API tools faq
paste
paladin316

Exes_c2152e5663311be9e94a429e1fb47c02_exe_2019-07-01_11_30.json

paladin316
Jul 1st, 2019
2,135
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 26.68 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_c2152e5663311be9e94a429e1fb47c02.exe"
  7. [*] File Size: 671744
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "c0f938884c362094dc26be3fb170d54d6124308965ac72c30573614eea304ec6"
  10. [*] MD5: "c2152e5663311be9e94a429e1fb47c02"
  11. [*] SHA1: "fe86e9f1ce3b410758993715044ac61a0bd1f074"
  12. [*] SHA512: "52321cafe8a114cd706aa3752744d49d6969ec05946728dff2911d7c7e93f1e93969548a9dd497c57b982315239bca22f6b4d895f456bbcfde4280a4971f368f"
  13. [*] CRC32: "6FCAABBE"
  14. [*] SSDEEP: "12288:rrBcjjFLiEtYiI8V+hI7OF6Qyw/EYmKoC2Qtj6qnI0:2jkEtUyVw/E4AqnI0"
  15.  
  16. [*] Process Execution: [
  17. "Exes_c2152e5663311be9e94a429e1fb47c02.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "Exes_c2152e5663311be9e94a429e1fb47c02.exe (2364) called API CreateProcessInternalW 40409 times"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "MicroWorld-eScan": "Gen:Variant.Ursu.512192"
  38. },
  39. {
  40. "FireEye": "Generic.mg.c2152e5663311be9"
  41. },
  42. {
  43. "McAfee": "RDN/Generic BackDoor"
  44. },
  45. {
  46. "Arcabit": "Trojan.Ursu.D7D0C0"
  47. },
  48. {
  49. "Symantec": "ML.Attribute.HighConfidence"
  50. },
  51. {
  52. "APEX": "Malicious"
  53. },
  54. {
  55. "Kaspersky": "Backdoor.Win32.NetWiredRC.hmt"
  56. },
  57. {
  58. "BitDefender": "Gen:Variant.Ursu.512192"
  59. },
  60. {
  61. "Endgame": "malicious (high confidence)"
  62. },
  63. {
  64. "Emsisoft": "Gen:Variant.Ursu.512192 (B)"
  65. },
  66. {
  67. "DrWeb": "Trojan.Inject3.18652"
  68. },
  69. {
  70. "Invincea": "heuristic"
  71. },
  72. {
  73. "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.jm"
  74. },
  75. {
  76. "Trapmine": "malicious.moderate.ml.score"
  77. },
  78. {
  79. "Ikarus": "Win32.Outbreak"
  80. },
  81. {
  82. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  83. },
  84. {
  85. "ZoneAlarm": "Backdoor.Win32.NetWiredRC.hmt"
  86. },
  87. {
  88. "GData": "Gen:Variant.Ursu.512192"
  89. },
  90. {
  91. "Ad-Aware": "Gen:Variant.Ursu.512192"
  92. },
  93. {
  94. "Cylance": "Unsafe"
  95. },
  96. {
  97. "ESET-NOD32": "a variant of Win32/GenKryptik.DMAA"
  98. },
  99. {
  100. "Rising": "Trojan.Formbook!8.F858 (CLOUD)"
  101. },
  102. {
  103. "SentinelOne": "DFI - Suspicious PE"
  104. },
  105. {
  106. "Fortinet": "W32/GenKryptik.DMAA!tr"
  107. },
  108. {
  109. "AVG": "FileRepMalware"
  110. },
  111. {
  112. "Cybereason": "malicious.1ce3b4"
  113. },
  114. {
  115. "Panda": "Trj/Genetic.gen"
  116. },
  117. {
  118. "CrowdStrike": "win/malicious_confidence_100% (W)"
  119. }
  120. ]
  121. }
  122. ]
  123.  
  124. [*] Started Service: []
  125.  
  126. [*] Executed Commands: [
  127. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\Exes_c2152e5663311be9e94a429e1fb47c02.exe\""
  128. ]
  129.  
  130. [*] Mutexes: [
  131. "CicLoadWinStaWinSta0",
  132. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  133. ]
  134.  
  135. [*] Modified Files: []
  136.  
  137. [*] Deleted Files: []
  138.  
  139. [*] Modified Registry Keys: []
  140.  
  141. [*] Deleted Registry Keys: []
  142.  
  143. [*] DNS Communications: []
  144.  
  145. [*] Domains: []
  146.  
  147. [*] Network Communication - ICMP: []
  148.  
  149. [*] Network Communication - HTTP: []
  150.  
  151. [*] Network Communication - SMTP: []
  152.  
  153. [*] Network Communication - Hosts: []
  154.  
  155. [*] Network Communication - IRC: []
  156.  
  157. [*] Static Analysis: {
  158. "pe": {
  159. "peid_signatures": null,
  160. "imports": [
  161. {
  162. "imports": [
  163. {
  164. "name": null,
  165. "address": "0x401000"
  166. },
  167. {
  168. "name": null,
  169. "address": "0x401004"
  170. },
  171. {
  172. "name": "MethCallEngine",
  173. "address": "0x401008"
  174. },
  175. {
  176. "name": null,
  177. "address": "0x40100c"
  178. },
  179. {
  180. "name": null,
  181. "address": "0x401010"
  182. },
  183. {
  184. "name": null,
  185. "address": "0x401014"
  186. },
  187. {
  188. "name": null,
  189. "address": "0x401018"
  190. },
  191. {
  192. "name": null,
  193. "address": "0x40101c"
  194. },
  195. {
  196. "name": null,
  197. "address": "0x401020"
  198. },
  199. {
  200. "name": null,
  201. "address": "0x401024"
  202. },
  203. {
  204. "name": null,
  205. "address": "0x401028"
  206. },
  207. {
  208. "name": null,
  209. "address": "0x40102c"
  210. },
  211. {
  212. "name": null,
  213. "address": "0x401030"
  214. },
  215. {
  216. "name": "EVENT_SINK_AddRef",
  217. "address": "0x401034"
  218. },
  219. {
  220. "name": null,
  221. "address": "0x401038"
  222. },
  223. {
  224. "name": null,
  225. "address": "0x40103c"
  226. },
  227. {
  228. "name": "EVENT_SINK_Release",
  229. "address": "0x401040"
  230. },
  231. {
  232. "name": null,
  233. "address": "0x401044"
  234. },
  235. {
  236. "name": "EVENT_SINK_QueryInterface",
  237. "address": "0x401048"
  238. },
  239. {
  240. "name": "__vbaExceptHandler",
  241. "address": "0x40104c"
  242. },
  243. {
  244. "name": null,
  245. "address": "0x401050"
  246. },
  247. {
  248. "name": null,
  249. "address": "0x401054"
  250. },
  251. {
  252. "name": null,
  253. "address": "0x401058"
  254. },
  255. {
  256. "name": null,
  257. "address": "0x40105c"
  258. },
  259. {
  260. "name": null,
  261. "address": "0x401060"
  262. },
  263. {
  264. "name": null,
  265. "address": "0x401064"
  266. },
  267. {
  268. "name": null,
  269. "address": "0x401068"
  270. },
  271. {
  272. "name": null,
  273. "address": "0x40106c"
  274. },
  275. {
  276. "name": null,
  277. "address": "0x401070"
  278. },
  279. {
  280. "name": null,
  281. "address": "0x401074"
  282. },
  283. {
  284. "name": null,
  285. "address": "0x401078"
  286. },
  287. {
  288. "name": null,
  289. "address": "0x40107c"
  290. },
  291. {
  292. "name": null,
  293. "address": "0x401080"
  294. },
  295. {
  296. "name": null,
  297. "address": "0x401084"
  298. },
  299. {
  300. "name": null,
  301. "address": "0x401088"
  302. },
  303. {
  304. "name": null,
  305. "address": "0x40108c"
  306. }
  307. ],
  308. "dll": "MSVBVM60.DLL"
  309. }
  310. ],
  311. "digital_signers": null,
  312. "exported_dll_name": null,
  313. "actual_checksum": "0x000ab48a",
  314. "overlay": null,
  315. "imagebase": "0x00400000",
  316. "reported_checksum": "0x000ab48a",
  317. "icon_hash": null,
  318. "entrypoint": "0x00401178",
  319. "timestamp": "2019-06-29 21:47:01",
  320. "osversion": "4.0",
  321. "sections": [
  322. {
  323. "name": ".text",
  324. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  325. "virtual_address": "0x00001000",
  326. "size_of_data": "0x0009d000",
  327. "entropy": "5.45",
  328. "raw_address": "0x00001000",
  329. "virtual_size": "0x0009ca4c",
  330. "characteristics_raw": "0x60000020"
  331. },
  332. {
  333. "name": ".data",
  334. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  335. "virtual_address": "0x0009e000",
  336. "size_of_data": "0x00000000",
  337. "entropy": "0.00",
  338. "raw_address": "0x00000000",
  339. "virtual_size": "0x00005bb0",
  340. "characteristics_raw": "0xc0000040"
  341. },
  342. {
  343. "name": ".rsrc",
  344. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  345. "virtual_address": "0x000a4000",
  346. "size_of_data": "0x00006000",
  347. "entropy": "4.22",
  348. "raw_address": "0x0009e000",
  349. "virtual_size": "0x00005950",
  350. "characteristics_raw": "0x40000040"
  351. }
  352. ],
  353. "resources": [],
  354. "dirents": [
  355. {
  356. "virtual_address": "0x00000000",
  357. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  358. "size": "0x00000000"
  359. },
  360. {
  361. "virtual_address": "0x0009d914",
  362. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  363. "size": "0x00000028"
  364. },
  365. {
  366. "virtual_address": "0x000a4000",
  367. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  368. "size": "0x00005950"
  369. },
  370. {
  371. "virtual_address": "0x00000000",
  372. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  373. "size": "0x00000000"
  374. },
  375. {
  376. "virtual_address": "0x00000000",
  377. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  378. "size": "0x00000000"
  379. },
  380. {
  381. "virtual_address": "0x00000000",
  382. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  383. "size": "0x00000000"
  384. },
  385. {
  386. "virtual_address": "0x00000000",
  387. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  388. "size": "0x00000000"
  389. },
  390. {
  391. "virtual_address": "0x00000000",
  392. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  393. "size": "0x00000000"
  394. },
  395. {
  396. "virtual_address": "0x00000000",
  397. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  398. "size": "0x00000000"
  399. },
  400. {
  401. "virtual_address": "0x00000000",
  402. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  403. "size": "0x00000000"
  404. },
  405. {
  406. "virtual_address": "0x00000000",
  407. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  408. "size": "0x00000000"
  409. },
  410. {
  411. "virtual_address": "0x00000220",
  412. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  413. "size": "0x00000020"
  414. },
  415. {
  416. "virtual_address": "0x00001000",
  417. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  418. "size": "0x00000094"
  419. },
  420. {
  421. "virtual_address": "0x00000000",
  422. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  423. "size": "0x00000000"
  424. },
  425. {
  426. "virtual_address": "0x00000000",
  427. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  428. "size": "0x00000000"
  429. },
  430. {
  431. "virtual_address": "0x00000000",
  432. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  433. "size": "0x00000000"
  434. }
  435. ],
  436. "exports": [],
  437. "guest_signers": {},
  438. "imphash": "746bf43b0b56a074bf9818bdc78892a5",
  439. "icon_fuzzy": null,
  440. "icon": null,
  441. "pdbpath": null,
  442. "imported_dll_count": 1,
  443. "versioninfo": []
  444. }
  445. }
  446.  
  447. [*] Resolved APIs: [
  448. "cryptbase.dll.SystemFunction036",
  449. "uxtheme.dll.ThemeInitApiHook",
  450. "user32.dll.IsProcessDPIAware",
  451. "oleaut32.dll.OleLoadPictureEx",
  452. "oleaut32.dll.DispCallFunc",
  453. "oleaut32.dll.LoadTypeLibEx",
  454. "oleaut32.dll.UnRegisterTypeLib",
  455. "oleaut32.dll.CreateTypeLib2",
  456. "oleaut32.dll.VarDateFromUdate",
  457. "oleaut32.dll.VarUdateFromDate",
  458. "oleaut32.dll.GetAltMonthNames",
  459. "oleaut32.dll.VarNumFromParseNum",
  460. "oleaut32.dll.VarParseNumFromStr",
  461. "oleaut32.dll.VarDecFromR4",
  462. "oleaut32.dll.VarDecFromR8",
  463. "oleaut32.dll.VarDecFromDate",
  464. "oleaut32.dll.VarDecFromI4",
  465. "oleaut32.dll.VarDecFromCy",
  466. "oleaut32.dll.VarR4FromDec",
  467. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  468. "oleaut32.dll.GetRecordInfoFromGuids",
  469. "oleaut32.dll.SafeArrayGetRecordInfo",
  470. "oleaut32.dll.SafeArraySetRecordInfo",
  471. "oleaut32.dll.SafeArrayGetIID",
  472. "oleaut32.dll.SafeArraySetIID",
  473. "oleaut32.dll.SafeArrayCopyData",
  474. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  475. "oleaut32.dll.SafeArrayCreateEx",
  476. "oleaut32.dll.VarFormat",
  477. "oleaut32.dll.VarFormatDateTime",
  478. "oleaut32.dll.VarFormatNumber",
  479. "oleaut32.dll.VarFormatPercent",
  480. "oleaut32.dll.VarFormatCurrency",
  481. "oleaut32.dll.VarWeekdayName",
  482. "oleaut32.dll.VarMonthName",
  483. "oleaut32.dll.VarAdd",
  484. "oleaut32.dll.VarAnd",
  485. "oleaut32.dll.VarCat",
  486. "oleaut32.dll.VarDiv",
  487. "oleaut32.dll.VarEqv",
  488. "oleaut32.dll.VarIdiv",
  489. "oleaut32.dll.VarImp",
  490. "oleaut32.dll.VarMod",
  491. "oleaut32.dll.VarMul",
  492. "oleaut32.dll.VarOr",
  493. "oleaut32.dll.VarPow",
  494. "oleaut32.dll.VarSub",
  495. "oleaut32.dll.VarXor",
  496. "oleaut32.dll.VarAbs",
  497. "oleaut32.dll.VarFix",
  498. "oleaut32.dll.VarInt",
  499. "oleaut32.dll.VarNeg",
  500. "oleaut32.dll.VarNot",
  501. "oleaut32.dll.VarRound",
  502. "oleaut32.dll.VarCmp",
  503. "oleaut32.dll.VarDecAdd",
  504. "oleaut32.dll.VarDecCmp",
  505. "oleaut32.dll.VarBstrCat",
  506. "oleaut32.dll.VarCyMulI4",
  507. "oleaut32.dll.VarBstrCmp",
  508. "ole32.dll.CoCreateInstanceEx",
  509. "ole32.dll.CLSIDFromProgIDEx",
  510. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  511. "user32.dll.GetSystemMetrics",
  512. "user32.dll.MonitorFromWindow",
  513. "user32.dll.MonitorFromRect",
  514. "user32.dll.MonitorFromPoint",
  515. "user32.dll.EnumDisplayMonitors",
  516. "user32.dll.GetMonitorInfoA",
  517. "dwmapi.dll.DwmIsCompositionEnabled",
  518. "gdi32.dll.GetLayout",
  519. "gdi32.dll.GdiRealizationInfo",
  520. "gdi32.dll.FontIsLinked",
  521. "advapi32.dll.RegOpenKeyExW",
  522. "advapi32.dll.RegQueryInfoKeyW",
  523. "gdi32.dll.GetTextFaceAliasW",
  524. "advapi32.dll.RegEnumValueW",
  525. "advapi32.dll.RegCloseKey",
  526. "advapi32.dll.RegQueryValueExW",
  527. "gdi32.dll.GetFontAssocStatus",
  528. "advapi32.dll.RegQueryValueExA",
  529. "advapi32.dll.RegEnumKeyExW",
  530. "gdi32.dll.GdiIsMetaPrintDC",
  531. "ole32.dll.CoInitializeEx",
  532. "ole32.dll.CoUninitialize",
  533. "ole32.dll.CoRegisterInitializeSpy",
  534. "ole32.dll.CoRevokeInitializeSpy",
  535. "gdi32.dll.GetTextExtentExPointWPri",
  536. "kernel32.dll.NlsGetCacheUpdateCount",
  537. "kernel32.dll.GetCalendarInfoW",
  538. "kernel32.dll.GetTickCount",
  539. "kernel32.dll.Sleep",
  540. "user32.dll.GetCursorPos",
  541. "user32.dll.EnumWindows",
  542. "kernel32.dll.SetErrorMode",
  543. "kernel32.dll.SetLastError",
  544. "kernel32.dll.VirtualAllocEx",
  545. "kernel32.dll.CloseHandle",
  546. "shell32.dll.ShellExecuteW",
  547. "kernel32.dll.WriteFile",
  548. "kernel32.dll.UnmapViewOfFile",
  549. "kernel32.dll.CreateFileW",
  550. "kernel32.dll.TerminateProcess",
  551. "kernel32.dll.VirtualProtectEx",
  552. "kernel32.dll.CreateProcessInternalW",
  553. "kernel32.dll.GetTempPathW",
  554. "kernel32.dll.GetLongPathNameW",
  555. "kernel32.dll.GetFileSize",
  556. "kernel32.dll.ReadFile",
  557. "ntdll.dll.NtProtectVirtualMemory",
  558. "kernel32.dll.GetCommandLineW"
  559. ]
  560.  
  561. [*] Static Analysis: {
  562. "pe": {
  563. "peid_signatures": null,
  564. "imports": [
  565. {
  566. "imports": [
  567. {
  568. "name": null,
  569. "address": "0x401000"
  570. },
  571. {
  572. "name": null,
  573. "address": "0x401004"
  574. },
  575. {
  576. "name": "MethCallEngine",
  577. "address": "0x401008"
  578. },
  579. {
  580. "name": null,
  581. "address": "0x40100c"
  582. },
  583. {
  584. "name": null,
  585. "address": "0x401010"
  586. },
  587. {
  588. "name": null,
  589. "address": "0x401014"
  590. },
  591. {
  592. "name": null,
  593. "address": "0x401018"
  594. },
  595. {
  596. "name": null,
  597. "address": "0x40101c"
  598. },
  599. {
  600. "name": null,
  601. "address": "0x401020"
  602. },
  603. {
  604. "name": null,
  605. "address": "0x401024"
  606. },
  607. {
  608. "name": null,
  609. "address": "0x401028"
  610. },
  611. {
  612. "name": null,
  613. "address": "0x40102c"
  614. },
  615. {
  616. "name": null,
  617. "address": "0x401030"
  618. },
  619. {
  620. "name": "EVENT_SINK_AddRef",
  621. "address": "0x401034"
  622. },
  623. {
  624. "name": null,
  625. "address": "0x401038"
  626. },
  627. {
  628. "name": null,
  629. "address": "0x40103c"
  630. },
  631. {
  632. "name": "EVENT_SINK_Release",
  633. "address": "0x401040"
  634. },
  635. {
  636. "name": null,
  637. "address": "0x401044"
  638. },
  639. {
  640. "name": "EVENT_SINK_QueryInterface",
  641. "address": "0x401048"
  642. },
  643. {
  644. "name": "__vbaExceptHandler",
  645. "address": "0x40104c"
  646. },
  647. {
  648. "name": null,
  649. "address": "0x401050"
  650. },
  651. {
  652. "name": null,
  653. "address": "0x401054"
  654. },
  655. {
  656. "name": null,
  657. "address": "0x401058"
  658. },
  659. {
  660. "name": null,
  661. "address": "0x40105c"
  662. },
  663. {
  664. "name": null,
  665. "address": "0x401060"
  666. },
  667. {
  668. "name": null,
  669. "address": "0x401064"
  670. },
  671. {
  672. "name": null,
  673. "address": "0x401068"
  674. },
  675. {
  676. "name": null,
  677. "address": "0x40106c"
  678. },
  679. {
  680. "name": null,
  681. "address": "0x401070"
  682. },
  683. {
  684. "name": null,
  685. "address": "0x401074"
  686. },
  687. {
  688. "name": null,
  689. "address": "0x401078"
  690. },
  691. {
  692. "name": null,
  693. "address": "0x40107c"
  694. },
  695. {
  696. "name": null,
  697. "address": "0x401080"
  698. },
  699. {
  700. "name": null,
  701. "address": "0x401084"
  702. },
  703. {
  704. "name": null,
  705. "address": "0x401088"
  706. },
  707. {
  708. "name": null,
  709. "address": "0x40108c"
  710. }
  711. ],
  712. "dll": "MSVBVM60.DLL"
  713. }
  714. ],
  715. "digital_signers": null,
  716. "exported_dll_name": null,
  717. "actual_checksum": "0x000ab48a",
  718. "overlay": null,
  719. "imagebase": "0x00400000",
  720. "reported_checksum": "0x000ab48a",
  721. "icon_hash": null,
  722. "entrypoint": "0x00401178",
  723. "timestamp": "2019-06-29 21:47:01",
  724. "osversion": "4.0",
  725. "sections": [
  726. {
  727. "name": ".text",
  728. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  729. "virtual_address": "0x00001000",
  730. "size_of_data": "0x0009d000",
  731. "entropy": "5.45",
  732. "raw_address": "0x00001000",
  733. "virtual_size": "0x0009ca4c",
  734. "characteristics_raw": "0x60000020"
  735. },
  736. {
  737. "name": ".data",
  738. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  739. "virtual_address": "0x0009e000",
  740. "size_of_data": "0x00000000",
  741. "entropy": "0.00",
  742. "raw_address": "0x00000000",
  743. "virtual_size": "0x00005bb0",
  744. "characteristics_raw": "0xc0000040"
  745. },
  746. {
  747. "name": ".rsrc",
  748. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  749. "virtual_address": "0x000a4000",
  750. "size_of_data": "0x00006000",
  751. "entropy": "4.22",
  752. "raw_address": "0x0009e000",
  753. "virtual_size": "0x00005950",
  754. "characteristics_raw": "0x40000040"
  755. }
  756. ],
  757. "resources": [],
  758. "dirents": [
  759. {
  760. "virtual_address": "0x00000000",
  761. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  762. "size": "0x00000000"
  763. },
  764. {
  765. "virtual_address": "0x0009d914",
  766. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  767. "size": "0x00000028"
  768. },
  769. {
  770. "virtual_address": "0x000a4000",
  771. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  772. "size": "0x00005950"
  773. },
  774. {
  775. "virtual_address": "0x00000000",
  776. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  777. "size": "0x00000000"
  778. },
  779. {
  780. "virtual_address": "0x00000000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  782. "size": "0x00000000"
  783. },
  784. {
  785. "virtual_address": "0x00000000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  787. "size": "0x00000000"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  797. "size": "0x00000000"
  798. },
  799. {
  800. "virtual_address": "0x00000000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  802. "size": "0x00000000"
  803. },
  804. {
  805. "virtual_address": "0x00000000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  807. "size": "0x00000000"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  812. "size": "0x00000000"
  813. },
  814. {
  815. "virtual_address": "0x00000220",
  816. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  817. "size": "0x00000020"
  818. },
  819. {
  820. "virtual_address": "0x00001000",
  821. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  822. "size": "0x00000094"
  823. },
  824. {
  825. "virtual_address": "0x00000000",
  826. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  827. "size": "0x00000000"
  828. },
  829. {
  830. "virtual_address": "0x00000000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  832. "size": "0x00000000"
  833. },
  834. {
  835. "virtual_address": "0x00000000",
  836. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  837. "size": "0x00000000"
  838. }
  839. ],
  840. "exports": [],
  841. "guest_signers": {},
  842. "imphash": "746bf43b0b56a074bf9818bdc78892a5",
  843. "icon_fuzzy": null,
  844. "icon": null,
  845. "pdbpath": null,
  846. "imported_dll_count": 1,
  847. "versioninfo": []
  848. }
  849. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!