API tools faq
paste
paladin316

NanoCore_8109c409b23a93a40f1363aaba8642cf_exe_2019-06-28_07_30.json

paladin316
Jun 28th, 2019
2,148
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.63 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 3.5
  5.  
  6. [*] File Name: "NanoCore_8109c409b23a93a40f1363aaba8642cf.exe"
  7. [*] File Size: 524288
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "cb448feecebfddee76350c18fc7c3b62e6d15765aad2628a11e9e0fe8f5af613"
  10. [*] MD5: "8109c409b23a93a40f1363aaba8642cf"
  11. [*] SHA1: "9a75b62e684db67092329863b2e7ea90feabaaa2"
  12. [*] SHA512: "61fe6719955ed41eac2936a443f71a564f40116d9c38edd8b47073f3ecd03cd4b74ef1fce74f9db9a216bb3472f2473431473c1936d1da7592e692948fa78a14"
  13. [*] CRC32: "C365C5BC"
  14. [*] SSDEEP: "6144:uvBWnxTf5NlqXYb7Yqp+TPsnKZ5cYlkVOCUqPAmOGXosQOEzaHnQU0Tbhw:WMf5N8X47R8bLlkVDr4mppQVzaHn"
  15.  
  16. [*] Process Execution: [
  17. "NanoCore_8109c409b23a93a40f1363aaba8642cf.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "The binary likely contains encrypted or compressed data.",
  27. "Details": [
  28. {
  29. "section": "name: .text, entropy: 7.07, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0007c000, virtual_size: 0x0007b6f4"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  35. "Details": [
  36. {
  37. "Spam": "NanoCore_8109c409b23a93a40f1363aaba8642cf.exe (1524) called API CreateProcessInternalW 32189 times"
  38. }
  39. ]
  40. }
  41. ]
  42.  
  43. [*] Started Service: []
  44.  
  45. [*] Executed Commands: [
  46. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\NanoCore_8109c409b23a93a40f1363aaba8642cf.exe\""
  47. ]
  48.  
  49. [*] Mutexes: []
  50.  
  51. [*] Modified Files: []
  52.  
  53. [*] Deleted Files: []
  54.  
  55. [*] Modified Registry Keys: []
  56.  
  57. [*] Deleted Registry Keys: []
  58.  
  59. [*] DNS Communications: []
  60.  
  61. [*] Domains: []
  62.  
  63. [*] Network Communication - ICMP: []
  64.  
  65. [*] Network Communication - HTTP: []
  66.  
  67. [*] Network Communication - SMTP: []
  68.  
  69. [*] Network Communication - Hosts: []
  70.  
  71. [*] Network Communication - IRC: []
  72.  
  73. [*] Static Analysis: {
  74. "pe": {
  75. "peid_signatures": null,
  76. "imports": [
  77. {
  78. "imports": [
  79. {
  80. "name": null,
  81. "address": "0x401000"
  82. },
  83. {
  84. "name": null,
  85. "address": "0x401004"
  86. },
  87. {
  88. "name": null,
  89. "address": "0x401008"
  90. },
  91. {
  92. "name": null,
  93. "address": "0x40100c"
  94. },
  95. {
  96. "name": null,
  97. "address": "0x401010"
  98. },
  99. {
  100. "name": "MethCallEngine",
  101. "address": "0x401014"
  102. },
  103. {
  104. "name": null,
  105. "address": "0x401018"
  106. },
  107. {
  108. "name": null,
  109. "address": "0x40101c"
  110. },
  111. {
  112. "name": null,
  113. "address": "0x401020"
  114. },
  115. {
  116. "name": null,
  117. "address": "0x401024"
  118. },
  119. {
  120. "name": null,
  121. "address": "0x401028"
  122. },
  123. {
  124. "name": null,
  125. "address": "0x40102c"
  126. },
  127. {
  128. "name": null,
  129. "address": "0x401030"
  130. },
  131. {
  132. "name": null,
  133. "address": "0x401034"
  134. },
  135. {
  136. "name": null,
  137. "address": "0x401038"
  138. },
  139. {
  140. "name": null,
  141. "address": "0x40103c"
  142. },
  143. {
  144. "name": null,
  145. "address": "0x401040"
  146. },
  147. {
  148. "name": null,
  149. "address": "0x401044"
  150. },
  151. {
  152. "name": null,
  153. "address": "0x401048"
  154. },
  155. {
  156. "name": null,
  157. "address": "0x40104c"
  158. },
  159. {
  160. "name": null,
  161. "address": "0x401050"
  162. },
  163. {
  164. "name": "EVENT_SINK_AddRef",
  165. "address": "0x401054"
  166. },
  167. {
  168. "name": null,
  169. "address": "0x401058"
  170. },
  171. {
  172. "name": null,
  173. "address": "0x40105c"
  174. },
  175. {
  176. "name": null,
  177. "address": "0x401060"
  178. },
  179. {
  180. "name": "EVENT_SINK_Release",
  181. "address": "0x401064"
  182. },
  183. {
  184. "name": null,
  185. "address": "0x401068"
  186. },
  187. {
  188. "name": "EVENT_SINK_QueryInterface",
  189. "address": "0x40106c"
  190. },
  191. {
  192. "name": "__vbaExceptHandler",
  193. "address": "0x401070"
  194. },
  195. {
  196. "name": null,
  197. "address": "0x401074"
  198. },
  199. {
  200. "name": null,
  201. "address": "0x401078"
  202. },
  203. {
  204. "name": null,
  205. "address": "0x40107c"
  206. },
  207. {
  208. "name": null,
  209. "address": "0x401080"
  210. },
  211. {
  212. "name": null,
  213. "address": "0x401084"
  214. },
  215. {
  216. "name": null,
  217. "address": "0x401088"
  218. },
  219. {
  220. "name": null,
  221. "address": "0x40108c"
  222. },
  223. {
  224. "name": null,
  225. "address": "0x401090"
  226. },
  227. {
  228. "name": null,
  229. "address": "0x401094"
  230. },
  231. {
  232. "name": null,
  233. "address": "0x401098"
  234. },
  235. {
  236. "name": null,
  237. "address": "0x40109c"
  238. },
  239. {
  240. "name": null,
  241. "address": "0x4010a0"
  242. },
  243. {
  244. "name": null,
  245. "address": "0x4010a4"
  246. },
  247. {
  248. "name": null,
  249. "address": "0x4010a8"
  250. },
  251. {
  252. "name": null,
  253. "address": "0x4010ac"
  254. },
  255. {
  256. "name": null,
  257. "address": "0x4010b0"
  258. },
  259. {
  260. "name": null,
  261. "address": "0x4010b4"
  262. }
  263. ],
  264. "dll": "MSVBVM60.DLL"
  265. }
  266. ],
  267. "digital_signers": null,
  268. "exported_dll_name": null,
  269. "actual_checksum": "0x0008b8e3",
  270. "overlay": null,
  271. "imagebase": "0x00400000",
  272. "reported_checksum": "0x0008b8e3",
  273. "icon_hash": null,
  274. "entrypoint": "0x004011d4",
  275. "timestamp": "2019-06-27 17:32:05",
  276. "osversion": "4.0",
  277. "sections": [
  278. {
  279. "name": ".text",
  280. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  281. "virtual_address": "0x00001000",
  282. "size_of_data": "0x0007c000",
  283. "entropy": "7.07",
  284. "raw_address": "0x00001000",
  285. "virtual_size": "0x0007b6f4",
  286. "characteristics_raw": "0x60000020"
  287. },
  288. {
  289. "name": ".data",
  290. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  291. "virtual_address": "0x0007d000",
  292. "size_of_data": "0x00000000",
  293. "entropy": "0.00",
  294. "raw_address": "0x00000000",
  295. "virtual_size": "0x000071f4",
  296. "characteristics_raw": "0xc0000040"
  297. },
  298. {
  299. "name": ".rsrc",
  300. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  301. "virtual_address": "0x00085000",
  302. "size_of_data": "0x00003000",
  303. "entropy": "4.14",
  304. "raw_address": "0x0007d000",
  305. "virtual_size": "0x00002a2a",
  306. "characteristics_raw": "0x40000040"
  307. }
  308. ],
  309. "resources": [],
  310. "dirents": [
  311. {
  312. "virtual_address": "0x00000000",
  313. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  314. "size": "0x00000000"
  315. },
  316. {
  317. "virtual_address": "0x0007c594",
  318. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  319. "size": "0x00000028"
  320. },
  321. {
  322. "virtual_address": "0x00085000",
  323. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  324. "size": "0x00002a2a"
  325. },
  326. {
  327. "virtual_address": "0x00000000",
  328. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  329. "size": "0x00000000"
  330. },
  331. {
  332. "virtual_address": "0x00000000",
  333. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  334. "size": "0x00000000"
  335. },
  336. {
  337. "virtual_address": "0x00000000",
  338. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  339. "size": "0x00000000"
  340. },
  341. {
  342. "virtual_address": "0x00000000",
  343. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  344. "size": "0x00000000"
  345. },
  346. {
  347. "virtual_address": "0x00000000",
  348. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  349. "size": "0x00000000"
  350. },
  351. {
  352. "virtual_address": "0x00000000",
  353. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  354. "size": "0x00000000"
  355. },
  356. {
  357. "virtual_address": "0x00000000",
  358. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  359. "size": "0x00000000"
  360. },
  361. {
  362. "virtual_address": "0x00000000",
  363. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  364. "size": "0x00000000"
  365. },
  366. {
  367. "virtual_address": "0x00000220",
  368. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  369. "size": "0x00000020"
  370. },
  371. {
  372. "virtual_address": "0x00001000",
  373. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  374. "size": "0x000000bc"
  375. },
  376. {
  377. "virtual_address": "0x00000000",
  378. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  379. "size": "0x00000000"
  380. },
  381. {
  382. "virtual_address": "0x00000000",
  383. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  384. "size": "0x00000000"
  385. },
  386. {
  387. "virtual_address": "0x00000000",
  388. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  389. "size": "0x00000000"
  390. }
  391. ],
  392. "exports": [],
  393. "guest_signers": {},
  394. "imphash": "21a2465d56c70c062b5eae0fca05fe67",
  395. "icon_fuzzy": null,
  396. "icon": null,
  397. "pdbpath": null,
  398. "imported_dll_count": 1,
  399. "versioninfo": []
  400. }
  401. }
  402.  
  403. [*] Resolved APIs: [
  404. "cryptbase.dll.SystemFunction036",
  405. "uxtheme.dll.ThemeInitApiHook",
  406. "user32.dll.IsProcessDPIAware",
  407. "oleaut32.dll.OleLoadPictureEx",
  408. "oleaut32.dll.DispCallFunc",
  409. "oleaut32.dll.LoadTypeLibEx",
  410. "oleaut32.dll.UnRegisterTypeLib",
  411. "oleaut32.dll.CreateTypeLib2",
  412. "oleaut32.dll.VarDateFromUdate",
  413. "oleaut32.dll.VarUdateFromDate",
  414. "oleaut32.dll.GetAltMonthNames",
  415. "oleaut32.dll.VarNumFromParseNum",
  416. "oleaut32.dll.VarParseNumFromStr",
  417. "oleaut32.dll.VarDecFromR4",
  418. "oleaut32.dll.VarDecFromR8",
  419. "oleaut32.dll.VarDecFromDate",
  420. "oleaut32.dll.VarDecFromI4",
  421. "oleaut32.dll.VarDecFromCy",
  422. "oleaut32.dll.VarR4FromDec",
  423. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  424. "oleaut32.dll.GetRecordInfoFromGuids",
  425. "oleaut32.dll.SafeArrayGetRecordInfo",
  426. "oleaut32.dll.SafeArraySetRecordInfo",
  427. "oleaut32.dll.SafeArrayGetIID",
  428. "oleaut32.dll.SafeArraySetIID",
  429. "oleaut32.dll.SafeArrayCopyData",
  430. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  431. "oleaut32.dll.SafeArrayCreateEx",
  432. "oleaut32.dll.VarFormat",
  433. "oleaut32.dll.VarFormatDateTime",
  434. "oleaut32.dll.VarFormatNumber",
  435. "oleaut32.dll.VarFormatPercent",
  436. "oleaut32.dll.VarFormatCurrency",
  437. "oleaut32.dll.VarWeekdayName",
  438. "oleaut32.dll.VarMonthName",
  439. "oleaut32.dll.VarAdd",
  440. "oleaut32.dll.VarAnd",
  441. "oleaut32.dll.VarCat",
  442. "oleaut32.dll.VarDiv",
  443. "oleaut32.dll.VarEqv",
  444. "oleaut32.dll.VarIdiv",
  445. "oleaut32.dll.VarImp",
  446. "oleaut32.dll.VarMod",
  447. "oleaut32.dll.VarMul",
  448. "oleaut32.dll.VarOr",
  449. "oleaut32.dll.VarPow",
  450. "oleaut32.dll.VarSub",
  451. "oleaut32.dll.VarXor",
  452. "oleaut32.dll.VarAbs",
  453. "oleaut32.dll.VarFix",
  454. "oleaut32.dll.VarInt",
  455. "oleaut32.dll.VarNeg",
  456. "oleaut32.dll.VarNot",
  457. "oleaut32.dll.VarRound",
  458. "oleaut32.dll.VarCmp",
  459. "oleaut32.dll.VarDecAdd",
  460. "oleaut32.dll.VarDecCmp",
  461. "oleaut32.dll.VarBstrCat",
  462. "oleaut32.dll.VarCyMulI4",
  463. "oleaut32.dll.VarBstrCmp",
  464. "ole32.dll.CoCreateInstanceEx",
  465. "ole32.dll.CLSIDFromProgIDEx",
  466. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  467. "user32.dll.GetSystemMetrics",
  468. "user32.dll.MonitorFromWindow",
  469. "user32.dll.MonitorFromRect",
  470. "user32.dll.MonitorFromPoint",
  471. "user32.dll.EnumDisplayMonitors",
  472. "user32.dll.GetMonitorInfoA",
  473. "dwmapi.dll.DwmIsCompositionEnabled",
  474. "gdi32.dll.GetLayout",
  475. "gdi32.dll.GdiRealizationInfo",
  476. "gdi32.dll.FontIsLinked",
  477. "advapi32.dll.RegOpenKeyExW",
  478. "advapi32.dll.RegQueryInfoKeyW",
  479. "gdi32.dll.GetTextFaceAliasW",
  480. "advapi32.dll.RegEnumValueW",
  481. "advapi32.dll.RegCloseKey",
  482. "advapi32.dll.RegQueryValueExW",
  483. "gdi32.dll.GetFontAssocStatus",
  484. "advapi32.dll.RegQueryValueExA",
  485. "advapi32.dll.RegEnumKeyExW",
  486. "gdi32.dll.GdiIsMetaPrintDC",
  487. "kernel32.dll.NlsGetCacheUpdateCount",
  488. "kernel32.dll.GetCalendarInfoW",
  489. "sechost.dll.LookupAccountNameLocalW",
  490. "advapi32.dll.LookupAccountSidW",
  491. "sechost.dll.LookupAccountSidLocalW",
  492. "cryptsp.dll.CryptAcquireContextW",
  493. "cryptsp.dll.CryptGenRandom",
  494. "ole32.dll.NdrOleInitializeExtension",
  495. "ole32.dll.CoGetClassObject",
  496. "ole32.dll.CoGetMarshalSizeMax",
  497. "ole32.dll.CoMarshalInterface",
  498. "ole32.dll.CoUnmarshalInterface",
  499. "ole32.dll.StringFromIID",
  500. "ole32.dll.CoGetPSClsid",
  501. "ole32.dll.CoTaskMemAlloc",
  502. "ole32.dll.CoTaskMemFree",
  503. "ole32.dll.CoCreateInstance",
  504. "ole32.dll.CoReleaseMarshalData",
  505. "ole32.dll.DcomChannelSetHResult",
  506. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  507. "gdi32.dll.GetTextExtentExPointWPri",
  508. "kernel32.dll.GetTickCount",
  509. "kernel32.dll.Sleep",
  510. "user32.dll.GetCursorPos",
  511. "user32.dll.EnumWindows",
  512. "kernel32.dll.SetErrorMode",
  513. "kernel32.dll.SetLastError",
  514. "kernel32.dll.VirtualAllocEx",
  515. "kernel32.dll.CloseHandle",
  516. "shell32.dll.ShellExecuteW",
  517. "kernel32.dll.WriteFile",
  518. "kernel32.dll.UnmapViewOfFile",
  519. "kernel32.dll.CreateFileW",
  520. "kernel32.dll.TerminateProcess",
  521. "kernel32.dll.VirtualProtectEx",
  522. "kernel32.dll.CreateProcessInternalW",
  523. "kernel32.dll.GetTempPathW",
  524. "kernel32.dll.GetLongPathNameW",
  525. "kernel32.dll.GetFileSize",
  526. "kernel32.dll.ReadFile",
  527. "ntdll.dll.NtProtectVirtualMemory",
  528. "kernel32.dll.GetCommandLineW"
  529. ]
  530.  
  531. [*] Static Analysis: {
  532. "pe": {
  533. "peid_signatures": null,
  534. "imports": [
  535. {
  536. "imports": [
  537. {
  538. "name": null,
  539. "address": "0x401000"
  540. },
  541. {
  542. "name": null,
  543. "address": "0x401004"
  544. },
  545. {
  546. "name": null,
  547. "address": "0x401008"
  548. },
  549. {
  550. "name": null,
  551. "address": "0x40100c"
  552. },
  553. {
  554. "name": null,
  555. "address": "0x401010"
  556. },
  557. {
  558. "name": "MethCallEngine",
  559. "address": "0x401014"
  560. },
  561. {
  562. "name": null,
  563. "address": "0x401018"
  564. },
  565. {
  566. "name": null,
  567. "address": "0x40101c"
  568. },
  569. {
  570. "name": null,
  571. "address": "0x401020"
  572. },
  573. {
  574. "name": null,
  575. "address": "0x401024"
  576. },
  577. {
  578. "name": null,
  579. "address": "0x401028"
  580. },
  581. {
  582. "name": null,
  583. "address": "0x40102c"
  584. },
  585. {
  586. "name": null,
  587. "address": "0x401030"
  588. },
  589. {
  590. "name": null,
  591. "address": "0x401034"
  592. },
  593. {
  594. "name": null,
  595. "address": "0x401038"
  596. },
  597. {
  598. "name": null,
  599. "address": "0x40103c"
  600. },
  601. {
  602. "name": null,
  603. "address": "0x401040"
  604. },
  605. {
  606. "name": null,
  607. "address": "0x401044"
  608. },
  609. {
  610. "name": null,
  611. "address": "0x401048"
  612. },
  613. {
  614. "name": null,
  615. "address": "0x40104c"
  616. },
  617. {
  618. "name": null,
  619. "address": "0x401050"
  620. },
  621. {
  622. "name": "EVENT_SINK_AddRef",
  623. "address": "0x401054"
  624. },
  625. {
  626. "name": null,
  627. "address": "0x401058"
  628. },
  629. {
  630. "name": null,
  631. "address": "0x40105c"
  632. },
  633. {
  634. "name": null,
  635. "address": "0x401060"
  636. },
  637. {
  638. "name": "EVENT_SINK_Release",
  639. "address": "0x401064"
  640. },
  641. {
  642. "name": null,
  643. "address": "0x401068"
  644. },
  645. {
  646. "name": "EVENT_SINK_QueryInterface",
  647. "address": "0x40106c"
  648. },
  649. {
  650. "name": "__vbaExceptHandler",
  651. "address": "0x401070"
  652. },
  653. {
  654. "name": null,
  655. "address": "0x401074"
  656. },
  657. {
  658. "name": null,
  659. "address": "0x401078"
  660. },
  661. {
  662. "name": null,
  663. "address": "0x40107c"
  664. },
  665. {
  666. "name": null,
  667. "address": "0x401080"
  668. },
  669. {
  670. "name": null,
  671. "address": "0x401084"
  672. },
  673. {
  674. "name": null,
  675. "address": "0x401088"
  676. },
  677. {
  678. "name": null,
  679. "address": "0x40108c"
  680. },
  681. {
  682. "name": null,
  683. "address": "0x401090"
  684. },
  685. {
  686. "name": null,
  687. "address": "0x401094"
  688. },
  689. {
  690. "name": null,
  691. "address": "0x401098"
  692. },
  693. {
  694. "name": null,
  695. "address": "0x40109c"
  696. },
  697. {
  698. "name": null,
  699. "address": "0x4010a0"
  700. },
  701. {
  702. "name": null,
  703. "address": "0x4010a4"
  704. },
  705. {
  706. "name": null,
  707. "address": "0x4010a8"
  708. },
  709. {
  710. "name": null,
  711. "address": "0x4010ac"
  712. },
  713. {
  714. "name": null,
  715. "address": "0x4010b0"
  716. },
  717. {
  718. "name": null,
  719. "address": "0x4010b4"
  720. }
  721. ],
  722. "dll": "MSVBVM60.DLL"
  723. }
  724. ],
  725. "digital_signers": null,
  726. "exported_dll_name": null,
  727. "actual_checksum": "0x0008b8e3",
  728. "overlay": null,
  729. "imagebase": "0x00400000",
  730. "reported_checksum": "0x0008b8e3",
  731. "icon_hash": null,
  732. "entrypoint": "0x004011d4",
  733. "timestamp": "2019-06-27 17:32:05",
  734. "osversion": "4.0",
  735. "sections": [
  736. {
  737. "name": ".text",
  738. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  739. "virtual_address": "0x00001000",
  740. "size_of_data": "0x0007c000",
  741. "entropy": "7.07",
  742. "raw_address": "0x00001000",
  743. "virtual_size": "0x0007b6f4",
  744. "characteristics_raw": "0x60000020"
  745. },
  746. {
  747. "name": ".data",
  748. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  749. "virtual_address": "0x0007d000",
  750. "size_of_data": "0x00000000",
  751. "entropy": "0.00",
  752. "raw_address": "0x00000000",
  753. "virtual_size": "0x000071f4",
  754. "characteristics_raw": "0xc0000040"
  755. },
  756. {
  757. "name": ".rsrc",
  758. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  759. "virtual_address": "0x00085000",
  760. "size_of_data": "0x00003000",
  761. "entropy": "4.14",
  762. "raw_address": "0x0007d000",
  763. "virtual_size": "0x00002a2a",
  764. "characteristics_raw": "0x40000040"
  765. }
  766. ],
  767. "resources": [],
  768. "dirents": [
  769. {
  770. "virtual_address": "0x00000000",
  771. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  772. "size": "0x00000000"
  773. },
  774. {
  775. "virtual_address": "0x0007c594",
  776. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  777. "size": "0x00000028"
  778. },
  779. {
  780. "virtual_address": "0x00085000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  782. "size": "0x00002a2a"
  783. },
  784. {
  785. "virtual_address": "0x00000000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  787. "size": "0x00000000"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  797. "size": "0x00000000"
  798. },
  799. {
  800. "virtual_address": "0x00000000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  802. "size": "0x00000000"
  803. },
  804. {
  805. "virtual_address": "0x00000000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  807. "size": "0x00000000"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  812. "size": "0x00000000"
  813. },
  814. {
  815. "virtual_address": "0x00000000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  817. "size": "0x00000000"
  818. },
  819. {
  820. "virtual_address": "0x00000000",
  821. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  822. "size": "0x00000000"
  823. },
  824. {
  825. "virtual_address": "0x00000220",
  826. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  827. "size": "0x00000020"
  828. },
  829. {
  830. "virtual_address": "0x00001000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  832. "size": "0x000000bc"
  833. },
  834. {
  835. "virtual_address": "0x00000000",
  836. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  837. "size": "0x00000000"
  838. },
  839. {
  840. "virtual_address": "0x00000000",
  841. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  842. "size": "0x00000000"
  843. },
  844. {
  845. "virtual_address": "0x00000000",
  846. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  847. "size": "0x00000000"
  848. }
  849. ],
  850. "exports": [],
  851. "guest_signers": {},
  852. "imphash": "21a2465d56c70c062b5eae0fca05fe67",
  853. "icon_fuzzy": null,
  854. "icon": null,
  855. "pdbpath": null,
  856. "imported_dll_count": 1,
  857. "versioninfo": []
  858. }
  859. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!