API tools faq
paste
paladin316

Microsoft_VisualStudio_Tools_Office_Word_AddInAdapter_v9_0_ni_dll_2019-06-26_10_30.json

paladin316
Jun 26th, 2019
2,159
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.64 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 1.6
  5.  
  6. [*] File Name: "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll"
  7. [*] File Size: 59904
  8. [*] File Type: "MS-DOS executable"
  9. [*] SHA256: "39a2cc4ff36e843bffbc3d23f9cdf3cf48f0779e74200440ddcbc2a107bdff13"
  10. [*] MD5: "870ebb6547f71877de115cd4b5795c72"
  11. [*] SHA1: "ebe74569c7df4f23a9302c14126281a3eed6e0f1"
  12. [*] SHA512: "243c60b9cc84c3763b07a8a1e9643b9298657740bc1399e2d88192e86c7f6c123051c1a7e27f75ca4e85d084c65f2c08781e1c8f5f27667e73ff5ac5012b7480"
  13. [*] CRC32: "B3B337E0"
  14. [*] SSDEEP: "384:jUbWj1CWj+LhUb5eE+Sedl5IGJg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+GsN5Wm:jzemcENGJFiJHv"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "Anomalous binary characteristics",
  21. "Details": [
  22. {
  23. "anomaly": "Entrypoint of binary is located outside of any mapped sections"
  24. }
  25. ]
  26. }
  27. ]
  28.  
  29. [*] Started Service: []
  30.  
  31. [*] Executed Commands: []
  32.  
  33. [*] Mutexes: []
  34.  
  35. [*] Modified Files: []
  36.  
  37. [*] Deleted Files: []
  38.  
  39. [*] Modified Registry Keys: []
  40.  
  41. [*] Deleted Registry Keys: []
  42.  
  43. [*] DNS Communications: []
  44.  
  45. [*] Domains: []
  46.  
  47. [*] Network Communication - ICMP: []
  48.  
  49. [*] Network Communication - HTTP: []
  50.  
  51. [*] Network Communication - SMTP: []
  52.  
  53. [*] Network Communication - Hosts: []
  54.  
  55. [*] Network Communication - IRC: []
  56.  
  57. [*] Static Analysis: {
  58. "pe": {
  59. "peid_signatures": null,
  60. "imports": [],
  61. "digital_signers": null,
  62. "exported_dll_name": null,
  63. "actual_checksum": "0x00018c60",
  64. "overlay": null,
  65. "imagebase": "0x642a0000000",
  66. "reported_checksum": "0x00000000",
  67. "icon_hash": null,
  68. "entrypoint": "0x642a0000000",
  69. "timestamp": "2012-04-04 10:19:08",
  70. "osversion": "5.2",
  71. "sections": [
  72. {
  73. "name": ".data",
  74. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  75. "virtual_address": "0x00001000",
  76. "size_of_data": "0x00003800",
  77. "entropy": "0.77",
  78. "raw_address": "0x00000400",
  79. "virtual_size": "0x000037e0",
  80. "characteristics_raw": "0xc0000040"
  81. },
  82. {
  83. "name": ".xdata",
  84. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  85. "virtual_address": "0x00005000",
  86. "size_of_data": "0x00002400",
  87. "entropy": "0.41",
  88. "raw_address": "0x00003c00",
  89. "virtual_size": "0x00002218",
  90. "characteristics_raw": "0xe0000040"
  91. },
  92. {
  93. "name": ".text",
  94. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  95. "virtual_address": "0x00008000",
  96. "size_of_data": "0x00008200",
  97. "entropy": "5.06",
  98. "raw_address": "0x00006000",
  99. "virtual_size": "0x0000801c",
  100. "characteristics_raw": "0x60000020"
  101. },
  102. {
  103. "name": ".extjmp",
  104. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  105. "virtual_address": "0x00011000",
  106. "size_of_data": "0x00000200",
  107. "entropy": "1.77",
  108. "raw_address": "0x0000e200",
  109. "virtual_size": "0x00000090",
  110. "characteristics_raw": "0x60000020"
  111. },
  112. {
  113. "name": ".extrel",
  114. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  115. "virtual_address": "0x00012000",
  116. "size_of_data": "0x00000200",
  117. "entropy": "0.51",
  118. "raw_address": "0x0000e400",
  119. "virtual_size": "0x0000001b",
  120. "characteristics_raw": "0x40000040"
  121. },
  122. {
  123. "name": ".reloc",
  124. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  125. "virtual_address": "0x00013000",
  126. "size_of_data": "0x00000400",
  127. "entropy": "3.63",
  128. "raw_address": "0x0000e600",
  129. "virtual_size": "0x0000024c",
  130. "characteristics_raw": "0x42000040"
  131. }
  132. ],
  133. "resources": [],
  134. "dirents": [
  135. {
  136. "virtual_address": "0x00000000",
  137. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  138. "size": "0x00000000"
  139. },
  140. {
  141. "virtual_address": "0x00000000",
  142. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  143. "size": "0x00000000"
  144. },
  145. {
  146. "virtual_address": "0x00008000",
  147. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  148. "size": "0x000005b0"
  149. },
  150. {
  151. "virtual_address": "0x00009aec",
  152. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  153. "size": "0x00000048"
  154. },
  155. {
  156. "virtual_address": "0x00000000",
  157. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  158. "size": "0x00000000"
  159. },
  160. {
  161. "virtual_address": "0x00013000",
  162. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  163. "size": "0x0000024c"
  164. },
  165. {
  166. "virtual_address": "0x0000ff60",
  167. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  168. "size": "0x0000001c"
  169. },
  170. {
  171. "virtual_address": "0x00000000",
  172. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  173. "size": "0x00000000"
  174. },
  175. {
  176. "virtual_address": "0x00000000",
  177. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  178. "size": "0x00000000"
  179. },
  180. {
  181. "virtual_address": "0x00000000",
  182. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  183. "size": "0x00000000"
  184. },
  185. {
  186. "virtual_address": "0x00000000",
  187. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  188. "size": "0x00000000"
  189. },
  190. {
  191. "virtual_address": "0x00000000",
  192. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  193. "size": "0x00000000"
  194. },
  195. {
  196. "virtual_address": "0x00000000",
  197. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  198. "size": "0x00000000"
  199. },
  200. {
  201. "virtual_address": "0x00000000",
  202. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  203. "size": "0x00000000"
  204. },
  205. {
  206. "virtual_address": "0x000085b0",
  207. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  208. "size": "0x00000048"
  209. },
  210. {
  211. "virtual_address": "0x00000000",
  212. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  213. "size": "0x00000000"
  214. }
  215. ],
  216. "exports": [],
  217. "guest_signers": {},
  218. "imphash": "",
  219. "icon_fuzzy": null,
  220. "icon": null,
  221. "pdbpath": "f:\\dd\\trinity\\appnet\\fx\\office\\viewcontrols\\AddInAdapters\\Word\\objr\\i386\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.pdb",
  222. "imported_dll_count": 0,
  223. "versioninfo": []
  224. }
  225. }
  226.  
  227. [*] Resolved APIs: []
  228.  
  229. [*] Static Analysis: {
  230. "pe": {
  231. "peid_signatures": null,
  232. "imports": [],
  233. "digital_signers": null,
  234. "exported_dll_name": null,
  235. "actual_checksum": "0x00018c60",
  236. "overlay": null,
  237. "imagebase": "0x642a0000000",
  238. "reported_checksum": "0x00000000",
  239. "icon_hash": null,
  240. "entrypoint": "0x642a0000000",
  241. "timestamp": "2012-04-04 10:19:08",
  242. "osversion": "5.2",
  243. "sections": [
  244. {
  245. "name": ".data",
  246. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  247. "virtual_address": "0x00001000",
  248. "size_of_data": "0x00003800",
  249. "entropy": "0.77",
  250. "raw_address": "0x00000400",
  251. "virtual_size": "0x000037e0",
  252. "characteristics_raw": "0xc0000040"
  253. },
  254. {
  255. "name": ".xdata",
  256. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  257. "virtual_address": "0x00005000",
  258. "size_of_data": "0x00002400",
  259. "entropy": "0.41",
  260. "raw_address": "0x00003c00",
  261. "virtual_size": "0x00002218",
  262. "characteristics_raw": "0xe0000040"
  263. },
  264. {
  265. "name": ".text",
  266. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  267. "virtual_address": "0x00008000",
  268. "size_of_data": "0x00008200",
  269. "entropy": "5.06",
  270. "raw_address": "0x00006000",
  271. "virtual_size": "0x0000801c",
  272. "characteristics_raw": "0x60000020"
  273. },
  274. {
  275. "name": ".extjmp",
  276. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  277. "virtual_address": "0x00011000",
  278. "size_of_data": "0x00000200",
  279. "entropy": "1.77",
  280. "raw_address": "0x0000e200",
  281. "virtual_size": "0x00000090",
  282. "characteristics_raw": "0x60000020"
  283. },
  284. {
  285. "name": ".extrel",
  286. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  287. "virtual_address": "0x00012000",
  288. "size_of_data": "0x00000200",
  289. "entropy": "0.51",
  290. "raw_address": "0x0000e400",
  291. "virtual_size": "0x0000001b",
  292. "characteristics_raw": "0x40000040"
  293. },
  294. {
  295. "name": ".reloc",
  296. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  297. "virtual_address": "0x00013000",
  298. "size_of_data": "0x00000400",
  299. "entropy": "3.63",
  300. "raw_address": "0x0000e600",
  301. "virtual_size": "0x0000024c",
  302. "characteristics_raw": "0x42000040"
  303. }
  304. ],
  305. "resources": [],
  306. "dirents": [
  307. {
  308. "virtual_address": "0x00000000",
  309. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  310. "size": "0x00000000"
  311. },
  312. {
  313. "virtual_address": "0x00000000",
  314. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  315. "size": "0x00000000"
  316. },
  317. {
  318. "virtual_address": "0x00008000",
  319. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  320. "size": "0x000005b0"
  321. },
  322. {
  323. "virtual_address": "0x00009aec",
  324. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  325. "size": "0x00000048"
  326. },
  327. {
  328. "virtual_address": "0x00000000",
  329. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  330. "size": "0x00000000"
  331. },
  332. {
  333. "virtual_address": "0x00013000",
  334. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  335. "size": "0x0000024c"
  336. },
  337. {
  338. "virtual_address": "0x0000ff60",
  339. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  340. "size": "0x0000001c"
  341. },
  342. {
  343. "virtual_address": "0x00000000",
  344. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  345. "size": "0x00000000"
  346. },
  347. {
  348. "virtual_address": "0x00000000",
  349. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  350. "size": "0x00000000"
  351. },
  352. {
  353. "virtual_address": "0x00000000",
  354. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  355. "size": "0x00000000"
  356. },
  357. {
  358. "virtual_address": "0x00000000",
  359. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  360. "size": "0x00000000"
  361. },
  362. {
  363. "virtual_address": "0x00000000",
  364. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  365. "size": "0x00000000"
  366. },
  367. {
  368. "virtual_address": "0x00000000",
  369. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  370. "size": "0x00000000"
  371. },
  372. {
  373. "virtual_address": "0x00000000",
  374. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  375. "size": "0x00000000"
  376. },
  377. {
  378. "virtual_address": "0x000085b0",
  379. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  380. "size": "0x00000048"
  381. },
  382. {
  383. "virtual_address": "0x00000000",
  384. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  385. "size": "0x00000000"
  386. }
  387. ],
  388. "exports": [],
  389. "guest_signers": {},
  390. "imphash": "",
  391. "icon_fuzzy": null,
  392. "icon": null,
  393. "pdbpath": "f:\\dd\\trinity\\appnet\\fx\\office\\viewcontrols\\AddInAdapters\\Word\\objr\\i386\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.pdb",
  394. "imported_dll_count": 0,
  395. "versioninfo": []
  396. }
  397. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!