API tools faq
paste
paladin316

NetWire_29b89507364a0868ff24aa52e9f9a30f_exe_2019-07-01_09_30.json

paladin316
Jul 1st, 2019
2,153
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 24.71 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "NetWire_29b89507364a0868ff24aa52e9f9a30f.exe"
  7. [*] File Size: 647168
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "ff0b1d9f2221e78773cfed9e89f87eab3add2c872f44f7f8cd10e18e2e0e8465"
  10. [*] MD5: "29b89507364a0868ff24aa52e9f9a30f"
  11. [*] SHA1: "a33e07b0f35d1fa69c732b8ef03fbd045c1d443d"
  12. [*] SHA512: "c7c4e572fbeaa3e10c9f5754b94e56efbcbcad5f6aa2b144e8b8a12d5fd3f43e16465f0b771c39e5d94167ae95416a2a5ebaa1a1b0329c3a7ba652fb13f34611"
  13. [*] CRC32: "434F77EB"
  14. [*] SSDEEP: "12288:t0Uhw2+EAMi0ROcNQ+hphjvqVYhN3unnNXHVRUfN4zyO:t22/Jr7NQ+hnjvr6nNXrUn"
  15.  
  16. [*] Process Execution: [
  17. "NetWire_29b89507364a0868ff24aa52e9f9a30f.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "NetWire_29b89507364a0868ff24aa52e9f9a30f.exe (1652) called API CreateProcessInternalW 36154 times"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 24 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "MicroWorld-eScan": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi"
  38. },
  39. {
  40. "FireEye": "Generic.mg.29b89507364a0868"
  41. },
  42. {
  43. "BitDefender": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi"
  44. },
  45. {
  46. "Invincea": "heuristic"
  47. },
  48. {
  49. "F-Prot": "W32/Wacatac.F.gen!Eldorado"
  50. },
  51. {
  52. "Symantec": "ML.Attribute.HighConfidence"
  53. },
  54. {
  55. "APEX": "Malicious"
  56. },
  57. {
  58. "Rising": "Trojan.Injector!8.C4 (TFE:dGZlOgU7RDK1NNTsOA)"
  59. },
  60. {
  61. "Endgame": "malicious (high confidence)"
  62. },
  63. {
  64. "DrWeb": "Trojan.PWS.Siggen2.20234"
  65. },
  66. {
  67. "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.jm"
  68. },
  69. {
  70. "Fortinet": "W32/Injector.EGIR!tr"
  71. },
  72. {
  73. "Trapmine": "malicious.moderate.ml.score"
  74. },
  75. {
  76. "Emsisoft": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi (B)"
  77. },
  78. {
  79. "Cyren": "W32/Wacatac.F.gen!Eldorado"
  80. },
  81. {
  82. "MAX": "malware (ai score=84)"
  83. },
  84. {
  85. "Arcabit": "Trojan.Heur.VP2.E4792D"
  86. },
  87. {
  88. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  89. },
  90. {
  91. "Ad-Aware": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi"
  92. },
  93. {
  94. "ESET-NOD32": "a variant of Win32/GenKryptik.DMBU"
  95. },
  96. {
  97. "SentinelOne": "DFI - Suspicious PE"
  98. },
  99. {
  100. "GData": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi"
  101. },
  102. {
  103. "Cybereason": "malicious.7364a0"
  104. },
  105. {
  106. "CrowdStrike": "win/malicious_confidence_80% (D)"
  107. }
  108. ]
  109. }
  110. ]
  111.  
  112. [*] Started Service: []
  113.  
  114. [*] Executed Commands: [
  115. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\NetWire_29b89507364a0868ff24aa52e9f9a30f.exe\""
  116. ]
  117.  
  118. [*] Mutexes: [
  119. "CicLoadWinStaWinSta0",
  120. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  121. ]
  122.  
  123. [*] Modified Files: []
  124.  
  125. [*] Deleted Files: []
  126.  
  127. [*] Modified Registry Keys: []
  128.  
  129. [*] Deleted Registry Keys: []
  130.  
  131. [*] DNS Communications: []
  132.  
  133. [*] Domains: []
  134.  
  135. [*] Network Communication - ICMP: []
  136.  
  137. [*] Network Communication - HTTP: []
  138.  
  139. [*] Network Communication - SMTP: []
  140.  
  141. [*] Network Communication - Hosts: []
  142.  
  143. [*] Network Communication - IRC: []
  144.  
  145. [*] Static Analysis: {
  146. "pe": {
  147. "peid_signatures": null,
  148. "imports": [
  149. {
  150. "imports": [
  151. {
  152. "name": "MethCallEngine",
  153. "address": "0x401000"
  154. },
  155. {
  156. "name": null,
  157. "address": "0x401004"
  158. },
  159. {
  160. "name": null,
  161. "address": "0x401008"
  162. },
  163. {
  164. "name": null,
  165. "address": "0x40100c"
  166. },
  167. {
  168. "name": null,
  169. "address": "0x401010"
  170. },
  171. {
  172. "name": null,
  173. "address": "0x401014"
  174. },
  175. {
  176. "name": null,
  177. "address": "0x401018"
  178. },
  179. {
  180. "name": null,
  181. "address": "0x40101c"
  182. },
  183. {
  184. "name": null,
  185. "address": "0x401020"
  186. },
  187. {
  188. "name": null,
  189. "address": "0x401024"
  190. },
  191. {
  192. "name": null,
  193. "address": "0x401028"
  194. },
  195. {
  196. "name": null,
  197. "address": "0x40102c"
  198. },
  199. {
  200. "name": "EVENT_SINK_AddRef",
  201. "address": "0x401030"
  202. },
  203. {
  204. "name": null,
  205. "address": "0x401034"
  206. },
  207. {
  208. "name": null,
  209. "address": "0x401038"
  210. },
  211. {
  212. "name": "EVENT_SINK_Release",
  213. "address": "0x40103c"
  214. },
  215. {
  216. "name": null,
  217. "address": "0x401040"
  218. },
  219. {
  220. "name": "EVENT_SINK_QueryInterface",
  221. "address": "0x401044"
  222. },
  223. {
  224. "name": "__vbaExceptHandler",
  225. "address": "0x401048"
  226. },
  227. {
  228. "name": null,
  229. "address": "0x40104c"
  230. },
  231. {
  232. "name": null,
  233. "address": "0x401050"
  234. },
  235. {
  236. "name": null,
  237. "address": "0x401054"
  238. },
  239. {
  240. "name": null,
  241. "address": "0x401058"
  242. },
  243. {
  244. "name": null,
  245. "address": "0x40105c"
  246. },
  247. {
  248. "name": null,
  249. "address": "0x401060"
  250. },
  251. {
  252. "name": null,
  253. "address": "0x401064"
  254. },
  255. {
  256. "name": null,
  257. "address": "0x401068"
  258. },
  259. {
  260. "name": null,
  261. "address": "0x40106c"
  262. },
  263. {
  264. "name": null,
  265. "address": "0x401070"
  266. }
  267. ],
  268. "dll": "MSVBVM60.DLL"
  269. }
  270. ],
  271. "digital_signers": null,
  272. "exported_dll_name": null,
  273. "actual_checksum": "0x0009e1c2",
  274. "overlay": null,
  275. "imagebase": "0x00400000",
  276. "reported_checksum": "0x0009e1c2",
  277. "icon_hash": null,
  278. "entrypoint": "0x00401130",
  279. "timestamp": "2019-07-01 06:20:00",
  280. "osversion": "4.0",
  281. "sections": [
  282. {
  283. "name": ".text",
  284. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  285. "virtual_address": "0x00001000",
  286. "size_of_data": "0x00099000",
  287. "entropy": "5.45",
  288. "raw_address": "0x00001000",
  289. "virtual_size": "0x000987c0",
  290. "characteristics_raw": "0x60000020"
  291. },
  292. {
  293. "name": ".data",
  294. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  295. "virtual_address": "0x0009a000",
  296. "size_of_data": "0x00000000",
  297. "entropy": "0.00",
  298. "raw_address": "0x00000000",
  299. "virtual_size": "0x00005444",
  300. "characteristics_raw": "0xc0000040"
  301. },
  302. {
  303. "name": ".rsrc",
  304. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  305. "virtual_address": "0x000a0000",
  306. "size_of_data": "0x00004000",
  307. "entropy": "4.05",
  308. "raw_address": "0x0009a000",
  309. "virtual_size": "0x00003966",
  310. "characteristics_raw": "0x40000040"
  311. }
  312. ],
  313. "resources": [],
  314. "dirents": [
  315. {
  316. "virtual_address": "0x00000000",
  317. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  318. "size": "0x00000000"
  319. },
  320. {
  321. "virtual_address": "0x000996a4",
  322. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  323. "size": "0x00000028"
  324. },
  325. {
  326. "virtual_address": "0x000a0000",
  327. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  328. "size": "0x00003966"
  329. },
  330. {
  331. "virtual_address": "0x00000000",
  332. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  333. "size": "0x00000000"
  334. },
  335. {
  336. "virtual_address": "0x00000000",
  337. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  338. "size": "0x00000000"
  339. },
  340. {
  341. "virtual_address": "0x00000000",
  342. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  343. "size": "0x00000000"
  344. },
  345. {
  346. "virtual_address": "0x00000000",
  347. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  348. "size": "0x00000000"
  349. },
  350. {
  351. "virtual_address": "0x00000000",
  352. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  353. "size": "0x00000000"
  354. },
  355. {
  356. "virtual_address": "0x00000000",
  357. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  358. "size": "0x00000000"
  359. },
  360. {
  361. "virtual_address": "0x00000000",
  362. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  363. "size": "0x00000000"
  364. },
  365. {
  366. "virtual_address": "0x00000000",
  367. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  368. "size": "0x00000000"
  369. },
  370. {
  371. "virtual_address": "0x00000220",
  372. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  373. "size": "0x00000020"
  374. },
  375. {
  376. "virtual_address": "0x00001000",
  377. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  378. "size": "0x00000078"
  379. },
  380. {
  381. "virtual_address": "0x00000000",
  382. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  383. "size": "0x00000000"
  384. },
  385. {
  386. "virtual_address": "0x00000000",
  387. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  388. "size": "0x00000000"
  389. },
  390. {
  391. "virtual_address": "0x00000000",
  392. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  393. "size": "0x00000000"
  394. }
  395. ],
  396. "exports": [],
  397. "guest_signers": {},
  398. "imphash": "2977270fae1bfe1cc3a3258b5bc0e2ed",
  399. "icon_fuzzy": null,
  400. "icon": null,
  401. "pdbpath": null,
  402. "imported_dll_count": 1,
  403. "versioninfo": []
  404. }
  405. }
  406.  
  407. [*] Resolved APIs: [
  408. "cryptbase.dll.SystemFunction036",
  409. "uxtheme.dll.ThemeInitApiHook",
  410. "user32.dll.IsProcessDPIAware",
  411. "oleaut32.dll.OleLoadPictureEx",
  412. "oleaut32.dll.DispCallFunc",
  413. "oleaut32.dll.LoadTypeLibEx",
  414. "oleaut32.dll.UnRegisterTypeLib",
  415. "oleaut32.dll.CreateTypeLib2",
  416. "oleaut32.dll.VarDateFromUdate",
  417. "oleaut32.dll.VarUdateFromDate",
  418. "oleaut32.dll.GetAltMonthNames",
  419. "oleaut32.dll.VarNumFromParseNum",
  420. "oleaut32.dll.VarParseNumFromStr",
  421. "oleaut32.dll.VarDecFromR4",
  422. "oleaut32.dll.VarDecFromR8",
  423. "oleaut32.dll.VarDecFromDate",
  424. "oleaut32.dll.VarDecFromI4",
  425. "oleaut32.dll.VarDecFromCy",
  426. "oleaut32.dll.VarR4FromDec",
  427. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  428. "oleaut32.dll.GetRecordInfoFromGuids",
  429. "oleaut32.dll.SafeArrayGetRecordInfo",
  430. "oleaut32.dll.SafeArraySetRecordInfo",
  431. "oleaut32.dll.SafeArrayGetIID",
  432. "oleaut32.dll.SafeArraySetIID",
  433. "oleaut32.dll.SafeArrayCopyData",
  434. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  435. "oleaut32.dll.SafeArrayCreateEx",
  436. "oleaut32.dll.VarFormat",
  437. "oleaut32.dll.VarFormatDateTime",
  438. "oleaut32.dll.VarFormatNumber",
  439. "oleaut32.dll.VarFormatPercent",
  440. "oleaut32.dll.VarFormatCurrency",
  441. "oleaut32.dll.VarWeekdayName",
  442. "oleaut32.dll.VarMonthName",
  443. "oleaut32.dll.VarAdd",
  444. "oleaut32.dll.VarAnd",
  445. "oleaut32.dll.VarCat",
  446. "oleaut32.dll.VarDiv",
  447. "oleaut32.dll.VarEqv",
  448. "oleaut32.dll.VarIdiv",
  449. "oleaut32.dll.VarImp",
  450. "oleaut32.dll.VarMod",
  451. "oleaut32.dll.VarMul",
  452. "oleaut32.dll.VarOr",
  453. "oleaut32.dll.VarPow",
  454. "oleaut32.dll.VarSub",
  455. "oleaut32.dll.VarXor",
  456. "oleaut32.dll.VarAbs",
  457. "oleaut32.dll.VarFix",
  458. "oleaut32.dll.VarInt",
  459. "oleaut32.dll.VarNeg",
  460. "oleaut32.dll.VarNot",
  461. "oleaut32.dll.VarRound",
  462. "oleaut32.dll.VarCmp",
  463. "oleaut32.dll.VarDecAdd",
  464. "oleaut32.dll.VarDecCmp",
  465. "oleaut32.dll.VarBstrCat",
  466. "oleaut32.dll.VarCyMulI4",
  467. "oleaut32.dll.VarBstrCmp",
  468. "ole32.dll.CoCreateInstanceEx",
  469. "ole32.dll.CLSIDFromProgIDEx",
  470. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  471. "user32.dll.GetSystemMetrics",
  472. "user32.dll.MonitorFromWindow",
  473. "user32.dll.MonitorFromRect",
  474. "user32.dll.MonitorFromPoint",
  475. "user32.dll.EnumDisplayMonitors",
  476. "user32.dll.GetMonitorInfoA",
  477. "dwmapi.dll.DwmIsCompositionEnabled",
  478. "gdi32.dll.GetLayout",
  479. "gdi32.dll.GdiRealizationInfo",
  480. "gdi32.dll.FontIsLinked",
  481. "advapi32.dll.RegOpenKeyExW",
  482. "advapi32.dll.RegQueryInfoKeyW",
  483. "gdi32.dll.GetTextFaceAliasW",
  484. "advapi32.dll.RegEnumValueW",
  485. "advapi32.dll.RegCloseKey",
  486. "advapi32.dll.RegQueryValueExW",
  487. "gdi32.dll.GetFontAssocStatus",
  488. "advapi32.dll.RegQueryValueExA",
  489. "advapi32.dll.RegEnumKeyExW",
  490. "gdi32.dll.GdiIsMetaPrintDC",
  491. "ole32.dll.CoInitializeEx",
  492. "ole32.dll.CoUninitialize",
  493. "ole32.dll.CoRegisterInitializeSpy",
  494. "ole32.dll.CoRevokeInitializeSpy",
  495. "gdi32.dll.GetTextExtentExPointWPri",
  496. "kernel32.dll.NlsGetCacheUpdateCount",
  497. "kernel32.dll.GetCalendarInfoW",
  498. "kernel32.dll.GetTickCount",
  499. "kernel32.dll.Sleep",
  500. "user32.dll.GetCursorPos",
  501. "user32.dll.EnumWindows",
  502. "kernel32.dll.SetErrorMode",
  503. "kernel32.dll.SetLastError",
  504. "kernel32.dll.VirtualAllocEx",
  505. "kernel32.dll.CloseHandle",
  506. "shell32.dll.ShellExecuteW",
  507. "kernel32.dll.WriteFile",
  508. "kernel32.dll.UnmapViewOfFile",
  509. "kernel32.dll.CreateFileW",
  510. "kernel32.dll.TerminateProcess",
  511. "kernel32.dll.VirtualProtectEx",
  512. "kernel32.dll.CreateProcessInternalW",
  513. "kernel32.dll.GetTempPathW",
  514. "kernel32.dll.GetLongPathNameW",
  515. "kernel32.dll.GetFileSize",
  516. "kernel32.dll.ReadFile",
  517. "ntdll.dll.NtProtectVirtualMemory",
  518. "kernel32.dll.GetCommandLineW"
  519. ]
  520.  
  521. [*] Static Analysis: {
  522. "pe": {
  523. "peid_signatures": null,
  524. "imports": [
  525. {
  526. "imports": [
  527. {
  528. "name": "MethCallEngine",
  529. "address": "0x401000"
  530. },
  531. {
  532. "name": null,
  533. "address": "0x401004"
  534. },
  535. {
  536. "name": null,
  537. "address": "0x401008"
  538. },
  539. {
  540. "name": null,
  541. "address": "0x40100c"
  542. },
  543. {
  544. "name": null,
  545. "address": "0x401010"
  546. },
  547. {
  548. "name": null,
  549. "address": "0x401014"
  550. },
  551. {
  552. "name": null,
  553. "address": "0x401018"
  554. },
  555. {
  556. "name": null,
  557. "address": "0x40101c"
  558. },
  559. {
  560. "name": null,
  561. "address": "0x401020"
  562. },
  563. {
  564. "name": null,
  565. "address": "0x401024"
  566. },
  567. {
  568. "name": null,
  569. "address": "0x401028"
  570. },
  571. {
  572. "name": null,
  573. "address": "0x40102c"
  574. },
  575. {
  576. "name": "EVENT_SINK_AddRef",
  577. "address": "0x401030"
  578. },
  579. {
  580. "name": null,
  581. "address": "0x401034"
  582. },
  583. {
  584. "name": null,
  585. "address": "0x401038"
  586. },
  587. {
  588. "name": "EVENT_SINK_Release",
  589. "address": "0x40103c"
  590. },
  591. {
  592. "name": null,
  593. "address": "0x401040"
  594. },
  595. {
  596. "name": "EVENT_SINK_QueryInterface",
  597. "address": "0x401044"
  598. },
  599. {
  600. "name": "__vbaExceptHandler",
  601. "address": "0x401048"
  602. },
  603. {
  604. "name": null,
  605. "address": "0x40104c"
  606. },
  607. {
  608. "name": null,
  609. "address": "0x401050"
  610. },
  611. {
  612. "name": null,
  613. "address": "0x401054"
  614. },
  615. {
  616. "name": null,
  617. "address": "0x401058"
  618. },
  619. {
  620. "name": null,
  621. "address": "0x40105c"
  622. },
  623. {
  624. "name": null,
  625. "address": "0x401060"
  626. },
  627. {
  628. "name": null,
  629. "address": "0x401064"
  630. },
  631. {
  632. "name": null,
  633. "address": "0x401068"
  634. },
  635. {
  636. "name": null,
  637. "address": "0x40106c"
  638. },
  639. {
  640. "name": null,
  641. "address": "0x401070"
  642. }
  643. ],
  644. "dll": "MSVBVM60.DLL"
  645. }
  646. ],
  647. "digital_signers": null,
  648. "exported_dll_name": null,
  649. "actual_checksum": "0x0009e1c2",
  650. "overlay": null,
  651. "imagebase": "0x00400000",
  652. "reported_checksum": "0x0009e1c2",
  653. "icon_hash": null,
  654. "entrypoint": "0x00401130",
  655. "timestamp": "2019-07-01 06:20:00",
  656. "osversion": "4.0",
  657. "sections": [
  658. {
  659. "name": ".text",
  660. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  661. "virtual_address": "0x00001000",
  662. "size_of_data": "0x00099000",
  663. "entropy": "5.45",
  664. "raw_address": "0x00001000",
  665. "virtual_size": "0x000987c0",
  666. "characteristics_raw": "0x60000020"
  667. },
  668. {
  669. "name": ".data",
  670. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  671. "virtual_address": "0x0009a000",
  672. "size_of_data": "0x00000000",
  673. "entropy": "0.00",
  674. "raw_address": "0x00000000",
  675. "virtual_size": "0x00005444",
  676. "characteristics_raw": "0xc0000040"
  677. },
  678. {
  679. "name": ".rsrc",
  680. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  681. "virtual_address": "0x000a0000",
  682. "size_of_data": "0x00004000",
  683. "entropy": "4.05",
  684. "raw_address": "0x0009a000",
  685. "virtual_size": "0x00003966",
  686. "characteristics_raw": "0x40000040"
  687. }
  688. ],
  689. "resources": [],
  690. "dirents": [
  691. {
  692. "virtual_address": "0x00000000",
  693. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  694. "size": "0x00000000"
  695. },
  696. {
  697. "virtual_address": "0x000996a4",
  698. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  699. "size": "0x00000028"
  700. },
  701. {
  702. "virtual_address": "0x000a0000",
  703. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  704. "size": "0x00003966"
  705. },
  706. {
  707. "virtual_address": "0x00000000",
  708. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  709. "size": "0x00000000"
  710. },
  711. {
  712. "virtual_address": "0x00000000",
  713. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  714. "size": "0x00000000"
  715. },
  716. {
  717. "virtual_address": "0x00000000",
  718. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  719. "size": "0x00000000"
  720. },
  721. {
  722. "virtual_address": "0x00000000",
  723. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  724. "size": "0x00000000"
  725. },
  726. {
  727. "virtual_address": "0x00000000",
  728. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  729. "size": "0x00000000"
  730. },
  731. {
  732. "virtual_address": "0x00000000",
  733. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  734. "size": "0x00000000"
  735. },
  736. {
  737. "virtual_address": "0x00000000",
  738. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  739. "size": "0x00000000"
  740. },
  741. {
  742. "virtual_address": "0x00000000",
  743. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  744. "size": "0x00000000"
  745. },
  746. {
  747. "virtual_address": "0x00000220",
  748. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  749. "size": "0x00000020"
  750. },
  751. {
  752. "virtual_address": "0x00001000",
  753. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  754. "size": "0x00000078"
  755. },
  756. {
  757. "virtual_address": "0x00000000",
  758. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  759. "size": "0x00000000"
  760. },
  761. {
  762. "virtual_address": "0x00000000",
  763. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  764. "size": "0x00000000"
  765. },
  766. {
  767. "virtual_address": "0x00000000",
  768. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  769. "size": "0x00000000"
  770. }
  771. ],
  772. "exports": [],
  773. "guest_signers": {},
  774. "imphash": "2977270fae1bfe1cc3a3258b5bc0e2ed",
  775. "icon_fuzzy": null,
  776. "icon": null,
  777. "pdbpath": null,
  778. "imported_dll_count": 1,
  779. "versioninfo": []
  780. }
  781. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!