API tools faq
paste
paladin316

Exes_6fcab2dbdcf5529cf9958d4c50524159_exe_2019-06-27_15_30.json

paladin316
Jun 27th, 2019
2,726
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 44.26 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_6fcab2dbdcf5529cf9958d4c50524159.exe"
  7. [*] File Size: 5464887
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows"
  9. [*] SHA256: "6300fa9fcef55f5064d158c07ef34a46edf721f32dfe9d8437ab82321613a39b"
  10. [*] MD5: "6fcab2dbdcf5529cf9958d4c50524159"
  11. [*] SHA1: "f4916595dbb22bef3d6ecd283f5000be6ef6b9da"
  12. [*] SHA512: "b8f4de1498bf1e4de5eb0e842019ece97af03b8831864243f5731457a1f732bfe8d01d755318431f8bb8b5784ea0161dfe22f4be81283a4242c78a00f6a84452"
  13. [*] CRC32: "0E027A20"
  14. [*] SSDEEP: "98304:5oMJKGjZjYfQfQEK9EmEZRBVeq9W7eMXlnzBB0YGYtQAjWVglqWztRsGk77CR9lJ:akF8H9EmEZ4eEr1zBB0P5AjNkWztRsxK"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .rsrc, entropy: 7.30, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0000ec00, virtual_size: 0x0000ea38"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "File has been identified by 51 Antiviruses on VirusTotal as malicious",
  29. "Details": [
  30. {
  31. "Bkav": "W32.WannaMine.Worm"
  32. },
  33. {
  34. "MicroWorld-eScan": "Trojan.Agent.DFJK"
  35. },
  36. {
  37. "CAT-QuickHeal": "Trojan.Zpevdo"
  38. },
  39. {
  40. "McAfee": "Artemis!6FCAB2DBDCF5"
  41. },
  42. {
  43. "Cylance": "Unsafe"
  44. },
  45. {
  46. "Alibaba": "Exploit:Win32/MS17-010.f7a0bf33"
  47. },
  48. {
  49. "K7GW": "Exploit ( 0053920f1 )"
  50. },
  51. {
  52. "K7AntiVirus": "Exploit ( 0053920f1 )"
  53. },
  54. {
  55. "Arcabit": "Trojan.Agent.DFJK"
  56. },
  57. {
  58. "TrendMicro": "HackTool.Win32.Impacket.AA"
  59. },
  60. {
  61. "NANO-Antivirus": "Exploit.Win32.MS17010.fkzvev"
  62. },
  63. {
  64. "Symantec": "ML.Attribute.HighConfidence"
  65. },
  66. {
  67. "ClamAV": "Win.Exploit.Eternalblue-6728828-0"
  68. },
  69. {
  70. "Kaspersky": "Exploit.Win32.MS17-010.m"
  71. },
  72. {
  73. "BitDefender": "Trojan.Agent.DFJK"
  74. },
  75. {
  76. "AegisLab": "Hacktool.Win32.MS17-010.3!c"
  77. },
  78. {
  79. "Tencent": "Win32.Exploit.Ms17-010.Wtxy"
  80. },
  81. {
  82. "Emsisoft": "Trojan.Agent.DFJK (B)"
  83. },
  84. {
  85. "F-Secure": "Exploit.EXP/Agent.eukco"
  86. },
  87. {
  88. },
  89. {
  90. "VIPRE": "Trojan.Win32.Generic!BT"
  91. },
  92. {
  93. "Invincea": "heuristic"
  94. },
  95. {
  96. "McAfee-GW-Edition": "BehavesLike.Win32.HToolLazagne.tc"
  97. },
  98. {
  99. "Trapmine": "malicious.high.ml.score"
  100. },
  101. {
  102. "FireEye": "Generic.mg.6fcab2dbdcf5529c"
  103. },
  104. {
  105. "Sophos": "Troj/Agent-BAFJ"
  106. },
  107. {
  108. "SentinelOne": "DFI - Suspicious PE"
  109. },
  110. {
  111. "Cyren": "W32/Trojan.JSUO-0993"
  112. },
  113. {
  114. "Webroot": "W32.Trojan.Gen"
  115. },
  116. {
  117. "Avira": "EXP/Agent.eukco"
  118. },
  119. {
  120. "Microsoft": "Trojan:Win32/Occamy.C"
  121. },
  122. {
  123. "ViRobot": "HackTool.EternalBlue.5464887"
  124. },
  125. {
  126. "ZoneAlarm": "Exploit.Win32.MS17-010.m"
  127. },
  128. {
  129. "GData": "Trojan.Agent.DFJK"
  130. },
  131. {
  132. "AhnLab-V3": "Trojan/Win32.PySmb.C3039840"
  133. },
  134. {
  135. "Acronis": "suspicious"
  136. },
  137. {
  138. "VBA32": "Trojan.Bitrep"
  139. },
  140. {
  141. "ALYac": "Trojan.Agent.DFJK"
  142. },
  143. {
  144. "MAX": "malware (ai score=100)"
  145. },
  146. {
  147. "Ad-Aware": "Trojan.Agent.DFJK"
  148. },
  149. {
  150. "ESET-NOD32": "Win32/Exploit.Agent.OGR"
  151. },
  152. {
  153. "TrendMicro-HouseCall": "HackTool.Win32.Impacket.AA"
  154. },
  155. {
  156. },
  157. {
  158. "eGambit": "Trojan.Generic"
  159. },
  160. {
  161. "Fortinet": "W32/MS17_010.M!exploit"
  162. },
  163. {
  164. "MaxSecure": "Trojan.Malware.1098773.susgen"
  165. },
  166. {
  167. "AVG": "FileRepMalware"
  168. },
  169. {
  170. "Cybereason": "malicious.bdcf55"
  171. },
  172. {
  173. "Panda": "Trj/RnkBend.A"
  174. },
  175. {
  176. "CrowdStrike": "win/malicious_confidence_100% (W)"
  177. },
  178. {
  179. "Qihoo-360": "Trojan.Generic"
  180. }
  181. ]
  182. }
  183. ]
  184.  
  185. [*] Started Service: []
  186.  
  187. [*] Executed Commands: []
  188.  
  189. [*] Mutexes: []
  190.  
  191. [*] Modified Files: []
  192.  
  193. [*] Deleted Files: []
  194.  
  195. [*] Modified Registry Keys: []
  196.  
  197. [*] Deleted Registry Keys: []
  198.  
  199. [*] DNS Communications: []
  200.  
  201. [*] Domains: []
  202.  
  203. [*] Network Communication - ICMP: []
  204.  
  205. [*] Network Communication - HTTP: []
  206.  
  207. [*] Network Communication - SMTP: []
  208.  
  209. [*] Network Communication - Hosts: []
  210.  
  211. [*] Network Communication - IRC: []
  212.  
  213. [*] Static Analysis: {
  214. "pe": {
  215. "peid_signatures": null,
  216. "imports": [
  217. {
  218. "imports": [
  219. {
  220. "name": "GetLastError",
  221. "address": "0x421000"
  222. },
  223. {
  224. "name": "SetDllDirectoryW",
  225. "address": "0x421004"
  226. },
  227. {
  228. "name": "GetModuleFileNameW",
  229. "address": "0x421008"
  230. },
  231. {
  232. "name": "GetProcAddress",
  233. "address": "0x42100c"
  234. },
  235. {
  236. "name": "GetCommandLineW",
  237. "address": "0x421010"
  238. },
  239. {
  240. "name": "GetEnvironmentVariableW",
  241. "address": "0x421014"
  242. },
  243. {
  244. "name": "SetEnvironmentVariableW",
  245. "address": "0x421018"
  246. },
  247. {
  248. "name": "ExpandEnvironmentStringsW",
  249. "address": "0x42101c"
  250. },
  251. {
  252. "name": "GetTempPathW",
  253. "address": "0x421020"
  254. },
  255. {
  256. "name": "WaitForSingleObject",
  257. "address": "0x421024"
  258. },
  259. {
  260. "name": "Sleep",
  261. "address": "0x421028"
  262. },
  263. {
  264. "name": "GetExitCodeProcess",
  265. "address": "0x42102c"
  266. },
  267. {
  268. "name": "CreateProcessW",
  269. "address": "0x421030"
  270. },
  271. {
  272. "name": "GetStartupInfoW",
  273. "address": "0x421034"
  274. },
  275. {
  276. "name": "LoadLibraryExW",
  277. "address": "0x421038"
  278. },
  279. {
  280. "name": "GetShortPathNameW",
  281. "address": "0x42103c"
  282. },
  283. {
  284. "name": "FormatMessageA",
  285. "address": "0x421040"
  286. },
  287. {
  288. "name": "LoadLibraryA",
  289. "address": "0x421044"
  290. },
  291. {
  292. "name": "MultiByteToWideChar",
  293. "address": "0x421048"
  294. },
  295. {
  296. "name": "WideCharToMultiByte",
  297. "address": "0x42104c"
  298. },
  299. {
  300. "name": "DecodePointer",
  301. "address": "0x421050"
  302. },
  303. {
  304. "name": "UnhandledExceptionFilter",
  305. "address": "0x421054"
  306. },
  307. {
  308. "name": "SetUnhandledExceptionFilter",
  309. "address": "0x421058"
  310. },
  311. {
  312. "name": "GetCurrentProcess",
  313. "address": "0x42105c"
  314. },
  315. {
  316. "name": "TerminateProcess",
  317. "address": "0x421060"
  318. },
  319. {
  320. "name": "IsProcessorFeaturePresent",
  321. "address": "0x421064"
  322. },
  323. {
  324. "name": "QueryPerformanceCounter",
  325. "address": "0x421068"
  326. },
  327. {
  328. "name": "GetCurrentProcessId",
  329. "address": "0x42106c"
  330. },
  331. {
  332. "name": "GetCurrentThreadId",
  333. "address": "0x421070"
  334. },
  335. {
  336. "name": "GetSystemTimeAsFileTime",
  337. "address": "0x421074"
  338. },
  339. {
  340. "name": "InitializeSListHead",
  341. "address": "0x421078"
  342. },
  343. {
  344. "name": "IsDebuggerPresent",
  345. "address": "0x42107c"
  346. },
  347. {
  348. "name": "GetModuleHandleW",
  349. "address": "0x421080"
  350. },
  351. {
  352. "name": "RtlUnwind",
  353. "address": "0x421084"
  354. },
  355. {
  356. "name": "SetLastError",
  357. "address": "0x421088"
  358. },
  359. {
  360. "name": "EnterCriticalSection",
  361. "address": "0x42108c"
  362. },
  363. {
  364. "name": "LeaveCriticalSection",
  365. "address": "0x421090"
  366. },
  367. {
  368. "name": "DeleteCriticalSection",
  369. "address": "0x421094"
  370. },
  371. {
  372. "name": "InitializeCriticalSectionAndSpinCount",
  373. "address": "0x421098"
  374. },
  375. {
  376. "name": "TlsAlloc",
  377. "address": "0x42109c"
  378. },
  379. {
  380. "name": "TlsGetValue",
  381. "address": "0x4210a0"
  382. },
  383. {
  384. "name": "TlsSetValue",
  385. "address": "0x4210a4"
  386. },
  387. {
  388. "name": "TlsFree",
  389. "address": "0x4210a8"
  390. },
  391. {
  392. "name": "FreeLibrary",
  393. "address": "0x4210ac"
  394. },
  395. {
  396. "name": "GetCommandLineA",
  397. "address": "0x4210b0"
  398. },
  399. {
  400. "name": "ReadFile",
  401. "address": "0x4210b4"
  402. },
  403. {
  404. "name": "CreateFileW",
  405. "address": "0x4210b8"
  406. },
  407. {
  408. "name": "GetDriveTypeW",
  409. "address": "0x4210bc"
  410. },
  411. {
  412. "name": "GetFileType",
  413. "address": "0x4210c0"
  414. },
  415. {
  416. "name": "CloseHandle",
  417. "address": "0x4210c4"
  418. },
  419. {
  420. "name": "PeekNamedPipe",
  421. "address": "0x4210c8"
  422. },
  423. {
  424. "name": "SystemTimeToTzSpecificLocalTime",
  425. "address": "0x4210cc"
  426. },
  427. {
  428. "name": "FileTimeToSystemTime",
  429. "address": "0x4210d0"
  430. },
  431. {
  432. "name": "GetFullPathNameW",
  433. "address": "0x4210d4"
  434. },
  435. {
  436. "name": "GetFullPathNameA",
  437. "address": "0x4210d8"
  438. },
  439. {
  440. "name": "CreateDirectoryW",
  441. "address": "0x4210dc"
  442. },
  443. {
  444. "name": "RemoveDirectoryW",
  445. "address": "0x4210e0"
  446. },
  447. {
  448. "name": "FindClose",
  449. "address": "0x4210e4"
  450. },
  451. {
  452. "name": "FindFirstFileExW",
  453. "address": "0x4210e8"
  454. },
  455. {
  456. "name": "FindNextFileW",
  457. "address": "0x4210ec"
  458. },
  459. {
  460. "name": "SetStdHandle",
  461. "address": "0x4210f0"
  462. },
  463. {
  464. "name": "SetConsoleCtrlHandler",
  465. "address": "0x4210f4"
  466. },
  467. {
  468. "name": "DeleteFileW",
  469. "address": "0x4210f8"
  470. },
  471. {
  472. "name": "GetStdHandle",
  473. "address": "0x4210fc"
  474. },
  475. {
  476. "name": "WriteFile",
  477. "address": "0x421100"
  478. },
  479. {
  480. "name": "ExitProcess",
  481. "address": "0x421104"
  482. },
  483. {
  484. "name": "GetModuleHandleExW",
  485. "address": "0x421108"
  486. },
  487. {
  488. "name": "GetACP",
  489. "address": "0x42110c"
  490. },
  491. {
  492. "name": "HeapFree",
  493. "address": "0x421110"
  494. },
  495. {
  496. "name": "HeapAlloc",
  497. "address": "0x421114"
  498. },
  499. {
  500. "name": "GetConsoleMode",
  501. "address": "0x421118"
  502. },
  503. {
  504. "name": "ReadConsoleW",
  505. "address": "0x42111c"
  506. },
  507. {
  508. "name": "SetFilePointerEx",
  509. "address": "0x421120"
  510. },
  511. {
  512. "name": "GetConsoleCP",
  513. "address": "0x421124"
  514. },
  515. {
  516. "name": "CompareStringW",
  517. "address": "0x421128"
  518. },
  519. {
  520. "name": "LCMapStringW",
  521. "address": "0x42112c"
  522. },
  523. {
  524. "name": "GetCurrentDirectoryW",
  525. "address": "0x421130"
  526. },
  527. {
  528. "name": "FlushFileBuffers",
  529. "address": "0x421134"
  530. },
  531. {
  532. "name": "SetEnvironmentVariableA",
  533. "address": "0x421138"
  534. },
  535. {
  536. "name": "GetFileAttributesExW",
  537. "address": "0x42113c"
  538. },
  539. {
  540. "name": "IsValidCodePage",
  541. "address": "0x421140"
  542. },
  543. {
  544. "name": "GetOEMCP",
  545. "address": "0x421144"
  546. },
  547. {
  548. "name": "GetCPInfo",
  549. "address": "0x421148"
  550. },
  551. {
  552. "name": "GetEnvironmentStringsW",
  553. "address": "0x42114c"
  554. },
  555. {
  556. "name": "FreeEnvironmentStringsW",
  557. "address": "0x421150"
  558. },
  559. {
  560. "name": "GetStringTypeW",
  561. "address": "0x421154"
  562. },
  563. {
  564. "name": "GetProcessHeap",
  565. "address": "0x421158"
  566. },
  567. {
  568. "name": "WriteConsoleW",
  569. "address": "0x42115c"
  570. },
  571. {
  572. "name": "GetTimeZoneInformation",
  573. "address": "0x421160"
  574. },
  575. {
  576. "name": "HeapSize",
  577. "address": "0x421164"
  578. },
  579. {
  580. "name": "HeapReAlloc",
  581. "address": "0x421168"
  582. },
  583. {
  584. "name": "SetEndOfFile",
  585. "address": "0x42116c"
  586. },
  587. {
  588. "name": "RaiseException",
  589. "address": "0x421170"
  590. }
  591. ],
  592. "dll": "KERNEL32.dll"
  593. },
  594. {
  595. "imports": [
  596. {
  597. "name": "ntohl",
  598. "address": "0x421178"
  599. }
  600. ],
  601. "dll": "WS2_32.dll"
  602. }
  603. ],
  604. "digital_signers": null,
  605. "exported_dll_name": null,
  606. "actual_checksum": "0x0053d295",
  607. "overlay": {
  608. "size": "0x004fab37",
  609. "offset": "0x0003b800"
  610. },
  611. "imagebase": "0x00400000",
  612. "reported_checksum": "0x00000000",
  613. "icon_hash": null,
  614. "entrypoint": "0x0040769a",
  615. "timestamp": "2017-12-11 15:09:08",
  616. "osversion": "5.1",
  617. "sections": [
  618. {
  619. "name": ".text",
  620. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  621. "virtual_address": "0x00001000",
  622. "size_of_data": "0x0001f200",
  623. "entropy": "6.66",
  624. "raw_address": "0x00000400",
  625. "virtual_size": "0x0001f144",
  626. "characteristics_raw": "0x60000020"
  627. },
  628. {
  629. "name": ".rdata",
  630. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  631. "virtual_address": "0x00021000",
  632. "size_of_data": "0x0000b200",
  633. "entropy": "6.09",
  634. "raw_address": "0x0001f600",
  635. "virtual_size": "0x0000b06c",
  636. "characteristics_raw": "0x40000040"
  637. },
  638. {
  639. "name": ".data",
  640. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  641. "virtual_address": "0x0002d000",
  642. "size_of_data": "0x00000a00",
  643. "entropy": "1.93",
  644. "raw_address": "0x0002a800",
  645. "virtual_size": "0x0000e678",
  646. "characteristics_raw": "0xc0000040"
  647. },
  648. {
  649. "name": ".gfids",
  650. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  651. "virtual_address": "0x0003c000",
  652. "size_of_data": "0x00000200",
  653. "entropy": "1.86",
  654. "raw_address": "0x0002b200",
  655. "virtual_size": "0x000000b8",
  656. "characteristics_raw": "0x40000040"
  657. },
  658. {
  659. "name": ".rsrc",
  660. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  661. "virtual_address": "0x0003d000",
  662. "size_of_data": "0x0000ec00",
  663. "entropy": "7.30",
  664. "raw_address": "0x0002b400",
  665. "virtual_size": "0x0000ea38",
  666. "characteristics_raw": "0x40000040"
  667. },
  668. {
  669. "name": ".reloc",
  670. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  671. "virtual_address": "0x0004c000",
  672. "size_of_data": "0x00001800",
  673. "entropy": "6.64",
  674. "raw_address": "0x0003a000",
  675. "virtual_size": "0x000017b8",
  676. "characteristics_raw": "0x42000040"
  677. }
  678. ],
  679. "resources": [],
  680. "dirents": [
  681. {
  682. "virtual_address": "0x00000000",
  683. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  684. "size": "0x00000000"
  685. },
  686. {
  687. "virtual_address": "0x0002b7ac",
  688. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  689. "size": "0x0000003c"
  690. },
  691. {
  692. "virtual_address": "0x0003d000",
  693. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  694. "size": "0x0000ea38"
  695. },
  696. {
  697. "virtual_address": "0x00000000",
  698. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  699. "size": "0x00000000"
  700. },
  701. {
  702. "virtual_address": "0x00000000",
  703. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  704. "size": "0x00000000"
  705. },
  706. {
  707. "virtual_address": "0x0004c000",
  708. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  709. "size": "0x000017b8"
  710. },
  711. {
  712. "virtual_address": "0x0002adc0",
  713. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  714. "size": "0x0000001c"
  715. },
  716. {
  717. "virtual_address": "0x00000000",
  718. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  719. "size": "0x00000000"
  720. },
  721. {
  722. "virtual_address": "0x00000000",
  723. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  724. "size": "0x00000000"
  725. },
  726. {
  727. "virtual_address": "0x00000000",
  728. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  729. "size": "0x00000000"
  730. },
  731. {
  732. "virtual_address": "0x0002ade0",
  733. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  734. "size": "0x00000040"
  735. },
  736. {
  737. "virtual_address": "0x00000000",
  738. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  739. "size": "0x00000000"
  740. },
  741. {
  742. "virtual_address": "0x00021000",
  743. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  744. "size": "0x00000180"
  745. },
  746. {
  747. "virtual_address": "0x00000000",
  748. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  749. "size": "0x00000000"
  750. },
  751. {
  752. "virtual_address": "0x00000000",
  753. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  754. "size": "0x00000000"
  755. },
  756. {
  757. "virtual_address": "0x00000000",
  758. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  759. "size": "0x00000000"
  760. }
  761. ],
  762. "exports": [],
  763. "guest_signers": {},
  764. "imphash": "fc40519af20116c903e3ff836e366e39",
  765. "icon_fuzzy": null,
  766. "icon": null,
  767. "pdbpath": null,
  768. "imported_dll_count": 2,
  769. "versioninfo": []
  770. }
  771. }
  772.  
  773. [*] Resolved APIs: []
  774.  
  775. [*] Static Analysis: {
  776. "pe": {
  777. "peid_signatures": null,
  778. "imports": [
  779. {
  780. "imports": [
  781. {
  782. "name": "GetLastError",
  783. "address": "0x421000"
  784. },
  785. {
  786. "name": "SetDllDirectoryW",
  787. "address": "0x421004"
  788. },
  789. {
  790. "name": "GetModuleFileNameW",
  791. "address": "0x421008"
  792. },
  793. {
  794. "name": "GetProcAddress",
  795. "address": "0x42100c"
  796. },
  797. {
  798. "name": "GetCommandLineW",
  799. "address": "0x421010"
  800. },
  801. {
  802. "name": "GetEnvironmentVariableW",
  803. "address": "0x421014"
  804. },
  805. {
  806. "name": "SetEnvironmentVariableW",
  807. "address": "0x421018"
  808. },
  809. {
  810. "name": "ExpandEnvironmentStringsW",
  811. "address": "0x42101c"
  812. },
  813. {
  814. "name": "GetTempPathW",
  815. "address": "0x421020"
  816. },
  817. {
  818. "name": "WaitForSingleObject",
  819. "address": "0x421024"
  820. },
  821. {
  822. "name": "Sleep",
  823. "address": "0x421028"
  824. },
  825. {
  826. "name": "GetExitCodeProcess",
  827. "address": "0x42102c"
  828. },
  829. {
  830. "name": "CreateProcessW",
  831. "address": "0x421030"
  832. },
  833. {
  834. "name": "GetStartupInfoW",
  835. "address": "0x421034"
  836. },
  837. {
  838. "name": "LoadLibraryExW",
  839. "address": "0x421038"
  840. },
  841. {
  842. "name": "GetShortPathNameW",
  843. "address": "0x42103c"
  844. },
  845. {
  846. "name": "FormatMessageA",
  847. "address": "0x421040"
  848. },
  849. {
  850. "name": "LoadLibraryA",
  851. "address": "0x421044"
  852. },
  853. {
  854. "name": "MultiByteToWideChar",
  855. "address": "0x421048"
  856. },
  857. {
  858. "name": "WideCharToMultiByte",
  859. "address": "0x42104c"
  860. },
  861. {
  862. "name": "DecodePointer",
  863. "address": "0x421050"
  864. },
  865. {
  866. "name": "UnhandledExceptionFilter",
  867. "address": "0x421054"
  868. },
  869. {
  870. "name": "SetUnhandledExceptionFilter",
  871. "address": "0x421058"
  872. },
  873. {
  874. "name": "GetCurrentProcess",
  875. "address": "0x42105c"
  876. },
  877. {
  878. "name": "TerminateProcess",
  879. "address": "0x421060"
  880. },
  881. {
  882. "name": "IsProcessorFeaturePresent",
  883. "address": "0x421064"
  884. },
  885. {
  886. "name": "QueryPerformanceCounter",
  887. "address": "0x421068"
  888. },
  889. {
  890. "name": "GetCurrentProcessId",
  891. "address": "0x42106c"
  892. },
  893. {
  894. "name": "GetCurrentThreadId",
  895. "address": "0x421070"
  896. },
  897. {
  898. "name": "GetSystemTimeAsFileTime",
  899. "address": "0x421074"
  900. },
  901. {
  902. "name": "InitializeSListHead",
  903. "address": "0x421078"
  904. },
  905. {
  906. "name": "IsDebuggerPresent",
  907. "address": "0x42107c"
  908. },
  909. {
  910. "name": "GetModuleHandleW",
  911. "address": "0x421080"
  912. },
  913. {
  914. "name": "RtlUnwind",
  915. "address": "0x421084"
  916. },
  917. {
  918. "name": "SetLastError",
  919. "address": "0x421088"
  920. },
  921. {
  922. "name": "EnterCriticalSection",
  923. "address": "0x42108c"
  924. },
  925. {
  926. "name": "LeaveCriticalSection",
  927. "address": "0x421090"
  928. },
  929. {
  930. "name": "DeleteCriticalSection",
  931. "address": "0x421094"
  932. },
  933. {
  934. "name": "InitializeCriticalSectionAndSpinCount",
  935. "address": "0x421098"
  936. },
  937. {
  938. "name": "TlsAlloc",
  939. "address": "0x42109c"
  940. },
  941. {
  942. "name": "TlsGetValue",
  943. "address": "0x4210a0"
  944. },
  945. {
  946. "name": "TlsSetValue",
  947. "address": "0x4210a4"
  948. },
  949. {
  950. "name": "TlsFree",
  951. "address": "0x4210a8"
  952. },
  953. {
  954. "name": "FreeLibrary",
  955. "address": "0x4210ac"
  956. },
  957. {
  958. "name": "GetCommandLineA",
  959. "address": "0x4210b0"
  960. },
  961. {
  962. "name": "ReadFile",
  963. "address": "0x4210b4"
  964. },
  965. {
  966. "name": "CreateFileW",
  967. "address": "0x4210b8"
  968. },
  969. {
  970. "name": "GetDriveTypeW",
  971. "address": "0x4210bc"
  972. },
  973. {
  974. "name": "GetFileType",
  975. "address": "0x4210c0"
  976. },
  977. {
  978. "name": "CloseHandle",
  979. "address": "0x4210c4"
  980. },
  981. {
  982. "name": "PeekNamedPipe",
  983. "address": "0x4210c8"
  984. },
  985. {
  986. "name": "SystemTimeToTzSpecificLocalTime",
  987. "address": "0x4210cc"
  988. },
  989. {
  990. "name": "FileTimeToSystemTime",
  991. "address": "0x4210d0"
  992. },
  993. {
  994. "name": "GetFullPathNameW",
  995. "address": "0x4210d4"
  996. },
  997. {
  998. "name": "GetFullPathNameA",
  999. "address": "0x4210d8"
  1000. },
  1001. {
  1002. "name": "CreateDirectoryW",
  1003. "address": "0x4210dc"
  1004. },
  1005. {
  1006. "name": "RemoveDirectoryW",
  1007. "address": "0x4210e0"
  1008. },
  1009. {
  1010. "name": "FindClose",
  1011. "address": "0x4210e4"
  1012. },
  1013. {
  1014. "name": "FindFirstFileExW",
  1015. "address": "0x4210e8"
  1016. },
  1017. {
  1018. "name": "FindNextFileW",
  1019. "address": "0x4210ec"
  1020. },
  1021. {
  1022. "name": "SetStdHandle",
  1023. "address": "0x4210f0"
  1024. },
  1025. {
  1026. "name": "SetConsoleCtrlHandler",
  1027. "address": "0x4210f4"
  1028. },
  1029. {
  1030. "name": "DeleteFileW",
  1031. "address": "0x4210f8"
  1032. },
  1033. {
  1034. "name": "GetStdHandle",
  1035. "address": "0x4210fc"
  1036. },
  1037. {
  1038. "name": "WriteFile",
  1039. "address": "0x421100"
  1040. },
  1041. {
  1042. "name": "ExitProcess",
  1043. "address": "0x421104"
  1044. },
  1045. {
  1046. "name": "GetModuleHandleExW",
  1047. "address": "0x421108"
  1048. },
  1049. {
  1050. "name": "GetACP",
  1051. "address": "0x42110c"
  1052. },
  1053. {
  1054. "name": "HeapFree",
  1055. "address": "0x421110"
  1056. },
  1057. {
  1058. "name": "HeapAlloc",
  1059. "address": "0x421114"
  1060. },
  1061. {
  1062. "name": "GetConsoleMode",
  1063. "address": "0x421118"
  1064. },
  1065. {
  1066. "name": "ReadConsoleW",
  1067. "address": "0x42111c"
  1068. },
  1069. {
  1070. "name": "SetFilePointerEx",
  1071. "address": "0x421120"
  1072. },
  1073. {
  1074. "name": "GetConsoleCP",
  1075. "address": "0x421124"
  1076. },
  1077. {
  1078. "name": "CompareStringW",
  1079. "address": "0x421128"
  1080. },
  1081. {
  1082. "name": "LCMapStringW",
  1083. "address": "0x42112c"
  1084. },
  1085. {
  1086. "name": "GetCurrentDirectoryW",
  1087. "address": "0x421130"
  1088. },
  1089. {
  1090. "name": "FlushFileBuffers",
  1091. "address": "0x421134"
  1092. },
  1093. {
  1094. "name": "SetEnvironmentVariableA",
  1095. "address": "0x421138"
  1096. },
  1097. {
  1098. "name": "GetFileAttributesExW",
  1099. "address": "0x42113c"
  1100. },
  1101. {
  1102. "name": "IsValidCodePage",
  1103. "address": "0x421140"
  1104. },
  1105. {
  1106. "name": "GetOEMCP",
  1107. "address": "0x421144"
  1108. },
  1109. {
  1110. "name": "GetCPInfo",
  1111. "address": "0x421148"
  1112. },
  1113. {
  1114. "name": "GetEnvironmentStringsW",
  1115. "address": "0x42114c"
  1116. },
  1117. {
  1118. "name": "FreeEnvironmentStringsW",
  1119. "address": "0x421150"
  1120. },
  1121. {
  1122. "name": "GetStringTypeW",
  1123. "address": "0x421154"
  1124. },
  1125. {
  1126. "name": "GetProcessHeap",
  1127. "address": "0x421158"
  1128. },
  1129. {
  1130. "name": "WriteConsoleW",
  1131. "address": "0x42115c"
  1132. },
  1133. {
  1134. "name": "GetTimeZoneInformation",
  1135. "address": "0x421160"
  1136. },
  1137. {
  1138. "name": "HeapSize",
  1139. "address": "0x421164"
  1140. },
  1141. {
  1142. "name": "HeapReAlloc",
  1143. "address": "0x421168"
  1144. },
  1145. {
  1146. "name": "SetEndOfFile",
  1147. "address": "0x42116c"
  1148. },
  1149. {
  1150. "name": "RaiseException",
  1151. "address": "0x421170"
  1152. }
  1153. ],
  1154. "dll": "KERNEL32.dll"
  1155. },
  1156. {
  1157. "imports": [
  1158. {
  1159. "name": "ntohl",
  1160. "address": "0x421178"
  1161. }
  1162. ],
  1163. "dll": "WS2_32.dll"
  1164. }
  1165. ],
  1166. "digital_signers": null,
  1167. "exported_dll_name": null,
  1168. "actual_checksum": "0x0053d295",
  1169. "overlay": {
  1170. "size": "0x004fab37",
  1171. "offset": "0x0003b800"
  1172. },
  1173. "imagebase": "0x00400000",
  1174. "reported_checksum": "0x00000000",
  1175. "icon_hash": null,
  1176. "entrypoint": "0x0040769a",
  1177. "timestamp": "2017-12-11 15:09:08",
  1178. "osversion": "5.1",
  1179. "sections": [
  1180. {
  1181. "name": ".text",
  1182. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1183. "virtual_address": "0x00001000",
  1184. "size_of_data": "0x0001f200",
  1185. "entropy": "6.66",
  1186. "raw_address": "0x00000400",
  1187. "virtual_size": "0x0001f144",
  1188. "characteristics_raw": "0x60000020"
  1189. },
  1190. {
  1191. "name": ".rdata",
  1192. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1193. "virtual_address": "0x00021000",
  1194. "size_of_data": "0x0000b200",
  1195. "entropy": "6.09",
  1196. "raw_address": "0x0001f600",
  1197. "virtual_size": "0x0000b06c",
  1198. "characteristics_raw": "0x40000040"
  1199. },
  1200. {
  1201. "name": ".data",
  1202. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1203. "virtual_address": "0x0002d000",
  1204. "size_of_data": "0x00000a00",
  1205. "entropy": "1.93",
  1206. "raw_address": "0x0002a800",
  1207. "virtual_size": "0x0000e678",
  1208. "characteristics_raw": "0xc0000040"
  1209. },
  1210. {
  1211. "name": ".gfids",
  1212. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1213. "virtual_address": "0x0003c000",
  1214. "size_of_data": "0x00000200",
  1215. "entropy": "1.86",
  1216. "raw_address": "0x0002b200",
  1217. "virtual_size": "0x000000b8",
  1218. "characteristics_raw": "0x40000040"
  1219. },
  1220. {
  1221. "name": ".rsrc",
  1222. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1223. "virtual_address": "0x0003d000",
  1224. "size_of_data": "0x0000ec00",
  1225. "entropy": "7.30",
  1226. "raw_address": "0x0002b400",
  1227. "virtual_size": "0x0000ea38",
  1228. "characteristics_raw": "0x40000040"
  1229. },
  1230. {
  1231. "name": ".reloc",
  1232. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1233. "virtual_address": "0x0004c000",
  1234. "size_of_data": "0x00001800",
  1235. "entropy": "6.64",
  1236. "raw_address": "0x0003a000",
  1237. "virtual_size": "0x000017b8",
  1238. "characteristics_raw": "0x42000040"
  1239. }
  1240. ],
  1241. "resources": [],
  1242. "dirents": [
  1243. {
  1244. "virtual_address": "0x00000000",
  1245. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1246. "size": "0x00000000"
  1247. },
  1248. {
  1249. "virtual_address": "0x0002b7ac",
  1250. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1251. "size": "0x0000003c"
  1252. },
  1253. {
  1254. "virtual_address": "0x0003d000",
  1255. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1256. "size": "0x0000ea38"
  1257. },
  1258. {
  1259. "virtual_address": "0x00000000",
  1260. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1261. "size": "0x00000000"
  1262. },
  1263. {
  1264. "virtual_address": "0x00000000",
  1265. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1266. "size": "0x00000000"
  1267. },
  1268. {
  1269. "virtual_address": "0x0004c000",
  1270. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1271. "size": "0x000017b8"
  1272. },
  1273. {
  1274. "virtual_address": "0x0002adc0",
  1275. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1276. "size": "0x0000001c"
  1277. },
  1278. {
  1279. "virtual_address": "0x00000000",
  1280. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1281. "size": "0x00000000"
  1282. },
  1283. {
  1284. "virtual_address": "0x00000000",
  1285. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1286. "size": "0x00000000"
  1287. },
  1288. {
  1289. "virtual_address": "0x00000000",
  1290. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1291. "size": "0x00000000"
  1292. },
  1293. {
  1294. "virtual_address": "0x0002ade0",
  1295. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1296. "size": "0x00000040"
  1297. },
  1298. {
  1299. "virtual_address": "0x00000000",
  1300. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1301. "size": "0x00000000"
  1302. },
  1303. {
  1304. "virtual_address": "0x00021000",
  1305. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1306. "size": "0x00000180"
  1307. },
  1308. {
  1309. "virtual_address": "0x00000000",
  1310. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1311. "size": "0x00000000"
  1312. },
  1313. {
  1314. "virtual_address": "0x00000000",
  1315. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1316. "size": "0x00000000"
  1317. },
  1318. {
  1319. "virtual_address": "0x00000000",
  1320. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1321. "size": "0x00000000"
  1322. }
  1323. ],
  1324. "exports": [],
  1325. "guest_signers": {},
  1326. "imphash": "fc40519af20116c903e3ff836e366e39",
  1327. "icon_fuzzy": null,
  1328. "icon": null,
  1329. "pdbpath": null,
  1330. "imported_dll_count": 2,
  1331. "versioninfo": []
  1332. }
  1333. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!