "6.64",
  1218. "raw_address": "0x00001000",
  1219. "virtual_size": "0x00009c28",
  1220. "characteristics_raw": "0x60000020"
  1221. },
  1222. {
  1223. "name": ".rdata",
  1224. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1225. "virtual_address": "0x0000b000",
  1226. "size_of_data": "0x00002000",
  1227. "entropy": "3.54",
  1228. "raw_address": "0x0000b000",
  1229. "virtual_size": "0x000011d0",
  1230. "characteristics_raw": "0x40000040"
  1231. },
  1232. {
  1233. "name": ".data",
  1234. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1235. "virtual_address": "0x0000d000",
  1236. "size_of_data": "0x00009000",
  1237. "entropy": "6.43",
  1238. "raw_address": "0x0000d000",
  1239. "virtual_size": "0x00009c00",
  1240. "characteristics_raw": "0xc0000040"
  1241. },
  1242. {
  1243. "name": ".rsrc",
  1244. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1245. "virtual_address": "0x00017000",
  1246. "size_of_data": "0x00016000",
  1247. "entropy": "6.49",
  1248. "raw_address": "0x00016000",
  1249. "virtual_size": "0x00015b60",
  1250. "characteristics_raw": "0x40000040"
  1251. }
  1252. ],
  1253. "resources": [],
  1254. "dirents": [
  1255. {
  1256. "virtual_address": "0x00000000",
  1257. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1258. "size": "0x00000000"
  1259. },
  1260. {
  1261. "virtual_address": "0x0000b828",
  1262. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1263. "size": "0x000000a0"
  1264. },
  1265. {
  1266. "virtual_address": "0x00017000",
  1267. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1268. "size": "0x00015b60"
  1269. },
  1270. {
  1271. "virtual_address": "0x00000000",
  1272. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1273. "size": "0x00000000"
  1274. },
  1275. {
  1276. "virtual_address": "0x00000000",
  1277. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1278. "size": "0x00000000"
  1279. },
  1280. {
  1281. "virtual_address": "0x00000000",
  1282. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1283. "size": "0x00000000"
  1284. },
  1285. {
  1286. "virtual_address": "0x00000000",
  1287. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1288. "size": "0x00000000"
  1289. },
  1290. {
  1291. "virtual_address": "0x00000000",
  1292. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1293. "size": "0x00000000"
  1294. },
  1295. {
  1296. "virtual_address": "0x00000000",
  1297. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1298. "size": "0x00000000"
  1299. },
  1300. {
  1301. "virtual_address": "0x00000000",
  1302. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1303. "size": "0x00000000"
  1304. },
  1305. {
  1306. "virtual_address": "0x00000000",
  1307. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1308. "size": "0x00000000"
  1309. },
  1310. {
  1311. "virtual_address": "0x00000000",
  1312. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1313. "size": "0x00000000"
  1314. },
  1315. {
  1316. "virtual_address": "0x0000b000",
  1317. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1318. "size": "0x000001a0"
  1319. },
  1320. {
  1321. "virtual_address": "0x00000000",
  1322. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1323. "size": "0x00000000"
  1324. },
  1325. {
  1326. "virtual_address": "0x00000000",
  1327. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1328. "size": "0x00000000"
  1329. },
  1330. {
  1331. "virtual_address": "0x00000000",
  1332. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1333. "size": "0x00000000"
  1334. }
  1335. ],
  1336. "exports": [],
  1337. "guest_signers": {},
  1338. "imphash": "7651bb6154beb262fc689e8016fc2b1b",
  1339. "icon_fuzzy": null,
  1340. "icon": null,
  1341. "pdbpath": null,
  1342. "imported_dll_count": 7,
  1343. "versioninfo": []
  1344. }
  1345. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!