API tools faq
paste
paladin316

Exes_8b47ff304df47c7d040541daf0a8dfbd_exe_2019-06-24_13_30.json

paladin316
Jun 24th, 2019
2,276
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 37.45 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_8b47ff304df47c7d040541daf0a8dfbd.exe"
  7. [*] File Size: 475136
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "0ce5ac3b0d246bc195673b49854a6d4eb94ed9b226233adf6c95e2497c20a76f"
  10. [*] MD5: "8b47ff304df47c7d040541daf0a8dfbd"
  11. [*] SHA1: "2073d8bcb60a05a5a7e9cb94496929e0c7cfd250"
  12. [*] SHA512: "365c24466a50929646dad43d2cb84d563903b141245cbb5033dddaee4eac191a45106c8aaadaf1b17f436b529ca174d8e2d783f55779b513a88efe4df0557f93"
  13. [*] CRC32: "A3438894"
  14. [*] SSDEEP: "12288:ht3LoMJUvN/Mz3ektppZtxjJPfyq+EEh:H7o6EN/MzOIppZtxFPfyqo"
  15.  
  16. [*] Process Execution: [
  17. "Exes_8b47ff304df47c7d040541daf0a8dfbd.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Installs itself for autorun at Windows startup",
  27. "Details": [
  28. {
  29. "file": "C:\\Windows\\win.ini"
  30. },
  31. {
  32. "file": "C:\\Windows\\win.ini"
  33. }
  34. ]
  35. },
  36. {
  37. "Description": "File has been identified by 41 Antiviruses on VirusTotal as malicious",
  38. "Details": [
  39. {
  40. "MicroWorld-eScan": "Trojan.GenericKD.32068439"
  41. },
  42. {
  43. "FireEye": "Trojan.GenericKD.32068439"
  44. },
  45. {
  46. "McAfee": "RDN/Generic.dx"
  47. },
  48. {
  49. "Cylance": "Unsafe"
  50. },
  51. {
  52. "VIPRE": "Trojan.Win32.Generic!BT"
  53. },
  54. {
  55. "Alibaba": "TrojanSpy:Win32/Noon.cdef7f4d"
  56. },
  57. {
  58. "K7GW": "Riskware ( 0040eff71 )"
  59. },
  60. {
  61. "TrendMicro": "TrojanSpy.Win32.FAREIT.SMA.hp"
  62. },
  63. {
  64. "F-Prot": "W32/Noon.AZ"
  65. },
  66. {
  67. "Symantec": "Packed.Generic.535"
  68. },
  69. {
  70. "APEX": "Malicious"
  71. },
  72. {
  73. "Avast": "Win32:Malware-gen"
  74. },
  75. {
  76. "Kaspersky": "Trojan-Spy.Win32.Noon.ahci"
  77. },
  78. {
  79. "BitDefender": "Trojan.GenericKD.32068439"
  80. },
  81. {
  82. "Paloalto": "generic.ml"
  83. },
  84. {
  85. "AegisLab": "Trojan.Win32.Generic.4!c"
  86. },
  87. {
  88. "Tencent": "Win32.Trojan.Inject.Auto"
  89. },
  90. {
  91. "Endgame": "malicious (high confidence)"
  92. },
  93. {
  94. "Emsisoft": "Trojan.GenericKD.32068439 (B)"
  95. },
  96. {
  97. "DrWeb": "Trojan.PWS.Banker1.32911"
  98. },
  99. {
  100. "Invincea": "heuristic"
  101. },
  102. {
  103. "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.gh"
  104. },
  105. {
  106. "Trapmine": "suspicious.low.ml.score"
  107. },
  108. {
  109. "Sophos": "Troj/VB-KHE"
  110. },
  111. {
  112. "SentinelOne": "DFI - Suspicious PE"
  113. },
  114. {
  115. "Cyren": "W32/Trojan.DOUZ-7421"
  116. },
  117. {
  118. "Microsoft": "Trojan:Win32/Dynamer!rfn"
  119. },
  120. {
  121. "ZoneAlarm": "Trojan-Spy.Win32.Noon.ahci"
  122. },
  123. {
  124. "GData": "Win32.Trojan-Stealer.FormBook.EE5K9B"
  125. },
  126. {
  127. "Acronis": "suspicious"
  128. },
  129. {
  130. "Ad-Aware": "Trojan.GenericKD.32068439"
  131. },
  132. {
  133. "ESET-NOD32": "a variant of Win32/Injector.EGCO"
  134. },
  135. {
  136. "TrendMicro-HouseCall": "TrojanSpy.Win32.FAREIT.SMA.hp"
  137. },
  138. {
  139. "Rising": "Spyware.Noon!8.E7C9 (CLOUD)"
  140. },
  141. {
  142. "Ikarus": "Trojan.VB.Crypt"
  143. },
  144. {
  145. "Fortinet": "W32/Noon.AHCI!tr"
  146. },
  147. {
  148. "AVG": "Win32:Malware-gen"
  149. },
  150. {
  151. "Cybereason": "malicious.cb60a0"
  152. },
  153. {
  154. "Panda": "Trj/GdSda.A"
  155. },
  156. {
  157. "CrowdStrike": "win/malicious_confidence_100% (W)"
  158. },
  159. {
  160. "Qihoo-360": "HEUR/QVM03.0.F235.Malware.Gen"
  161. }
  162. ]
  163. }
  164. ]
  165.  
  166. [*] Started Service: []
  167.  
  168. [*] Executed Commands: [
  169. "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_8b47ff304df47c7d040541daf0a8dfbd.exe\""
  170. ]
  171.  
  172. [*] Mutexes: [
  173. "CicLoadWinStaWinSta0",
  174. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  175. ]
  176.  
  177. [*] Modified Files: [
  178. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAF28002B0BC83A9F.TMP",
  179. "C:\\Windows\\win.ini"
  180. ]
  181.  
  182. [*] Deleted Files: []
  183.  
  184. [*] Modified Registry Keys: []
  185.  
  186. [*] Deleted Registry Keys: []
  187.  
  188. [*] DNS Communications: []
  189.  
  190. [*] Domains: []
  191.  
  192. [*] Network Communication - ICMP: []
  193.  
  194. [*] Network Communication - HTTP: []
  195.  
  196. [*] Network Communication - SMTP: []
  197.  
  198. [*] Network Communication - Hosts: []
  199.  
  200. [*] Network Communication - IRC: []
  201.  
  202. [*] Static Analysis: {
  203. "pe": {
  204. "peid_signatures": null,
  205. "imports": [
  206. {
  207. "imports": [
  208. {
  209. "name": null,
  210. "address": "0x401000"
  211. },
  212. {
  213. "name": "_CIcos",
  214. "address": "0x401004"
  215. },
  216. {
  217. "name": "_adj_fptan",
  218. "address": "0x401008"
  219. },
  220. {
  221. "name": null,
  222. "address": "0x40100c"
  223. },
  224. {
  225. "name": "__vbaFreeVar",
  226. "address": "0x401010"
  227. },
  228. {
  229. "name": "__vbaFreeVarList",
  230. "address": "0x401014"
  231. },
  232. {
  233. "name": "_adj_fdiv_m64",
  234. "address": "0x401018"
  235. },
  236. {
  237. "name": "__vbaFreeObjList",
  238. "address": "0x40101c"
  239. },
  240. {
  241. "name": "_adj_fprem1",
  242. "address": "0x401020"
  243. },
  244. {
  245. "name": null,
  246. "address": "0x401024"
  247. },
  248. {
  249. "name": null,
  250. "address": "0x401028"
  251. },
  252. {
  253. "name": "__vbaSetSystemError",
  254. "address": "0x40102c"
  255. },
  256. {
  257. "name": "__vbaHresultCheckObj",
  258. "address": "0x401030"
  259. },
  260. {
  261. "name": null,
  262. "address": "0x401034"
  263. },
  264. {
  265. "name": "_adj_fdiv_m32",
  266. "address": "0x401038"
  267. },
  268. {
  269. "name": null,
  270. "address": "0x40103c"
  271. },
  272. {
  273. "name": "__vbaOnError",
  274. "address": "0x401040"
  275. },
  276. {
  277. "name": "__vbaObjSet",
  278. "address": "0x401044"
  279. },
  280. {
  281. "name": null,
  282. "address": "0x401048"
  283. },
  284. {
  285. "name": "_adj_fdiv_m16i",
  286. "address": "0x40104c"
  287. },
  288. {
  289. "name": "__vbaObjSetAddref",
  290. "address": "0x401050"
  291. },
  292. {
  293. "name": "_adj_fdivr_m16i",
  294. "address": "0x401054"
  295. },
  296. {
  297. "name": "__vbaFpR8",
  298. "address": "0x401058"
  299. },
  300. {
  301. "name": "_CIsin",
  302. "address": "0x40105c"
  303. },
  304. {
  305. "name": "__vbaChkstk",
  306. "address": "0x401060"
  307. },
  308. {
  309. "name": "EVENT_SINK_AddRef",
  310. "address": "0x401064"
  311. },
  312. {
  313. "name": "__vbaStrCmp",
  314. "address": "0x401068"
  315. },
  316. {
  317. "name": null,
  318. "address": "0x40106c"
  319. },
  320. {
  321. "name": null,
  322. "address": "0x401070"
  323. },
  324. {
  325. "name": null,
  326. "address": "0x401074"
  327. },
  328. {
  329. "name": "DllFunctionCall",
  330. "address": "0x401078"
  331. },
  332. {
  333. "name": null,
  334. "address": "0x40107c"
  335. },
  336. {
  337. "name": "_adj_fpatan",
  338. "address": "0x401080"
  339. },
  340. {
  341. "name": null,
  342. "address": "0x401084"
  343. },
  344. {
  345. "name": "EVENT_SINK_Release",
  346. "address": "0x401088"
  347. },
  348. {
  349. "name": "_CIsqrt",
  350. "address": "0x40108c"
  351. },
  352. {
  353. "name": "EVENT_SINK_QueryInterface",
  354. "address": "0x401090"
  355. },
  356. {
  357. "name": "__vbaExceptHandler",
  358. "address": "0x401094"
  359. },
  360. {
  361. "name": "__vbaStrToUnicode",
  362. "address": "0x401098"
  363. },
  364. {
  365. "name": "_adj_fprem",
  366. "address": "0x40109c"
  367. },
  368. {
  369. "name": "_adj_fdivr_m64",
  370. "address": "0x4010a0"
  371. },
  372. {
  373. "name": null,
  374. "address": "0x4010a4"
  375. },
  376. {
  377. "name": null,
  378. "address": "0x4010a8"
  379. },
  380. {
  381. "name": "__vbaFPException",
  382. "address": "0x4010ac"
  383. },
  384. {
  385. "name": "__vbaStrVarVal",
  386. "address": "0x4010b0"
  387. },
  388. {
  389. "name": "_CIlog",
  390. "address": "0x4010b4"
  391. },
  392. {
  393. "name": "__vbaErrorOverflow",
  394. "address": "0x4010b8"
  395. },
  396. {
  397. "name": "__vbaFileOpen",
  398. "address": "0x4010bc"
  399. },
  400. {
  401. "name": "__vbaNew2",
  402. "address": "0x4010c0"
  403. },
  404. {
  405. "name": "_adj_fdiv_m32i",
  406. "address": "0x4010c4"
  407. },
  408. {
  409. "name": "_adj_fdivr_m32i",
  410. "address": "0x4010c8"
  411. },
  412. {
  413. "name": "__vbaFreeStrList",
  414. "address": "0x4010cc"
  415. },
  416. {
  417. "name": "_adj_fdivr_m32",
  418. "address": "0x4010d0"
  419. },
  420. {
  421. "name": "_adj_fdiv_r",
  422. "address": "0x4010d4"
  423. },
  424. {
  425. "name": null,
  426. "address": "0x4010d8"
  427. },
  428. {
  429. "name": null,
  430. "address": "0x4010dc"
  431. },
  432. {
  433. "name": "__vbaVarTstNe",
  434. "address": "0x4010e0"
  435. },
  436. {
  437. "name": "__vbaInStrB",
  438. "address": "0x4010e4"
  439. },
  440. {
  441. "name": "__vbaVarDup",
  442. "address": "0x4010e8"
  443. },
  444. {
  445. "name": "__vbaStrToAnsi",
  446. "address": "0x4010ec"
  447. },
  448. {
  449. "name": "__vbaVarLateMemCallLd",
  450. "address": "0x4010f0"
  451. },
  452. {
  453. "name": "_CIatan",
  454. "address": "0x4010f4"
  455. },
  456. {
  457. "name": "__vbaStrMove",
  458. "address": "0x4010f8"
  459. },
  460. {
  461. "name": "_allmul",
  462. "address": "0x4010fc"
  463. },
  464. {
  465. "name": "_CItan",
  466. "address": "0x401100"
  467. },
  468. {
  469. "name": "__vbaFPInt",
  470. "address": "0x401104"
  471. },
  472. {
  473. "name": "_CIexp",
  474. "address": "0x401108"
  475. },
  476. {
  477. "name": "__vbaFreeObj",
  478. "address": "0x40110c"
  479. },
  480. {
  481. "name": "__vbaFreeStr",
  482. "address": "0x401110"
  483. },
  484. {
  485. "name": null,
  486. "address": "0x401114"
  487. }
  488. ],
  489. "dll": "MSVBVM60.DLL"
  490. }
  491. ],
  492. "digital_signers": null,
  493. "exported_dll_name": null,
  494. "actual_checksum": "0x0008225b",
  495. "overlay": null,
  496. "imagebase": "0x00400000",
  497. "reported_checksum": "0x0008225b",
  498. "icon_hash": null,
  499. "entrypoint": "0x00401344",
  500. "timestamp": "2019-06-18 08:00:17",
  501. "osversion": "4.0",
  502. "sections": [
  503. {
  504. "name": ".text",
  505. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  506. "virtual_address": "0x00001000",
  507. "size_of_data": "0x00071000",
  508. "entropy": "6.33",
  509. "raw_address": "0x00001000",
  510. "virtual_size": "0x00070eec",
  511. "characteristics_raw": "0x60000020"
  512. },
  513. {
  514. "name": ".data",
  515. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  516. "virtual_address": "0x00072000",
  517. "size_of_data": "0x00001000",
  518. "entropy": "0.00",
  519. "raw_address": "0x00072000",
  520. "virtual_size": "0x00002f40",
  521. "characteristics_raw": "0xc0000040"
  522. },
  523. {
  524. "name": ".rsrc",
  525. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  526. "virtual_address": "0x00075000",
  527. "size_of_data": "0x00001000",
  528. "entropy": "5.71",
  529. "raw_address": "0x00073000",
  530. "virtual_size": "0x00000dc6",
  531. "characteristics_raw": "0x40000040"
  532. }
  533. ],
  534. "resources": [],
  535. "dirents": [
  536. {
  537. "virtual_address": "0x00000000",
  538. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  539. "size": "0x00000000"
  540. },
  541. {
  542. "virtual_address": "0x00071a34",
  543. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  544. "size": "0x00000028"
  545. },
  546. {
  547. "virtual_address": "0x00075000",
  548. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  549. "size": "0x00000dc6"
  550. },
  551. {
  552. "virtual_address": "0x00000000",
  553. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  554. "size": "0x00000000"
  555. },
  556. {
  557. "virtual_address": "0x00000000",
  558. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  559. "size": "0x00000000"
  560. },
  561. {
  562. "virtual_address": "0x00000000",
  563. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  564. "size": "0x00000000"
  565. },
  566. {
  567. "virtual_address": "0x00000000",
  568. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  569. "size": "0x00000000"
  570. },
  571. {
  572. "virtual_address": "0x00000000",
  573. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  574. "size": "0x00000000"
  575. },
  576. {
  577. "virtual_address": "0x00000000",
  578. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  579. "size": "0x00000000"
  580. },
  581. {
  582. "virtual_address": "0x00000000",
  583. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  584. "size": "0x00000000"
  585. },
  586. {
  587. "virtual_address": "0x00000000",
  588. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  589. "size": "0x00000000"
  590. },
  591. {
  592. "virtual_address": "0x00000230",
  593. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  594. "size": "0x00000020"
  595. },
  596. {
  597. "virtual_address": "0x00001000",
  598. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  599. "size": "0x0000011c"
  600. },
  601. {
  602. "virtual_address": "0x00000000",
  603. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  604. "size": "0x00000000"
  605. },
  606. {
  607. "virtual_address": "0x00000000",
  608. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  609. "size": "0x00000000"
  610. },
  611. {
  612. "virtual_address": "0x00000000",
  613. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  614. "size": "0x00000000"
  615. }
  616. ],
  617. "exports": [],
  618. "guest_signers": {},
  619. "imphash": "75ddc085f24f5caceeeafda8470cc501",
  620. "icon_fuzzy": null,
  621. "icon": null,
  622. "pdbpath": null,
  623. "imported_dll_count": 1,
  624. "versioninfo": []
  625. }
  626. }
  627.  
  628. [*] Resolved APIs: [
  629. "cryptbase.dll.SystemFunction036",
  630. "uxtheme.dll.ThemeInitApiHook",
  631. "user32.dll.IsProcessDPIAware",
  632. "oleaut32.dll.OleLoadPictureEx",
  633. "oleaut32.dll.DispCallFunc",
  634. "oleaut32.dll.LoadTypeLibEx",
  635. "oleaut32.dll.UnRegisterTypeLib",
  636. "oleaut32.dll.CreateTypeLib2",
  637. "oleaut32.dll.VarDateFromUdate",
  638. "oleaut32.dll.VarUdateFromDate",
  639. "oleaut32.dll.GetAltMonthNames",
  640. "oleaut32.dll.VarNumFromParseNum",
  641. "oleaut32.dll.VarParseNumFromStr",
  642. "oleaut32.dll.VarDecFromR4",
  643. "oleaut32.dll.VarDecFromR8",
  644. "oleaut32.dll.VarDecFromDate",
  645. "oleaut32.dll.VarDecFromI4",
  646. "oleaut32.dll.VarDecFromCy",
  647. "oleaut32.dll.VarR4FromDec",
  648. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  649. "oleaut32.dll.GetRecordInfoFromGuids",
  650. "oleaut32.dll.SafeArrayGetRecordInfo",
  651. "oleaut32.dll.SafeArraySetRecordInfo",
  652. "oleaut32.dll.SafeArrayGetIID",
  653. "oleaut32.dll.SafeArraySetIID",
  654. "oleaut32.dll.SafeArrayCopyData",
  655. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  656. "oleaut32.dll.SafeArrayCreateEx",
  657. "oleaut32.dll.VarFormat",
  658. "oleaut32.dll.VarFormatDateTime",
  659. "oleaut32.dll.VarFormatNumber",
  660. "oleaut32.dll.VarFormatPercent",
  661. "oleaut32.dll.VarFormatCurrency",
  662. "oleaut32.dll.VarWeekdayName",
  663. "oleaut32.dll.VarMonthName",
  664. "oleaut32.dll.VarAdd",
  665. "oleaut32.dll.VarAnd",
  666. "oleaut32.dll.VarCat",
  667. "oleaut32.dll.VarDiv",
  668. "oleaut32.dll.VarEqv",
  669. "oleaut32.dll.VarIdiv",
  670. "oleaut32.dll.VarImp",
  671. "oleaut32.dll.VarMod",
  672. "oleaut32.dll.VarMul",
  673. "oleaut32.dll.VarOr",
  674. "oleaut32.dll.VarPow",
  675. "oleaut32.dll.VarSub",
  676. "oleaut32.dll.VarXor",
  677. "oleaut32.dll.VarAbs",
  678. "oleaut32.dll.VarFix",
  679. "oleaut32.dll.VarInt",
  680. "oleaut32.dll.VarNeg",
  681. "oleaut32.dll.VarNot",
  682. "oleaut32.dll.VarRound",
  683. "oleaut32.dll.VarCmp",
  684. "oleaut32.dll.VarDecAdd",
  685. "oleaut32.dll.VarDecCmp",
  686. "oleaut32.dll.VarBstrCat",
  687. "oleaut32.dll.VarCyMulI4",
  688. "oleaut32.dll.VarBstrCmp",
  689. "ole32.dll.CoCreateInstanceEx",
  690. "ole32.dll.CLSIDFromProgIDEx",
  691. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  692. "user32.dll.GetSystemMetrics",
  693. "user32.dll.MonitorFromWindow",
  694. "user32.dll.MonitorFromRect",
  695. "user32.dll.MonitorFromPoint",
  696. "user32.dll.EnumDisplayMonitors",
  697. "user32.dll.GetMonitorInfoA",
  698. "cryptsp.dll.CryptAcquireContextW",
  699. "cryptsp.dll.CryptGenRandom",
  700. "dwmapi.dll.DwmIsCompositionEnabled",
  701. "gdi32.dll.GetLayout",
  702. "gdi32.dll.GdiRealizationInfo",
  703. "gdi32.dll.FontIsLinked",
  704. "advapi32.dll.RegOpenKeyExW",
  705. "advapi32.dll.RegQueryInfoKeyW",
  706. "gdi32.dll.GetTextFaceAliasW",
  707. "advapi32.dll.RegEnumValueW",
  708. "advapi32.dll.RegCloseKey",
  709. "advapi32.dll.RegQueryValueExW",
  710. "gdi32.dll.GetFontAssocStatus",
  711. "advapi32.dll.RegQueryValueExA",
  712. "advapi32.dll.RegEnumKeyExW",
  713. "gdi32.dll.GdiIsMetaPrintDC",
  714. "ole32.dll.CoInitializeEx",
  715. "ole32.dll.CoUninitialize",
  716. "ole32.dll.CoRegisterInitializeSpy",
  717. "ole32.dll.CoRevokeInitializeSpy",
  718. "gdi32.dll.GetTextExtentExPointWPri",
  719. "kernel32.dll.NlsGetCacheUpdateCount",
  720. "kernel32.dll.GetCalendarInfoW",
  721. "user32.dll.EnumChildWindows",
  722. "kernel32.dll.Sleep",
  723. "kernel32.dll.WriteProfileStringA",
  724. "ntdll.dll.NtProtectVirtualMemory",
  725. "kernel32.dll.CreateFileA",
  726. "kernel32.dll.WriteFile",
  727. "kernel32.dll.CloseHandle",
  728. "kernel32.dll.ReadFile",
  729. "kernel32.dll.GetFileSize",
  730. "kernel32.dll.UnmapViewOfFile",
  731. "kernel32.dll.VirtualProtectEx",
  732. "kernel32.dll.GetLongPathNameA",
  733. "kernel32.dll.TerminateProcess",
  734. "iphlpapi.dll.GetAdaptersInfo",
  735. "kernel32.dll.VirtualAllocEx",
  736. "kernel32.dll.CreateProcessW",
  737. "shell32.dll.ShellExecuteA",
  738. "advapi32.dll.RegCreateKeyExA",
  739. "advapi32.dll.RegSetValueExA",
  740. "kernel32.dll.WaitForDebugEvent",
  741. "kernel32.dll.ContinueDebugEvent",
  742. "kernel32.dll.DebugActiveProcessStop",
  743. "kernel32.dll.OutputDebugStringW"
  744. ]
  745.  
  746. [*] Static Analysis: {
  747. "pe": {
  748. "peid_signatures": null,
  749. "imports": [
  750. {
  751. "imports": [
  752. {
  753. "name": null,
  754. "address": "0x401000"
  755. },
  756. {
  757. "name": "_CIcos",
  758. "address": "0x401004"
  759. },
  760. {
  761. "name": "_adj_fptan",
  762. "address": "0x401008"
  763. },
  764. {
  765. "name": null,
  766. "address": "0x40100c"
  767. },
  768. {
  769. "name": "__vbaFreeVar",
  770. "address": "0x401010"
  771. },
  772. {
  773. "name": "__vbaFreeVarList",
  774. "address": "0x401014"
  775. },
  776. {
  777. "name": "_adj_fdiv_m64",
  778. "address": "0x401018"
  779. },
  780. {
  781. "name": "__vbaFreeObjList",
  782. "address": "0x40101c"
  783. },
  784. {
  785. "name": "_adj_fprem1",
  786. "address": "0x401020"
  787. },
  788. {
  789. "name": null,
  790. "address": "0x401024"
  791. },
  792. {
  793. "name": null,
  794. "address": "0x401028"
  795. },
  796. {
  797. "name": "__vbaSetSystemError",
  798. "address": "0x40102c"
  799. },
  800. {
  801. "name": "__vbaHresultCheckObj",
  802. "address": "0x401030"
  803. },
  804. {
  805. "name": null,
  806. "address": "0x401034"
  807. },
  808. {
  809. "name": "_adj_fdiv_m32",
  810. "address": "0x401038"
  811. },
  812. {
  813. "name": null,
  814. "address": "0x40103c"
  815. },
  816. {
  817. "name": "__vbaOnError",
  818. "address": "0x401040"
  819. },
  820. {
  821. "name": "__vbaObjSet",
  822. "address": "0x401044"
  823. },
  824. {
  825. "name": null,
  826. "address": "0x401048"
  827. },
  828. {
  829. "name": "_adj_fdiv_m16i",
  830. "address": "0x40104c"
  831. },
  832. {
  833. "name": "__vbaObjSetAddref",
  834. "address": "0x401050"
  835. },
  836. {
  837. "name": "_adj_fdivr_m16i",
  838. "address": "0x401054"
  839. },
  840. {
  841. "name": "__vbaFpR8",
  842. "address": "0x401058"
  843. },
  844. {
  845. "name": "_CIsin",
  846. "address": "0x40105c"
  847. },
  848. {
  849. "name": "__vbaChkstk",
  850. "address": "0x401060"
  851. },
  852. {
  853. "name": "EVENT_SINK_AddRef",
  854. "address": "0x401064"
  855. },
  856. {
  857. "name": "__vbaStrCmp",
  858. "address": "0x401068"
  859. },
  860. {
  861. "name": null,
  862. "address": "0x40106c"
  863. },
  864. {
  865. "name": null,
  866. "address": "0x401070"
  867. },
  868. {
  869. "name": null,
  870. "address": "0x401074"
  871. },
  872. {
  873. "name": "DllFunctionCall",
  874. "address": "0x401078"
  875. },
  876. {
  877. "name": null,
  878. "address": "0x40107c"
  879. },
  880. {
  881. "name": "_adj_fpatan",
  882. "address": "0x401080"
  883. },
  884. {
  885. "name": null,
  886. "address": "0x401084"
  887. },
  888. {
  889. "name": "EVENT_SINK_Release",
  890. "address": "0x401088"
  891. },
  892. {
  893. "name": "_CIsqrt",
  894. "address": "0x40108c"
  895. },
  896. {
  897. "name": "EVENT_SINK_QueryInterface",
  898. "address": "0x401090"
  899. },
  900. {
  901. "name": "__vbaExceptHandler",
  902. "address": "0x401094"
  903. },
  904. {
  905. "name": "__vbaStrToUnicode",
  906. "address": "0x401098"
  907. },
  908. {
  909. "name": "_adj_fprem",
  910. "address": "0x40109c"
  911. },
  912. {
  913. "name": "_adj_fdivr_m64",
  914. "address": "0x4010a0"
  915. },
  916. {
  917. "name": null,
  918. "address": "0x4010a4"
  919. },
  920. {
  921. "name": null,
  922. "address": "0x4010a8"
  923. },
  924. {
  925. "name": "__vbaFPException",
  926. "address": "0x4010ac"
  927. },
  928. {
  929. "name": "__vbaStrVarVal",
  930. "address": "0x4010b0"
  931. },
  932. {
  933. "name": "_CIlog",
  934. "address": "0x4010b4"
  935. },
  936. {
  937. "name": "__vbaErrorOverflow",
  938. "address": "0x4010b8"
  939. },
  940. {
  941. "name": "__vbaFileOpen",
  942. "address": "0x4010bc"
  943. },
  944. {
  945. "name": "__vbaNew2",
  946. "address": "0x4010c0"
  947. },
  948. {
  949. "name": "_adj_fdiv_m32i",
  950. "address": "0x4010c4"
  951. },
  952. {
  953. "name": "_adj_fdivr_m32i",
  954. "address": "0x4010c8"
  955. },
  956. {
  957. "name": "__vbaFreeStrList",
  958. "address": "0x4010cc"
  959. },
  960. {
  961. "name": "_adj_fdivr_m32",
  962. "address": "0x4010d0"
  963. },
  964. {
  965. "name": "_adj_fdiv_r",
  966. "address": "0x4010d4"
  967. },
  968. {
  969. "name": null,
  970. "address": "0x4010d8"
  971. },
  972. {
  973. "name": null,
  974. "address": "0x4010dc"
  975. },
  976. {
  977. "name": "__vbaVarTstNe",
  978. "address": "0x4010e0"
  979. },
  980. {
  981. "name": "__vbaInStrB",
  982. "address": "0x4010e4"
  983. },
  984. {
  985. "name": "__vbaVarDup",
  986. "address": "0x4010e8"
  987. },
  988. {
  989. "name": "__vbaStrToAnsi",
  990. "address": "0x4010ec"
  991. },
  992. {
  993. "name": "__vbaVarLateMemCallLd",
  994. "address": "0x4010f0"
  995. },
  996. {
  997. "name": "_CIatan",
  998. "address": "0x4010f4"
  999. },
  1000. {
  1001. "name": "__vbaStrMove",
  1002. "address": "0x4010f8"
  1003. },
  1004. {
  1005. "name": "_allmul",
  1006. "address": "0x4010fc"
  1007. },
  1008. {
  1009. "name": "_CItan",
  1010. "address": "0x401100"
  1011. },
  1012. {
  1013. "name": "__vbaFPInt",
  1014. "address": "0x401104"
  1015. },
  1016. {
  1017. "name": "_CIexp",
  1018. "address": "0x401108"
  1019. },
  1020. {
  1021. "name": "__vbaFreeObj",
  1022. "address": "0x40110c"
  1023. },
  1024. {
  1025. "name": "__vbaFreeStr",
  1026. "address": "0x401110"
  1027. },
  1028. {
  1029. "name": null,
  1030. "address": "0x401114"
  1031. }
  1032. ],
  1033. "dll": "MSVBVM60.DLL"
  1034. }
  1035. ],
  1036. "digital_signers": null,
  1037. "exported_dll_name": null,
  1038. "actual_checksum": "0x0008225b",
  1039. "overlay": null,
  1040. "imagebase": "0x00400000",
  1041. "reported_checksum": "0x0008225b",
  1042. "icon_hash": null,
  1043. "entrypoint": "0x00401344",
  1044. "timestamp": "2019-06-18 08:00:17",
  1045. "osversion": "4.0",
  1046. "sections": [
  1047. {
  1048. "name": ".text",
  1049. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1050. "virtual_address": "0x00001000",
  1051. "size_of_data": "0x00071000",
  1052. "entropy": "6.33",
  1053. "raw_address": "0x00001000",
  1054. "virtual_size": "0x00070eec",
  1055. "characteristics_raw": "0x60000020"
  1056. },
  1057. {
  1058. "name": ".data",
  1059. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1060. "virtual_address": "0x00072000",
  1061. "size_of_data": "0x00001000",
  1062. "entropy": "0.00",
  1063. "raw_address": "0x00072000",
  1064. "virtual_size": "0x00002f40",
  1065. "characteristics_raw": "0xc0000040"
  1066. },
  1067. {
  1068. "name": ".rsrc",
  1069. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1070. "virtual_address": "0x00075000",
  1071. "size_of_data": "0x00001000",
  1072. "entropy": "5.71",
  1073. "raw_address": "0x00073000",
  1074. "virtual_size": "0x00000dc6",
  1075. "characteristics_raw": "0x40000040"
  1076. }
  1077. ],
  1078. "resources": [],
  1079. "dirents": [
  1080. {
  1081. "virtual_address": "0x00000000",
  1082. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1083. "size": "0x00000000"
  1084. },
  1085. {
  1086. "virtual_address": "0x00071a34",
  1087. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1088. "size": "0x00000028"
  1089. },
  1090. {
  1091. "virtual_address": "0x00075000",
  1092. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1093. "size": "0x00000dc6"
  1094. },
  1095. {
  1096. "virtual_address": "0x00000000",
  1097. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1098. "size": "0x00000000"
  1099. },
  1100. {
  1101. "virtual_address": "0x00000000",
  1102. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1103. "size": "0x00000000"
  1104. },
  1105. {
  1106. "virtual_address": "0x00000000",
  1107. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1108. "size": "0x00000000"
  1109. },
  1110. {
  1111. "virtual_address": "0x00000000",
  1112. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1113. "size": "0x00000000"
  1114. },
  1115. {
  1116. "virtual_address": "0x00000000",
  1117. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1118. "size": "0x00000000"
  1119. },
  1120. {
  1121. "virtual_address": "0x00000000",
  1122. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1123. "size": "0x00000000"
  1124. },
  1125. {
  1126. "virtual_address": "0x00000000",
  1127. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1128. "size": "0x00000000"
  1129. },
  1130. {
  1131. "virtual_address": "0x00000000",
  1132. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1133. "size": "0x00000000"
  1134. },
  1135. {
  1136. "virtual_address": "0x00000230",
  1137. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1138. "size": "0x00000020"
  1139. },
  1140. {
  1141. "virtual_address": "0x00001000",
  1142. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1143. "size": "0x0000011c"
  1144. },
  1145. {
  1146. "virtual_address": "0x00000000",
  1147. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1148. "size": "0x00000000"
  1149. },
  1150. {
  1151. "virtual_address": "0x00000000",
  1152. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1153. "size": "0x00000000"
  1154. },
  1155. {
  1156. "virtual_address": "0x00000000",
  1157. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1158. "size": "0x00000000"
  1159. }
  1160. ],
  1161. "exports": [],
  1162. "guest_signers": {},
  1163. "imphash": "75ddc085f24f5caceeeafda8470cc501",
  1164. "icon_fuzzy": null,
  1165. "icon": null,
  1166. "pdbpath": null,
  1167. "imported_dll_count": 1,
  1168. "versioninfo": []
  1169. }
  1170. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!