API tools faq
paste
paladin316

Exes_c7ea07c0e33f68faa19dfc4a9566a3d9_exe_2019-06-24_06_30.json

paladin316
Jun 24th, 2019
2,270
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.52 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Ursu"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_c7ea07c0e33f68faa19dfc4a9566a3d9.exe"
  7. [*] File Size: 503808
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "ab25e29b88bac110c82240c99ab57308b01707a1c1014afcfbc6a995fe990070"
  10. [*] MD5: "c7ea07c0e33f68faa19dfc4a9566a3d9"
  11. [*] SHA1: "92eab623f89b396cdc111b627536ef4d46e25196"
  12. [*] SHA512: "ea1bdde2870a7f18f2e0dc39e8856772f2903cb63fd54fa34e091b3e2ff8cfadabc5a1cfa7a5196337e9918bb2e3675b1b9c6731ef7d1b1e2614bd140b36f044"
  13. [*] CRC32: "9720D853"
  14. [*] SSDEEP: "6144:Mg1a9wj6IwfG/fbIgYNks+9Ubz8oFTjVq+UTNX/qUIkfZNNL5SU:7a9wj67ybIgbs+9+z8oFdqNNX/4khNL"
  15.  
  16. [*] Process Execution: [
  17. "Exes_c7ea07c0e33f68faa19dfc4a9566a3d9.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "Exes_c7ea07c0e33f68faa19dfc4a9566a3d9.exe (1140) called API CreateProcessInternalW 40273 times"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "MicroWorld-eScan": "Gen:Variant.Ursu.499564"
  38. },
  39. {
  40. "FireEye": "Generic.mg.c7ea07c0e33f68fa"
  41. },
  42. {
  43. "McAfee": "Artemis!C7EA07C0E33F"
  44. },
  45. {
  46. "Malwarebytes": "Trojan.MalPack.VB.Generic"
  47. },
  48. {
  49. "CrowdStrike": "win/malicious_confidence_80% (D)"
  50. },
  51. {
  52. "Arcabit": "Trojan.Ursu.D79F6C"
  53. },
  54. {
  55. "APEX": "Malicious"
  56. },
  57. {
  58. "GData": "Gen:Variant.Ursu.499564"
  59. },
  60. {
  61. "Kaspersky": "Trojan-PSW.Win32.Azorult.wem"
  62. },
  63. {
  64. "BitDefender": "Gen:Variant.Ursu.499564"
  65. },
  66. {
  67. "Rising": "Trojan.Wacatac!8.10C01 (TFE:dGZlOgUthuwrsKVyqA)"
  68. },
  69. {
  70. "Ad-Aware": "Gen:Variant.Ursu.499564"
  71. },
  72. {
  73. "Emsisoft": "Gen:Variant.Ursu.499564 (B)"
  74. },
  75. {
  76. "DrWeb": "Trojan.PWS.Siggen2.19291"
  77. },
  78. {
  79. "VIPRE": "Trojan.Win32.Generic!BT"
  80. },
  81. {
  82. "Invincea": "heuristic"
  83. },
  84. {
  85. "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.gm"
  86. },
  87. {
  88. "Trapmine": "suspicious.low.ml.score"
  89. },
  90. {
  91. "SentinelOne": "DFI - Suspicious PE"
  92. },
  93. {
  94. "MAX": "malware (ai score=83)"
  95. },
  96. {
  97. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  98. },
  99. {
  100. "Endgame": "malicious (high confidence)"
  101. },
  102. {
  103. "ZoneAlarm": "Trojan-PSW.Win32.Azorult.wem"
  104. },
  105. {
  106. "ALYac": "Gen:Variant.Ursu.499564"
  107. },
  108. {
  109. "ESET-NOD32": "a variant of Win32/GenKryptik.DLHS"
  110. },
  111. {
  112. "TrendMicro-HouseCall": "TROJ_GEN.R020H09FM19"
  113. },
  114. {
  115. "Tencent": "Win32.Trojan-qqpass.Qqrob.Tbio"
  116. },
  117. {
  118. "AVG": "FileRepMetagen [Malware]"
  119. }
  120. ]
  121. }
  122. ]
  123.  
  124. [*] Started Service: []
  125.  
  126. [*] Executed Commands: [
  127. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\Exes_c7ea07c0e33f68faa19dfc4a9566a3d9.exe\""
  128. ]
  129.  
  130. [*] Mutexes: []
  131.  
  132. [*] Modified Files: []
  133.  
  134. [*] Deleted Files: []
  135.  
  136. [*] Modified Registry Keys: []
  137.  
  138. [*] Deleted Registry Keys: []
  139.  
  140. [*] DNS Communications: []
  141.  
  142. [*] Domains: []
  143.  
  144. [*] Network Communication - ICMP: []
  145.  
  146. [*] Network Communication - HTTP: []
  147.  
  148. [*] Network Communication - SMTP: []
  149.  
  150. [*] Network Communication - Hosts: []
  151.  
  152. [*] Network Communication - IRC: []
  153.  
  154. [*] Static Analysis: {
  155. "pe": {
  156. "peid_signatures": null,
  157. "imports": [
  158. {
  159. "imports": [
  160. {
  161. "name": null,
  162. "address": "0x401000"
  163. },
  164. {
  165. "name": null,
  166. "address": "0x401004"
  167. },
  168. {
  169. "name": null,
  170. "address": "0x401008"
  171. },
  172. {
  173. "name": "MethCallEngine",
  174. "address": "0x40100c"
  175. },
  176. {
  177. "name": null,
  178. "address": "0x401010"
  179. },
  180. {
  181. "name": null,
  182. "address": "0x401014"
  183. },
  184. {
  185. "name": null,
  186. "address": "0x401018"
  187. },
  188. {
  189. "name": null,
  190. "address": "0x40101c"
  191. },
  192. {
  193. "name": null,
  194. "address": "0x401020"
  195. },
  196. {
  197. "name": null,
  198. "address": "0x401024"
  199. },
  200. {
  201. "name": null,
  202. "address": "0x401028"
  203. },
  204. {
  205. "name": null,
  206. "address": "0x40102c"
  207. },
  208. {
  209. "name": null,
  210. "address": "0x401030"
  211. },
  212. {
  213. "name": null,
  214. "address": "0x401034"
  215. },
  216. {
  217. "name": "EVENT_SINK_AddRef",
  218. "address": "0x401038"
  219. },
  220. {
  221. "name": null,
  222. "address": "0x40103c"
  223. },
  224. {
  225. "name": "EVENT_SINK_Release",
  226. "address": "0x401040"
  227. },
  228. {
  229. "name": "EVENT_SINK_QueryInterface",
  230. "address": "0x401044"
  231. },
  232. {
  233. "name": "__vbaExceptHandler",
  234. "address": "0x401048"
  235. },
  236. {
  237. "name": null,
  238. "address": "0x40104c"
  239. },
  240. {
  241. "name": null,
  242. "address": "0x401050"
  243. },
  244. {
  245. "name": null,
  246. "address": "0x401054"
  247. },
  248. {
  249. "name": null,
  250. "address": "0x401058"
  251. },
  252. {
  253. "name": null,
  254. "address": "0x40105c"
  255. },
  256. {
  257. "name": null,
  258. "address": "0x401060"
  259. },
  260. {
  261. "name": null,
  262. "address": "0x401064"
  263. },
  264. {
  265. "name": null,
  266. "address": "0x401068"
  267. },
  268. {
  269. "name": null,
  270. "address": "0x40106c"
  271. },
  272. {
  273. "name": null,
  274. "address": "0x401070"
  275. },
  276. {
  277. "name": null,
  278. "address": "0x401074"
  279. },
  280. {
  281. "name": null,
  282. "address": "0x401078"
  283. },
  284. {
  285. "name": null,
  286. "address": "0x40107c"
  287. }
  288. ],
  289. "dll": "MSVBVM60.DLL"
  290. }
  291. ],
  292. "digital_signers": null,
  293. "exported_dll_name": null,
  294. "actual_checksum": "0x0007b2f1",
  295. "overlay": null,
  296. "imagebase": "0x00400000",
  297. "reported_checksum": "0x0007b2f1",
  298. "icon_hash": null,
  299. "entrypoint": "0x00401150",
  300. "timestamp": "2003-08-11 09:48:47",
  301. "osversion": "4.0",
  302. "sections": [
  303. {
  304. "name": ".text",
  305. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  306. "virtual_address": "0x00001000",
  307. "size_of_data": "0x00077000",
  308. "entropy": "5.67",
  309. "raw_address": "0x00001000",
  310. "virtual_size": "0x00076abc",
  311. "characteristics_raw": "0x60000020"
  312. },
  313. {
  314. "name": ".data",
  315. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  316. "virtual_address": "0x00078000",
  317. "size_of_data": "0x00000000",
  318. "entropy": "0.00",
  319. "raw_address": "0x00000000",
  320. "virtual_size": "0x000071e0",
  321. "characteristics_raw": "0xc0000040"
  322. },
  323. {
  324. "name": ".rsrc",
  325. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  326. "virtual_address": "0x00080000",
  327. "size_of_data": "0x00003000",
  328. "entropy": "4.12",
  329. "raw_address": "0x00078000",
  330. "virtual_size": "0x00002c96",
  331. "characteristics_raw": "0x40000040"
  332. }
  333. ],
  334. "resources": [],
  335. "dirents": [
  336. {
  337. "virtual_address": "0x00000000",
  338. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  339. "size": "0x00000000"
  340. },
  341. {
  342. "virtual_address": "0x00077994",
  343. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  344. "size": "0x00000028"
  345. },
  346. {
  347. "virtual_address": "0x00080000",
  348. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  349. "size": "0x00002c96"
  350. },
  351. {
  352. "virtual_address": "0x00000000",
  353. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  354. "size": "0x00000000"
  355. },
  356. {
  357. "virtual_address": "0x00000000",
  358. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  359. "size": "0x00000000"
  360. },
  361. {
  362. "virtual_address": "0x00000000",
  363. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  364. "size": "0x00000000"
  365. },
  366. {
  367. "virtual_address": "0x00000000",
  368. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  369. "size": "0x00000000"
  370. },
  371. {
  372. "virtual_address": "0x00000000",
  373. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  374. "size": "0x00000000"
  375. },
  376. {
  377. "virtual_address": "0x00000000",
  378. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  379. "size": "0x00000000"
  380. },
  381. {
  382. "virtual_address": "0x00000000",
  383. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  384. "size": "0x00000000"
  385. },
  386. {
  387. "virtual_address": "0x00000000",
  388. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  389. "size": "0x00000000"
  390. },
  391. {
  392. "virtual_address": "0x00000220",
  393. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  394. "size": "0x00000020"
  395. },
  396. {
  397. "virtual_address": "0x00001000",
  398. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  399. "size": "0x00000084"
  400. },
  401. {
  402. "virtual_address": "0x00000000",
  403. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  404. "size": "0x00000000"
  405. },
  406. {
  407. "virtual_address": "0x00000000",
  408. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  409. "size": "0x00000000"
  410. },
  411. {
  412. "virtual_address": "0x00000000",
  413. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  414. "size": "0x00000000"
  415. }
  416. ],
  417. "exports": [],
  418. "guest_signers": {},
  419. "imphash": "8ed7143961d5479d758ff1e797d35dc0",
  420. "icon_fuzzy": null,
  421. "icon": null,
  422. "pdbpath": null,
  423. "imported_dll_count": 1,
  424. "versioninfo": []
  425. }
  426. }
  427.  
  428. [*] Resolved APIs: [
  429. "cryptbase.dll.SystemFunction036",
  430. "uxtheme.dll.ThemeInitApiHook",
  431. "user32.dll.IsProcessDPIAware",
  432. "oleaut32.dll.OleLoadPictureEx",
  433. "oleaut32.dll.DispCallFunc",
  434. "oleaut32.dll.LoadTypeLibEx",
  435. "oleaut32.dll.UnRegisterTypeLib",
  436. "oleaut32.dll.CreateTypeLib2",
  437. "oleaut32.dll.VarDateFromUdate",
  438. "oleaut32.dll.VarUdateFromDate",
  439. "oleaut32.dll.GetAltMonthNames",
  440. "oleaut32.dll.VarNumFromParseNum",
  441. "oleaut32.dll.VarParseNumFromStr",
  442. "oleaut32.dll.VarDecFromR4",
  443. "oleaut32.dll.VarDecFromR8",
  444. "oleaut32.dll.VarDecFromDate",
  445. "oleaut32.dll.VarDecFromI4",
  446. "oleaut32.dll.VarDecFromCy",
  447. "oleaut32.dll.VarR4FromDec",
  448. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  449. "oleaut32.dll.GetRecordInfoFromGuids",
  450. "oleaut32.dll.SafeArrayGetRecordInfo",
  451. "oleaut32.dll.SafeArraySetRecordInfo",
  452. "oleaut32.dll.SafeArrayGetIID",
  453. "oleaut32.dll.SafeArraySetIID",
  454. "oleaut32.dll.SafeArrayCopyData",
  455. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  456. "oleaut32.dll.SafeArrayCreateEx",
  457. "oleaut32.dll.VarFormat",
  458. "oleaut32.dll.VarFormatDateTime",
  459. "oleaut32.dll.VarFormatNumber",
  460. "oleaut32.dll.VarFormatPercent",
  461. "oleaut32.dll.VarFormatCurrency",
  462. "oleaut32.dll.VarWeekdayName",
  463. "oleaut32.dll.VarMonthName",
  464. "oleaut32.dll.VarAdd",
  465. "oleaut32.dll.VarAnd",
  466. "oleaut32.dll.VarCat",
  467. "oleaut32.dll.VarDiv",
  468. "oleaut32.dll.VarEqv",
  469. "oleaut32.dll.VarIdiv",
  470. "oleaut32.dll.VarImp",
  471. "oleaut32.dll.VarMod",
  472. "oleaut32.dll.VarMul",
  473. "oleaut32.dll.VarOr",
  474. "oleaut32.dll.VarPow",
  475. "oleaut32.dll.VarSub",
  476. "oleaut32.dll.VarXor",
  477. "oleaut32.dll.VarAbs",
  478. "oleaut32.dll.VarFix",
  479. "oleaut32.dll.VarInt",
  480. "oleaut32.dll.VarNeg",
  481. "oleaut32.dll.VarNot",
  482. "oleaut32.dll.VarRound",
  483. "oleaut32.dll.VarCmp",
  484. "oleaut32.dll.VarDecAdd",
  485. "oleaut32.dll.VarDecCmp",
  486. "oleaut32.dll.VarBstrCat",
  487. "oleaut32.dll.VarCyMulI4",
  488. "oleaut32.dll.VarBstrCmp",
  489. "ole32.dll.CoCreateInstanceEx",
  490. "ole32.dll.CLSIDFromProgIDEx",
  491. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  492. "user32.dll.GetSystemMetrics",
  493. "user32.dll.MonitorFromWindow",
  494. "user32.dll.MonitorFromRect",
  495. "user32.dll.MonitorFromPoint",
  496. "user32.dll.EnumDisplayMonitors",
  497. "user32.dll.GetMonitorInfoA",
  498. "dwmapi.dll.DwmIsCompositionEnabled",
  499. "gdi32.dll.GetLayout",
  500. "gdi32.dll.GdiRealizationInfo",
  501. "gdi32.dll.FontIsLinked",
  502. "advapi32.dll.RegOpenKeyExW",
  503. "advapi32.dll.RegQueryInfoKeyW",
  504. "gdi32.dll.GetTextFaceAliasW",
  505. "advapi32.dll.RegEnumValueW",
  506. "advapi32.dll.RegCloseKey",
  507. "advapi32.dll.RegQueryValueExW",
  508. "gdi32.dll.GetFontAssocStatus",
  509. "advapi32.dll.RegQueryValueExA",
  510. "advapi32.dll.RegEnumKeyExW",
  511. "gdi32.dll.GdiIsMetaPrintDC",
  512. "kernel32.dll.NlsGetCacheUpdateCount",
  513. "kernel32.dll.GetCalendarInfoW",
  514. "kernel32.dll.GetTickCount",
  515. "kernel32.dll.Sleep",
  516. "user32.dll.GetCursorPos",
  517. "user32.dll.EnumWindows",
  518. "kernel32.dll.SetErrorMode",
  519. "kernel32.dll.SetLastError",
  520. "kernel32.dll.VirtualAllocEx",
  521. "kernel32.dll.CloseHandle",
  522. "shell32.dll.ShellExecuteW",
  523. "kernel32.dll.WriteFile",
  524. "kernel32.dll.UnmapViewOfFile",
  525. "kernel32.dll.CreateFileW",
  526. "kernel32.dll.TerminateProcess",
  527. "kernel32.dll.VirtualProtectEx",
  528. "kernel32.dll.CreateProcessInternalW",
  529. "kernel32.dll.GetTempPathW",
  530. "kernel32.dll.GetLongPathNameW",
  531. "kernel32.dll.GetFileSize",
  532. "kernel32.dll.ReadFile",
  533. "ntdll.dll.NtProtectVirtualMemory",
  534. "kernel32.dll.GetCommandLineW"
  535. ]
  536.  
  537. [*] Static Analysis: {
  538. "pe": {
  539. "peid_signatures": null,
  540. "imports": [
  541. {
  542. "imports": [
  543. {
  544. "name": null,
  545. "address": "0x401000"
  546. },
  547. {
  548. "name": null,
  549. "address": "0x401004"
  550. },
  551. {
  552. "name": null,
  553. "address": "0x401008"
  554. },
  555. {
  556. "name": "MethCallEngine",
  557. "address": "0x40100c"
  558. },
  559. {
  560. "name": null,
  561. "address": "0x401010"
  562. },
  563. {
  564. "name": null,
  565. "address": "0x401014"
  566. },
  567. {
  568. "name": null,
  569. "address": "0x401018"
  570. },
  571. {
  572. "name": null,
  573. "address": "0x40101c"
  574. },
  575. {
  576. "name": null,
  577. "address": "0x401020"
  578. },
  579. {
  580. "name": null,
  581. "address": "0x401024"
  582. },
  583. {
  584. "name": null,
  585. "address": "0x401028"
  586. },
  587. {
  588. "name": null,
  589. "address": "0x40102c"
  590. },
  591. {
  592. "name": null,
  593. "address": "0x401030"
  594. },
  595. {
  596. "name": null,
  597. "address": "0x401034"
  598. },
  599. {
  600. "name": "EVENT_SINK_AddRef",
  601. "address": "0x401038"
  602. },
  603. {
  604. "name": null,
  605. "address": "0x40103c"
  606. },
  607. {
  608. "name": "EVENT_SINK_Release",
  609. "address": "0x401040"
  610. },
  611. {
  612. "name": "EVENT_SINK_QueryInterface",
  613. "address": "0x401044"
  614. },
  615. {
  616. "name": "__vbaExceptHandler",
  617. "address": "0x401048"
  618. },
  619. {
  620. "name": null,
  621. "address": "0x40104c"
  622. },
  623. {
  624. "name": null,
  625. "address": "0x401050"
  626. },
  627. {
  628. "name": null,
  629. "address": "0x401054"
  630. },
  631. {
  632. "name": null,
  633. "address": "0x401058"
  634. },
  635. {
  636. "name": null,
  637. "address": "0x40105c"
  638. },
  639. {
  640. "name": null,
  641. "address": "0x401060"
  642. },
  643. {
  644. "name": null,
  645. "address": "0x401064"
  646. },
  647. {
  648. "name": null,
  649. "address": "0x401068"
  650. },
  651. {
  652. "name": null,
  653. "address": "0x40106c"
  654. },
  655. {
  656. "name": null,
  657. "address": "0x401070"
  658. },
  659. {
  660. "name": null,
  661. "address": "0x401074"
  662. },
  663. {
  664. "name": null,
  665. "address": "0x401078"
  666. },
  667. {
  668. "name": null,
  669. "address": "0x40107c"
  670. }
  671. ],
  672. "dll": "MSVBVM60.DLL"
  673. }
  674. ],
  675. "digital_signers": null,
  676. "exported_dll_name": null,
  677. "actual_checksum": "0x0007b2f1",
  678. "overlay": null,
  679. "imagebase": "0x00400000",
  680. "reported_checksum": "0x0007b2f1",
  681. "icon_hash": null,
  682. "entrypoint": "0x00401150",
  683. "timestamp": "2003-08-11 09:48:47",
  684. "osversion": "4.0",
  685. "sections": [
  686. {
  687. "name": ".text",
  688. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  689. "virtual_address": "0x00001000",
  690. "size_of_data": "0x00077000",
  691. "entropy": "5.67",
  692. "raw_address": "0x00001000",
  693. "virtual_size": "0x00076abc",
  694. "characteristics_raw": "0x60000020"
  695. },
  696. {
  697. "name": ".data",
  698. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  699. "virtual_address": "0x00078000",
  700. "size_of_data": "0x00000000",
  701. "entropy": "0.00",
  702. "raw_address": "0x00000000",
  703. "virtual_size": "0x000071e0",
  704. "characteristics_raw": "0xc0000040"
  705. },
  706. {
  707. "name": ".rsrc",
  708. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  709. "virtual_address": "0x00080000",
  710. "size_of_data": "0x00003000",
  711. "entropy": "4.12",
  712. "raw_address": "0x00078000",
  713. "virtual_size": "0x00002c96",
  714. "characteristics_raw": "0x40000040"
  715. }
  716. ],
  717. "resources": [],
  718. "dirents": [
  719. {
  720. "virtual_address": "0x00000000",
  721. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  722. "size": "0x00000000"
  723. },
  724. {
  725. "virtual_address": "0x00077994",
  726. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  727. "size": "0x00000028"
  728. },
  729. {
  730. "virtual_address": "0x00080000",
  731. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  732. "size": "0x00002c96"
  733. },
  734. {
  735. "virtual_address": "0x00000000",
  736. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  737. "size": "0x00000000"
  738. },
  739. {
  740. "virtual_address": "0x00000000",
  741. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  742. "size": "0x00000000"
  743. },
  744. {
  745. "virtual_address": "0x00000000",
  746. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  747. "size": "0x00000000"
  748. },
  749. {
  750. "virtual_address": "0x00000000",
  751. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  752. "size": "0x00000000"
  753. },
  754. {
  755. "virtual_address": "0x00000000",
  756. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  757. "size": "0x00000000"
  758. },
  759. {
  760. "virtual_address": "0x00000000",
  761. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  762. "size": "0x00000000"
  763. },
  764. {
  765. "virtual_address": "0x00000000",
  766. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  767. "size": "0x00000000"
  768. },
  769. {
  770. "virtual_address": "0x00000000",
  771. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  772. "size": "0x00000000"
  773. },
  774. {
  775. "virtual_address": "0x00000220",
  776. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  777. "size": "0x00000020"
  778. },
  779. {
  780. "virtual_address": "0x00001000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  782. "size": "0x00000084"
  783. },
  784. {
  785. "virtual_address": "0x00000000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  787. "size": "0x00000000"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  797. "size": "0x00000000"
  798. }
  799. ],
  800. "exports": [],
  801. "guest_signers": {},
  802. "imphash": "8ed7143961d5479d758ff1e797d35dc0",
  803. "icon_fuzzy": null,
  804. "icon": null,
  805. "pdbpath": null,
  806. "imported_dll_count": 1,
  807. "versioninfo": []
  808. }
  809. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!