API tools faq
paste
paladin316

Exes_5ab89a44b0beaa8d72fdf09c2ba4ceb2_exe_2019-06-30_15_30.json

paladin316
Jun 30th, 2019
2,145
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 48.56 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 1.5
  5.  
  6. [*] File Name: "Exes_5ab89a44b0beaa8d72fdf09c2ba4ceb2.exe"
  7. [*] File Size: 547328
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "7f11551476be0f559baf92cf971e50efa0013de620c47a1de9e576a723b4330c"
  10. [*] MD5: "5ab89a44b0beaa8d72fdf09c2ba4ceb2"
  11. [*] SHA1: "1878757bd069988150453677f5a077503dee744f"
  12. [*] SHA512: "9a3df9a96e7d46a2dd48aca073f0f28e5945387d464a01c27ecd4bf6374edce2360fb6a2d2548edf54aa1b6b431839287bdb949c017291c7df057bf4994ab500"
  13. [*] CRC32: "AA0221EF"
  14. [*] SSDEEP: "6144:jLlV4dNW5niz84U63Pn8ETjjeJWSY/xkTvfyIqZzBYQIBIjAEtjxcfkK6:j34dNWRi1U08ETjmCy3qV3ISjAaycz"
  15.  
  16. [*] Process Execution: [
  17. "Exes_5ab89a44b0beaa8d72fdf09c2ba4ceb2.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "A process created a hidden window",
  27. "Details": [
  28. {
  29. "Process": "Exes_5ab89a44b0beaa8d72fdf09c2ba4ceb2.exe -> C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
  30. }
  31. ]
  32. }
  33. ]
  34.  
  35. [*] Started Service: []
  36.  
  37. [*] Executed Commands: [
  38. "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe \"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_5ab89a44b0beaa8d72fdf09c2ba4ceb2.exe\""
  39. ]
  40.  
  41. [*] Mutexes: [
  42. "DBWinMutex"
  43. ]
  44.  
  45. [*] Modified Files: []
  46.  
  47. [*] Deleted Files: []
  48.  
  49. [*] Modified Registry Keys: []
  50.  
  51. [*] Deleted Registry Keys: []
  52.  
  53. [*] DNS Communications: []
  54.  
  55. [*] Domains: []
  56.  
  57. [*] Network Communication - ICMP: []
  58.  
  59. [*] Network Communication - HTTP: []
  60.  
  61. [*] Network Communication - SMTP: []
  62.  
  63. [*] Network Communication - Hosts: []
  64.  
  65. [*] Network Communication - IRC: []
  66.  
  67. [*] Static Analysis: {
  68. "pe": {
  69. "peid_signatures": null,
  70. "imports": [
  71. {
  72. "imports": [
  73. {
  74. "name": "LoadLibraryA",
  75. "address": "0x408000"
  76. },
  77. {
  78. "name": "LCMapStringW",
  79. "address": "0x408004"
  80. },
  81. {
  82. "name": "LCMapStringA",
  83. "address": "0x408008"
  84. },
  85. {
  86. "name": "GetStringTypeW",
  87. "address": "0x40800c"
  88. },
  89. {
  90. "name": "MultiByteToWideChar",
  91. "address": "0x408010"
  92. },
  93. {
  94. "name": "GetStringTypeA",
  95. "address": "0x408014"
  96. },
  97. {
  98. "name": "WideCharToMultiByte",
  99. "address": "0x408018"
  100. },
  101. {
  102. "name": "GetLocaleInfoA",
  103. "address": "0x40801c"
  104. },
  105. {
  106. "name": "HeapSize",
  107. "address": "0x408020"
  108. },
  109. {
  110. "name": "IsValidCodePage",
  111. "address": "0x408024"
  112. },
  113. {
  114. "name": "GetOEMCP",
  115. "address": "0x408028"
  116. },
  117. {
  118. "name": "GetACP",
  119. "address": "0x40802c"
  120. },
  121. {
  122. "name": "GetCPInfo",
  123. "address": "0x408030"
  124. },
  125. {
  126. "name": "RtlUnwind",
  127. "address": "0x408034"
  128. },
  129. {
  130. "name": "InitializeCriticalSectionAndSpinCount",
  131. "address": "0x408038"
  132. },
  133. {
  134. "name": "IsDebuggerPresent",
  135. "address": "0x40803c"
  136. },
  137. {
  138. "name": "UnhandledExceptionFilter",
  139. "address": "0x408040"
  140. },
  141. {
  142. "name": "GetCurrentProcess",
  143. "address": "0x408044"
  144. },
  145. {
  146. "name": "TerminateProcess",
  147. "address": "0x408048"
  148. },
  149. {
  150. "name": "GetSystemTimeAsFileTime",
  151. "address": "0x40804c"
  152. },
  153. {
  154. "name": "GetCurrentProcessId",
  155. "address": "0x408050"
  156. },
  157. {
  158. "name": "GetTickCount",
  159. "address": "0x408054"
  160. },
  161. {
  162. "name": "QueryPerformanceCounter",
  163. "address": "0x408058"
  164. },
  165. {
  166. "name": "InterlockedDecrement",
  167. "address": "0x40805c"
  168. },
  169. {
  170. "name": "GetCurrentThreadId",
  171. "address": "0x408060"
  172. },
  173. {
  174. "name": "SetLastError",
  175. "address": "0x408064"
  176. },
  177. {
  178. "name": "InterlockedIncrement",
  179. "address": "0x408068"
  180. },
  181. {
  182. "name": "TlsFree",
  183. "address": "0x40806c"
  184. },
  185. {
  186. "name": "TlsSetValue",
  187. "address": "0x408070"
  188. },
  189. {
  190. "name": "TlsAlloc",
  191. "address": "0x408074"
  192. },
  193. {
  194. "name": "TlsGetValue",
  195. "address": "0x408078"
  196. },
  197. {
  198. "name": "GetStartupInfoA",
  199. "address": "0x40807c"
  200. },
  201. {
  202. "name": "GetFileType",
  203. "address": "0x408080"
  204. },
  205. {
  206. "name": "SetHandleCount",
  207. "address": "0x408084"
  208. },
  209. {
  210. "name": "GetCommandLineW",
  211. "address": "0x408088"
  212. },
  213. {
  214. "name": "GetEnvironmentStringsW",
  215. "address": "0x40808c"
  216. },
  217. {
  218. "name": "FreeEnvironmentStringsW",
  219. "address": "0x408090"
  220. },
  221. {
  222. "name": "GetModuleFileNameW",
  223. "address": "0x408094"
  224. },
  225. {
  226. "name": "SetUnhandledExceptionFilter",
  227. "address": "0x408098"
  228. },
  229. {
  230. "name": "GetModuleFileNameA",
  231. "address": "0x40809c"
  232. },
  233. {
  234. "name": "GetStdHandle",
  235. "address": "0x4080a0"
  236. },
  237. {
  238. "name": "WriteFile",
  239. "address": "0x4080a4"
  240. },
  241. {
  242. "name": "ExitProcess",
  243. "address": "0x4080a8"
  244. },
  245. {
  246. "name": "GetProcAddress",
  247. "address": "0x4080ac"
  248. },
  249. {
  250. "name": "Sleep",
  251. "address": "0x4080b0"
  252. },
  253. {
  254. "name": "GetModuleHandleW",
  255. "address": "0x4080b4"
  256. },
  257. {
  258. "name": "HeapReAlloc",
  259. "address": "0x4080b8"
  260. },
  261. {
  262. "name": "VirtualAlloc",
  263. "address": "0x4080bc"
  264. },
  265. {
  266. "name": "EnterCriticalSection",
  267. "address": "0x4080c0"
  268. },
  269. {
  270. "name": "LeaveCriticalSection",
  271. "address": "0x4080c4"
  272. },
  273. {
  274. "name": "DeleteCriticalSection",
  275. "address": "0x4080c8"
  276. },
  277. {
  278. "name": "VirtualFree",
  279. "address": "0x4080cc"
  280. },
  281. {
  282. "name": "HeapCreate",
  283. "address": "0x4080d0"
  284. },
  285. {
  286. "name": "GetStartupInfoW",
  287. "address": "0x4080d4"
  288. },
  289. {
  290. "name": "HeapAlloc",
  291. "address": "0x4080d8"
  292. },
  293. {
  294. "name": "HeapFree",
  295. "address": "0x4080dc"
  296. },
  297. {
  298. "name": "GetLastError",
  299. "address": "0x4080e0"
  300. }
  301. ],
  302. "dll": "KERNEL32.dll"
  303. },
  304. {
  305. "imports": [
  306. {
  307. "name": "DeleteFormW",
  308. "address": "0x4080e8"
  309. },
  310. {
  311. "name": "GetPrintProcessorDirectoryA",
  312. "address": "0x4080ec"
  313. },
  314. {
  315. "name": "FreePrinterNotifyInfo",
  316. "address": "0x4080f0"
  317. },
  318. {
  319. "name": "EnumPrintProcessorDatatypesA",
  320. "address": "0x4080f4"
  321. },
  322. {
  323. "name": "EnumPrinterDataExW",
  324. "address": "0x4080f8"
  325. },
  326. {
  327. "name": "AdvancedDocumentPropertiesW",
  328. "address": "0x4080fc"
  329. },
  330. {
  331. "name": "DeletePrinterDataA",
  332. "address": "0x408100"
  333. },
  334. {
  335. "name": "DeletePrintProcessorA",
  336. "address": "0x408104"
  337. },
  338. {
  339. "name": "DevQueryPrint",
  340. "address": "0x408108"
  341. },
  342. {
  343. "name": "FindFirstPrinterChangeNotification",
  344. "address": "0x40810c"
  345. },
  346. {
  347. "name": null,
  348. "address": "0x408110"
  349. },
  350. {
  351. "name": "AddPrinterDriverExW",
  352. "address": "0x408114"
  353. },
  354. {
  355. "name": null,
  356. "address": "0x408118"
  357. },
  358. {
  359. "name": "ScheduleJob",
  360. "address": "0x40811c"
  361. }
  362. ],
  363. "dll": "WINSPOOL.DRV"
  364. },
  365. {
  366. "imports": [
  367. {
  368. "name": "OleCreateFromFile",
  369. "address": "0x408198"
  370. },
  371. {
  372. "name": "CoGetInstanceFromFile",
  373. "address": "0x40819c"
  374. },
  375. {
  376. "name": "MonikerCommonPrefixWith",
  377. "address": "0x4081a0"
  378. },
  379. {
  380. "name": "CoGetTreatAsClass",
  381. "address": "0x4081a4"
  382. },
  383. {
  384. "name": "SNB_UserSize",
  385. "address": "0x4081a8"
  386. },
  387. {
  388. "name": "UtConvertDvtd16toDvtd32",
  389. "address": "0x4081ac"
  390. },
  391. {
  392. "name": "OleUninitialize",
  393. "address": "0x4081b0"
  394. },
  395. {
  396. "name": "CoUnloadingWOW",
  397. "address": "0x4081b4"
  398. },
  399. {
  400. "name": "ReadOleStg",
  401. "address": "0x4081b8"
  402. },
  403. {
  404. "name": "CoGetCurrentProcess",
  405. "address": "0x4081bc"
  406. },
  407. {
  408. "name": "CoGetMarshalSizeMax",
  409. "address": "0x4081c0"
  410. },
  411. {
  412. "name": "GetRunningObjectTable",
  413. "address": "0x4081c4"
  414. },
  415. {
  416. "name": "StgGetIFillLockBytesOnFile",
  417. "address": "0x4081c8"
  418. },
  419. {
  420. "name": "CoQueryClientBlanket",
  421. "address": "0x4081cc"
  422. },
  423. {
  424. "name": "SetConvertStg",
  425. "address": "0x4081d0"
  426. },
  427. {
  428. "name": "CoFileTimeNow",
  429. "address": "0x4081d4"
  430. }
  431. ],
  432. "dll": "ole32.dll"
  433. },
  434. {
  435. "imports": [
  436. {
  437. "name": "CheckBitmapBits",
  438. "address": "0x408124"
  439. },
  440. {
  441. "name": "DisassociateColorProfileFromDeviceA",
  442. "address": "0x408128"
  443. },
  444. {
  445. "name": "CreateProfileFromLogColorSpaceW",
  446. "address": "0x40812c"
  447. },
  448. {
  449. "name": "IsColorProfileValid",
  450. "address": "0x408130"
  451. },
  452. {
  453. "name": "TranslateColors",
  454. "address": "0x408134"
  455. },
  456. {
  457. "name": "RegisterCMMA",
  458. "address": "0x408138"
  459. },
  460. {
  461. "name": "GetColorProfileElement",
  462. "address": "0x40813c"
  463. },
  464. {
  465. "name": "EnumColorProfilesA",
  466. "address": "0x408140"
  467. },
  468. {
  469. "name": "DeleteColorTransform",
  470. "address": "0x408144"
  471. },
  472. {
  473. "name": "CloseColorProfile",
  474. "address": "0x408148"
  475. },
  476. {
  477. "name": "CreateColorTransformA",
  478. "address": "0x40814c"
  479. }
  480. ],
  481. "dll": "mscms.dll"
  482. },
  483. {
  484. "imports": [
  485. {
  486. "name": null,
  487. "address": "0x408154"
  488. },
  489. {
  490. "name": null,
  491. "address": "0x408158"
  492. },
  493. {
  494. "name": null,
  495. "address": "0x40815c"
  496. },
  497. {
  498. "name": null,
  499. "address": "0x408160"
  500. },
  501. {
  502. "name": null,
  503. "address": "0x408164"
  504. },
  505. {
  506. "name": null,
  507. "address": "0x408168"
  508. },
  509. {
  510. "name": null,
  511. "address": "0x40816c"
  512. },
  513. {
  514. "name": null,
  515. "address": "0x408170"
  516. },
  517. {
  518. "name": null,
  519. "address": "0x408174"
  520. },
  521. {
  522. "name": null,
  523. "address": "0x408178"
  524. },
  525. {
  526. "name": null,
  527. "address": "0x40817c"
  528. },
  529. {
  530. "name": null,
  531. "address": "0x408180"
  532. },
  533. {
  534. "name": null,
  535. "address": "0x408184"
  536. },
  537. {
  538. "name": null,
  539. "address": "0x408188"
  540. },
  541. {
  542. "name": null,
  543. "address": "0x40818c"
  544. },
  545. {
  546. "name": null,
  547. "address": "0x408190"
  548. }
  549. ],
  550. "dll": "msi.dll"
  551. },
  552. {
  553. "imports": [
  554. {
  555. "name": "TraceDeregisterW",
  556. "address": "0x4081dc"
  557. },
  558. {
  559. "name": "TraceDeregisterExW",
  560. "address": "0x4081e0"
  561. },
  562. {
  563. "name": "RouterLogEventDataW",
  564. "address": "0x4081e4"
  565. },
  566. {
  567. "name": "TraceDeregisterA",
  568. "address": "0x4081e8"
  569. },
  570. {
  571. "name": "MprSetupProtocolFree",
  572. "address": "0x4081ec"
  573. },
  574. {
  575. "name": "RouterGetErrorStringW",
  576. "address": "0x4081f0"
  577. },
  578. {
  579. "name": "LogErrorA",
  580. "address": "0x4081f4"
  581. },
  582. {
  583. "name": "TracePrintfExA",
  584. "address": "0x4081f8"
  585. },
  586. {
  587. "name": "RouterLogRegisterW",
  588. "address": "0x4081fc"
  589. },
  590. {
  591. "name": "TracePrintfExW",
  592. "address": "0x408200"
  593. }
  594. ],
  595. "dll": "rtutils.dll"
  596. }
  597. ],
  598. "digital_signers": null,
  599. "exported_dll_name": null,
  600. "actual_checksum": "0x0008aa18",
  601. "overlay": null,
  602. "imagebase": "0x00400000",
  603. "reported_checksum": "0x00000000",
  604. "icon_hash": null,
  605. "entrypoint": "0x00401fd5",
  606. "timestamp": "2019-06-25 00:28:59",
  607. "osversion": "5.0",
  608. "sections": [
  609. {
  610. "name": ".text",
  611. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  612. "virtual_address": "0x00001000",
  613. "size_of_data": "0x00006e00",
  614. "entropy": "6.64",
  615. "raw_address": "0x00000400",
  616. "virtual_size": "0x00006d74",
  617. "characteristics_raw": "0x60000020"
  618. },
  619. {
  620. "name": ".rdata",
  621. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  622. "virtual_address": "0x00008000",
  623. "size_of_data": "0x00002400",
  624. "entropy": "5.40",
  625. "raw_address": "0x00007200",
  626. "virtual_size": "0x00002262",
  627. "characteristics_raw": "0x40000040"
  628. },
  629. {
  630. "name": ".data",
  631. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  632. "virtual_address": "0x0000b000",
  633. "size_of_data": "0x00008200",
  634. "entropy": "6.69",
  635. "raw_address": "0x00009600",
  636. "virtual_size": "0x00008ddc",
  637. "characteristics_raw": "0xc0000040"
  638. },
  639. {
  640. "name": ".rsrc",
  641. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  642. "virtual_address": "0x00014000",
  643. "size_of_data": "0x00072e00",
  644. "entropy": "6.75",
  645. "raw_address": "0x00011800",
  646. "virtual_size": "0x00072cd4",
  647. "characteristics_raw": "0x40000040"
  648. },
  649. {
  650. "name": ".reloc",
  651. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  652. "virtual_address": "0x00087000",
  653. "size_of_data": "0x00001400",
  654. "entropy": "5.31",
  655. "raw_address": "0x00084600",
  656. "virtual_size": "0x00001386",
  657. "characteristics_raw": "0x42000040"
  658. }
  659. ],
  660. "resources": [],
  661. "dirents": [
  662. {
  663. "virtual_address": "0x00000000",
  664. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  665. "size": "0x00000000"
  666. },
  667. {
  668. "virtual_address": "0x00009734",
  669. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  670. "size": "0x0000008c"
  671. },
  672. {
  673. "virtual_address": "0x00014000",
  674. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  675. "size": "0x00072cd4"
  676. },
  677. {
  678. "virtual_address": "0x00000000",
  679. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  680. "size": "0x00000000"
  681. },
  682. {
  683. "virtual_address": "0x00000000",
  684. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  685. "size": "0x00000000"
  686. },
  687. {
  688. "virtual_address": "0x00087000",
  689. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  690. "size": "0x00000db0"
  691. },
  692. {
  693. "virtual_address": "0x00000000",
  694. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  695. "size": "0x00000000"
  696. },
  697. {
  698. "virtual_address": "0x00000000",
  699. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  700. "size": "0x00000000"
  701. },
  702. {
  703. "virtual_address": "0x00000000",
  704. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  705. "size": "0x00000000"
  706. },
  707. {
  708. "virtual_address": "0x00000000",
  709. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  710. "size": "0x00000000"
  711. },
  712. {
  713. "virtual_address": "0x00009430",
  714. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  715. "size": "0x00000040"
  716. },
  717. {
  718. "virtual_address": "0x00000000",
  719. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  720. "size": "0x00000000"
  721. },
  722. {
  723. "virtual_address": "0x00008000",
  724. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  725. "size": "0x00000208"
  726. },
  727. {
  728. "virtual_address": "0x00000000",
  729. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  730. "size": "0x00000000"
  731. },
  732. {
  733. "virtual_address": "0x00000000",
  734. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  735. "size": "0x00000000"
  736. },
  737. {
  738. "virtual_address": "0x00000000",
  739. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  740. "size": "0x00000000"
  741. }
  742. ],
  743. "exports": [],
  744. "guest_signers": {},
  745. "imphash": "8c43e0533b1c61deb86d8d36fc7a5a37",
  746. "icon_fuzzy": null,
  747. "icon": null,
  748. "pdbpath": null,
  749. "imported_dll_count": 6,
  750. "versioninfo": []
  751. }
  752. }
  753.  
  754. [*] Resolved APIs: [
  755. "kernel32.dll.FlsAlloc",
  756. "kernel32.dll.FlsGetValue",
  757. "kernel32.dll.FlsSetValue",
  758. "kernel32.dll.FlsFree"
  759. ]
  760.  
  761. [*] Static Analysis: {
  762. "pe": {
  763. "peid_signatures": null,
  764. "imports": [
  765. {
  766. "imports": [
  767. {
  768. "name": "LoadLibraryA",
  769. "address": "0x408000"
  770. },
  771. {
  772. "name": "LCMapStringW",
  773. "address": "0x408004"
  774. },
  775. {
  776. "name": "LCMapStringA",
  777. "address": "0x408008"
  778. },
  779. {
  780. "name": "GetStringTypeW",
  781. "address": "0x40800c"
  782. },
  783. {
  784. "name": "MultiByteToWideChar",
  785. "address": "0x408010"
  786. },
  787. {
  788. "name": "GetStringTypeA",
  789. "address": "0x408014"
  790. },
  791. {
  792. "name": "WideCharToMultiByte",
  793. "address": "0x408018"
  794. },
  795. {
  796. "name": "GetLocaleInfoA",
  797. "address": "0x40801c"
  798. },
  799. {
  800. "name": "HeapSize",
  801. "address": "0x408020"
  802. },
  803. {
  804. "name": "IsValidCodePage",
  805. "address": "0x408024"
  806. },
  807. {
  808. "name": "GetOEMCP",
  809. "address": "0x408028"
  810. },
  811. {
  812. "name": "GetACP",
  813. "address": "0x40802c"
  814. },
  815. {
  816. "name": "GetCPInfo",
  817. "address": "0x408030"
  818. },
  819. {
  820. "name": "RtlUnwind",
  821. "address": "0x408034"
  822. },
  823. {
  824. "name": "InitializeCriticalSectionAndSpinCount",
  825. "address": "0x408038"
  826. },
  827. {
  828. "name": "IsDebuggerPresent",
  829. "address": "0x40803c"
  830. },
  831. {
  832. "name": "UnhandledExceptionFilter",
  833. "address": "0x408040"
  834. },
  835. {
  836. "name": "GetCurrentProcess",
  837. "address": "0x408044"
  838. },
  839. {
  840. "name": "TerminateProcess",
  841. "address": "0x408048"
  842. },
  843. {
  844. "name": "GetSystemTimeAsFileTime",
  845. "address": "0x40804c"
  846. },
  847. {
  848. "name": "GetCurrentProcessId",
  849. "address": "0x408050"
  850. },
  851. {
  852. "name": "GetTickCount",
  853. "address": "0x408054"
  854. },
  855. {
  856. "name": "QueryPerformanceCounter",
  857. "address": "0x408058"
  858. },
  859. {
  860. "name": "InterlockedDecrement",
  861. "address": "0x40805c"
  862. },
  863. {
  864. "name": "GetCurrentThreadId",
  865. "address": "0x408060"
  866. },
  867. {
  868. "name": "SetLastError",
  869. "address": "0x408064"
  870. },
  871. {
  872. "name": "InterlockedIncrement",
  873. "address": "0x408068"
  874. },
  875. {
  876. "name": "TlsFree",
  877. "address": "0x40806c"
  878. },
  879. {
  880. "name": "TlsSetValue",
  881. "address": "0x408070"
  882. },
  883. {
  884. "name": "TlsAlloc",
  885. "address": "0x408074"
  886. },
  887. {
  888. "name": "TlsGetValue",
  889. "address": "0x408078"
  890. },
  891. {
  892. "name": "GetStartupInfoA",
  893. "address": "0x40807c"
  894. },
  895. {
  896. "name": "GetFileType",
  897. "address": "0x408080"
  898. },
  899. {
  900. "name": "SetHandleCount",
  901. "address": "0x408084"
  902. },
  903. {
  904. "name": "GetCommandLineW",
  905. "address": "0x408088"
  906. },
  907. {
  908. "name": "GetEnvironmentStringsW",
  909. "address": "0x40808c"
  910. },
  911. {
  912. "name": "FreeEnvironmentStringsW",
  913. "address": "0x408090"
  914. },
  915. {
  916. "name": "GetModuleFileNameW",
  917. "address": "0x408094"
  918. },
  919. {
  920. "name": "SetUnhandledExceptionFilter",
  921. "address": "0x408098"
  922. },
  923. {
  924. "name": "GetModuleFileNameA",
  925. "address": "0x40809c"
  926. },
  927. {
  928. "name": "GetStdHandle",
  929. "address": "0x4080a0"
  930. },
  931. {
  932. "name": "WriteFile",
  933. "address": "0x4080a4"
  934. },
  935. {
  936. "name": "ExitProcess",
  937. "address": "0x4080a8"
  938. },
  939. {
  940. "name": "GetProcAddress",
  941. "address": "0x4080ac"
  942. },
  943. {
  944. "name": "Sleep",
  945. "address": "0x4080b0"
  946. },
  947. {
  948. "name": "GetModuleHandleW",
  949. "address": "0x4080b4"
  950. },
  951. {
  952. "name": "HeapReAlloc",
  953. "address": "0x4080b8"
  954. },
  955. {
  956. "name": "VirtualAlloc",
  957. "address": "0x4080bc"
  958. },
  959. {
  960. "name": "EnterCriticalSection",
  961. "address": "0x4080c0"
  962. },
  963. {
  964. "name": "LeaveCriticalSection",
  965. "address": "0x4080c4"
  966. },
  967. {
  968. "name": "DeleteCriticalSection",
  969. "address": "0x4080c8"
  970. },
  971. {
  972. "name": "VirtualFree",
  973. "address": "0x4080cc"
  974. },
  975. {
  976. "name": "HeapCreate",
  977. "address": "0x4080d0"
  978. },
  979. {
  980. "name": "GetStartupInfoW",
  981. "address": "0x4080d4"
  982. },
  983. {
  984. "name": "HeapAlloc",
  985. "address": "0x4080d8"
  986. },
  987. {
  988. "name": "HeapFree",
  989. "address": "0x4080dc"
  990. },
  991. {
  992. "name": "GetLastError",
  993. "address": "0x4080e0"
  994. }
  995. ],
  996. "dll": "KERNEL32.dll"
  997. },
  998. {
  999. "imports": [
  1000. {
  1001. "name": "DeleteFormW",
  1002. "address": "0x4080e8"
  1003. },
  1004. {
  1005. "name": "GetPrintProcessorDirectoryA",
  1006. "address": "0x4080ec"
  1007. },
  1008. {
  1009. "name": "FreePrinterNotifyInfo",
  1010. "address": "0x4080f0"
  1011. },
  1012. {
  1013. "name": "EnumPrintProcessorDatatypesA",
  1014. "address": "0x4080f4"
  1015. },
  1016. {
  1017. "name": "EnumPrinterDataExW",
  1018. "address": "0x4080f8"
  1019. },
  1020. {
  1021. "name": "AdvancedDocumentPropertiesW",
  1022. "address": "0x4080fc"
  1023. },
  1024. {
  1025. "name": "DeletePrinterDataA",
  1026. "address": "0x408100"
  1027. },
  1028. {
  1029. "name": "DeletePrintProcessorA",
  1030. "address": "0x408104"
  1031. },
  1032. {
  1033. "name": "DevQueryPrint",
  1034. "address": "0x408108"
  1035. },
  1036. {
  1037. "name": "FindFirstPrinterChangeNotification",
  1038. "address": "0x40810c"
  1039. },
  1040. {
  1041. "name": null,
  1042. "address": "0x408110"
  1043. },
  1044. {
  1045. "name": "AddPrinterDriverExW",
  1046. "address": "0x408114"
  1047. },
  1048. {
  1049. "name": null,
  1050. "address": "0x408118"
  1051. },
  1052. {
  1053. "name": "ScheduleJob",
  1054. "address": "0x40811c"
  1055. }
  1056. ],
  1057. "dll": "WINSPOOL.DRV"
  1058. },
  1059. {
  1060. "imports": [
  1061. {
  1062. "name": "OleCreateFromFile",
  1063. "address": "0x408198"
  1064. },
  1065. {
  1066. "name": "CoGetInstanceFromFile",
  1067. "address": "0x40819c"
  1068. },
  1069. {
  1070. "name": "MonikerCommonPrefixWith",
  1071. "address": "0x4081a0"
  1072. },
  1073. {
  1074. "name": "CoGetTreatAsClass",
  1075. "address": "0x4081a4"
  1076. },
  1077. {
  1078. "name": "SNB_UserSize",
  1079. "address": "0x4081a8"
  1080. },
  1081. {
  1082. "name": "UtConvertDvtd16toDvtd32",
  1083. "address": "0x4081ac"
  1084. },
  1085. {
  1086. "name": "OleUninitialize",
  1087. "address": "0x4081b0"
  1088. },
  1089. {
  1090. "name": "CoUnloadingWOW",
  1091. "address": "0x4081b4"
  1092. },
  1093. {
  1094. "name": "ReadOleStg",
  1095. "address": "0x4081b8"
  1096. },
  1097. {
  1098. "name": "CoGetCurrentProcess",
  1099. "address": "0x4081bc"
  1100. },
  1101. {
  1102. "name": "CoGetMarshalSizeMax",
  1103. "address": "0x4081c0"
  1104. },
  1105. {
  1106. "name": "GetRunningObjectTable",
  1107. "address": "0x4081c4"
  1108. },
  1109. {
  1110. "name": "StgGetIFillLockBytesOnFile",
  1111. "address": "0x4081c8"
  1112. },
  1113. {
  1114. "name": "CoQueryClientBlanket",
  1115. "address": "0x4081cc"
  1116. },
  1117. {
  1118. "name": "SetConvertStg",
  1119. "address": "0x4081d0"
  1120. },
  1121. {
  1122. "name": "CoFileTimeNow",
  1123. "address": "0x4081d4"
  1124. }
  1125. ],
  1126. "dll": "ole32.dll"
  1127. },
  1128. {
  1129. "imports": [
  1130. {
  1131. "name": "CheckBitmapBits",
  1132. "address": "0x408124"
  1133. },
  1134. {
  1135. "name": "DisassociateColorProfileFromDeviceA",
  1136. "address": "0x408128"
  1137. },
  1138. {
  1139. "name": "CreateProfileFromLogColorSpaceW",
  1140. "address": "0x40812c"
  1141. },
  1142. {
  1143. "name": "IsColorProfileValid",
  1144. "address": "0x408130"
  1145. },
  1146. {
  1147. "name": "TranslateColors",
  1148. "address": "0x408134"
  1149. },
  1150. {
  1151. "name": "RegisterCMMA",
  1152. "address": "0x408138"
  1153. },
  1154. {
  1155. "name": "GetColorProfileElement",
  1156. "address": "0x40813c"
  1157. },
  1158. {
  1159. "name": "EnumColorProfilesA",
  1160. "address": "0x408140"
  1161. },
  1162. {
  1163. "name": "DeleteColorTransform",
  1164. "address": "0x408144"
  1165. },
  1166. {
  1167. "name": "CloseColorProfile",
  1168. "address": "0x408148"
  1169. },
  1170. {
  1171. "name": "CreateColorTransformA",
  1172. "address": "0x40814c"
  1173. }
  1174. ],
  1175. "dll": "mscms.dll"
  1176. },
  1177. {
  1178. "imports": [
  1179. {
  1180. "name": null,
  1181. "address": "0x408154"
  1182. },
  1183. {
  1184. "name": null,
  1185. "address": "0x408158"
  1186. },
  1187. {
  1188. "name": null,
  1189. "address": "0x40815c"
  1190. },
  1191. {
  1192. "name": null,
  1193. "address": "0x408160"
  1194. },
  1195. {
  1196. "name": null,
  1197. "address": "0x408164"
  1198. },
  1199. {
  1200. "name": null,
  1201. "address": "0x408168"
  1202. },
  1203. {
  1204. "name": null,
  1205. "address": "0x40816c"
  1206. },
  1207. {
  1208. "name": null,
  1209. "address": "0x408170"
  1210. },
  1211. {
  1212. "name": null,
  1213. "address": "0x408174"
  1214. },
  1215. {
  1216. "name": null,
  1217. "address": "0x408178"
  1218. },
  1219. {
  1220. "name": null,
  1221. "address": "0x40817c"
  1222. },
  1223. {
  1224. "name": null,
  1225. "address": "0x408180"
  1226. },
  1227. {
  1228. "name": null,
  1229. "address": "0x408184"
  1230. },
  1231. {
  1232. "name": null,
  1233. "address": "0x408188"
  1234. },
  1235. {
  1236. "name": null,
  1237. "address": "0x40818c"
  1238. },
  1239. {
  1240. "name": null,
  1241. "address": "0x408190"
  1242. }
  1243. ],
  1244. "dll": "msi.dll"
  1245. },
  1246. {
  1247. "imports": [
  1248. {
  1249. "name": "TraceDeregisterW",
  1250. "address": "0x4081dc"
  1251. },
  1252. {
  1253. "name": "TraceDeregisterExW",
  1254. "address": "0x4081e0"
  1255. },
  1256. {
  1257. "name": "RouterLogEventDataW",
  1258. "address": "0x4081e4"
  1259. },
  1260. {
  1261. "name": "TraceDeregisterA",
  1262. "address": "0x4081e8"
  1263. },
  1264. {
  1265. "name": "MprSetupProtocolFree",
  1266. "address": "0x4081ec"
  1267. },
  1268. {
  1269. "name": "RouterGetErrorStringW",
  1270. "address": "0x4081f0"
  1271. },
  1272. {
  1273. "name": "LogErrorA",
  1274. "address": "0x4081f4"
  1275. },
  1276. {
  1277. "name": "TracePrintfExA",
  1278. "address": "0x4081f8"
  1279. },
  1280. {
  1281. "name": "RouterLogRegisterW",
  1282. "address": "0x4081fc"
  1283. },
  1284. {
  1285. "name": "TracePrintfExW",
  1286. "address": "0x408200"
  1287. }
  1288. ],
  1289. "dll": "rtutils.dll"
  1290. }
  1291. ],
  1292. "digital_signers": null,
  1293. "exported_dll_name": null,
  1294. "actual_checksum": "0x0008aa18",
  1295. "overlay": null,
  1296. "imagebase": "0x00400000",
  1297. "reported_checksum": "0x00000000",
  1298. "icon_hash": null,
  1299. "entrypoint": "0x00401fd5",
  1300. "timestamp": "2019-06-25 00:28:59",
  1301. "osversion": "5.0",
  1302. "sections": [
  1303. {
  1304. "name": ".text",
  1305. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1306. "virtual_address": "0x00001000",
  1307. "size_of_data": "0x00006e00",
  1308. "entropy": "6.64",
  1309. "raw_address": "0x00000400",
  1310. "virtual_size": "0x00006d74",
  1311. "characteristics_raw": "0x60000020"
  1312. },
  1313. {
  1314. "name": ".rdata",
  1315. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1316. "virtual_address": "0x00008000",
  1317. "size_of_data": "0x00002400",
  1318. "entropy": "5.40",
  1319. "raw_address": "0x00007200",
  1320. "virtual_size": "0x00002262",
  1321. "characteristics_raw": "0x40000040"
  1322. },
  1323. {
  1324. "name": ".data",
  1325. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1326. "virtual_address": "0x0000b000",
  1327. "size_of_data": "0x00008200",
  1328. "entropy": "6.69",
  1329. "raw_address": "0x00009600",
  1330. "virtual_size": "0x00008ddc",
  1331. "characteristics_raw": "0xc0000040"
  1332. },
  1333. {
  1334. "name": ".rsrc",
  1335. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1336. "virtual_address": "0x00014000",
  1337. "size_of_data": "0x00072e00",
  1338. "entropy": "6.75",
  1339. "raw_address": "0x00011800",
  1340. "virtual_size": "0x00072cd4",
  1341. "characteristics_raw": "0x40000040"
  1342. },
  1343. {
  1344. "name": ".reloc",
  1345. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1346. "virtual_address": "0x00087000",
  1347. "size_of_data": "0x00001400",
  1348. "entropy": "5.31",
  1349. "raw_address": "0x00084600",
  1350. "virtual_size": "0x00001386",
  1351. "characteristics_raw": "0x42000040"
  1352. }
  1353. ],
  1354. "resources": [],
  1355. "dirents": [
  1356. {
  1357. "virtual_address": "0x00000000",
  1358. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1359. "size": "0x00000000"
  1360. },
  1361. {
  1362. "virtual_address": "0x00009734",
  1363. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1364. "size": "0x0000008c"
  1365. },
  1366. {
  1367. "virtual_address": "0x00014000",
  1368. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1369. "size": "0x00072cd4"
  1370. },
  1371. {
  1372. "virtual_address": "0x00000000",
  1373. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1374. "size": "0x00000000"
  1375. },
  1376. {
  1377. "virtual_address": "0x00000000",
  1378. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1379. "size": "0x00000000"
  1380. },
  1381. {
  1382. "virtual_address": "0x00087000",
  1383. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1384. "size": "0x00000db0"
  1385. },
  1386. {
  1387. "virtual_address": "0x00000000",
  1388. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1389. "size": "0x00000000"
  1390. },
  1391. {
  1392. "virtual_address": "0x00000000",
  1393. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1394. "size": "0x00000000"
  1395. },
  1396. {
  1397. "virtual_address": "0x00000000",
  1398. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1399. "size": "0x00000000"
  1400. },
  1401. {
  1402. "virtual_address": "0x00000000",
  1403. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1404. "size": "0x00000000"
  1405. },
  1406. {
  1407. "virtual_address": "0x00009430",
  1408. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1409. "size": "0x00000040"
  1410. },
  1411. {
  1412. "virtual_address": "0x00000000",
  1413. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1414. "size": "0x00000000"
  1415. },
  1416. {
  1417. "virtual_address": "0x00008000",
  1418. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1419. "size": "0x00000208"
  1420. },
  1421. {
  1422. "virtual_address": "0x00000000",
  1423. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1424. "size": "0x00000000"
  1425. },
  1426. {
  1427. "virtual_address": "0x00000000",
  1428. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1429. "size": "0x00000000"
  1430. },
  1431. {
  1432. "virtual_address": "0x00000000",
  1433. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1434. "size": "0x00000000"
  1435. }
  1436. ],
  1437. "exports": [],
  1438. "guest_signers": {},
  1439. "imphash": "8c43e0533b1c61deb86d8d36fc7a5a37",
  1440. "icon_fuzzy": null,
  1441. "icon": null,
  1442. "pdbpath": null,
  1443. "imported_dll_count": 6,
  1444. "versioninfo": []
  1445. }
  1446. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!