API tools faq
paste
paladin316

Exes_fb546fa4aa75ce6efa7af645466ce974_exe_2019-06-24_11_30.json

paladin316
Jun 24th, 2019
2,244
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 26.32 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 2.5
  5.  
  6. [*] File Name: "Exes_fb546fa4aa75ce6efa7af645466ce974.exe"
  7. [*] File Size: 618496
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "01d5188e2016a0329d2aa002404367bf62680a354f93c0443d384360fc57714f"
  10. [*] MD5: "fb546fa4aa75ce6efa7af645466ce974"
  11. [*] SHA1: "a6a3f9a98218a063537304110f5a4ed70e499d77"
  12. [*] SHA512: "f3d89f8092d14d61078031b3db140401aad8afb712d489a4feb0719fd3cc7bdcf099b8b78690b9596f9b02c2dada4a7ff9a2859a18441464e9b77076eaaef692"
  13. [*] CRC32: "9FF71C79"
  14. [*] SSDEEP: "12288:pkXW0Vnr5pAsP0PgPp/WDL0wEo6DI1s/1vdV1axjJYv4:aXW8CsP0PcpMyEWtIxV"
  15.  
  16. [*] Process Execution: [
  17. "Exes_fb546fa4aa75ce6efa7af645466ce974.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "Exes_fb546fa4aa75ce6efa7af645466ce974.exe (3036) called API CreateProcessInternalW 41653 times"
  30. }
  31. ]
  32. }
  33. ]
  34.  
  35. [*] Started Service: []
  36.  
  37. [*] Executed Commands: [
  38. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\Exes_fb546fa4aa75ce6efa7af645466ce974.exe\""
  39. ]
  40.  
  41. [*] Mutexes: [
  42. "CicLoadWinStaWinSta0",
  43. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  44. ]
  45.  
  46. [*] Modified Files: []
  47.  
  48. [*] Deleted Files: []
  49.  
  50. [*] Modified Registry Keys: []
  51.  
  52. [*] Deleted Registry Keys: []
  53.  
  54. [*] DNS Communications: []
  55.  
  56. [*] Domains: []
  57.  
  58. [*] Network Communication - ICMP: []
  59.  
  60. [*] Network Communication - HTTP: []
  61.  
  62. [*] Network Communication - SMTP: []
  63.  
  64. [*] Network Communication - Hosts: []
  65.  
  66. [*] Network Communication - IRC: []
  67.  
  68. [*] Static Analysis: {
  69. "pe": {
  70. "peid_signatures": null,
  71. "imports": [
  72. {
  73. "imports": [
  74. {
  75. "name": null,
  76. "address": "0x401000"
  77. },
  78. {
  79. "name": null,
  80. "address": "0x401004"
  81. },
  82. {
  83. "name": null,
  84. "address": "0x401008"
  85. },
  86. {
  87. "name": null,
  88. "address": "0x40100c"
  89. },
  90. {
  91. "name": "MethCallEngine",
  92. "address": "0x401010"
  93. },
  94. {
  95. "name": null,
  96. "address": "0x401014"
  97. },
  98. {
  99. "name": null,
  100. "address": "0x401018"
  101. },
  102. {
  103. "name": null,
  104. "address": "0x40101c"
  105. },
  106. {
  107. "name": null,
  108. "address": "0x401020"
  109. },
  110. {
  111. "name": null,
  112. "address": "0x401024"
  113. },
  114. {
  115. "name": null,
  116. "address": "0x401028"
  117. },
  118. {
  119. "name": null,
  120. "address": "0x40102c"
  121. },
  122. {
  123. "name": null,
  124. "address": "0x401030"
  125. },
  126. {
  127. "name": null,
  128. "address": "0x401034"
  129. },
  130. {
  131. "name": null,
  132. "address": "0x401038"
  133. },
  134. {
  135. "name": null,
  136. "address": "0x40103c"
  137. },
  138. {
  139. "name": null,
  140. "address": "0x401040"
  141. },
  142. {
  143. "name": null,
  144. "address": "0x401044"
  145. },
  146. {
  147. "name": null,
  148. "address": "0x401048"
  149. },
  150. {
  151. "name": null,
  152. "address": "0x40104c"
  153. },
  154. {
  155. "name": null,
  156. "address": "0x401050"
  157. },
  158. {
  159. "name": null,
  160. "address": "0x401054"
  161. },
  162. {
  163. "name": null,
  164. "address": "0x401058"
  165. },
  166. {
  167. "name": null,
  168. "address": "0x40105c"
  169. },
  170. {
  171. "name": "EVENT_SINK_AddRef",
  172. "address": "0x401060"
  173. },
  174. {
  175. "name": null,
  176. "address": "0x401064"
  177. },
  178. {
  179. "name": null,
  180. "address": "0x401068"
  181. },
  182. {
  183. "name": "EVENT_SINK_Release",
  184. "address": "0x40106c"
  185. },
  186. {
  187. "name": "EVENT_SINK_QueryInterface",
  188. "address": "0x401070"
  189. },
  190. {
  191. "name": "__vbaExceptHandler",
  192. "address": "0x401074"
  193. },
  194. {
  195. "name": null,
  196. "address": "0x401078"
  197. },
  198. {
  199. "name": null,
  200. "address": "0x40107c"
  201. },
  202. {
  203. "name": null,
  204. "address": "0x401080"
  205. },
  206. {
  207. "name": null,
  208. "address": "0x401084"
  209. },
  210. {
  211. "name": null,
  212. "address": "0x401088"
  213. },
  214. {
  215. "name": null,
  216. "address": "0x40108c"
  217. },
  218. {
  219. "name": null,
  220. "address": "0x401090"
  221. },
  222. {
  223. "name": null,
  224. "address": "0x401094"
  225. },
  226. {
  227. "name": null,
  228. "address": "0x401098"
  229. },
  230. {
  231. "name": null,
  232. "address": "0x40109c"
  233. },
  234. {
  235. "name": null,
  236. "address": "0x4010a0"
  237. },
  238. {
  239. "name": null,
  240. "address": "0x4010a4"
  241. },
  242. {
  243. "name": null,
  244. "address": "0x4010a8"
  245. },
  246. {
  247. "name": null,
  248. "address": "0x4010ac"
  249. }
  250. ],
  251. "dll": "MSVBVM60.DLL"
  252. }
  253. ],
  254. "digital_signers": null,
  255. "exported_dll_name": null,
  256. "actual_checksum": "0x000a24c1",
  257. "overlay": null,
  258. "imagebase": "0x00400000",
  259. "reported_checksum": "0x000a24c1",
  260. "icon_hash": null,
  261. "entrypoint": "0x004011c8",
  262. "timestamp": "2005-03-06 04:43:42",
  263. "osversion": "4.0",
  264. "sections": [
  265. {
  266. "name": ".text",
  267. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  268. "virtual_address": "0x00001000",
  269. "size_of_data": "0x00093000",
  270. "entropy": "5.86",
  271. "raw_address": "0x00001000",
  272. "virtual_size": "0x0009251c",
  273. "characteristics_raw": "0x60000020"
  274. },
  275. {
  276. "name": ".data",
  277. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  278. "virtual_address": "0x00094000",
  279. "size_of_data": "0x00000000",
  280. "entropy": "0.00",
  281. "raw_address": "0x00000000",
  282. "virtual_size": "0x00004cc4",
  283. "characteristics_raw": "0xc0000040"
  284. },
  285. {
  286. "name": ".rsrc",
  287. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  288. "virtual_address": "0x00099000",
  289. "size_of_data": "0x00003000",
  290. "entropy": "3.68",
  291. "raw_address": "0x00094000",
  292. "virtual_size": "0x000024fe",
  293. "characteristics_raw": "0x40000040"
  294. }
  295. ],
  296. "resources": [],
  297. "dirents": [
  298. {
  299. "virtual_address": "0x00000000",
  300. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  301. "size": "0x00000000"
  302. },
  303. {
  304. "virtual_address": "0x000933c4",
  305. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  306. "size": "0x00000028"
  307. },
  308. {
  309. "virtual_address": "0x00099000",
  310. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  311. "size": "0x000024fe"
  312. },
  313. {
  314. "virtual_address": "0x00000000",
  315. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  316. "size": "0x00000000"
  317. },
  318. {
  319. "virtual_address": "0x00000000",
  320. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  321. "size": "0x00000000"
  322. },
  323. {
  324. "virtual_address": "0x00000000",
  325. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  326. "size": "0x00000000"
  327. },
  328. {
  329. "virtual_address": "0x00000000",
  330. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  331. "size": "0x00000000"
  332. },
  333. {
  334. "virtual_address": "0x00000000",
  335. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  336. "size": "0x00000000"
  337. },
  338. {
  339. "virtual_address": "0x00000000",
  340. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  341. "size": "0x00000000"
  342. },
  343. {
  344. "virtual_address": "0x00000000",
  345. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  346. "size": "0x00000000"
  347. },
  348. {
  349. "virtual_address": "0x00000000",
  350. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  351. "size": "0x00000000"
  352. },
  353. {
  354. "virtual_address": "0x00000220",
  355. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  356. "size": "0x00000020"
  357. },
  358. {
  359. "virtual_address": "0x00001000",
  360. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  361. "size": "0x000000b4"
  362. },
  363. {
  364. "virtual_address": "0x00000000",
  365. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  366. "size": "0x00000000"
  367. },
  368. {
  369. "virtual_address": "0x00000000",
  370. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  371. "size": "0x00000000"
  372. },
  373. {
  374. "virtual_address": "0x00000000",
  375. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  376. "size": "0x00000000"
  377. }
  378. ],
  379. "exports": [],
  380. "guest_signers": {},
  381. "imphash": "478b704ccaadc7a99e3f4008e3f800bb",
  382. "icon_fuzzy": null,
  383. "icon": null,
  384. "pdbpath": null,
  385. "imported_dll_count": 1,
  386. "versioninfo": []
  387. }
  388. }
  389.  
  390. [*] Resolved APIs: [
  391. "cryptbase.dll.SystemFunction036",
  392. "uxtheme.dll.ThemeInitApiHook",
  393. "user32.dll.IsProcessDPIAware",
  394. "oleaut32.dll.OleLoadPictureEx",
  395. "oleaut32.dll.DispCallFunc",
  396. "oleaut32.dll.LoadTypeLibEx",
  397. "oleaut32.dll.UnRegisterTypeLib",
  398. "oleaut32.dll.CreateTypeLib2",
  399. "oleaut32.dll.VarDateFromUdate",
  400. "oleaut32.dll.VarUdateFromDate",
  401. "oleaut32.dll.GetAltMonthNames",
  402. "oleaut32.dll.VarNumFromParseNum",
  403. "oleaut32.dll.VarParseNumFromStr",
  404. "oleaut32.dll.VarDecFromR4",
  405. "oleaut32.dll.VarDecFromR8",
  406. "oleaut32.dll.VarDecFromDate",
  407. "oleaut32.dll.VarDecFromI4",
  408. "oleaut32.dll.VarDecFromCy",
  409. "oleaut32.dll.VarR4FromDec",
  410. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  411. "oleaut32.dll.GetRecordInfoFromGuids",
  412. "oleaut32.dll.SafeArrayGetRecordInfo",
  413. "oleaut32.dll.SafeArraySetRecordInfo",
  414. "oleaut32.dll.SafeArrayGetIID",
  415. "oleaut32.dll.SafeArraySetIID",
  416. "oleaut32.dll.SafeArrayCopyData",
  417. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  418. "oleaut32.dll.SafeArrayCreateEx",
  419. "oleaut32.dll.VarFormat",
  420. "oleaut32.dll.VarFormatDateTime",
  421. "oleaut32.dll.VarFormatNumber",
  422. "oleaut32.dll.VarFormatPercent",
  423. "oleaut32.dll.VarFormatCurrency",
  424. "oleaut32.dll.VarWeekdayName",
  425. "oleaut32.dll.VarMonthName",
  426. "oleaut32.dll.VarAdd",
  427. "oleaut32.dll.VarAnd",
  428. "oleaut32.dll.VarCat",
  429. "oleaut32.dll.VarDiv",
  430. "oleaut32.dll.VarEqv",
  431. "oleaut32.dll.VarIdiv",
  432. "oleaut32.dll.VarImp",
  433. "oleaut32.dll.VarMod",
  434. "oleaut32.dll.VarMul",
  435. "oleaut32.dll.VarOr",
  436. "oleaut32.dll.VarPow",
  437. "oleaut32.dll.VarSub",
  438. "oleaut32.dll.VarXor",
  439. "oleaut32.dll.VarAbs",
  440. "oleaut32.dll.VarFix",
  441. "oleaut32.dll.VarInt",
  442. "oleaut32.dll.VarNeg",
  443. "oleaut32.dll.VarNot",
  444. "oleaut32.dll.VarRound",
  445. "oleaut32.dll.VarCmp",
  446. "oleaut32.dll.VarDecAdd",
  447. "oleaut32.dll.VarDecCmp",
  448. "oleaut32.dll.VarBstrCat",
  449. "oleaut32.dll.VarCyMulI4",
  450. "oleaut32.dll.VarBstrCmp",
  451. "ole32.dll.CoCreateInstanceEx",
  452. "ole32.dll.CLSIDFromProgIDEx",
  453. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  454. "user32.dll.GetSystemMetrics",
  455. "user32.dll.MonitorFromWindow",
  456. "user32.dll.MonitorFromRect",
  457. "user32.dll.MonitorFromPoint",
  458. "user32.dll.EnumDisplayMonitors",
  459. "user32.dll.GetMonitorInfoA",
  460. "dwmapi.dll.DwmIsCompositionEnabled",
  461. "gdi32.dll.GetLayout",
  462. "gdi32.dll.GdiRealizationInfo",
  463. "gdi32.dll.FontIsLinked",
  464. "advapi32.dll.RegOpenKeyExW",
  465. "advapi32.dll.RegQueryInfoKeyW",
  466. "gdi32.dll.GetTextFaceAliasW",
  467. "advapi32.dll.RegEnumValueW",
  468. "advapi32.dll.RegCloseKey",
  469. "advapi32.dll.RegQueryValueExW",
  470. "gdi32.dll.GetFontAssocStatus",
  471. "advapi32.dll.RegQueryValueExA",
  472. "advapi32.dll.RegEnumKeyExW",
  473. "gdi32.dll.GdiIsMetaPrintDC",
  474. "ole32.dll.CoInitializeEx",
  475. "ole32.dll.CoUninitialize",
  476. "ole32.dll.CoRegisterInitializeSpy",
  477. "ole32.dll.CoRevokeInitializeSpy",
  478. "gdi32.dll.GetTextExtentExPointWPri",
  479. "kernel32.dll.NlsGetCacheUpdateCount",
  480. "kernel32.dll.GetCalendarInfoW",
  481. "kernel32.dll.GetTickCount",
  482. "kernel32.dll.Sleep",
  483. "user32.dll.GetCursorPos",
  484. "user32.dll.EnumWindows",
  485. "kernel32.dll.SetErrorMode",
  486. "kernel32.dll.SetLastError",
  487. "kernel32.dll.VirtualAllocEx",
  488. "kernel32.dll.CloseHandle",
  489. "shell32.dll.ShellExecuteW",
  490. "kernel32.dll.WriteFile",
  491. "kernel32.dll.UnmapViewOfFile",
  492. "kernel32.dll.CreateFileW",
  493. "kernel32.dll.TerminateProcess",
  494. "kernel32.dll.VirtualProtectEx",
  495. "kernel32.dll.CreateProcessInternalW",
  496. "kernel32.dll.GetTempPathW",
  497. "kernel32.dll.GetLongPathNameW",
  498. "kernel32.dll.GetFileSize",
  499. "kernel32.dll.ReadFile",
  500. "ntdll.dll.NtProtectVirtualMemory",
  501. "kernel32.dll.GetCommandLineW"
  502. ]
  503.  
  504. [*] Static Analysis: {
  505. "pe": {
  506. "peid_signatures": null,
  507. "imports": [
  508. {
  509. "imports": [
  510. {
  511. "name": null,
  512. "address": "0x401000"
  513. },
  514. {
  515. "name": null,
  516. "address": "0x401004"
  517. },
  518. {
  519. "name": null,
  520. "address": "0x401008"
  521. },
  522. {
  523. "name": null,
  524. "address": "0x40100c"
  525. },
  526. {
  527. "name": "MethCallEngine",
  528. "address": "0x401010"
  529. },
  530. {
  531. "name": null,
  532. "address": "0x401014"
  533. },
  534. {
  535. "name": null,
  536. "address": "0x401018"
  537. },
  538. {
  539. "name": null,
  540. "address": "0x40101c"
  541. },
  542. {
  543. "name": null,
  544. "address": "0x401020"
  545. },
  546. {
  547. "name": null,
  548. "address": "0x401024"
  549. },
  550. {
  551. "name": null,
  552. "address": "0x401028"
  553. },
  554. {
  555. "name": null,
  556. "address": "0x40102c"
  557. },
  558. {
  559. "name": null,
  560. "address": "0x401030"
  561. },
  562. {
  563. "name": null,
  564. "address": "0x401034"
  565. },
  566. {
  567. "name": null,
  568. "address": "0x401038"
  569. },
  570. {
  571. "name": null,
  572. "address": "0x40103c"
  573. },
  574. {
  575. "name": null,
  576. "address": "0x401040"
  577. },
  578. {
  579. "name": null,
  580. "address": "0x401044"
  581. },
  582. {
  583. "name": null,
  584. "address": "0x401048"
  585. },
  586. {
  587. "name": null,
  588. "address": "0x40104c"
  589. },
  590. {
  591. "name": null,
  592. "address": "0x401050"
  593. },
  594. {
  595. "name": null,
  596. "address": "0x401054"
  597. },
  598. {
  599. "name": null,
  600. "address": "0x401058"
  601. },
  602. {
  603. "name": null,
  604. "address": "0x40105c"
  605. },
  606. {
  607. "name": "EVENT_SINK_AddRef",
  608. "address": "0x401060"
  609. },
  610. {
  611. "name": null,
  612. "address": "0x401064"
  613. },
  614. {
  615. "name": null,
  616. "address": "0x401068"
  617. },
  618. {
  619. "name": "EVENT_SINK_Release",
  620. "address": "0x40106c"
  621. },
  622. {
  623. "name": "EVENT_SINK_QueryInterface",
  624. "address": "0x401070"
  625. },
  626. {
  627. "name": "__vbaExceptHandler",
  628. "address": "0x401074"
  629. },
  630. {
  631. "name": null,
  632. "address": "0x401078"
  633. },
  634. {
  635. "name": null,
  636. "address": "0x40107c"
  637. },
  638. {
  639. "name": null,
  640. "address": "0x401080"
  641. },
  642. {
  643. "name": null,
  644. "address": "0x401084"
  645. },
  646. {
  647. "name": null,
  648. "address": "0x401088"
  649. },
  650. {
  651. "name": null,
  652. "address": "0x40108c"
  653. },
  654. {
  655. "name": null,
  656. "address": "0x401090"
  657. },
  658. {
  659. "name": null,
  660. "address": "0x401094"
  661. },
  662. {
  663. "name": null,
  664. "address": "0x401098"
  665. },
  666. {
  667. "name": null,
  668. "address": "0x40109c"
  669. },
  670. {
  671. "name": null,
  672. "address": "0x4010a0"
  673. },
  674. {
  675. "name": null,
  676. "address": "0x4010a4"
  677. },
  678. {
  679. "name": null,
  680. "address": "0x4010a8"
  681. },
  682. {
  683. "name": null,
  684. "address": "0x4010ac"
  685. }
  686. ],
  687. "dll": "MSVBVM60.DLL"
  688. }
  689. ],
  690. "digital_signers": null,
  691. "exported_dll_name": null,
  692. "actual_checksum": "0x000a24c1",
  693. "overlay": null,
  694. "imagebase": "0x00400000",
  695. "reported_checksum": "0x000a24c1",
  696. "icon_hash": null,
  697. "entrypoint": "0x004011c8",
  698. "timestamp": "2005-03-06 04:43:42",
  699. "osversion": "4.0",
  700. "sections": [
  701. {
  702. "name": ".text",
  703. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  704. "virtual_address": "0x00001000",
  705. "size_of_data": "0x00093000",
  706. "entropy": "5.86",
  707. "raw_address": "0x00001000",
  708. "virtual_size": "0x0009251c",
  709. "characteristics_raw": "0x60000020"
  710. },
  711. {
  712. "name": ".data",
  713. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  714. "virtual_address": "0x00094000",
  715. "size_of_data": "0x00000000",
  716. "entropy": "0.00",
  717. "raw_address": "0x00000000",
  718. "virtual_size": "0x00004cc4",
  719. "characteristics_raw": "0xc0000040"
  720. },
  721. {
  722. "name": ".rsrc",
  723. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  724. "virtual_address": "0x00099000",
  725. "size_of_data": "0x00003000",
  726. "entropy": "3.68",
  727. "raw_address": "0x00094000",
  728. "virtual_size": "0x000024fe",
  729. "characteristics_raw": "0x40000040"
  730. }
  731. ],
  732. "resources": [],
  733. "dirents": [
  734. {
  735. "virtual_address": "0x00000000",
  736. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  737. "size": "0x00000000"
  738. },
  739. {
  740. "virtual_address": "0x000933c4",
  741. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  742. "size": "0x00000028"
  743. },
  744. {
  745. "virtual_address": "0x00099000",
  746. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  747. "size": "0x000024fe"
  748. },
  749. {
  750. "virtual_address": "0x00000000",
  751. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  752. "size": "0x00000000"
  753. },
  754. {
  755. "virtual_address": "0x00000000",
  756. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  757. "size": "0x00000000"
  758. },
  759. {
  760. "virtual_address": "0x00000000",
  761. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  762. "size": "0x00000000"
  763. },
  764. {
  765. "virtual_address": "0x00000000",
  766. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  767. "size": "0x00000000"
  768. },
  769. {
  770. "virtual_address": "0x00000000",
  771. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  772. "size": "0x00000000"
  773. },
  774. {
  775. "virtual_address": "0x00000000",
  776. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  777. "size": "0x00000000"
  778. },
  779. {
  780. "virtual_address": "0x00000000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  782. "size": "0x00000000"
  783. },
  784. {
  785. "virtual_address": "0x00000000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  787. "size": "0x00000000"
  788. },
  789. {
  790. "virtual_address": "0x00000220",
  791. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  792. "size": "0x00000020"
  793. },
  794. {
  795. "virtual_address": "0x00001000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  797. "size": "0x000000b4"
  798. },
  799. {
  800. "virtual_address": "0x00000000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  802. "size": "0x00000000"
  803. },
  804. {
  805. "virtual_address": "0x00000000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  807. "size": "0x00000000"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  812. "size": "0x00000000"
  813. }
  814. ],
  815. "exports": [],
  816. "guest_signers": {},
  817. "imphash": "478b704ccaadc7a99e3f4008e3f800bb",
  818. "icon_fuzzy": null,
  819. "icon": null,
  820. "pdbpath": null,
  821. "imported_dll_count": 1,
  822. "versioninfo": []
  823. }
  824. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!