API tools faq
paste
paladin316

Exes_bbdb9aa608613f6e66bb3b305bfc1b0f_exe_2019-06-28_19_30.json

paladin316
Jun 28th, 2019
2,153
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 37.55 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_bbdb9aa608613f6e66bb3b305bfc1b0f.exe"
  7. [*] File Size: 335872
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "dcba8f4922b1f9124d0352c4bbbf60875152d24f838a4c678c3227bb6b85d097"
  10. [*] MD5: "bbdb9aa608613f6e66bb3b305bfc1b0f"
  11. [*] SHA1: "d74a544a8f5e311ac580c154318cd2c109fc3fe7"
  12. [*] SHA512: "d5f88e8df6d29711a2f6320b83cce5bd29c650f8a510d65b804e3f9cb81f8b5603d2e6b773b49f0d3acf3b5cfeca76337a4018f0a26c2bb2dbb1637023c01f0b"
  13. [*] CRC32: "43A8CD65"
  14. [*] SSDEEP: "6144:fEj/5wzOxJ/N/8Mk9pkR+x30Bk8bSgeVV/2ogdeqY7dlZe4kzL/5XysZ:fEj/azc8Mk9pkYxEuMogEPM4QLh3"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .text, entropy: 7.58, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00051600, virtual_size: 0x00051414"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "File has been identified by 47 Antiviruses on VirusTotal as malicious",
  29. "Details": [
  30. {
  31. "MicroWorld-eScan": "Gen:Variant.Zusy.86660"
  32. },
  33. {
  34. "CAT-QuickHeal": "Trojan.Multi"
  35. },
  36. {
  37. "Qihoo-360": "Win32/Backdoor.23a"
  38. },
  39. {
  40. "McAfee": "Packed-FTF!BBDB9AA60861"
  41. },
  42. {
  43. "Cylance": "Unsafe"
  44. },
  45. {
  46. "Alibaba": "Trojan:Win32/Malmail.ali1000112"
  47. },
  48. {
  49. "Arcabit": "Trojan.Zusy.D15284"
  50. },
  51. {
  52. "TrendMicro": "Trojan.MSIL.BANKERLOADER.USXVPFJ19"
  53. },
  54. {
  55. "F-Prot": "W32/Trojan.SW.gen!Eldorado"
  56. },
  57. {
  58. "Symantec": "ML.Attribute.HighConfidence"
  59. },
  60. {
  61. "APEX": "Malicious"
  62. },
  63. {
  64. "Paloalto": "generic.ml"
  65. },
  66. {
  67. "Kaspersky": "HEUR:Backdoor.MSIL.Remcos.gen"
  68. },
  69. {
  70. "BitDefender": "Gen:Variant.Zusy.86660"
  71. },
  72. {
  73. "AegisLab": "Trojan.Multi.Generic.4!c"
  74. },
  75. {
  76. "Rising": "Trojan.Kryptik!8.8 (CLOUD)"
  77. },
  78. {
  79. "Ad-Aware": "Gen:Variant.Zusy.86660"
  80. },
  81. {
  82. "Sophos": "Mal/Generic-S"
  83. },
  84. {
  85. "Comodo": "Malware@#1yfzzp7x67auo"
  86. },
  87. {
  88. "F-Secure": "Trojan.TR/Kryptik.qsrso"
  89. },
  90. {
  91. "Invincea": "heuristic"
  92. },
  93. {
  94. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  95. },
  96. {
  97. "Trapmine": "malicious.moderate.ml.score"
  98. },
  99. {
  100. "FireEye": "Generic.mg.bbdb9aa608613f6e"
  101. },
  102. {
  103. "Emsisoft": "Gen:Variant.Zusy.86660 (B)"
  104. },
  105. {
  106. "Ikarus": "Trojan.MSIL.Crypt"
  107. },
  108. {
  109. "Cyren": "W32/Trojan.SW.gen!Eldorado"
  110. },
  111. {
  112. "Webroot": "W32.Trojan.SW"
  113. },
  114. {
  115. "Avira": "TR/Kryptik.qsrso"
  116. },
  117. {
  118. "MAX": "malware (ai score=94)"
  119. },
  120. {
  121. "Microsoft": "Backdoor:Win32/Rescoms.C!bit"
  122. },
  123. {
  124. "Endgame": "malicious (high confidence)"
  125. },
  126. {
  127. "ZoneAlarm": "HEUR:Backdoor.MSIL.Remcos.gen"
  128. },
  129. {
  130. "GData": "Gen:Variant.Zusy.86660"
  131. },
  132. {
  133. "Acronis": "suspicious"
  134. },
  135. {
  136. "ALYac": "Gen:Variant.Zusy.86660"
  137. },
  138. {
  139. "Malwarebytes": "Trojan.PCrypt.MSIL.Generic"
  140. },
  141. {
  142. "Panda": "Trj/GdSda.A"
  143. },
  144. {
  145. "ESET-NOD32": "a variant of MSIL/Kryptik.RZC"
  146. },
  147. {
  148. "TrendMicro-HouseCall": "Trojan.MSIL.BANKERLOADER.USXVPFJ19"
  149. },
  150. {
  151. "Tencent": "Win32.Trojan.Inject.Auto"
  152. },
  153. {
  154. "SentinelOne": "DFI - Suspicious PE"
  155. },
  156. {
  157. "Fortinet": "MSIL/Kryptik.RZC!tr"
  158. },
  159. {
  160. "AVG": "Win32:Trojan-gen"
  161. },
  162. {
  163. "Cybereason": "malicious.608613"
  164. },
  165. {
  166. "Avast": "Win32:Trojan-gen"
  167. },
  168. {
  169. "CrowdStrike": "win/malicious_confidence_90% (W)"
  170. }
  171. ]
  172. },
  173. {
  174. "Description": "Anomalous binary characteristics",
  175. "Details": [
  176. {
  177. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  178. }
  179. ]
  180. }
  181. ]
  182.  
  183. [*] Started Service: []
  184.  
  185. [*] Executed Commands: []
  186.  
  187. [*] Mutexes: []
  188.  
  189. [*] Modified Files: []
  190.  
  191. [*] Deleted Files: []
  192.  
  193. [*] Modified Registry Keys: []
  194.  
  195. [*] Deleted Registry Keys: []
  196.  
  197. [*] DNS Communications: []
  198.  
  199. [*] Domains: []
  200.  
  201. [*] Network Communication - ICMP: []
  202.  
  203. [*] Network Communication - HTTP: []
  204.  
  205. [*] Network Communication - SMTP: []
  206.  
  207. [*] Network Communication - Hosts: []
  208.  
  209. [*] Network Communication - IRC: []
  210.  
  211. [*] Static Analysis: {
  212. "dotnet": {
  213. "customattrs": [
  214. {
  215. "type": "Assembly",
  216. "name": "[mscorlib]System.Reflection.AssemblyCompanyAttribute",
  217. "value": "Microso"
  218. },
  219. {
  220. "type": "Assembly",
  221. "name": "[mscorlib]System.Reflection.AssemblyProductAttribute",
  222. "value": "Microsoft Wo"
  223. },
  224. {
  225. "type": "Assembly",
  226. "name": "[mscorlib]System.Reflection.AssemblyTitleAttribute",
  227. "value": "Microsoft Wo"
  228. },
  229. {
  230. "type": "Assembly",
  231. "name": "[mscorlib]System.Reflection.AssemblyDescriptionAttribute",
  232. "value": "Microsoft Wo"
  233. },
  234. {
  235. "type": "Assembly",
  236. "name": "[mscorlib]System.Runtime.InteropServices.GuidAttribute",
  237. "value": "ef729f24-2985-487e-932b-7618f3eafc"
  238. },
  239. {
  240. "type": "Assembly",
  241. "name": "[mscorlib]System.Reflection.AssemblyFileVersionAttribute",
  242. "value": "8.12.17."
  243. },
  244. {
  245. "type": "Assembly",
  246. "name": "[mscorlib]System.Reflection.AssemblyCopyrightAttribute",
  247. "value": "Copyright @ 20"
  248. }
  249. ],
  250. "assemblyinfo": {
  251. "version": "1.0.0.0",
  252. "name": "/sn4Pbs/XuyNXFF2H6ooh5ibzKpkcs/ui6TjLsPXGb2skAw="
  253. },
  254. "assemblyrefs": [
  255. {
  256. "version": "4.0.0.0",
  257. "name": "mscorlib"
  258. },
  259. {
  260. "version": "4.0.0.0",
  261. "name": "System"
  262. },
  263. {
  264. "version": "1.0.0.1",
  265. "name": "gdi32"
  266. }
  267. ],
  268. "typerefs": [
  269. {
  270. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  271. "assembly": "System"
  272. },
  273. {
  274. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  275. "assembly": "System"
  276. },
  277. {
  278. "typename": "System.ComponentModel.EditorBrowsableState",
  279. "assembly": "System"
  280. },
  281. {
  282. "typename": "System.Configuration.ApplicationSettingsBase",
  283. "assembly": "System"
  284. },
  285. {
  286. "typename": "System.Configuration.SettingsBase",
  287. "assembly": "System"
  288. },
  289. {
  290. "typename": "System.Diagnostics.Stopwatch",
  291. "assembly": "System"
  292. },
  293. {
  294. "typename": "gdi32.Program",
  295. "assembly": "gdi32"
  296. },
  297. {
  298. "typename": "System.AppDomain",
  299. "assembly": "mscorlib"
  300. },
  301. {
  302. "typename": "System.Array",
  303. "assembly": "mscorlib"
  304. },
  305. {
  306. "typename": "System.Boolean",
  307. "assembly": "mscorlib"
  308. },
  309. {
  310. "typename": "System.Buffer",
  311. "assembly": "mscorlib"
  312. },
  313. {
  314. "typename": "System.Byte",
  315. "assembly": "mscorlib"
  316. },
  317. {
  318. "typename": "System.Char",
  319. "assembly": "mscorlib"
  320. },
  321. {
  322. "typename": "System.Collections.Generic.IEnumerable`1",
  323. "assembly": "mscorlib"
  324. },
  325. {
  326. "typename": "System.Collections.IEnumerable",
  327. "assembly": "mscorlib"
  328. },
  329. {
  330. "typename": "System.Console",
  331. "assembly": "mscorlib"
  332. },
  333. {
  334. "typename": "System.DBNull",
  335. "assembly": "mscorlib"
  336. },
  337. {
  338. "typename": "System.DateTime",
  339. "assembly": "mscorlib"
  340. },
  341. {
  342. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  343. "assembly": "mscorlib"
  344. },
  345. {
  346. "typename": "System.Enum",
  347. "assembly": "mscorlib"
  348. },
  349. {
  350. "typename": "System.Exception",
  351. "assembly": "mscorlib"
  352. },
  353. {
  354. "typename": "System.Globalization.CultureInfo",
  355. "assembly": "mscorlib"
  356. },
  357. {
  358. "typename": "System.Globalization.NumberStyles",
  359. "assembly": "mscorlib"
  360. },
  361. {
  362. "typename": "System.IConvertible",
  363. "assembly": "mscorlib"
  364. },
  365. {
  366. "typename": "System.IFormatProvider",
  367. "assembly": "mscorlib"
  368. },
  369. {
  370. "typename": "System.Int16",
  371. "assembly": "mscorlib"
  372. },
  373. {
  374. "typename": "System.Int32",
  375. "assembly": "mscorlib"
  376. },
  377. {
  378. "typename": "System.Int64",
  379. "assembly": "mscorlib"
  380. },
  381. {
  382. "typename": "System.NotSupportedException",
  383. "assembly": "mscorlib"
  384. },
  385. {
  386. "typename": "System.Object",
  387. "assembly": "mscorlib"
  388. },
  389. {
  390. "typename": "System.Reflection.Assembly",
  391. "assembly": "mscorlib"
  392. },
  393. {
  394. "typename": "System.Reflection.AssemblyCompanyAttribute",
  395. "assembly": "mscorlib"
  396. },
  397. {
  398. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  399. "assembly": "mscorlib"
  400. },
  401. {
  402. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  403. "assembly": "mscorlib"
  404. },
  405. {
  406. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  407. "assembly": "mscorlib"
  408. },
  409. {
  410. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  411. "assembly": "mscorlib"
  412. },
  413. {
  414. "typename": "System.Reflection.AssemblyProductAttribute",
  415. "assembly": "mscorlib"
  416. },
  417. {
  418. "typename": "System.Reflection.AssemblyTitleAttribute",
  419. "assembly": "mscorlib"
  420. },
  421. {
  422. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  423. "assembly": "mscorlib"
  424. },
  425. {
  426. "typename": "System.Reflection.BindingFlags",
  427. "assembly": "mscorlib"
  428. },
  429. {
  430. "typename": "System.Reflection.CallingConventions",
  431. "assembly": "mscorlib"
  432. },
  433. {
  434. "typename": "System.Reflection.IReflect",
  435. "assembly": "mscorlib"
  436. },
  437. {
  438. "typename": "System.Reflection.MemberInfo",
  439. "assembly": "mscorlib"
  440. },
  441. {
  442. "typename": "System.Reflection.MethodBase",
  443. "assembly": "mscorlib"
  444. },
  445. {
  446. "typename": "System.Reflection.ParameterInfo",
  447. "assembly": "mscorlib"
  448. },
  449. {
  450. "typename": "System.Reflection.ParameterModifier",
  451. "assembly": "mscorlib"
  452. },
  453. {
  454. "typename": "System.Reflection.PropertyInfo",
  455. "assembly": "mscorlib"
  456. },
  457. {
  458. "typename": "System.ResolveEventArgs",
  459. "assembly": "mscorlib"
  460. },
  461. {
  462. "typename": "System.ResolveEventHandler",
  463. "assembly": "mscorlib"
  464. },
  465. {
  466. "typename": "System.Resources.ResourceManager",
  467. "assembly": "mscorlib"
  468. },
  469. {
  470. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  471. "assembly": "mscorlib"
  472. },
  473. {
  474. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  475. "assembly": "mscorlib"
  476. },
  477. {
  478. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  479. "assembly": "mscorlib"
  480. },
  481. {
  482. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  483. "assembly": "mscorlib"
  484. },
  485. {
  486. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  487. "assembly": "mscorlib"
  488. },
  489. {
  490. "typename": "System.Runtime.InteropServices.GuidAttribute",
  491. "assembly": "mscorlib"
  492. },
  493. {
  494. "typename": "System.Runtime.Remoting.ObjectHandle",
  495. "assembly": "mscorlib"
  496. },
  497. {
  498. "typename": "System.Runtime.Serialization.ISerializable",
  499. "assembly": "mscorlib"
  500. },
  501. {
  502. "typename": "System.Runtime.Versioning.TargetFrameworkAttribute",
  503. "assembly": "mscorlib"
  504. },
  505. {
  506. "typename": "System.RuntimeFieldHandle",
  507. "assembly": "mscorlib"
  508. },
  509. {
  510. "typename": "System.RuntimeTypeHandle",
  511. "assembly": "mscorlib"
  512. },
  513. {
  514. "typename": "System.SByte",
  515. "assembly": "mscorlib"
  516. },
  517. {
  518. "typename": "System.STAThreadAttribute",
  519. "assembly": "mscorlib"
  520. },
  521. {
  522. "typename": "System.String",
  523. "assembly": "mscorlib"
  524. },
  525. {
  526. "typename": "System.Text.StringBuilder",
  527. "assembly": "mscorlib"
  528. },
  529. {
  530. "typename": "System.TimeSpan",
  531. "assembly": "mscorlib"
  532. },
  533. {
  534. "typename": "System.Type",
  535. "assembly": "mscorlib"
  536. },
  537. {
  538. "typename": "System.TypeCode",
  539. "assembly": "mscorlib"
  540. },
  541. {
  542. "typename": "System.UInt16",
  543. "assembly": "mscorlib"
  544. },
  545. {
  546. "typename": "System.UInt32",
  547. "assembly": "mscorlib"
  548. },
  549. {
  550. "typename": "System.UInt64",
  551. "assembly": "mscorlib"
  552. },
  553. {
  554. "typename": "System.ValueType",
  555. "assembly": "mscorlib"
  556. },
  557. {
  558. "typename": "System.Void",
  559. "assembly": "mscorlib"
  560. }
  561. ]
  562. },
  563. "pe": {
  564. "peid_signatures": null,
  565. "imports": [
  566. {
  567. "imports": [
  568. {
  569. "name": "_CorExeMain",
  570. "address": "0x402000"
  571. }
  572. ],
  573. "dll": "mscoree.dll"
  574. }
  575. ],
  576. "digital_signers": null,
  577. "exported_dll_name": null,
  578. "actual_checksum": "0x00054dc2",
  579. "overlay": null,
  580. "imagebase": "0x00400000",
  581. "reported_checksum": "0x00000000",
  582. "icon_hash": null,
  583. "entrypoint": "0x0045340e",
  584. "timestamp": "1987-12-16 22:49:36",
  585. "osversion": "4.0",
  586. "sections": [
  587. {
  588. "name": ".text",
  589. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  590. "virtual_address": "0x00002000",
  591. "size_of_data": "0x00051600",
  592. "entropy": "7.58",
  593. "raw_address": "0x00000200",
  594. "virtual_size": "0x00051414",
  595. "characteristics_raw": "0x60000020"
  596. },
  597. {
  598. "name": ".rsrc",
  599. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  600. "virtual_address": "0x00054000",
  601. "size_of_data": "0x00000600",
  602. "entropy": "4.53",
  603. "raw_address": "0x00051800",
  604. "virtual_size": "0x00000600",
  605. "characteristics_raw": "0x40000040"
  606. },
  607. {
  608. "name": ".reloc",
  609. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  610. "virtual_address": "0x00056000",
  611. "size_of_data": "0x00000200",
  612. "entropy": "0.10",
  613. "raw_address": "0x00051e00",
  614. "virtual_size": "0x0000000c",
  615. "characteristics_raw": "0x42000040"
  616. }
  617. ],
  618. "resources": [],
  619. "dirents": [
  620. {
  621. "virtual_address": "0x00000000",
  622. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  623. "size": "0x00000000"
  624. },
  625. {
  626. "virtual_address": "0x000533b4",
  627. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  628. "size": "0x00000057"
  629. },
  630. {
  631. "virtual_address": "0x00054000",
  632. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  633. "size": "0x00000600"
  634. },
  635. {
  636. "virtual_address": "0x00000000",
  637. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  638. "size": "0x00000000"
  639. },
  640. {
  641. "virtual_address": "0x00000000",
  642. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  643. "size": "0x00000000"
  644. },
  645. {
  646. "virtual_address": "0x00056000",
  647. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  648. "size": "0x0000000c"
  649. },
  650. {
  651. "virtual_address": "0x00000000",
  652. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  653. "size": "0x00000000"
  654. },
  655. {
  656. "virtual_address": "0x00000000",
  657. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  658. "size": "0x00000000"
  659. },
  660. {
  661. "virtual_address": "0x00000000",
  662. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  663. "size": "0x00000000"
  664. },
  665. {
  666. "virtual_address": "0x00000000",
  667. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  668. "size": "0x00000000"
  669. },
  670. {
  671. "virtual_address": "0x00000000",
  672. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  673. "size": "0x00000000"
  674. },
  675. {
  676. "virtual_address": "0x00000000",
  677. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  678. "size": "0x00000000"
  679. },
  680. {
  681. "virtual_address": "0x00002000",
  682. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  683. "size": "0x00000008"
  684. },
  685. {
  686. "virtual_address": "0x00000000",
  687. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  688. "size": "0x00000000"
  689. },
  690. {
  691. "virtual_address": "0x00002008",
  692. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  693. "size": "0x00000048"
  694. },
  695. {
  696. "virtual_address": "0x00000000",
  697. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  698. "size": "0x00000000"
  699. }
  700. ],
  701. "exports": [],
  702. "guest_signers": {},
  703. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  704. "icon_fuzzy": null,
  705. "icon": null,
  706. "pdbpath": null,
  707. "imported_dll_count": 1,
  708. "versioninfo": []
  709. }
  710. }
  711.  
  712. [*] Resolved APIs: []
  713.  
  714. [*] Static Analysis: {
  715. "dotnet": {
  716. "customattrs": [
  717. {
  718. "type": "Assembly",
  719. "name": "[mscorlib]System.Reflection.AssemblyCompanyAttribute",
  720. "value": "Microso"
  721. },
  722. {
  723. "type": "Assembly",
  724. "name": "[mscorlib]System.Reflection.AssemblyProductAttribute",
  725. "value": "Microsoft Wo"
  726. },
  727. {
  728. "type": "Assembly",
  729. "name": "[mscorlib]System.Reflection.AssemblyTitleAttribute",
  730. "value": "Microsoft Wo"
  731. },
  732. {
  733. "type": "Assembly",
  734. "name": "[mscorlib]System.Reflection.AssemblyDescriptionAttribute",
  735. "value": "Microsoft Wo"
  736. },
  737. {
  738. "type": "Assembly",
  739. "name": "[mscorlib]System.Runtime.InteropServices.GuidAttribute",
  740. "value": "ef729f24-2985-487e-932b-7618f3eafc"
  741. },
  742. {
  743. "type": "Assembly",
  744. "name": "[mscorlib]System.Reflection.AssemblyFileVersionAttribute",
  745. "value": "8.12.17."
  746. },
  747. {
  748. "type": "Assembly",
  749. "name": "[mscorlib]System.Reflection.AssemblyCopyrightAttribute",
  750. "value": "Copyright @ 20"
  751. }
  752. ],
  753. "assemblyinfo": {
  754. "version": "1.0.0.0",
  755. "name": "/sn4Pbs/XuyNXFF2H6ooh5ibzKpkcs/ui6TjLsPXGb2skAw="
  756. },
  757. "assemblyrefs": [
  758. {
  759. "version": "4.0.0.0",
  760. "name": "mscorlib"
  761. },
  762. {
  763. "version": "4.0.0.0",
  764. "name": "System"
  765. },
  766. {
  767. "version": "1.0.0.1",
  768. "name": "gdi32"
  769. }
  770. ],
  771. "typerefs": [
  772. {
  773. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  774. "assembly": "System"
  775. },
  776. {
  777. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  778. "assembly": "System"
  779. },
  780. {
  781. "typename": "System.ComponentModel.EditorBrowsableState",
  782. "assembly": "System"
  783. },
  784. {
  785. "typename": "System.Configuration.ApplicationSettingsBase",
  786. "assembly": "System"
  787. },
  788. {
  789. "typename": "System.Configuration.SettingsBase",
  790. "assembly": "System"
  791. },
  792. {
  793. "typename": "System.Diagnostics.Stopwatch",
  794. "assembly": "System"
  795. },
  796. {
  797. "typename": "gdi32.Program",
  798. "assembly": "gdi32"
  799. },
  800. {
  801. "typename": "System.AppDomain",
  802. "assembly": "mscorlib"
  803. },
  804. {
  805. "typename": "System.Array",
  806. "assembly": "mscorlib"
  807. },
  808. {
  809. "typename": "System.Boolean",
  810. "assembly": "mscorlib"
  811. },
  812. {
  813. "typename": "System.Buffer",
  814. "assembly": "mscorlib"
  815. },
  816. {
  817. "typename": "System.Byte",
  818. "assembly": "mscorlib"
  819. },
  820. {
  821. "typename": "System.Char",
  822. "assembly": "mscorlib"
  823. },
  824. {
  825. "typename": "System.Collections.Generic.IEnumerable`1",
  826. "assembly": "mscorlib"
  827. },
  828. {
  829. "typename": "System.Collections.IEnumerable",
  830. "assembly": "mscorlib"
  831. },
  832. {
  833. "typename": "System.Console",
  834. "assembly": "mscorlib"
  835. },
  836. {
  837. "typename": "System.DBNull",
  838. "assembly": "mscorlib"
  839. },
  840. {
  841. "typename": "System.DateTime",
  842. "assembly": "mscorlib"
  843. },
  844. {
  845. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  846. "assembly": "mscorlib"
  847. },
  848. {
  849. "typename": "System.Enum",
  850. "assembly": "mscorlib"
  851. },
  852. {
  853. "typename": "System.Exception",
  854. "assembly": "mscorlib"
  855. },
  856. {
  857. "typename": "System.Globalization.CultureInfo",
  858. "assembly": "mscorlib"
  859. },
  860. {
  861. "typename": "System.Globalization.NumberStyles",
  862. "assembly": "mscorlib"
  863. },
  864. {
  865. "typename": "System.IConvertible",
  866. "assembly": "mscorlib"
  867. },
  868. {
  869. "typename": "System.IFormatProvider",
  870. "assembly": "mscorlib"
  871. },
  872. {
  873. "typename": "System.Int16",
  874. "assembly": "mscorlib"
  875. },
  876. {
  877. "typename": "System.Int32",
  878. "assembly": "mscorlib"
  879. },
  880. {
  881. "typename": "System.Int64",
  882. "assembly": "mscorlib"
  883. },
  884. {
  885. "typename": "System.NotSupportedException",
  886. "assembly": "mscorlib"
  887. },
  888. {
  889. "typename": "System.Object",
  890. "assembly": "mscorlib"
  891. },
  892. {
  893. "typename": "System.Reflection.Assembly",
  894. "assembly": "mscorlib"
  895. },
  896. {
  897. "typename": "System.Reflection.AssemblyCompanyAttribute",
  898. "assembly": "mscorlib"
  899. },
  900. {
  901. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  902. "assembly": "mscorlib"
  903. },
  904. {
  905. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  906. "assembly": "mscorlib"
  907. },
  908. {
  909. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  910. "assembly": "mscorlib"
  911. },
  912. {
  913. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  914. "assembly": "mscorlib"
  915. },
  916. {
  917. "typename": "System.Reflection.AssemblyProductAttribute",
  918. "assembly": "mscorlib"
  919. },
  920. {
  921. "typename": "System.Reflection.AssemblyTitleAttribute",
  922. "assembly": "mscorlib"
  923. },
  924. {
  925. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  926. "assembly": "mscorlib"
  927. },
  928. {
  929. "typename": "System.Reflection.BindingFlags",
  930. "assembly": "mscorlib"
  931. },
  932. {
  933. "typename": "System.Reflection.CallingConventions",
  934. "assembly": "mscorlib"
  935. },
  936. {
  937. "typename": "System.Reflection.IReflect",
  938. "assembly": "mscorlib"
  939. },
  940. {
  941. "typename": "System.Reflection.MemberInfo",
  942. "assembly": "mscorlib"
  943. },
  944. {
  945. "typename": "System.Reflection.MethodBase",
  946. "assembly": "mscorlib"
  947. },
  948. {
  949. "typename": "System.Reflection.ParameterInfo",
  950. "assembly": "mscorlib"
  951. },
  952. {
  953. "typename": "System.Reflection.ParameterModifier",
  954. "assembly": "mscorlib"
  955. },
  956. {
  957. "typename": "System.Reflection.PropertyInfo",
  958. "assembly": "mscorlib"
  959. },
  960. {
  961. "typename": "System.ResolveEventArgs",
  962. "assembly": "mscorlib"
  963. },
  964. {
  965. "typename": "System.ResolveEventHandler",
  966. "assembly": "mscorlib"
  967. },
  968. {
  969. "typename": "System.Resources.ResourceManager",
  970. "assembly": "mscorlib"
  971. },
  972. {
  973. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  974. "assembly": "mscorlib"
  975. },
  976. {
  977. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  978. "assembly": "mscorlib"
  979. },
  980. {
  981. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  982. "assembly": "mscorlib"
  983. },
  984. {
  985. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  986. "assembly": "mscorlib"
  987. },
  988. {
  989. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  990. "assembly": "mscorlib"
  991. },
  992. {
  993. "typename": "System.Runtime.InteropServices.GuidAttribute",
  994. "assembly": "mscorlib"
  995. },
  996. {
  997. "typename": "System.Runtime.Remoting.ObjectHandle",
  998. "assembly": "mscorlib"
  999. },
  1000. {
  1001. "typename": "System.Runtime.Serialization.ISerializable",
  1002. "assembly": "mscorlib"
  1003. },
  1004. {
  1005. "typename": "System.Runtime.Versioning.TargetFrameworkAttribute",
  1006. "assembly": "mscorlib"
  1007. },
  1008. {
  1009. "typename": "System.RuntimeFieldHandle",
  1010. "assembly": "mscorlib"
  1011. },
  1012. {
  1013. "typename": "System.RuntimeTypeHandle",
  1014. "assembly": "mscorlib"
  1015. },
  1016. {
  1017. "typename": "System.SByte",
  1018. "assembly": "mscorlib"
  1019. },
  1020. {
  1021. "typename": "System.STAThreadAttribute",
  1022. "assembly": "mscorlib"
  1023. },
  1024. {
  1025. "typename": "System.String",
  1026. "assembly": "mscorlib"
  1027. },
  1028. {
  1029. "typename": "System.Text.StringBuilder",
  1030. "assembly": "mscorlib"
  1031. },
  1032. {
  1033. "typename": "System.TimeSpan",
  1034. "assembly": "mscorlib"
  1035. },
  1036. {
  1037. "typename": "System.Type",
  1038. "assembly": "mscorlib"
  1039. },
  1040. {
  1041. "typename": "System.TypeCode",
  1042. "assembly": "mscorlib"
  1043. },
  1044. {
  1045. "typename": "System.UInt16",
  1046. "assembly": "mscorlib"
  1047. },
  1048. {
  1049. "typename": "System.UInt32",
  1050. "assembly": "mscorlib"
  1051. },
  1052. {
  1053. "typename": "System.UInt64",
  1054. "assembly": "mscorlib"
  1055. },
  1056. {
  1057. "typename": "System.ValueType",
  1058. "assembly": "mscorlib"
  1059. },
  1060. {
  1061. "typename": "System.Void",
  1062. "assembly": "mscorlib"
  1063. }
  1064. ]
  1065. },
  1066. "pe": {
  1067. "peid_signatures": null,
  1068. "imports": [
  1069. {
  1070. "imports": [
  1071. {
  1072. "name": "_CorExeMain",
  1073. "address": "0x402000"
  1074. }
  1075. ],
  1076. "dll": "mscoree.dll"
  1077. }
  1078. ],
  1079. "digital_signers": null,
  1080. "exported_dll_name": null,
  1081. "actual_checksum": "0x00054dc2",
  1082. "overlay": null,
  1083. "imagebase": "0x00400000",
  1084. "reported_checksum": "0x00000000",
  1085. "icon_hash": null,
  1086. "entrypoint": "0x0045340e",
  1087. "timestamp": "1987-12-16 22:49:36",
  1088. "osversion": "4.0",
  1089. "sections": [
  1090. {
  1091. "name": ".text",
  1092. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1093. "virtual_address": "0x00002000",
  1094. "size_of_data": "0x00051600",
  1095. "entropy": "7.58",
  1096. "raw_address": "0x00000200",
  1097. "virtual_size": "0x00051414",
  1098. "characteristics_raw": "0x60000020"
  1099. },
  1100. {
  1101. "name": ".rsrc",
  1102. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1103. "virtual_address": "0x00054000",
  1104. "size_of_data": "0x00000600",
  1105. "entropy": "4.53",
  1106. "raw_address": "0x00051800",
  1107. "virtual_size": "0x00000600",
  1108. "characteristics_raw": "0x40000040"
  1109. },
  1110. {
  1111. "name": ".reloc",
  1112. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1113. "virtual_address": "0x00056000",
  1114. "size_of_data": "0x00000200",
  1115. "entropy": "0.10",
  1116. "raw_address": "0x00051e00",
  1117. "virtual_size": "0x0000000c",
  1118. "characteristics_raw": "0x42000040"
  1119. }
  1120. ],
  1121. "resources": [],
  1122. "dirents": [
  1123. {
  1124. "virtual_address": "0x00000000",
  1125. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1126. "size": "0x00000000"
  1127. },
  1128. {
  1129. "virtual_address": "0x000533b4",
  1130. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1131. "size": "0x00000057"
  1132. },
  1133. {
  1134. "virtual_address": "0x00054000",
  1135. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1136. "size": "0x00000600"
  1137. },
  1138. {
  1139. "virtual_address": "0x00000000",
  1140. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1141. "size": "0x00000000"
  1142. },
  1143. {
  1144. "virtual_address": "0x00000000",
  1145. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1146. "size": "0x00000000"
  1147. },
  1148. {
  1149. "virtual_address": "0x00056000",
  1150. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1151. "size": "0x0000000c"
  1152. },
  1153. {
  1154. "virtual_address": "0x00000000",
  1155. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1156. "size": "0x00000000"
  1157. },
  1158. {
  1159. "virtual_address": "0x00000000",
  1160. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1161. "size": "0x00000000"
  1162. },
  1163. {
  1164. "virtual_address": "0x00000000",
  1165. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1166. "size": "0x00000000"
  1167. },
  1168. {
  1169. "virtual_address": "0x00000000",
  1170. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1171. "size": "0x00000000"
  1172. },
  1173. {
  1174. "virtual_address": "0x00000000",
  1175. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1176. "size": "0x00000000"
  1177. },
  1178. {
  1179. "virtual_address": "0x00000000",
  1180. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1181. "size": "0x00000000"
  1182. },
  1183. {
  1184. "virtual_address": "0x00002000",
  1185. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1186. "size": "0x00000008"
  1187. },
  1188. {
  1189. "virtual_address": "0x00000000",
  1190. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1191. "size": "0x00000000"
  1192. },
  1193. {
  1194. "virtual_address": "0x00002008",
  1195. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1196. "size": "0x00000048"
  1197. },
  1198. {
  1199. "virtual_address": "0x00000000",
  1200. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1201. "size": "0x00000000"
  1202. }
  1203. ],
  1204. "exports": [],
  1205. "guest_signers": {},
  1206. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  1207. "icon_fuzzy": null,
  1208. "icon": null,
  1209. "pdbpath": null,
  1210. "imported_dll_count": 1,
  1211. "versioninfo": []
  1212. }
  1213. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!