API tools faq
paste
paladin316

bullmine_exe_2019-07-03_19_30.json

paladin316
Jul 3rd, 2019
2,266
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 99.71 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Starter"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "bullmine.exe"
  7. [*] File Size: 9453641
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive"
  9. [*] SHA256: "589cc0f7d0d93cc40a5f708732e40b4ebcec4206ff8fb66b866f3c02c6d3ce55"
  10. [*] MD5: "8a54ab259f341864cf6d7c7b6d1f679f"
  11. [*] SHA1: "0c276b6aca7ab852c3726975178f0851ff4aabad"
  12. [*] SHA512: "185bd2f51c390f335a4271c7e5d7a98bf3895f7aaa666231e0b0c3924ab65f741f36f5c91c22cdd52b864c7488c0c871a62cb7d516bf6857be427dba82d66c5c"
  13. [*] CRC32: "94670D02"
  14. [*] SSDEEP: "196608:GOm5r7iaZ1A6DuYpm5z1oFvd8CMYsr+MDkHI3Kl/ELI:45r7i21AGMz+oCi3A5ls0"
  15.  
  16. [*] Process Execution: [
  17. "bullmine.exe",
  18. "wscript.exe",
  19. "cmd.exe",
  20. "reg.exe",
  21. "startup.exe",
  22. "wscript.exe",
  23. "cmd.exe",
  24. "csrss.exe"
  25. ]
  26.  
  27. [*] Signatures Detected: [
  28. {
  29. "Description": "Detected script timer window indicative of sleep style evasion",
  30. "Details": [
  31. {
  32. "Window": "WSH-Timer"
  33. }
  34. ]
  35. },
  36. {
  37. "Description": "Reads data out of its own binary image",
  38. "Details": [
  39. {
  40. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00000000, length: 0x00000007"
  41. },
  42. {
  43. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00000000, length: 0x00002000"
  44. },
  45. {
  46. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00000007, length: 0x000ffff0"
  47. },
  48. {
  49. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00001ff0, length: 0x00002000"
  50. },
  51. {
  52. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00003fe0, length: 0x00002000"
  53. },
  54. {
  55. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00005fd0, length: 0x00002000"
  56. },
  57. {
  58. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00007fc0, length: 0x00002000"
  59. },
  60. {
  61. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00009fb0, length: 0x00002000"
  62. },
  63. {
  64. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0000bfa0, length: 0x00002000"
  65. },
  66. {
  67. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0000df90, length: 0x00002000"
  68. },
  69. {
  70. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0000ff80, length: 0x00002000"
  71. },
  72. {
  73. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00011f70, length: 0x00002000"
  74. },
  75. {
  76. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00013f60, length: 0x00002000"
  77. },
  78. {
  79. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00015f50, length: 0x00002000"
  80. },
  81. {
  82. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00017f40, length: 0x00002000"
  83. },
  84. {
  85. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00019f30, length: 0x00002000"
  86. },
  87. {
  88. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0001bf20, length: 0x00002000"
  89. },
  90. {
  91. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0001df10, length: 0x00002000"
  92. },
  93. {
  94. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0001ff00, length: 0x00002000"
  95. },
  96. {
  97. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00021ef0, length: 0x00002000"
  98. },
  99. {
  100. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00023ee0, length: 0x00002000"
  101. },
  102. {
  103. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00025ed0, length: 0x00002000"
  104. },
  105. {
  106. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00027ec0, length: 0x00002000"
  107. },
  108. {
  109. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x00029eb0, length: 0x00002000"
  110. },
  111. {
  112. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0002bea0, length: 0x00002000"
  113. },
  114. {
  115. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0002de90, length: 0x00002000"
  116. },
  117. {
  118. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0002ea00, length: 0x0000000e"
  119. },
  120. {
  121. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0002ea07, length: 0x0000000d"
  122. },
  123. {
  124. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0002ea0e, length: 0x0000000d"
  125. },
  126. {
  127. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0002ea14, length: 0x00000023"
  128. },
  129. {
  130. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0002ea1b, length: 0x002781a0"
  131. },
  132. {
  133. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x002b8366, length: 0x0004ff32"
  134. },
  135. {
  136. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x0030e9f6, length: 0x004ac44b"
  137. },
  138. {
  139. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x007d2deb, length: 0x0001001a"
  140. },
  141. {
  142. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x007e8899, length: 0x0000002a"
  143. },
  144. {
  145. "self_read": "process: bullmine.exe, pid: 2996, offset: 0x007eec79, length: 0x001153c9"
  146. },
  147. {
  148. "self_read": "process: wscript.exe, pid: 1716, offset: 0x00000000, length: 0x00000040"
  149. },
  150. {
  151. "self_read": "process: wscript.exe, pid: 1716, offset: 0x000000f0, length: 0x00000018"
  152. },
  153. {
  154. "self_read": "process: wscript.exe, pid: 1716, offset: 0x000001e8, length: 0x00000078"
  155. },
  156. {
  157. "self_read": "process: wscript.exe, pid: 1716, offset: 0x00018000, length: 0x00000020"
  158. },
  159. {
  160. "self_read": "process: wscript.exe, pid: 1716, offset: 0x00018058, length: 0x00000018"
  161. },
  162. {
  163. "self_read": "process: wscript.exe, pid: 1716, offset: 0x000181a8, length: 0x00000018"
  164. },
  165. {
  166. "self_read": "process: wscript.exe, pid: 1716, offset: 0x00018470, length: 0x00000010"
  167. },
  168. {
  169. "self_read": "process: wscript.exe, pid: 1716, offset: 0x00018640, length: 0x00000012"
  170. },
  171. {
  172. "self_read": "process: startup.exe, pid: 2072, offset: 0x00000000, length: 0x00000007"
  173. },
  174. {
  175. "self_read": "process: startup.exe, pid: 2072, offset: 0x00000000, length: 0x00002000"
  176. },
  177. {
  178. "self_read": "process: startup.exe, pid: 2072, offset: 0x00000007, length: 0x00036a57"
  179. },
  180. {
  181. "self_read": "process: startup.exe, pid: 2072, offset: 0x00001ff0, length: 0x00002000"
  182. },
  183. {
  184. "self_read": "process: startup.exe, pid: 2072, offset: 0x00003fe0, length: 0x00002000"
  185. },
  186. {
  187. "self_read": "process: startup.exe, pid: 2072, offset: 0x00005fd0, length: 0x00002000"
  188. },
  189. {
  190. "self_read": "process: startup.exe, pid: 2072, offset: 0x00007fc0, length: 0x00002000"
  191. },
  192. {
  193. "self_read": "process: startup.exe, pid: 2072, offset: 0x00009fb0, length: 0x00002000"
  194. },
  195. {
  196. "self_read": "process: startup.exe, pid: 2072, offset: 0x0000bfa0, length: 0x00002000"
  197. },
  198. {
  199. "self_read": "process: startup.exe, pid: 2072, offset: 0x0000df90, length: 0x00002000"
  200. },
  201. {
  202. "self_read": "process: startup.exe, pid: 2072, offset: 0x0000ff80, length: 0x00002000"
  203. },
  204. {
  205. "self_read": "process: startup.exe, pid: 2072, offset: 0x00011f70, length: 0x00002000"
  206. },
  207. {
  208. "self_read": "process: startup.exe, pid: 2072, offset: 0x00013f60, length: 0x00002000"
  209. },
  210. {
  211. "self_read": "process: startup.exe, pid: 2072, offset: 0x00015f50, length: 0x00002000"
  212. },
  213. {
  214. "self_read": "process: startup.exe, pid: 2072, offset: 0x00017f40, length: 0x00002000"
  215. },
  216. {
  217. "self_read": "process: startup.exe, pid: 2072, offset: 0x00019f30, length: 0x00002000"
  218. },
  219. {
  220. "self_read": "process: startup.exe, pid: 2072, offset: 0x0001bf20, length: 0x00002000"
  221. },
  222. {
  223. "self_read": "process: startup.exe, pid: 2072, offset: 0x0001df10, length: 0x00002000"
  224. },
  225. {
  226. "self_read": "process: startup.exe, pid: 2072, offset: 0x0001ff00, length: 0x00002000"
  227. },
  228. {
  229. "self_read": "process: startup.exe, pid: 2072, offset: 0x00021ef0, length: 0x00002000"
  230. },
  231. {
  232. "self_read": "process: startup.exe, pid: 2072, offset: 0x00023ee0, length: 0x00002000"
  233. },
  234. {
  235. "self_read": "process: startup.exe, pid: 2072, offset: 0x00025ed0, length: 0x00002000"
  236. },
  237. {
  238. "self_read": "process: startup.exe, pid: 2072, offset: 0x00027ec0, length: 0x00002000"
  239. },
  240. {
  241. "self_read": "process: startup.exe, pid: 2072, offset: 0x00029eb0, length: 0x00002000"
  242. },
  243. {
  244. "self_read": "process: startup.exe, pid: 2072, offset: 0x0002bea0, length: 0x00002000"
  245. },
  246. {
  247. "self_read": "process: startup.exe, pid: 2072, offset: 0x0002de90, length: 0x00002000"
  248. },
  249. {
  250. "self_read": "process: startup.exe, pid: 2072, offset: 0x0002fe80, length: 0x00002000"
  251. },
  252. {
  253. "self_read": "process: startup.exe, pid: 2072, offset: 0x00031e70, length: 0x00002000"
  254. },
  255. {
  256. "self_read": "process: startup.exe, pid: 2072, offset: 0x00033e60, length: 0x00002000"
  257. },
  258. {
  259. "self_read": "process: startup.exe, pid: 2072, offset: 0x00035e50, length: 0x00000c0e"
  260. },
  261. {
  262. "self_read": "process: startup.exe, pid: 2072, offset: 0x00036800, length: 0x000000fc"
  263. },
  264. {
  265. "self_read": "process: startup.exe, pid: 2072, offset: 0x000369c3, length: 0x0000002e"
  266. },
  267. {
  268. "self_read": "process: startup.exe, pid: 2072, offset: 0x00036a57, length: 0x00000007"
  269. },
  270. {
  271. "self_read": "process: wscript.exe, pid: 2592, offset: 0x00000000, length: 0x00000040"
  272. },
  273. {
  274. "self_read": "process: wscript.exe, pid: 2592, offset: 0x000000f0, length: 0x00000018"
  275. },
  276. {
  277. "self_read": "process: wscript.exe, pid: 2592, offset: 0x000001e8, length: 0x00000078"
  278. },
  279. {
  280. "self_read": "process: wscript.exe, pid: 2592, offset: 0x00018000, length: 0x00000020"
  281. },
  282. {
  283. "self_read": "process: wscript.exe, pid: 2592, offset: 0x00018058, length: 0x00000018"
  284. },
  285. {
  286. "self_read": "process: wscript.exe, pid: 2592, offset: 0x000181a8, length: 0x00000018"
  287. },
  288. {
  289. "self_read": "process: wscript.exe, pid: 2592, offset: 0x00018470, length: 0x00000010"
  290. },
  291. {
  292. "self_read": "process: wscript.exe, pid: 2592, offset: 0x00018640, length: 0x00000012"
  293. }
  294. ]
  295. },
  296. {
  297. "Description": "A process created a hidden window",
  298. "Details": [
  299. {
  300. "Process": "wscript.exe -> setup.bat"
  301. }
  302. ]
  303. },
  304. {
  305. "Description": "Installs OpenCL library, probably to mine Bitcoins",
  306. "Details": []
  307. },
  308. {
  309. "Description": "Drops a binary and executes it",
  310. "Details": [
  311. {
  312. "binary": "C:\\Users\\user\\AppData\\Roaming\\Silent\\csrss.exe"
  313. },
  314. {
  315. "binary": "C:\\Users\\user\\AppData\\Roaming\\Silent\\startup.exe"
  316. }
  317. ]
  318. },
  319. {
  320. "Description": "Installs itself for autorun at Windows startup",
  321. "Details": [
  322. {
  323. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\StartupName"
  324. },
  325. {
  326. "data": "C:\\Users\\user\\AppData\\Roaming\\Silent\\startup.exe"
  327. }
  328. ]
  329. },
  330. {
  331. "Description": "File has been identified by 43 Antiviruses on VirusTotal as malicious",
  332. "Details": [
  333. {
  334. "K7AntiVirus": "Trojan ( 004b92e01 )"
  335. },
  336. {
  337. "CAT-QuickHeal": "Trojan.VBS"
  338. },
  339. {
  340. "McAfee": "Artemis!8A54AB259F34"
  341. },
  342. {
  343. "Cylance": "Unsafe"
  344. },
  345. {
  346. "Zillya": "Trojan.Miner.Win32.7697"
  347. },
  348. {
  349. "Alibaba": "Trojan:Win32/starter.ali1000030"
  350. },
  351. {
  352. "K7GW": "Trojan ( 004b92e01 )"
  353. },
  354. {
  355. "TrendMicro": "TROJ_GEN.R002C0PB919"
  356. },
  357. {
  358. "Symantec": "Trojan.Gen.MBT"
  359. },
  360. {
  361. "Avast": "Win32:Trojan-gen"
  362. },
  363. {
  364. "ClamAV": "Win.Trojan.Autoit-1818"
  365. },
  366. {
  367. "Kaspersky": "Trojan.VBS.Starter.iz"
  368. },
  369. {
  370. "BitDefender": "Trojan.GenericKD.31674801"
  371. },
  372. {
  373. "NANO-Antivirus": "Trojan.Win32.Starter.fmtesf"
  374. },
  375. {
  376. "AegisLab": "Trojan.VBS.Starter.4!c"
  377. },
  378. {
  379. "Rising": "Trojan.Miner!8.EA1 (TFE:1:ALm7i6ilFyP)"
  380. },
  381. {
  382. "Emsisoft": "Trojan.GenericKD.31674801 (B)"
  383. },
  384. {
  385. "Comodo": "ApplicUnwnt@#1h5apyi2wa4d2"
  386. },
  387. {
  388. "F-Secure": "Trojan.TR/Agent.sbfxq"
  389. },
  390. {
  391. "DrWeb": "Trojan.DownLoader27.47022"
  392. },
  393. {
  394. "VIPRE": "Trojan.Win32.Generic!BT"
  395. },
  396. {
  397. "McAfee-GW-Edition": "VBS/Agent"
  398. },
  399. {
  400. "FireEye": "Trojan.GenericKD.31674801"
  401. },
  402. {
  403. "Sophos": "Mal/Generic-S"
  404. },
  405. {
  406. "Paloalto": "generic.ml"
  407. },
  408. {
  409. "Cyren": "W32/Trojan.DIZU-3338"
  410. },
  411. {
  412. "Jiangmin": "RiskTool.BitMiner.busz"
  413. },
  414. {
  415. "Avira": "TR/Dropper.Gen"
  416. },
  417. {
  418. "MAX": "malware (ai score=100)"
  419. },
  420. {
  421. "Antiy-AVL": "RiskWare[RiskTool]/Win32.BitMiner"
  422. },
  423. {
  424. "Microsoft": "Trojan:Win32/CoinMiner.C!cl"
  425. },
  426. {
  427. "ViRobot": "Trojan.Win32.Z.Agent.9453641"
  428. },
  429. {
  430. "ZoneAlarm": "Trojan.VBS.Starter.iz"
  431. },
  432. {
  433. "GData": "Trojan.GenericKD.41250311"
  434. },
  435. {
  436. "Malwarebytes": "Trojan.Dropper.SFXAI"
  437. },
  438. {
  439. "ESET-NOD32": "RAR/Agent.AP"
  440. },
  441. {
  442. "Tencent": "Vbs.Trojan.Starter.Ebgu"
  443. },
  444. {
  445. "Ikarus": "Trojan.Win32.Jorik"
  446. },
  447. {
  448. "Fortinet": "VBS/Agent!tr"
  449. },
  450. {
  451. "AVG": "Win32:Trojan-gen"
  452. },
  453. {
  454. "Cybereason": "malicious.59f341"
  455. },
  456. {
  457. "Panda": "Trj/CI.A"
  458. },
  459. {
  460. "Qihoo-360": "Win32/Trojan.51c"
  461. }
  462. ]
  463. },
  464. {
  465. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  466. "Details": [
  467. {
  468. "target": "clamav:Win.Trojan.Autoit-1818, sha256:589cc0f7d0d93cc40a5f708732e40b4ebcec4206ff8fb66b866f3c02c6d3ce55, type:PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive"
  469. },
  470. {
  471. "dropped": "clamav:Win.Trojan.Autoit-1818, sha256:d8014d3d0ec59ab136d892210e10c5c1f8a3f629234f5f9fc72811425966ed75 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\startup.exe*C:\\Users\\user\\AppData\\Roaming\\Silent\\startup.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive"
  472. },
  473. {
  474. "dropped": "clamav:Multios.Coinminer.Miner-6781728-2, sha256:4fb0ef737f62f0500b41e9bc1b75d8f123fb4f04098ee248203b797dafbb7d98 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\csrss.exe*C:\\Users\\user\\AppData\\Roaming\\Silent\\csrss.exe, type:PE32+ executable (console) x86-64, for MS Windows"
  475. }
  476. ]
  477. }
  478. ]
  479.  
  480. [*] Started Service: []
  481.  
  482. [*] Executed Commands: [
  483. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\setup.vbs\"",
  484. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\setup.vbs ",
  485. "\"C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\setup.bat\"",
  486. "setup.bat ",
  487. "C:\\Windows\\system32\\reg.exe REG ADD \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"StartupName\" /t REG_SZ /d \"C:\\Users\\user\\AppData\\Roaming\\Silent\\startup.exe\" /f",
  488. "C:\\Users\\user\\AppData\\Roaming\\Silent\\startup.exe",
  489. "C:\\Users\\user\\AppData\\Roaming\\Silent\\start.vbs",
  490. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Roaming\\Silent\\start.vbs\"",
  491. "C:\\Users\\user\\AppData\\Roaming\\Silent\\start.vbs ",
  492. "csrss -u [email protected] --xmr 2"
  493. ]
  494.  
  495. [*] Mutexes: [
  496. "DefaultTabtip-MainUI",
  497. "CicLoadWinStaWinSta0",
  498. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  499. "Local\\ZoneAttributeCacheCounterMutex",
  500. "Local\\ZonesCacheCounterMutex",
  501. "Local\\ZonesLockedCacheCounterMutex"
  502. ]
  503.  
  504. [*] Modified Files: [
  505. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\__tmp_rar_sfx_access_check_2630156",
  506. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\setup.bat",
  507. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\setup.vbs",
  508. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\start.bat",
  509. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\start.vbs",
  510. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\startup.exe",
  511. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\msvcp140.dll",
  512. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\nvcuda.dll",
  513. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\nvfatbinaryLoader.dll",
  514. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\nvrtc64_92.dll",
  515. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\nvrtc-builtins64_92.dll",
  516. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\OpenCL.dll",
  517. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\vcruntime140.dll",
  518. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\csrss.exe",
  519. "C:\\Users\\user\\AppData\\Roaming\\Silent\\csrss.exe",
  520. "C:\\Users\\user\\AppData\\Roaming\\Silent\\msvcp140.dll",
  521. "C:\\Users\\user\\AppData\\Roaming\\Silent\\nvcuda.dll",
  522. "C:\\Users\\user\\AppData\\Roaming\\Silent\\nvfatbinaryLoader.dll",
  523. "C:\\Users\\user\\AppData\\Roaming\\Silent\\nvrtc-builtins64_92.dll",
  524. "C:\\Users\\user\\AppData\\Roaming\\Silent\\nvrtc64_92.dll",
  525. "C:\\Users\\user\\AppData\\Roaming\\Silent\\OpenCL.dll",
  526. "C:\\Users\\user\\AppData\\Roaming\\Silent\\setup.bat",
  527. "C:\\Users\\user\\AppData\\Roaming\\Silent\\setup.vbs",
  528. "C:\\Users\\user\\AppData\\Roaming\\Silent\\start.bat",
  529. "C:\\Users\\user\\AppData\\Roaming\\Silent\\start.vbs",
  530. "C:\\Users\\user\\AppData\\Roaming\\Silent\\startup.exe",
  531. "C:\\Users\\user\\AppData\\Roaming\\Silent\\vcruntime140.dll",
  532. "C:\\Users\\user\\AppData\\Roaming\\Silent\\__tmp_rar_sfx_access_check_2748140",
  533. "\\??\\PIPE\\wkssvc",
  534. "\\??\\PIPE\\srvsvc"
  535. ]
  536.  
  537. [*] Deleted Files: [
  538. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0\\__tmp_rar_sfx_access_check_2630156",
  539. "C:\\Users\\user\\AppData\\Local\\Temp\\RarSFX0",
  540. "C:\\Users\\user\\AppData\\Roaming\\Silent\\__tmp_rar_sfx_access_check_2748140"
  541. ]
  542.  
  543. [*] Modified Registry Keys: [
  544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\StartupName"
  547. ]
  548.  
  549. [*] Deleted Registry Keys: [
  550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  551. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  553. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  554. ]
  555.  
  556. [*] DNS Communications: [
  557. {
  558. "type": "A",
  559. "request": "minergate.com",
  560. "answers": []
  561. }
  562. ]
  563.  
  564. [*] Domains: [
  565. {
  566. "ip": "136.243.102.167",
  567. "domain": "minergate.com"
  568. }
  569. ]
  570.  
  571. [*] Network Communication - ICMP: []
  572.  
  573. [*] Network Communication - HTTP: []
  574.  
  575. [*] Network Communication - SMTP: []
  576.  
  577. [*] Network Communication - Hosts: []
  578.  
  579. [*] Network Communication - IRC: []
  580.  
  581. [*] Static Analysis: {
  582. "pe": {
  583. "peid_signatures": null,
  584. "imports": [
  585. {
  586. "imports": [
  587. {
  588. "name": "InitCommonControlsEx",
  589. "address": "0x426028"
  590. }
  591. ],
  592. "dll": "COMCTL32.dll"
  593. },
  594. {
  595. "imports": [
  596. {
  597. "name": "SHAutoComplete",
  598. "address": "0x426288"
  599. }
  600. ],
  601. "dll": "SHLWAPI.dll"
  602. },
  603. {
  604. "imports": [
  605. {
  606. "name": "ReadFile",
  607. "address": "0x426064"
  608. },
  609. {
  610. "name": "GetFileAttributesW",
  611. "address": "0x426068"
  612. },
  613. {
  614. "name": "SetFileAttributesW",
  615. "address": "0x42606c"
  616. },
  617. {
  618. "name": "FindNextFileW",
  619. "address": "0x426070"
  620. },
  621. {
  622. "name": "GetFullPathNameW",
  623. "address": "0x426074"
  624. },
  625. {
  626. "name": "GetModuleFileNameW",
  627. "address": "0x426078"
  628. },
  629. {
  630. "name": "FindResourceW",
  631. "address": "0x42607c"
  632. },
  633. {
  634. "name": "GetModuleHandleW",
  635. "address": "0x426080"
  636. },
  637. {
  638. "name": "FreeLibrary",
  639. "address": "0x426084"
  640. },
  641. {
  642. "name": "GetProcAddress",
  643. "address": "0x426088"
  644. },
  645. {
  646. "name": "LoadLibraryW",
  647. "address": "0x42608c"
  648. },
  649. {
  650. "name": "GetCurrentProcessId",
  651. "address": "0x426090"
  652. },
  653. {
  654. "name": "GetLocaleInfoW",
  655. "address": "0x426094"
  656. },
  657. {
  658. "name": "GetNumberFormatW",
  659. "address": "0x426098"
  660. },
  661. {
  662. "name": "ExpandEnvironmentStringsW",
  663. "address": "0x42609c"
  664. },
  665. {
  666. "name": "WaitForSingleObject",
  667. "address": "0x4260a0"
  668. },
  669. {
  670. "name": "DosDateTimeToFileTime",
  671. "address": "0x4260a4"
  672. },
  673. {
  674. "name": "GetDateFormatW",
  675. "address": "0x4260a8"
  676. },
  677. {
  678. "name": "GetTimeFormatW",
  679. "address": "0x4260ac"
  680. },
  681. {
  682. "name": "FileTimeToSystemTime",
  683. "address": "0x4260b0"
  684. },
  685. {
  686. "name": "FileTimeToLocalFileTime",
  687. "address": "0x4260b4"
  688. },
  689. {
  690. "name": "GetExitCodeProcess",
  691. "address": "0x4260b8"
  692. },
  693. {
  694. "name": "GetTempPathW",
  695. "address": "0x4260bc"
  696. },
  697. {
  698. "name": "MoveFileExW",
  699. "address": "0x4260c0"
  700. },
  701. {
  702. "name": "Sleep",
  703. "address": "0x4260c4"
  704. },
  705. {
  706. "name": "UnmapViewOfFile",
  707. "address": "0x4260c8"
  708. },
  709. {
  710. "name": "MapViewOfFile",
  711. "address": "0x4260cc"
  712. },
  713. {
  714. "name": "GetCommandLineW",
  715. "address": "0x4260d0"
  716. },
  717. {
  718. "name": "CreateFileMappingW",
  719. "address": "0x4260d4"
  720. },
  721. {
  722. "name": "GetTickCount",
  723. "address": "0x4260d8"
  724. },
  725. {
  726. "name": "SetEnvironmentVariableW",
  727. "address": "0x4260dc"
  728. },
  729. {
  730. "name": "OpenFileMappingW",
  731. "address": "0x4260e0"
  732. },
  733. {
  734. "name": "CreateThread",
  735. "address": "0x4260e4"
  736. },
  737. {
  738. "name": "EnterCriticalSection",
  739. "address": "0x4260e8"
  740. },
  741. {
  742. "name": "LeaveCriticalSection",
  743. "address": "0x4260ec"
  744. },
  745. {
  746. "name": "GetProcessAffinityMask",
  747. "address": "0x4260f0"
  748. },
  749. {
  750. "name": "ReleaseSemaphore",
  751. "address": "0x4260f4"
  752. },
  753. {
  754. "name": "ResetEvent",
  755. "address": "0x4260f8"
  756. },
  757. {
  758. "name": "DeleteCriticalSection",
  759. "address": "0x4260fc"
  760. },
  761. {
  762. "name": "SetEvent",
  763. "address": "0x426100"
  764. },
  765. {
  766. "name": "SetThreadPriority",
  767. "address": "0x426104"
  768. },
  769. {
  770. "name": "InitializeCriticalSection",
  771. "address": "0x426108"
  772. },
  773. {
  774. "name": "CreateEventW",
  775. "address": "0x42610c"
  776. },
  777. {
  778. "name": "CreateSemaphoreW",
  779. "address": "0x426110"
  780. },
  781. {
  782. "name": "SystemTimeToFileTime",
  783. "address": "0x426114"
  784. },
  785. {
  786. "name": "GetSystemTime",
  787. "address": "0x426118"
  788. },
  789. {
  790. "name": "LocalFileTimeToFileTime",
  791. "address": "0x42611c"
  792. },
  793. {
  794. "name": "WideCharToMultiByte",
  795. "address": "0x426120"
  796. },
  797. {
  798. "name": "MultiByteToWideChar",
  799. "address": "0x426124"
  800. },
  801. {
  802. "name": "CompareStringW",
  803. "address": "0x426128"
  804. },
  805. {
  806. "name": "IsDBCSLeadByte",
  807. "address": "0x42612c"
  808. },
  809. {
  810. "name": "FindFirstFileW",
  811. "address": "0x426130"
  812. },
  813. {
  814. "name": "GetFileType",
  815. "address": "0x426134"
  816. },
  817. {
  818. "name": "SetCurrentDirectoryW",
  819. "address": "0x426138"
  820. },
  821. {
  822. "name": "WriteConsoleW",
  823. "address": "0x42613c"
  824. },
  825. {
  826. "name": "GetConsoleOutputCP",
  827. "address": "0x426140"
  828. },
  829. {
  830. "name": "WriteConsoleA",
  831. "address": "0x426144"
  832. },
  833. {
  834. "name": "SetStdHandle",
  835. "address": "0x426148"
  836. },
  837. {
  838. "name": "GetLocaleInfoA",
  839. "address": "0x42614c"
  840. },
  841. {
  842. "name": "GetStringTypeW",
  843. "address": "0x426150"
  844. },
  845. {
  846. "name": "GetStringTypeA",
  847. "address": "0x426154"
  848. },
  849. {
  850. "name": "LoadLibraryA",
  851. "address": "0x426158"
  852. },
  853. {
  854. "name": "GetConsoleMode",
  855. "address": "0x42615c"
  856. },
  857. {
  858. "name": "GetConsoleCP",
  859. "address": "0x426160"
  860. },
  861. {
  862. "name": "InitializeCriticalSectionAndSpinCount",
  863. "address": "0x426164"
  864. },
  865. {
  866. "name": "QueryPerformanceCounter",
  867. "address": "0x426168"
  868. },
  869. {
  870. "name": "SetHandleCount",
  871. "address": "0x42616c"
  872. },
  873. {
  874. "name": "GetEnvironmentStringsW",
  875. "address": "0x426170"
  876. },
  877. {
  878. "name": "FreeEnvironmentStringsW",
  879. "address": "0x426174"
  880. },
  881. {
  882. "name": "GetEnvironmentStrings",
  883. "address": "0x426178"
  884. },
  885. {
  886. "name": "FreeEnvironmentStringsA",
  887. "address": "0x42617c"
  888. },
  889. {
  890. "name": "LCMapStringW",
  891. "address": "0x426180"
  892. },
  893. {
  894. "name": "LCMapStringA",
  895. "address": "0x426184"
  896. },
  897. {
  898. "name": "IsValidCodePage",
  899. "address": "0x426188"
  900. },
  901. {
  902. "name": "GetOEMCP",
  903. "address": "0x42618c"
  904. },
  905. {
  906. "name": "GetACP",
  907. "address": "0x426190"
  908. },
  909. {
  910. "name": "GetModuleFileNameA",
  911. "address": "0x426194"
  912. },
  913. {
  914. "name": "ExitProcess",
  915. "address": "0x426198"
  916. },
  917. {
  918. "name": "HeapSize",
  919. "address": "0x42619c"
  920. },
  921. {
  922. "name": "IsDebuggerPresent",
  923. "address": "0x4261a0"
  924. },
  925. {
  926. "name": "SetUnhandledExceptionFilter",
  927. "address": "0x4261a4"
  928. },
  929. {
  930. "name": "UnhandledExceptionFilter",
  931. "address": "0x4261a8"
  932. },
  933. {
  934. "name": "TerminateProcess",
  935. "address": "0x4261ac"
  936. },
  937. {
  938. "name": "VirtualAlloc",
  939. "address": "0x4261b0"
  940. },
  941. {
  942. "name": "VirtualFree",
  943. "address": "0x4261b4"
  944. },
  945. {
  946. "name": "HeapCreate",
  947. "address": "0x4261b8"
  948. },
  949. {
  950. "name": "InterlockedDecrement",
  951. "address": "0x4261bc"
  952. },
  953. {
  954. "name": "GetCurrentThreadId",
  955. "address": "0x4261c0"
  956. },
  957. {
  958. "name": "InterlockedIncrement",
  959. "address": "0x4261c4"
  960. },
  961. {
  962. "name": "TlsFree",
  963. "address": "0x4261c8"
  964. },
  965. {
  966. "name": "TlsSetValue",
  967. "address": "0x4261cc"
  968. },
  969. {
  970. "name": "TlsAlloc",
  971. "address": "0x4261d0"
  972. },
  973. {
  974. "name": "TlsGetValue",
  975. "address": "0x4261d4"
  976. },
  977. {
  978. "name": "GetStartupInfoA",
  979. "address": "0x4261d8"
  980. },
  981. {
  982. "name": "GetCommandLineA",
  983. "address": "0x4261dc"
  984. },
  985. {
  986. "name": "RaiseException",
  987. "address": "0x4261e0"
  988. },
  989. {
  990. "name": "GetSystemTimeAsFileTime",
  991. "address": "0x4261e4"
  992. },
  993. {
  994. "name": "SetEndOfFile",
  995. "address": "0x4261e8"
  996. },
  997. {
  998. "name": "SetFilePointer",
  999. "address": "0x4261ec"
  1000. },
  1001. {
  1002. "name": "GetStdHandle",
  1003. "address": "0x4261f0"
  1004. },
  1005. {
  1006. "name": "WriteFile",
  1007. "address": "0x4261f4"
  1008. },
  1009. {
  1010. "name": "FlushFileBuffers",
  1011. "address": "0x4261f8"
  1012. },
  1013. {
  1014. "name": "GetLongPathNameW",
  1015. "address": "0x4261fc"
  1016. },
  1017. {
  1018. "name": "MoveFileW",
  1019. "address": "0x426200"
  1020. },
  1021. {
  1022. "name": "GetShortPathNameW",
  1023. "address": "0x426204"
  1024. },
  1025. {
  1026. "name": "CreateDirectoryW",
  1027. "address": "0x426208"
  1028. },
  1029. {
  1030. "name": "RemoveDirectoryW",
  1031. "address": "0x42620c"
  1032. },
  1033. {
  1034. "name": "GlobalAlloc",
  1035. "address": "0x426210"
  1036. },
  1037. {
  1038. "name": "DeleteFileW",
  1039. "address": "0x426214"
  1040. },
  1041. {
  1042. "name": "FindClose",
  1043. "address": "0x426218"
  1044. },
  1045. {
  1046. "name": "CreateFileW",
  1047. "address": "0x42621c"
  1048. },
  1049. {
  1050. "name": "DeviceIoControl",
  1051. "address": "0x426220"
  1052. },
  1053. {
  1054. "name": "SetFileTime",
  1055. "address": "0x426224"
  1056. },
  1057. {
  1058. "name": "GetCurrentProcess",
  1059. "address": "0x426228"
  1060. },
  1061. {
  1062. "name": "CloseHandle",
  1063. "address": "0x42622c"
  1064. },
  1065. {
  1066. "name": "CreateHardLinkW",
  1067. "address": "0x426230"
  1068. },
  1069. {
  1070. "name": "SetLastError",
  1071. "address": "0x426234"
  1072. },
  1073. {
  1074. "name": "GetLastError",
  1075. "address": "0x426238"
  1076. },
  1077. {
  1078. "name": "GetCurrentDirectoryW",
  1079. "address": "0x42623c"
  1080. },
  1081. {
  1082. "name": "CreateFileA",
  1083. "address": "0x426240"
  1084. },
  1085. {
  1086. "name": "GetCPInfo",
  1087. "address": "0x426244"
  1088. },
  1089. {
  1090. "name": "HeapAlloc",
  1091. "address": "0x426248"
  1092. },
  1093. {
  1094. "name": "HeapReAlloc",
  1095. "address": "0x42624c"
  1096. },
  1097. {
  1098. "name": "HeapFree",
  1099. "address": "0x426250"
  1100. },
  1101. {
  1102. "name": "RtlUnwind",
  1103. "address": "0x426254"
  1104. }
  1105. ],
  1106. "dll": "KERNEL32.dll"
  1107. },
  1108. {
  1109. "imports": [
  1110. {
  1111. "name": "EnableWindow",
  1112. "address": "0x426290"
  1113. },
  1114. {
  1115. "name": "ShowWindow",
  1116. "address": "0x426294"
  1117. },
  1118. {
  1119. "name": "GetDlgItem",
  1120. "address": "0x426298"
  1121. },
  1122. {
  1123. "name": "MessageBoxW",
  1124. "address": "0x42629c"
  1125. },
  1126. {
  1127. "name": "FindWindowExW",
  1128. "address": "0x4262a0"
  1129. },
  1130. {
  1131. "name": "GetParent",
  1132. "address": "0x4262a4"
  1133. },
  1134. {
  1135. "name": "MapWindowPoints",
  1136. "address": "0x4262a8"
  1137. },
  1138. {
  1139. "name": "CreateWindowExW",
  1140. "address": "0x4262ac"
  1141. },
  1142. {
  1143. "name": "UpdateWindow",
  1144. "address": "0x4262b0"
  1145. },
  1146. {
  1147. "name": "LoadCursorW",
  1148. "address": "0x4262b4"
  1149. },
  1150. {
  1151. "name": "RegisterClassExW",
  1152. "address": "0x4262b8"
  1153. },
  1154. {
  1155. "name": "DefWindowProcW",
  1156. "address": "0x4262bc"
  1157. },
  1158. {
  1159. "name": "DestroyWindow",
  1160. "address": "0x4262c0"
  1161. },
  1162. {
  1163. "name": "CopyRect",
  1164. "address": "0x4262c4"
  1165. },
  1166. {
  1167. "name": "IsWindow",
  1168. "address": "0x4262c8"
  1169. },
  1170. {
  1171. "name": "CharUpperW",
  1172. "address": "0x4262cc"
  1173. },
  1174. {
  1175. "name": "OemToCharBuffA",
  1176. "address": "0x4262d0"
  1177. },
  1178. {
  1179. "name": "LoadIconW",
  1180. "address": "0x4262d4"
  1181. },
  1182. {
  1183. "name": "PostMessageW",
  1184. "address": "0x4262d8"
  1185. },
  1186. {
  1187. "name": "GetSysColor",
  1188. "address": "0x4262dc"
  1189. },
  1190. {
  1191. "name": "SetForegroundWindow",
  1192. "address": "0x4262e0"
  1193. },
  1194. {
  1195. "name": "WaitForInputIdle",
  1196. "address": "0x4262e4"
  1197. },
  1198. {
  1199. "name": "IsWindowVisible",
  1200. "address": "0x4262e8"
  1201. },
  1202. {
  1203. "name": "DialogBoxParamW",
  1204. "address": "0x4262ec"
  1205. },
  1206. {
  1207. "name": "DestroyIcon",
  1208. "address": "0x4262f0"
  1209. },
  1210. {
  1211. "name": "SetFocus",
  1212. "address": "0x4262f4"
  1213. },
  1214. {
  1215. "name": "GetClassNameW",
  1216. "address": "0x4262f8"
  1217. },
  1218. {
  1219. "name": "SendDlgItemMessageW",
  1220. "address": "0x4262fc"
  1221. },
  1222. {
  1223. "name": "EndDialog",
  1224. "address": "0x426300"
  1225. },
  1226. {
  1227. "name": "GetDlgItemTextW",
  1228. "address": "0x426304"
  1229. },
  1230. {
  1231. "name": "SetDlgItemTextW",
  1232. "address": "0x426308"
  1233. },
  1234. {
  1235. "name": "wvsprintfW",
  1236. "address": "0x42630c"
  1237. },
  1238. {
  1239. "name": "SendMessageW",
  1240. "address": "0x426310"
  1241. },
  1242. {
  1243. "name": "GetDC",
  1244. "address": "0x426314"
  1245. },
  1246. {
  1247. "name": "ReleaseDC",
  1248. "address": "0x426318"
  1249. },
  1250. {
  1251. "name": "PeekMessageW",
  1252. "address": "0x42631c"
  1253. },
  1254. {
  1255. "name": "GetMessageW",
  1256. "address": "0x426320"
  1257. },
  1258. {
  1259. "name": "TranslateMessage",
  1260. "address": "0x426324"
  1261. },
  1262. {
  1263. "name": "DispatchMessageW",
  1264. "address": "0x426328"
  1265. },
  1266. {
  1267. "name": "LoadStringW",
  1268. "address": "0x42632c"
  1269. },
  1270. {
  1271. "name": "GetWindowRect",
  1272. "address": "0x426330"
  1273. },
  1274. {
  1275. "name": "GetClientRect",
  1276. "address": "0x426334"
  1277. },
  1278. {
  1279. "name": "SetWindowPos",
  1280. "address": "0x426338"
  1281. },
  1282. {
  1283. "name": "GetWindowTextW",
  1284. "address": "0x42633c"
  1285. },
  1286. {
  1287. "name": "SetWindowTextW",
  1288. "address": "0x426340"
  1289. },
  1290. {
  1291. "name": "GetSystemMetrics",
  1292. "address": "0x426344"
  1293. },
  1294. {
  1295. "name": "GetWindow",
  1296. "address": "0x426348"
  1297. },
  1298. {
  1299. "name": "GetWindowLongW",
  1300. "address": "0x42634c"
  1301. },
  1302. {
  1303. "name": "SetWindowLongW",
  1304. "address": "0x426350"
  1305. },
  1306. {
  1307. "name": "LoadBitmapW",
  1308. "address": "0x426354"
  1309. }
  1310. ],
  1311. "dll": "USER32.dll"
  1312. },
  1313. {
  1314. "imports": [
  1315. {
  1316. "name": "GetDeviceCaps",
  1317. "address": "0x426040"
  1318. },
  1319. {
  1320. "name": "CreateCompatibleDC",
  1321. "address": "0x426044"
  1322. },
  1323. {
  1324. "name": "GetObjectW",
  1325. "address": "0x426048"
  1326. },
  1327. {
  1328. "name": "CreateCompatibleBitmap",
  1329. "address": "0x42604c"
  1330. },
  1331. {
  1332. "name": "SelectObject",
  1333. "address": "0x426050"
  1334. },
  1335. {
  1336. "name": "StretchBlt",
  1337. "address": "0x426054"
  1338. },
  1339. {
  1340. "name": "DeleteDC",
  1341. "address": "0x426058"
  1342. },
  1343. {
  1344. "name": "DeleteObject",
  1345. "address": "0x42605c"
  1346. }
  1347. ],
  1348. "dll": "GDI32.dll"
  1349. },
  1350. {
  1351. "imports": [
  1352. {
  1353. "name": "GetSaveFileNameW",
  1354. "address": "0x426030"
  1355. },
  1356. {
  1357. "name": "CommDlgExtendedError",
  1358. "address": "0x426034"
  1359. },
  1360. {
  1361. "name": "GetOpenFileNameW",
  1362. "address": "0x426038"
  1363. }
  1364. ],
  1365. "dll": "COMDLG32.dll"
  1366. },
  1367. {
  1368. "imports": [
  1369. {
  1370. "name": "RegOpenKeyExW",
  1371. "address": "0x426000"
  1372. },
  1373. {
  1374. "name": "RegQueryValueExW",
  1375. "address": "0x426004"
  1376. },
  1377. {
  1378. "name": "RegCreateKeyExW",
  1379. "address": "0x426008"
  1380. },
  1381. {
  1382. "name": "RegSetValueExW",
  1383. "address": "0x42600c"
  1384. },
  1385. {
  1386. "name": "RegCloseKey",
  1387. "address": "0x426010"
  1388. },
  1389. {
  1390. "name": "SetFileSecurityW",
  1391. "address": "0x426014"
  1392. },
  1393. {
  1394. "name": "OpenProcessToken",
  1395. "address": "0x426018"
  1396. },
  1397. {
  1398. "name": "LookupPrivilegeValueW",
  1399. "address": "0x42601c"
  1400. },
  1401. {
  1402. "name": "AdjustTokenPrivileges",
  1403. "address": "0x426020"
  1404. }
  1405. ],
  1406. "dll": "ADVAPI32.dll"
  1407. },
  1408. {
  1409. "imports": [
  1410. {
  1411. "name": "SHChangeNotify",
  1412. "address": "0x426264"
  1413. },
  1414. {
  1415. "name": "SHGetFileInfoW",
  1416. "address": "0x426268"
  1417. },
  1418. {
  1419. "name": "SHGetMalloc",
  1420. "address": "0x42626c"
  1421. },
  1422. {
  1423. "name": "SHGetSpecialFolderLocation",
  1424. "address": "0x426270"
  1425. },
  1426. {
  1427. "name": "SHGetPathFromIDListW",
  1428. "address": "0x426274"
  1429. },
  1430. {
  1431. "name": "SHBrowseForFolderW",
  1432. "address": "0x426278"
  1433. },
  1434. {
  1435. "name": "ShellExecuteExW",
  1436. "address": "0x42627c"
  1437. },
  1438. {
  1439. "name": "SHFileOperationW",
  1440. "address": "0x426280"
  1441. }
  1442. ],
  1443. "dll": "SHELL32.dll"
  1444. },
  1445. {
  1446. "imports": [
  1447. {
  1448. "name": "CLSIDFromString",
  1449. "address": "0x42635c"
  1450. },
  1451. {
  1452. "name": "CoCreateInstance",
  1453. "address": "0x426360"
  1454. },
  1455. {
  1456. "name": "OleInitialize",
  1457. "address": "0x426364"
  1458. },
  1459. {
  1460. "name": "OleUninitialize",
  1461. "address": "0x426368"
  1462. },
  1463. {
  1464. "name": "CreateStreamOnHGlobal",
  1465. "address": "0x42636c"
  1466. }
  1467. ],
  1468. "dll": "ole32.dll"
  1469. },
  1470. {
  1471. "imports": [
  1472. {
  1473. "name": "VariantInit",
  1474. "address": "0x42625c"
  1475. }
  1476. ],
  1477. "dll": "OLEAUT32.dll"
  1478. }
  1479. ],
  1480. "digital_signers": null,
  1481. "exported_dll_name": "WINRAR.SFX",
  1482. "actual_checksum": "0x009061b0",
  1483. "overlay": {
  1484. "size": "0x008d5649",
  1485. "offset": "0x0002ea00"
  1486. },
  1487. "imagebase": "0x00400000",
  1488. "reported_checksum": "0x009061b0",
  1489. "icon_hash": null,
  1490. "entrypoint": "0x0041d1d8",
  1491. "timestamp": "2013-06-10 11:08:38",
  1492. "osversion": "5.0",
  1493. "sections": [
  1494. {
  1495. "name": ".text",
  1496. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1497. "virtual_address": "0x00001000",
  1498. "size_of_data": "0x00025000",
  1499. "entropy": "6.71",
  1500. "raw_address": "0x00000400",
  1501. "virtual_size": "0x00024fe4",
  1502. "characteristics_raw": "0x60000020"
  1503. },
  1504. {
  1505. "name": ".rdata",
  1506. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1507. "virtual_address": "0x00026000",
  1508. "size_of_data": "0x00005000",
  1509. "entropy": "5.33",
  1510. "raw_address": "0x00025400",
  1511. "virtual_size": "0x00004f33",
  1512. "characteristics_raw": "0x40000040"
  1513. },
  1514. {
  1515. "name": ".data",
  1516. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1517. "virtual_address": "0x0002b000",
  1518. "size_of_data": "0x00001400",
  1519. "entropy": "2.53",
  1520. "raw_address": "0x0002a400",
  1521. "virtual_size": "0x000215e0",
  1522. "characteristics_raw": "0xc0000040"
  1523. },
  1524. {
  1525. "name": ".rsrc",
  1526. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1527. "virtual_address": "0x0004d000",
  1528. "size_of_data": "0x00003200",
  1529. "entropy": "4.40",
  1530. "raw_address": "0x0002b800",
  1531. "virtual_size": "0x000030d0",
  1532. "characteristics_raw": "0x40000040"
  1533. }
  1534. ],
  1535. "resources": [],
  1536. "dirents": [
  1537. {
  1538. "virtual_address": "0x0002af00",
  1539. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1540. "size": "0x00000033"
  1541. },
  1542. {
  1543. "virtual_address": "0x00029b54",
  1544. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1545. "size": "0x000000dc"
  1546. },
  1547. {
  1548. "virtual_address": "0x0004d000",
  1549. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1550. "size": "0x000030d0"
  1551. },
  1552. {
  1553. "virtual_address": "0x00000000",
  1554. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1555. "size": "0x00000000"
  1556. },
  1557. {
  1558. "virtual_address": "0x00000000",
  1559. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1560. "size": "0x00000000"
  1561. },
  1562. {
  1563. "virtual_address": "0x00000000",
  1564. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1565. "size": "0x00000000"
  1566. },
  1567. {
  1568. "virtual_address": "0x000263f0",
  1569. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1570. "size": "0x0000001c"
  1571. },
  1572. {
  1573. "virtual_address": "0x00000000",
  1574. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1575. "size": "0x00000000"
  1576. },
  1577. {
  1578. "virtual_address": "0x00000000",
  1579. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1580. "size": "0x00000000"
  1581. },
  1582. {
  1583. "virtual_address": "0x00000000",
  1584. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1585. "size": "0x00000000"
  1586. },
  1587. {
  1588. "virtual_address": "0x00028b80",
  1589. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1590. "size": "0x00000040"
  1591. },
  1592. {
  1593. "virtual_address": "0x00000000",
  1594. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1595. "size": "0x00000000"
  1596. },
  1597. {
  1598. "virtual_address": "0x00026000",
  1599. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1600. "size": "0x00000374"
  1601. },
  1602. {
  1603. "virtual_address": "0x00000000",
  1604. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1605. "size": "0x00000000"
  1606. },
  1607. {
  1608. "virtual_address": "0x00000000",
  1609. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1610. "size": "0x00000000"
  1611. },
  1612. {
  1613. "virtual_address": "0x00000000",
  1614. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1615. "size": "0x00000000"
  1616. }
  1617. ],
  1618. "exports": [],
  1619. "guest_signers": {},
  1620. "imphash": "3eaa732d4dae53340f9646bdd85dac41",
  1621. "icon_fuzzy": null,
  1622. "icon": null,
  1623. "pdbpath": "d:\\Projects\\WinRAR\\SFX\\build\\sfxrar32\\Release\\sfxrar.pdb",
  1624. "imported_dll_count": 10,
  1625. "versioninfo": []
  1626. }
  1627. }
  1628.  
  1629. [*] Resolved APIs: [
  1630. "kernel32.dll.FlsAlloc",
  1631. "kernel32.dll.FlsGetValue",
  1632. "kernel32.dll.FlsSetValue",
  1633. "kernel32.dll.FlsFree",
  1634. "kernel32.dll.SetDllDirectoryW",
  1635. "cryptbase.dll.SystemFunction036",
  1636. "uxtheme.dll.ThemeInitApiHook",
  1637. "user32.dll.IsProcessDPIAware",
  1638. "ole32.dll.CoGetMalloc",
  1639. "dwmapi.dll.DwmIsCompositionEnabled",
  1640. "comctl32.dll.RegisterClassNameW",
  1641. "uxtheme.dll.EnableThemeDialogTexture",
  1642. "uxtheme.dll.OpenThemeData",
  1643. "uxtheme.dll.IsThemePartDefined",
  1644. "uxtheme.dll.GetThemeMargins",
  1645. "uxtheme.dll.GetThemeBool",
  1646. "uxtheme.dll.GetThemeInt",
  1647. "comctl32.dll.HIMAGELIST_QueryInterface",
  1648. "comctl32.dll.DrawShadowText",
  1649. "comctl32.dll.DrawSizeBox",
  1650. "comctl32.dll.DrawScrollBar",
  1651. "comctl32.dll.SizeBoxHwnd",
  1652. "comctl32.dll.ScrollBar_MouseMove",
  1653. "comctl32.dll.ScrollBar_Menu",
  1654. "comctl32.dll.HandleScrollCmd",
  1655. "comctl32.dll.DetachScrollBars",
  1656. "comctl32.dll.AttachScrollBars",
  1657. "comctl32.dll.CCSetScrollInfo",
  1658. "comctl32.dll.CCGetScrollInfo",
  1659. "comctl32.dll.CCEnableScrollBar",
  1660. "comctl32.dll.QuerySystemGestureStatus",
  1661. "uxtheme.dll.#49",
  1662. "uxtheme.dll.CloseThemeData",
  1663. "uxtheme.dll.SetWindowTheme",
  1664. "uxtheme.dll.GetThemeFont",
  1665. "uxtheme.dll.GetThemeColor",
  1666. "imm32.dll.ImmIsIME",
  1667. "ole32.dll.CoCreateInstance",
  1668. "comctl32.dll.#320",
  1669. "comctl32.dll.#324",
  1670. "comctl32.dll.#411",
  1671. "comctl32.dll.#410",
  1672. "ole32.dll.CLSIDFromString",
  1673. "uxtheme.dll.GetThemePartSize",
  1674. "uxtheme.dll.GetThemeTextExtent",
  1675. "gdi32.dll.GetLayout",
  1676. "gdi32.dll.GdiRealizationInfo",
  1677. "gdi32.dll.FontIsLinked",
  1678. "advapi32.dll.RegOpenKeyExW",
  1679. "advapi32.dll.RegQueryInfoKeyW",
  1680. "gdi32.dll.GetTextFaceAliasW",
  1681. "advapi32.dll.RegEnumValueW",
  1682. "advapi32.dll.RegCloseKey",
  1683. "advapi32.dll.RegQueryValueExW",
  1684. "gdi32.dll.GetFontAssocStatus",
  1685. "advapi32.dll.RegQueryValueExA",
  1686. "advapi32.dll.RegEnumKeyExW",
  1687. "comctl32.dll.#413",
  1688. "gdi32.dll.GdiIsMetaPrintDC",
  1689. "ole32.dll.CoInitializeEx",
  1690. "ole32.dll.CoUninitialize",
  1691. "ole32.dll.CoRegisterInitializeSpy",
  1692. "ole32.dll.CoRevokeInitializeSpy",
  1693. "ole32.dll.OleInitialize",
  1694. "ole32.dll.CreateBindCtx",
  1695. "ole32.dll.CoTaskMemAlloc",
  1696. "propsys.dll.PSCreateMemoryPropertyStore",
  1697. "propsys.dll.PSPropertyBag_WriteDWORD",
  1698. "ole32.dll.CoGetApartmentType",
  1699. "ole32.dll.CoTaskMemFree",
  1700. "comctl32.dll.#236",
  1701. "oleaut32.dll.#6",
  1702. "propsys.dll.PSPropertyBag_ReadDWORD",
  1703. "ole32.dll.StringFromGUID2",
  1704. "comctl32.dll.#323",
  1705. "advapi32.dll.RegEnumKeyW",
  1706. "oleaut32.dll.#2",
  1707. "propsys.dll.PSPropertyBag_ReadBSTR",
  1708. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  1709. "shell32.dll.#102",
  1710. "advapi32.dll.OpenThreadToken",
  1711. "advapi32.dll.InitializeSecurityDescriptor",
  1712. "advapi32.dll.SetEntriesInAclW",
  1713. "ntmarta.dll.GetMartaExtensionInterface",
  1714. "advapi32.dll.SetSecurityDescriptorDacl",
  1715. "advapi32.dll.IsTextUnicode",
  1716. "comctl32.dll.#328",
  1717. "comctl32.dll.#334",
  1718. "comctl32.dll.#332",
  1719. "comctl32.dll.#338",
  1720. "comctl32.dll.#339",
  1721. "sechost.dll.ConvertSidToStringSidW",
  1722. "profapi.dll.#104",
  1723. "propsys.dll.#417",
  1724. "ole32.dll.PropVariantClear",
  1725. "oleaut32.dll.#9",
  1726. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  1727. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  1728. "comctl32.dll.#386",
  1729. "advapi32.dll.RegQueryValueW",
  1730. "apphelp.dll.ApphelpCheckShellObject",
  1731. "propsys.dll.#430",
  1732. "advapi32.dll.RegGetValueW",
  1733. "ole32.dll.CoTaskMemRealloc",
  1734. "propsys.dll.InitPropVariantFromStringAsVector",
  1735. "propsys.dll.PSCoerceToCanonicalValue",
  1736. "propsys.dll.PropVariantToStringAlloc",
  1737. "ole32.dll.CoAllowSetForegroundWindow",
  1738. "kernel32.dll.InitializeSRWLock",
  1739. "kernel32.dll.AcquireSRWLockExclusive",
  1740. "kernel32.dll.AcquireSRWLockShared",
  1741. "kernel32.dll.ReleaseSRWLockExclusive",
  1742. "kernel32.dll.ReleaseSRWLockShared",
  1743. "shell32.dll.SHGetFolderPathW",
  1744. "advapi32.dll.SaferGetPolicyInformation",
  1745. "sfc.dll.SfcIsFileProtected",
  1746. "ntdll.dll.RtlDllShutdownInProgress",
  1747. "comctl32.dll.#329",
  1748. "ole32.dll.OleUninitialize",
  1749. "comctl32.dll.#388",
  1750. "oleaut32.dll.#500",
  1751. "comctl32.dll.#412",
  1752. "oleaut32.dll.#200",
  1753. "comctl32.dll.#385",
  1754. "propsys.dll.PSLookupPropertyHandlerCLSID",
  1755. "propsys.dll.PSCreatePropertyStoreFromObject",
  1756. "shell32.dll.#66",
  1757. "comctl32.dll.#326",
  1758. "comctl32.dll.#321",
  1759. "advapi32.dll.GetNamedSecurityInfoW",
  1760. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1761. "propsys.dll.PropVariantToBoolean",
  1762. "propsys.dll.VariantToUInt64",
  1763. "propsys.dll.InitPropVariantFromBuffer",
  1764. "propsys.dll.PropVariantToBuffer",
  1765. "sechost.dll.ConvertStringSidToSidW",
  1766. "netutils.dll.NetApiBufferFree",
  1767. "comctl32.dll.#387",
  1768. "advapi32.dll.UnregisterTraceGuids",
  1769. "cryptsp.dll.CryptReleaseContext",
  1770. "sechost.dll.LookupAccountNameLocalW",
  1771. "advapi32.dll.LookupAccountSidW",
  1772. "sechost.dll.LookupAccountSidLocalW",
  1773. "kernel32.dll.HeapSetInformation",
  1774. "kernel32.dll.SortGetHandle",
  1775. "kernel32.dll.SortCloseHandle",
  1776. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  1777. "advapi32.dll.SaferIdentifyLevel",
  1778. "advapi32.dll.SaferComputeTokenFromLevel",
  1779. "advapi32.dll.SaferCloseLevel",
  1780. "ole32.dll.CLSIDFromProgIDEx",
  1781. "ole32.dll.CoGetClassObject",
  1782. "wscript.exe.#1",
  1783. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  1784. "advapi32.dll.RegOpenKeyW",
  1785. "shell32.dll.ShellExecuteExW",
  1786. "propsys.dll.PSPropertyBag_ReadGUID",
  1787. "urlmon.dll.CreateUri",
  1788. "kernel32.dll.SetThreadUILanguage",
  1789. "kernel32.dll.CopyFileExW",
  1790. "kernel32.dll.IsDebuggerPresent",
  1791. "kernel32.dll.SetConsoleInputExeNameW",
  1792. "api-ms-win-core-synch-l1-2-0.dll.InitializeConditionVariable",
  1793. "api-ms-win-core-synch-l1-2-0.dll.SleepConditionVariableCS",
  1794. "api-ms-win-core-synch-l1-2-0.dll.WakeAllConditionVariable",
  1795. "netapi32.dll.NetStatisticsGet",
  1796. "netapi32.dll.NetApiBufferFree",
  1797. "advapi32.dll.CryptAcquireContextW",
  1798. "advapi32.dll.CryptGenRandom",
  1799. "advapi32.dll.CryptReleaseContext",
  1800. "cryptsp.dll.CryptGenRandom",
  1801. "user32.dll.GetForegroundWindow",
  1802. "user32.dll.GetCursorInfo",
  1803. "user32.dll.GetQueueStatus",
  1804. "kernel32.dll.CreateToolhelp32Snapshot",
  1805. "kernel32.dll.Heap32First",
  1806. "kernel32.dll.Heap32Next",
  1807. "kernel32.dll.Heap32ListFirst",
  1808. "kernel32.dll.Heap32ListNext",
  1809. "kernel32.dll.Process32First",
  1810. "kernel32.dll.Process32Next",
  1811. "kernel32.dll.Thread32First",
  1812. "kernel32.dll.Thread32Next",
  1813. "kernel32.dll.Module32First",
  1814. "kernel32.dll.Module32Next"
  1815. ]
  1816.  
  1817. [*] Static Analysis: {
  1818. "pe": {
  1819. "peid_signatures": null,
  1820. "imports": [
  1821. {
  1822. "imports": [
  1823. {
  1824. "name": "InitCommonControlsEx",
  1825. "address": "0x426028"
  1826. }
  1827. ],
  1828. "dll": "COMCTL32.dll"
  1829. },
  1830. {
  1831. "imports": [
  1832. {
  1833. "name": "SHAutoComplete",
  1834. "address": "0x426288"
  1835. }
  1836. ],
  1837. "dll": "SHLWAPI.dll"
  1838. },
  1839. {
  1840. "imports": [
  1841. {
  1842. "name": "ReadFile",
  1843. "address": "0x426064"
  1844. },
  1845. {
  1846. "name": "GetFileAttributesW",
  1847. "address": "0x426068"
  1848. },
  1849. {
  1850. "name": "SetFileAttributesW",
  1851. "address": "0x42606c"
  1852. },
  1853. {
  1854. "name": "FindNextFileW",
  1855. "address": "0x426070"
  1856. },
  1857. {
  1858. "name": "GetFullPathNameW",
  1859. "address": "0x426074"
  1860. },
  1861. {
  1862. "name": "GetModuleFileNameW",
  1863. "address": "0x426078"
  1864. },
  1865. {
  1866. "name": "FindResourceW",
  1867. "address": "0x42607c"
  1868. },
  1869. {
  1870. "name": "GetModuleHandleW",
  1871. "address": "0x426080"
  1872. },
  1873. {
  1874. "name": "FreeLibrary",
  1875. "address": "0x426084"
  1876. },
  1877. {
  1878. "name": "GetProcAddress",
  1879. "address": "0x426088"
  1880. },
  1881. {
  1882. "name": "LoadLibraryW",
  1883. "address": "0x42608c"
  1884. },
  1885. {
  1886. "name": "GetCurrentProcessId",
  1887. "address": "0x426090"
  1888. },
  1889. {
  1890. "name": "GetLocaleInfoW",
  1891. "address": "0x426094"
  1892. },
  1893. {
  1894. "name": "GetNumberFormatW",
  1895. "address": "0x426098"
  1896. },
  1897. {
  1898. "name": "ExpandEnvironmentStringsW",
  1899. "address": "0x42609c"
  1900. },
  1901. {
  1902. "name": "WaitForSingleObject",
  1903. "address": "0x4260a0"
  1904. },
  1905. {
  1906. "name": "DosDateTimeToFileTime",
  1907. "address": "0x4260a4"
  1908. },
  1909. {
  1910. "name": "GetDateFormatW",
  1911. "address": "0x4260a8"
  1912. },
  1913. {
  1914. "name": "GetTimeFormatW",
  1915. "address": "0x4260ac"
  1916. },
  1917. {
  1918. "name": "FileTimeToSystemTime",
  1919. "address": "0x4260b0"
  1920. },
  1921. {
  1922. "name": "FileTimeToLocalFileTime",
  1923. "address": "0x4260b4"
  1924. },
  1925. {
  1926. "name": "GetExitCodeProcess",
  1927. "address": "0x4260b8"
  1928. },
  1929. {
  1930. "name": "GetTempPathW",
  1931. "address": "0x4260bc"
  1932. },
  1933. {
  1934. "name": "MoveFileExW",
  1935. "address": "0x4260c0"
  1936. },
  1937. {
  1938. "name": "Sleep",
  1939. "address": "0x4260c4"
  1940. },
  1941. {
  1942. "name": "UnmapViewOfFile",
  1943. "address": "0x4260c8"
  1944. },
  1945. {
  1946. "name": "MapViewOfFile",
  1947. "address": "0x4260cc"
  1948. },
  1949. {
  1950. "name": "GetCommandLineW",
  1951. "address": "0x4260d0"
  1952. },
  1953. {
  1954. "name": "CreateFileMappingW",
  1955. "address": "0x4260d4"
  1956. },
  1957. {
  1958. "name": "GetTickCount",
  1959. "address": "0x4260d8"
  1960. },
  1961. {
  1962. "name": "SetEnvironmentVariableW",
  1963. "address": "0x4260dc"
  1964. },
  1965. {
  1966. "name": "OpenFileMappingW",
  1967. "address": "0x4260e0"
  1968. },
  1969. {
  1970. "name": "CreateThread",
  1971. "address": "0x4260e4"
  1972. },
  1973. {
  1974. "name": "EnterCriticalSection",
  1975. "address": "0x4260e8"
  1976. },
  1977. {
  1978. "name": "LeaveCriticalSection",
  1979. "address": "0x4260ec"
  1980. },
  1981. {
  1982. "name": "GetProcessAffinityMask",
  1983. "address": "0x4260f0"
  1984. },
  1985. {
  1986. "name": "ReleaseSemaphore",
  1987. "address": "0x4260f4"
  1988. },
  1989. {
  1990. "name": "ResetEvent",
  1991. "address": "0x4260f8"
  1992. },
  1993. {
  1994. "name": "DeleteCriticalSection",
  1995. "address": "0x4260fc"
  1996. },
  1997. {
  1998. "name": "SetEvent",
  1999. "address": "0x426100"
  2000. },
  2001. {
  2002. "name": "SetThreadPriority",
  2003. "address": "0x426104"
  2004. },
  2005. {
  2006. "name": "InitializeCriticalSection",
  2007. "address": "0x426108"
  2008. },
  2009. {
  2010. "name": "CreateEventW",
  2011. "address": "0x42610c"
  2012. },
  2013. {
  2014. "name": "CreateSemaphoreW",
  2015. "address": "0x426110"
  2016. },
  2017. {
  2018. "name": "SystemTimeToFileTime",
  2019. "address": "0x426114"
  2020. },
  2021. {
  2022. "name": "GetSystemTime",
  2023. "address": "0x426118"
  2024. },
  2025. {
  2026. "name": "LocalFileTimeToFileTime",
  2027. "address": "0x42611c"
  2028. },
  2029. {
  2030. "name": "WideCharToMultiByte",
  2031. "address": "0x426120"
  2032. },
  2033. {
  2034. "name": "MultiByteToWideChar",
  2035. "address": "0x426124"
  2036. },
  2037. {
  2038. "name": "CompareStringW",
  2039. "address": "0x426128"
  2040. },
  2041. {
  2042. "name": "IsDBCSLeadByte",
  2043. "address": "0x42612c"
  2044. },
  2045. {
  2046. "name": "FindFirstFileW",
  2047. "address": "0x426130"
  2048. },
  2049. {
  2050. "name": "GetFileType",
  2051. "address": "0x426134"
  2052. },
  2053. {
  2054. "name": "SetCurrentDirectoryW",
  2055. "address": "0x426138"
  2056. },
  2057. {
  2058. "name": "WriteConsoleW",
  2059. "address": "0x42613c"
  2060. },
  2061. {
  2062. "name": "GetConsoleOutputCP",
  2063. "address": "0x426140"
  2064. },
  2065. {
  2066. "name": "WriteConsoleA",
  2067. "address": "0x426144"
  2068. },
  2069. {
  2070. "name": "SetStdHandle",
  2071. "address": "0x426148"
  2072. },
  2073. {
  2074. "name": "GetLocaleInfoA",
  2075. "address": "0x42614c"
  2076. },
  2077. {
  2078. "name": "GetStringTypeW",
  2079. "address": "0x426150"
  2080. },
  2081. {
  2082. "name": "GetStringTypeA",
  2083. "address": "0x426154"
  2084. },
  2085. {
  2086. "name": "LoadLibraryA",
  2087. "address": "0x426158"
  2088. },
  2089. {
  2090. "name": "GetConsoleMode",
  2091. "address": "0x42615c"
  2092. },
  2093. {
  2094. "name": "GetConsoleCP",
  2095. "address": "0x426160"
  2096. },
  2097. {
  2098. "name": "InitializeCriticalSectionAndSpinCount",
  2099. "address": "0x426164"
  2100. },
  2101. {
  2102. "name": "QueryPerformanceCounter",
  2103. "address": "0x426168"
  2104. },
  2105. {
  2106. "name": "SetHandleCount",
  2107. "address": "0x42616c"
  2108. },
  2109. {
  2110. "name": "GetEnvironmentStringsW",
  2111. "address": "0x426170"
  2112. },
  2113. {
  2114. "name": "FreeEnvironmentStringsW",
  2115. "address": "0x426174"
  2116. },
  2117. {
  2118. "name": "GetEnvironmentStrings",
  2119. "address": "0x426178"
  2120. },
  2121. {
  2122. "name": "FreeEnvironmentStringsA",
  2123. "address": "0x42617c"
  2124. },
  2125. {
  2126. "name": "LCMapStringW",
  2127. "address": "0x426180"
  2128. },
  2129. {
  2130. "name": "LCMapStringA",
  2131. "address": "0x426184"
  2132. },
  2133. {
  2134. "name": "IsValidCodePage",
  2135. "address": "0x426188"
  2136. },
  2137. {
  2138. "name": "GetOEMCP",
  2139. "address": "0x42618c"
  2140. },
  2141. {
  2142. "name": "GetACP",
  2143. "address": "0x426190"
  2144. },
  2145. {
  2146. "name": "GetModuleFileNameA",
  2147. "address": "0x426194"
  2148. },
  2149. {
  2150. "name": "ExitProcess",
  2151. "address": "0x426198"
  2152. },
  2153. {
  2154. "name": "HeapSize",
  2155. "address": "0x42619c"
  2156. },
  2157. {
  2158. "name": "IsDebuggerPresent",
  2159. "address": "0x4261a0"
  2160. },
  2161. {
  2162. "name": "SetUnhandledExceptionFilter",
  2163. "address": "0x4261a4"
  2164. },
  2165. {
  2166. "name": "UnhandledExceptionFilter",
  2167. "address": "0x4261a8"
  2168. },
  2169. {
  2170. "name": "TerminateProcess",
  2171. "address": "0x4261ac"
  2172. },
  2173. {
  2174. "name": "VirtualAlloc",
  2175. "address": "0x4261b0"
  2176. },
  2177. {
  2178. "name": "VirtualFree",
  2179. "address": "0x4261b4"
  2180. },
  2181. {
  2182. "name": "HeapCreate",
  2183. "address": "0x4261b8"
  2184. },
  2185. {
  2186. "name": "InterlockedDecrement",
  2187. "address": "0x4261bc"
  2188. },
  2189. {
  2190. "name": "GetCurrentThreadId",
  2191. "address": "0x4261c0"
  2192. },
  2193. {
  2194. "name": "InterlockedIncrement",
  2195. "address": "0x4261c4"
  2196. },
  2197. {
  2198. "name": "TlsFree",
  2199. "address": "0x4261c8"
  2200. },
  2201. {
  2202. "name": "TlsSetValue",
  2203. "address": "0x4261cc"
  2204. },
  2205. {
  2206. "name": "TlsAlloc",
  2207. "address": "0x4261d0"
  2208. },
  2209. {
  2210. "name": "TlsGetValue",
  2211. "address": "0x4261d4"
  2212. },
  2213. {
  2214. "name": "GetStartupInfoA",
  2215. "address": "0x4261d8"
  2216. },
  2217. {
  2218. "name": "GetCommandLineA",
  2219. "address": "0x4261dc"
  2220. },
  2221. {
  2222. "name": "RaiseException",
  2223. "address": "0x4261e0"
  2224. },
  2225. {
  2226. "name": "GetSystemTimeAsFileTime",
  2227. "address": "0x4261e4"
  2228. },
  2229. {
  2230. "name": "SetEndOfFile",
  2231. "address": "0x4261e8"
  2232. },
  2233. {
  2234. "name": "SetFilePointer",
  2235. "address": "0x4261ec"
  2236. },
  2237. {
  2238. "name": "GetStdHandle",
  2239. "address": "0x4261f0"
  2240. },
  2241. {
  2242. "name": "WriteFile",
  2243. "address": "0x4261f4"
  2244. },
  2245. {
  2246. "name": "FlushFileBuffers",
  2247. "address": "0x4261f8"
  2248. },
  2249. {
  2250. "name": "GetLongPathNameW",
  2251. "address": "0x4261fc"
  2252. },
  2253. {
  2254. "name": "MoveFileW",
  2255. "address": "0x426200"
  2256. },
  2257. {
  2258. "name": "GetShortPathNameW",
  2259. "address": "0x426204"
  2260. },
  2261. {
  2262. "name": "CreateDirectoryW",
  2263. "address": "0x426208"
  2264. },
  2265. {
  2266. "name": "RemoveDirectoryW",
  2267. "address": "0x42620c"
  2268. },
  2269. {
  2270. "name": "GlobalAlloc",
  2271. "address": "0x426210"
  2272. },
  2273. {
  2274. "name": "DeleteFileW",
  2275. "address": "0x426214"
  2276. },
  2277. {
  2278. "name": "FindClose",
  2279. "address": "0x426218"
  2280. },
  2281. {
  2282. "name": "CreateFileW",
  2283. "address": "0x42621c"
  2284. },
  2285. {
  2286. "name": "DeviceIoControl",
  2287. "address": "0x426220"
  2288. },
  2289. {
  2290. "name": "SetFileTime",
  2291. "address": "0x426224"
  2292. },
  2293. {
  2294. "name": "GetCurrentProcess",
  2295. "address": "0x426228"
  2296. },
  2297. {
  2298. "name": "CloseHandle",
  2299. "address": "0x42622c"
  2300. },
  2301. {
  2302. "name": "CreateHardLinkW",
  2303. "address": "0x426230"
  2304. },
  2305. {
  2306. "name": "SetLastError",
  2307. "address": "0x426234"
  2308. },
  2309. {
  2310. "name": "GetLastError",
  2311. "address": "0x426238"
  2312. },
  2313. {
  2314. "name": "GetCurrentDirectoryW",
  2315. "address": "0x42623c"
  2316. },
  2317. {
  2318. "name": "CreateFileA",
  2319. "address": "0x426240"
  2320. },
  2321. {
  2322. "name": "GetCPInfo",
  2323. "address": "0x426244"
  2324. },
  2325. {
  2326. "name": "HeapAlloc",
  2327. "address": "0x426248"
  2328. },
  2329. {
  2330. "name": "HeapReAlloc",
  2331. "address": "0x42624c"
  2332. },
  2333. {
  2334. "name": "HeapFree",
  2335. "address": "0x426250"
  2336. },
  2337. {
  2338. "name": "RtlUnwind",
  2339. "address": "0x426254"
  2340. }
  2341. ],
  2342. "dll": "KERNEL32.dll"
  2343. },
  2344. {
  2345. "imports": [
  2346. {
  2347. "name": "EnableWindow",
  2348. "address": "0x426290"
  2349. },
  2350. {
  2351. "name": "ShowWindow",
  2352. "address": "0x426294"
  2353. },
  2354. {
  2355. "name": "GetDlgItem",
  2356. "address": "0x426298"
  2357. },
  2358. {
  2359. "name": "MessageBoxW",
  2360. "address": "0x42629c"
  2361. },
  2362. {
  2363. "name": "FindWindowExW",
  2364. "address": "0x4262a0"
  2365. },
  2366. {
  2367. "name": "GetParent",
  2368. "address": "0x4262a4"
  2369. },
  2370. {
  2371. "name": "MapWindowPoints",
  2372. "address": "0x4262a8"
  2373. },
  2374. {
  2375. "name": "CreateWindowExW",
  2376. "address": "0x4262ac"
  2377. },
  2378. {
  2379. "name": "UpdateWindow",
  2380. "address": "0x4262b0"
  2381. },
  2382. {
  2383. "name": "LoadCursorW",
  2384. "address": "0x4262b4"
  2385. },
  2386. {
  2387. "name": "RegisterClassExW",
  2388. "address": "0x4262b8"
  2389. },
  2390. {
  2391. "name": "DefWindowProcW",
  2392. "address": "0x4262bc"
  2393. },
  2394. {
  2395. "name": "DestroyWindow",
  2396. "address": "0x4262c0"
  2397. },
  2398. {
  2399. "name": "CopyRect",
  2400. "address": "0x4262c4"
  2401. },
  2402. {
  2403. "name": "IsWindow",
  2404. "address": "0x4262c8"
  2405. },
  2406. {
  2407. "name": "CharUpperW",
  2408. "address": "0x4262cc"
  2409. },
  2410. {
  2411. "name": "OemToCharBuffA",
  2412. "address": "0x4262d0"
  2413. },
  2414. {
  2415. "name": "LoadIconW",
  2416. "address": "0x4262d4"
  2417. },
  2418. {
  2419. "name": "PostMessageW",
  2420. "address": "0x4262d8"
  2421. },
  2422. {
  2423. "name": "GetSysColor",
  2424. "address": "0x4262dc"
  2425. },
  2426. {
  2427. "name": "SetForegroundWindow",
  2428. "address": "0x4262e0"
  2429. },
  2430. {
  2431. "name": "WaitForInputIdle",
  2432. "address": "0x4262e4"
  2433. },
  2434. {
  2435. "name": "IsWindowVisible",
  2436. "address": "0x4262e8"
  2437. },
  2438. {
  2439. "name": "DialogBoxParamW",
  2440. "address": "0x4262ec"
  2441. },
  2442. {
  2443. "name": "DestroyIcon",
  2444. "address": "0x4262f0"
  2445. },
  2446. {
  2447. "name": "SetFocus",
  2448. "address": "0x4262f4"
  2449. },
  2450. {
  2451. "name": "GetClassNameW",
  2452. "address": "0x4262f8"
  2453. },
  2454. {
  2455. "name": "SendDlgItemMessageW",
  2456. "address": "0x4262fc"
  2457. },
  2458. {
  2459. "name": "EndDialog",
  2460. "address": "0x426300"
  2461. },
  2462. {
  2463. "name": "GetDlgItemTextW",
  2464. "address": "0x426304"
  2465. },
  2466. {
  2467. "name": "SetDlgItemTextW",
  2468. "address": "0x426308"
  2469. },
  2470. {
  2471. "name": "wvsprintfW",
  2472. "address": "0x42630c"
  2473. },
  2474. {
  2475. "name": "SendMessageW",
  2476. "address": "0x426310"
  2477. },
  2478. {
  2479. "name": "GetDC",
  2480. "address": "0x426314"
  2481. },
  2482. {
  2483. "name": "ReleaseDC",
  2484. "address": "0x426318"
  2485. },
  2486. {
  2487. "name": "PeekMessageW",
  2488. "address": "0x42631c"
  2489. },
  2490. {
  2491. "name": "GetMessageW",
  2492. "address": "0x426320"
  2493. },
  2494. {
  2495. "name": "TranslateMessage",
  2496. "address": "0x426324"
  2497. },
  2498. {
  2499. "name": "DispatchMessageW",
  2500. "address": "0x426328"
  2501. },
  2502. {
  2503. "name": "LoadStringW",
  2504. "address": "0x42632c"
  2505. },
  2506. {
  2507. "name": "GetWindowRect",
  2508. "address": "0x426330"
  2509. },
  2510. {
  2511. "name": "GetClientRect",
  2512. "address": "0x426334"
  2513. },
  2514. {
  2515. "name": "SetWindowPos",
  2516. "address": "0x426338"
  2517. },
  2518. {
  2519. "name": "GetWindowTextW",
  2520. "address": "0x42633c"
  2521. },
  2522. {
  2523. "name": "SetWindowTextW",
  2524. "address": "0x426340"
  2525. },
  2526. {
  2527. "name": "GetSystemMetrics",
  2528. "address": "0x426344"
  2529. },
  2530. {
  2531. "name": "GetWindow",
  2532. "address": "0x426348"
  2533. },
  2534. {
  2535. "name": "GetWindowLongW",
  2536. "address": "0x42634c"
  2537. },
  2538. {
  2539. "name": "SetWindowLongW",
  2540. "address": "0x426350"
  2541. },
  2542. {
  2543. "name": "LoadBitmapW",
  2544. "address": "0x426354"
  2545. }
  2546. ],
  2547. "dll": "USER32.dll"
  2548. },
  2549. {
  2550. "imports": [
  2551. {
  2552. "name": "GetDeviceCaps",
  2553. "address": "0x426040"
  2554. },
  2555. {
  2556. "name": "CreateCompatibleDC",
  2557. "address": "0x426044"
  2558. },
  2559. {
  2560. "name": "GetObjectW",
  2561. "address": "0x426048"
  2562. },
  2563. {
  2564. "name": "CreateCompatibleBitmap",
  2565. "address": "0x42604c"
  2566. },
  2567. {
  2568. "name": "SelectObject",
  2569. "address": "0x426050"
  2570. },
  2571. {
  2572. "name": "StretchBlt",
  2573. "address": "0x426054"
  2574. },
  2575. {
  2576. "name": "DeleteDC",
  2577. "address": "0x426058"
  2578. },
  2579. {
  2580. "name": "DeleteObject",
  2581. "address": "0x42605c"
  2582. }
  2583. ],
  2584. "dll": "GDI32.dll"
  2585. },
  2586. {
  2587. "imports": [
  2588. {
  2589. "name": "GetSaveFileNameW",
  2590. "address": "0x426030"
  2591. },
  2592. {
  2593. "name": "CommDlgExtendedError",
  2594. "address": "0x426034"
  2595. },
  2596. {
  2597. "name": "GetOpenFileNameW",
  2598. "address": "0x426038"
  2599. }
  2600. ],
  2601. "dll": "COMDLG32.dll"
  2602. },
  2603. {
  2604. "imports": [
  2605. {
  2606. "name": "RegOpenKeyExW",
  2607. "address": "0x426000"
  2608. },
  2609. {
  2610. "name": "RegQueryValueExW",
  2611. "address": "0x426004"
  2612. },
  2613. {
  2614. "name": "RegCreateKeyExW",
  2615. "address": "0x426008"
  2616. },
  2617. {
  2618. "name": "RegSetValueExW",
  2619. "address": "0x42600c"
  2620. },
  2621. {
  2622. "name": "RegCloseKey",
  2623. "address": "0x426010"
  2624. },
  2625. {
  2626. "name": "SetFileSecurityW",
  2627. "address": "0x426014"
  2628. },
  2629. {
  2630. "name": "OpenProcessToken",
  2631. "address": "0x426018"
  2632. },
  2633. {
  2634. "name": "LookupPrivilegeValueW",
  2635. "address": "0x42601c"
  2636. },
  2637. {
  2638. "name": "AdjustTokenPrivileges",
  2639. "address": "0x426020"
  2640. }
  2641. ],
  2642. "dll": "ADVAPI32.dll"
  2643. },
  2644. {
  2645. "imports": [
  2646. {
  2647. "name": "SHChangeNotify",
  2648. "address": "0x426264"
  2649. },
  2650. {
  2651. "name": "SHGetFileInfoW",
  2652. "address": "0x426268"
  2653. },
  2654. {
  2655. "name": "SHGetMalloc",
  2656. "address": "0x42626c"
  2657. },
  2658. {
  2659. "name": "SHGetSpecialFolderLocation",
  2660. "address": "0x426270"
  2661. },
  2662. {
  2663. "name": "SHGetPathFromIDListW",
  2664. "address": "0x426274"
  2665. },
  2666. {
  2667. "name": "SHBrowseForFolderW",
  2668. "address": "0x426278"
  2669. },
  2670. {
  2671. "name": "ShellExecuteExW",
  2672. "address": "0x42627c"
  2673. },
  2674. {
  2675. "name": "SHFileOperationW",
  2676. "address": "0x426280"
  2677. }
  2678. ],
  2679. "dll": "SHELL32.dll"
  2680. },
  2681. {
  2682. "imports": [
  2683. {
  2684. "name": "CLSIDFromString",
  2685. "address": "0x42635c"
  2686. },
  2687. {
  2688. "name": "CoCreateInstance",
  2689. "address": "0x426360"
  2690. },
  2691. {
  2692. "name": "OleInitialize",
  2693. "address": "0x426364"
  2694. },
  2695. {
  2696. "name": "OleUninitialize",
  2697. "address": "0x426368"
  2698. },
  2699. {
  2700. "name": "CreateStreamOnHGlobal",
  2701. "address": "0x42636c"
  2702. }
  2703. ],
  2704. "dll": "ole32.dll"
  2705. },
  2706. {
  2707. "imports": [
  2708. {
  2709. "name": "VariantInit",
  2710. "address": "0x42625c"
  2711. }
  2712. ],
  2713. "dll": "OLEAUT32.dll"
  2714. }
  2715. ],
  2716. "digital_signers": null,
  2717. "exported_dll_name": "WINRAR.SFX",
  2718. "actual_checksum": "0x009061b0",
  2719. "overlay": {
  2720. "size": "0x008d5649",
  2721. "offset": "0x0002ea00"
  2722. },
  2723. "imagebase": "0x00400000",
  2724. "reported_checksum": "0x009061b0",
  2725. "icon_hash": null,
  2726. "entrypoint": "0x0041d1d8",
  2727. "timestamp": "2013-06-10 11:08:38",
  2728. "osversion": "5.0",
  2729. "sections": [
  2730. {
  2731. "name": ".text",
  2732. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2733. "virtual_address": "0x00001000",
  2734. "size_of_data": "0x00025000",
  2735. "entropy": "6.71",
  2736. "raw_address": "0x00000400",
  2737. "virtual_size": "0x00024fe4",
  2738. "characteristics_raw": "0x60000020"
  2739. },
  2740. {
  2741. "name": ".rdata",
  2742. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2743. "virtual_address": "0x00026000",
  2744. "size_of_data": "0x00005000",
  2745. "entropy": "5.33",
  2746. "raw_address": "0x00025400",
  2747. "virtual_size": "0x00004f33",
  2748. "characteristics_raw": "0x40000040"
  2749. },
  2750. {
  2751. "name": ".data",
  2752. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2753. "virtual_address": "0x0002b000",
  2754. "size_of_data": "0x00001400",
  2755. "entropy": "2.53",
  2756. "raw_address": "0x0002a400",
  2757. "virtual_size": "0x000215e0",
  2758. "characteristics_raw": "0xc0000040"
  2759. },
  2760. {
  2761. "name": ".rsrc",
  2762. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2763. "virtual_address": "0x0004d000",
  2764. "size_of_data": "0x00003200",
  2765. "entropy": "4.40",
  2766. "raw_address": "0x0002b800",
  2767. "virtual_size": "0x000030d0",
  2768. "characteristics_raw": "0x40000040"
  2769. }
  2770. ],
  2771. "resources": [],
  2772. "dirents": [
  2773. {
  2774. "virtual_address": "0x0002af00",
  2775. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2776. "size": "0x00000033"
  2777. },
  2778. {
  2779. "virtual_address": "0x00029b54",
  2780. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2781. "size": "0x000000dc"
  2782. },
  2783. {
  2784. "virtual_address": "0x0004d000",
  2785. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2786. "size": "0x000030d0"
  2787. },
  2788. {
  2789. "virtual_address": "0x00000000",
  2790. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2791. "size": "0x00000000"
  2792. },
  2793. {
  2794. "virtual_address": "0x00000000",
  2795. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2796. "size": "0x00000000"
  2797. },
  2798. {
  2799. "virtual_address": "0x00000000",
  2800. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2801. "size": "0x00000000"
  2802. },
  2803. {
  2804. "virtual_address": "0x000263f0",
  2805. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2806. "size": "0x0000001c"
  2807. },
  2808. {
  2809. "virtual_address": "0x00000000",
  2810. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2811. "size": "0x00000000"
  2812. },
  2813. {
  2814. "virtual_address": "0x00000000",
  2815. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2816. "size": "0x00000000"
  2817. },
  2818. {
  2819. "virtual_address": "0x00000000",
  2820. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2821. "size": "0x00000000"
  2822. },
  2823. {
  2824. "virtual_address": "0x00028b80",
  2825. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2826. "size": "0x00000040"
  2827. },
  2828. {
  2829. "virtual_address": "0x00000000",
  2830. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2831. "size": "0x00000000"
  2832. },
  2833. {
  2834. "virtual_address": "0x00026000",
  2835. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2836. "size": "0x00000374"
  2837. },
  2838. {
  2839. "virtual_address": "0x00000000",
  2840. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2841. "size": "0x00000000"
  2842. },
  2843. {
  2844. "virtual_address": "0x00000000",
  2845. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2846. "size": "0x00000000"
  2847. },
  2848. {
  2849. "virtual_address": "0x00000000",
  2850. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2851. "size": "0x00000000"
  2852. }
  2853. ],
  2854. "exports": [],
  2855. "guest_signers": {},
  2856. "imphash": "3eaa732d4dae53340f9646bdd85dac41",
  2857. "icon_fuzzy": null,
  2858. "icon": null,
  2859. "pdbpath": "d:\\Projects\\WinRAR\\SFX\\build\\sfxrar32\\Release\\sfxrar.pdb",
  2860. "imported_dll_count": 10,
  2861. "versioninfo": []
  2862. }
  2863. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!