API tools faq
paste
paladin316

Exes_e3638516b609eed8bfa8e5732e5eebba_exe_2019-07-03_06_30.json

paladin316
Jul 3rd, 2019
2,069
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.81 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_e3638516b609eed8bfa8e5732e5eebba.exe"
  7. [*] File Size: 569856
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "4c10f8881ab7b1b47a4db73fb9052e23efbfcecf4b2b28c569c01faba944d482"
  10. [*] MD5: "e3638516b609eed8bfa8e5732e5eebba"
  11. [*] SHA1: "12c752d26dab93e1b10f81cca4c7bb5d45c7b654"
  12. [*] SHA512: "ef60515898834800b2b281bb3484591125c4e5f91487dd8e5f1c2e07226d64cb0739448d9a53f68a3e42ab5498cf721e4e55b0702135657f5d9974158d746984"
  13. [*] CRC32: "015EBB47"
  14. [*] SSDEEP: "12288:E5g7zmAPre5Jzkn3ZeIA+oigyvR3p1Eu3kj0qvuRn1yRAzvlR4TeXtZ:E5yzmwSkd553J0j0qM1yRALlW2Z"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .text, entropy: 7.96, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0008aa00, virtual_size: 0x0008a88c"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "Anomalous .NET characteristics",
  29. "Details": [
  30. {
  31. "anomalous_version": "Assembly version is set to 0"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  37. "Details": [
  38. {
  39. "McAfee": "RDN/Generic.dx"
  40. },
  41. {
  42. "Cylance": "Unsafe"
  43. },
  44. {
  45. "Alibaba": "Trojan:MSIL/DOTHETUK.8f33151d"
  46. },
  47. {
  48. "ESET-NOD32": "a variant of MSIL/Packed.SmartAssembly.AX"
  49. },
  50. {
  51. "APEX": "Malicious"
  52. },
  53. {
  54. "Paloalto": "generic.ml"
  55. },
  56. {
  57. "GData": "MSIL.Trojan-Stealer.Brogcy.2DR3WS"
  58. },
  59. {
  60. "Kaspersky": "HEUR:Trojan.MSIL.DOTHETUK.gen"
  61. },
  62. {
  63. "Avast": "Win32:CrypterX-gen [Trj]"
  64. },
  65. {
  66. "Endgame": "malicious (high confidence)"
  67. },
  68. {
  69. "F-Secure": "Trojan.TR/Dothetuk.avgod"
  70. },
  71. {
  72. "Qihoo-360": "Win32/Trojan.7ed"
  73. },
  74. {
  75. "Invincea": "heuristic"
  76. },
  77. {
  78. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.hc"
  79. },
  80. {
  81. "Trapmine": "malicious.high.ml.score"
  82. },
  83. {
  84. "FireEye": "Generic.mg.e3638516b609eed8"
  85. },
  86. {
  87. "SentinelOne": "DFI - Malicious PE"
  88. },
  89. {
  90. "ZoneAlarm": "HEUR:Trojan.MSIL.DOTHETUK.gen"
  91. },
  92. {
  93. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  94. },
  95. {
  96. "Acronis": "suspicious"
  97. },
  98. {
  99. "MAX": "malware (ai score=99)"
  100. },
  101. {
  102. "Rising": "Trojan.DOTHETUK!8.E40A (CLOUD)"
  103. },
  104. {
  105. "Ikarus": "Win32.Outbreak"
  106. },
  107. {
  108. "eGambit": "Unsafe.AI_Score_55%"
  109. },
  110. {
  111. "Fortinet": "MSIL/DOTHETUK!tr"
  112. },
  113. {
  114. "AVG": "Win32:CrypterX-gen [Trj]"
  115. },
  116. {
  117. "Cybereason": "malicious.26dab9"
  118. },
  119. {
  120. "CrowdStrike": "win/malicious_confidence_100% (W)"
  121. }
  122. ]
  123. }
  124. ]
  125.  
  126. [*] Started Service: []
  127.  
  128. [*] Executed Commands: []
  129.  
  130. [*] Mutexes: []
  131.  
  132. [*] Modified Files: []
  133.  
  134. [*] Deleted Files: []
  135.  
  136. [*] Modified Registry Keys: []
  137.  
  138. [*] Deleted Registry Keys: []
  139.  
  140. [*] DNS Communications: []
  141.  
  142. [*] Domains: []
  143.  
  144. [*] Network Communication - ICMP: []
  145.  
  146. [*] Network Communication - HTTP: []
  147.  
  148. [*] Network Communication - SMTP: []
  149.  
  150. [*] Network Communication - Hosts: []
  151.  
  152. [*] Network Communication - IRC: []
  153.  
  154. [*] Static Analysis: {
  155. "dotnet": {
  156. "customattrs": null,
  157. "assemblyinfo": {
  158. "version": "0.0.0.0",
  159. "name": "ovnk"
  160. },
  161. "assemblyrefs": [
  162. {
  163. "version": "2.0.0.0",
  164. "name": "mscorlib"
  165. },
  166. {
  167. "version": "8.0.0.0",
  168. "name": "Microsoft.VisualBasic"
  169. },
  170. {
  171. "version": "2.0.0.0",
  172. "name": "System"
  173. }
  174. ],
  175. "typerefs": [
  176. {
  177. "typename": "Microsoft.VisualBasic.ApplicationServices.ApplicationBase",
  178. "assembly": "Microsoft.VisualBasic"
  179. },
  180. {
  181. "typename": "Microsoft.VisualBasic.ApplicationServices.User",
  182. "assembly": "Microsoft.VisualBasic"
  183. },
  184. {
  185. "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
  186. "assembly": "Microsoft.VisualBasic"
  187. },
  188. {
  189. "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
  190. "assembly": "Microsoft.VisualBasic"
  191. },
  192. {
  193. "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
  194. "assembly": "Microsoft.VisualBasic"
  195. },
  196. {
  197. "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
  198. "assembly": "Microsoft.VisualBasic"
  199. },
  200. {
  201. "typename": "Microsoft.VisualBasic.Devices.Computer",
  202. "assembly": "Microsoft.VisualBasic"
  203. },
  204. {
  205. "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
  206. "assembly": "Microsoft.VisualBasic"
  207. },
  208. {
  209. "typename": "Microsoft.VisualBasic.Interaction",
  210. "assembly": "Microsoft.VisualBasic"
  211. },
  212. {
  213. "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
  214. "assembly": "Microsoft.VisualBasic"
  215. },
  216. {
  217. "typename": "Microsoft.VisualBasic.MyServices.Internal.ContextValue`1",
  218. "assembly": "Microsoft.VisualBasic"
  219. },
  220. {
  221. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  222. "assembly": "System"
  223. },
  224. {
  225. "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
  226. "assembly": "System"
  227. },
  228. {
  229. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  230. "assembly": "System"
  231. },
  232. {
  233. "typename": "System.ComponentModel.EditorBrowsableState",
  234. "assembly": "System"
  235. },
  236. {
  237. "typename": "System.Configuration.ApplicationSettingsBase",
  238. "assembly": "System"
  239. },
  240. {
  241. "typename": "System.Configuration.SettingsBase",
  242. "assembly": "System"
  243. },
  244. {
  245. "typename": "System.Diagnostics.Process",
  246. "assembly": "System"
  247. },
  248. {
  249. "typename": "System.Diagnostics.ProcessModule",
  250. "assembly": "System"
  251. },
  252. {
  253. "typename": "System.Diagnostics.ProcessModuleCollection",
  254. "assembly": "System"
  255. },
  256. {
  257. "typename": "System.Activator",
  258. "assembly": "mscorlib"
  259. },
  260. {
  261. "typename": "System.AppDomain",
  262. "assembly": "mscorlib"
  263. },
  264. {
  265. "typename": "System.ArgumentOutOfRangeException",
  266. "assembly": "mscorlib"
  267. },
  268. {
  269. "typename": "System.Array",
  270. "assembly": "mscorlib"
  271. },
  272. {
  273. "typename": "System.AsyncCallback",
  274. "assembly": "mscorlib"
  275. },
  276. {
  277. "typename": "System.Attribute",
  278. "assembly": "mscorlib"
  279. },
  280. {
  281. "typename": "System.AttributeTargets",
  282. "assembly": "mscorlib"
  283. },
  284. {
  285. "typename": "System.AttributeUsageAttribute",
  286. "assembly": "mscorlib"
  287. },
  288. {
  289. "typename": "System.BadImageFormatException",
  290. "assembly": "mscorlib"
  291. },
  292. {
  293. "typename": "System.BitConverter",
  294. "assembly": "mscorlib"
  295. },
  296. {
  297. "typename": "System.Boolean",
  298. "assembly": "mscorlib"
  299. },
  300. {
  301. "typename": "System.Buffer",
  302. "assembly": "mscorlib"
  303. },
  304. {
  305. "typename": "System.Byte",
  306. "assembly": "mscorlib"
  307. },
  308. {
  309. "typename": "System.Char",
  310. "assembly": "mscorlib"
  311. },
  312. {
  313. "typename": "System.Collections.Generic.Dictionary`2",
  314. "assembly": "mscorlib"
  315. },
  316. {
  317. "typename": "System.Collections.IEnumerator",
  318. "assembly": "mscorlib"
  319. },
  320. {
  321. "typename": "System.Collections.ReadOnlyCollectionBase",
  322. "assembly": "mscorlib"
  323. },
  324. {
  325. "typename": "System.Convert",
  326. "assembly": "mscorlib"
  327. },
  328. {
  329. "typename": "System.Delegate",
  330. "assembly": "mscorlib"
  331. },
  332. {
  333. "typename": "System.Diagnostics.DebuggerDisplayAttribute",
  334. "assembly": "mscorlib"
  335. },
  336. {
  337. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  338. "assembly": "mscorlib"
  339. },
  340. {
  341. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  342. "assembly": "mscorlib"
  343. },
  344. {
  345. "typename": "System.Diagnostics.StackFrame",
  346. "assembly": "mscorlib"
  347. },
  348. {
  349. "typename": "System.Diagnostics.StackTrace",
  350. "assembly": "mscorlib"
  351. },
  352. {
  353. "typename": "System.Enum",
  354. "assembly": "mscorlib"
  355. },
  356. {
  357. "typename": "System.Exception",
  358. "assembly": "mscorlib"
  359. },
  360. {
  361. "typename": "System.FlagsAttribute",
  362. "assembly": "mscorlib"
  363. },
  364. {
  365. "typename": "System.FormatException",
  366. "assembly": "mscorlib"
  367. },
  368. {
  369. "typename": "System.GC",
  370. "assembly": "mscorlib"
  371. },
  372. {
  373. "typename": "System.Globalization.CultureInfo",
  374. "assembly": "mscorlib"
  375. },
  376. {
  377. "typename": "System.IAsyncResult",
  378. "assembly": "mscorlib"
  379. },
  380. {
  381. "typename": "System.IDisposable",
  382. "assembly": "mscorlib"
  383. },
  384. {
  385. "typename": "System.IO.Directory",
  386. "assembly": "mscorlib"
  387. },
  388. {
  389. "typename": "System.IO.DirectoryInfo",
  390. "assembly": "mscorlib"
  391. },
  392. {
  393. "typename": "System.IO.File",
  394. "assembly": "mscorlib"
  395. },
  396. {
  397. "typename": "System.IO.FileLoadException",
  398. "assembly": "mscorlib"
  399. },
  400. {
  401. "typename": "System.IO.FileStream",
  402. "assembly": "mscorlib"
  403. },
  404. {
  405. "typename": "System.IO.MemoryStream",
  406. "assembly": "mscorlib"
  407. },
  408. {
  409. "typename": "System.IO.Path",
  410. "assembly": "mscorlib"
  411. },
  412. {
  413. "typename": "System.IO.Stream",
  414. "assembly": "mscorlib"
  415. },
  416. {
  417. "typename": "System.Int16",
  418. "assembly": "mscorlib"
  419. },
  420. {
  421. "typename": "System.Int32",
  422. "assembly": "mscorlib"
  423. },
  424. {
  425. "typename": "System.IntPtr",
  426. "assembly": "mscorlib"
  427. },
  428. {
  429. "typename": "System.InvalidOperationException",
  430. "assembly": "mscorlib"
  431. },
  432. {
  433. "typename": "System.Math",
  434. "assembly": "mscorlib"
  435. },
  436. {
  437. "typename": "System.MulticastDelegate",
  438. "assembly": "mscorlib"
  439. },
  440. {
  441. "typename": "System.Object",
  442. "assembly": "mscorlib"
  443. },
  444. {
  445. "typename": "System.Reflection.Assembly",
  446. "assembly": "mscorlib"
  447. },
  448. {
  449. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  450. "assembly": "mscorlib"
  451. },
  452. {
  453. "typename": "System.Reflection.AssemblyName",
  454. "assembly": "mscorlib"
  455. },
  456. {
  457. "typename": "System.Reflection.MemberInfo",
  458. "assembly": "mscorlib"
  459. },
  460. {
  461. "typename": "System.Reflection.MethodBase",
  462. "assembly": "mscorlib"
  463. },
  464. {
  465. "typename": "System.Reflection.Module",
  466. "assembly": "mscorlib"
  467. },
  468. {
  469. "typename": "System.ResolveEventArgs",
  470. "assembly": "mscorlib"
  471. },
  472. {
  473. "typename": "System.ResolveEventHandler",
  474. "assembly": "mscorlib"
  475. },
  476. {
  477. "typename": "System.Resources.ResourceManager",
  478. "assembly": "mscorlib"
  479. },
  480. {
  481. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  482. "assembly": "mscorlib"
  483. },
  484. {
  485. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  486. "assembly": "mscorlib"
  487. },
  488. {
  489. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  490. "assembly": "mscorlib"
  491. },
  492. {
  493. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  494. "assembly": "mscorlib"
  495. },
  496. {
  497. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  498. "assembly": "mscorlib"
  499. },
  500. {
  501. "typename": "System.Runtime.InteropServices.Marshal",
  502. "assembly": "mscorlib"
  503. },
  504. {
  505. "typename": "System.RuntimeFieldHandle",
  506. "assembly": "mscorlib"
  507. },
  508. {
  509. "typename": "System.RuntimeTypeHandle",
  510. "assembly": "mscorlib"
  511. },
  512. {
  513. "typename": "System.STAThreadAttribute",
  514. "assembly": "mscorlib"
  515. },
  516. {
  517. "typename": "System.Security.Cryptography.CipherMode",
  518. "assembly": "mscorlib"
  519. },
  520. {
  521. "typename": "System.Security.Cryptography.CryptoStream",
  522. "assembly": "mscorlib"
  523. },
  524. {
  525. "typename": "System.Security.Cryptography.CryptoStreamMode",
  526. "assembly": "mscorlib"
  527. },
  528. {
  529. "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
  530. "assembly": "mscorlib"
  531. },
  532. {
  533. "typename": "System.Security.Cryptography.HashAlgorithm",
  534. "assembly": "mscorlib"
  535. },
  536. {
  537. "typename": "System.Security.Cryptography.ICryptoTransform",
  538. "assembly": "mscorlib"
  539. },
  540. {
  541. "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
  542. "assembly": "mscorlib"
  543. },
  544. {
  545. "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
  546. "assembly": "mscorlib"
  547. },
  548. {
  549. "typename": "System.Security.Cryptography.RijndaelManaged",
  550. "assembly": "mscorlib"
  551. },
  552. {
  553. "typename": "System.Security.Cryptography.SymmetricAlgorithm",
  554. "assembly": "mscorlib"
  555. },
  556. {
  557. "typename": "System.String",
  558. "assembly": "mscorlib"
  559. },
  560. {
  561. "typename": "System.Text.Encoding",
  562. "assembly": "mscorlib"
  563. },
  564. {
  565. "typename": "System.Text.StringBuilder",
  566. "assembly": "mscorlib"
  567. },
  568. {
  569. "typename": "System.Threading.Monitor",
  570. "assembly": "mscorlib"
  571. },
  572. {
  573. "typename": "System.Threading.Thread",
  574. "assembly": "mscorlib"
  575. },
  576. {
  577. "typename": "System.Threading.ThreadStart",
  578. "assembly": "mscorlib"
  579. },
  580. {
  581. "typename": "System.Type",
  582. "assembly": "mscorlib"
  583. },
  584. {
  585. "typename": "System.ValueType",
  586. "assembly": "mscorlib"
  587. },
  588. {
  589. "typename": "System.Version",
  590. "assembly": "mscorlib"
  591. }
  592. ]
  593. },
  594. "pe": {
  595. "peid_signatures": null,
  596. "imports": [
  597. {
  598. "imports": [
  599. {
  600. "name": "_CorExeMain",
  601. "address": "0x402000"
  602. }
  603. ],
  604. "dll": "mscoree.dll"
  605. }
  606. ],
  607. "digital_signers": null,
  608. "exported_dll_name": null,
  609. "actual_checksum": "0x000943fe",
  610. "overlay": null,
  611. "imagebase": "0x00400000",
  612. "reported_checksum": "0x00000000",
  613. "icon_hash": null,
  614. "entrypoint": "0x0048c886",
  615. "timestamp": "2019-07-01 09:34:21",
  616. "osversion": "4.0",
  617. "sections": [
  618. {
  619. "name": ".text",
  620. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  621. "virtual_address": "0x00002000",
  622. "size_of_data": "0x0008aa00",
  623. "entropy": "7.96",
  624. "raw_address": "0x00000200",
  625. "virtual_size": "0x0008a88c",
  626. "characteristics_raw": "0x60000020"
  627. },
  628. {
  629. "name": ".rsrc",
  630. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  631. "virtual_address": "0x0008e000",
  632. "size_of_data": "0x00000400",
  633. "entropy": "4.46",
  634. "raw_address": "0x0008ac00",
  635. "virtual_size": "0x00000394",
  636. "characteristics_raw": "0x40000040"
  637. },
  638. {
  639. "name": ".reloc",
  640. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  641. "virtual_address": "0x00090000",
  642. "size_of_data": "0x00000200",
  643. "entropy": "0.10",
  644. "raw_address": "0x0008b000",
  645. "virtual_size": "0x0000000c",
  646. "characteristics_raw": "0x42000040"
  647. }
  648. ],
  649. "resources": [],
  650. "dirents": [
  651. {
  652. "virtual_address": "0x00000000",
  653. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  654. "size": "0x00000000"
  655. },
  656. {
  657. "virtual_address": "0x0008c83c",
  658. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  659. "size": "0x0000004a"
  660. },
  661. {
  662. "virtual_address": "0x0008e000",
  663. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  664. "size": "0x00000394"
  665. },
  666. {
  667. "virtual_address": "0x00000000",
  668. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  669. "size": "0x00000000"
  670. },
  671. {
  672. "virtual_address": "0x00000000",
  673. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  674. "size": "0x00000000"
  675. },
  676. {
  677. "virtual_address": "0x00090000",
  678. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  679. "size": "0x0000000c"
  680. },
  681. {
  682. "virtual_address": "0x00000000",
  683. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  684. "size": "0x00000000"
  685. },
  686. {
  687. "virtual_address": "0x00000000",
  688. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  689. "size": "0x00000000"
  690. },
  691. {
  692. "virtual_address": "0x00000000",
  693. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  694. "size": "0x00000000"
  695. },
  696. {
  697. "virtual_address": "0x00000000",
  698. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  699. "size": "0x00000000"
  700. },
  701. {
  702. "virtual_address": "0x00000000",
  703. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  704. "size": "0x00000000"
  705. },
  706. {
  707. "virtual_address": "0x00000000",
  708. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  709. "size": "0x00000000"
  710. },
  711. {
  712. "virtual_address": "0x00002000",
  713. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  714. "size": "0x00000008"
  715. },
  716. {
  717. "virtual_address": "0x00000000",
  718. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  719. "size": "0x00000000"
  720. },
  721. {
  722. "virtual_address": "0x00002008",
  723. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  724. "size": "0x00000048"
  725. },
  726. {
  727. "virtual_address": "0x00000000",
  728. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  729. "size": "0x00000000"
  730. }
  731. ],
  732. "exports": [],
  733. "guest_signers": {},
  734. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  735. "icon_fuzzy": null,
  736. "icon": null,
  737. "pdbpath": null,
  738. "imported_dll_count": 1,
  739. "versioninfo": []
  740. }
  741. }
  742.  
  743. [*] Resolved APIs: []
  744.  
  745. [*] Static Analysis: {
  746. "dotnet": {
  747. "customattrs": null,
  748. "assemblyinfo": {
  749. "version": "0.0.0.0",
  750. "name": "ovnk"
  751. },
  752. "assemblyrefs": [
  753. {
  754. "version": "2.0.0.0",
  755. "name": "mscorlib"
  756. },
  757. {
  758. "version": "8.0.0.0",
  759. "name": "Microsoft.VisualBasic"
  760. },
  761. {
  762. "version": "2.0.0.0",
  763. "name": "System"
  764. }
  765. ],
  766. "typerefs": [
  767. {
  768. "typename": "Microsoft.VisualBasic.ApplicationServices.ApplicationBase",
  769. "assembly": "Microsoft.VisualBasic"
  770. },
  771. {
  772. "typename": "Microsoft.VisualBasic.ApplicationServices.User",
  773. "assembly": "Microsoft.VisualBasic"
  774. },
  775. {
  776. "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
  777. "assembly": "Microsoft.VisualBasic"
  778. },
  779. {
  780. "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
  781. "assembly": "Microsoft.VisualBasic"
  782. },
  783. {
  784. "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
  785. "assembly": "Microsoft.VisualBasic"
  786. },
  787. {
  788. "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
  789. "assembly": "Microsoft.VisualBasic"
  790. },
  791. {
  792. "typename": "Microsoft.VisualBasic.Devices.Computer",
  793. "assembly": "Microsoft.VisualBasic"
  794. },
  795. {
  796. "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
  797. "assembly": "Microsoft.VisualBasic"
  798. },
  799. {
  800. "typename": "Microsoft.VisualBasic.Interaction",
  801. "assembly": "Microsoft.VisualBasic"
  802. },
  803. {
  804. "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
  805. "assembly": "Microsoft.VisualBasic"
  806. },
  807. {
  808. "typename": "Microsoft.VisualBasic.MyServices.Internal.ContextValue`1",
  809. "assembly": "Microsoft.VisualBasic"
  810. },
  811. {
  812. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  813. "assembly": "System"
  814. },
  815. {
  816. "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
  817. "assembly": "System"
  818. },
  819. {
  820. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  821. "assembly": "System"
  822. },
  823. {
  824. "typename": "System.ComponentModel.EditorBrowsableState",
  825. "assembly": "System"
  826. },
  827. {
  828. "typename": "System.Configuration.ApplicationSettingsBase",
  829. "assembly": "System"
  830. },
  831. {
  832. "typename": "System.Configuration.SettingsBase",
  833. "assembly": "System"
  834. },
  835. {
  836. "typename": "System.Diagnostics.Process",
  837. "assembly": "System"
  838. },
  839. {
  840. "typename": "System.Diagnostics.ProcessModule",
  841. "assembly": "System"
  842. },
  843. {
  844. "typename": "System.Diagnostics.ProcessModuleCollection",
  845. "assembly": "System"
  846. },
  847. {
  848. "typename": "System.Activator",
  849. "assembly": "mscorlib"
  850. },
  851. {
  852. "typename": "System.AppDomain",
  853. "assembly": "mscorlib"
  854. },
  855. {
  856. "typename": "System.ArgumentOutOfRangeException",
  857. "assembly": "mscorlib"
  858. },
  859. {
  860. "typename": "System.Array",
  861. "assembly": "mscorlib"
  862. },
  863. {
  864. "typename": "System.AsyncCallback",
  865. "assembly": "mscorlib"
  866. },
  867. {
  868. "typename": "System.Attribute",
  869. "assembly": "mscorlib"
  870. },
  871. {
  872. "typename": "System.AttributeTargets",
  873. "assembly": "mscorlib"
  874. },
  875. {
  876. "typename": "System.AttributeUsageAttribute",
  877. "assembly": "mscorlib"
  878. },
  879. {
  880. "typename": "System.BadImageFormatException",
  881. "assembly": "mscorlib"
  882. },
  883. {
  884. "typename": "System.BitConverter",
  885. "assembly": "mscorlib"
  886. },
  887. {
  888. "typename": "System.Boolean",
  889. "assembly": "mscorlib"
  890. },
  891. {
  892. "typename": "System.Buffer",
  893. "assembly": "mscorlib"
  894. },
  895. {
  896. "typename": "System.Byte",
  897. "assembly": "mscorlib"
  898. },
  899. {
  900. "typename": "System.Char",
  901. "assembly": "mscorlib"
  902. },
  903. {
  904. "typename": "System.Collections.Generic.Dictionary`2",
  905. "assembly": "mscorlib"
  906. },
  907. {
  908. "typename": "System.Collections.IEnumerator",
  909. "assembly": "mscorlib"
  910. },
  911. {
  912. "typename": "System.Collections.ReadOnlyCollectionBase",
  913. "assembly": "mscorlib"
  914. },
  915. {
  916. "typename": "System.Convert",
  917. "assembly": "mscorlib"
  918. },
  919. {
  920. "typename": "System.Delegate",
  921. "assembly": "mscorlib"
  922. },
  923. {
  924. "typename": "System.Diagnostics.DebuggerDisplayAttribute",
  925. "assembly": "mscorlib"
  926. },
  927. {
  928. "typename": "System.Diagnostics.DebuggerHiddenAttribute",
  929. "assembly": "mscorlib"
  930. },
  931. {
  932. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  933. "assembly": "mscorlib"
  934. },
  935. {
  936. "typename": "System.Diagnostics.StackFrame",
  937. "assembly": "mscorlib"
  938. },
  939. {
  940. "typename": "System.Diagnostics.StackTrace",
  941. "assembly": "mscorlib"
  942. },
  943. {
  944. "typename": "System.Enum",
  945. "assembly": "mscorlib"
  946. },
  947. {
  948. "typename": "System.Exception",
  949. "assembly": "mscorlib"
  950. },
  951. {
  952. "typename": "System.FlagsAttribute",
  953. "assembly": "mscorlib"
  954. },
  955. {
  956. "typename": "System.FormatException",
  957. "assembly": "mscorlib"
  958. },
  959. {
  960. "typename": "System.GC",
  961. "assembly": "mscorlib"
  962. },
  963. {
  964. "typename": "System.Globalization.CultureInfo",
  965. "assembly": "mscorlib"
  966. },
  967. {
  968. "typename": "System.IAsyncResult",
  969. "assembly": "mscorlib"
  970. },
  971. {
  972. "typename": "System.IDisposable",
  973. "assembly": "mscorlib"
  974. },
  975. {
  976. "typename": "System.IO.Directory",
  977. "assembly": "mscorlib"
  978. },
  979. {
  980. "typename": "System.IO.DirectoryInfo",
  981. "assembly": "mscorlib"
  982. },
  983. {
  984. "typename": "System.IO.File",
  985. "assembly": "mscorlib"
  986. },
  987. {
  988. "typename": "System.IO.FileLoadException",
  989. "assembly": "mscorlib"
  990. },
  991. {
  992. "typename": "System.IO.FileStream",
  993. "assembly": "mscorlib"
  994. },
  995. {
  996. "typename": "System.IO.MemoryStream",
  997. "assembly": "mscorlib"
  998. },
  999. {
  1000. "typename": "System.IO.Path",
  1001. "assembly": "mscorlib"
  1002. },
  1003. {
  1004. "typename": "System.IO.Stream",
  1005. "assembly": "mscorlib"
  1006. },
  1007. {
  1008. "typename": "System.Int16",
  1009. "assembly": "mscorlib"
  1010. },
  1011. {
  1012. "typename": "System.Int32",
  1013. "assembly": "mscorlib"
  1014. },
  1015. {
  1016. "typename": "System.IntPtr",
  1017. "assembly": "mscorlib"
  1018. },
  1019. {
  1020. "typename": "System.InvalidOperationException",
  1021. "assembly": "mscorlib"
  1022. },
  1023. {
  1024. "typename": "System.Math",
  1025. "assembly": "mscorlib"
  1026. },
  1027. {
  1028. "typename": "System.MulticastDelegate",
  1029. "assembly": "mscorlib"
  1030. },
  1031. {
  1032. "typename": "System.Object",
  1033. "assembly": "mscorlib"
  1034. },
  1035. {
  1036. "typename": "System.Reflection.Assembly",
  1037. "assembly": "mscorlib"
  1038. },
  1039. {
  1040. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  1041. "assembly": "mscorlib"
  1042. },
  1043. {
  1044. "typename": "System.Reflection.AssemblyName",
  1045. "assembly": "mscorlib"
  1046. },
  1047. {
  1048. "typename": "System.Reflection.MemberInfo",
  1049. "assembly": "mscorlib"
  1050. },
  1051. {
  1052. "typename": "System.Reflection.MethodBase",
  1053. "assembly": "mscorlib"
  1054. },
  1055. {
  1056. "typename": "System.Reflection.Module",
  1057. "assembly": "mscorlib"
  1058. },
  1059. {
  1060. "typename": "System.ResolveEventArgs",
  1061. "assembly": "mscorlib"
  1062. },
  1063. {
  1064. "typename": "System.ResolveEventHandler",
  1065. "assembly": "mscorlib"
  1066. },
  1067. {
  1068. "typename": "System.Resources.ResourceManager",
  1069. "assembly": "mscorlib"
  1070. },
  1071. {
  1072. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  1073. "assembly": "mscorlib"
  1074. },
  1075. {
  1076. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  1077. "assembly": "mscorlib"
  1078. },
  1079. {
  1080. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  1081. "assembly": "mscorlib"
  1082. },
  1083. {
  1084. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  1085. "assembly": "mscorlib"
  1086. },
  1087. {
  1088. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  1089. "assembly": "mscorlib"
  1090. },
  1091. {
  1092. "typename": "System.Runtime.InteropServices.Marshal",
  1093. "assembly": "mscorlib"
  1094. },
  1095. {
  1096. "typename": "System.RuntimeFieldHandle",
  1097. "assembly": "mscorlib"
  1098. },
  1099. {
  1100. "typename": "System.RuntimeTypeHandle",
  1101. "assembly": "mscorlib"
  1102. },
  1103. {
  1104. "typename": "System.STAThreadAttribute",
  1105. "assembly": "mscorlib"
  1106. },
  1107. {
  1108. "typename": "System.Security.Cryptography.CipherMode",
  1109. "assembly": "mscorlib"
  1110. },
  1111. {
  1112. "typename": "System.Security.Cryptography.CryptoStream",
  1113. "assembly": "mscorlib"
  1114. },
  1115. {
  1116. "typename": "System.Security.Cryptography.CryptoStreamMode",
  1117. "assembly": "mscorlib"
  1118. },
  1119. {
  1120. "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
  1121. "assembly": "mscorlib"
  1122. },
  1123. {
  1124. "typename": "System.Security.Cryptography.HashAlgorithm",
  1125. "assembly": "mscorlib"
  1126. },
  1127. {
  1128. "typename": "System.Security.Cryptography.ICryptoTransform",
  1129. "assembly": "mscorlib"
  1130. },
  1131. {
  1132. "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
  1133. "assembly": "mscorlib"
  1134. },
  1135. {
  1136. "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
  1137. "assembly": "mscorlib"
  1138. },
  1139. {
  1140. "typename": "System.Security.Cryptography.RijndaelManaged",
  1141. "assembly": "mscorlib"
  1142. },
  1143. {
  1144. "typename": "System.Security.Cryptography.SymmetricAlgorithm",
  1145. "assembly": "mscorlib"
  1146. },
  1147. {
  1148. "typename": "System.String",
  1149. "assembly": "mscorlib"
  1150. },
  1151. {
  1152. "typename": "System.Text.Encoding",
  1153. "assembly": "mscorlib"
  1154. },
  1155. {
  1156. "typename": "System.Text.StringBuilder",
  1157. "assembly": "mscorlib"
  1158. },
  1159. {
  1160. "typename": "System.Threading.Monitor",
  1161. "assembly": "mscorlib"
  1162. },
  1163. {
  1164. "typename": "System.Threading.Thread",
  1165. "assembly": "mscorlib"
  1166. },
  1167. {
  1168. "typename": "System.Threading.ThreadStart",
  1169. "assembly": "mscorlib"
  1170. },
  1171. {
  1172. "typename": "System.Type",
  1173. "assembly": "mscorlib"
  1174. },
  1175. {
  1176. "typename": "System.ValueType",
  1177. "assembly": "mscorlib"
  1178. },
  1179. {
  1180. "typename": "System.Version",
  1181. "assembly": "mscorlib"
  1182. }
  1183. ]
  1184. },
  1185. "pe": {
  1186. "peid_signatures": null,
  1187. "imports": [
  1188. {
  1189. "imports": [
  1190. {
  1191. "name": "_CorExeMain",
  1192. "address": "0x402000"
  1193. }
  1194. ],
  1195. "dll": "mscoree.dll"
  1196. }
  1197. ],
  1198. "digital_signers": null,
  1199. "exported_dll_name": null,
  1200. "actual_checksum": "0x000943fe",
  1201. "overlay": null,
  1202. "imagebase": "0x00400000",
  1203. "reported_checksum": "0x00000000",
  1204. "icon_hash": null,
  1205. "entrypoint": "0x0048c886",
  1206. "timestamp": "2019-07-01 09:34:21",
  1207. "osversion": "4.0",
  1208. "sections": [
  1209. {
  1210. "name": ".text",
  1211. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1212. "virtual_address": "0x00002000",
  1213. "size_of_data": "0x0008aa00",
  1214. "entropy": "7.96",
  1215. "raw_address": "0x00000200",
  1216. "virtual_size": "0x0008a88c",
  1217. "characteristics_raw": "0x60000020"
  1218. },
  1219. {
  1220. "name": ".rsrc",
  1221. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1222. "virtual_address": "0x0008e000",
  1223. "size_of_data": "0x00000400",
  1224. "entropy": "4.46",
  1225. "raw_address": "0x0008ac00",
  1226. "virtual_size": "0x00000394",
  1227. "characteristics_raw": "0x40000040"
  1228. },
  1229. {
  1230. "name": ".reloc",
  1231. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1232. "virtual_address": "0x00090000",
  1233. "size_of_data": "0x00000200",
  1234. "entropy": "0.10",
  1235. "raw_address": "0x0008b000",
  1236. "virtual_size": "0x0000000c",
  1237. "characteristics_raw": "0x42000040"
  1238. }
  1239. ],
  1240. "resources": [],
  1241. "dirents": [
  1242. {
  1243. "virtual_address": "0x00000000",
  1244. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1245. "size": "0x00000000"
  1246. },
  1247. {
  1248. "virtual_address": "0x0008c83c",
  1249. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1250. "size": "0x0000004a"
  1251. },
  1252. {
  1253. "virtual_address": "0x0008e000",
  1254. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1255. "size": "0x00000394"
  1256. },
  1257. {
  1258. "virtual_address": "0x00000000",
  1259. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1260. "size": "0x00000000"
  1261. },
  1262. {
  1263. "virtual_address": "0x00000000",
  1264. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1265. "size": "0x00000000"
  1266. },
  1267. {
  1268. "virtual_address": "0x00090000",
  1269. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1270. "size": "0x0000000c"
  1271. },
  1272. {
  1273. "virtual_address": "0x00000000",
  1274. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1275. "size": "0x00000000"
  1276. },
  1277. {
  1278. "virtual_address": "0x00000000",
  1279. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1280. "size": "0x00000000"
  1281. },
  1282. {
  1283. "virtual_address": "0x00000000",
  1284. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1285. "size": "0x00000000"
  1286. },
  1287. {
  1288. "virtual_address": "0x00000000",
  1289. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1290. "size": "0x00000000"
  1291. },
  1292. {
  1293. "virtual_address": "0x00000000",
  1294. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1295. "size": "0x00000000"
  1296. },
  1297. {
  1298. "virtual_address": "0x00000000",
  1299. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1300. "size": "0x00000000"
  1301. },
  1302. {
  1303. "virtual_address": "0x00002000",
  1304. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1305. "size": "0x00000008"
  1306. },
  1307. {
  1308. "virtual_address": "0x00000000",
  1309. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1310. "size": "0x00000000"
  1311. },
  1312. {
  1313. "virtual_address": "0x00002008",
  1314. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1315. "size": "0x00000048"
  1316. },
  1317. {
  1318. "virtual_address": "0x00000000",
  1319. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1320. "size": "0x00000000"
  1321. }
  1322. ],
  1323. "exports": [],
  1324. "guest_signers": {},
  1325. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1326. "icon_fuzzy": null,
  1327. "icon": null,
  1328. "pdbpath": null,
  1329. "imported_dll_count": 1,
  1330. "versioninfo": []
  1331. }
  1332. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!