API tools faq
paste
paladin316

wshbth_exe_2019-06-27_06_30.json

paladin316
Jun 27th, 2019
2,184
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 31.39 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 4.1
  5.  
  6. [*] File Name: "wshbth.exe"
  7. [*] File Size: 8203112
  8. [*] File Type: "PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows"
  9. [*] SHA256: "40ee48201151c83c7bfbd2fffff6b2d8962d5e71f8ec28593e61876174970071"
  10. [*] MD5: "33c2bbae319caee9ffffd725fc6243e4"
  11. [*] SHA1: "6e32df2fc15cfeaa5b89422d6f34eb0e2ca9b632"
  12. [*] SHA512: "34310d8bd4d17aec8c4f2188f1c39f2e118e2135bb05ba129513539ada1d005457c3add90e6df62fed4ab0e9078a03e2d90c574030832d7cb21fe526c0abf211"
  13. [*] CRC32: "36034C06"
  14. [*] SSDEEP: "98304:EfEoDUN0vJgHmUXeqsFUsW+xu3mMBHs2vbwTCqDnC8XEm+pRdy+dkccznZ81Kf12:EfNDUVVuUYgHs2TwDDnRUmcRd0Nbf11M"
  15.  
  16. [*] Process Execution: [
  17. "wshbth.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "wshbth.exe, PID 1792"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "The binary likely contains encrypted or compressed data.",
  31. "Details": [
  32. {
  33. "section": "name: .vmp1, entropy: 7.94, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x007c7800, virtual_size: 0x007c77e4"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "The executable is likely packed with VMProtect",
  39. "Details": [
  40. {
  41. "section": {
  42. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  43. "characteristics_raw": "0x68000060",
  44. "entropy": "0.00",
  45. "name": ".vmp0",
  46. "raw_address": "0x00000000",
  47. "size_of_data": "0x00000000",
  48. "virtual_address": "0x00507000",
  49. "virtual_size": "0x0048ed6d"
  50. }
  51. }
  52. ]
  53. },
  54. {
  55. "Description": "Anomalous binary characteristics",
  56. "Details": [
  57. {
  58. "anomaly": "Actual checksum does not match that reported in PE header"
  59. }
  60. ]
  61. }
  62. ]
  63.  
  64. [*] Started Service: []
  65.  
  66. [*] Executed Commands: []
  67.  
  68. [*] Mutexes: []
  69.  
  70. [*] Modified Files: []
  71.  
  72. [*] Deleted Files: []
  73.  
  74. [*] Modified Registry Keys: []
  75.  
  76. [*] Deleted Registry Keys: []
  77.  
  78. [*] DNS Communications: []
  79.  
  80. [*] Domains: []
  81.  
  82. [*] Network Communication - ICMP: []
  83.  
  84. [*] Network Communication - HTTP: []
  85.  
  86. [*] Network Communication - SMTP: []
  87.  
  88. [*] Network Communication - Hosts: []
  89.  
  90. [*] Network Communication - IRC: []
  91.  
  92. [*] Static Analysis: {
  93. "pe": {
  94. "peid_signatures": null,
  95. "imports": [
  96. {
  97. "imports": [
  98. {
  99. "name": "AdjustTokenPrivileges",
  100. "address": "0x1326000"
  101. }
  102. ],
  103. "dll": "ADVAPI32.dll"
  104. },
  105. {
  106. "imports": [
  107. {
  108. "name": "CertCloseStore",
  109. "address": "0x1326010"
  110. }
  111. ],
  112. "dll": "CRYPT32.dll"
  113. },
  114. {
  115. "imports": [
  116. {
  117. "name": "ConvertInterfaceIndexToLuid",
  118. "address": "0x1326020"
  119. }
  120. ],
  121. "dll": "IPHLPAPI.DLL"
  122. },
  123. {
  124. "imports": [
  125. {
  126. "name": "GetVersion",
  127. "address": "0x1326030"
  128. },
  129. {
  130. "name": "GetVersionExW",
  131. "address": "0x1326038"
  132. }
  133. ],
  134. "dll": "KERNEL32.dll"
  135. },
  136. {
  137. "imports": [
  138. {
  139. "name": "___lc_codepage_func",
  140. "address": "0x1326048"
  141. }
  142. ],
  143. "dll": "msvcrt.dll"
  144. },
  145. {
  146. "imports": [
  147. {
  148. "name": "GetProcessMemoryInfo",
  149. "address": "0x1326058"
  150. }
  151. ],
  152. "dll": "PSAPI.DLL"
  153. },
  154. {
  155. "imports": [
  156. {
  157. "name": "DispatchMessageA",
  158. "address": "0x1326068"
  159. }
  160. ],
  161. "dll": "USER32.dll"
  162. },
  163. {
  164. "imports": [
  165. {
  166. "name": "GetUserProfileDirectoryW",
  167. "address": "0x1326078"
  168. }
  169. ],
  170. "dll": "USERENV.dll"
  171. },
  172. {
  173. "imports": [
  174. {
  175. "name": "FreeAddrInfoW",
  176. "address": "0x1326088"
  177. }
  178. ],
  179. "dll": "WS2_32.dll"
  180. },
  181. {
  182. "imports": [
  183. {
  184. "name": "WTSSendMessageW",
  185. "address": "0x1326098"
  186. }
  187. ],
  188. "dll": "WTSAPI32.dll"
  189. },
  190. {
  191. "imports": [
  192. {
  193. "name": "FlsSetValue",
  194. "address": "0x13260a8"
  195. }
  196. ],
  197. "dll": "KERNEL32.dll"
  198. },
  199. {
  200. "imports": [
  201. {
  202. "name": "GetProcessWindowStation",
  203. "address": "0x13260b8"
  204. }
  205. ],
  206. "dll": "USER32.dll"
  207. },
  208. {
  209. "imports": [
  210. {
  211. "name": "LocalAlloc",
  212. "address": "0x13260c8"
  213. },
  214. {
  215. "name": "LocalFree",
  216. "address": "0x13260d0"
  217. },
  218. {
  219. "name": "GetModuleFileNameW",
  220. "address": "0x13260d8"
  221. },
  222. {
  223. "name": "GetProcessAffinityMask",
  224. "address": "0x13260e0"
  225. },
  226. {
  227. "name": "SetProcessAffinityMask",
  228. "address": "0x13260e8"
  229. },
  230. {
  231. "name": "SetThreadAffinityMask",
  232. "address": "0x13260f0"
  233. },
  234. {
  235. "name": "Sleep",
  236. "address": "0x13260f8"
  237. },
  238. {
  239. "name": "ExitProcess",
  240. "address": "0x1326100"
  241. },
  242. {
  243. "name": "FreeLibrary",
  244. "address": "0x1326108"
  245. },
  246. {
  247. "name": "LoadLibraryA",
  248. "address": "0x1326110"
  249. },
  250. {
  251. "name": "GetModuleHandleA",
  252. "address": "0x1326118"
  253. },
  254. {
  255. "name": "GetProcAddress",
  256. "address": "0x1326120"
  257. }
  258. ],
  259. "dll": "KERNEL32.dll"
  260. },
  261. {
  262. "imports": [
  263. {
  264. "name": "GetProcessWindowStation",
  265. "address": "0x1326130"
  266. },
  267. {
  268. "name": "GetUserObjectInformationW",
  269. "address": "0x1326138"
  270. }
  271. ],
  272. "dll": "USER32.dll"
  273. }
  274. ],
  275. "digital_signers": null,
  276. "exported_dll_name": null,
  277. "actual_checksum": "0x007d5ab6",
  278. "overlay": {
  279. "size": "0x00001b68",
  280. "offset": "0x007d1000"
  281. },
  282. "imagebase": "0x00400000",
  283. "reported_checksum": "0x007e07f3",
  284. "icon_hash": null,
  285. "entrypoint": "0x0137b62e",
  286. "timestamp": "2019-06-02 07:32:53",
  287. "osversion": "5.2",
  288. "sections": [
  289. {
  290. "name": ".text",
  291. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4096BYTES",
  292. "virtual_address": "0x00001000",
  293. "size_of_data": "0x00000000",
  294. "entropy": "0.00",
  295. "raw_address": "0x00000000",
  296. "virtual_size": "0x003f7148",
  297. "characteristics_raw": "0x60d00060"
  298. },
  299. {
  300. "name": ".data",
  301. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  302. "virtual_address": "0x003f9000",
  303. "size_of_data": "0x00000000",
  304. "entropy": "0.00",
  305. "raw_address": "0x00000000",
  306. "virtual_size": "0x00007d60",
  307. "characteristics_raw": "0xc0600040"
  308. },
  309. {
  310. "name": ".rdata",
  311. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_64BYTES",
  312. "virtual_address": "0x00401000",
  313. "size_of_data": "0x00000000",
  314. "entropy": "0.00",
  315. "raw_address": "0x00000000",
  316. "virtual_size": "0x000a5f10",
  317. "characteristics_raw": "0x40700040"
  318. },
  319. {
  320. "name": ".pdata",
  321. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES",
  322. "virtual_address": "0x004a7000",
  323. "size_of_data": "0x00000000",
  324. "entropy": "0.00",
  325. "raw_address": "0x00000000",
  326. "virtual_size": "0x000246cc",
  327. "characteristics_raw": "0x40300040"
  328. },
  329. {
  330. "name": ".xdata",
  331. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES",
  332. "virtual_address": "0x004cc000",
  333. "size_of_data": "0x00000000",
  334. "entropy": "0.00",
  335. "raw_address": "0x00000000",
  336. "virtual_size": "0x000273e8",
  337. "characteristics_raw": "0x40400040"
  338. },
  339. {
  340. "name": ".bss",
  341. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  342. "virtual_address": "0x004f4000",
  343. "size_of_data": "0x00000000",
  344. "entropy": "0.00",
  345. "raw_address": "0x00000000",
  346. "virtual_size": "0x0000c620",
  347. "characteristics_raw": "0xc0600080"
  348. },
  349. {
  350. "name": ".idata",
  351. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  352. "virtual_address": "0x00501000",
  353. "size_of_data": "0x00000000",
  354. "entropy": "0.00",
  355. "raw_address": "0x00000000",
  356. "virtual_size": "0x00003d9c",
  357. "characteristics_raw": "0xc0300040"
  358. },
  359. {
  360. "name": ".CRT",
  361. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES",
  362. "virtual_address": "0x00505000",
  363. "size_of_data": "0x00000000",
  364. "entropy": "0.00",
  365. "raw_address": "0x00000000",
  366. "virtual_size": "0x00000070",
  367. "characteristics_raw": "0xc0400040"
  368. },
  369. {
  370. "name": ".tls",
  371. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES",
  372. "virtual_address": "0x00506000",
  373. "size_of_data": "0x00000000",
  374. "entropy": "0.00",
  375. "raw_address": "0x00000000",
  376. "virtual_size": "0x00000010",
  377. "characteristics_raw": "0xc0400040"
  378. },
  379. {
  380. "name": ".vmp0",
  381. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  382. "virtual_address": "0x00507000",
  383. "size_of_data": "0x00000000",
  384. "entropy": "0.00",
  385. "raw_address": "0x00000000",
  386. "virtual_size": "0x0048ed6d",
  387. "characteristics_raw": "0x68000060"
  388. },
  389. {
  390. "name": ".vmp1",
  391. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  392. "virtual_address": "0x00996000",
  393. "size_of_data": "0x007c7800",
  394. "entropy": "7.94",
  395. "raw_address": "0x00001000",
  396. "virtual_size": "0x007c77e4",
  397. "characteristics_raw": "0x68000060"
  398. },
  399. {
  400. "name": ".rsrc",
  401. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  402. "virtual_address": "0x0115e000",
  403. "size_of_data": "0x00008800",
  404. "entropy": "6.17",
  405. "raw_address": "0x007c8800",
  406. "virtual_size": "0x000086cf",
  407. "characteristics_raw": "0xc0300040"
  408. }
  409. ],
  410. "resources": [],
  411. "dirents": [
  412. {
  413. "virtual_address": "0x00000000",
  414. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  415. "size": "0x00000000"
  416. },
  417. {
  418. "virtual_address": "0x00b4a710",
  419. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  420. "size": "0x0000012c"
  421. },
  422. {
  423. "virtual_address": "0x0115e000",
  424. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  425. "size": "0x000086cf"
  426. },
  427. {
  428. "virtual_address": "0x01136040",
  429. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  430. "size": "0x000277a4"
  431. },
  432. {
  433. "virtual_address": "0x007d1000",
  434. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  435. "size": "0x00001b68"
  436. },
  437. {
  438. "virtual_address": "0x00000000",
  439. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  440. "size": "0x00000000"
  441. },
  442. {
  443. "virtual_address": "0x00000000",
  444. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  445. "size": "0x00000000"
  446. },
  447. {
  448. "virtual_address": "0x00000000",
  449. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  450. "size": "0x00000000"
  451. },
  452. {
  453. "virtual_address": "0x00000000",
  454. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  455. "size": "0x00000000"
  456. },
  457. {
  458. "virtual_address": "0x00f06730",
  459. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  460. "size": "0x00000058"
  461. },
  462. {
  463. "virtual_address": "0x00000000",
  464. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  465. "size": "0x00000000"
  466. },
  467. {
  468. "virtual_address": "0x00000000",
  469. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  470. "size": "0x00000000"
  471. },
  472. {
  473. "virtual_address": "0x00f26000",
  474. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  475. "size": "0x00000148"
  476. },
  477. {
  478. "virtual_address": "0x00000000",
  479. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  480. "size": "0x00000000"
  481. },
  482. {
  483. "virtual_address": "0x00000000",
  484. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  485. "size": "0x00000000"
  486. },
  487. {
  488. "virtual_address": "0x00000000",
  489. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  490. "size": "0x00000000"
  491. }
  492. ],
  493. "exports": [],
  494. "guest_signers": {},
  495. "imphash": "ea2543a8a747d6925fcdd3c0e26b8f4f",
  496. "icon_fuzzy": null,
  497. "icon": null,
  498. "pdbpath": null,
  499. "imported_dll_count": 14,
  500. "versioninfo": []
  501. }
  502. }
  503.  
  504. [*] Resolved APIs: [
  505. "msvcrt.dll._localtime64_s"
  506. ]
  507.  
  508. [*] Static Analysis: {
  509. "pe": {
  510. "peid_signatures": null,
  511. "imports": [
  512. {
  513. "imports": [
  514. {
  515. "name": "AdjustTokenPrivileges",
  516. "address": "0x1326000"
  517. }
  518. ],
  519. "dll": "ADVAPI32.dll"
  520. },
  521. {
  522. "imports": [
  523. {
  524. "name": "CertCloseStore",
  525. "address": "0x1326010"
  526. }
  527. ],
  528. "dll": "CRYPT32.dll"
  529. },
  530. {
  531. "imports": [
  532. {
  533. "name": "ConvertInterfaceIndexToLuid",
  534. "address": "0x1326020"
  535. }
  536. ],
  537. "dll": "IPHLPAPI.DLL"
  538. },
  539. {
  540. "imports": [
  541. {
  542. "name": "GetVersion",
  543. "address": "0x1326030"
  544. },
  545. {
  546. "name": "GetVersionExW",
  547. "address": "0x1326038"
  548. }
  549. ],
  550. "dll": "KERNEL32.dll"
  551. },
  552. {
  553. "imports": [
  554. {
  555. "name": "___lc_codepage_func",
  556. "address": "0x1326048"
  557. }
  558. ],
  559. "dll": "msvcrt.dll"
  560. },
  561. {
  562. "imports": [
  563. {
  564. "name": "GetProcessMemoryInfo",
  565. "address": "0x1326058"
  566. }
  567. ],
  568. "dll": "PSAPI.DLL"
  569. },
  570. {
  571. "imports": [
  572. {
  573. "name": "DispatchMessageA",
  574. "address": "0x1326068"
  575. }
  576. ],
  577. "dll": "USER32.dll"
  578. },
  579. {
  580. "imports": [
  581. {
  582. "name": "GetUserProfileDirectoryW",
  583. "address": "0x1326078"
  584. }
  585. ],
  586. "dll": "USERENV.dll"
  587. },
  588. {
  589. "imports": [
  590. {
  591. "name": "FreeAddrInfoW",
  592. "address": "0x1326088"
  593. }
  594. ],
  595. "dll": "WS2_32.dll"
  596. },
  597. {
  598. "imports": [
  599. {
  600. "name": "WTSSendMessageW",
  601. "address": "0x1326098"
  602. }
  603. ],
  604. "dll": "WTSAPI32.dll"
  605. },
  606. {
  607. "imports": [
  608. {
  609. "name": "FlsSetValue",
  610. "address": "0x13260a8"
  611. }
  612. ],
  613. "dll": "KERNEL32.dll"
  614. },
  615. {
  616. "imports": [
  617. {
  618. "name": "GetProcessWindowStation",
  619. "address": "0x13260b8"
  620. }
  621. ],
  622. "dll": "USER32.dll"
  623. },
  624. {
  625. "imports": [
  626. {
  627. "name": "LocalAlloc",
  628. "address": "0x13260c8"
  629. },
  630. {
  631. "name": "LocalFree",
  632. "address": "0x13260d0"
  633. },
  634. {
  635. "name": "GetModuleFileNameW",
  636. "address": "0x13260d8"
  637. },
  638. {
  639. "name": "GetProcessAffinityMask",
  640. "address": "0x13260e0"
  641. },
  642. {
  643. "name": "SetProcessAffinityMask",
  644. "address": "0x13260e8"
  645. },
  646. {
  647. "name": "SetThreadAffinityMask",
  648. "address": "0x13260f0"
  649. },
  650. {
  651. "name": "Sleep",
  652. "address": "0x13260f8"
  653. },
  654. {
  655. "name": "ExitProcess",
  656. "address": "0x1326100"
  657. },
  658. {
  659. "name": "FreeLibrary",
  660. "address": "0x1326108"
  661. },
  662. {
  663. "name": "LoadLibraryA",
  664. "address": "0x1326110"
  665. },
  666. {
  667. "name": "GetModuleHandleA",
  668. "address": "0x1326118"
  669. },
  670. {
  671. "name": "GetProcAddress",
  672. "address": "0x1326120"
  673. }
  674. ],
  675. "dll": "KERNEL32.dll"
  676. },
  677. {
  678. "imports": [
  679. {
  680. "name": "GetProcessWindowStation",
  681. "address": "0x1326130"
  682. },
  683. {
  684. "name": "GetUserObjectInformationW",
  685. "address": "0x1326138"
  686. }
  687. ],
  688. "dll": "USER32.dll"
  689. }
  690. ],
  691. "digital_signers": null,
  692. "exported_dll_name": null,
  693. "actual_checksum": "0x007d5ab6",
  694. "overlay": {
  695. "size": "0x00001b68",
  696. "offset": "0x007d1000"
  697. },
  698. "imagebase": "0x00400000",
  699. "reported_checksum": "0x007e07f3",
  700. "icon_hash": null,
  701. "entrypoint": "0x0137b62e",
  702. "timestamp": "2019-06-02 07:32:53",
  703. "osversion": "5.2",
  704. "sections": [
  705. {
  706. "name": ".text",
  707. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4096BYTES",
  708. "virtual_address": "0x00001000",
  709. "size_of_data": "0x00000000",
  710. "entropy": "0.00",
  711. "raw_address": "0x00000000",
  712. "virtual_size": "0x003f7148",
  713. "characteristics_raw": "0x60d00060"
  714. },
  715. {
  716. "name": ".data",
  717. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  718. "virtual_address": "0x003f9000",
  719. "size_of_data": "0x00000000",
  720. "entropy": "0.00",
  721. "raw_address": "0x00000000",
  722. "virtual_size": "0x00007d60",
  723. "characteristics_raw": "0xc0600040"
  724. },
  725. {
  726. "name": ".rdata",
  727. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_64BYTES",
  728. "virtual_address": "0x00401000",
  729. "size_of_data": "0x00000000",
  730. "entropy": "0.00",
  731. "raw_address": "0x00000000",
  732. "virtual_size": "0x000a5f10",
  733. "characteristics_raw": "0x40700040"
  734. },
  735. {
  736. "name": ".pdata",
  737. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES",
  738. "virtual_address": "0x004a7000",
  739. "size_of_data": "0x00000000",
  740. "entropy": "0.00",
  741. "raw_address": "0x00000000",
  742. "virtual_size": "0x000246cc",
  743. "characteristics_raw": "0x40300040"
  744. },
  745. {
  746. "name": ".xdata",
  747. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES",
  748. "virtual_address": "0x004cc000",
  749. "size_of_data": "0x00000000",
  750. "entropy": "0.00",
  751. "raw_address": "0x00000000",
  752. "virtual_size": "0x000273e8",
  753. "characteristics_raw": "0x40400040"
  754. },
  755. {
  756. "name": ".bss",
  757. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES",
  758. "virtual_address": "0x004f4000",
  759. "size_of_data": "0x00000000",
  760. "entropy": "0.00",
  761. "raw_address": "0x00000000",
  762. "virtual_size": "0x0000c620",
  763. "characteristics_raw": "0xc0600080"
  764. },
  765. {
  766. "name": ".idata",
  767. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  768. "virtual_address": "0x00501000",
  769. "size_of_data": "0x00000000",
  770. "entropy": "0.00",
  771. "raw_address": "0x00000000",
  772. "virtual_size": "0x00003d9c",
  773. "characteristics_raw": "0xc0300040"
  774. },
  775. {
  776. "name": ".CRT",
  777. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES",
  778. "virtual_address": "0x00505000",
  779. "size_of_data": "0x00000000",
  780. "entropy": "0.00",
  781. "raw_address": "0x00000000",
  782. "virtual_size": "0x00000070",
  783. "characteristics_raw": "0xc0400040"
  784. },
  785. {
  786. "name": ".tls",
  787. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES",
  788. "virtual_address": "0x00506000",
  789. "size_of_data": "0x00000000",
  790. "entropy": "0.00",
  791. "raw_address": "0x00000000",
  792. "virtual_size": "0x00000010",
  793. "characteristics_raw": "0xc0400040"
  794. },
  795. {
  796. "name": ".vmp0",
  797. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  798. "virtual_address": "0x00507000",
  799. "size_of_data": "0x00000000",
  800. "entropy": "0.00",
  801. "raw_address": "0x00000000",
  802. "virtual_size": "0x0048ed6d",
  803. "characteristics_raw": "0x68000060"
  804. },
  805. {
  806. "name": ".vmp1",
  807. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  808. "virtual_address": "0x00996000",
  809. "size_of_data": "0x007c7800",
  810. "entropy": "7.94",
  811. "raw_address": "0x00001000",
  812. "virtual_size": "0x007c77e4",
  813. "characteristics_raw": "0x68000060"
  814. },
  815. {
  816. "name": ".rsrc",
  817. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES",
  818. "virtual_address": "0x0115e000",
  819. "size_of_data": "0x00008800",
  820. "entropy": "6.17",
  821. "raw_address": "0x007c8800",
  822. "virtual_size": "0x000086cf",
  823. "characteristics_raw": "0xc0300040"
  824. }
  825. ],
  826. "resources": [],
  827. "dirents": [
  828. {
  829. "virtual_address": "0x00000000",
  830. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  831. "size": "0x00000000"
  832. },
  833. {
  834. "virtual_address": "0x00b4a710",
  835. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  836. "size": "0x0000012c"
  837. },
  838. {
  839. "virtual_address": "0x0115e000",
  840. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  841. "size": "0x000086cf"
  842. },
  843. {
  844. "virtual_address": "0x01136040",
  845. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  846. "size": "0x000277a4"
  847. },
  848. {
  849. "virtual_address": "0x007d1000",
  850. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  851. "size": "0x00001b68"
  852. },
  853. {
  854. "virtual_address": "0x00000000",
  855. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  856. "size": "0x00000000"
  857. },
  858. {
  859. "virtual_address": "0x00000000",
  860. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  861. "size": "0x00000000"
  862. },
  863. {
  864. "virtual_address": "0x00000000",
  865. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  866. "size": "0x00000000"
  867. },
  868. {
  869. "virtual_address": "0x00000000",
  870. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  871. "size": "0x00000000"
  872. },
  873. {
  874. "virtual_address": "0x00f06730",
  875. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  876. "size": "0x00000058"
  877. },
  878. {
  879. "virtual_address": "0x00000000",
  880. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  881. "size": "0x00000000"
  882. },
  883. {
  884. "virtual_address": "0x00000000",
  885. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  886. "size": "0x00000000"
  887. },
  888. {
  889. "virtual_address": "0x00f26000",
  890. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  891. "size": "0x00000148"
  892. },
  893. {
  894. "virtual_address": "0x00000000",
  895. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  896. "size": "0x00000000"
  897. },
  898. {
  899. "virtual_address": "0x00000000",
  900. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  901. "size": "0x00000000"
  902. },
  903. {
  904. "virtual_address": "0x00000000",
  905. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  906. "size": "0x00000000"
  907. }
  908. ],
  909. "exports": [],
  910. "guest_signers": {},
  911. "imphash": "ea2543a8a747d6925fcdd3c0e26b8f4f",
  912. "icon_fuzzy": null,
  913. "icon": null,
  914. "pdbpath": null,
  915. "imported_dll_count": 14,
  916. "versioninfo": []
  917. }
  918. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!