API tools faq
paste
paladin316

file_1_2019-07-03_11_30.json

paladin316
Jul 3rd, 2019
2,145
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 73.40 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 0.0
  5.  
  6. [*] File Name: "file.1"
  7. [*] File Size: 210944
  8. [*] File Type: "MS-DOS executable"
  9. [*] SHA256: "d3deea72beee86e60a03950308eb725e28116593e3ce0333febf194565a73a0a"
  10. [*] MD5: "fc5bf675c2d4c2a52d5b614a32b3cd52"
  11. [*] SHA1: "44d56f78c60dbb260e09fcf23ce3bad9d7e42507"
  12. [*] SHA512: "df869b9e0a26c6f316bbe8dba45523d84f6838cc2e0bbb2633e8ee16b7b46562d3a030d2c6c598efe55fc91cdc90c481190c28b6ce9405d89c3b7fe307861c7c"
  13. [*] CRC32: "B7E551A4"
  14. [*] SSDEEP: "3072:nryYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtHL5AuN:lXkiq4wfv4Kjnv+srwoud"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: []
  19.  
  20. [*] Started Service: []
  21.  
  22. [*] Executed Commands: []
  23.  
  24. [*] Mutexes: []
  25.  
  26. [*] Modified Files: []
  27.  
  28. [*] Deleted Files: []
  29.  
  30. [*] Modified Registry Keys: []
  31.  
  32. [*] Deleted Registry Keys: []
  33.  
  34. [*] DNS Communications: []
  35.  
  36. [*] Domains: []
  37.  
  38. [*] Network Communication - ICMP: []
  39.  
  40. [*] Network Communication - HTTP: []
  41.  
  42. [*] Network Communication - SMTP: []
  43.  
  44. [*] Network Communication - Hosts: []
  45.  
  46. [*] Network Communication - IRC: []
  47.  
  48. [*] Static Analysis: {
  49. "pe": {
  50. "peid_signatures": null,
  51. "imports": [
  52. {
  53. "imports": [
  54. {
  55. "name": "UpdateProcThreadAttribute",
  56. "address": "0x100260b0"
  57. },
  58. {
  59. "name": "HeapFree",
  60. "address": "0x100260b4"
  61. },
  62. {
  63. "name": "GetProcessHeap",
  64. "address": "0x100260b8"
  65. },
  66. {
  67. "name": "CreateRemoteThread",
  68. "address": "0x100260bc"
  69. },
  70. {
  71. "name": "VirtualAlloc",
  72. "address": "0x100260c0"
  73. },
  74. {
  75. "name": "VirtualProtectEx",
  76. "address": "0x100260c4"
  77. },
  78. {
  79. "name": "VirtualAllocEx",
  80. "address": "0x100260c8"
  81. },
  82. {
  83. "name": "LoadLibraryA",
  84. "address": "0x100260cc"
  85. },
  86. {
  87. "name": "ProcessIdToSessionId",
  88. "address": "0x100260d0"
  89. },
  90. {
  91. "name": "DuplicateHandle",
  92. "address": "0x100260d4"
  93. },
  94. {
  95. "name": "InitializeProcThreadAttributeList",
  96. "address": "0x100260d8"
  97. },
  98. {
  99. "name": "WriteProcessMemory",
  100. "address": "0x100260dc"
  101. },
  102. {
  103. "name": "CreateThread",
  104. "address": "0x100260e0"
  105. },
  106. {
  107. "name": "GetThreadContext",
  108. "address": "0x100260e4"
  109. },
  110. {
  111. "name": "SetThreadContext",
  112. "address": "0x100260e8"
  113. },
  114. {
  115. "name": "FreeLibrary",
  116. "address": "0x100260ec"
  117. },
  118. {
  119. "name": "VirtualFree",
  120. "address": "0x100260f0"
  121. },
  122. {
  123. "name": "Thread32First",
  124. "address": "0x100260f4"
  125. },
  126. {
  127. "name": "Thread32Next",
  128. "address": "0x100260f8"
  129. },
  130. {
  131. "name": "SetLastError",
  132. "address": "0x100260fc"
  133. },
  134. {
  135. "name": "OpenThread",
  136. "address": "0x10026100"
  137. },
  138. {
  139. "name": "CreateToolhelp32Snapshot",
  140. "address": "0x10026104"
  141. },
  142. {
  143. "name": "GetVersionExA",
  144. "address": "0x10026108"
  145. },
  146. {
  147. "name": "SuspendThread",
  148. "address": "0x1002610c"
  149. },
  150. {
  151. "name": "ResumeThread",
  152. "address": "0x10026110"
  153. },
  154. {
  155. "name": "PeekNamedPipe",
  156. "address": "0x10026114"
  157. },
  158. {
  159. "name": "WaitNamedPipeA",
  160. "address": "0x10026118"
  161. },
  162. {
  163. "name": "SetNamedPipeHandleState",
  164. "address": "0x1002611c"
  165. },
  166. {
  167. "name": "LocalAlloc",
  168. "address": "0x10026120"
  169. },
  170. {
  171. "name": "LocalFree",
  172. "address": "0x10026124"
  173. },
  174. {
  175. "name": "GetComputerNameA",
  176. "address": "0x10026128"
  177. },
  178. {
  179. "name": "Process32First",
  180. "address": "0x1002612c"
  181. },
  182. {
  183. "name": "TerminateProcess",
  184. "address": "0x10026130"
  185. },
  186. {
  187. "name": "HeapAlloc",
  188. "address": "0x10026134"
  189. },
  190. {
  191. "name": "ExitProcess",
  192. "address": "0x10026138"
  193. },
  194. {
  195. "name": "DeleteProcThreadAttributeList",
  196. "address": "0x1002613c"
  197. },
  198. {
  199. "name": "VirtualProtect",
  200. "address": "0x10026140"
  201. },
  202. {
  203. "name": "FindNextFileA",
  204. "address": "0x10026144"
  205. },
  206. {
  207. "name": "MoveFileA",
  208. "address": "0x10026148"
  209. },
  210. {
  211. "name": "FindClose",
  212. "address": "0x1002614c"
  213. },
  214. {
  215. "name": "CopyFileA",
  216. "address": "0x10026150"
  217. },
  218. {
  219. "name": "FindFirstFileA",
  220. "address": "0x10026154"
  221. },
  222. {
  223. "name": "FileTimeToSystemTime",
  224. "address": "0x10026158"
  225. },
  226. {
  227. "name": "GetFileAttributesA",
  228. "address": "0x1002615c"
  229. },
  230. {
  231. "name": "ExpandEnvironmentStringsA",
  232. "address": "0x10026160"
  233. },
  234. {
  235. "name": "GetLogicalDrives",
  236. "address": "0x10026164"
  237. },
  238. {
  239. "name": "SystemTimeToTzSpecificLocalTime",
  240. "address": "0x10026168"
  241. },
  242. {
  243. "name": "GetFullPathNameA",
  244. "address": "0x1002616c"
  245. },
  246. {
  247. "name": "GetModuleHandleA",
  248. "address": "0x10026170"
  249. },
  250. {
  251. "name": "CreateNamedPipeA",
  252. "address": "0x10026174"
  253. },
  254. {
  255. "name": "GetProcAddress",
  256. "address": "0x10026178"
  257. },
  258. {
  259. "name": "ReadFile",
  260. "address": "0x1002617c"
  261. },
  262. {
  263. "name": "GetCurrentThread",
  264. "address": "0x10026180"
  265. },
  266. {
  267. "name": "ConnectNamedPipe",
  268. "address": "0x10026184"
  269. },
  270. {
  271. "name": "GetCurrentProcess",
  272. "address": "0x10026188"
  273. },
  274. {
  275. "name": "CloseHandle",
  276. "address": "0x1002618c"
  277. },
  278. {
  279. "name": "GetFileTime",
  280. "address": "0x10026190"
  281. },
  282. {
  283. "name": "GetCurrentDirectoryA",
  284. "address": "0x10026194"
  285. },
  286. {
  287. "name": "CreatePipe",
  288. "address": "0x10026198"
  289. },
  290. {
  291. "name": "GetCurrentDirectoryW",
  292. "address": "0x1002619c"
  293. },
  294. {
  295. "name": "GetLastError",
  296. "address": "0x100261a0"
  297. },
  298. {
  299. "name": "GetStartupInfoA",
  300. "address": "0x100261a4"
  301. },
  302. {
  303. "name": "SetCurrentDirectoryA",
  304. "address": "0x100261a8"
  305. },
  306. {
  307. "name": "FlushFileBuffers",
  308. "address": "0x100261ac"
  309. },
  310. {
  311. "name": "DisconnectNamedPipe",
  312. "address": "0x100261b0"
  313. },
  314. {
  315. "name": "MultiByteToWideChar",
  316. "address": "0x100261b4"
  317. },
  318. {
  319. "name": "CreateProcessA",
  320. "address": "0x100261b8"
  321. },
  322. {
  323. "name": "OpenProcess",
  324. "address": "0x100261bc"
  325. },
  326. {
  327. "name": "WriteFile",
  328. "address": "0x100261c0"
  329. },
  330. {
  331. "name": "SetFileTime",
  332. "address": "0x100261c4"
  333. },
  334. {
  335. "name": "WaitForSingleObject",
  336. "address": "0x100261c8"
  337. },
  338. {
  339. "name": "SetEnvironmentVariableW",
  340. "address": "0x100261cc"
  341. },
  342. {
  343. "name": "CreateFileA",
  344. "address": "0x100261d0"
  345. },
  346. {
  347. "name": "Sleep",
  348. "address": "0x100261d4"
  349. },
  350. {
  351. "name": "SetEnvironmentVariableA",
  352. "address": "0x100261d8"
  353. },
  354. {
  355. "name": "CompareStringW",
  356. "address": "0x100261dc"
  357. },
  358. {
  359. "name": "CompareStringA",
  360. "address": "0x100261e0"
  361. },
  362. {
  363. "name": "SetEndOfFile",
  364. "address": "0x100261e4"
  365. },
  366. {
  367. "name": "GetStringTypeW",
  368. "address": "0x100261e8"
  369. },
  370. {
  371. "name": "GetStringTypeA",
  372. "address": "0x100261ec"
  373. },
  374. {
  375. "name": "LCMapStringW",
  376. "address": "0x100261f0"
  377. },
  378. {
  379. "name": "LCMapStringA",
  380. "address": "0x100261f4"
  381. },
  382. {
  383. "name": "VirtualQuery",
  384. "address": "0x100261f8"
  385. },
  386. {
  387. "name": "GetModuleFileNameW",
  388. "address": "0x100261fc"
  389. },
  390. {
  391. "name": "SetStdHandle",
  392. "address": "0x10026200"
  393. },
  394. {
  395. "name": "WriteConsoleW",
  396. "address": "0x10026204"
  397. },
  398. {
  399. "name": "GetConsoleOutputCP",
  400. "address": "0x10026208"
  401. },
  402. {
  403. "name": "WriteConsoleA",
  404. "address": "0x1002620c"
  405. },
  406. {
  407. "name": "GetLocaleInfoA",
  408. "address": "0x10026210"
  409. },
  410. {
  411. "name": "HeapSize",
  412. "address": "0x10026214"
  413. },
  414. {
  415. "name": "IsValidCodePage",
  416. "address": "0x10026218"
  417. },
  418. {
  419. "name": "GetCPInfo",
  420. "address": "0x1002621c"
  421. },
  422. {
  423. "name": "DebugBreak",
  424. "address": "0x10026220"
  425. },
  426. {
  427. "name": "RaiseException",
  428. "address": "0x10026224"
  429. },
  430. {
  431. "name": "QueryPerformanceCounter",
  432. "address": "0x10026228"
  433. },
  434. {
  435. "name": "GetEnvironmentStringsW",
  436. "address": "0x1002622c"
  437. },
  438. {
  439. "name": "FreeEnvironmentStringsW",
  440. "address": "0x10026230"
  441. },
  442. {
  443. "name": "GetCurrentProcessId",
  444. "address": "0x10026234"
  445. },
  446. {
  447. "name": "GetOEMCP",
  448. "address": "0x10026238"
  449. },
  450. {
  451. "name": "GetLocalTime",
  452. "address": "0x1002623c"
  453. },
  454. {
  455. "name": "GetACP",
  456. "address": "0x10026240"
  457. },
  458. {
  459. "name": "Process32Next",
  460. "address": "0x10026244"
  461. },
  462. {
  463. "name": "GetTickCount",
  464. "address": "0x10026248"
  465. },
  466. {
  467. "name": "GetEnvironmentStrings",
  468. "address": "0x1002624c"
  469. },
  470. {
  471. "name": "FreeEnvironmentStringsA",
  472. "address": "0x10026250"
  473. },
  474. {
  475. "name": "SetFilePointer",
  476. "address": "0x10026254"
  477. },
  478. {
  479. "name": "GetFileType",
  480. "address": "0x10026258"
  481. },
  482. {
  483. "name": "GetModuleHandleW",
  484. "address": "0x1002625c"
  485. },
  486. {
  487. "name": "DeleteFileA",
  488. "address": "0x10026260"
  489. },
  490. {
  491. "name": "CreateDirectoryA",
  492. "address": "0x10026264"
  493. },
  494. {
  495. "name": "RemoveDirectoryA",
  496. "address": "0x10026268"
  497. },
  498. {
  499. "name": "GetCurrentThreadId",
  500. "address": "0x1002626c"
  501. },
  502. {
  503. "name": "GetCommandLineA",
  504. "address": "0x10026270"
  505. },
  506. {
  507. "name": "GetSystemTimeAsFileTime",
  508. "address": "0x10026274"
  509. },
  510. {
  511. "name": "UnhandledExceptionFilter",
  512. "address": "0x10026278"
  513. },
  514. {
  515. "name": "SetUnhandledExceptionFilter",
  516. "address": "0x1002627c"
  517. },
  518. {
  519. "name": "IsDebuggerPresent",
  520. "address": "0x10026280"
  521. },
  522. {
  523. "name": "HeapCreate",
  524. "address": "0x10026284"
  525. },
  526. {
  527. "name": "HeapDestroy",
  528. "address": "0x10026288"
  529. },
  530. {
  531. "name": "DeleteCriticalSection",
  532. "address": "0x1002628c"
  533. },
  534. {
  535. "name": "LeaveCriticalSection",
  536. "address": "0x10026290"
  537. },
  538. {
  539. "name": "EnterCriticalSection",
  540. "address": "0x10026294"
  541. },
  542. {
  543. "name": "HeapReAlloc",
  544. "address": "0x10026298"
  545. },
  546. {
  547. "name": "GetStdHandle",
  548. "address": "0x1002629c"
  549. },
  550. {
  551. "name": "GetModuleFileNameA",
  552. "address": "0x100262a0"
  553. },
  554. {
  555. "name": "TlsGetValue",
  556. "address": "0x100262a4"
  557. },
  558. {
  559. "name": "TlsAlloc",
  560. "address": "0x100262a8"
  561. },
  562. {
  563. "name": "TlsSetValue",
  564. "address": "0x100262ac"
  565. },
  566. {
  567. "name": "TlsFree",
  568. "address": "0x100262b0"
  569. },
  570. {
  571. "name": "InterlockedIncrement",
  572. "address": "0x100262b4"
  573. },
  574. {
  575. "name": "InterlockedDecrement",
  576. "address": "0x100262b8"
  577. },
  578. {
  579. "name": "InitializeCriticalSectionAndSpinCount",
  580. "address": "0x100262bc"
  581. },
  582. {
  583. "name": "RtlUnwind",
  584. "address": "0x100262c0"
  585. },
  586. {
  587. "name": "WideCharToMultiByte",
  588. "address": "0x100262c4"
  589. },
  590. {
  591. "name": "GetConsoleCP",
  592. "address": "0x100262c8"
  593. },
  594. {
  595. "name": "GetConsoleMode",
  596. "address": "0x100262cc"
  597. },
  598. {
  599. "name": "SetHandleCount",
  600. "address": "0x100262d0"
  601. }
  602. ],
  603. "dll": "KERNEL32.dll"
  604. },
  605. {
  606. "imports": [
  607. {
  608. "name": "RegEnumValueA",
  609. "address": "0x10026000"
  610. },
  611. {
  612. "name": "CloseServiceHandle",
  613. "address": "0x10026004"
  614. },
  615. {
  616. "name": "OpenProcessToken",
  617. "address": "0x10026008"
  618. },
  619. {
  620. "name": "CreateProcessWithLogonW",
  621. "address": "0x1002600c"
  622. },
  623. {
  624. "name": "DeleteService",
  625. "address": "0x10026010"
  626. },
  627. {
  628. "name": "CryptReleaseContext",
  629. "address": "0x10026014"
  630. },
  631. {
  632. "name": "CryptAcquireContextA",
  633. "address": "0x10026018"
  634. },
  635. {
  636. "name": "CryptGenRandom",
  637. "address": "0x1002601c"
  638. },
  639. {
  640. "name": "LogonUserA",
  641. "address": "0x10026020"
  642. },
  643. {
  644. "name": "CheckTokenMembership",
  645. "address": "0x10026024"
  646. },
  647. {
  648. "name": "FreeSid",
  649. "address": "0x10026028"
  650. },
  651. {
  652. "name": "RevertToSelf",
  653. "address": "0x1002602c"
  654. },
  655. {
  656. "name": "AllocateAndInitializeSid",
  657. "address": "0x10026030"
  658. },
  659. {
  660. "name": "DuplicateTokenEx",
  661. "address": "0x10026034"
  662. },
  663. {
  664. "name": "LookupAccountSidA",
  665. "address": "0x10026038"
  666. },
  667. {
  668. "name": "GetTokenInformation",
  669. "address": "0x1002603c"
  670. },
  671. {
  672. "name": "SetSecurityDescriptorDacl",
  673. "address": "0x10026040"
  674. },
  675. {
  676. "name": "InitializeSecurityDescriptor",
  677. "address": "0x10026044"
  678. },
  679. {
  680. "name": "RegCloseKey",
  681. "address": "0x10026048"
  682. },
  683. {
  684. "name": "RegEnumKeyA",
  685. "address": "0x1002604c"
  686. },
  687. {
  688. "name": "CreateProcessAsUserA",
  689. "address": "0x10026050"
  690. },
  691. {
  692. "name": "RegOpenCurrentUser",
  693. "address": "0x10026054"
  694. },
  695. {
  696. "name": "RegOpenKeyExA",
  697. "address": "0x10026058"
  698. },
  699. {
  700. "name": "GetUserNameA",
  701. "address": "0x1002605c"
  702. },
  703. {
  704. "name": "AdjustTokenPrivileges",
  705. "address": "0x10026060"
  706. },
  707. {
  708. "name": "ControlService",
  709. "address": "0x10026064"
  710. },
  711. {
  712. "name": "QueryServiceStatusEx",
  713. "address": "0x10026068"
  714. },
  715. {
  716. "name": "ImpersonateNamedPipeClient",
  717. "address": "0x1002606c"
  718. },
  719. {
  720. "name": "ImpersonateLoggedOnUser",
  721. "address": "0x10026070"
  722. },
  723. {
  724. "name": "LookupPrivilegeValueA",
  725. "address": "0x10026074"
  726. },
  727. {
  728. "name": "OpenThreadToken",
  729. "address": "0x10026078"
  730. },
  731. {
  732. "name": "OpenServiceA",
  733. "address": "0x1002607c"
  734. },
  735. {
  736. "name": "OpenSCManagerA",
  737. "address": "0x10026080"
  738. },
  739. {
  740. "name": "QueryServiceStatus",
  741. "address": "0x10026084"
  742. },
  743. {
  744. "name": "CreateProcessWithTokenW",
  745. "address": "0x10026088"
  746. },
  747. {
  748. "name": "StartServiceA",
  749. "address": "0x1002608c"
  750. },
  751. {
  752. "name": "CreateServiceA",
  753. "address": "0x10026090"
  754. }
  755. ],
  756. "dll": "ADVAPI32.dll"
  757. },
  758. {
  759. "imports": [
  760. {
  761. "name": "HttpQueryInfoA",
  762. "address": "0x100262e8"
  763. },
  764. {
  765. "name": "InternetQueryDataAvailable",
  766. "address": "0x100262ec"
  767. },
  768. {
  769. "name": "InternetReadFile",
  770. "address": "0x100262f0"
  771. },
  772. {
  773. "name": "InternetSetOptionA",
  774. "address": "0x100262f4"
  775. },
  776. {
  777. "name": "HttpOpenRequestA",
  778. "address": "0x100262f8"
  779. },
  780. {
  781. "name": "HttpSendRequestA",
  782. "address": "0x100262fc"
  783. },
  784. {
  785. "name": "InternetOpenA",
  786. "address": "0x10026300"
  787. },
  788. {
  789. "name": "InternetCloseHandle",
  790. "address": "0x10026304"
  791. },
  792. {
  793. "name": "InternetQueryOptionA",
  794. "address": "0x10026308"
  795. },
  796. {
  797. "name": "InternetConnectA",
  798. "address": "0x1002630c"
  799. }
  800. ],
  801. "dll": "WININET.dll"
  802. },
  803. {
  804. "imports": [
  805. {
  806. "name": "ntohs",
  807. "address": "0x10026314"
  808. },
  809. {
  810. "name": "connect",
  811. "address": "0x10026318"
  812. },
  813. {
  814. "name": "htons",
  815. "address": "0x1002631c"
  816. },
  817. {
  818. "name": "socket",
  819. "address": "0x10026320"
  820. },
  821. {
  822. "name": "accept",
  823. "address": "0x10026324"
  824. },
  825. {
  826. "name": "send",
  827. "address": "0x10026328"
  828. },
  829. {
  830. "name": "gethostname",
  831. "address": "0x1002632c"
  832. },
  833. {
  834. "name": "inet_ntoa",
  835. "address": "0x10026330"
  836. },
  837. {
  838. "name": "WSAStartup",
  839. "address": "0x10026334"
  840. },
  841. {
  842. "name": "WSACleanup",
  843. "address": "0x10026338"
  844. },
  845. {
  846. "name": "gethostbyname",
  847. "address": "0x1002633c"
  848. },
  849. {
  850. "name": "htonl",
  851. "address": "0x10026340"
  852. },
  853. {
  854. "name": "ntohl",
  855. "address": "0x10026344"
  856. },
  857. {
  858. "name": "listen",
  859. "address": "0x10026348"
  860. },
  861. {
  862. "name": "__WSAFDIsSet",
  863. "address": "0x1002634c"
  864. },
  865. {
  866. "name": "bind",
  867. "address": "0x10026350"
  868. },
  869. {
  870. "name": "recv",
  871. "address": "0x10026354"
  872. },
  873. {
  874. "name": "shutdown",
  875. "address": "0x10026358"
  876. },
  877. {
  878. "name": "WSAGetLastError",
  879. "address": "0x1002635c"
  880. },
  881. {
  882. "name": "select",
  883. "address": "0x10026360"
  884. },
  885. {
  886. "name": "ioctlsocket",
  887. "address": "0x10026364"
  888. },
  889. {
  890. "name": "inet_addr",
  891. "address": "0x10026368"
  892. },
  893. {
  894. "name": "closesocket",
  895. "address": "0x1002636c"
  896. }
  897. ],
  898. "dll": "WS2_32.dll"
  899. },
  900. {
  901. "imports": [
  902. {
  903. "name": "DnsFree",
  904. "address": "0x10026098"
  905. },
  906. {
  907. "name": "DnsQuery_A",
  908. "address": "0x1002609c"
  909. }
  910. ],
  911. "dll": "DNSAPI.dll"
  912. },
  913. {
  914. "imports": [
  915. {
  916. "name": "GetIfEntry",
  917. "address": "0x100260a4"
  918. },
  919. {
  920. "name": "GetIpAddrTable",
  921. "address": "0x100260a8"
  922. }
  923. ],
  924. "dll": "IPHLPAPI.DLL"
  925. },
  926. {
  927. "imports": [
  928. {
  929. "name": "LsaCallAuthenticationPackage",
  930. "address": "0x100262d8"
  931. },
  932. {
  933. "name": "LsaConnectUntrusted",
  934. "address": "0x100262dc"
  935. },
  936. {
  937. "name": "LsaLookupAuthenticationPackage",
  938. "address": "0x100262e0"
  939. }
  940. ],
  941. "dll": "Secur32.dll"
  942. }
  943. ],
  944. "digital_signers": null,
  945. "exported_dll_name": "beacon.dll",
  946. "actual_checksum": "0x00037e03",
  947. "overlay": null,
  948. "imagebase": "0x10000000",
  949. "reported_checksum": "0x00000000",
  950. "icon_hash": null,
  951. "entrypoint": "0x10017771",
  952. "timestamp": "2018-09-05 21:53:17",
  953. "osversion": "5.0",
  954. "sections": [
  955. {
  956. "name": ".text",
  957. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  958. "virtual_address": "0x00001000",
  959. "size_of_data": "0x00024e00",
  960. "entropy": "6.64",
  961. "raw_address": "0x00000400",
  962. "virtual_size": "0x00024c0a",
  963. "characteristics_raw": "0x60000020"
  964. },
  965. {
  966. "name": ".rdata",
  967. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  968. "virtual_address": "0x00026000",
  969. "size_of_data": "0x0000a200",
  970. "entropy": "6.81",
  971. "raw_address": "0x00025200",
  972. "virtual_size": "0x0000a1a1",
  973. "characteristics_raw": "0x40000040"
  974. },
  975. {
  976. "name": ".data",
  977. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  978. "virtual_address": "0x00031000",
  979. "size_of_data": "0x00002400",
  980. "entropy": "3.03",
  981. "raw_address": "0x0002f400",
  982. "virtual_size": "0x0000ff40",
  983. "characteristics_raw": "0xc0000040"
  984. },
  985. {
  986. "name": ".reloc",
  987. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  988. "virtual_address": "0x00041000",
  989. "size_of_data": "0x00002000",
  990. "entropy": "5.49",
  991. "raw_address": "0x00031800",
  992. "virtual_size": "0x00001e5a",
  993. "characteristics_raw": "0x42000040"
  994. }
  995. ],
  996. "resources": [],
  997. "dirents": [
  998. {
  999. "virtual_address": "0x00030150",
  1000. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1001. "size": "0x00000051"
  1002. },
  1003. {
  1004. "virtual_address": "0x0002ee74",
  1005. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1006. "size": "0x000000a0"
  1007. },
  1008. {
  1009. "virtual_address": "0x00000000",
  1010. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1011. "size": "0x00000000"
  1012. },
  1013. {
  1014. "virtual_address": "0x00000000",
  1015. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1016. "size": "0x00000000"
  1017. },
  1018. {
  1019. "virtual_address": "0x00000000",
  1020. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1021. "size": "0x00000000"
  1022. },
  1023. {
  1024. "virtual_address": "0x00041000",
  1025. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1026. "size": "0x000016c0"
  1027. },
  1028. {
  1029. "virtual_address": "0x00000000",
  1030. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1031. "size": "0x00000000"
  1032. },
  1033. {
  1034. "virtual_address": "0x00000000",
  1035. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1036. "size": "0x00000000"
  1037. },
  1038. {
  1039. "virtual_address": "0x00000000",
  1040. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1041. "size": "0x00000000"
  1042. },
  1043. {
  1044. "virtual_address": "0x00000000",
  1045. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1046. "size": "0x00000000"
  1047. },
  1048. {
  1049. "virtual_address": "0x0002e8c0",
  1050. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1051. "size": "0x00000040"
  1052. },
  1053. {
  1054. "virtual_address": "0x00000000",
  1055. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1056. "size": "0x00000000"
  1057. },
  1058. {
  1059. "virtual_address": "0x00026000",
  1060. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1061. "size": "0x00000374"
  1062. },
  1063. {
  1064. "virtual_address": "0x00000000",
  1065. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1066. "size": "0x00000000"
  1067. },
  1068. {
  1069. "virtual_address": "0x00000000",
  1070. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1071. "size": "0x00000000"
  1072. },
  1073. {
  1074. "virtual_address": "0x00000000",
  1075. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1076. "size": "0x00000000"
  1077. }
  1078. ],
  1079. "exports": [
  1080. {
  1081. "ordinal": 1,
  1082. "name": "_ReflectiveLoader@4",
  1083. "address": "0x10008f2f"
  1084. }
  1085. ],
  1086. "guest_signers": {},
  1087. "imphash": "0bc418575efc832b308d227b31192688",
  1088. "icon_fuzzy": null,
  1089. "icon": null,
  1090. "pdbpath": null,
  1091. "imported_dll_count": 7,
  1092. "versioninfo": []
  1093. }
  1094. }
  1095.  
  1096. [*] Resolved APIs: []
  1097.  
  1098. [*] Static Analysis: {
  1099. "pe": {
  1100. "peid_signatures": null,
  1101. "imports": [
  1102. {
  1103. "imports": [
  1104. {
  1105. "name": "UpdateProcThreadAttribute",
  1106. "address": "0x100260b0"
  1107. },
  1108. {
  1109. "name": "HeapFree",
  1110. "address": "0x100260b4"
  1111. },
  1112. {
  1113. "name": "GetProcessHeap",
  1114. "address": "0x100260b8"
  1115. },
  1116. {
  1117. "name": "CreateRemoteThread",
  1118. "address": "0x100260bc"
  1119. },
  1120. {
  1121. "name": "VirtualAlloc",
  1122. "address": "0x100260c0"
  1123. },
  1124. {
  1125. "name": "VirtualProtectEx",
  1126. "address": "0x100260c4"
  1127. },
  1128. {
  1129. "name": "VirtualAllocEx",
  1130. "address": "0x100260c8"
  1131. },
  1132. {
  1133. "name": "LoadLibraryA",
  1134. "address": "0x100260cc"
  1135. },
  1136. {
  1137. "name": "ProcessIdToSessionId",
  1138. "address": "0x100260d0"
  1139. },
  1140. {
  1141. "name": "DuplicateHandle",
  1142. "address": "0x100260d4"
  1143. },
  1144. {
  1145. "name": "InitializeProcThreadAttributeList",
  1146. "address": "0x100260d8"
  1147. },
  1148. {
  1149. "name": "WriteProcessMemory",
  1150. "address": "0x100260dc"
  1151. },
  1152. {
  1153. "name": "CreateThread",
  1154. "address": "0x100260e0"
  1155. },
  1156. {
  1157. "name": "GetThreadContext",
  1158. "address": "0x100260e4"
  1159. },
  1160. {
  1161. "name": "SetThreadContext",
  1162. "address": "0x100260e8"
  1163. },
  1164. {
  1165. "name": "FreeLibrary",
  1166. "address": "0x100260ec"
  1167. },
  1168. {
  1169. "name": "VirtualFree",
  1170. "address": "0x100260f0"
  1171. },
  1172. {
  1173. "name": "Thread32First",
  1174. "address": "0x100260f4"
  1175. },
  1176. {
  1177. "name": "Thread32Next",
  1178. "address": "0x100260f8"
  1179. },
  1180. {
  1181. "name": "SetLastError",
  1182. "address": "0x100260fc"
  1183. },
  1184. {
  1185. "name": "OpenThread",
  1186. "address": "0x10026100"
  1187. },
  1188. {
  1189. "name": "CreateToolhelp32Snapshot",
  1190. "address": "0x10026104"
  1191. },
  1192. {
  1193. "name": "GetVersionExA",
  1194. "address": "0x10026108"
  1195. },
  1196. {
  1197. "name": "SuspendThread",
  1198. "address": "0x1002610c"
  1199. },
  1200. {
  1201. "name": "ResumeThread",
  1202. "address": "0x10026110"
  1203. },
  1204. {
  1205. "name": "PeekNamedPipe",
  1206. "address": "0x10026114"
  1207. },
  1208. {
  1209. "name": "WaitNamedPipeA",
  1210. "address": "0x10026118"
  1211. },
  1212. {
  1213. "name": "SetNamedPipeHandleState",
  1214. "address": "0x1002611c"
  1215. },
  1216. {
  1217. "name": "LocalAlloc",
  1218. "address": "0x10026120"
  1219. },
  1220. {
  1221. "name": "LocalFree",
  1222. "address": "0x10026124"
  1223. },
  1224. {
  1225. "name": "GetComputerNameA",
  1226. "address": "0x10026128"
  1227. },
  1228. {
  1229. "name": "Process32First",
  1230. "address": "0x1002612c"
  1231. },
  1232. {
  1233. "name": "TerminateProcess",
  1234. "address": "0x10026130"
  1235. },
  1236. {
  1237. "name": "HeapAlloc",
  1238. "address": "0x10026134"
  1239. },
  1240. {
  1241. "name": "ExitProcess",
  1242. "address": "0x10026138"
  1243. },
  1244. {
  1245. "name": "DeleteProcThreadAttributeList",
  1246. "address": "0x1002613c"
  1247. },
  1248. {
  1249. "name": "VirtualProtect",
  1250. "address": "0x10026140"
  1251. },
  1252. {
  1253. "name": "FindNextFileA",
  1254. "address": "0x10026144"
  1255. },
  1256. {
  1257. "name": "MoveFileA",
  1258. "address": "0x10026148"
  1259. },
  1260. {
  1261. "name": "FindClose",
  1262. "address": "0x1002614c"
  1263. },
  1264. {
  1265. "name": "CopyFileA",
  1266. "address": "0x10026150"
  1267. },
  1268. {
  1269. "name": "FindFirstFileA",
  1270. "address": "0x10026154"
  1271. },
  1272. {
  1273. "name": "FileTimeToSystemTime",
  1274. "address": "0x10026158"
  1275. },
  1276. {
  1277. "name": "GetFileAttributesA",
  1278. "address": "0x1002615c"
  1279. },
  1280. {
  1281. "name": "ExpandEnvironmentStringsA",
  1282. "address": "0x10026160"
  1283. },
  1284. {
  1285. "name": "GetLogicalDrives",
  1286. "address": "0x10026164"
  1287. },
  1288. {
  1289. "name": "SystemTimeToTzSpecificLocalTime",
  1290. "address": "0x10026168"
  1291. },
  1292. {
  1293. "name": "GetFullPathNameA",
  1294. "address": "0x1002616c"
  1295. },
  1296. {
  1297. "name": "GetModuleHandleA",
  1298. "address": "0x10026170"
  1299. },
  1300. {
  1301. "name": "CreateNamedPipeA",
  1302. "address": "0x10026174"
  1303. },
  1304. {
  1305. "name": "GetProcAddress",
  1306. "address": "0x10026178"
  1307. },
  1308. {
  1309. "name": "ReadFile",
  1310. "address": "0x1002617c"
  1311. },
  1312. {
  1313. "name": "GetCurrentThread",
  1314. "address": "0x10026180"
  1315. },
  1316. {
  1317. "name": "ConnectNamedPipe",
  1318. "address": "0x10026184"
  1319. },
  1320. {
  1321. "name": "GetCurrentProcess",
  1322. "address": "0x10026188"
  1323. },
  1324. {
  1325. "name": "CloseHandle",
  1326. "address": "0x1002618c"
  1327. },
  1328. {
  1329. "name": "GetFileTime",
  1330. "address": "0x10026190"
  1331. },
  1332. {
  1333. "name": "GetCurrentDirectoryA",
  1334. "address": "0x10026194"
  1335. },
  1336. {
  1337. "name": "CreatePipe",
  1338. "address": "0x10026198"
  1339. },
  1340. {
  1341. "name": "GetCurrentDirectoryW",
  1342. "address": "0x1002619c"
  1343. },
  1344. {
  1345. "name": "GetLastError",
  1346. "address": "0x100261a0"
  1347. },
  1348. {
  1349. "name": "GetStartupInfoA",
  1350. "address": "0x100261a4"
  1351. },
  1352. {
  1353. "name": "SetCurrentDirectoryA",
  1354. "address": "0x100261a8"
  1355. },
  1356. {
  1357. "name": "FlushFileBuffers",
  1358. "address": "0x100261ac"
  1359. },
  1360. {
  1361. "name": "DisconnectNamedPipe",
  1362. "address": "0x100261b0"
  1363. },
  1364. {
  1365. "name": "MultiByteToWideChar",
  1366. "address": "0x100261b4"
  1367. },
  1368. {
  1369. "name": "CreateProcessA",
  1370. "address": "0x100261b8"
  1371. },
  1372. {
  1373. "name": "OpenProcess",
  1374. "address": "0x100261bc"
  1375. },
  1376. {
  1377. "name": "WriteFile",
  1378. "address": "0x100261c0"
  1379. },
  1380. {
  1381. "name": "SetFileTime",
  1382. "address": "0x100261c4"
  1383. },
  1384. {
  1385. "name": "WaitForSingleObject",
  1386. "address": "0x100261c8"
  1387. },
  1388. {
  1389. "name": "SetEnvironmentVariableW",
  1390. "address": "0x100261cc"
  1391. },
  1392. {
  1393. "name": "CreateFileA",
  1394. "address": "0x100261d0"
  1395. },
  1396. {
  1397. "name": "Sleep",
  1398. "address": "0x100261d4"
  1399. },
  1400. {
  1401. "name": "SetEnvironmentVariableA",
  1402. "address": "0x100261d8"
  1403. },
  1404. {
  1405. "name": "CompareStringW",
  1406. "address": "0x100261dc"
  1407. },
  1408. {
  1409. "name": "CompareStringA",
  1410. "address": "0x100261e0"
  1411. },
  1412. {
  1413. "name": "SetEndOfFile",
  1414. "address": "0x100261e4"
  1415. },
  1416. {
  1417. "name": "GetStringTypeW",
  1418. "address": "0x100261e8"
  1419. },
  1420. {
  1421. "name": "GetStringTypeA",
  1422. "address": "0x100261ec"
  1423. },
  1424. {
  1425. "name": "LCMapStringW",
  1426. "address": "0x100261f0"
  1427. },
  1428. {
  1429. "name": "LCMapStringA",
  1430. "address": "0x100261f4"
  1431. },
  1432. {
  1433. "name": "VirtualQuery",
  1434. "address": "0x100261f8"
  1435. },
  1436. {
  1437. "name": "GetModuleFileNameW",
  1438. "address": "0x100261fc"
  1439. },
  1440. {
  1441. "name": "SetStdHandle",
  1442. "address": "0x10026200"
  1443. },
  1444. {
  1445. "name": "WriteConsoleW",
  1446. "address": "0x10026204"
  1447. },
  1448. {
  1449. "name": "GetConsoleOutputCP",
  1450. "address": "0x10026208"
  1451. },
  1452. {
  1453. "name": "WriteConsoleA",
  1454. "address": "0x1002620c"
  1455. },
  1456. {
  1457. "name": "GetLocaleInfoA",
  1458. "address": "0x10026210"
  1459. },
  1460. {
  1461. "name": "HeapSize",
  1462. "address": "0x10026214"
  1463. },
  1464. {
  1465. "name": "IsValidCodePage",
  1466. "address": "0x10026218"
  1467. },
  1468. {
  1469. "name": "GetCPInfo",
  1470. "address": "0x1002621c"
  1471. },
  1472. {
  1473. "name": "DebugBreak",
  1474. "address": "0x10026220"
  1475. },
  1476. {
  1477. "name": "RaiseException",
  1478. "address": "0x10026224"
  1479. },
  1480. {
  1481. "name": "QueryPerformanceCounter",
  1482. "address": "0x10026228"
  1483. },
  1484. {
  1485. "name": "GetEnvironmentStringsW",
  1486. "address": "0x1002622c"
  1487. },
  1488. {
  1489. "name": "FreeEnvironmentStringsW",
  1490. "address": "0x10026230"
  1491. },
  1492. {
  1493. "name": "GetCurrentProcessId",
  1494. "address": "0x10026234"
  1495. },
  1496. {
  1497. "name": "GetOEMCP",
  1498. "address": "0x10026238"
  1499. },
  1500. {
  1501. "name": "GetLocalTime",
  1502. "address": "0x1002623c"
  1503. },
  1504. {
  1505. "name": "GetACP",
  1506. "address": "0x10026240"
  1507. },
  1508. {
  1509. "name": "Process32Next",
  1510. "address": "0x10026244"
  1511. },
  1512. {
  1513. "name": "GetTickCount",
  1514. "address": "0x10026248"
  1515. },
  1516. {
  1517. "name": "GetEnvironmentStrings",
  1518. "address": "0x1002624c"
  1519. },
  1520. {
  1521. "name": "FreeEnvironmentStringsA",
  1522. "address": "0x10026250"
  1523. },
  1524. {
  1525. "name": "SetFilePointer",
  1526. "address": "0x10026254"
  1527. },
  1528. {
  1529. "name": "GetFileType",
  1530. "address": "0x10026258"
  1531. },
  1532. {
  1533. "name": "GetModuleHandleW",
  1534. "address": "0x1002625c"
  1535. },
  1536. {
  1537. "name": "DeleteFileA",
  1538. "address": "0x10026260"
  1539. },
  1540. {
  1541. "name": "CreateDirectoryA",
  1542. "address": "0x10026264"
  1543. },
  1544. {
  1545. "name": "RemoveDirectoryA",
  1546. "address": "0x10026268"
  1547. },
  1548. {
  1549. "name": "GetCurrentThreadId",
  1550. "address": "0x1002626c"
  1551. },
  1552. {
  1553. "name": "GetCommandLineA",
  1554. "address": "0x10026270"
  1555. },
  1556. {
  1557. "name": "GetSystemTimeAsFileTime",
  1558. "address": "0x10026274"
  1559. },
  1560. {
  1561. "name": "UnhandledExceptionFilter",
  1562. "address": "0x10026278"
  1563. },
  1564. {
  1565. "name": "SetUnhandledExceptionFilter",
  1566. "address": "0x1002627c"
  1567. },
  1568. {
  1569. "name": "IsDebuggerPresent",
  1570. "address": "0x10026280"
  1571. },
  1572. {
  1573. "name": "HeapCreate",
  1574. "address": "0x10026284"
  1575. },
  1576. {
  1577. "name": "HeapDestroy",
  1578. "address": "0x10026288"
  1579. },
  1580. {
  1581. "name": "DeleteCriticalSection",
  1582. "address": "0x1002628c"
  1583. },
  1584. {
  1585. "name": "LeaveCriticalSection",
  1586. "address": "0x10026290"
  1587. },
  1588. {
  1589. "name": "EnterCriticalSection",
  1590. "address": "0x10026294"
  1591. },
  1592. {
  1593. "name": "HeapReAlloc",
  1594. "address": "0x10026298"
  1595. },
  1596. {
  1597. "name": "GetStdHandle",
  1598. "address": "0x1002629c"
  1599. },
  1600. {
  1601. "name": "GetModuleFileNameA",
  1602. "address": "0x100262a0"
  1603. },
  1604. {
  1605. "name": "TlsGetValue",
  1606. "address": "0x100262a4"
  1607. },
  1608. {
  1609. "name": "TlsAlloc",
  1610. "address": "0x100262a8"
  1611. },
  1612. {
  1613. "name": "TlsSetValue",
  1614. "address": "0x100262ac"
  1615. },
  1616. {
  1617. "name": "TlsFree",
  1618. "address": "0x100262b0"
  1619. },
  1620. {
  1621. "name": "InterlockedIncrement",
  1622. "address": "0x100262b4"
  1623. },
  1624. {
  1625. "name": "InterlockedDecrement",
  1626. "address": "0x100262b8"
  1627. },
  1628. {
  1629. "name": "InitializeCriticalSectionAndSpinCount",
  1630. "address": "0x100262bc"
  1631. },
  1632. {
  1633. "name": "RtlUnwind",
  1634. "address": "0x100262c0"
  1635. },
  1636. {
  1637. "name": "WideCharToMultiByte",
  1638. "address": "0x100262c4"
  1639. },
  1640. {
  1641. "name": "GetConsoleCP",
  1642. "address": "0x100262c8"
  1643. },
  1644. {
  1645. "name": "GetConsoleMode",
  1646. "address": "0x100262cc"
  1647. },
  1648. {
  1649. "name": "SetHandleCount",
  1650. "address": "0x100262d0"
  1651. }
  1652. ],
  1653. "dll": "KERNEL32.dll"
  1654. },
  1655. {
  1656. "imports": [
  1657. {
  1658. "name": "RegEnumValueA",
  1659. "address": "0x10026000"
  1660. },
  1661. {
  1662. "name": "CloseServiceHandle",
  1663. "address": "0x10026004"
  1664. },
  1665. {
  1666. "name": "OpenProcessToken",
  1667. "address": "0x10026008"
  1668. },
  1669. {
  1670. "name": "CreateProcessWithLogonW",
  1671. "address": "0x1002600c"
  1672. },
  1673. {
  1674. "name": "DeleteService",
  1675. "address": "0x10026010"
  1676. },
  1677. {
  1678. "name": "CryptReleaseContext",
  1679. "address": "0x10026014"
  1680. },
  1681. {
  1682. "name": "CryptAcquireContextA",
  1683. "address": "0x10026018"
  1684. },
  1685. {
  1686. "name": "CryptGenRandom",
  1687. "address": "0x1002601c"
  1688. },
  1689. {
  1690. "name": "LogonUserA",
  1691. "address": "0x10026020"
  1692. },
  1693. {
  1694. "name": "CheckTokenMembership",
  1695. "address": "0x10026024"
  1696. },
  1697. {
  1698. "name": "FreeSid",
  1699. "address": "0x10026028"
  1700. },
  1701. {
  1702. "name": "RevertToSelf",
  1703. "address": "0x1002602c"
  1704. },
  1705. {
  1706. "name": "AllocateAndInitializeSid",
  1707. "address": "0x10026030"
  1708. },
  1709. {
  1710. "name": "DuplicateTokenEx",
  1711. "address": "0x10026034"
  1712. },
  1713. {
  1714. "name": "LookupAccountSidA",
  1715. "address": "0x10026038"
  1716. },
  1717. {
  1718. "name": "GetTokenInformation",
  1719. "address": "0x1002603c"
  1720. },
  1721. {
  1722. "name": "SetSecurityDescriptorDacl",
  1723. "address": "0x10026040"
  1724. },
  1725. {
  1726. "name": "InitializeSecurityDescriptor",
  1727. "address": "0x10026044"
  1728. },
  1729. {
  1730. "name": "RegCloseKey",
  1731. "address": "0x10026048"
  1732. },
  1733. {
  1734. "name": "RegEnumKeyA",
  1735. "address": "0x1002604c"
  1736. },
  1737. {
  1738. "name": "CreateProcessAsUserA",
  1739. "address": "0x10026050"
  1740. },
  1741. {
  1742. "name": "RegOpenCurrentUser",
  1743. "address": "0x10026054"
  1744. },
  1745. {
  1746. "name": "RegOpenKeyExA",
  1747. "address": "0x10026058"
  1748. },
  1749. {
  1750. "name": "GetUserNameA",
  1751. "address": "0x1002605c"
  1752. },
  1753. {
  1754. "name": "AdjustTokenPrivileges",
  1755. "address": "0x10026060"
  1756. },
  1757. {
  1758. "name": "ControlService",
  1759. "address": "0x10026064"
  1760. },
  1761. {
  1762. "name": "QueryServiceStatusEx",
  1763. "address": "0x10026068"
  1764. },
  1765. {
  1766. "name": "ImpersonateNamedPipeClient",
  1767. "address": "0x1002606c"
  1768. },
  1769. {
  1770. "name": "ImpersonateLoggedOnUser",
  1771. "address": "0x10026070"
  1772. },
  1773. {
  1774. "name": "LookupPrivilegeValueA",
  1775. "address": "0x10026074"
  1776. },
  1777. {
  1778. "name": "OpenThreadToken",
  1779. "address": "0x10026078"
  1780. },
  1781. {
  1782. "name": "OpenServiceA",
  1783. "address": "0x1002607c"
  1784. },
  1785. {
  1786. "name": "OpenSCManagerA",
  1787. "address": "0x10026080"
  1788. },
  1789. {
  1790. "name": "QueryServiceStatus",
  1791. "address": "0x10026084"
  1792. },
  1793. {
  1794. "name": "CreateProcessWithTokenW",
  1795. "address": "0x10026088"
  1796. },
  1797. {
  1798. "name": "StartServiceA",
  1799. "address": "0x1002608c"
  1800. },
  1801. {
  1802. "name": "CreateServiceA",
  1803. "address": "0x10026090"
  1804. }
  1805. ],
  1806. "dll": "ADVAPI32.dll"
  1807. },
  1808. {
  1809. "imports": [
  1810. {
  1811. "name": "HttpQueryInfoA",
  1812. "address": "0x100262e8"
  1813. },
  1814. {
  1815. "name": "InternetQueryDataAvailable",
  1816. "address": "0x100262ec"
  1817. },
  1818. {
  1819. "name": "InternetReadFile",
  1820. "address": "0x100262f0"
  1821. },
  1822. {
  1823. "name": "InternetSetOptionA",
  1824. "address": "0x100262f4"
  1825. },
  1826. {
  1827. "name": "HttpOpenRequestA",
  1828. "address": "0x100262f8"
  1829. },
  1830. {
  1831. "name": "HttpSendRequestA",
  1832. "address": "0x100262fc"
  1833. },
  1834. {
  1835. "name": "InternetOpenA",
  1836. "address": "0x10026300"
  1837. },
  1838. {
  1839. "name": "InternetCloseHandle",
  1840. "address": "0x10026304"
  1841. },
  1842. {
  1843. "name": "InternetQueryOptionA",
  1844. "address": "0x10026308"
  1845. },
  1846. {
  1847. "name": "InternetConnectA",
  1848. "address": "0x1002630c"
  1849. }
  1850. ],
  1851. "dll": "WININET.dll"
  1852. },
  1853. {
  1854. "imports": [
  1855. {
  1856. "name": "ntohs",
  1857. "address": "0x10026314"
  1858. },
  1859. {
  1860. "name": "connect",
  1861. "address": "0x10026318"
  1862. },
  1863. {
  1864. "name": "htons",
  1865. "address": "0x1002631c"
  1866. },
  1867. {
  1868. "name": "socket",
  1869. "address": "0x10026320"
  1870. },
  1871. {
  1872. "name": "accept",
  1873. "address": "0x10026324"
  1874. },
  1875. {
  1876. "name": "send",
  1877. "address": "0x10026328"
  1878. },
  1879. {
  1880. "name": "gethostname",
  1881. "address": "0x1002632c"
  1882. },
  1883. {
  1884. "name": "inet_ntoa",
  1885. "address": "0x10026330"
  1886. },
  1887. {
  1888. "name": "WSAStartup",
  1889. "address": "0x10026334"
  1890. },
  1891. {
  1892. "name": "WSACleanup",
  1893. "address": "0x10026338"
  1894. },
  1895. {
  1896. "name": "gethostbyname",
  1897. "address": "0x1002633c"
  1898. },
  1899. {
  1900. "name": "htonl",
  1901. "address": "0x10026340"
  1902. },
  1903. {
  1904. "name": "ntohl",
  1905. "address": "0x10026344"
  1906. },
  1907. {
  1908. "name": "listen",
  1909. "address": "0x10026348"
  1910. },
  1911. {
  1912. "name": "__WSAFDIsSet",
  1913. "address": "0x1002634c"
  1914. },
  1915. {
  1916. "name": "bind",
  1917. "address": "0x10026350"
  1918. },
  1919. {
  1920. "name": "recv",
  1921. "address": "0x10026354"
  1922. },
  1923. {
  1924. "name": "shutdown",
  1925. "address": "0x10026358"
  1926. },
  1927. {
  1928. "name": "WSAGetLastError",
  1929. "address": "0x1002635c"
  1930. },
  1931. {
  1932. "name": "select",
  1933. "address": "0x10026360"
  1934. },
  1935. {
  1936. "name": "ioctlsocket",
  1937. "address": "0x10026364"
  1938. },
  1939. {
  1940. "name": "inet_addr",
  1941. "address": "0x10026368"
  1942. },
  1943. {
  1944. "name": "closesocket",
  1945. "address": "0x1002636c"
  1946. }
  1947. ],
  1948. "dll": "WS2_32.dll"
  1949. },
  1950. {
  1951. "imports": [
  1952. {
  1953. "name": "DnsFree",
  1954. "address": "0x10026098"
  1955. },
  1956. {
  1957. "name": "DnsQuery_A",
  1958. "address": "0x1002609c"
  1959. }
  1960. ],
  1961. "dll": "DNSAPI.dll"
  1962. },
  1963. {
  1964. "imports": [
  1965. {
  1966. "name": "GetIfEntry",
  1967. "address": "0x100260a4"
  1968. },
  1969. {
  1970. "name": "GetIpAddrTable",
  1971. "address": "0x100260a8"
  1972. }
  1973. ],
  1974. "dll": "IPHLPAPI.DLL"
  1975. },
  1976. {
  1977. "imports": [
  1978. {
  1979. "name": "LsaCallAuthenticationPackage",
  1980. "address": "0x100262d8"
  1981. },
  1982. {
  1983. "name": "LsaConnectUntrusted",
  1984. "address": "0x100262dc"
  1985. },
  1986. {
  1987. "name": "LsaLookupAuthenticationPackage",
  1988. "address": "0x100262e0"
  1989. }
  1990. ],
  1991. "dll": "Secur32.dll"
  1992. }
  1993. ],
  1994. "digital_signers": null,
  1995. "exported_dll_name": "beacon.dll",
  1996. "actual_checksum": "0x00037e03",
  1997. "overlay": null,
  1998. "imagebase": "0x10000000",
  1999. "reported_checksum": "0x00000000",
  2000. "icon_hash": null,
  2001. "entrypoint": "0x10017771",
  2002. "timestamp": "2018-09-05 21:53:17",
  2003. "osversion": "5.0",
  2004. "sections": [
  2005. {
  2006. "name": ".text",
  2007. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2008. "virtual_address": "0x00001000",
  2009. "size_of_data": "0x00024e00",
  2010. "entropy": "6.64",
  2011. "raw_address": "0x00000400",
  2012. "virtual_size": "0x00024c0a",
  2013. "characteristics_raw": "0x60000020"
  2014. },
  2015. {
  2016. "name": ".rdata",
  2017. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2018. "virtual_address": "0x00026000",
  2019. "size_of_data": "0x0000a200",
  2020. "entropy": "6.81",
  2021. "raw_address": "0x00025200",
  2022. "virtual_size": "0x0000a1a1",
  2023. "characteristics_raw": "0x40000040"
  2024. },
  2025. {
  2026. "name": ".data",
  2027. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2028. "virtual_address": "0x00031000",
  2029. "size_of_data": "0x00002400",
  2030. "entropy": "3.03",
  2031. "raw_address": "0x0002f400",
  2032. "virtual_size": "0x0000ff40",
  2033. "characteristics_raw": "0xc0000040"
  2034. },
  2035. {
  2036. "name": ".reloc",
  2037. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  2038. "virtual_address": "0x00041000",
  2039. "size_of_data": "0x00002000",
  2040. "entropy": "5.49",
  2041. "raw_address": "0x00031800",
  2042. "virtual_size": "0x00001e5a",
  2043. "characteristics_raw": "0x42000040"
  2044. }
  2045. ],
  2046. "resources": [],
  2047. "dirents": [
  2048. {
  2049. "virtual_address": "0x00030150",
  2050. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2051. "size": "0x00000051"
  2052. },
  2053. {
  2054. "virtual_address": "0x0002ee74",
  2055. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2056. "size": "0x000000a0"
  2057. },
  2058. {
  2059. "virtual_address": "0x00000000",
  2060. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2061. "size": "0x00000000"
  2062. },
  2063. {
  2064. "virtual_address": "0x00000000",
  2065. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2066. "size": "0x00000000"
  2067. },
  2068. {
  2069. "virtual_address": "0x00000000",
  2070. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2071. "size": "0x00000000"
  2072. },
  2073. {
  2074. "virtual_address": "0x00041000",
  2075. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2076. "size": "0x000016c0"
  2077. },
  2078. {
  2079. "virtual_address": "0x00000000",
  2080. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2081. "size": "0x00000000"
  2082. },
  2083. {
  2084. "virtual_address": "0x00000000",
  2085. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2086. "size": "0x00000000"
  2087. },
  2088. {
  2089. "virtual_address": "0x00000000",
  2090. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2091. "size": "0x00000000"
  2092. },
  2093. {
  2094. "virtual_address": "0x00000000",
  2095. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2096. "size": "0x00000000"
  2097. },
  2098. {
  2099. "virtual_address": "0x0002e8c0",
  2100. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2101. "size": "0x00000040"
  2102. },
  2103. {
  2104. "virtual_address": "0x00000000",
  2105. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2106. "size": "0x00000000"
  2107. },
  2108. {
  2109. "virtual_address": "0x00026000",
  2110. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2111. "size": "0x00000374"
  2112. },
  2113. {
  2114. "virtual_address": "0x00000000",
  2115. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2116. "size": "0x00000000"
  2117. },
  2118. {
  2119. "virtual_address": "0x00000000",
  2120. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2121. "size": "0x00000000"
  2122. },
  2123. {
  2124. "virtual_address": "0x00000000",
  2125. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2126. "size": "0x00000000"
  2127. }
  2128. ],
  2129. "exports": [
  2130. {
  2131. "ordinal": 1,
  2132. "name": "_ReflectiveLoader@4",
  2133. "address": "0x10008f2f"
  2134. }
  2135. ],
  2136. "guest_signers": {},
  2137. "imphash": "0bc418575efc832b308d227b31192688",
  2138. "icon_fuzzy": null,
  2139. "icon": null,
  2140. "pdbpath": null,
  2141. "imported_dll_count": 7,
  2142. "versioninfo": []
  2143. }
  2144. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!