API tools faq
paste
paladin316

Dridex_69659706d74718bda28070019432d78d_exe_2019-06-21_20_30.json

paladin316
Jun 21st, 2019
2,191
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 46.49 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Dridex_69659706d74718bda28070019432d78d.exe"
  7. [*] File Size: 281368
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows"
  9. [*] SHA256: "fa747f9d2f329d16947eace988d440bc1ace2f8894dae0dfc5668f1283808e8f"
  10. [*] MD5: "69659706d74718bda28070019432d78d"
  11. [*] SHA1: "3cc881111bf4aabd6fc558a008718341ef9316b9"
  12. [*] SHA512: "5c79407dc46d73784d5b3e63502910c08658fe9a2a2bdb04019bb748e1e07a88d597c4dc807d5b8c37cee74de18cdb6be57f8bfb5e41957e202538022a42a9dd"
  13. [*] CRC32: "F3D05948"
  14. [*] SSDEEP: "6144:ZTktD36+/IXLTw/2T8qX9o4N9gX7EyorHunqfgrnXl:ZYN3pQXLThTtqTrE/tf4l"
  15.  
  16. [*] Process Execution: [
  17. "Dridex_69659706d74718bda28070019432d78d.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Performs some HTTP requests",
  27. "Details": [
  28. {
  29. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  30. },
  31. {
  32. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  33. },
  34. {
  35. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  36. }
  37. ]
  38. },
  39. {
  40. "Description": "The binary likely contains encrypted or compressed data.",
  41. "Details": [
  42. {
  43. "section": "name: .text, entropy: 6.82, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00010800, virtual_size: 0x0001073b"
  44. }
  45. ]
  46. },
  47. {
  48. "Description": "File has been identified by 36 Antiviruses on VirusTotal as malicious",
  49. "Details": [
  50. {
  51. "MicroWorld-eScan": "Trojan.GenericKD.32072221"
  52. },
  53. {
  54. "Qihoo-360": "Win32/Trojan.9ad"
  55. },
  56. {
  57. "Malwarebytes": "Trojan.MalPack.GS"
  58. },
  59. {
  60. "Alibaba": "Trojan:Win32/Kryptik.62e230cb"
  61. },
  62. {
  63. "Arcabit": "Trojan.Generic.D1E9621D"
  64. },
  65. {
  66. "Cyren": "W32/Trojan.BIFV-7602"
  67. },
  68. {
  69. "Symantec": "ML.Attribute.HighConfidence"
  70. },
  71. {
  72. "ESET-NOD32": "a variant of Win32/Kryptik.GUCX"
  73. },
  74. {
  75. "Avast": "Win32:DangerousSig [Trj]"
  76. },
  77. {
  78. "Kaspersky": "Trojan.Win32.Chapak.dpol"
  79. },
  80. {
  81. "BitDefender": "Trojan.GenericKD.32072221"
  82. },
  83. {
  84. "Paloalto": "generic.ml"
  85. },
  86. {
  87. "Rising": "Trojan.MalCert!1.B92C (CLOUD)"
  88. },
  89. {
  90. "Ad-Aware": "Trojan.GenericKD.32072221"
  91. },
  92. {
  93. "Sophos": "Mal/Generic-S"
  94. },
  95. {
  96. "Comodo": "TrojWare.Win32.Fakecsrss.AV@88nqyj"
  97. },
  98. {
  99. "F-Secure": "Trojan.TR/Crypt.Agent.zlxcp"
  100. },
  101. {
  102. "DrWeb": "Trojan.Packed2.41804"
  103. },
  104. {
  105. "Invincea": "heuristic"
  106. },
  107. {
  108. "McAfee-GW-Edition": "Trojan-FQXG!69659706D747"
  109. },
  110. {
  111. "FireEye": "Generic.mg.69659706d74718bd"
  112. },
  113. {
  114. "Emsisoft": "MalCert.D (A)"
  115. },
  116. {
  117. "Webroot": "W32.Trojan.Gen"
  118. },
  119. {
  120. "Avira": "TR/Crypt.Agent.zlxcp"
  121. },
  122. {
  123. "Microsoft": "Trojan:Win32/Fuery.A!cl"
  124. },
  125. {
  126. "Endgame": "malicious (high confidence)"
  127. },
  128. {
  129. "ZoneAlarm": "Trojan.Win32.Chapak.dpol"
  130. },
  131. {
  132. "GData": "Win32.Malware.Dridex.Y24U02"
  133. },
  134. {
  135. "AhnLab-V3": "Trojan/Win32.Kryptik.C3296533"
  136. },
  137. {
  138. "McAfee": "Trojan-FQXG!69659706D747"
  139. },
  140. {
  141. "Tencent": "Win32.Trojan.Chapak.Wpjp"
  142. },
  143. {
  144. "Ikarus": "Trojan.Win32.Crypt"
  145. },
  146. {
  147. "Fortinet": "W32/GenKryptik.DLEW!tr"
  148. },
  149. {
  150. "AVG": "Win32:DangerousSig [Trj]"
  151. },
  152. {
  153. "CrowdStrike": "win/malicious_confidence_80% (W)"
  154. },
  155. {
  156. "MaxSecure": "Ransomeware.CRAB.gen"
  157. }
  158. ]
  159. }
  160. ]
  161.  
  162. [*] Started Service: []
  163.  
  164. [*] Executed Commands: []
  165.  
  166. [*] Mutexes: [
  167. "DBWinMutex"
  168. ]
  169.  
  170. [*] Modified Files: []
  171.  
  172. [*] Deleted Files: []
  173.  
  174. [*] Modified Registry Keys: []
  175.  
  176. [*] Deleted Registry Keys: []
  177.  
  178. [*] DNS Communications: []
  179.  
  180. [*] Domains: []
  181.  
  182. [*] Network Communication - ICMP: []
  183.  
  184. [*] Network Communication - HTTP: [
  185. {
  186. "count": 1,
  187. "body": "",
  188. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  189. "user-agent": "Microsoft-CryptoAPI/6.1",
  190. "method": "GET",
  191. "host": "ocsp.digicert.com",
  192. "version": "1.1",
  193. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  194. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  195. "port": 80
  196. },
  197. {
  198. "count": 1,
  199. "body": "",
  200. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  201. "user-agent": "Microsoft-CryptoAPI/6.1",
  202. "method": "GET",
  203. "host": "ocsp.digicert.com",
  204. "version": "1.1",
  205. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  206. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  207. "port": 80
  208. },
  209. {
  210. "count": 1,
  211. "body": "",
  212. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  213. "user-agent": "Microsoft-CryptoAPI/6.1",
  214. "method": "GET",
  215. "host": "ocsp.digicert.com",
  216. "version": "1.1",
  217. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  218. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  219. "port": 80
  220. }
  221. ]
  222.  
  223. [*] Network Communication - SMTP: []
  224.  
  225. [*] Network Communication - Hosts: []
  226.  
  227. [*] Network Communication - IRC: []
  228.  
  229. [*] Static Analysis: {
  230. "pe": {
  231. "peid_signatures": null,
  232. "imports": [
  233. {
  234. "imports": [
  235. {
  236. "name": "HeapReAlloc",
  237. "address": "0x412000"
  238. },
  239. {
  240. "name": "GetNativeSystemInfo",
  241. "address": "0x412004"
  242. },
  243. {
  244. "name": "GetProfileIntW",
  245. "address": "0x412008"
  246. },
  247. {
  248. "name": "GetDefaultCommConfigW",
  249. "address": "0x41200c"
  250. },
  251. {
  252. "name": "GetProfileStringW",
  253. "address": "0x412010"
  254. },
  255. {
  256. "name": "SetTapeParameters",
  257. "address": "0x412014"
  258. },
  259. {
  260. "name": "MoveFileWithProgressA",
  261. "address": "0x412018"
  262. },
  263. {
  264. "name": "GetTickCount",
  265. "address": "0x41201c"
  266. },
  267. {
  268. "name": "ExpandEnvironmentStringsA",
  269. "address": "0x412020"
  270. },
  271. {
  272. "name": "FormatMessageA",
  273. "address": "0x412024"
  274. },
  275. {
  276. "name": "WaitNamedPipeW",
  277. "address": "0x412028"
  278. },
  279. {
  280. "name": "EnumTimeFormatsA",
  281. "address": "0x41202c"
  282. },
  283. {
  284. "name": "IsBadCodePtr",
  285. "address": "0x412030"
  286. },
  287. {
  288. "name": "GetStringTypeExW",
  289. "address": "0x412034"
  290. },
  291. {
  292. "name": "WritePrivateProfileStructW",
  293. "address": "0x412038"
  294. },
  295. {
  296. "name": "IsProcessorFeaturePresent",
  297. "address": "0x41203c"
  298. },
  299. {
  300. "name": "WritePrivateProfileSectionW",
  301. "address": "0x412040"
  302. },
  303. {
  304. "name": "GetBinaryTypeW",
  305. "address": "0x412044"
  306. },
  307. {
  308. "name": "VerifyVersionInfoW",
  309. "address": "0x412048"
  310. },
  311. {
  312. "name": "Module32First",
  313. "address": "0x41204c"
  314. },
  315. {
  316. "name": "FillConsoleOutputCharacterW",
  317. "address": "0x412050"
  318. },
  319. {
  320. "name": "GetLastError",
  321. "address": "0x412054"
  322. },
  323. {
  324. "name": "GetLongPathNameA",
  325. "address": "0x412058"
  326. },
  327. {
  328. "name": "MoveFileW",
  329. "address": "0x41205c"
  330. },
  331. {
  332. "name": "FreeUserPhysicalPages",
  333. "address": "0x412060"
  334. },
  335. {
  336. "name": "DefineDosDeviceA",
  337. "address": "0x412064"
  338. },
  339. {
  340. "name": "LocalAlloc",
  341. "address": "0x412068"
  342. },
  343. {
  344. "name": "DnsHostnameToComputerNameA",
  345. "address": "0x41206c"
  346. },
  347. {
  348. "name": "FindFirstVolumeMountPointW",
  349. "address": "0x412070"
  350. },
  351. {
  352. "name": "WaitForMultipleObjects",
  353. "address": "0x412074"
  354. },
  355. {
  356. "name": "VirtualProtect",
  357. "address": "0x412078"
  358. },
  359. {
  360. "name": "EncodePointer",
  361. "address": "0x41207c"
  362. },
  363. {
  364. "name": "DecodePointer",
  365. "address": "0x412080"
  366. },
  367. {
  368. "name": "GetCommandLineA",
  369. "address": "0x412084"
  370. },
  371. {
  372. "name": "RaiseException",
  373. "address": "0x412088"
  374. },
  375. {
  376. "name": "RtlUnwind",
  377. "address": "0x41208c"
  378. },
  379. {
  380. "name": "ExitProcess",
  381. "address": "0x412090"
  382. },
  383. {
  384. "name": "GetModuleHandleExW",
  385. "address": "0x412094"
  386. },
  387. {
  388. "name": "GetProcAddress",
  389. "address": "0x412098"
  390. },
  391. {
  392. "name": "MultiByteToWideChar",
  393. "address": "0x41209c"
  394. },
  395. {
  396. "name": "WideCharToMultiByte",
  397. "address": "0x4120a0"
  398. },
  399. {
  400. "name": "HeapSize",
  401. "address": "0x4120a4"
  402. },
  403. {
  404. "name": "HeapFree",
  405. "address": "0x4120a8"
  406. },
  407. {
  408. "name": "HeapAlloc",
  409. "address": "0x4120ac"
  410. },
  411. {
  412. "name": "SetLastError",
  413. "address": "0x4120b0"
  414. },
  415. {
  416. "name": "GetCurrentThreadId",
  417. "address": "0x4120b4"
  418. },
  419. {
  420. "name": "GetProcessHeap",
  421. "address": "0x4120b8"
  422. },
  423. {
  424. "name": "GetStdHandle",
  425. "address": "0x4120bc"
  426. },
  427. {
  428. "name": "GetFileType",
  429. "address": "0x4120c0"
  430. },
  431. {
  432. "name": "DeleteCriticalSection",
  433. "address": "0x4120c4"
  434. },
  435. {
  436. "name": "GetStartupInfoW",
  437. "address": "0x4120c8"
  438. },
  439. {
  440. "name": "GetModuleFileNameA",
  441. "address": "0x4120cc"
  442. },
  443. {
  444. "name": "WriteFile",
  445. "address": "0x4120d0"
  446. },
  447. {
  448. "name": "GetModuleFileNameW",
  449. "address": "0x4120d4"
  450. },
  451. {
  452. "name": "QueryPerformanceCounter",
  453. "address": "0x4120d8"
  454. },
  455. {
  456. "name": "GetCurrentProcessId",
  457. "address": "0x4120dc"
  458. },
  459. {
  460. "name": "GetSystemTimeAsFileTime",
  461. "address": "0x4120e0"
  462. },
  463. {
  464. "name": "GetEnvironmentStringsW",
  465. "address": "0x4120e4"
  466. },
  467. {
  468. "name": "FreeEnvironmentStringsW",
  469. "address": "0x4120e8"
  470. },
  471. {
  472. "name": "UnhandledExceptionFilter",
  473. "address": "0x4120ec"
  474. },
  475. {
  476. "name": "SetUnhandledExceptionFilter",
  477. "address": "0x4120f0"
  478. },
  479. {
  480. "name": "InitializeCriticalSectionAndSpinCount",
  481. "address": "0x4120f4"
  482. },
  483. {
  484. "name": "Sleep",
  485. "address": "0x4120f8"
  486. },
  487. {
  488. "name": "GetCurrentProcess",
  489. "address": "0x4120fc"
  490. },
  491. {
  492. "name": "TerminateProcess",
  493. "address": "0x412100"
  494. },
  495. {
  496. "name": "TlsAlloc",
  497. "address": "0x412104"
  498. },
  499. {
  500. "name": "TlsGetValue",
  501. "address": "0x412108"
  502. },
  503. {
  504. "name": "TlsSetValue",
  505. "address": "0x41210c"
  506. },
  507. {
  508. "name": "TlsFree",
  509. "address": "0x412110"
  510. },
  511. {
  512. "name": "GetModuleHandleW",
  513. "address": "0x412114"
  514. },
  515. {
  516. "name": "IsDebuggerPresent",
  517. "address": "0x412118"
  518. },
  519. {
  520. "name": "EnterCriticalSection",
  521. "address": "0x41211c"
  522. },
  523. {
  524. "name": "LeaveCriticalSection",
  525. "address": "0x412120"
  526. },
  527. {
  528. "name": "LoadLibraryExW",
  529. "address": "0x412124"
  530. },
  531. {
  532. "name": "IsValidCodePage",
  533. "address": "0x412128"
  534. },
  535. {
  536. "name": "GetACP",
  537. "address": "0x41212c"
  538. },
  539. {
  540. "name": "GetOEMCP",
  541. "address": "0x412130"
  542. },
  543. {
  544. "name": "GetCPInfo",
  545. "address": "0x412134"
  546. },
  547. {
  548. "name": "LCMapStringW",
  549. "address": "0x412138"
  550. },
  551. {
  552. "name": "OutputDebugStringW",
  553. "address": "0x41213c"
  554. },
  555. {
  556. "name": "GetStringTypeW",
  557. "address": "0x412140"
  558. },
  559. {
  560. "name": "FlushFileBuffers",
  561. "address": "0x412144"
  562. },
  563. {
  564. "name": "GetConsoleCP",
  565. "address": "0x412148"
  566. },
  567. {
  568. "name": "GetConsoleMode",
  569. "address": "0x41214c"
  570. },
  571. {
  572. "name": "SetStdHandle",
  573. "address": "0x412150"
  574. },
  575. {
  576. "name": "SetFilePointerEx",
  577. "address": "0x412154"
  578. },
  579. {
  580. "name": "WriteConsoleW",
  581. "address": "0x412158"
  582. },
  583. {
  584. "name": "CloseHandle",
  585. "address": "0x41215c"
  586. },
  587. {
  588. "name": "CreateFileW",
  589. "address": "0x412160"
  590. }
  591. ],
  592. "dll": "KERNEL32.dll"
  593. }
  594. ],
  595. "digital_signers": null,
  596. "exported_dll_name": null,
  597. "actual_checksum": "0x00051c0c",
  598. "overlay": {
  599. "size": "0x00001f18",
  600. "offset": "0x00042c00"
  601. },
  602. "imagebase": "0x00400000",
  603. "reported_checksum": "0x00051c0c",
  604. "icon_hash": null,
  605. "entrypoint": "0x00406477",
  606. "timestamp": "2018-07-25 09:28:34",
  607. "osversion": "5.1",
  608. "sections": [
  609. {
  610. "name": ".text",
  611. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  612. "virtual_address": "0x00001000",
  613. "size_of_data": "0x00010800",
  614. "entropy": "6.82",
  615. "raw_address": "0x00000400",
  616. "virtual_size": "0x0001073b",
  617. "characteristics_raw": "0x60000020"
  618. },
  619. {
  620. "name": ".rdata",
  621. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  622. "virtual_address": "0x00012000",
  623. "size_of_data": "0x00027800",
  624. "entropy": "6.28",
  625. "raw_address": "0x00010c00",
  626. "virtual_size": "0x000276c4",
  627. "characteristics_raw": "0x40000040"
  628. },
  629. {
  630. "name": ".data",
  631. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  632. "virtual_address": "0x0003a000",
  633. "size_of_data": "0x00002200",
  634. "entropy": "2.42",
  635. "raw_address": "0x00038400",
  636. "virtual_size": "0x0000e460",
  637. "characteristics_raw": "0xc0000040"
  638. },
  639. {
  640. "name": ".rsrc",
  641. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  642. "virtual_address": "0x00049000",
  643. "size_of_data": "0x00007200",
  644. "entropy": "5.74",
  645. "raw_address": "0x0003a600",
  646. "virtual_size": "0x000071e0",
  647. "characteristics_raw": "0x40000040"
  648. },
  649. {
  650. "name": ".reloc",
  651. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  652. "virtual_address": "0x00051000",
  653. "size_of_data": "0x00001400",
  654. "entropy": "6.33",
  655. "raw_address": "0x00041800",
  656. "virtual_size": "0x00001274",
  657. "characteristics_raw": "0x42000040"
  658. }
  659. ],
  660. "resources": [],
  661. "dirents": [
  662. {
  663. "virtual_address": "0x00000000",
  664. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  665. "size": "0x00000000"
  666. },
  667. {
  668. "virtual_address": "0x00038e64",
  669. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  670. "size": "0x00000028"
  671. },
  672. {
  673. "virtual_address": "0x00049000",
  674. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  675. "size": "0x000071e0"
  676. },
  677. {
  678. "virtual_address": "0x00000000",
  679. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  680. "size": "0x00000000"
  681. },
  682. {
  683. "virtual_address": "0x00042c00",
  684. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  685. "size": "0x00001f18"
  686. },
  687. {
  688. "virtual_address": "0x00051000",
  689. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  690. "size": "0x00001274"
  691. },
  692. {
  693. "virtual_address": "0x000121c0",
  694. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  695. "size": "0x00000038"
  696. },
  697. {
  698. "virtual_address": "0x00000000",
  699. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  700. "size": "0x00000000"
  701. },
  702. {
  703. "virtual_address": "0x00000000",
  704. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  705. "size": "0x00000000"
  706. },
  707. {
  708. "virtual_address": "0x00000000",
  709. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  710. "size": "0x00000000"
  711. },
  712. {
  713. "virtual_address": "0x00000000",
  714. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  715. "size": "0x00000000"
  716. },
  717. {
  718. "virtual_address": "0x00000000",
  719. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  720. "size": "0x00000000"
  721. },
  722. {
  723. "virtual_address": "0x00012000",
  724. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  725. "size": "0x00000168"
  726. },
  727. {
  728. "virtual_address": "0x00000000",
  729. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  730. "size": "0x00000000"
  731. },
  732. {
  733. "virtual_address": "0x00000000",
  734. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  735. "size": "0x00000000"
  736. },
  737. {
  738. "virtual_address": "0x00000000",
  739. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  740. "size": "0x00000000"
  741. }
  742. ],
  743. "exports": [],
  744. "guest_signers": {},
  745. "imphash": "27d988ed096d38fb8ee666e8edfa2fe0",
  746. "icon_fuzzy": null,
  747. "icon": null,
  748. "pdbpath": "C:\\becetupigibuh.pdb\\x00ver\\runtime\\crypt\\tmp_1455301041\\bin\\tofewira.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xbcC\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xb0\\x84C",
  749. "imported_dll_count": 1,
  750. "versioninfo": []
  751. }
  752. }
  753.  
  754. [*] Resolved APIs: [
  755. "kernel32.dll.FlsAlloc",
  756. "kernel32.dll.FlsFree",
  757. "kernel32.dll.FlsGetValue",
  758. "kernel32.dll.FlsSetValue",
  759. "kernel32.dll.InitializeCriticalSectionEx",
  760. "kernel32.dll.CreateEventExW",
  761. "kernel32.dll.CreateSemaphoreExW",
  762. "kernel32.dll.SetThreadStackGuarantee",
  763. "kernel32.dll.CreateThreadpoolTimer",
  764. "kernel32.dll.SetThreadpoolTimer",
  765. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  766. "kernel32.dll.CloseThreadpoolTimer",
  767. "kernel32.dll.CreateThreadpoolWait",
  768. "kernel32.dll.SetThreadpoolWait",
  769. "kernel32.dll.CloseThreadpoolWait",
  770. "kernel32.dll.FlushProcessWriteBuffers",
  771. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  772. "kernel32.dll.GetCurrentProcessorNumber",
  773. "kernel32.dll.GetLogicalProcessorInformation",
  774. "kernel32.dll.CreateSymbolicLinkW",
  775. "kernel32.dll.EnumSystemLocalesEx",
  776. "kernel32.dll.CompareStringEx",
  777. "kernel32.dll.GetDateFormatEx",
  778. "kernel32.dll.GetLocaleInfoEx",
  779. "kernel32.dll.GetTimeFormatEx",
  780. "kernel32.dll.GetUserDefaultLocaleName",
  781. "kernel32.dll.IsValidLocaleName",
  782. "kernel32.dll.LCMapStringEx",
  783. "kernel32.dll.GetTickCount64",
  784. "kernel32.dll.GlobalAlloc",
  785. "kernel32.dll.GetLastError",
  786. "kernel32.dll.Sleep",
  787. "kernel32.dll.CreateToolhelp32Snapshot",
  788. "kernel32.dll.Module32First",
  789. "kernel32.dll.CloseHandle",
  790. "kernel32.dll.LoadLibraryA",
  791. "kernel32.dll.VirtualAlloc",
  792. "kernel32.dll.VirtualProtect",
  793. "kernel32.dll.VirtualFree",
  794. "kernel32.dll.GetVersionExA",
  795. "kernel32.dll.TerminateProcess",
  796. "kernel32.dll.ExitProcess",
  797. "kernel32.dll.SetErrorMode",
  798. "kernel32.dll.FreeConsole",
  799. "kernel32.dll.OutputDebugStringW",
  800. "msvcr100.dll.atexit"
  801. ]
  802.  
  803. [*] Static Analysis: {
  804. "pe": {
  805. "peid_signatures": null,
  806. "imports": [
  807. {
  808. "imports": [
  809. {
  810. "name": "HeapReAlloc",
  811. "address": "0x412000"
  812. },
  813. {
  814. "name": "GetNativeSystemInfo",
  815. "address": "0x412004"
  816. },
  817. {
  818. "name": "GetProfileIntW",
  819. "address": "0x412008"
  820. },
  821. {
  822. "name": "GetDefaultCommConfigW",
  823. "address": "0x41200c"
  824. },
  825. {
  826. "name": "GetProfileStringW",
  827. "address": "0x412010"
  828. },
  829. {
  830. "name": "SetTapeParameters",
  831. "address": "0x412014"
  832. },
  833. {
  834. "name": "MoveFileWithProgressA",
  835. "address": "0x412018"
  836. },
  837. {
  838. "name": "GetTickCount",
  839. "address": "0x41201c"
  840. },
  841. {
  842. "name": "ExpandEnvironmentStringsA",
  843. "address": "0x412020"
  844. },
  845. {
  846. "name": "FormatMessageA",
  847. "address": "0x412024"
  848. },
  849. {
  850. "name": "WaitNamedPipeW",
  851. "address": "0x412028"
  852. },
  853. {
  854. "name": "EnumTimeFormatsA",
  855. "address": "0x41202c"
  856. },
  857. {
  858. "name": "IsBadCodePtr",
  859. "address": "0x412030"
  860. },
  861. {
  862. "name": "GetStringTypeExW",
  863. "address": "0x412034"
  864. },
  865. {
  866. "name": "WritePrivateProfileStructW",
  867. "address": "0x412038"
  868. },
  869. {
  870. "name": "IsProcessorFeaturePresent",
  871. "address": "0x41203c"
  872. },
  873. {
  874. "name": "WritePrivateProfileSectionW",
  875. "address": "0x412040"
  876. },
  877. {
  878. "name": "GetBinaryTypeW",
  879. "address": "0x412044"
  880. },
  881. {
  882. "name": "VerifyVersionInfoW",
  883. "address": "0x412048"
  884. },
  885. {
  886. "name": "Module32First",
  887. "address": "0x41204c"
  888. },
  889. {
  890. "name": "FillConsoleOutputCharacterW",
  891. "address": "0x412050"
  892. },
  893. {
  894. "name": "GetLastError",
  895. "address": "0x412054"
  896. },
  897. {
  898. "name": "GetLongPathNameA",
  899. "address": "0x412058"
  900. },
  901. {
  902. "name": "MoveFileW",
  903. "address": "0x41205c"
  904. },
  905. {
  906. "name": "FreeUserPhysicalPages",
  907. "address": "0x412060"
  908. },
  909. {
  910. "name": "DefineDosDeviceA",
  911. "address": "0x412064"
  912. },
  913. {
  914. "name": "LocalAlloc",
  915. "address": "0x412068"
  916. },
  917. {
  918. "name": "DnsHostnameToComputerNameA",
  919. "address": "0x41206c"
  920. },
  921. {
  922. "name": "FindFirstVolumeMountPointW",
  923. "address": "0x412070"
  924. },
  925. {
  926. "name": "WaitForMultipleObjects",
  927. "address": "0x412074"
  928. },
  929. {
  930. "name": "VirtualProtect",
  931. "address": "0x412078"
  932. },
  933. {
  934. "name": "EncodePointer",
  935. "address": "0x41207c"
  936. },
  937. {
  938. "name": "DecodePointer",
  939. "address": "0x412080"
  940. },
  941. {
  942. "name": "GetCommandLineA",
  943. "address": "0x412084"
  944. },
  945. {
  946. "name": "RaiseException",
  947. "address": "0x412088"
  948. },
  949. {
  950. "name": "RtlUnwind",
  951. "address": "0x41208c"
  952. },
  953. {
  954. "name": "ExitProcess",
  955. "address": "0x412090"
  956. },
  957. {
  958. "name": "GetModuleHandleExW",
  959. "address": "0x412094"
  960. },
  961. {
  962. "name": "GetProcAddress",
  963. "address": "0x412098"
  964. },
  965. {
  966. "name": "MultiByteToWideChar",
  967. "address": "0x41209c"
  968. },
  969. {
  970. "name": "WideCharToMultiByte",
  971. "address": "0x4120a0"
  972. },
  973. {
  974. "name": "HeapSize",
  975. "address": "0x4120a4"
  976. },
  977. {
  978. "name": "HeapFree",
  979. "address": "0x4120a8"
  980. },
  981. {
  982. "name": "HeapAlloc",
  983. "address": "0x4120ac"
  984. },
  985. {
  986. "name": "SetLastError",
  987. "address": "0x4120b0"
  988. },
  989. {
  990. "name": "GetCurrentThreadId",
  991. "address": "0x4120b4"
  992. },
  993. {
  994. "name": "GetProcessHeap",
  995. "address": "0x4120b8"
  996. },
  997. {
  998. "name": "GetStdHandle",
  999. "address": "0x4120bc"
  1000. },
  1001. {
  1002. "name": "GetFileType",
  1003. "address": "0x4120c0"
  1004. },
  1005. {
  1006. "name": "DeleteCriticalSection",
  1007. "address": "0x4120c4"
  1008. },
  1009. {
  1010. "name": "GetStartupInfoW",
  1011. "address": "0x4120c8"
  1012. },
  1013. {
  1014. "name": "GetModuleFileNameA",
  1015. "address": "0x4120cc"
  1016. },
  1017. {
  1018. "name": "WriteFile",
  1019. "address": "0x4120d0"
  1020. },
  1021. {
  1022. "name": "GetModuleFileNameW",
  1023. "address": "0x4120d4"
  1024. },
  1025. {
  1026. "name": "QueryPerformanceCounter",
  1027. "address": "0x4120d8"
  1028. },
  1029. {
  1030. "name": "GetCurrentProcessId",
  1031. "address": "0x4120dc"
  1032. },
  1033. {
  1034. "name": "GetSystemTimeAsFileTime",
  1035. "address": "0x4120e0"
  1036. },
  1037. {
  1038. "name": "GetEnvironmentStringsW",
  1039. "address": "0x4120e4"
  1040. },
  1041. {
  1042. "name": "FreeEnvironmentStringsW",
  1043. "address": "0x4120e8"
  1044. },
  1045. {
  1046. "name": "UnhandledExceptionFilter",
  1047. "address": "0x4120ec"
  1048. },
  1049. {
  1050. "name": "SetUnhandledExceptionFilter",
  1051. "address": "0x4120f0"
  1052. },
  1053. {
  1054. "name": "InitializeCriticalSectionAndSpinCount",
  1055. "address": "0x4120f4"
  1056. },
  1057. {
  1058. "name": "Sleep",
  1059. "address": "0x4120f8"
  1060. },
  1061. {
  1062. "name": "GetCurrentProcess",
  1063. "address": "0x4120fc"
  1064. },
  1065. {
  1066. "name": "TerminateProcess",
  1067. "address": "0x412100"
  1068. },
  1069. {
  1070. "name": "TlsAlloc",
  1071. "address": "0x412104"
  1072. },
  1073. {
  1074. "name": "TlsGetValue",
  1075. "address": "0x412108"
  1076. },
  1077. {
  1078. "name": "TlsSetValue",
  1079. "address": "0x41210c"
  1080. },
  1081. {
  1082. "name": "TlsFree",
  1083. "address": "0x412110"
  1084. },
  1085. {
  1086. "name": "GetModuleHandleW",
  1087. "address": "0x412114"
  1088. },
  1089. {
  1090. "name": "IsDebuggerPresent",
  1091. "address": "0x412118"
  1092. },
  1093. {
  1094. "name": "EnterCriticalSection",
  1095. "address": "0x41211c"
  1096. },
  1097. {
  1098. "name": "LeaveCriticalSection",
  1099. "address": "0x412120"
  1100. },
  1101. {
  1102. "name": "LoadLibraryExW",
  1103. "address": "0x412124"
  1104. },
  1105. {
  1106. "name": "IsValidCodePage",
  1107. "address": "0x412128"
  1108. },
  1109. {
  1110. "name": "GetACP",
  1111. "address": "0x41212c"
  1112. },
  1113. {
  1114. "name": "GetOEMCP",
  1115. "address": "0x412130"
  1116. },
  1117. {
  1118. "name": "GetCPInfo",
  1119. "address": "0x412134"
  1120. },
  1121. {
  1122. "name": "LCMapStringW",
  1123. "address": "0x412138"
  1124. },
  1125. {
  1126. "name": "OutputDebugStringW",
  1127. "address": "0x41213c"
  1128. },
  1129. {
  1130. "name": "GetStringTypeW",
  1131. "address": "0x412140"
  1132. },
  1133. {
  1134. "name": "FlushFileBuffers",
  1135. "address": "0x412144"
  1136. },
  1137. {
  1138. "name": "GetConsoleCP",
  1139. "address": "0x412148"
  1140. },
  1141. {
  1142. "name": "GetConsoleMode",
  1143. "address": "0x41214c"
  1144. },
  1145. {
  1146. "name": "SetStdHandle",
  1147. "address": "0x412150"
  1148. },
  1149. {
  1150. "name": "SetFilePointerEx",
  1151. "address": "0x412154"
  1152. },
  1153. {
  1154. "name": "WriteConsoleW",
  1155. "address": "0x412158"
  1156. },
  1157. {
  1158. "name": "CloseHandle",
  1159. "address": "0x41215c"
  1160. },
  1161. {
  1162. "name": "CreateFileW",
  1163. "address": "0x412160"
  1164. }
  1165. ],
  1166. "dll": "KERNEL32.dll"
  1167. }
  1168. ],
  1169. "digital_signers": null,
  1170. "exported_dll_name": null,
  1171. "actual_checksum": "0x00051c0c",
  1172. "overlay": {
  1173. "size": "0x00001f18",
  1174. "offset": "0x00042c00"
  1175. },
  1176. "imagebase": "0x00400000",
  1177. "reported_checksum": "0x00051c0c",
  1178. "icon_hash": null,
  1179. "entrypoint": "0x00406477",
  1180. "timestamp": "2018-07-25 09:28:34",
  1181. "osversion": "5.1",
  1182. "sections": [
  1183. {
  1184. "name": ".text",
  1185. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1186. "virtual_address": "0x00001000",
  1187. "size_of_data": "0x00010800",
  1188. "entropy": "6.82",
  1189. "raw_address": "0x00000400",
  1190. "virtual_size": "0x0001073b",
  1191. "characteristics_raw": "0x60000020"
  1192. },
  1193. {
  1194. "name": ".rdata",
  1195. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1196. "virtual_address": "0x00012000",
  1197. "size_of_data": "0x00027800",
  1198. "entropy": "6.28",
  1199. "raw_address": "0x00010c00",
  1200. "virtual_size": "0x000276c4",
  1201. "characteristics_raw": "0x40000040"
  1202. },
  1203. {
  1204. "name": ".data",
  1205. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1206. "virtual_address": "0x0003a000",
  1207. "size_of_data": "0x00002200",
  1208. "entropy": "2.42",
  1209. "raw_address": "0x00038400",
  1210. "virtual_size": "0x0000e460",
  1211. "characteristics_raw": "0xc0000040"
  1212. },
  1213. {
  1214. "name": ".rsrc",
  1215. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1216. "virtual_address": "0x00049000",
  1217. "size_of_data": "0x00007200",
  1218. "entropy": "5.74",
  1219. "raw_address": "0x0003a600",
  1220. "virtual_size": "0x000071e0",
  1221. "characteristics_raw": "0x40000040"
  1222. },
  1223. {
  1224. "name": ".reloc",
  1225. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1226. "virtual_address": "0x00051000",
  1227. "size_of_data": "0x00001400",
  1228. "entropy": "6.33",
  1229. "raw_address": "0x00041800",
  1230. "virtual_size": "0x00001274",
  1231. "characteristics_raw": "0x42000040"
  1232. }
  1233. ],
  1234. "resources": [],
  1235. "dirents": [
  1236. {
  1237. "virtual_address": "0x00000000",
  1238. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1239. "size": "0x00000000"
  1240. },
  1241. {
  1242. "virtual_address": "0x00038e64",
  1243. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1244. "size": "0x00000028"
  1245. },
  1246. {
  1247. "virtual_address": "0x00049000",
  1248. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1249. "size": "0x000071e0"
  1250. },
  1251. {
  1252. "virtual_address": "0x00000000",
  1253. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1254. "size": "0x00000000"
  1255. },
  1256. {
  1257. "virtual_address": "0x00042c00",
  1258. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1259. "size": "0x00001f18"
  1260. },
  1261. {
  1262. "virtual_address": "0x00051000",
  1263. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1264. "size": "0x00001274"
  1265. },
  1266. {
  1267. "virtual_address": "0x000121c0",
  1268. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1269. "size": "0x00000038"
  1270. },
  1271. {
  1272. "virtual_address": "0x00000000",
  1273. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1274. "size": "0x00000000"
  1275. },
  1276. {
  1277. "virtual_address": "0x00000000",
  1278. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1279. "size": "0x00000000"
  1280. },
  1281. {
  1282. "virtual_address": "0x00000000",
  1283. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1284. "size": "0x00000000"
  1285. },
  1286. {
  1287. "virtual_address": "0x00000000",
  1288. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1289. "size": "0x00000000"
  1290. },
  1291. {
  1292. "virtual_address": "0x00000000",
  1293. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1294. "size": "0x00000000"
  1295. },
  1296. {
  1297. "virtual_address": "0x00012000",
  1298. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1299. "size": "0x00000168"
  1300. },
  1301. {
  1302. "virtual_address": "0x00000000",
  1303. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1304. "size": "0x00000000"
  1305. },
  1306. {
  1307. "virtual_address": "0x00000000",
  1308. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1309. "size": "0x00000000"
  1310. },
  1311. {
  1312. "virtual_address": "0x00000000",
  1313. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1314. "size": "0x00000000"
  1315. }
  1316. ],
  1317. "exports": [],
  1318. "guest_signers": {},
  1319. "imphash": "27d988ed096d38fb8ee666e8edfa2fe0",
  1320. "icon_fuzzy": null,
  1321. "icon": null,
  1322. "pdbpath": "C:\\becetupigibuh.pdb\\x00ver\\runtime\\crypt\\tmp_1455301041\\bin\\tofewira.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xbcC\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xb0\\x84C",
  1323. "imported_dll_count": 1,
  1324. "versioninfo": []
  1325. }
  1326. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!