API tools faq
paste
paladin316

Microsoft_Office_Tools_Common_v9_0_ni_dll_2019-06-26_12_30.json

paladin316
Jun 26th, 2019
2,157
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.73 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 3.2
  5.  
  6. [*] File Name: "Microsoft.Office.Tools.Common.v9.0.ni.dll"
  7. [*] File Size: 816128
  8. [*] File Type: "MS-DOS executable"
  9. [*] SHA256: "aa52ec53049a39446ef69177a98c1930dbc50d729ff18b1d7bd2e00cc430396c"
  10. [*] MD5: "d2fb65504d6eb3eea56cf1257a6b52fb"
  11. [*] SHA1: "7a2026780efd5cc23c2c522317eeca8704553f74"
  12. [*] SHA512: "b5fe63bc4e800eb831306f225c6963035cab3a72b4c78198af2710ccbd1c18c0554a30e65f08404e880a816a2391aeaa9817f05f6574111d22cbe8e754bb103c"
  13. [*] CRC32: "36D163BB"
  14. [*] SSDEEP: "12288:6t8eQTQulIPEuQuT/xK6ur6EaPeVu4DDOikXuQKSLP63FX:sVEQulIPEJIEaP2DDBYWFX"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "Anomalous binary characteristics",
  21. "Details": [
  22. {
  23. "anomaly": "Unprintable characters found in section name"
  24. },
  25. {
  26. "anomaly": "Entrypoint of binary is located outside of any mapped sections"
  27. }
  28. ]
  29. }
  30. ]
  31.  
  32. [*] Started Service: []
  33.  
  34. [*] Executed Commands: []
  35.  
  36. [*] Mutexes: []
  37.  
  38. [*] Modified Files: []
  39.  
  40. [*] Deleted Files: []
  41.  
  42. [*] Modified Registry Keys: []
  43.  
  44. [*] Deleted Registry Keys: []
  45.  
  46. [*] DNS Communications: []
  47.  
  48. [*] Domains: []
  49.  
  50. [*] Network Communication - ICMP: []
  51.  
  52. [*] Network Communication - HTTP: []
  53.  
  54. [*] Network Communication - SMTP: []
  55.  
  56. [*] Network Communication - Hosts: []
  57.  
  58. [*] Network Communication - IRC: []
  59.  
  60. [*] Static Analysis: {
  61. "pe": {
  62. "peid_signatures": null,
  63. "imports": [],
  64. "digital_signers": null,
  65. "exported_dll_name": null,
  66. "actual_checksum": "0x000d095e",
  67. "overlay": null,
  68. "imagebase": "0x10000000",
  69. "reported_checksum": "0x00000000",
  70. "icon_hash": null,
  71. "entrypoint": "0x10000000",
  72. "timestamp": "2012-04-04 10:18:55",
  73. "osversion": "5.0",
  74. "sections": [
  75. {
  76. "name": ".data\\x00j\\x08",
  77. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  78. "virtual_address": "0x00001000",
  79. "size_of_data": "0x00020200",
  80. "entropy": "4.35",
  81. "raw_address": "0x00000200",
  82. "virtual_size": "0x000200a0",
  83. "characteristics_raw": "0xc0000040"
  84. },
  85. {
  86. "name": ".xdata\\x00\\x90",
  87. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  88. "virtual_address": "0x00022000",
  89. "size_of_data": "0x00006600",
  90. "entropy": "5.76",
  91. "raw_address": "0x00020400",
  92. "virtual_size": "0x000064dc",
  93. "characteristics_raw": "0xe0000040"
  94. },
  95. {
  96. "name": ".text\\x00\\x8b\\x06",
  97. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  98. "virtual_address": "0x00029000",
  99. "size_of_data": "0x00097e00",
  100. "entropy": "6.41",
  101. "raw_address": "0x00026a00",
  102. "virtual_size": "0x00097ceb",
  103. "characteristics_raw": "0x60000020"
  104. },
  105. {
  106. "name": ".extrel",
  107. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  108. "virtual_address": "0x000c1000",
  109. "size_of_data": "0x00000200",
  110. "entropy": "1.96",
  111. "raw_address": "0x000be800",
  112. "virtual_size": "0x0000009a",
  113. "characteristics_raw": "0x40000040"
  114. },
  115. {
  116. "name": ".reloc\\x00\\x90",
  117. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  118. "virtual_address": "0x000c2000",
  119. "size_of_data": "0x00008a00",
  120. "entropy": "6.33",
  121. "raw_address": "0x000bea00",
  122. "virtual_size": "0x00008854",
  123. "characteristics_raw": "0x42000040"
  124. }
  125. ],
  126. "resources": [],
  127. "dirents": [
  128. {
  129. "virtual_address": "0x00000000",
  130. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  131. "size": "0x00000000"
  132. },
  133. {
  134. "virtual_address": "0x00000000",
  135. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  136. "size": "0x00000000"
  137. },
  138. {
  139. "virtual_address": "0x00029000",
  140. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  141. "size": "0x000004f0"
  142. },
  143. {
  144. "virtual_address": "0x00000000",
  145. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  146. "size": "0x00000000"
  147. },
  148. {
  149. "virtual_address": "0x00000000",
  150. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  151. "size": "0x00000000"
  152. },
  153. {
  154. "virtual_address": "0x000c2000",
  155. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  156. "size": "0x00008854"
  157. },
  158. {
  159. "virtual_address": "0x000c0c90",
  160. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  161. "size": "0x0000001c"
  162. },
  163. {
  164. "virtual_address": "0x00000000",
  165. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  166. "size": "0x00000000"
  167. },
  168. {
  169. "virtual_address": "0x00000000",
  170. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  171. "size": "0x00000000"
  172. },
  173. {
  174. "virtual_address": "0x00000000",
  175. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  176. "size": "0x00000000"
  177. },
  178. {
  179. "virtual_address": "0x00000000",
  180. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  181. "size": "0x00000000"
  182. },
  183. {
  184. "virtual_address": "0x00000000",
  185. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  186. "size": "0x00000000"
  187. },
  188. {
  189. "virtual_address": "0x00000000",
  190. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  191. "size": "0x00000000"
  192. },
  193. {
  194. "virtual_address": "0x00000000",
  195. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  196. "size": "0x00000000"
  197. },
  198. {
  199. "virtual_address": "0x000294f0",
  200. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  201. "size": "0x00000048"
  202. },
  203. {
  204. "virtual_address": "0x00000000",
  205. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  206. "size": "0x00000000"
  207. }
  208. ],
  209. "exports": [],
  210. "guest_signers": {},
  211. "imphash": "",
  212. "icon_fuzzy": null,
  213. "icon": null,
  214. "pdbpath": "Microsoft.Office.Tools.Common.v9.0.pdb",
  215. "imported_dll_count": 0,
  216. "versioninfo": []
  217. }
  218. }
  219.  
  220. [*] Resolved APIs: []
  221.  
  222. [*] Static Analysis: {
  223. "pe": {
  224. "peid_signatures": null,
  225. "imports": [],
  226. "digital_signers": null,
  227. "exported_dll_name": null,
  228. "actual_checksum": "0x000d095e",
  229. "overlay": null,
  230. "imagebase": "0x10000000",
  231. "reported_checksum": "0x00000000",
  232. "icon_hash": null,
  233. "entrypoint": "0x10000000",
  234. "timestamp": "2012-04-04 10:18:55",
  235. "osversion": "5.0",
  236. "sections": [
  237. {
  238. "name": ".data\\x00j\\x08",
  239. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  240. "virtual_address": "0x00001000",
  241. "size_of_data": "0x00020200",
  242. "entropy": "4.35",
  243. "raw_address": "0x00000200",
  244. "virtual_size": "0x000200a0",
  245. "characteristics_raw": "0xc0000040"
  246. },
  247. {
  248. "name": ".xdata\\x00\\x90",
  249. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  250. "virtual_address": "0x00022000",
  251. "size_of_data": "0x00006600",
  252. "entropy": "5.76",
  253. "raw_address": "0x00020400",
  254. "virtual_size": "0x000064dc",
  255. "characteristics_raw": "0xe0000040"
  256. },
  257. {
  258. "name": ".text\\x00\\x8b\\x06",
  259. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  260. "virtual_address": "0x00029000",
  261. "size_of_data": "0x00097e00",
  262. "entropy": "6.41",
  263. "raw_address": "0x00026a00",
  264. "virtual_size": "0x00097ceb",
  265. "characteristics_raw": "0x60000020"
  266. },
  267. {
  268. "name": ".extrel",
  269. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  270. "virtual_address": "0x000c1000",
  271. "size_of_data": "0x00000200",
  272. "entropy": "1.96",
  273. "raw_address": "0x000be800",
  274. "virtual_size": "0x0000009a",
  275. "characteristics_raw": "0x40000040"
  276. },
  277. {
  278. "name": ".reloc\\x00\\x90",
  279. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  280. "virtual_address": "0x000c2000",
  281. "size_of_data": "0x00008a00",
  282. "entropy": "6.33",
  283. "raw_address": "0x000bea00",
  284. "virtual_size": "0x00008854",
  285. "characteristics_raw": "0x42000040"
  286. }
  287. ],
  288. "resources": [],
  289. "dirents": [
  290. {
  291. "virtual_address": "0x00000000",
  292. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  293. "size": "0x00000000"
  294. },
  295. {
  296. "virtual_address": "0x00000000",
  297. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  298. "size": "0x00000000"
  299. },
  300. {
  301. "virtual_address": "0x00029000",
  302. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  303. "size": "0x000004f0"
  304. },
  305. {
  306. "virtual_address": "0x00000000",
  307. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  308. "size": "0x00000000"
  309. },
  310. {
  311. "virtual_address": "0x00000000",
  312. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  313. "size": "0x00000000"
  314. },
  315. {
  316. "virtual_address": "0x000c2000",
  317. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  318. "size": "0x00008854"
  319. },
  320. {
  321. "virtual_address": "0x000c0c90",
  322. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  323. "size": "0x0000001c"
  324. },
  325. {
  326. "virtual_address": "0x00000000",
  327. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  328. "size": "0x00000000"
  329. },
  330. {
  331. "virtual_address": "0x00000000",
  332. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  333. "size": "0x00000000"
  334. },
  335. {
  336. "virtual_address": "0x00000000",
  337. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  338. "size": "0x00000000"
  339. },
  340. {
  341. "virtual_address": "0x00000000",
  342. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  343. "size": "0x00000000"
  344. },
  345. {
  346. "virtual_address": "0x00000000",
  347. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  348. "size": "0x00000000"
  349. },
  350. {
  351. "virtual_address": "0x00000000",
  352. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  353. "size": "0x00000000"
  354. },
  355. {
  356. "virtual_address": "0x00000000",
  357. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  358. "size": "0x00000000"
  359. },
  360. {
  361. "virtual_address": "0x000294f0",
  362. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  363. "size": "0x00000048"
  364. },
  365. {
  366. "virtual_address": "0x00000000",
  367. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  368. "size": "0x00000000"
  369. }
  370. ],
  371. "exports": [],
  372. "guest_signers": {},
  373. "imphash": "",
  374. "icon_fuzzy": null,
  375. "icon": null,
  376. "pdbpath": "Microsoft.Office.Tools.Common.v9.0.pdb",
  377. "imported_dll_count": 0,
  378. "versioninfo": []
  379. }
  380. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!