API tools faq
paste
paladin316

IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63_bin_2019-06-29_02_30.json

paladin316
Jun 28th, 2019
2,190
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 70.94 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin"
  7. [*] File Size: 65536
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63"
  10. [*] MD5: "a36b52c9b4a33691b5caa7809525858c"
  11. [*] SHA1: "f308a4293eafd2f97435476559e4967ce76bb154"
  12. [*] SHA512: "7ba550118563147f12165ab32e361ede93e8b5bb9aa0a9f44a11c46b25c8aedcff80aaf916f66fc440a4da48cc412813d721c1f0838ab984726d7e2963b26f8a"
  13. [*] CRC32: "F383820B"
  14. [*] SSDEEP: "1536:2wZCkwcab1ULG6I1OGYKsTDecmIeP3Xlm85ppm21Owk:2db1FN1DYKsPUIOXlmglOwk"
  15.  
  16. [*] Process Execution: [
  17. "IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin",
  18. "IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin",
  19. "IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin",
  20. "IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin",
  21. "svchost.exe",
  22. "svchost.exe",
  23. "WMIADAP.exe",
  24. "svchost.exe",
  25. "WmiPrvSE.exe",
  26. "svchost.exe"
  27. ]
  28.  
  29. [*] Signatures Detected: [
  30. {
  31. "Description": "Creates RWX memory",
  32. "Details": []
  33. },
  34. {
  35. "Description": "A process attempted to delay the analysis task.",
  36. "Details": [
  37. {
  38. "Process": "svchost.exe tried to sleep 305 seconds, actually delayed analysis time by 0 seconds"
  39. }
  40. ]
  41. },
  42. {
  43. "Description": "A process created a hidden window",
  44. "Details": [
  45. {
  46. "Process": "IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin -> C:\\Users\\user\\AppData\\Local\\Temp\\IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin"
  47. },
  48. {
  49. "Process": "IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin -> C:\\Users\\user\\AppData\\Local\\Temp\\IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin"
  50. },
  51. {
  52. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  53. }
  54. ]
  55. },
  56. {
  57. "Description": "Executed a process and injected code into it, probably while unpacking",
  58. "Details": [
  59. {
  60. "Injection": "IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin(2500) -> IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin(1204)"
  61. }
  62. ]
  63. },
  64. {
  65. "Description": "File has been identified by 37 Antiviruses on VirusTotal as malicious",
  66. "Details": [
  67. {
  68. "Qihoo-360": "Trojan.Generic"
  69. },
  70. {
  71. "McAfee": "RDN/Generic.cf"
  72. },
  73. {
  74. "Alibaba": "TrojanBanker:Win32/IcedID.0e96a3f2"
  75. },
  76. {
  77. "CrowdStrike": "win/malicious_confidence_60% (D)"
  78. },
  79. {
  80. "NANO-Antivirus": "Trojan.Win32.IcedID.frqgbq"
  81. },
  82. {
  83. "Symantec": "Trojan.Gen.MBT"
  84. },
  85. {
  86. "ESET-NOD32": "a variant of Win32/GenKryptik.DLAC"
  87. },
  88. {
  89. "APEX": "Malicious"
  90. },
  91. {
  92. "Avast": "Win32:Malware-gen"
  93. },
  94. {
  95. "Kaspersky": "Trojan-Banker.Win32.IcedID.tsxr"
  96. },
  97. {
  98. "Paloalto": "generic.ml"
  99. },
  100. {
  101. "Tencent": "Win32.Trojan.Inject.Auto"
  102. },
  103. {
  104. "Sophos": "Mal/Generic-S"
  105. },
  106. {
  107. "Comodo": "TrojWare.Win32.IcedID.VP@896nhl"
  108. },
  109. {
  110. "F-Secure": "Trojan.TR/AD.IcedId.guhcl"
  111. },
  112. {
  113. "DrWeb": "Trojan.Inject3.17374"
  114. },
  115. {
  116. "Zillya": "Trojan.GenKryptik.Win32.31136"
  117. },
  118. {
  119. "Invincea": "heuristic"
  120. },
  121. {
  122. "McAfee-GW-Edition": "RDN/Generic.cf"
  123. },
  124. {
  125. "FireEye": "Generic.mg.a36b52c9b4a33691"
  126. },
  127. {
  128. "Emsisoft": "Trojan-Banker.Trickster (A)"
  129. },
  130. {
  131. "Ikarus": "Trojan.Win32.Trickbot"
  132. },
  133. {
  134. "Webroot": "W32.Adware.Gen"
  135. },
  136. {
  137. "Avira": "TR/AD.IcedId.guhcl"
  138. },
  139. {
  140. "Antiy-AVL": "Trojan[Banker]/Win32.IcedID"
  141. },
  142. {
  143. "Microsoft": "Trojan:Win32/Tiggre!plock"
  144. },
  145. {
  146. "Endgame": "malicious (high confidence)"
  147. },
  148. {
  149. "ZoneAlarm": "Trojan-Banker.Win32.IcedID.tsxr"
  150. },
  151. {
  152. "GData": "Win32.Trojan.Agent.O3FHA9"
  153. },
  154. {
  155. "AhnLab-V3": "Malware/Win32.Generic.C3294845"
  156. },
  157. {
  158. "Acronis": "suspicious"
  159. },
  160. {
  161. "VBA32": "BScope.Trojan.Iceid"
  162. },
  163. {
  164. "Malwarebytes": "Trojan.Banker"
  165. },
  166. {
  167. "Rising": "Trojan.GenKryptik!8.AA55 (CLOUD)"
  168. },
  169. {
  170. "Fortinet": "W32/Kryptik.GUBD!tr"
  171. },
  172. {
  173. "AVG": "Win32:Malware-gen"
  174. },
  175. {
  176. "Panda": "Trj/GdSda.A"
  177. }
  178. ]
  179. },
  180. {
  181. "Description": "Creates a slightly modified copy of itself",
  182. "Details": [
  183. {
  184. "file": "C:\\ProgramData\\{D62673F0-37F0-46DA-BFC0-5B9596B01F09}\\{562673F1-37F1-46DA-BFC1-5B959AB01F09}\\jaykd.exe"
  185. },
  186. {
  187. "percent_match": 100
  188. }
  189. ]
  190. },
  191. {
  192. "Description": "Created network traffic indicative of malicious activity",
  193. "Details": [
  194. {
  195. "signature": "ET DNS Query to a *.pw domain - Likely Hostile"
  196. },
  197. {
  198. "signature": "ET CURRENT_EVENTS DNS Query Domain .bit"
  199. }
  200. ]
  201. }
  202. ]
  203.  
  204. [*] Started Service: []
  205.  
  206. [*] Executed Commands: [
  207. "\"C:\\Users\\user\\AppData\\Local\\Temp\\IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin\"",
  208. "\"C:\\Users\\user\\AppData\\Local\\Temp\\IcedID_18f32d000404292cfdb95fade8e5138af87377240fdd37b0d21bf460d5ea0f63.bin\" -q=1754146098",
  209. "C:\\Windows\\system32\\svchost.exe",
  210. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  211. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
  212. ]
  213.  
  214. [*] Mutexes: [
  215. "Global\\ADAP_WMI_ENTRY",
  216. "Global\\RefreshRA_Mutex",
  217. "Global\\RefreshRA_Mutex_Lib",
  218. "Global\\RefreshRA_Mutex_Flag"
  219. ]
  220.  
  221. [*] Modified Files: [
  222. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-0000000000-0000000000-0000000000-1000\\00000000-0000-0000-0000-000000000000b_00000000-0000-0000-0000-000000000000",
  223. "C:\\ProgramData\\{D62673F0-37F0-46DA-BFC0-5B9596B01F09}\\{562673F1-37F1-46DA-BFC1-5B959AB01F09}\\jaykd.exe",
  224. "\\??\\PIPE\\wkssvc",
  225. "C:\\Windows\\sysnative\\Tasks\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}",
  226. "\\Device\\LanmanDatagramReceiver",
  227. "\\??\\PIPE\\srvsvc",
  228. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  229. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  230. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  231. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  232. "\\??\\PIPE\\samr",
  233. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  234. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  235. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  236. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  237. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  238. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  239. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  240. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  241. "\\??\\WMIDataDevice"
  242. ]
  243.  
  244. [*] Deleted Files: [
  245. "C:\\Windows\\Tasks\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}.job",
  246. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  247. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  248. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  249. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  250. ]
  251.  
  252. [*] Modified Registry Keys: [
  253. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{75265AFF-A3F5-4DFC-A222-CF5DBA720476}\\Path",
  254. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{75265AFF-A3F5-4DFC-A222-CF5DBA720476}\\Hash",
  255. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}\\Id",
  256. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}\\Index",
  257. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{75265AFF-A3F5-4DFC-A222-CF5DBA720476}\\Triggers",
  258. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{75265AFF-A3F5-4DFC-A222-CF5DBA720476}\\DynamicInfo",
  259. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  260. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  261. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  262. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D802E2E4-2771-458F-A331-5941A64C01E1}\\Path",
  263. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D802E2E4-2771-458F-A331-5941A64C01E1}\\Hash",
  264. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  265. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  266. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D802E2E4-2771-458F-A331-5941A64C01E1}\\Triggers",
  267. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D802E2E4-2771-458F-A331-5941A64C01E1}\\DynamicInfo",
  268. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  269. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  270. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  271. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  272. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  273. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  274. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  275. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-{00000000-0000-0000-0000-000000000000}",
  276. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dll[MofResourceName]",
  277. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.mui[MofResourceName]",
  278. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sys[ACPIMOFResource]",
  279. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
  280. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
  281. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
  282. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sys[MofResource]",
  283. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui[MofResource]",
  284. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sys[HDAudioMofName]",
  285. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui[HDAudioMofName]",
  286. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sys[PROCESSORWMI]",
  287. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.mui[PROCESSORWMI]",
  288. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYS[PortclsMof]",
  289. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.mui[PortclsMof]",
  290. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  291. ]
  292.  
  293. [*] Deleted Registry Keys: [
  294. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}.job",
  295. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\{D6266B5F-EE5F-44B6-BEAC-5B0C0EB01EC5}.job.fp",
  296. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  297. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  298. ]
  299.  
  300. [*] DNS Communications: [
  301. {
  302. "type": "A",
  303. "request": "mozambiquest.pw",
  304. "answers": []
  305. },
  306. {
  307. "type": "A",
  308. "request": "ransmittend.club",
  309. "answers": [
  310. {
  311. "data": "",
  312. "type": "NXDOMAIN"
  313. }
  314. ]
  315. },
  316. {
  317. "type": "A",
  318. "request": "summerch.xyz",
  319. "answers": [
  320. {
  321. "data": "",
  322. "type": "NXDOMAIN"
  323. }
  324. ]
  325. },
  326. {
  327. "type": "A",
  328. "request": "ignorepairs.pro",
  329. "answers": [
  330. {
  331. "data": "",
  332. "type": "NXDOMAIN"
  333. }
  334. ]
  335. },
  336. {
  337. "type": "A",
  338. "request": "consequencycle.pw",
  339. "answers": []
  340. },
  341. {
  342. "type": "A",
  343. "request": "harbournal.club",
  344. "answers": [
  345. {
  346. "data": "",
  347. "type": "NXDOMAIN"
  348. }
  349. ]
  350. },
  351. {
  352. "type": "A",
  353. "request": "demandymedes.xyz",
  354. "answers": [
  355. {
  356. "data": "",
  357. "type": "NXDOMAIN"
  358. }
  359. ]
  360. },
  361. {
  362. "type": "A",
  363. "request": "hahashow67.bit",
  364. "answers": [
  365. {
  366. "data": "",
  367. "type": "NXDOMAIN"
  368. }
  369. ]
  370. },
  371. {
  372. "type": "A",
  373. "request": "albarthurst.pro",
  374. "answers": [
  375. {
  376. "data": "",
  377. "type": "NXDOMAIN"
  378. }
  379. ]
  380. }
  381. ]
  382.  
  383. [*] Domains: [
  384. {
  385. "ip": "",
  386. "domain": "ransmittend.club"
  387. },
  388. {
  389. "ip": "",
  390. "domain": "ignorepairs.pro"
  391. },
  392. {
  393. "ip": "",
  394. "domain": "mozambiquest.pw"
  395. },
  396. {
  397. "ip": "",
  398. "domain": "hahashow67.bit"
  399. },
  400. {
  401. "ip": "",
  402. "domain": "albarthurst.pro"
  403. },
  404. {
  405. "ip": "",
  406. "domain": "summerch.xyz"
  407. },
  408. {
  409. "ip": "",
  410. "domain": "consequencycle.pw"
  411. },
  412. {
  413. "ip": "",
  414. "domain": "harbournal.club"
  415. },
  416. {
  417. "ip": "",
  418. "domain": "demandymedes.xyz"
  419. }
  420. ]
  421.  
  422. [*] Network Communication - ICMP: []
  423.  
  424. [*] Network Communication - HTTP: []
  425.  
  426. [*] Network Communication - SMTP: []
  427.  
  428. [*] Network Communication - Hosts: []
  429.  
  430. [*] Network Communication - IRC: []
  431.  
  432. [*] Static Analysis: {
  433. "pe": {
  434. "peid_signatures": null,
  435. "imports": [
  436. {
  437. "imports": [
  438. {
  439. "name": "VirtualAlloc",
  440. "address": "0x40505c"
  441. },
  442. {
  443. "name": "InterlockedCompareExchange",
  444. "address": "0x405060"
  445. },
  446. {
  447. "name": "GetStartupInfoA",
  448. "address": "0x405064"
  449. },
  450. {
  451. "name": "TerminateProcess",
  452. "address": "0x405068"
  453. },
  454. {
  455. "name": "GetCurrentProcess",
  456. "address": "0x40506c"
  457. },
  458. {
  459. "name": "UnhandledExceptionFilter",
  460. "address": "0x405070"
  461. },
  462. {
  463. "name": "SetUnhandledExceptionFilter",
  464. "address": "0x405074"
  465. },
  466. {
  467. "name": "IsDebuggerPresent",
  468. "address": "0x405078"
  469. },
  470. {
  471. "name": "QueryPerformanceCounter",
  472. "address": "0x40507c"
  473. },
  474. {
  475. "name": "GetTickCount",
  476. "address": "0x405080"
  477. },
  478. {
  479. "name": "GetCurrentThreadId",
  480. "address": "0x405084"
  481. },
  482. {
  483. "name": "GetCurrentProcessId",
  484. "address": "0x405088"
  485. },
  486. {
  487. "name": "GetCurrentDirectoryA",
  488. "address": "0x40508c"
  489. },
  490. {
  491. "name": "GetModuleHandleA",
  492. "address": "0x405090"
  493. },
  494. {
  495. "name": "Sleep",
  496. "address": "0x405094"
  497. },
  498. {
  499. "name": "LoadLibraryW",
  500. "address": "0x405098"
  501. },
  502. {
  503. "name": "GetProcAddress",
  504. "address": "0x40509c"
  505. },
  506. {
  507. "name": "CreateFileMappingW",
  508. "address": "0x4050a0"
  509. },
  510. {
  511. "name": "MapViewOfFile",
  512. "address": "0x4050a4"
  513. },
  514. {
  515. "name": "InterlockedExchange",
  516. "address": "0x4050a8"
  517. },
  518. {
  519. "name": "GetSystemTimeAsFileTime",
  520. "address": "0x4050ac"
  521. }
  522. ],
  523. "dll": "KERNEL32.dll"
  524. },
  525. {
  526. "imports": [
  527. {
  528. "name": "LoadImageA",
  529. "address": "0x405174"
  530. },
  531. {
  532. "name": "GetDC",
  533. "address": "0x405178"
  534. },
  535. {
  536. "name": "UpdateWindow",
  537. "address": "0x40517c"
  538. },
  539. {
  540. "name": "SetWindowRgn",
  541. "address": "0x405180"
  542. },
  543. {
  544. "name": "MoveWindow",
  545. "address": "0x405184"
  546. },
  547. {
  548. "name": "GetWindowRgn",
  549. "address": "0x405188"
  550. },
  551. {
  552. "name": "DrawIconEx",
  553. "address": "0x40518c"
  554. },
  555. {
  556. "name": "GetClientRect",
  557. "address": "0x405190"
  558. },
  559. {
  560. "name": "GetWindowTextA",
  561. "address": "0x405194"
  562. },
  563. {
  564. "name": "DestroyIcon",
  565. "address": "0x405198"
  566. },
  567. {
  568. "name": "EndPaint",
  569. "address": "0x40519c"
  570. },
  571. {
  572. "name": "BeginPaint",
  573. "address": "0x4051a0"
  574. },
  575. {
  576. "name": "SetCapture",
  577. "address": "0x4051a4"
  578. },
  579. {
  580. "name": "SendMessageA",
  581. "address": "0x4051a8"
  582. },
  583. {
  584. "name": "GetParent",
  585. "address": "0x4051ac"
  586. },
  587. {
  588. "name": "GetWindowLongA",
  589. "address": "0x4051b0"
  590. },
  591. {
  592. "name": "ReleaseCapture",
  593. "address": "0x4051b4"
  594. },
  595. {
  596. "name": "GetWindowRect",
  597. "address": "0x4051b8"
  598. },
  599. {
  600. "name": "SetWindowLongA",
  601. "address": "0x4051bc"
  602. },
  603. {
  604. "name": "CreateDialogParamA",
  605. "address": "0x4051c0"
  606. },
  607. {
  608. "name": "GetDlgItem",
  609. "address": "0x4051c4"
  610. },
  611. {
  612. "name": "ReleaseDC",
  613. "address": "0x4051c8"
  614. },
  615. {
  616. "name": "PostQuitMessage",
  617. "address": "0x4051cc"
  618. },
  619. {
  620. "name": "MessageBoxA",
  621. "address": "0x4051d0"
  622. },
  623. {
  624. "name": "DefWindowProcA",
  625. "address": "0x4051d4"
  626. },
  627. {
  628. "name": "LoadCursorA",
  629. "address": "0x4051d8"
  630. },
  631. {
  632. "name": "LoadIconA",
  633. "address": "0x4051dc"
  634. },
  635. {
  636. "name": "RegisterClassA",
  637. "address": "0x4051e0"
  638. },
  639. {
  640. "name": "CreateWindowExA",
  641. "address": "0x4051e4"
  642. },
  643. {
  644. "name": "ShowWindow",
  645. "address": "0x4051e8"
  646. },
  647. {
  648. "name": "GetMessageA",
  649. "address": "0x4051ec"
  650. },
  651. {
  652. "name": "TranslateMessage",
  653. "address": "0x4051f0"
  654. },
  655. {
  656. "name": "DispatchMessageA",
  657. "address": "0x4051f4"
  658. }
  659. ],
  660. "dll": "USER32.dll"
  661. },
  662. {
  663. "imports": [
  664. {
  665. "name": "CreateCompatibleBitmap",
  666. "address": "0x405000"
  667. },
  668. {
  669. "name": "GetRegionData",
  670. "address": "0x405004"
  671. },
  672. {
  673. "name": "DeleteDC",
  674. "address": "0x405008"
  675. },
  676. {
  677. "name": "DeleteObject",
  678. "address": "0x40500c"
  679. },
  680. {
  681. "name": "CombineRgn",
  682. "address": "0x405010"
  683. },
  684. {
  685. "name": "CreateRectRgn",
  686. "address": "0x405014"
  687. },
  688. {
  689. "name": "GetPixel",
  690. "address": "0x405018"
  691. },
  692. {
  693. "name": "SelectObject",
  694. "address": "0x40501c"
  695. },
  696. {
  697. "name": "SaveDC",
  698. "address": "0x405020"
  699. },
  700. {
  701. "name": "GetObjectA",
  702. "address": "0x405024"
  703. },
  704. {
  705. "name": "CreateCompatibleDC",
  706. "address": "0x405028"
  707. },
  708. {
  709. "name": "GetRgnBox",
  710. "address": "0x40502c"
  711. },
  712. {
  713. "name": "CreateRectRgnIndirect",
  714. "address": "0x405030"
  715. },
  716. {
  717. "name": "BitBlt",
  718. "address": "0x405034"
  719. },
  720. {
  721. "name": "FrameRgn",
  722. "address": "0x405038"
  723. },
  724. {
  725. "name": "TextOutA",
  726. "address": "0x40503c"
  727. },
  728. {
  729. "name": "SetTextColor",
  730. "address": "0x405040"
  731. },
  732. {
  733. "name": "GetTextExtentPoint32A",
  734. "address": "0x405044"
  735. },
  736. {
  737. "name": "SetBkMode",
  738. "address": "0x405048"
  739. },
  740. {
  741. "name": "CreateFontA",
  742. "address": "0x40504c"
  743. },
  744. {
  745. "name": "PtInRegion",
  746. "address": "0x405050"
  747. },
  748. {
  749. "name": "GetStockObject",
  750. "address": "0x405054"
  751. }
  752. ],
  753. "dll": "GDI32.dll"
  754. },
  755. {
  756. "imports": [
  757. {
  758. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  759. "address": "0x4050b4"
  760. },
  761. {
  762. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  763. "address": "0x4050b8"
  764. },
  765. {
  766. "name": "??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z",
  767. "address": "0x4050bc"
  768. },
  769. {
  770. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z",
  771. "address": "0x4050c0"
  772. },
  773. {
  774. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  775. "address": "0x4050c4"
  776. },
  777. {
  778. "name": "?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ",
  779. "address": "0x4050c8"
  780. },
  781. {
  782. "name": "?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ",
  783. "address": "0x4050cc"
  784. }
  785. ],
  786. "dll": "MSVCP90.dll"
  787. },
  788. {
  789. "imports": [
  790. {
  791. "name": "__p__fmode",
  792. "address": "0x4050d4"
  793. },
  794. {
  795. "name": "__p__commode",
  796. "address": "0x4050d8"
  797. },
  798. {
  799. "name": "_adjust_fdiv",
  800. "address": "0x4050dc"
  801. },
  802. {
  803. "name": "__setusermatherr",
  804. "address": "0x4050e0"
  805. },
  806. {
  807. "name": "_configthreadlocale",
  808. "address": "0x4050e4"
  809. },
  810. {
  811. "name": "_initterm_e",
  812. "address": "0x4050e8"
  813. },
  814. {
  815. "name": "__set_app_type",
  816. "address": "0x4050ec"
  817. },
  818. {
  819. "name": "_acmdln",
  820. "address": "0x4050f0"
  821. },
  822. {
  823. "name": "exit",
  824. "address": "0x4050f4"
  825. },
  826. {
  827. "name": "_ismbblead",
  828. "address": "0x4050f8"
  829. },
  830. {
  831. "name": "_XcptFilter",
  832. "address": "0x4050fc"
  833. },
  834. {
  835. "name": "_exit",
  836. "address": "0x405100"
  837. },
  838. {
  839. "name": "_cexit",
  840. "address": "0x405104"
  841. },
  842. {
  843. "name": "_crt_debugger_hook",
  844. "address": "0x405108"
  845. },
  846. {
  847. "name": "_except_handler4_common",
  848. "address": "0x40510c"
  849. },
  850. {
  851. "name": "?terminate@@YAXXZ",
  852. "address": "0x405110"
  853. },
  854. {
  855. "name": "?_type_info_dtor_internal_method@type_info@@QAEXXZ",
  856. "address": "0x405114"
  857. },
  858. {
  859. "name": "_invoke_watson",
  860. "address": "0x405118"
  861. },
  862. {
  863. "name": "_controlfp_s",
  864. "address": "0x40511c"
  865. },
  866. {
  867. "name": "_initterm",
  868. "address": "0x405120"
  869. },
  870. {
  871. "name": "malloc",
  872. "address": "0x405124"
  873. },
  874. {
  875. "name": "strlen",
  876. "address": "0x405128"
  877. },
  878. {
  879. "name": "fclose",
  880. "address": "0x40512c"
  881. },
  882. {
  883. "name": "fwrite",
  884. "address": "0x405130"
  885. },
  886. {
  887. "name": "fopen",
  888. "address": "0x405134"
  889. },
  890. {
  891. "name": "free",
  892. "address": "0x405138"
  893. },
  894. {
  895. "name": "??3@YAXPAX@Z",
  896. "address": "0x40513c"
  897. },
  898. {
  899. "name": "strcat",
  900. "address": "0x405140"
  901. },
  902. {
  903. "name": "fread",
  904. "address": "0x405144"
  905. },
  906. {
  907. "name": "feof",
  908. "address": "0x405148"
  909. },
  910. {
  911. "name": "strcmp",
  912. "address": "0x40514c"
  913. },
  914. {
  915. "name": "_unlock",
  916. "address": "0x405150"
  917. },
  918. {
  919. "name": "__dllonexit",
  920. "address": "0x405154"
  921. },
  922. {
  923. "name": "_encode_pointer",
  924. "address": "0x405158"
  925. },
  926. {
  927. "name": "_lock",
  928. "address": "0x40515c"
  929. },
  930. {
  931. "name": "_onexit",
  932. "address": "0x405160"
  933. },
  934. {
  935. "name": "_decode_pointer",
  936. "address": "0x405164"
  937. },
  938. {
  939. "name": "_amsg_exit",
  940. "address": "0x405168"
  941. },
  942. {
  943. "name": "__getmainargs",
  944. "address": "0x40516c"
  945. }
  946. ],
  947. "dll": "MSVCR90.dll"
  948. }
  949. ],
  950. "digital_signers": null,
  951. "exported_dll_name": null,
  952. "actual_checksum": "0x000159b5",
  953. "overlay": null,
  954. "imagebase": "0x00400000",
  955. "reported_checksum": "0x000159b5",
  956. "icon_hash": null,
  957. "entrypoint": "0x00403ceb",
  958. "timestamp": "2019-06-18 14:23:08",
  959. "osversion": "5.0",
  960. "sections": [
  961. {
  962. "name": ".text",
  963. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  964. "virtual_address": "0x00001000",
  965. "size_of_data": "0x00003400",
  966. "entropy": "5.92",
  967. "raw_address": "0x00000400",
  968. "virtual_size": "0x000033af",
  969. "characteristics_raw": "0x60000020"
  970. },
  971. {
  972. "name": ".rdata",
  973. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  974. "virtual_address": "0x00005000",
  975. "size_of_data": "0x0000c200",
  976. "entropy": "6.18",
  977. "raw_address": "0x00003800",
  978. "virtual_size": "0x0000c1c8",
  979. "characteristics_raw": "0x40000040"
  980. },
  981. {
  982. "name": ".data",
  983. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  984. "virtual_address": "0x00012000",
  985. "size_of_data": "0x00000200",
  986. "entropy": "1.51",
  987. "raw_address": "0x0000fa00",
  988. "virtual_size": "0x000004b4",
  989. "characteristics_raw": "0xc0000040"
  990. },
  991. {
  992. "name": ".rsrc",
  993. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  994. "virtual_address": "0x00013000",
  995. "size_of_data": "0x00000400",
  996. "entropy": "5.19",
  997. "raw_address": "0x0000fc00",
  998. "virtual_size": "0x000002b0",
  999. "characteristics_raw": "0x40000040"
  1000. }
  1001. ],
  1002. "resources": [],
  1003. "dirents": [
  1004. {
  1005. "virtual_address": "0x00000000",
  1006. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1007. "size": "0x00000000"
  1008. },
  1009. {
  1010. "virtual_address": "0x0001057c",
  1011. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1012. "size": "0x00000078"
  1013. },
  1014. {
  1015. "virtual_address": "0x00013000",
  1016. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1017. "size": "0x000002b0"
  1018. },
  1019. {
  1020. "virtual_address": "0x00000000",
  1021. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1022. "size": "0x00000000"
  1023. },
  1024. {
  1025. "virtual_address": "0x00000000",
  1026. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1027. "size": "0x00000000"
  1028. },
  1029. {
  1030. "virtual_address": "0x00000000",
  1031. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1032. "size": "0x00000000"
  1033. },
  1034. {
  1035. "virtual_address": "0x00005230",
  1036. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1037. "size": "0x0000001c"
  1038. },
  1039. {
  1040. "virtual_address": "0x00000000",
  1041. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1042. "size": "0x00000000"
  1043. },
  1044. {
  1045. "virtual_address": "0x00000000",
  1046. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1047. "size": "0x00000000"
  1048. },
  1049. {
  1050. "virtual_address": "0x00000000",
  1051. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1052. "size": "0x00000000"
  1053. },
  1054. {
  1055. "virtual_address": "0x00010330",
  1056. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1057. "size": "0x00000040"
  1058. },
  1059. {
  1060. "virtual_address": "0x00000000",
  1061. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1062. "size": "0x00000000"
  1063. },
  1064. {
  1065. "virtual_address": "0x00005000",
  1066. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1067. "size": "0x000001fc"
  1068. },
  1069. {
  1070. "virtual_address": "0x00000000",
  1071. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1072. "size": "0x00000000"
  1073. },
  1074. {
  1075. "virtual_address": "0x00000000",
  1076. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1077. "size": "0x00000000"
  1078. },
  1079. {
  1080. "virtual_address": "0x00000000",
  1081. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1082. "size": "0x00000000"
  1083. }
  1084. ],
  1085. "exports": [],
  1086. "guest_signers": {},
  1087. "imphash": "a5e07b9d885d7be2b11371ae68839d0c",
  1088. "icon_fuzzy": null,
  1089. "icon": null,
  1090. "pdbpath": "c:\\Users\\User\\Desktop\\DReY_Shape1667871152003\\Release\\ShapeGradientButton.pdb",
  1091. "imported_dll_count": 5,
  1092. "versioninfo": []
  1093. }
  1094. }
  1095.  
  1096. [*] Resolved APIs: [
  1097. "uxtheme.dll.ThemeInitApiHook",
  1098. "user32.dll.IsProcessDPIAware",
  1099. "dwmapi.dll.DwmIsCompositionEnabled",
  1100. "advapi32.dll.CryptAcquireContextA",
  1101. "cryptsp.dll.CryptAcquireContextA",
  1102. "advapi32.dll.CryptImportKey",
  1103. "advapi32.dll.CryptEncrypt",
  1104. "cryptsp.dll.CryptImportKey",
  1105. "cryptbase.dll.SystemFunction040",
  1106. "cryptbase.dll.SystemFunction041",
  1107. "cryptsp.dll.CryptEncrypt",
  1108. "kernel32.dll.SortGetHandle",
  1109. "kernel32.dll.SortCloseHandle",
  1110. "crypt32.dll.CryptProtectData",
  1111. "kernel32.dll.LoadLibraryA",
  1112. "kernel32.dll.GetProcAddress",
  1113. "secur32.dll.GetUserNameExW",
  1114. "userenv.dll.CreateEnvironmentBlock",
  1115. "user32.dll.wsprintfA",
  1116. "user32.dll.wsprintfW",
  1117. "wtsapi32.dll.WTSQueryUserToken",
  1118. "shlwapi.dll.StrStrA",
  1119. "shlwapi.dll.StrStrIW",
  1120. "shlwapi.dll.StrChrA",
  1121. "shlwapi.dll.StrStrIA",
  1122. "netapi32.dll.NetApiBufferFree",
  1123. "netapi32.dll.NetWkstaGetInfo",
  1124. "netapi32.dll.NetGetDCName",
  1125. "dnsapi.dll.DnsFree",
  1126. "dnsapi.dll.DnsQuery_A",
  1127. "msvcrt.dll.memcpy",
  1128. "msvcrt.dll.memset",
  1129. "msvcrt.dll._vsnprintf",
  1130. "kernel32.dll.lstrcpyA",
  1131. "kernel32.dll.Sleep",
  1132. "kernel32.dll.CreateThread",
  1133. "kernel32.dll.SetErrorMode",
  1134. "kernel32.dll.SetEvent",
  1135. "kernel32.dll.WaitForSingleObject",
  1136. "kernel32.dll.CreateEventW",
  1137. "kernel32.dll.GetComputerNameExW",
  1138. "kernel32.dll.lstrlenW",
  1139. "kernel32.dll.CreateProcessA",
  1140. "kernel32.dll.OpenEventW",
  1141. "kernel32.dll.lstrcpyW",
  1142. "kernel32.dll.SetUnhandledExceptionFilter",
  1143. "kernel32.dll.ExitProcess",
  1144. "kernel32.dll.CreateProcessW",
  1145. "kernel32.dll.GetSystemTimeAsFileTime",
  1146. "kernel32.dll.lstrcatW",
  1147. "kernel32.dll.CopyFileW",
  1148. "kernel32.dll.ExpandEnvironmentStringsA",
  1149. "kernel32.dll.CreateFileA",
  1150. "kernel32.dll.CreateFileW",
  1151. "kernel32.dll.GetFileSize",
  1152. "kernel32.dll.ReadFile",
  1153. "kernel32.dll.WriteFile",
  1154. "kernel32.dll.HeapReAlloc",
  1155. "kernel32.dll.QueryPerformanceCounter",
  1156. "kernel32.dll.QueryPerformanceFrequency",
  1157. "kernel32.dll.GetTickCount",
  1158. "kernel32.dll.GetNativeSystemInfo",
  1159. "kernel32.dll.GetCurrentProcessId",
  1160. "kernel32.dll.GetLocalTime",
  1161. "kernel32.dll.GetCurrentProcess",
  1162. "kernel32.dll.WTSGetActiveConsoleSessionId",
  1163. "kernel32.dll.WideCharToMultiByte",
  1164. "kernel32.dll.CreateFileMappingW",
  1165. "kernel32.dll.MapViewOfFile",
  1166. "kernel32.dll.UnmapViewOfFile",
  1167. "kernel32.dll.MultiByteToWideChar",
  1168. "kernel32.dll.GetExitCodeProcess",
  1169. "kernel32.dll.ResumeThread",
  1170. "kernel32.dll.DeleteFileW",
  1171. "kernel32.dll.CreateDirectoryW",
  1172. "kernel32.dll.GetTempPathA",
  1173. "kernel32.dll.HeapAlloc",
  1174. "kernel32.dll.CloseHandle",
  1175. "kernel32.dll.lstrlenA",
  1176. "kernel32.dll.GetProcessHeap",
  1177. "kernel32.dll.HeapFree",
  1178. "kernel32.dll.lstrcatA",
  1179. "kernel32.dll.GetLastError",
  1180. "ws2_32.dll.#12",
  1181. "ntdll.dll.RtlGetVersion",
  1182. "ntdll.dll.ZwQuerySystemInformation",
  1183. "ntdll.dll.RtlLargeIntegerDivide",
  1184. "shell32.dll.SHGetFolderPathW",
  1185. "iphlpapi.dll.GetAdaptersInfo",
  1186. "ole32.dll.CoCreateInstance",
  1187. "ole32.dll.CoInitializeEx",
  1188. "winhttp.dll.WinHttpOpen",
  1189. "winhttp.dll.WinHttpCrackUrl",
  1190. "winhttp.dll.WinHttpReceiveResponse",
  1191. "winhttp.dll.WinHttpCloseHandle",
  1192. "winhttp.dll.WinHttpSendRequest",
  1193. "winhttp.dll.WinHttpConnect",
  1194. "winhttp.dll.WinHttpOpenRequest",
  1195. "winhttp.dll.WinHttpSetOption",
  1196. "winhttp.dll.WinHttpQueryDataAvailable",
  1197. "winhttp.dll.WinHttpReadData",
  1198. "winhttp.dll.WinHttpQueryHeaders",
  1199. "advapi32.dll.GetSidSubAuthority",
  1200. "advapi32.dll.RegSetValueExA",
  1201. "advapi32.dll.RegQueryValueExA",
  1202. "advapi32.dll.RegOpenKeyA",
  1203. "advapi32.dll.RegDeleteKeyA",
  1204. "advapi32.dll.RegCreateKeyA",
  1205. "advapi32.dll.RegCloseKey",
  1206. "advapi32.dll.CryptVerifySignatureA",
  1207. "advapi32.dll.CryptDestroyKey",
  1208. "advapi32.dll.LookupPrivilegeValueA",
  1209. "advapi32.dll.AdjustTokenPrivileges",
  1210. "advapi32.dll.CreateProcessAsUserW",
  1211. "advapi32.dll.GetTokenInformation",
  1212. "advapi32.dll.GetSidSubAuthorityCount",
  1213. "advapi32.dll.CryptReleaseContext",
  1214. "advapi32.dll.GetSidIdentifierAuthority",
  1215. "advapi32.dll.OpenProcessToken",
  1216. "advapi32.dll.CryptAcquireContextW",
  1217. "advapi32.dll.LookupAccountNameW",
  1218. "advapi32.dll.GetUserNameW",
  1219. "advapi32.dll.CryptDestroyHash",
  1220. "advapi32.dll.CryptHashData",
  1221. "advapi32.dll.CryptCreateHash",
  1222. "advapi32.dll.CryptGetHashParam",
  1223. "advapi32.dll.InitiateSystemShutdownExA",
  1224. "sechost.dll.LookupAccountNameLocalW",
  1225. "advapi32.dll.LsaOpenPolicy",
  1226. "advapi32.dll.LsaQueryInformationPolicy",
  1227. "netutils.dll.NetApiBufferAllocate",
  1228. "advapi32.dll.LsaFreeMemory",
  1229. "advapi32.dll.LsaClose",
  1230. "netutils.dll.NetApiBufferFree",
  1231. "cryptbase.dll.SystemFunction036",
  1232. "sspicli.dll.GetUserNameExW",
  1233. "xmllite.dll.CreateXmlWriter",
  1234. "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
  1235. "oleaut32.dll.#500",
  1236. "wkscli.dll.NetWkstaGetInfo",
  1237. "cscapi.dll.CscNetApiGetInterface",
  1238. "ws2_32.dll.GetAddrInfoW",
  1239. "rpcrt4.dll.RpcBindingFree",
  1240. "ws2_32.dll.#116",
  1241. "ole32.dll.CoUninitialize",
  1242. "advapi32.dll.WmiMofEnumerateResourcesW",
  1243. "advapi32.dll.WmiFreeBuffer",
  1244. "advapi32.dll.WmiCloseBlock",
  1245. "propsys.dll.PropVariantToVariant",
  1246. "wbemcore.dll.Shutdown",
  1247. "advapi32.dll.LookupAccountSidW",
  1248. "sechost.dll.LookupAccountSidLocalW",
  1249. "kernel32.dll.GetThreadPreferredUILanguages",
  1250. "kernel32.dll.SetThreadPreferredUILanguages",
  1251. "kernel32.dll.LocaleNameToLCID",
  1252. "kernel32.dll.GetLocaleInfoEx",
  1253. "kernel32.dll.LCIDToLocaleName",
  1254. "kernel32.dll.GetSystemDefaultLocaleName",
  1255. "fastprox.dll.DllGetClassObject",
  1256. "fastprox.dll.DllCanUnloadNow",
  1257. "oleaut32.dll.#283",
  1258. "oleaut32.dll.#284",
  1259. "kernel32.dll.RegOpenKeyExW",
  1260. "psapi.dll.EnumProcesses",
  1261. "psapi.dll.EnumProcessModules",
  1262. "psapi.dll.GetModuleBaseNameW",
  1263. "ntdll.dll.NtQuerySystemInformation",
  1264. "ole32.dll.CoGetClassObject",
  1265. "ole32.dll.CoGetMarshalSizeMax",
  1266. "ole32.dll.CoMarshalInterface",
  1267. "ole32.dll.CoUnmarshalInterface",
  1268. "ole32.dll.StringFromIID",
  1269. "ole32.dll.CoGetPSClsid",
  1270. "ole32.dll.CoTaskMemAlloc",
  1271. "ole32.dll.CoTaskMemFree",
  1272. "ole32.dll.CoReleaseMarshalData",
  1273. "ole32.dll.DcomChannelSetHResult",
  1274. "vssapi.dll.CreateWriter",
  1275. "oleaut32.dll.#6",
  1276. "oleaut32.dll.#2",
  1277. "samcli.dll.NetLocalGroupGetMembers",
  1278. "samlib.dll.SamConnect",
  1279. "rpcrt4.dll.NdrClientCall3",
  1280. "rpcrt4.dll.RpcStringBindingComposeW",
  1281. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1282. "rpcrt4.dll.RpcStringFreeW",
  1283. "samlib.dll.SamOpenDomain",
  1284. "samlib.dll.SamLookupNamesInDomain",
  1285. "samlib.dll.SamOpenAlias",
  1286. "samlib.dll.SamFreeMemory",
  1287. "samlib.dll.SamCloseHandle",
  1288. "samlib.dll.SamGetMembersInAlias",
  1289. "samlib.dll.SamEnumerateDomainsInSamServer",
  1290. "samlib.dll.SamLookupDomainInSamServer",
  1291. "ole32.dll.CoCreateGuid",
  1292. "ole32.dll.StringFromCLSID",
  1293. "oleaut32.dll.#4",
  1294. "oleaut32.dll.#7",
  1295. "propsys.dll.VariantToPropVariant",
  1296. "wbemcore.dll.Reinitialize",
  1297. "wbemsvc.dll.DllGetClassObject",
  1298. "wbemsvc.dll.DllCanUnloadNow",
  1299. "authz.dll.AuthzInitializeContextFromToken",
  1300. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  1301. "authz.dll.AuthzAccessCheck",
  1302. "authz.dll.AuthzFreeAuditEvent",
  1303. "authz.dll.AuthzFreeContext",
  1304. "authz.dll.AuthzInitializeResourceManager",
  1305. "authz.dll.AuthzFreeResourceManager",
  1306. "rpcrt4.dll.RpcBindingCreateW",
  1307. "rpcrt4.dll.RpcBindingBind",
  1308. "rpcrt4.dll.I_RpcMapWin32Status",
  1309. "advapi32.dll.EventRegister",
  1310. "advapi32.dll.EventUnregister",
  1311. "advapi32.dll.EventWrite",
  1312. "kernel32.dll.RegCloseKey",
  1313. "kernel32.dll.RegSetValueExW",
  1314. "kernel32.dll.RegQueryValueExW",
  1315. "wmisvc.dll.IsImproperShutdownDetected",
  1316. "wevtapi.dll.EvtRender",
  1317. "wevtapi.dll.EvtNext",
  1318. "wevtapi.dll.EvtClose",
  1319. "wevtapi.dll.EvtQuery",
  1320. "wevtapi.dll.EvtCreateRenderContext",
  1321. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1322. "rpcrt4.dll.RpcBindingSetOption",
  1323. "ole32.dll.CoCreateFreeThreadedMarshaler",
  1324. "ole32.dll.CreateStreamOnHGlobal",
  1325. "advapi32.dll.RegCreateKeyExW",
  1326. "advapi32.dll.RegSetValueExW",
  1327. "cryptsp.dll.CryptAcquireContextW",
  1328. "cryptsp.dll.CryptGenRandom",
  1329. "cryptsp.dll.CryptReleaseContext",
  1330. "kernelbase.dll.InitializeAcl",
  1331. "kernelbase.dll.AddAce",
  1332. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1333. "kernel32.dll.IsThreadAFiber",
  1334. "kernel32.dll.OpenProcessToken",
  1335. "kernelbase.dll.GetTokenInformation",
  1336. "kernelbase.dll.DuplicateTokenEx",
  1337. "kernelbase.dll.AdjustTokenPrivileges",
  1338. "kernelbase.dll.AllocateAndInitializeSid",
  1339. "kernelbase.dll.CheckTokenMembership",
  1340. "kernel32.dll.SetThreadToken",
  1341. "oleaut32.dll.#285",
  1342. "advapi32.dll.RegOpenKeyW",
  1343. "ole32.dll.CLSIDFromString",
  1344. "oleaut32.dll.#17",
  1345. "oleaut32.dll.#20",
  1346. "oleaut32.dll.#19",
  1347. "oleaut32.dll.#25",
  1348. "oleaut32.dll.#286",
  1349. "authz.dll.AuthzInitializeContextFromSid",
  1350. "ole32.dll.CoGetCallContext",
  1351. "ole32.dll.CoImpersonateClient",
  1352. "advapi32.dll.OpenThreadToken",
  1353. "ole32.dll.CoRevertToSelf",
  1354. "oleaut32.dll.#8",
  1355. "oleaut32.dll.#9",
  1356. "ole32.dll.CoSwitchCallContext",
  1357. "ntmarta.dll.GetMartaExtensionInterface"
  1358. ]
  1359.  
  1360. [*] Static Analysis: {
  1361. "pe": {
  1362. "peid_signatures": null,
  1363. "imports": [
  1364. {
  1365. "imports": [
  1366. {
  1367. "name": "VirtualAlloc",
  1368. "address": "0x40505c"
  1369. },
  1370. {
  1371. "name": "InterlockedCompareExchange",
  1372. "address": "0x405060"
  1373. },
  1374. {
  1375. "name": "GetStartupInfoA",
  1376. "address": "0x405064"
  1377. },
  1378. {
  1379. "name": "TerminateProcess",
  1380. "address": "0x405068"
  1381. },
  1382. {
  1383. "name": "GetCurrentProcess",
  1384. "address": "0x40506c"
  1385. },
  1386. {
  1387. "name": "UnhandledExceptionFilter",
  1388. "address": "0x405070"
  1389. },
  1390. {
  1391. "name": "SetUnhandledExceptionFilter",
  1392. "address": "0x405074"
  1393. },
  1394. {
  1395. "name": "IsDebuggerPresent",
  1396. "address": "0x405078"
  1397. },
  1398. {
  1399. "name": "QueryPerformanceCounter",
  1400. "address": "0x40507c"
  1401. },
  1402. {
  1403. "name": "GetTickCount",
  1404. "address": "0x405080"
  1405. },
  1406. {
  1407. "name": "GetCurrentThreadId",
  1408. "address": "0x405084"
  1409. },
  1410. {
  1411. "name": "GetCurrentProcessId",
  1412. "address": "0x405088"
  1413. },
  1414. {
  1415. "name": "GetCurrentDirectoryA",
  1416. "address": "0x40508c"
  1417. },
  1418. {
  1419. "name": "GetModuleHandleA",
  1420. "address": "0x405090"
  1421. },
  1422. {
  1423. "name": "Sleep",
  1424. "address": "0x405094"
  1425. },
  1426. {
  1427. "name": "LoadLibraryW",
  1428. "address": "0x405098"
  1429. },
  1430. {
  1431. "name": "GetProcAddress",
  1432. "address": "0x40509c"
  1433. },
  1434. {
  1435. "name": "CreateFileMappingW",
  1436. "address": "0x4050a0"
  1437. },
  1438. {
  1439. "name": "MapViewOfFile",
  1440. "address": "0x4050a4"
  1441. },
  1442. {
  1443. "name": "InterlockedExchange",
  1444. "address": "0x4050a8"
  1445. },
  1446. {
  1447. "name": "GetSystemTimeAsFileTime",
  1448. "address": "0x4050ac"
  1449. }
  1450. ],
  1451. "dll": "KERNEL32.dll"
  1452. },
  1453. {
  1454. "imports": [
  1455. {
  1456. "name": "LoadImageA",
  1457. "address": "0x405174"
  1458. },
  1459. {
  1460. "name": "GetDC",
  1461. "address": "0x405178"
  1462. },
  1463. {
  1464. "name": "UpdateWindow",
  1465. "address": "0x40517c"
  1466. },
  1467. {
  1468. "name": "SetWindowRgn",
  1469. "address": "0x405180"
  1470. },
  1471. {
  1472. "name": "MoveWindow",
  1473. "address": "0x405184"
  1474. },
  1475. {
  1476. "name": "GetWindowRgn",
  1477. "address": "0x405188"
  1478. },
  1479. {
  1480. "name": "DrawIconEx",
  1481. "address": "0x40518c"
  1482. },
  1483. {
  1484. "name": "GetClientRect",
  1485. "address": "0x405190"
  1486. },
  1487. {
  1488. "name": "GetWindowTextA",
  1489. "address": "0x405194"
  1490. },
  1491. {
  1492. "name": "DestroyIcon",
  1493. "address": "0x405198"
  1494. },
  1495. {
  1496. "name": "EndPaint",
  1497. "address": "0x40519c"
  1498. },
  1499. {
  1500. "name": "BeginPaint",
  1501. "address": "0x4051a0"
  1502. },
  1503. {
  1504. "name": "SetCapture",
  1505. "address": "0x4051a4"
  1506. },
  1507. {
  1508. "name": "SendMessageA",
  1509. "address": "0x4051a8"
  1510. },
  1511. {
  1512. "name": "GetParent",
  1513. "address": "0x4051ac"
  1514. },
  1515. {
  1516. "name": "GetWindowLongA",
  1517. "address": "0x4051b0"
  1518. },
  1519. {
  1520. "name": "ReleaseCapture",
  1521. "address": "0x4051b4"
  1522. },
  1523. {
  1524. "name": "GetWindowRect",
  1525. "address": "0x4051b8"
  1526. },
  1527. {
  1528. "name": "SetWindowLongA",
  1529. "address": "0x4051bc"
  1530. },
  1531. {
  1532. "name": "CreateDialogParamA",
  1533. "address": "0x4051c0"
  1534. },
  1535. {
  1536. "name": "GetDlgItem",
  1537. "address": "0x4051c4"
  1538. },
  1539. {
  1540. "name": "ReleaseDC",
  1541. "address": "0x4051c8"
  1542. },
  1543. {
  1544. "name": "PostQuitMessage",
  1545. "address": "0x4051cc"
  1546. },
  1547. {
  1548. "name": "MessageBoxA",
  1549. "address": "0x4051d0"
  1550. },
  1551. {
  1552. "name": "DefWindowProcA",
  1553. "address": "0x4051d4"
  1554. },
  1555. {
  1556. "name": "LoadCursorA",
  1557. "address": "0x4051d8"
  1558. },
  1559. {
  1560. "name": "LoadIconA",
  1561. "address": "0x4051dc"
  1562. },
  1563. {
  1564. "name": "RegisterClassA",
  1565. "address": "0x4051e0"
  1566. },
  1567. {
  1568. "name": "CreateWindowExA",
  1569. "address": "0x4051e4"
  1570. },
  1571. {
  1572. "name": "ShowWindow",
  1573. "address": "0x4051e8"
  1574. },
  1575. {
  1576. "name": "GetMessageA",
  1577. "address": "0x4051ec"
  1578. },
  1579. {
  1580. "name": "TranslateMessage",
  1581. "address": "0x4051f0"
  1582. },
  1583. {
  1584. "name": "DispatchMessageA",
  1585. "address": "0x4051f4"
  1586. }
  1587. ],
  1588. "dll": "USER32.dll"
  1589. },
  1590. {
  1591. "imports": [
  1592. {
  1593. "name": "CreateCompatibleBitmap",
  1594. "address": "0x405000"
  1595. },
  1596. {
  1597. "name": "GetRegionData",
  1598. "address": "0x405004"
  1599. },
  1600. {
  1601. "name": "DeleteDC",
  1602. "address": "0x405008"
  1603. },
  1604. {
  1605. "name": "DeleteObject",
  1606. "address": "0x40500c"
  1607. },
  1608. {
  1609. "name": "CombineRgn",
  1610. "address": "0x405010"
  1611. },
  1612. {
  1613. "name": "CreateRectRgn",
  1614. "address": "0x405014"
  1615. },
  1616. {
  1617. "name": "GetPixel",
  1618. "address": "0x405018"
  1619. },
  1620. {
  1621. "name": "SelectObject",
  1622. "address": "0x40501c"
  1623. },
  1624. {
  1625. "name": "SaveDC",
  1626. "address": "0x405020"
  1627. },
  1628. {
  1629. "name": "GetObjectA",
  1630. "address": "0x405024"
  1631. },
  1632. {
  1633. "name": "CreateCompatibleDC",
  1634. "address": "0x405028"
  1635. },
  1636. {
  1637. "name": "GetRgnBox",
  1638. "address": "0x40502c"
  1639. },
  1640. {
  1641. "name": "CreateRectRgnIndirect",
  1642. "address": "0x405030"
  1643. },
  1644. {
  1645. "name": "BitBlt",
  1646. "address": "0x405034"
  1647. },
  1648. {
  1649. "name": "FrameRgn",
  1650. "address": "0x405038"
  1651. },
  1652. {
  1653. "name": "TextOutA",
  1654. "address": "0x40503c"
  1655. },
  1656. {
  1657. "name": "SetTextColor",
  1658. "address": "0x405040"
  1659. },
  1660. {
  1661. "name": "GetTextExtentPoint32A",
  1662. "address": "0x405044"
  1663. },
  1664. {
  1665. "name": "SetBkMode",
  1666. "address": "0x405048"
  1667. },
  1668. {
  1669. "name": "CreateFontA",
  1670. "address": "0x40504c"
  1671. },
  1672. {
  1673. "name": "PtInRegion",
  1674. "address": "0x405050"
  1675. },
  1676. {
  1677. "name": "GetStockObject",
  1678. "address": "0x405054"
  1679. }
  1680. ],
  1681. "dll": "GDI32.dll"
  1682. },
  1683. {
  1684. "imports": [
  1685. {
  1686. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1687. "address": "0x4050b4"
  1688. },
  1689. {
  1690. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  1691. "address": "0x4050b8"
  1692. },
  1693. {
  1694. "name": "??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z",
  1695. "address": "0x4050bc"
  1696. },
  1697. {
  1698. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z",
  1699. "address": "0x4050c0"
  1700. },
  1701. {
  1702. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1703. "address": "0x4050c4"
  1704. },
  1705. {
  1706. "name": "?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ",
  1707. "address": "0x4050c8"
  1708. },
  1709. {
  1710. "name": "?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ",
  1711. "address": "0x4050cc"
  1712. }
  1713. ],
  1714. "dll": "MSVCP90.dll"
  1715. },
  1716. {
  1717. "imports": [
  1718. {
  1719. "name": "__p__fmode",
  1720. "address": "0x4050d4"
  1721. },
  1722. {
  1723. "name": "__p__commode",
  1724. "address": "0x4050d8"
  1725. },
  1726. {
  1727. "name": "_adjust_fdiv",
  1728. "address": "0x4050dc"
  1729. },
  1730. {
  1731. "name": "__setusermatherr",
  1732. "address": "0x4050e0"
  1733. },
  1734. {
  1735. "name": "_configthreadlocale",
  1736. "address": "0x4050e4"
  1737. },
  1738. {
  1739. "name": "_initterm_e",
  1740. "address": "0x4050e8"
  1741. },
  1742. {
  1743. "name": "__set_app_type",
  1744. "address": "0x4050ec"
  1745. },
  1746. {
  1747. "name": "_acmdln",
  1748. "address": "0x4050f0"
  1749. },
  1750. {
  1751. "name": "exit",
  1752. "address": "0x4050f4"
  1753. },
  1754. {
  1755. "name": "_ismbblead",
  1756. "address": "0x4050f8"
  1757. },
  1758. {
  1759. "name": "_XcptFilter",
  1760. "address": "0x4050fc"
  1761. },
  1762. {
  1763. "name": "_exit",
  1764. "address": "0x405100"
  1765. },
  1766. {
  1767. "name": "_cexit",
  1768. "address": "0x405104"
  1769. },
  1770. {
  1771. "name": "_crt_debugger_hook",
  1772. "address": "0x405108"
  1773. },
  1774. {
  1775. "name": "_except_handler4_common",
  1776. "address": "0x40510c"
  1777. },
  1778. {
  1779. "name": "?terminate@@YAXXZ",
  1780. "address": "0x405110"
  1781. },
  1782. {
  1783. "name": "?_type_info_dtor_internal_method@type_info@@QAEXXZ",
  1784. "address": "0x405114"
  1785. },
  1786. {
  1787. "name": "_invoke_watson",
  1788. "address": "0x405118"
  1789. },
  1790. {
  1791. "name": "_controlfp_s",
  1792. "address": "0x40511c"
  1793. },
  1794. {
  1795. "name": "_initterm",
  1796. "address": "0x405120"
  1797. },
  1798. {
  1799. "name": "malloc",
  1800. "address": "0x405124"
  1801. },
  1802. {
  1803. "name": "strlen",
  1804. "address": "0x405128"
  1805. },
  1806. {
  1807. "name": "fclose",
  1808. "address": "0x40512c"
  1809. },
  1810. {
  1811. "name": "fwrite",
  1812. "address": "0x405130"
  1813. },
  1814. {
  1815. "name": "fopen",
  1816. "address": "0x405134"
  1817. },
  1818. {
  1819. "name": "free",
  1820. "address": "0x405138"
  1821. },
  1822. {
  1823. "name": "??3@YAXPAX@Z",
  1824. "address": "0x40513c"
  1825. },
  1826. {
  1827. "name": "strcat",
  1828. "address": "0x405140"
  1829. },
  1830. {
  1831. "name": "fread",
  1832. "address": "0x405144"
  1833. },
  1834. {
  1835. "name": "feof",
  1836. "address": "0x405148"
  1837. },
  1838. {
  1839. "name": "strcmp",
  1840. "address": "0x40514c"
  1841. },
  1842. {
  1843. "name": "_unlock",
  1844. "address": "0x405150"
  1845. },
  1846. {
  1847. "name": "__dllonexit",
  1848. "address": "0x405154"
  1849. },
  1850. {
  1851. "name": "_encode_pointer",
  1852. "address": "0x405158"
  1853. },
  1854. {
  1855. "name": "_lock",
  1856. "address": "0x40515c"
  1857. },
  1858. {
  1859. "name": "_onexit",
  1860. "address": "0x405160"
  1861. },
  1862. {
  1863. "name": "_decode_pointer",
  1864. "address": "0x405164"
  1865. },
  1866. {
  1867. "name": "_amsg_exit",
  1868. "address": "0x405168"
  1869. },
  1870. {
  1871. "name": "__getmainargs",
  1872. "address": "0x40516c"
  1873. }
  1874. ],
  1875. "dll": "MSVCR90.dll"
  1876. }
  1877. ],
  1878. "digital_signers": null,
  1879. "exported_dll_name": null,
  1880. "actual_checksum": "0x000159b5",
  1881. "overlay": null,
  1882. "imagebase": "0x00400000",
  1883. "reported_checksum": "0x000159b5",
  1884. "icon_hash": null,
  1885. "entrypoint": "0x00403ceb",
  1886. "timestamp": "2019-06-18 14:23:08",
  1887. "osversion": "5.0",
  1888. "sections": [
  1889. {
  1890. "name": ".text",
  1891. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1892. "virtual_address": "0x00001000",
  1893. "size_of_data": "0x00003400",
  1894. "entropy": "5.92",
  1895. "raw_address": "0x00000400",
  1896. "virtual_size": "0x000033af",
  1897. "characteristics_raw": "0x60000020"
  1898. },
  1899. {
  1900. "name": ".rdata",
  1901. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1902. "virtual_address": "0x00005000",
  1903. "size_of_data": "0x0000c200",
  1904. "entropy": "6.18",
  1905. "raw_address": "0x00003800",
  1906. "virtual_size": "0x0000c1c8",
  1907. "characteristics_raw": "0x40000040"
  1908. },
  1909. {
  1910. "name": ".data",
  1911. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1912. "virtual_address": "0x00012000",
  1913. "size_of_data": "0x00000200",
  1914. "entropy": "1.51",
  1915. "raw_address": "0x0000fa00",
  1916. "virtual_size": "0x000004b4",
  1917. "characteristics_raw": "0xc0000040"
  1918. },
  1919. {
  1920. "name": ".rsrc",
  1921. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1922. "virtual_address": "0x00013000",
  1923. "size_of_data": "0x00000400",
  1924. "entropy": "5.19",
  1925. "raw_address": "0x0000fc00",
  1926. "virtual_size": "0x000002b0",
  1927. "characteristics_raw": "0x40000040"
  1928. }
  1929. ],
  1930. "resources": [],
  1931. "dirents": [
  1932. {
  1933. "virtual_address": "0x00000000",
  1934. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1935. "size": "0x00000000"
  1936. },
  1937. {
  1938. "virtual_address": "0x0001057c",
  1939. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1940. "size": "0x00000078"
  1941. },
  1942. {
  1943. "virtual_address": "0x00013000",
  1944. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1945. "size": "0x000002b0"
  1946. },
  1947. {
  1948. "virtual_address": "0x00000000",
  1949. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1950. "size": "0x00000000"
  1951. },
  1952. {
  1953. "virtual_address": "0x00000000",
  1954. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1955. "size": "0x00000000"
  1956. },
  1957. {
  1958. "virtual_address": "0x00000000",
  1959. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1960. "size": "0x00000000"
  1961. },
  1962. {
  1963. "virtual_address": "0x00005230",
  1964. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1965. "size": "0x0000001c"
  1966. },
  1967. {
  1968. "virtual_address": "0x00000000",
  1969. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1970. "size": "0x00000000"
  1971. },
  1972. {
  1973. "virtual_address": "0x00000000",
  1974. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1975. "size": "0x00000000"
  1976. },
  1977. {
  1978. "virtual_address": "0x00000000",
  1979. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1980. "size": "0x00000000"
  1981. },
  1982. {
  1983. "virtual_address": "0x00010330",
  1984. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1985. "size": "0x00000040"
  1986. },
  1987. {
  1988. "virtual_address": "0x00000000",
  1989. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1990. "size": "0x00000000"
  1991. },
  1992. {
  1993. "virtual_address": "0x00005000",
  1994. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1995. "size": "0x000001fc"
  1996. },
  1997. {
  1998. "virtual_address": "0x00000000",
  1999. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2000. "size": "0x00000000"
  2001. },
  2002. {
  2003. "virtual_address": "0x00000000",
  2004. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2005. "size": "0x00000000"
  2006. },
  2007. {
  2008. "virtual_address": "0x00000000",
  2009. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2010. "size": "0x00000000"
  2011. }
  2012. ],
  2013. "exports": [],
  2014. "guest_signers": {},
  2015. "imphash": "a5e07b9d885d7be2b11371ae68839d0c",
  2016. "icon_fuzzy": null,
  2017. "icon": null,
  2018. "pdbpath": "c:\\Users\\User\\Desktop\\DReY_Shape1667871152003\\Release\\ShapeGradientButton.pdb",
  2019. "imported_dll_count": 5,
  2020. "versioninfo": []
  2021. }
  2022. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!