API tools faq
paste
paladin316

HawkEye_db05ffb253a089762c69d6061cd9fe78_exe_2019-07-02_03_30.json

paladin316
Jul 1st, 2019
2,166
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 50.66 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "HawkEye_db05ffb253a089762c69d6061cd9fe78.exe"
  7. [*] File Size: 524800
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "229330a2a983b95847b81fa32dc05488c3395dfa388fe95eb5232a8ff2c005b1"
  10. [*] MD5: "db05ffb253a089762c69d6061cd9fe78"
  11. [*] SHA1: "e02533d92d4f920cb83d7bbff285a8a5ed291a49"
  12. [*] SHA512: "90b15b70aed1d055eaa6ab9eee4c338ad6db189b80c08720b61a3d520dd1659121891958ad750085388c7fefe0385b14f9599dfc1694c6aa0c5fa1fba72ef8a9"
  13. [*] CRC32: "8527317D"
  14. [*] SSDEEP: "12288:hFdoNbinikKTWh/wkPvjVxgn0ReZ+S/cIeVu8NvulZ1:h6/kKyNwk7gn+fIqu8u"
  15.  
  16. [*] Process Execution: [
  17. "HawkEye_db05ffb253a089762c69d6061cd9fe78.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "A process created a hidden window",
  27. "Details": [
  28. {
  29. "Process": "HawkEye_db05ffb253a089762c69d6061cd9fe78.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_db05ffb253a089762c69d6061cd9fe78.exe"
  30. },
  31. {
  32. "Process": "HawkEye_db05ffb253a089762c69d6061cd9fe78.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_db05ffb253a089762c69d6061cd9fe78.exe"
  33. },
  34. {
  35. "Process": "HawkEye_db05ffb253a089762c69d6061cd9fe78.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_db05ffb253a089762c69d6061cd9fe78.exe"
  36. },
  37. {
  38. "Process": "HawkEye_db05ffb253a089762c69d6061cd9fe78.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_db05ffb253a089762c69d6061cd9fe78.exe"
  39. },
  40. {
  41. "Process": "HawkEye_db05ffb253a089762c69d6061cd9fe78.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_db05ffb253a089762c69d6061cd9fe78.exe"
  42. },
  43. {
  44. "Process": "HawkEye_db05ffb253a089762c69d6061cd9fe78.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_db05ffb253a089762c69d6061cd9fe78.exe"
  45. }
  46. ]
  47. },
  48. {
  49. "Description": "The binary likely contains encrypted or compressed data.",
  50. "Details": [
  51. {
  52. "section": "name: .text, entropy: 7.99, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0007f800, virtual_size: 0x0007f764"
  53. }
  54. ]
  55. },
  56. {
  57. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  58. "Details": [
  59. {
  60. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_db05ffb253a089762c69d6061cd9fe78.exe:Zone.Identifier"
  61. }
  62. ]
  63. },
  64. {
  65. "Description": "Installs itself for autorun at Windows startup",
  66. "Details": [
  67. {
  68. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
  69. },
  70. {
  71. "data": "\"C:\\Users\\user\\AppData\\Roaming\\e6PnQR1W9pvM66zW\\GIew8OT3AdYO.exe\",explorer.exe"
  72. }
  73. ]
  74. },
  75. {
  76. "Description": "Creates a hidden or system file",
  77. "Details": [
  78. {
  79. "file": "C:\\Users\\user\\AppData\\Roaming\\e6PnQR1W9pvM66zW"
  80. },
  81. {
  82. "file": "C:\\Users\\user\\AppData\\Roaming\\e6PnQR1W9pvM66zW\\GIew8OT3AdYO.exe"
  83. }
  84. ]
  85. },
  86. {
  87. "Description": "File has been identified by 36 Antiviruses on VirusTotal as malicious",
  88. "Details": [
  89. {
  90. "MicroWorld-eScan": "Gen:Variant.MSILPerseus.191035"
  91. },
  92. {
  93. "FireEye": "Generic.mg.db05ffb253a08976"
  94. },
  95. {
  96. "ALYac": "Gen:Variant.MSILPerseus.190890"
  97. },
  98. {
  99. "Arcabit": "Trojan.MSILPerseus.D2EA3B"
  100. },
  101. {
  102. "Symantec": "ML.Attribute.HighConfidence"
  103. },
  104. {
  105. "APEX": "Malicious"
  106. },
  107. {
  108. "Paloalto": "generic.ml"
  109. },
  110. {
  111. "Kaspersky": "HEUR:Backdoor.MSIL.Androm.gen"
  112. },
  113. {
  114. "BitDefender": "Gen:Variant.MSILPerseus.191035"
  115. },
  116. {
  117. "Avast": "Win32:CrypterX-gen [Trj]"
  118. },
  119. {
  120. "Ad-Aware": "Gen:Variant.MSILPerseus.191035"
  121. },
  122. {
  123. "Emsisoft": "Gen:Variant.MSILPerseus.191035 (B)"
  124. },
  125. {
  126. "F-Secure": "Heuristic.HEUR/AGEN.1035809"
  127. },
  128. {
  129. "DrWeb": "BackDoor.RevetRat.2"
  130. },
  131. {
  132. "Invincea": "heuristic"
  133. },
  134. {
  135. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.hc"
  136. },
  137. {
  138. "Trapmine": "malicious.high.ml.score"
  139. },
  140. {
  141. "Jiangmin": "Backdoor.MSIL.bgdv"
  142. },
  143. {
  144. "Avira": "HEUR/AGEN.1035809"
  145. },
  146. {
  147. "MAX": "malware (ai score=81)"
  148. },
  149. {
  150. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  151. },
  152. {
  153. "ZoneAlarm": "HEUR:Backdoor.MSIL.Androm.gen"
  154. },
  155. {
  156. "GData": "Gen:Variant.MSILPerseus.191035"
  157. },
  158. {
  159. "AhnLab-V3": "Trojan/Win32.Kryptik.R278666"
  160. },
  161. {
  162. "Acronis": "suspicious"
  163. },
  164. {
  165. "McAfee": "GenericRXHU-XW!DB05FFB253A0"
  166. },
  167. {
  168. "Malwarebytes": "Spyware.HawkEyeKeyLogger"
  169. },
  170. {
  171. "ESET-NOD32": "a variant of MSIL/Kryptik.QME"
  172. },
  173. {
  174. "Rising": "Trojan.Kryptik!8.8 (TFE:dGZlOgzdU/FSdyzRwQ)"
  175. },
  176. {
  177. "SentinelOne": "DFI - Malicious PE"
  178. },
  179. {
  180. "Fortinet": "MSIL/Generic.AP.1BE98B6!tr"
  181. },
  182. {
  183. "AVG": "Win32:CrypterX-gen [Trj]"
  184. },
  185. {
  186. "Cybereason": "malicious.92d4f9"
  187. },
  188. {
  189. "Panda": "Trj/GdSda.A"
  190. },
  191. {
  192. "CrowdStrike": "win/malicious_confidence_100% (D)"
  193. },
  194. {
  195. "Qihoo-360": "HEUR/QVM03.0.3A37.Malware.Gen"
  196. }
  197. ]
  198. },
  199. {
  200. "Description": "Creates a copy of itself",
  201. "Details": [
  202. {
  203. "copy": "C:\\Users\\user\\AppData\\Roaming\\e6PnQR1W9pvM66zW\\GIew8OT3AdYO.exe"
  204. }
  205. ]
  206. }
  207. ]
  208.  
  209. [*] Started Service: []
  210.  
  211. [*] Executed Commands: [
  212. "\"C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_db05ffb253a089762c69d6061cd9fe78.exe\""
  213. ]
  214.  
  215. [*] Mutexes: [
  216. "Global\\CLR_CASOFF_MUTEX"
  217. ]
  218.  
  219. [*] Modified Files: [
  220. "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
  221. "C:\\Users\\user\\AppData\\Roaming\\e6PnQR1W9pvM66zW\\GIew8OT3AdYO.exe"
  222. ]
  223.  
  224. [*] Deleted Files: [
  225. "C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_db05ffb253a089762c69d6061cd9fe78.exe:Zone.Identifier",
  226. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1100.7514453",
  227. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1100.7514453",
  228. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1100.7514453"
  229. ]
  230.  
  231. [*] Modified Registry Keys: [
  232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
  233. ]
  234.  
  235. [*] Deleted Registry Keys: []
  236.  
  237. [*] DNS Communications: []
  238.  
  239. [*] Domains: []
  240.  
  241. [*] Network Communication - ICMP: []
  242.  
  243. [*] Network Communication - HTTP: []
  244.  
  245. [*] Network Communication - SMTP: []
  246.  
  247. [*] Network Communication - Hosts: []
  248.  
  249. [*] Network Communication - IRC: []
  250.  
  251. [*] Static Analysis: {
  252. "dotnet": {
  253. "customattrs": null,
  254. "assemblyinfo": {
  255. "version": "1.0.0.0",
  256. "name": "ChTable"
  257. },
  258. "assemblyrefs": [
  259. {
  260. "version": "2.0.0.0",
  261. "name": "mscorlib"
  262. },
  263. {
  264. "version": "2.0.0.0",
  265. "name": "System.Windows.Forms"
  266. },
  267. {
  268. "version": "2.0.0.0",
  269. "name": "System"
  270. },
  271. {
  272. "version": "2.0.0.0",
  273. "name": "System.Drawing"
  274. }
  275. ],
  276. "typerefs": [
  277. {
  278. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  279. "assembly": "System"
  280. },
  281. {
  282. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  283. "assembly": "System"
  284. },
  285. {
  286. "typename": "System.ComponentModel.EditorBrowsableState",
  287. "assembly": "System"
  288. },
  289. {
  290. "typename": "System.ComponentModel.IContainer",
  291. "assembly": "System"
  292. },
  293. {
  294. "typename": "System.Configuration.ApplicationSettingsBase",
  295. "assembly": "System"
  296. },
  297. {
  298. "typename": "System.Configuration.SettingsBase",
  299. "assembly": "System"
  300. },
  301. {
  302. "typename": "System.Drawing.Point",
  303. "assembly": "System.Drawing"
  304. },
  305. {
  306. "typename": "System.Drawing.Size",
  307. "assembly": "System.Drawing"
  308. },
  309. {
  310. "typename": "System.Drawing.SizeF",
  311. "assembly": "System.Drawing"
  312. },
  313. {
  314. "typename": "System.Windows.Forms.Application",
  315. "assembly": "System.Windows.Forms"
  316. },
  317. {
  318. "typename": "System.Windows.Forms.AutoScaleMode",
  319. "assembly": "System.Windows.Forms"
  320. },
  321. {
  322. "typename": "System.Windows.Forms.Button",
  323. "assembly": "System.Windows.Forms"
  324. },
  325. {
  326. "typename": "System.Windows.Forms.ButtonBase",
  327. "assembly": "System.Windows.Forms"
  328. },
  329. {
  330. "typename": "System.Windows.Forms.CommonDialog",
  331. "assembly": "System.Windows.Forms"
  332. },
  333. {
  334. "typename": "System.Windows.Forms.ContainerControl",
  335. "assembly": "System.Windows.Forms"
  336. },
  337. {
  338. "typename": "System.Windows.Forms.Control",
  339. "assembly": "System.Windows.Forms"
  340. },
  341. {
  342. "typename": "System.Windows.Forms.Control/ControlCollection",
  343. "assembly": "System.Windows.Forms"
  344. },
  345. {
  346. "typename": "System.Windows.Forms.DialogResult",
  347. "assembly": "System.Windows.Forms"
  348. },
  349. {
  350. "typename": "System.Windows.Forms.FileDialog",
  351. "assembly": "System.Windows.Forms"
  352. },
  353. {
  354. "typename": "System.Windows.Forms.Form",
  355. "assembly": "System.Windows.Forms"
  356. },
  357. {
  358. "typename": "System.Windows.Forms.GroupBox",
  359. "assembly": "System.Windows.Forms"
  360. },
  361. {
  362. "typename": "System.Windows.Forms.ListView",
  363. "assembly": "System.Windows.Forms"
  364. },
  365. {
  366. "typename": "System.Windows.Forms.ListView/ListViewItemCollection",
  367. "assembly": "System.Windows.Forms"
  368. },
  369. {
  370. "typename": "System.Windows.Forms.ListViewItem",
  371. "assembly": "System.Windows.Forms"
  372. },
  373. {
  374. "typename": "System.Windows.Forms.OpenFileDialog",
  375. "assembly": "System.Windows.Forms"
  376. },
  377. {
  378. "typename": "System.Windows.Forms.TextBox",
  379. "assembly": "System.Windows.Forms"
  380. },
  381. {
  382. "typename": "System.Windows.Forms.TextBoxBase",
  383. "assembly": "System.Windows.Forms"
  384. },
  385. {
  386. "typename": "System.Action`1",
  387. "assembly": "mscorlib"
  388. },
  389. {
  390. "typename": "System.Activator",
  391. "assembly": "mscorlib"
  392. },
  393. {
  394. "typename": "System.ArgumentNullException",
  395. "assembly": "mscorlib"
  396. },
  397. {
  398. "typename": "System.Array",
  399. "assembly": "mscorlib"
  400. },
  401. {
  402. "typename": "System.Attribute",
  403. "assembly": "mscorlib"
  404. },
  405. {
  406. "typename": "System.BadImageFormatException",
  407. "assembly": "mscorlib"
  408. },
  409. {
  410. "typename": "System.Byte",
  411. "assembly": "mscorlib"
  412. },
  413. {
  414. "typename": "System.Collections.DictionaryEntry",
  415. "assembly": "mscorlib"
  416. },
  417. {
  418. "typename": "System.Collections.Generic.Dictionary`2",
  419. "assembly": "mscorlib"
  420. },
  421. {
  422. "typename": "System.Collections.Generic.IEnumerable`1",
  423. "assembly": "mscorlib"
  424. },
  425. {
  426. "typename": "System.Collections.Generic.IEnumerator`1",
  427. "assembly": "mscorlib"
  428. },
  429. {
  430. "typename": "System.Collections.Generic.List`1",
  431. "assembly": "mscorlib"
  432. },
  433. {
  434. "typename": "System.Collections.Generic.List`1/Enumerator",
  435. "assembly": "mscorlib"
  436. },
  437. {
  438. "typename": "System.Collections.ICollection",
  439. "assembly": "mscorlib"
  440. },
  441. {
  442. "typename": "System.Collections.IDictionaryEnumerator",
  443. "assembly": "mscorlib"
  444. },
  445. {
  446. "typename": "System.Collections.IEnumerable",
  447. "assembly": "mscorlib"
  448. },
  449. {
  450. "typename": "System.Collections.IEnumerator",
  451. "assembly": "mscorlib"
  452. },
  453. {
  454. "typename": "System.Collections.IList",
  455. "assembly": "mscorlib"
  456. },
  457. {
  458. "typename": "System.Delegate",
  459. "assembly": "mscorlib"
  460. },
  461. {
  462. "typename": "System.Diagnostics.DebuggableAttribute",
  463. "assembly": "mscorlib"
  464. },
  465. {
  466. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  467. "assembly": "mscorlib"
  468. },
  469. {
  470. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  471. "assembly": "mscorlib"
  472. },
  473. {
  474. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  475. "assembly": "mscorlib"
  476. },
  477. {
  478. "typename": "System.Environment",
  479. "assembly": "mscorlib"
  480. },
  481. {
  482. "typename": "System.EventArgs",
  483. "assembly": "mscorlib"
  484. },
  485. {
  486. "typename": "System.EventHandler",
  487. "assembly": "mscorlib"
  488. },
  489. {
  490. "typename": "System.Globalization.CultureInfo",
  491. "assembly": "mscorlib"
  492. },
  493. {
  494. "typename": "System.IDisposable",
  495. "assembly": "mscorlib"
  496. },
  497. {
  498. "typename": "System.IO.MemoryStream",
  499. "assembly": "mscorlib"
  500. },
  501. {
  502. "typename": "System.IO.SeekOrigin",
  503. "assembly": "mscorlib"
  504. },
  505. {
  506. "typename": "System.IO.Stream",
  507. "assembly": "mscorlib"
  508. },
  509. {
  510. "typename": "System.IO.StreamReader",
  511. "assembly": "mscorlib"
  512. },
  513. {
  514. "typename": "System.IO.TextReader",
  515. "assembly": "mscorlib"
  516. },
  517. {
  518. "typename": "System.NotSupportedException",
  519. "assembly": "mscorlib"
  520. },
  521. {
  522. "typename": "System.Object",
  523. "assembly": "mscorlib"
  524. },
  525. {
  526. "typename": "System.Predicate`1",
  527. "assembly": "mscorlib"
  528. },
  529. {
  530. "typename": "System.Random",
  531. "assembly": "mscorlib"
  532. },
  533. {
  534. "typename": "System.Reflection.Assembly",
  535. "assembly": "mscorlib"
  536. },
  537. {
  538. "typename": "System.Reflection.AssemblyCompanyAttribute",
  539. "assembly": "mscorlib"
  540. },
  541. {
  542. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  543. "assembly": "mscorlib"
  544. },
  545. {
  546. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  547. "assembly": "mscorlib"
  548. },
  549. {
  550. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  551. "assembly": "mscorlib"
  552. },
  553. {
  554. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  555. "assembly": "mscorlib"
  556. },
  557. {
  558. "typename": "System.Reflection.AssemblyProductAttribute",
  559. "assembly": "mscorlib"
  560. },
  561. {
  562. "typename": "System.Reflection.AssemblyTitleAttribute",
  563. "assembly": "mscorlib"
  564. },
  565. {
  566. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  567. "assembly": "mscorlib"
  568. },
  569. {
  570. "typename": "System.Resources.ResourceManager",
  571. "assembly": "mscorlib"
  572. },
  573. {
  574. "typename": "System.Resources.ResourceSet",
  575. "assembly": "mscorlib"
  576. },
  577. {
  578. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  579. "assembly": "mscorlib"
  580. },
  581. {
  582. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  583. "assembly": "mscorlib"
  584. },
  585. {
  586. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  587. "assembly": "mscorlib"
  588. },
  589. {
  590. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  591. "assembly": "mscorlib"
  592. },
  593. {
  594. "typename": "System.Runtime.InteropServices.GuidAttribute",
  595. "assembly": "mscorlib"
  596. },
  597. {
  598. "typename": "System.RuntimeTypeHandle",
  599. "assembly": "mscorlib"
  600. },
  601. {
  602. "typename": "System.STAThreadAttribute",
  603. "assembly": "mscorlib"
  604. },
  605. {
  606. "typename": "System.Security.UnverifiableCodeAttribute",
  607. "assembly": "mscorlib"
  608. },
  609. {
  610. "typename": "System.Threading.Monitor",
  611. "assembly": "mscorlib"
  612. },
  613. {
  614. "typename": "System.Threading.Thread",
  615. "assembly": "mscorlib"
  616. },
  617. {
  618. "typename": "System.Threading.ThreadStart",
  619. "assembly": "mscorlib"
  620. },
  621. {
  622. "typename": "System.Type",
  623. "assembly": "mscorlib"
  624. }
  625. ]
  626. },
  627. "pe": {
  628. "peid_signatures": null,
  629. "imports": [
  630. {
  631. "imports": [
  632. {
  633. "name": "_CorExeMain",
  634. "address": "0x402000"
  635. }
  636. ],
  637. "dll": "mscoree.dll"
  638. }
  639. ],
  640. "digital_signers": null,
  641. "exported_dll_name": null,
  642. "actual_checksum": "0x00080816",
  643. "overlay": null,
  644. "imagebase": "0x00400000",
  645. "reported_checksum": "0x00080816",
  646. "icon_hash": null,
  647. "entrypoint": "0x0048175e",
  648. "timestamp": "2019-06-23 14:01:26",
  649. "osversion": "4.0",
  650. "sections": [
  651. {
  652. "name": ".text",
  653. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  654. "virtual_address": "0x00002000",
  655. "size_of_data": "0x0007f800",
  656. "entropy": "7.99",
  657. "raw_address": "0x00000200",
  658. "virtual_size": "0x0007f764",
  659. "characteristics_raw": "0x60000020"
  660. },
  661. {
  662. "name": ".rsrc",
  663. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  664. "virtual_address": "0x00082000",
  665. "size_of_data": "0x00000600",
  666. "entropy": "4.06",
  667. "raw_address": "0x0007fa00",
  668. "virtual_size": "0x000005a8",
  669. "characteristics_raw": "0x40000040"
  670. },
  671. {
  672. "name": ".reloc",
  673. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  674. "virtual_address": "0x00084000",
  675. "size_of_data": "0x00000200",
  676. "entropy": "0.10",
  677. "raw_address": "0x00080000",
  678. "virtual_size": "0x0000000c",
  679. "characteristics_raw": "0x42000040"
  680. }
  681. ],
  682. "resources": [],
  683. "dirents": [
  684. {
  685. "virtual_address": "0x00000000",
  686. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  687. "size": "0x00000000"
  688. },
  689. {
  690. "virtual_address": "0x00081708",
  691. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  692. "size": "0x00000053"
  693. },
  694. {
  695. "virtual_address": "0x00082000",
  696. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  697. "size": "0x000005a8"
  698. },
  699. {
  700. "virtual_address": "0x00000000",
  701. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  702. "size": "0x00000000"
  703. },
  704. {
  705. "virtual_address": "0x00000000",
  706. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  707. "size": "0x00000000"
  708. },
  709. {
  710. "virtual_address": "0x00084000",
  711. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  712. "size": "0x0000000c"
  713. },
  714. {
  715. "virtual_address": "0x00000000",
  716. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  717. "size": "0x00000000"
  718. },
  719. {
  720. "virtual_address": "0x00000000",
  721. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  722. "size": "0x00000000"
  723. },
  724. {
  725. "virtual_address": "0x00000000",
  726. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  727. "size": "0x00000000"
  728. },
  729. {
  730. "virtual_address": "0x00000000",
  731. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  732. "size": "0x00000000"
  733. },
  734. {
  735. "virtual_address": "0x00000000",
  736. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  737. "size": "0x00000000"
  738. },
  739. {
  740. "virtual_address": "0x00000000",
  741. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  742. "size": "0x00000000"
  743. },
  744. {
  745. "virtual_address": "0x00002000",
  746. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  747. "size": "0x00000008"
  748. },
  749. {
  750. "virtual_address": "0x00000000",
  751. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  752. "size": "0x00000000"
  753. },
  754. {
  755. "virtual_address": "0x00002008",
  756. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  757. "size": "0x00000048"
  758. },
  759. {
  760. "virtual_address": "0x00000000",
  761. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  762. "size": "0x00000000"
  763. }
  764. ],
  765. "exports": [],
  766. "guest_signers": {},
  767. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  768. "icon_fuzzy": null,
  769. "icon": null,
  770. "pdbpath": null,
  771. "imported_dll_count": 1,
  772. "versioninfo": []
  773. }
  774. }
  775.  
  776. [*] Resolved APIs: [
  777. "advapi32.dll.RegOpenKeyExW",
  778. "advapi32.dll.RegQueryInfoKeyW",
  779. "advapi32.dll.RegEnumKeyExW",
  780. "advapi32.dll.RegEnumValueW",
  781. "advapi32.dll.RegCloseKey",
  782. "advapi32.dll.RegQueryValueExW",
  783. "kernel32.dll.QueryActCtxW",
  784. "shlwapi.dll.UrlIsW",
  785. "kernel32.dll.FlsAlloc",
  786. "kernel32.dll.FlsGetValue",
  787. "kernel32.dll.FlsSetValue",
  788. "kernel32.dll.FlsFree",
  789. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  790. "kernel32.dll.IsProcessorFeaturePresent",
  791. "msvcrt.dll._set_error_mode",
  792. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  793. "kernel32.dll.FindActCtxSectionStringW",
  794. "kernel32.dll.GetSystemWindowsDirectoryW",
  795. "mscoree.dll.GetProcessExecutableHeap",
  796. "mscorwks.dll._CorExeMain",
  797. "mscorwks.dll.GetCLRFunction",
  798. "advapi32.dll.RegisterTraceGuidsW",
  799. "advapi32.dll.UnregisterTraceGuids",
  800. "advapi32.dll.GetTraceLoggerHandle",
  801. "advapi32.dll.GetTraceEnableLevel",
  802. "advapi32.dll.GetTraceEnableFlags",
  803. "advapi32.dll.TraceEvent",
  804. "mscoree.dll.IEE",
  805. "mscorwks.dll.IEE",
  806. "mscoree.dll.GetStartupFlags",
  807. "mscoree.dll.GetHostConfigurationFile",
  808. "mscoree.dll.GetCORSystemDirectory",
  809. "ntdll.dll.RtlUnwind",
  810. "kernel32.dll.IsWow64Process",
  811. "advapi32.dll.AllocateAndInitializeSid",
  812. "advapi32.dll.OpenProcessToken",
  813. "advapi32.dll.GetTokenInformation",
  814. "advapi32.dll.InitializeAcl",
  815. "advapi32.dll.AddAccessAllowedAce",
  816. "advapi32.dll.FreeSid",
  817. "kernel32.dll.SetThreadStackGuarantee",
  818. "kernel32.dll.AddVectoredContinueHandler",
  819. "kernel32.dll.RemoveVectoredContinueHandler",
  820. "advapi32.dll.ConvertSidToStringSidW",
  821. "shell32.dll.SHGetFolderPathW",
  822. "kernel32.dll.FlushProcessWriteBuffers",
  823. "kernel32.dll.GetWriteWatch",
  824. "kernel32.dll.ResetWriteWatch",
  825. "kernel32.dll.CreateMemoryResourceNotification",
  826. "kernel32.dll.QueryMemoryResourceNotification",
  827. "ole32.dll.CoInitializeEx",
  828. "cryptbase.dll.SystemFunction036",
  829. "uxtheme.dll.ThemeInitApiHook",
  830. "user32.dll.IsProcessDPIAware",
  831. "ole32.dll.CoGetContextToken",
  832. "kernel32.dll.GetFullPathNameW",
  833. "kernel32.dll.GetVersionExW",
  834. "advapi32.dll.CryptAcquireContextA",
  835. "advapi32.dll.CryptReleaseContext",
  836. "advapi32.dll.CryptCreateHash",
  837. "advapi32.dll.CryptDestroyHash",
  838. "advapi32.dll.CryptHashData",
  839. "advapi32.dll.CryptGetHashParam",
  840. "advapi32.dll.CryptImportKey",
  841. "advapi32.dll.CryptExportKey",
  842. "advapi32.dll.CryptGenKey",
  843. "advapi32.dll.CryptGetKeyParam",
  844. "advapi32.dll.CryptDestroyKey",
  845. "advapi32.dll.CryptVerifySignatureA",
  846. "advapi32.dll.CryptSignHashA",
  847. "advapi32.dll.CryptGetProvParam",
  848. "advapi32.dll.CryptGetUserKey",
  849. "advapi32.dll.CryptEnumProvidersA",
  850. "mscoree.dll.GetMetaDataInternalInterface",
  851. "mscorwks.dll.GetMetaDataInternalInterface",
  852. "mscorjit.dll.getJit",
  853. "uxtheme.dll.IsAppThemed",
  854. "kernel32.dll.CreateActCtxA",
  855. "ole32.dll.CoTaskMemAlloc",
  856. "ole32.dll.CoTaskMemFree",
  857. "user32.dll.RegisterWindowMessageW",
  858. "user32.dll.GetSystemMetrics",
  859. "user32.dll.AdjustWindowRectEx",
  860. "kernel32.dll.GetCurrentProcess",
  861. "kernel32.dll.GetCurrentThread",
  862. "kernel32.dll.DuplicateHandle",
  863. "kernel32.dll.GetCurrentThreadId",
  864. "kernel32.dll.GetCurrentActCtx",
  865. "kernel32.dll.ActivateActCtx",
  866. "kernel32.dll.lstrlen",
  867. "kernel32.dll.lstrlenW",
  868. "kernel32.dll.GetModuleHandleW",
  869. "kernel32.dll.GetProcAddress",
  870. "user32.dll.DefWindowProcW",
  871. "gdi32.dll.GetStockObject",
  872. "kernel32.dll.GetUserDefaultUILanguage",
  873. "user32.dll.RegisterClassW",
  874. "user32.dll.CreateWindowExW",
  875. "user32.dll.SetWindowLongW",
  876. "user32.dll.GetWindowLongW",
  877. "user32.dll.CallWindowProcW",
  878. "user32.dll.GetClientRect",
  879. "user32.dll.GetWindowRect",
  880. "user32.dll.GetParent",
  881. "kernel32.dll.DeactivateActCtx",
  882. "kernel32.dll.GetSystemDefaultLCID",
  883. "gdi32.dll.GetObjectW",
  884. "user32.dll.GetDC",
  885. "kernel32.dll.GetCurrentProcessId",
  886. "kernel32.dll.FindAtomW",
  887. "kernel32.dll.AddAtomW",
  888. "mscoree.dll.LoadLibraryShim",
  889. "gdiplus.dll.GdiplusStartup",
  890. "user32.dll.GetWindowInfo",
  891. "user32.dll.GetAncestor",
  892. "user32.dll.GetMonitorInfoA",
  893. "user32.dll.EnumDisplayMonitors",
  894. "user32.dll.EnumDisplayDevicesA",
  895. "gdi32.dll.ExtTextOutW",
  896. "gdi32.dll.GdiIsMetaPrintDC",
  897. "gdiplus.dll.GdipCreateFontFromLogfontW",
  898. "kernel32.dll.RegOpenKeyExW",
  899. "kernel32.dll.RegQueryInfoKeyA",
  900. "kernel32.dll.RegCloseKey",
  901. "kernel32.dll.RegCreateKeyExW",
  902. "kernel32.dll.RegQueryValueExW",
  903. "kernel32.dll.RegEnumValueW",
  904. "kernel32.dll.RegQueryInfoKeyW",
  905. "mscoree.dll.ND_RI2",
  906. "mscoree.dll.ND_RU1",
  907. "gdiplus.dll.GdipGetFontUnit",
  908. "gdiplus.dll.GdipGetFontSize",
  909. "gdiplus.dll.GdipGetFontStyle",
  910. "gdiplus.dll.GdipGetFamily",
  911. "user32.dll.ReleaseDC",
  912. "gdiplus.dll.GdipCreateFromHDC",
  913. "gdiplus.dll.GdipGetDpiY",
  914. "gdiplus.dll.GdipGetFontHeight",
  915. "gdiplus.dll.GdipGetEmHeight",
  916. "gdiplus.dll.GdipGetLineSpacing",
  917. "gdiplus.dll.GdipDeleteGraphics",
  918. "gdiplus.dll.GdipCreateFont",
  919. "gdiplus.dll.GdipDeleteFont",
  920. "gdiplus.dll.GdipGetLogFontW",
  921. "mscoree.dll.ND_WU1",
  922. "gdi32.dll.CreateFontIndirectW",
  923. "user32.dll.GetProcessWindowStation",
  924. "user32.dll.GetUserObjectInformationA",
  925. "kernel32.dll.SetConsoleCtrlHandler",
  926. "user32.dll.GetClassInfoW",
  927. "user32.dll.GetSysColor",
  928. "gdi32.dll.CreateCompatibleDC",
  929. "gdi32.dll.SelectObject",
  930. "gdi32.dll.GetTextMetricsW",
  931. "gdi32.dll.GetTextExtentPoint32W",
  932. "gdi32.dll.DeleteDC",
  933. "dwmapi.dll.DwmIsCompositionEnabled",
  934. "user32.dll.SetWindowTextW",
  935. "kernel32.dll.GetStartupInfoW",
  936. "gdi32.dll.GetDeviceCaps",
  937. "user32.dll.CreateIconFromResourceEx",
  938. "user32.dll.SendMessageW",
  939. "gdi32.dll.GetLayout",
  940. "gdi32.dll.GdiRealizationInfo",
  941. "gdi32.dll.FontIsLinked",
  942. "gdi32.dll.GetTextFaceAliasW",
  943. "gdi32.dll.GetFontAssocStatus",
  944. "advapi32.dll.RegQueryValueExA",
  945. "user32.dll.GetSystemMenu",
  946. "user32.dll.GetWindowPlacement",
  947. "user32.dll.EnableMenuItem",
  948. "user32.dll.GetWindowTextLengthW",
  949. "user32.dll.GetWindowTextW",
  950. "user32.dll.SetWindowPos",
  951. "user32.dll.RedrawWindow",
  952. "user32.dll.ShowWindow",
  953. "comctl32.dll.InitCommonControlsEx",
  954. "uxtheme.dll.OpenThemeData",
  955. "uxtheme.dll.GetThemeBool",
  956. "uxtheme.dll.IsThemePartDefined",
  957. "comctl32.dll.RegisterClassNameW",
  958. "uxtheme.dll.GetThemeColor",
  959. "uxtheme.dll.GetThemeMargins",
  960. "uxtheme.dll.GetThemeFont",
  961. "user32.dll.GetWindow",
  962. "user32.dll.MapWindowPoints",
  963. "user32.dll.InvalidateRect",
  964. "uxtheme.dll.EnableThemeDialogTexture",
  965. "imm32.dll.ImmIsIME",
  966. "kernel32.dll.SwitchToThread",
  967. "ole32.dll.CoUninitialize",
  968. "ole32.dll.CoWaitForMultipleHandles",
  969. "sechost.dll.LookupAccountNameLocalW",
  970. "advapi32.dll.LookupAccountSidW",
  971. "sechost.dll.LookupAccountSidLocalW",
  972. "cryptsp.dll.CryptAcquireContextW",
  973. "cryptsp.dll.CryptGenRandom",
  974. "ole32.dll.NdrOleInitializeExtension",
  975. "ole32.dll.CoGetClassObject",
  976. "ole32.dll.CoGetMarshalSizeMax",
  977. "ole32.dll.CoMarshalInterface",
  978. "ole32.dll.CoUnmarshalInterface",
  979. "ole32.dll.StringFromIID",
  980. "ole32.dll.CoGetPSClsid",
  981. "ole32.dll.CoCreateInstance",
  982. "ole32.dll.CoReleaseMarshalData",
  983. "ole32.dll.DcomChannelSetHResult",
  984. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  985. "kernel32.dll.SetErrorMode",
  986. "kernel32.dll.GetFileAttributesExW",
  987. "culture.dll.ConvertLangIdToCultureName",
  988. "kernel32.dll.GlobalMemoryStatusEx",
  989. "bcrypt.dll.BCryptGetFipsAlgorithmMode",
  990. "kernel32.dll.CloseHandle",
  991. "advapi32.dll.LookupPrivilegeValueW",
  992. "advapi32.dll.AdjustTokenPrivileges",
  993. "kernel32.dll.OpenProcess",
  994. "psapi.dll.EnumProcessModules",
  995. "psapi.dll.GetModuleInformation",
  996. "psapi.dll.GetModuleBaseNameW",
  997. "psapi.dll.GetModuleFileNameExW",
  998. "kernel32.dll.GetExitCodeProcess",
  999. "advapi32.dll.LookupPrivilegeValueA",
  1000. "advapi32.dll.GetKernelObjectSecurity",
  1001. "advapi32.dll.CreateWellKnownSid",
  1002. "advapi32.dll.SetKernelObjectSecurity",
  1003. "kernel32.dll.DeleteFileA",
  1004. "kernel32.dll.QueryPerformanceFrequency",
  1005. "kernel32.dll.QueryPerformanceCounter",
  1006. "shfolder.dll.SHGetFolderPathW",
  1007. "kernel32.dll.CreateDirectoryW",
  1008. "kernel32.dll.SetFileAttributesW",
  1009. "kernel32.dll.CopyFileW",
  1010. "advapi32.dll.RegSetValueExW",
  1011. "kernel32.dll.CreateProcessA",
  1012. "psapi.dll.EnumProcesses",
  1013. "kernel32.dll.GetThreadContext",
  1014. "kernel32.dll.ReadProcessMemory",
  1015. "kernel32.dll.VirtualAllocEx",
  1016. "kernel32.dll.TerminateProcess",
  1017. "ntdll.dll.NtQuerySystemInformation",
  1018. "kernel32.dll.OpenThread",
  1019. "kernel32.dll.TerminateThread",
  1020. "kernel32.dll.CreateActCtxW",
  1021. "kernel32.dll.AddRefActCtx",
  1022. "kernel32.dll.ReleaseActCtx",
  1023. "cryptsp.dll.CryptReleaseContext"
  1024. ]
  1025.  
  1026. [*] Static Analysis: {
  1027. "dotnet": {
  1028. "customattrs": null,
  1029. "assemblyinfo": {
  1030. "version": "1.0.0.0",
  1031. "name": "ChTable"
  1032. },
  1033. "assemblyrefs": [
  1034. {
  1035. "version": "2.0.0.0",
  1036. "name": "mscorlib"
  1037. },
  1038. {
  1039. "version": "2.0.0.0",
  1040. "name": "System.Windows.Forms"
  1041. },
  1042. {
  1043. "version": "2.0.0.0",
  1044. "name": "System"
  1045. },
  1046. {
  1047. "version": "2.0.0.0",
  1048. "name": "System.Drawing"
  1049. }
  1050. ],
  1051. "typerefs": [
  1052. {
  1053. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  1054. "assembly": "System"
  1055. },
  1056. {
  1057. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  1058. "assembly": "System"
  1059. },
  1060. {
  1061. "typename": "System.ComponentModel.EditorBrowsableState",
  1062. "assembly": "System"
  1063. },
  1064. {
  1065. "typename": "System.ComponentModel.IContainer",
  1066. "assembly": "System"
  1067. },
  1068. {
  1069. "typename": "System.Configuration.ApplicationSettingsBase",
  1070. "assembly": "System"
  1071. },
  1072. {
  1073. "typename": "System.Configuration.SettingsBase",
  1074. "assembly": "System"
  1075. },
  1076. {
  1077. "typename": "System.Drawing.Point",
  1078. "assembly": "System.Drawing"
  1079. },
  1080. {
  1081. "typename": "System.Drawing.Size",
  1082. "assembly": "System.Drawing"
  1083. },
  1084. {
  1085. "typename": "System.Drawing.SizeF",
  1086. "assembly": "System.Drawing"
  1087. },
  1088. {
  1089. "typename": "System.Windows.Forms.Application",
  1090. "assembly": "System.Windows.Forms"
  1091. },
  1092. {
  1093. "typename": "System.Windows.Forms.AutoScaleMode",
  1094. "assembly": "System.Windows.Forms"
  1095. },
  1096. {
  1097. "typename": "System.Windows.Forms.Button",
  1098. "assembly": "System.Windows.Forms"
  1099. },
  1100. {
  1101. "typename": "System.Windows.Forms.ButtonBase",
  1102. "assembly": "System.Windows.Forms"
  1103. },
  1104. {
  1105. "typename": "System.Windows.Forms.CommonDialog",
  1106. "assembly": "System.Windows.Forms"
  1107. },
  1108. {
  1109. "typename": "System.Windows.Forms.ContainerControl",
  1110. "assembly": "System.Windows.Forms"
  1111. },
  1112. {
  1113. "typename": "System.Windows.Forms.Control",
  1114. "assembly": "System.Windows.Forms"
  1115. },
  1116. {
  1117. "typename": "System.Windows.Forms.Control/ControlCollection",
  1118. "assembly": "System.Windows.Forms"
  1119. },
  1120. {
  1121. "typename": "System.Windows.Forms.DialogResult",
  1122. "assembly": "System.Windows.Forms"
  1123. },
  1124. {
  1125. "typename": "System.Windows.Forms.FileDialog",
  1126. "assembly": "System.Windows.Forms"
  1127. },
  1128. {
  1129. "typename": "System.Windows.Forms.Form",
  1130. "assembly": "System.Windows.Forms"
  1131. },
  1132. {
  1133. "typename": "System.Windows.Forms.GroupBox",
  1134. "assembly": "System.Windows.Forms"
  1135. },
  1136. {
  1137. "typename": "System.Windows.Forms.ListView",
  1138. "assembly": "System.Windows.Forms"
  1139. },
  1140. {
  1141. "typename": "System.Windows.Forms.ListView/ListViewItemCollection",
  1142. "assembly": "System.Windows.Forms"
  1143. },
  1144. {
  1145. "typename": "System.Windows.Forms.ListViewItem",
  1146. "assembly": "System.Windows.Forms"
  1147. },
  1148. {
  1149. "typename": "System.Windows.Forms.OpenFileDialog",
  1150. "assembly": "System.Windows.Forms"
  1151. },
  1152. {
  1153. "typename": "System.Windows.Forms.TextBox",
  1154. "assembly": "System.Windows.Forms"
  1155. },
  1156. {
  1157. "typename": "System.Windows.Forms.TextBoxBase",
  1158. "assembly": "System.Windows.Forms"
  1159. },
  1160. {
  1161. "typename": "System.Action`1",
  1162. "assembly": "mscorlib"
  1163. },
  1164. {
  1165. "typename": "System.Activator",
  1166. "assembly": "mscorlib"
  1167. },
  1168. {
  1169. "typename": "System.ArgumentNullException",
  1170. "assembly": "mscorlib"
  1171. },
  1172. {
  1173. "typename": "System.Array",
  1174. "assembly": "mscorlib"
  1175. },
  1176. {
  1177. "typename": "System.Attribute",
  1178. "assembly": "mscorlib"
  1179. },
  1180. {
  1181. "typename": "System.BadImageFormatException",
  1182. "assembly": "mscorlib"
  1183. },
  1184. {
  1185. "typename": "System.Byte",
  1186. "assembly": "mscorlib"
  1187. },
  1188. {
  1189. "typename": "System.Collections.DictionaryEntry",
  1190. "assembly": "mscorlib"
  1191. },
  1192. {
  1193. "typename": "System.Collections.Generic.Dictionary`2",
  1194. "assembly": "mscorlib"
  1195. },
  1196. {
  1197. "typename": "System.Collections.Generic.IEnumerable`1",
  1198. "assembly": "mscorlib"
  1199. },
  1200. {
  1201. "typename": "System.Collections.Generic.IEnumerator`1",
  1202. "assembly": "mscorlib"
  1203. },
  1204. {
  1205. "typename": "System.Collections.Generic.List`1",
  1206. "assembly": "mscorlib"
  1207. },
  1208. {
  1209. "typename": "System.Collections.Generic.List`1/Enumerator",
  1210. "assembly": "mscorlib"
  1211. },
  1212. {
  1213. "typename": "System.Collections.ICollection",
  1214. "assembly": "mscorlib"
  1215. },
  1216. {
  1217. "typename": "System.Collections.IDictionaryEnumerator",
  1218. "assembly": "mscorlib"
  1219. },
  1220. {
  1221. "typename": "System.Collections.IEnumerable",
  1222. "assembly": "mscorlib"
  1223. },
  1224. {
  1225. "typename": "System.Collections.IEnumerator",
  1226. "assembly": "mscorlib"
  1227. },
  1228. {
  1229. "typename": "System.Collections.IList",
  1230. "assembly": "mscorlib"
  1231. },
  1232. {
  1233. "typename": "System.Delegate",
  1234. "assembly": "mscorlib"
  1235. },
  1236. {
  1237. "typename": "System.Diagnostics.DebuggableAttribute",
  1238. "assembly": "mscorlib"
  1239. },
  1240. {
  1241. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  1242. "assembly": "mscorlib"
  1243. },
  1244. {
  1245. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  1246. "assembly": "mscorlib"
  1247. },
  1248. {
  1249. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  1250. "assembly": "mscorlib"
  1251. },
  1252. {
  1253. "typename": "System.Environment",
  1254. "assembly": "mscorlib"
  1255. },
  1256. {
  1257. "typename": "System.EventArgs",
  1258. "assembly": "mscorlib"
  1259. },
  1260. {
  1261. "typename": "System.EventHandler",
  1262. "assembly": "mscorlib"
  1263. },
  1264. {
  1265. "typename": "System.Globalization.CultureInfo",
  1266. "assembly": "mscorlib"
  1267. },
  1268. {
  1269. "typename": "System.IDisposable",
  1270. "assembly": "mscorlib"
  1271. },
  1272. {
  1273. "typename": "System.IO.MemoryStream",
  1274. "assembly": "mscorlib"
  1275. },
  1276. {
  1277. "typename": "System.IO.SeekOrigin",
  1278. "assembly": "mscorlib"
  1279. },
  1280. {
  1281. "typename": "System.IO.Stream",
  1282. "assembly": "mscorlib"
  1283. },
  1284. {
  1285. "typename": "System.IO.StreamReader",
  1286. "assembly": "mscorlib"
  1287. },
  1288. {
  1289. "typename": "System.IO.TextReader",
  1290. "assembly": "mscorlib"
  1291. },
  1292. {
  1293. "typename": "System.NotSupportedException",
  1294. "assembly": "mscorlib"
  1295. },
  1296. {
  1297. "typename": "System.Object",
  1298. "assembly": "mscorlib"
  1299. },
  1300. {
  1301. "typename": "System.Predicate`1",
  1302. "assembly": "mscorlib"
  1303. },
  1304. {
  1305. "typename": "System.Random",
  1306. "assembly": "mscorlib"
  1307. },
  1308. {
  1309. "typename": "System.Reflection.Assembly",
  1310. "assembly": "mscorlib"
  1311. },
  1312. {
  1313. "typename": "System.Reflection.AssemblyCompanyAttribute",
  1314. "assembly": "mscorlib"
  1315. },
  1316. {
  1317. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  1318. "assembly": "mscorlib"
  1319. },
  1320. {
  1321. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  1322. "assembly": "mscorlib"
  1323. },
  1324. {
  1325. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  1326. "assembly": "mscorlib"
  1327. },
  1328. {
  1329. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  1330. "assembly": "mscorlib"
  1331. },
  1332. {
  1333. "typename": "System.Reflection.AssemblyProductAttribute",
  1334. "assembly": "mscorlib"
  1335. },
  1336. {
  1337. "typename": "System.Reflection.AssemblyTitleAttribute",
  1338. "assembly": "mscorlib"
  1339. },
  1340. {
  1341. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  1342. "assembly": "mscorlib"
  1343. },
  1344. {
  1345. "typename": "System.Resources.ResourceManager",
  1346. "assembly": "mscorlib"
  1347. },
  1348. {
  1349. "typename": "System.Resources.ResourceSet",
  1350. "assembly": "mscorlib"
  1351. },
  1352. {
  1353. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  1354. "assembly": "mscorlib"
  1355. },
  1356. {
  1357. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  1358. "assembly": "mscorlib"
  1359. },
  1360. {
  1361. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  1362. "assembly": "mscorlib"
  1363. },
  1364. {
  1365. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  1366. "assembly": "mscorlib"
  1367. },
  1368. {
  1369. "typename": "System.Runtime.InteropServices.GuidAttribute",
  1370. "assembly": "mscorlib"
  1371. },
  1372. {
  1373. "typename": "System.RuntimeTypeHandle",
  1374. "assembly": "mscorlib"
  1375. },
  1376. {
  1377. "typename": "System.STAThreadAttribute",
  1378. "assembly": "mscorlib"
  1379. },
  1380. {
  1381. "typename": "System.Security.UnverifiableCodeAttribute",
  1382. "assembly": "mscorlib"
  1383. },
  1384. {
  1385. "typename": "System.Threading.Monitor",
  1386. "assembly": "mscorlib"
  1387. },
  1388. {
  1389. "typename": "System.Threading.Thread",
  1390. "assembly": "mscorlib"
  1391. },
  1392. {
  1393. "typename": "System.Threading.ThreadStart",
  1394. "assembly": "mscorlib"
  1395. },
  1396. {
  1397. "typename": "System.Type",
  1398. "assembly": "mscorlib"
  1399. }
  1400. ]
  1401. },
  1402. "pe": {
  1403. "peid_signatures": null,
  1404. "imports": [
  1405. {
  1406. "imports": [
  1407. {
  1408. "name": "_CorExeMain",
  1409. "address": "0x402000"
  1410. }
  1411. ],
  1412. "dll": "mscoree.dll"
  1413. }
  1414. ],
  1415. "digital_signers": null,
  1416. "exported_dll_name": null,
  1417. "actual_checksum": "0x00080816",
  1418. "overlay": null,
  1419. "imagebase": "0x00400000",
  1420. "reported_checksum": "0x00080816",
  1421. "icon_hash": null,
  1422. "entrypoint": "0x0048175e",
  1423. "timestamp": "2019-06-23 14:01:26",
  1424. "osversion": "4.0",
  1425. "sections": [
  1426. {
  1427. "name": ".text",
  1428. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1429. "virtual_address": "0x00002000",
  1430. "size_of_data": "0x0007f800",
  1431. "entropy": "7.99",
  1432. "raw_address": "0x00000200",
  1433. "virtual_size": "0x0007f764",
  1434. "characteristics_raw": "0x60000020"
  1435. },
  1436. {
  1437. "name": ".rsrc",
  1438. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1439. "virtual_address": "0x00082000",
  1440. "size_of_data": "0x00000600",
  1441. "entropy": "4.06",
  1442. "raw_address": "0x0007fa00",
  1443. "virtual_size": "0x000005a8",
  1444. "characteristics_raw": "0x40000040"
  1445. },
  1446. {
  1447. "name": ".reloc",
  1448. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1449. "virtual_address": "0x00084000",
  1450. "size_of_data": "0x00000200",
  1451. "entropy": "0.10",
  1452. "raw_address": "0x00080000",
  1453. "virtual_size": "0x0000000c",
  1454. "characteristics_raw": "0x42000040"
  1455. }
  1456. ],
  1457. "resources": [],
  1458. "dirents": [
  1459. {
  1460. "virtual_address": "0x00000000",
  1461. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1462. "size": "0x00000000"
  1463. },
  1464. {
  1465. "virtual_address": "0x00081708",
  1466. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1467. "size": "0x00000053"
  1468. },
  1469. {
  1470. "virtual_address": "0x00082000",
  1471. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1472. "size": "0x000005a8"
  1473. },
  1474. {
  1475. "virtual_address": "0x00000000",
  1476. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1477. "size": "0x00000000"
  1478. },
  1479. {
  1480. "virtual_address": "0x00000000",
  1481. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1482. "size": "0x00000000"
  1483. },
  1484. {
  1485. "virtual_address": "0x00084000",
  1486. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1487. "size": "0x0000000c"
  1488. },
  1489. {
  1490. "virtual_address": "0x00000000",
  1491. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1492. "size": "0x00000000"
  1493. },
  1494. {
  1495. "virtual_address": "0x00000000",
  1496. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1497. "size": "0x00000000"
  1498. },
  1499. {
  1500. "virtual_address": "0x00000000",
  1501. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1502. "size": "0x00000000"
  1503. },
  1504. {
  1505. "virtual_address": "0x00000000",
  1506. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1507. "size": "0x00000000"
  1508. },
  1509. {
  1510. "virtual_address": "0x00000000",
  1511. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1512. "size": "0x00000000"
  1513. },
  1514. {
  1515. "virtual_address": "0x00000000",
  1516. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1517. "size": "0x00000000"
  1518. },
  1519. {
  1520. "virtual_address": "0x00002000",
  1521. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1522. "size": "0x00000008"
  1523. },
  1524. {
  1525. "virtual_address": "0x00000000",
  1526. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1527. "size": "0x00000000"
  1528. },
  1529. {
  1530. "virtual_address": "0x00002008",
  1531. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1532. "size": "0x00000048"
  1533. },
  1534. {
  1535. "virtual_address": "0x00000000",
  1536. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1537. "size": "0x00000000"
  1538. }
  1539. ],
  1540. "exports": [],
  1541. "guest_signers": {},
  1542. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1543. "icon_fuzzy": null,
  1544. "icon": null,
  1545. "pdbpath": null,
  1546. "imported_dll_count": 1,
  1547. "versioninfo": []
  1548. }
  1549. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!