API tools faq
paste
paladin316

Exes_46ddc1f66344a9afb439c3e1e2b12af4_exe_2019-07-03_15_30.json

paladin316
Jul 3rd, 2019
2,162
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.29 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_46ddc1f66344a9afb439c3e1e2b12af4.exe"
  7. [*] File Size: 121344
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "6e730c6038642f062a0800571442d0a0ce5cfcddd5d1bd21180d5c751db3a755"
  10. [*] MD5: "46ddc1f66344a9afb439c3e1e2b12af4"
  11. [*] SHA1: "97c86c7af5baf1ee6b730e28f92f796cb401ad45"
  12. [*] SHA512: "bd09d3f8f8294c264c748cac3fbe06d3d05222d12563e0b8be25a2a1337d3b6cdd2d007704133fe587b164ccba20b217a72c03bf08180f3055b727a702d17e05"
  13. [*] CRC32: "047044D8"
  14. [*] SSDEEP: "3072:Vu0qYa6MPWpYv0cPAgMCZV0snQsOwYCWyNwsq866s:Vu77BOpSU2VjPRWyus+"
  15.  
  16. [*] Process Execution: [
  17. "Exes_46ddc1f66344a9afb439c3e1e2b12af4.exe",
  18. "Exes_46ddc1f66344a9afb439c3e1e2b12af4.exe"
  19. ]
  20.  
  21. [*] Signatures Detected: [
  22. {
  23. "Description": "Creates RWX memory",
  24. "Details": []
  25. },
  26. {
  27. "Description": "A process created a hidden window",
  28. "Details": [
  29. {
  30. "Process": "Exes_46ddc1f66344a9afb439c3e1e2b12af4.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\Exes_46ddc1f66344a9afb439c3e1e2b12af4.exe"
  31. }
  32. ]
  33. },
  34. {
  35. "Description": "The binary likely contains encrypted or compressed data.",
  36. "Details": [
  37. {
  38. "section": "name: UPX1, entropy: 7.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0001ce00, virtual_size: 0x0001d000"
  39. }
  40. ]
  41. },
  42. {
  43. "Description": "The executable is compressed using UPX",
  44. "Details": [
  45. {
  46. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00018000"
  47. }
  48. ]
  49. },
  50. {
  51. "Description": "File has been identified by 43 Antiviruses on VirusTotal as malicious",
  52. "Details": [
  53. {
  54. "MicroWorld-eScan": "Gen:Variant.Graftor.616643"
  55. },
  56. {
  57. "FireEye": "Generic.mg.46ddc1f66344a9af"
  58. },
  59. {
  60. "McAfee": "Artemis!46DDC1F66344"
  61. },
  62. {
  63. "Cylance": "Unsafe"
  64. },
  65. {
  66. "Alibaba": "Trojan:Win32/Kryptik.e2d139f6"
  67. },
  68. {
  69. "Symantec": "ML.Attribute.HighConfidence"
  70. },
  71. {
  72. "APEX": "Malicious"
  73. },
  74. {
  75. "Paloalto": "generic.ml"
  76. },
  77. {
  78. "Kaspersky": "Trojan-PSW.Win32.Kpot.ee"
  79. },
  80. {
  81. "BitDefender": "Gen:Variant.Graftor.616643"
  82. },
  83. {
  84. "NANO-Antivirus": "Trojan.Win32.Kryptik.fscxwe"
  85. },
  86. {
  87. "Avast": "Win32:MalwareX-gen [Trj]"
  88. },
  89. {
  90. "Rising": "Dropper.Generic!8.35E (TFE:dGZlOgUXWZFLoB4AIA)"
  91. },
  92. {
  93. "Ad-Aware": "Gen:Variant.Graftor.616643"
  94. },
  95. {
  96. "Emsisoft": "Gen:Variant.Graftor.616643 (B)"
  97. },
  98. {
  99. "F-Secure": "Trojan.TR/Dropper.Gen"
  100. },
  101. {
  102. "VIPRE": "Trojan.Win32.Generic!BT"
  103. },
  104. {
  105. "Invincea": "heuristic"
  106. },
  107. {
  108. "McAfee-GW-Edition": "BehavesLike.Win32.Trojan.cc"
  109. },
  110. {
  111. "Trapmine": "malicious.moderate.ml.score"
  112. },
  113. {
  114. "Ikarus": "Trojan.Win32.Crypt"
  115. },
  116. {
  117. "Jiangmin": "Trojan.PSW.Kpot.an"
  118. },
  119. {
  120. "Avira": "TR/Dropper.Gen"
  121. },
  122. {
  123. "Antiy-AVL": "Trojan[PSW]/Win32.Kpot"
  124. },
  125. {
  126. "Microsoft": "Trojan:Win32/Fuerboos.C!cl"
  127. },
  128. {
  129. "Endgame": "malicious (moderate confidence)"
  130. },
  131. {
  132. "ZoneAlarm": "Trojan-PSW.Win32.Kpot.ee"
  133. },
  134. {
  135. "GData": "Gen:Variant.Graftor.616643"
  136. },
  137. {
  138. "AhnLab-V3": "Malware/Win32.Generic.C3316884"
  139. },
  140. {
  141. "Acronis": "suspicious"
  142. },
  143. {
  144. "VBA32": "TrojanPSW.Kpot"
  145. },
  146. {
  147. "ALYac": "Gen:Variant.Graftor.616643"
  148. },
  149. {
  150. "MAX": "malware (ai score=94)"
  151. },
  152. {
  153. "Malwarebytes": "Ransom.GandCrab"
  154. },
  155. {
  156. "ESET-NOD32": "a variant of Win32/Kryptik.GUIR"
  157. },
  158. {
  159. "Tencent": "Win32.Trojan.Dropper.Pfab"
  160. },
  161. {
  162. "SentinelOne": "DFI - Malicious PE"
  163. },
  164. {
  165. "eGambit": "Unsafe.AI_Score_90%"
  166. },
  167. {
  168. "Fortinet": "W32/Kryptik.GUIR!tr"
  169. },
  170. {
  171. "AVG": "FileRepMalware"
  172. },
  173. {
  174. "Cybereason": "malicious.66344a"
  175. },
  176. {
  177. "CrowdStrike": "win/malicious_confidence_90% (D)"
  178. },
  179. {
  180. "Qihoo-360": "HEUR/QVM11.1.45AD.Malware.Gen"
  181. }
  182. ]
  183. }
  184. ]
  185.  
  186. [*] Started Service: []
  187.  
  188. [*] Executed Commands: [
  189. "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_46ddc1f66344a9afb439c3e1e2b12af4.exe\""
  190. ]
  191.  
  192. [*] Mutexes: [
  193. "DBWinMutex"
  194. ]
  195.  
  196. [*] Modified Files: []
  197.  
  198. [*] Deleted Files: []
  199.  
  200. [*] Modified Registry Keys: []
  201.  
  202. [*] Deleted Registry Keys: []
  203.  
  204. [*] DNS Communications: []
  205.  
  206. [*] Domains: []
  207.  
  208. [*] Network Communication - ICMP: []
  209.  
  210. [*] Network Communication - HTTP: []
  211.  
  212. [*] Network Communication - SMTP: []
  213.  
  214. [*] Network Communication - Hosts: []
  215.  
  216. [*] Network Communication - IRC: []
  217.  
  218. [*] Static Analysis: {
  219. "pe": {
  220. "peid_signatures": null,
  221. "imports": [
  222. {
  223. "imports": [
  224. {
  225. "name": "ImmEscapeA",
  226. "address": "0x4365d8"
  227. }
  228. ],
  229. "dll": "IMM32.dll"
  230. },
  231. {
  232. "imports": [
  233. {
  234. "name": "LoadLibraryA",
  235. "address": "0x4365e0"
  236. },
  237. {
  238. "name": "ExitProcess",
  239. "address": "0x4365e4"
  240. },
  241. {
  242. "name": "GetProcAddress",
  243. "address": "0x4365e8"
  244. },
  245. {
  246. "name": "VirtualProtect",
  247. "address": "0x4365ec"
  248. }
  249. ],
  250. "dll": "KERNEL32.DLL"
  251. }
  252. ],
  253. "digital_signers": null,
  254. "exported_dll_name": null,
  255. "actual_checksum": "0x0002b6c3",
  256. "overlay": null,
  257. "imagebase": "0x00400000",
  258. "reported_checksum": "0x00000000",
  259. "icon_hash": null,
  260. "entrypoint": "0x00435b40",
  261. "timestamp": "2019-06-28 18:29:58",
  262. "osversion": "5.1",
  263. "sections": [
  264. {
  265. "name": "UPX0",
  266. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  267. "virtual_address": "0x00001000",
  268. "size_of_data": "0x00000000",
  269. "entropy": "0.00",
  270. "raw_address": "0x00000400",
  271. "virtual_size": "0x00018000",
  272. "characteristics_raw": "0xe0000080"
  273. },
  274. {
  275. "name": "UPX1",
  276. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  277. "virtual_address": "0x00019000",
  278. "size_of_data": "0x0001ce00",
  279. "entropy": "7.94",
  280. "raw_address": "0x00000400",
  281. "virtual_size": "0x0001d000",
  282. "characteristics_raw": "0xe0000040"
  283. },
  284. {
  285. "name": ".rsrc",
  286. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  287. "virtual_address": "0x00036000",
  288. "size_of_data": "0x00000800",
  289. "entropy": "3.67",
  290. "raw_address": "0x0001d200",
  291. "virtual_size": "0x00001000",
  292. "characteristics_raw": "0xc0000040"
  293. }
  294. ],
  295. "resources": [],
  296. "dirents": [
  297. {
  298. "virtual_address": "0x00000000",
  299. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  300. "size": "0x00000000"
  301. },
  302. {
  303. "virtual_address": "0x0003659c",
  304. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  305. "size": "0x000000bc"
  306. },
  307. {
  308. "virtual_address": "0x00036000",
  309. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  310. "size": "0x0000059c"
  311. },
  312. {
  313. "virtual_address": "0x00000000",
  314. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  315. "size": "0x00000000"
  316. },
  317. {
  318. "virtual_address": "0x00000000",
  319. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  320. "size": "0x00000000"
  321. },
  322. {
  323. "virtual_address": "0x00036658",
  324. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  325. "size": "0x00000010"
  326. },
  327. {
  328. "virtual_address": "0x00000000",
  329. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  330. "size": "0x00000000"
  331. },
  332. {
  333. "virtual_address": "0x00000000",
  334. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  335. "size": "0x00000000"
  336. },
  337. {
  338. "virtual_address": "0x00000000",
  339. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  340. "size": "0x00000000"
  341. },
  342. {
  343. "virtual_address": "0x00000000",
  344. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  345. "size": "0x00000000"
  346. },
  347. {
  348. "virtual_address": "0x00035cfc",
  349. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  350. "size": "0x00000048"
  351. },
  352. {
  353. "virtual_address": "0x00000000",
  354. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  355. "size": "0x00000000"
  356. },
  357. {
  358. "virtual_address": "0x00000000",
  359. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  360. "size": "0x00000000"
  361. },
  362. {
  363. "virtual_address": "0x00000000",
  364. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  365. "size": "0x00000000"
  366. },
  367. {
  368. "virtual_address": "0x00000000",
  369. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  370. "size": "0x00000000"
  371. },
  372. {
  373. "virtual_address": "0x00000000",
  374. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  375. "size": "0x00000000"
  376. }
  377. ],
  378. "exports": [],
  379. "guest_signers": {},
  380. "imphash": "d1fe23ade297b098c916b90cc11fc745",
  381. "icon_fuzzy": null,
  382. "icon": null,
  383. "pdbpath": null,
  384. "imported_dll_count": 2,
  385. "versioninfo": []
  386. }
  387. }
  388.  
  389. [*] Resolved APIs: [
  390. "kernel32.dll.LoadLibraryA",
  391. "kernel32.dll.GetLastError",
  392. "kernel32.dll.HeapFree",
  393. "kernel32.dll.HeapAlloc",
  394. "kernel32.dll.GetCommandLineW",
  395. "kernel32.dll.GetProcessHeap",
  396. "kernel32.dll.ExitProcess",
  397. "kernel32.dll.GetModuleHandleExW",
  398. "kernel32.dll.GetProcAddress",
  399. "kernel32.dll.MultiByteToWideChar",
  400. "kernel32.dll.WideCharToMultiByte",
  401. "kernel32.dll.GetStdHandle",
  402. "kernel32.dll.WriteFile",
  403. "kernel32.dll.GetModuleFileNameW",
  404. "kernel32.dll.IsProcessorFeaturePresent",
  405. "kernel32.dll.SetLastError",
  406. "kernel32.dll.GetCurrentThreadId",
  407. "kernel32.dll.GetFileType",
  408. "kernel32.dll.DeleteCriticalSection",
  409. "kernel32.dll.GetStartupInfoW",
  410. "kernel32.dll.QueryPerformanceCounter",
  411. "kernel32.dll.GetCurrentProcessId",
  412. "kernel32.dll.GetSystemTimeAsFileTime",
  413. "kernel32.dll.GetEnvironmentStringsW",
  414. "kernel32.dll.FreeEnvironmentStringsW",
  415. "kernel32.dll.UnhandledExceptionFilter",
  416. "kernel32.dll.SetUnhandledExceptionFilter",
  417. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  418. "kernel32.dll.Sleep",
  419. "kernel32.dll.GetCurrentProcess",
  420. "kernel32.dll.TerminateProcess",
  421. "kernel32.dll.TlsAlloc",
  422. "kernel32.dll.TlsGetValue",
  423. "kernel32.dll.TlsSetValue",
  424. "kernel32.dll.TlsFree",
  425. "kernel32.dll.GetModuleHandleW",
  426. "kernel32.dll.IsDebuggerPresent",
  427. "kernel32.dll.EnterCriticalSection",
  428. "kernel32.dll.LeaveCriticalSection",
  429. "kernel32.dll.LoadLibraryExW",
  430. "kernel32.dll.IsValidCodePage",
  431. "kernel32.dll.GetACP",
  432. "kernel32.dll.GetOEMCP",
  433. "kernel32.dll.GetCPInfo",
  434. "kernel32.dll.OutputDebugStringW",
  435. "kernel32.dll.RtlUnwind",
  436. "kernel32.dll.HeapSize",
  437. "kernel32.dll.HeapReAlloc",
  438. "kernel32.dll.LCMapStringW",
  439. "kernel32.dll.GetStringTypeW",
  440. "kernel32.dll.FlushFileBuffers",
  441. "kernel32.dll.GetConsoleCP",
  442. "kernel32.dll.GetConsoleMode",
  443. "kernel32.dll.SetStdHandle",
  444. "kernel32.dll.SetFilePointerEx",
  445. "kernel32.dll.WriteConsoleW",
  446. "kernel32.dll.CloseHandle",
  447. "kernel32.dll.CreateFileW",
  448. "imm32.dll.ImmIsUIMessageW",
  449. "imm32.dll.ImmGetConversionStatus",
  450. "imm32.dll.ImmEscapeA",
  451. "imm32.dll.ImmReSizeIMCC",
  452. "imm32.dll.ImmRequestMessageW",
  453. "imm32.dll.ImmGetRegisterWordStyleW",
  454. "imm32.dll.ImmGetIMEFileNameW",
  455. "imm32.dll.ImmGetDefaultIMEWnd",
  456. "imm32.dll.ImmUnregisterWordW",
  457. "imm32.dll.ImmGetVirtualKey",
  458. "imm32.dll.ImmSetStatusWindowPos",
  459. "imm32.dll.ImmGetCompositionWindow",
  460. "imm32.dll.ImmLockIMC",
  461. "imm32.dll.ImmInstallIMEW",
  462. "imm32.dll.ImmDisableIME",
  463. "imm32.dll.ImmGenerateMessage",
  464. "imm32.dll.ImmSimulateHotKey",
  465. "imm32.dll.ImmShowSoftKeyboard",
  466. "imm32.dll.ImmGetDescriptionA",
  467. "imm32.dll.ImmGetCandidateListA",
  468. "imm32.dll.ImmIsUIMessageA",
  469. "imm32.dll.ImmSetOpenStatus",
  470. "kernel32.dll.FlsAlloc",
  471. "kernel32.dll.FlsFree",
  472. "kernel32.dll.FlsGetValue",
  473. "kernel32.dll.FlsSetValue",
  474. "kernel32.dll.InitializeCriticalSectionEx",
  475. "kernel32.dll.CreateEventExW",
  476. "kernel32.dll.CreateSemaphoreExW",
  477. "kernel32.dll.SetThreadStackGuarantee",
  478. "kernel32.dll.CreateThreadpoolTimer",
  479. "kernel32.dll.SetThreadpoolTimer",
  480. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  481. "kernel32.dll.CloseThreadpoolTimer",
  482. "kernel32.dll.CreateThreadpoolWait",
  483. "kernel32.dll.SetThreadpoolWait",
  484. "kernel32.dll.CloseThreadpoolWait",
  485. "kernel32.dll.FlushProcessWriteBuffers",
  486. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  487. "kernel32.dll.GetCurrentProcessorNumber",
  488. "kernel32.dll.GetLogicalProcessorInformation",
  489. "kernel32.dll.CreateSymbolicLinkW",
  490. "kernel32.dll.EnumSystemLocalesEx",
  491. "kernel32.dll.CompareStringEx",
  492. "kernel32.dll.GetDateFormatEx",
  493. "kernel32.dll.GetLocaleInfoEx",
  494. "kernel32.dll.GetTimeFormatEx",
  495. "kernel32.dll.GetUserDefaultLocaleName",
  496. "kernel32.dll.IsValidLocaleName",
  497. "kernel32.dll.LCMapStringEx",
  498. "kernel32.dll.GetTickCount64"
  499. ]
  500.  
  501. [*] Static Analysis: {
  502. "pe": {
  503. "peid_signatures": null,
  504. "imports": [
  505. {
  506. "imports": [
  507. {
  508. "name": "ImmEscapeA",
  509. "address": "0x4365d8"
  510. }
  511. ],
  512. "dll": "IMM32.dll"
  513. },
  514. {
  515. "imports": [
  516. {
  517. "name": "LoadLibraryA",
  518. "address": "0x4365e0"
  519. },
  520. {
  521. "name": "ExitProcess",
  522. "address": "0x4365e4"
  523. },
  524. {
  525. "name": "GetProcAddress",
  526. "address": "0x4365e8"
  527. },
  528. {
  529. "name": "VirtualProtect",
  530. "address": "0x4365ec"
  531. }
  532. ],
  533. "dll": "KERNEL32.DLL"
  534. }
  535. ],
  536. "digital_signers": null,
  537. "exported_dll_name": null,
  538. "actual_checksum": "0x0002b6c3",
  539. "overlay": null,
  540. "imagebase": "0x00400000",
  541. "reported_checksum": "0x00000000",
  542. "icon_hash": null,
  543. "entrypoint": "0x00435b40",
  544. "timestamp": "2019-06-28 18:29:58",
  545. "osversion": "5.1",
  546. "sections": [
  547. {
  548. "name": "UPX0",
  549. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  550. "virtual_address": "0x00001000",
  551. "size_of_data": "0x00000000",
  552. "entropy": "0.00",
  553. "raw_address": "0x00000400",
  554. "virtual_size": "0x00018000",
  555. "characteristics_raw": "0xe0000080"
  556. },
  557. {
  558. "name": "UPX1",
  559. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  560. "virtual_address": "0x00019000",
  561. "size_of_data": "0x0001ce00",
  562. "entropy": "7.94",
  563. "raw_address": "0x00000400",
  564. "virtual_size": "0x0001d000",
  565. "characteristics_raw": "0xe0000040"
  566. },
  567. {
  568. "name": ".rsrc",
  569. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  570. "virtual_address": "0x00036000",
  571. "size_of_data": "0x00000800",
  572. "entropy": "3.67",
  573. "raw_address": "0x0001d200",
  574. "virtual_size": "0x00001000",
  575. "characteristics_raw": "0xc0000040"
  576. }
  577. ],
  578. "resources": [],
  579. "dirents": [
  580. {
  581. "virtual_address": "0x00000000",
  582. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  583. "size": "0x00000000"
  584. },
  585. {
  586. "virtual_address": "0x0003659c",
  587. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  588. "size": "0x000000bc"
  589. },
  590. {
  591. "virtual_address": "0x00036000",
  592. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  593. "size": "0x0000059c"
  594. },
  595. {
  596. "virtual_address": "0x00000000",
  597. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  598. "size": "0x00000000"
  599. },
  600. {
  601. "virtual_address": "0x00000000",
  602. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  603. "size": "0x00000000"
  604. },
  605. {
  606. "virtual_address": "0x00036658",
  607. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  608. "size": "0x00000010"
  609. },
  610. {
  611. "virtual_address": "0x00000000",
  612. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  613. "size": "0x00000000"
  614. },
  615. {
  616. "virtual_address": "0x00000000",
  617. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  618. "size": "0x00000000"
  619. },
  620. {
  621. "virtual_address": "0x00000000",
  622. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  623. "size": "0x00000000"
  624. },
  625. {
  626. "virtual_address": "0x00000000",
  627. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  628. "size": "0x00000000"
  629. },
  630. {
  631. "virtual_address": "0x00035cfc",
  632. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  633. "size": "0x00000048"
  634. },
  635. {
  636. "virtual_address": "0x00000000",
  637. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  638. "size": "0x00000000"
  639. },
  640. {
  641. "virtual_address": "0x00000000",
  642. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  643. "size": "0x00000000"
  644. },
  645. {
  646. "virtual_address": "0x00000000",
  647. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  648. "size": "0x00000000"
  649. },
  650. {
  651. "virtual_address": "0x00000000",
  652. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  653. "size": "0x00000000"
  654. },
  655. {
  656. "virtual_address": "0x00000000",
  657. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  658. "size": "0x00000000"
  659. }
  660. ],
  661. "exports": [],
  662. "guest_signers": {},
  663. "imphash": "d1fe23ade297b098c916b90cc11fc745",
  664. "icon_fuzzy": null,
  665. "icon": null,
  666. "pdbpath": null,
  667. "imported_dll_count": 2,
  668. "versioninfo": []
  669. }
  670. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!