API tools faq
paste
paladin316

Exes_8d2b9df9dd6c98a540e0fa53ae8ba1eb_exe_2019-06-27_20_30.json

paladin316
Jun 27th, 2019
2,178
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.43 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_8d2b9df9dd6c98a540e0fa53ae8ba1eb.exe"
  7. [*] File Size: 1888768
  8. [*] File Type: "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  9. [*] SHA256: "b562ad8c740ba4549be9c7dc693c1f77bd2ba3bac33128769d5a7e079bfdedec"
  10. [*] MD5: "8d2b9df9dd6c98a540e0fa53ae8ba1eb"
  11. [*] SHA1: "1637f07b521ab147226d5ebdd245ef96eb53ad7a"
  12. [*] SHA512: "a248a49c695b128560fe0ba86271af6621ab41ee8dfd56adb9668d5da19de46aea5312d49a30b828bdf1398b656ee6955b44147275f31a9eda23d1693d199c14"
  13. [*] CRC32: "6678B2F0"
  14. [*] SSDEEP: "49152:Dhzz3nQOhk06u4fVcuVaJP9QjHBujIs8:tzzAAwu49cOI98h"
  15.  
  16. [*] Process Execution: [
  17. "Exes_8d2b9df9dd6c98a540e0fa53ae8ba1eb.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: UPX1, entropy: 7.87, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x001cce00, virtual_size: 0x001cd000"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "The executable is compressed using UPX",
  31. "Details": [
  32. {
  33. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x002a3000"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "File has been identified by 51 Antiviruses on VirusTotal as malicious",
  39. "Details": [
  40. {
  41. "Bkav": "W32.PorisurAOW.Trojan"
  42. },
  43. {
  44. "MicroWorld-eScan": "Trojan.GenericKD.31758859"
  45. },
  46. {
  47. "CAT-QuickHeal": "Trojan.Razy"
  48. },
  49. {
  50. "ALYac": "Trojan.Agent.1888768"
  51. },
  52. {
  53. "SUPERAntiSpyware": "Trojan.Agent/Gen-Dropper"
  54. },
  55. {
  56. "BitDefender": "Trojan.GenericKD.31758859"
  57. },
  58. {
  59. "K7GW": "Trojan ( 005295b11 )"
  60. },
  61. {
  62. "K7AntiVirus": "Trojan ( 005295b11 )"
  63. },
  64. {
  65. "Arcabit": "Trojan.Generic.D1E49A0B"
  66. },
  67. {
  68. "NANO-Antivirus": "Trojan.Win32.SpyBot.fozpvl"
  69. },
  70. {
  71. "Cyren": "W32/Trojan.NGJZ-7215"
  72. },
  73. {
  74. "Symantec": "Trojan.Gen.2"
  75. },
  76. {
  77. "ESET-NOD32": "a variant of Win32/Agent.TAE"
  78. },
  79. {
  80. "Paloalto": "generic.ml"
  81. },
  82. {
  83. "GData": "Trojan.GenericKD.31758859"
  84. },
  85. {
  86. "Kaspersky": "Trojan.Win32.Agent.qwiyok"
  87. },
  88. {
  89. "Alibaba": "Trojan:Win32/Agent.dd7bf8c3"
  90. },
  91. {
  92. "ViRobot": "Trojan.Win32.S.Agent.1888768"
  93. },
  94. {
  95. "Avast": "Win32:Malware-gen"
  96. },
  97. {
  98. "Tencent": "Win32.Trojan.Agent.Ebhb"
  99. },
  100. {
  101. "Ad-Aware": "Trojan.GenericKD.31758859"
  102. },
  103. {
  104. "Emsisoft": "Trojan.GenericKD.31758859 (B)"
  105. },
  106. {
  107. "Comodo": "Malware@#36kg2pu4xzk1x"
  108. },
  109. {
  110. "F-Secure": "Trojan.TR/Agent.tlrcm"
  111. },
  112. {
  113. "DrWeb": "Trojan.SpyBot.799"
  114. },
  115. {
  116. "Invincea": "heuristic"
  117. },
  118. {
  119. "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.tc"
  120. },
  121. {
  122. "Trapmine": "suspicious.low.ml.score"
  123. },
  124. {
  125. "FireEye": "Trojan.GenericKD.31758859"
  126. },
  127. {
  128. "Sophos": "Troj/Agent-BBMN"
  129. },
  130. {
  131. "Ikarus": "Trojan.Win32.Agent"
  132. },
  133. {
  134. "Jiangmin": "Trojan.Agent.bxfw"
  135. },
  136. {
  137. "Webroot": "W32.Trojan.Gen"
  138. },
  139. {
  140. "Avira": "TR/Agent.tlrcm"
  141. },
  142. {
  143. "Microsoft": "Trojan:Win32/Tiggre!rfn"
  144. },
  145. {
  146. "Endgame": "malicious (moderate confidence)"
  147. },
  148. {
  149. "AegisLab": "Trojan.Win32.Agent.4!c"
  150. },
  151. {
  152. "ZoneAlarm": "Trojan.Win32.Agent.qwiyok"
  153. },
  154. {
  155. "AhnLab-V3": "Trojan/Win32.Tiggre.C3129801"
  156. },
  157. {
  158. "Acronis": "suspicious"
  159. },
  160. {
  161. "McAfee": "Artemis!8D2B9DF9DD6C"
  162. },
  163. {
  164. "VBA32": "Trojan.Agent"
  165. },
  166. {
  167. "Cylance": "Unsafe"
  168. },
  169. {
  170. "Rising": "Trojan.Zpevdo!8.F912 (CLOUD)"
  171. },
  172. {
  173. "Yandex": "Trojan.Agent!K66es6EoQpc"
  174. },
  175. {
  176. "Fortinet": "W32/Agent.TAE!tr"
  177. },
  178. {
  179. "AVG": "Win32:Malware-gen"
  180. },
  181. {
  182. "Cybereason": "malicious.9dd6c9"
  183. },
  184. {
  185. "Panda": "Trj/CI.A"
  186. },
  187. {
  188. "CrowdStrike": "win/malicious_confidence_80% (W)"
  189. },
  190. {
  191. "Qihoo-360": "Win32/Trojan.6a8"
  192. }
  193. ]
  194. }
  195. ]
  196.  
  197. [*] Started Service: []
  198.  
  199. [*] Executed Commands: []
  200.  
  201. [*] Mutexes: []
  202.  
  203. [*] Modified Files: []
  204.  
  205. [*] Deleted Files: []
  206.  
  207. [*] Modified Registry Keys: []
  208.  
  209. [*] Deleted Registry Keys: []
  210.  
  211. [*] DNS Communications: []
  212.  
  213. [*] Domains: []
  214.  
  215. [*] Network Communication - ICMP: []
  216.  
  217. [*] Network Communication - HTTP: []
  218.  
  219. [*] Network Communication - SMTP: []
  220.  
  221. [*] Network Communication - Hosts: []
  222.  
  223. [*] Network Communication - IRC: []
  224.  
  225. [*] Static Analysis: {
  226. "pe": {
  227. "peid_signatures": [
  228. [
  229. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  230. ]
  231. ],
  232. "imports": [
  233. {
  234. "imports": [
  235. {
  236. "name": "LoadLibraryA",
  237. "address": "0x871050"
  238. },
  239. {
  240. "name": "GetProcAddress",
  241. "address": "0x871054"
  242. },
  243. {
  244. "name": "VirtualProtect",
  245. "address": "0x871058"
  246. },
  247. {
  248. "name": "VirtualAlloc",
  249. "address": "0x87105c"
  250. },
  251. {
  252. "name": "VirtualFree",
  253. "address": "0x871060"
  254. },
  255. {
  256. "name": "ExitProcess",
  257. "address": "0x871064"
  258. }
  259. ],
  260. "dll": "KERNEL32.DLL"
  261. },
  262. {
  263. "imports": [
  264. {
  265. "name": "timeEndPeriod",
  266. "address": "0x87106c"
  267. }
  268. ],
  269. "dll": "winmm.dll"
  270. },
  271. {
  272. "imports": [
  273. {
  274. "name": "WSAGetOverlappedResult",
  275. "address": "0x871074"
  276. }
  277. ],
  278. "dll": "ws2_32.dll"
  279. }
  280. ],
  281. "digital_signers": null,
  282. "exported_dll_name": null,
  283. "actual_checksum": "0x001da964",
  284. "overlay": null,
  285. "imagebase": "0x00400000",
  286. "reported_checksum": "0x00000000",
  287. "icon_hash": null,
  288. "entrypoint": "0x00870af0",
  289. "timestamp": "1970-01-01 00:00:00",
  290. "osversion": "4.0",
  291. "sections": [
  292. {
  293. "name": "UPX0",
  294. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  295. "virtual_address": "0x00001000",
  296. "size_of_data": "0x00000000",
  297. "entropy": "0.00",
  298. "raw_address": "0x00000200",
  299. "virtual_size": "0x002a3000",
  300. "characteristics_raw": "0xe0000080"
  301. },
  302. {
  303. "name": "UPX1",
  304. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  305. "virtual_address": "0x002a4000",
  306. "size_of_data": "0x001cce00",
  307. "entropy": "7.87",
  308. "raw_address": "0x00000200",
  309. "virtual_size": "0x001cd000",
  310. "characteristics_raw": "0xe0000040"
  311. },
  312. {
  313. "name": "UPX2",
  314. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  315. "virtual_address": "0x00471000",
  316. "size_of_data": "0x00000200",
  317. "entropy": "2.71",
  318. "raw_address": "0x001cd000",
  319. "virtual_size": "0x00001000",
  320. "characteristics_raw": "0xc0000040"
  321. }
  322. ],
  323. "resources": [],
  324. "dirents": [
  325. {
  326. "virtual_address": "0x00000000",
  327. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  328. "size": "0x00000000"
  329. },
  330. {
  331. "virtual_address": "0x00471000",
  332. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  333. "size": "0x00000120"
  334. },
  335. {
  336. "virtual_address": "0x00000000",
  337. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  338. "size": "0x00000000"
  339. },
  340. {
  341. "virtual_address": "0x00000000",
  342. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  343. "size": "0x00000000"
  344. },
  345. {
  346. "virtual_address": "0x00000000",
  347. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  348. "size": "0x00000000"
  349. },
  350. {
  351. "virtual_address": "0x00000000",
  352. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  353. "size": "0x00000000"
  354. },
  355. {
  356. "virtual_address": "0x00000000",
  357. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  358. "size": "0x00000000"
  359. },
  360. {
  361. "virtual_address": "0x00000000",
  362. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  363. "size": "0x00000000"
  364. },
  365. {
  366. "virtual_address": "0x00000000",
  367. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  368. "size": "0x00000000"
  369. },
  370. {
  371. "virtual_address": "0x00000000",
  372. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  373. "size": "0x00000000"
  374. },
  375. {
  376. "virtual_address": "0x00000000",
  377. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  378. "size": "0x00000000"
  379. },
  380. {
  381. "virtual_address": "0x00000000",
  382. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  383. "size": "0x00000000"
  384. },
  385. {
  386. "virtual_address": "0x00000000",
  387. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  388. "size": "0x00000000"
  389. },
  390. {
  391. "virtual_address": "0x00000000",
  392. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  393. "size": "0x00000000"
  394. },
  395. {
  396. "virtual_address": "0x00000000",
  397. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  398. "size": "0x00000000"
  399. },
  400. {
  401. "virtual_address": "0x00000000",
  402. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  403. "size": "0x00000000"
  404. }
  405. ],
  406. "exports": [],
  407. "guest_signers": {},
  408. "imphash": "2cd14f15921469c2e776cf169a885091",
  409. "icon_fuzzy": null,
  410. "icon": null,
  411. "pdbpath": null,
  412. "imported_dll_count": 3,
  413. "versioninfo": []
  414. }
  415. }
  416.  
  417. [*] Resolved APIs: [
  418. "kernel32.dll.WriteFile",
  419. "kernel32.dll.WriteConsoleW",
  420. "kernel32.dll.WaitForSingleObject",
  421. "kernel32.dll.VirtualQuery",
  422. "kernel32.dll.VirtualFree",
  423. "kernel32.dll.VirtualAlloc",
  424. "kernel32.dll.SwitchToThread",
  425. "kernel32.dll.SetWaitableTimer",
  426. "kernel32.dll.SetUnhandledExceptionFilter",
  427. "kernel32.dll.SetProcessPriorityBoost",
  428. "kernel32.dll.SetEvent",
  429. "kernel32.dll.SetErrorMode",
  430. "kernel32.dll.SetConsoleCtrlHandler",
  431. "kernel32.dll.LoadLibraryA",
  432. "kernel32.dll.LoadLibraryW",
  433. "kernel32.dll.GetSystemInfo",
  434. "kernel32.dll.GetStdHandle",
  435. "kernel32.dll.GetQueuedCompletionStatus",
  436. "kernel32.dll.GetProcessAffinityMask",
  437. "kernel32.dll.GetProcAddress",
  438. "kernel32.dll.GetEnvironmentStringsW",
  439. "kernel32.dll.GetConsoleMode",
  440. "kernel32.dll.FreeEnvironmentStringsW",
  441. "kernel32.dll.ExitProcess",
  442. "kernel32.dll.DuplicateHandle",
  443. "kernel32.dll.CreateThread",
  444. "kernel32.dll.CreateIoCompletionPort",
  445. "kernel32.dll.CreateEventA",
  446. "kernel32.dll.CloseHandle",
  447. "kernel32.dll.AddVectoredExceptionHandler",
  448. "winmm.dll.timeEndPeriod",
  449. "winmm.dll.timeBeginPeriod",
  450. "ws2_32.dll.WSAGetOverlappedResult",
  451. "kernel32.dll.AddVectoredContinueHandler",
  452. "kernel32.dll.GetQueuedCompletionStatusEx",
  453. "kernel32.dll.LoadLibraryExW",
  454. "advapi32.dll.SystemFunction036",
  455. "ntdll.dll.NtWaitForSingleObject",
  456. "cryptbase.dll.SystemFunction001",
  457. "cryptbase.dll.SystemFunction002",
  458. "cryptbase.dll.SystemFunction003",
  459. "cryptbase.dll.SystemFunction004",
  460. "cryptbase.dll.SystemFunction005",
  461. "cryptbase.dll.SystemFunction028",
  462. "cryptbase.dll.SystemFunction029",
  463. "cryptbase.dll.SystemFunction034",
  464. "cryptbase.dll.SystemFunction036",
  465. "cryptbase.dll.SystemFunction040",
  466. "cryptbase.dll.SystemFunction041",
  467. "kernel32.dll.SetHandleInformation",
  468. "ws2_32.dll.WSAStartup",
  469. "kernel32.dll.CancelIoEx",
  470. "kernel32.dll.SetFileCompletionNotificationModes",
  471. "ws2_32.dll.WSAEnumProtocolsW",
  472. "kernel32.dll.GetCommandLineW",
  473. "kernel32.dll.GetEnvironmentVariableW",
  474. "ole32.dll.CoInitialize",
  475. "ole32.dll.CoInitializeEx",
  476. "ole32.dll.CoUninitialize",
  477. "ole32.dll.CoCreateInstance",
  478. "ole32.dll.CoTaskMemFree",
  479. "ole32.dll.CLSIDFromProgID",
  480. "ole32.dll.CLSIDFromString",
  481. "ole32.dll.StringFromCLSID",
  482. "ole32.dll.StringFromIID",
  483. "ole32.dll.IIDFromString",
  484. "kernel32.dll.GetUserDefaultLCID",
  485. "kernel32.dll.RtlMoveMemory",
  486. "oleaut32.dll.VariantInit",
  487. "oleaut32.dll.VariantClear",
  488. "oleaut32.dll.VariantTimeToSystemTime",
  489. "oleaut32.dll.SysAllocString",
  490. "oleaut32.dll.SysAllocStringLen",
  491. "oleaut32.dll.SysFreeString",
  492. "oleaut32.dll.SysStringLen",
  493. "oleaut32.dll.CreateDispTypeInfo",
  494. "oleaut32.dll.CreateStdDispatch",
  495. "oleaut32.dll.GetActiveObject",
  496. "user32.dll.GetMessageW",
  497. "user32.dll.DispatchMessageW",
  498. "oleaut32.dll.SafeArrayAccessData",
  499. "oleaut32.dll.SafeArrayAllocData",
  500. "oleaut32.dll.SafeArrayAllocDescriptor",
  501. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  502. "oleaut32.dll.SafeArrayCopy",
  503. "oleaut32.dll.SafeArrayCopyData",
  504. "oleaut32.dll.SafeArrayCreate",
  505. "oleaut32.dll.SafeArrayCreateEx",
  506. "oleaut32.dll.SafeArrayCreateVector",
  507. "oleaut32.dll.SafeArrayCreateVectorEx",
  508. "oleaut32.dll.SafeArrayDestroy",
  509. "oleaut32.dll.SafeArrayDestroyData",
  510. "oleaut32.dll.SafeArrayDestroyDescriptor",
  511. "oleaut32.dll.SafeArrayGetDim",
  512. "oleaut32.dll.SafeArrayGetElement",
  513. "oleaut32.dll.SafeArrayGetElemsize",
  514. "oleaut32.dll.SafeArrayGetIID",
  515. "oleaut32.dll.SafeArrayGetLBound",
  516. "oleaut32.dll.SafeArrayGetUBound",
  517. "oleaut32.dll.SafeArrayGetVartype",
  518. "oleaut32.dll.SafeArrayLock",
  519. "oleaut32.dll.SafeArrayPtrOfIndex",
  520. "oleaut32.dll.SafeArrayUnaccessData",
  521. "oleaut32.dll.SafeArrayUnlock",
  522. "oleaut32.dll.SafeArrayPutElement",
  523. "oleaut32.dll.SafeArrayGetRecordInfo",
  524. "oleaut32.dll.SafeArraySetRecordInfo",
  525. "kernel32.dll.WTSGetActiveConsoleSessionId",
  526. "kernel32.dll.FormatMessageW",
  527. "wtsapi32.dll.WTSQuerySessionInformationW",
  528. "winsta.dll.WinStationQueryInformationW",
  529. "advapi32.dll.LookupAccountSidW",
  530. "sechost.dll.LookupAccountSidLocalW",
  531. "advapi32.dll.CreateWellKnownSid",
  532. "rpcrt4.dll.RpcStringBindingComposeW",
  533. "rpcrt4.dll.RpcBindingFromStringBindingW",
  534. "rpcrt4.dll.RpcStringFreeW",
  535. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  536. "sechost.dll.LookupAccountNameLocalW",
  537. "rpcrt4.dll.NdrClientCall2",
  538. "rpcrt4.dll.I_RpcExceptionFilter",
  539. "rpcrt4.dll.RpcBindingFree",
  540. "advapi32.dll.LookupAccountNameW",
  541. "advapi32.dll.ConvertSidToStringSidW",
  542. "kernel32.dll.LocalFree",
  543. "advapi32.dll.RegOpenKeyExW",
  544. "kernel32.dll.GetTimeZoneInformation"
  545. ]
  546.  
  547. [*] Static Analysis: {
  548. "pe": {
  549. "peid_signatures": [
  550. [
  551. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  552. ]
  553. ],
  554. "imports": [
  555. {
  556. "imports": [
  557. {
  558. "name": "LoadLibraryA",
  559. "address": "0x871050"
  560. },
  561. {
  562. "name": "GetProcAddress",
  563. "address": "0x871054"
  564. },
  565. {
  566. "name": "VirtualProtect",
  567. "address": "0x871058"
  568. },
  569. {
  570. "name": "VirtualAlloc",
  571. "address": "0x87105c"
  572. },
  573. {
  574. "name": "VirtualFree",
  575. "address": "0x871060"
  576. },
  577. {
  578. "name": "ExitProcess",
  579. "address": "0x871064"
  580. }
  581. ],
  582. "dll": "KERNEL32.DLL"
  583. },
  584. {
  585. "imports": [
  586. {
  587. "name": "timeEndPeriod",
  588. "address": "0x87106c"
  589. }
  590. ],
  591. "dll": "winmm.dll"
  592. },
  593. {
  594. "imports": [
  595. {
  596. "name": "WSAGetOverlappedResult",
  597. "address": "0x871074"
  598. }
  599. ],
  600. "dll": "ws2_32.dll"
  601. }
  602. ],
  603. "digital_signers": null,
  604. "exported_dll_name": null,
  605. "actual_checksum": "0x001da964",
  606. "overlay": null,
  607. "imagebase": "0x00400000",
  608. "reported_checksum": "0x00000000",
  609. "icon_hash": null,
  610. "entrypoint": "0x00870af0",
  611. "timestamp": "1970-01-01 00:00:00",
  612. "osversion": "4.0",
  613. "sections": [
  614. {
  615. "name": "UPX0",
  616. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  617. "virtual_address": "0x00001000",
  618. "size_of_data": "0x00000000",
  619. "entropy": "0.00",
  620. "raw_address": "0x00000200",
  621. "virtual_size": "0x002a3000",
  622. "characteristics_raw": "0xe0000080"
  623. },
  624. {
  625. "name": "UPX1",
  626. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  627. "virtual_address": "0x002a4000",
  628. "size_of_data": "0x001cce00",
  629. "entropy": "7.87",
  630. "raw_address": "0x00000200",
  631. "virtual_size": "0x001cd000",
  632. "characteristics_raw": "0xe0000040"
  633. },
  634. {
  635. "name": "UPX2",
  636. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  637. "virtual_address": "0x00471000",
  638. "size_of_data": "0x00000200",
  639. "entropy": "2.71",
  640. "raw_address": "0x001cd000",
  641. "virtual_size": "0x00001000",
  642. "characteristics_raw": "0xc0000040"
  643. }
  644. ],
  645. "resources": [],
  646. "dirents": [
  647. {
  648. "virtual_address": "0x00000000",
  649. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  650. "size": "0x00000000"
  651. },
  652. {
  653. "virtual_address": "0x00471000",
  654. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  655. "size": "0x00000120"
  656. },
  657. {
  658. "virtual_address": "0x00000000",
  659. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  660. "size": "0x00000000"
  661. },
  662. {
  663. "virtual_address": "0x00000000",
  664. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  665. "size": "0x00000000"
  666. },
  667. {
  668. "virtual_address": "0x00000000",
  669. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  670. "size": "0x00000000"
  671. },
  672. {
  673. "virtual_address": "0x00000000",
  674. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  675. "size": "0x00000000"
  676. },
  677. {
  678. "virtual_address": "0x00000000",
  679. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  680. "size": "0x00000000"
  681. },
  682. {
  683. "virtual_address": "0x00000000",
  684. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  685. "size": "0x00000000"
  686. },
  687. {
  688. "virtual_address": "0x00000000",
  689. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  690. "size": "0x00000000"
  691. },
  692. {
  693. "virtual_address": "0x00000000",
  694. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  695. "size": "0x00000000"
  696. },
  697. {
  698. "virtual_address": "0x00000000",
  699. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  700. "size": "0x00000000"
  701. },
  702. {
  703. "virtual_address": "0x00000000",
  704. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  705. "size": "0x00000000"
  706. },
  707. {
  708. "virtual_address": "0x00000000",
  709. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  710. "size": "0x00000000"
  711. },
  712. {
  713. "virtual_address": "0x00000000",
  714. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  715. "size": "0x00000000"
  716. },
  717. {
  718. "virtual_address": "0x00000000",
  719. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  720. "size": "0x00000000"
  721. },
  722. {
  723. "virtual_address": "0x00000000",
  724. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  725. "size": "0x00000000"
  726. }
  727. ],
  728. "exports": [],
  729. "guest_signers": {},
  730. "imphash": "2cd14f15921469c2e776cf169a885091",
  731. "icon_fuzzy": null,
  732. "icon": null,
  733. "pdbpath": null,
  734. "imported_dll_count": 3,
  735. "versioninfo": []
  736. }
  737. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!