API tools faq
paste
paladin316

Dridex_cbb4661499c8eb1381c8ebd0e1b87122_exe_2019-07-03_22_30.json

paladin316
Jul 3rd, 2019
2,446
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 43.31 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Dridex_cbb4661499c8eb1381c8ebd0e1b87122.exe"
  7. [*] File Size: 313344
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows"
  9. [*] SHA256: "3c3a9317925fe537227cc242ad27020787bd7f9ca3655cb34a1c277d725a40a3"
  10. [*] MD5: "cbb4661499c8eb1381c8ebd0e1b87122"
  11. [*] SHA1: "6ced2171af54977cfa04841c7813676cca136ec6"
  12. [*] SHA512: "6b2e754eb8c1e3b1d93eb8be1989e8fba5c1bad92a74ab8c353284abc6d1046e8671fa95afcda0ddda807687e18a83936b6f363143d7ff3fd0561407e17770e3"
  13. [*] CRC32: "49AE63BD"
  14. [*] SSDEEP: "6144:QbxMH60bp1CjtpuC8BhaPCTta6TpjYCQCqmTE7LYOZ+R:WE6091CJpuHhQCpVjY5CqmTEYJ"
  15.  
  16. [*] Process Execution: [
  17. "Dridex_cbb4661499c8eb1381c8ebd0e1b87122.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "The binary likely contains encrypted or compressed data.",
  27. "Details": [
  28. {
  29. "section": "name: .text, entropy: 6.99, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0003ce00, virtual_size: 0x0003cc36"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 14 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "FireEye": "Generic.mg.cbb4661499c8eb13"
  38. },
  39. {
  40. "Malwarebytes": "Trojan.MalPack.GS"
  41. },
  42. {
  43. "Cybereason": "malicious.1af549"
  44. },
  45. {
  46. "APEX": "Malicious"
  47. },
  48. {
  49. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  50. },
  51. {
  52. "Invincea": "heuristic"
  53. },
  54. {
  55. "Trapmine": "malicious.high.ml.score"
  56. },
  57. {
  58. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  59. },
  60. {
  61. "Endgame": "malicious (moderate confidence)"
  62. },
  63. {
  64. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  65. },
  66. {
  67. "Acronis": "suspicious"
  68. },
  69. {
  70. "VBA32": "BScope.Trojan.Chapak"
  71. },
  72. {
  73. "Rising": "Trojan.Fuery!8.EAFB (TFE:dGZlOgbNjO8vrqxAEA)"
  74. },
  75. {
  76. "CrowdStrike": "win/malicious_confidence_60% (D)"
  77. }
  78. ]
  79. }
  80. ]
  81.  
  82. [*] Started Service: []
  83.  
  84. [*] Executed Commands: []
  85.  
  86. [*] Mutexes: [
  87. "DBWinMutex"
  88. ]
  89.  
  90. [*] Modified Files: []
  91.  
  92. [*] Deleted Files: []
  93.  
  94. [*] Modified Registry Keys: []
  95.  
  96. [*] Deleted Registry Keys: []
  97.  
  98. [*] DNS Communications: []
  99.  
  100. [*] Domains: []
  101.  
  102. [*] Network Communication - ICMP: []
  103.  
  104. [*] Network Communication - HTTP: []
  105.  
  106. [*] Network Communication - SMTP: []
  107.  
  108. [*] Network Communication - Hosts: []
  109.  
  110. [*] Network Communication - IRC: []
  111.  
  112. [*] Static Analysis: {
  113. "pe": {
  114. "peid_signatures": null,
  115. "imports": [
  116. {
  117. "imports": [
  118. {
  119. "name": "ExpandEnvironmentStringsW",
  120. "address": "0x43e000"
  121. },
  122. {
  123. "name": "GlobalAlloc",
  124. "address": "0x43e004"
  125. },
  126. {
  127. "name": "GetDriveTypeW",
  128. "address": "0x43e008"
  129. },
  130. {
  131. "name": "GetModuleHandleW",
  132. "address": "0x43e00c"
  133. },
  134. {
  135. "name": "GetSystemDirectoryW",
  136. "address": "0x43e010"
  137. },
  138. {
  139. "name": "GetCommandLineA",
  140. "address": "0x43e014"
  141. },
  142. {
  143. "name": "SetEnvironmentVariableW",
  144. "address": "0x43e018"
  145. },
  146. {
  147. "name": "GetFirmwareEnvironmentVariableA",
  148. "address": "0x43e01c"
  149. },
  150. {
  151. "name": "HeapLock",
  152. "address": "0x43e020"
  153. },
  154. {
  155. "name": "ReplaceFileW",
  156. "address": "0x43e024"
  157. },
  158. {
  159. "name": "EnumTimeFormatsW",
  160. "address": "0x43e028"
  161. },
  162. {
  163. "name": "GetVolumePathNamesForVolumeNameW",
  164. "address": "0x43e02c"
  165. },
  166. {
  167. "name": "ReadConsoleW",
  168. "address": "0x43e030"
  169. },
  170. {
  171. "name": "GetProcAddress",
  172. "address": "0x43e034"
  173. },
  174. {
  175. "name": "LoadLibraryA",
  176. "address": "0x43e038"
  177. },
  178. {
  179. "name": "TryEnterCriticalSection",
  180. "address": "0x43e03c"
  181. },
  182. {
  183. "name": "IsProcessorFeaturePresent",
  184. "address": "0x43e040"
  185. },
  186. {
  187. "name": "GetLastError",
  188. "address": "0x43e044"
  189. },
  190. {
  191. "name": "_lclose",
  192. "address": "0x43e048"
  193. },
  194. {
  195. "name": "GetUserDefaultLCID",
  196. "address": "0x43e04c"
  197. },
  198. {
  199. "name": "CreateMutexW",
  200. "address": "0x43e050"
  201. },
  202. {
  203. "name": "GetTempPathW",
  204. "address": "0x43e054"
  205. },
  206. {
  207. "name": "InitializeSListHead",
  208. "address": "0x43e058"
  209. },
  210. {
  211. "name": "CloseHandle",
  212. "address": "0x43e05c"
  213. },
  214. {
  215. "name": "IsValidLocale",
  216. "address": "0x43e060"
  217. },
  218. {
  219. "name": "EnumSystemLocalesA",
  220. "address": "0x43e064"
  221. },
  222. {
  223. "name": "GetLocaleInfoA",
  224. "address": "0x43e068"
  225. },
  226. {
  227. "name": "WriteConsoleW",
  228. "address": "0x43e06c"
  229. },
  230. {
  231. "name": "SetStdHandle",
  232. "address": "0x43e070"
  233. },
  234. {
  235. "name": "ReadFile",
  236. "address": "0x43e074"
  237. },
  238. {
  239. "name": "FlushFileBuffers",
  240. "address": "0x43e078"
  241. },
  242. {
  243. "name": "ExitProcess",
  244. "address": "0x43e07c"
  245. },
  246. {
  247. "name": "DecodePointer",
  248. "address": "0x43e080"
  249. },
  250. {
  251. "name": "GetCommandLineW",
  252. "address": "0x43e084"
  253. },
  254. {
  255. "name": "HeapSetInformation",
  256. "address": "0x43e088"
  257. },
  258. {
  259. "name": "GetStartupInfoW",
  260. "address": "0x43e08c"
  261. },
  262. {
  263. "name": "EncodePointer",
  264. "address": "0x43e090"
  265. },
  266. {
  267. "name": "InitializeCriticalSectionAndSpinCount",
  268. "address": "0x43e094"
  269. },
  270. {
  271. "name": "DeleteCriticalSection",
  272. "address": "0x43e098"
  273. },
  274. {
  275. "name": "LeaveCriticalSection",
  276. "address": "0x43e09c"
  277. },
  278. {
  279. "name": "FatalAppExitA",
  280. "address": "0x43e0a0"
  281. },
  282. {
  283. "name": "EnterCriticalSection",
  284. "address": "0x43e0a4"
  285. },
  286. {
  287. "name": "SetConsoleCtrlHandler",
  288. "address": "0x43e0a8"
  289. },
  290. {
  291. "name": "FreeLibrary",
  292. "address": "0x43e0ac"
  293. },
  294. {
  295. "name": "InterlockedExchange",
  296. "address": "0x43e0b0"
  297. },
  298. {
  299. "name": "LoadLibraryW",
  300. "address": "0x43e0b4"
  301. },
  302. {
  303. "name": "GetLocaleInfoW",
  304. "address": "0x43e0b8"
  305. },
  306. {
  307. "name": "UnhandledExceptionFilter",
  308. "address": "0x43e0bc"
  309. },
  310. {
  311. "name": "SetUnhandledExceptionFilter",
  312. "address": "0x43e0c0"
  313. },
  314. {
  315. "name": "IsDebuggerPresent",
  316. "address": "0x43e0c4"
  317. },
  318. {
  319. "name": "TerminateProcess",
  320. "address": "0x43e0c8"
  321. },
  322. {
  323. "name": "GetCurrentProcess",
  324. "address": "0x43e0cc"
  325. },
  326. {
  327. "name": "TlsAlloc",
  328. "address": "0x43e0d0"
  329. },
  330. {
  331. "name": "TlsGetValue",
  332. "address": "0x43e0d4"
  333. },
  334. {
  335. "name": "TlsSetValue",
  336. "address": "0x43e0d8"
  337. },
  338. {
  339. "name": "TlsFree",
  340. "address": "0x43e0dc"
  341. },
  342. {
  343. "name": "InterlockedIncrement",
  344. "address": "0x43e0e0"
  345. },
  346. {
  347. "name": "SetLastError",
  348. "address": "0x43e0e4"
  349. },
  350. {
  351. "name": "GetCurrentThreadId",
  352. "address": "0x43e0e8"
  353. },
  354. {
  355. "name": "InterlockedDecrement",
  356. "address": "0x43e0ec"
  357. },
  358. {
  359. "name": "GetCurrentThread",
  360. "address": "0x43e0f0"
  361. },
  362. {
  363. "name": "WriteFile",
  364. "address": "0x43e0f4"
  365. },
  366. {
  367. "name": "GetStdHandle",
  368. "address": "0x43e0f8"
  369. },
  370. {
  371. "name": "GetModuleFileNameW",
  372. "address": "0x43e0fc"
  373. },
  374. {
  375. "name": "SetHandleCount",
  376. "address": "0x43e100"
  377. },
  378. {
  379. "name": "GetFileType",
  380. "address": "0x43e104"
  381. },
  382. {
  383. "name": "FreeEnvironmentStringsW",
  384. "address": "0x43e108"
  385. },
  386. {
  387. "name": "GetEnvironmentStringsW",
  388. "address": "0x43e10c"
  389. },
  390. {
  391. "name": "HeapCreate",
  392. "address": "0x43e110"
  393. },
  394. {
  395. "name": "HeapDestroy",
  396. "address": "0x43e114"
  397. },
  398. {
  399. "name": "QueryPerformanceCounter",
  400. "address": "0x43e118"
  401. },
  402. {
  403. "name": "GetTickCount",
  404. "address": "0x43e11c"
  405. },
  406. {
  407. "name": "GetCurrentProcessId",
  408. "address": "0x43e120"
  409. },
  410. {
  411. "name": "GetSystemTimeAsFileTime",
  412. "address": "0x43e124"
  413. },
  414. {
  415. "name": "GetCPInfo",
  416. "address": "0x43e128"
  417. },
  418. {
  419. "name": "GetACP",
  420. "address": "0x43e12c"
  421. },
  422. {
  423. "name": "GetOEMCP",
  424. "address": "0x43e130"
  425. },
  426. {
  427. "name": "IsValidCodePage",
  428. "address": "0x43e134"
  429. },
  430. {
  431. "name": "HeapFree",
  432. "address": "0x43e138"
  433. },
  434. {
  435. "name": "Sleep",
  436. "address": "0x43e13c"
  437. },
  438. {
  439. "name": "WideCharToMultiByte",
  440. "address": "0x43e140"
  441. },
  442. {
  443. "name": "HeapSize",
  444. "address": "0x43e144"
  445. },
  446. {
  447. "name": "RtlUnwind",
  448. "address": "0x43e148"
  449. },
  450. {
  451. "name": "MultiByteToWideChar",
  452. "address": "0x43e14c"
  453. },
  454. {
  455. "name": "SetFilePointer",
  456. "address": "0x43e150"
  457. },
  458. {
  459. "name": "GetConsoleCP",
  460. "address": "0x43e154"
  461. },
  462. {
  463. "name": "GetConsoleMode",
  464. "address": "0x43e158"
  465. },
  466. {
  467. "name": "RaiseException",
  468. "address": "0x43e15c"
  469. },
  470. {
  471. "name": "LCMapStringW",
  472. "address": "0x43e160"
  473. },
  474. {
  475. "name": "GetStringTypeW",
  476. "address": "0x43e164"
  477. },
  478. {
  479. "name": "HeapAlloc",
  480. "address": "0x43e168"
  481. },
  482. {
  483. "name": "HeapReAlloc",
  484. "address": "0x43e16c"
  485. },
  486. {
  487. "name": "CreateFileW",
  488. "address": "0x43e170"
  489. }
  490. ],
  491. "dll": "KERNEL32.dll"
  492. },
  493. {
  494. "imports": [
  495. {
  496. "name": "VkKeyScanA",
  497. "address": "0x43e178"
  498. },
  499. {
  500. "name": "DrawFrameControl",
  501. "address": "0x43e17c"
  502. },
  503. {
  504. "name": "CreateAcceleratorTableA",
  505. "address": "0x43e180"
  506. },
  507. {
  508. "name": "ValidateRect",
  509. "address": "0x43e184"
  510. },
  511. {
  512. "name": "SetActiveWindow",
  513. "address": "0x43e188"
  514. },
  515. {
  516. "name": "GetMessageTime",
  517. "address": "0x43e18c"
  518. },
  519. {
  520. "name": "GetScrollBarInfo",
  521. "address": "0x43e190"
  522. }
  523. ],
  524. "dll": "USER32.dll"
  525. }
  526. ],
  527. "digital_signers": null,
  528. "exported_dll_name": "cexucuga.exe",
  529. "actual_checksum": "0x0005209a",
  530. "overlay": null,
  531. "imagebase": "0x00400000",
  532. "reported_checksum": "0x0005209a",
  533. "icon_hash": null,
  534. "entrypoint": "0x004233dd",
  535. "timestamp": "2018-07-08 15:16:11",
  536. "osversion": "5.1",
  537. "sections": [
  538. {
  539. "name": ".text",
  540. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  541. "virtual_address": "0x00001000",
  542. "size_of_data": "0x0003ce00",
  543. "entropy": "6.99",
  544. "raw_address": "0x00000400",
  545. "virtual_size": "0x0003cc36",
  546. "characteristics_raw": "0x60000020"
  547. },
  548. {
  549. "name": ".rdata",
  550. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  551. "virtual_address": "0x0003e000",
  552. "size_of_data": "0x00006a00",
  553. "entropy": "6.48",
  554. "raw_address": "0x0003d200",
  555. "virtual_size": "0x0000680c",
  556. "characteristics_raw": "0x40000040"
  557. },
  558. {
  559. "name": ".data",
  560. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  561. "virtual_address": "0x00045000",
  562. "size_of_data": "0x00002000",
  563. "entropy": "2.29",
  564. "raw_address": "0x00043c00",
  565. "virtual_size": "0x0001ff48",
  566. "characteristics_raw": "0xc0000040"
  567. },
  568. {
  569. "name": ".rsrc",
  570. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  571. "virtual_address": "0x00065000",
  572. "size_of_data": "0x00005800",
  573. "entropy": "5.24",
  574. "raw_address": "0x00045c00",
  575. "virtual_size": "0x00005758",
  576. "characteristics_raw": "0x40000040"
  577. },
  578. {
  579. "name": ".reloc",
  580. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  581. "virtual_address": "0x0006b000",
  582. "size_of_data": "0x00001400",
  583. "entropy": "6.11",
  584. "raw_address": "0x0004b400",
  585. "virtual_size": "0x000013ce",
  586. "characteristics_raw": "0x42000040"
  587. }
  588. ],
  589. "resources": [],
  590. "dirents": [
  591. {
  592. "virtual_address": "0x000447c0",
  593. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  594. "size": "0x0000004c"
  595. },
  596. {
  597. "virtual_address": "0x00043e84",
  598. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  599. "size": "0x0000003c"
  600. },
  601. {
  602. "virtual_address": "0x00065000",
  603. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  604. "size": "0x00005758"
  605. },
  606. {
  607. "virtual_address": "0x00000000",
  608. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  609. "size": "0x00000000"
  610. },
  611. {
  612. "virtual_address": "0x00000000",
  613. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  614. "size": "0x00000000"
  615. },
  616. {
  617. "virtual_address": "0x0006b000",
  618. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  619. "size": "0x000010fc"
  620. },
  621. {
  622. "virtual_address": "0x0003e1e0",
  623. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  624. "size": "0x0000001c"
  625. },
  626. {
  627. "virtual_address": "0x00000000",
  628. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  629. "size": "0x00000000"
  630. },
  631. {
  632. "virtual_address": "0x00000000",
  633. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  634. "size": "0x00000000"
  635. },
  636. {
  637. "virtual_address": "0x00000000",
  638. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  639. "size": "0x00000000"
  640. },
  641. {
  642. "virtual_address": "0x00000000",
  643. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  644. "size": "0x00000000"
  645. },
  646. {
  647. "virtual_address": "0x00000000",
  648. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  649. "size": "0x00000000"
  650. },
  651. {
  652. "virtual_address": "0x0003e000",
  653. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  654. "size": "0x00000198"
  655. },
  656. {
  657. "virtual_address": "0x00000000",
  658. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  659. "size": "0x00000000"
  660. },
  661. {
  662. "virtual_address": "0x00000000",
  663. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  664. "size": "0x00000000"
  665. },
  666. {
  667. "virtual_address": "0x00000000",
  668. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  669. "size": "0x00000000"
  670. }
  671. ],
  672. "exports": [
  673. {
  674. "ordinal": 1,
  675. "name": "_MyFunc124@4",
  676. "address": "0x41f139"
  677. }
  678. ],
  679. "guest_signers": {},
  680. "imphash": "4cbd52413dc2cb104bf3a2d4e85df04b",
  681. "icon_fuzzy": null,
  682. "icon": null,
  683. "pdbpath": "C:\\yuw jaf_yonavekocev\\sakig82_hayiwugog60 yamerazituduf.pdb\\x00ucuga.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p",
  684. "imported_dll_count": 2,
  685. "versioninfo": []
  686. }
  687. }
  688.  
  689. [*] Resolved APIs: [
  690. "kernel32.dll.FlsAlloc",
  691. "kernel32.dll.FlsGetValue",
  692. "kernel32.dll.FlsSetValue",
  693. "kernel32.dll.FlsFree",
  694. "kernel32.dll.VirtualProtect",
  695. "kernel32.dll.LoadLibraryA",
  696. "kernel32.dll.VirtualAlloc",
  697. "kernel32.dll.VirtualFree",
  698. "kernel32.dll.GetVersionExA",
  699. "kernel32.dll.TerminateProcess",
  700. "kernel32.dll.ExitProcess",
  701. "kernel32.dll.SetErrorMode",
  702. "kernel32.dll.FreeConsole",
  703. "kernel32.dll.Sleep",
  704. "kernel32.dll.OutputDebugStringW",
  705. "msvcr100.dll.atexit"
  706. ]
  707.  
  708. [*] Static Analysis: {
  709. "pe": {
  710. "peid_signatures": null,
  711. "imports": [
  712. {
  713. "imports": [
  714. {
  715. "name": "ExpandEnvironmentStringsW",
  716. "address": "0x43e000"
  717. },
  718. {
  719. "name": "GlobalAlloc",
  720. "address": "0x43e004"
  721. },
  722. {
  723. "name": "GetDriveTypeW",
  724. "address": "0x43e008"
  725. },
  726. {
  727. "name": "GetModuleHandleW",
  728. "address": "0x43e00c"
  729. },
  730. {
  731. "name": "GetSystemDirectoryW",
  732. "address": "0x43e010"
  733. },
  734. {
  735. "name": "GetCommandLineA",
  736. "address": "0x43e014"
  737. },
  738. {
  739. "name": "SetEnvironmentVariableW",
  740. "address": "0x43e018"
  741. },
  742. {
  743. "name": "GetFirmwareEnvironmentVariableA",
  744. "address": "0x43e01c"
  745. },
  746. {
  747. "name": "HeapLock",
  748. "address": "0x43e020"
  749. },
  750. {
  751. "name": "ReplaceFileW",
  752. "address": "0x43e024"
  753. },
  754. {
  755. "name": "EnumTimeFormatsW",
  756. "address": "0x43e028"
  757. },
  758. {
  759. "name": "GetVolumePathNamesForVolumeNameW",
  760. "address": "0x43e02c"
  761. },
  762. {
  763. "name": "ReadConsoleW",
  764. "address": "0x43e030"
  765. },
  766. {
  767. "name": "GetProcAddress",
  768. "address": "0x43e034"
  769. },
  770. {
  771. "name": "LoadLibraryA",
  772. "address": "0x43e038"
  773. },
  774. {
  775. "name": "TryEnterCriticalSection",
  776. "address": "0x43e03c"
  777. },
  778. {
  779. "name": "IsProcessorFeaturePresent",
  780. "address": "0x43e040"
  781. },
  782. {
  783. "name": "GetLastError",
  784. "address": "0x43e044"
  785. },
  786. {
  787. "name": "_lclose",
  788. "address": "0x43e048"
  789. },
  790. {
  791. "name": "GetUserDefaultLCID",
  792. "address": "0x43e04c"
  793. },
  794. {
  795. "name": "CreateMutexW",
  796. "address": "0x43e050"
  797. },
  798. {
  799. "name": "GetTempPathW",
  800. "address": "0x43e054"
  801. },
  802. {
  803. "name": "InitializeSListHead",
  804. "address": "0x43e058"
  805. },
  806. {
  807. "name": "CloseHandle",
  808. "address": "0x43e05c"
  809. },
  810. {
  811. "name": "IsValidLocale",
  812. "address": "0x43e060"
  813. },
  814. {
  815. "name": "EnumSystemLocalesA",
  816. "address": "0x43e064"
  817. },
  818. {
  819. "name": "GetLocaleInfoA",
  820. "address": "0x43e068"
  821. },
  822. {
  823. "name": "WriteConsoleW",
  824. "address": "0x43e06c"
  825. },
  826. {
  827. "name": "SetStdHandle",
  828. "address": "0x43e070"
  829. },
  830. {
  831. "name": "ReadFile",
  832. "address": "0x43e074"
  833. },
  834. {
  835. "name": "FlushFileBuffers",
  836. "address": "0x43e078"
  837. },
  838. {
  839. "name": "ExitProcess",
  840. "address": "0x43e07c"
  841. },
  842. {
  843. "name": "DecodePointer",
  844. "address": "0x43e080"
  845. },
  846. {
  847. "name": "GetCommandLineW",
  848. "address": "0x43e084"
  849. },
  850. {
  851. "name": "HeapSetInformation",
  852. "address": "0x43e088"
  853. },
  854. {
  855. "name": "GetStartupInfoW",
  856. "address": "0x43e08c"
  857. },
  858. {
  859. "name": "EncodePointer",
  860. "address": "0x43e090"
  861. },
  862. {
  863. "name": "InitializeCriticalSectionAndSpinCount",
  864. "address": "0x43e094"
  865. },
  866. {
  867. "name": "DeleteCriticalSection",
  868. "address": "0x43e098"
  869. },
  870. {
  871. "name": "LeaveCriticalSection",
  872. "address": "0x43e09c"
  873. },
  874. {
  875. "name": "FatalAppExitA",
  876. "address": "0x43e0a0"
  877. },
  878. {
  879. "name": "EnterCriticalSection",
  880. "address": "0x43e0a4"
  881. },
  882. {
  883. "name": "SetConsoleCtrlHandler",
  884. "address": "0x43e0a8"
  885. },
  886. {
  887. "name": "FreeLibrary",
  888. "address": "0x43e0ac"
  889. },
  890. {
  891. "name": "InterlockedExchange",
  892. "address": "0x43e0b0"
  893. },
  894. {
  895. "name": "LoadLibraryW",
  896. "address": "0x43e0b4"
  897. },
  898. {
  899. "name": "GetLocaleInfoW",
  900. "address": "0x43e0b8"
  901. },
  902. {
  903. "name": "UnhandledExceptionFilter",
  904. "address": "0x43e0bc"
  905. },
  906. {
  907. "name": "SetUnhandledExceptionFilter",
  908. "address": "0x43e0c0"
  909. },
  910. {
  911. "name": "IsDebuggerPresent",
  912. "address": "0x43e0c4"
  913. },
  914. {
  915. "name": "TerminateProcess",
  916. "address": "0x43e0c8"
  917. },
  918. {
  919. "name": "GetCurrentProcess",
  920. "address": "0x43e0cc"
  921. },
  922. {
  923. "name": "TlsAlloc",
  924. "address": "0x43e0d0"
  925. },
  926. {
  927. "name": "TlsGetValue",
  928. "address": "0x43e0d4"
  929. },
  930. {
  931. "name": "TlsSetValue",
  932. "address": "0x43e0d8"
  933. },
  934. {
  935. "name": "TlsFree",
  936. "address": "0x43e0dc"
  937. },
  938. {
  939. "name": "InterlockedIncrement",
  940. "address": "0x43e0e0"
  941. },
  942. {
  943. "name": "SetLastError",
  944. "address": "0x43e0e4"
  945. },
  946. {
  947. "name": "GetCurrentThreadId",
  948. "address": "0x43e0e8"
  949. },
  950. {
  951. "name": "InterlockedDecrement",
  952. "address": "0x43e0ec"
  953. },
  954. {
  955. "name": "GetCurrentThread",
  956. "address": "0x43e0f0"
  957. },
  958. {
  959. "name": "WriteFile",
  960. "address": "0x43e0f4"
  961. },
  962. {
  963. "name": "GetStdHandle",
  964. "address": "0x43e0f8"
  965. },
  966. {
  967. "name": "GetModuleFileNameW",
  968. "address": "0x43e0fc"
  969. },
  970. {
  971. "name": "SetHandleCount",
  972. "address": "0x43e100"
  973. },
  974. {
  975. "name": "GetFileType",
  976. "address": "0x43e104"
  977. },
  978. {
  979. "name": "FreeEnvironmentStringsW",
  980. "address": "0x43e108"
  981. },
  982. {
  983. "name": "GetEnvironmentStringsW",
  984. "address": "0x43e10c"
  985. },
  986. {
  987. "name": "HeapCreate",
  988. "address": "0x43e110"
  989. },
  990. {
  991. "name": "HeapDestroy",
  992. "address": "0x43e114"
  993. },
  994. {
  995. "name": "QueryPerformanceCounter",
  996. "address": "0x43e118"
  997. },
  998. {
  999. "name": "GetTickCount",
  1000. "address": "0x43e11c"
  1001. },
  1002. {
  1003. "name": "GetCurrentProcessId",
  1004. "address": "0x43e120"
  1005. },
  1006. {
  1007. "name": "GetSystemTimeAsFileTime",
  1008. "address": "0x43e124"
  1009. },
  1010. {
  1011. "name": "GetCPInfo",
  1012. "address": "0x43e128"
  1013. },
  1014. {
  1015. "name": "GetACP",
  1016. "address": "0x43e12c"
  1017. },
  1018. {
  1019. "name": "GetOEMCP",
  1020. "address": "0x43e130"
  1021. },
  1022. {
  1023. "name": "IsValidCodePage",
  1024. "address": "0x43e134"
  1025. },
  1026. {
  1027. "name": "HeapFree",
  1028. "address": "0x43e138"
  1029. },
  1030. {
  1031. "name": "Sleep",
  1032. "address": "0x43e13c"
  1033. },
  1034. {
  1035. "name": "WideCharToMultiByte",
  1036. "address": "0x43e140"
  1037. },
  1038. {
  1039. "name": "HeapSize",
  1040. "address": "0x43e144"
  1041. },
  1042. {
  1043. "name": "RtlUnwind",
  1044. "address": "0x43e148"
  1045. },
  1046. {
  1047. "name": "MultiByteToWideChar",
  1048. "address": "0x43e14c"
  1049. },
  1050. {
  1051. "name": "SetFilePointer",
  1052. "address": "0x43e150"
  1053. },
  1054. {
  1055. "name": "GetConsoleCP",
  1056. "address": "0x43e154"
  1057. },
  1058. {
  1059. "name": "GetConsoleMode",
  1060. "address": "0x43e158"
  1061. },
  1062. {
  1063. "name": "RaiseException",
  1064. "address": "0x43e15c"
  1065. },
  1066. {
  1067. "name": "LCMapStringW",
  1068. "address": "0x43e160"
  1069. },
  1070. {
  1071. "name": "GetStringTypeW",
  1072. "address": "0x43e164"
  1073. },
  1074. {
  1075. "name": "HeapAlloc",
  1076. "address": "0x43e168"
  1077. },
  1078. {
  1079. "name": "HeapReAlloc",
  1080. "address": "0x43e16c"
  1081. },
  1082. {
  1083. "name": "CreateFileW",
  1084. "address": "0x43e170"
  1085. }
  1086. ],
  1087. "dll": "KERNEL32.dll"
  1088. },
  1089. {
  1090. "imports": [
  1091. {
  1092. "name": "VkKeyScanA",
  1093. "address": "0x43e178"
  1094. },
  1095. {
  1096. "name": "DrawFrameControl",
  1097. "address": "0x43e17c"
  1098. },
  1099. {
  1100. "name": "CreateAcceleratorTableA",
  1101. "address": "0x43e180"
  1102. },
  1103. {
  1104. "name": "ValidateRect",
  1105. "address": "0x43e184"
  1106. },
  1107. {
  1108. "name": "SetActiveWindow",
  1109. "address": "0x43e188"
  1110. },
  1111. {
  1112. "name": "GetMessageTime",
  1113. "address": "0x43e18c"
  1114. },
  1115. {
  1116. "name": "GetScrollBarInfo",
  1117. "address": "0x43e190"
  1118. }
  1119. ],
  1120. "dll": "USER32.dll"
  1121. }
  1122. ],
  1123. "digital_signers": null,
  1124. "exported_dll_name": "cexucuga.exe",
  1125. "actual_checksum": "0x0005209a",
  1126. "overlay": null,
  1127. "imagebase": "0x00400000",
  1128. "reported_checksum": "0x0005209a",
  1129. "icon_hash": null,
  1130. "entrypoint": "0x004233dd",
  1131. "timestamp": "2018-07-08 15:16:11",
  1132. "osversion": "5.1",
  1133. "sections": [
  1134. {
  1135. "name": ".text",
  1136. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1137. "virtual_address": "0x00001000",
  1138. "size_of_data": "0x0003ce00",
  1139. "entropy": "6.99",
  1140. "raw_address": "0x00000400",
  1141. "virtual_size": "0x0003cc36",
  1142. "characteristics_raw": "0x60000020"
  1143. },
  1144. {
  1145. "name": ".rdata",
  1146. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1147. "virtual_address": "0x0003e000",
  1148. "size_of_data": "0x00006a00",
  1149. "entropy": "6.48",
  1150. "raw_address": "0x0003d200",
  1151. "virtual_size": "0x0000680c",
  1152. "characteristics_raw": "0x40000040"
  1153. },
  1154. {
  1155. "name": ".data",
  1156. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1157. "virtual_address": "0x00045000",
  1158. "size_of_data": "0x00002000",
  1159. "entropy": "2.29",
  1160. "raw_address": "0x00043c00",
  1161. "virtual_size": "0x0001ff48",
  1162. "characteristics_raw": "0xc0000040"
  1163. },
  1164. {
  1165. "name": ".rsrc",
  1166. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1167. "virtual_address": "0x00065000",
  1168. "size_of_data": "0x00005800",
  1169. "entropy": "5.24",
  1170. "raw_address": "0x00045c00",
  1171. "virtual_size": "0x00005758",
  1172. "characteristics_raw": "0x40000040"
  1173. },
  1174. {
  1175. "name": ".reloc",
  1176. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1177. "virtual_address": "0x0006b000",
  1178. "size_of_data": "0x00001400",
  1179. "entropy": "6.11",
  1180. "raw_address": "0x0004b400",
  1181. "virtual_size": "0x000013ce",
  1182. "characteristics_raw": "0x42000040"
  1183. }
  1184. ],
  1185. "resources": [],
  1186. "dirents": [
  1187. {
  1188. "virtual_address": "0x000447c0",
  1189. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1190. "size": "0x0000004c"
  1191. },
  1192. {
  1193. "virtual_address": "0x00043e84",
  1194. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1195. "size": "0x0000003c"
  1196. },
  1197. {
  1198. "virtual_address": "0x00065000",
  1199. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1200. "size": "0x00005758"
  1201. },
  1202. {
  1203. "virtual_address": "0x00000000",
  1204. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1205. "size": "0x00000000"
  1206. },
  1207. {
  1208. "virtual_address": "0x00000000",
  1209. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1210. "size": "0x00000000"
  1211. },
  1212. {
  1213. "virtual_address": "0x0006b000",
  1214. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1215. "size": "0x000010fc"
  1216. },
  1217. {
  1218. "virtual_address": "0x0003e1e0",
  1219. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1220. "size": "0x0000001c"
  1221. },
  1222. {
  1223. "virtual_address": "0x00000000",
  1224. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1225. "size": "0x00000000"
  1226. },
  1227. {
  1228. "virtual_address": "0x00000000",
  1229. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1230. "size": "0x00000000"
  1231. },
  1232. {
  1233. "virtual_address": "0x00000000",
  1234. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1235. "size": "0x00000000"
  1236. },
  1237. {
  1238. "virtual_address": "0x00000000",
  1239. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1240. "size": "0x00000000"
  1241. },
  1242. {
  1243. "virtual_address": "0x00000000",
  1244. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1245. "size": "0x00000000"
  1246. },
  1247. {
  1248. "virtual_address": "0x0003e000",
  1249. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1250. "size": "0x00000198"
  1251. },
  1252. {
  1253. "virtual_address": "0x00000000",
  1254. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1255. "size": "0x00000000"
  1256. },
  1257. {
  1258. "virtual_address": "0x00000000",
  1259. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1260. "size": "0x00000000"
  1261. },
  1262. {
  1263. "virtual_address": "0x00000000",
  1264. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1265. "size": "0x00000000"
  1266. }
  1267. ],
  1268. "exports": [
  1269. {
  1270. "ordinal": 1,
  1271. "name": "_MyFunc124@4",
  1272. "address": "0x41f139"
  1273. }
  1274. ],
  1275. "guest_signers": {},
  1276. "imphash": "4cbd52413dc2cb104bf3a2d4e85df04b",
  1277. "icon_fuzzy": null,
  1278. "icon": null,
  1279. "pdbpath": "C:\\yuw jaf_yonavekocev\\sakig82_hayiwugog60 yamerazituduf.pdb\\x00ucuga.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p",
  1280. "imported_dll_count": 2,
  1281. "versioninfo": []
  1282. }
  1283. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!