API tools faq
paste
paladin316

Exes_68dc7f2d0ca5647b28945ce9b1b720c6_exe_2019-07-01_05_30.json

paladin316
Jul 1st, 2019
2,196
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 31.58 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Small"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_68dc7f2d0ca5647b28945ce9b1b720c6.exe"
  7. [*] File Size: 37096
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "b0ca5b87bbdd4cbb12be21c62e0c589fe263192f2fa1a053981e27ac4fc03f3e"
  10. [*] MD5: "68dc7f2d0ca5647b28945ce9b1b720c6"
  11. [*] SHA1: "572adfd8461f1880475221f9220dd18d8b439fe3"
  12. [*] SHA512: "86fa5f201a572314d2c8c43f30450bfd2cf4e0bc17c96faedd01c93cef416ef72abe6e2d7f60383160311747afcc697e633f1ddc943cd6e40288b3b768cc9a79"
  13. [*] CRC32: "23F4DF0C"
  14. [*] SSDEEP: "384:q9Yr0Fyv4TsYSPXoml8UrYutfv+rhWuTGR6lx89DthncDk9EK6:IjFCSsYy+uU8uhv8ZtyAT6"
  15.  
  16. [*] Process Execution: [
  17. "Exes_68dc7f2d0ca5647b28945ce9b1b720c6.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  23. "Details": [
  24. {
  25. "Process": "Exes_68dc7f2d0ca5647b28945ce9b1b720c6.exe tried to sleep 5400 seconds, actually delayed analysis time by 0 seconds"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "File has been identified by 43 Antiviruses on VirusTotal as malicious",
  31. "Details": [
  32. {
  33. "MicroWorld-eScan": "Trojan.GenericKD.6139686"
  34. },
  35. {
  36. "CMC": "Backdoor.Win32.Small!O"
  37. },
  38. {
  39. "CAT-QuickHeal": "Trojan.Tiggre"
  40. },
  41. {
  42. "ALYac": "Trojan.GenericKD.6139686"
  43. },
  44. {
  45. "Zillya": "Backdoor.Small.Win32.10951"
  46. },
  47. {
  48. "BitDefender": "Trojan.GenericKD.6139686"
  49. },
  50. {
  51. "K7GW": "Trojan ( 0040f8b51 )"
  52. },
  53. {
  54. "K7AntiVirus": "Trojan ( 0040f8b51 )"
  55. },
  56. {
  57. "Invincea": "heuristic"
  58. },
  59. {
  60. "NANO-Antivirus": "Trojan.Win32.Rndseed.ejwzgr"
  61. },
  62. {
  63. "Cyren": "W32/Trojan.ZTBX-8389"
  64. },
  65. {
  66. "Symantec": "ML.Attribute.HighConfidence"
  67. },
  68. {
  69. "TrendMicro-HouseCall": "TROJ_GEN.R002C0PH218"
  70. },
  71. {
  72. "Kaspersky": "Backdoor.Win32.Small.lkc"
  73. },
  74. {
  75. "Ad-Aware": "Trojan.GenericKD.6139686"
  76. },
  77. {
  78. "Emsisoft": "Trojan.GenericKD.6139686 (B)"
  79. },
  80. {
  81. "F-Secure": "Trojan.GenericKD.6139686"
  82. },
  83. {
  84. "DrWeb": "BackDoor.Rndseed.17"
  85. },
  86. {
  87. "TrendMicro": "TROJ_GEN.R002C0PH218"
  88. },
  89. {
  90. "McAfee-GW-Edition": "GenericRXBV-HA!68DC7F2D0CA5"
  91. },
  92. {
  93. "Sophos": "Mal/Generic-S"
  94. },
  95. {
  96. "Ikarus": "Trojan.Win32.Agent"
  97. },
  98. {
  99. "Jiangmin": "Backdoor.Small.hs"
  100. },
  101. {
  102. "Avira": "BDS/Small.qciqd"
  103. },
  104. {
  105. "Fortinet": "W32/Generic.AC.3BBD59!tr"
  106. },
  107. {
  108. "Antiy-AVL": "Trojan/Win32.BTSGeneric"
  109. },
  110. {
  111. "Endgame": "malicious (high confidence)"
  112. },
  113. {
  114. "Arcabit": "Trojan.Generic.D5DAF26"
  115. },
  116. {
  117. "ZoneAlarm": "Backdoor.Win32.Small.lkc"
  118. },
  119. {
  120. "Microsoft": "Trojan:Win32/Occamy.C"
  121. },
  122. {
  123. "AhnLab-V3": "Backdoor/Win32.Small.C2651918"
  124. },
  125. {
  126. "McAfee": "GenericRXBV-HA!68DC7F2D0CA5"
  127. },
  128. {
  129. "MAX": "malware (ai score=100)"
  130. },
  131. {
  132. "VBA32": "Backdoor.Small"
  133. },
  134. {
  135. "Cylance": "Unsafe"
  136. },
  137. {
  138. "ESET-NOD32": "a variant of Win32/Agent.SOD"
  139. },
  140. {
  141. "Tencent": "Win32.Backdoor.Small.Wrqy"
  142. },
  143. {
  144. "Yandex": "Backdoor.Small!1kRB0ObuOI0"
  145. },
  146. {
  147. "GData": "Trojan.GenericKD.6139686"
  148. },
  149. {
  150. "Cybereason": "malicious.d0ca56"
  151. },
  152. {
  153. "Panda": "Trj/CI.A"
  154. },
  155. {
  156. "CrowdStrike": "malicious_confidence_90% (W)"
  157. },
  158. {
  159. "Qihoo-360": "Win32/Backdoor.34f"
  160. }
  161. ]
  162. }
  163. ]
  164.  
  165. [*] Started Service: []
  166.  
  167. [*] Executed Commands: []
  168.  
  169. [*] Mutexes: []
  170.  
  171. [*] Modified Files: []
  172.  
  173. [*] Deleted Files: []
  174.  
  175. [*] Modified Registry Keys: []
  176.  
  177. [*] Deleted Registry Keys: []
  178.  
  179. [*] DNS Communications: []
  180.  
  181. [*] Domains: []
  182.  
  183. [*] Network Communication - ICMP: []
  184.  
  185. [*] Network Communication - HTTP: []
  186.  
  187. [*] Network Communication - SMTP: []
  188.  
  189. [*] Network Communication - Hosts: []
  190.  
  191. [*] Network Communication - IRC: []
  192.  
  193. [*] Static Analysis: {
  194. "pe": {
  195. "peid_signatures": null,
  196. "imports": [
  197. {
  198. "imports": [
  199. {
  200. "name": "GetVersionExA",
  201. "address": "0x406000"
  202. },
  203. {
  204. "name": "GlobalMemoryStatus",
  205. "address": "0x406004"
  206. },
  207. {
  208. "name": "CreateProcessA",
  209. "address": "0x406008"
  210. },
  211. {
  212. "name": "Sleep",
  213. "address": "0x40600c"
  214. },
  215. {
  216. "name": "FlushFileBuffers",
  217. "address": "0x406010"
  218. },
  219. {
  220. "name": "LCMapStringW",
  221. "address": "0x406014"
  222. },
  223. {
  224. "name": "LCMapStringA",
  225. "address": "0x406018"
  226. },
  227. {
  228. "name": "SetStdHandle",
  229. "address": "0x40601c"
  230. },
  231. {
  232. "name": "LoadLibraryA",
  233. "address": "0x406020"
  234. },
  235. {
  236. "name": "GetProcAddress",
  237. "address": "0x406024"
  238. },
  239. {
  240. "name": "GetOEMCP",
  241. "address": "0x406028"
  242. },
  243. {
  244. "name": "GetACP",
  245. "address": "0x40602c"
  246. },
  247. {
  248. "name": "GetCPInfo",
  249. "address": "0x406030"
  250. },
  251. {
  252. "name": "GetStringTypeW",
  253. "address": "0x406034"
  254. },
  255. {
  256. "name": "GetStringTypeA",
  257. "address": "0x406038"
  258. },
  259. {
  260. "name": "MultiByteToWideChar",
  261. "address": "0x40603c"
  262. },
  263. {
  264. "name": "SetFilePointer",
  265. "address": "0x406040"
  266. },
  267. {
  268. "name": "GetLastError",
  269. "address": "0x406044"
  270. },
  271. {
  272. "name": "WriteFile",
  273. "address": "0x406048"
  274. },
  275. {
  276. "name": "RtlUnwind",
  277. "address": "0x40604c"
  278. },
  279. {
  280. "name": "HeapAlloc",
  281. "address": "0x406050"
  282. },
  283. {
  284. "name": "ExitProcess",
  285. "address": "0x406054"
  286. },
  287. {
  288. "name": "TerminateProcess",
  289. "address": "0x406058"
  290. },
  291. {
  292. "name": "GetCurrentProcess",
  293. "address": "0x40605c"
  294. },
  295. {
  296. "name": "GetModuleHandleA",
  297. "address": "0x406060"
  298. },
  299. {
  300. "name": "GetStartupInfoA",
  301. "address": "0x406064"
  302. },
  303. {
  304. "name": "GetCommandLineA",
  305. "address": "0x406068"
  306. },
  307. {
  308. "name": "GetVersion",
  309. "address": "0x40606c"
  310. },
  311. {
  312. "name": "HeapDestroy",
  313. "address": "0x406070"
  314. },
  315. {
  316. "name": "HeapCreate",
  317. "address": "0x406074"
  318. },
  319. {
  320. "name": "VirtualFree",
  321. "address": "0x406078"
  322. },
  323. {
  324. "name": "HeapFree",
  325. "address": "0x40607c"
  326. },
  327. {
  328. "name": "VirtualAlloc",
  329. "address": "0x406080"
  330. },
  331. {
  332. "name": "HeapReAlloc",
  333. "address": "0x406084"
  334. },
  335. {
  336. "name": "UnhandledExceptionFilter",
  337. "address": "0x406088"
  338. },
  339. {
  340. "name": "GetModuleFileNameA",
  341. "address": "0x40608c"
  342. },
  343. {
  344. "name": "FreeEnvironmentStringsA",
  345. "address": "0x406090"
  346. },
  347. {
  348. "name": "FreeEnvironmentStringsW",
  349. "address": "0x406094"
  350. },
  351. {
  352. "name": "WideCharToMultiByte",
  353. "address": "0x406098"
  354. },
  355. {
  356. "name": "GetEnvironmentStrings",
  357. "address": "0x40609c"
  358. },
  359. {
  360. "name": "GetEnvironmentStringsW",
  361. "address": "0x4060a0"
  362. },
  363. {
  364. "name": "SetHandleCount",
  365. "address": "0x4060a4"
  366. },
  367. {
  368. "name": "GetStdHandle",
  369. "address": "0x4060a8"
  370. },
  371. {
  372. "name": "GetFileType",
  373. "address": "0x4060ac"
  374. },
  375. {
  376. "name": "CloseHandle",
  377. "address": "0x4060b0"
  378. }
  379. ],
  380. "dll": "KERNEL32.dll"
  381. },
  382. {
  383. "imports": [
  384. {
  385. "name": "URLDownloadToFileA",
  386. "address": "0x4060f0"
  387. }
  388. ],
  389. "dll": "urlmon.dll"
  390. },
  391. {
  392. "imports": [
  393. {
  394. "name": "IcmpSendEcho2",
  395. "address": "0x4060e0"
  396. },
  397. {
  398. "name": "IcmpCloseHandle",
  399. "address": "0x4060e4"
  400. },
  401. {
  402. "name": "IcmpCreateFile",
  403. "address": "0x4060e8"
  404. }
  405. ],
  406. "dll": "iphlpapi.dll"
  407. },
  408. {
  409. "imports": [
  410. {
  411. "name": "inet_addr",
  412. "address": "0x4060d8"
  413. }
  414. ],
  415. "dll": "WS2_32.dll"
  416. },
  417. {
  418. "imports": [
  419. {
  420. "name": "HttpAddRequestHeadersA",
  421. "address": "0x4060b8"
  422. },
  423. {
  424. "name": "InternetReadFile",
  425. "address": "0x4060bc"
  426. },
  427. {
  428. "name": "InternetCloseHandle",
  429. "address": "0x4060c0"
  430. },
  431. {
  432. "name": "InternetOpenA",
  433. "address": "0x4060c4"
  434. },
  435. {
  436. "name": "InternetConnectA",
  437. "address": "0x4060c8"
  438. },
  439. {
  440. "name": "HttpOpenRequestA",
  441. "address": "0x4060cc"
  442. },
  443. {
  444. "name": "HttpSendRequestA",
  445. "address": "0x4060d0"
  446. }
  447. ],
  448. "dll": "WININET.dll"
  449. }
  450. ],
  451. "digital_signers": null,
  452. "exported_dll_name": null,
  453. "actual_checksum": "0x00014fb0",
  454. "overlay": {
  455. "size": "0x000000e8",
  456. "offset": "0x00009000"
  457. },
  458. "imagebase": "0x00400000",
  459. "reported_checksum": "0x00000000",
  460. "icon_hash": null,
  461. "entrypoint": "0x00401cd6",
  462. "timestamp": "2008-07-01 02:08:27",
  463. "osversion": "4.0",
  464. "sections": [
  465. {
  466. "name": ".text",
  467. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  468. "virtual_address": "0x00001000",
  469. "size_of_data": "0x00005000",
  470. "entropy": "6.03",
  471. "raw_address": "0x00001000",
  472. "virtual_size": "0x000044e8",
  473. "characteristics_raw": "0x60000020"
  474. },
  475. {
  476. "name": ".rdata",
  477. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  478. "virtual_address": "0x00006000",
  479. "size_of_data": "0x00001000",
  480. "entropy": "3.89",
  481. "raw_address": "0x00006000",
  482. "virtual_size": "0x00000a5e",
  483. "characteristics_raw": "0x40000040"
  484. },
  485. {
  486. "name": ".data",
  487. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  488. "virtual_address": "0x00007000",
  489. "size_of_data": "0x00002000",
  490. "entropy": "1.40",
  491. "raw_address": "0x00007000",
  492. "virtual_size": "0x00003038",
  493. "characteristics_raw": "0xc0000040"
  494. }
  495. ],
  496. "resources": [],
  497. "dirents": [
  498. {
  499. "virtual_address": "0x00000000",
  500. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  501. "size": "0x00000000"
  502. },
  503. {
  504. "virtual_address": "0x000064d0",
  505. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  506. "size": "0x00000078"
  507. },
  508. {
  509. "virtual_address": "0x00000000",
  510. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  511. "size": "0x00000000"
  512. },
  513. {
  514. "virtual_address": "0x00000000",
  515. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  516. "size": "0x00000000"
  517. },
  518. {
  519. "virtual_address": "0x00000000",
  520. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  521. "size": "0x00000000"
  522. },
  523. {
  524. "virtual_address": "0x00000000",
  525. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  526. "size": "0x00000000"
  527. },
  528. {
  529. "virtual_address": "0x00000000",
  530. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  531. "size": "0x00000000"
  532. },
  533. {
  534. "virtual_address": "0x00000000",
  535. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  536. "size": "0x00000000"
  537. },
  538. {
  539. "virtual_address": "0x00000000",
  540. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  541. "size": "0x00000000"
  542. },
  543. {
  544. "virtual_address": "0x00000000",
  545. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  546. "size": "0x00000000"
  547. },
  548. {
  549. "virtual_address": "0x00000000",
  550. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  551. "size": "0x00000000"
  552. },
  553. {
  554. "virtual_address": "0x00000000",
  555. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  556. "size": "0x00000000"
  557. },
  558. {
  559. "virtual_address": "0x00006000",
  560. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  561. "size": "0x000000f8"
  562. },
  563. {
  564. "virtual_address": "0x00000000",
  565. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  566. "size": "0x00000000"
  567. },
  568. {
  569. "virtual_address": "0x00000000",
  570. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  571. "size": "0x00000000"
  572. },
  573. {
  574. "virtual_address": "0x00000000",
  575. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  576. "size": "0x00000000"
  577. }
  578. ],
  579. "exports": [],
  580. "guest_signers": {},
  581. "imphash": "6397d644747a244a1136f6495b700a74",
  582. "icon_fuzzy": null,
  583. "icon": null,
  584. "pdbpath": null,
  585. "imported_dll_count": 5,
  586. "versioninfo": []
  587. }
  588. }
  589.  
  590. [*] Resolved APIs: [
  591. "rasapi32.dll.RasConnectionNotificationW",
  592. "sechost.dll.NotifyServiceStatusChangeA",
  593. "cryptbase.dll.SystemFunction036"
  594. ]
  595.  
  596. [*] Static Analysis: {
  597. "pe": {
  598. "peid_signatures": null,
  599. "imports": [
  600. {
  601. "imports": [
  602. {
  603. "name": "GetVersionExA",
  604. "address": "0x406000"
  605. },
  606. {
  607. "name": "GlobalMemoryStatus",
  608. "address": "0x406004"
  609. },
  610. {
  611. "name": "CreateProcessA",
  612. "address": "0x406008"
  613. },
  614. {
  615. "name": "Sleep",
  616. "address": "0x40600c"
  617. },
  618. {
  619. "name": "FlushFileBuffers",
  620. "address": "0x406010"
  621. },
  622. {
  623. "name": "LCMapStringW",
  624. "address": "0x406014"
  625. },
  626. {
  627. "name": "LCMapStringA",
  628. "address": "0x406018"
  629. },
  630. {
  631. "name": "SetStdHandle",
  632. "address": "0x40601c"
  633. },
  634. {
  635. "name": "LoadLibraryA",
  636. "address": "0x406020"
  637. },
  638. {
  639. "name": "GetProcAddress",
  640. "address": "0x406024"
  641. },
  642. {
  643. "name": "GetOEMCP",
  644. "address": "0x406028"
  645. },
  646. {
  647. "name": "GetACP",
  648. "address": "0x40602c"
  649. },
  650. {
  651. "name": "GetCPInfo",
  652. "address": "0x406030"
  653. },
  654. {
  655. "name": "GetStringTypeW",
  656. "address": "0x406034"
  657. },
  658. {
  659. "name": "GetStringTypeA",
  660. "address": "0x406038"
  661. },
  662. {
  663. "name": "MultiByteToWideChar",
  664. "address": "0x40603c"
  665. },
  666. {
  667. "name": "SetFilePointer",
  668. "address": "0x406040"
  669. },
  670. {
  671. "name": "GetLastError",
  672. "address": "0x406044"
  673. },
  674. {
  675. "name": "WriteFile",
  676. "address": "0x406048"
  677. },
  678. {
  679. "name": "RtlUnwind",
  680. "address": "0x40604c"
  681. },
  682. {
  683. "name": "HeapAlloc",
  684. "address": "0x406050"
  685. },
  686. {
  687. "name": "ExitProcess",
  688. "address": "0x406054"
  689. },
  690. {
  691. "name": "TerminateProcess",
  692. "address": "0x406058"
  693. },
  694. {
  695. "name": "GetCurrentProcess",
  696. "address": "0x40605c"
  697. },
  698. {
  699. "name": "GetModuleHandleA",
  700. "address": "0x406060"
  701. },
  702. {
  703. "name": "GetStartupInfoA",
  704. "address": "0x406064"
  705. },
  706. {
  707. "name": "GetCommandLineA",
  708. "address": "0x406068"
  709. },
  710. {
  711. "name": "GetVersion",
  712. "address": "0x40606c"
  713. },
  714. {
  715. "name": "HeapDestroy",
  716. "address": "0x406070"
  717. },
  718. {
  719. "name": "HeapCreate",
  720. "address": "0x406074"
  721. },
  722. {
  723. "name": "VirtualFree",
  724. "address": "0x406078"
  725. },
  726. {
  727. "name": "HeapFree",
  728. "address": "0x40607c"
  729. },
  730. {
  731. "name": "VirtualAlloc",
  732. "address": "0x406080"
  733. },
  734. {
  735. "name": "HeapReAlloc",
  736. "address": "0x406084"
  737. },
  738. {
  739. "name": "UnhandledExceptionFilter",
  740. "address": "0x406088"
  741. },
  742. {
  743. "name": "GetModuleFileNameA",
  744. "address": "0x40608c"
  745. },
  746. {
  747. "name": "FreeEnvironmentStringsA",
  748. "address": "0x406090"
  749. },
  750. {
  751. "name": "FreeEnvironmentStringsW",
  752. "address": "0x406094"
  753. },
  754. {
  755. "name": "WideCharToMultiByte",
  756. "address": "0x406098"
  757. },
  758. {
  759. "name": "GetEnvironmentStrings",
  760. "address": "0x40609c"
  761. },
  762. {
  763. "name": "GetEnvironmentStringsW",
  764. "address": "0x4060a0"
  765. },
  766. {
  767. "name": "SetHandleCount",
  768. "address": "0x4060a4"
  769. },
  770. {
  771. "name": "GetStdHandle",
  772. "address": "0x4060a8"
  773. },
  774. {
  775. "name": "GetFileType",
  776. "address": "0x4060ac"
  777. },
  778. {
  779. "name": "CloseHandle",
  780. "address": "0x4060b0"
  781. }
  782. ],
  783. "dll": "KERNEL32.dll"
  784. },
  785. {
  786. "imports": [
  787. {
  788. "name": "URLDownloadToFileA",
  789. "address": "0x4060f0"
  790. }
  791. ],
  792. "dll": "urlmon.dll"
  793. },
  794. {
  795. "imports": [
  796. {
  797. "name": "IcmpSendEcho2",
  798. "address": "0x4060e0"
  799. },
  800. {
  801. "name": "IcmpCloseHandle",
  802. "address": "0x4060e4"
  803. },
  804. {
  805. "name": "IcmpCreateFile",
  806. "address": "0x4060e8"
  807. }
  808. ],
  809. "dll": "iphlpapi.dll"
  810. },
  811. {
  812. "imports": [
  813. {
  814. "name": "inet_addr",
  815. "address": "0x4060d8"
  816. }
  817. ],
  818. "dll": "WS2_32.dll"
  819. },
  820. {
  821. "imports": [
  822. {
  823. "name": "HttpAddRequestHeadersA",
  824. "address": "0x4060b8"
  825. },
  826. {
  827. "name": "InternetReadFile",
  828. "address": "0x4060bc"
  829. },
  830. {
  831. "name": "InternetCloseHandle",
  832. "address": "0x4060c0"
  833. },
  834. {
  835. "name": "InternetOpenA",
  836. "address": "0x4060c4"
  837. },
  838. {
  839. "name": "InternetConnectA",
  840. "address": "0x4060c8"
  841. },
  842. {
  843. "name": "HttpOpenRequestA",
  844. "address": "0x4060cc"
  845. },
  846. {
  847. "name": "HttpSendRequestA",
  848. "address": "0x4060d0"
  849. }
  850. ],
  851. "dll": "WININET.dll"
  852. }
  853. ],
  854. "digital_signers": null,
  855. "exported_dll_name": null,
  856. "actual_checksum": "0x00014fb0",
  857. "overlay": {
  858. "size": "0x000000e8",
  859. "offset": "0x00009000"
  860. },
  861. "imagebase": "0x00400000",
  862. "reported_checksum": "0x00000000",
  863. "icon_hash": null,
  864. "entrypoint": "0x00401cd6",
  865. "timestamp": "2008-07-01 02:08:27",
  866. "osversion": "4.0",
  867. "sections": [
  868. {
  869. "name": ".text",
  870. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  871. "virtual_address": "0x00001000",
  872. "size_of_data": "0x00005000",
  873. "entropy": "6.03",
  874. "raw_address": "0x00001000",
  875. "virtual_size": "0x000044e8",
  876. "characteristics_raw": "0x60000020"
  877. },
  878. {
  879. "name": ".rdata",
  880. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  881. "virtual_address": "0x00006000",
  882. "size_of_data": "0x00001000",
  883. "entropy": "3.89",
  884. "raw_address": "0x00006000",
  885. "virtual_size": "0x00000a5e",
  886. "characteristics_raw": "0x40000040"
  887. },
  888. {
  889. "name": ".data",
  890. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  891. "virtual_address": "0x00007000",
  892. "size_of_data": "0x00002000",
  893. "entropy": "1.40",
  894. "raw_address": "0x00007000",
  895. "virtual_size": "0x00003038",
  896. "characteristics_raw": "0xc0000040"
  897. }
  898. ],
  899. "resources": [],
  900. "dirents": [
  901. {
  902. "virtual_address": "0x00000000",
  903. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  904. "size": "0x00000000"
  905. },
  906. {
  907. "virtual_address": "0x000064d0",
  908. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  909. "size": "0x00000078"
  910. },
  911. {
  912. "virtual_address": "0x00000000",
  913. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  914. "size": "0x00000000"
  915. },
  916. {
  917. "virtual_address": "0x00000000",
  918. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  919. "size": "0x00000000"
  920. },
  921. {
  922. "virtual_address": "0x00000000",
  923. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  924. "size": "0x00000000"
  925. },
  926. {
  927. "virtual_address": "0x00000000",
  928. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  929. "size": "0x00000000"
  930. },
  931. {
  932. "virtual_address": "0x00000000",
  933. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  934. "size": "0x00000000"
  935. },
  936. {
  937. "virtual_address": "0x00000000",
  938. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  939. "size": "0x00000000"
  940. },
  941. {
  942. "virtual_address": "0x00000000",
  943. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  944. "size": "0x00000000"
  945. },
  946. {
  947. "virtual_address": "0x00000000",
  948. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  949. "size": "0x00000000"
  950. },
  951. {
  952. "virtual_address": "0x00000000",
  953. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  954. "size": "0x00000000"
  955. },
  956. {
  957. "virtual_address": "0x00000000",
  958. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  959. "size": "0x00000000"
  960. },
  961. {
  962. "virtual_address": "0x00006000",
  963. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  964. "size": "0x000000f8"
  965. },
  966. {
  967. "virtual_address": "0x00000000",
  968. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  969. "size": "0x00000000"
  970. },
  971. {
  972. "virtual_address": "0x00000000",
  973. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  974. "size": "0x00000000"
  975. },
  976. {
  977. "virtual_address": "0x00000000",
  978. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  979. "size": "0x00000000"
  980. }
  981. ],
  982. "exports": [],
  983. "guest_signers": {},
  984. "imphash": "6397d644747a244a1136f6495b700a74",
  985. "icon_fuzzy": null,
  986. "icon": null,
  987. "pdbpath": null,
  988. "imported_dll_count": 5,
  989. "versioninfo": []
  990. }
  991. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!