API tools faq
paste
paladin316

Exes_1360ab327c95aa8367a484fb23f87a0e_contact_2019-06-27_18_30.json

paladin316
Jun 27th, 2019
2,174
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 60.57 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_1360ab327c95aa8367a484fb23f87a0e.contact"
  7. [*] File Size: 279552
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "ddbd96aac52acc974ae0e0eb5c5f0a95a5c653928d9464b1bb1453d9f1d5f234"
  10. [*] MD5: "1360ab327c95aa8367a484fb23f87a0e"
  11. [*] SHA1: "a0d3ead54d083eca54d61f102e78b6d877d39e47"
  12. [*] SHA512: "7986dd7fc48a022c0c10cf0592ecb7655baa827f4a17d2eb9fda68184a5c3b51658f388d28bab6d286b0d431b2a065cf3851f0b34cda3b01c5536d42201d3e5c"
  13. [*] CRC32: "26DC4258"
  14. [*] SSDEEP: "6144:pduB1zpJIydxGNA0aKdeIJr6xpwbwhOa4u8b0TNVGD3Y6aQOG+13oNChYSyN:pdupn/GNRaUMx6m4CUHabMChYj"
  15.  
  16. [*] Process Execution: [
  17. "Exes_1360ab327c95aa8367a484fb23f87a0e.contact",
  18. "cmd.exe",
  19. "powershell.exe",
  20. "cmd.exe",
  21. "sc.exe",
  22. "cmd.exe",
  23. "sc.exe",
  24. "cmd.exe",
  25. "sc.exe",
  26. "cmd.exe",
  27. "sc.exe",
  28. "cmd.exe",
  29. "powershell.exe",
  30. "svchost.exe",
  31. "services.exe",
  32. "lsass.exe"
  33. ]
  34.  
  35. [*] Signatures Detected: [
  36. {
  37. "Description": "Creates RWX memory",
  38. "Details": []
  39. },
  40. {
  41. "Description": "Possible date expiration check, exits too soon after checking local time",
  42. "Details": [
  43. {
  44. "process": "cmd.exe, PID 2292"
  45. }
  46. ]
  47. },
  48. {
  49. "Description": "A process created a hidden window",
  50. "Details": [
  51. {
  52. "Process": "Exes_1360ab327c95aa8367a484fb23f87a0e.contact -> cmd"
  53. },
  54. {
  55. "Process": "Exes_1360ab327c95aa8367a484fb23f87a0e.contact -> cmd"
  56. },
  57. {
  58. "Process": "Exes_1360ab327c95aa8367a484fb23f87a0e.contact -> cmd"
  59. }
  60. ]
  61. },
  62. {
  63. "Description": "Attempts to stop active services",
  64. "Details": [
  65. {
  66. "servicename": "WinDefend"
  67. }
  68. ]
  69. },
  70. {
  71. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  72. "Details": [
  73. {
  74. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 13757733 times"
  75. }
  76. ]
  77. },
  78. {
  79. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  80. "Details": [
  81. {
  82. "modified_name": "svchost.exe",
  83. "modified_path": "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_1360ab327c95aa8367a484fb23f87a0e.contact",
  84. "original_name": "svchost.exe",
  85. "original_path": "C:\\Windows\\system32\\svchost.exe"
  86. }
  87. ]
  88. },
  89. {
  90. "Description": "Creates a hidden or system file",
  91. "Details": [
  92. {
  93. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF604b7d.TMP"
  94. }
  95. ]
  96. },
  97. {
  98. "Description": "File has been identified by 15 Antiviruses on VirusTotal as malicious",
  99. "Details": [
  100. {
  101. "McAfee": "Trojan-FQMS!1360AB327C95"
  102. },
  103. {
  104. "ESET-NOD32": "a variant of Win32/Kryptik.GUHF"
  105. },
  106. {
  107. "APEX": "Malicious"
  108. },
  109. {
  110. "Paloalto": "generic.ml"
  111. },
  112. {
  113. "Kaspersky": "Trojan-Banker.Win32.Trickster.edd"
  114. },
  115. {
  116. "Avast": "Win32:Trojan-gen"
  117. },
  118. {
  119. "DrWeb": "Trojan.Inject3.18215"
  120. },
  121. {
  122. "Invincea": "heuristic"
  123. },
  124. {
  125. "FireEye": "Generic.mg.1360ab327c95aa83"
  126. },
  127. {
  128. "Emsisoft": "Malware.Generic.CN1 (A)"
  129. },
  130. {
  131. "Endgame": "malicious (high confidence)"
  132. },
  133. {
  134. "ZoneAlarm": "Trojan-Banker.Win32.Trickster.edd"
  135. },
  136. {
  137. "Microsoft": "Trojan:Win32/MereTam.A"
  138. },
  139. {
  140. "Webroot": "W32.Trojan.Gen"
  141. },
  142. {
  143. "AVG": "Win32:Trojan-gen"
  144. }
  145. ]
  146. },
  147. {
  148. "Description": "Attempts to disable Windows Defender",
  149. "Details": []
  150. }
  151. ]
  152.  
  153. [*] Started Service: [
  154. "KeyIso"
  155. ]
  156.  
  157. [*] Executed Commands: [
  158. "\"C:\\Windows\\System32\\cmd.exe\" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  159. "cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  160. "\"C:\\Windows\\System32\\cmd.exe\" /c sc stop WinDefend",
  161. "cmd /c sc stop WinDefend",
  162. "\"C:\\Windows\\System32\\cmd.exe\" /c sc delete WinDefend",
  163. "cmd /c sc delete WinDefend",
  164. "C:\\Windows\\system32\\cmd.exe /c sc stop WinDefend",
  165. "C:\\Windows\\system32\\cmd.exe /c sc delete WinDefend",
  166. "C:\\Windows\\system32\\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  167. "C:\\Windows\\system32\\svchost.exe",
  168. "powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  169. "sc stop WinDefend",
  170. "sc delete WinDefend",
  171. "C:\\Windows\\system32\\lsass.exe"
  172. ]
  173.  
  174. [*] Mutexes: [
  175. "Local\\ZoneAttributeCacheCounterMutex",
  176. "Local\\ZonesCacheCounterMutex",
  177. "Local\\ZonesLockedCacheCounterMutex",
  178. "Global\\CLR_CASOFF_MUTEX",
  179. "Global\\838B6C9EB27932960"
  180. ]
  181.  
  182. [*] Modified Files: [
  183. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-0000000000-0000000000-0000000000-1000\\00000000-0000-0000-0000-000000000000b_00000000-0000-0000-0000-000000000000",
  184. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  185. "\\??\\PIPE\\srvsvc",
  186. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9PDAC99M8BZ1P1JS6Y0J.temp",
  187. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF604b7d.TMP",
  188. "C:\\Windows\\SysWOW64\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  189. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\FNCM9MINBMI4E4MQDZJC.temp",
  190. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms"
  191. ]
  192.  
  193. [*] Deleted Files: [
  194. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF604b7d.TMP",
  195. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2556.6312015",
  196. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2556.6312015",
  197. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2556.6312015",
  198. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\FNCM9MINBMI4E4MQDZJC.temp",
  199. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2500.6333734",
  200. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2500.6333734",
  201. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2500.6333734"
  202. ]
  203.  
  204. [*] Modified Registry Keys: [
  205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  207. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender",
  208. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
  209. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection",
  210. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring",
  211. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection",
  212. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnRealtimeEnable",
  213. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection",
  214. "DisableNotifications",
  215. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList"
  216. ]
  217.  
  218. [*] Deleted Registry Keys: [
  219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  220. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  222. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  223. ]
  224.  
  225. [*] DNS Communications: []
  226.  
  227. [*] Domains: []
  228.  
  229. [*] Network Communication - ICMP: []
  230.  
  231. [*] Network Communication - HTTP: []
  232.  
  233. [*] Network Communication - SMTP: []
  234.  
  235. [*] Network Communication - Hosts: []
  236.  
  237. [*] Network Communication - IRC: []
  238.  
  239. [*] Static Analysis: {
  240. "pe": {
  241. "peid_signatures": null,
  242. "imports": [
  243. {
  244. "imports": [
  245. {
  246. "name": "DirectDrawCreateEx",
  247. "address": "0x405008"
  248. }
  249. ],
  250. "dll": "DDRAW.dll"
  251. },
  252. {
  253. "imports": [
  254. {
  255. "name": "timeGetTime",
  256. "address": "0x4051b8"
  257. }
  258. ],
  259. "dll": "WINMM.dll"
  260. },
  261. {
  262. "imports": [
  263. {
  264. "name": "UnhandledExceptionFilter",
  265. "address": "0x405050"
  266. },
  267. {
  268. "name": "GetCurrentProcessId",
  269. "address": "0x405054"
  270. },
  271. {
  272. "name": "MapViewOfFile",
  273. "address": "0x405058"
  274. },
  275. {
  276. "name": "CreateFileMappingW",
  277. "address": "0x40505c"
  278. },
  279. {
  280. "name": "InterlockedExchange",
  281. "address": "0x405060"
  282. },
  283. {
  284. "name": "Sleep",
  285. "address": "0x405064"
  286. },
  287. {
  288. "name": "InterlockedCompareExchange",
  289. "address": "0x405068"
  290. },
  291. {
  292. "name": "GetStartupInfoA",
  293. "address": "0x40506c"
  294. },
  295. {
  296. "name": "TerminateProcess",
  297. "address": "0x405070"
  298. },
  299. {
  300. "name": "GetCurrentProcess",
  301. "address": "0x405074"
  302. },
  303. {
  304. "name": "GetSystemTimeAsFileTime",
  305. "address": "0x405078"
  306. },
  307. {
  308. "name": "SetUnhandledExceptionFilter",
  309. "address": "0x40507c"
  310. },
  311. {
  312. "name": "IsDebuggerPresent",
  313. "address": "0x405080"
  314. },
  315. {
  316. "name": "QueryPerformanceCounter",
  317. "address": "0x405084"
  318. },
  319. {
  320. "name": "GetTickCount",
  321. "address": "0x405088"
  322. },
  323. {
  324. "name": "GetCurrentThreadId",
  325. "address": "0x40508c"
  326. }
  327. ],
  328. "dll": "KERNEL32.dll"
  329. },
  330. {
  331. "imports": [
  332. {
  333. "name": "PeekMessageA",
  334. "address": "0x405158"
  335. },
  336. {
  337. "name": "PostQuitMessage",
  338. "address": "0x40515c"
  339. },
  340. {
  341. "name": "DefWindowProcA",
  342. "address": "0x405160"
  343. },
  344. {
  345. "name": "IntersectRect",
  346. "address": "0x405164"
  347. },
  348. {
  349. "name": "ShowWindow",
  350. "address": "0x405168"
  351. },
  352. {
  353. "name": "UpdateWindow",
  354. "address": "0x40516c"
  355. },
  356. {
  357. "name": "LoadIconA",
  358. "address": "0x405170"
  359. },
  360. {
  361. "name": "LoadCursorA",
  362. "address": "0x405174"
  363. },
  364. {
  365. "name": "RegisterClassA",
  366. "address": "0x405178"
  367. },
  368. {
  369. "name": "CreateWindowExA",
  370. "address": "0x40517c"
  371. },
  372. {
  373. "name": "GetSystemMetrics",
  374. "address": "0x405180"
  375. },
  376. {
  377. "name": "GetWindowLongA",
  378. "address": "0x405184"
  379. },
  380. {
  381. "name": "SendMessageA",
  382. "address": "0x405188"
  383. },
  384. {
  385. "name": "GetMessageA",
  386. "address": "0x40518c"
  387. },
  388. {
  389. "name": "TranslateMessage",
  390. "address": "0x405190"
  391. },
  392. {
  393. "name": "DispatchMessageA",
  394. "address": "0x405194"
  395. },
  396. {
  397. "name": "LoadImageA",
  398. "address": "0x405198"
  399. },
  400. {
  401. "name": "GetDC",
  402. "address": "0x40519c"
  403. },
  404. {
  405. "name": "ReleaseDC",
  406. "address": "0x4051a0"
  407. },
  408. {
  409. "name": "GetClientRect",
  410. "address": "0x4051a4"
  411. },
  412. {
  413. "name": "ClientToScreen",
  414. "address": "0x4051a8"
  415. },
  416. {
  417. "name": "DrawTextA",
  418. "address": "0x4051ac"
  419. },
  420. {
  421. "name": "FillRect",
  422. "address": "0x4051b0"
  423. }
  424. ],
  425. "dll": "USER32.dll"
  426. },
  427. {
  428. "imports": [
  429. {
  430. "name": "Ellipse",
  431. "address": "0x405010"
  432. },
  433. {
  434. "name": "CreateBrushIndirect",
  435. "address": "0x405014"
  436. },
  437. {
  438. "name": "CreatePen",
  439. "address": "0x405018"
  440. },
  441. {
  442. "name": "SelectObject",
  443. "address": "0x40501c"
  444. },
  445. {
  446. "name": "Rectangle",
  447. "address": "0x405020"
  448. },
  449. {
  450. "name": "Polyline",
  451. "address": "0x405024"
  452. },
  453. {
  454. "name": "SetTextColor",
  455. "address": "0x405028"
  456. },
  457. {
  458. "name": "CreateSolidBrush",
  459. "address": "0x40502c"
  460. },
  461. {
  462. "name": "DeleteObject",
  463. "address": "0x405030"
  464. },
  465. {
  466. "name": "CreateCompatibleDC",
  467. "address": "0x405034"
  468. },
  469. {
  470. "name": "GetObjectA",
  471. "address": "0x405038"
  472. },
  473. {
  474. "name": "GetStockObject",
  475. "address": "0x40503c"
  476. },
  477. {
  478. "name": "BitBlt",
  479. "address": "0x405040"
  480. },
  481. {
  482. "name": "SetBkMode",
  483. "address": "0x405044"
  484. },
  485. {
  486. "name": "DeleteDC",
  487. "address": "0x405048"
  488. }
  489. ],
  490. "dll": "GDI32.dll"
  491. },
  492. {
  493. "imports": [
  494. {
  495. "name": "CryptAcquireContextA",
  496. "address": "0x405000"
  497. }
  498. ],
  499. "dll": "ADVAPI32.dll"
  500. },
  501. {
  502. "imports": [
  503. {
  504. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  505. "address": "0x405094"
  506. },
  507. {
  508. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z",
  509. "address": "0x405098"
  510. },
  511. {
  512. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  513. "address": "0x40509c"
  514. },
  515. {
  516. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  517. "address": "0x4050a0"
  518. },
  519. {
  520. "name": "??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z",
  521. "address": "0x4050a4"
  522. }
  523. ],
  524. "dll": "MSVCP90.dll"
  525. },
  526. {
  527. "imports": [
  528. {
  529. "name": "__set_app_type",
  530. "address": "0x4050ac"
  531. },
  532. {
  533. "name": "_crt_debugger_hook",
  534. "address": "0x4050b0"
  535. },
  536. {
  537. "name": "_unlock",
  538. "address": "0x4050b4"
  539. },
  540. {
  541. "name": "__dllonexit",
  542. "address": "0x4050b8"
  543. },
  544. {
  545. "name": "_lock",
  546. "address": "0x4050bc"
  547. },
  548. {
  549. "name": "_onexit",
  550. "address": "0x4050c0"
  551. },
  552. {
  553. "name": "_decode_pointer",
  554. "address": "0x4050c4"
  555. },
  556. {
  557. "name": "_except_handler4_common",
  558. "address": "0x4050c8"
  559. },
  560. {
  561. "name": "_invoke_watson",
  562. "address": "0x4050cc"
  563. },
  564. {
  565. "name": "_controlfp_s",
  566. "address": "0x4050d0"
  567. },
  568. {
  569. "name": "?terminate@@YAXXZ",
  570. "address": "0x4050d4"
  571. },
  572. {
  573. "name": "memset",
  574. "address": "0x4050d8"
  575. },
  576. {
  577. "name": "strlen",
  578. "address": "0x4050dc"
  579. },
  580. {
  581. "name": "memcpy",
  582. "address": "0x4050e0"
  583. },
  584. {
  585. "name": "malloc",
  586. "address": "0x4050e4"
  587. },
  588. {
  589. "name": "free",
  590. "address": "0x4050e8"
  591. },
  592. {
  593. "name": "sprintf",
  594. "address": "0x4050ec"
  595. },
  596. {
  597. "name": "atof",
  598. "address": "0x4050f0"
  599. },
  600. {
  601. "name": "strcat",
  602. "address": "0x4050f4"
  603. },
  604. {
  605. "name": "realloc",
  606. "address": "0x4050f8"
  607. },
  608. {
  609. "name": "abs",
  610. "address": "0x4050fc"
  611. },
  612. {
  613. "name": "sqrt",
  614. "address": "0x405100"
  615. },
  616. {
  617. "name": "fabs",
  618. "address": "0x405104"
  619. },
  620. {
  621. "name": "rand",
  622. "address": "0x405108"
  623. },
  624. {
  625. "name": "calloc",
  626. "address": "0x40510c"
  627. },
  628. {
  629. "name": "_amsg_exit",
  630. "address": "0x405110"
  631. },
  632. {
  633. "name": "__getmainargs",
  634. "address": "0x405114"
  635. },
  636. {
  637. "name": "_cexit",
  638. "address": "0x405118"
  639. },
  640. {
  641. "name": "_exit",
  642. "address": "0x40511c"
  643. },
  644. {
  645. "name": "_XcptFilter",
  646. "address": "0x405120"
  647. },
  648. {
  649. "name": "_ismbblead",
  650. "address": "0x405124"
  651. },
  652. {
  653. "name": "exit",
  654. "address": "0x405128"
  655. },
  656. {
  657. "name": "_acmdln",
  658. "address": "0x40512c"
  659. },
  660. {
  661. "name": "_initterm",
  662. "address": "0x405130"
  663. },
  664. {
  665. "name": "_initterm_e",
  666. "address": "0x405134"
  667. },
  668. {
  669. "name": "_configthreadlocale",
  670. "address": "0x405138"
  671. },
  672. {
  673. "name": "__setusermatherr",
  674. "address": "0x40513c"
  675. },
  676. {
  677. "name": "_adjust_fdiv",
  678. "address": "0x405140"
  679. },
  680. {
  681. "name": "__p__commode",
  682. "address": "0x405144"
  683. },
  684. {
  685. "name": "__p__fmode",
  686. "address": "0x405148"
  687. },
  688. {
  689. "name": "_encode_pointer",
  690. "address": "0x40514c"
  691. },
  692. {
  693. "name": "_getcwd",
  694. "address": "0x405150"
  695. }
  696. ],
  697. "dll": "MSVCR90.dll"
  698. }
  699. ],
  700. "digital_signers": null,
  701. "exported_dll_name": null,
  702. "actual_checksum": "0x00050efa",
  703. "overlay": null,
  704. "imagebase": "0x00400000",
  705. "reported_checksum": "0x00050efa",
  706. "icon_hash": null,
  707. "entrypoint": "0x00404515",
  708. "timestamp": "2019-06-26 11:29:19",
  709. "osversion": "5.0",
  710. "sections": [
  711. {
  712. "name": ".text",
  713. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  714. "virtual_address": "0x00001000",
  715. "size_of_data": "0x00003c00",
  716. "entropy": "6.49",
  717. "raw_address": "0x00000400",
  718. "virtual_size": "0x00003bea",
  719. "characteristics_raw": "0x60000020"
  720. },
  721. {
  722. "name": ".rdata",
  723. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  724. "virtual_address": "0x00005000",
  725. "size_of_data": "0x0003ba00",
  726. "entropy": "6.25",
  727. "raw_address": "0x00004000",
  728. "virtual_size": "0x0003b984",
  729. "characteristics_raw": "0x40000040"
  730. },
  731. {
  732. "name": ".data",
  733. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  734. "virtual_address": "0x00041000",
  735. "size_of_data": "0x00000200",
  736. "entropy": "0.49",
  737. "raw_address": "0x0003fa00",
  738. "virtual_size": "0x00000bc8",
  739. "characteristics_raw": "0xc0000040"
  740. },
  741. {
  742. "name": ".rsrc",
  743. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  744. "virtual_address": "0x00042000",
  745. "size_of_data": "0x00004800",
  746. "entropy": "4.34",
  747. "raw_address": "0x0003fc00",
  748. "virtual_size": "0x0000472a",
  749. "characteristics_raw": "0x40000040"
  750. }
  751. ],
  752. "resources": [],
  753. "dirents": [
  754. {
  755. "virtual_address": "0x00000000",
  756. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  757. "size": "0x00000000"
  758. },
  759. {
  760. "virtual_address": "0x0003fefc",
  761. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  762. "size": "0x000000b4"
  763. },
  764. {
  765. "virtual_address": "0x00042000",
  766. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  767. "size": "0x0000472a"
  768. },
  769. {
  770. "virtual_address": "0x00000000",
  771. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  772. "size": "0x00000000"
  773. },
  774. {
  775. "virtual_address": "0x00000000",
  776. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  777. "size": "0x00000000"
  778. },
  779. {
  780. "virtual_address": "0x00000000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  782. "size": "0x00000000"
  783. },
  784. {
  785. "virtual_address": "0x000051e0",
  786. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  787. "size": "0x0000001c"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  797. "size": "0x00000000"
  798. },
  799. {
  800. "virtual_address": "0x00000000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  802. "size": "0x00000000"
  803. },
  804. {
  805. "virtual_address": "0x0003fda8",
  806. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  807. "size": "0x00000040"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  812. "size": "0x00000000"
  813. },
  814. {
  815. "virtual_address": "0x00005000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  817. "size": "0x000001c0"
  818. },
  819. {
  820. "virtual_address": "0x00000000",
  821. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  822. "size": "0x00000000"
  823. },
  824. {
  825. "virtual_address": "0x00000000",
  826. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  827. "size": "0x00000000"
  828. },
  829. {
  830. "virtual_address": "0x00000000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  832. "size": "0x00000000"
  833. }
  834. ],
  835. "exports": [],
  836. "guest_signers": {},
  837. "imphash": "8048485d9e7268ad1314244966f61c96",
  838. "icon_fuzzy": null,
  839. "icon": null,
  840. "pdbpath": "c:\\Users\\User\\Desktop\\26.6.2019\\A_Real_Tim3461511112001\\Battle\\Release\\Battle.pdb",
  841. "imported_dll_count": 8,
  842. "versioninfo": []
  843. }
  844. }
  845.  
  846. [*] Resolved APIs: [
  847. "cryptsp.dll.CryptAcquireContextA",
  848. "kernel32.dll.VirtualAlloc",
  849. "ntdll.dll.memcpy",
  850. "kernel32.dll.GetCurrentProcess",
  851. "kernel32.dll.CloseHandle",
  852. "advapi32.dll.OpenProcessToken",
  853. "advapi32.dll.GetTokenInformation",
  854. "kernel32.dll.Wow64EnableWow64FsRedirection",
  855. "advapi32.dll.RegCloseKey",
  856. "advapi32.dll.RegCreateKeyW",
  857. "advapi32.dll.RegOpenKeyExW",
  858. "advapi32.dll.RegSetValueExW",
  859. "shell32.dll.ShellExecuteA",
  860. "ole32.dll.OleInitialize",
  861. "cryptbase.dll.SystemFunction036",
  862. "uxtheme.dll.ThemeInitApiHook",
  863. "user32.dll.IsProcessDPIAware",
  864. "ole32.dll.CreateBindCtx",
  865. "ole32.dll.CoTaskMemAlloc",
  866. "propsys.dll.PSCreateMemoryPropertyStore",
  867. "propsys.dll.PSPropertyBag_WriteDWORD",
  868. "ole32.dll.CoGetApartmentType",
  869. "ole32.dll.CoRegisterInitializeSpy",
  870. "ole32.dll.CoTaskMemFree",
  871. "comctl32.dll.#236",
  872. "oleaut32.dll.#6",
  873. "ole32.dll.CoGetMalloc",
  874. "propsys.dll.PSPropertyBag_ReadDWORD",
  875. "propsys.dll.PSPropertyBag_ReadGUID",
  876. "comctl32.dll.#320",
  877. "comctl32.dll.#324",
  878. "comctl32.dll.#323",
  879. "advapi32.dll.RegEnumKeyW",
  880. "advapi32.dll.OpenThreadToken",
  881. "ole32.dll.StringFromGUID2",
  882. "apphelp.dll.ApphelpCheckShellObject",
  883. "ole32.dll.CoCreateInstance",
  884. "urlmon.dll.CreateUri",
  885. "kernel32.dll.InitializeSRWLock",
  886. "kernel32.dll.AcquireSRWLockExclusive",
  887. "kernel32.dll.AcquireSRWLockShared",
  888. "kernel32.dll.ReleaseSRWLockExclusive",
  889. "kernel32.dll.ReleaseSRWLockShared",
  890. "comctl32.dll.#328",
  891. "comctl32.dll.#334",
  892. "oleaut32.dll.#2",
  893. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  894. "shell32.dll.#102",
  895. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  896. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  897. "comctl32.dll.#332",
  898. "ole32.dll.CoInitializeEx",
  899. "comctl32.dll.#386",
  900. "advapi32.dll.InitializeSecurityDescriptor",
  901. "advapi32.dll.SetEntriesInAclW",
  902. "ntmarta.dll.GetMartaExtensionInterface",
  903. "advapi32.dll.SetSecurityDescriptorDacl",
  904. "advapi32.dll.IsTextUnicode",
  905. "comctl32.dll.#338",
  906. "comctl32.dll.#339",
  907. "ole32.dll.CoUninitialize",
  908. "sechost.dll.ConvertSidToStringSidW",
  909. "profapi.dll.#104",
  910. "propsys.dll.#430",
  911. "advapi32.dll.RegGetValueW",
  912. "ole32.dll.CoTaskMemRealloc",
  913. "propsys.dll.InitPropVariantFromStringAsVector",
  914. "propsys.dll.PSCoerceToCanonicalValue",
  915. "propsys.dll.PropVariantToStringAlloc",
  916. "ole32.dll.PropVariantClear",
  917. "ole32.dll.CoAllowSetForegroundWindow",
  918. "shell32.dll.SHGetFolderPathW",
  919. "advapi32.dll.SaferGetPolicyInformation",
  920. "ntdll.dll.RtlDllShutdownInProgress",
  921. "comctl32.dll.#329",
  922. "ole32.dll.OleUninitialize",
  923. "ole32.dll.CoRevokeInitializeSpy",
  924. "comctl32.dll.#388",
  925. "oleaut32.dll.#500",
  926. "advapi32.dll.CryptAcquireContextA",
  927. "advapi32.dll.CryptImportKey",
  928. "advapi32.dll.CryptEncrypt",
  929. "cryptsp.dll.CryptImportKey",
  930. "cryptbase.dll.SystemFunction040",
  931. "cryptbase.dll.SystemFunction041",
  932. "cryptsp.dll.CryptEncrypt",
  933. "advapi32.dll.UnregisterTraceGuids",
  934. "comctl32.dll.#321",
  935. "kernel32.dll.SetThreadUILanguage",
  936. "kernel32.dll.CopyFileExW",
  937. "kernel32.dll.IsDebuggerPresent",
  938. "kernel32.dll.SetConsoleInputExeNameW",
  939. "kernel32.dll.SortGetHandle",
  940. "kernel32.dll.SortCloseHandle",
  941. "shell32.dll.#66",
  942. "comctl32.dll.#385",
  943. "comctl32.dll.#336",
  944. "comctl32.dll.#333",
  945. "linkinfo.dll.IsValidLinkInfo",
  946. "propsys.dll.#417",
  947. "propsys.dll.PSGetNameFromPropertyKey",
  948. "propsys.dll.PSStringFromPropertyKey",
  949. "propsys.dll.InitVariantFromBuffer",
  950. "oleaut32.dll.#9",
  951. "propsys.dll.PropVariantToGUID",
  952. "linkinfo.dll.CreateLinkInfoW",
  953. "user32.dll.IsCharAlphaW",
  954. "user32.dll.CharPrevW",
  955. "ntshrui.dll.GetNetResourceFromLocalPathW",
  956. "srvcli.dll.NetShareEnum",
  957. "cscapi.dll.CscNetApiGetInterface",
  958. "slc.dll.SLGetWindowsInformationDWORD",
  959. "shlwapi.dll.PathRemoveFileSpecW",
  960. "linkinfo.dll.DestroyLinkInfo",
  961. "propsys.dll.PropVariantToBoolean",
  962. "cryptsp.dll.CryptAcquireContextW",
  963. "cryptsp.dll.CryptGenRandom",
  964. "cryptsp.dll.CryptReleaseContext",
  965. "advapi32.dll.GetSecurityInfo",
  966. "advapi32.dll.SetSecurityInfo",
  967. "advapi32.dll.GetSecurityDescriptorControl",
  968. "advapi32.dll.RegQueryInfoKeyW",
  969. "advapi32.dll.RegEnumKeyExW",
  970. "advapi32.dll.RegEnumValueW",
  971. "advapi32.dll.RegQueryValueExW",
  972. "shlwapi.dll.UrlIsW",
  973. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  974. "msvcrt.dll._set_error_mode",
  975. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  976. "kernel32.dll.FindActCtxSectionStringW",
  977. "kernel32.dll.GetSystemWindowsDirectoryW",
  978. "mscoree.dll.GetProcessExecutableHeap",
  979. "mscorwks.dll.DllGetClassObjectInternal",
  980. "mscorwks.dll.GetCLRFunction",
  981. "advapi32.dll.RegisterTraceGuidsW",
  982. "advapi32.dll.GetTraceLoggerHandle",
  983. "advapi32.dll.GetTraceEnableLevel",
  984. "advapi32.dll.GetTraceEnableFlags",
  985. "advapi32.dll.TraceEvent",
  986. "mscoree.dll.IEE",
  987. "mscorwks.dll.IEE",
  988. "mscoree.dll.GetStartupFlags",
  989. "mscoree.dll.GetHostConfigurationFile",
  990. "mscoree.dll.GetCORSystemDirectory",
  991. "ntdll.dll.RtlVirtualUnwind",
  992. "kernel32.dll.IsWow64Process",
  993. "advapi32.dll.AllocateAndInitializeSid",
  994. "advapi32.dll.InitializeAcl",
  995. "advapi32.dll.AddAccessAllowedAce",
  996. "advapi32.dll.FreeSid",
  997. "kernel32.dll.SetThreadStackGuarantee",
  998. "kernel32.dll.FlsSetValue",
  999. "kernel32.dll.FlsGetValue",
  1000. "kernel32.dll.FlsAlloc",
  1001. "kernel32.dll.FlsFree",
  1002. "kernel32.dll.AddVectoredContinueHandler",
  1003. "kernel32.dll.RemoveVectoredContinueHandler",
  1004. "advapi32.dll.ConvertSidToStringSidW",
  1005. "kernel32.dll.FlushProcessWriteBuffers",
  1006. "kernel32.dll.GetWriteWatch",
  1007. "kernel32.dll.ResetWriteWatch",
  1008. "kernel32.dll.CreateMemoryResourceNotification",
  1009. "kernel32.dll.QueryMemoryResourceNotification",
  1010. "kernel32.dll.GlobalMemoryStatusEx",
  1011. "ole32.dll.CoGetContextToken",
  1012. "oleaut32.dll.#149",
  1013. "kernel32.dll.GetUserDefaultUILanguage",
  1014. "kernel32.dll.GetVersionExW",
  1015. "kernel32.dll.GetFullPathNameW",
  1016. "kernel32.dll.SetErrorMode",
  1017. "kernel32.dll.GetFileAttributesExW",
  1018. "version.dll.GetFileVersionInfoSizeW",
  1019. "version.dll.GetFileVersionInfoW",
  1020. "version.dll.VerQueryValueW",
  1021. "kernel32.dll.lstrlen",
  1022. "kernel32.dll.lstrlenW",
  1023. "mscoree.dll.ND_RI2",
  1024. "kernel32.dll.lstrcpy",
  1025. "kernel32.dll.lstrcpyW",
  1026. "version.dll.VerLanguageNameW",
  1027. "kernel32.dll.GetCurrentProcessId",
  1028. "advapi32.dll.LookupPrivilegeValueW",
  1029. "advapi32.dll.AdjustTokenPrivileges",
  1030. "kernel32.dll.OpenProcess",
  1031. "psapi.dll.EnumProcessModules",
  1032. "psapi.dll.GetModuleInformation",
  1033. "psapi.dll.GetModuleBaseNameW",
  1034. "psapi.dll.GetModuleFileNameExW",
  1035. "kernel32.dll.GetExitCodeProcess",
  1036. "ntdll.dll.NtQuerySystemInformation",
  1037. "user32.dll.EnumWindows",
  1038. "user32.dll.GetWindowThreadProcessId",
  1039. "kernel32.dll.WerSetFlags",
  1040. "kernel32.dll.SetThreadPreferredUILanguages",
  1041. "kernel32.dll.GetThreadPreferredUILanguages",
  1042. "kernel32.dll.GetUserDefaultLocaleName",
  1043. "kernel32.dll.GetEnvironmentVariableW",
  1044. "advapi32.dll.CryptReleaseContext",
  1045. "advapi32.dll.CryptCreateHash",
  1046. "advapi32.dll.CryptDestroyHash",
  1047. "advapi32.dll.CryptHashData",
  1048. "advapi32.dll.CryptGetHashParam",
  1049. "advapi32.dll.CryptExportKey",
  1050. "advapi32.dll.CryptGenKey",
  1051. "advapi32.dll.CryptGetKeyParam",
  1052. "advapi32.dll.CryptDestroyKey",
  1053. "advapi32.dll.CryptVerifySignatureA",
  1054. "advapi32.dll.CryptSignHashA",
  1055. "advapi32.dll.CryptGetProvParam",
  1056. "advapi32.dll.CryptGetUserKey",
  1057. "advapi32.dll.CryptEnumProvidersA",
  1058. "cryptsp.dll.CryptHashData",
  1059. "cryptsp.dll.CryptGetHashParam",
  1060. "cryptsp.dll.CryptDestroyHash",
  1061. "cryptsp.dll.CryptDestroyKey",
  1062. "mscoree.dll.GetTokenForVTableEntry",
  1063. "mscoree.dll.SetTargetForVTableEntry",
  1064. "mscoree.dll.GetTargetForVTableEntry",
  1065. "culture.dll.ConvertLangIdToCultureName",
  1066. "ole32.dll.CoCreateGuid",
  1067. "kernel32.dll.CreateFileW",
  1068. "kernel32.dll.GetConsoleScreenBufferInfo",
  1069. "kernel32.dll.LocalFree",
  1070. "kernel32.dll.LocalAlloc",
  1071. "mscoree.dll.ND_RI4",
  1072. "advapi32.dll.DuplicateTokenEx",
  1073. "advapi32.dll.CheckTokenMembership",
  1074. "kernel32.dll.GetConsoleTitleW",
  1075. "mscorjit.dll.getJit",
  1076. "kernel32.dll.SetConsoleTitleW",
  1077. "kernel32.dll.SetConsoleCtrlHandler",
  1078. "kernel32.dll.CreateEventW",
  1079. "ntdll.dll.WinSqmIsOptedIn",
  1080. "kernel32.dll.ExpandEnvironmentStringsW",
  1081. "shfolder.dll.SHGetFolderPathW",
  1082. "kernel32.dll.SetEnvironmentVariableW",
  1083. "kernel32.dll.GetACP",
  1084. "kernel32.dll.UnmapViewOfFile",
  1085. "kernel32.dll.GetFileType",
  1086. "kernel32.dll.ReadFile",
  1087. "kernel32.dll.GetSystemInfo",
  1088. "kernel32.dll.VirtualQuery",
  1089. "secur32.dll.GetUserNameExW",
  1090. "advapi32.dll.GetUserNameW",
  1091. "kernel32.dll.ReleaseMutex",
  1092. "advapi32.dll.RegisterEventSourceW",
  1093. "advapi32.dll.DeregisterEventSource",
  1094. "advapi32.dll.ReportEventW",
  1095. "kernel32.dll.GetLogicalDrives",
  1096. "kernel32.dll.GetDriveTypeW",
  1097. "kernel32.dll.GetVolumeInformationW",
  1098. "kernel32.dll.GetCurrentDirectoryW",
  1099. "kernel32.dll.GetLastError",
  1100. "kernel32.dll.GetStdHandle",
  1101. "kernel32.dll.GetConsoleMode",
  1102. "kernel32.dll.SetEvent",
  1103. "kernel32.dll.FindFirstFileW",
  1104. "kernel32.dll.FindClose",
  1105. "mscoree.dll.DllGetClassObject",
  1106. "diasymreader.dll.DllGetClassObjectInternal",
  1107. "kernel32.dll.GetConsoleOutputCP",
  1108. "gdi32.dll.TranslateCharsetInfo",
  1109. "kernel32.dll.SetConsoleTextAttribute",
  1110. "kernel32.dll.WriteConsoleW",
  1111. "mscoree.dll.CorExitProcess",
  1112. "mscorwks.dll.CorExitProcess",
  1113. "mscorwks.dll._CorDllMain",
  1114. "kernel32.dll.CreateActCtxW",
  1115. "kernel32.dll.AddRefActCtx",
  1116. "kernel32.dll.ReleaseActCtx",
  1117. "kernel32.dll.ActivateActCtx",
  1118. "kernel32.dll.DeactivateActCtx",
  1119. "kernel32.dll.GetCurrentActCtx",
  1120. "kernel32.dll.QueryActCtxW",
  1121. "netutils.dll.NetApiBufferFree",
  1122. "kernel32.dll.IsProcessorFeaturePresent",
  1123. "ntdll.dll.RtlUnwind",
  1124. "mscoree.dll._CorExeMain",
  1125. "mscoree.dll._CorImageUnloading",
  1126. "mscoree.dll._CorValidateImage",
  1127. "cryptsp.dll.CryptExportKey",
  1128. "cryptsp.dll.CryptCreateHash",
  1129. "kernel32.dll.SwitchToThread",
  1130. "rpcrt4.dll.UuidFromStringW",
  1131. "rpcrt4.dll.RpcBindingCreateW",
  1132. "rpcrt4.dll.RpcBindingBind",
  1133. "sechost.dll.OpenSCManagerW",
  1134. "sechost.dll.OpenServiceW",
  1135. "sechost.dll.StartServiceW",
  1136. "sechost.dll.CloseServiceHandle"
  1137. ]
  1138.  
  1139. [*] Static Analysis: {
  1140. "pe": {
  1141. "peid_signatures": null,
  1142. "imports": [
  1143. {
  1144. "imports": [
  1145. {
  1146. "name": "DirectDrawCreateEx",
  1147. "address": "0x405008"
  1148. }
  1149. ],
  1150. "dll": "DDRAW.dll"
  1151. },
  1152. {
  1153. "imports": [
  1154. {
  1155. "name": "timeGetTime",
  1156. "address": "0x4051b8"
  1157. }
  1158. ],
  1159. "dll": "WINMM.dll"
  1160. },
  1161. {
  1162. "imports": [
  1163. {
  1164. "name": "UnhandledExceptionFilter",
  1165. "address": "0x405050"
  1166. },
  1167. {
  1168. "name": "GetCurrentProcessId",
  1169. "address": "0x405054"
  1170. },
  1171. {
  1172. "name": "MapViewOfFile",
  1173. "address": "0x405058"
  1174. },
  1175. {
  1176. "name": "CreateFileMappingW",
  1177. "address": "0x40505c"
  1178. },
  1179. {
  1180. "name": "InterlockedExchange",
  1181. "address": "0x405060"
  1182. },
  1183. {
  1184. "name": "Sleep",
  1185. "address": "0x405064"
  1186. },
  1187. {
  1188. "name": "InterlockedCompareExchange",
  1189. "address": "0x405068"
  1190. },
  1191. {
  1192. "name": "GetStartupInfoA",
  1193. "address": "0x40506c"
  1194. },
  1195. {
  1196. "name": "TerminateProcess",
  1197. "address": "0x405070"
  1198. },
  1199. {
  1200. "name": "GetCurrentProcess",
  1201. "address": "0x405074"
  1202. },
  1203. {
  1204. "name": "GetSystemTimeAsFileTime",
  1205. "address": "0x405078"
  1206. },
  1207. {
  1208. "name": "SetUnhandledExceptionFilter",
  1209. "address": "0x40507c"
  1210. },
  1211. {
  1212. "name": "IsDebuggerPresent",
  1213. "address": "0x405080"
  1214. },
  1215. {
  1216. "name": "QueryPerformanceCounter",
  1217. "address": "0x405084"
  1218. },
  1219. {
  1220. "name": "GetTickCount",
  1221. "address": "0x405088"
  1222. },
  1223. {
  1224. "name": "GetCurrentThreadId",
  1225. "address": "0x40508c"
  1226. }
  1227. ],
  1228. "dll": "KERNEL32.dll"
  1229. },
  1230. {
  1231. "imports": [
  1232. {
  1233. "name": "PeekMessageA",
  1234. "address": "0x405158"
  1235. },
  1236. {
  1237. "name": "PostQuitMessage",
  1238. "address": "0x40515c"
  1239. },
  1240. {
  1241. "name": "DefWindowProcA",
  1242. "address": "0x405160"
  1243. },
  1244. {
  1245. "name": "IntersectRect",
  1246. "address": "0x405164"
  1247. },
  1248. {
  1249. "name": "ShowWindow",
  1250. "address": "0x405168"
  1251. },
  1252. {
  1253. "name": "UpdateWindow",
  1254. "address": "0x40516c"
  1255. },
  1256. {
  1257. "name": "LoadIconA",
  1258. "address": "0x405170"
  1259. },
  1260. {
  1261. "name": "LoadCursorA",
  1262. "address": "0x405174"
  1263. },
  1264. {
  1265. "name": "RegisterClassA",
  1266. "address": "0x405178"
  1267. },
  1268. {
  1269. "name": "CreateWindowExA",
  1270. "address": "0x40517c"
  1271. },
  1272. {
  1273. "name": "GetSystemMetrics",
  1274. "address": "0x405180"
  1275. },
  1276. {
  1277. "name": "GetWindowLongA",
  1278. "address": "0x405184"
  1279. },
  1280. {
  1281. "name": "SendMessageA",
  1282. "address": "0x405188"
  1283. },
  1284. {
  1285. "name": "GetMessageA",
  1286. "address": "0x40518c"
  1287. },
  1288. {
  1289. "name": "TranslateMessage",
  1290. "address": "0x405190"
  1291. },
  1292. {
  1293. "name": "DispatchMessageA",
  1294. "address": "0x405194"
  1295. },
  1296. {
  1297. "name": "LoadImageA",
  1298. "address": "0x405198"
  1299. },
  1300. {
  1301. "name": "GetDC",
  1302. "address": "0x40519c"
  1303. },
  1304. {
  1305. "name": "ReleaseDC",
  1306. "address": "0x4051a0"
  1307. },
  1308. {
  1309. "name": "GetClientRect",
  1310. "address": "0x4051a4"
  1311. },
  1312. {
  1313. "name": "ClientToScreen",
  1314. "address": "0x4051a8"
  1315. },
  1316. {
  1317. "name": "DrawTextA",
  1318. "address": "0x4051ac"
  1319. },
  1320. {
  1321. "name": "FillRect",
  1322. "address": "0x4051b0"
  1323. }
  1324. ],
  1325. "dll": "USER32.dll"
  1326. },
  1327. {
  1328. "imports": [
  1329. {
  1330. "name": "Ellipse",
  1331. "address": "0x405010"
  1332. },
  1333. {
  1334. "name": "CreateBrushIndirect",
  1335. "address": "0x405014"
  1336. },
  1337. {
  1338. "name": "CreatePen",
  1339. "address": "0x405018"
  1340. },
  1341. {
  1342. "name": "SelectObject",
  1343. "address": "0x40501c"
  1344. },
  1345. {
  1346. "name": "Rectangle",
  1347. "address": "0x405020"
  1348. },
  1349. {
  1350. "name": "Polyline",
  1351. "address": "0x405024"
  1352. },
  1353. {
  1354. "name": "SetTextColor",
  1355. "address": "0x405028"
  1356. },
  1357. {
  1358. "name": "CreateSolidBrush",
  1359. "address": "0x40502c"
  1360. },
  1361. {
  1362. "name": "DeleteObject",
  1363. "address": "0x405030"
  1364. },
  1365. {
  1366. "name": "CreateCompatibleDC",
  1367. "address": "0x405034"
  1368. },
  1369. {
  1370. "name": "GetObjectA",
  1371. "address": "0x405038"
  1372. },
  1373. {
  1374. "name": "GetStockObject",
  1375. "address": "0x40503c"
  1376. },
  1377. {
  1378. "name": "BitBlt",
  1379. "address": "0x405040"
  1380. },
  1381. {
  1382. "name": "SetBkMode",
  1383. "address": "0x405044"
  1384. },
  1385. {
  1386. "name": "DeleteDC",
  1387. "address": "0x405048"
  1388. }
  1389. ],
  1390. "dll": "GDI32.dll"
  1391. },
  1392. {
  1393. "imports": [
  1394. {
  1395. "name": "CryptAcquireContextA",
  1396. "address": "0x405000"
  1397. }
  1398. ],
  1399. "dll": "ADVAPI32.dll"
  1400. },
  1401. {
  1402. "imports": [
  1403. {
  1404. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1405. "address": "0x405094"
  1406. },
  1407. {
  1408. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z",
  1409. "address": "0x405098"
  1410. },
  1411. {
  1412. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1413. "address": "0x40509c"
  1414. },
  1415. {
  1416. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  1417. "address": "0x4050a0"
  1418. },
  1419. {
  1420. "name": "??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z",
  1421. "address": "0x4050a4"
  1422. }
  1423. ],
  1424. "dll": "MSVCP90.dll"
  1425. },
  1426. {
  1427. "imports": [
  1428. {
  1429. "name": "__set_app_type",
  1430. "address": "0x4050ac"
  1431. },
  1432. {
  1433. "name": "_crt_debugger_hook",
  1434. "address": "0x4050b0"
  1435. },
  1436. {
  1437. "name": "_unlock",
  1438. "address": "0x4050b4"
  1439. },
  1440. {
  1441. "name": "__dllonexit",
  1442. "address": "0x4050b8"
  1443. },
  1444. {
  1445. "name": "_lock",
  1446. "address": "0x4050bc"
  1447. },
  1448. {
  1449. "name": "_onexit",
  1450. "address": "0x4050c0"
  1451. },
  1452. {
  1453. "name": "_decode_pointer",
  1454. "address": "0x4050c4"
  1455. },
  1456. {
  1457. "name": "_except_handler4_common",
  1458. "address": "0x4050c8"
  1459. },
  1460. {
  1461. "name": "_invoke_watson",
  1462. "address": "0x4050cc"
  1463. },
  1464. {
  1465. "name": "_controlfp_s",
  1466. "address": "0x4050d0"
  1467. },
  1468. {
  1469. "name": "?terminate@@YAXXZ",
  1470. "address": "0x4050d4"
  1471. },
  1472. {
  1473. "name": "memset",
  1474. "address": "0x4050d8"
  1475. },
  1476. {
  1477. "name": "strlen",
  1478. "address": "0x4050dc"
  1479. },
  1480. {
  1481. "name": "memcpy",
  1482. "address": "0x4050e0"
  1483. },
  1484. {
  1485. "name": "malloc",
  1486. "address": "0x4050e4"
  1487. },
  1488. {
  1489. "name": "free",
  1490. "address": "0x4050e8"
  1491. },
  1492. {
  1493. "name": "sprintf",
  1494. "address": "0x4050ec"
  1495. },
  1496. {
  1497. "name": "atof",
  1498. "address": "0x4050f0"
  1499. },
  1500. {
  1501. "name": "strcat",
  1502. "address": "0x4050f4"
  1503. },
  1504. {
  1505. "name": "realloc",
  1506. "address": "0x4050f8"
  1507. },
  1508. {
  1509. "name": "abs",
  1510. "address": "0x4050fc"
  1511. },
  1512. {
  1513. "name": "sqrt",
  1514. "address": "0x405100"
  1515. },
  1516. {
  1517. "name": "fabs",
  1518. "address": "0x405104"
  1519. },
  1520. {
  1521. "name": "rand",
  1522. "address": "0x405108"
  1523. },
  1524. {
  1525. "name": "calloc",
  1526. "address": "0x40510c"
  1527. },
  1528. {
  1529. "name": "_amsg_exit",
  1530. "address": "0x405110"
  1531. },
  1532. {
  1533. "name": "__getmainargs",
  1534. "address": "0x405114"
  1535. },
  1536. {
  1537. "name": "_cexit",
  1538. "address": "0x405118"
  1539. },
  1540. {
  1541. "name": "_exit",
  1542. "address": "0x40511c"
  1543. },
  1544. {
  1545. "name": "_XcptFilter",
  1546. "address": "0x405120"
  1547. },
  1548. {
  1549. "name": "_ismbblead",
  1550. "address": "0x405124"
  1551. },
  1552. {
  1553. "name": "exit",
  1554. "address": "0x405128"
  1555. },
  1556. {
  1557. "name": "_acmdln",
  1558. "address": "0x40512c"
  1559. },
  1560. {
  1561. "name": "_initterm",
  1562. "address": "0x405130"
  1563. },
  1564. {
  1565. "name": "_initterm_e",
  1566. "address": "0x405134"
  1567. },
  1568. {
  1569. "name": "_configthreadlocale",
  1570. "address": "0x405138"
  1571. },
  1572. {
  1573. "name": "__setusermatherr",
  1574. "address": "0x40513c"
  1575. },
  1576. {
  1577. "name": "_adjust_fdiv",
  1578. "address": "0x405140"
  1579. },
  1580. {
  1581. "name": "__p__commode",
  1582. "address": "0x405144"
  1583. },
  1584. {
  1585. "name": "__p__fmode",
  1586. "address": "0x405148"
  1587. },
  1588. {
  1589. "name": "_encode_pointer",
  1590. "address": "0x40514c"
  1591. },
  1592. {
  1593. "name": "_getcwd",
  1594. "address": "0x405150"
  1595. }
  1596. ],
  1597. "dll": "MSVCR90.dll"
  1598. }
  1599. ],
  1600. "digital_signers": null,
  1601. "exported_dll_name": null,
  1602. "actual_checksum": "0x00050efa",
  1603. "overlay": null,
  1604. "imagebase": "0x00400000",
  1605. "reported_checksum": "0x00050efa",
  1606. "icon_hash": null,
  1607. "entrypoint": "0x00404515",
  1608. "timestamp": "2019-06-26 11:29:19",
  1609. "osversion": "5.0",
  1610. "sections": [
  1611. {
  1612. "name": ".text",
  1613. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1614. "virtual_address": "0x00001000",
  1615. "size_of_data": "0x00003c00",
  1616. "entropy": "6.49",
  1617. "raw_address": "0x00000400",
  1618. "virtual_size": "0x00003bea",
  1619. "characteristics_raw": "0x60000020"
  1620. },
  1621. {
  1622. "name": ".rdata",
  1623. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1624. "virtual_address": "0x00005000",
  1625. "size_of_data": "0x0003ba00",
  1626. "entropy": "6.25",
  1627. "raw_address": "0x00004000",
  1628. "virtual_size": "0x0003b984",
  1629. "characteristics_raw": "0x40000040"
  1630. },
  1631. {
  1632. "name": ".data",
  1633. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1634. "virtual_address": "0x00041000",
  1635. "size_of_data": "0x00000200",
  1636. "entropy": "0.49",
  1637. "raw_address": "0x0003fa00",
  1638. "virtual_size": "0x00000bc8",
  1639. "characteristics_raw": "0xc0000040"
  1640. },
  1641. {
  1642. "name": ".rsrc",
  1643. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1644. "virtual_address": "0x00042000",
  1645. "size_of_data": "0x00004800",
  1646. "entropy": "4.34",
  1647. "raw_address": "0x0003fc00",
  1648. "virtual_size": "0x0000472a",
  1649. "characteristics_raw": "0x40000040"
  1650. }
  1651. ],
  1652. "resources": [],
  1653. "dirents": [
  1654. {
  1655. "virtual_address": "0x00000000",
  1656. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1657. "size": "0x00000000"
  1658. },
  1659. {
  1660. "virtual_address": "0x0003fefc",
  1661. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1662. "size": "0x000000b4"
  1663. },
  1664. {
  1665. "virtual_address": "0x00042000",
  1666. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1667. "size": "0x0000472a"
  1668. },
  1669. {
  1670. "virtual_address": "0x00000000",
  1671. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1672. "size": "0x00000000"
  1673. },
  1674. {
  1675. "virtual_address": "0x00000000",
  1676. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1677. "size": "0x00000000"
  1678. },
  1679. {
  1680. "virtual_address": "0x00000000",
  1681. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1682. "size": "0x00000000"
  1683. },
  1684. {
  1685. "virtual_address": "0x000051e0",
  1686. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1687. "size": "0x0000001c"
  1688. },
  1689. {
  1690. "virtual_address": "0x00000000",
  1691. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1692. "size": "0x00000000"
  1693. },
  1694. {
  1695. "virtual_address": "0x00000000",
  1696. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1697. "size": "0x00000000"
  1698. },
  1699. {
  1700. "virtual_address": "0x00000000",
  1701. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1702. "size": "0x00000000"
  1703. },
  1704. {
  1705. "virtual_address": "0x0003fda8",
  1706. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1707. "size": "0x00000040"
  1708. },
  1709. {
  1710. "virtual_address": "0x00000000",
  1711. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1712. "size": "0x00000000"
  1713. },
  1714. {
  1715. "virtual_address": "0x00005000",
  1716. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1717. "size": "0x000001c0"
  1718. },
  1719. {
  1720. "virtual_address": "0x00000000",
  1721. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1722. "size": "0x00000000"
  1723. },
  1724. {
  1725. "virtual_address": "0x00000000",
  1726. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1727. "size": "0x00000000"
  1728. },
  1729. {
  1730. "virtual_address": "0x00000000",
  1731. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1732. "size": "0x00000000"
  1733. }
  1734. ],
  1735. "exports": [],
  1736. "guest_signers": {},
  1737. "imphash": "8048485d9e7268ad1314244966f61c96",
  1738. "icon_fuzzy": null,
  1739. "icon": null,
  1740. "pdbpath": "c:\\Users\\User\\Desktop\\26.6.2019\\A_Real_Tim3461511112001\\Battle\\Release\\Battle.pdb",
  1741. "imported_dll_count": 8,
  1742. "versioninfo": []
  1743. }
  1744. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!