API tools faq
paste
paladin316

file_2_2019-06-26_08_30.json

paladin316
Jun 26th, 2019
2,184
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.11 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "file.2"
  7. [*] File Size: 479744
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "b75dfcf1fb456750d74943252f8ab23b2310dbb262b3d49d6060da9107cd9cc3"
  10. [*] MD5: "d86710bc4d3ead9f49af4290c50583bc"
  11. [*] SHA1: "4900f33617cdc2ca9cb918cd60840636e18a0b3e"
  12. [*] SHA512: "b11bca311c0fabf7a8ced917f2020a8590dd062cce6e47308a2f4856423d92a4dd070b137a1d24c31af4d5c59bbc270d0612f864dcc3d4d4df64ac8fb4f91a72"
  13. [*] CRC32: "77867CE2"
  14. [*] SSDEEP: "3072:DCKezyOOAODZ7BtMwmYVpdXd3TE8XD2Tcs42AxrPBjFCS4jH2CpOVWpgdnO+M:DCKezrOFBtMb+L2Ibt"
  15.  
  16. [*] Process Execution: [
  17. "file.2"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "The binary likely contains encrypted or compressed data.",
  27. "Details": [
  28. {
  29. "section": "name: UPX1, entropy: 7.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0001a000, virtual_size: 0x0001a000"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "The executable is compressed using UPX",
  35. "Details": [
  36. {
  37. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00073000"
  38. }
  39. ]
  40. },
  41. {
  42. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  43. "Details": [
  44. {
  45. "FireEye": "Generic.mg.d86710bc4d3ead9f"
  46. },
  47. {
  48. "McAfee": "Artemis!D86710BC4D3E"
  49. },
  50. {
  51. "CrowdStrike": "win/malicious_confidence_90% (W)"
  52. },
  53. {
  54. "Alibaba": "Trojan:Win32/GenKryptik.c446bd74"
  55. },
  56. {
  57. "Invincea": "heuristic"
  58. },
  59. {
  60. "Symantec": "ML.Attribute.HighConfidence"
  61. },
  62. {
  63. "APEX": "Malicious"
  64. },
  65. {
  66. "Paloalto": "generic.ml"
  67. },
  68. {
  69. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  70. },
  71. {
  72. "Avast": "Win32:TrojanX-gen [Trj]"
  73. },
  74. {
  75. "Rising": "Trojan.Kryptik!8.8 (CLOUD)"
  76. },
  77. {
  78. "Sophos": "Mal/Generic-S"
  79. },
  80. {
  81. "DrWeb": "Trojan.PWS.Siggen2.19543"
  82. },
  83. {
  84. "McAfee-GW-Edition": "BehavesLike.Win32.Trojan.gz"
  85. },
  86. {
  87. "Trapmine": "malicious.moderate.ml.score"
  88. },
  89. {
  90. "Microsoft": "Trojan:Win32/Pwsteal.Q!bit"
  91. },
  92. {
  93. "AegisLab": "Trojan.Win32.Generic.4!c"
  94. },
  95. {
  96. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  97. },
  98. {
  99. "AhnLab-V3": "Win-Trojan/Gandcrab08.Exp"
  100. },
  101. {
  102. "Acronis": "suspicious"
  103. },
  104. {
  105. "MAX": "malware (ai score=98)"
  106. },
  107. {
  108. "ESET-NOD32": "a variant of Win32/Kryptik.GUFO"
  109. },
  110. {
  111. "Tencent": "Win32.Backdoor.Fareit.Auto"
  112. },
  113. {
  114. "SentinelOne": "DFI - Malicious PE"
  115. },
  116. {
  117. "Fortinet": "W32/GenKryptik.DLMD!tr"
  118. },
  119. {
  120. "AVG": "Win32:TrojanX-gen [Trj]"
  121. },
  122. {
  123. "Cybereason": "malicious.617cdc"
  124. },
  125. {
  126. "Qihoo-360": "HEUR/QVM11.1.1DDF.Malware.Gen"
  127. }
  128. ]
  129. }
  130. ]
  131.  
  132. [*] Started Service: []
  133.  
  134. [*] Executed Commands: []
  135.  
  136. [*] Mutexes: [
  137. "DBWinMutex"
  138. ]
  139.  
  140. [*] Modified Files: []
  141.  
  142. [*] Deleted Files: []
  143.  
  144. [*] Modified Registry Keys: []
  145.  
  146. [*] Deleted Registry Keys: []
  147.  
  148. [*] DNS Communications: []
  149.  
  150. [*] Domains: []
  151.  
  152. [*] Network Communication - ICMP: []
  153.  
  154. [*] Network Communication - HTTP: []
  155.  
  156. [*] Network Communication - SMTP: []
  157.  
  158. [*] Network Communication - Hosts: []
  159.  
  160. [*] Network Communication - IRC: []
  161.  
  162. [*] Static Analysis: {
  163. "pe": {
  164. "peid_signatures": null,
  165. "imports": [
  166. {
  167. "imports": [
  168. {
  169. "name": "LoadLibraryA",
  170. "address": "0x4e8b88"
  171. },
  172. {
  173. "name": "ExitProcess",
  174. "address": "0x4e8b8c"
  175. },
  176. {
  177. "name": "GetProcAddress",
  178. "address": "0x4e8b90"
  179. },
  180. {
  181. "name": "VirtualProtect",
  182. "address": "0x4e8b94"
  183. }
  184. ],
  185. "dll": "KERNEL32.DLL"
  186. },
  187. {
  188. "imports": [
  189. {
  190. "name": "RegisterCMMA",
  191. "address": "0x4e8b9c"
  192. }
  193. ],
  194. "dll": "mscms.dll"
  195. },
  196. {
  197. "imports": [
  198. {
  199. "name": null,
  200. "address": "0x4e8ba4"
  201. }
  202. ],
  203. "dll": "msi.dll"
  204. },
  205. {
  206. "imports": [
  207. {
  208. "name": "ReadOleStg",
  209. "address": "0x4e8bac"
  210. }
  211. ],
  212. "dll": "ole32.dll"
  213. },
  214. {
  215. "imports": [
  216. {
  217. "name": "LogErrorA",
  218. "address": "0x4e8bb4"
  219. }
  220. ],
  221. "dll": "rtutils.dll"
  222. },
  223. {
  224. "imports": [
  225. {
  226. "name": null,
  227. "address": "0x4e8bbc"
  228. }
  229. ],
  230. "dll": "WINSPOOL.DRV"
  231. }
  232. ],
  233. "digital_signers": null,
  234. "exported_dll_name": null,
  235. "actual_checksum": "0x00083aa1",
  236. "overlay": null,
  237. "imagebase": "0x00400000",
  238. "reported_checksum": "0x00000000",
  239. "icon_hash": null,
  240. "entrypoint": "0x0048dd80",
  241. "timestamp": "2019-06-25 00:28:59",
  242. "osversion": "5.0",
  243. "sections": [
  244. {
  245. "name": "UPX0",
  246. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  247. "virtual_address": "0x00001000",
  248. "size_of_data": "0x00000000",
  249. "entropy": "0.00",
  250. "raw_address": "0x00000400",
  251. "virtual_size": "0x00073000",
  252. "characteristics_raw": "0xe0000080"
  253. },
  254. {
  255. "name": "UPX1",
  256. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  257. "virtual_address": "0x00074000",
  258. "size_of_data": "0x0001a000",
  259. "entropy": "7.94",
  260. "raw_address": "0x00000400",
  261. "virtual_size": "0x0001a000",
  262. "characteristics_raw": "0xe0000040"
  263. },
  264. {
  265. "name": ".rsrc",
  266. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  267. "virtual_address": "0x0008e000",
  268. "size_of_data": "0x0005ae00",
  269. "entropy": "1.75",
  270. "raw_address": "0x0001a400",
  271. "virtual_size": "0x0005b000",
  272. "characteristics_raw": "0xc0000040"
  273. }
  274. ],
  275. "resources": [
  276. {
  277. "name": "RFYQK",
  278. "language": "LANG_NEUTRAL",
  279. "filetype": null,
  280. "sublanguage": "SUBLANG_NEUTRAL",
  281. "entropy": "0.00",
  282. "offset": "0x0002e278",
  283. "size": "0x00000116"
  284. },
  285. {
  286. "name": "RFYQK",
  287. "language": "LANG_NEUTRAL",
  288. "filetype": null,
  289. "sublanguage": "SUBLANG_NEUTRAL",
  290. "entropy": "0.00",
  291. "offset": "0x0002e278",
  292. "size": "0x00000116"
  293. }
  294. ],
  295. "dirents": [
  296. {
  297. "virtual_address": "0x00000000",
  298. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  299. "size": "0x00000000"
  300. },
  301. {
  302. "virtual_address": "0x000e8afc",
  303. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  304. "size": "0x0000016c"
  305. },
  306. {
  307. "virtual_address": "0x0008e000",
  308. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  309. "size": "0x0005aafc"
  310. },
  311. {
  312. "virtual_address": "0x00000000",
  313. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  314. "size": "0x00000000"
  315. },
  316. {
  317. "virtual_address": "0x00000000",
  318. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  319. "size": "0x00000000"
  320. },
  321. {
  322. "virtual_address": "0x000e8c68",
  323. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  324. "size": "0x00000010"
  325. },
  326. {
  327. "virtual_address": "0x00000000",
  328. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  329. "size": "0x00000000"
  330. },
  331. {
  332. "virtual_address": "0x00000000",
  333. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  334. "size": "0x00000000"
  335. },
  336. {
  337. "virtual_address": "0x00000000",
  338. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  339. "size": "0x00000000"
  340. },
  341. {
  342. "virtual_address": "0x00000000",
  343. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  344. "size": "0x00000000"
  345. },
  346. {
  347. "virtual_address": "0x0008df64",
  348. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  349. "size": "0x00000048"
  350. },
  351. {
  352. "virtual_address": "0x00000000",
  353. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  354. "size": "0x00000000"
  355. },
  356. {
  357. "virtual_address": "0x00000000",
  358. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  359. "size": "0x00000000"
  360. },
  361. {
  362. "virtual_address": "0x00000000",
  363. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  364. "size": "0x00000000"
  365. },
  366. {
  367. "virtual_address": "0x00000000",
  368. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  369. "size": "0x00000000"
  370. },
  371. {
  372. "virtual_address": "0x00000000",
  373. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  374. "size": "0x00000000"
  375. }
  376. ],
  377. "exports": [],
  378. "guest_signers": {},
  379. "imphash": "a957f3be893e6889f08acfe9dd8a7950",
  380. "icon_fuzzy": null,
  381. "icon": null,
  382. "pdbpath": null,
  383. "imported_dll_count": 6,
  384. "versioninfo": []
  385. }
  386. }
  387.  
  388. [*] Resolved APIs: [
  389. "kernel32.dll.LoadLibraryA",
  390. "kernel32.dll.LCMapStringW",
  391. "kernel32.dll.LCMapStringA",
  392. "kernel32.dll.GetStringTypeW",
  393. "kernel32.dll.MultiByteToWideChar",
  394. "kernel32.dll.GetStringTypeA",
  395. "kernel32.dll.WideCharToMultiByte",
  396. "kernel32.dll.GetLocaleInfoA",
  397. "kernel32.dll.HeapSize",
  398. "kernel32.dll.IsValidCodePage",
  399. "kernel32.dll.GetOEMCP",
  400. "kernel32.dll.GetACP",
  401. "kernel32.dll.GetCPInfo",
  402. "kernel32.dll.RtlUnwind",
  403. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  404. "kernel32.dll.IsDebuggerPresent",
  405. "kernel32.dll.UnhandledExceptionFilter",
  406. "kernel32.dll.GetCurrentProcess",
  407. "kernel32.dll.TerminateProcess",
  408. "kernel32.dll.GetSystemTimeAsFileTime",
  409. "kernel32.dll.GetCurrentProcessId",
  410. "kernel32.dll.GetTickCount",
  411. "kernel32.dll.QueryPerformanceCounter",
  412. "kernel32.dll.InterlockedDecrement",
  413. "kernel32.dll.GetCurrentThreadId",
  414. "kernel32.dll.SetLastError",
  415. "kernel32.dll.InterlockedIncrement",
  416. "kernel32.dll.TlsFree",
  417. "kernel32.dll.TlsSetValue",
  418. "kernel32.dll.TlsAlloc",
  419. "kernel32.dll.TlsGetValue",
  420. "kernel32.dll.GetStartupInfoA",
  421. "kernel32.dll.GetFileType",
  422. "kernel32.dll.SetHandleCount",
  423. "kernel32.dll.GetCommandLineW",
  424. "kernel32.dll.GetEnvironmentStringsW",
  425. "kernel32.dll.FreeEnvironmentStringsW",
  426. "kernel32.dll.GetModuleFileNameW",
  427. "kernel32.dll.SetUnhandledExceptionFilter",
  428. "kernel32.dll.GetModuleFileNameA",
  429. "kernel32.dll.GetStdHandle",
  430. "kernel32.dll.WriteFile",
  431. "kernel32.dll.ExitProcess",
  432. "kernel32.dll.GetProcAddress",
  433. "kernel32.dll.Sleep",
  434. "kernel32.dll.GetModuleHandleW",
  435. "kernel32.dll.HeapReAlloc",
  436. "kernel32.dll.VirtualAlloc",
  437. "kernel32.dll.EnterCriticalSection",
  438. "kernel32.dll.LeaveCriticalSection",
  439. "kernel32.dll.DeleteCriticalSection",
  440. "kernel32.dll.VirtualFree",
  441. "kernel32.dll.HeapCreate",
  442. "kernel32.dll.GetStartupInfoW",
  443. "kernel32.dll.HeapAlloc",
  444. "kernel32.dll.HeapFree",
  445. "kernel32.dll.GetLastError",
  446. "mscms.dll.CheckBitmapBits",
  447. "mscms.dll.DisassociateColorProfileFromDeviceA",
  448. "mscms.dll.CreateProfileFromLogColorSpaceW",
  449. "mscms.dll.IsColorProfileValid",
  450. "mscms.dll.TranslateColors",
  451. "mscms.dll.RegisterCMMA",
  452. "mscms.dll.GetColorProfileElement",
  453. "mscms.dll.EnumColorProfilesA",
  454. "mscms.dll.DeleteColorTransform",
  455. "mscms.dll.CloseColorProfile",
  456. "mscms.dll.CreateColorTransformA",
  457. "msi.dll.#114",
  458. "msi.dll.#79",
  459. "msi.dll.#66",
  460. "msi.dll.#85",
  461. "msi.dll.#49",
  462. "msi.dll.#156",
  463. "msi.dll.#22",
  464. "msi.dll.#65",
  465. "msi.dll.#23",
  466. "msi.dll.#40",
  467. "msi.dll.#89",
  468. "msi.dll.#45",
  469. "msi.dll.#21",
  470. "msi.dll.#129",
  471. "msi.dll.#141",
  472. "msi.dll.#158",
  473. "ole32.dll.OleCreateFromFile",
  474. "ole32.dll.CoGetInstanceFromFile",
  475. "ole32.dll.MonikerCommonPrefixWith",
  476. "ole32.dll.CoGetTreatAsClass",
  477. "ole32.dll.SNB_UserSize",
  478. "ole32.dll.UtConvertDvtd16toDvtd32",
  479. "ole32.dll.OleUninitialize",
  480. "ole32.dll.CoUnloadingWOW",
  481. "ole32.dll.ReadOleStg",
  482. "ole32.dll.CoGetCurrentProcess",
  483. "ole32.dll.CoGetMarshalSizeMax",
  484. "ole32.dll.GetRunningObjectTable",
  485. "ole32.dll.StgGetIFillLockBytesOnFile",
  486. "ole32.dll.CoQueryClientBlanket",
  487. "ole32.dll.SetConvertStg",
  488. "ole32.dll.CoFileTimeNow",
  489. "rtutils.dll.TraceDeregisterW",
  490. "rtutils.dll.TraceDeregisterExW",
  491. "rtutils.dll.RouterLogEventDataW",
  492. "rtutils.dll.TraceDeregisterA",
  493. "rtutils.dll.MprSetupProtocolFree",
  494. "rtutils.dll.RouterGetErrorStringW",
  495. "rtutils.dll.LogErrorA",
  496. "rtutils.dll.TracePrintfExA",
  497. "rtutils.dll.RouterLogRegisterW",
  498. "rtutils.dll.TracePrintfExW",
  499. "winspool.drv.DeleteFormW",
  500. "winspool.drv.GetPrintProcessorDirectoryA",
  501. "winspool.drv.FreePrinterNotifyInfo",
  502. "winspool.drv.EnumPrintProcessorDatatypesA",
  503. "winspool.drv.EnumPrinterDataExW",
  504. "winspool.drv.AdvancedDocumentPropertiesW",
  505. "winspool.drv.DeletePrinterDataA",
  506. "winspool.drv.DeletePrintProcessorA",
  507. "winspool.drv.DevQueryPrint",
  508. "winspool.drv.FindFirstPrinterChangeNotification",
  509. "winspool.drv.#209",
  510. "winspool.drv.AddPrinterDriverExW",
  511. "winspool.drv.#103",
  512. "winspool.drv.ScheduleJob",
  513. "kernel32.dll.FlsAlloc",
  514. "kernel32.dll.FlsGetValue",
  515. "kernel32.dll.FlsSetValue",
  516. "kernel32.dll.FlsFree"
  517. ]
  518.  
  519. [*] Static Analysis: {
  520. "pe": {
  521. "peid_signatures": null,
  522. "imports": [
  523. {
  524. "imports": [
  525. {
  526. "name": "LoadLibraryA",
  527. "address": "0x4e8b88"
  528. },
  529. {
  530. "name": "ExitProcess",
  531. "address": "0x4e8b8c"
  532. },
  533. {
  534. "name": "GetProcAddress",
  535. "address": "0x4e8b90"
  536. },
  537. {
  538. "name": "VirtualProtect",
  539. "address": "0x4e8b94"
  540. }
  541. ],
  542. "dll": "KERNEL32.DLL"
  543. },
  544. {
  545. "imports": [
  546. {
  547. "name": "RegisterCMMA",
  548. "address": "0x4e8b9c"
  549. }
  550. ],
  551. "dll": "mscms.dll"
  552. },
  553. {
  554. "imports": [
  555. {
  556. "name": null,
  557. "address": "0x4e8ba4"
  558. }
  559. ],
  560. "dll": "msi.dll"
  561. },
  562. {
  563. "imports": [
  564. {
  565. "name": "ReadOleStg",
  566. "address": "0x4e8bac"
  567. }
  568. ],
  569. "dll": "ole32.dll"
  570. },
  571. {
  572. "imports": [
  573. {
  574. "name": "LogErrorA",
  575. "address": "0x4e8bb4"
  576. }
  577. ],
  578. "dll": "rtutils.dll"
  579. },
  580. {
  581. "imports": [
  582. {
  583. "name": null,
  584. "address": "0x4e8bbc"
  585. }
  586. ],
  587. "dll": "WINSPOOL.DRV"
  588. }
  589. ],
  590. "digital_signers": null,
  591. "exported_dll_name": null,
  592. "actual_checksum": "0x00083aa1",
  593. "overlay": null,
  594. "imagebase": "0x00400000",
  595. "reported_checksum": "0x00000000",
  596. "icon_hash": null,
  597. "entrypoint": "0x0048dd80",
  598. "timestamp": "2019-06-25 00:28:59",
  599. "osversion": "5.0",
  600. "sections": [
  601. {
  602. "name": "UPX0",
  603. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  604. "virtual_address": "0x00001000",
  605. "size_of_data": "0x00000000",
  606. "entropy": "0.00",
  607. "raw_address": "0x00000400",
  608. "virtual_size": "0x00073000",
  609. "characteristics_raw": "0xe0000080"
  610. },
  611. {
  612. "name": "UPX1",
  613. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  614. "virtual_address": "0x00074000",
  615. "size_of_data": "0x0001a000",
  616. "entropy": "7.94",
  617. "raw_address": "0x00000400",
  618. "virtual_size": "0x0001a000",
  619. "characteristics_raw": "0xe0000040"
  620. },
  621. {
  622. "name": ".rsrc",
  623. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  624. "virtual_address": "0x0008e000",
  625. "size_of_data": "0x0005ae00",
  626. "entropy": "1.75",
  627. "raw_address": "0x0001a400",
  628. "virtual_size": "0x0005b000",
  629. "characteristics_raw": "0xc0000040"
  630. }
  631. ],
  632. "resources": [
  633. {
  634. "name": "RFYQK",
  635. "language": "LANG_NEUTRAL",
  636. "filetype": null,
  637. "sublanguage": "SUBLANG_NEUTRAL",
  638. "entropy": "0.00",
  639. "offset": "0x0002e278",
  640. "size": "0x00000116"
  641. },
  642. {
  643. "name": "RFYQK",
  644. "language": "LANG_NEUTRAL",
  645. "filetype": null,
  646. "sublanguage": "SUBLANG_NEUTRAL",
  647. "entropy": "0.00",
  648. "offset": "0x0002e278",
  649. "size": "0x00000116"
  650. }
  651. ],
  652. "dirents": [
  653. {
  654. "virtual_address": "0x00000000",
  655. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  656. "size": "0x00000000"
  657. },
  658. {
  659. "virtual_address": "0x000e8afc",
  660. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  661. "size": "0x0000016c"
  662. },
  663. {
  664. "virtual_address": "0x0008e000",
  665. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  666. "size": "0x0005aafc"
  667. },
  668. {
  669. "virtual_address": "0x00000000",
  670. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  671. "size": "0x00000000"
  672. },
  673. {
  674. "virtual_address": "0x00000000",
  675. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  676. "size": "0x00000000"
  677. },
  678. {
  679. "virtual_address": "0x000e8c68",
  680. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  681. "size": "0x00000010"
  682. },
  683. {
  684. "virtual_address": "0x00000000",
  685. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  686. "size": "0x00000000"
  687. },
  688. {
  689. "virtual_address": "0x00000000",
  690. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  691. "size": "0x00000000"
  692. },
  693. {
  694. "virtual_address": "0x00000000",
  695. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  696. "size": "0x00000000"
  697. },
  698. {
  699. "virtual_address": "0x00000000",
  700. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  701. "size": "0x00000000"
  702. },
  703. {
  704. "virtual_address": "0x0008df64",
  705. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  706. "size": "0x00000048"
  707. },
  708. {
  709. "virtual_address": "0x00000000",
  710. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  711. "size": "0x00000000"
  712. },
  713. {
  714. "virtual_address": "0x00000000",
  715. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  716. "size": "0x00000000"
  717. },
  718. {
  719. "virtual_address": "0x00000000",
  720. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  721. "size": "0x00000000"
  722. },
  723. {
  724. "virtual_address": "0x00000000",
  725. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  726. "size": "0x00000000"
  727. },
  728. {
  729. "virtual_address": "0x00000000",
  730. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  731. "size": "0x00000000"
  732. }
  733. ],
  734. "exports": [],
  735. "guest_signers": {},
  736. "imphash": "a957f3be893e6889f08acfe9dd8a7950",
  737. "icon_fuzzy": null,
  738. "icon": null,
  739. "pdbpath": null,
  740. "imported_dll_count": 6,
  741. "versioninfo": []
  742. }
  743. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!