API tools faq
paste
paladin316

Exes_0beb47fb8d046a51f181b5979f08d960_exe_2019-07-03_19_30.json

paladin316
Jul 3rd, 2019
2,143
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.61 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_0beb47fb8d046a51f181b5979f08d960.exe"
  7. [*] File Size: 570368
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "bc88ce71668c818fda4b7afaac7cf38959d7316e81e0e8359984bc9dbb69b30d"
  10. [*] MD5: "0beb47fb8d046a51f181b5979f08d960"
  11. [*] SHA1: "1efcb649b88f5501df5aca47c1a225cc3a0084f6"
  12. [*] SHA512: "0c3210a2d1d4b5f8e683a911e7dc4096e0e0e6eb9573a11cdd3f063a6660767bccaf1c4aafdb2de818f7f89d7c5bb1abf55194f2e29250a52d9f90d8905571b2"
  13. [*] CRC32: "17C1EE79"
  14. [*] SSDEEP: "6144:j6ny90TKxLIqB7yqLTRN+BjgGC59b/XJt7IIbo1Otgo8A:GnyyKLYqLTL+lgGsx/XF8OGoj"
  15.  
  16. [*] Process Execution: [
  17. "Exes_0beb47fb8d046a51f181b5979f08d960.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Anomalous .NET characteristics",
  23. "Details": [
  24. {
  25. "anomalous_version": "Assembly version is set to 0"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "File has been identified by 35 Antiviruses on VirusTotal as malicious",
  31. "Details": [
  32. {
  33. "MicroWorld-eScan": "Gen:Variant.Razy.520223"
  34. },
  35. {
  36. "FireEye": "Gen:Variant.Razy.520223"
  37. },
  38. {
  39. "McAfee": "RDN/Generic BackDoor"
  40. },
  41. {
  42. "Cylance": "Unsafe"
  43. },
  44. {
  45. "BitDefender": "Gen:Variant.Razy.520223"
  46. },
  47. {
  48. "K7GW": "Trojan ( 0054fd2d1 )"
  49. },
  50. {
  51. "K7AntiVirus": "Trojan ( 0054fd2d1 )"
  52. },
  53. {
  54. "TrendMicro": "TROJ_GEN.R03BC0PFC19"
  55. },
  56. {
  57. "Symantec": "Trojan.Gen.2"
  58. },
  59. {
  60. "APEX": "Malicious"
  61. },
  62. {
  63. "Kaspersky": "HEUR:Backdoor.MSIL.NanoBot.gen"
  64. },
  65. {
  66. "Alibaba": "Backdoor:MSIL/Injector.2d4e8eca"
  67. },
  68. {
  69. "AegisLab": "Trojan.MSIL.NanoBot.4!c"
  70. },
  71. {
  72. "Rising": "Backdoor.NanoBot!8.28C (CLOUD)"
  73. },
  74. {
  75. "Ad-Aware": "Gen:Variant.Razy.520223"
  76. },
  77. {
  78. "Sophos": "Mal/Generic-S"
  79. },
  80. {
  81. "F-Secure": "Trojan.TR/Injector.uuoue"
  82. },
  83. {
  84. "McAfee-GW-Edition": "RDN/Generic BackDoor"
  85. },
  86. {
  87. "Fortinet": "MSIL/Kryptik.RWW!tr"
  88. },
  89. {
  90. "Emsisoft": "Gen:Variant.Razy.520223 (B)"
  91. },
  92. {
  93. "Ikarus": "Trojan.MSIL.Injector"
  94. },
  95. {
  96. "Cyren": "W32/Trojan.XUOO-7867"
  97. },
  98. {
  99. "Endgame": "malicious (high confidence)"
  100. },
  101. {
  102. "Avira": "TR/Injector.uuoue"
  103. },
  104. {
  105. "ZoneAlarm": "HEUR:Backdoor.MSIL.NanoBot.gen"
  106. },
  107. {
  108. "Microsoft": "VirTool:MSIL/Subti.U!bit"
  109. },
  110. {
  111. "ESET-NOD32": "a variant of MSIL/Injector.UKR"
  112. },
  113. {
  114. "Acronis": "suspicious"
  115. },
  116. {
  117. "TrendMicro-HouseCall": "TROJ_GEN.R03BC0PFC19"
  118. },
  119. {
  120. "SentinelOne": "DFI - Malicious PE"
  121. },
  122. {
  123. "GData": "Gen:Variant.Razy.520223"
  124. },
  125. {
  126. "AVG": "FileRepMalware"
  127. },
  128. {
  129. "Panda": "Trj/GdSda.A"
  130. },
  131. {
  132. "CrowdStrike": "win/malicious_confidence_100% (W)"
  133. },
  134. {
  135. "Qihoo-360": "Win32/Backdoor.BO.5c9"
  136. }
  137. ]
  138. },
  139. {
  140. "Description": "Anomalous binary characteristics",
  141. "Details": [
  142. {
  143. "anomaly": "Actual checksum does not match that reported in PE header"
  144. }
  145. ]
  146. }
  147. ]
  148.  
  149. [*] Started Service: []
  150.  
  151. [*] Executed Commands: []
  152.  
  153. [*] Mutexes: []
  154.  
  155. [*] Modified Files: []
  156.  
  157. [*] Deleted Files: []
  158.  
  159. [*] Modified Registry Keys: []
  160.  
  161. [*] Deleted Registry Keys: []
  162.  
  163. [*] DNS Communications: []
  164.  
  165. [*] Domains: []
  166.  
  167. [*] Network Communication - ICMP: []
  168.  
  169. [*] Network Communication - HTTP: []
  170.  
  171. [*] Network Communication - SMTP: []
  172.  
  173. [*] Network Communication - Hosts: []
  174.  
  175. [*] Network Communication - IRC: []
  176.  
  177. [*] Static Analysis: {
  178. "dotnet": {
  179. "customattrs": [],
  180. "assemblyinfo": {
  181. "version": "0.0.0.0",
  182. "name": "oZyhvPuWiBLzanKIma"
  183. },
  184. "assemblyrefs": [
  185. {
  186. "version": "4.0.0.0",
  187. "name": "mscorlib"
  188. },
  189. {
  190. "version": "4.0.0.0",
  191. "name": "System"
  192. },
  193. {
  194. "version": "4.0.0.0",
  195. "name": "System.Windows.Forms"
  196. },
  197. {
  198. "version": "4.0.0.0",
  199. "name": "System.Drawing"
  200. },
  201. {
  202. "version": "4.0.0.0",
  203. "name": "System.Core"
  204. },
  205. {
  206. "version": "6.0.0.0",
  207. "name": "EntityFramework"
  208. }
  209. ],
  210. "typerefs": [
  211. {
  212. "typename": "System.Data.Entity.Core.Objects.ObjectContext",
  213. "assembly": "EntityFramework"
  214. },
  215. {
  216. "typename": "System.Data.Entity.Core.Objects.ObjectParameter",
  217. "assembly": "EntityFramework"
  218. },
  219. {
  220. "typename": "System.Data.Entity.DbContext",
  221. "assembly": "EntityFramework"
  222. },
  223. {
  224. "typename": "System.Data.Entity.DbModelBuilder",
  225. "assembly": "EntityFramework"
  226. },
  227. {
  228. "typename": "System.Data.Entity.DbSet`1",
  229. "assembly": "EntityFramework"
  230. },
  231. {
  232. "typename": "System.Data.Entity.Infrastructure.IObjectContextAdapter",
  233. "assembly": "EntityFramework"
  234. },
  235. {
  236. "typename": "System.Data.Entity.Infrastructure.UnintentionalCodeFirstException",
  237. "assembly": "EntityFramework"
  238. },
  239. {
  240. "typename": "System.ComponentModel.IContainer",
  241. "assembly": "System"
  242. },
  243. {
  244. "typename": "System.Net.Cookie",
  245. "assembly": "System"
  246. },
  247. {
  248. "typename": "System.Collections.Generic.HashSet`1",
  249. "assembly": "System.Core"
  250. },
  251. {
  252. "typename": "System.Drawing.Size",
  253. "assembly": "System.Drawing"
  254. },
  255. {
  256. "typename": "System.Drawing.SizeF",
  257. "assembly": "System.Drawing"
  258. },
  259. {
  260. "typename": "System.Windows.Forms.Application",
  261. "assembly": "System.Windows.Forms"
  262. },
  263. {
  264. "typename": "System.Windows.Forms.AutoScaleMode",
  265. "assembly": "System.Windows.Forms"
  266. },
  267. {
  268. "typename": "System.Windows.Forms.ContainerControl",
  269. "assembly": "System.Windows.Forms"
  270. },
  271. {
  272. "typename": "System.Windows.Forms.Control",
  273. "assembly": "System.Windows.Forms"
  274. },
  275. {
  276. "typename": "System.Windows.Forms.Form",
  277. "assembly": "System.Windows.Forms"
  278. },
  279. {
  280. "typename": "System.Windows.Forms.FormStartPosition",
  281. "assembly": "System.Windows.Forms"
  282. },
  283. {
  284. "typename": "System.Windows.Forms.FormWindowState",
  285. "assembly": "System.Windows.Forms"
  286. },
  287. {
  288. "typename": "System.Boolean",
  289. "assembly": "mscorlib"
  290. },
  291. {
  292. "typename": "System.Byte",
  293. "assembly": "mscorlib"
  294. },
  295. {
  296. "typename": "System.Collections.Generic.ICollection`1",
  297. "assembly": "mscorlib"
  298. },
  299. {
  300. "typename": "System.DateTime",
  301. "assembly": "mscorlib"
  302. },
  303. {
  304. "typename": "System.Diagnostics.DebuggableAttribute",
  305. "assembly": "mscorlib"
  306. },
  307. {
  308. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  309. "assembly": "mscorlib"
  310. },
  311. {
  312. "typename": "System.Environment",
  313. "assembly": "mscorlib"
  314. },
  315. {
  316. "typename": "System.EventArgs",
  317. "assembly": "mscorlib"
  318. },
  319. {
  320. "typename": "System.EventHandler",
  321. "assembly": "mscorlib"
  322. },
  323. {
  324. "typename": "System.Guid",
  325. "assembly": "mscorlib"
  326. },
  327. {
  328. "typename": "System.IDisposable",
  329. "assembly": "mscorlib"
  330. },
  331. {
  332. "typename": "System.IO.BinaryReader",
  333. "assembly": "mscorlib"
  334. },
  335. {
  336. "typename": "System.IO.Stream",
  337. "assembly": "mscorlib"
  338. },
  339. {
  340. "typename": "System.Int32",
  341. "assembly": "mscorlib"
  342. },
  343. {
  344. "typename": "System.Nullable`1",
  345. "assembly": "mscorlib"
  346. },
  347. {
  348. "typename": "System.Object",
  349. "assembly": "mscorlib"
  350. },
  351. {
  352. "typename": "System.Reflection.Assembly",
  353. "assembly": "mscorlib"
  354. },
  355. {
  356. "typename": "System.Reflection.MethodBase",
  357. "assembly": "mscorlib"
  358. },
  359. {
  360. "typename": "System.Reflection.MethodInfo",
  361. "assembly": "mscorlib"
  362. },
  363. {
  364. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  365. "assembly": "mscorlib"
  366. },
  367. {
  368. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  369. "assembly": "mscorlib"
  370. },
  371. {
  372. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  373. "assembly": "mscorlib"
  374. },
  375. {
  376. "typename": "System.RuntimeTypeHandle",
  377. "assembly": "mscorlib"
  378. },
  379. {
  380. "typename": "System.STAThreadAttribute",
  381. "assembly": "mscorlib"
  382. },
  383. {
  384. "typename": "System.String",
  385. "assembly": "mscorlib"
  386. },
  387. {
  388. "typename": "System.Text.Encoding",
  389. "assembly": "mscorlib"
  390. },
  391. {
  392. "typename": "System.Type",
  393. "assembly": "mscorlib"
  394. }
  395. ]
  396. },
  397. "pe": {
  398. "peid_signatures": null,
  399. "imports": [
  400. {
  401. "imports": [
  402. {
  403. "name": "_CorExeMain",
  404. "address": "0x402000"
  405. }
  406. ],
  407. "dll": "mscoree.dll"
  408. }
  409. ],
  410. "digital_signers": null,
  411. "exported_dll_name": null,
  412. "actual_checksum": "0x00090b9e",
  413. "overlay": {
  414. "size": "0x00019000",
  415. "offset": "0x00072400"
  416. },
  417. "imagebase": "0x00400000",
  418. "reported_checksum": "0x0007b2d5",
  419. "icon_hash": null,
  420. "entrypoint": "0x00473cfe",
  421. "timestamp": "2019-05-02 13:38:01",
  422. "osversion": "4.0",
  423. "sections": [
  424. {
  425. "name": ".text",
  426. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  427. "virtual_address": "0x00002000",
  428. "size_of_data": "0x00071e00",
  429. "entropy": "6.52",
  430. "raw_address": "0x00000200",
  431. "virtual_size": "0x00071d04",
  432. "characteristics_raw": "0x60000020"
  433. },
  434. {
  435. "name": ".rsrc",
  436. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  437. "virtual_address": "0x00074000",
  438. "size_of_data": "0x00000200",
  439. "entropy": "0.00",
  440. "raw_address": "0x00072000",
  441. "virtual_size": "0x00000010",
  442. "characteristics_raw": "0x40000040"
  443. },
  444. {
  445. "name": ".reloc",
  446. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  447. "virtual_address": "0x00076000",
  448. "size_of_data": "0x00000200",
  449. "entropy": "0.08",
  450. "raw_address": "0x00072200",
  451. "virtual_size": "0x0000000c",
  452. "characteristics_raw": "0x42000040"
  453. }
  454. ],
  455. "resources": [],
  456. "dirents": [
  457. {
  458. "virtual_address": "0x00000000",
  459. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  460. "size": "0x00000000"
  461. },
  462. {
  463. "virtual_address": "0x00073cac",
  464. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  465. "size": "0x0000004f"
  466. },
  467. {
  468. "virtual_address": "0x00074000",
  469. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  470. "size": "0x00000010"
  471. },
  472. {
  473. "virtual_address": "0x00000000",
  474. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  475. "size": "0x00000000"
  476. },
  477. {
  478. "virtual_address": "0x00000000",
  479. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  480. "size": "0x00000000"
  481. },
  482. {
  483. "virtual_address": "0x00076000",
  484. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  485. "size": "0x0000000c"
  486. },
  487. {
  488. "virtual_address": "0x00073c28",
  489. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  490. "size": "0x0000001c"
  491. },
  492. {
  493. "virtual_address": "0x00000000",
  494. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  495. "size": "0x00000000"
  496. },
  497. {
  498. "virtual_address": "0x00000000",
  499. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  500. "size": "0x00000000"
  501. },
  502. {
  503. "virtual_address": "0x00000000",
  504. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  505. "size": "0x00000000"
  506. },
  507. {
  508. "virtual_address": "0x00000000",
  509. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  510. "size": "0x00000000"
  511. },
  512. {
  513. "virtual_address": "0x00000000",
  514. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  515. "size": "0x00000000"
  516. },
  517. {
  518. "virtual_address": "0x00002000",
  519. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  520. "size": "0x00000008"
  521. },
  522. {
  523. "virtual_address": "0x00000000",
  524. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  525. "size": "0x00000000"
  526. },
  527. {
  528. "virtual_address": "0x00002008",
  529. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  530. "size": "0x00000048"
  531. },
  532. {
  533. "virtual_address": "0x00000000",
  534. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  535. "size": "0x00000000"
  536. }
  537. ],
  538. "exports": [],
  539. "guest_signers": {},
  540. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  541. "icon_fuzzy": null,
  542. "icon": null,
  543. "pdbpath": "C:\\xampp\\htdocs\\Aspire\\files\\Error040_oZyhvPuWiBLzanKI\\oZyhvPuWiBLzanKIma.pdb",
  544. "imported_dll_count": 1,
  545. "versioninfo": []
  546. }
  547. }
  548.  
  549. [*] Resolved APIs: [
  550. "advapi32.dll.RegOpenKeyExW",
  551. "advapi32.dll.RegQueryInfoKeyW",
  552. "advapi32.dll.RegEnumKeyExW",
  553. "advapi32.dll.RegEnumValueW",
  554. "advapi32.dll.RegCloseKey",
  555. "advapi32.dll.RegQueryValueExW",
  556. "kernel32.dll.QueryActCtxW",
  557. "shlwapi.dll.UrlIsW"
  558. ]
  559.  
  560. [*] Static Analysis: {
  561. "dotnet": {
  562. "customattrs": [],
  563. "assemblyinfo": {
  564. "version": "0.0.0.0",
  565. "name": "oZyhvPuWiBLzanKIma"
  566. },
  567. "assemblyrefs": [
  568. {
  569. "version": "4.0.0.0",
  570. "name": "mscorlib"
  571. },
  572. {
  573. "version": "4.0.0.0",
  574. "name": "System"
  575. },
  576. {
  577. "version": "4.0.0.0",
  578. "name": "System.Windows.Forms"
  579. },
  580. {
  581. "version": "4.0.0.0",
  582. "name": "System.Drawing"
  583. },
  584. {
  585. "version": "4.0.0.0",
  586. "name": "System.Core"
  587. },
  588. {
  589. "version": "6.0.0.0",
  590. "name": "EntityFramework"
  591. }
  592. ],
  593. "typerefs": [
  594. {
  595. "typename": "System.Data.Entity.Core.Objects.ObjectContext",
  596. "assembly": "EntityFramework"
  597. },
  598. {
  599. "typename": "System.Data.Entity.Core.Objects.ObjectParameter",
  600. "assembly": "EntityFramework"
  601. },
  602. {
  603. "typename": "System.Data.Entity.DbContext",
  604. "assembly": "EntityFramework"
  605. },
  606. {
  607. "typename": "System.Data.Entity.DbModelBuilder",
  608. "assembly": "EntityFramework"
  609. },
  610. {
  611. "typename": "System.Data.Entity.DbSet`1",
  612. "assembly": "EntityFramework"
  613. },
  614. {
  615. "typename": "System.Data.Entity.Infrastructure.IObjectContextAdapter",
  616. "assembly": "EntityFramework"
  617. },
  618. {
  619. "typename": "System.Data.Entity.Infrastructure.UnintentionalCodeFirstException",
  620. "assembly": "EntityFramework"
  621. },
  622. {
  623. "typename": "System.ComponentModel.IContainer",
  624. "assembly": "System"
  625. },
  626. {
  627. "typename": "System.Net.Cookie",
  628. "assembly": "System"
  629. },
  630. {
  631. "typename": "System.Collections.Generic.HashSet`1",
  632. "assembly": "System.Core"
  633. },
  634. {
  635. "typename": "System.Drawing.Size",
  636. "assembly": "System.Drawing"
  637. },
  638. {
  639. "typename": "System.Drawing.SizeF",
  640. "assembly": "System.Drawing"
  641. },
  642. {
  643. "typename": "System.Windows.Forms.Application",
  644. "assembly": "System.Windows.Forms"
  645. },
  646. {
  647. "typename": "System.Windows.Forms.AutoScaleMode",
  648. "assembly": "System.Windows.Forms"
  649. },
  650. {
  651. "typename": "System.Windows.Forms.ContainerControl",
  652. "assembly": "System.Windows.Forms"
  653. },
  654. {
  655. "typename": "System.Windows.Forms.Control",
  656. "assembly": "System.Windows.Forms"
  657. },
  658. {
  659. "typename": "System.Windows.Forms.Form",
  660. "assembly": "System.Windows.Forms"
  661. },
  662. {
  663. "typename": "System.Windows.Forms.FormStartPosition",
  664. "assembly": "System.Windows.Forms"
  665. },
  666. {
  667. "typename": "System.Windows.Forms.FormWindowState",
  668. "assembly": "System.Windows.Forms"
  669. },
  670. {
  671. "typename": "System.Boolean",
  672. "assembly": "mscorlib"
  673. },
  674. {
  675. "typename": "System.Byte",
  676. "assembly": "mscorlib"
  677. },
  678. {
  679. "typename": "System.Collections.Generic.ICollection`1",
  680. "assembly": "mscorlib"
  681. },
  682. {
  683. "typename": "System.DateTime",
  684. "assembly": "mscorlib"
  685. },
  686. {
  687. "typename": "System.Diagnostics.DebuggableAttribute",
  688. "assembly": "mscorlib"
  689. },
  690. {
  691. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  692. "assembly": "mscorlib"
  693. },
  694. {
  695. "typename": "System.Environment",
  696. "assembly": "mscorlib"
  697. },
  698. {
  699. "typename": "System.EventArgs",
  700. "assembly": "mscorlib"
  701. },
  702. {
  703. "typename": "System.EventHandler",
  704. "assembly": "mscorlib"
  705. },
  706. {
  707. "typename": "System.Guid",
  708. "assembly": "mscorlib"
  709. },
  710. {
  711. "typename": "System.IDisposable",
  712. "assembly": "mscorlib"
  713. },
  714. {
  715. "typename": "System.IO.BinaryReader",
  716. "assembly": "mscorlib"
  717. },
  718. {
  719. "typename": "System.IO.Stream",
  720. "assembly": "mscorlib"
  721. },
  722. {
  723. "typename": "System.Int32",
  724. "assembly": "mscorlib"
  725. },
  726. {
  727. "typename": "System.Nullable`1",
  728. "assembly": "mscorlib"
  729. },
  730. {
  731. "typename": "System.Object",
  732. "assembly": "mscorlib"
  733. },
  734. {
  735. "typename": "System.Reflection.Assembly",
  736. "assembly": "mscorlib"
  737. },
  738. {
  739. "typename": "System.Reflection.MethodBase",
  740. "assembly": "mscorlib"
  741. },
  742. {
  743. "typename": "System.Reflection.MethodInfo",
  744. "assembly": "mscorlib"
  745. },
  746. {
  747. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  748. "assembly": "mscorlib"
  749. },
  750. {
  751. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  752. "assembly": "mscorlib"
  753. },
  754. {
  755. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  756. "assembly": "mscorlib"
  757. },
  758. {
  759. "typename": "System.RuntimeTypeHandle",
  760. "assembly": "mscorlib"
  761. },
  762. {
  763. "typename": "System.STAThreadAttribute",
  764. "assembly": "mscorlib"
  765. },
  766. {
  767. "typename": "System.String",
  768. "assembly": "mscorlib"
  769. },
  770. {
  771. "typename": "System.Text.Encoding",
  772. "assembly": "mscorlib"
  773. },
  774. {
  775. "typename": "System.Type",
  776. "assembly": "mscorlib"
  777. }
  778. ]
  779. },
  780. "pe": {
  781. "peid_signatures": null,
  782. "imports": [
  783. {
  784. "imports": [
  785. {
  786. "name": "_CorExeMain",
  787. "address": "0x402000"
  788. }
  789. ],
  790. "dll": "mscoree.dll"
  791. }
  792. ],
  793. "digital_signers": null,
  794. "exported_dll_name": null,
  795. "actual_checksum": "0x00090b9e",
  796. "overlay": {
  797. "size": "0x00019000",
  798. "offset": "0x00072400"
  799. },
  800. "imagebase": "0x00400000",
  801. "reported_checksum": "0x0007b2d5",
  802. "icon_hash": null,
  803. "entrypoint": "0x00473cfe",
  804. "timestamp": "2019-05-02 13:38:01",
  805. "osversion": "4.0",
  806. "sections": [
  807. {
  808. "name": ".text",
  809. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  810. "virtual_address": "0x00002000",
  811. "size_of_data": "0x00071e00",
  812. "entropy": "6.52",
  813. "raw_address": "0x00000200",
  814. "virtual_size": "0x00071d04",
  815. "characteristics_raw": "0x60000020"
  816. },
  817. {
  818. "name": ".rsrc",
  819. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  820. "virtual_address": "0x00074000",
  821. "size_of_data": "0x00000200",
  822. "entropy": "0.00",
  823. "raw_address": "0x00072000",
  824. "virtual_size": "0x00000010",
  825. "characteristics_raw": "0x40000040"
  826. },
  827. {
  828. "name": ".reloc",
  829. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  830. "virtual_address": "0x00076000",
  831. "size_of_data": "0x00000200",
  832. "entropy": "0.08",
  833. "raw_address": "0x00072200",
  834. "virtual_size": "0x0000000c",
  835. "characteristics_raw": "0x42000040"
  836. }
  837. ],
  838. "resources": [],
  839. "dirents": [
  840. {
  841. "virtual_address": "0x00000000",
  842. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  843. "size": "0x00000000"
  844. },
  845. {
  846. "virtual_address": "0x00073cac",
  847. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  848. "size": "0x0000004f"
  849. },
  850. {
  851. "virtual_address": "0x00074000",
  852. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  853. "size": "0x00000010"
  854. },
  855. {
  856. "virtual_address": "0x00000000",
  857. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  858. "size": "0x00000000"
  859. },
  860. {
  861. "virtual_address": "0x00000000",
  862. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  863. "size": "0x00000000"
  864. },
  865. {
  866. "virtual_address": "0x00076000",
  867. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  868. "size": "0x0000000c"
  869. },
  870. {
  871. "virtual_address": "0x00073c28",
  872. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  873. "size": "0x0000001c"
  874. },
  875. {
  876. "virtual_address": "0x00000000",
  877. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  878. "size": "0x00000000"
  879. },
  880. {
  881. "virtual_address": "0x00000000",
  882. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  883. "size": "0x00000000"
  884. },
  885. {
  886. "virtual_address": "0x00000000",
  887. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  888. "size": "0x00000000"
  889. },
  890. {
  891. "virtual_address": "0x00000000",
  892. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  893. "size": "0x00000000"
  894. },
  895. {
  896. "virtual_address": "0x00000000",
  897. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  898. "size": "0x00000000"
  899. },
  900. {
  901. "virtual_address": "0x00002000",
  902. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  903. "size": "0x00000008"
  904. },
  905. {
  906. "virtual_address": "0x00000000",
  907. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  908. "size": "0x00000000"
  909. },
  910. {
  911. "virtual_address": "0x00002008",
  912. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  913. "size": "0x00000048"
  914. },
  915. {
  916. "virtual_address": "0x00000000",
  917. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  918. "size": "0x00000000"
  919. }
  920. ],
  921. "exports": [],
  922. "guest_signers": {},
  923. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  924. "icon_fuzzy": null,
  925. "icon": null,
  926. "pdbpath": "C:\\xampp\\htdocs\\Aspire\\files\\Error040_oZyhvPuWiBLzanKI\\oZyhvPuWiBLzanKIma.pdb",
  927. "imported_dll_count": 1,
  928. "versioninfo": []
  929. }
  930. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!