API tools faq
paste
paladin316

Exes_ded1b05b0a49319281b31b94d9343ea6_doc_2019-07-02_01_30.json

paladin316
Jul 1st, 2019
2,262
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 59.70 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_ded1b05b0a49319281b31b94d9343ea6.doc"
  7. [*] File Size: 249344
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "9d288fe3ceb9c8173058b70a739c0d90fac7c98d95bd32709eb1160d841b2400"
  10. [*] MD5: "ded1b05b0a49319281b31b94d9343ea6"
  11. [*] SHA1: "8843476b2efc4bfcfb01ffd2d9938a277e31472a"
  12. [*] SHA512: "2e111a93b55479edd75a5afe1b4ef06ba61a737f24189e7e66408bd5994f5476c5fb72f2cb17e8e473911d53658e549f49f529e1dc0921d65f2e6b0b32bd0492"
  13. [*] CRC32: "0BBE6F8C"
  14. [*] SSDEEP: "6144:dfHuG+GzzxVWYgKW9k9R8rQ/qgBoQjxX:dvuBgxVfgKt9KU/TBoU5"
  15.  
  16. [*] Process Execution: [
  17. "Exes_ded1b05b0a49319281b31b94d9343ea6.doc",
  18. "cmd.exe",
  19. "powershell.exe",
  20. "cmd.exe",
  21. "sc.exe",
  22. "cmd.exe",
  23. "sc.exe",
  24. "cmd.exe",
  25. "sc.exe",
  26. "cmd.exe",
  27. "sc.exe",
  28. "cmd.exe",
  29. "powershell.exe",
  30. "svchost.exe",
  31. "services.exe",
  32. "lsass.exe"
  33. ]
  34.  
  35. [*] Signatures Detected: [
  36. {
  37. "Description": "Creates RWX memory",
  38. "Details": []
  39. },
  40. {
  41. "Description": "Possible date expiration check, exits too soon after checking local time",
  42. "Details": [
  43. {
  44. "process": "cmd.exe, PID 2596"
  45. }
  46. ]
  47. },
  48. {
  49. "Description": "A process created a hidden window",
  50. "Details": [
  51. {
  52. "Process": "Exes_ded1b05b0a49319281b31b94d9343ea6.doc -> cmd"
  53. },
  54. {
  55. "Process": "Exes_ded1b05b0a49319281b31b94d9343ea6.doc -> cmd"
  56. },
  57. {
  58. "Process": "Exes_ded1b05b0a49319281b31b94d9343ea6.doc -> cmd"
  59. }
  60. ]
  61. },
  62. {
  63. "Description": "The binary likely contains encrypted or compressed data.",
  64. "Details": [
  65. {
  66. "section": "name: .data, entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00029c00, virtual_size: 0x0002a17c"
  67. }
  68. ]
  69. },
  70. {
  71. "Description": "Attempts to stop active services",
  72. "Details": [
  73. {
  74. "servicename": "WinDefend"
  75. }
  76. ]
  77. },
  78. {
  79. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  80. "Details": [
  81. {
  82. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 7436051 times"
  83. }
  84. ]
  85. },
  86. {
  87. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  88. "Details": [
  89. {
  90. "modified_name": "svchost.exe",
  91. "modified_path": "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_ded1b05b0a49319281b31b94d9343ea6.doc",
  92. "original_name": "svchost.exe",
  93. "original_path": "C:\\Windows\\system32\\svchost.exe"
  94. }
  95. ]
  96. },
  97. {
  98. "Description": "Creates a hidden or system file",
  99. "Details": [
  100. {
  101. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF311648.TMP"
  102. }
  103. ]
  104. },
  105. {
  106. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  107. "Details": [
  108. {
  109. "FireEye": "Generic.mg.ded1b05b0a493192"
  110. },
  111. {
  112. "Qihoo-360": "QVM41.1.Malware.Gen"
  113. },
  114. {
  115. "McAfee": "Artemis!DED1B05B0A49"
  116. },
  117. {
  118. "Alibaba": "Trojan:Win32/Kryptik.262dcaed"
  119. },
  120. {
  121. "ESET-NOD32": "a variant of Win32/Kryptik.GTHE"
  122. },
  123. {
  124. "APEX": "Malicious"
  125. },
  126. {
  127. "Paloalto": "generic.ml"
  128. },
  129. {
  130. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  131. },
  132. {
  133. "Avast": "FileRepMalware"
  134. },
  135. {
  136. "VIPRE": "Trojan.Win32.Generic.pak!cobra"
  137. },
  138. {
  139. "Invincea": "heuristic"
  140. },
  141. {
  142. "McAfee-GW-Edition": "BehavesLike.Win32.Ramnit.dc"
  143. },
  144. {
  145. "Trapmine": "malicious.high.ml.score"
  146. },
  147. {
  148. "Webroot": "W32.Trojan.Gen"
  149. },
  150. {
  151. "Microsoft": "Trojan:Win32/MereTam.A"
  152. },
  153. {
  154. "Endgame": "malicious (high confidence)"
  155. },
  156. {
  157. "Acronis": "suspicious"
  158. },
  159. {
  160. "SentinelOne": "DFI - Malicious PE"
  161. },
  162. {
  163. "AVG": "FileRepMalware"
  164. },
  165. {
  166. "CrowdStrike": "win/malicious_confidence_100% (W)"
  167. }
  168. ]
  169. },
  170. {
  171. "Description": "Attempts to disable Windows Defender",
  172. "Details": []
  173. }
  174. ]
  175.  
  176. [*] Started Service: [
  177. "KeyIso"
  178. ]
  179.  
  180. [*] Executed Commands: [
  181. "\"C:\\Windows\\System32\\cmd.exe\" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  182. "cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  183. "\"C:\\Windows\\System32\\cmd.exe\" /c sc stop WinDefend",
  184. "cmd /c sc stop WinDefend",
  185. "\"C:\\Windows\\System32\\cmd.exe\" /c sc delete WinDefend",
  186. "cmd /c sc delete WinDefend",
  187. "C:\\Windows\\system32\\cmd.exe /c sc stop WinDefend",
  188. "C:\\Windows\\system32\\cmd.exe /c sc delete WinDefend",
  189. "C:\\Windows\\system32\\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  190. "C:\\Windows\\system32\\svchost.exe",
  191. "powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  192. "sc stop WinDefend",
  193. "sc delete WinDefend",
  194. "C:\\Windows\\system32\\lsass.exe"
  195. ]
  196.  
  197. [*] Mutexes: [
  198. "Local\\ZoneAttributeCacheCounterMutex",
  199. "Local\\ZonesCacheCounterMutex",
  200. "Local\\ZonesLockedCacheCounterMutex",
  201. "Global\\CLR_CASOFF_MUTEX",
  202. "Global\\838B6C9EB27932960"
  203. ]
  204.  
  205. [*] Modified Files: [
  206. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-0000000000-0000000000-0000000000-1000\\00000000-0000-0000-0000-000000000000b_00000000-0000-0000-0000-000000000000",
  207. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  208. "\\??\\PIPE\\srvsvc",
  209. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\S2MIU31F41L60JWXQSRZ.temp",
  210. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF311648.TMP",
  211. "C:\\Windows\\SysWOW64\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  212. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\0WFDJNQ79MIJTPU6FS4F.temp",
  213. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms"
  214. ]
  215.  
  216. [*] Deleted Files: [
  217. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF311648.TMP",
  218. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2364.3263000",
  219. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2364.3263000",
  220. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2364.3263000",
  221. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\0WFDJNQ79MIJTPU6FS4F.temp",
  222. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2180.3305343",
  223. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2180.3305343",
  224. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2180.3305359"
  225. ]
  226.  
  227. [*] Modified Registry Keys: [
  228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  230. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender",
  231. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
  232. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection",
  233. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring",
  234. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection",
  235. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnRealtimeEnable",
  236. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection",
  237. "DisableNotifications",
  238. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList"
  239. ]
  240.  
  241. [*] Deleted Registry Keys: [
  242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  243. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  245. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  246. ]
  247.  
  248. [*] DNS Communications: []
  249.  
  250. [*] Domains: []
  251.  
  252. [*] Network Communication - ICMP: []
  253.  
  254. [*] Network Communication - HTTP: []
  255.  
  256. [*] Network Communication - SMTP: []
  257.  
  258. [*] Network Communication - Hosts: []
  259.  
  260. [*] Network Communication - IRC: []
  261.  
  262. [*] Static Analysis: {
  263. "pe": {
  264. "peid_signatures": null,
  265. "imports": [
  266. {
  267. "imports": [
  268. {
  269. "name": "SetUnhandledExceptionFilter",
  270. "address": "0x404034"
  271. },
  272. {
  273. "name": "UnhandledExceptionFilter",
  274. "address": "0x404038"
  275. },
  276. {
  277. "name": "GetCurrentProcess",
  278. "address": "0x40403c"
  279. },
  280. {
  281. "name": "TerminateProcess",
  282. "address": "0x404040"
  283. },
  284. {
  285. "name": "IsDebuggerPresent",
  286. "address": "0x404044"
  287. },
  288. {
  289. "name": "InterlockedCompareExchange",
  290. "address": "0x404048"
  291. },
  292. {
  293. "name": "Sleep",
  294. "address": "0x40404c"
  295. },
  296. {
  297. "name": "InterlockedExchange",
  298. "address": "0x404050"
  299. },
  300. {
  301. "name": "QueryPerformanceCounter",
  302. "address": "0x404054"
  303. },
  304. {
  305. "name": "GetTickCount",
  306. "address": "0x404058"
  307. },
  308. {
  309. "name": "GetCurrentThreadId",
  310. "address": "0x40405c"
  311. },
  312. {
  313. "name": "GetCurrentProcessId",
  314. "address": "0x404060"
  315. },
  316. {
  317. "name": "MapViewOfFile",
  318. "address": "0x404064"
  319. },
  320. {
  321. "name": "CreateFileA",
  322. "address": "0x404068"
  323. },
  324. {
  325. "name": "GetFileSize",
  326. "address": "0x40406c"
  327. },
  328. {
  329. "name": "CloseHandle",
  330. "address": "0x404070"
  331. },
  332. {
  333. "name": "ReadFile",
  334. "address": "0x404074"
  335. },
  336. {
  337. "name": "CreateFileMappingW",
  338. "address": "0x404078"
  339. },
  340. {
  341. "name": "GetStartupInfoA",
  342. "address": "0x40407c"
  343. },
  344. {
  345. "name": "GetSystemTimeAsFileTime",
  346. "address": "0x404080"
  347. }
  348. ],
  349. "dll": "KERNEL32.dll"
  350. },
  351. {
  352. "imports": [
  353. {
  354. "name": "CreateWindowExA",
  355. "address": "0x404114"
  356. },
  357. {
  358. "name": "EndDialog",
  359. "address": "0x404118"
  360. },
  361. {
  362. "name": "ReleaseCapture",
  363. "address": "0x40411c"
  364. },
  365. {
  366. "name": "DefWindowProcA",
  367. "address": "0x404120"
  368. },
  369. {
  370. "name": "SetCapture",
  371. "address": "0x404124"
  372. },
  373. {
  374. "name": "EndPaint",
  375. "address": "0x404128"
  376. },
  377. {
  378. "name": "BeginPaint",
  379. "address": "0x40412c"
  380. },
  381. {
  382. "name": "SetWindowPos",
  383. "address": "0x404130"
  384. },
  385. {
  386. "name": "DialogBoxParamA",
  387. "address": "0x404134"
  388. },
  389. {
  390. "name": "InvalidateRect",
  391. "address": "0x404138"
  392. },
  393. {
  394. "name": "ShowCursor",
  395. "address": "0x40413c"
  396. },
  397. {
  398. "name": "SetCursor",
  399. "address": "0x404140"
  400. },
  401. {
  402. "name": "LoadCursorA",
  403. "address": "0x404144"
  404. },
  405. {
  406. "name": "DestroyWindow",
  407. "address": "0x404148"
  408. },
  409. {
  410. "name": "GetMessageA",
  411. "address": "0x40414c"
  412. },
  413. {
  414. "name": "TranslateMessage",
  415. "address": "0x404150"
  416. },
  417. {
  418. "name": "DispatchMessageA",
  419. "address": "0x404154"
  420. },
  421. {
  422. "name": "LoadIconA",
  423. "address": "0x404158"
  424. },
  425. {
  426. "name": "RegisterClassA",
  427. "address": "0x40415c"
  428. },
  429. {
  430. "name": "PostQuitMessage",
  431. "address": "0x404160"
  432. },
  433. {
  434. "name": "ShowWindow",
  435. "address": "0x404164"
  436. },
  437. {
  438. "name": "UpdateWindow",
  439. "address": "0x404168"
  440. },
  441. {
  442. "name": "MessageBoxA",
  443. "address": "0x40416c"
  444. },
  445. {
  446. "name": "GetClientRect",
  447. "address": "0x404170"
  448. },
  449. {
  450. "name": "GetSystemMetrics",
  451. "address": "0x404174"
  452. },
  453. {
  454. "name": "ClientToScreen",
  455. "address": "0x404178"
  456. },
  457. {
  458. "name": "WindowFromPoint",
  459. "address": "0x40417c"
  460. },
  461. {
  462. "name": "GetDlgCtrlID",
  463. "address": "0x404180"
  464. },
  465. {
  466. "name": "GetParent",
  467. "address": "0x404184"
  468. },
  469. {
  470. "name": "ScreenToClient",
  471. "address": "0x404188"
  472. },
  473. {
  474. "name": "MoveWindow",
  475. "address": "0x40418c"
  476. },
  477. {
  478. "name": "GetWindowRect",
  479. "address": "0x404190"
  480. },
  481. {
  482. "name": "GetDlgItem",
  483. "address": "0x404194"
  484. },
  485. {
  486. "name": "GetMenu",
  487. "address": "0x404198"
  488. }
  489. ],
  490. "dll": "USER32.dll"
  491. },
  492. {
  493. "imports": [
  494. {
  495. "name": "CreateCompatibleDC",
  496. "address": "0x404010"
  497. },
  498. {
  499. "name": "SetDIBitsToDevice",
  500. "address": "0x404014"
  501. },
  502. {
  503. "name": "SelectObject",
  504. "address": "0x404018"
  505. },
  506. {
  507. "name": "SetStretchBltMode",
  508. "address": "0x40401c"
  509. },
  510. {
  511. "name": "StretchDIBits",
  512. "address": "0x404020"
  513. },
  514. {
  515. "name": "GetStockObject",
  516. "address": "0x404024"
  517. },
  518. {
  519. "name": "CreateDIBitmap",
  520. "address": "0x404028"
  521. },
  522. {
  523. "name": "BitBlt",
  524. "address": "0x40402c"
  525. }
  526. ],
  527. "dll": "GDI32.dll"
  528. },
  529. {
  530. "imports": [
  531. {
  532. "name": "GetOpenFileNameA",
  533. "address": "0x404008"
  534. }
  535. ],
  536. "dll": "COMDLG32.dll"
  537. },
  538. {
  539. "imports": [
  540. {
  541. "name": "CryptAcquireContextA",
  542. "address": "0x404000"
  543. }
  544. ],
  545. "dll": "ADVAPI32.dll"
  546. },
  547. {
  548. "imports": [
  549. {
  550. "name": "_controlfp_s",
  551. "address": "0x404098"
  552. },
  553. {
  554. "name": "_invoke_watson",
  555. "address": "0x40409c"
  556. },
  557. {
  558. "name": "_except_handler4_common",
  559. "address": "0x4040a0"
  560. },
  561. {
  562. "name": "_decode_pointer",
  563. "address": "0x4040a4"
  564. },
  565. {
  566. "name": "_onexit",
  567. "address": "0x4040a8"
  568. },
  569. {
  570. "name": "_lock",
  571. "address": "0x4040ac"
  572. },
  573. {
  574. "name": "__dllonexit",
  575. "address": "0x4040b0"
  576. },
  577. {
  578. "name": "_unlock",
  579. "address": "0x4040b4"
  580. },
  581. {
  582. "name": "?terminate@@YAXXZ",
  583. "address": "0x4040b8"
  584. },
  585. {
  586. "name": "_crt_debugger_hook",
  587. "address": "0x4040bc"
  588. },
  589. {
  590. "name": "__set_app_type",
  591. "address": "0x4040c0"
  592. },
  593. {
  594. "name": "_encode_pointer",
  595. "address": "0x4040c4"
  596. },
  597. {
  598. "name": "__p__fmode",
  599. "address": "0x4040c8"
  600. },
  601. {
  602. "name": "__p__commode",
  603. "address": "0x4040cc"
  604. },
  605. {
  606. "name": "_adjust_fdiv",
  607. "address": "0x4040d0"
  608. },
  609. {
  610. "name": "__setusermatherr",
  611. "address": "0x4040d4"
  612. },
  613. {
  614. "name": "rand",
  615. "address": "0x4040d8"
  616. },
  617. {
  618. "name": "malloc",
  619. "address": "0x4040dc"
  620. },
  621. {
  622. "name": "free",
  623. "address": "0x4040e0"
  624. },
  625. {
  626. "name": "_amsg_exit",
  627. "address": "0x4040e4"
  628. },
  629. {
  630. "name": "__getmainargs",
  631. "address": "0x4040e8"
  632. },
  633. {
  634. "name": "_cexit",
  635. "address": "0x4040ec"
  636. },
  637. {
  638. "name": "_exit",
  639. "address": "0x4040f0"
  640. },
  641. {
  642. "name": "_XcptFilter",
  643. "address": "0x4040f4"
  644. },
  645. {
  646. "name": "_ismbblead",
  647. "address": "0x4040f8"
  648. },
  649. {
  650. "name": "exit",
  651. "address": "0x4040fc"
  652. },
  653. {
  654. "name": "_acmdln",
  655. "address": "0x404100"
  656. },
  657. {
  658. "name": "_initterm",
  659. "address": "0x404104"
  660. },
  661. {
  662. "name": "_initterm_e",
  663. "address": "0x404108"
  664. },
  665. {
  666. "name": "_configthreadlocale",
  667. "address": "0x40410c"
  668. }
  669. ],
  670. "dll": "MSVCR90.dll"
  671. },
  672. {
  673. "imports": [
  674. {
  675. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  676. "address": "0x404088"
  677. },
  678. {
  679. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  680. "address": "0x40408c"
  681. },
  682. {
  683. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  684. "address": "0x404090"
  685. }
  686. ],
  687. "dll": "MSVCP90.dll"
  688. }
  689. ],
  690. "digital_signers": null,
  691. "exported_dll_name": null,
  692. "actual_checksum": "0x0004521c",
  693. "overlay": null,
  694. "imagebase": "0x00400000",
  695. "reported_checksum": "0x0004521c",
  696. "icon_hash": null,
  697. "entrypoint": "0x00403477",
  698. "timestamp": "2019-07-01 06:45:17",
  699. "osversion": "5.0",
  700. "sections": [
  701. {
  702. "name": ".text",
  703. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  704. "virtual_address": "0x00001000",
  705. "size_of_data": "0x00002a00",
  706. "entropy": "6.26",
  707. "raw_address": "0x00000400",
  708. "virtual_size": "0x000029be",
  709. "characteristics_raw": "0x60000020"
  710. },
  711. {
  712. "name": ".rdata",
  713. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  714. "virtual_address": "0x00004000",
  715. "size_of_data": "0x00004200",
  716. "entropy": "6.08",
  717. "raw_address": "0x00002e00",
  718. "virtual_size": "0x00004096",
  719. "characteristics_raw": "0x40000040"
  720. },
  721. {
  722. "name": ".data",
  723. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  724. "virtual_address": "0x00009000",
  725. "size_of_data": "0x00029c00",
  726. "entropy": "8.00",
  727. "raw_address": "0x00007000",
  728. "virtual_size": "0x0002a17c",
  729. "characteristics_raw": "0xc0000040"
  730. },
  731. {
  732. "name": ".rsrc",
  733. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  734. "virtual_address": "0x00034000",
  735. "size_of_data": "0x0000ba00",
  736. "entropy": "5.49",
  737. "raw_address": "0x00030c00",
  738. "virtual_size": "0x0000b8ea",
  739. "characteristics_raw": "0x40000040"
  740. },
  741. {
  742. "name": ".reloc",
  743. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  744. "virtual_address": "0x00040000",
  745. "size_of_data": "0x00000800",
  746. "entropy": "5.10",
  747. "raw_address": "0x0003c600",
  748. "virtual_size": "0x000007ba",
  749. "characteristics_raw": "0x42000040"
  750. }
  751. ],
  752. "resources": [],
  753. "dirents": [
  754. {
  755. "virtual_address": "0x00000000",
  756. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  757. "size": "0x00000000"
  758. },
  759. {
  760. "virtual_address": "0x0000770c",
  761. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  762. "size": "0x000000a0"
  763. },
  764. {
  765. "virtual_address": "0x00034000",
  766. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  767. "size": "0x0000b8ea"
  768. },
  769. {
  770. "virtual_address": "0x00000000",
  771. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  772. "size": "0x00000000"
  773. },
  774. {
  775. "virtual_address": "0x00000000",
  776. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  777. "size": "0x00000000"
  778. },
  779. {
  780. "virtual_address": "0x00040000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  782. "size": "0x00000524"
  783. },
  784. {
  785. "virtual_address": "0x00000000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  787. "size": "0x00000000"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  797. "size": "0x00000000"
  798. },
  799. {
  800. "virtual_address": "0x00000000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  802. "size": "0x00000000"
  803. },
  804. {
  805. "virtual_address": "0x00007640",
  806. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  807. "size": "0x00000040"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  812. "size": "0x00000000"
  813. },
  814. {
  815. "virtual_address": "0x00004000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  817. "size": "0x000001a0"
  818. },
  819. {
  820. "virtual_address": "0x00000000",
  821. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  822. "size": "0x00000000"
  823. },
  824. {
  825. "virtual_address": "0x00000000",
  826. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  827. "size": "0x00000000"
  828. },
  829. {
  830. "virtual_address": "0x00000000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  832. "size": "0x00000000"
  833. }
  834. ],
  835. "exports": [],
  836. "guest_signers": {},
  837. "imphash": "e7da0e6cc5faa043f26b08286ff6fc41",
  838. "icon_fuzzy": null,
  839. "icon": null,
  840. "pdbpath": null,
  841. "imported_dll_count": 7,
  842. "versioninfo": []
  843. }
  844. }
  845.  
  846. [*] Resolved APIs: [
  847. "cryptsp.dll.CryptAcquireContextA",
  848. "kernel32.dll.VirtualAlloc",
  849. "ntdll.dll.memcpy",
  850. "kernel32.dll.GetCurrentProcess",
  851. "kernel32.dll.CloseHandle",
  852. "advapi32.dll.OpenProcessToken",
  853. "advapi32.dll.GetTokenInformation",
  854. "kernel32.dll.Wow64EnableWow64FsRedirection",
  855. "advapi32.dll.RegCloseKey",
  856. "advapi32.dll.RegCreateKeyW",
  857. "advapi32.dll.RegOpenKeyExW",
  858. "advapi32.dll.RegSetValueExW",
  859. "shell32.dll.ShellExecuteA",
  860. "ole32.dll.OleInitialize",
  861. "cryptbase.dll.SystemFunction036",
  862. "uxtheme.dll.ThemeInitApiHook",
  863. "user32.dll.IsProcessDPIAware",
  864. "ole32.dll.CreateBindCtx",
  865. "ole32.dll.CoTaskMemAlloc",
  866. "propsys.dll.PSCreateMemoryPropertyStore",
  867. "propsys.dll.PSPropertyBag_WriteDWORD",
  868. "ole32.dll.CoGetApartmentType",
  869. "ole32.dll.CoRegisterInitializeSpy",
  870. "ole32.dll.CoTaskMemFree",
  871. "comctl32.dll.#236",
  872. "oleaut32.dll.#6",
  873. "ole32.dll.CoGetMalloc",
  874. "propsys.dll.PSPropertyBag_ReadDWORD",
  875. "propsys.dll.PSPropertyBag_ReadGUID",
  876. "comctl32.dll.#320",
  877. "comctl32.dll.#324",
  878. "comctl32.dll.#323",
  879. "advapi32.dll.RegEnumKeyW",
  880. "advapi32.dll.OpenThreadToken",
  881. "ole32.dll.StringFromGUID2",
  882. "apphelp.dll.ApphelpCheckShellObject",
  883. "ole32.dll.CoCreateInstance",
  884. "urlmon.dll.CreateUri",
  885. "kernel32.dll.InitializeSRWLock",
  886. "kernel32.dll.AcquireSRWLockExclusive",
  887. "kernel32.dll.AcquireSRWLockShared",
  888. "kernel32.dll.ReleaseSRWLockExclusive",
  889. "kernel32.dll.ReleaseSRWLockShared",
  890. "comctl32.dll.#328",
  891. "comctl32.dll.#334",
  892. "oleaut32.dll.#2",
  893. "shell32.dll.#102",
  894. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  895. "ole32.dll.CoInitializeEx",
  896. "advapi32.dll.InitializeSecurityDescriptor",
  897. "advapi32.dll.SetEntriesInAclW",
  898. "ntmarta.dll.GetMartaExtensionInterface",
  899. "advapi32.dll.SetSecurityDescriptorDacl",
  900. "advapi32.dll.IsTextUnicode",
  901. "comctl32.dll.#332",
  902. "comctl32.dll.#338",
  903. "comctl32.dll.#339",
  904. "ole32.dll.CoUninitialize",
  905. "sechost.dll.ConvertSidToStringSidW",
  906. "profapi.dll.#104",
  907. "propsys.dll.#430",
  908. "advapi32.dll.RegGetValueW",
  909. "ole32.dll.CoTaskMemRealloc",
  910. "propsys.dll.InitPropVariantFromStringAsVector",
  911. "propsys.dll.PSCoerceToCanonicalValue",
  912. "propsys.dll.PropVariantToStringAlloc",
  913. "ole32.dll.PropVariantClear",
  914. "ole32.dll.CoAllowSetForegroundWindow",
  915. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  916. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  917. "comctl32.dll.#386",
  918. "shell32.dll.SHGetFolderPathW",
  919. "advapi32.dll.SaferGetPolicyInformation",
  920. "ntdll.dll.RtlDllShutdownInProgress",
  921. "comctl32.dll.#329",
  922. "ole32.dll.OleUninitialize",
  923. "ole32.dll.CoRevokeInitializeSpy",
  924. "comctl32.dll.#388",
  925. "oleaut32.dll.#500",
  926. "advapi32.dll.CryptAcquireContextA",
  927. "advapi32.dll.CryptImportKey",
  928. "advapi32.dll.CryptEncrypt",
  929. "cryptsp.dll.CryptImportKey",
  930. "cryptbase.dll.SystemFunction040",
  931. "cryptbase.dll.SystemFunction041",
  932. "cryptsp.dll.CryptEncrypt",
  933. "advapi32.dll.UnregisterTraceGuids",
  934. "comctl32.dll.#321",
  935. "kernel32.dll.SetThreadUILanguage",
  936. "kernel32.dll.CopyFileExW",
  937. "kernel32.dll.IsDebuggerPresent",
  938. "kernel32.dll.SetConsoleInputExeNameW",
  939. "kernel32.dll.SortGetHandle",
  940. "kernel32.dll.SortCloseHandle",
  941. "shell32.dll.#66",
  942. "comctl32.dll.#385",
  943. "comctl32.dll.#336",
  944. "comctl32.dll.#333",
  945. "linkinfo.dll.IsValidLinkInfo",
  946. "propsys.dll.#417",
  947. "propsys.dll.PSGetNameFromPropertyKey",
  948. "propsys.dll.PSStringFromPropertyKey",
  949. "propsys.dll.InitVariantFromBuffer",
  950. "oleaut32.dll.#9",
  951. "propsys.dll.PropVariantToGUID",
  952. "linkinfo.dll.CreateLinkInfoW",
  953. "user32.dll.IsCharAlphaW",
  954. "user32.dll.CharPrevW",
  955. "ntshrui.dll.GetNetResourceFromLocalPathW",
  956. "srvcli.dll.NetShareEnum",
  957. "cscapi.dll.CscNetApiGetInterface",
  958. "slc.dll.SLGetWindowsInformationDWORD",
  959. "shlwapi.dll.PathRemoveFileSpecW",
  960. "linkinfo.dll.DestroyLinkInfo",
  961. "propsys.dll.PropVariantToBoolean",
  962. "cryptsp.dll.CryptAcquireContextW",
  963. "cryptsp.dll.CryptGenRandom",
  964. "cryptsp.dll.CryptReleaseContext",
  965. "advapi32.dll.GetSecurityInfo",
  966. "advapi32.dll.SetSecurityInfo",
  967. "advapi32.dll.GetSecurityDescriptorControl",
  968. "advapi32.dll.RegQueryInfoKeyW",
  969. "advapi32.dll.RegEnumKeyExW",
  970. "advapi32.dll.RegEnumValueW",
  971. "advapi32.dll.RegQueryValueExW",
  972. "shlwapi.dll.UrlIsW",
  973. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  974. "msvcrt.dll._set_error_mode",
  975. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  976. "kernel32.dll.FindActCtxSectionStringW",
  977. "kernel32.dll.GetSystemWindowsDirectoryW",
  978. "mscoree.dll.GetProcessExecutableHeap",
  979. "mscorwks.dll.DllGetClassObjectInternal",
  980. "mscorwks.dll.GetCLRFunction",
  981. "advapi32.dll.RegisterTraceGuidsW",
  982. "advapi32.dll.GetTraceLoggerHandle",
  983. "advapi32.dll.GetTraceEnableLevel",
  984. "advapi32.dll.GetTraceEnableFlags",
  985. "advapi32.dll.TraceEvent",
  986. "mscoree.dll.IEE",
  987. "mscorwks.dll.IEE",
  988. "mscoree.dll.GetStartupFlags",
  989. "mscoree.dll.GetHostConfigurationFile",
  990. "mscoree.dll.GetCORSystemDirectory",
  991. "ntdll.dll.RtlVirtualUnwind",
  992. "kernel32.dll.IsWow64Process",
  993. "advapi32.dll.AllocateAndInitializeSid",
  994. "advapi32.dll.InitializeAcl",
  995. "advapi32.dll.AddAccessAllowedAce",
  996. "advapi32.dll.FreeSid",
  997. "kernel32.dll.SetThreadStackGuarantee",
  998. "kernel32.dll.FlsSetValue",
  999. "kernel32.dll.FlsGetValue",
  1000. "kernel32.dll.FlsAlloc",
  1001. "kernel32.dll.FlsFree",
  1002. "kernel32.dll.AddVectoredContinueHandler",
  1003. "kernel32.dll.RemoveVectoredContinueHandler",
  1004. "advapi32.dll.ConvertSidToStringSidW",
  1005. "kernel32.dll.FlushProcessWriteBuffers",
  1006. "kernel32.dll.GetWriteWatch",
  1007. "kernel32.dll.ResetWriteWatch",
  1008. "kernel32.dll.CreateMemoryResourceNotification",
  1009. "kernel32.dll.QueryMemoryResourceNotification",
  1010. "kernel32.dll.GlobalMemoryStatusEx",
  1011. "ole32.dll.CoGetContextToken",
  1012. "oleaut32.dll.#149",
  1013. "kernel32.dll.GetUserDefaultUILanguage",
  1014. "kernel32.dll.GetVersionExW",
  1015. "kernel32.dll.GetFullPathNameW",
  1016. "kernel32.dll.SetErrorMode",
  1017. "kernel32.dll.GetFileAttributesExW",
  1018. "version.dll.GetFileVersionInfoSizeW",
  1019. "version.dll.GetFileVersionInfoW",
  1020. "version.dll.VerQueryValueW",
  1021. "kernel32.dll.lstrlen",
  1022. "kernel32.dll.lstrlenW",
  1023. "mscoree.dll.ND_RI2",
  1024. "kernel32.dll.lstrcpy",
  1025. "kernel32.dll.lstrcpyW",
  1026. "version.dll.VerLanguageNameW",
  1027. "kernel32.dll.GetCurrentProcessId",
  1028. "advapi32.dll.LookupPrivilegeValueW",
  1029. "advapi32.dll.AdjustTokenPrivileges",
  1030. "kernel32.dll.OpenProcess",
  1031. "psapi.dll.EnumProcessModules",
  1032. "psapi.dll.GetModuleInformation",
  1033. "psapi.dll.GetModuleBaseNameW",
  1034. "psapi.dll.GetModuleFileNameExW",
  1035. "kernel32.dll.GetExitCodeProcess",
  1036. "ntdll.dll.NtQuerySystemInformation",
  1037. "user32.dll.EnumWindows",
  1038. "user32.dll.GetWindowThreadProcessId",
  1039. "kernel32.dll.WerSetFlags",
  1040. "kernel32.dll.SetThreadPreferredUILanguages",
  1041. "kernel32.dll.GetThreadPreferredUILanguages",
  1042. "kernel32.dll.GetUserDefaultLocaleName",
  1043. "kernel32.dll.GetEnvironmentVariableW",
  1044. "advapi32.dll.CryptReleaseContext",
  1045. "advapi32.dll.CryptCreateHash",
  1046. "advapi32.dll.CryptDestroyHash",
  1047. "advapi32.dll.CryptHashData",
  1048. "advapi32.dll.CryptGetHashParam",
  1049. "advapi32.dll.CryptExportKey",
  1050. "advapi32.dll.CryptGenKey",
  1051. "advapi32.dll.CryptGetKeyParam",
  1052. "advapi32.dll.CryptDestroyKey",
  1053. "advapi32.dll.CryptVerifySignatureA",
  1054. "advapi32.dll.CryptSignHashA",
  1055. "advapi32.dll.CryptGetProvParam",
  1056. "advapi32.dll.CryptGetUserKey",
  1057. "advapi32.dll.CryptEnumProvidersA",
  1058. "cryptsp.dll.CryptHashData",
  1059. "cryptsp.dll.CryptGetHashParam",
  1060. "cryptsp.dll.CryptDestroyHash",
  1061. "cryptsp.dll.CryptDestroyKey",
  1062. "mscoree.dll.GetTokenForVTableEntry",
  1063. "mscoree.dll.SetTargetForVTableEntry",
  1064. "mscoree.dll.GetTargetForVTableEntry",
  1065. "culture.dll.ConvertLangIdToCultureName",
  1066. "ole32.dll.CoCreateGuid",
  1067. "kernel32.dll.CreateFileW",
  1068. "kernel32.dll.GetConsoleScreenBufferInfo",
  1069. "kernel32.dll.LocalFree",
  1070. "kernel32.dll.LocalAlloc",
  1071. "mscoree.dll.ND_RI4",
  1072. "advapi32.dll.DuplicateTokenEx",
  1073. "advapi32.dll.CheckTokenMembership",
  1074. "kernel32.dll.GetConsoleTitleW",
  1075. "mscorjit.dll.getJit",
  1076. "kernel32.dll.SetConsoleTitleW",
  1077. "kernel32.dll.SetConsoleCtrlHandler",
  1078. "kernel32.dll.CreateEventW",
  1079. "ntdll.dll.WinSqmIsOptedIn",
  1080. "kernel32.dll.ExpandEnvironmentStringsW",
  1081. "shfolder.dll.SHGetFolderPathW",
  1082. "kernel32.dll.SetEnvironmentVariableW",
  1083. "kernel32.dll.GetACP",
  1084. "kernel32.dll.UnmapViewOfFile",
  1085. "kernel32.dll.GetFileType",
  1086. "kernel32.dll.ReadFile",
  1087. "kernel32.dll.GetSystemInfo",
  1088. "kernel32.dll.VirtualQuery",
  1089. "secur32.dll.GetUserNameExW",
  1090. "advapi32.dll.GetUserNameW",
  1091. "kernel32.dll.ReleaseMutex",
  1092. "advapi32.dll.RegisterEventSourceW",
  1093. "advapi32.dll.DeregisterEventSource",
  1094. "advapi32.dll.ReportEventW",
  1095. "kernel32.dll.GetLogicalDrives",
  1096. "kernel32.dll.GetDriveTypeW",
  1097. "kernel32.dll.GetVolumeInformationW",
  1098. "kernel32.dll.GetCurrentDirectoryW",
  1099. "kernel32.dll.GetLastError",
  1100. "kernel32.dll.GetStdHandle",
  1101. "kernel32.dll.GetConsoleMode",
  1102. "kernel32.dll.SetEvent",
  1103. "kernel32.dll.FindFirstFileW",
  1104. "kernel32.dll.FindClose",
  1105. "mscoree.dll.DllGetClassObject",
  1106. "diasymreader.dll.DllGetClassObjectInternal",
  1107. "kernel32.dll.GetConsoleOutputCP",
  1108. "gdi32.dll.TranslateCharsetInfo",
  1109. "kernel32.dll.SetConsoleTextAttribute",
  1110. "kernel32.dll.WriteConsoleW",
  1111. "mscoree.dll.CorExitProcess",
  1112. "mscorwks.dll.CorExitProcess",
  1113. "mscorwks.dll._CorDllMain",
  1114. "kernel32.dll.CreateActCtxW",
  1115. "kernel32.dll.AddRefActCtx",
  1116. "kernel32.dll.ReleaseActCtx",
  1117. "kernel32.dll.ActivateActCtx",
  1118. "kernel32.dll.DeactivateActCtx",
  1119. "kernel32.dll.GetCurrentActCtx",
  1120. "kernel32.dll.QueryActCtxW",
  1121. "netutils.dll.NetApiBufferFree",
  1122. "kernel32.dll.IsProcessorFeaturePresent",
  1123. "ntdll.dll.RtlUnwind",
  1124. "mscoree.dll._CorExeMain",
  1125. "mscoree.dll._CorImageUnloading",
  1126. "mscoree.dll._CorValidateImage",
  1127. "cryptsp.dll.CryptExportKey",
  1128. "cryptsp.dll.CryptCreateHash",
  1129. "kernel32.dll.SwitchToThread",
  1130. "rpcrt4.dll.UuidFromStringW",
  1131. "rpcrt4.dll.RpcBindingCreateW",
  1132. "rpcrt4.dll.RpcBindingBind",
  1133. "sechost.dll.OpenSCManagerW",
  1134. "sechost.dll.OpenServiceW",
  1135. "sechost.dll.StartServiceW",
  1136. "sechost.dll.CloseServiceHandle"
  1137. ]
  1138.  
  1139. [*] Static Analysis: {
  1140. "pe": {
  1141. "peid_signatures": null,
  1142. "imports": [
  1143. {
  1144. "imports": [
  1145. {
  1146. "name": "SetUnhandledExceptionFilter",
  1147. "address": "0x404034"
  1148. },
  1149. {
  1150. "name": "UnhandledExceptionFilter",
  1151. "address": "0x404038"
  1152. },
  1153. {
  1154. "name": "GetCurrentProcess",
  1155. "address": "0x40403c"
  1156. },
  1157. {
  1158. "name": "TerminateProcess",
  1159. "address": "0x404040"
  1160. },
  1161. {
  1162. "name": "IsDebuggerPresent",
  1163. "address": "0x404044"
  1164. },
  1165. {
  1166. "name": "InterlockedCompareExchange",
  1167. "address": "0x404048"
  1168. },
  1169. {
  1170. "name": "Sleep",
  1171. "address": "0x40404c"
  1172. },
  1173. {
  1174. "name": "InterlockedExchange",
  1175. "address": "0x404050"
  1176. },
  1177. {
  1178. "name": "QueryPerformanceCounter",
  1179. "address": "0x404054"
  1180. },
  1181. {
  1182. "name": "GetTickCount",
  1183. "address": "0x404058"
  1184. },
  1185. {
  1186. "name": "GetCurrentThreadId",
  1187. "address": "0x40405c"
  1188. },
  1189. {
  1190. "name": "GetCurrentProcessId",
  1191. "address": "0x404060"
  1192. },
  1193. {
  1194. "name": "MapViewOfFile",
  1195. "address": "0x404064"
  1196. },
  1197. {
  1198. "name": "CreateFileA",
  1199. "address": "0x404068"
  1200. },
  1201. {
  1202. "name": "GetFileSize",
  1203. "address": "0x40406c"
  1204. },
  1205. {
  1206. "name": "CloseHandle",
  1207. "address": "0x404070"
  1208. },
  1209. {
  1210. "name": "ReadFile",
  1211. "address": "0x404074"
  1212. },
  1213. {
  1214. "name": "CreateFileMappingW",
  1215. "address": "0x404078"
  1216. },
  1217. {
  1218. "name": "GetStartupInfoA",
  1219. "address": "0x40407c"
  1220. },
  1221. {
  1222. "name": "GetSystemTimeAsFileTime",
  1223. "address": "0x404080"
  1224. }
  1225. ],
  1226. "dll": "KERNEL32.dll"
  1227. },
  1228. {
  1229. "imports": [
  1230. {
  1231. "name": "CreateWindowExA",
  1232. "address": "0x404114"
  1233. },
  1234. {
  1235. "name": "EndDialog",
  1236. "address": "0x404118"
  1237. },
  1238. {
  1239. "name": "ReleaseCapture",
  1240. "address": "0x40411c"
  1241. },
  1242. {
  1243. "name": "DefWindowProcA",
  1244. "address": "0x404120"
  1245. },
  1246. {
  1247. "name": "SetCapture",
  1248. "address": "0x404124"
  1249. },
  1250. {
  1251. "name": "EndPaint",
  1252. "address": "0x404128"
  1253. },
  1254. {
  1255. "name": "BeginPaint",
  1256. "address": "0x40412c"
  1257. },
  1258. {
  1259. "name": "SetWindowPos",
  1260. "address": "0x404130"
  1261. },
  1262. {
  1263. "name": "DialogBoxParamA",
  1264. "address": "0x404134"
  1265. },
  1266. {
  1267. "name": "InvalidateRect",
  1268. "address": "0x404138"
  1269. },
  1270. {
  1271. "name": "ShowCursor",
  1272. "address": "0x40413c"
  1273. },
  1274. {
  1275. "name": "SetCursor",
  1276. "address": "0x404140"
  1277. },
  1278. {
  1279. "name": "LoadCursorA",
  1280. "address": "0x404144"
  1281. },
  1282. {
  1283. "name": "DestroyWindow",
  1284. "address": "0x404148"
  1285. },
  1286. {
  1287. "name": "GetMessageA",
  1288. "address": "0x40414c"
  1289. },
  1290. {
  1291. "name": "TranslateMessage",
  1292. "address": "0x404150"
  1293. },
  1294. {
  1295. "name": "DispatchMessageA",
  1296. "address": "0x404154"
  1297. },
  1298. {
  1299. "name": "LoadIconA",
  1300. "address": "0x404158"
  1301. },
  1302. {
  1303. "name": "RegisterClassA",
  1304. "address": "0x40415c"
  1305. },
  1306. {
  1307. "name": "PostQuitMessage",
  1308. "address": "0x404160"
  1309. },
  1310. {
  1311. "name": "ShowWindow",
  1312. "address": "0x404164"
  1313. },
  1314. {
  1315. "name": "UpdateWindow",
  1316. "address": "0x404168"
  1317. },
  1318. {
  1319. "name": "MessageBoxA",
  1320. "address": "0x40416c"
  1321. },
  1322. {
  1323. "name": "GetClientRect",
  1324. "address": "0x404170"
  1325. },
  1326. {
  1327. "name": "GetSystemMetrics",
  1328. "address": "0x404174"
  1329. },
  1330. {
  1331. "name": "ClientToScreen",
  1332. "address": "0x404178"
  1333. },
  1334. {
  1335. "name": "WindowFromPoint",
  1336. "address": "0x40417c"
  1337. },
  1338. {
  1339. "name": "GetDlgCtrlID",
  1340. "address": "0x404180"
  1341. },
  1342. {
  1343. "name": "GetParent",
  1344. "address": "0x404184"
  1345. },
  1346. {
  1347. "name": "ScreenToClient",
  1348. "address": "0x404188"
  1349. },
  1350. {
  1351. "name": "MoveWindow",
  1352. "address": "0x40418c"
  1353. },
  1354. {
  1355. "name": "GetWindowRect",
  1356. "address": "0x404190"
  1357. },
  1358. {
  1359. "name": "GetDlgItem",
  1360. "address": "0x404194"
  1361. },
  1362. {
  1363. "name": "GetMenu",
  1364. "address": "0x404198"
  1365. }
  1366. ],
  1367. "dll": "USER32.dll"
  1368. },
  1369. {
  1370. "imports": [
  1371. {
  1372. "name": "CreateCompatibleDC",
  1373. "address": "0x404010"
  1374. },
  1375. {
  1376. "name": "SetDIBitsToDevice",
  1377. "address": "0x404014"
  1378. },
  1379. {
  1380. "name": "SelectObject",
  1381. "address": "0x404018"
  1382. },
  1383. {
  1384. "name": "SetStretchBltMode",
  1385. "address": "0x40401c"
  1386. },
  1387. {
  1388. "name": "StretchDIBits",
  1389. "address": "0x404020"
  1390. },
  1391. {
  1392. "name": "GetStockObject",
  1393. "address": "0x404024"
  1394. },
  1395. {
  1396. "name": "CreateDIBitmap",
  1397. "address": "0x404028"
  1398. },
  1399. {
  1400. "name": "BitBlt",
  1401. "address": "0x40402c"
  1402. }
  1403. ],
  1404. "dll": "GDI32.dll"
  1405. },
  1406. {
  1407. "imports": [
  1408. {
  1409. "name": "GetOpenFileNameA",
  1410. "address": "0x404008"
  1411. }
  1412. ],
  1413. "dll": "COMDLG32.dll"
  1414. },
  1415. {
  1416. "imports": [
  1417. {
  1418. "name": "CryptAcquireContextA",
  1419. "address": "0x404000"
  1420. }
  1421. ],
  1422. "dll": "ADVAPI32.dll"
  1423. },
  1424. {
  1425. "imports": [
  1426. {
  1427. "name": "_controlfp_s",
  1428. "address": "0x404098"
  1429. },
  1430. {
  1431. "name": "_invoke_watson",
  1432. "address": "0x40409c"
  1433. },
  1434. {
  1435. "name": "_except_handler4_common",
  1436. "address": "0x4040a0"
  1437. },
  1438. {
  1439. "name": "_decode_pointer",
  1440. "address": "0x4040a4"
  1441. },
  1442. {
  1443. "name": "_onexit",
  1444. "address": "0x4040a8"
  1445. },
  1446. {
  1447. "name": "_lock",
  1448. "address": "0x4040ac"
  1449. },
  1450. {
  1451. "name": "__dllonexit",
  1452. "address": "0x4040b0"
  1453. },
  1454. {
  1455. "name": "_unlock",
  1456. "address": "0x4040b4"
  1457. },
  1458. {
  1459. "name": "?terminate@@YAXXZ",
  1460. "address": "0x4040b8"
  1461. },
  1462. {
  1463. "name": "_crt_debugger_hook",
  1464. "address": "0x4040bc"
  1465. },
  1466. {
  1467. "name": "__set_app_type",
  1468. "address": "0x4040c0"
  1469. },
  1470. {
  1471. "name": "_encode_pointer",
  1472. "address": "0x4040c4"
  1473. },
  1474. {
  1475. "name": "__p__fmode",
  1476. "address": "0x4040c8"
  1477. },
  1478. {
  1479. "name": "__p__commode",
  1480. "address": "0x4040cc"
  1481. },
  1482. {
  1483. "name": "_adjust_fdiv",
  1484. "address": "0x4040d0"
  1485. },
  1486. {
  1487. "name": "__setusermatherr",
  1488. "address": "0x4040d4"
  1489. },
  1490. {
  1491. "name": "rand",
  1492. "address": "0x4040d8"
  1493. },
  1494. {
  1495. "name": "malloc",
  1496. "address": "0x4040dc"
  1497. },
  1498. {
  1499. "name": "free",
  1500. "address": "0x4040e0"
  1501. },
  1502. {
  1503. "name": "_amsg_exit",
  1504. "address": "0x4040e4"
  1505. },
  1506. {
  1507. "name": "__getmainargs",
  1508. "address": "0x4040e8"
  1509. },
  1510. {
  1511. "name": "_cexit",
  1512. "address": "0x4040ec"
  1513. },
  1514. {
  1515. "name": "_exit",
  1516. "address": "0x4040f0"
  1517. },
  1518. {
  1519. "name": "_XcptFilter",
  1520. "address": "0x4040f4"
  1521. },
  1522. {
  1523. "name": "_ismbblead",
  1524. "address": "0x4040f8"
  1525. },
  1526. {
  1527. "name": "exit",
  1528. "address": "0x4040fc"
  1529. },
  1530. {
  1531. "name": "_acmdln",
  1532. "address": "0x404100"
  1533. },
  1534. {
  1535. "name": "_initterm",
  1536. "address": "0x404104"
  1537. },
  1538. {
  1539. "name": "_initterm_e",
  1540. "address": "0x404108"
  1541. },
  1542. {
  1543. "name": "_configthreadlocale",
  1544. "address": "0x40410c"
  1545. }
  1546. ],
  1547. "dll": "MSVCR90.dll"
  1548. },
  1549. {
  1550. "imports": [
  1551. {
  1552. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1553. "address": "0x404088"
  1554. },
  1555. {
  1556. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  1557. "address": "0x40408c"
  1558. },
  1559. {
  1560. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1561. "address": "0x404090"
  1562. }
  1563. ],
  1564. "dll": "MSVCP90.dll"
  1565. }
  1566. ],
  1567. "digital_signers": null,
  1568. "exported_dll_name": null,
  1569. "actual_checksum": "0x0004521c",
  1570. "overlay": null,
  1571. "imagebase": "0x00400000",
  1572. "reported_checksum": "0x0004521c",
  1573. "icon_hash": null,
  1574. "entrypoint": "0x00403477",
  1575. "timestamp": "2019-07-01 06:45:17",
  1576. "osversion": "5.0",
  1577. "sections": [
  1578. {
  1579. "name": ".text",
  1580. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1581. "virtual_address": "0x00001000",
  1582. "size_of_data": "0x00002a00",
  1583. "entropy": "6.26",
  1584. "raw_address": "0x00000400",
  1585. "virtual_size": "0x000029be",
  1586. "characteristics_raw": "0x60000020"
  1587. },
  1588. {
  1589. "name": ".rdata",
  1590. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1591. "virtual_address": "0x00004000",
  1592. "size_of_data": "0x00004200",
  1593. "entropy": "6.08",
  1594. "raw_address": "0x00002e00",
  1595. "virtual_size": "0x00004096",
  1596. "characteristics_raw": "0x40000040"
  1597. },
  1598. {
  1599. "name": ".data",
  1600. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1601. "virtual_address": "0x00009000",
  1602. "size_of_data": "0x00029c00",
  1603. "entropy": "8.00",
  1604. "raw_address": "0x00007000",
  1605. "virtual_size": "0x0002a17c",
  1606. "characteristics_raw": "0xc0000040"
  1607. },
  1608. {
  1609. "name": ".rsrc",
  1610. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1611. "virtual_address": "0x00034000",
  1612. "size_of_data": "0x0000ba00",
  1613. "entropy": "5.49",
  1614. "raw_address": "0x00030c00",
  1615. "virtual_size": "0x0000b8ea",
  1616. "characteristics_raw": "0x40000040"
  1617. },
  1618. {
  1619. "name": ".reloc",
  1620. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1621. "virtual_address": "0x00040000",
  1622. "size_of_data": "0x00000800",
  1623. "entropy": "5.10",
  1624. "raw_address": "0x0003c600",
  1625. "virtual_size": "0x000007ba",
  1626. "characteristics_raw": "0x42000040"
  1627. }
  1628. ],
  1629. "resources": [],
  1630. "dirents": [
  1631. {
  1632. "virtual_address": "0x00000000",
  1633. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1634. "size": "0x00000000"
  1635. },
  1636. {
  1637. "virtual_address": "0x0000770c",
  1638. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1639. "size": "0x000000a0"
  1640. },
  1641. {
  1642. "virtual_address": "0x00034000",
  1643. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1644. "size": "0x0000b8ea"
  1645. },
  1646. {
  1647. "virtual_address": "0x00000000",
  1648. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1649. "size": "0x00000000"
  1650. },
  1651. {
  1652. "virtual_address": "0x00000000",
  1653. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1654. "size": "0x00000000"
  1655. },
  1656. {
  1657. "virtual_address": "0x00040000",
  1658. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1659. "size": "0x00000524"
  1660. },
  1661. {
  1662. "virtual_address": "0x00000000",
  1663. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1664. "size": "0x00000000"
  1665. },
  1666. {
  1667. "virtual_address": "0x00000000",
  1668. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1669. "size": "0x00000000"
  1670. },
  1671. {
  1672. "virtual_address": "0x00000000",
  1673. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1674. "size": "0x00000000"
  1675. },
  1676. {
  1677. "virtual_address": "0x00000000",
  1678. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1679. "size": "0x00000000"
  1680. },
  1681. {
  1682. "virtual_address": "0x00007640",
  1683. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1684. "size": "0x00000040"
  1685. },
  1686. {
  1687. "virtual_address": "0x00000000",
  1688. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1689. "size": "0x00000000"
  1690. },
  1691. {
  1692. "virtual_address": "0x00004000",
  1693. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1694. "size": "0x000001a0"
  1695. },
  1696. {
  1697. "virtual_address": "0x00000000",
  1698. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1699. "size": "0x00000000"
  1700. },
  1701. {
  1702. "virtual_address": "0x00000000",
  1703. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1704. "size": "0x00000000"
  1705. },
  1706. {
  1707. "virtual_address": "0x00000000",
  1708. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1709. "size": "0x00000000"
  1710. }
  1711. ],
  1712. "exports": [],
  1713. "guest_signers": {},
  1714. "imphash": "e7da0e6cc5faa043f26b08286ff6fc41",
  1715. "icon_fuzzy": null,
  1716. "icon": null,
  1717. "pdbpath": null,
  1718. "imported_dll_count": 7,
  1719. "versioninfo": []
  1720. }
  1721. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!