API tools faq
paste
paladin316

Exes_29b89507364a0868ff24aa52e9f9a30f_exe_2019-07-02_00_30.json

paladin316
Jul 1st, 2019
2,140
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.97 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_29b89507364a0868ff24aa52e9f9a30f.exe"
  7. [*] File Size: 647168
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "ff0b1d9f2221e78773cfed9e89f87eab3add2c872f44f7f8cd10e18e2e0e8465"
  10. [*] MD5: "29b89507364a0868ff24aa52e9f9a30f"
  11. [*] SHA1: "a33e07b0f35d1fa69c732b8ef03fbd045c1d443d"
  12. [*] SHA512: "c7c4e572fbeaa3e10c9f5754b94e56efbcbcad5f6aa2b144e8b8a12d5fd3f43e16465f0b771c39e5d94167ae95416a2a5ebaa1a1b0329c3a7ba652fb13f34611"
  13. [*] CRC32: "434F77EB"
  14. [*] SSDEEP: "12288:t0Uhw2+EAMi0ROcNQ+hphjvqVYhN3unnNXHVRUfN4zyO:t22/Jr7NQ+hnjvr6nNXrUn"
  15.  
  16. [*] Process Execution: [
  17. "Exes_29b89507364a0868ff24aa52e9f9a30f.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  27. "Details": [
  28. {
  29. "Spam": "Exes_29b89507364a0868ff24aa52e9f9a30f.exe (2320) called API CreateProcessInternalW 41004 times"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 40 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "MicroWorld-eScan": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi"
  38. },
  39. {
  40. "FireEye": "Generic.mg.29b89507364a0868"
  41. },
  42. {
  43. "McAfee": "Fareit-FPH!29B89507364A"
  44. },
  45. {
  46. "Malwarebytes": "Trojan.MalPack.VB.Generic"
  47. },
  48. {
  49. "Alibaba": "Trojan:Win32/GenKryptik.63d5ecc8"
  50. },
  51. {
  52. "Arcabit": "Trojan.Heur.VP2.E4792D"
  53. },
  54. {
  55. "Invincea": "heuristic"
  56. },
  57. {
  58. "Cyren": "W32/Wacatac.F.gen!Eldorado"
  59. },
  60. {
  61. "Symantec": "ML.Attribute.HighConfidence"
  62. },
  63. {
  64. "APEX": "Malicious"
  65. },
  66. {
  67. "Paloalto": "generic.ml"
  68. },
  69. {
  70. "Kaspersky": "Trojan.Win32.VBKryjetor.byhi"
  71. },
  72. {
  73. "BitDefender": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi"
  74. },
  75. {
  76. "Avast": "Win32:Malware-gen"
  77. },
  78. {
  79. "Rising": "Trojan.Injector!8.C4 (CLOUD)"
  80. },
  81. {
  82. "Ad-Aware": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi"
  83. },
  84. {
  85. "Emsisoft": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi (B)"
  86. },
  87. {
  88. "F-Secure": "Trojan.TR/Kryptik.kxlmq"
  89. },
  90. {
  91. "DrWeb": "Trojan.PWS.Siggen2.20234"
  92. },
  93. {
  94. "VIPRE": "Trojan.Win32.Generic!BT"
  95. },
  96. {
  97. "TrendMicro": "Trojan.Win32.GLUPTEBA.USXVPG119"
  98. },
  99. {
  100. "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.jm"
  101. },
  102. {
  103. "Trapmine": "malicious.moderate.ml.score"
  104. },
  105. {
  106. "Sophos": "Mal/Generic-S"
  107. },
  108. {
  109. "Ikarus": "Trojan.VB.Crypt"
  110. },
  111. {
  112. "F-Prot": "W32/Wacatac.F.gen!Eldorado"
  113. },
  114. {
  115. "Avira": "TR/Kryptik.kxlmq"
  116. },
  117. {
  118. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  119. },
  120. {
  121. "Endgame": "malicious (high confidence)"
  122. },
  123. {
  124. "AegisLab": "Trojan.Win32.Malicious.4!c"
  125. },
  126. {
  127. "ZoneAlarm": "Trojan.Win32.VBKryjetor.byhi"
  128. },
  129. {
  130. "GData": "Gen:Trojan.Heur.VP2.Nm0@aCwdAhpi"
  131. },
  132. {
  133. "MAX": "malware (ai score=99)"
  134. },
  135. {
  136. "ESET-NOD32": "a variant of Win32/GenKryptik.DMBU"
  137. },
  138. {
  139. "TrendMicro-HouseCall": "Trojan.Win32.GLUPTEBA.USXVPG119"
  140. },
  141. {
  142. "SentinelOne": "DFI - Suspicious PE"
  143. },
  144. {
  145. "Fortinet": "W32/Injector.EGIR!tr"
  146. },
  147. {
  148. "AVG": "Win32:Malware-gen"
  149. },
  150. {
  151. "Cybereason": "malicious.7364a0"
  152. },
  153. {
  154. "CrowdStrike": "win/malicious_confidence_100% (W)"
  155. }
  156. ]
  157. }
  158. ]
  159.  
  160. [*] Started Service: []
  161.  
  162. [*] Executed Commands: [
  163. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\Exes_29b89507364a0868ff24aa52e9f9a30f.exe\""
  164. ]
  165.  
  166. [*] Mutexes: [
  167. "CicLoadWinStaWinSta0",
  168. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  169. ]
  170.  
  171. [*] Modified Files: []
  172.  
  173. [*] Deleted Files: []
  174.  
  175. [*] Modified Registry Keys: []
  176.  
  177. [*] Deleted Registry Keys: []
  178.  
  179. [*] DNS Communications: []
  180.  
  181. [*] Domains: []
  182.  
  183. [*] Network Communication - ICMP: []
  184.  
  185. [*] Network Communication - HTTP: []
  186.  
  187. [*] Network Communication - SMTP: []
  188.  
  189. [*] Network Communication - Hosts: []
  190.  
  191. [*] Network Communication - IRC: []
  192.  
  193. [*] Static Analysis: {
  194. "pe": {
  195. "peid_signatures": null,
  196. "imports": [
  197. {
  198. "imports": [
  199. {
  200. "name": "MethCallEngine",
  201. "address": "0x401000"
  202. },
  203. {
  204. "name": null,
  205. "address": "0x401004"
  206. },
  207. {
  208. "name": null,
  209. "address": "0x401008"
  210. },
  211. {
  212. "name": null,
  213. "address": "0x40100c"
  214. },
  215. {
  216. "name": null,
  217. "address": "0x401010"
  218. },
  219. {
  220. "name": null,
  221. "address": "0x401014"
  222. },
  223. {
  224. "name": null,
  225. "address": "0x401018"
  226. },
  227. {
  228. "name": null,
  229. "address": "0x40101c"
  230. },
  231. {
  232. "name": null,
  233. "address": "0x401020"
  234. },
  235. {
  236. "name": null,
  237. "address": "0x401024"
  238. },
  239. {
  240. "name": null,
  241. "address": "0x401028"
  242. },
  243. {
  244. "name": null,
  245. "address": "0x40102c"
  246. },
  247. {
  248. "name": "EVENT_SINK_AddRef",
  249. "address": "0x401030"
  250. },
  251. {
  252. "name": null,
  253. "address": "0x401034"
  254. },
  255. {
  256. "name": null,
  257. "address": "0x401038"
  258. },
  259. {
  260. "name": "EVENT_SINK_Release",
  261. "address": "0x40103c"
  262. },
  263. {
  264. "name": null,
  265. "address": "0x401040"
  266. },
  267. {
  268. "name": "EVENT_SINK_QueryInterface",
  269. "address": "0x401044"
  270. },
  271. {
  272. "name": "__vbaExceptHandler",
  273. "address": "0x401048"
  274. },
  275. {
  276. "name": null,
  277. "address": "0x40104c"
  278. },
  279. {
  280. "name": null,
  281. "address": "0x401050"
  282. },
  283. {
  284. "name": null,
  285. "address": "0x401054"
  286. },
  287. {
  288. "name": null,
  289. "address": "0x401058"
  290. },
  291. {
  292. "name": null,
  293. "address": "0x40105c"
  294. },
  295. {
  296. "name": null,
  297. "address": "0x401060"
  298. },
  299. {
  300. "name": null,
  301. "address": "0x401064"
  302. },
  303. {
  304. "name": null,
  305. "address": "0x401068"
  306. },
  307. {
  308. "name": null,
  309. "address": "0x40106c"
  310. },
  311. {
  312. "name": null,
  313. "address": "0x401070"
  314. }
  315. ],
  316. "dll": "MSVBVM60.DLL"
  317. }
  318. ],
  319. "digital_signers": null,
  320. "exported_dll_name": null,
  321. "actual_checksum": "0x0009e1c2",
  322. "overlay": null,
  323. "imagebase": "0x00400000",
  324. "reported_checksum": "0x0009e1c2",
  325. "icon_hash": null,
  326. "entrypoint": "0x00401130",
  327. "timestamp": "2019-07-01 06:20:00",
  328. "osversion": "4.0",
  329. "sections": [
  330. {
  331. "name": ".text",
  332. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  333. "virtual_address": "0x00001000",
  334. "size_of_data": "0x00099000",
  335. "entropy": "5.45",
  336. "raw_address": "0x00001000",
  337. "virtual_size": "0x000987c0",
  338. "characteristics_raw": "0x60000020"
  339. },
  340. {
  341. "name": ".data",
  342. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  343. "virtual_address": "0x0009a000",
  344. "size_of_data": "0x00000000",
  345. "entropy": "0.00",
  346. "raw_address": "0x00000000",
  347. "virtual_size": "0x00005444",
  348. "characteristics_raw": "0xc0000040"
  349. },
  350. {
  351. "name": ".rsrc",
  352. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  353. "virtual_address": "0x000a0000",
  354. "size_of_data": "0x00004000",
  355. "entropy": "4.05",
  356. "raw_address": "0x0009a000",
  357. "virtual_size": "0x00003966",
  358. "characteristics_raw": "0x40000040"
  359. }
  360. ],
  361. "resources": [],
  362. "dirents": [
  363. {
  364. "virtual_address": "0x00000000",
  365. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  366. "size": "0x00000000"
  367. },
  368. {
  369. "virtual_address": "0x000996a4",
  370. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  371. "size": "0x00000028"
  372. },
  373. {
  374. "virtual_address": "0x000a0000",
  375. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  376. "size": "0x00003966"
  377. },
  378. {
  379. "virtual_address": "0x00000000",
  380. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  381. "size": "0x00000000"
  382. },
  383. {
  384. "virtual_address": "0x00000000",
  385. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  386. "size": "0x00000000"
  387. },
  388. {
  389. "virtual_address": "0x00000000",
  390. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  391. "size": "0x00000000"
  392. },
  393. {
  394. "virtual_address": "0x00000000",
  395. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  396. "size": "0x00000000"
  397. },
  398. {
  399. "virtual_address": "0x00000000",
  400. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  401. "size": "0x00000000"
  402. },
  403. {
  404. "virtual_address": "0x00000000",
  405. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  406. "size": "0x00000000"
  407. },
  408. {
  409. "virtual_address": "0x00000000",
  410. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  411. "size": "0x00000000"
  412. },
  413. {
  414. "virtual_address": "0x00000000",
  415. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  416. "size": "0x00000000"
  417. },
  418. {
  419. "virtual_address": "0x00000220",
  420. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  421. "size": "0x00000020"
  422. },
  423. {
  424. "virtual_address": "0x00001000",
  425. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  426. "size": "0x00000078"
  427. },
  428. {
  429. "virtual_address": "0x00000000",
  430. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  431. "size": "0x00000000"
  432. },
  433. {
  434. "virtual_address": "0x00000000",
  435. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  436. "size": "0x00000000"
  437. },
  438. {
  439. "virtual_address": "0x00000000",
  440. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  441. "size": "0x00000000"
  442. }
  443. ],
  444. "exports": [],
  445. "guest_signers": {},
  446. "imphash": "2977270fae1bfe1cc3a3258b5bc0e2ed",
  447. "icon_fuzzy": null,
  448. "icon": null,
  449. "pdbpath": null,
  450. "imported_dll_count": 1,
  451. "versioninfo": []
  452. }
  453. }
  454.  
  455. [*] Resolved APIs: [
  456. "cryptbase.dll.SystemFunction036",
  457. "uxtheme.dll.ThemeInitApiHook",
  458. "user32.dll.IsProcessDPIAware",
  459. "oleaut32.dll.OleLoadPictureEx",
  460. "oleaut32.dll.DispCallFunc",
  461. "oleaut32.dll.LoadTypeLibEx",
  462. "oleaut32.dll.UnRegisterTypeLib",
  463. "oleaut32.dll.CreateTypeLib2",
  464. "oleaut32.dll.VarDateFromUdate",
  465. "oleaut32.dll.VarUdateFromDate",
  466. "oleaut32.dll.GetAltMonthNames",
  467. "oleaut32.dll.VarNumFromParseNum",
  468. "oleaut32.dll.VarParseNumFromStr",
  469. "oleaut32.dll.VarDecFromR4",
  470. "oleaut32.dll.VarDecFromR8",
  471. "oleaut32.dll.VarDecFromDate",
  472. "oleaut32.dll.VarDecFromI4",
  473. "oleaut32.dll.VarDecFromCy",
  474. "oleaut32.dll.VarR4FromDec",
  475. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  476. "oleaut32.dll.GetRecordInfoFromGuids",
  477. "oleaut32.dll.SafeArrayGetRecordInfo",
  478. "oleaut32.dll.SafeArraySetRecordInfo",
  479. "oleaut32.dll.SafeArrayGetIID",
  480. "oleaut32.dll.SafeArraySetIID",
  481. "oleaut32.dll.SafeArrayCopyData",
  482. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  483. "oleaut32.dll.SafeArrayCreateEx",
  484. "oleaut32.dll.VarFormat",
  485. "oleaut32.dll.VarFormatDateTime",
  486. "oleaut32.dll.VarFormatNumber",
  487. "oleaut32.dll.VarFormatPercent",
  488. "oleaut32.dll.VarFormatCurrency",
  489. "oleaut32.dll.VarWeekdayName",
  490. "oleaut32.dll.VarMonthName",
  491. "oleaut32.dll.VarAdd",
  492. "oleaut32.dll.VarAnd",
  493. "oleaut32.dll.VarCat",
  494. "oleaut32.dll.VarDiv",
  495. "oleaut32.dll.VarEqv",
  496. "oleaut32.dll.VarIdiv",
  497. "oleaut32.dll.VarImp",
  498. "oleaut32.dll.VarMod",
  499. "oleaut32.dll.VarMul",
  500. "oleaut32.dll.VarOr",
  501. "oleaut32.dll.VarPow",
  502. "oleaut32.dll.VarSub",
  503. "oleaut32.dll.VarXor",
  504. "oleaut32.dll.VarAbs",
  505. "oleaut32.dll.VarFix",
  506. "oleaut32.dll.VarInt",
  507. "oleaut32.dll.VarNeg",
  508. "oleaut32.dll.VarNot",
  509. "oleaut32.dll.VarRound",
  510. "oleaut32.dll.VarCmp",
  511. "oleaut32.dll.VarDecAdd",
  512. "oleaut32.dll.VarDecCmp",
  513. "oleaut32.dll.VarBstrCat",
  514. "oleaut32.dll.VarCyMulI4",
  515. "oleaut32.dll.VarBstrCmp",
  516. "ole32.dll.CoCreateInstanceEx",
  517. "ole32.dll.CLSIDFromProgIDEx",
  518. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  519. "user32.dll.GetSystemMetrics",
  520. "user32.dll.MonitorFromWindow",
  521. "user32.dll.MonitorFromRect",
  522. "user32.dll.MonitorFromPoint",
  523. "user32.dll.EnumDisplayMonitors",
  524. "user32.dll.GetMonitorInfoA",
  525. "dwmapi.dll.DwmIsCompositionEnabled",
  526. "gdi32.dll.GetLayout",
  527. "gdi32.dll.GdiRealizationInfo",
  528. "gdi32.dll.FontIsLinked",
  529. "advapi32.dll.RegOpenKeyExW",
  530. "advapi32.dll.RegQueryInfoKeyW",
  531. "gdi32.dll.GetTextFaceAliasW",
  532. "advapi32.dll.RegEnumValueW",
  533. "advapi32.dll.RegCloseKey",
  534. "advapi32.dll.RegQueryValueExW",
  535. "gdi32.dll.GetFontAssocStatus",
  536. "advapi32.dll.RegQueryValueExA",
  537. "advapi32.dll.RegEnumKeyExW",
  538. "gdi32.dll.GdiIsMetaPrintDC",
  539. "ole32.dll.CoInitializeEx",
  540. "ole32.dll.CoUninitialize",
  541. "ole32.dll.CoRegisterInitializeSpy",
  542. "ole32.dll.CoRevokeInitializeSpy",
  543. "gdi32.dll.GetTextExtentExPointWPri",
  544. "kernel32.dll.NlsGetCacheUpdateCount",
  545. "kernel32.dll.GetCalendarInfoW",
  546. "kernel32.dll.GetTickCount",
  547. "kernel32.dll.Sleep",
  548. "user32.dll.GetCursorPos",
  549. "user32.dll.EnumWindows",
  550. "kernel32.dll.SetErrorMode",
  551. "kernel32.dll.SetLastError",
  552. "kernel32.dll.VirtualAllocEx",
  553. "kernel32.dll.CloseHandle",
  554. "shell32.dll.ShellExecuteW",
  555. "kernel32.dll.WriteFile",
  556. "kernel32.dll.UnmapViewOfFile",
  557. "kernel32.dll.CreateFileW",
  558. "kernel32.dll.TerminateProcess",
  559. "kernel32.dll.VirtualProtectEx",
  560. "kernel32.dll.CreateProcessInternalW",
  561. "kernel32.dll.GetTempPathW",
  562. "kernel32.dll.GetLongPathNameW",
  563. "kernel32.dll.GetFileSize",
  564. "kernel32.dll.ReadFile",
  565. "ntdll.dll.NtProtectVirtualMemory",
  566. "kernel32.dll.GetCommandLineW"
  567. ]
  568.  
  569. [*] Static Analysis: {
  570. "pe": {
  571. "peid_signatures": null,
  572. "imports": [
  573. {
  574. "imports": [
  575. {
  576. "name": "MethCallEngine",
  577. "address": "0x401000"
  578. },
  579. {
  580. "name": null,
  581. "address": "0x401004"
  582. },
  583. {
  584. "name": null,
  585. "address": "0x401008"
  586. },
  587. {
  588. "name": null,
  589. "address": "0x40100c"
  590. },
  591. {
  592. "name": null,
  593. "address": "0x401010"
  594. },
  595. {
  596. "name": null,
  597. "address": "0x401014"
  598. },
  599. {
  600. "name": null,
  601. "address": "0x401018"
  602. },
  603. {
  604. "name": null,
  605. "address": "0x40101c"
  606. },
  607. {
  608. "name": null,
  609. "address": "0x401020"
  610. },
  611. {
  612. "name": null,
  613. "address": "0x401024"
  614. },
  615. {
  616. "name": null,
  617. "address": "0x401028"
  618. },
  619. {
  620. "name": null,
  621. "address": "0x40102c"
  622. },
  623. {
  624. "name": "EVENT_SINK_AddRef",
  625. "address": "0x401030"
  626. },
  627. {
  628. "name": null,
  629. "address": "0x401034"
  630. },
  631. {
  632. "name": null,
  633. "address": "0x401038"
  634. },
  635. {
  636. "name": "EVENT_SINK_Release",
  637. "address": "0x40103c"
  638. },
  639. {
  640. "name": null,
  641. "address": "0x401040"
  642. },
  643. {
  644. "name": "EVENT_SINK_QueryInterface",
  645. "address": "0x401044"
  646. },
  647. {
  648. "name": "__vbaExceptHandler",
  649. "address": "0x401048"
  650. },
  651. {
  652. "name": null,
  653. "address": "0x40104c"
  654. },
  655. {
  656. "name": null,
  657. "address": "0x401050"
  658. },
  659. {
  660. "name": null,
  661. "address": "0x401054"
  662. },
  663. {
  664. "name": null,
  665. "address": "0x401058"
  666. },
  667. {
  668. "name": null,
  669. "address": "0x40105c"
  670. },
  671. {
  672. "name": null,
  673. "address": "0x401060"
  674. },
  675. {
  676. "name": null,
  677. "address": "0x401064"
  678. },
  679. {
  680. "name": null,
  681. "address": "0x401068"
  682. },
  683. {
  684. "name": null,
  685. "address": "0x40106c"
  686. },
  687. {
  688. "name": null,
  689. "address": "0x401070"
  690. }
  691. ],
  692. "dll": "MSVBVM60.DLL"
  693. }
  694. ],
  695. "digital_signers": null,
  696. "exported_dll_name": null,
  697. "actual_checksum": "0x0009e1c2",
  698. "overlay": null,
  699. "imagebase": "0x00400000",
  700. "reported_checksum": "0x0009e1c2",
  701. "icon_hash": null,
  702. "entrypoint": "0x00401130",
  703. "timestamp": "2019-07-01 06:20:00",
  704. "osversion": "4.0",
  705. "sections": [
  706. {
  707. "name": ".text",
  708. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  709. "virtual_address": "0x00001000",
  710. "size_of_data": "0x00099000",
  711. "entropy": "5.45",
  712. "raw_address": "0x00001000",
  713. "virtual_size": "0x000987c0",
  714. "characteristics_raw": "0x60000020"
  715. },
  716. {
  717. "name": ".data",
  718. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  719. "virtual_address": "0x0009a000",
  720. "size_of_data": "0x00000000",
  721. "entropy": "0.00",
  722. "raw_address": "0x00000000",
  723. "virtual_size": "0x00005444",
  724. "characteristics_raw": "0xc0000040"
  725. },
  726. {
  727. "name": ".rsrc",
  728. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  729. "virtual_address": "0x000a0000",
  730. "size_of_data": "0x00004000",
  731. "entropy": "4.05",
  732. "raw_address": "0x0009a000",
  733. "virtual_size": "0x00003966",
  734. "characteristics_raw": "0x40000040"
  735. }
  736. ],
  737. "resources": [],
  738. "dirents": [
  739. {
  740. "virtual_address": "0x00000000",
  741. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  742. "size": "0x00000000"
  743. },
  744. {
  745. "virtual_address": "0x000996a4",
  746. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  747. "size": "0x00000028"
  748. },
  749. {
  750. "virtual_address": "0x000a0000",
  751. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  752. "size": "0x00003966"
  753. },
  754. {
  755. "virtual_address": "0x00000000",
  756. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  757. "size": "0x00000000"
  758. },
  759. {
  760. "virtual_address": "0x00000000",
  761. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  762. "size": "0x00000000"
  763. },
  764. {
  765. "virtual_address": "0x00000000",
  766. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  767. "size": "0x00000000"
  768. },
  769. {
  770. "virtual_address": "0x00000000",
  771. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  772. "size": "0x00000000"
  773. },
  774. {
  775. "virtual_address": "0x00000000",
  776. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  777. "size": "0x00000000"
  778. },
  779. {
  780. "virtual_address": "0x00000000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  782. "size": "0x00000000"
  783. },
  784. {
  785. "virtual_address": "0x00000000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  787. "size": "0x00000000"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x00000220",
  796. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  797. "size": "0x00000020"
  798. },
  799. {
  800. "virtual_address": "0x00001000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  802. "size": "0x00000078"
  803. },
  804. {
  805. "virtual_address": "0x00000000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  807. "size": "0x00000000"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  812. "size": "0x00000000"
  813. },
  814. {
  815. "virtual_address": "0x00000000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  817. "size": "0x00000000"
  818. }
  819. ],
  820. "exports": [],
  821. "guest_signers": {},
  822. "imphash": "2977270fae1bfe1cc3a3258b5bc0e2ed",
  823. "icon_fuzzy": null,
  824. "icon": null,
  825. "pdbpath": null,
  826. "imported_dll_count": 1,
  827. "versioninfo": []
  828. }
  829. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!