API tools faq
paste
paladin316

Dridex_3a2af5cebe0329fd0f5be142117e6f6f_exe_2019-06-26_19_30.json

paladin316
Jun 26th, 2019
2,178
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 46.88 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Wacatac"
  3.  
  4. [*] MalScore: 3.5
  5.  
  6. [*] File Name: "Dridex_3a2af5cebe0329fd0f5be142117e6f6f.exe"
  7. [*] File Size: 387072
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows"
  9. [*] SHA256: "c1d31374a51311ccd7c3531efb02460c2a58d8375ab1abfb49629149e972b40a"
  10. [*] MD5: "3a2af5cebe0329fd0f5be142117e6f6f"
  11. [*] SHA1: "b83cd9a6bd97c7add621825e01fcca35324f6ec5"
  12. [*] SHA512: "509111700e835d902834674b9c4dcefadb03a5593c5201cc6c6bfc95e6080923694a22711e9d733353f6b4b4adae9f21f5215cc3b570c2980681390be80c2dca"
  13. [*] CRC32: "322741E0"
  14. [*] SSDEEP: "6144:0TrDqFK61GTTx63n8Ta9jwS6hHgfFkt5ve+3b7JVeat5C36WYY/KkKgM:0nDiK61Gs3h4hHgfFYWsb7tc3QqKkKgM"
  15.  
  16. [*] Process Execution: [
  17. "Dridex_3a2af5cebe0329fd0f5be142117e6f6f.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "File has been identified by 8 Antiviruses on VirusTotal as malicious",
  27. "Details": [
  28. {
  29. "Cylance": "Unsafe"
  30. },
  31. {
  32. "Invincea": "heuristic"
  33. },
  34. {
  35. "Comodo": "TrojWare.Win32.Fakecsrss.AV@88nqyj"
  36. },
  37. {
  38. "Trapmine": "malicious.moderate.ml.score"
  39. },
  40. {
  41. "FireEye": "Generic.mg.3a2af5cebe0329fd"
  42. },
  43. {
  44. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  45. },
  46. {
  47. "Acronis": "suspicious"
  48. },
  49. {
  50. "Malwarebytes": "Trojan.MalPack.GS.Generic"
  51. }
  52. ]
  53. }
  54. ]
  55.  
  56. [*] Started Service: []
  57.  
  58. [*] Executed Commands: []
  59.  
  60. [*] Mutexes: [
  61. "DBWinMutex"
  62. ]
  63.  
  64. [*] Modified Files: []
  65.  
  66. [*] Deleted Files: []
  67.  
  68. [*] Modified Registry Keys: []
  69.  
  70. [*] Deleted Registry Keys: []
  71.  
  72. [*] DNS Communications: []
  73.  
  74. [*] Domains: []
  75.  
  76. [*] Network Communication - ICMP: []
  77.  
  78. [*] Network Communication - HTTP: []
  79.  
  80. [*] Network Communication - SMTP: []
  81.  
  82. [*] Network Communication - Hosts: []
  83.  
  84. [*] Network Communication - IRC: []
  85.  
  86. [*] Static Analysis: {
  87. "pe": {
  88. "peid_signatures": null,
  89. "imports": [
  90. {
  91. "imports": [
  92. {
  93. "name": "HeapReAlloc",
  94. "address": "0x42e000"
  95. },
  96. {
  97. "name": "WritePrivateProfileStructA",
  98. "address": "0x42e004"
  99. },
  100. {
  101. "name": "GetDriveTypeW",
  102. "address": "0x42e008"
  103. },
  104. {
  105. "name": "WaitNamedPipeA",
  106. "address": "0x42e00c"
  107. },
  108. {
  109. "name": "WaitForSingleObject",
  110. "address": "0x42e010"
  111. },
  112. {
  113. "name": "SetTapeParameters",
  114. "address": "0x42e014"
  115. },
  116. {
  117. "name": "GetModuleHandleW",
  118. "address": "0x42e018"
  119. },
  120. {
  121. "name": "GetTickCount",
  122. "address": "0x42e01c"
  123. },
  124. {
  125. "name": "ReadConsoleW",
  126. "address": "0x42e020"
  127. },
  128. {
  129. "name": "EnumTimeFormatsA",
  130. "address": "0x42e024"
  131. },
  132. {
  133. "name": "GetSystemDirectoryW",
  134. "address": "0x42e028"
  135. },
  136. {
  137. "name": "GetFirmwareEnvironmentVariableA",
  138. "address": "0x42e02c"
  139. },
  140. {
  141. "name": "LoadLibraryW",
  142. "address": "0x42e030"
  143. },
  144. {
  145. "name": "Sleep",
  146. "address": "0x42e034"
  147. },
  148. {
  149. "name": "FormatMessageW",
  150. "address": "0x42e038"
  151. },
  152. {
  153. "name": "IsProcessorFeaturePresent",
  154. "address": "0x42e03c"
  155. },
  156. {
  157. "name": "GetOverlappedResult",
  158. "address": "0x42e040"
  159. },
  160. {
  161. "name": "CreateMailslotW",
  162. "address": "0x42e044"
  163. },
  164. {
  165. "name": "ReplaceFileA",
  166. "address": "0x42e048"
  167. },
  168. {
  169. "name": "GetStringTypeExA",
  170. "address": "0x42e04c"
  171. },
  172. {
  173. "name": "EnumSystemLocalesA",
  174. "address": "0x42e050"
  175. },
  176. {
  177. "name": "GetProfileIntA",
  178. "address": "0x42e054"
  179. },
  180. {
  181. "name": "GetLongPathNameW",
  182. "address": "0x42e058"
  183. },
  184. {
  185. "name": "GetProcAddress",
  186. "address": "0x42e05c"
  187. },
  188. {
  189. "name": "DefineDosDeviceW",
  190. "address": "0x42e060"
  191. },
  192. {
  193. "name": "LocalAlloc",
  194. "address": "0x42e064"
  195. },
  196. {
  197. "name": "WritePrivateProfileStringA",
  198. "address": "0x42e068"
  199. },
  200. {
  201. "name": "MoveFileA",
  202. "address": "0x42e06c"
  203. },
  204. {
  205. "name": "GetProfileStringA",
  206. "address": "0x42e070"
  207. },
  208. {
  209. "name": "HeapLock",
  210. "address": "0x42e074"
  211. },
  212. {
  213. "name": "GetDefaultCommConfigA",
  214. "address": "0x42e078"
  215. },
  216. {
  217. "name": "FindFirstVolumeMountPointA",
  218. "address": "0x42e07c"
  219. },
  220. {
  221. "name": "SetLocaleInfoW",
  222. "address": "0x42e080"
  223. },
  224. {
  225. "name": "GetCurrentDirectoryA",
  226. "address": "0x42e084"
  227. },
  228. {
  229. "name": "GetConsoleProcessList",
  230. "address": "0x42e088"
  231. },
  232. {
  233. "name": "ExpandEnvironmentStringsW",
  234. "address": "0x42e08c"
  235. },
  236. {
  237. "name": "GetStringTypeW",
  238. "address": "0x42e090"
  239. },
  240. {
  241. "name": "ReadFile",
  242. "address": "0x42e094"
  243. },
  244. {
  245. "name": "EnumSystemLocalesW",
  246. "address": "0x42e098"
  247. },
  248. {
  249. "name": "GetUserDefaultLCID",
  250. "address": "0x42e09c"
  251. },
  252. {
  253. "name": "IsValidLocale",
  254. "address": "0x42e0a0"
  255. },
  256. {
  257. "name": "GetLocaleInfoW",
  258. "address": "0x42e0a4"
  259. },
  260. {
  261. "name": "GetLastError",
  262. "address": "0x42e0a8"
  263. },
  264. {
  265. "name": "HeapFree",
  266. "address": "0x42e0ac"
  267. },
  268. {
  269. "name": "HeapAlloc",
  270. "address": "0x42e0b0"
  271. },
  272. {
  273. "name": "EncodePointer",
  274. "address": "0x42e0b4"
  275. },
  276. {
  277. "name": "DecodePointer",
  278. "address": "0x42e0b8"
  279. },
  280. {
  281. "name": "GetCommandLineW",
  282. "address": "0x42e0bc"
  283. },
  284. {
  285. "name": "RaiseException",
  286. "address": "0x42e0c0"
  287. },
  288. {
  289. "name": "RtlUnwind",
  290. "address": "0x42e0c4"
  291. },
  292. {
  293. "name": "IsDebuggerPresent",
  294. "address": "0x42e0c8"
  295. },
  296. {
  297. "name": "EnterCriticalSection",
  298. "address": "0x42e0cc"
  299. },
  300. {
  301. "name": "LeaveCriticalSection",
  302. "address": "0x42e0d0"
  303. },
  304. {
  305. "name": "GetStdHandle",
  306. "address": "0x42e0d4"
  307. },
  308. {
  309. "name": "GetFileType",
  310. "address": "0x42e0d8"
  311. },
  312. {
  313. "name": "DeleteCriticalSection",
  314. "address": "0x42e0dc"
  315. },
  316. {
  317. "name": "GetStartupInfoW",
  318. "address": "0x42e0e0"
  319. },
  320. {
  321. "name": "GetProcessHeap",
  322. "address": "0x42e0e4"
  323. },
  324. {
  325. "name": "ExitProcess",
  326. "address": "0x42e0e8"
  327. },
  328. {
  329. "name": "GetModuleHandleExW",
  330. "address": "0x42e0ec"
  331. },
  332. {
  333. "name": "AreFileApisANSI",
  334. "address": "0x42e0f0"
  335. },
  336. {
  337. "name": "MultiByteToWideChar",
  338. "address": "0x42e0f4"
  339. },
  340. {
  341. "name": "WideCharToMultiByte",
  342. "address": "0x42e0f8"
  343. },
  344. {
  345. "name": "WriteFile",
  346. "address": "0x42e0fc"
  347. },
  348. {
  349. "name": "GetModuleFileNameW",
  350. "address": "0x42e100"
  351. },
  352. {
  353. "name": "FlushFileBuffers",
  354. "address": "0x42e104"
  355. },
  356. {
  357. "name": "GetConsoleCP",
  358. "address": "0x42e108"
  359. },
  360. {
  361. "name": "GetConsoleMode",
  362. "address": "0x42e10c"
  363. },
  364. {
  365. "name": "FatalAppExitA",
  366. "address": "0x42e110"
  367. },
  368. {
  369. "name": "HeapSize",
  370. "address": "0x42e114"
  371. },
  372. {
  373. "name": "CloseHandle",
  374. "address": "0x42e118"
  375. },
  376. {
  377. "name": "SetLastError",
  378. "address": "0x42e11c"
  379. },
  380. {
  381. "name": "GetCurrentThread",
  382. "address": "0x42e120"
  383. },
  384. {
  385. "name": "GetCurrentThreadId",
  386. "address": "0x42e124"
  387. },
  388. {
  389. "name": "QueryPerformanceCounter",
  390. "address": "0x42e128"
  391. },
  392. {
  393. "name": "GetCurrentProcessId",
  394. "address": "0x42e12c"
  395. },
  396. {
  397. "name": "GetSystemTimeAsFileTime",
  398. "address": "0x42e130"
  399. },
  400. {
  401. "name": "GetEnvironmentStringsW",
  402. "address": "0x42e134"
  403. },
  404. {
  405. "name": "FreeEnvironmentStringsW",
  406. "address": "0x42e138"
  407. },
  408. {
  409. "name": "UnhandledExceptionFilter",
  410. "address": "0x42e13c"
  411. },
  412. {
  413. "name": "SetUnhandledExceptionFilter",
  414. "address": "0x42e140"
  415. },
  416. {
  417. "name": "InitializeCriticalSectionAndSpinCount",
  418. "address": "0x42e144"
  419. },
  420. {
  421. "name": "CreateEventW",
  422. "address": "0x42e148"
  423. },
  424. {
  425. "name": "GetCurrentProcess",
  426. "address": "0x42e14c"
  427. },
  428. {
  429. "name": "TerminateProcess",
  430. "address": "0x42e150"
  431. },
  432. {
  433. "name": "TlsAlloc",
  434. "address": "0x42e154"
  435. },
  436. {
  437. "name": "TlsGetValue",
  438. "address": "0x42e158"
  439. },
  440. {
  441. "name": "TlsSetValue",
  442. "address": "0x42e15c"
  443. },
  444. {
  445. "name": "TlsFree",
  446. "address": "0x42e160"
  447. },
  448. {
  449. "name": "CreateSemaphoreW",
  450. "address": "0x42e164"
  451. },
  452. {
  453. "name": "IsValidCodePage",
  454. "address": "0x42e168"
  455. },
  456. {
  457. "name": "GetACP",
  458. "address": "0x42e16c"
  459. },
  460. {
  461. "name": "GetOEMCP",
  462. "address": "0x42e170"
  463. },
  464. {
  465. "name": "GetCPInfo",
  466. "address": "0x42e174"
  467. },
  468. {
  469. "name": "SetFilePointerEx",
  470. "address": "0x42e178"
  471. },
  472. {
  473. "name": "SetConsoleCtrlHandler",
  474. "address": "0x42e17c"
  475. },
  476. {
  477. "name": "FreeLibrary",
  478. "address": "0x42e180"
  479. },
  480. {
  481. "name": "LoadLibraryExW",
  482. "address": "0x42e184"
  483. },
  484. {
  485. "name": "OutputDebugStringW",
  486. "address": "0x42e188"
  487. },
  488. {
  489. "name": "SetStdHandle",
  490. "address": "0x42e18c"
  491. },
  492. {
  493. "name": "WriteConsoleW",
  494. "address": "0x42e190"
  495. },
  496. {
  497. "name": "GetDateFormatW",
  498. "address": "0x42e194"
  499. },
  500. {
  501. "name": "GetTimeFormatW",
  502. "address": "0x42e198"
  503. },
  504. {
  505. "name": "CompareStringW",
  506. "address": "0x42e19c"
  507. },
  508. {
  509. "name": "LCMapStringW",
  510. "address": "0x42e1a0"
  511. },
  512. {
  513. "name": "CreateFileW",
  514. "address": "0x42e1a4"
  515. }
  516. ],
  517. "dll": "KERNEL32.dll"
  518. },
  519. {
  520. "imports": [
  521. {
  522. "name": "DrawEdge",
  523. "address": "0x42e1ac"
  524. },
  525. {
  526. "name": "GetScrollBarInfo",
  527. "address": "0x42e1b0"
  528. },
  529. {
  530. "name": "CreateWindowStationA",
  531. "address": "0x42e1b4"
  532. },
  533. {
  534. "name": "GetMessageTime",
  535. "address": "0x42e1b8"
  536. },
  537. {
  538. "name": "GetTopWindow",
  539. "address": "0x42e1bc"
  540. }
  541. ],
  542. "dll": "USER32.dll"
  543. }
  544. ],
  545. "digital_signers": null,
  546. "exported_dll_name": null,
  547. "actual_checksum": "0x0006b044",
  548. "overlay": null,
  549. "imagebase": "0x00400000",
  550. "reported_checksum": "0x0006b044",
  551. "icon_hash": null,
  552. "entrypoint": "0x004089a4",
  553. "timestamp": "2018-02-01 11:02:11",
  554. "osversion": "5.1",
  555. "sections": [
  556. {
  557. "name": ".text",
  558. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  559. "virtual_address": "0x00001000",
  560. "size_of_data": "0x0002d000",
  561. "entropy": "6.71",
  562. "raw_address": "0x00000400",
  563. "virtual_size": "0x0002cf1f",
  564. "characteristics_raw": "0x60000020"
  565. },
  566. {
  567. "name": ".rdata",
  568. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  569. "virtual_address": "0x0002e000",
  570. "size_of_data": "0x00028800",
  571. "entropy": "6.42",
  572. "raw_address": "0x0002d400",
  573. "virtual_size": "0x000286d0",
  574. "characteristics_raw": "0x40000040"
  575. },
  576. {
  577. "name": ".data",
  578. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  579. "virtual_address": "0x00057000",
  580. "size_of_data": "0x00002400",
  581. "entropy": "2.66",
  582. "raw_address": "0x00055c00",
  583. "virtual_size": "0x00014eac",
  584. "characteristics_raw": "0xc0000040"
  585. },
  586. {
  587. "name": ".rsrc",
  588. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  589. "virtual_address": "0x0006c000",
  590. "size_of_data": "0x00004400",
  591. "entropy": "5.26",
  592. "raw_address": "0x00058000",
  593. "virtual_size": "0x00004358",
  594. "characteristics_raw": "0x40000040"
  595. },
  596. {
  597. "name": ".reloc",
  598. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  599. "virtual_address": "0x00071000",
  600. "size_of_data": "0x00002400",
  601. "entropy": "6.60",
  602. "raw_address": "0x0005c400",
  603. "virtual_size": "0x0000232c",
  604. "characteristics_raw": "0x42000040"
  605. }
  606. ],
  607. "resources": [],
  608. "dirents": [
  609. {
  610. "virtual_address": "0x00000000",
  611. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  612. "size": "0x00000000"
  613. },
  614. {
  615. "virtual_address": "0x00055c7c",
  616. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  617. "size": "0x0000003c"
  618. },
  619. {
  620. "virtual_address": "0x0006c000",
  621. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  622. "size": "0x00004358"
  623. },
  624. {
  625. "virtual_address": "0x00000000",
  626. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  627. "size": "0x00000000"
  628. },
  629. {
  630. "virtual_address": "0x00000000",
  631. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  632. "size": "0x00000000"
  633. },
  634. {
  635. "virtual_address": "0x00071000",
  636. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  637. "size": "0x0000232c"
  638. },
  639. {
  640. "virtual_address": "0x0002e220",
  641. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  642. "size": "0x00000038"
  643. },
  644. {
  645. "virtual_address": "0x00000000",
  646. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  647. "size": "0x00000000"
  648. },
  649. {
  650. "virtual_address": "0x00000000",
  651. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  652. "size": "0x00000000"
  653. },
  654. {
  655. "virtual_address": "0x00000000",
  656. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  657. "size": "0x00000000"
  658. },
  659. {
  660. "virtual_address": "0x00000000",
  661. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  662. "size": "0x00000000"
  663. },
  664. {
  665. "virtual_address": "0x00000000",
  666. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  667. "size": "0x00000000"
  668. },
  669. {
  670. "virtual_address": "0x0002e000",
  671. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  672. "size": "0x000001c4"
  673. },
  674. {
  675. "virtual_address": "0x00000000",
  676. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  677. "size": "0x00000000"
  678. },
  679. {
  680. "virtual_address": "0x00000000",
  681. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  682. "size": "0x00000000"
  683. },
  684. {
  685. "virtual_address": "0x00000000",
  686. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  687. "size": "0x00000000"
  688. }
  689. ],
  690. "exports": [],
  691. "guest_signers": {},
  692. "imphash": "c7f5f4bab484be356bafc4020fc2fafb",
  693. "icon_fuzzy": null,
  694. "icon": null,
  695. "pdbpath": "C:\\cap.pdb\\x00\\crypt_server\\runtime\\crypt\\tmp_2093232069\\bin\\gucoc.pdb\\x00\\x00\\x00\\x00\\x00\\xad\\x00\\x00\\x00\\xac\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x8dE\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00,KE\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01",
  696. "imported_dll_count": 2,
  697. "versioninfo": []
  698. }
  699. }
  700.  
  701. [*] Resolved APIs: [
  702. "kernel32.dll.FlsAlloc",
  703. "kernel32.dll.FlsFree",
  704. "kernel32.dll.FlsGetValue",
  705. "kernel32.dll.FlsSetValue",
  706. "kernel32.dll.InitializeCriticalSectionEx",
  707. "kernel32.dll.CreateEventExW",
  708. "kernel32.dll.CreateSemaphoreExW",
  709. "kernel32.dll.SetThreadStackGuarantee",
  710. "kernel32.dll.CreateThreadpoolTimer",
  711. "kernel32.dll.SetThreadpoolTimer",
  712. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  713. "kernel32.dll.CloseThreadpoolTimer",
  714. "kernel32.dll.CreateThreadpoolWait",
  715. "kernel32.dll.SetThreadpoolWait",
  716. "kernel32.dll.CloseThreadpoolWait",
  717. "kernel32.dll.FlushProcessWriteBuffers",
  718. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  719. "kernel32.dll.GetCurrentProcessorNumber",
  720. "kernel32.dll.GetLogicalProcessorInformation",
  721. "kernel32.dll.CreateSymbolicLinkW",
  722. "kernel32.dll.EnumSystemLocalesEx",
  723. "kernel32.dll.CompareStringEx",
  724. "kernel32.dll.GetDateFormatEx",
  725. "kernel32.dll.GetLocaleInfoEx",
  726. "kernel32.dll.GetTimeFormatEx",
  727. "kernel32.dll.GetUserDefaultLocaleName",
  728. "kernel32.dll.IsValidLocaleName",
  729. "kernel32.dll.LCMapStringEx",
  730. "kernel32.dll.GetTickCount64",
  731. "kernel32.dll.VirtualProtect",
  732. "kernel32.dll.GlobalAlloc",
  733. "kernel32.dll.GetLastError",
  734. "kernel32.dll.Sleep",
  735. "kernel32.dll.CreateToolhelp32Snapshot",
  736. "kernel32.dll.Module32First",
  737. "kernel32.dll.CloseHandle",
  738. "kernel32.dll.LoadLibraryA",
  739. "kernel32.dll.VirtualAlloc",
  740. "kernel32.dll.VirtualFree",
  741. "kernel32.dll.GetVersionExA",
  742. "kernel32.dll.TerminateProcess",
  743. "kernel32.dll.ExitProcess",
  744. "kernel32.dll.SetErrorMode",
  745. "kernel32.dll.FreeConsole",
  746. "kernel32.dll.OutputDebugStringW",
  747. "msvcr100.dll.atexit"
  748. ]
  749.  
  750. [*] Static Analysis: {
  751. "pe": {
  752. "peid_signatures": null,
  753. "imports": [
  754. {
  755. "imports": [
  756. {
  757. "name": "HeapReAlloc",
  758. "address": "0x42e000"
  759. },
  760. {
  761. "name": "WritePrivateProfileStructA",
  762. "address": "0x42e004"
  763. },
  764. {
  765. "name": "GetDriveTypeW",
  766. "address": "0x42e008"
  767. },
  768. {
  769. "name": "WaitNamedPipeA",
  770. "address": "0x42e00c"
  771. },
  772. {
  773. "name": "WaitForSingleObject",
  774. "address": "0x42e010"
  775. },
  776. {
  777. "name": "SetTapeParameters",
  778. "address": "0x42e014"
  779. },
  780. {
  781. "name": "GetModuleHandleW",
  782. "address": "0x42e018"
  783. },
  784. {
  785. "name": "GetTickCount",
  786. "address": "0x42e01c"
  787. },
  788. {
  789. "name": "ReadConsoleW",
  790. "address": "0x42e020"
  791. },
  792. {
  793. "name": "EnumTimeFormatsA",
  794. "address": "0x42e024"
  795. },
  796. {
  797. "name": "GetSystemDirectoryW",
  798. "address": "0x42e028"
  799. },
  800. {
  801. "name": "GetFirmwareEnvironmentVariableA",
  802. "address": "0x42e02c"
  803. },
  804. {
  805. "name": "LoadLibraryW",
  806. "address": "0x42e030"
  807. },
  808. {
  809. "name": "Sleep",
  810. "address": "0x42e034"
  811. },
  812. {
  813. "name": "FormatMessageW",
  814. "address": "0x42e038"
  815. },
  816. {
  817. "name": "IsProcessorFeaturePresent",
  818. "address": "0x42e03c"
  819. },
  820. {
  821. "name": "GetOverlappedResult",
  822. "address": "0x42e040"
  823. },
  824. {
  825. "name": "CreateMailslotW",
  826. "address": "0x42e044"
  827. },
  828. {
  829. "name": "ReplaceFileA",
  830. "address": "0x42e048"
  831. },
  832. {
  833. "name": "GetStringTypeExA",
  834. "address": "0x42e04c"
  835. },
  836. {
  837. "name": "EnumSystemLocalesA",
  838. "address": "0x42e050"
  839. },
  840. {
  841. "name": "GetProfileIntA",
  842. "address": "0x42e054"
  843. },
  844. {
  845. "name": "GetLongPathNameW",
  846. "address": "0x42e058"
  847. },
  848. {
  849. "name": "GetProcAddress",
  850. "address": "0x42e05c"
  851. },
  852. {
  853. "name": "DefineDosDeviceW",
  854. "address": "0x42e060"
  855. },
  856. {
  857. "name": "LocalAlloc",
  858. "address": "0x42e064"
  859. },
  860. {
  861. "name": "WritePrivateProfileStringA",
  862. "address": "0x42e068"
  863. },
  864. {
  865. "name": "MoveFileA",
  866. "address": "0x42e06c"
  867. },
  868. {
  869. "name": "GetProfileStringA",
  870. "address": "0x42e070"
  871. },
  872. {
  873. "name": "HeapLock",
  874. "address": "0x42e074"
  875. },
  876. {
  877. "name": "GetDefaultCommConfigA",
  878. "address": "0x42e078"
  879. },
  880. {
  881. "name": "FindFirstVolumeMountPointA",
  882. "address": "0x42e07c"
  883. },
  884. {
  885. "name": "SetLocaleInfoW",
  886. "address": "0x42e080"
  887. },
  888. {
  889. "name": "GetCurrentDirectoryA",
  890. "address": "0x42e084"
  891. },
  892. {
  893. "name": "GetConsoleProcessList",
  894. "address": "0x42e088"
  895. },
  896. {
  897. "name": "ExpandEnvironmentStringsW",
  898. "address": "0x42e08c"
  899. },
  900. {
  901. "name": "GetStringTypeW",
  902. "address": "0x42e090"
  903. },
  904. {
  905. "name": "ReadFile",
  906. "address": "0x42e094"
  907. },
  908. {
  909. "name": "EnumSystemLocalesW",
  910. "address": "0x42e098"
  911. },
  912. {
  913. "name": "GetUserDefaultLCID",
  914. "address": "0x42e09c"
  915. },
  916. {
  917. "name": "IsValidLocale",
  918. "address": "0x42e0a0"
  919. },
  920. {
  921. "name": "GetLocaleInfoW",
  922. "address": "0x42e0a4"
  923. },
  924. {
  925. "name": "GetLastError",
  926. "address": "0x42e0a8"
  927. },
  928. {
  929. "name": "HeapFree",
  930. "address": "0x42e0ac"
  931. },
  932. {
  933. "name": "HeapAlloc",
  934. "address": "0x42e0b0"
  935. },
  936. {
  937. "name": "EncodePointer",
  938. "address": "0x42e0b4"
  939. },
  940. {
  941. "name": "DecodePointer",
  942. "address": "0x42e0b8"
  943. },
  944. {
  945. "name": "GetCommandLineW",
  946. "address": "0x42e0bc"
  947. },
  948. {
  949. "name": "RaiseException",
  950. "address": "0x42e0c0"
  951. },
  952. {
  953. "name": "RtlUnwind",
  954. "address": "0x42e0c4"
  955. },
  956. {
  957. "name": "IsDebuggerPresent",
  958. "address": "0x42e0c8"
  959. },
  960. {
  961. "name": "EnterCriticalSection",
  962. "address": "0x42e0cc"
  963. },
  964. {
  965. "name": "LeaveCriticalSection",
  966. "address": "0x42e0d0"
  967. },
  968. {
  969. "name": "GetStdHandle",
  970. "address": "0x42e0d4"
  971. },
  972. {
  973. "name": "GetFileType",
  974. "address": "0x42e0d8"
  975. },
  976. {
  977. "name": "DeleteCriticalSection",
  978. "address": "0x42e0dc"
  979. },
  980. {
  981. "name": "GetStartupInfoW",
  982. "address": "0x42e0e0"
  983. },
  984. {
  985. "name": "GetProcessHeap",
  986. "address": "0x42e0e4"
  987. },
  988. {
  989. "name": "ExitProcess",
  990. "address": "0x42e0e8"
  991. },
  992. {
  993. "name": "GetModuleHandleExW",
  994. "address": "0x42e0ec"
  995. },
  996. {
  997. "name": "AreFileApisANSI",
  998. "address": "0x42e0f0"
  999. },
  1000. {
  1001. "name": "MultiByteToWideChar",
  1002. "address": "0x42e0f4"
  1003. },
  1004. {
  1005. "name": "WideCharToMultiByte",
  1006. "address": "0x42e0f8"
  1007. },
  1008. {
  1009. "name": "WriteFile",
  1010. "address": "0x42e0fc"
  1011. },
  1012. {
  1013. "name": "GetModuleFileNameW",
  1014. "address": "0x42e100"
  1015. },
  1016. {
  1017. "name": "FlushFileBuffers",
  1018. "address": "0x42e104"
  1019. },
  1020. {
  1021. "name": "GetConsoleCP",
  1022. "address": "0x42e108"
  1023. },
  1024. {
  1025. "name": "GetConsoleMode",
  1026. "address": "0x42e10c"
  1027. },
  1028. {
  1029. "name": "FatalAppExitA",
  1030. "address": "0x42e110"
  1031. },
  1032. {
  1033. "name": "HeapSize",
  1034. "address": "0x42e114"
  1035. },
  1036. {
  1037. "name": "CloseHandle",
  1038. "address": "0x42e118"
  1039. },
  1040. {
  1041. "name": "SetLastError",
  1042. "address": "0x42e11c"
  1043. },
  1044. {
  1045. "name": "GetCurrentThread",
  1046. "address": "0x42e120"
  1047. },
  1048. {
  1049. "name": "GetCurrentThreadId",
  1050. "address": "0x42e124"
  1051. },
  1052. {
  1053. "name": "QueryPerformanceCounter",
  1054. "address": "0x42e128"
  1055. },
  1056. {
  1057. "name": "GetCurrentProcessId",
  1058. "address": "0x42e12c"
  1059. },
  1060. {
  1061. "name": "GetSystemTimeAsFileTime",
  1062. "address": "0x42e130"
  1063. },
  1064. {
  1065. "name": "GetEnvironmentStringsW",
  1066. "address": "0x42e134"
  1067. },
  1068. {
  1069. "name": "FreeEnvironmentStringsW",
  1070. "address": "0x42e138"
  1071. },
  1072. {
  1073. "name": "UnhandledExceptionFilter",
  1074. "address": "0x42e13c"
  1075. },
  1076. {
  1077. "name": "SetUnhandledExceptionFilter",
  1078. "address": "0x42e140"
  1079. },
  1080. {
  1081. "name": "InitializeCriticalSectionAndSpinCount",
  1082. "address": "0x42e144"
  1083. },
  1084. {
  1085. "name": "CreateEventW",
  1086. "address": "0x42e148"
  1087. },
  1088. {
  1089. "name": "GetCurrentProcess",
  1090. "address": "0x42e14c"
  1091. },
  1092. {
  1093. "name": "TerminateProcess",
  1094. "address": "0x42e150"
  1095. },
  1096. {
  1097. "name": "TlsAlloc",
  1098. "address": "0x42e154"
  1099. },
  1100. {
  1101. "name": "TlsGetValue",
  1102. "address": "0x42e158"
  1103. },
  1104. {
  1105. "name": "TlsSetValue",
  1106. "address": "0x42e15c"
  1107. },
  1108. {
  1109. "name": "TlsFree",
  1110. "address": "0x42e160"
  1111. },
  1112. {
  1113. "name": "CreateSemaphoreW",
  1114. "address": "0x42e164"
  1115. },
  1116. {
  1117. "name": "IsValidCodePage",
  1118. "address": "0x42e168"
  1119. },
  1120. {
  1121. "name": "GetACP",
  1122. "address": "0x42e16c"
  1123. },
  1124. {
  1125. "name": "GetOEMCP",
  1126. "address": "0x42e170"
  1127. },
  1128. {
  1129. "name": "GetCPInfo",
  1130. "address": "0x42e174"
  1131. },
  1132. {
  1133. "name": "SetFilePointerEx",
  1134. "address": "0x42e178"
  1135. },
  1136. {
  1137. "name": "SetConsoleCtrlHandler",
  1138. "address": "0x42e17c"
  1139. },
  1140. {
  1141. "name": "FreeLibrary",
  1142. "address": "0x42e180"
  1143. },
  1144. {
  1145. "name": "LoadLibraryExW",
  1146. "address": "0x42e184"
  1147. },
  1148. {
  1149. "name": "OutputDebugStringW",
  1150. "address": "0x42e188"
  1151. },
  1152. {
  1153. "name": "SetStdHandle",
  1154. "address": "0x42e18c"
  1155. },
  1156. {
  1157. "name": "WriteConsoleW",
  1158. "address": "0x42e190"
  1159. },
  1160. {
  1161. "name": "GetDateFormatW",
  1162. "address": "0x42e194"
  1163. },
  1164. {
  1165. "name": "GetTimeFormatW",
  1166. "address": "0x42e198"
  1167. },
  1168. {
  1169. "name": "CompareStringW",
  1170. "address": "0x42e19c"
  1171. },
  1172. {
  1173. "name": "LCMapStringW",
  1174. "address": "0x42e1a0"
  1175. },
  1176. {
  1177. "name": "CreateFileW",
  1178. "address": "0x42e1a4"
  1179. }
  1180. ],
  1181. "dll": "KERNEL32.dll"
  1182. },
  1183. {
  1184. "imports": [
  1185. {
  1186. "name": "DrawEdge",
  1187. "address": "0x42e1ac"
  1188. },
  1189. {
  1190. "name": "GetScrollBarInfo",
  1191. "address": "0x42e1b0"
  1192. },
  1193. {
  1194. "name": "CreateWindowStationA",
  1195. "address": "0x42e1b4"
  1196. },
  1197. {
  1198. "name": "GetMessageTime",
  1199. "address": "0x42e1b8"
  1200. },
  1201. {
  1202. "name": "GetTopWindow",
  1203. "address": "0x42e1bc"
  1204. }
  1205. ],
  1206. "dll": "USER32.dll"
  1207. }
  1208. ],
  1209. "digital_signers": null,
  1210. "exported_dll_name": null,
  1211. "actual_checksum": "0x0006b044",
  1212. "overlay": null,
  1213. "imagebase": "0x00400000",
  1214. "reported_checksum": "0x0006b044",
  1215. "icon_hash": null,
  1216. "entrypoint": "0x004089a4",
  1217. "timestamp": "2018-02-01 11:02:11",
  1218. "osversion": "5.1",
  1219. "sections": [
  1220. {
  1221. "name": ".text",
  1222. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1223. "virtual_address": "0x00001000",
  1224. "size_of_data": "0x0002d000",
  1225. "entropy": "6.71",
  1226. "raw_address": "0x00000400",
  1227. "virtual_size": "0x0002cf1f",
  1228. "characteristics_raw": "0x60000020"
  1229. },
  1230. {
  1231. "name": ".rdata",
  1232. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1233. "virtual_address": "0x0002e000",
  1234. "size_of_data": "0x00028800",
  1235. "entropy": "6.42",
  1236. "raw_address": "0x0002d400",
  1237. "virtual_size": "0x000286d0",
  1238. "characteristics_raw": "0x40000040"
  1239. },
  1240. {
  1241. "name": ".data",
  1242. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1243. "virtual_address": "0x00057000",
  1244. "size_of_data": "0x00002400",
  1245. "entropy": "2.66",
  1246. "raw_address": "0x00055c00",
  1247. "virtual_size": "0x00014eac",
  1248. "characteristics_raw": "0xc0000040"
  1249. },
  1250. {
  1251. "name": ".rsrc",
  1252. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1253. "virtual_address": "0x0006c000",
  1254. "size_of_data": "0x00004400",
  1255. "entropy": "5.26",
  1256. "raw_address": "0x00058000",
  1257. "virtual_size": "0x00004358",
  1258. "characteristics_raw": "0x40000040"
  1259. },
  1260. {
  1261. "name": ".reloc",
  1262. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1263. "virtual_address": "0x00071000",
  1264. "size_of_data": "0x00002400",
  1265. "entropy": "6.60",
  1266. "raw_address": "0x0005c400",
  1267. "virtual_size": "0x0000232c",
  1268. "characteristics_raw": "0x42000040"
  1269. }
  1270. ],
  1271. "resources": [],
  1272. "dirents": [
  1273. {
  1274. "virtual_address": "0x00000000",
  1275. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1276. "size": "0x00000000"
  1277. },
  1278. {
  1279. "virtual_address": "0x00055c7c",
  1280. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1281. "size": "0x0000003c"
  1282. },
  1283. {
  1284. "virtual_address": "0x0006c000",
  1285. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1286. "size": "0x00004358"
  1287. },
  1288. {
  1289. "virtual_address": "0x00000000",
  1290. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1291. "size": "0x00000000"
  1292. },
  1293. {
  1294. "virtual_address": "0x00000000",
  1295. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1296. "size": "0x00000000"
  1297. },
  1298. {
  1299. "virtual_address": "0x00071000",
  1300. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1301. "size": "0x0000232c"
  1302. },
  1303. {
  1304. "virtual_address": "0x0002e220",
  1305. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1306. "size": "0x00000038"
  1307. },
  1308. {
  1309. "virtual_address": "0x00000000",
  1310. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1311. "size": "0x00000000"
  1312. },
  1313. {
  1314. "virtual_address": "0x00000000",
  1315. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1316. "size": "0x00000000"
  1317. },
  1318. {
  1319. "virtual_address": "0x00000000",
  1320. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1321. "size": "0x00000000"
  1322. },
  1323. {
  1324. "virtual_address": "0x00000000",
  1325. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1326. "size": "0x00000000"
  1327. },
  1328. {
  1329. "virtual_address": "0x00000000",
  1330. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1331. "size": "0x00000000"
  1332. },
  1333. {
  1334. "virtual_address": "0x0002e000",
  1335. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1336. "size": "0x000001c4"
  1337. },
  1338. {
  1339. "virtual_address": "0x00000000",
  1340. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1341. "size": "0x00000000"
  1342. },
  1343. {
  1344. "virtual_address": "0x00000000",
  1345. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1346. "size": "0x00000000"
  1347. },
  1348. {
  1349. "virtual_address": "0x00000000",
  1350. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1351. "size": "0x00000000"
  1352. }
  1353. ],
  1354. "exports": [],
  1355. "guest_signers": {},
  1356. "imphash": "c7f5f4bab484be356bafc4020fc2fafb",
  1357. "icon_fuzzy": null,
  1358. "icon": null,
  1359. "pdbpath": "C:\\cap.pdb\\x00\\crypt_server\\runtime\\crypt\\tmp_2093232069\\bin\\gucoc.pdb\\x00\\x00\\x00\\x00\\x00\\xad\\x00\\x00\\x00\\xac\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x8dE\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00,KE\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01",
  1360. "imported_dll_count": 2,
  1361. "versioninfo": []
  1362. }
  1363. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!