API tools faq
paste
paladin316

BN65EA_tmp_2019-07-02_18_30.json

paladin316
Jul 2nd, 2019
2,104
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 38.16 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 4.1
  5.  
  6. [*] File Name: "BN65EA.tmp"
  7. [*] File Size: 57344
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "6a616061eaba4f864574d432fdcafb48ec222ff7eb56d4eb14d219a74d9e58bc"
  10. [*] MD5: "7fb5b4e5054492299ef15831aa5d36e5"
  11. [*] SHA1: "c6f596f7731d6672a589d0d5c0554a2939880ffd"
  12. [*] SHA512: "78305a4e016c61b127b340a55ac9e32b4c764e8269ae0689e2e56664167b47fc25a2ab62ddb5e68ec519441867e1333a8cf29953fef23e29671d380a69d7fa16"
  13. [*] CRC32: "D748248C"
  14. [*] SSDEEP: "768:bHrLX+6j4SbqBnHbsEIOZKMOpsQq6sFvO/QduXD3:bzkzRHYEIOZmp5FAd0D3"
  15.  
  16. [*] Process Execution: [
  17. "BN65EA.tmp"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "A process attempted to delay the analysis task.",
  27. "Details": [
  28. {
  29. "Process": "BN65EA.tmp tried to sleep 1350 seconds, actually delayed analysis time by 0 seconds"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  35. "Details": [
  36. {
  37. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  38. },
  39. {
  40. "suspicious_request": "http://31.44.184.33/H7mp"
  41. },
  42. {
  43. "suspicious_request": "http://31.44.184.33/ga.js"
  44. }
  45. ]
  46. },
  47. {
  48. "Description": "Performs some HTTP requests",
  49. "Details": [
  50. {
  51. "url": "http://31.44.184.33/H7mp"
  52. },
  53. {
  54. "url": "http://31.44.184.33/ga.js"
  55. }
  56. ]
  57. },
  58. {
  59. "Description": "Network activity contains more than one unique useragent.",
  60. "Details": [
  61. {
  62. "Process": "BN65EA.tmp"
  63. },
  64. {
  65. "User-Agent": ""
  66. },
  67. {
  68. "Process": "BN65EA.tmp"
  69. },
  70. {
  71. "User-Agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)"
  72. }
  73. ]
  74. }
  75. ]
  76.  
  77. [*] Started Service: []
  78.  
  79. [*] Executed Commands: []
  80.  
  81. [*] Mutexes: [
  82. "DBWinMutex"
  83. ]
  84.  
  85. [*] Modified Files: []
  86.  
  87. [*] Deleted Files: []
  88.  
  89. [*] Modified Registry Keys: []
  90.  
  91. [*] Deleted Registry Keys: []
  92.  
  93. [*] DNS Communications: []
  94.  
  95. [*] Domains: []
  96.  
  97. [*] Network Communication - ICMP: []
  98.  
  99. [*] Network Communication - HTTP: [
  100. {
  101. "count": 1,
  102. "body": "",
  103. "uri": "http://31.44.184.33/H7mp",
  104. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.3; .NET CLR 2.0.50727)",
  105. "method": "GET",
  106. "host": "31.44.184.33",
  107. "version": "1.1",
  108. "path": "/H7mp",
  109. "data": "GET /H7mp HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.3; .NET CLR 2.0.50727)\r\nHost: 31.44.184.33\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  110. "port": 80
  111. },
  112. {
  113. "count": 19,
  114. "body": "",
  115. "uri": "http://31.44.184.33/ga.js",
  116. "user-agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)",
  117. "method": "GET",
  118. "host": "31.44.184.33",
  119. "version": "1.1",
  120. "path": "/ga.js",
  121. "data": "GET /ga.js HTTP/1.1\r\nAccept: */*\r\nCookie: u2Blfp8kO3xkf10zgTGVerhrx/qdJ5pLG/h/9vgR2iHBDG42HDMANT2yl178XpCHhDz896WnG7ueiKu8oq4UBiUQuLynBD3F6EuaznG0xhyD8LkBnmly95ZEJe81AJw9njGVzkWL8ALX5f1pO0Wqqc/iRCwW6bTWTGK6sohD6g0=\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)\r\nHost: 31.44.184.33\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  122. "port": 80
  123. }
  124. ]
  125.  
  126. [*] Network Communication - SMTP: []
  127.  
  128. [*] Network Communication - Hosts: []
  129.  
  130. [*] Network Communication - IRC: []
  131.  
  132. [*] Static Analysis: {
  133. "pe": {
  134. "peid_signatures": null,
  135. "imports": [
  136. {
  137. "imports": [
  138. {
  139. "name": "FindResourceW",
  140. "address": "0x408000"
  141. },
  142. {
  143. "name": "OpenProcess",
  144. "address": "0x408004"
  145. },
  146. {
  147. "name": "FindResourceA",
  148. "address": "0x408008"
  149. },
  150. {
  151. "name": "GetLongPathNameA",
  152. "address": "0x40800c"
  153. },
  154. {
  155. "name": "InterlockedCompareExchange",
  156. "address": "0x408010"
  157. },
  158. {
  159. "name": "GetSystemDefaultUILanguage",
  160. "address": "0x408014"
  161. },
  162. {
  163. "name": "GetModuleHandleExW",
  164. "address": "0x408018"
  165. },
  166. {
  167. "name": "GetPrivateProfileSectionW",
  168. "address": "0x40801c"
  169. },
  170. {
  171. "name": "GetTimeFormatW",
  172. "address": "0x408020"
  173. },
  174. {
  175. "name": "TerminateProcess",
  176. "address": "0x408024"
  177. },
  178. {
  179. "name": "SetThreadPriority",
  180. "address": "0x408028"
  181. },
  182. {
  183. "name": "lstrlenW",
  184. "address": "0x40802c"
  185. },
  186. {
  187. "name": "PeekNamedPipe",
  188. "address": "0x408030"
  189. },
  190. {
  191. "name": "VirtualProtect",
  192. "address": "0x408034"
  193. },
  194. {
  195. "name": "EnumSystemLocalesA",
  196. "address": "0x408038"
  197. },
  198. {
  199. "name": "GetLocalTime",
  200. "address": "0x40803c"
  201. },
  202. {
  203. "name": "LCMapStringA",
  204. "address": "0x408040"
  205. },
  206. {
  207. "name": "SetCurrentDirectoryW",
  208. "address": "0x408044"
  209. },
  210. {
  211. "name": "SetFilePointerEx",
  212. "address": "0x408048"
  213. },
  214. {
  215. "name": "ConvertDefaultLocale",
  216. "address": "0x40804c"
  217. },
  218. {
  219. "name": "lstrcpyA",
  220. "address": "0x408050"
  221. },
  222. {
  223. "name": "SystemTimeToTzSpecificLocalTime",
  224. "address": "0x408054"
  225. },
  226. {
  227. "name": "SetFileAttributesA",
  228. "address": "0x408058"
  229. },
  230. {
  231. "name": "VerSetConditionMask",
  232. "address": "0x40805c"
  233. },
  234. {
  235. "name": "ExitThread",
  236. "address": "0x408060"
  237. },
  238. {
  239. "name": "SignalObjectAndWait",
  240. "address": "0x408064"
  241. },
  242. {
  243. "name": "GetModuleFileNameW",
  244. "address": "0x408068"
  245. },
  246. {
  247. "name": "GetDiskFreeSpaceW",
  248. "address": "0x40806c"
  249. },
  250. {
  251. "name": "CloseHandle",
  252. "address": "0x408070"
  253. },
  254. {
  255. "name": "SetThreadExecutionState",
  256. "address": "0x408074"
  257. },
  258. {
  259. "name": "GetModuleFileNameA",
  260. "address": "0x408078"
  261. },
  262. {
  263. "name": "lstrcatA",
  264. "address": "0x40807c"
  265. },
  266. {
  267. "name": "DeleteFileW",
  268. "address": "0x408080"
  269. },
  270. {
  271. "name": "HeapValidate",
  272. "address": "0x408084"
  273. },
  274. {
  275. "name": "GlobalAddAtomW",
  276. "address": "0x408088"
  277. },
  278. {
  279. "name": "OpenFileMappingA",
  280. "address": "0x40808c"
  281. },
  282. {
  283. "name": "IsDBCSLeadByteEx",
  284. "address": "0x408090"
  285. },
  286. {
  287. "name": "SetLastError",
  288. "address": "0x408094"
  289. },
  290. {
  291. "name": "GetDriveTypeW",
  292. "address": "0x408098"
  293. },
  294. {
  295. "name": "GetSystemDirectoryW",
  296. "address": "0x40809c"
  297. },
  298. {
  299. "name": "MoveFileW",
  300. "address": "0x4080a0"
  301. },
  302. {
  303. "name": "GlobalAlloc",
  304. "address": "0x4080a4"
  305. },
  306. {
  307. "name": "FindClose",
  308. "address": "0x4080a8"
  309. },
  310. {
  311. "name": "CreateProcessA",
  312. "address": "0x4080ac"
  313. },
  314. {
  315. "name": "SetErrorMode",
  316. "address": "0x4080b0"
  317. },
  318. {
  319. "name": "SetNamedPipeHandleState",
  320. "address": "0x4080b4"
  321. },
  322. {
  323. "name": "RemoveDirectoryA",
  324. "address": "0x4080b8"
  325. },
  326. {
  327. "name": "TlsSetValue",
  328. "address": "0x4080bc"
  329. },
  330. {
  331. "name": "GetSystemTime",
  332. "address": "0x4080c0"
  333. },
  334. {
  335. "name": "GetTempPathW",
  336. "address": "0x4080c4"
  337. },
  338. {
  339. "name": "GetShortPathNameA",
  340. "address": "0x4080c8"
  341. },
  342. {
  343. "name": "AreFileApisANSI",
  344. "address": "0x4080cc"
  345. },
  346. {
  347. "name": "CreateEventA",
  348. "address": "0x4080d0"
  349. }
  350. ],
  351. "dll": "KERNEL32.dll"
  352. }
  353. ],
  354. "digital_signers": null,
  355. "exported_dll_name": null,
  356. "actual_checksum": "0x0001168b",
  357. "overlay": null,
  358. "imagebase": "0x00400000",
  359. "reported_checksum": "0x0001168b",
  360. "icon_hash": null,
  361. "entrypoint": "0x004016eb",
  362. "timestamp": "2019-03-21 00:05:35",
  363. "osversion": "4.0",
  364. "sections": [
  365. {
  366. "name": ".text",
  367. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  368. "virtual_address": "0x00001000",
  369. "size_of_data": "0x00007000",
  370. "entropy": "5.60",
  371. "raw_address": "0x00001000",
  372. "virtual_size": "0x00006ff8",
  373. "characteristics_raw": "0x60000020"
  374. },
  375. {
  376. "name": ".rdata",
  377. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  378. "virtual_address": "0x00008000",
  379. "size_of_data": "0x00001000",
  380. "entropy": "2.42",
  381. "raw_address": "0x00008000",
  382. "virtual_size": "0x00000796",
  383. "characteristics_raw": "0x40000040"
  384. },
  385. {
  386. "name": ".data",
  387. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  388. "virtual_address": "0x00009000",
  389. "size_of_data": "0x00002000",
  390. "entropy": "0.85",
  391. "raw_address": "0x00009000",
  392. "virtual_size": "0x00002d60",
  393. "characteristics_raw": "0xc0000040"
  394. },
  395. {
  396. "name": ".ndata",
  397. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  398. "virtual_address": "0x0000c000",
  399. "size_of_data": "0x00000000",
  400. "entropy": "0.00",
  401. "raw_address": "0x0000b000",
  402. "virtual_size": "0x00014000",
  403. "characteristics_raw": "0xc0000080"
  404. },
  405. {
  406. "name": ".rsrc",
  407. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  408. "virtual_address": "0x00020000",
  409. "size_of_data": "0x00003000",
  410. "entropy": "5.44",
  411. "raw_address": "0x0000b000",
  412. "virtual_size": "0x00003000",
  413. "characteristics_raw": "0x40000040"
  414. }
  415. ],
  416. "resources": [],
  417. "dirents": [
  418. {
  419. "virtual_address": "0x10000000",
  420. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  421. "size": "0x10000000"
  422. },
  423. {
  424. "virtual_address": "0x0000829c",
  425. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  426. "size": "0x00000028"
  427. },
  428. {
  429. "virtual_address": "0x00020000",
  430. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  431. "size": "0x00002510"
  432. },
  433. {
  434. "virtual_address": "0x00000000",
  435. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  436. "size": "0x00000000"
  437. },
  438. {
  439. "virtual_address": "0x00000000",
  440. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  441. "size": "0x00000000"
  442. },
  443. {
  444. "virtual_address": "0x00000000",
  445. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  446. "size": "0x00000000"
  447. },
  448. {
  449. "virtual_address": "0x00000000",
  450. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  451. "size": "0x00000000"
  452. },
  453. {
  454. "virtual_address": "0x00000000",
  455. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  456. "size": "0x00000000"
  457. },
  458. {
  459. "virtual_address": "0x00000000",
  460. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  461. "size": "0x00000000"
  462. },
  463. {
  464. "virtual_address": "0x00000000",
  465. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  466. "size": "0x00000000"
  467. },
  468. {
  469. "virtual_address": "0x00000000",
  470. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  471. "size": "0x00000000"
  472. },
  473. {
  474. "virtual_address": "0x00000000",
  475. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  476. "size": "0x00000000"
  477. },
  478. {
  479. "virtual_address": "0x00008000",
  480. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  481. "size": "0x000000d8"
  482. },
  483. {
  484. "virtual_address": "0x00000000",
  485. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  486. "size": "0x00000000"
  487. },
  488. {
  489. "virtual_address": "0x00000000",
  490. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  491. "size": "0x00000000"
  492. },
  493. {
  494. "virtual_address": "0x00000000",
  495. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  496. "size": "0x00000000"
  497. }
  498. ],
  499. "exports": [],
  500. "guest_signers": {},
  501. "imphash": "40af0ba33e055fe01ef14d60b2ec86c7",
  502. "icon_fuzzy": null,
  503. "icon": null,
  504. "pdbpath": null,
  505. "imported_dll_count": 1,
  506. "versioninfo": []
  507. }
  508. }
  509.  
  510. [*] Resolved APIs: [
  511. "kernel32.dll.GetModuleHandleA",
  512. "kernel32.dll.LoadLibraryA",
  513. "kernel32.dll.VirtualAlloc",
  514. "kernel32.dll.VirtualFree",
  515. "kernel32.dll.OutputDebugStringA",
  516. "ntdll.dll._stricmp",
  517. "ntdll.dll.memset",
  518. "ntdll.dll.memcpy",
  519. "kernel32.dll.CreateThread",
  520. "kernel32.dll.DeleteCriticalSection",
  521. "kernel32.dll.EnterCriticalSection",
  522. "kernel32.dll.FreeLibrary",
  523. "kernel32.dll.GetCurrentProcess",
  524. "kernel32.dll.GetCurrentProcessId",
  525. "kernel32.dll.GetCurrentThreadId",
  526. "kernel32.dll.GetLastError",
  527. "kernel32.dll.GetProcAddress",
  528. "kernel32.dll.GetStartupInfoA",
  529. "kernel32.dll.GetSystemTimeAsFileTime",
  530. "kernel32.dll.GetTickCount",
  531. "kernel32.dll.InitializeCriticalSection",
  532. "kernel32.dll.LeaveCriticalSection",
  533. "kernel32.dll.LoadLibraryW",
  534. "kernel32.dll.QueryPerformanceCounter",
  535. "kernel32.dll.SetUnhandledExceptionFilter",
  536. "kernel32.dll.Sleep",
  537. "kernel32.dll.TerminateProcess",
  538. "kernel32.dll.TlsGetValue",
  539. "kernel32.dll.UnhandledExceptionFilter",
  540. "kernel32.dll.VirtualProtect",
  541. "kernel32.dll.VirtualQuery",
  542. "msvcrt.dll.__dllonexit",
  543. "msvcrt.dll.__getmainargs",
  544. "msvcrt.dll.__initenv",
  545. "msvcrt.dll.__lconv_init",
  546. "msvcrt.dll.__set_app_type",
  547. "msvcrt.dll.__setusermatherr",
  548. "msvcrt.dll._acmdln",
  549. "msvcrt.dll._amsg_exit",
  550. "msvcrt.dll._cexit",
  551. "msvcrt.dll._fmode",
  552. "msvcrt.dll._initterm",
  553. "msvcrt.dll._iob",
  554. "msvcrt.dll._lock",
  555. "msvcrt.dll._onexit",
  556. "msvcrt.dll._unlock",
  557. "msvcrt.dll._winmajor",
  558. "msvcrt.dll.abort",
  559. "msvcrt.dll.calloc",
  560. "msvcrt.dll.exit",
  561. "msvcrt.dll.fprintf",
  562. "msvcrt.dll.free",
  563. "msvcrt.dll.fwrite",
  564. "msvcrt.dll.malloc",
  565. "msvcrt.dll.memcpy",
  566. "msvcrt.dll.signal",
  567. "msvcrt.dll.strlen",
  568. "msvcrt.dll.strncmp",
  569. "msvcrt.dll.vfprintf",
  570. "rasapi32.dll.RasConnectionNotificationW",
  571. "sechost.dll.NotifyServiceStatusChangeA",
  572. "cryptbase.dll.SystemFunction036",
  573. "kernel32.dll.UpdateProcThreadAttribute",
  574. "kernel32.dll.HeapFree",
  575. "kernel32.dll.GetProcessHeap",
  576. "kernel32.dll.CreateRemoteThread",
  577. "kernel32.dll.VirtualProtectEx",
  578. "kernel32.dll.VirtualAllocEx",
  579. "kernel32.dll.ProcessIdToSessionId",
  580. "kernel32.dll.DuplicateHandle",
  581. "kernel32.dll.InitializeProcThreadAttributeList",
  582. "kernel32.dll.WriteProcessMemory",
  583. "kernel32.dll.GetThreadContext",
  584. "kernel32.dll.SetThreadContext",
  585. "kernel32.dll.Thread32First",
  586. "kernel32.dll.Thread32Next",
  587. "kernel32.dll.SetLastError",
  588. "kernel32.dll.OpenThread",
  589. "kernel32.dll.CreateToolhelp32Snapshot",
  590. "kernel32.dll.GetVersionExA",
  591. "kernel32.dll.SuspendThread",
  592. "kernel32.dll.ResumeThread",
  593. "kernel32.dll.PeekNamedPipe",
  594. "kernel32.dll.WaitNamedPipeA",
  595. "kernel32.dll.SetNamedPipeHandleState",
  596. "kernel32.dll.LocalAlloc",
  597. "kernel32.dll.LocalFree",
  598. "kernel32.dll.GetComputerNameA",
  599. "kernel32.dll.Process32First",
  600. "kernel32.dll.HeapAlloc",
  601. "kernel32.dll.ExitProcess",
  602. "kernel32.dll.DeleteProcThreadAttributeList",
  603. "kernel32.dll.FindNextFileA",
  604. "kernel32.dll.MoveFileA",
  605. "kernel32.dll.FindClose",
  606. "kernel32.dll.CopyFileA",
  607. "kernel32.dll.FindFirstFileA",
  608. "kernel32.dll.FileTimeToSystemTime",
  609. "kernel32.dll.GetFileAttributesA",
  610. "kernel32.dll.ExpandEnvironmentStringsA",
  611. "kernel32.dll.GetLogicalDrives",
  612. "kernel32.dll.SystemTimeToTzSpecificLocalTime",
  613. "kernel32.dll.GetFullPathNameA",
  614. "kernel32.dll.CreateNamedPipeA",
  615. "kernel32.dll.ReadFile",
  616. "kernel32.dll.GetCurrentThread",
  617. "kernel32.dll.ConnectNamedPipe",
  618. "kernel32.dll.CloseHandle",
  619. "kernel32.dll.GetFileTime",
  620. "kernel32.dll.GetCurrentDirectoryA",
  621. "kernel32.dll.CreatePipe",
  622. "kernel32.dll.GetCurrentDirectoryW",
  623. "kernel32.dll.SetCurrentDirectoryA",
  624. "kernel32.dll.FlushFileBuffers",
  625. "kernel32.dll.DisconnectNamedPipe",
  626. "kernel32.dll.MultiByteToWideChar",
  627. "kernel32.dll.CreateProcessA",
  628. "kernel32.dll.OpenProcess",
  629. "kernel32.dll.WriteFile",
  630. "kernel32.dll.SetFileTime",
  631. "kernel32.dll.WaitForSingleObject",
  632. "kernel32.dll.SetEnvironmentVariableW",
  633. "kernel32.dll.CreateFileA",
  634. "kernel32.dll.SetEnvironmentVariableA",
  635. "kernel32.dll.CompareStringW",
  636. "kernel32.dll.CompareStringA",
  637. "kernel32.dll.SetEndOfFile",
  638. "kernel32.dll.GetStringTypeW",
  639. "kernel32.dll.GetStringTypeA",
  640. "kernel32.dll.LCMapStringW",
  641. "kernel32.dll.LCMapStringA",
  642. "kernel32.dll.GetModuleFileNameW",
  643. "kernel32.dll.SetStdHandle",
  644. "kernel32.dll.WriteConsoleW",
  645. "kernel32.dll.GetConsoleOutputCP",
  646. "kernel32.dll.WriteConsoleA",
  647. "kernel32.dll.GetLocaleInfoA",
  648. "kernel32.dll.HeapSize",
  649. "kernel32.dll.IsValidCodePage",
  650. "kernel32.dll.GetCPInfo",
  651. "kernel32.dll.DebugBreak",
  652. "kernel32.dll.RaiseException",
  653. "kernel32.dll.GetEnvironmentStringsW",
  654. "kernel32.dll.FreeEnvironmentStringsW",
  655. "kernel32.dll.GetOEMCP",
  656. "kernel32.dll.GetLocalTime",
  657. "kernel32.dll.GetACP",
  658. "kernel32.dll.Process32Next",
  659. "kernel32.dll.GetEnvironmentStrings",
  660. "kernel32.dll.FreeEnvironmentStringsA",
  661. "kernel32.dll.SetFilePointer",
  662. "kernel32.dll.GetFileType",
  663. "kernel32.dll.GetModuleHandleW",
  664. "kernel32.dll.DeleteFileA",
  665. "kernel32.dll.CreateDirectoryA",
  666. "kernel32.dll.RemoveDirectoryA",
  667. "kernel32.dll.GetCommandLineA",
  668. "kernel32.dll.IsDebuggerPresent",
  669. "kernel32.dll.HeapCreate",
  670. "kernel32.dll.HeapDestroy",
  671. "kernel32.dll.HeapReAlloc",
  672. "kernel32.dll.GetStdHandle",
  673. "kernel32.dll.GetModuleFileNameA",
  674. "kernel32.dll.TlsAlloc",
  675. "kernel32.dll.TlsSetValue",
  676. "kernel32.dll.TlsFree",
  677. "kernel32.dll.InterlockedIncrement",
  678. "kernel32.dll.InterlockedDecrement",
  679. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  680. "kernel32.dll.RtlUnwind",
  681. "kernel32.dll.WideCharToMultiByte",
  682. "kernel32.dll.GetConsoleCP",
  683. "kernel32.dll.GetConsoleMode",
  684. "kernel32.dll.SetHandleCount",
  685. "advapi32.dll.RegEnumValueA",
  686. "advapi32.dll.CloseServiceHandle",
  687. "advapi32.dll.OpenProcessToken",
  688. "advapi32.dll.CreateProcessWithLogonW",
  689. "advapi32.dll.DeleteService",
  690. "advapi32.dll.CryptReleaseContext",
  691. "advapi32.dll.CryptAcquireContextA",
  692. "advapi32.dll.CryptGenRandom",
  693. "advapi32.dll.LogonUserA",
  694. "advapi32.dll.CheckTokenMembership",
  695. "advapi32.dll.FreeSid",
  696. "advapi32.dll.RevertToSelf",
  697. "advapi32.dll.AllocateAndInitializeSid",
  698. "advapi32.dll.DuplicateTokenEx",
  699. "advapi32.dll.LookupAccountSidA",
  700. "advapi32.dll.GetTokenInformation",
  701. "advapi32.dll.SetSecurityDescriptorDacl",
  702. "advapi32.dll.InitializeSecurityDescriptor",
  703. "advapi32.dll.RegCloseKey",
  704. "advapi32.dll.RegEnumKeyA",
  705. "advapi32.dll.CreateProcessAsUserA",
  706. "advapi32.dll.RegOpenCurrentUser",
  707. "advapi32.dll.RegOpenKeyExA",
  708. "advapi32.dll.GetUserNameA",
  709. "advapi32.dll.AdjustTokenPrivileges",
  710. "advapi32.dll.ControlService",
  711. "advapi32.dll.QueryServiceStatusEx",
  712. "advapi32.dll.ImpersonateNamedPipeClient",
  713. "advapi32.dll.ImpersonateLoggedOnUser",
  714. "advapi32.dll.LookupPrivilegeValueA",
  715. "advapi32.dll.OpenThreadToken",
  716. "advapi32.dll.OpenServiceA",
  717. "advapi32.dll.OpenSCManagerA",
  718. "advapi32.dll.QueryServiceStatus",
  719. "advapi32.dll.CreateProcessWithTokenW",
  720. "advapi32.dll.StartServiceA",
  721. "advapi32.dll.CreateServiceA",
  722. "wininet.dll.HttpQueryInfoA",
  723. "wininet.dll.InternetQueryDataAvailable",
  724. "wininet.dll.InternetReadFile",
  725. "wininet.dll.InternetSetOptionA",
  726. "wininet.dll.HttpOpenRequestA",
  727. "wininet.dll.HttpSendRequestA",
  728. "wininet.dll.InternetOpenA",
  729. "wininet.dll.InternetCloseHandle",
  730. "wininet.dll.InternetQueryOptionA",
  731. "wininet.dll.InternetConnectA",
  732. "dnsapi.dll.DnsFree",
  733. "dnsapi.dll.DnsQuery_A",
  734. "iphlpapi.dll.GetIfEntry",
  735. "iphlpapi.dll.GetIpAddrTable",
  736. "secur32.dll.LsaCallAuthenticationPackage",
  737. "secur32.dll.LsaConnectUntrusted",
  738. "secur32.dll.LsaLookupAuthenticationPackage",
  739. "kernel32.dll.FlsAlloc",
  740. "kernel32.dll.FlsGetValue",
  741. "kernel32.dll.FlsSetValue",
  742. "kernel32.dll.FlsFree",
  743. "cryptsp.dll.CryptAcquireContextA",
  744. "cryptsp.dll.CryptGenRandom",
  745. "cryptsp.dll.CryptReleaseContext",
  746. "kernel32.dll.IsWow64Process"
  747. ]
  748.  
  749. [*] Static Analysis: {
  750. "pe": {
  751. "peid_signatures": null,
  752. "imports": [
  753. {
  754. "imports": [
  755. {
  756. "name": "FindResourceW",
  757. "address": "0x408000"
  758. },
  759. {
  760. "name": "OpenProcess",
  761. "address": "0x408004"
  762. },
  763. {
  764. "name": "FindResourceA",
  765. "address": "0x408008"
  766. },
  767. {
  768. "name": "GetLongPathNameA",
  769. "address": "0x40800c"
  770. },
  771. {
  772. "name": "InterlockedCompareExchange",
  773. "address": "0x408010"
  774. },
  775. {
  776. "name": "GetSystemDefaultUILanguage",
  777. "address": "0x408014"
  778. },
  779. {
  780. "name": "GetModuleHandleExW",
  781. "address": "0x408018"
  782. },
  783. {
  784. "name": "GetPrivateProfileSectionW",
  785. "address": "0x40801c"
  786. },
  787. {
  788. "name": "GetTimeFormatW",
  789. "address": "0x408020"
  790. },
  791. {
  792. "name": "TerminateProcess",
  793. "address": "0x408024"
  794. },
  795. {
  796. "name": "SetThreadPriority",
  797. "address": "0x408028"
  798. },
  799. {
  800. "name": "lstrlenW",
  801. "address": "0x40802c"
  802. },
  803. {
  804. "name": "PeekNamedPipe",
  805. "address": "0x408030"
  806. },
  807. {
  808. "name": "VirtualProtect",
  809. "address": "0x408034"
  810. },
  811. {
  812. "name": "EnumSystemLocalesA",
  813. "address": "0x408038"
  814. },
  815. {
  816. "name": "GetLocalTime",
  817. "address": "0x40803c"
  818. },
  819. {
  820. "name": "LCMapStringA",
  821. "address": "0x408040"
  822. },
  823. {
  824. "name": "SetCurrentDirectoryW",
  825. "address": "0x408044"
  826. },
  827. {
  828. "name": "SetFilePointerEx",
  829. "address": "0x408048"
  830. },
  831. {
  832. "name": "ConvertDefaultLocale",
  833. "address": "0x40804c"
  834. },
  835. {
  836. "name": "lstrcpyA",
  837. "address": "0x408050"
  838. },
  839. {
  840. "name": "SystemTimeToTzSpecificLocalTime",
  841. "address": "0x408054"
  842. },
  843. {
  844. "name": "SetFileAttributesA",
  845. "address": "0x408058"
  846. },
  847. {
  848. "name": "VerSetConditionMask",
  849. "address": "0x40805c"
  850. },
  851. {
  852. "name": "ExitThread",
  853. "address": "0x408060"
  854. },
  855. {
  856. "name": "SignalObjectAndWait",
  857. "address": "0x408064"
  858. },
  859. {
  860. "name": "GetModuleFileNameW",
  861. "address": "0x408068"
  862. },
  863. {
  864. "name": "GetDiskFreeSpaceW",
  865. "address": "0x40806c"
  866. },
  867. {
  868. "name": "CloseHandle",
  869. "address": "0x408070"
  870. },
  871. {
  872. "name": "SetThreadExecutionState",
  873. "address": "0x408074"
  874. },
  875. {
  876. "name": "GetModuleFileNameA",
  877. "address": "0x408078"
  878. },
  879. {
  880. "name": "lstrcatA",
  881. "address": "0x40807c"
  882. },
  883. {
  884. "name": "DeleteFileW",
  885. "address": "0x408080"
  886. },
  887. {
  888. "name": "HeapValidate",
  889. "address": "0x408084"
  890. },
  891. {
  892. "name": "GlobalAddAtomW",
  893. "address": "0x408088"
  894. },
  895. {
  896. "name": "OpenFileMappingA",
  897. "address": "0x40808c"
  898. },
  899. {
  900. "name": "IsDBCSLeadByteEx",
  901. "address": "0x408090"
  902. },
  903. {
  904. "name": "SetLastError",
  905. "address": "0x408094"
  906. },
  907. {
  908. "name": "GetDriveTypeW",
  909. "address": "0x408098"
  910. },
  911. {
  912. "name": "GetSystemDirectoryW",
  913. "address": "0x40809c"
  914. },
  915. {
  916. "name": "MoveFileW",
  917. "address": "0x4080a0"
  918. },
  919. {
  920. "name": "GlobalAlloc",
  921. "address": "0x4080a4"
  922. },
  923. {
  924. "name": "FindClose",
  925. "address": "0x4080a8"
  926. },
  927. {
  928. "name": "CreateProcessA",
  929. "address": "0x4080ac"
  930. },
  931. {
  932. "name": "SetErrorMode",
  933. "address": "0x4080b0"
  934. },
  935. {
  936. "name": "SetNamedPipeHandleState",
  937. "address": "0x4080b4"
  938. },
  939. {
  940. "name": "RemoveDirectoryA",
  941. "address": "0x4080b8"
  942. },
  943. {
  944. "name": "TlsSetValue",
  945. "address": "0x4080bc"
  946. },
  947. {
  948. "name": "GetSystemTime",
  949. "address": "0x4080c0"
  950. },
  951. {
  952. "name": "GetTempPathW",
  953. "address": "0x4080c4"
  954. },
  955. {
  956. "name": "GetShortPathNameA",
  957. "address": "0x4080c8"
  958. },
  959. {
  960. "name": "AreFileApisANSI",
  961. "address": "0x4080cc"
  962. },
  963. {
  964. "name": "CreateEventA",
  965. "address": "0x4080d0"
  966. }
  967. ],
  968. "dll": "KERNEL32.dll"
  969. }
  970. ],
  971. "digital_signers": null,
  972. "exported_dll_name": null,
  973. "actual_checksum": "0x0001168b",
  974. "overlay": null,
  975. "imagebase": "0x00400000",
  976. "reported_checksum": "0x0001168b",
  977. "icon_hash": null,
  978. "entrypoint": "0x004016eb",
  979. "timestamp": "2019-03-21 00:05:35",
  980. "osversion": "4.0",
  981. "sections": [
  982. {
  983. "name": ".text",
  984. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  985. "virtual_address": "0x00001000",
  986. "size_of_data": "0x00007000",
  987. "entropy": "5.60",
  988. "raw_address": "0x00001000",
  989. "virtual_size": "0x00006ff8",
  990. "characteristics_raw": "0x60000020"
  991. },
  992. {
  993. "name": ".rdata",
  994. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  995. "virtual_address": "0x00008000",
  996. "size_of_data": "0x00001000",
  997. "entropy": "2.42",
  998. "raw_address": "0x00008000",
  999. "virtual_size": "0x00000796",
  1000. "characteristics_raw": "0x40000040"
  1001. },
  1002. {
  1003. "name": ".data",
  1004. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1005. "virtual_address": "0x00009000",
  1006. "size_of_data": "0x00002000",
  1007. "entropy": "0.85",
  1008. "raw_address": "0x00009000",
  1009. "virtual_size": "0x00002d60",
  1010. "characteristics_raw": "0xc0000040"
  1011. },
  1012. {
  1013. "name": ".ndata",
  1014. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1015. "virtual_address": "0x0000c000",
  1016. "size_of_data": "0x00000000",
  1017. "entropy": "0.00",
  1018. "raw_address": "0x0000b000",
  1019. "virtual_size": "0x00014000",
  1020. "characteristics_raw": "0xc0000080"
  1021. },
  1022. {
  1023. "name": ".rsrc",
  1024. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1025. "virtual_address": "0x00020000",
  1026. "size_of_data": "0x00003000",
  1027. "entropy": "5.44",
  1028. "raw_address": "0x0000b000",
  1029. "virtual_size": "0x00003000",
  1030. "characteristics_raw": "0x40000040"
  1031. }
  1032. ],
  1033. "resources": [],
  1034. "dirents": [
  1035. {
  1036. "virtual_address": "0x10000000",
  1037. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1038. "size": "0x10000000"
  1039. },
  1040. {
  1041. "virtual_address": "0x0000829c",
  1042. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1043. "size": "0x00000028"
  1044. },
  1045. {
  1046. "virtual_address": "0x00020000",
  1047. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1048. "size": "0x00002510"
  1049. },
  1050. {
  1051. "virtual_address": "0x00000000",
  1052. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1053. "size": "0x00000000"
  1054. },
  1055. {
  1056. "virtual_address": "0x00000000",
  1057. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1058. "size": "0x00000000"
  1059. },
  1060. {
  1061. "virtual_address": "0x00000000",
  1062. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1063. "size": "0x00000000"
  1064. },
  1065. {
  1066. "virtual_address": "0x00000000",
  1067. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1068. "size": "0x00000000"
  1069. },
  1070. {
  1071. "virtual_address": "0x00000000",
  1072. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1073. "size": "0x00000000"
  1074. },
  1075. {
  1076. "virtual_address": "0x00000000",
  1077. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1078. "size": "0x00000000"
  1079. },
  1080. {
  1081. "virtual_address": "0x00000000",
  1082. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1083. "size": "0x00000000"
  1084. },
  1085. {
  1086. "virtual_address": "0x00000000",
  1087. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1088. "size": "0x00000000"
  1089. },
  1090. {
  1091. "virtual_address": "0x00000000",
  1092. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1093. "size": "0x00000000"
  1094. },
  1095. {
  1096. "virtual_address": "0x00008000",
  1097. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1098. "size": "0x000000d8"
  1099. },
  1100. {
  1101. "virtual_address": "0x00000000",
  1102. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1103. "size": "0x00000000"
  1104. },
  1105. {
  1106. "virtual_address": "0x00000000",
  1107. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1108. "size": "0x00000000"
  1109. },
  1110. {
  1111. "virtual_address": "0x00000000",
  1112. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1113. "size": "0x00000000"
  1114. }
  1115. ],
  1116. "exports": [],
  1117. "guest_signers": {},
  1118. "imphash": "40af0ba33e055fe01ef14d60b2ec86c7",
  1119. "icon_fuzzy": null,
  1120. "icon": null,
  1121. "pdbpath": null,
  1122. "imported_dll_count": 1,
  1123. "versioninfo": []
  1124. }
  1125. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!