API tools faq
paste
paladin316

Exes_4c2fdadb29f624ff540c0e2790b60987_exe_2019-06-30_15_30.json

paladin316
Jun 30th, 2019
2,163
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.74 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_4c2fdadb29f624ff540c0e2790b60987.exe"
  7. [*] File Size: 5521408
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "b3dc1bb1c72c6bda1a7508147b2c92021aa18eb99d419db7e8245f32979cd01b"
  10. [*] MD5: "4c2fdadb29f624ff540c0e2790b60987"
  11. [*] SHA1: "e4b95dd05aa80f8380554590359ba63036c76e69"
  12. [*] SHA512: "03a26f8769f46ca5b8bdc9fb44b8ed4a56dfab21a8948516a2fabdbbde7f9c73f708c11c1540ce8c2e0ff47ab539e0780b202c249fe3ebd5423ae31e922294b3"
  13. [*] CRC32: "8E312343"
  14. [*] SSDEEP: "98304:z4ARSOULuXDTLjEGxGUiibSpRZxP4BPXWtqZLr8U+GzNQ12Pe7Xw1:z4NOUL+PECGUiUS1xgJge7xwa"
  15.  
  16. [*] Process Execution: [
  17. "Exes_4c2fdadb29f624ff540c0e2790b60987.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "The binary likely contains encrypted or compressed data.",
  27. "Details": [
  28. {
  29. "section": "name: .\\xd0\\xb2\\xd0\\xb2\\xd0\\xb21, entropy: 7.96, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0053e600, virtual_size: 0x0053e550"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  35. "Details": [
  36. {
  37. "Process": "Exes_4c2fdadb29f624ff540c0e2790b60987.exe (2896)"
  38. }
  39. ]
  40. },
  41. {
  42. "Description": "Tries to unhook or modify Windows functions monitored by Cuckoo",
  43. "Details": [
  44. {
  45. "unhook": "function_name: NtProtectVirtualMemory, type: modification"
  46. }
  47. ]
  48. },
  49. {
  50. "Description": "File has been identified by 40 Antiviruses on VirusTotal as malicious",
  51. "Details": [
  52. {
  53. "Bkav": "HW32.Packed."
  54. },
  55. {
  56. "MicroWorld-eScan": "Gen:Variant.Razy.341932"
  57. },
  58. {
  59. "FireEye": "Generic.mg.4c2fdadb29f624ff"
  60. },
  61. {
  62. "McAfee": "Artemis!4C2FDADB29F6"
  63. },
  64. {
  65. "Malwarebytes": "Ransom.Hermes"
  66. },
  67. {
  68. "Alibaba": "Packed:Win32/VMProtect.58273d72"
  69. },
  70. {
  71. "Arcabit": "Trojan.Razy.D537AC"
  72. },
  73. {
  74. "Cyren": "W32/Trojan.XGTG-6079"
  75. },
  76. {
  77. "Symantec": "ML.Attribute.HighConfidence"
  78. },
  79. {
  80. "APEX": "Malicious"
  81. },
  82. {
  83. "Avast": "Win32:Trojan-gen"
  84. },
  85. {
  86. "Kaspersky": "Trojan-Ransom.Win32.Encoder.cyk"
  87. },
  88. {
  89. "BitDefender": "Gen:Variant.Razy.341932"
  90. },
  91. {
  92. "Paloalto": "generic.ml"
  93. },
  94. {
  95. "Ad-Aware": "Gen:Variant.Razy.341932"
  96. },
  97. {
  98. "Emsisoft": "Gen:Variant.Razy.341932 (B)"
  99. },
  100. {
  101. "F-Secure": "Heuristic.HEUR/AGEN.1040232"
  102. },
  103. {
  104. "Invincea": "heuristic"
  105. },
  106. {
  107. "McAfee-GW-Edition": "BehavesLike.Win32.RansomWannaCry.tc"
  108. },
  109. {
  110. "SentinelOne": "DFI - Malicious PE"
  111. },
  112. {
  113. "Avira": "HEUR/AGEN.1040232"
  114. },
  115. {
  116. "MAX": "malware (ai score=99)"
  117. },
  118. {
  119. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  120. },
  121. {
  122. "Endgame": "malicious (high confidence)"
  123. },
  124. {
  125. "ZoneAlarm": "Trojan-Ransom.Win32.Encoder.cyk"
  126. },
  127. {
  128. "GData": "Gen:Variant.Razy.341932"
  129. },
  130. {
  131. "AhnLab-V3": "Unwanted/Win32.Agent.R215717"
  132. },
  133. {
  134. "Acronis": "suspicious"
  135. },
  136. {
  137. "ALYac": "Gen:Variant.Razy.341932"
  138. },
  139. {
  140. "Cylance": "Unsafe"
  141. },
  142. {
  143. "ESET-NOD32": "a variant of Win32/Packed.VMProtect.JG"
  144. },
  145. {
  146. "TrendMicro-HouseCall": "TROJ_GEN.R002H09FT19"
  147. },
  148. {
  149. "Rising": "Ransom.Encoder!8.FFD4 (CLOUD)"
  150. },
  151. {
  152. "Ikarus": "Trojan.Win32.VMProtect"
  153. },
  154. {
  155. "Fortinet": "W32/PossibleThreat"
  156. },
  157. {
  158. "AVG": "Win32:Trojan-gen"
  159. },
  160. {
  161. "Cybereason": "malicious.b29f62"
  162. },
  163. {
  164. "Panda": "Trj/CI.A"
  165. },
  166. {
  167. "CrowdStrike": "win/malicious_confidence_90% (W)"
  168. },
  169. {
  170. "Qihoo-360": "HEUR/QVM19.1.3055.Malware.Gen"
  171. }
  172. ]
  173. },
  174. {
  175. "Description": "Anomalous binary characteristics",
  176. "Details": [
  177. {
  178. "anomaly": "Unprintable characters found in section name"
  179. }
  180. ]
  181. }
  182. ]
  183.  
  184. [*] Started Service: []
  185.  
  186. [*] Executed Commands: []
  187.  
  188. [*] Mutexes: []
  189.  
  190. [*] Modified Files: []
  191.  
  192. [*] Deleted Files: []
  193.  
  194. [*] Modified Registry Keys: []
  195.  
  196. [*] Deleted Registry Keys: []
  197.  
  198. [*] DNS Communications: []
  199.  
  200. [*] Domains: []
  201.  
  202. [*] Network Communication - ICMP: []
  203.  
  204. [*] Network Communication - HTTP: []
  205.  
  206. [*] Network Communication - SMTP: []
  207.  
  208. [*] Network Communication - Hosts: []
  209.  
  210. [*] Network Communication - IRC: []
  211.  
  212. [*] Static Analysis: {
  213. "pe": {
  214. "peid_signatures": null,
  215. "imports": [
  216. {
  217. "imports": [
  218. {
  219. "name": "RaiseException",
  220. "address": "0xb8a000"
  221. }
  222. ],
  223. "dll": "KERNEL32.dll"
  224. },
  225. {
  226. "imports": [
  227. {
  228. "name": "OleInitialize",
  229. "address": "0xb8a008"
  230. }
  231. ],
  232. "dll": "ole32.dll"
  233. },
  234. {
  235. "imports": [
  236. {
  237. "name": "SafeArrayCreate",
  238. "address": "0xb8a010"
  239. }
  240. ],
  241. "dll": "OLEAUT32.dll"
  242. },
  243. {
  244. "imports": [
  245. {
  246. "name": "WTSSendMessageW",
  247. "address": "0xb8a018"
  248. }
  249. ],
  250. "dll": "WTSAPI32.dll"
  251. },
  252. {
  253. "imports": [
  254. {
  255. "name": "VirtualQuery",
  256. "address": "0xb8a020"
  257. }
  258. ],
  259. "dll": "KERNEL32.dll"
  260. },
  261. {
  262. "imports": [
  263. {
  264. "name": "GetUserObjectInformationW",
  265. "address": "0xb8a028"
  266. }
  267. ],
  268. "dll": "USER32.dll"
  269. },
  270. {
  271. "imports": [
  272. {
  273. "name": "LocalAlloc",
  274. "address": "0xb8a030"
  275. },
  276. {
  277. "name": "LocalFree",
  278. "address": "0xb8a034"
  279. },
  280. {
  281. "name": "GetModuleFileNameW",
  282. "address": "0xb8a038"
  283. },
  284. {
  285. "name": "GetProcessAffinityMask",
  286. "address": "0xb8a03c"
  287. },
  288. {
  289. "name": "SetProcessAffinityMask",
  290. "address": "0xb8a040"
  291. },
  292. {
  293. "name": "SetThreadAffinityMask",
  294. "address": "0xb8a044"
  295. },
  296. {
  297. "name": "Sleep",
  298. "address": "0xb8a048"
  299. },
  300. {
  301. "name": "ExitProcess",
  302. "address": "0xb8a04c"
  303. },
  304. {
  305. "name": "FreeLibrary",
  306. "address": "0xb8a050"
  307. },
  308. {
  309. "name": "LoadLibraryA",
  310. "address": "0xb8a054"
  311. },
  312. {
  313. "name": "GetModuleHandleA",
  314. "address": "0xb8a058"
  315. },
  316. {
  317. "name": "GetProcAddress",
  318. "address": "0xb8a05c"
  319. }
  320. ],
  321. "dll": "KERNEL32.dll"
  322. },
  323. {
  324. "imports": [
  325. {
  326. "name": "GetProcessWindowStation",
  327. "address": "0xb8a064"
  328. },
  329. {
  330. "name": "GetUserObjectInformationW",
  331. "address": "0xb8a068"
  332. }
  333. ],
  334. "dll": "USER32.dll"
  335. }
  336. ],
  337. "digital_signers": null,
  338. "exported_dll_name": "MZ\\x90",
  339. "actual_checksum": "0x0055294a",
  340. "overlay": null,
  341. "imagebase": "0x00400000",
  342. "reported_checksum": "0x0055294a",
  343. "icon_hash": null,
  344. "entrypoint": "0x00c72a95",
  345. "timestamp": "2012-07-13 22:47:16",
  346. "osversion": "5.0",
  347. "sections": [
  348. {
  349. "name": ".text",
  350. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  351. "virtual_address": "0x00001000",
  352. "size_of_data": "0x00000000",
  353. "entropy": "0.00",
  354. "raw_address": "0x00000000",
  355. "virtual_size": "0x00019718",
  356. "characteristics_raw": "0x60000020"
  357. },
  358. {
  359. "name": ".rdata",
  360. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  361. "virtual_address": "0x0001b000",
  362. "size_of_data": "0x00000000",
  363. "entropy": "0.00",
  364. "raw_address": "0x00000000",
  365. "virtual_size": "0x00006db4",
  366. "characteristics_raw": "0x40000040"
  367. },
  368. {
  369. "name": ".data",
  370. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  371. "virtual_address": "0x00022000",
  372. "size_of_data": "0x00000000",
  373. "entropy": "0.00",
  374. "raw_address": "0x00000000",
  375. "virtual_size": "0x000030c0",
  376. "characteristics_raw": "0xc0000040"
  377. },
  378. {
  379. "name": ".\\xd0\\xb2\\xd0\\xb2\\xd0\\xb20",
  380. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  381. "virtual_address": "0x00026000",
  382. "size_of_data": "0x00000000",
  383. "entropy": "0.00",
  384. "raw_address": "0x00000000",
  385. "virtual_size": "0x0033def8",
  386. "characteristics_raw": "0x60000060"
  387. },
  388. {
  389. "name": ".\\xd0\\xb2\\xd0\\xb2\\xd0\\xb21",
  390. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  391. "virtual_address": "0x00364000",
  392. "size_of_data": "0x0053e600",
  393. "entropy": "7.96",
  394. "raw_address": "0x00000400",
  395. "virtual_size": "0x0053e550",
  396. "characteristics_raw": "0x60000060"
  397. },
  398. {
  399. "name": ".rsrc",
  400. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  401. "virtual_address": "0x008a3000",
  402. "size_of_data": "0x00005600",
  403. "entropy": "4.49",
  404. "raw_address": "0x0053ea00",
  405. "virtual_size": "0x000054e2",
  406. "characteristics_raw": "0x40000040"
  407. }
  408. ],
  409. "resources": [],
  410. "dirents": [
  411. {
  412. "virtual_address": "0x0046e6e8",
  413. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  414. "size": "0x00000c4f"
  415. },
  416. {
  417. "virtual_address": "0x0077c4bc",
  418. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  419. "size": "0x000000b4"
  420. },
  421. {
  422. "virtual_address": "0x008a3000",
  423. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  424. "size": "0x000054e2"
  425. },
  426. {
  427. "virtual_address": "0x00000000",
  428. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  429. "size": "0x00000000"
  430. },
  431. {
  432. "virtual_address": "0x00000000",
  433. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  434. "size": "0x00000000"
  435. },
  436. {
  437. "virtual_address": "0x00000000",
  438. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  439. "size": "0x00000000"
  440. },
  441. {
  442. "virtual_address": "0x00000000",
  443. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  444. "size": "0x00000000"
  445. },
  446. {
  447. "virtual_address": "0x00000000",
  448. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  449. "size": "0x00000000"
  450. },
  451. {
  452. "virtual_address": "0x00000000",
  453. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  454. "size": "0x00000000"
  455. },
  456. {
  457. "virtual_address": "0x00000000",
  458. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  459. "size": "0x00000000"
  460. },
  461. {
  462. "virtual_address": "0x008a2410",
  463. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  464. "size": "0x00000040"
  465. },
  466. {
  467. "virtual_address": "0x00000000",
  468. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  469. "size": "0x00000000"
  470. },
  471. {
  472. "virtual_address": "0x0078a000",
  473. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  474. "size": "0x00000070"
  475. },
  476. {
  477. "virtual_address": "0x00000000",
  478. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  479. "size": "0x00000000"
  480. },
  481. {
  482. "virtual_address": "0x00000000",
  483. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  484. "size": "0x00000000"
  485. },
  486. {
  487. "virtual_address": "0x00000000",
  488. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  489. "size": "0x00000000"
  490. }
  491. ],
  492. "exports": [],
  493. "guest_signers": {},
  494. "imphash": "0f95a431ac4033f952fb4eecc31cf15d",
  495. "icon_fuzzy": null,
  496. "icon": null,
  497. "pdbpath": null,
  498. "imported_dll_count": 8,
  499. "versioninfo": []
  500. }
  501. }
  502.  
  503. [*] Resolved APIs: [
  504. "kernel32.dll.FlsAlloc",
  505. "kernel32.dll.FlsGetValue",
  506. "kernel32.dll.FlsSetValue",
  507. "kernel32.dll.FlsFree",
  508. "kernel32.dll.IsProcessorFeaturePresent",
  509. "cryptbase.dll.SystemFunction036",
  510. "uxtheme.dll.ThemeInitApiHook",
  511. "user32.dll.IsProcessDPIAware",
  512. "mscoree.dll.CLRCreateInstance",
  513. "advapi32.dll.RegOpenKeyExW",
  514. "advapi32.dll.RegQueryInfoKeyW",
  515. "advapi32.dll.RegEnumKeyExW",
  516. "advapi32.dll.RegEnumValueW",
  517. "advapi32.dll.RegCloseKey",
  518. "advapi32.dll.RegQueryValueExW",
  519. "mscoree.dll.CorExitProcess"
  520. ]
  521.  
  522. [*] Static Analysis: {
  523. "pe": {
  524. "peid_signatures": null,
  525. "imports": [
  526. {
  527. "imports": [
  528. {
  529. "name": "RaiseException",
  530. "address": "0xb8a000"
  531. }
  532. ],
  533. "dll": "KERNEL32.dll"
  534. },
  535. {
  536. "imports": [
  537. {
  538. "name": "OleInitialize",
  539. "address": "0xb8a008"
  540. }
  541. ],
  542. "dll": "ole32.dll"
  543. },
  544. {
  545. "imports": [
  546. {
  547. "name": "SafeArrayCreate",
  548. "address": "0xb8a010"
  549. }
  550. ],
  551. "dll": "OLEAUT32.dll"
  552. },
  553. {
  554. "imports": [
  555. {
  556. "name": "WTSSendMessageW",
  557. "address": "0xb8a018"
  558. }
  559. ],
  560. "dll": "WTSAPI32.dll"
  561. },
  562. {
  563. "imports": [
  564. {
  565. "name": "VirtualQuery",
  566. "address": "0xb8a020"
  567. }
  568. ],
  569. "dll": "KERNEL32.dll"
  570. },
  571. {
  572. "imports": [
  573. {
  574. "name": "GetUserObjectInformationW",
  575. "address": "0xb8a028"
  576. }
  577. ],
  578. "dll": "USER32.dll"
  579. },
  580. {
  581. "imports": [
  582. {
  583. "name": "LocalAlloc",
  584. "address": "0xb8a030"
  585. },
  586. {
  587. "name": "LocalFree",
  588. "address": "0xb8a034"
  589. },
  590. {
  591. "name": "GetModuleFileNameW",
  592. "address": "0xb8a038"
  593. },
  594. {
  595. "name": "GetProcessAffinityMask",
  596. "address": "0xb8a03c"
  597. },
  598. {
  599. "name": "SetProcessAffinityMask",
  600. "address": "0xb8a040"
  601. },
  602. {
  603. "name": "SetThreadAffinityMask",
  604. "address": "0xb8a044"
  605. },
  606. {
  607. "name": "Sleep",
  608. "address": "0xb8a048"
  609. },
  610. {
  611. "name": "ExitProcess",
  612. "address": "0xb8a04c"
  613. },
  614. {
  615. "name": "FreeLibrary",
  616. "address": "0xb8a050"
  617. },
  618. {
  619. "name": "LoadLibraryA",
  620. "address": "0xb8a054"
  621. },
  622. {
  623. "name": "GetModuleHandleA",
  624. "address": "0xb8a058"
  625. },
  626. {
  627. "name": "GetProcAddress",
  628. "address": "0xb8a05c"
  629. }
  630. ],
  631. "dll": "KERNEL32.dll"
  632. },
  633. {
  634. "imports": [
  635. {
  636. "name": "GetProcessWindowStation",
  637. "address": "0xb8a064"
  638. },
  639. {
  640. "name": "GetUserObjectInformationW",
  641. "address": "0xb8a068"
  642. }
  643. ],
  644. "dll": "USER32.dll"
  645. }
  646. ],
  647. "digital_signers": null,
  648. "exported_dll_name": "MZ\\x90",
  649. "actual_checksum": "0x0055294a",
  650. "overlay": null,
  651. "imagebase": "0x00400000",
  652. "reported_checksum": "0x0055294a",
  653. "icon_hash": null,
  654. "entrypoint": "0x00c72a95",
  655. "timestamp": "2012-07-13 22:47:16",
  656. "osversion": "5.0",
  657. "sections": [
  658. {
  659. "name": ".text",
  660. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  661. "virtual_address": "0x00001000",
  662. "size_of_data": "0x00000000",
  663. "entropy": "0.00",
  664. "raw_address": "0x00000000",
  665. "virtual_size": "0x00019718",
  666. "characteristics_raw": "0x60000020"
  667. },
  668. {
  669. "name": ".rdata",
  670. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  671. "virtual_address": "0x0001b000",
  672. "size_of_data": "0x00000000",
  673. "entropy": "0.00",
  674. "raw_address": "0x00000000",
  675. "virtual_size": "0x00006db4",
  676. "characteristics_raw": "0x40000040"
  677. },
  678. {
  679. "name": ".data",
  680. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  681. "virtual_address": "0x00022000",
  682. "size_of_data": "0x00000000",
  683. "entropy": "0.00",
  684. "raw_address": "0x00000000",
  685. "virtual_size": "0x000030c0",
  686. "characteristics_raw": "0xc0000040"
  687. },
  688. {
  689. "name": ".\\xd0\\xb2\\xd0\\xb2\\xd0\\xb20",
  690. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  691. "virtual_address": "0x00026000",
  692. "size_of_data": "0x00000000",
  693. "entropy": "0.00",
  694. "raw_address": "0x00000000",
  695. "virtual_size": "0x0033def8",
  696. "characteristics_raw": "0x60000060"
  697. },
  698. {
  699. "name": ".\\xd0\\xb2\\xd0\\xb2\\xd0\\xb21",
  700. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  701. "virtual_address": "0x00364000",
  702. "size_of_data": "0x0053e600",
  703. "entropy": "7.96",
  704. "raw_address": "0x00000400",
  705. "virtual_size": "0x0053e550",
  706. "characteristics_raw": "0x60000060"
  707. },
  708. {
  709. "name": ".rsrc",
  710. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  711. "virtual_address": "0x008a3000",
  712. "size_of_data": "0x00005600",
  713. "entropy": "4.49",
  714. "raw_address": "0x0053ea00",
  715. "virtual_size": "0x000054e2",
  716. "characteristics_raw": "0x40000040"
  717. }
  718. ],
  719. "resources": [],
  720. "dirents": [
  721. {
  722. "virtual_address": "0x0046e6e8",
  723. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  724. "size": "0x00000c4f"
  725. },
  726. {
  727. "virtual_address": "0x0077c4bc",
  728. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  729. "size": "0x000000b4"
  730. },
  731. {
  732. "virtual_address": "0x008a3000",
  733. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  734. "size": "0x000054e2"
  735. },
  736. {
  737. "virtual_address": "0x00000000",
  738. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  739. "size": "0x00000000"
  740. },
  741. {
  742. "virtual_address": "0x00000000",
  743. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  744. "size": "0x00000000"
  745. },
  746. {
  747. "virtual_address": "0x00000000",
  748. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  749. "size": "0x00000000"
  750. },
  751. {
  752. "virtual_address": "0x00000000",
  753. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  754. "size": "0x00000000"
  755. },
  756. {
  757. "virtual_address": "0x00000000",
  758. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  759. "size": "0x00000000"
  760. },
  761. {
  762. "virtual_address": "0x00000000",
  763. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  764. "size": "0x00000000"
  765. },
  766. {
  767. "virtual_address": "0x00000000",
  768. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  769. "size": "0x00000000"
  770. },
  771. {
  772. "virtual_address": "0x008a2410",
  773. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  774. "size": "0x00000040"
  775. },
  776. {
  777. "virtual_address": "0x00000000",
  778. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  779. "size": "0x00000000"
  780. },
  781. {
  782. "virtual_address": "0x0078a000",
  783. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  784. "size": "0x00000070"
  785. },
  786. {
  787. "virtual_address": "0x00000000",
  788. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  789. "size": "0x00000000"
  790. },
  791. {
  792. "virtual_address": "0x00000000",
  793. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  794. "size": "0x00000000"
  795. },
  796. {
  797. "virtual_address": "0x00000000",
  798. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  799. "size": "0x00000000"
  800. }
  801. ],
  802. "exports": [],
  803. "guest_signers": {},
  804. "imphash": "0f95a431ac4033f952fb4eecc31cf15d",
  805. "icon_fuzzy": null,
  806. "icon": null,
  807. "pdbpath": null,
  808. "imported_dll_count": 8,
  809. "versioninfo": []
  810. }
  811. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!