API tools faq
paste
paladin316

Exes_9c71633afc8014d11153cf6ee52effed_exe_2019-06-27_04_30.json

paladin316
Jun 26th, 2019
2,219
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 91.12 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_9c71633afc8014d11153cf6ee52effed.exe"
  7. [*] File Size: 1659392
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "9585c386966ac0a27a65fbb09158ef37e0401e8dac16ca768a0a98af8710a9da"
  10. [*] MD5: "9c71633afc8014d11153cf6ee52effed"
  11. [*] SHA1: "572ecd6ff0cf05e27ffe418086df708d6e086313"
  12. [*] SHA512: "5a3e494013ad5487a5c193a20b9be29afce30656d42e854de053fc541ed2f1ce5934ab45df9ac34576d42ac51a106b4383efb08df13c0ec791682761418cbf4a"
  13. [*] CRC32: "8A7D7615"
  14. [*] SSDEEP: "49152:GAToOvtkyoYMAJ8O69uhsgISMGi7y1WVu4YE05EXAwYuAB:GHOv5cpG12Iz5EqJ"
  15.  
  16. [*] Process Execution: [
  17. "Exes_9c71633afc8014d11153cf6ee52effed.exe",
  18. "bL6pp4F.exe",
  19. "explorer.exe"
  20. ]
  21.  
  22. [*] Signatures Detected: [
  23. {
  24. "Description": "Creates RWX memory",
  25. "Details": []
  26. },
  27. {
  28. "Description": "Possible date expiration check, exits too soon after checking local time",
  29. "Details": [
  30. {
  31. "process": "Exes_9c71633afc8014d11153cf6ee52effed.exe, PID 1464"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "Expresses interest in specific running processes",
  37. "Details": [
  38. {
  39. "process": "explorer.exe"
  40. }
  41. ]
  42. },
  43. {
  44. "Description": "Drops a binary and executes it",
  45. "Details": [
  46. {
  47. "binary": "C:\\Windows\\c887c3\\bL6pp4F.exe"
  48. }
  49. ]
  50. },
  51. {
  52. "Description": "The binary likely contains encrypted or compressed data.",
  53. "Details": [
  54. {
  55. "section": "name: .vmp0, entropy: 7.85, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00158600, virtual_size: 0x001584ae"
  56. },
  57. {
  58. "section": "name: .vmp1, entropy: 7.48, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00011e00, virtual_size: 0x00011c93"
  59. }
  60. ]
  61. },
  62. {
  63. "Description": "The executable is likely packed with VMProtect",
  64. "Details": [
  65. {
  66. "section": {
  67. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  68. "characteristics_raw": "0xe0000060",
  69. "entropy": "7.85",
  70. "name": ".vmp0",
  71. "raw_address": "0x00028000",
  72. "size_of_data": "0x00158600",
  73. "virtual_address": "0x0002c000",
  74. "virtual_size": "0x001584ae"
  75. }
  76. }
  77. ]
  78. },
  79. {
  80. "Description": "Detects Sandboxie through the presence of a library",
  81. "Details": []
  82. },
  83. {
  84. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  85. "Details": [
  86. {
  87. "Process": "Exes_9c71633afc8014d11153cf6ee52effed.exe (1464)"
  88. }
  89. ]
  90. },
  91. {
  92. "Description": "Code injection with CreateRemoteThread in a remote process",
  93. "Details": [
  94. {
  95. "Injection": "bL6pp4F.exe(1824) -> explorer.exe(1960)"
  96. }
  97. ]
  98. },
  99. {
  100. "Description": "Creates a hidden or system file",
  101. "Details": [
  102. {
  103. "file": "C:\\Windows\\System32\\lz_scby.txt"
  104. }
  105. ]
  106. },
  107. {
  108. "Description": "File has been identified by 45 Antiviruses on VirusTotal as malicious",
  109. "Details": [
  110. {
  111. "Bkav": "HW32.Packed."
  112. },
  113. {
  114. "MicroWorld-eScan": "Gen:Variant.Ursu.227819"
  115. },
  116. {
  117. "FireEye": "Generic.mg.9c71633afc8014d1"
  118. },
  119. {
  120. "Qihoo-360": "Win32/Trojan.Proxy.301"
  121. },
  122. {
  123. "McAfee": "Artemis!9C71633AFC80"
  124. },
  125. {
  126. "Malwarebytes": "Trojan.VMProtect"
  127. },
  128. {
  129. "K7AntiVirus": "Trojan ( 004fe7031 )"
  130. },
  131. {
  132. "Alibaba": "Trojan:Win32/Black.7e4f6f72"
  133. },
  134. {
  135. "K7GW": "Trojan ( 004fe7031 )"
  136. },
  137. {
  138. "Cybereason": "malicious.afc801"
  139. },
  140. {
  141. "Baidu": "Win32.Packed.VMProtect.a"
  142. },
  143. {
  144. "APEX": "Malicious"
  145. },
  146. {
  147. "Paloalto": "generic.ml"
  148. },
  149. {
  150. "Kaspersky": "Trojan-Proxy.Win32.PexTea.bm"
  151. },
  152. {
  153. "BitDefender": "Gen:Variant.Ursu.227819"
  154. },
  155. {
  156. "NANO-Antivirus": "Trojan.Win32.PexTea.frcrnf"
  157. },
  158. {
  159. "ViRobot": "Trojan.Win32.Z.Ursu.1659392"
  160. },
  161. {
  162. "AegisLab": "Trojan.Win32.PexTea.4!c"
  163. },
  164. {
  165. "Rising": "Backdoor.Zegost!8.177 (TFE:5:PXJhjRkygl)"
  166. },
  167. {
  168. "Endgame": "malicious (high confidence)"
  169. },
  170. {
  171. "Sophos": "Mal/VMProtBad-A"
  172. },
  173. {
  174. "Comodo": "Malware@#3shsaruhtr322"
  175. },
  176. {
  177. "F-Secure": "Trojan.TR/Black.Gen2"
  178. },
  179. {
  180. "DrWeb": "Trojan.MulDrop7.3471"
  181. },
  182. {
  183. "Invincea": "heuristic"
  184. },
  185. {
  186. "McAfee-GW-Edition": "BehavesLike.Win32.Virut.tc"
  187. },
  188. {
  189. "Emsisoft": "Gen:Variant.Ursu.227819 (B)"
  190. },
  191. {
  192. "SentinelOne": "DFI - Malicious PE"
  193. },
  194. {
  195. "Avira": "TR/Black.Gen2"
  196. },
  197. {
  198. "MAX": "malware (ai score=100)"
  199. },
  200. {
  201. "Microsoft": "Trojan:Win32/Occamy.C"
  202. },
  203. {
  204. "Arcabit": "Trojan.Ursu.D379EB"
  205. },
  206. {
  207. "AhnLab-V3": "Malware/Win32.Generic.C3121731"
  208. },
  209. {
  210. "ZoneAlarm": "Trojan-Proxy.Win32.PexTea.bm"
  211. },
  212. {
  213. "GData": "Gen:Variant.Ursu.227819"
  214. },
  215. {
  216. "ESET-NOD32": "a variant of Win32/Agent.YKQ"
  217. },
  218. {
  219. "VBA32": "TrojanPSW.Coins"
  220. },
  221. {
  222. "ALYac": "Gen:Variant.Ursu.227819"
  223. },
  224. {
  225. "Ad-Aware": "Gen:Variant.Ursu.227819"
  226. },
  227. {
  228. "Panda": "Generic Suspicious"
  229. },
  230. {
  231. "Tencent": "Win32.Trojan.Gen.Hvsr"
  232. },
  233. {
  234. "Ikarus": "Trojan.Win32.Agent"
  235. },
  236. {
  237. "Fortinet": "W32/Agent.A!tr"
  238. },
  239. {
  240. "Avast": "Win32:Malware-gen"
  241. },
  242. {
  243. "CrowdStrike": "win/malicious_confidence_90% (W)"
  244. }
  245. ]
  246. },
  247. {
  248. "Description": "Checks the presence of disk drives in the registry, possibly for anti-virtualization",
  249. "Details": []
  250. }
  251. ]
  252.  
  253. [*] Started Service: []
  254.  
  255. [*] Executed Commands: [
  256. "C:/Windows/c887c3/bL6pp4F.exe /runp2p:C:/Windows/c887c3/njHUWu0.dll"
  257. ]
  258.  
  259. [*] Mutexes: [
  260. "e91db4ec7f217a55ebcc47b56e42e2ee",
  261. "19f46277b625a9d36d1f948fd357097e",
  262. "8c4ab3d03888446a81787da1a8862c4f",
  263. "a01d46e817b2a8c7dd6af4ed6f9c1323"
  264. ]
  265.  
  266. [*] Modified Files: [
  267. "C:\\Windows\\System32\\lz_scby.txt",
  268. "C:\\Windows\\c887c3\\ce070904adc09a1f77098be9eb713cf0",
  269. "C:\\Windows\\c887c3\\njHUWu0.dll",
  270. "C:\\Windows\\c887c3\\bL6pp4F.exe"
  271. ]
  272.  
  273. [*] Deleted Files: [
  274. "C:\\Windows\\System32\\lz_scby.txt",
  275. "C:\\Windows\\c887c3\\bL6pp4F.exe",
  276. "C:\\Windows\\c887c3\\mGoR094.d"
  277. ]
  278.  
  279. [*] Modified Registry Keys: []
  280.  
  281. [*] Deleted Registry Keys: []
  282.  
  283. [*] DNS Communications: []
  284.  
  285. [*] Domains: []
  286.  
  287. [*] Network Communication - ICMP: []
  288.  
  289. [*] Network Communication - HTTP: []
  290.  
  291. [*] Network Communication - SMTP: []
  292.  
  293. [*] Network Communication - Hosts: []
  294.  
  295. [*] Network Communication - IRC: []
  296.  
  297. [*] Static Analysis: {
  298. "pe": {
  299. "peid_signatures": null,
  300. "imports": [
  301. {
  302. "imports": [
  303. {
  304. "name": "FindResourceA",
  305. "address": "0x588000"
  306. },
  307. {
  308. "name": "FreeResource",
  309. "address": "0x588004"
  310. },
  311. {
  312. "name": "LoadResource",
  313. "address": "0x588008"
  314. },
  315. {
  316. "name": "HeapAlloc",
  317. "address": "0x58800c"
  318. },
  319. {
  320. "name": "SetUnhandledExceptionFilter",
  321. "address": "0x588010"
  322. },
  323. {
  324. "name": "GetCurrentProcess",
  325. "address": "0x588014"
  326. },
  327. {
  328. "name": "HeapFree",
  329. "address": "0x588018"
  330. },
  331. {
  332. "name": "GetTickCount",
  333. "address": "0x58801c"
  334. },
  335. {
  336. "name": "GetProcessHeap",
  337. "address": "0x588020"
  338. },
  339. {
  340. "name": "WideCharToMultiByte",
  341. "address": "0x588024"
  342. },
  343. {
  344. "name": "SizeofResource",
  345. "address": "0x588028"
  346. },
  347. {
  348. "name": "GetVersionExW",
  349. "address": "0x58802c"
  350. },
  351. {
  352. "name": "MultiByteToWideChar",
  353. "address": "0x588030"
  354. },
  355. {
  356. "name": "OpenMutexA",
  357. "address": "0x588034"
  358. },
  359. {
  360. "name": "LockResource",
  361. "address": "0x588038"
  362. },
  363. {
  364. "name": "GetCurrentThreadId",
  365. "address": "0x58803c"
  366. },
  367. {
  368. "name": "ReleaseMutex",
  369. "address": "0x588040"
  370. },
  371. {
  372. "name": "GetCurrentProcessId",
  373. "address": "0x588044"
  374. },
  375. {
  376. "name": "Sleep",
  377. "address": "0x588048"
  378. },
  379. {
  380. "name": "TerminateProcess",
  381. "address": "0x58804c"
  382. },
  383. {
  384. "name": "SetFileAttributesA",
  385. "address": "0x588050"
  386. },
  387. {
  388. "name": "HeapSize",
  389. "address": "0x588054"
  390. },
  391. {
  392. "name": "SetEnvironmentVariableA",
  393. "address": "0x588058"
  394. },
  395. {
  396. "name": "CompareStringW",
  397. "address": "0x58805c"
  398. },
  399. {
  400. "name": "CompareStringA",
  401. "address": "0x588060"
  402. },
  403. {
  404. "name": "DeleteFileA",
  405. "address": "0x588064"
  406. },
  407. {
  408. "name": "CloseHandle",
  409. "address": "0x588068"
  410. },
  411. {
  412. "name": "GetModuleFileNameA",
  413. "address": "0x58806c"
  414. },
  415. {
  416. "name": "GetLastError",
  417. "address": "0x588070"
  418. },
  419. {
  420. "name": "ReadFile",
  421. "address": "0x588074"
  422. },
  423. {
  424. "name": "WriteFile",
  425. "address": "0x588078"
  426. },
  427. {
  428. "name": "SetFilePointer",
  429. "address": "0x58807c"
  430. },
  431. {
  432. "name": "GetFileSize",
  433. "address": "0x588080"
  434. },
  435. {
  436. "name": "CreateFileA",
  437. "address": "0x588084"
  438. },
  439. {
  440. "name": "VirtualProtect",
  441. "address": "0x588088"
  442. },
  443. {
  444. "name": "InitializeCriticalSection",
  445. "address": "0x58808c"
  446. },
  447. {
  448. "name": "GetModuleHandleA",
  449. "address": "0x588090"
  450. },
  451. {
  452. "name": "LoadLibraryA",
  453. "address": "0x588094"
  454. },
  455. {
  456. "name": "VirtualAlloc",
  457. "address": "0x588098"
  458. },
  459. {
  460. "name": "GetProcAddress",
  461. "address": "0x58809c"
  462. },
  463. {
  464. "name": "VirtualFree",
  465. "address": "0x5880a0"
  466. },
  467. {
  468. "name": "DeleteCriticalSection",
  469. "address": "0x5880a4"
  470. },
  471. {
  472. "name": "EnterCriticalSection",
  473. "address": "0x5880a8"
  474. },
  475. {
  476. "name": "SetStdHandle",
  477. "address": "0x5880ac"
  478. },
  479. {
  480. "name": "WriteConsoleW",
  481. "address": "0x5880b0"
  482. },
  483. {
  484. "name": "GetConsoleOutputCP",
  485. "address": "0x5880b4"
  486. },
  487. {
  488. "name": "WriteConsoleA",
  489. "address": "0x5880b8"
  490. },
  491. {
  492. "name": "GetLocaleInfoA",
  493. "address": "0x5880bc"
  494. },
  495. {
  496. "name": "GetStringTypeW",
  497. "address": "0x5880c0"
  498. },
  499. {
  500. "name": "GetStringTypeA",
  501. "address": "0x5880c4"
  502. },
  503. {
  504. "name": "LCMapStringW",
  505. "address": "0x5880c8"
  506. },
  507. {
  508. "name": "LCMapStringA",
  509. "address": "0x5880cc"
  510. },
  511. {
  512. "name": "QueryPerformanceCounter",
  513. "address": "0x5880d0"
  514. },
  515. {
  516. "name": "GetEnvironmentStringsW",
  517. "address": "0x5880d4"
  518. },
  519. {
  520. "name": "FreeEnvironmentStringsW",
  521. "address": "0x5880d8"
  522. },
  523. {
  524. "name": "GetEnvironmentStrings",
  525. "address": "0x5880dc"
  526. },
  527. {
  528. "name": "FreeEnvironmentStringsA",
  529. "address": "0x5880e0"
  530. },
  531. {
  532. "name": "InitializeCriticalSectionAndSpinCount",
  533. "address": "0x5880e4"
  534. },
  535. {
  536. "name": "GetTimeZoneInformation",
  537. "address": "0x5880e8"
  538. },
  539. {
  540. "name": "RtlUnwind",
  541. "address": "0x5880ec"
  542. },
  543. {
  544. "name": "FlushFileBuffers",
  545. "address": "0x5880f0"
  546. },
  547. {
  548. "name": "GetConsoleMode",
  549. "address": "0x5880f4"
  550. },
  551. {
  552. "name": "GetConsoleCP",
  553. "address": "0x5880f8"
  554. },
  555. {
  556. "name": "GetStartupInfoA",
  557. "address": "0x5880fc"
  558. },
  559. {
  560. "name": "GetFileType",
  561. "address": "0x588100"
  562. },
  563. {
  564. "name": "SetHandleCount",
  565. "address": "0x588104"
  566. },
  567. {
  568. "name": "SetLastError",
  569. "address": "0x588108"
  570. },
  571. {
  572. "name": "TlsFree",
  573. "address": "0x58810c"
  574. },
  575. {
  576. "name": "TlsSetValue",
  577. "address": "0x588110"
  578. },
  579. {
  580. "name": "TlsAlloc",
  581. "address": "0x588114"
  582. },
  583. {
  584. "name": "TlsGetValue",
  585. "address": "0x588118"
  586. },
  587. {
  588. "name": "IsValidCodePage",
  589. "address": "0x58811c"
  590. },
  591. {
  592. "name": "GetOEMCP",
  593. "address": "0x588120"
  594. },
  595. {
  596. "name": "GetACP",
  597. "address": "0x588124"
  598. },
  599. {
  600. "name": "InterlockedDecrement",
  601. "address": "0x588128"
  602. },
  603. {
  604. "name": "LeaveCriticalSection",
  605. "address": "0x58812c"
  606. },
  607. {
  608. "name": "InterlockedIncrement",
  609. "address": "0x588130"
  610. },
  611. {
  612. "name": "GetCPInfo",
  613. "address": "0x588134"
  614. },
  615. {
  616. "name": "GetStdHandle",
  617. "address": "0x588138"
  618. },
  619. {
  620. "name": "HeapReAlloc",
  621. "address": "0x58813c"
  622. },
  623. {
  624. "name": "GetSystemTimeAsFileTime",
  625. "address": "0x588140"
  626. },
  627. {
  628. "name": "GetModuleHandleW",
  629. "address": "0x588144"
  630. },
  631. {
  632. "name": "ExitProcess",
  633. "address": "0x588148"
  634. },
  635. {
  636. "name": "GetCommandLineA",
  637. "address": "0x58814c"
  638. },
  639. {
  640. "name": "UnhandledExceptionFilter",
  641. "address": "0x588150"
  642. },
  643. {
  644. "name": "IsDebuggerPresent",
  645. "address": "0x588154"
  646. },
  647. {
  648. "name": "HeapCreate",
  649. "address": "0x588158"
  650. },
  651. {
  652. "name": "SetEndOfFile",
  653. "address": "0x58815c"
  654. }
  655. ],
  656. "dll": "KERNEL32.dll"
  657. },
  658. {
  659. "imports": [
  660. {
  661. "name": "GetInputState",
  662. "address": "0x588164"
  663. },
  664. {
  665. "name": "PostThreadMessageW",
  666. "address": "0x588168"
  667. },
  668. {
  669. "name": "GetMessageA",
  670. "address": "0x58816c"
  671. },
  672. {
  673. "name": "PostThreadMessageA",
  674. "address": "0x588170"
  675. }
  676. ],
  677. "dll": "USER32.dll"
  678. },
  679. {
  680. "imports": [
  681. {
  682. "name": "RegQueryInfoKeyA",
  683. "address": "0x588178"
  684. },
  685. {
  686. "name": "RegCloseKey",
  687. "address": "0x58817c"
  688. },
  689. {
  690. "name": "RegOpenKeyExA",
  691. "address": "0x588180"
  692. },
  693. {
  694. "name": "RegEnumKeyExA",
  695. "address": "0x588184"
  696. },
  697. {
  698. "name": "RegQueryValueExA",
  699. "address": "0x588188"
  700. }
  701. ],
  702. "dll": "ADVAPI32.dll"
  703. },
  704. {
  705. "imports": [
  706. {
  707. "name": "inet_addr",
  708. "address": "0x588190"
  709. },
  710. {
  711. "name": "gethostbyname",
  712. "address": "0x588194"
  713. },
  714. {
  715. "name": "WSAStartup",
  716. "address": "0x588198"
  717. },
  718. {
  719. "name": "gethostname",
  720. "address": "0x58819c"
  721. },
  722. {
  723. "name": "inet_ntoa",
  724. "address": "0x5881a0"
  725. },
  726. {
  727. "name": "WSAGetLastError",
  728. "address": "0x5881a4"
  729. }
  730. ],
  731. "dll": "WS2_32.dll"
  732. },
  733. {
  734. "imports": [
  735. {
  736. "name": "GetAdaptersInfo",
  737. "address": "0x5881ac"
  738. }
  739. ],
  740. "dll": "IPHLPAPI.DLL"
  741. },
  742. {
  743. "imports": [
  744. {
  745. "name": "GetFileVersionInfoA",
  746. "address": "0x5881b4"
  747. },
  748. {
  749. "name": "GetFileVersionInfoSizeA",
  750. "address": "0x5881b8"
  751. },
  752. {
  753. "name": "VerQueryValueA",
  754. "address": "0x5881bc"
  755. }
  756. ],
  757. "dll": "VERSION.dll"
  758. },
  759. {
  760. "imports": [
  761. {
  762. "name": "LoadLibraryA",
  763. "address": "0x5881c4"
  764. },
  765. {
  766. "name": "GetProcAddress",
  767. "address": "0x5881c8"
  768. },
  769. {
  770. "name": "GetLastError",
  771. "address": "0x5881cc"
  772. },
  773. {
  774. "name": "FreeLibrary",
  775. "address": "0x5881d0"
  776. },
  777. {
  778. "name": "InitializeCriticalSection",
  779. "address": "0x5881d4"
  780. },
  781. {
  782. "name": "GetModuleFileNameW",
  783. "address": "0x5881d8"
  784. },
  785. {
  786. "name": "GetModuleHandleW",
  787. "address": "0x5881dc"
  788. },
  789. {
  790. "name": "TerminateProcess",
  791. "address": "0x5881e0"
  792. },
  793. {
  794. "name": "GetCurrentProcess",
  795. "address": "0x5881e4"
  796. },
  797. {
  798. "name": "DeleteCriticalSection",
  799. "address": "0x5881e8"
  800. },
  801. {
  802. "name": "LoadLibraryW",
  803. "address": "0x5881ec"
  804. },
  805. {
  806. "name": "CreateEventW",
  807. "address": "0x5881f0"
  808. },
  809. {
  810. "name": "CompareStringW",
  811. "address": "0x5881f4"
  812. },
  813. {
  814. "name": "SetLastError",
  815. "address": "0x5881f8"
  816. },
  817. {
  818. "name": "GetModuleHandleA",
  819. "address": "0x5881fc"
  820. },
  821. {
  822. "name": "VirtualProtect",
  823. "address": "0x588200"
  824. },
  825. {
  826. "name": "GetTickCount",
  827. "address": "0x588204"
  828. },
  829. {
  830. "name": "EnterCriticalSection",
  831. "address": "0x588208"
  832. },
  833. {
  834. "name": "LeaveCriticalSection",
  835. "address": "0x58820c"
  836. },
  837. {
  838. "name": "VirtualFree",
  839. "address": "0x588210"
  840. },
  841. {
  842. "name": "VirtualAlloc",
  843. "address": "0x588214"
  844. },
  845. {
  846. "name": "WriteProcessMemory",
  847. "address": "0x588218"
  848. },
  849. {
  850. "name": "CreateToolhelp32Snapshot",
  851. "address": "0x58821c"
  852. },
  853. {
  854. "name": "GetCurrentProcessId",
  855. "address": "0x588220"
  856. },
  857. {
  858. "name": "GetCurrentThreadId",
  859. "address": "0x588224"
  860. },
  861. {
  862. "name": "Thread32First",
  863. "address": "0x588228"
  864. },
  865. {
  866. "name": "OpenThread",
  867. "address": "0x58822c"
  868. },
  869. {
  870. "name": "Thread32Next",
  871. "address": "0x588230"
  872. },
  873. {
  874. "name": "CloseHandle",
  875. "address": "0x588234"
  876. },
  877. {
  878. "name": "SuspendThread",
  879. "address": "0x588238"
  880. },
  881. {
  882. "name": "ResumeThread",
  883. "address": "0x58823c"
  884. },
  885. {
  886. "name": "GetSystemInfo",
  887. "address": "0x588240"
  888. },
  889. {
  890. "name": "LoadResource",
  891. "address": "0x588244"
  892. },
  893. {
  894. "name": "MultiByteToWideChar",
  895. "address": "0x588248"
  896. },
  897. {
  898. "name": "WideCharToMultiByte",
  899. "address": "0x58824c"
  900. },
  901. {
  902. "name": "FindResourceExW",
  903. "address": "0x588250"
  904. },
  905. {
  906. "name": "FindResourceExA",
  907. "address": "0x588254"
  908. },
  909. {
  910. "name": "GetThreadLocale",
  911. "address": "0x588258"
  912. },
  913. {
  914. "name": "GetUserDefaultLCID",
  915. "address": "0x58825c"
  916. },
  917. {
  918. "name": "GetSystemDefaultLCID",
  919. "address": "0x588260"
  920. },
  921. {
  922. "name": "EnumResourceNamesA",
  923. "address": "0x588264"
  924. },
  925. {
  926. "name": "EnumResourceNamesW",
  927. "address": "0x588268"
  928. },
  929. {
  930. "name": "EnumResourceLanguagesA",
  931. "address": "0x58826c"
  932. },
  933. {
  934. "name": "EnumResourceLanguagesW",
  935. "address": "0x588270"
  936. },
  937. {
  938. "name": "EnumResourceTypesA",
  939. "address": "0x588274"
  940. },
  941. {
  942. "name": "EnumResourceTypesW",
  943. "address": "0x588278"
  944. },
  945. {
  946. "name": "HeapAlloc",
  947. "address": "0x58827c"
  948. },
  949. {
  950. "name": "HeapFree",
  951. "address": "0x588280"
  952. },
  953. {
  954. "name": "HeapDestroy",
  955. "address": "0x588284"
  956. },
  957. {
  958. "name": "HeapCreate",
  959. "address": "0x588288"
  960. },
  961. {
  962. "name": "GetSystemTime",
  963. "address": "0x58828c"
  964. },
  965. {
  966. "name": "GetLocalTime",
  967. "address": "0x588290"
  968. },
  969. {
  970. "name": "SystemTimeToFileTime",
  971. "address": "0x588294"
  972. },
  973. {
  974. "name": "CompareFileTime",
  975. "address": "0x588298"
  976. },
  977. {
  978. "name": "GetCommandLineA",
  979. "address": "0x58829c"
  980. },
  981. {
  982. "name": "GetCPInfo",
  983. "address": "0x5882a0"
  984. },
  985. {
  986. "name": "InterlockedIncrement",
  987. "address": "0x5882a4"
  988. },
  989. {
  990. "name": "InterlockedDecrement",
  991. "address": "0x5882a8"
  992. },
  993. {
  994. "name": "GetACP",
  995. "address": "0x5882ac"
  996. },
  997. {
  998. "name": "GetOEMCP",
  999. "address": "0x5882b0"
  1000. },
  1001. {
  1002. "name": "IsValidCodePage",
  1003. "address": "0x5882b4"
  1004. },
  1005. {
  1006. "name": "TlsGetValue",
  1007. "address": "0x5882b8"
  1008. },
  1009. {
  1010. "name": "TlsAlloc",
  1011. "address": "0x5882bc"
  1012. },
  1013. {
  1014. "name": "TlsSetValue",
  1015. "address": "0x5882c0"
  1016. },
  1017. {
  1018. "name": "TlsFree",
  1019. "address": "0x5882c4"
  1020. },
  1021. {
  1022. "name": "LCMapStringA",
  1023. "address": "0x5882c8"
  1024. },
  1025. {
  1026. "name": "LCMapStringW",
  1027. "address": "0x5882cc"
  1028. },
  1029. {
  1030. "name": "UnhandledExceptionFilter",
  1031. "address": "0x5882d0"
  1032. },
  1033. {
  1034. "name": "SetUnhandledExceptionFilter",
  1035. "address": "0x5882d4"
  1036. },
  1037. {
  1038. "name": "IsDebuggerPresent",
  1039. "address": "0x5882d8"
  1040. },
  1041. {
  1042. "name": "WriteFile",
  1043. "address": "0x5882dc"
  1044. },
  1045. {
  1046. "name": "GetStdHandle",
  1047. "address": "0x5882e0"
  1048. },
  1049. {
  1050. "name": "GetModuleFileNameA",
  1051. "address": "0x5882e4"
  1052. },
  1053. {
  1054. "name": "RaiseException",
  1055. "address": "0x5882e8"
  1056. },
  1057. {
  1058. "name": "Sleep",
  1059. "address": "0x5882ec"
  1060. },
  1061. {
  1062. "name": "ExitProcess",
  1063. "address": "0x5882f0"
  1064. },
  1065. {
  1066. "name": "SetHandleCount",
  1067. "address": "0x5882f4"
  1068. },
  1069. {
  1070. "name": "GetFileType",
  1071. "address": "0x5882f8"
  1072. },
  1073. {
  1074. "name": "GetStartupInfoA",
  1075. "address": "0x5882fc"
  1076. },
  1077. {
  1078. "name": "FreeEnvironmentStringsA",
  1079. "address": "0x588300"
  1080. },
  1081. {
  1082. "name": "GetEnvironmentStrings",
  1083. "address": "0x588304"
  1084. },
  1085. {
  1086. "name": "FreeEnvironmentStringsW",
  1087. "address": "0x588308"
  1088. },
  1089. {
  1090. "name": "GetEnvironmentStringsW",
  1091. "address": "0x58830c"
  1092. },
  1093. {
  1094. "name": "QueryPerformanceCounter",
  1095. "address": "0x588310"
  1096. },
  1097. {
  1098. "name": "GetSystemTimeAsFileTime",
  1099. "address": "0x588314"
  1100. },
  1101. {
  1102. "name": "HeapReAlloc",
  1103. "address": "0x588318"
  1104. },
  1105. {
  1106. "name": "GetStringTypeA",
  1107. "address": "0x58831c"
  1108. },
  1109. {
  1110. "name": "GetStringTypeW",
  1111. "address": "0x588320"
  1112. },
  1113. {
  1114. "name": "GetLocaleInfoA",
  1115. "address": "0x588324"
  1116. },
  1117. {
  1118. "name": "RtlUnwind",
  1119. "address": "0x588328"
  1120. },
  1121. {
  1122. "name": "HeapSize",
  1123. "address": "0x58832c"
  1124. },
  1125. {
  1126. "name": "SetFilePointer",
  1127. "address": "0x588330"
  1128. },
  1129. {
  1130. "name": "GetConsoleCP",
  1131. "address": "0x588334"
  1132. },
  1133. {
  1134. "name": "GetConsoleMode",
  1135. "address": "0x588338"
  1136. },
  1137. {
  1138. "name": "InitializeCriticalSectionAndSpinCount",
  1139. "address": "0x58833c"
  1140. },
  1141. {
  1142. "name": "SetStdHandle",
  1143. "address": "0x588340"
  1144. },
  1145. {
  1146. "name": "WriteConsoleA",
  1147. "address": "0x588344"
  1148. },
  1149. {
  1150. "name": "GetConsoleOutputCP",
  1151. "address": "0x588348"
  1152. },
  1153. {
  1154. "name": "WriteConsoleW",
  1155. "address": "0x58834c"
  1156. },
  1157. {
  1158. "name": "CreateFileA",
  1159. "address": "0x588350"
  1160. },
  1161. {
  1162. "name": "FlushFileBuffers",
  1163. "address": "0x588354"
  1164. },
  1165. {
  1166. "name": "VirtualQuery",
  1167. "address": "0x588358"
  1168. }
  1169. ],
  1170. "dll": "KERNEL32.dll"
  1171. },
  1172. {
  1173. "imports": [
  1174. {
  1175. "name": "MessageBoxW",
  1176. "address": "0x588360"
  1177. },
  1178. {
  1179. "name": "CharUpperBuffW",
  1180. "address": "0x588364"
  1181. }
  1182. ],
  1183. "dll": "USER32.dll"
  1184. },
  1185. {
  1186. "imports": [
  1187. {
  1188. "name": "GetModuleFileNameW",
  1189. "address": "0x58836c"
  1190. }
  1191. ],
  1192. "dll": "KERNEL32.dll"
  1193. },
  1194. {
  1195. "imports": [
  1196. {
  1197. "name": "GetModuleHandleA",
  1198. "address": "0x588374"
  1199. },
  1200. {
  1201. "name": "LoadLibraryA",
  1202. "address": "0x588378"
  1203. },
  1204. {
  1205. "name": "LocalAlloc",
  1206. "address": "0x58837c"
  1207. },
  1208. {
  1209. "name": "LocalFree",
  1210. "address": "0x588380"
  1211. },
  1212. {
  1213. "name": "GetModuleFileNameA",
  1214. "address": "0x588384"
  1215. },
  1216. {
  1217. "name": "ExitProcess",
  1218. "address": "0x588388"
  1219. }
  1220. ],
  1221. "dll": "KERNEL32.dll"
  1222. }
  1223. ],
  1224. "digital_signers": null,
  1225. "exported_dll_name": "",
  1226. "actual_checksum": "0x001995e9",
  1227. "overlay": null,
  1228. "imagebase": "0x00400000",
  1229. "reported_checksum": "0x001995e9",
  1230. "icon_hash": null,
  1231. "entrypoint": "0x0058c1b8",
  1232. "timestamp": "2018-11-24 02:02:51",
  1233. "osversion": "5.0",
  1234. "sections": [
  1235. {
  1236. "name": ".text",
  1237. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1238. "virtual_address": "0x00001000",
  1239. "size_of_data": "0x0001e000",
  1240. "entropy": "6.52",
  1241. "raw_address": "0x00000400",
  1242. "virtual_size": "0x0001de52",
  1243. "characteristics_raw": "0x60000020"
  1244. },
  1245. {
  1246. "name": ".rdata",
  1247. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1248. "virtual_address": "0x0001f000",
  1249. "size_of_data": "0x00008200",
  1250. "entropy": "6.61",
  1251. "raw_address": "0x0001e400",
  1252. "virtual_size": "0x000081b2",
  1253. "characteristics_raw": "0x40000040"
  1254. },
  1255. {
  1256. "name": ".data",
  1257. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1258. "virtual_address": "0x00028000",
  1259. "size_of_data": "0x00001a00",
  1260. "entropy": "3.74",
  1261. "raw_address": "0x00026600",
  1262. "virtual_size": "0x000036c4",
  1263. "characteristics_raw": "0xc0000040"
  1264. },
  1265. {
  1266. "name": ".vmp0",
  1267. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1268. "virtual_address": "0x0002c000",
  1269. "size_of_data": "0x00158600",
  1270. "entropy": "7.85",
  1271. "raw_address": "0x00028000",
  1272. "virtual_size": "0x001584ae",
  1273. "characteristics_raw": "0xe0000060"
  1274. },
  1275. {
  1276. "name": ".tls",
  1277. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1278. "virtual_address": "0x00185000",
  1279. "size_of_data": "0x00000200",
  1280. "entropy": "0.00",
  1281. "raw_address": "0x00180600",
  1282. "virtual_size": "0x00000018",
  1283. "characteristics_raw": "0xc0000040"
  1284. },
  1285. {
  1286. "name": ".vmp1",
  1287. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1288. "virtual_address": "0x00186000",
  1289. "size_of_data": "0x00011e00",
  1290. "entropy": "7.48",
  1291. "raw_address": "0x00180800",
  1292. "virtual_size": "0x00011c93",
  1293. "characteristics_raw": "0xe0000060"
  1294. },
  1295. {
  1296. "name": ".reloc",
  1297. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1298. "virtual_address": "0x00198000",
  1299. "size_of_data": "0x00002800",
  1300. "entropy": "6.44",
  1301. "raw_address": "0x00192600",
  1302. "virtual_size": "0x000026d8",
  1303. "characteristics_raw": "0x40000040"
  1304. },
  1305. {
  1306. "name": ".rsrc",
  1307. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1308. "virtual_address": "0x0019b000",
  1309. "size_of_data": "0x00000400",
  1310. "entropy": "3.92",
  1311. "raw_address": "0x00194e00",
  1312. "virtual_size": "0x00000352",
  1313. "characteristics_raw": "0x40000040"
  1314. }
  1315. ],
  1316. "resources": [],
  1317. "dirents": [
  1318. {
  1319. "virtual_address": "0x0018385e",
  1320. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1321. "size": "0x00000c50"
  1322. },
  1323. {
  1324. "virtual_address": "0x001910ec",
  1325. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1326. "size": "0x000000dc"
  1327. },
  1328. {
  1329. "virtual_address": "0x0019b000",
  1330. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1331. "size": "0x00000352"
  1332. },
  1333. {
  1334. "virtual_address": "0x00000000",
  1335. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1336. "size": "0x00000000"
  1337. },
  1338. {
  1339. "virtual_address": "0x00000000",
  1340. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1341. "size": "0x00000000"
  1342. },
  1343. {
  1344. "virtual_address": "0x00198000",
  1345. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1346. "size": "0x000026d8"
  1347. },
  1348. {
  1349. "virtual_address": "0x00000000",
  1350. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1351. "size": "0x00000000"
  1352. },
  1353. {
  1354. "virtual_address": "0x00000000",
  1355. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1356. "size": "0x00000000"
  1357. },
  1358. {
  1359. "virtual_address": "0x00000000",
  1360. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1361. "size": "0x00000000"
  1362. },
  1363. {
  1364. "virtual_address": "0x0019374c",
  1365. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1366. "size": "0x00000020"
  1367. },
  1368. {
  1369. "virtual_address": "0x00026270",
  1370. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1371. "size": "0x00000040"
  1372. },
  1373. {
  1374. "virtual_address": "0x00000000",
  1375. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1376. "size": "0x00000000"
  1377. },
  1378. {
  1379. "virtual_address": "0x00188000",
  1380. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1381. "size": "0x00000390"
  1382. },
  1383. {
  1384. "virtual_address": "0x00000000",
  1385. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1386. "size": "0x00000000"
  1387. },
  1388. {
  1389. "virtual_address": "0x00000000",
  1390. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1391. "size": "0x00000000"
  1392. },
  1393. {
  1394. "virtual_address": "0x00000000",
  1395. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1396. "size": "0x00000000"
  1397. }
  1398. ],
  1399. "exports": [],
  1400. "guest_signers": {},
  1401. "imphash": "2c4b653e617da18516332d4c0ab46237",
  1402. "icon_fuzzy": null,
  1403. "icon": null,
  1404. "pdbpath": null,
  1405. "imported_dll_count": 10,
  1406. "versioninfo": []
  1407. }
  1408. }
  1409.  
  1410. [*] Resolved APIs: [
  1411. "kernel32.dll.FlsAlloc",
  1412. "kernel32.dll.FlsGetValue",
  1413. "kernel32.dll.FlsSetValue",
  1414. "kernel32.dll.FlsFree",
  1415. "kernel32.dll.IsProcessorFeaturePresent",
  1416. "kernel32.dll.DeleteProcThreadAttributeList",
  1417. "kernel32.dll.FindResourceA",
  1418. "kernel32.dll.FreeResource",
  1419. "kernel32.dll.LoadResource",
  1420. "kernel32.dll.HeapAlloc",
  1421. "kernel32.dll.SetUnhandledExceptionFilter",
  1422. "kernel32.dll.GetCurrentProcess",
  1423. "kernel32.dll.UpdateProcThreadAttribute",
  1424. "kernel32.dll.HeapFree",
  1425. "kernel32.dll.GetModuleHandleW",
  1426. "kernel32.dll.GetProcessHeap",
  1427. "kernel32.dll.GetWindowsDirectoryA",
  1428. "kernel32.dll.OpenProcess",
  1429. "kernel32.dll.WideCharToMultiByte",
  1430. "kernel32.dll.LoadLibraryW",
  1431. "kernel32.dll.SizeofResource",
  1432. "kernel32.dll.GetFileAttributesA",
  1433. "kernel32.dll.CreateProcessA",
  1434. "kernel32.dll.GetSystemDirectoryA",
  1435. "kernel32.dll.MultiByteToWideChar",
  1436. "kernel32.dll.CreateDirectoryA",
  1437. "kernel32.dll.Process32FirstW",
  1438. "kernel32.dll.OpenMutexA",
  1439. "kernel32.dll.MoveFileA",
  1440. "kernel32.dll.LockResource",
  1441. "kernel32.dll.DeviceIoControl",
  1442. "kernel32.dll.Process32NextW",
  1443. "kernel32.dll.CreateMutexA",
  1444. "kernel32.dll.CreateToolhelp32Snapshot",
  1445. "kernel32.dll.GetCurrentThreadId",
  1446. "kernel32.dll.ReleaseMutex",
  1447. "kernel32.dll.WinExec",
  1448. "kernel32.dll.InitializeProcThreadAttributeList",
  1449. "kernel32.dll.GetCurrentProcessId",
  1450. "kernel32.dll.OpenFileMappingA",
  1451. "kernel32.dll.Sleep",
  1452. "kernel32.dll.CreateFileW",
  1453. "kernel32.dll.SetProcessWorkingSetSize",
  1454. "kernel32.dll.CreateRemoteThread",
  1455. "kernel32.dll.VirtualFreeEx",
  1456. "kernel32.dll.SetFileAttributesA",
  1457. "kernel32.dll.VirtualAllocEx",
  1458. "kernel32.dll.VirtualQueryEx",
  1459. "kernel32.dll.TerminateProcess",
  1460. "kernel32.dll.GetModuleFileNameW",
  1461. "kernel32.dll.FreeLibraryAndExitThread",
  1462. "kernel32.dll.SetEnvironmentVariableA",
  1463. "kernel32.dll.CompareStringW",
  1464. "kernel32.dll.CompareStringA",
  1465. "kernel32.dll.WriteConsoleW",
  1466. "kernel32.dll.GetConsoleOutputCP",
  1467. "kernel32.dll.WriteConsoleA",
  1468. "kernel32.dll.CreateThread",
  1469. "kernel32.dll.DeleteFileA",
  1470. "kernel32.dll.ResumeThread",
  1471. "kernel32.dll.GetModuleFileNameA",
  1472. "kernel32.dll.GetLastError",
  1473. "kernel32.dll.ReadFile",
  1474. "kernel32.dll.WriteFile",
  1475. "kernel32.dll.WaitForSingleObject",
  1476. "kernel32.dll.SetFilePointer",
  1477. "kernel32.dll.CloseHandle",
  1478. "kernel32.dll.CreateFileMappingA",
  1479. "kernel32.dll.GetTickCount",
  1480. "kernel32.dll.MapViewOfFile",
  1481. "kernel32.dll.GetFileSize",
  1482. "kernel32.dll.CreateFileA",
  1483. "kernel32.dll.InitializeCriticalSection",
  1484. "kernel32.dll.VirtualProtect",
  1485. "kernel32.dll.GetModuleHandleA",
  1486. "kernel32.dll.LoadLibraryA",
  1487. "kernel32.dll.VirtualAlloc",
  1488. "kernel32.dll.GetProcAddress",
  1489. "kernel32.dll.VirtualFree",
  1490. "kernel32.dll.DeleteCriticalSection",
  1491. "kernel32.dll.EnterCriticalSection",
  1492. "kernel32.dll.SetStdHandle",
  1493. "kernel32.dll.GetLocaleInfoA",
  1494. "kernel32.dll.GetStringTypeW",
  1495. "kernel32.dll.GetStringTypeA",
  1496. "kernel32.dll.LCMapStringA",
  1497. "kernel32.dll.QueryPerformanceCounter",
  1498. "kernel32.dll.GetEnvironmentStringsW",
  1499. "kernel32.dll.FreeEnvironmentStringsW",
  1500. "kernel32.dll.GetEnvironmentStrings",
  1501. "kernel32.dll.FreeEnvironmentStringsA",
  1502. "kernel32.dll.LCMapStringW",
  1503. "kernel32.dll.HeapSize",
  1504. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  1505. "kernel32.dll.GetTimeZoneInformation",
  1506. "kernel32.dll.FlushFileBuffers",
  1507. "kernel32.dll.RaiseException",
  1508. "kernel32.dll.GetConsoleMode",
  1509. "kernel32.dll.GetConsoleCP",
  1510. "kernel32.dll.RtlUnwind",
  1511. "kernel32.dll.GetStartupInfoA",
  1512. "kernel32.dll.GetFileType",
  1513. "kernel32.dll.SetHandleCount",
  1514. "kernel32.dll.SetLastError",
  1515. "kernel32.dll.TlsFree",
  1516. "kernel32.dll.TlsSetValue",
  1517. "kernel32.dll.TlsAlloc",
  1518. "kernel32.dll.TlsGetValue",
  1519. "kernel32.dll.IsValidCodePage",
  1520. "kernel32.dll.GetOEMCP",
  1521. "kernel32.dll.GetACP",
  1522. "kernel32.dll.InterlockedDecrement",
  1523. "kernel32.dll.InterlockedIncrement",
  1524. "kernel32.dll.GetCPInfo",
  1525. "kernel32.dll.GetStdHandle",
  1526. "kernel32.dll.HeapReAlloc",
  1527. "kernel32.dll.HeapDestroy",
  1528. "kernel32.dll.HeapCreate",
  1529. "kernel32.dll.IsDebuggerPresent",
  1530. "kernel32.dll.UnhandledExceptionFilter",
  1531. "kernel32.dll.GetCommandLineA",
  1532. "kernel32.dll.ExitProcess",
  1533. "kernel32.dll.GetSystemTimeAsFileTime",
  1534. "kernel32.dll.LeaveCriticalSection",
  1535. "kernel32.dll.WriteProcessMemory",
  1536. "kernel32.dll.SetEndOfFile",
  1537. "user32.dll.GetWindowThreadProcessId",
  1538. "user32.dll.FindWindowA",
  1539. "advapi32.dll.RegCloseKey",
  1540. "advapi32.dll.AdjustTokenPrivileges",
  1541. "advapi32.dll.OpenSCManagerA",
  1542. "advapi32.dll.RegQueryInfoKeyA",
  1543. "advapi32.dll.RegOpenKeyExA",
  1544. "advapi32.dll.LookupPrivilegeValueW",
  1545. "advapi32.dll.StartServiceA",
  1546. "advapi32.dll.RegEnumKeyExA",
  1547. "advapi32.dll.CreateServiceA",
  1548. "advapi32.dll.RegQueryValueExA",
  1549. "advapi32.dll.OpenProcessToken",
  1550. "advapi32.dll.CloseServiceHandle",
  1551. "advapi32.dll.OpenServiceA",
  1552. "advapi32.dll.CreateProcessAsUserA",
  1553. "shell32.dll.SHGetSpecialFolderPathA",
  1554. "ole32.dll.CoInitialize",
  1555. "ole32.dll.CoCreateGuid",
  1556. "ws2_32.dll.#17",
  1557. "ws2_32.dll.#11",
  1558. "ws2_32.dll.#115",
  1559. "ws2_32.dll.#9",
  1560. "ws2_32.dll.#22",
  1561. "ws2_32.dll.#21",
  1562. "ws2_32.dll.#20",
  1563. "ws2_32.dll.#16",
  1564. "ws2_32.dll.#12",
  1565. "ws2_32.dll.#23",
  1566. "ws2_32.dll.#151",
  1567. "ws2_32.dll.#3",
  1568. "ws2_32.dll.#52",
  1569. "ws2_32.dll.#19",
  1570. "ws2_32.dll.#13",
  1571. "ws2_32.dll.#1",
  1572. "ws2_32.dll.#8",
  1573. "ws2_32.dll.#4",
  1574. "ws2_32.dll.#116",
  1575. "ws2_32.dll.#111",
  1576. "ws2_32.dll.#2",
  1577. "ws2_32.dll.#57",
  1578. "ws2_32.dll.#18",
  1579. "ws2_32.dll.#5",
  1580. "imagehlp.dll.CheckSumMappedFile",
  1581. "urlmon.dll.URLDownloadToFileA",
  1582. "userenv.dll.CreateEnvironmentBlock",
  1583. "userenv.dll.DestroyEnvironmentBlock",
  1584. "iphlpapi.dll.GetAdaptersInfo",
  1585. "shlwapi.dll.StrStrIA",
  1586. "psapi.dll.GetModuleFileNameExW",
  1587. "psapi.dll.EnumProcessModules",
  1588. "psapi.dll.EnumProcesses",
  1589. "cryptbase.dll.SystemFunction036",
  1590. "uxtheme.dll.ThemeInitApiHook",
  1591. "user32.dll.IsProcessDPIAware",
  1592. "sechost.dll.ConvertSidToStringSidW",
  1593. "sspicli.dll.GetUserNameExW",
  1594. "njhuwu0.dll.R0010002",
  1595. "kernel32.dll.RtlPcToFileHeader",
  1596. "kernel32.dll.RtlUnwindEx",
  1597. "kernel32.dll.HeapSetInformation",
  1598. "kernel32.dll.RtlCaptureContext",
  1599. "kernel32.dll.RtlLookupFunctionEntry",
  1600. "kernel32.dll.RtlVirtualUnwind"
  1601. ]
  1602.  
  1603. [*] Static Analysis: {
  1604. "pe": {
  1605. "peid_signatures": null,
  1606. "imports": [
  1607. {
  1608. "imports": [
  1609. {
  1610. "name": "FindResourceA",
  1611. "address": "0x588000"
  1612. },
  1613. {
  1614. "name": "FreeResource",
  1615. "address": "0x588004"
  1616. },
  1617. {
  1618. "name": "LoadResource",
  1619. "address": "0x588008"
  1620. },
  1621. {
  1622. "name": "HeapAlloc",
  1623. "address": "0x58800c"
  1624. },
  1625. {
  1626. "name": "SetUnhandledExceptionFilter",
  1627. "address": "0x588010"
  1628. },
  1629. {
  1630. "name": "GetCurrentProcess",
  1631. "address": "0x588014"
  1632. },
  1633. {
  1634. "name": "HeapFree",
  1635. "address": "0x588018"
  1636. },
  1637. {
  1638. "name": "GetTickCount",
  1639. "address": "0x58801c"
  1640. },
  1641. {
  1642. "name": "GetProcessHeap",
  1643. "address": "0x588020"
  1644. },
  1645. {
  1646. "name": "WideCharToMultiByte",
  1647. "address": "0x588024"
  1648. },
  1649. {
  1650. "name": "SizeofResource",
  1651. "address": "0x588028"
  1652. },
  1653. {
  1654. "name": "GetVersionExW",
  1655. "address": "0x58802c"
  1656. },
  1657. {
  1658. "name": "MultiByteToWideChar",
  1659. "address": "0x588030"
  1660. },
  1661. {
  1662. "name": "OpenMutexA",
  1663. "address": "0x588034"
  1664. },
  1665. {
  1666. "name": "LockResource",
  1667. "address": "0x588038"
  1668. },
  1669. {
  1670. "name": "GetCurrentThreadId",
  1671. "address": "0x58803c"
  1672. },
  1673. {
  1674. "name": "ReleaseMutex",
  1675. "address": "0x588040"
  1676. },
  1677. {
  1678. "name": "GetCurrentProcessId",
  1679. "address": "0x588044"
  1680. },
  1681. {
  1682. "name": "Sleep",
  1683. "address": "0x588048"
  1684. },
  1685. {
  1686. "name": "TerminateProcess",
  1687. "address": "0x58804c"
  1688. },
  1689. {
  1690. "name": "SetFileAttributesA",
  1691. "address": "0x588050"
  1692. },
  1693. {
  1694. "name": "HeapSize",
  1695. "address": "0x588054"
  1696. },
  1697. {
  1698. "name": "SetEnvironmentVariableA",
  1699. "address": "0x588058"
  1700. },
  1701. {
  1702. "name": "CompareStringW",
  1703. "address": "0x58805c"
  1704. },
  1705. {
  1706. "name": "CompareStringA",
  1707. "address": "0x588060"
  1708. },
  1709. {
  1710. "name": "DeleteFileA",
  1711. "address": "0x588064"
  1712. },
  1713. {
  1714. "name": "CloseHandle",
  1715. "address": "0x588068"
  1716. },
  1717. {
  1718. "name": "GetModuleFileNameA",
  1719. "address": "0x58806c"
  1720. },
  1721. {
  1722. "name": "GetLastError",
  1723. "address": "0x588070"
  1724. },
  1725. {
  1726. "name": "ReadFile",
  1727. "address": "0x588074"
  1728. },
  1729. {
  1730. "name": "WriteFile",
  1731. "address": "0x588078"
  1732. },
  1733. {
  1734. "name": "SetFilePointer",
  1735. "address": "0x58807c"
  1736. },
  1737. {
  1738. "name": "GetFileSize",
  1739. "address": "0x588080"
  1740. },
  1741. {
  1742. "name": "CreateFileA",
  1743. "address": "0x588084"
  1744. },
  1745. {
  1746. "name": "VirtualProtect",
  1747. "address": "0x588088"
  1748. },
  1749. {
  1750. "name": "InitializeCriticalSection",
  1751. "address": "0x58808c"
  1752. },
  1753. {
  1754. "name": "GetModuleHandleA",
  1755. "address": "0x588090"
  1756. },
  1757. {
  1758. "name": "LoadLibraryA",
  1759. "address": "0x588094"
  1760. },
  1761. {
  1762. "name": "VirtualAlloc",
  1763. "address": "0x588098"
  1764. },
  1765. {
  1766. "name": "GetProcAddress",
  1767. "address": "0x58809c"
  1768. },
  1769. {
  1770. "name": "VirtualFree",
  1771. "address": "0x5880a0"
  1772. },
  1773. {
  1774. "name": "DeleteCriticalSection",
  1775. "address": "0x5880a4"
  1776. },
  1777. {
  1778. "name": "EnterCriticalSection",
  1779. "address": "0x5880a8"
  1780. },
  1781. {
  1782. "name": "SetStdHandle",
  1783. "address": "0x5880ac"
  1784. },
  1785. {
  1786. "name": "WriteConsoleW",
  1787. "address": "0x5880b0"
  1788. },
  1789. {
  1790. "name": "GetConsoleOutputCP",
  1791. "address": "0x5880b4"
  1792. },
  1793. {
  1794. "name": "WriteConsoleA",
  1795. "address": "0x5880b8"
  1796. },
  1797. {
  1798. "name": "GetLocaleInfoA",
  1799. "address": "0x5880bc"
  1800. },
  1801. {
  1802. "name": "GetStringTypeW",
  1803. "address": "0x5880c0"
  1804. },
  1805. {
  1806. "name": "GetStringTypeA",
  1807. "address": "0x5880c4"
  1808. },
  1809. {
  1810. "name": "LCMapStringW",
  1811. "address": "0x5880c8"
  1812. },
  1813. {
  1814. "name": "LCMapStringA",
  1815. "address": "0x5880cc"
  1816. },
  1817. {
  1818. "name": "QueryPerformanceCounter",
  1819. "address": "0x5880d0"
  1820. },
  1821. {
  1822. "name": "GetEnvironmentStringsW",
  1823. "address": "0x5880d4"
  1824. },
  1825. {
  1826. "name": "FreeEnvironmentStringsW",
  1827. "address": "0x5880d8"
  1828. },
  1829. {
  1830. "name": "GetEnvironmentStrings",
  1831. "address": "0x5880dc"
  1832. },
  1833. {
  1834. "name": "FreeEnvironmentStringsA",
  1835. "address": "0x5880e0"
  1836. },
  1837. {
  1838. "name": "InitializeCriticalSectionAndSpinCount",
  1839. "address": "0x5880e4"
  1840. },
  1841. {
  1842. "name": "GetTimeZoneInformation",
  1843. "address": "0x5880e8"
  1844. },
  1845. {
  1846. "name": "RtlUnwind",
  1847. "address": "0x5880ec"
  1848. },
  1849. {
  1850. "name": "FlushFileBuffers",
  1851. "address": "0x5880f0"
  1852. },
  1853. {
  1854. "name": "GetConsoleMode",
  1855. "address": "0x5880f4"
  1856. },
  1857. {
  1858. "name": "GetConsoleCP",
  1859. "address": "0x5880f8"
  1860. },
  1861. {
  1862. "name": "GetStartupInfoA",
  1863. "address": "0x5880fc"
  1864. },
  1865. {
  1866. "name": "GetFileType",
  1867. "address": "0x588100"
  1868. },
  1869. {
  1870. "name": "SetHandleCount",
  1871. "address": "0x588104"
  1872. },
  1873. {
  1874. "name": "SetLastError",
  1875. "address": "0x588108"
  1876. },
  1877. {
  1878. "name": "TlsFree",
  1879. "address": "0x58810c"
  1880. },
  1881. {
  1882. "name": "TlsSetValue",
  1883. "address": "0x588110"
  1884. },
  1885. {
  1886. "name": "TlsAlloc",
  1887. "address": "0x588114"
  1888. },
  1889. {
  1890. "name": "TlsGetValue",
  1891. "address": "0x588118"
  1892. },
  1893. {
  1894. "name": "IsValidCodePage",
  1895. "address": "0x58811c"
  1896. },
  1897. {
  1898. "name": "GetOEMCP",
  1899. "address": "0x588120"
  1900. },
  1901. {
  1902. "name": "GetACP",
  1903. "address": "0x588124"
  1904. },
  1905. {
  1906. "name": "InterlockedDecrement",
  1907. "address": "0x588128"
  1908. },
  1909. {
  1910. "name": "LeaveCriticalSection",
  1911. "address": "0x58812c"
  1912. },
  1913. {
  1914. "name": "InterlockedIncrement",
  1915. "address": "0x588130"
  1916. },
  1917. {
  1918. "name": "GetCPInfo",
  1919. "address": "0x588134"
  1920. },
  1921. {
  1922. "name": "GetStdHandle",
  1923. "address": "0x588138"
  1924. },
  1925. {
  1926. "name": "HeapReAlloc",
  1927. "address": "0x58813c"
  1928. },
  1929. {
  1930. "name": "GetSystemTimeAsFileTime",
  1931. "address": "0x588140"
  1932. },
  1933. {
  1934. "name": "GetModuleHandleW",
  1935. "address": "0x588144"
  1936. },
  1937. {
  1938. "name": "ExitProcess",
  1939. "address": "0x588148"
  1940. },
  1941. {
  1942. "name": "GetCommandLineA",
  1943. "address": "0x58814c"
  1944. },
  1945. {
  1946. "name": "UnhandledExceptionFilter",
  1947. "address": "0x588150"
  1948. },
  1949. {
  1950. "name": "IsDebuggerPresent",
  1951. "address": "0x588154"
  1952. },
  1953. {
  1954. "name": "HeapCreate",
  1955. "address": "0x588158"
  1956. },
  1957. {
  1958. "name": "SetEndOfFile",
  1959. "address": "0x58815c"
  1960. }
  1961. ],
  1962. "dll": "KERNEL32.dll"
  1963. },
  1964. {
  1965. "imports": [
  1966. {
  1967. "name": "GetInputState",
  1968. "address": "0x588164"
  1969. },
  1970. {
  1971. "name": "PostThreadMessageW",
  1972. "address": "0x588168"
  1973. },
  1974. {
  1975. "name": "GetMessageA",
  1976. "address": "0x58816c"
  1977. },
  1978. {
  1979. "name": "PostThreadMessageA",
  1980. "address": "0x588170"
  1981. }
  1982. ],
  1983. "dll": "USER32.dll"
  1984. },
  1985. {
  1986. "imports": [
  1987. {
  1988. "name": "RegQueryInfoKeyA",
  1989. "address": "0x588178"
  1990. },
  1991. {
  1992. "name": "RegCloseKey",
  1993. "address": "0x58817c"
  1994. },
  1995. {
  1996. "name": "RegOpenKeyExA",
  1997. "address": "0x588180"
  1998. },
  1999. {
  2000. "name": "RegEnumKeyExA",
  2001. "address": "0x588184"
  2002. },
  2003. {
  2004. "name": "RegQueryValueExA",
  2005. "address": "0x588188"
  2006. }
  2007. ],
  2008. "dll": "ADVAPI32.dll"
  2009. },
  2010. {
  2011. "imports": [
  2012. {
  2013. "name": "inet_addr",
  2014. "address": "0x588190"
  2015. },
  2016. {
  2017. "name": "gethostbyname",
  2018. "address": "0x588194"
  2019. },
  2020. {
  2021. "name": "WSAStartup",
  2022. "address": "0x588198"
  2023. },
  2024. {
  2025. "name": "gethostname",
  2026. "address": "0x58819c"
  2027. },
  2028. {
  2029. "name": "inet_ntoa",
  2030. "address": "0x5881a0"
  2031. },
  2032. {
  2033. "name": "WSAGetLastError",
  2034. "address": "0x5881a4"
  2035. }
  2036. ],
  2037. "dll": "WS2_32.dll"
  2038. },
  2039. {
  2040. "imports": [
  2041. {
  2042. "name": "GetAdaptersInfo",
  2043. "address": "0x5881ac"
  2044. }
  2045. ],
  2046. "dll": "IPHLPAPI.DLL"
  2047. },
  2048. {
  2049. "imports": [
  2050. {
  2051. "name": "GetFileVersionInfoA",
  2052. "address": "0x5881b4"
  2053. },
  2054. {
  2055. "name": "GetFileVersionInfoSizeA",
  2056. "address": "0x5881b8"
  2057. },
  2058. {
  2059. "name": "VerQueryValueA",
  2060. "address": "0x5881bc"
  2061. }
  2062. ],
  2063. "dll": "VERSION.dll"
  2064. },
  2065. {
  2066. "imports": [
  2067. {
  2068. "name": "LoadLibraryA",
  2069. "address": "0x5881c4"
  2070. },
  2071. {
  2072. "name": "GetProcAddress",
  2073. "address": "0x5881c8"
  2074. },
  2075. {
  2076. "name": "GetLastError",
  2077. "address": "0x5881cc"
  2078. },
  2079. {
  2080. "name": "FreeLibrary",
  2081. "address": "0x5881d0"
  2082. },
  2083. {
  2084. "name": "InitializeCriticalSection",
  2085. "address": "0x5881d4"
  2086. },
  2087. {
  2088. "name": "GetModuleFileNameW",
  2089. "address": "0x5881d8"
  2090. },
  2091. {
  2092. "name": "GetModuleHandleW",
  2093. "address": "0x5881dc"
  2094. },
  2095. {
  2096. "name": "TerminateProcess",
  2097. "address": "0x5881e0"
  2098. },
  2099. {
  2100. "name": "GetCurrentProcess",
  2101. "address": "0x5881e4"
  2102. },
  2103. {
  2104. "name": "DeleteCriticalSection",
  2105. "address": "0x5881e8"
  2106. },
  2107. {
  2108. "name": "LoadLibraryW",
  2109. "address": "0x5881ec"
  2110. },
  2111. {
  2112. "name": "CreateEventW",
  2113. "address": "0x5881f0"
  2114. },
  2115. {
  2116. "name": "CompareStringW",
  2117. "address": "0x5881f4"
  2118. },
  2119. {
  2120. "name": "SetLastError",
  2121. "address": "0x5881f8"
  2122. },
  2123. {
  2124. "name": "GetModuleHandleA",
  2125. "address": "0x5881fc"
  2126. },
  2127. {
  2128. "name": "VirtualProtect",
  2129. "address": "0x588200"
  2130. },
  2131. {
  2132. "name": "GetTickCount",
  2133. "address": "0x588204"
  2134. },
  2135. {
  2136. "name": "EnterCriticalSection",
  2137. "address": "0x588208"
  2138. },
  2139. {
  2140. "name": "LeaveCriticalSection",
  2141. "address": "0x58820c"
  2142. },
  2143. {
  2144. "name": "VirtualFree",
  2145. "address": "0x588210"
  2146. },
  2147. {
  2148. "name": "VirtualAlloc",
  2149. "address": "0x588214"
  2150. },
  2151. {
  2152. "name": "WriteProcessMemory",
  2153. "address": "0x588218"
  2154. },
  2155. {
  2156. "name": "CreateToolhelp32Snapshot",
  2157. "address": "0x58821c"
  2158. },
  2159. {
  2160. "name": "GetCurrentProcessId",
  2161. "address": "0x588220"
  2162. },
  2163. {
  2164. "name": "GetCurrentThreadId",
  2165. "address": "0x588224"
  2166. },
  2167. {
  2168. "name": "Thread32First",
  2169. "address": "0x588228"
  2170. },
  2171. {
  2172. "name": "OpenThread",
  2173. "address": "0x58822c"
  2174. },
  2175. {
  2176. "name": "Thread32Next",
  2177. "address": "0x588230"
  2178. },
  2179. {
  2180. "name": "CloseHandle",
  2181. "address": "0x588234"
  2182. },
  2183. {
  2184. "name": "SuspendThread",
  2185. "address": "0x588238"
  2186. },
  2187. {
  2188. "name": "ResumeThread",
  2189. "address": "0x58823c"
  2190. },
  2191. {
  2192. "name": "GetSystemInfo",
  2193. "address": "0x588240"
  2194. },
  2195. {
  2196. "name": "LoadResource",
  2197. "address": "0x588244"
  2198. },
  2199. {
  2200. "name": "MultiByteToWideChar",
  2201. "address": "0x588248"
  2202. },
  2203. {
  2204. "name": "WideCharToMultiByte",
  2205. "address": "0x58824c"
  2206. },
  2207. {
  2208. "name": "FindResourceExW",
  2209. "address": "0x588250"
  2210. },
  2211. {
  2212. "name": "FindResourceExA",
  2213. "address": "0x588254"
  2214. },
  2215. {
  2216. "name": "GetThreadLocale",
  2217. "address": "0x588258"
  2218. },
  2219. {
  2220. "name": "GetUserDefaultLCID",
  2221. "address": "0x58825c"
  2222. },
  2223. {
  2224. "name": "GetSystemDefaultLCID",
  2225. "address": "0x588260"
  2226. },
  2227. {
  2228. "name": "EnumResourceNamesA",
  2229. "address": "0x588264"
  2230. },
  2231. {
  2232. "name": "EnumResourceNamesW",
  2233. "address": "0x588268"
  2234. },
  2235. {
  2236. "name": "EnumResourceLanguagesA",
  2237. "address": "0x58826c"
  2238. },
  2239. {
  2240. "name": "EnumResourceLanguagesW",
  2241. "address": "0x588270"
  2242. },
  2243. {
  2244. "name": "EnumResourceTypesA",
  2245. "address": "0x588274"
  2246. },
  2247. {
  2248. "name": "EnumResourceTypesW",
  2249. "address": "0x588278"
  2250. },
  2251. {
  2252. "name": "HeapAlloc",
  2253. "address": "0x58827c"
  2254. },
  2255. {
  2256. "name": "HeapFree",
  2257. "address": "0x588280"
  2258. },
  2259. {
  2260. "name": "HeapDestroy",
  2261. "address": "0x588284"
  2262. },
  2263. {
  2264. "name": "HeapCreate",
  2265. "address": "0x588288"
  2266. },
  2267. {
  2268. "name": "GetSystemTime",
  2269. "address": "0x58828c"
  2270. },
  2271. {
  2272. "name": "GetLocalTime",
  2273. "address": "0x588290"
  2274. },
  2275. {
  2276. "name": "SystemTimeToFileTime",
  2277. "address": "0x588294"
  2278. },
  2279. {
  2280. "name": "CompareFileTime",
  2281. "address": "0x588298"
  2282. },
  2283. {
  2284. "name": "GetCommandLineA",
  2285. "address": "0x58829c"
  2286. },
  2287. {
  2288. "name": "GetCPInfo",
  2289. "address": "0x5882a0"
  2290. },
  2291. {
  2292. "name": "InterlockedIncrement",
  2293. "address": "0x5882a4"
  2294. },
  2295. {
  2296. "name": "InterlockedDecrement",
  2297. "address": "0x5882a8"
  2298. },
  2299. {
  2300. "name": "GetACP",
  2301. "address": "0x5882ac"
  2302. },
  2303. {
  2304. "name": "GetOEMCP",
  2305. "address": "0x5882b0"
  2306. },
  2307. {
  2308. "name": "IsValidCodePage",
  2309. "address": "0x5882b4"
  2310. },
  2311. {
  2312. "name": "TlsGetValue",
  2313. "address": "0x5882b8"
  2314. },
  2315. {
  2316. "name": "TlsAlloc",
  2317. "address": "0x5882bc"
  2318. },
  2319. {
  2320. "name": "TlsSetValue",
  2321. "address": "0x5882c0"
  2322. },
  2323. {
  2324. "name": "TlsFree",
  2325. "address": "0x5882c4"
  2326. },
  2327. {
  2328. "name": "LCMapStringA",
  2329. "address": "0x5882c8"
  2330. },
  2331. {
  2332. "name": "LCMapStringW",
  2333. "address": "0x5882cc"
  2334. },
  2335. {
  2336. "name": "UnhandledExceptionFilter",
  2337. "address": "0x5882d0"
  2338. },
  2339. {
  2340. "name": "SetUnhandledExceptionFilter",
  2341. "address": "0x5882d4"
  2342. },
  2343. {
  2344. "name": "IsDebuggerPresent",
  2345. "address": "0x5882d8"
  2346. },
  2347. {
  2348. "name": "WriteFile",
  2349. "address": "0x5882dc"
  2350. },
  2351. {
  2352. "name": "GetStdHandle",
  2353. "address": "0x5882e0"
  2354. },
  2355. {
  2356. "name": "GetModuleFileNameA",
  2357. "address": "0x5882e4"
  2358. },
  2359. {
  2360. "name": "RaiseException",
  2361. "address": "0x5882e8"
  2362. },
  2363. {
  2364. "name": "Sleep",
  2365. "address": "0x5882ec"
  2366. },
  2367. {
  2368. "name": "ExitProcess",
  2369. "address": "0x5882f0"
  2370. },
  2371. {
  2372. "name": "SetHandleCount",
  2373. "address": "0x5882f4"
  2374. },
  2375. {
  2376. "name": "GetFileType",
  2377. "address": "0x5882f8"
  2378. },
  2379. {
  2380. "name": "GetStartupInfoA",
  2381. "address": "0x5882fc"
  2382. },
  2383. {
  2384. "name": "FreeEnvironmentStringsA",
  2385. "address": "0x588300"
  2386. },
  2387. {
  2388. "name": "GetEnvironmentStrings",
  2389. "address": "0x588304"
  2390. },
  2391. {
  2392. "name": "FreeEnvironmentStringsW",
  2393. "address": "0x588308"
  2394. },
  2395. {
  2396. "name": "GetEnvironmentStringsW",
  2397. "address": "0x58830c"
  2398. },
  2399. {
  2400. "name": "QueryPerformanceCounter",
  2401. "address": "0x588310"
  2402. },
  2403. {
  2404. "name": "GetSystemTimeAsFileTime",
  2405. "address": "0x588314"
  2406. },
  2407. {
  2408. "name": "HeapReAlloc",
  2409. "address": "0x588318"
  2410. },
  2411. {
  2412. "name": "GetStringTypeA",
  2413. "address": "0x58831c"
  2414. },
  2415. {
  2416. "name": "GetStringTypeW",
  2417. "address": "0x588320"
  2418. },
  2419. {
  2420. "name": "GetLocaleInfoA",
  2421. "address": "0x588324"
  2422. },
  2423. {
  2424. "name": "RtlUnwind",
  2425. "address": "0x588328"
  2426. },
  2427. {
  2428. "name": "HeapSize",
  2429. "address": "0x58832c"
  2430. },
  2431. {
  2432. "name": "SetFilePointer",
  2433. "address": "0x588330"
  2434. },
  2435. {
  2436. "name": "GetConsoleCP",
  2437. "address": "0x588334"
  2438. },
  2439. {
  2440. "name": "GetConsoleMode",
  2441. "address": "0x588338"
  2442. },
  2443. {
  2444. "name": "InitializeCriticalSectionAndSpinCount",
  2445. "address": "0x58833c"
  2446. },
  2447. {
  2448. "name": "SetStdHandle",
  2449. "address": "0x588340"
  2450. },
  2451. {
  2452. "name": "WriteConsoleA",
  2453. "address": "0x588344"
  2454. },
  2455. {
  2456. "name": "GetConsoleOutputCP",
  2457. "address": "0x588348"
  2458. },
  2459. {
  2460. "name": "WriteConsoleW",
  2461. "address": "0x58834c"
  2462. },
  2463. {
  2464. "name": "CreateFileA",
  2465. "address": "0x588350"
  2466. },
  2467. {
  2468. "name": "FlushFileBuffers",
  2469. "address": "0x588354"
  2470. },
  2471. {
  2472. "name": "VirtualQuery",
  2473. "address": "0x588358"
  2474. }
  2475. ],
  2476. "dll": "KERNEL32.dll"
  2477. },
  2478. {
  2479. "imports": [
  2480. {
  2481. "name": "MessageBoxW",
  2482. "address": "0x588360"
  2483. },
  2484. {
  2485. "name": "CharUpperBuffW",
  2486. "address": "0x588364"
  2487. }
  2488. ],
  2489. "dll": "USER32.dll"
  2490. },
  2491. {
  2492. "imports": [
  2493. {
  2494. "name": "GetModuleFileNameW",
  2495. "address": "0x58836c"
  2496. }
  2497. ],
  2498. "dll": "KERNEL32.dll"
  2499. },
  2500. {
  2501. "imports": [
  2502. {
  2503. "name": "GetModuleHandleA",
  2504. "address": "0x588374"
  2505. },
  2506. {
  2507. "name": "LoadLibraryA",
  2508. "address": "0x588378"
  2509. },
  2510. {
  2511. "name": "LocalAlloc",
  2512. "address": "0x58837c"
  2513. },
  2514. {
  2515. "name": "LocalFree",
  2516. "address": "0x588380"
  2517. },
  2518. {
  2519. "name": "GetModuleFileNameA",
  2520. "address": "0x588384"
  2521. },
  2522. {
  2523. "name": "ExitProcess",
  2524. "address": "0x588388"
  2525. }
  2526. ],
  2527. "dll": "KERNEL32.dll"
  2528. }
  2529. ],
  2530. "digital_signers": null,
  2531. "exported_dll_name": "",
  2532. "actual_checksum": "0x001995e9",
  2533. "overlay": null,
  2534. "imagebase": "0x00400000",
  2535. "reported_checksum": "0x001995e9",
  2536. "icon_hash": null,
  2537. "entrypoint": "0x0058c1b8",
  2538. "timestamp": "2018-11-24 02:02:51",
  2539. "osversion": "5.0",
  2540. "sections": [
  2541. {
  2542. "name": ".text",
  2543. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2544. "virtual_address": "0x00001000",
  2545. "size_of_data": "0x0001e000",
  2546. "entropy": "6.52",
  2547. "raw_address": "0x00000400",
  2548. "virtual_size": "0x0001de52",
  2549. "characteristics_raw": "0x60000020"
  2550. },
  2551. {
  2552. "name": ".rdata",
  2553. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2554. "virtual_address": "0x0001f000",
  2555. "size_of_data": "0x00008200",
  2556. "entropy": "6.61",
  2557. "raw_address": "0x0001e400",
  2558. "virtual_size": "0x000081b2",
  2559. "characteristics_raw": "0x40000040"
  2560. },
  2561. {
  2562. "name": ".data",
  2563. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2564. "virtual_address": "0x00028000",
  2565. "size_of_data": "0x00001a00",
  2566. "entropy": "3.74",
  2567. "raw_address": "0x00026600",
  2568. "virtual_size": "0x000036c4",
  2569. "characteristics_raw": "0xc0000040"
  2570. },
  2571. {
  2572. "name": ".vmp0",
  2573. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2574. "virtual_address": "0x0002c000",
  2575. "size_of_data": "0x00158600",
  2576. "entropy": "7.85",
  2577. "raw_address": "0x00028000",
  2578. "virtual_size": "0x001584ae",
  2579. "characteristics_raw": "0xe0000060"
  2580. },
  2581. {
  2582. "name": ".tls",
  2583. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2584. "virtual_address": "0x00185000",
  2585. "size_of_data": "0x00000200",
  2586. "entropy": "0.00",
  2587. "raw_address": "0x00180600",
  2588. "virtual_size": "0x00000018",
  2589. "characteristics_raw": "0xc0000040"
  2590. },
  2591. {
  2592. "name": ".vmp1",
  2593. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2594. "virtual_address": "0x00186000",
  2595. "size_of_data": "0x00011e00",
  2596. "entropy": "7.48",
  2597. "raw_address": "0x00180800",
  2598. "virtual_size": "0x00011c93",
  2599. "characteristics_raw": "0xe0000060"
  2600. },
  2601. {
  2602. "name": ".reloc",
  2603. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2604. "virtual_address": "0x00198000",
  2605. "size_of_data": "0x00002800",
  2606. "entropy": "6.44",
  2607. "raw_address": "0x00192600",
  2608. "virtual_size": "0x000026d8",
  2609. "characteristics_raw": "0x40000040"
  2610. },
  2611. {
  2612. "name": ".rsrc",
  2613. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2614. "virtual_address": "0x0019b000",
  2615. "size_of_data": "0x00000400",
  2616. "entropy": "3.92",
  2617. "raw_address": "0x00194e00",
  2618. "virtual_size": "0x00000352",
  2619. "characteristics_raw": "0x40000040"
  2620. }
  2621. ],
  2622. "resources": [],
  2623. "dirents": [
  2624. {
  2625. "virtual_address": "0x0018385e",
  2626. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2627. "size": "0x00000c50"
  2628. },
  2629. {
  2630. "virtual_address": "0x001910ec",
  2631. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2632. "size": "0x000000dc"
  2633. },
  2634. {
  2635. "virtual_address": "0x0019b000",
  2636. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2637. "size": "0x00000352"
  2638. },
  2639. {
  2640. "virtual_address": "0x00000000",
  2641. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2642. "size": "0x00000000"
  2643. },
  2644. {
  2645. "virtual_address": "0x00000000",
  2646. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2647. "size": "0x00000000"
  2648. },
  2649. {
  2650. "virtual_address": "0x00198000",
  2651. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2652. "size": "0x000026d8"
  2653. },
  2654. {
  2655. "virtual_address": "0x00000000",
  2656. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2657. "size": "0x00000000"
  2658. },
  2659. {
  2660. "virtual_address": "0x00000000",
  2661. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2662. "size": "0x00000000"
  2663. },
  2664. {
  2665. "virtual_address": "0x00000000",
  2666. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2667. "size": "0x00000000"
  2668. },
  2669. {
  2670. "virtual_address": "0x0019374c",
  2671. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2672. "size": "0x00000020"
  2673. },
  2674. {
  2675. "virtual_address": "0x00026270",
  2676. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2677. "size": "0x00000040"
  2678. },
  2679. {
  2680. "virtual_address": "0x00000000",
  2681. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2682. "size": "0x00000000"
  2683. },
  2684. {
  2685. "virtual_address": "0x00188000",
  2686. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2687. "size": "0x00000390"
  2688. },
  2689. {
  2690. "virtual_address": "0x00000000",
  2691. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2692. "size": "0x00000000"
  2693. },
  2694. {
  2695. "virtual_address": "0x00000000",
  2696. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2697. "size": "0x00000000"
  2698. },
  2699. {
  2700. "virtual_address": "0x00000000",
  2701. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2702. "size": "0x00000000"
  2703. }
  2704. ],
  2705. "exports": [],
  2706. "guest_signers": {},
  2707. "imphash": "2c4b653e617da18516332d4c0ab46237",
  2708. "icon_fuzzy": null,
  2709. "icon": null,
  2710. "pdbpath": null,
  2711. "imported_dll_count": 10,
  2712. "versioninfo": []
  2713. }
  2714. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!