API tools faq
paste
paladin316

eAdobe_exe_2019-07-03_05_30.json

paladin316
Jul 3rd, 2019
2,171
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 40.05 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 0.5
  5.  
  6. [*] File Name: "eAdobe.exe"
  7. [*] File Size: 53248
  8. [*] File Type: "PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391"
  10. [*] MD5: "278edbd499374bf73621f8c1f969d894"
  11. [*] SHA1: "a81170af14747781c5f5f51bb1215893136f0bc0"
  12. [*] SHA512: "93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9"
  13. [*] CRC32: "4B85346C"
  14. [*] SSDEEP: "768:jP2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2OKFRJS8D:CJv46yoD2BTNz1+M9GLf7w8D"
  15.  
  16. [*] Process Execution: [
  17. "eAdobe.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. }
  25. ]
  26.  
  27. [*] Started Service: []
  28.  
  29. [*] Executed Commands: []
  30.  
  31. [*] Mutexes: [
  32. "Global\\CLR_CASOFF_MUTEX"
  33. ]
  34.  
  35. [*] Modified Files: []
  36.  
  37. [*] Deleted Files: [
  38. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2784.25424453",
  39. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2784.25424453",
  40. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2784.25424453"
  41. ]
  42.  
  43. [*] Modified Registry Keys: []
  44.  
  45. [*] Deleted Registry Keys: []
  46.  
  47. [*] DNS Communications: []
  48.  
  49. [*] Domains: []
  50.  
  51. [*] Network Communication - ICMP: []
  52.  
  53. [*] Network Communication - HTTP: []
  54.  
  55. [*] Network Communication - SMTP: []
  56.  
  57. [*] Network Communication - Hosts: []
  58.  
  59. [*] Network Communication - IRC: []
  60.  
  61. [*] Static Analysis: {
  62. "dotnet": {
  63. "customattrs": null,
  64. "assemblyinfo": {
  65. "version": "2.0.0.0",
  66. "name": "RegAsm"
  67. },
  68. "assemblyrefs": [
  69. {
  70. "version": "2.0.0.0",
  71. "name": "mscorlib"
  72. }
  73. ],
  74. "typerefs": [
  75. {
  76. "typename": "System.AppDomain",
  77. "assembly": "mscorlib"
  78. },
  79. {
  80. "typename": "System.AppDomainSetup",
  81. "assembly": "mscorlib"
  82. },
  83. {
  84. "typename": "System.ApplicationException",
  85. "assembly": "mscorlib"
  86. },
  87. {
  88. "typename": "System.Array",
  89. "assembly": "mscorlib"
  90. },
  91. {
  92. "typename": "System.BadImageFormatException",
  93. "assembly": "mscorlib"
  94. },
  95. {
  96. "typename": "System.Boolean",
  97. "assembly": "mscorlib"
  98. },
  99. {
  100. "typename": "System.CLSCompliantAttribute",
  101. "assembly": "mscorlib"
  102. },
  103. {
  104. "typename": "System.Char",
  105. "assembly": "mscorlib"
  106. },
  107. {
  108. "typename": "System.Collections.Generic.ICollection`1",
  109. "assembly": "mscorlib"
  110. },
  111. {
  112. "typename": "System.Collections.Generic.IList`1",
  113. "assembly": "mscorlib"
  114. },
  115. {
  116. "typename": "System.Console",
  117. "assembly": "mscorlib"
  118. },
  119. {
  120. "typename": "System.Diagnostics.DebuggableAttribute",
  121. "assembly": "mscorlib"
  122. },
  123. {
  124. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  125. "assembly": "mscorlib"
  126. },
  127. {
  128. "typename": "System.Enum",
  129. "assembly": "mscorlib"
  130. },
  131. {
  132. "typename": "System.Environment",
  133. "assembly": "mscorlib"
  134. },
  135. {
  136. "typename": "System.Exception",
  137. "assembly": "mscorlib"
  138. },
  139. {
  140. "typename": "System.Globalization.CultureInfo",
  141. "assembly": "mscorlib"
  142. },
  143. {
  144. "typename": "System.Globalization.TextInfo",
  145. "assembly": "mscorlib"
  146. },
  147. {
  148. "typename": "System.Guid",
  149. "assembly": "mscorlib"
  150. },
  151. {
  152. "typename": "System.IFormatProvider",
  153. "assembly": "mscorlib"
  154. },
  155. {
  156. "typename": "System.IO.Directory",
  157. "assembly": "mscorlib"
  158. },
  159. {
  160. "typename": "System.IO.DirectoryInfo",
  161. "assembly": "mscorlib"
  162. },
  163. {
  164. "typename": "System.IO.File",
  165. "assembly": "mscorlib"
  166. },
  167. {
  168. "typename": "System.IO.FileInfo",
  169. "assembly": "mscorlib"
  170. },
  171. {
  172. "typename": "System.IO.FileNotFoundException",
  173. "assembly": "mscorlib"
  174. },
  175. {
  176. "typename": "System.IO.FileStream",
  177. "assembly": "mscorlib"
  178. },
  179. {
  180. "typename": "System.IO.FileSystemInfo",
  181. "assembly": "mscorlib"
  182. },
  183. {
  184. "typename": "System.IO.Path",
  185. "assembly": "mscorlib"
  186. },
  187. {
  188. "typename": "System.IO.Stream",
  189. "assembly": "mscorlib"
  190. },
  191. {
  192. "typename": "System.IO.TextWriter",
  193. "assembly": "mscorlib"
  194. },
  195. {
  196. "typename": "System.Int32",
  197. "assembly": "mscorlib"
  198. },
  199. {
  200. "typename": "System.IntPtr",
  201. "assembly": "mscorlib"
  202. },
  203. {
  204. "typename": "System.MarshalByRefObject",
  205. "assembly": "mscorlib"
  206. },
  207. {
  208. "typename": "System.Object",
  209. "assembly": "mscorlib"
  210. },
  211. {
  212. "typename": "System.OperatingSystem",
  213. "assembly": "mscorlib"
  214. },
  215. {
  216. "typename": "System.PlatformID",
  217. "assembly": "mscorlib"
  218. },
  219. {
  220. "typename": "System.Reflection.Assembly",
  221. "assembly": "mscorlib"
  222. },
  223. {
  224. "typename": "System.Reflection.AssemblyCompanyAttribute",
  225. "assembly": "mscorlib"
  226. },
  227. {
  228. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  229. "assembly": "mscorlib"
  230. },
  231. {
  232. "typename": "System.Reflection.AssemblyDefaultAliasAttribute",
  233. "assembly": "mscorlib"
  234. },
  235. {
  236. "typename": "System.Reflection.AssemblyDelaySignAttribute",
  237. "assembly": "mscorlib"
  238. },
  239. {
  240. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  241. "assembly": "mscorlib"
  242. },
  243. {
  244. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  245. "assembly": "mscorlib"
  246. },
  247. {
  248. "typename": "System.Reflection.AssemblyInformationalVersionAttribute",
  249. "assembly": "mscorlib"
  250. },
  251. {
  252. "typename": "System.Reflection.AssemblyKeyFileAttribute",
  253. "assembly": "mscorlib"
  254. },
  255. {
  256. "typename": "System.Reflection.AssemblyName",
  257. "assembly": "mscorlib"
  258. },
  259. {
  260. "typename": "System.Reflection.AssemblyProductAttribute",
  261. "assembly": "mscorlib"
  262. },
  263. {
  264. "typename": "System.Reflection.AssemblyTitleAttribute",
  265. "assembly": "mscorlib"
  266. },
  267. {
  268. "typename": "System.Reflection.AssemblyVersionAttribute",
  269. "assembly": "mscorlib"
  270. },
  271. {
  272. "typename": "System.Reflection.ConstructorInfo",
  273. "assembly": "mscorlib"
  274. },
  275. {
  276. "typename": "System.Reflection.CustomAttributeData",
  277. "assembly": "mscorlib"
  278. },
  279. {
  280. "typename": "System.Reflection.CustomAttributeTypedArgument",
  281. "assembly": "mscorlib"
  282. },
  283. {
  284. "typename": "System.Reflection.MemberInfo",
  285. "assembly": "mscorlib"
  286. },
  287. {
  288. "typename": "System.Reflection.ReflectionTypeLoadException",
  289. "assembly": "mscorlib"
  290. },
  291. {
  292. "typename": "System.Reflection.TargetInvocationException",
  293. "assembly": "mscorlib"
  294. },
  295. {
  296. "typename": "System.ResolveEventArgs",
  297. "assembly": "mscorlib"
  298. },
  299. {
  300. "typename": "System.ResolveEventHandler",
  301. "assembly": "mscorlib"
  302. },
  303. {
  304. "typename": "System.Resources.NeutralResourcesLanguageAttribute",
  305. "assembly": "mscorlib"
  306. },
  307. {
  308. "typename": "System.Resources.ResourceManager",
  309. "assembly": "mscorlib"
  310. },
  311. {
  312. "typename": "System.Resources.SatelliteContractVersionAttribute",
  313. "assembly": "mscorlib"
  314. },
  315. {
  316. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  317. "assembly": "mscorlib"
  318. },
  319. {
  320. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  321. "assembly": "mscorlib"
  322. },
  323. {
  324. "typename": "System.Runtime.InteropServices.AssemblyRegistrationFlags",
  325. "assembly": "mscorlib"
  326. },
  327. {
  328. "typename": "System.Runtime.InteropServices.COMException",
  329. "assembly": "mscorlib"
  330. },
  331. {
  332. "typename": "System.Runtime.InteropServices.ComImportAttribute",
  333. "assembly": "mscorlib"
  334. },
  335. {
  336. "typename": "System.Runtime.InteropServices.ComInterfaceType",
  337. "assembly": "mscorlib"
  338. },
  339. {
  340. "typename": "System.Runtime.InteropServices.ComTypes.ITypeLib",
  341. "assembly": "mscorlib"
  342. },
  343. {
  344. "typename": "System.Runtime.InteropServices.ComTypes.SYSKIND",
  345. "assembly": "mscorlib"
  346. },
  347. {
  348. "typename": "System.Runtime.InteropServices.ComTypes.TYPELIBATTR",
  349. "assembly": "mscorlib"
  350. },
  351. {
  352. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  353. "assembly": "mscorlib"
  354. },
  355. {
  356. "typename": "System.Runtime.InteropServices.DllImportAttribute",
  357. "assembly": "mscorlib"
  358. },
  359. {
  360. "typename": "System.Runtime.InteropServices.ExporterEventKind",
  361. "assembly": "mscorlib"
  362. },
  363. {
  364. "typename": "System.Runtime.InteropServices.ExternalException",
  365. "assembly": "mscorlib"
  366. },
  367. {
  368. "typename": "System.Runtime.InteropServices.GuidAttribute",
  369. "assembly": "mscorlib"
  370. },
  371. {
  372. "typename": "System.Runtime.InteropServices.ITypeLibConverter",
  373. "assembly": "mscorlib"
  374. },
  375. {
  376. "typename": "System.Runtime.InteropServices.ITypeLibExporterNotifySink",
  377. "assembly": "mscorlib"
  378. },
  379. {
  380. "typename": "System.Runtime.InteropServices.ImportedFromTypeLibAttribute",
  381. "assembly": "mscorlib"
  382. },
  383. {
  384. "typename": "System.Runtime.InteropServices.InterfaceTypeAttribute",
  385. "assembly": "mscorlib"
  386. },
  387. {
  388. "typename": "System.Runtime.InteropServices.Marshal",
  389. "assembly": "mscorlib"
  390. },
  391. {
  392. "typename": "System.Runtime.InteropServices.OutAttribute",
  393. "assembly": "mscorlib"
  394. },
  395. {
  396. "typename": "System.Runtime.InteropServices.PrimaryInteropAssemblyAttribute",
  397. "assembly": "mscorlib"
  398. },
  399. {
  400. "typename": "System.Runtime.InteropServices.RegistrationServices",
  401. "assembly": "mscorlib"
  402. },
  403. {
  404. "typename": "System.Runtime.InteropServices.TypeLibConverter",
  405. "assembly": "mscorlib"
  406. },
  407. {
  408. "typename": "System.Runtime.InteropServices.TypeLibExporterFlags",
  409. "assembly": "mscorlib"
  410. },
  411. {
  412. "typename": "System.Runtime.Remoting.ObjectHandle",
  413. "assembly": "mscorlib"
  414. },
  415. {
  416. "typename": "System.RuntimeTypeHandle",
  417. "assembly": "mscorlib"
  418. },
  419. {
  420. "typename": "System.Security.Policy.Evidence",
  421. "assembly": "mscorlib"
  422. },
  423. {
  424. "typename": "System.String",
  425. "assembly": "mscorlib"
  426. },
  427. {
  428. "typename": "System.StringComparison",
  429. "assembly": "mscorlib"
  430. },
  431. {
  432. "typename": "System.Text.Encoding",
  433. "assembly": "mscorlib"
  434. },
  435. {
  436. "typename": "System.Text.StringBuilder",
  437. "assembly": "mscorlib"
  438. },
  439. {
  440. "typename": "System.Threading.Thread",
  441. "assembly": "mscorlib"
  442. },
  443. {
  444. "typename": "System.Type",
  445. "assembly": "mscorlib"
  446. },
  447. {
  448. "typename": "System.UnauthorizedAccessException",
  449. "assembly": "mscorlib"
  450. },
  451. {
  452. "typename": "System.Version",
  453. "assembly": "mscorlib"
  454. }
  455. ]
  456. },
  457. "pe": {
  458. "peid_signatures": null,
  459. "imports": [
  460. {
  461. "imports": [
  462. {
  463. "name": "_CorExeMain",
  464. "address": "0x402000"
  465. }
  466. ],
  467. "dll": "mscoree.dll"
  468. }
  469. ],
  470. "digital_signers": null,
  471. "exported_dll_name": null,
  472. "actual_checksum": "0x00017539",
  473. "overlay": null,
  474. "imagebase": "0x00400000",
  475. "reported_checksum": "0x00017539",
  476. "icon_hash": null,
  477. "entrypoint": "0x0040b7de",
  478. "timestamp": "2010-09-29 03:57:06",
  479. "osversion": "4.0",
  480. "sections": [
  481. {
  482. "name": ".text",
  483. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  484. "virtual_address": "0x00002000",
  485. "size_of_data": "0x0000a000",
  486. "entropy": "5.29",
  487. "raw_address": "0x00001000",
  488. "virtual_size": "0x000097e4",
  489. "characteristics_raw": "0x60000020"
  490. },
  491. {
  492. "name": ".rsrc",
  493. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  494. "virtual_address": "0x0000c000",
  495. "size_of_data": "0x00001000",
  496. "entropy": "1.90",
  497. "raw_address": "0x0000b000",
  498. "virtual_size": "0x00000600",
  499. "characteristics_raw": "0x40000040"
  500. },
  501. {
  502. "name": ".reloc",
  503. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  504. "virtual_address": "0x0000e000",
  505. "size_of_data": "0x00001000",
  506. "entropy": "0.01",
  507. "raw_address": "0x0000c000",
  508. "virtual_size": "0x0000000c",
  509. "characteristics_raw": "0x42000040"
  510. }
  511. ],
  512. "resources": [],
  513. "dirents": [
  514. {
  515. "virtual_address": "0x00000000",
  516. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  517. "size": "0x00000000"
  518. },
  519. {
  520. "virtual_address": "0x0000b78c",
  521. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  522. "size": "0x0000004f"
  523. },
  524. {
  525. "virtual_address": "0x0000c000",
  526. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  527. "size": "0x00000600"
  528. },
  529. {
  530. "virtual_address": "0x00000000",
  531. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  532. "size": "0x00000000"
  533. },
  534. {
  535. "virtual_address": "0x00000000",
  536. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  537. "size": "0x00000000"
  538. },
  539. {
  540. "virtual_address": "0x0000e000",
  541. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  542. "size": "0x0000000c"
  543. },
  544. {
  545. "virtual_address": "0x0000b720",
  546. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  547. "size": "0x0000001c"
  548. },
  549. {
  550. "virtual_address": "0x00000000",
  551. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  552. "size": "0x00000000"
  553. },
  554. {
  555. "virtual_address": "0x00000000",
  556. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  557. "size": "0x00000000"
  558. },
  559. {
  560. "virtual_address": "0x00000000",
  561. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  562. "size": "0x00000000"
  563. },
  564. {
  565. "virtual_address": "0x00000000",
  566. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  567. "size": "0x00000000"
  568. },
  569. {
  570. "virtual_address": "0x00000000",
  571. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  572. "size": "0x00000000"
  573. },
  574. {
  575. "virtual_address": "0x00002000",
  576. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  577. "size": "0x00000008"
  578. },
  579. {
  580. "virtual_address": "0x00000000",
  581. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  582. "size": "0x00000000"
  583. },
  584. {
  585. "virtual_address": "0x00002008",
  586. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  587. "size": "0x00000048"
  588. },
  589. {
  590. "virtual_address": "0x00000000",
  591. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  592. "size": "0x00000000"
  593. }
  594. ],
  595. "exports": [],
  596. "guest_signers": {},
  597. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  598. "icon_fuzzy": null,
  599. "icon": null,
  600. "pdbpath": "RegAsm.pdb",
  601. "imported_dll_count": 1,
  602. "versioninfo": []
  603. }
  604. }
  605.  
  606. [*] Resolved APIs: [
  607. "advapi32.dll.RegOpenKeyExW",
  608. "advapi32.dll.RegQueryInfoKeyW",
  609. "advapi32.dll.RegEnumKeyExW",
  610. "advapi32.dll.RegEnumValueW",
  611. "advapi32.dll.RegCloseKey",
  612. "advapi32.dll.RegQueryValueExW",
  613. "kernel32.dll.QueryActCtxW",
  614. "shlwapi.dll.UrlIsW",
  615. "kernel32.dll.FlsAlloc",
  616. "kernel32.dll.FlsGetValue",
  617. "kernel32.dll.FlsSetValue",
  618. "kernel32.dll.FlsFree",
  619. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  620. "kernel32.dll.IsProcessorFeaturePresent",
  621. "msvcrt.dll._set_error_mode",
  622. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  623. "kernel32.dll.FindActCtxSectionStringW",
  624. "kernel32.dll.GetSystemWindowsDirectoryW",
  625. "mscoree.dll.GetProcessExecutableHeap",
  626. "mscorwks.dll._CorExeMain",
  627. "mscorwks.dll.GetCLRFunction",
  628. "advapi32.dll.RegisterTraceGuidsW",
  629. "advapi32.dll.UnregisterTraceGuids",
  630. "advapi32.dll.GetTraceLoggerHandle",
  631. "advapi32.dll.GetTraceEnableLevel",
  632. "advapi32.dll.GetTraceEnableFlags",
  633. "advapi32.dll.TraceEvent",
  634. "mscoree.dll.IEE",
  635. "mscorwks.dll.IEE",
  636. "mscoree.dll.GetStartupFlags",
  637. "mscoree.dll.GetHostConfigurationFile",
  638. "mscoree.dll.GetCORSystemDirectory",
  639. "ntdll.dll.RtlUnwind",
  640. "kernel32.dll.IsWow64Process",
  641. "advapi32.dll.AllocateAndInitializeSid",
  642. "advapi32.dll.OpenProcessToken",
  643. "advapi32.dll.GetTokenInformation",
  644. "advapi32.dll.InitializeAcl",
  645. "advapi32.dll.AddAccessAllowedAce",
  646. "advapi32.dll.FreeSid",
  647. "kernel32.dll.SetThreadStackGuarantee",
  648. "kernel32.dll.AddVectoredContinueHandler",
  649. "kernel32.dll.RemoveVectoredContinueHandler",
  650. "advapi32.dll.ConvertSidToStringSidW",
  651. "shell32.dll.SHGetFolderPathW",
  652. "kernel32.dll.FlushProcessWriteBuffers",
  653. "kernel32.dll.GetWriteWatch",
  654. "kernel32.dll.ResetWriteWatch",
  655. "kernel32.dll.CreateMemoryResourceNotification",
  656. "kernel32.dll.QueryMemoryResourceNotification",
  657. "ole32.dll.CoInitializeEx",
  658. "cryptbase.dll.SystemFunction036",
  659. "ole32.dll.CoGetContextToken",
  660. "advapi32.dll.CryptAcquireContextA",
  661. "advapi32.dll.CryptReleaseContext",
  662. "advapi32.dll.CryptCreateHash",
  663. "advapi32.dll.CryptDestroyHash",
  664. "advapi32.dll.CryptHashData",
  665. "advapi32.dll.CryptGetHashParam",
  666. "advapi32.dll.CryptImportKey",
  667. "advapi32.dll.CryptExportKey",
  668. "advapi32.dll.CryptGenKey",
  669. "advapi32.dll.CryptGetKeyParam",
  670. "advapi32.dll.CryptDestroyKey",
  671. "advapi32.dll.CryptVerifySignatureA",
  672. "advapi32.dll.CryptSignHashA",
  673. "advapi32.dll.CryptGetProvParam",
  674. "advapi32.dll.CryptGetUserKey",
  675. "advapi32.dll.CryptEnumProvidersA",
  676. "kernel32.dll.GetFullPathNameW",
  677. "kernel32.dll.GetVersionExW",
  678. "mscorjit.dll.getJit",
  679. "kernel32.dll.GetUserDefaultUILanguage",
  680. "kernel32.dll.GetConsoleOutputCP",
  681. "kernel32.dll.UnmapViewOfFile",
  682. "kernel32.dll.CloseHandle",
  683. "kernel32.dll.GetStdHandle",
  684. "kernel32.dll.WriteFile",
  685. "ole32.dll.CoUninitialize",
  686. "kernel32.dll.CreateActCtxW",
  687. "kernel32.dll.AddRefActCtx",
  688. "kernel32.dll.ReleaseActCtx",
  689. "kernel32.dll.ActivateActCtx",
  690. "kernel32.dll.DeactivateActCtx",
  691. "kernel32.dll.GetCurrentActCtx"
  692. ]
  693.  
  694. [*] Static Analysis: {
  695. "dotnet": {
  696. "customattrs": null,
  697. "assemblyinfo": {
  698. "version": "2.0.0.0",
  699. "name": "RegAsm"
  700. },
  701. "assemblyrefs": [
  702. {
  703. "version": "2.0.0.0",
  704. "name": "mscorlib"
  705. }
  706. ],
  707. "typerefs": [
  708. {
  709. "typename": "System.AppDomain",
  710. "assembly": "mscorlib"
  711. },
  712. {
  713. "typename": "System.AppDomainSetup",
  714. "assembly": "mscorlib"
  715. },
  716. {
  717. "typename": "System.ApplicationException",
  718. "assembly": "mscorlib"
  719. },
  720. {
  721. "typename": "System.Array",
  722. "assembly": "mscorlib"
  723. },
  724. {
  725. "typename": "System.BadImageFormatException",
  726. "assembly": "mscorlib"
  727. },
  728. {
  729. "typename": "System.Boolean",
  730. "assembly": "mscorlib"
  731. },
  732. {
  733. "typename": "System.CLSCompliantAttribute",
  734. "assembly": "mscorlib"
  735. },
  736. {
  737. "typename": "System.Char",
  738. "assembly": "mscorlib"
  739. },
  740. {
  741. "typename": "System.Collections.Generic.ICollection`1",
  742. "assembly": "mscorlib"
  743. },
  744. {
  745. "typename": "System.Collections.Generic.IList`1",
  746. "assembly": "mscorlib"
  747. },
  748. {
  749. "typename": "System.Console",
  750. "assembly": "mscorlib"
  751. },
  752. {
  753. "typename": "System.Diagnostics.DebuggableAttribute",
  754. "assembly": "mscorlib"
  755. },
  756. {
  757. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  758. "assembly": "mscorlib"
  759. },
  760. {
  761. "typename": "System.Enum",
  762. "assembly": "mscorlib"
  763. },
  764. {
  765. "typename": "System.Environment",
  766. "assembly": "mscorlib"
  767. },
  768. {
  769. "typename": "System.Exception",
  770. "assembly": "mscorlib"
  771. },
  772. {
  773. "typename": "System.Globalization.CultureInfo",
  774. "assembly": "mscorlib"
  775. },
  776. {
  777. "typename": "System.Globalization.TextInfo",
  778. "assembly": "mscorlib"
  779. },
  780. {
  781. "typename": "System.Guid",
  782. "assembly": "mscorlib"
  783. },
  784. {
  785. "typename": "System.IFormatProvider",
  786. "assembly": "mscorlib"
  787. },
  788. {
  789. "typename": "System.IO.Directory",
  790. "assembly": "mscorlib"
  791. },
  792. {
  793. "typename": "System.IO.DirectoryInfo",
  794. "assembly": "mscorlib"
  795. },
  796. {
  797. "typename": "System.IO.File",
  798. "assembly": "mscorlib"
  799. },
  800. {
  801. "typename": "System.IO.FileInfo",
  802. "assembly": "mscorlib"
  803. },
  804. {
  805. "typename": "System.IO.FileNotFoundException",
  806. "assembly": "mscorlib"
  807. },
  808. {
  809. "typename": "System.IO.FileStream",
  810. "assembly": "mscorlib"
  811. },
  812. {
  813. "typename": "System.IO.FileSystemInfo",
  814. "assembly": "mscorlib"
  815. },
  816. {
  817. "typename": "System.IO.Path",
  818. "assembly": "mscorlib"
  819. },
  820. {
  821. "typename": "System.IO.Stream",
  822. "assembly": "mscorlib"
  823. },
  824. {
  825. "typename": "System.IO.TextWriter",
  826. "assembly": "mscorlib"
  827. },
  828. {
  829. "typename": "System.Int32",
  830. "assembly": "mscorlib"
  831. },
  832. {
  833. "typename": "System.IntPtr",
  834. "assembly": "mscorlib"
  835. },
  836. {
  837. "typename": "System.MarshalByRefObject",
  838. "assembly": "mscorlib"
  839. },
  840. {
  841. "typename": "System.Object",
  842. "assembly": "mscorlib"
  843. },
  844. {
  845. "typename": "System.OperatingSystem",
  846. "assembly": "mscorlib"
  847. },
  848. {
  849. "typename": "System.PlatformID",
  850. "assembly": "mscorlib"
  851. },
  852. {
  853. "typename": "System.Reflection.Assembly",
  854. "assembly": "mscorlib"
  855. },
  856. {
  857. "typename": "System.Reflection.AssemblyCompanyAttribute",
  858. "assembly": "mscorlib"
  859. },
  860. {
  861. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  862. "assembly": "mscorlib"
  863. },
  864. {
  865. "typename": "System.Reflection.AssemblyDefaultAliasAttribute",
  866. "assembly": "mscorlib"
  867. },
  868. {
  869. "typename": "System.Reflection.AssemblyDelaySignAttribute",
  870. "assembly": "mscorlib"
  871. },
  872. {
  873. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  874. "assembly": "mscorlib"
  875. },
  876. {
  877. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  878. "assembly": "mscorlib"
  879. },
  880. {
  881. "typename": "System.Reflection.AssemblyInformationalVersionAttribute",
  882. "assembly": "mscorlib"
  883. },
  884. {
  885. "typename": "System.Reflection.AssemblyKeyFileAttribute",
  886. "assembly": "mscorlib"
  887. },
  888. {
  889. "typename": "System.Reflection.AssemblyName",
  890. "assembly": "mscorlib"
  891. },
  892. {
  893. "typename": "System.Reflection.AssemblyProductAttribute",
  894. "assembly": "mscorlib"
  895. },
  896. {
  897. "typename": "System.Reflection.AssemblyTitleAttribute",
  898. "assembly": "mscorlib"
  899. },
  900. {
  901. "typename": "System.Reflection.AssemblyVersionAttribute",
  902. "assembly": "mscorlib"
  903. },
  904. {
  905. "typename": "System.Reflection.ConstructorInfo",
  906. "assembly": "mscorlib"
  907. },
  908. {
  909. "typename": "System.Reflection.CustomAttributeData",
  910. "assembly": "mscorlib"
  911. },
  912. {
  913. "typename": "System.Reflection.CustomAttributeTypedArgument",
  914. "assembly": "mscorlib"
  915. },
  916. {
  917. "typename": "System.Reflection.MemberInfo",
  918. "assembly": "mscorlib"
  919. },
  920. {
  921. "typename": "System.Reflection.ReflectionTypeLoadException",
  922. "assembly": "mscorlib"
  923. },
  924. {
  925. "typename": "System.Reflection.TargetInvocationException",
  926. "assembly": "mscorlib"
  927. },
  928. {
  929. "typename": "System.ResolveEventArgs",
  930. "assembly": "mscorlib"
  931. },
  932. {
  933. "typename": "System.ResolveEventHandler",
  934. "assembly": "mscorlib"
  935. },
  936. {
  937. "typename": "System.Resources.NeutralResourcesLanguageAttribute",
  938. "assembly": "mscorlib"
  939. },
  940. {
  941. "typename": "System.Resources.ResourceManager",
  942. "assembly": "mscorlib"
  943. },
  944. {
  945. "typename": "System.Resources.SatelliteContractVersionAttribute",
  946. "assembly": "mscorlib"
  947. },
  948. {
  949. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  950. "assembly": "mscorlib"
  951. },
  952. {
  953. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  954. "assembly": "mscorlib"
  955. },
  956. {
  957. "typename": "System.Runtime.InteropServices.AssemblyRegistrationFlags",
  958. "assembly": "mscorlib"
  959. },
  960. {
  961. "typename": "System.Runtime.InteropServices.COMException",
  962. "assembly": "mscorlib"
  963. },
  964. {
  965. "typename": "System.Runtime.InteropServices.ComImportAttribute",
  966. "assembly": "mscorlib"
  967. },
  968. {
  969. "typename": "System.Runtime.InteropServices.ComInterfaceType",
  970. "assembly": "mscorlib"
  971. },
  972. {
  973. "typename": "System.Runtime.InteropServices.ComTypes.ITypeLib",
  974. "assembly": "mscorlib"
  975. },
  976. {
  977. "typename": "System.Runtime.InteropServices.ComTypes.SYSKIND",
  978. "assembly": "mscorlib"
  979. },
  980. {
  981. "typename": "System.Runtime.InteropServices.ComTypes.TYPELIBATTR",
  982. "assembly": "mscorlib"
  983. },
  984. {
  985. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  986. "assembly": "mscorlib"
  987. },
  988. {
  989. "typename": "System.Runtime.InteropServices.DllImportAttribute",
  990. "assembly": "mscorlib"
  991. },
  992. {
  993. "typename": "System.Runtime.InteropServices.ExporterEventKind",
  994. "assembly": "mscorlib"
  995. },
  996. {
  997. "typename": "System.Runtime.InteropServices.ExternalException",
  998. "assembly": "mscorlib"
  999. },
  1000. {
  1001. "typename": "System.Runtime.InteropServices.GuidAttribute",
  1002. "assembly": "mscorlib"
  1003. },
  1004. {
  1005. "typename": "System.Runtime.InteropServices.ITypeLibConverter",
  1006. "assembly": "mscorlib"
  1007. },
  1008. {
  1009. "typename": "System.Runtime.InteropServices.ITypeLibExporterNotifySink",
  1010. "assembly": "mscorlib"
  1011. },
  1012. {
  1013. "typename": "System.Runtime.InteropServices.ImportedFromTypeLibAttribute",
  1014. "assembly": "mscorlib"
  1015. },
  1016. {
  1017. "typename": "System.Runtime.InteropServices.InterfaceTypeAttribute",
  1018. "assembly": "mscorlib"
  1019. },
  1020. {
  1021. "typename": "System.Runtime.InteropServices.Marshal",
  1022. "assembly": "mscorlib"
  1023. },
  1024. {
  1025. "typename": "System.Runtime.InteropServices.OutAttribute",
  1026. "assembly": "mscorlib"
  1027. },
  1028. {
  1029. "typename": "System.Runtime.InteropServices.PrimaryInteropAssemblyAttribute",
  1030. "assembly": "mscorlib"
  1031. },
  1032. {
  1033. "typename": "System.Runtime.InteropServices.RegistrationServices",
  1034. "assembly": "mscorlib"
  1035. },
  1036. {
  1037. "typename": "System.Runtime.InteropServices.TypeLibConverter",
  1038. "assembly": "mscorlib"
  1039. },
  1040. {
  1041. "typename": "System.Runtime.InteropServices.TypeLibExporterFlags",
  1042. "assembly": "mscorlib"
  1043. },
  1044. {
  1045. "typename": "System.Runtime.Remoting.ObjectHandle",
  1046. "assembly": "mscorlib"
  1047. },
  1048. {
  1049. "typename": "System.RuntimeTypeHandle",
  1050. "assembly": "mscorlib"
  1051. },
  1052. {
  1053. "typename": "System.Security.Policy.Evidence",
  1054. "assembly": "mscorlib"
  1055. },
  1056. {
  1057. "typename": "System.String",
  1058. "assembly": "mscorlib"
  1059. },
  1060. {
  1061. "typename": "System.StringComparison",
  1062. "assembly": "mscorlib"
  1063. },
  1064. {
  1065. "typename": "System.Text.Encoding",
  1066. "assembly": "mscorlib"
  1067. },
  1068. {
  1069. "typename": "System.Text.StringBuilder",
  1070. "assembly": "mscorlib"
  1071. },
  1072. {
  1073. "typename": "System.Threading.Thread",
  1074. "assembly": "mscorlib"
  1075. },
  1076. {
  1077. "typename": "System.Type",
  1078. "assembly": "mscorlib"
  1079. },
  1080. {
  1081. "typename": "System.UnauthorizedAccessException",
  1082. "assembly": "mscorlib"
  1083. },
  1084. {
  1085. "typename": "System.Version",
  1086. "assembly": "mscorlib"
  1087. }
  1088. ]
  1089. },
  1090. "pe": {
  1091. "peid_signatures": null,
  1092. "imports": [
  1093. {
  1094. "imports": [
  1095. {
  1096. "name": "_CorExeMain",
  1097. "address": "0x402000"
  1098. }
  1099. ],
  1100. "dll": "mscoree.dll"
  1101. }
  1102. ],
  1103. "digital_signers": null,
  1104. "exported_dll_name": null,
  1105. "actual_checksum": "0x00017539",
  1106. "overlay": null,
  1107. "imagebase": "0x00400000",
  1108. "reported_checksum": "0x00017539",
  1109. "icon_hash": null,
  1110. "entrypoint": "0x0040b7de",
  1111. "timestamp": "2010-09-29 03:57:06",
  1112. "osversion": "4.0",
  1113. "sections": [
  1114. {
  1115. "name": ".text",
  1116. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1117. "virtual_address": "0x00002000",
  1118. "size_of_data": "0x0000a000",
  1119. "entropy": "5.29",
  1120. "raw_address": "0x00001000",
  1121. "virtual_size": "0x000097e4",
  1122. "characteristics_raw": "0x60000020"
  1123. },
  1124. {
  1125. "name": ".rsrc",
  1126. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1127. "virtual_address": "0x0000c000",
  1128. "size_of_data": "0x00001000",
  1129. "entropy": "1.90",
  1130. "raw_address": "0x0000b000",
  1131. "virtual_size": "0x00000600",
  1132. "characteristics_raw": "0x40000040"
  1133. },
  1134. {
  1135. "name": ".reloc",
  1136. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1137. "virtual_address": "0x0000e000",
  1138. "size_of_data": "0x00001000",
  1139. "entropy": "0.01",
  1140. "raw_address": "0x0000c000",
  1141. "virtual_size": "0x0000000c",
  1142. "characteristics_raw": "0x42000040"
  1143. }
  1144. ],
  1145. "resources": [],
  1146. "dirents": [
  1147. {
  1148. "virtual_address": "0x00000000",
  1149. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1150. "size": "0x00000000"
  1151. },
  1152. {
  1153. "virtual_address": "0x0000b78c",
  1154. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1155. "size": "0x0000004f"
  1156. },
  1157. {
  1158. "virtual_address": "0x0000c000",
  1159. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1160. "size": "0x00000600"
  1161. },
  1162. {
  1163. "virtual_address": "0x00000000",
  1164. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1165. "size": "0x00000000"
  1166. },
  1167. {
  1168. "virtual_address": "0x00000000",
  1169. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1170. "size": "0x00000000"
  1171. },
  1172. {
  1173. "virtual_address": "0x0000e000",
  1174. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1175. "size": "0x0000000c"
  1176. },
  1177. {
  1178. "virtual_address": "0x0000b720",
  1179. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1180. "size": "0x0000001c"
  1181. },
  1182. {
  1183. "virtual_address": "0x00000000",
  1184. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1185. "size": "0x00000000"
  1186. },
  1187. {
  1188. "virtual_address": "0x00000000",
  1189. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1190. "size": "0x00000000"
  1191. },
  1192. {
  1193. "virtual_address": "0x00000000",
  1194. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1195. "size": "0x00000000"
  1196. },
  1197. {
  1198. "virtual_address": "0x00000000",
  1199. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1200. "size": "0x00000000"
  1201. },
  1202. {
  1203. "virtual_address": "0x00000000",
  1204. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1205. "size": "0x00000000"
  1206. },
  1207. {
  1208. "virtual_address": "0x00002000",
  1209. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1210. "size": "0x00000008"
  1211. },
  1212. {
  1213. "virtual_address": "0x00000000",
  1214. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1215. "size": "0x00000000"
  1216. },
  1217. {
  1218. "virtual_address": "0x00002008",
  1219. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1220. "size": "0x00000048"
  1221. },
  1222. {
  1223. "virtual_address": "0x00000000",
  1224. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1225. "size": "0x00000000"
  1226. }
  1227. ],
  1228. "exports": [],
  1229. "guest_signers": {},
  1230. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1231. "icon_fuzzy": null,
  1232. "icon": null,
  1233. "pdbpath": "RegAsm.pdb",
  1234. "imported_dll_count": 1,
  1235. "versioninfo": []
  1236. }
  1237. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!