API tools faq
paste
paladin316

file_9.json

paladin316
Jun 19th, 2019
2,211
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 46.59 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "file.9"
  7. [*] File Size: 2542592
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "bfcde7f66c042845af095b5600d1e7a383926e2836624f7eb1690b078e9cfe28"
  10. [*] MD5: "c4c6fe64765bc68c0d6fcaf2765b5319"
  11. [*] SHA1: "a988b152469a8b22052377d4127f0a3ee0a92927"
  12. [*] SHA512: "82c891297ca784c0a6f07a307083064210e6773d0b771481b9e2aee2b477b099820165bb9ea862f651cb47890431638207a002d99d06a36fe8d77af7e9f2646d"
  13. [*] CRC32: "39218A7C"
  14. [*] SSDEEP: "12288:VyDlQMzt2cMBuxTtupk5dZXcpLiJ1UbYZDfj:VyWp"
  15.  
  16. [*] Process Execution: [
  17. "file.9",
  18. "file.9"
  19. ]
  20.  
  21. [*] Signatures Detected: [
  22. {
  23. "Description": "Creates RWX memory",
  24. "Details": []
  25. },
  26. {
  27. "Description": "Executed a process and injected code into it, probably while unpacking",
  28. "Details": [
  29. {
  30. "Injection": "file.9(1436) -> file.9(2492)"
  31. }
  32. ]
  33. },
  34. {
  35. "Description": "File has been identified by 54 Antiviruses on VirusTotal as malicious",
  36. "Details": [
  37. {
  38. "MicroWorld-eScan": "Trojan.GenericKD.31923015"
  39. },
  40. {
  41. "CAT-QuickHeal": "Trojan.MSIL"
  42. },
  43. {
  44. "McAfee": "GenericRXHS-BM!C4C6FE64765B"
  45. },
  46. {
  47. "Malwarebytes": "Trojan.Injector"
  48. },
  49. {
  50. "Alibaba": "Trojan:MSIL/Inject.59df6a90"
  51. },
  52. {
  53. "K7GW": "Trojan ( 0054ceec1 )"
  54. },
  55. {
  56. "K7AntiVirus": "Trojan ( 0054ceec1 )"
  57. },
  58. {
  59. "Arcabit": "Trojan.Generic.D1E71B47"
  60. },
  61. {
  62. "Invincea": "heuristic"
  63. },
  64. {
  65. "Symantec": "Trojan.Gen.MBT"
  66. },
  67. {
  68. "APEX": "Malicious"
  69. },
  70. {
  71. "Avast": "Win32:Trojan-gen"
  72. },
  73. {
  74. "GData": "Trojan.GenericKD.31923015"
  75. },
  76. {
  77. "Kaspersky": "Trojan.MSIL.Inject.accty"
  78. },
  79. {
  80. "BitDefender": "Trojan.GenericKD.31923015"
  81. },
  82. {
  83. "NANO-Antivirus": "Trojan.Win32.Inject.fpozsa"
  84. },
  85. {
  86. "Paloalto": "generic.ml"
  87. },
  88. {
  89. "ViRobot": "Trojan.Win32.Z.Unwaders.2542592"
  90. },
  91. {
  92. "Tencent": "Msil.Trojan.Inject.Szle"
  93. },
  94. {
  95. "Ad-Aware": "Trojan.GenericKD.31923015"
  96. },
  97. {
  98. "Sophos": "Mal/Generic-S"
  99. },
  100. {
  101. "Comodo": "Malware@#ipj2l9lxiff8"
  102. },
  103. {
  104. "F-Secure": "Trojan.TR/ATRAPS.Gen"
  105. },
  106. {
  107. "DrWeb": "Trojan.Starter.2890"
  108. },
  109. {
  110. "TrendMicro": "TROJ_GEN.R002C0PDR19"
  111. },
  112. {
  113. "McAfee-GW-Edition": "GenericRXHS-BM!C4C6FE64765B"
  114. },
  115. {
  116. "Trapmine": "malicious.high.ml.score"
  117. },
  118. {
  119. "FireEye": "Generic.mg.c4c6fe64765bc68c"
  120. },
  121. {
  122. "Emsisoft": "Trojan.GenericKD.31923015 (B)"
  123. },
  124. {
  125. "SentinelOne": "DFI - Malicious PE"
  126. },
  127. {
  128. "Cyren": "W32/Trojan.XXOV-9075"
  129. },
  130. {
  131. "Avira": "TR/ATRAPS.Gen"
  132. },
  133. {
  134. "Antiy-AVL": "Trojan/MSIL.Inject"
  135. },
  136. {
  137. "Microsoft": "Trojan:Win32/Tiggre!plock"
  138. },
  139. {
  140. "Endgame": "malicious (high confidence)"
  141. },
  142. {
  143. "AegisLab": "Trojan.MSIL.Inject.4!c"
  144. },
  145. {
  146. "ZoneAlarm": "Trojan.MSIL.Inject.accty"
  147. },
  148. {
  149. "AhnLab-V3": "HackTool/Win32.PassViewer.C3175239"
  150. },
  151. {
  152. "ALYac": "Trojan.GenericKD.31923015"
  153. },
  154. {
  155. "MAX": "malware (ai score=100)"
  156. },
  157. {
  158. "Cylance": "Unsafe"
  159. },
  160. {
  161. "ESET-NOD32": "a variant of MSIL/GenKryptik.DCTC"
  162. },
  163. {
  164. "TrendMicro-HouseCall": "TROJ_GEN.R002C0PDR19"
  165. },
  166. {
  167. "Rising": "Trojan.GenKryptik!8.AA55 (CLOUD)"
  168. },
  169. {
  170. "Yandex": "Trojan.Inject!2Auc+CceK5M"
  171. },
  172. {
  173. "Ikarus": "Trojan.MSIL.Krypt"
  174. },
  175. {
  176. "MaxSecure": "Trojan.Malware.9677582.susgen"
  177. },
  178. {
  179. "Fortinet": "MSIL/GenKryptik.DCTC!tr"
  180. },
  181. {
  182. "Webroot": "W32.Trojan.Gen"
  183. },
  184. {
  185. "AVG": "Win32:Trojan-gen"
  186. },
  187. {
  188. "Cybereason": "malicious.2469a8"
  189. },
  190. {
  191. "Panda": "Trj/CI.A"
  192. },
  193. {
  194. "CrowdStrike": "win/malicious_confidence_90% (W)"
  195. },
  196. {
  197. "Qihoo-360": "Win32/Trojan.848"
  198. }
  199. ]
  200. },
  201. {
  202. "Description": "Harvests information related to installed instant messenger clients",
  203. "Details": [
  204. {
  205. "key": "HKEY_CURRENT_USER\\Software\\Google\\Google Talk\\Accounts"
  206. }
  207. ]
  208. },
  209. {
  210. "Description": "Harvests information related to installed mail clients",
  211. "Details": [
  212. {
  213. "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows Live Mail\\*.oeaccount"
  214. },
  215. {
  216. "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows Live Mail\\*.*"
  217. },
  218. {
  219. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles"
  220. },
  221. {
  222. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  223. },
  224. {
  225. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  226. },
  227. {
  228. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User"
  229. },
  230. {
  231. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  232. },
  233. {
  234. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  235. },
  236. {
  237. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  238. },
  239. {
  240. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User"
  241. },
  242. {
  243. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  244. },
  245. {
  246. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  247. },
  248. {
  249. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  250. },
  251. {
  252. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  253. },
  254. {
  255. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  256. },
  257. {
  258. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User"
  259. },
  260. {
  261. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  262. },
  263. {
  264. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  265. },
  266. {
  267. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP User"
  268. },
  269. {
  270. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  271. },
  272. {
  273. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User"
  274. },
  275. {
  276. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  277. },
  278. {
  279. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User"
  280. },
  281. {
  282. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User"
  283. },
  284. {
  285. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  286. },
  287. {
  288. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  289. },
  290. {
  291. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  292. },
  293. {
  294. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP User"
  295. },
  296. {
  297. "key": "HKEY_CURRENT_USER\\Identities\\{0A258175-2D14-4D69-9955-E200F247250F}\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"
  298. },
  299. {
  300. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"
  301. },
  302. {
  303. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  304. },
  305. {
  306. "key": "HKEY_CURRENT_USER\\Identities\\{0A258175-2D14-4D69-9955-E200F247250F}\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  307. }
  308. ]
  309. }
  310. ]
  311.  
  312. [*] Started Service: []
  313.  
  314. [*] Executed Commands: [
  315. "C:\\Users\\user\\AppData\\Local\\Temp\\file.9"
  316. ]
  317.  
  318. [*] Mutexes: [
  319. "Global\\CLR_CASOFF_MUTEX",
  320. "CicLoadWinStaWinSta0",
  321. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  322. ]
  323.  
  324. [*] Modified Files: []
  325.  
  326. [*] Deleted Files: [
  327. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1436.24139500",
  328. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1436.24139500",
  329. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1436.24139500"
  330. ]
  331.  
  332. [*] Modified Registry Keys: []
  333.  
  334. [*] Deleted Registry Keys: []
  335.  
  336. [*] DNS Communications: []
  337.  
  338. [*] Domains: []
  339.  
  340. [*] Network Communication - ICMP: []
  341.  
  342. [*] Network Communication - HTTP: []
  343.  
  344. [*] Network Communication - SMTP: []
  345.  
  346. [*] Network Communication - Hosts: []
  347.  
  348. [*] Network Communication - IRC: []
  349.  
  350. [*] Static Analysis: {
  351. "dotnet": {
  352. "customattrs": null,
  353. "assemblyinfo": {
  354. "version": "3.3.2.1",
  355. "name": "Doctorpol"
  356. },
  357. "assemblyrefs": [
  358. {
  359. "version": "2.0.0.0",
  360. "name": "mscorlib"
  361. },
  362. {
  363. "version": "8.0.0.0",
  364. "name": "Microsoft.VisualBasic"
  365. },
  366. {
  367. "version": "2.0.0.0",
  368. "name": "System.Windows.Forms"
  369. },
  370. {
  371. "version": "2.0.0.0",
  372. "name": "System"
  373. }
  374. ],
  375. "typerefs": [
  376. {
  377. "typename": "Microsoft.VisualBasic.ApplicationServices.ConsoleApplicationBase",
  378. "assembly": "Microsoft.VisualBasic"
  379. },
  380. {
  381. "typename": "Microsoft.VisualBasic.ApplicationServices.User",
  382. "assembly": "Microsoft.VisualBasic"
  383. },
  384. {
  385. "typename": "Microsoft.VisualBasic.CompilerServices.Conversions",
  386. "assembly": "Microsoft.VisualBasic"
  387. },
  388. {
  389. "typename": "Microsoft.VisualBasic.CompilerServices.NewLateBinding",
  390. "assembly": "Microsoft.VisualBasic"
  391. },
  392. {
  393. "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
  394. "assembly": "Microsoft.VisualBasic"
  395. },
  396. {
  397. "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
  398. "assembly": "Microsoft.VisualBasic"
  399. },
  400. {
  401. "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
  402. "assembly": "Microsoft.VisualBasic"
  403. },
  404. {
  405. "typename": "Microsoft.VisualBasic.Devices.Computer",
  406. "assembly": "Microsoft.VisualBasic"
  407. },
  408. {
  409. "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
  410. "assembly": "Microsoft.VisualBasic"
  411. },
  412. {
  413. "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
  414. "assembly": "Microsoft.VisualBasic"
  415. },
  416. {
  417. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  418. "assembly": "System"
  419. },
  420. {
  421. "typename": "System.ComponentModel.Component",
  422. "assembly": "System"
  423. },
  424. {
  425. "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
  426. "assembly": "System"
  427. },
  428. {
  429. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  430. "assembly": "System"
  431. },
  432. {
  433. "typename": "System.ComponentModel.EditorBrowsableState",
  434. "assembly": "System"
  435. },
  436. {
  437. "typename": "System.Configuration.ApplicationSettingsBase",
  438. "assembly": "System"
  439. },
  440. {
  441. "typename": "System.Configuration.SettingsBase",
  442. "assembly": "System"
  443. },
  444. {
  445. "typename": "System.Windows.Forms.Application",
  446. "assembly": "System.Windows.Forms"
  447. },
  448. {
  449. "typename": "System.Windows.Forms.Control",
  450. "assembly": "System.Windows.Forms"
  451. },
  452. {
  453. "typename": "System.Windows.Forms.Form",
  454. "assembly": "System.Windows.Forms"
  455. },
  456. {
  457. "typename": "System.Activator",
  458. "assembly": "mscorlib"
  459. },
  460. {
  461. "typename": "System.Array",
  462. "assembly": "mscorlib"
  463. },
  464. {
  465. "typename": "System.Byte",
  466. "assembly": "mscorlib"
  467. },
  468. {
  469. "typename": "System.Collections.Hashtable",
  470. "assembly": "mscorlib"
  471. },
  472. {
  473. "typename": "System.Convert",
  474. "assembly": "mscorlib"
  475. },
  476. {
  477. "typename": "System.Diagnostics.DebuggableAttribute",
  478. "assembly": "mscorlib"
  479. },
  480. {
  481. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  482. "assembly": "mscorlib"
  483. },
  484. {
  485. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  486. "assembly": "mscorlib"
  487. },
  488. {
  489. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  490. "assembly": "mscorlib"
  491. },
  492. {
  493. "typename": "System.Exception",
  494. "assembly": "mscorlib"
  495. },
  496. {
  497. "typename": "System.Globalization.CultureInfo",
  498. "assembly": "mscorlib"
  499. },
  500. {
  501. "typename": "System.IO.MemoryStream",
  502. "assembly": "mscorlib"
  503. },
  504. {
  505. "typename": "System.IO.Stream",
  506. "assembly": "mscorlib"
  507. },
  508. {
  509. "typename": "System.InvalidOperationException",
  510. "assembly": "mscorlib"
  511. },
  512. {
  513. "typename": "System.Object",
  514. "assembly": "mscorlib"
  515. },
  516. {
  517. "typename": "System.Reflection.Assembly",
  518. "assembly": "mscorlib"
  519. },
  520. {
  521. "typename": "System.Reflection.AssemblyCompanyAttribute",
  522. "assembly": "mscorlib"
  523. },
  524. {
  525. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  526. "assembly": "mscorlib"
  527. },
  528. {
  529. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  530. "assembly": "mscorlib"
  531. },
  532. {
  533. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  534. "assembly": "mscorlib"
  535. },
  536. {
  537. "typename": "System.Reflection.AssemblyProductAttribute",
  538. "assembly": "mscorlib"
  539. },
  540. {
  541. "typename": "System.Reflection.AssemblyTitleAttribute",
  542. "assembly": "mscorlib"
  543. },
  544. {
  545. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  546. "assembly": "mscorlib"
  547. },
  548. {
  549. "typename": "System.Reflection.MethodInfo",
  550. "assembly": "mscorlib"
  551. },
  552. {
  553. "typename": "System.Reflection.TargetInvocationException",
  554. "assembly": "mscorlib"
  555. },
  556. {
  557. "typename": "System.Resources.ResourceManager",
  558. "assembly": "mscorlib"
  559. },
  560. {
  561. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  562. "assembly": "mscorlib"
  563. },
  564. {
  565. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  566. "assembly": "mscorlib"
  567. },
  568. {
  569. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  570. "assembly": "mscorlib"
  571. },
  572. {
  573. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  574. "assembly": "mscorlib"
  575. },
  576. {
  577. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  578. "assembly": "mscorlib"
  579. },
  580. {
  581. "typename": "System.Runtime.InteropServices.GuidAttribute",
  582. "assembly": "mscorlib"
  583. },
  584. {
  585. "typename": "System.RuntimeTypeHandle",
  586. "assembly": "mscorlib"
  587. },
  588. {
  589. "typename": "System.STAThreadAttribute",
  590. "assembly": "mscorlib"
  591. },
  592. {
  593. "typename": "System.Security.Cryptography.CryptoStream",
  594. "assembly": "mscorlib"
  595. },
  596. {
  597. "typename": "System.Security.Cryptography.CryptoStreamMode",
  598. "assembly": "mscorlib"
  599. },
  600. {
  601. "typename": "System.Security.Cryptography.HashAlgorithm",
  602. "assembly": "mscorlib"
  603. },
  604. {
  605. "typename": "System.Security.Cryptography.ICryptoTransform",
  606. "assembly": "mscorlib"
  607. },
  608. {
  609. "typename": "System.Security.Cryptography.SHA1CryptoServiceProvider",
  610. "assembly": "mscorlib"
  611. },
  612. {
  613. "typename": "System.Security.Cryptography.SymmetricAlgorithm",
  614. "assembly": "mscorlib"
  615. },
  616. {
  617. "typename": "System.Security.Cryptography.TripleDES",
  618. "assembly": "mscorlib"
  619. },
  620. {
  621. "typename": "System.Security.Cryptography.TripleDESCryptoServiceProvider",
  622. "assembly": "mscorlib"
  623. },
  624. {
  625. "typename": "System.String",
  626. "assembly": "mscorlib"
  627. },
  628. {
  629. "typename": "System.Text.Encoding",
  630. "assembly": "mscorlib"
  631. },
  632. {
  633. "typename": "System.ThreadStaticAttribute",
  634. "assembly": "mscorlib"
  635. },
  636. {
  637. "typename": "System.Type",
  638. "assembly": "mscorlib"
  639. }
  640. ]
  641. },
  642. "pe": {
  643. "peid_signatures": null,
  644. "imports": [
  645. {
  646. "imports": [
  647. {
  648. "name": "_CorExeMain",
  649. "address": "0x402000"
  650. }
  651. ],
  652. "dll": "mscoree.dll"
  653. }
  654. ],
  655. "digital_signers": null,
  656. "exported_dll_name": null,
  657. "actual_checksum": "0x00272d76",
  658. "overlay": {
  659. "size": "0x00200000",
  660. "offset": "0x0006cc00"
  661. },
  662. "imagebase": "0x00400000",
  663. "reported_checksum": "0x00000000",
  664. "icon_hash": null,
  665. "entrypoint": "0x0045504e",
  666. "timestamp": "2019-04-17 14:19:49",
  667. "osversion": "4.0",
  668. "sections": [
  669. {
  670. "name": ".text",
  671. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  672. "virtual_address": "0x00002000",
  673. "size_of_data": "0x00053200",
  674. "entropy": "4.24",
  675. "raw_address": "0x00000400",
  676. "virtual_size": "0x00053054",
  677. "characteristics_raw": "0x60000020"
  678. },
  679. {
  680. "name": ".sdata",
  681. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  682. "virtual_address": "0x00056000",
  683. "size_of_data": "0x00000200",
  684. "entropy": "1.99",
  685. "raw_address": "0x00053600",
  686. "virtual_size": "0x00000138",
  687. "characteristics_raw": "0xc0000040"
  688. },
  689. {
  690. "name": ".rsrc",
  691. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  692. "virtual_address": "0x00058000",
  693. "size_of_data": "0x00019200",
  694. "entropy": "0.93",
  695. "raw_address": "0x00053800",
  696. "virtual_size": "0x000190c0",
  697. "characteristics_raw": "0x40000040"
  698. },
  699. {
  700. "name": ".reloc",
  701. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  702. "virtual_address": "0x00072000",
  703. "size_of_data": "0x00000200",
  704. "entropy": "0.10",
  705. "raw_address": "0x0006ca00",
  706. "virtual_size": "0x0000000c",
  707. "characteristics_raw": "0x42000040"
  708. }
  709. ],
  710. "resources": [],
  711. "dirents": [
  712. {
  713. "virtual_address": "0x00000000",
  714. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  715. "size": "0x00000000"
  716. },
  717. {
  718. "virtual_address": "0x00055000",
  719. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  720. "size": "0x0000004b"
  721. },
  722. {
  723. "virtual_address": "0x00058000",
  724. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  725. "size": "0x000190c0"
  726. },
  727. {
  728. "virtual_address": "0x00000000",
  729. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  730. "size": "0x00000000"
  731. },
  732. {
  733. "virtual_address": "0x00000000",
  734. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  735. "size": "0x00000000"
  736. },
  737. {
  738. "virtual_address": "0x00072000",
  739. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  740. "size": "0x0000000c"
  741. },
  742. {
  743. "virtual_address": "0x00056000",
  744. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  745. "size": "0x0000001c"
  746. },
  747. {
  748. "virtual_address": "0x00000000",
  749. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  750. "size": "0x00000000"
  751. },
  752. {
  753. "virtual_address": "0x00000000",
  754. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  755. "size": "0x00000000"
  756. }
  757. ],
  758. "exports": [],
  759. "guest_signers": {},
  760. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  761. "icon_fuzzy": null,
  762. "icon": null,
  763. "pdbpath": "C:\\Users\\Android\\AppData\\Local\\Temp\\AgaYHfLgBL\\Doctorpol\\obj\\x86\\Debug\\Doctorpol.pdb",
  764. "imported_dll_count": 1,
  765. "versioninfo": []
  766. }
  767. }
  768.  
  769. [*] Resolved APIs: [
  770. "advapi32.dll.RegOpenKeyExW",
  771. "advapi32.dll.RegQueryInfoKeyW",
  772. "advapi32.dll.RegEnumKeyExW",
  773. "advapi32.dll.RegEnumValueW",
  774. "advapi32.dll.RegCloseKey",
  775. "advapi32.dll.RegQueryValueExW",
  776. "kernel32.dll.QueryActCtxW",
  777. "shlwapi.dll.UrlIsW",
  778. "kernel32.dll.FlsAlloc",
  779. "kernel32.dll.FlsGetValue",
  780. "kernel32.dll.FlsSetValue",
  781. "kernel32.dll.FlsFree",
  782. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  783. "kernel32.dll.IsProcessorFeaturePresent",
  784. "msvcrt.dll._set_error_mode",
  785. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  786. "kernel32.dll.FindActCtxSectionStringW",
  787. "kernel32.dll.GetSystemWindowsDirectoryW",
  788. "mscoree.dll.GetProcessExecutableHeap",
  789. "mscorwks.dll._CorExeMain",
  790. "mscorwks.dll.GetCLRFunction",
  791. "advapi32.dll.RegisterTraceGuidsW",
  792. "advapi32.dll.UnregisterTraceGuids",
  793. "advapi32.dll.GetTraceLoggerHandle",
  794. "advapi32.dll.GetTraceEnableLevel",
  795. "advapi32.dll.GetTraceEnableFlags",
  796. "advapi32.dll.TraceEvent",
  797. "mscoree.dll.IEE",
  798. "mscorwks.dll.IEE",
  799. "mscoree.dll.GetStartupFlags",
  800. "mscoree.dll.GetHostConfigurationFile",
  801. "mscoree.dll.GetCORSystemDirectory",
  802. "ntdll.dll.RtlUnwind",
  803. "kernel32.dll.IsWow64Process",
  804. "advapi32.dll.AllocateAndInitializeSid",
  805. "advapi32.dll.OpenProcessToken",
  806. "advapi32.dll.GetTokenInformation",
  807. "advapi32.dll.InitializeAcl",
  808. "advapi32.dll.AddAccessAllowedAce",
  809. "advapi32.dll.FreeSid",
  810. "kernel32.dll.SetThreadStackGuarantee",
  811. "kernel32.dll.AddVectoredContinueHandler",
  812. "kernel32.dll.RemoveVectoredContinueHandler",
  813. "advapi32.dll.ConvertSidToStringSidW",
  814. "shell32.dll.SHGetFolderPathW",
  815. "kernel32.dll.FlushProcessWriteBuffers",
  816. "kernel32.dll.GetWriteWatch",
  817. "kernel32.dll.ResetWriteWatch",
  818. "kernel32.dll.CreateMemoryResourceNotification",
  819. "kernel32.dll.QueryMemoryResourceNotification",
  820. "mscoree.dll._CorExeMain",
  821. "mscoree.dll._CorImageUnloading",
  822. "mscoree.dll._CorValidateImage",
  823. "ole32.dll.CoInitializeEx",
  824. "cryptbase.dll.SystemFunction036",
  825. "uxtheme.dll.ThemeInitApiHook",
  826. "user32.dll.IsProcessDPIAware",
  827. "ole32.dll.CoGetContextToken",
  828. "kernel32.dll.GetFullPathNameW",
  829. "kernel32.dll.GetVersionExW",
  830. "advapi32.dll.CryptAcquireContextA",
  831. "advapi32.dll.CryptReleaseContext",
  832. "advapi32.dll.CryptCreateHash",
  833. "advapi32.dll.CryptDestroyHash",
  834. "advapi32.dll.CryptHashData",
  835. "advapi32.dll.CryptGetHashParam",
  836. "advapi32.dll.CryptImportKey",
  837. "advapi32.dll.CryptExportKey",
  838. "advapi32.dll.CryptGenKey",
  839. "advapi32.dll.CryptGetKeyParam",
  840. "advapi32.dll.CryptDestroyKey",
  841. "advapi32.dll.CryptVerifySignatureA",
  842. "advapi32.dll.CryptSignHashA",
  843. "advapi32.dll.CryptGetProvParam",
  844. "advapi32.dll.CryptGetUserKey",
  845. "advapi32.dll.CryptEnumProvidersA",
  846. "mscoree.dll.GetMetaDataInternalInterface",
  847. "mscorwks.dll.GetMetaDataInternalInterface",
  848. "mscorjit.dll.getJit",
  849. "cryptsp.dll.CryptAcquireContextW",
  850. "cryptsp.dll.CryptGetProvParam",
  851. "cryptsp.dll.CryptCreateHash",
  852. "cryptsp.dll.CryptHashData",
  853. "cryptsp.dll.CryptGetHashParam",
  854. "cryptsp.dll.CryptDestroyHash",
  855. "kernel32.dll.GlobalMemoryStatusEx",
  856. "kernel32.dll.SwitchToThread",
  857. "cryptsp.dll.CryptImportKey",
  858. "cryptsp.dll.CryptSetKeyParam",
  859. "cryptsp.dll.CryptDecrypt",
  860. "cryptsp.dll.CryptEncrypt",
  861. "kernel32.dll.lstrlen",
  862. "kernel32.dll.lstrlenW",
  863. "kernel32.dll.GetUserDefaultUILanguage",
  864. "kernel32.dll.LoadLibraryA",
  865. "kernel32.dll.GetProcAddress",
  866. "kernel32.dll.CreateProcessA",
  867. "ntdll.dll.NtUnmapViewOfSection",
  868. "kernel32.dll.VirtualAllocEx",
  869. "ntdll.dll.NtWriteVirtualMemory",
  870. "ntdll.dll.NtReadVirtualMemory",
  871. "ntdll.dll.NtGetContextThread",
  872. "ntdll.dll.NtSetContextThread",
  873. "ntdll.dll.NtResumeThread",
  874. "ntdll.dll.NtQueryInformationProcess",
  875. "msvcrt.dll.memcpy",
  876. "kernel32.dll.LocalAlloc",
  877. "kernel32.dll.RtlMoveMemory",
  878. "kernel32.dll.VirtualProtect",
  879. "kernel32.dll.LocalFree",
  880. "ole32.dll.CoWaitForMultipleHandles",
  881. "cryptsp.dll.CryptDestroyKey",
  882. "cryptsp.dll.CryptReleaseContext",
  883. "sechost.dll.LookupAccountNameLocalW",
  884. "advapi32.dll.LookupAccountSidW",
  885. "sechost.dll.LookupAccountSidLocalW",
  886. "cryptsp.dll.CryptGenRandom",
  887. "ole32.dll.NdrOleInitializeExtension",
  888. "ole32.dll.CoGetClassObject",
  889. "ole32.dll.CoGetMarshalSizeMax",
  890. "ole32.dll.CoMarshalInterface",
  891. "ole32.dll.CoUnmarshalInterface",
  892. "ole32.dll.StringFromIID",
  893. "ole32.dll.CoGetPSClsid",
  894. "ole32.dll.CoTaskMemAlloc",
  895. "ole32.dll.CoTaskMemFree",
  896. "ole32.dll.CoCreateInstance",
  897. "ole32.dll.CoReleaseMarshalData",
  898. "ole32.dll.DcomChannelSetHResult",
  899. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  900. "kernel32.dll.CreateActCtxW",
  901. "kernel32.dll.AddRefActCtx",
  902. "kernel32.dll.ReleaseActCtx",
  903. "kernel32.dll.ActivateActCtx",
  904. "kernel32.dll.DeactivateActCtx",
  905. "kernel32.dll.GetCurrentActCtx",
  906. "comctl32.dll.InitCommonControlsEx",
  907. "shell32.dll.SHGetSpecialFolderPathA",
  908. "dwmapi.dll.DwmIsCompositionEnabled",
  909. "gdi32.dll.GetLayout",
  910. "gdi32.dll.GdiRealizationInfo",
  911. "gdi32.dll.FontIsLinked",
  912. "gdi32.dll.GetTextFaceAliasW",
  913. "gdi32.dll.GetFontAssocStatus",
  914. "advapi32.dll.RegQueryValueExA",
  915. "user32.dll.NotifyWinEvent",
  916. "lpk.dll.LpkEditControl",
  917. "comctl32.dll.HIMAGELIST_QueryInterface",
  918. "comctl32.dll.DrawShadowText",
  919. "comctl32.dll.DrawSizeBox",
  920. "comctl32.dll.DrawScrollBar",
  921. "comctl32.dll.SizeBoxHwnd",
  922. "comctl32.dll.ScrollBar_MouseMove",
  923. "comctl32.dll.ScrollBar_Menu",
  924. "comctl32.dll.HandleScrollCmd",
  925. "comctl32.dll.DetachScrollBars",
  926. "comctl32.dll.AttachScrollBars",
  927. "comctl32.dll.CCSetScrollInfo",
  928. "comctl32.dll.CCGetScrollInfo",
  929. "comctl32.dll.CCEnableScrollBar",
  930. "comctl32.dll.QuerySystemGestureStatus",
  931. "uxtheme.dll.#49",
  932. "uxtheme.dll.DrawThemeBackground",
  933. "uxtheme.dll.GetThemeBackgroundContentRect",
  934. "uxtheme.dll.GetThemePartSize",
  935. "gdi32.dll.GdiIsMetaPrintDC",
  936. "ole32.dll.CoUninitialize",
  937. "ole32.dll.CoRegisterInitializeSpy",
  938. "ole32.dll.CoRevokeInitializeSpy",
  939. "kernel32.dll.SortGetHandle",
  940. "kernel32.dll.SortCloseHandle",
  941. "pstorec.dll.PStoreCreateInstance",
  942. "crypt32.dll.CryptUnprotectData",
  943. "advapi32.dll.CredReadA",
  944. "advapi32.dll.CredFree",
  945. "advapi32.dll.CredDeleteA",
  946. "advapi32.dll.CredEnumerateA",
  947. "advapi32.dll.CredEnumerateW",
  948. "uxtheme.dll.GetThemeTransitionDuration",
  949. "user32.dll.TrackMouseEvent"
  950. ]
  951.  
  952. [*] Static Analysis: {
  953. "dotnet": {
  954. "customattrs": null,
  955. "assemblyinfo": {
  956. "version": "3.3.2.1",
  957. "name": "Doctorpol"
  958. },
  959. "assemblyrefs": [
  960. {
  961. "version": "2.0.0.0",
  962. "name": "mscorlib"
  963. },
  964. {
  965. "version": "8.0.0.0",
  966. "name": "Microsoft.VisualBasic"
  967. },
  968. {
  969. "version": "2.0.0.0",
  970. "name": "System.Windows.Forms"
  971. },
  972. {
  973. "version": "2.0.0.0",
  974. "name": "System"
  975. }
  976. ],
  977. "typerefs": [
  978. {
  979. "typename": "Microsoft.VisualBasic.ApplicationServices.ConsoleApplicationBase",
  980. "assembly": "Microsoft.VisualBasic"
  981. },
  982. {
  983. "typename": "Microsoft.VisualBasic.ApplicationServices.User",
  984. "assembly": "Microsoft.VisualBasic"
  985. },
  986. {
  987. "typename": "Microsoft.VisualBasic.CompilerServices.Conversions",
  988. "assembly": "Microsoft.VisualBasic"
  989. },
  990. {
  991. "typename": "Microsoft.VisualBasic.CompilerServices.NewLateBinding",
  992. "assembly": "Microsoft.VisualBasic"
  993. },
  994. {
  995. "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
  996. "assembly": "Microsoft.VisualBasic"
  997. },
  998. {
  999. "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
  1000. "assembly": "Microsoft.VisualBasic"
  1001. },
  1002. {
  1003. "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
  1004. "assembly": "Microsoft.VisualBasic"
  1005. },
  1006. {
  1007. "typename": "Microsoft.VisualBasic.Devices.Computer",
  1008. "assembly": "Microsoft.VisualBasic"
  1009. },
  1010. {
  1011. "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
  1012. "assembly": "Microsoft.VisualBasic"
  1013. },
  1014. {
  1015. "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
  1016. "assembly": "Microsoft.VisualBasic"
  1017. },
  1018. {
  1019. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  1020. "assembly": "System"
  1021. },
  1022. {
  1023. "typename": "System.ComponentModel.Component",
  1024. "assembly": "System"
  1025. },
  1026. {
  1027. "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
  1028. "assembly": "System"
  1029. },
  1030. {
  1031. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  1032. "assembly": "System"
  1033. },
  1034. {
  1035. "typename": "System.ComponentModel.EditorBrowsableState",
  1036. "assembly": "System"
  1037. },
  1038. {
  1039. "typename": "System.Configuration.ApplicationSettingsBase",
  1040. "assembly": "System"
  1041. },
  1042. {
  1043. "typename": "System.Configuration.SettingsBase",
  1044. "assembly": "System"
  1045. },
  1046. {
  1047. "typename": "System.Windows.Forms.Application",
  1048. "assembly": "System.Windows.Forms"
  1049. },
  1050. {
  1051. "typename": "System.Windows.Forms.Control",
  1052. "assembly": "System.Windows.Forms"
  1053. },
  1054. {
  1055. "typename": "System.Windows.Forms.Form",
  1056. "assembly": "System.Windows.Forms"
  1057. },
  1058. {
  1059. "typename": "System.Activator",
  1060. "assembly": "mscorlib"
  1061. },
  1062. {
  1063. "typename": "System.Array",
  1064. "assembly": "mscorlib"
  1065. },
  1066. {
  1067. "typename": "System.Byte",
  1068. "assembly": "mscorlib"
  1069. },
  1070. {
  1071. "typename": "System.Collections.Hashtable",
  1072. "assembly": "mscorlib"
  1073. },
  1074. {
  1075. "typename": "System.Convert",
  1076. "assembly": "mscorlib"
  1077. },
  1078. {
  1079. "typename": "System.Diagnostics.DebuggableAttribute",
  1080. "assembly": "mscorlib"
  1081. },
  1082. {
  1083. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  1084. "assembly": "mscorlib"
  1085. },
  1086. {
  1087. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  1088. "assembly": "mscorlib"
  1089. },
  1090. {
  1091. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  1092. "assembly": "mscorlib"
  1093. },
  1094. {
  1095. "typename": "System.Exception",
  1096. "assembly": "mscorlib"
  1097. },
  1098. {
  1099. "typename": "System.Globalization.CultureInfo",
  1100. "assembly": "mscorlib"
  1101. },
  1102. {
  1103. "typename": "System.IO.MemoryStream",
  1104. "assembly": "mscorlib"
  1105. },
  1106. {
  1107. "typename": "System.IO.Stream",
  1108. "assembly": "mscorlib"
  1109. },
  1110. {
  1111. "typename": "System.InvalidOperationException",
  1112. "assembly": "mscorlib"
  1113. },
  1114. {
  1115. "typename": "System.Object",
  1116. "assembly": "mscorlib"
  1117. },
  1118. {
  1119. "typename": "System.Reflection.Assembly",
  1120. "assembly": "mscorlib"
  1121. },
  1122. {
  1123. "typename": "System.Reflection.AssemblyCompanyAttribute",
  1124. "assembly": "mscorlib"
  1125. },
  1126. {
  1127. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  1128. "assembly": "mscorlib"
  1129. },
  1130. {
  1131. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  1132. "assembly": "mscorlib"
  1133. },
  1134. {
  1135. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  1136. "assembly": "mscorlib"
  1137. },
  1138. {
  1139. "typename": "System.Reflection.AssemblyProductAttribute",
  1140. "assembly": "mscorlib"
  1141. },
  1142. {
  1143. "typename": "System.Reflection.AssemblyTitleAttribute",
  1144. "assembly": "mscorlib"
  1145. },
  1146. {
  1147. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  1148. "assembly": "mscorlib"
  1149. },
  1150. {
  1151. "typename": "System.Reflection.MethodInfo",
  1152. "assembly": "mscorlib"
  1153. },
  1154. {
  1155. "typename": "System.Reflection.TargetInvocationException",
  1156. "assembly": "mscorlib"
  1157. },
  1158. {
  1159. "typename": "System.Resources.ResourceManager",
  1160. "assembly": "mscorlib"
  1161. },
  1162. {
  1163. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  1164. "assembly": "mscorlib"
  1165. },
  1166. {
  1167. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  1168. "assembly": "mscorlib"
  1169. },
  1170. {
  1171. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  1172. "assembly": "mscorlib"
  1173. },
  1174. {
  1175. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  1176. "assembly": "mscorlib"
  1177. },
  1178. {
  1179. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  1180. "assembly": "mscorlib"
  1181. },
  1182. {
  1183. "typename": "System.Runtime.InteropServices.GuidAttribute",
  1184. "assembly": "mscorlib"
  1185. },
  1186. {
  1187. "typename": "System.RuntimeTypeHandle",
  1188. "assembly": "mscorlib"
  1189. },
  1190. {
  1191. "typename": "System.STAThreadAttribute",
  1192. "assembly": "mscorlib"
  1193. },
  1194. {
  1195. "typename": "System.Security.Cryptography.CryptoStream",
  1196. "assembly": "mscorlib"
  1197. },
  1198. {
  1199. "typename": "System.Security.Cryptography.CryptoStreamMode",
  1200. "assembly": "mscorlib"
  1201. },
  1202. {
  1203. "typename": "System.Security.Cryptography.HashAlgorithm",
  1204. "assembly": "mscorlib"
  1205. },
  1206. {
  1207. "typename": "System.Security.Cryptography.ICryptoTransform",
  1208. "assembly": "mscorlib"
  1209. },
  1210. {
  1211. "typename": "System.Security.Cryptography.SHA1CryptoServiceProvider",
  1212. "assembly": "mscorlib"
  1213. },
  1214. {
  1215. "typename": "System.Security.Cryptography.SymmetricAlgorithm",
  1216. "assembly": "mscorlib"
  1217. },
  1218. {
  1219. "typename": "System.Security.Cryptography.TripleDES",
  1220. "assembly": "mscorlib"
  1221. },
  1222. {
  1223. "typename": "System.Security.Cryptography.TripleDESCryptoServiceProvider",
  1224. "assembly": "mscorlib"
  1225. },
  1226. {
  1227. "typename": "System.String",
  1228. "assembly": "mscorlib"
  1229. },
  1230. {
  1231. "typename": "System.Text.Encoding",
  1232. "assembly": "mscorlib"
  1233. },
  1234. {
  1235. "typename": "System.ThreadStaticAttribute",
  1236. "assembly": "mscorlib"
  1237. },
  1238. {
  1239. "typename": "System.Type",
  1240. "assembly": "mscorlib"
  1241. }
  1242. ]
  1243. },
  1244. "pe": {
  1245. "peid_signatures": null,
  1246. "imports": [
  1247. {
  1248. "imports": [
  1249. {
  1250. "name": "_CorExeMain",
  1251. "address": "0x402000"
  1252. }
  1253. ],
  1254. "dll": "mscoree.dll"
  1255. }
  1256. ],
  1257. "digital_signers": null,
  1258. "exported_dll_name": null,
  1259. "actual_checksum": "0x00272d76",
  1260. "overlay": {
  1261. "size": "0x00200000",
  1262. "offset": "0x0006cc00"
  1263. },
  1264. "imagebase": "0x00400000",
  1265. "reported_checksum": "0x00000000",
  1266. "icon_hash": null,
  1267. "entrypoint": "0x0045504e",
  1268. "timestamp": "2019-04-17 14:19:49",
  1269. "osversion": "4.0",
  1270. "sections": [
  1271. {
  1272. "name": ".text",
  1273. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1274. "virtual_address": "0x00002000",
  1275. "size_of_data": "0x00053200",
  1276. "entropy": "4.24",
  1277. "raw_address": "0x00000400",
  1278. "virtual_size": "0x00053054",
  1279. "characteristics_raw": "0x60000020"
  1280. },
  1281. {
  1282. "name": ".sdata",
  1283. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1284. "virtual_address": "0x00056000",
  1285. "size_of_data": "0x00000200",
  1286. "entropy": "1.99",
  1287. "raw_address": "0x00053600",
  1288. "virtual_size": "0x00000138",
  1289. "characteristics_raw": "0xc0000040"
  1290. },
  1291. {
  1292. "name": ".rsrc",
  1293. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1294. "virtual_address": "0x00058000",
  1295. "size_of_data": "0x00019200",
  1296. "entropy": "0.93",
  1297. "raw_address": "0x00053800",
  1298. "virtual_size": "0x000190c0",
  1299. "characteristics_raw": "0x40000040"
  1300. },
  1301. {
  1302. "name": ".reloc",
  1303. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1304. "virtual_address": "0x00072000",
  1305. "size_of_data": "0x00000200",
  1306. "entropy": "0.10",
  1307. "raw_address": "0x0006ca00",
  1308. "virtual_size": "0x0000000c",
  1309. "characteristics_raw": "0x42000040"
  1310. }
  1311. ],
  1312. "resources": [],
  1313. "dirents": [
  1314. {
  1315. "virtual_address": "0x00000000",
  1316. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1317. "size": "0x00000000"
  1318. },
  1319. {
  1320. "virtual_address": "0x00055000",
  1321. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1322. "size": "0x0000004b"
  1323. },
  1324. {
  1325. "virtual_address": "0x00058000",
  1326. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1327. "size": "0x000190c0"
  1328. },
  1329. {
  1330. "virtual_address": "0x00000000",
  1331. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1332. "size": "0x00000000"
  1333. },
  1334. {
  1335. "virtual_address": "0x00000000",
  1336. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1337. "size": "0x00000000"
  1338. },
  1339. {
  1340. "virtual_address": "0x00072000",
  1341. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1342. "size": "0x0000000c"
  1343. },
  1344. {
  1345. "virtual_address": "0x00056000",
  1346. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1347. "size": "0x0000001c"
  1348. },
  1349. {
  1350. "virtual_address": "0x00000000",
  1351. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1352. "size": "0x00000000"
  1353. },
  1354. {
  1355. "virtual_address": "0x00000000",
  1356. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1357. "size": "0x00000000"
  1358. }
  1359. ],
  1360. "exports": [],
  1361. "guest_signers": {},
  1362. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1363. "icon_fuzzy": null,
  1364. "icon": null,
  1365. "pdbpath": "C:\\Users\\Android\\AppData\\Local\\Temp\\AgaYHfLgBL\\Doctorpol\\obj\\x86\\Debug\\Doctorpol.pdb",
  1366. "imported_dll_count": 1,
  1367. "versioninfo": []
  1368. }
  1369. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!