API tools faq
paste
paladin316

file_11_2019-07-02_18_30.json

paladin316
Jul 2nd, 2019
2,171
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 77.38 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Cobaltstrike"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "file.11"
  7. [*] File Size: 210944
  8. [*] File Type: "MS-DOS executable"
  9. [*] SHA256: "d3deea72beee86e60a03950308eb725e28116593e3ce0333febf194565a73a0a"
  10. [*] MD5: "fc5bf675c2d4c2a52d5b614a32b3cd52"
  11. [*] SHA1: "44d56f78c60dbb260e09fcf23ce3bad9d7e42507"
  12. [*] SHA512: "df869b9e0a26c6f316bbe8dba45523d84f6838cc2e0bbb2633e8ee16b7b46562d3a030d2c6c598efe55fc91cdc90c481190c28b6ce9405d89c3b7fe307861c7c"
  13. [*] CRC32: "B7E551A4"
  14. [*] SSDEEP: "3072:nryYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtHL5AuN:lXkiq4wfv4Kjnv+srwoud"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "File has been identified by 48 Antiviruses on VirusTotal as malicious",
  21. "Details": [
  22. {
  23. "MicroWorld-eScan": "Trojan.CobaltStrike.E"
  24. },
  25. {
  26. "FireEye": "Generic.mg.fc5bf675c2d4c2a5"
  27. },
  28. {
  29. "CAT-QuickHeal": "Trojan.GenericPMF.S4808331"
  30. },
  31. {
  32. "McAfee": "CobaltStr-FDWE!FC5BF675C2D4"
  33. },
  34. {
  35. "Zillya": "Tool.CobaltStrike.Win32.19"
  36. },
  37. {
  38. "CrowdStrike": "win/malicious_confidence_100% (D)"
  39. },
  40. {
  41. "K7GW": "Riskware ( 0050f89b1 )"
  42. },
  43. {
  44. "K7AntiVirus": "Riskware ( 0050f89b1 )"
  45. },
  46. {
  47. "Arcabit": "Trojan.CobaltStrike.E"
  48. },
  49. {
  50. "Invincea": "heuristic"
  51. },
  52. {
  53. "NANO-Antivirus": "Trojan.Win32.Inject.fiptsw"
  54. },
  55. {
  56. "F-Prot": "W32/S-2d1b851e!Eldorado"
  57. },
  58. {
  59. "Symantec": "ML.Attribute.HighConfidence"
  60. },
  61. {
  62. "APEX": "Malicious"
  63. },
  64. {
  65. "Paloalto": "generic.ml"
  66. },
  67. {
  68. "Kaspersky": "HEUR:HackTool.Win32.Inject.heur"
  69. },
  70. {
  71. "BitDefender": "Trojan.CobaltStrike.E"
  72. },
  73. {
  74. "Avast": "Win32:Malware-gen"
  75. },
  76. {
  77. "Endgame": "malicious (high confidence)"
  78. },
  79. {
  80. "Emsisoft": "Trojan.CobaltStrike.E (B)"
  81. },
  82. {
  83. "F-Secure": "Trojan.TR/Proxy.Gen"
  84. },
  85. {
  86. "DrWeb": "BackDoor.Meterpreter.67"
  87. },
  88. {
  89. "McAfee-GW-Edition": "CobaltStr-FDWE!FC5BF675C2D4"
  90. },
  91. {
  92. "Trapmine": "malicious.high.ml.score"
  93. },
  94. {
  95. "Sophos": "Mal/Swrort-Y"
  96. },
  97. {
  98. "Ikarus": "Virus.Win32.Atosev"
  99. },
  100. {
  101. "Cyren": "W32/S-2d1b851e!Eldorado"
  102. },
  103. {
  104. "Jiangmin": "HackTool.Inject.bmx"
  105. },
  106. {
  107. "MaxSecure": "Trojan.Malware.73756026.susgen"
  108. },
  109. {
  110. "Avira": "TR/Proxy.Gen"
  111. },
  112. {
  113. "MAX": "malware (ai score=84)"
  114. },
  115. {
  116. "Antiy-AVL": "HackTool/Win32.Inject"
  117. },
  118. {
  119. "Microsoft": "VirTool:Win32/Atosev.A"
  120. },
  121. {
  122. "ZoneAlarm": "HEUR:HackTool.Win32.Inject.heur"
  123. },
  124. {
  125. "GData": "Trojan.CobaltStrike.E"
  126. },
  127. {
  128. "AhnLab-V3": "HackTool/Win32.Cobalt.R218043"
  129. },
  130. {
  131. "Acronis": "suspicious"
  132. },
  133. {
  134. "VBA32": "BScope.Trojan.Cometer"
  135. },
  136. {
  137. "ALYac": "Trojan.CobaltStrike.E"
  138. },
  139. {
  140. "Ad-Aware": "Trojan.CobaltStrike.E"
  141. },
  142. {
  143. "Cylance": "Unsafe"
  144. },
  145. {
  146. "ESET-NOD32": "a variant of Win32/RiskWare.CobaltStrike.Beacon.A"
  147. },
  148. {
  149. "Rising": "HackTool.Swrort!1.6477 (C64:YzY0OsgFx7Qx62jx)"
  150. },
  151. {
  152. "Yandex": "RiskWare.CobaltStrike!"
  153. },
  154. {
  155. "SentinelOne": "DFI - Malicious PE"
  156. },
  157. {
  158. "eGambit": "Trojan.Generic"
  159. },
  160. {
  161. "AVG": "Win32:Malware-gen"
  162. },
  163. {
  164. "Panda": "Trj/Genetic.gen"
  165. }
  166. ]
  167. }
  168. ]
  169.  
  170. [*] Started Service: []
  171.  
  172. [*] Executed Commands: []
  173.  
  174. [*] Mutexes: []
  175.  
  176. [*] Modified Files: []
  177.  
  178. [*] Deleted Files: []
  179.  
  180. [*] Modified Registry Keys: []
  181.  
  182. [*] Deleted Registry Keys: []
  183.  
  184. [*] DNS Communications: []
  185.  
  186. [*] Domains: []
  187.  
  188. [*] Network Communication - ICMP: []
  189.  
  190. [*] Network Communication - HTTP: []
  191.  
  192. [*] Network Communication - SMTP: []
  193.  
  194. [*] Network Communication - Hosts: []
  195.  
  196. [*] Network Communication - IRC: []
  197.  
  198. [*] Static Analysis: {
  199. "pe": {
  200. "peid_signatures": null,
  201. "imports": [
  202. {
  203. "imports": [
  204. {
  205. "name": "UpdateProcThreadAttribute",
  206. "address": "0x100260b0"
  207. },
  208. {
  209. "name": "HeapFree",
  210. "address": "0x100260b4"
  211. },
  212. {
  213. "name": "GetProcessHeap",
  214. "address": "0x100260b8"
  215. },
  216. {
  217. "name": "CreateRemoteThread",
  218. "address": "0x100260bc"
  219. },
  220. {
  221. "name": "VirtualAlloc",
  222. "address": "0x100260c0"
  223. },
  224. {
  225. "name": "VirtualProtectEx",
  226. "address": "0x100260c4"
  227. },
  228. {
  229. "name": "VirtualAllocEx",
  230. "address": "0x100260c8"
  231. },
  232. {
  233. "name": "LoadLibraryA",
  234. "address": "0x100260cc"
  235. },
  236. {
  237. "name": "ProcessIdToSessionId",
  238. "address": "0x100260d0"
  239. },
  240. {
  241. "name": "DuplicateHandle",
  242. "address": "0x100260d4"
  243. },
  244. {
  245. "name": "InitializeProcThreadAttributeList",
  246. "address": "0x100260d8"
  247. },
  248. {
  249. "name": "WriteProcessMemory",
  250. "address": "0x100260dc"
  251. },
  252. {
  253. "name": "CreateThread",
  254. "address": "0x100260e0"
  255. },
  256. {
  257. "name": "GetThreadContext",
  258. "address": "0x100260e4"
  259. },
  260. {
  261. "name": "SetThreadContext",
  262. "address": "0x100260e8"
  263. },
  264. {
  265. "name": "FreeLibrary",
  266. "address": "0x100260ec"
  267. },
  268. {
  269. "name": "VirtualFree",
  270. "address": "0x100260f0"
  271. },
  272. {
  273. "name": "Thread32First",
  274. "address": "0x100260f4"
  275. },
  276. {
  277. "name": "Thread32Next",
  278. "address": "0x100260f8"
  279. },
  280. {
  281. "name": "SetLastError",
  282. "address": "0x100260fc"
  283. },
  284. {
  285. "name": "OpenThread",
  286. "address": "0x10026100"
  287. },
  288. {
  289. "name": "CreateToolhelp32Snapshot",
  290. "address": "0x10026104"
  291. },
  292. {
  293. "name": "GetVersionExA",
  294. "address": "0x10026108"
  295. },
  296. {
  297. "name": "SuspendThread",
  298. "address": "0x1002610c"
  299. },
  300. {
  301. "name": "ResumeThread",
  302. "address": "0x10026110"
  303. },
  304. {
  305. "name": "PeekNamedPipe",
  306. "address": "0x10026114"
  307. },
  308. {
  309. "name": "WaitNamedPipeA",
  310. "address": "0x10026118"
  311. },
  312. {
  313. "name": "SetNamedPipeHandleState",
  314. "address": "0x1002611c"
  315. },
  316. {
  317. "name": "LocalAlloc",
  318. "address": "0x10026120"
  319. },
  320. {
  321. "name": "LocalFree",
  322. "address": "0x10026124"
  323. },
  324. {
  325. "name": "GetComputerNameA",
  326. "address": "0x10026128"
  327. },
  328. {
  329. "name": "Process32First",
  330. "address": "0x1002612c"
  331. },
  332. {
  333. "name": "TerminateProcess",
  334. "address": "0x10026130"
  335. },
  336. {
  337. "name": "HeapAlloc",
  338. "address": "0x10026134"
  339. },
  340. {
  341. "name": "ExitProcess",
  342. "address": "0x10026138"
  343. },
  344. {
  345. "name": "DeleteProcThreadAttributeList",
  346. "address": "0x1002613c"
  347. },
  348. {
  349. "name": "VirtualProtect",
  350. "address": "0x10026140"
  351. },
  352. {
  353. "name": "FindNextFileA",
  354. "address": "0x10026144"
  355. },
  356. {
  357. "name": "MoveFileA",
  358. "address": "0x10026148"
  359. },
  360. {
  361. "name": "FindClose",
  362. "address": "0x1002614c"
  363. },
  364. {
  365. "name": "CopyFileA",
  366. "address": "0x10026150"
  367. },
  368. {
  369. "name": "FindFirstFileA",
  370. "address": "0x10026154"
  371. },
  372. {
  373. "name": "FileTimeToSystemTime",
  374. "address": "0x10026158"
  375. },
  376. {
  377. "name": "GetFileAttributesA",
  378. "address": "0x1002615c"
  379. },
  380. {
  381. "name": "ExpandEnvironmentStringsA",
  382. "address": "0x10026160"
  383. },
  384. {
  385. "name": "GetLogicalDrives",
  386. "address": "0x10026164"
  387. },
  388. {
  389. "name": "SystemTimeToTzSpecificLocalTime",
  390. "address": "0x10026168"
  391. },
  392. {
  393. "name": "GetFullPathNameA",
  394. "address": "0x1002616c"
  395. },
  396. {
  397. "name": "GetModuleHandleA",
  398. "address": "0x10026170"
  399. },
  400. {
  401. "name": "CreateNamedPipeA",
  402. "address": "0x10026174"
  403. },
  404. {
  405. "name": "GetProcAddress",
  406. "address": "0x10026178"
  407. },
  408. {
  409. "name": "ReadFile",
  410. "address": "0x1002617c"
  411. },
  412. {
  413. "name": "GetCurrentThread",
  414. "address": "0x10026180"
  415. },
  416. {
  417. "name": "ConnectNamedPipe",
  418. "address": "0x10026184"
  419. },
  420. {
  421. "name": "GetCurrentProcess",
  422. "address": "0x10026188"
  423. },
  424. {
  425. "name": "CloseHandle",
  426. "address": "0x1002618c"
  427. },
  428. {
  429. "name": "GetFileTime",
  430. "address": "0x10026190"
  431. },
  432. {
  433. "name": "GetCurrentDirectoryA",
  434. "address": "0x10026194"
  435. },
  436. {
  437. "name": "CreatePipe",
  438. "address": "0x10026198"
  439. },
  440. {
  441. "name": "GetCurrentDirectoryW",
  442. "address": "0x1002619c"
  443. },
  444. {
  445. "name": "GetLastError",
  446. "address": "0x100261a0"
  447. },
  448. {
  449. "name": "GetStartupInfoA",
  450. "address": "0x100261a4"
  451. },
  452. {
  453. "name": "SetCurrentDirectoryA",
  454. "address": "0x100261a8"
  455. },
  456. {
  457. "name": "FlushFileBuffers",
  458. "address": "0x100261ac"
  459. },
  460. {
  461. "name": "DisconnectNamedPipe",
  462. "address": "0x100261b0"
  463. },
  464. {
  465. "name": "MultiByteToWideChar",
  466. "address": "0x100261b4"
  467. },
  468. {
  469. "name": "CreateProcessA",
  470. "address": "0x100261b8"
  471. },
  472. {
  473. "name": "OpenProcess",
  474. "address": "0x100261bc"
  475. },
  476. {
  477. "name": "WriteFile",
  478. "address": "0x100261c0"
  479. },
  480. {
  481. "name": "SetFileTime",
  482. "address": "0x100261c4"
  483. },
  484. {
  485. "name": "WaitForSingleObject",
  486. "address": "0x100261c8"
  487. },
  488. {
  489. "name": "SetEnvironmentVariableW",
  490. "address": "0x100261cc"
  491. },
  492. {
  493. "name": "CreateFileA",
  494. "address": "0x100261d0"
  495. },
  496. {
  497. "name": "Sleep",
  498. "address": "0x100261d4"
  499. },
  500. {
  501. "name": "SetEnvironmentVariableA",
  502. "address": "0x100261d8"
  503. },
  504. {
  505. "name": "CompareStringW",
  506. "address": "0x100261dc"
  507. },
  508. {
  509. "name": "CompareStringA",
  510. "address": "0x100261e0"
  511. },
  512. {
  513. "name": "SetEndOfFile",
  514. "address": "0x100261e4"
  515. },
  516. {
  517. "name": "GetStringTypeW",
  518. "address": "0x100261e8"
  519. },
  520. {
  521. "name": "GetStringTypeA",
  522. "address": "0x100261ec"
  523. },
  524. {
  525. "name": "LCMapStringW",
  526. "address": "0x100261f0"
  527. },
  528. {
  529. "name": "LCMapStringA",
  530. "address": "0x100261f4"
  531. },
  532. {
  533. "name": "VirtualQuery",
  534. "address": "0x100261f8"
  535. },
  536. {
  537. "name": "GetModuleFileNameW",
  538. "address": "0x100261fc"
  539. },
  540. {
  541. "name": "SetStdHandle",
  542. "address": "0x10026200"
  543. },
  544. {
  545. "name": "WriteConsoleW",
  546. "address": "0x10026204"
  547. },
  548. {
  549. "name": "GetConsoleOutputCP",
  550. "address": "0x10026208"
  551. },
  552. {
  553. "name": "WriteConsoleA",
  554. "address": "0x1002620c"
  555. },
  556. {
  557. "name": "GetLocaleInfoA",
  558. "address": "0x10026210"
  559. },
  560. {
  561. "name": "HeapSize",
  562. "address": "0x10026214"
  563. },
  564. {
  565. "name": "IsValidCodePage",
  566. "address": "0x10026218"
  567. },
  568. {
  569. "name": "GetCPInfo",
  570. "address": "0x1002621c"
  571. },
  572. {
  573. "name": "DebugBreak",
  574. "address": "0x10026220"
  575. },
  576. {
  577. "name": "RaiseException",
  578. "address": "0x10026224"
  579. },
  580. {
  581. "name": "QueryPerformanceCounter",
  582. "address": "0x10026228"
  583. },
  584. {
  585. "name": "GetEnvironmentStringsW",
  586. "address": "0x1002622c"
  587. },
  588. {
  589. "name": "FreeEnvironmentStringsW",
  590. "address": "0x10026230"
  591. },
  592. {
  593. "name": "GetCurrentProcessId",
  594. "address": "0x10026234"
  595. },
  596. {
  597. "name": "GetOEMCP",
  598. "address": "0x10026238"
  599. },
  600. {
  601. "name": "GetLocalTime",
  602. "address": "0x1002623c"
  603. },
  604. {
  605. "name": "GetACP",
  606. "address": "0x10026240"
  607. },
  608. {
  609. "name": "Process32Next",
  610. "address": "0x10026244"
  611. },
  612. {
  613. "name": "GetTickCount",
  614. "address": "0x10026248"
  615. },
  616. {
  617. "name": "GetEnvironmentStrings",
  618. "address": "0x1002624c"
  619. },
  620. {
  621. "name": "FreeEnvironmentStringsA",
  622. "address": "0x10026250"
  623. },
  624. {
  625. "name": "SetFilePointer",
  626. "address": "0x10026254"
  627. },
  628. {
  629. "name": "GetFileType",
  630. "address": "0x10026258"
  631. },
  632. {
  633. "name": "GetModuleHandleW",
  634. "address": "0x1002625c"
  635. },
  636. {
  637. "name": "DeleteFileA",
  638. "address": "0x10026260"
  639. },
  640. {
  641. "name": "CreateDirectoryA",
  642. "address": "0x10026264"
  643. },
  644. {
  645. "name": "RemoveDirectoryA",
  646. "address": "0x10026268"
  647. },
  648. {
  649. "name": "GetCurrentThreadId",
  650. "address": "0x1002626c"
  651. },
  652. {
  653. "name": "GetCommandLineA",
  654. "address": "0x10026270"
  655. },
  656. {
  657. "name": "GetSystemTimeAsFileTime",
  658. "address": "0x10026274"
  659. },
  660. {
  661. "name": "UnhandledExceptionFilter",
  662. "address": "0x10026278"
  663. },
  664. {
  665. "name": "SetUnhandledExceptionFilter",
  666. "address": "0x1002627c"
  667. },
  668. {
  669. "name": "IsDebuggerPresent",
  670. "address": "0x10026280"
  671. },
  672. {
  673. "name": "HeapCreate",
  674. "address": "0x10026284"
  675. },
  676. {
  677. "name": "HeapDestroy",
  678. "address": "0x10026288"
  679. },
  680. {
  681. "name": "DeleteCriticalSection",
  682. "address": "0x1002628c"
  683. },
  684. {
  685. "name": "LeaveCriticalSection",
  686. "address": "0x10026290"
  687. },
  688. {
  689. "name": "EnterCriticalSection",
  690. "address": "0x10026294"
  691. },
  692. {
  693. "name": "HeapReAlloc",
  694. "address": "0x10026298"
  695. },
  696. {
  697. "name": "GetStdHandle",
  698. "address": "0x1002629c"
  699. },
  700. {
  701. "name": "GetModuleFileNameA",
  702. "address": "0x100262a0"
  703. },
  704. {
  705. "name": "TlsGetValue",
  706. "address": "0x100262a4"
  707. },
  708. {
  709. "name": "TlsAlloc",
  710. "address": "0x100262a8"
  711. },
  712. {
  713. "name": "TlsSetValue",
  714. "address": "0x100262ac"
  715. },
  716. {
  717. "name": "TlsFree",
  718. "address": "0x100262b0"
  719. },
  720. {
  721. "name": "InterlockedIncrement",
  722. "address": "0x100262b4"
  723. },
  724. {
  725. "name": "InterlockedDecrement",
  726. "address": "0x100262b8"
  727. },
  728. {
  729. "name": "InitializeCriticalSectionAndSpinCount",
  730. "address": "0x100262bc"
  731. },
  732. {
  733. "name": "RtlUnwind",
  734. "address": "0x100262c0"
  735. },
  736. {
  737. "name": "WideCharToMultiByte",
  738. "address": "0x100262c4"
  739. },
  740. {
  741. "name": "GetConsoleCP",
  742. "address": "0x100262c8"
  743. },
  744. {
  745. "name": "GetConsoleMode",
  746. "address": "0x100262cc"
  747. },
  748. {
  749. "name": "SetHandleCount",
  750. "address": "0x100262d0"
  751. }
  752. ],
  753. "dll": "KERNEL32.dll"
  754. },
  755. {
  756. "imports": [
  757. {
  758. "name": "RegEnumValueA",
  759. "address": "0x10026000"
  760. },
  761. {
  762. "name": "CloseServiceHandle",
  763. "address": "0x10026004"
  764. },
  765. {
  766. "name": "OpenProcessToken",
  767. "address": "0x10026008"
  768. },
  769. {
  770. "name": "CreateProcessWithLogonW",
  771. "address": "0x1002600c"
  772. },
  773. {
  774. "name": "DeleteService",
  775. "address": "0x10026010"
  776. },
  777. {
  778. "name": "CryptReleaseContext",
  779. "address": "0x10026014"
  780. },
  781. {
  782. "name": "CryptAcquireContextA",
  783. "address": "0x10026018"
  784. },
  785. {
  786. "name": "CryptGenRandom",
  787. "address": "0x1002601c"
  788. },
  789. {
  790. "name": "LogonUserA",
  791. "address": "0x10026020"
  792. },
  793. {
  794. "name": "CheckTokenMembership",
  795. "address": "0x10026024"
  796. },
  797. {
  798. "name": "FreeSid",
  799. "address": "0x10026028"
  800. },
  801. {
  802. "name": "RevertToSelf",
  803. "address": "0x1002602c"
  804. },
  805. {
  806. "name": "AllocateAndInitializeSid",
  807. "address": "0x10026030"
  808. },
  809. {
  810. "name": "DuplicateTokenEx",
  811. "address": "0x10026034"
  812. },
  813. {
  814. "name": "LookupAccountSidA",
  815. "address": "0x10026038"
  816. },
  817. {
  818. "name": "GetTokenInformation",
  819. "address": "0x1002603c"
  820. },
  821. {
  822. "name": "SetSecurityDescriptorDacl",
  823. "address": "0x10026040"
  824. },
  825. {
  826. "name": "InitializeSecurityDescriptor",
  827. "address": "0x10026044"
  828. },
  829. {
  830. "name": "RegCloseKey",
  831. "address": "0x10026048"
  832. },
  833. {
  834. "name": "RegEnumKeyA",
  835. "address": "0x1002604c"
  836. },
  837. {
  838. "name": "CreateProcessAsUserA",
  839. "address": "0x10026050"
  840. },
  841. {
  842. "name": "RegOpenCurrentUser",
  843. "address": "0x10026054"
  844. },
  845. {
  846. "name": "RegOpenKeyExA",
  847. "address": "0x10026058"
  848. },
  849. {
  850. "name": "GetUserNameA",
  851. "address": "0x1002605c"
  852. },
  853. {
  854. "name": "AdjustTokenPrivileges",
  855. "address": "0x10026060"
  856. },
  857. {
  858. "name": "ControlService",
  859. "address": "0x10026064"
  860. },
  861. {
  862. "name": "QueryServiceStatusEx",
  863. "address": "0x10026068"
  864. },
  865. {
  866. "name": "ImpersonateNamedPipeClient",
  867. "address": "0x1002606c"
  868. },
  869. {
  870. "name": "ImpersonateLoggedOnUser",
  871. "address": "0x10026070"
  872. },
  873. {
  874. "name": "LookupPrivilegeValueA",
  875. "address": "0x10026074"
  876. },
  877. {
  878. "name": "OpenThreadToken",
  879. "address": "0x10026078"
  880. },
  881. {
  882. "name": "OpenServiceA",
  883. "address": "0x1002607c"
  884. },
  885. {
  886. "name": "OpenSCManagerA",
  887. "address": "0x10026080"
  888. },
  889. {
  890. "name": "QueryServiceStatus",
  891. "address": "0x10026084"
  892. },
  893. {
  894. "name": "CreateProcessWithTokenW",
  895. "address": "0x10026088"
  896. },
  897. {
  898. "name": "StartServiceA",
  899. "address": "0x1002608c"
  900. },
  901. {
  902. "name": "CreateServiceA",
  903. "address": "0x10026090"
  904. }
  905. ],
  906. "dll": "ADVAPI32.dll"
  907. },
  908. {
  909. "imports": [
  910. {
  911. "name": "HttpQueryInfoA",
  912. "address": "0x100262e8"
  913. },
  914. {
  915. "name": "InternetQueryDataAvailable",
  916. "address": "0x100262ec"
  917. },
  918. {
  919. "name": "InternetReadFile",
  920. "address": "0x100262f0"
  921. },
  922. {
  923. "name": "InternetSetOptionA",
  924. "address": "0x100262f4"
  925. },
  926. {
  927. "name": "HttpOpenRequestA",
  928. "address": "0x100262f8"
  929. },
  930. {
  931. "name": "HttpSendRequestA",
  932. "address": "0x100262fc"
  933. },
  934. {
  935. "name": "InternetOpenA",
  936. "address": "0x10026300"
  937. },
  938. {
  939. "name": "InternetCloseHandle",
  940. "address": "0x10026304"
  941. },
  942. {
  943. "name": "InternetQueryOptionA",
  944. "address": "0x10026308"
  945. },
  946. {
  947. "name": "InternetConnectA",
  948. "address": "0x1002630c"
  949. }
  950. ],
  951. "dll": "WININET.dll"
  952. },
  953. {
  954. "imports": [
  955. {
  956. "name": "ntohs",
  957. "address": "0x10026314"
  958. },
  959. {
  960. "name": "connect",
  961. "address": "0x10026318"
  962. },
  963. {
  964. "name": "htons",
  965. "address": "0x1002631c"
  966. },
  967. {
  968. "name": "socket",
  969. "address": "0x10026320"
  970. },
  971. {
  972. "name": "accept",
  973. "address": "0x10026324"
  974. },
  975. {
  976. "name": "send",
  977. "address": "0x10026328"
  978. },
  979. {
  980. "name": "gethostname",
  981. "address": "0x1002632c"
  982. },
  983. {
  984. "name": "inet_ntoa",
  985. "address": "0x10026330"
  986. },
  987. {
  988. "name": "WSAStartup",
  989. "address": "0x10026334"
  990. },
  991. {
  992. "name": "WSACleanup",
  993. "address": "0x10026338"
  994. },
  995. {
  996. "name": "gethostbyname",
  997. "address": "0x1002633c"
  998. },
  999. {
  1000. "name": "htonl",
  1001. "address": "0x10026340"
  1002. },
  1003. {
  1004. "name": "ntohl",
  1005. "address": "0x10026344"
  1006. },
  1007. {
  1008. "name": "listen",
  1009. "address": "0x10026348"
  1010. },
  1011. {
  1012. "name": "__WSAFDIsSet",
  1013. "address": "0x1002634c"
  1014. },
  1015. {
  1016. "name": "bind",
  1017. "address": "0x10026350"
  1018. },
  1019. {
  1020. "name": "recv",
  1021. "address": "0x10026354"
  1022. },
  1023. {
  1024. "name": "shutdown",
  1025. "address": "0x10026358"
  1026. },
  1027. {
  1028. "name": "WSAGetLastError",
  1029. "address": "0x1002635c"
  1030. },
  1031. {
  1032. "name": "select",
  1033. "address": "0x10026360"
  1034. },
  1035. {
  1036. "name": "ioctlsocket",
  1037. "address": "0x10026364"
  1038. },
  1039. {
  1040. "name": "inet_addr",
  1041. "address": "0x10026368"
  1042. },
  1043. {
  1044. "name": "closesocket",
  1045. "address": "0x1002636c"
  1046. }
  1047. ],
  1048. "dll": "WS2_32.dll"
  1049. },
  1050. {
  1051. "imports": [
  1052. {
  1053. "name": "DnsFree",
  1054. "address": "0x10026098"
  1055. },
  1056. {
  1057. "name": "DnsQuery_A",
  1058. "address": "0x1002609c"
  1059. }
  1060. ],
  1061. "dll": "DNSAPI.dll"
  1062. },
  1063. {
  1064. "imports": [
  1065. {
  1066. "name": "GetIfEntry",
  1067. "address": "0x100260a4"
  1068. },
  1069. {
  1070. "name": "GetIpAddrTable",
  1071. "address": "0x100260a8"
  1072. }
  1073. ],
  1074. "dll": "IPHLPAPI.DLL"
  1075. },
  1076. {
  1077. "imports": [
  1078. {
  1079. "name": "LsaCallAuthenticationPackage",
  1080. "address": "0x100262d8"
  1081. },
  1082. {
  1083. "name": "LsaConnectUntrusted",
  1084. "address": "0x100262dc"
  1085. },
  1086. {
  1087. "name": "LsaLookupAuthenticationPackage",
  1088. "address": "0x100262e0"
  1089. }
  1090. ],
  1091. "dll": "Secur32.dll"
  1092. }
  1093. ],
  1094. "digital_signers": null,
  1095. "exported_dll_name": "beacon.dll",
  1096. "actual_checksum": "0x00037e03",
  1097. "overlay": null,
  1098. "imagebase": "0x10000000",
  1099. "reported_checksum": "0x00000000",
  1100. "icon_hash": null,
  1101. "entrypoint": "0x10017771",
  1102. "timestamp": "2018-09-05 21:53:17",
  1103. "osversion": "5.0",
  1104. "sections": [
  1105. {
  1106. "name": ".text",
  1107. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1108. "virtual_address": "0x00001000",
  1109. "size_of_data": "0x00024e00",
  1110. "entropy": "6.64",
  1111. "raw_address": "0x00000400",
  1112. "virtual_size": "0x00024c0a",
  1113. "characteristics_raw": "0x60000020"
  1114. },
  1115. {
  1116. "name": ".rdata",
  1117. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1118. "virtual_address": "0x00026000",
  1119. "size_of_data": "0x0000a200",
  1120. "entropy": "6.81",
  1121. "raw_address": "0x00025200",
  1122. "virtual_size": "0x0000a1a1",
  1123. "characteristics_raw": "0x40000040"
  1124. },
  1125. {
  1126. "name": ".data",
  1127. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1128. "virtual_address": "0x00031000",
  1129. "size_of_data": "0x00002400",
  1130. "entropy": "3.03",
  1131. "raw_address": "0x0002f400",
  1132. "virtual_size": "0x0000ff40",
  1133. "characteristics_raw": "0xc0000040"
  1134. },
  1135. {
  1136. "name": ".reloc",
  1137. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1138. "virtual_address": "0x00041000",
  1139. "size_of_data": "0x00002000",
  1140. "entropy": "5.49",
  1141. "raw_address": "0x00031800",
  1142. "virtual_size": "0x00001e5a",
  1143. "characteristics_raw": "0x42000040"
  1144. }
  1145. ],
  1146. "resources": [],
  1147. "dirents": [
  1148. {
  1149. "virtual_address": "0x00030150",
  1150. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1151. "size": "0x00000051"
  1152. },
  1153. {
  1154. "virtual_address": "0x0002ee74",
  1155. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1156. "size": "0x000000a0"
  1157. },
  1158. {
  1159. "virtual_address": "0x00000000",
  1160. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1161. "size": "0x00000000"
  1162. },
  1163. {
  1164. "virtual_address": "0x00000000",
  1165. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1166. "size": "0x00000000"
  1167. },
  1168. {
  1169. "virtual_address": "0x00000000",
  1170. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1171. "size": "0x00000000"
  1172. },
  1173. {
  1174. "virtual_address": "0x00041000",
  1175. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1176. "size": "0x000016c0"
  1177. },
  1178. {
  1179. "virtual_address": "0x00000000",
  1180. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1181. "size": "0x00000000"
  1182. },
  1183. {
  1184. "virtual_address": "0x00000000",
  1185. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1186. "size": "0x00000000"
  1187. },
  1188. {
  1189. "virtual_address": "0x00000000",
  1190. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1191. "size": "0x00000000"
  1192. },
  1193. {
  1194. "virtual_address": "0x00000000",
  1195. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1196. "size": "0x00000000"
  1197. },
  1198. {
  1199. "virtual_address": "0x0002e8c0",
  1200. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1201. "size": "0x00000040"
  1202. },
  1203. {
  1204. "virtual_address": "0x00000000",
  1205. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1206. "size": "0x00000000"
  1207. },
  1208. {
  1209. "virtual_address": "0x00026000",
  1210. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1211. "size": "0x00000374"
  1212. },
  1213. {
  1214. "virtual_address": "0x00000000",
  1215. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1216. "size": "0x00000000"
  1217. },
  1218. {
  1219. "virtual_address": "0x00000000",
  1220. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1221. "size": "0x00000000"
  1222. },
  1223. {
  1224. "virtual_address": "0x00000000",
  1225. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1226. "size": "0x00000000"
  1227. }
  1228. ],
  1229. "exports": [
  1230. {
  1231. "ordinal": 1,
  1232. "name": "_ReflectiveLoader@4",
  1233. "address": "0x10008f2f"
  1234. }
  1235. ],
  1236. "guest_signers": {},
  1237. "imphash": "0bc418575efc832b308d227b31192688",
  1238. "icon_fuzzy": null,
  1239. "icon": null,
  1240. "pdbpath": null,
  1241. "imported_dll_count": 7,
  1242. "versioninfo": []
  1243. }
  1244. }
  1245.  
  1246. [*] Resolved APIs: []
  1247.  
  1248. [*] Static Analysis: {
  1249. "pe": {
  1250. "peid_signatures": null,
  1251. "imports": [
  1252. {
  1253. "imports": [
  1254. {
  1255. "name": "UpdateProcThreadAttribute",
  1256. "address": "0x100260b0"
  1257. },
  1258. {
  1259. "name": "HeapFree",
  1260. "address": "0x100260b4"
  1261. },
  1262. {
  1263. "name": "GetProcessHeap",
  1264. "address": "0x100260b8"
  1265. },
  1266. {
  1267. "name": "CreateRemoteThread",
  1268. "address": "0x100260bc"
  1269. },
  1270. {
  1271. "name": "VirtualAlloc",
  1272. "address": "0x100260c0"
  1273. },
  1274. {
  1275. "name": "VirtualProtectEx",
  1276. "address": "0x100260c4"
  1277. },
  1278. {
  1279. "name": "VirtualAllocEx",
  1280. "address": "0x100260c8"
  1281. },
  1282. {
  1283. "name": "LoadLibraryA",
  1284. "address": "0x100260cc"
  1285. },
  1286. {
  1287. "name": "ProcessIdToSessionId",
  1288. "address": "0x100260d0"
  1289. },
  1290. {
  1291. "name": "DuplicateHandle",
  1292. "address": "0x100260d4"
  1293. },
  1294. {
  1295. "name": "InitializeProcThreadAttributeList",
  1296. "address": "0x100260d8"
  1297. },
  1298. {
  1299. "name": "WriteProcessMemory",
  1300. "address": "0x100260dc"
  1301. },
  1302. {
  1303. "name": "CreateThread",
  1304. "address": "0x100260e0"
  1305. },
  1306. {
  1307. "name": "GetThreadContext",
  1308. "address": "0x100260e4"
  1309. },
  1310. {
  1311. "name": "SetThreadContext",
  1312. "address": "0x100260e8"
  1313. },
  1314. {
  1315. "name": "FreeLibrary",
  1316. "address": "0x100260ec"
  1317. },
  1318. {
  1319. "name": "VirtualFree",
  1320. "address": "0x100260f0"
  1321. },
  1322. {
  1323. "name": "Thread32First",
  1324. "address": "0x100260f4"
  1325. },
  1326. {
  1327. "name": "Thread32Next",
  1328. "address": "0x100260f8"
  1329. },
  1330. {
  1331. "name": "SetLastError",
  1332. "address": "0x100260fc"
  1333. },
  1334. {
  1335. "name": "OpenThread",
  1336. "address": "0x10026100"
  1337. },
  1338. {
  1339. "name": "CreateToolhelp32Snapshot",
  1340. "address": "0x10026104"
  1341. },
  1342. {
  1343. "name": "GetVersionExA",
  1344. "address": "0x10026108"
  1345. },
  1346. {
  1347. "name": "SuspendThread",
  1348. "address": "0x1002610c"
  1349. },
  1350. {
  1351. "name": "ResumeThread",
  1352. "address": "0x10026110"
  1353. },
  1354. {
  1355. "name": "PeekNamedPipe",
  1356. "address": "0x10026114"
  1357. },
  1358. {
  1359. "name": "WaitNamedPipeA",
  1360. "address": "0x10026118"
  1361. },
  1362. {
  1363. "name": "SetNamedPipeHandleState",
  1364. "address": "0x1002611c"
  1365. },
  1366. {
  1367. "name": "LocalAlloc",
  1368. "address": "0x10026120"
  1369. },
  1370. {
  1371. "name": "LocalFree",
  1372. "address": "0x10026124"
  1373. },
  1374. {
  1375. "name": "GetComputerNameA",
  1376. "address": "0x10026128"
  1377. },
  1378. {
  1379. "name": "Process32First",
  1380. "address": "0x1002612c"
  1381. },
  1382. {
  1383. "name": "TerminateProcess",
  1384. "address": "0x10026130"
  1385. },
  1386. {
  1387. "name": "HeapAlloc",
  1388. "address": "0x10026134"
  1389. },
  1390. {
  1391. "name": "ExitProcess",
  1392. "address": "0x10026138"
  1393. },
  1394. {
  1395. "name": "DeleteProcThreadAttributeList",
  1396. "address": "0x1002613c"
  1397. },
  1398. {
  1399. "name": "VirtualProtect",
  1400. "address": "0x10026140"
  1401. },
  1402. {
  1403. "name": "FindNextFileA",
  1404. "address": "0x10026144"
  1405. },
  1406. {
  1407. "name": "MoveFileA",
  1408. "address": "0x10026148"
  1409. },
  1410. {
  1411. "name": "FindClose",
  1412. "address": "0x1002614c"
  1413. },
  1414. {
  1415. "name": "CopyFileA",
  1416. "address": "0x10026150"
  1417. },
  1418. {
  1419. "name": "FindFirstFileA",
  1420. "address": "0x10026154"
  1421. },
  1422. {
  1423. "name": "FileTimeToSystemTime",
  1424. "address": "0x10026158"
  1425. },
  1426. {
  1427. "name": "GetFileAttributesA",
  1428. "address": "0x1002615c"
  1429. },
  1430. {
  1431. "name": "ExpandEnvironmentStringsA",
  1432. "address": "0x10026160"
  1433. },
  1434. {
  1435. "name": "GetLogicalDrives",
  1436. "address": "0x10026164"
  1437. },
  1438. {
  1439. "name": "SystemTimeToTzSpecificLocalTime",
  1440. "address": "0x10026168"
  1441. },
  1442. {
  1443. "name": "GetFullPathNameA",
  1444. "address": "0x1002616c"
  1445. },
  1446. {
  1447. "name": "GetModuleHandleA",
  1448. "address": "0x10026170"
  1449. },
  1450. {
  1451. "name": "CreateNamedPipeA",
  1452. "address": "0x10026174"
  1453. },
  1454. {
  1455. "name": "GetProcAddress",
  1456. "address": "0x10026178"
  1457. },
  1458. {
  1459. "name": "ReadFile",
  1460. "address": "0x1002617c"
  1461. },
  1462. {
  1463. "name": "GetCurrentThread",
  1464. "address": "0x10026180"
  1465. },
  1466. {
  1467. "name": "ConnectNamedPipe",
  1468. "address": "0x10026184"
  1469. },
  1470. {
  1471. "name": "GetCurrentProcess",
  1472. "address": "0x10026188"
  1473. },
  1474. {
  1475. "name": "CloseHandle",
  1476. "address": "0x1002618c"
  1477. },
  1478. {
  1479. "name": "GetFileTime",
  1480. "address": "0x10026190"
  1481. },
  1482. {
  1483. "name": "GetCurrentDirectoryA",
  1484. "address": "0x10026194"
  1485. },
  1486. {
  1487. "name": "CreatePipe",
  1488. "address": "0x10026198"
  1489. },
  1490. {
  1491. "name": "GetCurrentDirectoryW",
  1492. "address": "0x1002619c"
  1493. },
  1494. {
  1495. "name": "GetLastError",
  1496. "address": "0x100261a0"
  1497. },
  1498. {
  1499. "name": "GetStartupInfoA",
  1500. "address": "0x100261a4"
  1501. },
  1502. {
  1503. "name": "SetCurrentDirectoryA",
  1504. "address": "0x100261a8"
  1505. },
  1506. {
  1507. "name": "FlushFileBuffers",
  1508. "address": "0x100261ac"
  1509. },
  1510. {
  1511. "name": "DisconnectNamedPipe",
  1512. "address": "0x100261b0"
  1513. },
  1514. {
  1515. "name": "MultiByteToWideChar",
  1516. "address": "0x100261b4"
  1517. },
  1518. {
  1519. "name": "CreateProcessA",
  1520. "address": "0x100261b8"
  1521. },
  1522. {
  1523. "name": "OpenProcess",
  1524. "address": "0x100261bc"
  1525. },
  1526. {
  1527. "name": "WriteFile",
  1528. "address": "0x100261c0"
  1529. },
  1530. {
  1531. "name": "SetFileTime",
  1532. "address": "0x100261c4"
  1533. },
  1534. {
  1535. "name": "WaitForSingleObject",
  1536. "address": "0x100261c8"
  1537. },
  1538. {
  1539. "name": "SetEnvironmentVariableW",
  1540. "address": "0x100261cc"
  1541. },
  1542. {
  1543. "name": "CreateFileA",
  1544. "address": "0x100261d0"
  1545. },
  1546. {
  1547. "name": "Sleep",
  1548. "address": "0x100261d4"
  1549. },
  1550. {
  1551. "name": "SetEnvironmentVariableA",
  1552. "address": "0x100261d8"
  1553. },
  1554. {
  1555. "name": "CompareStringW",
  1556. "address": "0x100261dc"
  1557. },
  1558. {
  1559. "name": "CompareStringA",
  1560. "address": "0x100261e0"
  1561. },
  1562. {
  1563. "name": "SetEndOfFile",
  1564. "address": "0x100261e4"
  1565. },
  1566. {
  1567. "name": "GetStringTypeW",
  1568. "address": "0x100261e8"
  1569. },
  1570. {
  1571. "name": "GetStringTypeA",
  1572. "address": "0x100261ec"
  1573. },
  1574. {
  1575. "name": "LCMapStringW",
  1576. "address": "0x100261f0"
  1577. },
  1578. {
  1579. "name": "LCMapStringA",
  1580. "address": "0x100261f4"
  1581. },
  1582. {
  1583. "name": "VirtualQuery",
  1584. "address": "0x100261f8"
  1585. },
  1586. {
  1587. "name": "GetModuleFileNameW",
  1588. "address": "0x100261fc"
  1589. },
  1590. {
  1591. "name": "SetStdHandle",
  1592. "address": "0x10026200"
  1593. },
  1594. {
  1595. "name": "WriteConsoleW",
  1596. "address": "0x10026204"
  1597. },
  1598. {
  1599. "name": "GetConsoleOutputCP",
  1600. "address": "0x10026208"
  1601. },
  1602. {
  1603. "name": "WriteConsoleA",
  1604. "address": "0x1002620c"
  1605. },
  1606. {
  1607. "name": "GetLocaleInfoA",
  1608. "address": "0x10026210"
  1609. },
  1610. {
  1611. "name": "HeapSize",
  1612. "address": "0x10026214"
  1613. },
  1614. {
  1615. "name": "IsValidCodePage",
  1616. "address": "0x10026218"
  1617. },
  1618. {
  1619. "name": "GetCPInfo",
  1620. "address": "0x1002621c"
  1621. },
  1622. {
  1623. "name": "DebugBreak",
  1624. "address": "0x10026220"
  1625. },
  1626. {
  1627. "name": "RaiseException",
  1628. "address": "0x10026224"
  1629. },
  1630. {
  1631. "name": "QueryPerformanceCounter",
  1632. "address": "0x10026228"
  1633. },
  1634. {
  1635. "name": "GetEnvironmentStringsW",
  1636. "address": "0x1002622c"
  1637. },
  1638. {
  1639. "name": "FreeEnvironmentStringsW",
  1640. "address": "0x10026230"
  1641. },
  1642. {
  1643. "name": "GetCurrentProcessId",
  1644. "address": "0x10026234"
  1645. },
  1646. {
  1647. "name": "GetOEMCP",
  1648. "address": "0x10026238"
  1649. },
  1650. {
  1651. "name": "GetLocalTime",
  1652. "address": "0x1002623c"
  1653. },
  1654. {
  1655. "name": "GetACP",
  1656. "address": "0x10026240"
  1657. },
  1658. {
  1659. "name": "Process32Next",
  1660. "address": "0x10026244"
  1661. },
  1662. {
  1663. "name": "GetTickCount",
  1664. "address": "0x10026248"
  1665. },
  1666. {
  1667. "name": "GetEnvironmentStrings",
  1668. "address": "0x1002624c"
  1669. },
  1670. {
  1671. "name": "FreeEnvironmentStringsA",
  1672. "address": "0x10026250"
  1673. },
  1674. {
  1675. "name": "SetFilePointer",
  1676. "address": "0x10026254"
  1677. },
  1678. {
  1679. "name": "GetFileType",
  1680. "address": "0x10026258"
  1681. },
  1682. {
  1683. "name": "GetModuleHandleW",
  1684. "address": "0x1002625c"
  1685. },
  1686. {
  1687. "name": "DeleteFileA",
  1688. "address": "0x10026260"
  1689. },
  1690. {
  1691. "name": "CreateDirectoryA",
  1692. "address": "0x10026264"
  1693. },
  1694. {
  1695. "name": "RemoveDirectoryA",
  1696. "address": "0x10026268"
  1697. },
  1698. {
  1699. "name": "GetCurrentThreadId",
  1700. "address": "0x1002626c"
  1701. },
  1702. {
  1703. "name": "GetCommandLineA",
  1704. "address": "0x10026270"
  1705. },
  1706. {
  1707. "name": "GetSystemTimeAsFileTime",
  1708. "address": "0x10026274"
  1709. },
  1710. {
  1711. "name": "UnhandledExceptionFilter",
  1712. "address": "0x10026278"
  1713. },
  1714. {
  1715. "name": "SetUnhandledExceptionFilter",
  1716. "address": "0x1002627c"
  1717. },
  1718. {
  1719. "name": "IsDebuggerPresent",
  1720. "address": "0x10026280"
  1721. },
  1722. {
  1723. "name": "HeapCreate",
  1724. "address": "0x10026284"
  1725. },
  1726. {
  1727. "name": "HeapDestroy",
  1728. "address": "0x10026288"
  1729. },
  1730. {
  1731. "name": "DeleteCriticalSection",
  1732. "address": "0x1002628c"
  1733. },
  1734. {
  1735. "name": "LeaveCriticalSection",
  1736. "address": "0x10026290"
  1737. },
  1738. {
  1739. "name": "EnterCriticalSection",
  1740. "address": "0x10026294"
  1741. },
  1742. {
  1743. "name": "HeapReAlloc",
  1744. "address": "0x10026298"
  1745. },
  1746. {
  1747. "name": "GetStdHandle",
  1748. "address": "0x1002629c"
  1749. },
  1750. {
  1751. "name": "GetModuleFileNameA",
  1752. "address": "0x100262a0"
  1753. },
  1754. {
  1755. "name": "TlsGetValue",
  1756. "address": "0x100262a4"
  1757. },
  1758. {
  1759. "name": "TlsAlloc",
  1760. "address": "0x100262a8"
  1761. },
  1762. {
  1763. "name": "TlsSetValue",
  1764. "address": "0x100262ac"
  1765. },
  1766. {
  1767. "name": "TlsFree",
  1768. "address": "0x100262b0"
  1769. },
  1770. {
  1771. "name": "InterlockedIncrement",
  1772. "address": "0x100262b4"
  1773. },
  1774. {
  1775. "name": "InterlockedDecrement",
  1776. "address": "0x100262b8"
  1777. },
  1778. {
  1779. "name": "InitializeCriticalSectionAndSpinCount",
  1780. "address": "0x100262bc"
  1781. },
  1782. {
  1783. "name": "RtlUnwind",
  1784. "address": "0x100262c0"
  1785. },
  1786. {
  1787. "name": "WideCharToMultiByte",
  1788. "address": "0x100262c4"
  1789. },
  1790. {
  1791. "name": "GetConsoleCP",
  1792. "address": "0x100262c8"
  1793. },
  1794. {
  1795. "name": "GetConsoleMode",
  1796. "address": "0x100262cc"
  1797. },
  1798. {
  1799. "name": "SetHandleCount",
  1800. "address": "0x100262d0"
  1801. }
  1802. ],
  1803. "dll": "KERNEL32.dll"
  1804. },
  1805. {
  1806. "imports": [
  1807. {
  1808. "name": "RegEnumValueA",
  1809. "address": "0x10026000"
  1810. },
  1811. {
  1812. "name": "CloseServiceHandle",
  1813. "address": "0x10026004"
  1814. },
  1815. {
  1816. "name": "OpenProcessToken",
  1817. "address": "0x10026008"
  1818. },
  1819. {
  1820. "name": "CreateProcessWithLogonW",
  1821. "address": "0x1002600c"
  1822. },
  1823. {
  1824. "name": "DeleteService",
  1825. "address": "0x10026010"
  1826. },
  1827. {
  1828. "name": "CryptReleaseContext",
  1829. "address": "0x10026014"
  1830. },
  1831. {
  1832. "name": "CryptAcquireContextA",
  1833. "address": "0x10026018"
  1834. },
  1835. {
  1836. "name": "CryptGenRandom",
  1837. "address": "0x1002601c"
  1838. },
  1839. {
  1840. "name": "LogonUserA",
  1841. "address": "0x10026020"
  1842. },
  1843. {
  1844. "name": "CheckTokenMembership",
  1845. "address": "0x10026024"
  1846. },
  1847. {
  1848. "name": "FreeSid",
  1849. "address": "0x10026028"
  1850. },
  1851. {
  1852. "name": "RevertToSelf",
  1853. "address": "0x1002602c"
  1854. },
  1855. {
  1856. "name": "AllocateAndInitializeSid",
  1857. "address": "0x10026030"
  1858. },
  1859. {
  1860. "name": "DuplicateTokenEx",
  1861. "address": "0x10026034"
  1862. },
  1863. {
  1864. "name": "LookupAccountSidA",
  1865. "address": "0x10026038"
  1866. },
  1867. {
  1868. "name": "GetTokenInformation",
  1869. "address": "0x1002603c"
  1870. },
  1871. {
  1872. "name": "SetSecurityDescriptorDacl",
  1873. "address": "0x10026040"
  1874. },
  1875. {
  1876. "name": "InitializeSecurityDescriptor",
  1877. "address": "0x10026044"
  1878. },
  1879. {
  1880. "name": "RegCloseKey",
  1881. "address": "0x10026048"
  1882. },
  1883. {
  1884. "name": "RegEnumKeyA",
  1885. "address": "0x1002604c"
  1886. },
  1887. {
  1888. "name": "CreateProcessAsUserA",
  1889. "address": "0x10026050"
  1890. },
  1891. {
  1892. "name": "RegOpenCurrentUser",
  1893. "address": "0x10026054"
  1894. },
  1895. {
  1896. "name": "RegOpenKeyExA",
  1897. "address": "0x10026058"
  1898. },
  1899. {
  1900. "name": "GetUserNameA",
  1901. "address": "0x1002605c"
  1902. },
  1903. {
  1904. "name": "AdjustTokenPrivileges",
  1905. "address": "0x10026060"
  1906. },
  1907. {
  1908. "name": "ControlService",
  1909. "address": "0x10026064"
  1910. },
  1911. {
  1912. "name": "QueryServiceStatusEx",
  1913. "address": "0x10026068"
  1914. },
  1915. {
  1916. "name": "ImpersonateNamedPipeClient",
  1917. "address": "0x1002606c"
  1918. },
  1919. {
  1920. "name": "ImpersonateLoggedOnUser",
  1921. "address": "0x10026070"
  1922. },
  1923. {
  1924. "name": "LookupPrivilegeValueA",
  1925. "address": "0x10026074"
  1926. },
  1927. {
  1928. "name": "OpenThreadToken",
  1929. "address": "0x10026078"
  1930. },
  1931. {
  1932. "name": "OpenServiceA",
  1933. "address": "0x1002607c"
  1934. },
  1935. {
  1936. "name": "OpenSCManagerA",
  1937. "address": "0x10026080"
  1938. },
  1939. {
  1940. "name": "QueryServiceStatus",
  1941. "address": "0x10026084"
  1942. },
  1943. {
  1944. "name": "CreateProcessWithTokenW",
  1945. "address": "0x10026088"
  1946. },
  1947. {
  1948. "name": "StartServiceA",
  1949. "address": "0x1002608c"
  1950. },
  1951. {
  1952. "name": "CreateServiceA",
  1953. "address": "0x10026090"
  1954. }
  1955. ],
  1956. "dll": "ADVAPI32.dll"
  1957. },
  1958. {
  1959. "imports": [
  1960. {
  1961. "name": "HttpQueryInfoA",
  1962. "address": "0x100262e8"
  1963. },
  1964. {
  1965. "name": "InternetQueryDataAvailable",
  1966. "address": "0x100262ec"
  1967. },
  1968. {
  1969. "name": "InternetReadFile",
  1970. "address": "0x100262f0"
  1971. },
  1972. {
  1973. "name": "InternetSetOptionA",
  1974. "address": "0x100262f4"
  1975. },
  1976. {
  1977. "name": "HttpOpenRequestA",
  1978. "address": "0x100262f8"
  1979. },
  1980. {
  1981. "name": "HttpSendRequestA",
  1982. "address": "0x100262fc"
  1983. },
  1984. {
  1985. "name": "InternetOpenA",
  1986. "address": "0x10026300"
  1987. },
  1988. {
  1989. "name": "InternetCloseHandle",
  1990. "address": "0x10026304"
  1991. },
  1992. {
  1993. "name": "InternetQueryOptionA",
  1994. "address": "0x10026308"
  1995. },
  1996. {
  1997. "name": "InternetConnectA",
  1998. "address": "0x1002630c"
  1999. }
  2000. ],
  2001. "dll": "WININET.dll"
  2002. },
  2003. {
  2004. "imports": [
  2005. {
  2006. "name": "ntohs",
  2007. "address": "0x10026314"
  2008. },
  2009. {
  2010. "name": "connect",
  2011. "address": "0x10026318"
  2012. },
  2013. {
  2014. "name": "htons",
  2015. "address": "0x1002631c"
  2016. },
  2017. {
  2018. "name": "socket",
  2019. "address": "0x10026320"
  2020. },
  2021. {
  2022. "name": "accept",
  2023. "address": "0x10026324"
  2024. },
  2025. {
  2026. "name": "send",
  2027. "address": "0x10026328"
  2028. },
  2029. {
  2030. "name": "gethostname",
  2031. "address": "0x1002632c"
  2032. },
  2033. {
  2034. "name": "inet_ntoa",
  2035. "address": "0x10026330"
  2036. },
  2037. {
  2038. "name": "WSAStartup",
  2039. "address": "0x10026334"
  2040. },
  2041. {
  2042. "name": "WSACleanup",
  2043. "address": "0x10026338"
  2044. },
  2045. {
  2046. "name": "gethostbyname",
  2047. "address": "0x1002633c"
  2048. },
  2049. {
  2050. "name": "htonl",
  2051. "address": "0x10026340"
  2052. },
  2053. {
  2054. "name": "ntohl",
  2055. "address": "0x10026344"
  2056. },
  2057. {
  2058. "name": "listen",
  2059. "address": "0x10026348"
  2060. },
  2061. {
  2062. "name": "__WSAFDIsSet",
  2063. "address": "0x1002634c"
  2064. },
  2065. {
  2066. "name": "bind",
  2067. "address": "0x10026350"
  2068. },
  2069. {
  2070. "name": "recv",
  2071. "address": "0x10026354"
  2072. },
  2073. {
  2074. "name": "shutdown",
  2075. "address": "0x10026358"
  2076. },
  2077. {
  2078. "name": "WSAGetLastError",
  2079. "address": "0x1002635c"
  2080. },
  2081. {
  2082. "name": "select",
  2083. "address": "0x10026360"
  2084. },
  2085. {
  2086. "name": "ioctlsocket",
  2087. "address": "0x10026364"
  2088. },
  2089. {
  2090. "name": "inet_addr",
  2091. "address": "0x10026368"
  2092. },
  2093. {
  2094. "name": "closesocket",
  2095. "address": "0x1002636c"
  2096. }
  2097. ],
  2098. "dll": "WS2_32.dll"
  2099. },
  2100. {
  2101. "imports": [
  2102. {
  2103. "name": "DnsFree",
  2104. "address": "0x10026098"
  2105. },
  2106. {
  2107. "name": "DnsQuery_A",
  2108. "address": "0x1002609c"
  2109. }
  2110. ],
  2111. "dll": "DNSAPI.dll"
  2112. },
  2113. {
  2114. "imports": [
  2115. {
  2116. "name": "GetIfEntry",
  2117. "address": "0x100260a4"
  2118. },
  2119. {
  2120. "name": "GetIpAddrTable",
  2121. "address": "0x100260a8"
  2122. }
  2123. ],
  2124. "dll": "IPHLPAPI.DLL"
  2125. },
  2126. {
  2127. "imports": [
  2128. {
  2129. "name": "LsaCallAuthenticationPackage",
  2130. "address": "0x100262d8"
  2131. },
  2132. {
  2133. "name": "LsaConnectUntrusted",
  2134. "address": "0x100262dc"
  2135. },
  2136. {
  2137. "name": "LsaLookupAuthenticationPackage",
  2138. "address": "0x100262e0"
  2139. }
  2140. ],
  2141. "dll": "Secur32.dll"
  2142. }
  2143. ],
  2144. "digital_signers": null,
  2145. "exported_dll_name": "beacon.dll",
  2146. "actual_checksum": "0x00037e03",
  2147. "overlay": null,
  2148. "imagebase": "0x10000000",
  2149. "reported_checksum": "0x00000000",
  2150. "icon_hash": null,
  2151. "entrypoint": "0x10017771",
  2152. "timestamp": "2018-09-05 21:53:17",
  2153. "osversion": "5.0",
  2154. "sections": [
  2155. {
  2156. "name": ".text",
  2157. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2158. "virtual_address": "0x00001000",
  2159. "size_of_data": "0x00024e00",
  2160. "entropy": "6.64",
  2161. "raw_address": "0x00000400",
  2162. "virtual_size": "0x00024c0a",
  2163. "characteristics_raw": "0x60000020"
  2164. },
  2165. {
  2166. "name": ".rdata",
  2167. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2168. "virtual_address": "0x00026000",
  2169. "size_of_data": "0x0000a200",
  2170. "entropy": "6.81",
  2171. "raw_address": "0x00025200",
  2172. "virtual_size": "0x0000a1a1",
  2173. "characteristics_raw": "0x40000040"
  2174. },
  2175. {
  2176. "name": ".data",
  2177. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2178. "virtual_address": "0x00031000",
  2179. "size_of_data": "0x00002400",
  2180. "entropy": "3.03",
  2181. "raw_address": "0x0002f400",
  2182. "virtual_size": "0x0000ff40",
  2183. "characteristics_raw": "0xc0000040"
  2184. },
  2185. {
  2186. "name": ".reloc",
  2187. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  2188. "virtual_address": "0x00041000",
  2189. "size_of_data": "0x00002000",
  2190. "entropy": "5.49",
  2191. "raw_address": "0x00031800",
  2192. "virtual_size": "0x00001e5a",
  2193. "characteristics_raw": "0x42000040"
  2194. }
  2195. ],
  2196. "resources": [],
  2197. "dirents": [
  2198. {
  2199. "virtual_address": "0x00030150",
  2200. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2201. "size": "0x00000051"
  2202. },
  2203. {
  2204. "virtual_address": "0x0002ee74",
  2205. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2206. "size": "0x000000a0"
  2207. },
  2208. {
  2209. "virtual_address": "0x00000000",
  2210. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2211. "size": "0x00000000"
  2212. },
  2213. {
  2214. "virtual_address": "0x00000000",
  2215. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2216. "size": "0x00000000"
  2217. },
  2218. {
  2219. "virtual_address": "0x00000000",
  2220. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2221. "size": "0x00000000"
  2222. },
  2223. {
  2224. "virtual_address": "0x00041000",
  2225. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2226. "size": "0x000016c0"
  2227. },
  2228. {
  2229. "virtual_address": "0x00000000",
  2230. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2231. "size": "0x00000000"
  2232. },
  2233. {
  2234. "virtual_address": "0x00000000",
  2235. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2236. "size": "0x00000000"
  2237. },
  2238. {
  2239. "virtual_address": "0x00000000",
  2240. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2241. "size": "0x00000000"
  2242. },
  2243. {
  2244. "virtual_address": "0x00000000",
  2245. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2246. "size": "0x00000000"
  2247. },
  2248. {
  2249. "virtual_address": "0x0002e8c0",
  2250. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2251. "size": "0x00000040"
  2252. },
  2253. {
  2254. "virtual_address": "0x00000000",
  2255. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2256. "size": "0x00000000"
  2257. },
  2258. {
  2259. "virtual_address": "0x00026000",
  2260. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2261. "size": "0x00000374"
  2262. },
  2263. {
  2264. "virtual_address": "0x00000000",
  2265. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2266. "size": "0x00000000"
  2267. },
  2268. {
  2269. "virtual_address": "0x00000000",
  2270. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2271. "size": "0x00000000"
  2272. },
  2273. {
  2274. "virtual_address": "0x00000000",
  2275. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2276. "size": "0x00000000"
  2277. }
  2278. ],
  2279. "exports": [
  2280. {
  2281. "ordinal": 1,
  2282. "name": "_ReflectiveLoader@4",
  2283. "address": "0x10008f2f"
  2284. }
  2285. ],
  2286. "guest_signers": {},
  2287. "imphash": "0bc418575efc832b308d227b31192688",
  2288. "icon_fuzzy": null,
  2289. "icon": null,
  2290. "pdbpath": null,
  2291. "imported_dll_count": 7,
  2292. "versioninfo": []
  2293. }
  2294. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!