API tools faq
paste
paladin316

45B65D_exe_2019-06-25_10_30.json

paladin316
Jun 25th, 2019
2,249
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 36.32 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 0.5
  5.  
  6. [*] File Name: "45B65D.exe"
  7. [*] File Size: 14848
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b"
  10. [*] MD5: "432be6cf7311062633459eef6b242fb5"
  11. [*] SHA1: "a774a816662ff5b75669aa5bce751bab9d0972b8"
  12. [*] SHA512: "02dace1d807e9f2a6034688ff8950bb156ff36ea4eacbf5af8bcc8011106904e1810e26e4c12a20120640ae0c4acaa56372d956f16d037838b8d7dcc921cfa05"
  13. [*] CRC32: "485C00E8"
  14. [*] SSDEEP: "384:ItGG2yMSPGQZicA+bms4qLg2iV5kQWr+TLHW:YaSuQZicHJwXKUL"
  15.  
  16. [*] Process Execution: [
  17. "45B65D.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. }
  25. ]
  26.  
  27. [*] Started Service: []
  28.  
  29. [*] Executed Commands: []
  30.  
  31. [*] Mutexes: [
  32. "CicLoadWinStaWinSta0",
  33. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  34. ]
  35.  
  36. [*] Modified Files: []
  37.  
  38. [*] Deleted Files: []
  39.  
  40. [*] Modified Registry Keys: []
  41.  
  42. [*] Deleted Registry Keys: []
  43.  
  44. [*] DNS Communications: []
  45.  
  46. [*] Domains: []
  47.  
  48. [*] Network Communication - ICMP: []
  49.  
  50. [*] Network Communication - HTTP: []
  51.  
  52. [*] Network Communication - SMTP: []
  53.  
  54. [*] Network Communication - Hosts: []
  55.  
  56. [*] Network Communication - IRC: []
  57.  
  58. [*] Static Analysis: {
  59. "pe": {
  60. "peid_signatures": null,
  61. "imports": [
  62. {
  63. "imports": [
  64. {
  65. "name": "RegQueryValueW",
  66. "address": "0x1001000"
  67. },
  68. {
  69. "name": "RegOpenKeyExW",
  70. "address": "0x1001004"
  71. },
  72. {
  73. "name": "RegCloseKey",
  74. "address": "0x1001008"
  75. }
  76. ],
  77. "dll": "ADVAPI32.dll"
  78. },
  79. {
  80. "imports": [
  81. {
  82. "name": "ReadFile",
  83. "address": "0x1001018"
  84. },
  85. {
  86. "name": "CreateFileW",
  87. "address": "0x100101c"
  88. },
  89. {
  90. "name": "GetExitCodeProcess",
  91. "address": "0x1001020"
  92. },
  93. {
  94. "name": "WaitForSingleObject",
  95. "address": "0x1001024"
  96. },
  97. {
  98. "name": "CreateProcessW",
  99. "address": "0x1001028"
  100. },
  101. {
  102. "name": "Wow64EnableWow64FsRedirection",
  103. "address": "0x100102c"
  104. },
  105. {
  106. "name": "GetSystemDirectoryW",
  107. "address": "0x1001030"
  108. },
  109. {
  110. "name": "GetNativeSystemInfo",
  111. "address": "0x1001034"
  112. },
  113. {
  114. "name": "IsWow64Process",
  115. "address": "0x1001038"
  116. },
  117. {
  118. "name": "GetCurrentProcess",
  119. "address": "0x100103c"
  120. },
  121. {
  122. "name": "GetCommandLineW",
  123. "address": "0x1001040"
  124. },
  125. {
  126. "name": "lstrlenW",
  127. "address": "0x1001044"
  128. },
  129. {
  130. "name": "GetProcAddress",
  131. "address": "0x1001048"
  132. },
  133. {
  134. "name": "GetModuleHandleW",
  135. "address": "0x100104c"
  136. },
  137. {
  138. "name": "GetLastError",
  139. "address": "0x1001050"
  140. },
  141. {
  142. "name": "FreeLibrary",
  143. "address": "0x1001054"
  144. },
  145. {
  146. "name": "SetFilePointer",
  147. "address": "0x1001058"
  148. },
  149. {
  150. "name": "LoadLibraryExW",
  151. "address": "0x100105c"
  152. },
  153. {
  154. "name": "WideCharToMultiByte",
  155. "address": "0x1001060"
  156. },
  157. {
  158. "name": "SetErrorMode",
  159. "address": "0x1001064"
  160. },
  161. {
  162. "name": "FormatMessageW",
  163. "address": "0x1001068"
  164. },
  165. {
  166. "name": "LocalAlloc",
  167. "address": "0x100106c"
  168. },
  169. {
  170. "name": "HeapSetInformation",
  171. "address": "0x1001070"
  172. },
  173. {
  174. "name": "TerminateProcess",
  175. "address": "0x1001074"
  176. },
  177. {
  178. "name": "GetSystemTimeAsFileTime",
  179. "address": "0x1001078"
  180. },
  181. {
  182. "name": "GetCurrentProcessId",
  183. "address": "0x100107c"
  184. },
  185. {
  186. "name": "GetCurrentThreadId",
  187. "address": "0x1001080"
  188. },
  189. {
  190. "name": "GetTickCount",
  191. "address": "0x1001084"
  192. },
  193. {
  194. "name": "QueryPerformanceCounter",
  195. "address": "0x1001088"
  196. },
  197. {
  198. "name": "GetModuleHandleA",
  199. "address": "0x100108c"
  200. },
  201. {
  202. "name": "SetUnhandledExceptionFilter",
  203. "address": "0x1001090"
  204. },
  205. {
  206. "name": "GetStartupInfoW",
  207. "address": "0x1001094"
  208. },
  209. {
  210. "name": "InterlockedCompareExchange",
  211. "address": "0x1001098"
  212. },
  213. {
  214. "name": "Sleep",
  215. "address": "0x100109c"
  216. },
  217. {
  218. "name": "UnhandledExceptionFilter",
  219. "address": "0x10010a0"
  220. },
  221. {
  222. "name": "InterlockedExchange",
  223. "address": "0x10010a4"
  224. },
  225. {
  226. "name": "CloseHandle",
  227. "address": "0x10010a8"
  228. },
  229. {
  230. "name": "lstrcmpW",
  231. "address": "0x10010ac"
  232. }
  233. ],
  234. "dll": "KERNEL32.dll"
  235. },
  236. {
  237. "imports": [
  238. {
  239. "name": "CharNextW",
  240. "address": "0x10010b4"
  241. },
  242. {
  243. "name": "LoadStringW",
  244. "address": "0x10010b8"
  245. }
  246. ],
  247. "dll": "USER32.dll"
  248. },
  249. {
  250. "imports": [
  251. {
  252. "name": "_initterm",
  253. "address": "0x10010c0"
  254. },
  255. {
  256. "name": "_amsg_exit",
  257. "address": "0x10010c4"
  258. },
  259. {
  260. "name": "__setusermatherr",
  261. "address": "0x10010c8"
  262. },
  263. {
  264. "name": "__p__commode",
  265. "address": "0x10010cc"
  266. },
  267. {
  268. "name": "__p__fmode",
  269. "address": "0x10010d0"
  270. },
  271. {
  272. "name": "__set_app_type",
  273. "address": "0x10010d4"
  274. },
  275. {
  276. "name": "_wcmdln",
  277. "address": "0x10010d8"
  278. },
  279. {
  280. "name": "_except_handler4_common",
  281. "address": "0x10010dc"
  282. },
  283. {
  284. "name": "_controlfp",
  285. "address": "0x10010e0"
  286. },
  287. {
  288. "name": "exit",
  289. "address": "0x10010e4"
  290. },
  291. {
  292. "name": "?terminate@@YAXXZ",
  293. "address": "0x10010e8"
  294. },
  295. {
  296. "name": "__argc",
  297. "address": "0x10010ec"
  298. },
  299. {
  300. "name": "_XcptFilter",
  301. "address": "0x10010f0"
  302. },
  303. {
  304. "name": "wcsncpy_s",
  305. "address": "0x10010f4"
  306. },
  307. {
  308. "name": "memset",
  309. "address": "0x10010f8"
  310. },
  311. {
  312. "name": "_exit",
  313. "address": "0x10010fc"
  314. },
  315. {
  316. "name": "_cexit",
  317. "address": "0x1001100"
  318. },
  319. {
  320. "name": "__wgetmainargs",
  321. "address": "0x1001104"
  322. },
  323. {
  324. "name": "__wargv",
  325. "address": "0x1001108"
  326. },
  327. {
  328. "name": "strcat_s",
  329. "address": "0x100110c"
  330. },
  331. {
  332. "name": "swprintf_s",
  333. "address": "0x1001110"
  334. },
  335. {
  336. "name": "_wsplitpath_s",
  337. "address": "0x1001114"
  338. },
  339. {
  340. "name": "wcscat_s",
  341. "address": "0x1001118"
  342. },
  343. {
  344. "name": "wcscpy_s",
  345. "address": "0x100111c"
  346. }
  347. ],
  348. "dll": "msvcrt.dll"
  349. },
  350. {
  351. "imports": [
  352. {
  353. "name": "OleUninitialize",
  354. "address": "0x1001130"
  355. },
  356. {
  357. "name": "OleInitialize",
  358. "address": "0x1001134"
  359. }
  360. ],
  361. "dll": "ole32.dll"
  362. },
  363. {
  364. "imports": [
  365. {
  366. "name": "NtSetInformationProcess",
  367. "address": "0x1001124"
  368. },
  369. {
  370. "name": "RtlImageNtHeader",
  371. "address": "0x1001128"
  372. }
  373. ],
  374. "dll": "ntdll.dll"
  375. },
  376. {
  377. "imports": [
  378. {
  379. "name": null,
  380. "address": "0x1001010"
  381. }
  382. ],
  383. "dll": "COMCTL32.dll"
  384. }
  385. ],
  386. "digital_signers": null,
  387. "exported_dll_name": null,
  388. "actual_checksum": "0x0001123b",
  389. "overlay": null,
  390. "imagebase": "0x01000000",
  391. "reported_checksum": "0x0001123b",
  392. "icon_hash": null,
  393. "entrypoint": "0x010027c1",
  394. "timestamp": "2009-07-13 23:58:32",
  395. "osversion": "6.1",
  396. "sections": [
  397. {
  398. "name": ".text",
  399. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  400. "virtual_address": "0x00001000",
  401. "size_of_data": "0x00002600",
  402. "entropy": "6.04",
  403. "raw_address": "0x00000400",
  404. "virtual_size": "0x00002428",
  405. "characteristics_raw": "0x60000020"
  406. },
  407. {
  408. "name": ".data",
  409. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  410. "virtual_address": "0x00004000",
  411. "size_of_data": "0x00000200",
  412. "entropy": "1.34",
  413. "raw_address": "0x00002a00",
  414. "virtual_size": "0x00000758",
  415. "characteristics_raw": "0xc0000040"
  416. },
  417. {
  418. "name": ".rsrc",
  419. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  420. "virtual_address": "0x00005000",
  421. "size_of_data": "0x00000a00",
  422. "entropy": "4.38",
  423. "raw_address": "0x00002c00",
  424. "virtual_size": "0x00000950",
  425. "characteristics_raw": "0x40000040"
  426. },
  427. {
  428. "name": ".reloc",
  429. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  430. "virtual_address": "0x00006000",
  431. "size_of_data": "0x00000400",
  432. "entropy": "4.09",
  433. "raw_address": "0x00003600",
  434. "virtual_size": "0x000002b6",
  435. "characteristics_raw": "0x42000040"
  436. }
  437. ],
  438. "resources": [],
  439. "dirents": [
  440. {
  441. "virtual_address": "0x00000000",
  442. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  443. "size": "0x00000000"
  444. },
  445. {
  446. "virtual_address": "0x00002d2c",
  447. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  448. "size": "0x000000a0"
  449. },
  450. {
  451. "virtual_address": "0x00005000",
  452. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  453. "size": "0x00000950"
  454. },
  455. {
  456. "virtual_address": "0x00000000",
  457. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  458. "size": "0x00000000"
  459. },
  460. {
  461. "virtual_address": "0x00000000",
  462. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  463. "size": "0x00000000"
  464. },
  465. {
  466. "virtual_address": "0x00006000",
  467. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  468. "size": "0x000001fc"
  469. },
  470. {
  471. "virtual_address": "0x00001160",
  472. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  473. "size": "0x0000001c"
  474. },
  475. {
  476. "virtual_address": "0x00000000",
  477. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  478. "size": "0x00000000"
  479. },
  480. {
  481. "virtual_address": "0x00000000",
  482. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  483. "size": "0x00000000"
  484. },
  485. {
  486. "virtual_address": "0x00000000",
  487. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  488. "size": "0x00000000"
  489. },
  490. {
  491. "virtual_address": "0x00001328",
  492. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  493. "size": "0x00000040"
  494. },
  495. {
  496. "virtual_address": "0x00000280",
  497. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  498. "size": "0x00000094"
  499. },
  500. {
  501. "virtual_address": "0x00001000",
  502. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  503. "size": "0x0000013c"
  504. },
  505. {
  506. "virtual_address": "0x00000000",
  507. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  508. "size": "0x00000000"
  509. },
  510. {
  511. "virtual_address": "0x00000000",
  512. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  513. "size": "0x00000000"
  514. },
  515. {
  516. "virtual_address": "0x00000000",
  517. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  518. "size": "0x00000000"
  519. }
  520. ],
  521. "exports": [],
  522. "guest_signers": {},
  523. "imphash": "a2dad36bd73280726da578eb659d0583",
  524. "icon_fuzzy": null,
  525. "icon": null,
  526. "pdbpath": "regsvr32.pdb",
  527. "imported_dll_count": 7,
  528. "versioninfo": []
  529. }
  530. }
  531.  
  532. [*] Resolved APIs: [
  533. "user32.dll.SetProcessDPIAware",
  534. "comctl32.dll.LoadIconWithScaleDown",
  535. "ntdll.dll.RtlRunEncodeUnicodeString",
  536. "ntdll.dll.RtlInitUnicodeString",
  537. "ntdll.dll.RtlRunDecodeUnicodeString",
  538. "duser.dll.InitGadgets",
  539. "user32.dll.RegisterMessagePumpHook",
  540. "dwmapi.dll.DwmIsCompositionEnabled",
  541. "uxtheme.dll.IsThemeActive",
  542. "duser.dll.CreateGadget",
  543. "duser.dll.SetGadgetMessageFilter",
  544. "duser.dll.SetGadgetStyle",
  545. "duser.dll.SetGadgetRootInfo",
  546. "uxtheme.dll.IsAppThemed",
  547. "uxtheme.dll.GetThemeAppProperties",
  548. "ole32.dll.CreateStreamOnHGlobal",
  549. "xmllite.dll.CreateXmlReader",
  550. "xmllite.dll.CreateXmlReaderInputWithEncodingName",
  551. "uxtheme.dll.OpenThemeData",
  552. "uxtheme.dll.GetThemeMargins",
  553. "uxtheme.dll.GetThemeFont",
  554. "uxtheme.dll.GetThemeColor",
  555. "uxtheme.dll.GetThemeMetric",
  556. "oleaut32.dll.#6",
  557. "duser.dll.SetGadgetParent",
  558. "duser.dll.GetDUserModule",
  559. "duser.dll.FindStdColor",
  560. "duser.dll.AttachWndProcW",
  561. "kernel32.dll.IsProcessorFeaturePresent",
  562. "kernel32.dll.InterlockedPopEntrySList",
  563. "kernel32.dll.InterlockedPushEntrySList",
  564. "kernel32.dll.InterlockedCompareExchange",
  565. "comctl32.dll.RegisterClassNameW",
  566. "kernel32.dll.SortGetHandle",
  567. "kernel32.dll.SortCloseHandle",
  568. "duser.dll.GetGadgetRect",
  569. "duser.dll.GetGadgetRgn",
  570. "duser.dll.GetGadgetTicket",
  571. "gdi32.dll.GetLayout",
  572. "gdi32.dll.GdiRealizationInfo",
  573. "gdi32.dll.FontIsLinked",
  574. "advapi32.dll.RegOpenKeyExW",
  575. "advapi32.dll.RegQueryInfoKeyW",
  576. "gdi32.dll.GetTextFaceAliasW",
  577. "advapi32.dll.RegEnumValueW",
  578. "advapi32.dll.RegCloseKey",
  579. "advapi32.dll.RegQueryValueExW",
  580. "gdi32.dll.GetFontAssocStatus",
  581. "advapi32.dll.RegQueryValueExA",
  582. "advapi32.dll.RegEnumKeyExW",
  583. "gdi32.dll.GdiIsMetaPrintDC",
  584. "uxtheme.dll.EnableThemeDialogTexture",
  585. "uxtheme.dll.GetThemeBool",
  586. "duser.dll.InvalidateGadget",
  587. "duser.dll.GetGadgetFocus",
  588. "uxtheme.dll.GetThemeBackgroundContentRect",
  589. "uxtheme.dll.GetThemeTextExtent",
  590. "uxtheme.dll.GetThemeBackgroundExtent",
  591. "uxtheme.dll.CloseThemeData",
  592. "ole32.dll.CoInitializeEx",
  593. "ole32.dll.CoUninitialize",
  594. "cryptbase.dll.SystemFunction036",
  595. "ole32.dll.CoRegisterInitializeSpy",
  596. "ole32.dll.CoRevokeInitializeSpy",
  597. "duser.dll.SetGadgetFocus",
  598. "duser.dll.DUserSendEvent",
  599. "duser.dll.SetGadgetRect",
  600. "uxtheme.dll.#47",
  601. "uxtheme.dll.BufferedPaintInit",
  602. "uxtheme.dll.BeginBufferedPaint",
  603. "uxtheme.dll.BufferedPaintRenderAnimation",
  604. "uxtheme.dll.GetThemeTransitionDuration",
  605. "uxtheme.dll.BeginBufferedAnimation",
  606. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  607. "uxtheme.dll.DrawThemeParentBackground",
  608. "uxtheme.dll.DrawThemeBackground",
  609. "uxtheme.dll.DrawThemeText",
  610. "uxtheme.dll.EndBufferedAnimation",
  611. "uxtheme.dll.GetBufferedPaintDC",
  612. "uxtheme.dll.GetBufferedPaintTargetDC",
  613. "uxtheme.dll.EndBufferedPaint",
  614. "duser.dll.ForwardGadgetMessage",
  615. "duser.dll.SetGadgetFocusEx",
  616. "uxtheme.dll.BufferedPaintStopAllAnimations",
  617. "uxtheme.dll.BufferedPaintUnInit",
  618. "oleaut32.dll.#500",
  619. "duser.dll.DisableContainerHwnd",
  620. "duser.dll.DUserFlushMessages",
  621. "duser.dll.DUserFlushDeferredMessages",
  622. "duser.dll.DeleteHandle",
  623. "user32.dll.UnregisterMessagePumpHook"
  624. ]
  625.  
  626. [*] Static Analysis: {
  627. "pe": {
  628. "peid_signatures": null,
  629. "imports": [
  630. {
  631. "imports": [
  632. {
  633. "name": "RegQueryValueW",
  634. "address": "0x1001000"
  635. },
  636. {
  637. "name": "RegOpenKeyExW",
  638. "address": "0x1001004"
  639. },
  640. {
  641. "name": "RegCloseKey",
  642. "address": "0x1001008"
  643. }
  644. ],
  645. "dll": "ADVAPI32.dll"
  646. },
  647. {
  648. "imports": [
  649. {
  650. "name": "ReadFile",
  651. "address": "0x1001018"
  652. },
  653. {
  654. "name": "CreateFileW",
  655. "address": "0x100101c"
  656. },
  657. {
  658. "name": "GetExitCodeProcess",
  659. "address": "0x1001020"
  660. },
  661. {
  662. "name": "WaitForSingleObject",
  663. "address": "0x1001024"
  664. },
  665. {
  666. "name": "CreateProcessW",
  667. "address": "0x1001028"
  668. },
  669. {
  670. "name": "Wow64EnableWow64FsRedirection",
  671. "address": "0x100102c"
  672. },
  673. {
  674. "name": "GetSystemDirectoryW",
  675. "address": "0x1001030"
  676. },
  677. {
  678. "name": "GetNativeSystemInfo",
  679. "address": "0x1001034"
  680. },
  681. {
  682. "name": "IsWow64Process",
  683. "address": "0x1001038"
  684. },
  685. {
  686. "name": "GetCurrentProcess",
  687. "address": "0x100103c"
  688. },
  689. {
  690. "name": "GetCommandLineW",
  691. "address": "0x1001040"
  692. },
  693. {
  694. "name": "lstrlenW",
  695. "address": "0x1001044"
  696. },
  697. {
  698. "name": "GetProcAddress",
  699. "address": "0x1001048"
  700. },
  701. {
  702. "name": "GetModuleHandleW",
  703. "address": "0x100104c"
  704. },
  705. {
  706. "name": "GetLastError",
  707. "address": "0x1001050"
  708. },
  709. {
  710. "name": "FreeLibrary",
  711. "address": "0x1001054"
  712. },
  713. {
  714. "name": "SetFilePointer",
  715. "address": "0x1001058"
  716. },
  717. {
  718. "name": "LoadLibraryExW",
  719. "address": "0x100105c"
  720. },
  721. {
  722. "name": "WideCharToMultiByte",
  723. "address": "0x1001060"
  724. },
  725. {
  726. "name": "SetErrorMode",
  727. "address": "0x1001064"
  728. },
  729. {
  730. "name": "FormatMessageW",
  731. "address": "0x1001068"
  732. },
  733. {
  734. "name": "LocalAlloc",
  735. "address": "0x100106c"
  736. },
  737. {
  738. "name": "HeapSetInformation",
  739. "address": "0x1001070"
  740. },
  741. {
  742. "name": "TerminateProcess",
  743. "address": "0x1001074"
  744. },
  745. {
  746. "name": "GetSystemTimeAsFileTime",
  747. "address": "0x1001078"
  748. },
  749. {
  750. "name": "GetCurrentProcessId",
  751. "address": "0x100107c"
  752. },
  753. {
  754. "name": "GetCurrentThreadId",
  755. "address": "0x1001080"
  756. },
  757. {
  758. "name": "GetTickCount",
  759. "address": "0x1001084"
  760. },
  761. {
  762. "name": "QueryPerformanceCounter",
  763. "address": "0x1001088"
  764. },
  765. {
  766. "name": "GetModuleHandleA",
  767. "address": "0x100108c"
  768. },
  769. {
  770. "name": "SetUnhandledExceptionFilter",
  771. "address": "0x1001090"
  772. },
  773. {
  774. "name": "GetStartupInfoW",
  775. "address": "0x1001094"
  776. },
  777. {
  778. "name": "InterlockedCompareExchange",
  779. "address": "0x1001098"
  780. },
  781. {
  782. "name": "Sleep",
  783. "address": "0x100109c"
  784. },
  785. {
  786. "name": "UnhandledExceptionFilter",
  787. "address": "0x10010a0"
  788. },
  789. {
  790. "name": "InterlockedExchange",
  791. "address": "0x10010a4"
  792. },
  793. {
  794. "name": "CloseHandle",
  795. "address": "0x10010a8"
  796. },
  797. {
  798. "name": "lstrcmpW",
  799. "address": "0x10010ac"
  800. }
  801. ],
  802. "dll": "KERNEL32.dll"
  803. },
  804. {
  805. "imports": [
  806. {
  807. "name": "CharNextW",
  808. "address": "0x10010b4"
  809. },
  810. {
  811. "name": "LoadStringW",
  812. "address": "0x10010b8"
  813. }
  814. ],
  815. "dll": "USER32.dll"
  816. },
  817. {
  818. "imports": [
  819. {
  820. "name": "_initterm",
  821. "address": "0x10010c0"
  822. },
  823. {
  824. "name": "_amsg_exit",
  825. "address": "0x10010c4"
  826. },
  827. {
  828. "name": "__setusermatherr",
  829. "address": "0x10010c8"
  830. },
  831. {
  832. "name": "__p__commode",
  833. "address": "0x10010cc"
  834. },
  835. {
  836. "name": "__p__fmode",
  837. "address": "0x10010d0"
  838. },
  839. {
  840. "name": "__set_app_type",
  841. "address": "0x10010d4"
  842. },
  843. {
  844. "name": "_wcmdln",
  845. "address": "0x10010d8"
  846. },
  847. {
  848. "name": "_except_handler4_common",
  849. "address": "0x10010dc"
  850. },
  851. {
  852. "name": "_controlfp",
  853. "address": "0x10010e0"
  854. },
  855. {
  856. "name": "exit",
  857. "address": "0x10010e4"
  858. },
  859. {
  860. "name": "?terminate@@YAXXZ",
  861. "address": "0x10010e8"
  862. },
  863. {
  864. "name": "__argc",
  865. "address": "0x10010ec"
  866. },
  867. {
  868. "name": "_XcptFilter",
  869. "address": "0x10010f0"
  870. },
  871. {
  872. "name": "wcsncpy_s",
  873. "address": "0x10010f4"
  874. },
  875. {
  876. "name": "memset",
  877. "address": "0x10010f8"
  878. },
  879. {
  880. "name": "_exit",
  881. "address": "0x10010fc"
  882. },
  883. {
  884. "name": "_cexit",
  885. "address": "0x1001100"
  886. },
  887. {
  888. "name": "__wgetmainargs",
  889. "address": "0x1001104"
  890. },
  891. {
  892. "name": "__wargv",
  893. "address": "0x1001108"
  894. },
  895. {
  896. "name": "strcat_s",
  897. "address": "0x100110c"
  898. },
  899. {
  900. "name": "swprintf_s",
  901. "address": "0x1001110"
  902. },
  903. {
  904. "name": "_wsplitpath_s",
  905. "address": "0x1001114"
  906. },
  907. {
  908. "name": "wcscat_s",
  909. "address": "0x1001118"
  910. },
  911. {
  912. "name": "wcscpy_s",
  913. "address": "0x100111c"
  914. }
  915. ],
  916. "dll": "msvcrt.dll"
  917. },
  918. {
  919. "imports": [
  920. {
  921. "name": "OleUninitialize",
  922. "address": "0x1001130"
  923. },
  924. {
  925. "name": "OleInitialize",
  926. "address": "0x1001134"
  927. }
  928. ],
  929. "dll": "ole32.dll"
  930. },
  931. {
  932. "imports": [
  933. {
  934. "name": "NtSetInformationProcess",
  935. "address": "0x1001124"
  936. },
  937. {
  938. "name": "RtlImageNtHeader",
  939. "address": "0x1001128"
  940. }
  941. ],
  942. "dll": "ntdll.dll"
  943. },
  944. {
  945. "imports": [
  946. {
  947. "name": null,
  948. "address": "0x1001010"
  949. }
  950. ],
  951. "dll": "COMCTL32.dll"
  952. }
  953. ],
  954. "digital_signers": null,
  955. "exported_dll_name": null,
  956. "actual_checksum": "0x0001123b",
  957. "overlay": null,
  958. "imagebase": "0x01000000",
  959. "reported_checksum": "0x0001123b",
  960. "icon_hash": null,
  961. "entrypoint": "0x010027c1",
  962. "timestamp": "2009-07-13 23:58:32",
  963. "osversion": "6.1",
  964. "sections": [
  965. {
  966. "name": ".text",
  967. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  968. "virtual_address": "0x00001000",
  969. "size_of_data": "0x00002600",
  970. "entropy": "6.04",
  971. "raw_address": "0x00000400",
  972. "virtual_size": "0x00002428",
  973. "characteristics_raw": "0x60000020"
  974. },
  975. {
  976. "name": ".data",
  977. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  978. "virtual_address": "0x00004000",
  979. "size_of_data": "0x00000200",
  980. "entropy": "1.34",
  981. "raw_address": "0x00002a00",
  982. "virtual_size": "0x00000758",
  983. "characteristics_raw": "0xc0000040"
  984. },
  985. {
  986. "name": ".rsrc",
  987. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  988. "virtual_address": "0x00005000",
  989. "size_of_data": "0x00000a00",
  990. "entropy": "4.38",
  991. "raw_address": "0x00002c00",
  992. "virtual_size": "0x00000950",
  993. "characteristics_raw": "0x40000040"
  994. },
  995. {
  996. "name": ".reloc",
  997. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  998. "virtual_address": "0x00006000",
  999. "size_of_data": "0x00000400",
  1000. "entropy": "4.09",
  1001. "raw_address": "0x00003600",
  1002. "virtual_size": "0x000002b6",
  1003. "characteristics_raw": "0x42000040"
  1004. }
  1005. ],
  1006. "resources": [],
  1007. "dirents": [
  1008. {
  1009. "virtual_address": "0x00000000",
  1010. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1011. "size": "0x00000000"
  1012. },
  1013. {
  1014. "virtual_address": "0x00002d2c",
  1015. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1016. "size": "0x000000a0"
  1017. },
  1018. {
  1019. "virtual_address": "0x00005000",
  1020. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1021. "size": "0x00000950"
  1022. },
  1023. {
  1024. "virtual_address": "0x00000000",
  1025. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1026. "size": "0x00000000"
  1027. },
  1028. {
  1029. "virtual_address": "0x00000000",
  1030. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1031. "size": "0x00000000"
  1032. },
  1033. {
  1034. "virtual_address": "0x00006000",
  1035. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1036. "size": "0x000001fc"
  1037. },
  1038. {
  1039. "virtual_address": "0x00001160",
  1040. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1041. "size": "0x0000001c"
  1042. },
  1043. {
  1044. "virtual_address": "0x00000000",
  1045. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1046. "size": "0x00000000"
  1047. },
  1048. {
  1049. "virtual_address": "0x00000000",
  1050. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1051. "size": "0x00000000"
  1052. },
  1053. {
  1054. "virtual_address": "0x00000000",
  1055. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1056. "size": "0x00000000"
  1057. },
  1058. {
  1059. "virtual_address": "0x00001328",
  1060. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1061. "size": "0x00000040"
  1062. },
  1063. {
  1064. "virtual_address": "0x00000280",
  1065. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1066. "size": "0x00000094"
  1067. },
  1068. {
  1069. "virtual_address": "0x00001000",
  1070. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1071. "size": "0x0000013c"
  1072. },
  1073. {
  1074. "virtual_address": "0x00000000",
  1075. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1076. "size": "0x00000000"
  1077. },
  1078. {
  1079. "virtual_address": "0x00000000",
  1080. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1081. "size": "0x00000000"
  1082. },
  1083. {
  1084. "virtual_address": "0x00000000",
  1085. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1086. "size": "0x00000000"
  1087. }
  1088. ],
  1089. "exports": [],
  1090. "guest_signers": {},
  1091. "imphash": "a2dad36bd73280726da578eb659d0583",
  1092. "icon_fuzzy": null,
  1093. "icon": null,
  1094. "pdbpath": "regsvr32.pdb",
  1095. "imported_dll_count": 7,
  1096. "versioninfo": []
  1097. }
  1098. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!