API tools faq
paste
paladin316

Exes_c15b58c5b0c68ff29bec8902cb7ca6b4_exe_2019-07-03_03_30.json

paladin316
Jul 2nd, 2019
2,149
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 46.39 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Ursu"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_c15b58c5b0c68ff29bec8902cb7ca6b4.exe"
  7. [*] File Size: 1976320
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "9d8ad4c4aea07b90651f9f9bdf9dc98cfc7bacd644f3fd1f8523127e217b55ad"
  10. [*] MD5: "c15b58c5b0c68ff29bec8902cb7ca6b4"
  11. [*] SHA1: "03fcd5f1386b028821564c31cc2492f7569c47e0"
  12. [*] SHA512: "7c80e9167d90d9d16b07c05eac936bdb321c1dac0e17b382e4a73dd2fd8f54c291f6000444c3771670dbab1cfde017245f94862e1628b50e67ac44c1a9653486"
  13. [*] CRC32: "CDF1F927"
  14. [*] SSDEEP: "24576:9kcDblev3TyJVJF67X1A+ro806tHiwe4lL1qMdLEvnjM/RRQpzrmF0CiQKXoen:9xblev3cVahAQNtPe4N5Er2RahpX5n"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "Unconventionial language used in binary resources: Arabic (Egypt)",
  21. "Details": []
  22. },
  23. {
  24. "Description": "The binary likely contains encrypted or compressed data.",
  25. "Details": [
  26. {
  27. "section": "name: UPX1, entropy: 7.80, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x001d0200, virtual_size: 0x001d1000"
  28. }
  29. ]
  30. },
  31. {
  32. "Description": "The executable is compressed using UPX",
  33. "Details": [
  34. {
  35. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00118000"
  36. }
  37. ]
  38. },
  39. {
  40. "Description": "File has been identified by 49 Antiviruses on VirusTotal as malicious",
  41. "Details": [
  42. {
  43. "MicroWorld-eScan": "Gen:Variant.Ursu.470972"
  44. },
  45. {
  46. "FireEye": "Generic.mg.c15b58c5b0c68ff2"
  47. },
  48. {
  49. "CAT-QuickHeal": "Trojan.Multi"
  50. },
  51. {
  52. "Qihoo-360": "HEUR/QVM11.1.7267.Malware.Gen"
  53. },
  54. {
  55. "McAfee": "Artemis!C15B58C5B0C6"
  56. },
  57. {
  58. "Cylance": "Unsafe"
  59. },
  60. {
  61. "K7AntiVirus": "Trojan ( 0054edc11 )"
  62. },
  63. {
  64. "Alibaba": "Trojan:Win32/Inject.9ccfb1fd"
  65. },
  66. {
  67. "K7GW": "Trojan ( 0054edc11 )"
  68. },
  69. {
  70. "Cybereason": "malicious.5b0c68"
  71. },
  72. {
  73. "TrendMicro": "TROJ_GEN.R011C0WES19"
  74. },
  75. {
  76. "Symantec": "Trojan Horse"
  77. },
  78. {
  79. "Paloalto": "generic.ml"
  80. },
  81. {
  82. "ClamAV": "Win.Trojan.Generic-6982539-0"
  83. },
  84. {
  85. "Kaspersky": "Trojan.Win32.Inject.alrkx"
  86. },
  87. {
  88. "BitDefender": "Gen:Variant.Ursu.470972"
  89. },
  90. {
  91. "NANO-Antivirus": "Trojan.Win32.Inject.fqoovo"
  92. },
  93. {
  94. "AegisLab": "Trojan.Multi.Generic.4!c"
  95. },
  96. {
  97. "Rising": "Backdoor.Fynloski!8.1FD (CLOUD)"
  98. },
  99. {
  100. "Sophos": "Mal/Generic-S"
  101. },
  102. {
  103. "Comodo": "Malware@#20fppg2vn4ci"
  104. },
  105. {
  106. "F-Secure": "Trojan.TR/Injector.uwtzj"
  107. },
  108. {
  109. "DrWeb": "Trojan.Remcos.3"
  110. },
  111. {
  112. "Zillya": "Trojan.Stealer.Win32.6066"
  113. },
  114. {
  115. "Invincea": "heuristic"
  116. },
  117. {
  118. "McAfee-GW-Edition": "BehavesLike.Win32.Trojan.tc"
  119. },
  120. {
  121. "Trapmine": "malicious.high.ml.score"
  122. },
  123. {
  124. "Emsisoft": "Gen:Variant.Ursu.470972 (B)"
  125. },
  126. {
  127. "Cyren": "W32/Trojan.ACYN-2967"
  128. },
  129. {
  130. "Jiangmin": "TrojanSpy.Stealer.bdn"
  131. },
  132. {
  133. "Avira": "TR/Injector.uwtzj"
  134. },
  135. {
  136. "Antiy-AVL": "Trojan[Spy]/Win32.Stealer"
  137. },
  138. {
  139. "Microsoft": "Trojan:Win32/CryptInject"
  140. },
  141. {
  142. "ZoneAlarm": "Trojan.Win32.Inject.alrkx"
  143. },
  144. {
  145. "GData": "Gen:Variant.Ursu.470972"
  146. },
  147. {
  148. "VBA32": "Trojan.Inject"
  149. },
  150. {
  151. "ALYac": "Gen:Variant.Ursu.470972"
  152. },
  153. {
  154. "Ad-Aware": "Gen:Variant.Ursu.470972"
  155. },
  156. {
  157. "Malwarebytes": "Trojan.Injector"
  158. },
  159. {
  160. "Panda": "Trj/CI.A"
  161. },
  162. {
  163. "ESET-NOD32": "a variant of Win32/Injector.EFPU"
  164. },
  165. {
  166. "TrendMicro-HouseCall": "TROJ_GEN.R011C0WES19"
  167. },
  168. {
  169. "Tencent": "Win32.Trojan.Inject.Svqx"
  170. },
  171. {
  172. "Yandex": "Trojan.Inject!Dp60aO43DPs"
  173. },
  174. {
  175. "Fortinet": "W32/Injector.EFPU!tr"
  176. },
  177. {
  178. "AVG": "Win32:Trojan-gen"
  179. },
  180. {
  181. "Avast": "Win32:Trojan-gen"
  182. },
  183. {
  184. "CrowdStrike": "win/malicious_confidence_80% (W)"
  185. },
  186. {
  187. "MaxSecure": "Trojan.Malware.74336550.susgen"
  188. }
  189. ]
  190. },
  191. {
  192. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  193. "Details": [
  194. {
  195. "target": "clamav:Win.Trojan.Generic-6982539-0, sha256:9d8ad4c4aea07b90651f9f9bdf9dc98cfc7bacd644f3fd1f8523127e217b55ad, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  196. }
  197. ]
  198. },
  199. {
  200. "Description": "Anomalous binary characteristics",
  201. "Details": [
  202. {
  203. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  204. }
  205. ]
  206. }
  207. ]
  208.  
  209. [*] Started Service: []
  210.  
  211. [*] Executed Commands: []
  212.  
  213. [*] Mutexes: []
  214.  
  215. [*] Modified Files: []
  216.  
  217. [*] Deleted Files: []
  218.  
  219. [*] Modified Registry Keys: []
  220.  
  221. [*] Deleted Registry Keys: []
  222.  
  223. [*] DNS Communications: []
  224.  
  225. [*] Domains: []
  226.  
  227. [*] Network Communication - ICMP: []
  228.  
  229. [*] Network Communication - HTTP: []
  230.  
  231. [*] Network Communication - SMTP: []
  232.  
  233. [*] Network Communication - Hosts: []
  234.  
  235. [*] Network Communication - IRC: []
  236.  
  237. [*] Static Analysis: {
  238. "pe": {
  239. "peid_signatures": [
  240. [
  241. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  242. ]
  243. ],
  244. "imports": [
  245. {
  246. "imports": [
  247. {
  248. "name": "LoadLibraryA",
  249. "address": "0x6fbf34"
  250. },
  251. {
  252. "name": "GetProcAddress",
  253. "address": "0x6fbf38"
  254. },
  255. {
  256. "name": "VirtualProtect",
  257. "address": "0x6fbf3c"
  258. },
  259. {
  260. "name": "ExitProcess",
  261. "address": "0x6fbf40"
  262. }
  263. ],
  264. "dll": "KERNEL32.DLL"
  265. },
  266. {
  267. "imports": [
  268. {
  269. "name": "RegCloseKey",
  270. "address": "0x6fbf48"
  271. }
  272. ],
  273. "dll": "advapi32.dll"
  274. },
  275. {
  276. "imports": [
  277. {
  278. "name": "ImageList_Add",
  279. "address": "0x6fbf50"
  280. }
  281. ],
  282. "dll": "comctl32.dll"
  283. },
  284. {
  285. "imports": [
  286. {
  287. "name": "SaveDC",
  288. "address": "0x6fbf58"
  289. }
  290. ],
  291. "dll": "gdi32.dll"
  292. },
  293. {
  294. "imports": [
  295. {
  296. "name": "VariantCopy",
  297. "address": "0x6fbf60"
  298. }
  299. ],
  300. "dll": "oleaut32.dll"
  301. },
  302. {
  303. "imports": [
  304. {
  305. "name": "SHGetFolderPathA",
  306. "address": "0x6fbf68"
  307. }
  308. ],
  309. "dll": "shfolder.dll"
  310. },
  311. {
  312. "imports": [
  313. {
  314. "name": "GetDC",
  315. "address": "0x6fbf70"
  316. }
  317. ],
  318. "dll": "user32.dll"
  319. },
  320. {
  321. "imports": [
  322. {
  323. "name": "VerQueryValueA",
  324. "address": "0x6fbf78"
  325. }
  326. ],
  327. "dll": "version.dll"
  328. }
  329. ],
  330. "digital_signers": null,
  331. "exported_dll_name": null,
  332. "actual_checksum": "0x001ee565",
  333. "overlay": null,
  334. "imagebase": "0x00400000",
  335. "reported_checksum": "0x00000000",
  336. "icon_hash": null,
  337. "entrypoint": "0x006e8ee0",
  338. "timestamp": "1992-06-19 22:22:17",
  339. "osversion": "4.0",
  340. "sections": [
  341. {
  342. "name": "UPX0",
  343. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  344. "virtual_address": "0x00001000",
  345. "size_of_data": "0x00000000",
  346. "entropy": "0.00",
  347. "raw_address": "0x00000400",
  348. "virtual_size": "0x00118000",
  349. "characteristics_raw": "0xe0000080"
  350. },
  351. {
  352. "name": "UPX1",
  353. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  354. "virtual_address": "0x00119000",
  355. "size_of_data": "0x001d0200",
  356. "entropy": "7.80",
  357. "raw_address": "0x00000400",
  358. "virtual_size": "0x001d1000",
  359. "characteristics_raw": "0xe0000040"
  360. },
  361. {
  362. "name": ".rsrc",
  363. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  364. "virtual_address": "0x002ea000",
  365. "size_of_data": "0x00012200",
  366. "entropy": "5.12",
  367. "raw_address": "0x001d0600",
  368. "virtual_size": "0x00013000",
  369. "characteristics_raw": "0xc0000040"
  370. }
  371. ],
  372. "resources": [
  373. {
  374. "name": "RT_CURSOR",
  375. "language": "LANG_NEUTRAL",
  376. "filetype": null,
  377. "sublanguage": "SUBLANG_NEUTRAL",
  378. "entropy": "0.00",
  379. "offset": "0x000773e0",
  380. "size": "0x00000134"
  381. },
  382. {
  383. "name": "RT_CURSOR",
  384. "language": "LANG_NEUTRAL",
  385. "filetype": null,
  386. "sublanguage": "SUBLANG_NEUTRAL",
  387. "entropy": "0.00",
  388. "offset": "0x000773e0",
  389. "size": "0x00000134"
  390. },
  391. {
  392. "name": "RT_CURSOR",
  393. "language": "LANG_NEUTRAL",
  394. "filetype": null,
  395. "sublanguage": "SUBLANG_NEUTRAL",
  396. "entropy": "0.00",
  397. "offset": "0x000773e0",
  398. "size": "0x00000134"
  399. },
  400. {
  401. "name": "RT_CURSOR",
  402. "language": "LANG_NEUTRAL",
  403. "filetype": null,
  404. "sublanguage": "SUBLANG_NEUTRAL",
  405. "entropy": "0.00",
  406. "offset": "0x000773e0",
  407. "size": "0x00000134"
  408. },
  409. {
  410. "name": "RT_CURSOR",
  411. "language": "LANG_NEUTRAL",
  412. "filetype": null,
  413. "sublanguage": "SUBLANG_NEUTRAL",
  414. "entropy": "0.00",
  415. "offset": "0x000773e0",
  416. "size": "0x00000134"
  417. },
  418. {
  419. "name": "RT_CURSOR",
  420. "language": "LANG_NEUTRAL",
  421. "filetype": null,
  422. "sublanguage": "SUBLANG_NEUTRAL",
  423. "entropy": "0.00",
  424. "offset": "0x000773e0",
  425. "size": "0x00000134"
  426. },
  427. {
  428. "name": "RT_CURSOR",
  429. "language": "LANG_NEUTRAL",
  430. "filetype": null,
  431. "sublanguage": "SUBLANG_NEUTRAL",
  432. "entropy": "0.00",
  433. "offset": "0x000773e0",
  434. "size": "0x00000134"
  435. },
  436. {
  437. "name": "RT_BITMAP",
  438. "language": "LANG_ARABIC",
  439. "filetype": null,
  440. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  441. "entropy": "0.00",
  442. "offset": "0x00078748",
  443. "size": "0x000000e8"
  444. },
  445. {
  446. "name": "RT_BITMAP",
  447. "language": "LANG_ARABIC",
  448. "filetype": null,
  449. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  450. "entropy": "0.00",
  451. "offset": "0x00078748",
  452. "size": "0x000000e8"
  453. },
  454. {
  455. "name": "RT_BITMAP",
  456. "language": "LANG_ARABIC",
  457. "filetype": null,
  458. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  459. "entropy": "0.00",
  460. "offset": "0x00078748",
  461. "size": "0x000000e8"
  462. },
  463. {
  464. "name": "RT_BITMAP",
  465. "language": "LANG_ARABIC",
  466. "filetype": null,
  467. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  468. "entropy": "0.00",
  469. "offset": "0x00078748",
  470. "size": "0x000000e8"
  471. },
  472. {
  473. "name": "RT_BITMAP",
  474. "language": "LANG_ARABIC",
  475. "filetype": null,
  476. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  477. "entropy": "0.00",
  478. "offset": "0x00078748",
  479. "size": "0x000000e8"
  480. },
  481. {
  482. "name": "RT_BITMAP",
  483. "language": "LANG_ARABIC",
  484. "filetype": null,
  485. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  486. "entropy": "0.00",
  487. "offset": "0x00078748",
  488. "size": "0x000000e8"
  489. },
  490. {
  491. "name": "RT_BITMAP",
  492. "language": "LANG_ARABIC",
  493. "filetype": null,
  494. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  495. "entropy": "0.00",
  496. "offset": "0x00078748",
  497. "size": "0x000000e8"
  498. },
  499. {
  500. "name": "RT_BITMAP",
  501. "language": "LANG_ARABIC",
  502. "filetype": null,
  503. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  504. "entropy": "0.00",
  505. "offset": "0x00078748",
  506. "size": "0x000000e8"
  507. },
  508. {
  509. "name": "RT_BITMAP",
  510. "language": "LANG_ARABIC",
  511. "filetype": null,
  512. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  513. "entropy": "0.00",
  514. "offset": "0x00078748",
  515. "size": "0x000000e8"
  516. },
  517. {
  518. "name": "RT_BITMAP",
  519. "language": "LANG_ARABIC",
  520. "filetype": null,
  521. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  522. "entropy": "0.00",
  523. "offset": "0x00078748",
  524. "size": "0x000000e8"
  525. },
  526. {
  527. "name": "RT_BITMAP",
  528. "language": "LANG_ARABIC",
  529. "filetype": null,
  530. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  531. "entropy": "0.00",
  532. "offset": "0x00078748",
  533. "size": "0x000000e8"
  534. },
  535. {
  536. "name": "RT_DIALOG",
  537. "language": "LANG_NEUTRAL",
  538. "filetype": null,
  539. "sublanguage": "SUBLANG_NEUTRAL",
  540. "entropy": "0.00",
  541. "offset": "0x00089058",
  542. "size": "0x00000052"
  543. },
  544. {
  545. "name": "RT_STRING",
  546. "language": "LANG_NEUTRAL",
  547. "filetype": null,
  548. "sublanguage": "SUBLANG_NEUTRAL",
  549. "entropy": "0.00",
  550. "offset": "0x0008b4d8",
  551. "size": "0x000002b4"
  552. },
  553. {
  554. "name": "RT_STRING",
  555. "language": "LANG_NEUTRAL",
  556. "filetype": null,
  557. "sublanguage": "SUBLANG_NEUTRAL",
  558. "entropy": "0.00",
  559. "offset": "0x0008b4d8",
  560. "size": "0x000002b4"
  561. },
  562. {
  563. "name": "RT_STRING",
  564. "language": "LANG_NEUTRAL",
  565. "filetype": null,
  566. "sublanguage": "SUBLANG_NEUTRAL",
  567. "entropy": "0.00",
  568. "offset": "0x0008b4d8",
  569. "size": "0x000002b4"
  570. },
  571. {
  572. "name": "RT_STRING",
  573. "language": "LANG_NEUTRAL",
  574. "filetype": null,
  575. "sublanguage": "SUBLANG_NEUTRAL",
  576. "entropy": "0.00",
  577. "offset": "0x0008b4d8",
  578. "size": "0x000002b4"
  579. },
  580. {
  581. "name": "RT_STRING",
  582. "language": "LANG_NEUTRAL",
  583. "filetype": null,
  584. "sublanguage": "SUBLANG_NEUTRAL",
  585. "entropy": "0.00",
  586. "offset": "0x0008b4d8",
  587. "size": "0x000002b4"
  588. },
  589. {
  590. "name": "RT_STRING",
  591. "language": "LANG_NEUTRAL",
  592. "filetype": null,
  593. "sublanguage": "SUBLANG_NEUTRAL",
  594. "entropy": "0.00",
  595. "offset": "0x0008b4d8",
  596. "size": "0x000002b4"
  597. },
  598. {
  599. "name": "RT_STRING",
  600. "language": "LANG_NEUTRAL",
  601. "filetype": null,
  602. "sublanguage": "SUBLANG_NEUTRAL",
  603. "entropy": "0.00",
  604. "offset": "0x0008b4d8",
  605. "size": "0x000002b4"
  606. },
  607. {
  608. "name": "RT_STRING",
  609. "language": "LANG_NEUTRAL",
  610. "filetype": null,
  611. "sublanguage": "SUBLANG_NEUTRAL",
  612. "entropy": "0.00",
  613. "offset": "0x0008b4d8",
  614. "size": "0x000002b4"
  615. },
  616. {
  617. "name": "RT_STRING",
  618. "language": "LANG_NEUTRAL",
  619. "filetype": null,
  620. "sublanguage": "SUBLANG_NEUTRAL",
  621. "entropy": "0.00",
  622. "offset": "0x0008b4d8",
  623. "size": "0x000002b4"
  624. },
  625. {
  626. "name": "RT_STRING",
  627. "language": "LANG_NEUTRAL",
  628. "filetype": null,
  629. "sublanguage": "SUBLANG_NEUTRAL",
  630. "entropy": "0.00",
  631. "offset": "0x0008b4d8",
  632. "size": "0x000002b4"
  633. },
  634. {
  635. "name": "RT_STRING",
  636. "language": "LANG_NEUTRAL",
  637. "filetype": null,
  638. "sublanguage": "SUBLANG_NEUTRAL",
  639. "entropy": "0.00",
  640. "offset": "0x0008b4d8",
  641. "size": "0x000002b4"
  642. },
  643. {
  644. "name": "RT_STRING",
  645. "language": "LANG_NEUTRAL",
  646. "filetype": null,
  647. "sublanguage": "SUBLANG_NEUTRAL",
  648. "entropy": "0.00",
  649. "offset": "0x0008b4d8",
  650. "size": "0x000002b4"
  651. },
  652. {
  653. "name": "RT_STRING",
  654. "language": "LANG_NEUTRAL",
  655. "filetype": null,
  656. "sublanguage": "SUBLANG_NEUTRAL",
  657. "entropy": "0.00",
  658. "offset": "0x0008b4d8",
  659. "size": "0x000002b4"
  660. },
  661. {
  662. "name": "RT_STRING",
  663. "language": "LANG_NEUTRAL",
  664. "filetype": null,
  665. "sublanguage": "SUBLANG_NEUTRAL",
  666. "entropy": "0.00",
  667. "offset": "0x0008b4d8",
  668. "size": "0x000002b4"
  669. },
  670. {
  671. "name": "RT_STRING",
  672. "language": "LANG_NEUTRAL",
  673. "filetype": null,
  674. "sublanguage": "SUBLANG_NEUTRAL",
  675. "entropy": "0.00",
  676. "offset": "0x0008b4d8",
  677. "size": "0x000002b4"
  678. },
  679. {
  680. "name": "RT_STRING",
  681. "language": "LANG_NEUTRAL",
  682. "filetype": null,
  683. "sublanguage": "SUBLANG_NEUTRAL",
  684. "entropy": "0.00",
  685. "offset": "0x0008b4d8",
  686. "size": "0x000002b4"
  687. },
  688. {
  689. "name": "RT_STRING",
  690. "language": "LANG_NEUTRAL",
  691. "filetype": null,
  692. "sublanguage": "SUBLANG_NEUTRAL",
  693. "entropy": "0.00",
  694. "offset": "0x0008b4d8",
  695. "size": "0x000002b4"
  696. },
  697. {
  698. "name": "RT_RCDATA",
  699. "language": "LANG_NEUTRAL",
  700. "filetype": null,
  701. "sublanguage": "SUBLANG_NEUTRAL",
  702. "entropy": "0.00",
  703. "offset": "0x00288ab8",
  704. "size": "0x0005cac2"
  705. },
  706. {
  707. "name": "RT_RCDATA",
  708. "language": "LANG_NEUTRAL",
  709. "filetype": null,
  710. "sublanguage": "SUBLANG_NEUTRAL",
  711. "entropy": "0.00",
  712. "offset": "0x00288ab8",
  713. "size": "0x0005cac2"
  714. },
  715. {
  716. "name": "RT_RCDATA",
  717. "language": "LANG_NEUTRAL",
  718. "filetype": null,
  719. "sublanguage": "SUBLANG_NEUTRAL",
  720. "entropy": "0.00",
  721. "offset": "0x00288ab8",
  722. "size": "0x0005cac2"
  723. },
  724. {
  725. "name": "RT_RCDATA",
  726. "language": "LANG_NEUTRAL",
  727. "filetype": null,
  728. "sublanguage": "SUBLANG_NEUTRAL",
  729. "entropy": "0.00",
  730. "offset": "0x00288ab8",
  731. "size": "0x0005cac2"
  732. },
  733. {
  734. "name": "RT_RCDATA",
  735. "language": "LANG_NEUTRAL",
  736. "filetype": null,
  737. "sublanguage": "SUBLANG_NEUTRAL",
  738. "entropy": "0.00",
  739. "offset": "0x00288ab8",
  740. "size": "0x0005cac2"
  741. },
  742. {
  743. "name": "RT_RCDATA",
  744. "language": "LANG_NEUTRAL",
  745. "filetype": null,
  746. "sublanguage": "SUBLANG_NEUTRAL",
  747. "entropy": "0.00",
  748. "offset": "0x00288ab8",
  749. "size": "0x0005cac2"
  750. }
  751. ],
  752. "dirents": [
  753. {
  754. "virtual_address": "0x00000000",
  755. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  756. "size": "0x00000000"
  757. },
  758. {
  759. "virtual_address": "0x002fbe80",
  760. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  761. "size": "0x00000200"
  762. },
  763. {
  764. "virtual_address": "0x002ea000",
  765. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  766. "size": "0x00011e80"
  767. },
  768. {
  769. "virtual_address": "0x00000000",
  770. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  771. "size": "0x00000000"
  772. },
  773. {
  774. "virtual_address": "0x00000000",
  775. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  776. "size": "0x00000000"
  777. },
  778. {
  779. "virtual_address": "0x00000000",
  780. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  781. "size": "0x00000000"
  782. },
  783. {
  784. "virtual_address": "0x00000000",
  785. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  786. "size": "0x00000000"
  787. },
  788. {
  789. "virtual_address": "0x00000000",
  790. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  791. "size": "0x00000000"
  792. },
  793. {
  794. "virtual_address": "0x00000000",
  795. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  796. "size": "0x00000000"
  797. },
  798. {
  799. "virtual_address": "0x002e9090",
  800. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  801. "size": "0x00000018"
  802. },
  803. {
  804. "virtual_address": "0x00000000",
  805. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  806. "size": "0x00000000"
  807. },
  808. {
  809. "virtual_address": "0x00000000",
  810. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  811. "size": "0x00000000"
  812. },
  813. {
  814. "virtual_address": "0x00000000",
  815. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  816. "size": "0x00000000"
  817. },
  818. {
  819. "virtual_address": "0x00000000",
  820. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  821. "size": "0x00000000"
  822. },
  823. {
  824. "virtual_address": "0x00000000",
  825. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  826. "size": "0x00000000"
  827. },
  828. {
  829. "virtual_address": "0x00000000",
  830. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  831. "size": "0x00000000"
  832. }
  833. ],
  834. "exports": [],
  835. "guest_signers": {},
  836. "imphash": "7fdbee4a55ee41124cfc9a5131b45c10",
  837. "icon_fuzzy": null,
  838. "icon": null,
  839. "pdbpath": null,
  840. "imported_dll_count": 8,
  841. "versioninfo": []
  842. }
  843. }
  844.  
  845. [*] Resolved APIs: []
  846.  
  847. [*] Static Analysis: {
  848. "pe": {
  849. "peid_signatures": [
  850. [
  851. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  852. ]
  853. ],
  854. "imports": [
  855. {
  856. "imports": [
  857. {
  858. "name": "LoadLibraryA",
  859. "address": "0x6fbf34"
  860. },
  861. {
  862. "name": "GetProcAddress",
  863. "address": "0x6fbf38"
  864. },
  865. {
  866. "name": "VirtualProtect",
  867. "address": "0x6fbf3c"
  868. },
  869. {
  870. "name": "ExitProcess",
  871. "address": "0x6fbf40"
  872. }
  873. ],
  874. "dll": "KERNEL32.DLL"
  875. },
  876. {
  877. "imports": [
  878. {
  879. "name": "RegCloseKey",
  880. "address": "0x6fbf48"
  881. }
  882. ],
  883. "dll": "advapi32.dll"
  884. },
  885. {
  886. "imports": [
  887. {
  888. "name": "ImageList_Add",
  889. "address": "0x6fbf50"
  890. }
  891. ],
  892. "dll": "comctl32.dll"
  893. },
  894. {
  895. "imports": [
  896. {
  897. "name": "SaveDC",
  898. "address": "0x6fbf58"
  899. }
  900. ],
  901. "dll": "gdi32.dll"
  902. },
  903. {
  904. "imports": [
  905. {
  906. "name": "VariantCopy",
  907. "address": "0x6fbf60"
  908. }
  909. ],
  910. "dll": "oleaut32.dll"
  911. },
  912. {
  913. "imports": [
  914. {
  915. "name": "SHGetFolderPathA",
  916. "address": "0x6fbf68"
  917. }
  918. ],
  919. "dll": "shfolder.dll"
  920. },
  921. {
  922. "imports": [
  923. {
  924. "name": "GetDC",
  925. "address": "0x6fbf70"
  926. }
  927. ],
  928. "dll": "user32.dll"
  929. },
  930. {
  931. "imports": [
  932. {
  933. "name": "VerQueryValueA",
  934. "address": "0x6fbf78"
  935. }
  936. ],
  937. "dll": "version.dll"
  938. }
  939. ],
  940. "digital_signers": null,
  941. "exported_dll_name": null,
  942. "actual_checksum": "0x001ee565",
  943. "overlay": null,
  944. "imagebase": "0x00400000",
  945. "reported_checksum": "0x00000000",
  946. "icon_hash": null,
  947. "entrypoint": "0x006e8ee0",
  948. "timestamp": "1992-06-19 22:22:17",
  949. "osversion": "4.0",
  950. "sections": [
  951. {
  952. "name": "UPX0",
  953. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  954. "virtual_address": "0x00001000",
  955. "size_of_data": "0x00000000",
  956. "entropy": "0.00",
  957. "raw_address": "0x00000400",
  958. "virtual_size": "0x00118000",
  959. "characteristics_raw": "0xe0000080"
  960. },
  961. {
  962. "name": "UPX1",
  963. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  964. "virtual_address": "0x00119000",
  965. "size_of_data": "0x001d0200",
  966. "entropy": "7.80",
  967. "raw_address": "0x00000400",
  968. "virtual_size": "0x001d1000",
  969. "characteristics_raw": "0xe0000040"
  970. },
  971. {
  972. "name": ".rsrc",
  973. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  974. "virtual_address": "0x002ea000",
  975. "size_of_data": "0x00012200",
  976. "entropy": "5.12",
  977. "raw_address": "0x001d0600",
  978. "virtual_size": "0x00013000",
  979. "characteristics_raw": "0xc0000040"
  980. }
  981. ],
  982. "resources": [
  983. {
  984. "name": "RT_CURSOR",
  985. "language": "LANG_NEUTRAL",
  986. "filetype": null,
  987. "sublanguage": "SUBLANG_NEUTRAL",
  988. "entropy": "0.00",
  989. "offset": "0x000773e0",
  990. "size": "0x00000134"
  991. },
  992. {
  993. "name": "RT_CURSOR",
  994. "language": "LANG_NEUTRAL",
  995. "filetype": null,
  996. "sublanguage": "SUBLANG_NEUTRAL",
  997. "entropy": "0.00",
  998. "offset": "0x000773e0",
  999. "size": "0x00000134"
  1000. },
  1001. {
  1002. "name": "RT_CURSOR",
  1003. "language": "LANG_NEUTRAL",
  1004. "filetype": null,
  1005. "sublanguage": "SUBLANG_NEUTRAL",
  1006. "entropy": "0.00",
  1007. "offset": "0x000773e0",
  1008. "size": "0x00000134"
  1009. },
  1010. {
  1011. "name": "RT_CURSOR",
  1012. "language": "LANG_NEUTRAL",
  1013. "filetype": null,
  1014. "sublanguage": "SUBLANG_NEUTRAL",
  1015. "entropy": "0.00",
  1016. "offset": "0x000773e0",
  1017. "size": "0x00000134"
  1018. },
  1019. {
  1020. "name": "RT_CURSOR",
  1021. "language": "LANG_NEUTRAL",
  1022. "filetype": null,
  1023. "sublanguage": "SUBLANG_NEUTRAL",
  1024. "entropy": "0.00",
  1025. "offset": "0x000773e0",
  1026. "size": "0x00000134"
  1027. },
  1028. {
  1029. "name": "RT_CURSOR",
  1030. "language": "LANG_NEUTRAL",
  1031. "filetype": null,
  1032. "sublanguage": "SUBLANG_NEUTRAL",
  1033. "entropy": "0.00",
  1034. "offset": "0x000773e0",
  1035. "size": "0x00000134"
  1036. },
  1037. {
  1038. "name": "RT_CURSOR",
  1039. "language": "LANG_NEUTRAL",
  1040. "filetype": null,
  1041. "sublanguage": "SUBLANG_NEUTRAL",
  1042. "entropy": "0.00",
  1043. "offset": "0x000773e0",
  1044. "size": "0x00000134"
  1045. },
  1046. {
  1047. "name": "RT_BITMAP",
  1048. "language": "LANG_ARABIC",
  1049. "filetype": null,
  1050. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1051. "entropy": "0.00",
  1052. "offset": "0x00078748",
  1053. "size": "0x000000e8"
  1054. },
  1055. {
  1056. "name": "RT_BITMAP",
  1057. "language": "LANG_ARABIC",
  1058. "filetype": null,
  1059. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1060. "entropy": "0.00",
  1061. "offset": "0x00078748",
  1062. "size": "0x000000e8"
  1063. },
  1064. {
  1065. "name": "RT_BITMAP",
  1066. "language": "LANG_ARABIC",
  1067. "filetype": null,
  1068. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1069. "entropy": "0.00",
  1070. "offset": "0x00078748",
  1071. "size": "0x000000e8"
  1072. },
  1073. {
  1074. "name": "RT_BITMAP",
  1075. "language": "LANG_ARABIC",
  1076. "filetype": null,
  1077. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1078. "entropy": "0.00",
  1079. "offset": "0x00078748",
  1080. "size": "0x000000e8"
  1081. },
  1082. {
  1083. "name": "RT_BITMAP",
  1084. "language": "LANG_ARABIC",
  1085. "filetype": null,
  1086. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1087. "entropy": "0.00",
  1088. "offset": "0x00078748",
  1089. "size": "0x000000e8"
  1090. },
  1091. {
  1092. "name": "RT_BITMAP",
  1093. "language": "LANG_ARABIC",
  1094. "filetype": null,
  1095. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1096. "entropy": "0.00",
  1097. "offset": "0x00078748",
  1098. "size": "0x000000e8"
  1099. },
  1100. {
  1101. "name": "RT_BITMAP",
  1102. "language": "LANG_ARABIC",
  1103. "filetype": null,
  1104. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1105. "entropy": "0.00",
  1106. "offset": "0x00078748",
  1107. "size": "0x000000e8"
  1108. },
  1109. {
  1110. "name": "RT_BITMAP",
  1111. "language": "LANG_ARABIC",
  1112. "filetype": null,
  1113. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1114. "entropy": "0.00",
  1115. "offset": "0x00078748",
  1116. "size": "0x000000e8"
  1117. },
  1118. {
  1119. "name": "RT_BITMAP",
  1120. "language": "LANG_ARABIC",
  1121. "filetype": null,
  1122. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1123. "entropy": "0.00",
  1124. "offset": "0x00078748",
  1125. "size": "0x000000e8"
  1126. },
  1127. {
  1128. "name": "RT_BITMAP",
  1129. "language": "LANG_ARABIC",
  1130. "filetype": null,
  1131. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1132. "entropy": "0.00",
  1133. "offset": "0x00078748",
  1134. "size": "0x000000e8"
  1135. },
  1136. {
  1137. "name": "RT_BITMAP",
  1138. "language": "LANG_ARABIC",
  1139. "filetype": null,
  1140. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1141. "entropy": "0.00",
  1142. "offset": "0x00078748",
  1143. "size": "0x000000e8"
  1144. },
  1145. {
  1146. "name": "RT_DIALOG",
  1147. "language": "LANG_NEUTRAL",
  1148. "filetype": null,
  1149. "sublanguage": "SUBLANG_NEUTRAL",
  1150. "entropy": "0.00",
  1151. "offset": "0x00089058",
  1152. "size": "0x00000052"
  1153. },
  1154. {
  1155. "name": "RT_STRING",
  1156. "language": "LANG_NEUTRAL",
  1157. "filetype": null,
  1158. "sublanguage": "SUBLANG_NEUTRAL",
  1159. "entropy": "0.00",
  1160. "offset": "0x0008b4d8",
  1161. "size": "0x000002b4"
  1162. },
  1163. {
  1164. "name": "RT_STRING",
  1165. "language": "LANG_NEUTRAL",
  1166. "filetype": null,
  1167. "sublanguage": "SUBLANG_NEUTRAL",
  1168. "entropy": "0.00",
  1169. "offset": "0x0008b4d8",
  1170. "size": "0x000002b4"
  1171. },
  1172. {
  1173. "name": "RT_STRING",
  1174. "language": "LANG_NEUTRAL",
  1175. "filetype": null,
  1176. "sublanguage": "SUBLANG_NEUTRAL",
  1177. "entropy": "0.00",
  1178. "offset": "0x0008b4d8",
  1179. "size": "0x000002b4"
  1180. },
  1181. {
  1182. "name": "RT_STRING",
  1183. "language": "LANG_NEUTRAL",
  1184. "filetype": null,
  1185. "sublanguage": "SUBLANG_NEUTRAL",
  1186. "entropy": "0.00",
  1187. "offset": "0x0008b4d8",
  1188. "size": "0x000002b4"
  1189. },
  1190. {
  1191. "name": "RT_STRING",
  1192. "language": "LANG_NEUTRAL",
  1193. "filetype": null,
  1194. "sublanguage": "SUBLANG_NEUTRAL",
  1195. "entropy": "0.00",
  1196. "offset": "0x0008b4d8",
  1197. "size": "0x000002b4"
  1198. },
  1199. {
  1200. "name": "RT_STRING",
  1201. "language": "LANG_NEUTRAL",
  1202. "filetype": null,
  1203. "sublanguage": "SUBLANG_NEUTRAL",
  1204. "entropy": "0.00",
  1205. "offset": "0x0008b4d8",
  1206. "size": "0x000002b4"
  1207. },
  1208. {
  1209. "name": "RT_STRING",
  1210. "language": "LANG_NEUTRAL",
  1211. "filetype": null,
  1212. "sublanguage": "SUBLANG_NEUTRAL",
  1213. "entropy": "0.00",
  1214. "offset": "0x0008b4d8",
  1215. "size": "0x000002b4"
  1216. },
  1217. {
  1218. "name": "RT_STRING",
  1219. "language": "LANG_NEUTRAL",
  1220. "filetype": null,
  1221. "sublanguage": "SUBLANG_NEUTRAL",
  1222. "entropy": "0.00",
  1223. "offset": "0x0008b4d8",
  1224. "size": "0x000002b4"
  1225. },
  1226. {
  1227. "name": "RT_STRING",
  1228. "language": "LANG_NEUTRAL",
  1229. "filetype": null,
  1230. "sublanguage": "SUBLANG_NEUTRAL",
  1231. "entropy": "0.00",
  1232. "offset": "0x0008b4d8",
  1233. "size": "0x000002b4"
  1234. },
  1235. {
  1236. "name": "RT_STRING",
  1237. "language": "LANG_NEUTRAL",
  1238. "filetype": null,
  1239. "sublanguage": "SUBLANG_NEUTRAL",
  1240. "entropy": "0.00",
  1241. "offset": "0x0008b4d8",
  1242. "size": "0x000002b4"
  1243. },
  1244. {
  1245. "name": "RT_STRING",
  1246. "language": "LANG_NEUTRAL",
  1247. "filetype": null,
  1248. "sublanguage": "SUBLANG_NEUTRAL",
  1249. "entropy": "0.00",
  1250. "offset": "0x0008b4d8",
  1251. "size": "0x000002b4"
  1252. },
  1253. {
  1254. "name": "RT_STRING",
  1255. "language": "LANG_NEUTRAL",
  1256. "filetype": null,
  1257. "sublanguage": "SUBLANG_NEUTRAL",
  1258. "entropy": "0.00",
  1259. "offset": "0x0008b4d8",
  1260. "size": "0x000002b4"
  1261. },
  1262. {
  1263. "name": "RT_STRING",
  1264. "language": "LANG_NEUTRAL",
  1265. "filetype": null,
  1266. "sublanguage": "SUBLANG_NEUTRAL",
  1267. "entropy": "0.00",
  1268. "offset": "0x0008b4d8",
  1269. "size": "0x000002b4"
  1270. },
  1271. {
  1272. "name": "RT_STRING",
  1273. "language": "LANG_NEUTRAL",
  1274. "filetype": null,
  1275. "sublanguage": "SUBLANG_NEUTRAL",
  1276. "entropy": "0.00",
  1277. "offset": "0x0008b4d8",
  1278. "size": "0x000002b4"
  1279. },
  1280. {
  1281. "name": "RT_STRING",
  1282. "language": "LANG_NEUTRAL",
  1283. "filetype": null,
  1284. "sublanguage": "SUBLANG_NEUTRAL",
  1285. "entropy": "0.00",
  1286. "offset": "0x0008b4d8",
  1287. "size": "0x000002b4"
  1288. },
  1289. {
  1290. "name": "RT_STRING",
  1291. "language": "LANG_NEUTRAL",
  1292. "filetype": null,
  1293. "sublanguage": "SUBLANG_NEUTRAL",
  1294. "entropy": "0.00",
  1295. "offset": "0x0008b4d8",
  1296. "size": "0x000002b4"
  1297. },
  1298. {
  1299. "name": "RT_STRING",
  1300. "language": "LANG_NEUTRAL",
  1301. "filetype": null,
  1302. "sublanguage": "SUBLANG_NEUTRAL",
  1303. "entropy": "0.00",
  1304. "offset": "0x0008b4d8",
  1305. "size": "0x000002b4"
  1306. },
  1307. {
  1308. "name": "RT_RCDATA",
  1309. "language": "LANG_NEUTRAL",
  1310. "filetype": null,
  1311. "sublanguage": "SUBLANG_NEUTRAL",
  1312. "entropy": "0.00",
  1313. "offset": "0x00288ab8",
  1314. "size": "0x0005cac2"
  1315. },
  1316. {
  1317. "name": "RT_RCDATA",
  1318. "language": "LANG_NEUTRAL",
  1319. "filetype": null,
  1320. "sublanguage": "SUBLANG_NEUTRAL",
  1321. "entropy": "0.00",
  1322. "offset": "0x00288ab8",
  1323. "size": "0x0005cac2"
  1324. },
  1325. {
  1326. "name": "RT_RCDATA",
  1327. "language": "LANG_NEUTRAL",
  1328. "filetype": null,
  1329. "sublanguage": "SUBLANG_NEUTRAL",
  1330. "entropy": "0.00",
  1331. "offset": "0x00288ab8",
  1332. "size": "0x0005cac2"
  1333. },
  1334. {
  1335. "name": "RT_RCDATA",
  1336. "language": "LANG_NEUTRAL",
  1337. "filetype": null,
  1338. "sublanguage": "SUBLANG_NEUTRAL",
  1339. "entropy": "0.00",
  1340. "offset": "0x00288ab8",
  1341. "size": "0x0005cac2"
  1342. },
  1343. {
  1344. "name": "RT_RCDATA",
  1345. "language": "LANG_NEUTRAL",
  1346. "filetype": null,
  1347. "sublanguage": "SUBLANG_NEUTRAL",
  1348. "entropy": "0.00",
  1349. "offset": "0x00288ab8",
  1350. "size": "0x0005cac2"
  1351. },
  1352. {
  1353. "name": "RT_RCDATA",
  1354. "language": "LANG_NEUTRAL",
  1355. "filetype": null,
  1356. "sublanguage": "SUBLANG_NEUTRAL",
  1357. "entropy": "0.00",
  1358. "offset": "0x00288ab8",
  1359. "size": "0x0005cac2"
  1360. }
  1361. ],
  1362. "dirents": [
  1363. {
  1364. "virtual_address": "0x00000000",
  1365. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1366. "size": "0x00000000"
  1367. },
  1368. {
  1369. "virtual_address": "0x002fbe80",
  1370. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1371. "size": "0x00000200"
  1372. },
  1373. {
  1374. "virtual_address": "0x002ea000",
  1375. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1376. "size": "0x00011e80"
  1377. },
  1378. {
  1379. "virtual_address": "0x00000000",
  1380. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1381. "size": "0x00000000"
  1382. },
  1383. {
  1384. "virtual_address": "0x00000000",
  1385. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1386. "size": "0x00000000"
  1387. },
  1388. {
  1389. "virtual_address": "0x00000000",
  1390. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1391. "size": "0x00000000"
  1392. },
  1393. {
  1394. "virtual_address": "0x00000000",
  1395. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1396. "size": "0x00000000"
  1397. },
  1398. {
  1399. "virtual_address": "0x00000000",
  1400. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1401. "size": "0x00000000"
  1402. },
  1403. {
  1404. "virtual_address": "0x00000000",
  1405. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1406. "size": "0x00000000"
  1407. },
  1408. {
  1409. "virtual_address": "0x002e9090",
  1410. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1411. "size": "0x00000018"
  1412. },
  1413. {
  1414. "virtual_address": "0x00000000",
  1415. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1416. "size": "0x00000000"
  1417. },
  1418. {
  1419. "virtual_address": "0x00000000",
  1420. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1421. "size": "0x00000000"
  1422. },
  1423. {
  1424. "virtual_address": "0x00000000",
  1425. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1426. "size": "0x00000000"
  1427. },
  1428. {
  1429. "virtual_address": "0x00000000",
  1430. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1431. "size": "0x00000000"
  1432. },
  1433. {
  1434. "virtual_address": "0x00000000",
  1435. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1436. "size": "0x00000000"
  1437. },
  1438. {
  1439. "virtual_address": "0x00000000",
  1440. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1441. "size": "0x00000000"
  1442. }
  1443. ],
  1444. "exports": [],
  1445. "guest_signers": {},
  1446. "imphash": "7fdbee4a55ee41124cfc9a5131b45c10",
  1447. "icon_fuzzy": null,
  1448. "icon": null,
  1449. "pdbpath": null,
  1450. "imported_dll_count": 8,
  1451. "versioninfo": []
  1452. }
  1453. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!