API tools faq
paste
paladin316

Exes_e91c029560252df7fd47ecfbffa97b2d_exe_2019-07-03_17_30.json

paladin316
Jul 3rd, 2019
2,167
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.53 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_e91c029560252df7fd47ecfbffa97b2d.exe"
  7. [*] File Size: 704000
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "4543ed32e1bbea536e9ec8d52486c90e67dd58a9f034c8597d62f6da88249038"
  10. [*] MD5: "e91c029560252df7fd47ecfbffa97b2d"
  11. [*] SHA1: "4aaca45bba89fe4568ee08157bf95fc749f6191b"
  12. [*] SHA512: "3ea13e0b28c892b648859c60e95d9a04d77d4387cf8c0903786f47a36f96b95a41ee319f0dc20a226c0503971a56a743b72b6b84148a8da6230e42ac0113def0"
  13. [*] CRC32: "E15B9C1D"
  14. [*] SSDEEP: "12288:k3LN6rKBvCkkMiydYvvl5+D6D0WUy1haJRJAXRR/+adeQw:e3L3dYv9BD0WUOaJvBac"
  15.  
  16. [*] Process Execution: [
  17. "Exes_e91c029560252df7fd47ecfbffa97b2d.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: .rsrc, entropy: 7.63, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0009ac00, virtual_size: 0x0009ab24"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "Anomalous .NET characteristics",
  31. "Details": [
  32. {
  33. "anomalous_version": "Assembly version is set to 0"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "File has been identified by 15 Antiviruses on VirusTotal as malicious",
  39. "Details": [
  40. {
  41. "Cylance": "Unsafe"
  42. },
  43. {
  44. "APEX": "Malicious"
  45. },
  46. {
  47. "Rising": "Trojan.MSIL/Kryptik!1.B1DC (CLASSIC)"
  48. },
  49. {
  50. "Invincea": "heuristic"
  51. },
  52. {
  53. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.jc"
  54. },
  55. {
  56. "FireEye": "Generic.mg.e91c029560252df7"
  57. },
  58. {
  59. "Microsoft": "Trojan:Win32/Fuerboos.C!cl"
  60. },
  61. {
  62. "Endgame": "malicious (high confidence)"
  63. },
  64. {
  65. "Acronis": "suspicious"
  66. },
  67. {
  68. "ESET-NOD32": "a variant of MSIL/Kryptik.RYY"
  69. },
  70. {
  71. "SentinelOne": "DFI - Suspicious PE"
  72. },
  73. {
  74. "Fortinet": "MSIL/Kryptik.RQA!tr"
  75. },
  76. {
  77. "Cybereason": "malicious.bba89f"
  78. },
  79. {
  80. "CrowdStrike": "win/malicious_confidence_80% (D)"
  81. },
  82. {
  83. "Qihoo-360": "HEUR/QVM03.0.4787.Malware.Gen"
  84. }
  85. ]
  86. }
  87. ]
  88.  
  89. [*] Started Service: []
  90.  
  91. [*] Executed Commands: []
  92.  
  93. [*] Mutexes: []
  94.  
  95. [*] Modified Files: []
  96.  
  97. [*] Deleted Files: []
  98.  
  99. [*] Modified Registry Keys: []
  100.  
  101. [*] Deleted Registry Keys: []
  102.  
  103. [*] DNS Communications: []
  104.  
  105. [*] Domains: []
  106.  
  107. [*] Network Communication - ICMP: []
  108.  
  109. [*] Network Communication - HTTP: []
  110.  
  111. [*] Network Communication - SMTP: []
  112.  
  113. [*] Network Communication - Hosts: []
  114.  
  115. [*] Network Communication - IRC: []
  116.  
  117. [*] Static Analysis: {
  118. "dotnet": {
  119. "customattrs": [],
  120. "assemblyinfo": {
  121. "version": "0.0.0.0",
  122. "name": "vsYXWxGtxxfRZxbkma"
  123. },
  124. "assemblyrefs": [
  125. {
  126. "version": "4.0.0.0",
  127. "name": "mscorlib"
  128. },
  129. {
  130. "version": "4.0.0.0",
  131. "name": "System"
  132. },
  133. {
  134. "version": "4.0.0.0",
  135. "name": "System.Web"
  136. },
  137. {
  138. "version": "4.0.0.0",
  139. "name": "System.Core"
  140. }
  141. ],
  142. "typerefs": [
  143. {
  144. "typename": "System.Net.Cookie",
  145. "assembly": "System"
  146. },
  147. {
  148. "typename": "System.Net.FtpStatusCode",
  149. "assembly": "System"
  150. },
  151. {
  152. "typename": "System.Net.FtpWebRequest",
  153. "assembly": "System"
  154. },
  155. {
  156. "typename": "System.Net.FtpWebResponse",
  157. "assembly": "System"
  158. },
  159. {
  160. "typename": "System.Net.ICredentials",
  161. "assembly": "System"
  162. },
  163. {
  164. "typename": "System.Net.NetworkCredential",
  165. "assembly": "System"
  166. },
  167. {
  168. "typename": "System.Net.WebException",
  169. "assembly": "System"
  170. },
  171. {
  172. "typename": "System.Net.WebRequest",
  173. "assembly": "System"
  174. },
  175. {
  176. "typename": "System.Net.WebResponse",
  177. "assembly": "System"
  178. },
  179. {
  180. "typename": "System.Text.RegularExpressions.Regex",
  181. "assembly": "System"
  182. },
  183. {
  184. "typename": "System.Linq.Enumerable",
  185. "assembly": "System.Core"
  186. },
  187. {
  188. "typename": "System.Runtime.CompilerServices.ExtensionAttribute",
  189. "assembly": "System.Core"
  190. },
  191. {
  192. "typename": "System.Web.HttpServerUtility",
  193. "assembly": "System.Web"
  194. },
  195. {
  196. "typename": "System.Action`1",
  197. "assembly": "mscorlib"
  198. },
  199. {
  200. "typename": "System.ArgumentException",
  201. "assembly": "mscorlib"
  202. },
  203. {
  204. "typename": "System.ArgumentNullException",
  205. "assembly": "mscorlib"
  206. },
  207. {
  208. "typename": "System.Array",
  209. "assembly": "mscorlib"
  210. },
  211. {
  212. "typename": "System.Byte",
  213. "assembly": "mscorlib"
  214. },
  215. {
  216. "typename": "System.Char",
  217. "assembly": "mscorlib"
  218. },
  219. {
  220. "typename": "System.Collections.Generic.IEnumerable`1",
  221. "assembly": "mscorlib"
  222. },
  223. {
  224. "typename": "System.Collections.Generic.List`1",
  225. "assembly": "mscorlib"
  226. },
  227. {
  228. "typename": "System.Console",
  229. "assembly": "mscorlib"
  230. },
  231. {
  232. "typename": "System.Convert",
  233. "assembly": "mscorlib"
  234. },
  235. {
  236. "typename": "System.DateTime",
  237. "assembly": "mscorlib"
  238. },
  239. {
  240. "typename": "System.DayOfWeek",
  241. "assembly": "mscorlib"
  242. },
  243. {
  244. "typename": "System.Diagnostics.DebuggableAttribute",
  245. "assembly": "mscorlib"
  246. },
  247. {
  248. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  249. "assembly": "mscorlib"
  250. },
  251. {
  252. "typename": "System.Diagnostics.DebuggerBrowsableAttribute",
  253. "assembly": "mscorlib"
  254. },
  255. {
  256. "typename": "System.Diagnostics.DebuggerBrowsableState",
  257. "assembly": "mscorlib"
  258. },
  259. {
  260. "typename": "System.Exception",
  261. "assembly": "mscorlib"
  262. },
  263. {
  264. "typename": "System.Func`2",
  265. "assembly": "mscorlib"
  266. },
  267. {
  268. "typename": "System.Guid",
  269. "assembly": "mscorlib"
  270. },
  271. {
  272. "typename": "System.IDisposable",
  273. "assembly": "mscorlib"
  274. },
  275. {
  276. "typename": "System.IO.FileMode",
  277. "assembly": "mscorlib"
  278. },
  279. {
  280. "typename": "System.IO.FileStream",
  281. "assembly": "mscorlib"
  282. },
  283. {
  284. "typename": "System.IO.MemoryStream",
  285. "assembly": "mscorlib"
  286. },
  287. {
  288. "typename": "System.IO.Path",
  289. "assembly": "mscorlib"
  290. },
  291. {
  292. "typename": "System.IO.Stream",
  293. "assembly": "mscorlib"
  294. },
  295. {
  296. "typename": "System.IO.StreamReader",
  297. "assembly": "mscorlib"
  298. },
  299. {
  300. "typename": "System.IO.TextReader",
  301. "assembly": "mscorlib"
  302. },
  303. {
  304. "typename": "System.Int32",
  305. "assembly": "mscorlib"
  306. },
  307. {
  308. "typename": "System.Math",
  309. "assembly": "mscorlib"
  310. },
  311. {
  312. "typename": "System.Nullable`1",
  313. "assembly": "mscorlib"
  314. },
  315. {
  316. "typename": "System.Object",
  317. "assembly": "mscorlib"
  318. },
  319. {
  320. "typename": "System.Random",
  321. "assembly": "mscorlib"
  322. },
  323. {
  324. "typename": "System.Reflection.Assembly",
  325. "assembly": "mscorlib"
  326. },
  327. {
  328. "typename": "System.Reflection.MethodBase",
  329. "assembly": "mscorlib"
  330. },
  331. {
  332. "typename": "System.Reflection.MethodInfo",
  333. "assembly": "mscorlib"
  334. },
  335. {
  336. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  337. "assembly": "mscorlib"
  338. },
  339. {
  340. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  341. "assembly": "mscorlib"
  342. },
  343. {
  344. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  345. "assembly": "mscorlib"
  346. },
  347. {
  348. "typename": "System.String",
  349. "assembly": "mscorlib"
  350. },
  351. {
  352. "typename": "System.TimeSpan",
  353. "assembly": "mscorlib"
  354. }
  355. ]
  356. },
  357. "pe": {
  358. "peid_signatures": null,
  359. "imports": [
  360. {
  361. "imports": [
  362. {
  363. "name": "_CorExeMain",
  364. "address": "0x402000"
  365. }
  366. ],
  367. "dll": "mscoree.dll"
  368. }
  369. ],
  370. "digital_signers": null,
  371. "exported_dll_name": null,
  372. "actual_checksum": "0x000ad128",
  373. "overlay": null,
  374. "imagebase": "0x00400000",
  375. "reported_checksum": "0x000ad128",
  376. "icon_hash": null,
  377. "entrypoint": "0x00412d3e",
  378. "timestamp": "2019-05-26 12:28:38",
  379. "osversion": "4.0",
  380. "sections": [
  381. {
  382. "name": ".text",
  383. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  384. "virtual_address": "0x00002000",
  385. "size_of_data": "0x00010e00",
  386. "entropy": "5.21",
  387. "raw_address": "0x00000200",
  388. "virtual_size": "0x00010d44",
  389. "characteristics_raw": "0x60000020"
  390. },
  391. {
  392. "name": ".rsrc",
  393. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  394. "virtual_address": "0x00014000",
  395. "size_of_data": "0x0009ac00",
  396. "entropy": "7.63",
  397. "raw_address": "0x00011000",
  398. "virtual_size": "0x0009ab24",
  399. "characteristics_raw": "0x40000040"
  400. },
  401. {
  402. "name": ".reloc",
  403. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  404. "virtual_address": "0x000b0000",
  405. "size_of_data": "0x00000200",
  406. "entropy": "0.10",
  407. "raw_address": "0x000abc00",
  408. "virtual_size": "0x0000000c",
  409. "characteristics_raw": "0x42000040"
  410. }
  411. ],
  412. "resources": [],
  413. "dirents": [
  414. {
  415. "virtual_address": "0x00000000",
  416. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  417. "size": "0x00000000"
  418. },
  419. {
  420. "virtual_address": "0x00012cf0",
  421. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  422. "size": "0x0000004b"
  423. },
  424. {
  425. "virtual_address": "0x00014000",
  426. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  427. "size": "0x0009ab24"
  428. },
  429. {
  430. "virtual_address": "0x00000000",
  431. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  432. "size": "0x00000000"
  433. },
  434. {
  435. "virtual_address": "0x00000000",
  436. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  437. "size": "0x00000000"
  438. },
  439. {
  440. "virtual_address": "0x000b0000",
  441. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  442. "size": "0x0000000c"
  443. },
  444. {
  445. "virtual_address": "0x00012c70",
  446. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  447. "size": "0x0000001c"
  448. },
  449. {
  450. "virtual_address": "0x00000000",
  451. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  452. "size": "0x00000000"
  453. },
  454. {
  455. "virtual_address": "0x00000000",
  456. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  457. "size": "0x00000000"
  458. },
  459. {
  460. "virtual_address": "0x00000000",
  461. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  462. "size": "0x00000000"
  463. },
  464. {
  465. "virtual_address": "0x00000000",
  466. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  467. "size": "0x00000000"
  468. },
  469. {
  470. "virtual_address": "0x00000000",
  471. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  472. "size": "0x00000000"
  473. },
  474. {
  475. "virtual_address": "0x00002000",
  476. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  477. "size": "0x00000008"
  478. },
  479. {
  480. "virtual_address": "0x00000000",
  481. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  482. "size": "0x00000000"
  483. },
  484. {
  485. "virtual_address": "0x00002008",
  486. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  487. "size": "0x00000048"
  488. },
  489. {
  490. "virtual_address": "0x00000000",
  491. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  492. "size": "0x00000000"
  493. }
  494. ],
  495. "exports": [],
  496. "guest_signers": {},
  497. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  498. "icon_fuzzy": null,
  499. "icon": null,
  500. "pdbpath": "C:\\xampp\\htdocs\\Aspire\\files\\durtch_vsYXWxGtxxfRZxbk\\vsYXWxGtxxfRZxbkma.pdb",
  501. "imported_dll_count": 1,
  502. "versioninfo": []
  503. }
  504. }
  505.  
  506. [*] Resolved APIs: [
  507. "advapi32.dll.RegOpenKeyExW",
  508. "advapi32.dll.RegQueryInfoKeyW",
  509. "advapi32.dll.RegEnumKeyExW",
  510. "advapi32.dll.RegEnumValueW",
  511. "advapi32.dll.RegCloseKey",
  512. "advapi32.dll.RegQueryValueExW",
  513. "kernel32.dll.QueryActCtxW",
  514. "shlwapi.dll.UrlIsW"
  515. ]
  516.  
  517. [*] Static Analysis: {
  518. "dotnet": {
  519. "customattrs": [],
  520. "assemblyinfo": {
  521. "version": "0.0.0.0",
  522. "name": "vsYXWxGtxxfRZxbkma"
  523. },
  524. "assemblyrefs": [
  525. {
  526. "version": "4.0.0.0",
  527. "name": "mscorlib"
  528. },
  529. {
  530. "version": "4.0.0.0",
  531. "name": "System"
  532. },
  533. {
  534. "version": "4.0.0.0",
  535. "name": "System.Web"
  536. },
  537. {
  538. "version": "4.0.0.0",
  539. "name": "System.Core"
  540. }
  541. ],
  542. "typerefs": [
  543. {
  544. "typename": "System.Net.Cookie",
  545. "assembly": "System"
  546. },
  547. {
  548. "typename": "System.Net.FtpStatusCode",
  549. "assembly": "System"
  550. },
  551. {
  552. "typename": "System.Net.FtpWebRequest",
  553. "assembly": "System"
  554. },
  555. {
  556. "typename": "System.Net.FtpWebResponse",
  557. "assembly": "System"
  558. },
  559. {
  560. "typename": "System.Net.ICredentials",
  561. "assembly": "System"
  562. },
  563. {
  564. "typename": "System.Net.NetworkCredential",
  565. "assembly": "System"
  566. },
  567. {
  568. "typename": "System.Net.WebException",
  569. "assembly": "System"
  570. },
  571. {
  572. "typename": "System.Net.WebRequest",
  573. "assembly": "System"
  574. },
  575. {
  576. "typename": "System.Net.WebResponse",
  577. "assembly": "System"
  578. },
  579. {
  580. "typename": "System.Text.RegularExpressions.Regex",
  581. "assembly": "System"
  582. },
  583. {
  584. "typename": "System.Linq.Enumerable",
  585. "assembly": "System.Core"
  586. },
  587. {
  588. "typename": "System.Runtime.CompilerServices.ExtensionAttribute",
  589. "assembly": "System.Core"
  590. },
  591. {
  592. "typename": "System.Web.HttpServerUtility",
  593. "assembly": "System.Web"
  594. },
  595. {
  596. "typename": "System.Action`1",
  597. "assembly": "mscorlib"
  598. },
  599. {
  600. "typename": "System.ArgumentException",
  601. "assembly": "mscorlib"
  602. },
  603. {
  604. "typename": "System.ArgumentNullException",
  605. "assembly": "mscorlib"
  606. },
  607. {
  608. "typename": "System.Array",
  609. "assembly": "mscorlib"
  610. },
  611. {
  612. "typename": "System.Byte",
  613. "assembly": "mscorlib"
  614. },
  615. {
  616. "typename": "System.Char",
  617. "assembly": "mscorlib"
  618. },
  619. {
  620. "typename": "System.Collections.Generic.IEnumerable`1",
  621. "assembly": "mscorlib"
  622. },
  623. {
  624. "typename": "System.Collections.Generic.List`1",
  625. "assembly": "mscorlib"
  626. },
  627. {
  628. "typename": "System.Console",
  629. "assembly": "mscorlib"
  630. },
  631. {
  632. "typename": "System.Convert",
  633. "assembly": "mscorlib"
  634. },
  635. {
  636. "typename": "System.DateTime",
  637. "assembly": "mscorlib"
  638. },
  639. {
  640. "typename": "System.DayOfWeek",
  641. "assembly": "mscorlib"
  642. },
  643. {
  644. "typename": "System.Diagnostics.DebuggableAttribute",
  645. "assembly": "mscorlib"
  646. },
  647. {
  648. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  649. "assembly": "mscorlib"
  650. },
  651. {
  652. "typename": "System.Diagnostics.DebuggerBrowsableAttribute",
  653. "assembly": "mscorlib"
  654. },
  655. {
  656. "typename": "System.Diagnostics.DebuggerBrowsableState",
  657. "assembly": "mscorlib"
  658. },
  659. {
  660. "typename": "System.Exception",
  661. "assembly": "mscorlib"
  662. },
  663. {
  664. "typename": "System.Func`2",
  665. "assembly": "mscorlib"
  666. },
  667. {
  668. "typename": "System.Guid",
  669. "assembly": "mscorlib"
  670. },
  671. {
  672. "typename": "System.IDisposable",
  673. "assembly": "mscorlib"
  674. },
  675. {
  676. "typename": "System.IO.FileMode",
  677. "assembly": "mscorlib"
  678. },
  679. {
  680. "typename": "System.IO.FileStream",
  681. "assembly": "mscorlib"
  682. },
  683. {
  684. "typename": "System.IO.MemoryStream",
  685. "assembly": "mscorlib"
  686. },
  687. {
  688. "typename": "System.IO.Path",
  689. "assembly": "mscorlib"
  690. },
  691. {
  692. "typename": "System.IO.Stream",
  693. "assembly": "mscorlib"
  694. },
  695. {
  696. "typename": "System.IO.StreamReader",
  697. "assembly": "mscorlib"
  698. },
  699. {
  700. "typename": "System.IO.TextReader",
  701. "assembly": "mscorlib"
  702. },
  703. {
  704. "typename": "System.Int32",
  705. "assembly": "mscorlib"
  706. },
  707. {
  708. "typename": "System.Math",
  709. "assembly": "mscorlib"
  710. },
  711. {
  712. "typename": "System.Nullable`1",
  713. "assembly": "mscorlib"
  714. },
  715. {
  716. "typename": "System.Object",
  717. "assembly": "mscorlib"
  718. },
  719. {
  720. "typename": "System.Random",
  721. "assembly": "mscorlib"
  722. },
  723. {
  724. "typename": "System.Reflection.Assembly",
  725. "assembly": "mscorlib"
  726. },
  727. {
  728. "typename": "System.Reflection.MethodBase",
  729. "assembly": "mscorlib"
  730. },
  731. {
  732. "typename": "System.Reflection.MethodInfo",
  733. "assembly": "mscorlib"
  734. },
  735. {
  736. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  737. "assembly": "mscorlib"
  738. },
  739. {
  740. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  741. "assembly": "mscorlib"
  742. },
  743. {
  744. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  745. "assembly": "mscorlib"
  746. },
  747. {
  748. "typename": "System.String",
  749. "assembly": "mscorlib"
  750. },
  751. {
  752. "typename": "System.TimeSpan",
  753. "assembly": "mscorlib"
  754. }
  755. ]
  756. },
  757. "pe": {
  758. "peid_signatures": null,
  759. "imports": [
  760. {
  761. "imports": [
  762. {
  763. "name": "_CorExeMain",
  764. "address": "0x402000"
  765. }
  766. ],
  767. "dll": "mscoree.dll"
  768. }
  769. ],
  770. "digital_signers": null,
  771. "exported_dll_name": null,
  772. "actual_checksum": "0x000ad128",
  773. "overlay": null,
  774. "imagebase": "0x00400000",
  775. "reported_checksum": "0x000ad128",
  776. "icon_hash": null,
  777. "entrypoint": "0x00412d3e",
  778. "timestamp": "2019-05-26 12:28:38",
  779. "osversion": "4.0",
  780. "sections": [
  781. {
  782. "name": ".text",
  783. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  784. "virtual_address": "0x00002000",
  785. "size_of_data": "0x00010e00",
  786. "entropy": "5.21",
  787. "raw_address": "0x00000200",
  788. "virtual_size": "0x00010d44",
  789. "characteristics_raw": "0x60000020"
  790. },
  791. {
  792. "name": ".rsrc",
  793. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  794. "virtual_address": "0x00014000",
  795. "size_of_data": "0x0009ac00",
  796. "entropy": "7.63",
  797. "raw_address": "0x00011000",
  798. "virtual_size": "0x0009ab24",
  799. "characteristics_raw": "0x40000040"
  800. },
  801. {
  802. "name": ".reloc",
  803. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  804. "virtual_address": "0x000b0000",
  805. "size_of_data": "0x00000200",
  806. "entropy": "0.10",
  807. "raw_address": "0x000abc00",
  808. "virtual_size": "0x0000000c",
  809. "characteristics_raw": "0x42000040"
  810. }
  811. ],
  812. "resources": [],
  813. "dirents": [
  814. {
  815. "virtual_address": "0x00000000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  817. "size": "0x00000000"
  818. },
  819. {
  820. "virtual_address": "0x00012cf0",
  821. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  822. "size": "0x0000004b"
  823. },
  824. {
  825. "virtual_address": "0x00014000",
  826. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  827. "size": "0x0009ab24"
  828. },
  829. {
  830. "virtual_address": "0x00000000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  832. "size": "0x00000000"
  833. },
  834. {
  835. "virtual_address": "0x00000000",
  836. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  837. "size": "0x00000000"
  838. },
  839. {
  840. "virtual_address": "0x000b0000",
  841. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  842. "size": "0x0000000c"
  843. },
  844. {
  845. "virtual_address": "0x00012c70",
  846. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  847. "size": "0x0000001c"
  848. },
  849. {
  850. "virtual_address": "0x00000000",
  851. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  852. "size": "0x00000000"
  853. },
  854. {
  855. "virtual_address": "0x00000000",
  856. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  857. "size": "0x00000000"
  858. },
  859. {
  860. "virtual_address": "0x00000000",
  861. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  862. "size": "0x00000000"
  863. },
  864. {
  865. "virtual_address": "0x00000000",
  866. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  867. "size": "0x00000000"
  868. },
  869. {
  870. "virtual_address": "0x00000000",
  871. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  872. "size": "0x00000000"
  873. },
  874. {
  875. "virtual_address": "0x00002000",
  876. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  877. "size": "0x00000008"
  878. },
  879. {
  880. "virtual_address": "0x00000000",
  881. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  882. "size": "0x00000000"
  883. },
  884. {
  885. "virtual_address": "0x00002008",
  886. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  887. "size": "0x00000048"
  888. },
  889. {
  890. "virtual_address": "0x00000000",
  891. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  892. "size": "0x00000000"
  893. }
  894. ],
  895. "exports": [],
  896. "guest_signers": {},
  897. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  898. "icon_fuzzy": null,
  899. "icon": null,
  900. "pdbpath": "C:\\xampp\\htdocs\\Aspire\\files\\durtch_vsYXWxGtxxfRZxbk\\vsYXWxGtxxfRZxbkma.pdb",
  901. "imported_dll_count": 1,
  902. "versioninfo": []
  903. }
  904. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!