API tools faq
paste
paladin316

NanoCore_5b84f715c48702af33b92893facd1b56_exe_2019-06-28_20_30.json

paladin316
Jun 28th, 2019
2,195
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 26.70 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "NanoCore_5b84f715c48702af33b92893facd1b56.exe"
  7. [*] File Size: 524288
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "99b2f205fc125f7c009019960456f2e3d50c4224cf6e3603dd5820cf6a8eefdb"
  10. [*] MD5: "5b84f715c48702af33b92893facd1b56"
  11. [*] SHA1: "3bf625328be7fbe3afc32845f8f514f363d93fe0"
  12. [*] SHA512: "42f9d8eae3e459d7d4ba25a38ab3ebfaf340333f8a23fbf3e822d2bd38f613fb1dc2b484d1d8b260708fa7dd2738bc0a176299f521df8715d6675ca171e5a903"
  13. [*] CRC32: "4CF29330"
  14. [*] SSDEEP: "12288:jofokhHkoI9znnT8A0cFEH9DHlwSQjFdtj/52:8gkeoI9zTOH9DCSQjFdNM"
  15.  
  16. [*] Process Execution: [
  17. "NanoCore_5b84f715c48702af33b92893facd1b56.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "The binary likely contains encrypted or compressed data.",
  27. "Details": [
  28. {
  29. "section": "name: .text, entropy: 7.15, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00079000, virtual_size: 0x00078510"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  35. "Details": [
  36. {
  37. "Spam": "NanoCore_5b84f715c48702af33b92893facd1b56.exe (2408) called API CreateProcessInternalW 35785 times"
  38. }
  39. ]
  40. },
  41. {
  42. "Description": "File has been identified by 21 Antiviruses on VirusTotal as malicious",
  43. "Details": [
  44. {
  45. "Bkav": "HW32.Packed."
  46. },
  47. {
  48. "McAfee": "Fareit-FPJ!5B84F715C487"
  49. },
  50. {
  51. "Cylance": "Unsafe"
  52. },
  53. {
  54. "Symantec": "ML.Attribute.HighConfidence"
  55. },
  56. {
  57. "ESET-NOD32": "a variant of Win32/GenKryptik.DKLS"
  58. },
  59. {
  60. "APEX": "Malicious"
  61. },
  62. {
  63. "Avast": "Win32:Malware-gen"
  64. },
  65. {
  66. "Paloalto": "generic.ml"
  67. },
  68. {
  69. "Endgame": "malicious (moderate confidence)"
  70. },
  71. {
  72. "Sophos": "Mal/FareitVB-N"
  73. },
  74. {
  75. "Invincea": "heuristic"
  76. },
  77. {
  78. "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.hc"
  79. },
  80. {
  81. "Trapmine": "malicious.high.ml.score"
  82. },
  83. {
  84. "FireEye": "Generic.mg.5b84f715c48702af"
  85. },
  86. {
  87. "SentinelOne": "DFI - Malicious PE"
  88. },
  89. {
  90. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  91. },
  92. {
  93. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  94. },
  95. {
  96. "Rising": "Trojan.GenKryptik!8.AA55 (CLOUD)"
  97. },
  98. {
  99. "AVG": "Win32:Malware-gen"
  100. },
  101. {
  102. "Cybereason": "malicious.28be7f"
  103. },
  104. {
  105. "CrowdStrike": "win/malicious_confidence_100% (W)"
  106. }
  107. ]
  108. }
  109. ]
  110.  
  111. [*] Started Service: []
  112.  
  113. [*] Executed Commands: [
  114. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\NanoCore_5b84f715c48702af33b92893facd1b56.exe\""
  115. ]
  116.  
  117. [*] Mutexes: [
  118. "CicLoadWinStaWinSta0",
  119. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  120. ]
  121.  
  122. [*] Modified Files: []
  123.  
  124. [*] Deleted Files: []
  125.  
  126. [*] Modified Registry Keys: []
  127.  
  128. [*] Deleted Registry Keys: []
  129.  
  130. [*] DNS Communications: []
  131.  
  132. [*] Domains: []
  133.  
  134. [*] Network Communication - ICMP: []
  135.  
  136. [*] Network Communication - HTTP: []
  137.  
  138. [*] Network Communication - SMTP: []
  139.  
  140. [*] Network Communication - Hosts: []
  141.  
  142. [*] Network Communication - IRC: []
  143.  
  144. [*] Static Analysis: {
  145. "pe": {
  146. "peid_signatures": null,
  147. "imports": [
  148. {
  149. "imports": [
  150. {
  151. "name": null,
  152. "address": "0x401000"
  153. },
  154. {
  155. "name": null,
  156. "address": "0x401004"
  157. },
  158. {
  159. "name": null,
  160. "address": "0x401008"
  161. },
  162. {
  163. "name": "MethCallEngine",
  164. "address": "0x40100c"
  165. },
  166. {
  167. "name": null,
  168. "address": "0x401010"
  169. },
  170. {
  171. "name": null,
  172. "address": "0x401014"
  173. },
  174. {
  175. "name": null,
  176. "address": "0x401018"
  177. },
  178. {
  179. "name": null,
  180. "address": "0x40101c"
  181. },
  182. {
  183. "name": null,
  184. "address": "0x401020"
  185. },
  186. {
  187. "name": null,
  188. "address": "0x401024"
  189. },
  190. {
  191. "name": null,
  192. "address": "0x401028"
  193. },
  194. {
  195. "name": null,
  196. "address": "0x40102c"
  197. },
  198. {
  199. "name": null,
  200. "address": "0x401030"
  201. },
  202. {
  203. "name": null,
  204. "address": "0x401034"
  205. },
  206. {
  207. "name": null,
  208. "address": "0x401038"
  209. },
  210. {
  211. "name": null,
  212. "address": "0x40103c"
  213. },
  214. {
  215. "name": null,
  216. "address": "0x401040"
  217. },
  218. {
  219. "name": "EVENT_SINK_AddRef",
  220. "address": "0x401044"
  221. },
  222. {
  223. "name": null,
  224. "address": "0x401048"
  225. },
  226. {
  227. "name": "EVENT_SINK_Release",
  228. "address": "0x40104c"
  229. },
  230. {
  231. "name": null,
  232. "address": "0x401050"
  233. },
  234. {
  235. "name": "EVENT_SINK_QueryInterface",
  236. "address": "0x401054"
  237. },
  238. {
  239. "name": "__vbaExceptHandler",
  240. "address": "0x401058"
  241. },
  242. {
  243. "name": null,
  244. "address": "0x40105c"
  245. },
  246. {
  247. "name": null,
  248. "address": "0x401060"
  249. },
  250. {
  251. "name": null,
  252. "address": "0x401064"
  253. },
  254. {
  255. "name": null,
  256. "address": "0x401068"
  257. },
  258. {
  259. "name": null,
  260. "address": "0x40106c"
  261. },
  262. {
  263. "name": null,
  264. "address": "0x401070"
  265. },
  266. {
  267. "name": null,
  268. "address": "0x401074"
  269. },
  270. {
  271. "name": null,
  272. "address": "0x401078"
  273. },
  274. {
  275. "name": null,
  276. "address": "0x40107c"
  277. },
  278. {
  279. "name": null,
  280. "address": "0x401080"
  281. },
  282. {
  283. "name": null,
  284. "address": "0x401084"
  285. },
  286. {
  287. "name": null,
  288. "address": "0x401088"
  289. },
  290. {
  291. "name": null,
  292. "address": "0x40108c"
  293. },
  294. {
  295. "name": null,
  296. "address": "0x401090"
  297. }
  298. ],
  299. "dll": "MSVBVM60.DLL"
  300. }
  301. ],
  302. "digital_signers": null,
  303. "exported_dll_name": null,
  304. "actual_checksum": "0x00082236",
  305. "overlay": null,
  306. "imagebase": "0x00400000",
  307. "reported_checksum": "0x00082236",
  308. "icon_hash": null,
  309. "entrypoint": "0x00401180",
  310. "timestamp": "2019-06-28 08:01:54",
  311. "osversion": "4.0",
  312. "sections": [
  313. {
  314. "name": ".text",
  315. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  316. "virtual_address": "0x00001000",
  317. "size_of_data": "0x00079000",
  318. "entropy": "7.15",
  319. "raw_address": "0x00001000",
  320. "virtual_size": "0x00078510",
  321. "characteristics_raw": "0x60000020"
  322. },
  323. {
  324. "name": ".data",
  325. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  326. "virtual_address": "0x0007a000",
  327. "size_of_data": "0x00000000",
  328. "entropy": "0.00",
  329. "raw_address": "0x00000000",
  330. "virtual_size": "0x00006a88",
  331. "characteristics_raw": "0xc0000040"
  332. },
  333. {
  334. "name": ".rsrc",
  335. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  336. "virtual_address": "0x00081000",
  337. "size_of_data": "0x00006000",
  338. "entropy": "4.22",
  339. "raw_address": "0x0007a000",
  340. "virtual_size": "0x00005940",
  341. "characteristics_raw": "0x40000040"
  342. }
  343. ],
  344. "resources": [],
  345. "dirents": [
  346. {
  347. "virtual_address": "0x00000000",
  348. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  349. "size": "0x00000000"
  350. },
  351. {
  352. "virtual_address": "0x000793d4",
  353. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  354. "size": "0x00000028"
  355. },
  356. {
  357. "virtual_address": "0x00081000",
  358. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  359. "size": "0x00005940"
  360. },
  361. {
  362. "virtual_address": "0x00000000",
  363. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  364. "size": "0x00000000"
  365. },
  366. {
  367. "virtual_address": "0x00000000",
  368. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  369. "size": "0x00000000"
  370. },
  371. {
  372. "virtual_address": "0x00000000",
  373. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  374. "size": "0x00000000"
  375. },
  376. {
  377. "virtual_address": "0x00000000",
  378. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  379. "size": "0x00000000"
  380. },
  381. {
  382. "virtual_address": "0x00000000",
  383. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  384. "size": "0x00000000"
  385. },
  386. {
  387. "virtual_address": "0x00000000",
  388. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  389. "size": "0x00000000"
  390. },
  391. {
  392. "virtual_address": "0x00000000",
  393. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  394. "size": "0x00000000"
  395. },
  396. {
  397. "virtual_address": "0x00000000",
  398. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  399. "size": "0x00000000"
  400. },
  401. {
  402. "virtual_address": "0x00000220",
  403. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  404. "size": "0x00000020"
  405. },
  406. {
  407. "virtual_address": "0x00001000",
  408. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  409. "size": "0x00000098"
  410. },
  411. {
  412. "virtual_address": "0x00000000",
  413. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  414. "size": "0x00000000"
  415. },
  416. {
  417. "virtual_address": "0x00000000",
  418. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  419. "size": "0x00000000"
  420. },
  421. {
  422. "virtual_address": "0x00000000",
  423. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  424. "size": "0x00000000"
  425. }
  426. ],
  427. "exports": [],
  428. "guest_signers": {},
  429. "imphash": "25867cc9bf0bfc3c7ed2fc0be2b414b6",
  430. "icon_fuzzy": null,
  431. "icon": null,
  432. "pdbpath": null,
  433. "imported_dll_count": 1,
  434. "versioninfo": []
  435. }
  436. }
  437.  
  438. [*] Resolved APIs: [
  439. "cryptbase.dll.SystemFunction036",
  440. "uxtheme.dll.ThemeInitApiHook",
  441. "user32.dll.IsProcessDPIAware",
  442. "oleaut32.dll.OleLoadPictureEx",
  443. "oleaut32.dll.DispCallFunc",
  444. "oleaut32.dll.LoadTypeLibEx",
  445. "oleaut32.dll.UnRegisterTypeLib",
  446. "oleaut32.dll.CreateTypeLib2",
  447. "oleaut32.dll.VarDateFromUdate",
  448. "oleaut32.dll.VarUdateFromDate",
  449. "oleaut32.dll.GetAltMonthNames",
  450. "oleaut32.dll.VarNumFromParseNum",
  451. "oleaut32.dll.VarParseNumFromStr",
  452. "oleaut32.dll.VarDecFromR4",
  453. "oleaut32.dll.VarDecFromR8",
  454. "oleaut32.dll.VarDecFromDate",
  455. "oleaut32.dll.VarDecFromI4",
  456. "oleaut32.dll.VarDecFromCy",
  457. "oleaut32.dll.VarR4FromDec",
  458. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  459. "oleaut32.dll.GetRecordInfoFromGuids",
  460. "oleaut32.dll.SafeArrayGetRecordInfo",
  461. "oleaut32.dll.SafeArraySetRecordInfo",
  462. "oleaut32.dll.SafeArrayGetIID",
  463. "oleaut32.dll.SafeArraySetIID",
  464. "oleaut32.dll.SafeArrayCopyData",
  465. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  466. "oleaut32.dll.SafeArrayCreateEx",
  467. "oleaut32.dll.VarFormat",
  468. "oleaut32.dll.VarFormatDateTime",
  469. "oleaut32.dll.VarFormatNumber",
  470. "oleaut32.dll.VarFormatPercent",
  471. "oleaut32.dll.VarFormatCurrency",
  472. "oleaut32.dll.VarWeekdayName",
  473. "oleaut32.dll.VarMonthName",
  474. "oleaut32.dll.VarAdd",
  475. "oleaut32.dll.VarAnd",
  476. "oleaut32.dll.VarCat",
  477. "oleaut32.dll.VarDiv",
  478. "oleaut32.dll.VarEqv",
  479. "oleaut32.dll.VarIdiv",
  480. "oleaut32.dll.VarImp",
  481. "oleaut32.dll.VarMod",
  482. "oleaut32.dll.VarMul",
  483. "oleaut32.dll.VarOr",
  484. "oleaut32.dll.VarPow",
  485. "oleaut32.dll.VarSub",
  486. "oleaut32.dll.VarXor",
  487. "oleaut32.dll.VarAbs",
  488. "oleaut32.dll.VarFix",
  489. "oleaut32.dll.VarInt",
  490. "oleaut32.dll.VarNeg",
  491. "oleaut32.dll.VarNot",
  492. "oleaut32.dll.VarRound",
  493. "oleaut32.dll.VarCmp",
  494. "oleaut32.dll.VarDecAdd",
  495. "oleaut32.dll.VarDecCmp",
  496. "oleaut32.dll.VarBstrCat",
  497. "oleaut32.dll.VarCyMulI4",
  498. "oleaut32.dll.VarBstrCmp",
  499. "ole32.dll.CoCreateInstanceEx",
  500. "ole32.dll.CLSIDFromProgIDEx",
  501. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  502. "user32.dll.GetSystemMetrics",
  503. "user32.dll.MonitorFromWindow",
  504. "user32.dll.MonitorFromRect",
  505. "user32.dll.MonitorFromPoint",
  506. "user32.dll.EnumDisplayMonitors",
  507. "user32.dll.GetMonitorInfoA",
  508. "dwmapi.dll.DwmIsCompositionEnabled",
  509. "gdi32.dll.GetLayout",
  510. "gdi32.dll.GdiRealizationInfo",
  511. "gdi32.dll.FontIsLinked",
  512. "advapi32.dll.RegOpenKeyExW",
  513. "advapi32.dll.RegQueryInfoKeyW",
  514. "gdi32.dll.GetTextFaceAliasW",
  515. "advapi32.dll.RegEnumValueW",
  516. "advapi32.dll.RegCloseKey",
  517. "advapi32.dll.RegQueryValueExW",
  518. "gdi32.dll.GetFontAssocStatus",
  519. "advapi32.dll.RegQueryValueExA",
  520. "advapi32.dll.RegEnumKeyExW",
  521. "gdi32.dll.GdiIsMetaPrintDC",
  522. "ole32.dll.CoInitializeEx",
  523. "ole32.dll.CoUninitialize",
  524. "ole32.dll.CoRegisterInitializeSpy",
  525. "ole32.dll.CoRevokeInitializeSpy",
  526. "gdi32.dll.GetTextExtentExPointWPri",
  527. "kernel32.dll.NlsGetCacheUpdateCount",
  528. "kernel32.dll.GetCalendarInfoW",
  529. "kernel32.dll.GetTickCount",
  530. "kernel32.dll.Sleep",
  531. "user32.dll.GetCursorPos",
  532. "user32.dll.EnumWindows",
  533. "kernel32.dll.SetErrorMode",
  534. "kernel32.dll.SetLastError",
  535. "kernel32.dll.VirtualAllocEx",
  536. "kernel32.dll.CloseHandle",
  537. "shell32.dll.ShellExecuteW",
  538. "kernel32.dll.WriteFile",
  539. "kernel32.dll.UnmapViewOfFile",
  540. "kernel32.dll.CreateFileW",
  541. "kernel32.dll.TerminateProcess",
  542. "kernel32.dll.VirtualProtectEx",
  543. "kernel32.dll.CreateProcessInternalW",
  544. "kernel32.dll.GetTempPathW",
  545. "kernel32.dll.GetLongPathNameW",
  546. "kernel32.dll.GetFileSize",
  547. "kernel32.dll.ReadFile",
  548. "ntdll.dll.NtProtectVirtualMemory",
  549. "kernel32.dll.GetCommandLineW"
  550. ]
  551.  
  552. [*] Static Analysis: {
  553. "pe": {
  554. "peid_signatures": null,
  555. "imports": [
  556. {
  557. "imports": [
  558. {
  559. "name": null,
  560. "address": "0x401000"
  561. },
  562. {
  563. "name": null,
  564. "address": "0x401004"
  565. },
  566. {
  567. "name": null,
  568. "address": "0x401008"
  569. },
  570. {
  571. "name": "MethCallEngine",
  572. "address": "0x40100c"
  573. },
  574. {
  575. "name": null,
  576. "address": "0x401010"
  577. },
  578. {
  579. "name": null,
  580. "address": "0x401014"
  581. },
  582. {
  583. "name": null,
  584. "address": "0x401018"
  585. },
  586. {
  587. "name": null,
  588. "address": "0x40101c"
  589. },
  590. {
  591. "name": null,
  592. "address": "0x401020"
  593. },
  594. {
  595. "name": null,
  596. "address": "0x401024"
  597. },
  598. {
  599. "name": null,
  600. "address": "0x401028"
  601. },
  602. {
  603. "name": null,
  604. "address": "0x40102c"
  605. },
  606. {
  607. "name": null,
  608. "address": "0x401030"
  609. },
  610. {
  611. "name": null,
  612. "address": "0x401034"
  613. },
  614. {
  615. "name": null,
  616. "address": "0x401038"
  617. },
  618. {
  619. "name": null,
  620. "address": "0x40103c"
  621. },
  622. {
  623. "name": null,
  624. "address": "0x401040"
  625. },
  626. {
  627. "name": "EVENT_SINK_AddRef",
  628. "address": "0x401044"
  629. },
  630. {
  631. "name": null,
  632. "address": "0x401048"
  633. },
  634. {
  635. "name": "EVENT_SINK_Release",
  636. "address": "0x40104c"
  637. },
  638. {
  639. "name": null,
  640. "address": "0x401050"
  641. },
  642. {
  643. "name": "EVENT_SINK_QueryInterface",
  644. "address": "0x401054"
  645. },
  646. {
  647. "name": "__vbaExceptHandler",
  648. "address": "0x401058"
  649. },
  650. {
  651. "name": null,
  652. "address": "0x40105c"
  653. },
  654. {
  655. "name": null,
  656. "address": "0x401060"
  657. },
  658. {
  659. "name": null,
  660. "address": "0x401064"
  661. },
  662. {
  663. "name": null,
  664. "address": "0x401068"
  665. },
  666. {
  667. "name": null,
  668. "address": "0x40106c"
  669. },
  670. {
  671. "name": null,
  672. "address": "0x401070"
  673. },
  674. {
  675. "name": null,
  676. "address": "0x401074"
  677. },
  678. {
  679. "name": null,
  680. "address": "0x401078"
  681. },
  682. {
  683. "name": null,
  684. "address": "0x40107c"
  685. },
  686. {
  687. "name": null,
  688. "address": "0x401080"
  689. },
  690. {
  691. "name": null,
  692. "address": "0x401084"
  693. },
  694. {
  695. "name": null,
  696. "address": "0x401088"
  697. },
  698. {
  699. "name": null,
  700. "address": "0x40108c"
  701. },
  702. {
  703. "name": null,
  704. "address": "0x401090"
  705. }
  706. ],
  707. "dll": "MSVBVM60.DLL"
  708. }
  709. ],
  710. "digital_signers": null,
  711. "exported_dll_name": null,
  712. "actual_checksum": "0x00082236",
  713. "overlay": null,
  714. "imagebase": "0x00400000",
  715. "reported_checksum": "0x00082236",
  716. "icon_hash": null,
  717. "entrypoint": "0x00401180",
  718. "timestamp": "2019-06-28 08:01:54",
  719. "osversion": "4.0",
  720. "sections": [
  721. {
  722. "name": ".text",
  723. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  724. "virtual_address": "0x00001000",
  725. "size_of_data": "0x00079000",
  726. "entropy": "7.15",
  727. "raw_address": "0x00001000",
  728. "virtual_size": "0x00078510",
  729. "characteristics_raw": "0x60000020"
  730. },
  731. {
  732. "name": ".data",
  733. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  734. "virtual_address": "0x0007a000",
  735. "size_of_data": "0x00000000",
  736. "entropy": "0.00",
  737. "raw_address": "0x00000000",
  738. "virtual_size": "0x00006a88",
  739. "characteristics_raw": "0xc0000040"
  740. },
  741. {
  742. "name": ".rsrc",
  743. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  744. "virtual_address": "0x00081000",
  745. "size_of_data": "0x00006000",
  746. "entropy": "4.22",
  747. "raw_address": "0x0007a000",
  748. "virtual_size": "0x00005940",
  749. "characteristics_raw": "0x40000040"
  750. }
  751. ],
  752. "resources": [],
  753. "dirents": [
  754. {
  755. "virtual_address": "0x00000000",
  756. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  757. "size": "0x00000000"
  758. },
  759. {
  760. "virtual_address": "0x000793d4",
  761. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  762. "size": "0x00000028"
  763. },
  764. {
  765. "virtual_address": "0x00081000",
  766. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  767. "size": "0x00005940"
  768. },
  769. {
  770. "virtual_address": "0x00000000",
  771. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  772. "size": "0x00000000"
  773. },
  774. {
  775. "virtual_address": "0x00000000",
  776. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  777. "size": "0x00000000"
  778. },
  779. {
  780. "virtual_address": "0x00000000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  782. "size": "0x00000000"
  783. },
  784. {
  785. "virtual_address": "0x00000000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  787. "size": "0x00000000"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  797. "size": "0x00000000"
  798. },
  799. {
  800. "virtual_address": "0x00000000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  802. "size": "0x00000000"
  803. },
  804. {
  805. "virtual_address": "0x00000000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  807. "size": "0x00000000"
  808. },
  809. {
  810. "virtual_address": "0x00000220",
  811. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  812. "size": "0x00000020"
  813. },
  814. {
  815. "virtual_address": "0x00001000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  817. "size": "0x00000098"
  818. },
  819. {
  820. "virtual_address": "0x00000000",
  821. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  822. "size": "0x00000000"
  823. },
  824. {
  825. "virtual_address": "0x00000000",
  826. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  827. "size": "0x00000000"
  828. },
  829. {
  830. "virtual_address": "0x00000000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  832. "size": "0x00000000"
  833. }
  834. ],
  835. "exports": [],
  836. "guest_signers": {},
  837. "imphash": "25867cc9bf0bfc3c7ed2fc0be2b414b6",
  838. "icon_fuzzy": null,
  839. "icon": null,
  840. "pdbpath": null,
  841. "imported_dll_count": 1,
  842. "versioninfo": []
  843. }
  844. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!