API tools faq
paste
paladin316

Exes_3304788eac83e8f043be3f2655f08ef8_exe_2019-06-27_20_30.json

paladin316
Jun 27th, 2019
2,143
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.24 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_3304788eac83e8f043be3f2655f08ef8.exe"
  7. [*] File Size: 2880000
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  9. [*] SHA256: "1e71965e20aa50df21375a1db003e92823abacac1c1850c2d0922d43420e2d30"
  10. [*] MD5: "3304788eac83e8f043be3f2655f08ef8"
  11. [*] SHA1: "9aee63e75d36fec78c98cf2d7ce5ef1bb5ed07b1"
  12. [*] SHA512: "c54200611c75bde16f70ab75eb4d3a734839d632ae42eaa3f33991b26fbde3a0ef439ef8fd316707a8b7fe254ddc19c767a610ebeb6853f85fdb99a65251fdbf"
  13. [*] CRC32: "1AC0FA72"
  14. [*] SSDEEP: "49152:yhtM+KQF3mcouqPCjzBZvt7gqLL2G8Jz9jOaTDpeGZ9+xtlL7:+tDRpmcRqiBtt7gqLMOs9glL"
  15.  
  16. [*] Process Execution: [
  17. "Exes_3304788eac83e8f043be3f2655f08ef8.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: UPX1, entropy: 7.88, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x002bee00, virtual_size: 0x002bf000"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "The executable is compressed using UPX",
  31. "Details": [
  32. {
  33. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x003d3000"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "File has been identified by 47 Antiviruses on VirusTotal as malicious",
  39. "Details": [
  40. {
  41. "MicroWorld-eScan": "Trojan.GenericKD.31871038"
  42. },
  43. {
  44. "FireEye": "Trojan.GenericKD.31871038"
  45. },
  46. {
  47. "CAT-QuickHeal": "Trojan.Tiggre"
  48. },
  49. {
  50. "McAfee": "Artemis!3304788EAC83"
  51. },
  52. {
  53. "CrowdStrike": "win/malicious_confidence_100% (W)"
  54. },
  55. {
  56. "Alibaba": "TrojanPSW:Win32/Generic.f4b10533"
  57. },
  58. {
  59. "K7GW": "Password-Stealer ( 0054bdb01 )"
  60. },
  61. {
  62. "K7AntiVirus": "Password-Stealer ( 0054bdb01 )"
  63. },
  64. {
  65. "Arcabit": "Trojan.Generic.D1E6503E"
  66. },
  67. {
  68. "TrendMicro": "Virus.Win32.VIRUT.USXVPD819"
  69. },
  70. {
  71. "NANO-Antivirus": "Trojan.Win32.ULPM.fpceaj"
  72. },
  73. {
  74. "Cyren": "W32/Zbot.GH.gen!Eldorado"
  75. },
  76. {
  77. "Symantec": "ML.Attribute.HighConfidence"
  78. },
  79. {
  80. "Avast": "Win32:Trojan-gen"
  81. },
  82. {
  83. "Kaspersky": "Trojan.Win32.Agentb.jpon"
  84. },
  85. {
  86. "BitDefender": "Trojan.GenericKD.31871038"
  87. },
  88. {
  89. "Paloalto": "generic.ml"
  90. },
  91. {
  92. "AegisLab": "Trojan.Win32.Generic.4!c"
  93. },
  94. {
  95. "Tencent": "Win32.Trojan.Agentb.Lfzo"
  96. },
  97. {
  98. "Ad-Aware": "Trojan.GenericKD.31871038"
  99. },
  100. {
  101. "Emsisoft": "Trojan.GenericKD.31871038 (B)"
  102. },
  103. {
  104. "Comodo": "Malware@#1as8hm8j7flkp"
  105. },
  106. {
  107. "F-Secure": "Trojan.TR/PSW.Agent.elvvc"
  108. },
  109. {
  110. "DrWeb": "Trojan.SpyBot.808"
  111. },
  112. {
  113. "Zillya": "Trojan.Agentb.Win32.22622"
  114. },
  115. {
  116. "McAfee-GW-Edition": "BehavesLike.Win32.Virus.vc"
  117. },
  118. {
  119. "F-Prot": "W32/Zbot.GH.gen!Eldorado"
  120. },
  121. {
  122. "Jiangmin": "Trojan.Agentb.evf"
  123. },
  124. {
  125. "Webroot": "W32.Trojan.Gen"
  126. },
  127. {
  128. "Avira": "TR/PSW.Agent.elvvc"
  129. },
  130. {
  131. "Antiy-AVL": "GrayWare/Win32.Presenoker"
  132. },
  133. {
  134. "Microsoft": "Trojan:Win32/Occamy.C"
  135. },
  136. {
  137. "ZoneAlarm": "Trojan.Win32.Agentb.jpon"
  138. },
  139. {
  140. "GData": "Trojan.GenericKD.31871038"
  141. },
  142. {
  143. "VBA32": "Trojan.SpyBot"
  144. },
  145. {
  146. "MAX": "malware (ai score=100)"
  147. },
  148. {
  149. "Cylance": "Unsafe"
  150. },
  151. {
  152. "ESET-NOD32": "a variant of Win32/PSW.Agent.OGL"
  153. },
  154. {
  155. "TrendMicro-HouseCall": "Virus.Win32.VIRUT.USXVPD819"
  156. },
  157. {
  158. "Rising": "Virus.Virut!8.44 (CLOUD)"
  159. },
  160. {
  161. "Yandex": "Trojan.PWS.Agent!Mnw8FCN0qR0"
  162. },
  163. {
  164. "Ikarus": "Trojan-PSW.Agent"
  165. },
  166. {
  167. "Fortinet": "W32/Agent.OGL!tr.pws"
  168. },
  169. {
  170. "AVG": "Win32:Trojan-gen"
  171. },
  172. {
  173. "Cybereason": "malicious.eac83e"
  174. },
  175. {
  176. "Panda": "Trj/Agent.XL"
  177. },
  178. {
  179. "Qihoo-360": "HEUR/QVM11.1.13C9.Malware.Gen"
  180. }
  181. ]
  182. }
  183. ]
  184.  
  185. [*] Started Service: []
  186.  
  187. [*] Executed Commands: []
  188.  
  189. [*] Mutexes: []
  190.  
  191. [*] Modified Files: []
  192.  
  193. [*] Deleted Files: []
  194.  
  195. [*] Modified Registry Keys: []
  196.  
  197. [*] Deleted Registry Keys: []
  198.  
  199. [*] DNS Communications: []
  200.  
  201. [*] Domains: []
  202.  
  203. [*] Network Communication - ICMP: []
  204.  
  205. [*] Network Communication - HTTP: []
  206.  
  207. [*] Network Communication - SMTP: []
  208.  
  209. [*] Network Communication - Hosts: []
  210.  
  211. [*] Network Communication - IRC: []
  212.  
  213. [*] Static Analysis: {
  214. "pe": {
  215. "peid_signatures": null,
  216. "imports": [
  217. {
  218. "imports": [
  219. {
  220. "name": "LoadLibraryA",
  221. "address": "0xa93064"
  222. },
  223. {
  224. "name": "GetProcAddress",
  225. "address": "0xa93068"
  226. },
  227. {
  228. "name": "VirtualProtect",
  229. "address": "0xa9306c"
  230. },
  231. {
  232. "name": "VirtualAlloc",
  233. "address": "0xa93070"
  234. },
  235. {
  236. "name": "VirtualFree",
  237. "address": "0xa93074"
  238. },
  239. {
  240. "name": "ExitProcess",
  241. "address": "0xa93078"
  242. }
  243. ],
  244. "dll": "KERNEL32.DLL"
  245. },
  246. {
  247. "imports": [
  248. {
  249. "name": "_iob",
  250. "address": "0xa93080"
  251. }
  252. ],
  253. "dll": "msvcrt.dll"
  254. },
  255. {
  256. "imports": [
  257. {
  258. "name": "timeEndPeriod",
  259. "address": "0xa93088"
  260. }
  261. ],
  262. "dll": "WINMM.DLL"
  263. },
  264. {
  265. "imports": [
  266. {
  267. "name": "WSAGetOverlappedResult",
  268. "address": "0xa93090"
  269. }
  270. ],
  271. "dll": "WS2_32.dll"
  272. }
  273. ],
  274. "digital_signers": null,
  275. "exported_dll_name": null,
  276. "actual_checksum": "0x002cd06a",
  277. "overlay": null,
  278. "imagebase": "0x00400000",
  279. "reported_checksum": "0x00000000",
  280. "icon_hash": null,
  281. "entrypoint": "0x00a92ac0",
  282. "timestamp": "2019-03-21 14:41:18",
  283. "osversion": "4.0",
  284. "sections": [
  285. {
  286. "name": "UPX0",
  287. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  288. "virtual_address": "0x00001000",
  289. "size_of_data": "0x00000000",
  290. "entropy": "0.00",
  291. "raw_address": "0x00000200",
  292. "virtual_size": "0x003d3000",
  293. "characteristics_raw": "0xe0000080"
  294. },
  295. {
  296. "name": "UPX1",
  297. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  298. "virtual_address": "0x003d4000",
  299. "size_of_data": "0x002bee00",
  300. "entropy": "7.88",
  301. "raw_address": "0x00000200",
  302. "virtual_size": "0x002bf000",
  303. "characteristics_raw": "0xe0000040"
  304. },
  305. {
  306. "name": "UPX2",
  307. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  308. "virtual_address": "0x00693000",
  309. "size_of_data": "0x00000200",
  310. "entropy": "3.27",
  311. "raw_address": "0x002bf000",
  312. "virtual_size": "0x00001000",
  313. "characteristics_raw": "0xc0000040"
  314. }
  315. ],
  316. "resources": [],
  317. "dirents": [
  318. {
  319. "virtual_address": "0x00000000",
  320. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  321. "size": "0x00000000"
  322. },
  323. {
  324. "virtual_address": "0x00693000",
  325. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  326. "size": "0x0000014c"
  327. },
  328. {
  329. "virtual_address": "0x00000000",
  330. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  331. "size": "0x00000000"
  332. },
  333. {
  334. "virtual_address": "0x00000000",
  335. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  336. "size": "0x00000000"
  337. },
  338. {
  339. "virtual_address": "0x00000000",
  340. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  341. "size": "0x00000000"
  342. },
  343. {
  344. "virtual_address": "0x0069314c",
  345. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  346. "size": "0x00000018"
  347. },
  348. {
  349. "virtual_address": "0x00000000",
  350. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  351. "size": "0x00000000"
  352. },
  353. {
  354. "virtual_address": "0x00000000",
  355. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  356. "size": "0x00000000"
  357. },
  358. {
  359. "virtual_address": "0x00000000",
  360. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  361. "size": "0x00000000"
  362. },
  363. {
  364. "virtual_address": "0x00692cb0",
  365. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  366. "size": "0x00000018"
  367. },
  368. {
  369. "virtual_address": "0x00000000",
  370. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  371. "size": "0x00000000"
  372. },
  373. {
  374. "virtual_address": "0x00000000",
  375. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  376. "size": "0x00000000"
  377. },
  378. {
  379. "virtual_address": "0x00000000",
  380. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  381. "size": "0x00000000"
  382. },
  383. {
  384. "virtual_address": "0x00000000",
  385. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  386. "size": "0x00000000"
  387. },
  388. {
  389. "virtual_address": "0x00000000",
  390. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  391. "size": "0x00000000"
  392. },
  393. {
  394. "virtual_address": "0x00000000",
  395. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  396. "size": "0x00000000"
  397. }
  398. ],
  399. "exports": [],
  400. "guest_signers": {},
  401. "imphash": "02c1de0d2fa1f59a1ea0088678b855f1",
  402. "icon_fuzzy": null,
  403. "icon": null,
  404. "pdbpath": null,
  405. "imported_dll_count": 4,
  406. "versioninfo": []
  407. }
  408. }
  409.  
  410. [*] Resolved APIs: [
  411. "kernel32.dll.AddVectoredExceptionHandler",
  412. "kernel32.dll.AreFileApisANSI",
  413. "kernel32.dll.CloseHandle",
  414. "kernel32.dll.CreateEventA",
  415. "kernel32.dll.CreateFileA",
  416. "kernel32.dll.CreateFileMappingA",
  417. "kernel32.dll.CreateFileMappingW",
  418. "kernel32.dll.CreateFileW",
  419. "kernel32.dll.CreateIoCompletionPort",
  420. "kernel32.dll.CreateMutexW",
  421. "kernel32.dll.CreateThread",
  422. "kernel32.dll.CreateWaitableTimerA",
  423. "kernel32.dll.DeleteCriticalSection",
  424. "kernel32.dll.DeleteFileA",
  425. "kernel32.dll.DeleteFileW",
  426. "kernel32.dll.DuplicateHandle",
  427. "kernel32.dll.EnterCriticalSection",
  428. "kernel32.dll.ExitProcess",
  429. "kernel32.dll.FlushFileBuffers",
  430. "kernel32.dll.FlushViewOfFile",
  431. "kernel32.dll.FormatMessageA",
  432. "kernel32.dll.FormatMessageW",
  433. "kernel32.dll.FreeEnvironmentStringsW",
  434. "kernel32.dll.FreeLibrary",
  435. "kernel32.dll.GetConsoleMode",
  436. "kernel32.dll.GetCurrentProcess",
  437. "kernel32.dll.GetCurrentProcessId",
  438. "kernel32.dll.GetCurrentThreadId",
  439. "kernel32.dll.GetDiskFreeSpaceA",
  440. "kernel32.dll.GetDiskFreeSpaceW",
  441. "kernel32.dll.GetEnvironmentStringsW",
  442. "kernel32.dll.GetFileAttributesA",
  443. "kernel32.dll.GetFileAttributesExW",
  444. "kernel32.dll.GetFileAttributesW",
  445. "kernel32.dll.GetFileSize",
  446. "kernel32.dll.GetFullPathNameA",
  447. "kernel32.dll.GetFullPathNameW",
  448. "kernel32.dll.GetLastError",
  449. "kernel32.dll.GetModuleHandleA",
  450. "kernel32.dll.GetProcAddress",
  451. "kernel32.dll.GetProcessAffinityMask",
  452. "kernel32.dll.GetProcessHeap",
  453. "kernel32.dll.GetQueuedCompletionStatus",
  454. "kernel32.dll.GetStartupInfoA",
  455. "kernel32.dll.GetStdHandle",
  456. "kernel32.dll.GetSystemInfo",
  457. "kernel32.dll.GetSystemTime",
  458. "kernel32.dll.GetSystemTimeAsFileTime",
  459. "kernel32.dll.GetTempPathA",
  460. "kernel32.dll.GetTempPathW",
  461. "kernel32.dll.GetTickCount",
  462. "kernel32.dll.GetVersionExA",
  463. "kernel32.dll.GetVersionExW",
  464. "kernel32.dll.HeapAlloc",
  465. "kernel32.dll.HeapCompact",
  466. "kernel32.dll.HeapCreate",
  467. "kernel32.dll.HeapDestroy",
  468. "kernel32.dll.HeapFree",
  469. "kernel32.dll.HeapReAlloc",
  470. "kernel32.dll.HeapSize",
  471. "kernel32.dll.HeapValidate",
  472. "kernel32.dll.InitializeCriticalSection",
  473. "kernel32.dll.InterlockedCompareExchange",
  474. "kernel32.dll.LeaveCriticalSection",
  475. "kernel32.dll.LoadLibraryA",
  476. "kernel32.dll.LoadLibraryW",
  477. "kernel32.dll.LocalFree",
  478. "kernel32.dll.LockFile",
  479. "kernel32.dll.LockFileEx",
  480. "kernel32.dll.MapViewOfFile",
  481. "kernel32.dll.MultiByteToWideChar",
  482. "kernel32.dll.OutputDebugStringA",
  483. "kernel32.dll.OutputDebugStringW",
  484. "kernel32.dll.QueryPerformanceCounter",
  485. "kernel32.dll.ReadFile",
  486. "kernel32.dll.SetConsoleCtrlHandler",
  487. "kernel32.dll.SetEndOfFile",
  488. "kernel32.dll.SetErrorMode",
  489. "kernel32.dll.SetEvent",
  490. "kernel32.dll.SetFilePointer",
  491. "kernel32.dll.SetProcessPriorityBoost",
  492. "kernel32.dll.SetUnhandledExceptionFilter",
  493. "kernel32.dll.SetWaitableTimer",
  494. "kernel32.dll.Sleep",
  495. "kernel32.dll.SwitchToThread",
  496. "kernel32.dll.SystemTimeToFileTime",
  497. "kernel32.dll.TerminateProcess",
  498. "kernel32.dll.TlsGetValue",
  499. "kernel32.dll.TryEnterCriticalSection",
  500. "kernel32.dll.UnhandledExceptionFilter",
  501. "kernel32.dll.UnlockFile",
  502. "kernel32.dll.UnlockFileEx",
  503. "kernel32.dll.UnmapViewOfFile",
  504. "kernel32.dll.VirtualAlloc",
  505. "kernel32.dll.VirtualFree",
  506. "kernel32.dll.VirtualProtect",
  507. "kernel32.dll.VirtualQuery",
  508. "kernel32.dll.WaitForSingleObject",
  509. "kernel32.dll.WaitForSingleObjectEx",
  510. "kernel32.dll.WideCharToMultiByte",
  511. "kernel32.dll.WriteConsoleW",
  512. "kernel32.dll.WriteFile",
  513. "msvcrt.dll.__dllonexit",
  514. "msvcrt.dll.__getmainargs",
  515. "msvcrt.dll.__initenv",
  516. "msvcrt.dll.__lconv_init",
  517. "msvcrt.dll.__set_app_type",
  518. "msvcrt.dll.__setusermatherr",
  519. "msvcrt.dll._acmdln",
  520. "msvcrt.dll._amsg_exit",
  521. "msvcrt.dll._beginthread",
  522. "msvcrt.dll._beginthreadex",
  523. "msvcrt.dll._cexit",
  524. "msvcrt.dll._endthreadex",
  525. "msvcrt.dll._errno",
  526. "msvcrt.dll._fmode",
  527. "msvcrt.dll._initterm",
  528. "msvcrt.dll._iob",
  529. "msvcrt.dll._lock",
  530. "msvcrt.dll._onexit",
  531. "msvcrt.dll.localtime",
  532. "msvcrt.dll.exit",
  533. "msvcrt.dll.fprintf",
  534. "msvcrt.dll.free",
  535. "msvcrt.dll.fwrite",
  536. "msvcrt.dll.malloc",
  537. "msvcrt.dll.memcmp",
  538. "msvcrt.dll.memcpy",
  539. "msvcrt.dll.memmove",
  540. "msvcrt.dll.memset",
  541. "msvcrt.dll.qsort",
  542. "msvcrt.dll.realloc",
  543. "msvcrt.dll.signal",
  544. "msvcrt.dll.strcmp",
  545. "msvcrt.dll.strcspn",
  546. "msvcrt.dll.strlen",
  547. "msvcrt.dll.strncmp",
  548. "msvcrt.dll.strrchr",
  549. "msvcrt.dll._unlock",
  550. "msvcrt.dll.abort",
  551. "msvcrt.dll.vfprintf",
  552. "msvcrt.dll.calloc",
  553. "winmm.dll.timeBeginPeriod",
  554. "winmm.dll.timeEndPeriod",
  555. "ws2_32.dll.WSAGetOverlappedResult",
  556. "kernel32.dll.AddVectoredContinueHandler",
  557. "kernel32.dll.GetQueuedCompletionStatusEx",
  558. "kernel32.dll.LoadLibraryExW",
  559. "advapi32.dll.SystemFunction036",
  560. "ntdll.dll.NtWaitForSingleObject",
  561. "cryptbase.dll.SystemFunction001",
  562. "cryptbase.dll.SystemFunction002",
  563. "cryptbase.dll.SystemFunction003",
  564. "cryptbase.dll.SystemFunction004",
  565. "cryptbase.dll.SystemFunction005",
  566. "cryptbase.dll.SystemFunction028",
  567. "cryptbase.dll.SystemFunction029",
  568. "cryptbase.dll.SystemFunction034",
  569. "cryptbase.dll.SystemFunction036",
  570. "cryptbase.dll.SystemFunction040",
  571. "cryptbase.dll.SystemFunction041",
  572. "kernel32.dll.SetHandleInformation",
  573. "ws2_32.dll.WSAStartup",
  574. "kernel32.dll.CancelIoEx",
  575. "kernel32.dll.SetFileCompletionNotificationModes",
  576. "ws2_32.dll.WSAEnumProtocolsW",
  577. "kernel32.dll.GetCommandLineW",
  578. "kernel32.dll.GetEnvironmentVariableW",
  579. "kernel32.dll.GetSystemDirectoryW",
  580. "advapi32.dll.OpenProcessToken",
  581. "advapi32.dll.GetTokenInformation",
  582. "advapi32.dll.ConvertSidToStringSidW",
  583. "kernel32.dll.WTSGetActiveConsoleSessionId",
  584. "wtsapi32.dll.WTSQuerySessionInformationW",
  585. "winsta.dll.WinStationQueryInformationW",
  586. "advapi32.dll.LookupAccountSidW",
  587. "sechost.dll.LookupAccountSidLocalW",
  588. "advapi32.dll.CreateWellKnownSid",
  589. "rpcrt4.dll.RpcStringBindingComposeW",
  590. "rpcrt4.dll.RpcBindingFromStringBindingW",
  591. "rpcrt4.dll.RpcStringFreeW",
  592. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  593. "sechost.dll.LookupAccountNameLocalW",
  594. "rpcrt4.dll.NdrClientCall2",
  595. "rpcrt4.dll.I_RpcExceptionFilter",
  596. "rpcrt4.dll.RpcBindingFree",
  597. "advapi32.dll.LookupAccountNameW",
  598. "advapi32.dll.RegOpenKeyExW",
  599. "kernel32.dll.GetTimeZoneInformation"
  600. ]
  601.  
  602. [*] Static Analysis: {
  603. "pe": {
  604. "peid_signatures": null,
  605. "imports": [
  606. {
  607. "imports": [
  608. {
  609. "name": "LoadLibraryA",
  610. "address": "0xa93064"
  611. },
  612. {
  613. "name": "GetProcAddress",
  614. "address": "0xa93068"
  615. },
  616. {
  617. "name": "VirtualProtect",
  618. "address": "0xa9306c"
  619. },
  620. {
  621. "name": "VirtualAlloc",
  622. "address": "0xa93070"
  623. },
  624. {
  625. "name": "VirtualFree",
  626. "address": "0xa93074"
  627. },
  628. {
  629. "name": "ExitProcess",
  630. "address": "0xa93078"
  631. }
  632. ],
  633. "dll": "KERNEL32.DLL"
  634. },
  635. {
  636. "imports": [
  637. {
  638. "name": "_iob",
  639. "address": "0xa93080"
  640. }
  641. ],
  642. "dll": "msvcrt.dll"
  643. },
  644. {
  645. "imports": [
  646. {
  647. "name": "timeEndPeriod",
  648. "address": "0xa93088"
  649. }
  650. ],
  651. "dll": "WINMM.DLL"
  652. },
  653. {
  654. "imports": [
  655. {
  656. "name": "WSAGetOverlappedResult",
  657. "address": "0xa93090"
  658. }
  659. ],
  660. "dll": "WS2_32.dll"
  661. }
  662. ],
  663. "digital_signers": null,
  664. "exported_dll_name": null,
  665. "actual_checksum": "0x002cd06a",
  666. "overlay": null,
  667. "imagebase": "0x00400000",
  668. "reported_checksum": "0x00000000",
  669. "icon_hash": null,
  670. "entrypoint": "0x00a92ac0",
  671. "timestamp": "2019-03-21 14:41:18",
  672. "osversion": "4.0",
  673. "sections": [
  674. {
  675. "name": "UPX0",
  676. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  677. "virtual_address": "0x00001000",
  678. "size_of_data": "0x00000000",
  679. "entropy": "0.00",
  680. "raw_address": "0x00000200",
  681. "virtual_size": "0x003d3000",
  682. "characteristics_raw": "0xe0000080"
  683. },
  684. {
  685. "name": "UPX1",
  686. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  687. "virtual_address": "0x003d4000",
  688. "size_of_data": "0x002bee00",
  689. "entropy": "7.88",
  690. "raw_address": "0x00000200",
  691. "virtual_size": "0x002bf000",
  692. "characteristics_raw": "0xe0000040"
  693. },
  694. {
  695. "name": "UPX2",
  696. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  697. "virtual_address": "0x00693000",
  698. "size_of_data": "0x00000200",
  699. "entropy": "3.27",
  700. "raw_address": "0x002bf000",
  701. "virtual_size": "0x00001000",
  702. "characteristics_raw": "0xc0000040"
  703. }
  704. ],
  705. "resources": [],
  706. "dirents": [
  707. {
  708. "virtual_address": "0x00000000",
  709. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  710. "size": "0x00000000"
  711. },
  712. {
  713. "virtual_address": "0x00693000",
  714. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  715. "size": "0x0000014c"
  716. },
  717. {
  718. "virtual_address": "0x00000000",
  719. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  720. "size": "0x00000000"
  721. },
  722. {
  723. "virtual_address": "0x00000000",
  724. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  725. "size": "0x00000000"
  726. },
  727. {
  728. "virtual_address": "0x00000000",
  729. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  730. "size": "0x00000000"
  731. },
  732. {
  733. "virtual_address": "0x0069314c",
  734. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  735. "size": "0x00000018"
  736. },
  737. {
  738. "virtual_address": "0x00000000",
  739. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  740. "size": "0x00000000"
  741. },
  742. {
  743. "virtual_address": "0x00000000",
  744. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  745. "size": "0x00000000"
  746. },
  747. {
  748. "virtual_address": "0x00000000",
  749. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  750. "size": "0x00000000"
  751. },
  752. {
  753. "virtual_address": "0x00692cb0",
  754. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  755. "size": "0x00000018"
  756. },
  757. {
  758. "virtual_address": "0x00000000",
  759. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  760. "size": "0x00000000"
  761. },
  762. {
  763. "virtual_address": "0x00000000",
  764. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  765. "size": "0x00000000"
  766. },
  767. {
  768. "virtual_address": "0x00000000",
  769. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  770. "size": "0x00000000"
  771. },
  772. {
  773. "virtual_address": "0x00000000",
  774. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  775. "size": "0x00000000"
  776. },
  777. {
  778. "virtual_address": "0x00000000",
  779. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  780. "size": "0x00000000"
  781. },
  782. {
  783. "virtual_address": "0x00000000",
  784. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  785. "size": "0x00000000"
  786. }
  787. ],
  788. "exports": [],
  789. "guest_signers": {},
  790. "imphash": "02c1de0d2fa1f59a1ea0088678b855f1",
  791. "icon_fuzzy": null,
  792. "icon": null,
  793. "pdbpath": null,
  794. "imported_dll_count": 4,
  795. "versioninfo": []
  796. }
  797. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!