API tools faq
paste
paladin316

12_dll_2019-06-27_20_30.json

paladin316
Jun 27th, 2019
2,155
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 42.77 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Ursu"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "12.dll"
  7. [*] File Size: 10502144
  8. [*] File Type: "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "ae3488f3f9f1e1b8aba5727a1e4b7cc2762c211c5b4b34e3bcf719968d8ca8f4"
  10. [*] MD5: "27dc8452ad015e8ad4ecfcea49d6a424"
  11. [*] SHA1: "1844ebf2051ad629fd04b2bd9d3cedcec8b9795b"
  12. [*] SHA512: "5c3d45dbc839442d53a95023ced17fd016880fb26c135dbcb46e92b7cb5e9191e612ecc7c56e5646f492266933ec4d0d2a6ea8a5fe1dc2ee2ea5c3a99e145792"
  13. [*] CRC32: "A490DDF1"
  14. [*] SSDEEP: "196608:jM+nBNvJICuaVzvUdgg5Za122tksp/LiQG8cCz3vyRaI5O:g+bhIEcdtjPKkqfVIc"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .vmp1, entropy: 7.98, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x009f4c00, virtual_size: 0x009f4b00"
  24. },
  25. {
  26. "section": "name: .rsrc, entropy: 7.47, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0000ea00, virtual_size: 0x0000e8aa"
  27. }
  28. ]
  29. },
  30. {
  31. "Description": "The executable is likely packed with VMProtect",
  32. "Details": [
  33. {
  34. "section": {
  35. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  36. "characteristics_raw": "0x60000060",
  37. "entropy": "0.00",
  38. "name": ".vmp0",
  39. "raw_address": "0x00000000",
  40. "size_of_data": "0x00000000",
  41. "virtual_address": "0x003e0000",
  42. "virtual_size": "0x0178bdf5"
  43. }
  44. }
  45. ]
  46. },
  47. {
  48. "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
  49. "Details": [
  50. {
  51. "Bkav": "HW32.Packed."
  52. },
  53. {
  54. "MicroWorld-eScan": "Gen:Variant.Ursu.311378"
  55. },
  56. {
  57. "FireEye": "Generic.mg.27dc8452ad015e8a"
  58. },
  59. {
  60. "McAfee": "Artemis!27DC8452AD01"
  61. },
  62. {
  63. "Cylance": "Unsafe"
  64. },
  65. {
  66. "CrowdStrike": "win/malicious_confidence_80% (D)"
  67. },
  68. {
  69. "Alibaba": "Packed:Win32/VMProtect.09d919a2"
  70. },
  71. {
  72. "Symantec": "ML.Attribute.HighConfidence"
  73. },
  74. {
  75. "Kaspersky": "not-a-virus:HEUR:RiskTool.Win32.Generic"
  76. },
  77. {
  78. "BitDefender": "Gen:Variant.Ursu.311378"
  79. },
  80. {
  81. "Endgame": "malicious (high confidence)"
  82. },
  83. {
  84. "Emsisoft": "Gen:Variant.Ursu.311378 (B)"
  85. },
  86. {
  87. "Invincea": "heuristic"
  88. },
  89. {
  90. "McAfee-GW-Edition": "BehavesLike.Win32.BadFile.vc"
  91. },
  92. {
  93. "Sophos": "Generic PUA BI (PUA)"
  94. },
  95. {
  96. "SentinelOne": "DFI - Suspicious PE"
  97. },
  98. {
  99. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  100. },
  101. {
  102. "Arcabit": "Trojan.Ursu.D4C052"
  103. },
  104. {
  105. "ZoneAlarm": "not-a-virus:HEUR:RiskTool.Win32.Generic"
  106. },
  107. {
  108. "GData": "Gen:Variant.Ursu.311378"
  109. },
  110. {
  111. "AhnLab-V3": "Malware/Win32.Generic.C3273244"
  112. },
  113. {
  114. "Acronis": "suspicious"
  115. },
  116. {
  117. "ALYac": "Gen:Variant.Ursu.311378"
  118. },
  119. {
  120. "MAX": "malware (ai score=94)"
  121. },
  122. {
  123. "ESET-NOD32": "a variant of Win32/Packed.VMProtect.CW"
  124. },
  125. {
  126. "Rising": "Trojan.Fuerboos!8.EFC8/N3#92% (RDM+:cmRtazpBTyKzKtSEsfQpUuQSxHNw)"
  127. },
  128. {
  129. "Ikarus": "Win32.Outbreak"
  130. },
  131. {
  132. "eGambit": "Unsafe.AI_Score_74%"
  133. },
  134. {
  135. "Ad-Aware": "Gen:Variant.Ursu.311378"
  136. }
  137. ]
  138. }
  139. ]
  140.  
  141. [*] Started Service: []
  142.  
  143. [*] Executed Commands: []
  144.  
  145. [*] Mutexes: []
  146.  
  147. [*] Modified Files: []
  148.  
  149. [*] Deleted Files: []
  150.  
  151. [*] Modified Registry Keys: []
  152.  
  153. [*] Deleted Registry Keys: []
  154.  
  155. [*] DNS Communications: []
  156.  
  157. [*] Domains: []
  158.  
  159. [*] Network Communication - ICMP: []
  160.  
  161. [*] Network Communication - HTTP: []
  162.  
  163. [*] Network Communication - SMTP: []
  164.  
  165. [*] Network Communication - Hosts: []
  166.  
  167. [*] Network Communication - IRC: []
  168.  
  169. [*] Static Analysis: {
  170. "pe": {
  171. "peid_signatures": null,
  172. "imports": [
  173. {
  174. "imports": [
  175. {
  176. "name": "SysFreeString",
  177. "address": "0x22b1000"
  178. }
  179. ],
  180. "dll": "oleaut32.dll"
  181. },
  182. {
  183. "imports": [
  184. {
  185. "name": "RegQueryValueExW",
  186. "address": "0x22b1008"
  187. }
  188. ],
  189. "dll": "advapi32.dll"
  190. },
  191. {
  192. "imports": [
  193. {
  194. "name": "CharNextW",
  195. "address": "0x22b1010"
  196. }
  197. ],
  198. "dll": "user32.dll"
  199. },
  200. {
  201. "imports": [
  202. {
  203. "name": "GetVersion",
  204. "address": "0x22b1018"
  205. }
  206. ],
  207. "dll": "kernel32.dll"
  208. },
  209. {
  210. "imports": [
  211. {
  212. "name": "GetProcAddress",
  213. "address": "0x22b1020"
  214. }
  215. ],
  216. "dll": "kernel32.dll"
  217. },
  218. {
  219. "imports": [
  220. {
  221. "name": "SetClassLongW",
  222. "address": "0x22b1028"
  223. }
  224. ],
  225. "dll": "user32.dll"
  226. },
  227. {
  228. "imports": [
  229. {
  230. "name": "UnrealizeObject",
  231. "address": "0x22b1030"
  232. }
  233. ],
  234. "dll": "gdi32.dll"
  235. },
  236. {
  237. "imports": [
  238. {
  239. "name": "VerQueryValueW",
  240. "address": "0x22b1038"
  241. }
  242. ],
  243. "dll": "version.dll"
  244. },
  245. {
  246. "imports": [
  247. {
  248. "name": "GetVersionExW",
  249. "address": "0x22b1040"
  250. },
  251. {
  252. "name": "GetVersion",
  253. "address": "0x22b1044"
  254. }
  255. ],
  256. "dll": "kernel32.dll"
  257. },
  258. {
  259. "imports": [
  260. {
  261. "name": "RegSetValueExW",
  262. "address": "0x22b104c"
  263. }
  264. ],
  265. "dll": "advapi32.dll"
  266. },
  267. {
  268. "imports": [
  269. {
  270. "name": "Sleep",
  271. "address": "0x22b1054"
  272. }
  273. ],
  274. "dll": "kernel32.dll"
  275. },
  276. {
  277. "imports": [
  278. {
  279. "name": "NetWkstaGetInfo",
  280. "address": "0x22b105c"
  281. }
  282. ],
  283. "dll": "netapi32.dll"
  284. },
  285. {
  286. "imports": [
  287. {
  288. "name": "SafeArrayPtrOfIndex",
  289. "address": "0x22b1064"
  290. }
  291. ],
  292. "dll": "oleaut32.dll"
  293. },
  294. {
  295. "imports": [
  296. {
  297. "name": "GetErrorInfo",
  298. "address": "0x22b106c"
  299. }
  300. ],
  301. "dll": "oleaut32.dll"
  302. },
  303. {
  304. "imports": [
  305. {
  306. "name": "OleUninitialize",
  307. "address": "0x22b1074"
  308. }
  309. ],
  310. "dll": "ole32.dll"
  311. },
  312. {
  313. "imports": [
  314. {
  315. "name": "InitializeFlatSB",
  316. "address": "0x22b107c"
  317. }
  318. ],
  319. "dll": "comctl32.dll"
  320. },
  321. {
  322. "imports": [
  323. {
  324. "name": "EnumDisplayMonitors",
  325. "address": "0x22b1084"
  326. }
  327. ],
  328. "dll": "user32.dll"
  329. },
  330. {
  331. "imports": [
  332. {
  333. "name": "memset",
  334. "address": "0x22b108c"
  335. }
  336. ],
  337. "dll": "msvcrt.dll"
  338. },
  339. {
  340. "imports": [
  341. {
  342. "name": "ShellExecuteW",
  343. "address": "0x22b1094"
  344. }
  345. ],
  346. "dll": "shell32.dll"
  347. },
  348. {
  349. "imports": [
  350. {
  351. "name": "URLDownloadToFileW",
  352. "address": "0x22b109c"
  353. }
  354. ],
  355. "dll": "URLMON.DLL"
  356. },
  357. {
  358. "imports": [
  359. {
  360. "name": "SHGetFolderPathW",
  361. "address": "0x22b10a4"
  362. }
  363. ],
  364. "dll": "shell32.dll"
  365. },
  366. {
  367. "imports": [
  368. {
  369. "name": "MagSetImageScalingCallback",
  370. "address": "0x22b10ac"
  371. }
  372. ],
  373. "dll": "Magnification.dll"
  374. },
  375. {
  376. "imports": [
  377. {
  378. "name": "WSACleanup",
  379. "address": "0x22b10b4"
  380. }
  381. ],
  382. "dll": "wsock32.dll"
  383. },
  384. {
  385. "imports": [
  386. {
  387. "name": "sqlite3_bind_parameter_index",
  388. "address": "0x22b10bc"
  389. }
  390. ],
  391. "dll": "sqlite3.dll"
  392. },
  393. {
  394. "imports": [
  395. {
  396. "name": "CryptUnprotectData",
  397. "address": "0x22b10c4"
  398. }
  399. ],
  400. "dll": "crypt32.dll"
  401. },
  402. {
  403. "imports": [
  404. {
  405. "name": "timeGetTime",
  406. "address": "0x22b10cc"
  407. }
  408. ],
  409. "dll": "winmm.dll"
  410. },
  411. {
  412. "imports": [
  413. {
  414. "name": "MulDiv",
  415. "address": "0x22b10d4"
  416. }
  417. ],
  418. "dll": "kernel32.dll"
  419. },
  420. {
  421. "imports": [
  422. {
  423. "name": "WTSSendMessageW",
  424. "address": "0x22b10dc"
  425. }
  426. ],
  427. "dll": "WTSAPI32.dll"
  428. },
  429. {
  430. "imports": [
  431. {
  432. "name": "VirtualQuery",
  433. "address": "0x22b10e4"
  434. }
  435. ],
  436. "dll": "kernel32.dll"
  437. },
  438. {
  439. "imports": [
  440. {
  441. "name": "GetUserObjectInformationW",
  442. "address": "0x22b10ec"
  443. }
  444. ],
  445. "dll": "user32.dll"
  446. },
  447. {
  448. "imports": [
  449. {
  450. "name": "LocalAlloc",
  451. "address": "0x22b10f4"
  452. },
  453. {
  454. "name": "LocalFree",
  455. "address": "0x22b10f8"
  456. },
  457. {
  458. "name": "GetModuleFileNameW",
  459. "address": "0x22b10fc"
  460. },
  461. {
  462. "name": "GetProcessAffinityMask",
  463. "address": "0x22b1100"
  464. },
  465. {
  466. "name": "SetProcessAffinityMask",
  467. "address": "0x22b1104"
  468. },
  469. {
  470. "name": "SetThreadAffinityMask",
  471. "address": "0x22b1108"
  472. },
  473. {
  474. "name": "Sleep",
  475. "address": "0x22b110c"
  476. },
  477. {
  478. "name": "ExitProcess",
  479. "address": "0x22b1110"
  480. },
  481. {
  482. "name": "FreeLibrary",
  483. "address": "0x22b1114"
  484. },
  485. {
  486. "name": "LoadLibraryA",
  487. "address": "0x22b1118"
  488. },
  489. {
  490. "name": "GetModuleHandleA",
  491. "address": "0x22b111c"
  492. },
  493. {
  494. "name": "GetProcAddress",
  495. "address": "0x22b1120"
  496. }
  497. ],
  498. "dll": "kernel32.dll"
  499. },
  500. {
  501. "imports": [
  502. {
  503. "name": "GetProcessWindowStation",
  504. "address": "0x22b1128"
  505. },
  506. {
  507. "name": "GetUserObjectInformationW",
  508. "address": "0x22b112c"
  509. }
  510. ],
  511. "dll": "user32.dll"
  512. }
  513. ],
  514. "digital_signers": null,
  515. "exported_dll_name": "staticdata.dll",
  516. "actual_checksum": "0x00a082ea",
  517. "overlay": null,
  518. "imagebase": "0x00400000",
  519. "reported_checksum": "0x00000000",
  520. "icon_hash": null,
  521. "entrypoint": "0x02254eb2",
  522. "timestamp": "2019-06-21 11:07:58",
  523. "osversion": "5.0",
  524. "sections": [
  525. {
  526. "name": ".text",
  527. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  528. "virtual_address": "0x00001000",
  529. "size_of_data": "0x00000000",
  530. "entropy": "0.00",
  531. "raw_address": "0x00000000",
  532. "virtual_size": "0x003b6064",
  533. "characteristics_raw": "0x60000020"
  534. },
  535. {
  536. "name": ".itext",
  537. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  538. "virtual_address": "0x003b8000",
  539. "size_of_data": "0x00000000",
  540. "entropy": "0.00",
  541. "raw_address": "0x00000000",
  542. "virtual_size": "0x000043a8",
  543. "characteristics_raw": "0x60000020"
  544. },
  545. {
  546. "name": ".data",
  547. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  548. "virtual_address": "0x003bd000",
  549. "size_of_data": "0x00000000",
  550. "entropy": "0.00",
  551. "raw_address": "0x00000000",
  552. "virtual_size": "0x000128e0",
  553. "characteristics_raw": "0xc0000040"
  554. },
  555. {
  556. "name": ".bss",
  557. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  558. "virtual_address": "0x003d0000",
  559. "size_of_data": "0x00000000",
  560. "entropy": "0.00",
  561. "raw_address": "0x00000000",
  562. "virtual_size": "0x00007df8",
  563. "characteristics_raw": "0xc0000000"
  564. },
  565. {
  566. "name": ".idata",
  567. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  568. "virtual_address": "0x003d8000",
  569. "size_of_data": "0x00000000",
  570. "entropy": "0.00",
  571. "raw_address": "0x00000000",
  572. "virtual_size": "0x0000430c",
  573. "characteristics_raw": "0xc0000040"
  574. },
  575. {
  576. "name": ".didata",
  577. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  578. "virtual_address": "0x003dd000",
  579. "size_of_data": "0x00000000",
  580. "entropy": "0.00",
  581. "raw_address": "0x00000000",
  582. "virtual_size": "0x0000097e",
  583. "characteristics_raw": "0xc0000040"
  584. },
  585. {
  586. "name": ".edata",
  587. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  588. "virtual_address": "0x003de000",
  589. "size_of_data": "0x00000000",
  590. "entropy": "0.00",
  591. "raw_address": "0x00000000",
  592. "virtual_size": "0x000000b4",
  593. "characteristics_raw": "0x40000040"
  594. },
  595. {
  596. "name": ".rdata",
  597. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  598. "virtual_address": "0x003df000",
  599. "size_of_data": "0x00000000",
  600. "entropy": "0.00",
  601. "raw_address": "0x00000000",
  602. "virtual_size": "0x00000045",
  603. "characteristics_raw": "0x40000040"
  604. },
  605. {
  606. "name": ".vmp0",
  607. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  608. "virtual_address": "0x003e0000",
  609. "size_of_data": "0x00000000",
  610. "entropy": "0.00",
  611. "raw_address": "0x00000000",
  612. "virtual_size": "0x0178bdf5",
  613. "characteristics_raw": "0x60000060"
  614. },
  615. {
  616. "name": ".vmp1",
  617. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  618. "virtual_address": "0x01b6c000",
  619. "size_of_data": "0x009f4c00",
  620. "entropy": "7.98",
  621. "raw_address": "0x00000400",
  622. "virtual_size": "0x009f4b00",
  623. "characteristics_raw": "0x60000060"
  624. },
  625. {
  626. "name": ".reloc",
  627. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  628. "virtual_address": "0x02561000",
  629. "size_of_data": "0x00000600",
  630. "entropy": "4.53",
  631. "raw_address": "0x009f5000",
  632. "virtual_size": "0x000005d4",
  633. "characteristics_raw": "0x40000040"
  634. },
  635. {
  636. "name": ".rsrc",
  637. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  638. "virtual_address": "0x02562000",
  639. "size_of_data": "0x0000ea00",
  640. "entropy": "7.47",
  641. "raw_address": "0x009f5600",
  642. "virtual_size": "0x0000e8aa",
  643. "characteristics_raw": "0x40000040"
  644. }
  645. ],
  646. "resources": [],
  647. "dirents": [
  648. {
  649. "virtual_address": "0x01dc67a4",
  650. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  651. "size": "0x000000b4"
  652. },
  653. {
  654. "virtual_address": "0x01b73de4",
  655. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  656. "size": "0x00000294"
  657. },
  658. {
  659. "virtual_address": "0x02562000",
  660. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  661. "size": "0x0000e8aa"
  662. },
  663. {
  664. "virtual_address": "0x00000000",
  665. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  666. "size": "0x00000000"
  667. },
  668. {
  669. "virtual_address": "0x00000000",
  670. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  671. "size": "0x00000000"
  672. },
  673. {
  674. "virtual_address": "0x02561000",
  675. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  676. "size": "0x000005d4"
  677. },
  678. {
  679. "virtual_address": "0x00000000",
  680. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  681. "size": "0x00000000"
  682. },
  683. {
  684. "virtual_address": "0x00000000",
  685. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  686. "size": "0x00000000"
  687. },
  688. {
  689. "virtual_address": "0x00000000",
  690. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  691. "size": "0x00000000"
  692. },
  693. {
  694. "virtual_address": "0x00000000",
  695. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  696. "size": "0x00000000"
  697. },
  698. {
  699. "virtual_address": "0x00000000",
  700. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  701. "size": "0x00000000"
  702. },
  703. {
  704. "virtual_address": "0x00000000",
  705. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  706. "size": "0x00000000"
  707. },
  708. {
  709. "virtual_address": "0x01eb1000",
  710. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  711. "size": "0x00000134"
  712. },
  713. {
  714. "virtual_address": "0x01efd06c",
  715. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  716. "size": "0x000001a0"
  717. },
  718. {
  719. "virtual_address": "0x00000000",
  720. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  721. "size": "0x00000000"
  722. },
  723. {
  724. "virtual_address": "0x00000000",
  725. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  726. "size": "0x00000000"
  727. }
  728. ],
  729. "exports": [
  730. {
  731. "ordinal": 4,
  732. "name": "JLI_CmdToArgs",
  733. "address": "0x7abc38"
  734. },
  735. {
  736. "ordinal": 3,
  737. "name": "TMethodImplementationIntercept",
  738. "address": "0x456c40"
  739. },
  740. {
  741. "ordinal": 2,
  742. "name": "__dbk_fcall_wrapper",
  743. "address": "0x40f02c"
  744. },
  745. {
  746. "ordinal": 1,
  747. "name": "dbkFCallWrapperAddr",
  748. "address": "0x7d35ac"
  749. }
  750. ],
  751. "guest_signers": {},
  752. "imphash": "c0089258e755c13e2ed2a9b9197513dd",
  753. "icon_fuzzy": null,
  754. "icon": null,
  755. "pdbpath": null,
  756. "imported_dll_count": 32,
  757. "versioninfo": []
  758. }
  759. }
  760.  
  761. [*] Resolved APIs: []
  762.  
  763. [*] Static Analysis: {
  764. "pe": {
  765. "peid_signatures": null,
  766. "imports": [
  767. {
  768. "imports": [
  769. {
  770. "name": "SysFreeString",
  771. "address": "0x22b1000"
  772. }
  773. ],
  774. "dll": "oleaut32.dll"
  775. },
  776. {
  777. "imports": [
  778. {
  779. "name": "RegQueryValueExW",
  780. "address": "0x22b1008"
  781. }
  782. ],
  783. "dll": "advapi32.dll"
  784. },
  785. {
  786. "imports": [
  787. {
  788. "name": "CharNextW",
  789. "address": "0x22b1010"
  790. }
  791. ],
  792. "dll": "user32.dll"
  793. },
  794. {
  795. "imports": [
  796. {
  797. "name": "GetVersion",
  798. "address": "0x22b1018"
  799. }
  800. ],
  801. "dll": "kernel32.dll"
  802. },
  803. {
  804. "imports": [
  805. {
  806. "name": "GetProcAddress",
  807. "address": "0x22b1020"
  808. }
  809. ],
  810. "dll": "kernel32.dll"
  811. },
  812. {
  813. "imports": [
  814. {
  815. "name": "SetClassLongW",
  816. "address": "0x22b1028"
  817. }
  818. ],
  819. "dll": "user32.dll"
  820. },
  821. {
  822. "imports": [
  823. {
  824. "name": "UnrealizeObject",
  825. "address": "0x22b1030"
  826. }
  827. ],
  828. "dll": "gdi32.dll"
  829. },
  830. {
  831. "imports": [
  832. {
  833. "name": "VerQueryValueW",
  834. "address": "0x22b1038"
  835. }
  836. ],
  837. "dll": "version.dll"
  838. },
  839. {
  840. "imports": [
  841. {
  842. "name": "GetVersionExW",
  843. "address": "0x22b1040"
  844. },
  845. {
  846. "name": "GetVersion",
  847. "address": "0x22b1044"
  848. }
  849. ],
  850. "dll": "kernel32.dll"
  851. },
  852. {
  853. "imports": [
  854. {
  855. "name": "RegSetValueExW",
  856. "address": "0x22b104c"
  857. }
  858. ],
  859. "dll": "advapi32.dll"
  860. },
  861. {
  862. "imports": [
  863. {
  864. "name": "Sleep",
  865. "address": "0x22b1054"
  866. }
  867. ],
  868. "dll": "kernel32.dll"
  869. },
  870. {
  871. "imports": [
  872. {
  873. "name": "NetWkstaGetInfo",
  874. "address": "0x22b105c"
  875. }
  876. ],
  877. "dll": "netapi32.dll"
  878. },
  879. {
  880. "imports": [
  881. {
  882. "name": "SafeArrayPtrOfIndex",
  883. "address": "0x22b1064"
  884. }
  885. ],
  886. "dll": "oleaut32.dll"
  887. },
  888. {
  889. "imports": [
  890. {
  891. "name": "GetErrorInfo",
  892. "address": "0x22b106c"
  893. }
  894. ],
  895. "dll": "oleaut32.dll"
  896. },
  897. {
  898. "imports": [
  899. {
  900. "name": "OleUninitialize",
  901. "address": "0x22b1074"
  902. }
  903. ],
  904. "dll": "ole32.dll"
  905. },
  906. {
  907. "imports": [
  908. {
  909. "name": "InitializeFlatSB",
  910. "address": "0x22b107c"
  911. }
  912. ],
  913. "dll": "comctl32.dll"
  914. },
  915. {
  916. "imports": [
  917. {
  918. "name": "EnumDisplayMonitors",
  919. "address": "0x22b1084"
  920. }
  921. ],
  922. "dll": "user32.dll"
  923. },
  924. {
  925. "imports": [
  926. {
  927. "name": "memset",
  928. "address": "0x22b108c"
  929. }
  930. ],
  931. "dll": "msvcrt.dll"
  932. },
  933. {
  934. "imports": [
  935. {
  936. "name": "ShellExecuteW",
  937. "address": "0x22b1094"
  938. }
  939. ],
  940. "dll": "shell32.dll"
  941. },
  942. {
  943. "imports": [
  944. {
  945. "name": "URLDownloadToFileW",
  946. "address": "0x22b109c"
  947. }
  948. ],
  949. "dll": "URLMON.DLL"
  950. },
  951. {
  952. "imports": [
  953. {
  954. "name": "SHGetFolderPathW",
  955. "address": "0x22b10a4"
  956. }
  957. ],
  958. "dll": "shell32.dll"
  959. },
  960. {
  961. "imports": [
  962. {
  963. "name": "MagSetImageScalingCallback",
  964. "address": "0x22b10ac"
  965. }
  966. ],
  967. "dll": "Magnification.dll"
  968. },
  969. {
  970. "imports": [
  971. {
  972. "name": "WSACleanup",
  973. "address": "0x22b10b4"
  974. }
  975. ],
  976. "dll": "wsock32.dll"
  977. },
  978. {
  979. "imports": [
  980. {
  981. "name": "sqlite3_bind_parameter_index",
  982. "address": "0x22b10bc"
  983. }
  984. ],
  985. "dll": "sqlite3.dll"
  986. },
  987. {
  988. "imports": [
  989. {
  990. "name": "CryptUnprotectData",
  991. "address": "0x22b10c4"
  992. }
  993. ],
  994. "dll": "crypt32.dll"
  995. },
  996. {
  997. "imports": [
  998. {
  999. "name": "timeGetTime",
  1000. "address": "0x22b10cc"
  1001. }
  1002. ],
  1003. "dll": "winmm.dll"
  1004. },
  1005. {
  1006. "imports": [
  1007. {
  1008. "name": "MulDiv",
  1009. "address": "0x22b10d4"
  1010. }
  1011. ],
  1012. "dll": "kernel32.dll"
  1013. },
  1014. {
  1015. "imports": [
  1016. {
  1017. "name": "WTSSendMessageW",
  1018. "address": "0x22b10dc"
  1019. }
  1020. ],
  1021. "dll": "WTSAPI32.dll"
  1022. },
  1023. {
  1024. "imports": [
  1025. {
  1026. "name": "VirtualQuery",
  1027. "address": "0x22b10e4"
  1028. }
  1029. ],
  1030. "dll": "kernel32.dll"
  1031. },
  1032. {
  1033. "imports": [
  1034. {
  1035. "name": "GetUserObjectInformationW",
  1036. "address": "0x22b10ec"
  1037. }
  1038. ],
  1039. "dll": "user32.dll"
  1040. },
  1041. {
  1042. "imports": [
  1043. {
  1044. "name": "LocalAlloc",
  1045. "address": "0x22b10f4"
  1046. },
  1047. {
  1048. "name": "LocalFree",
  1049. "address": "0x22b10f8"
  1050. },
  1051. {
  1052. "name": "GetModuleFileNameW",
  1053. "address": "0x22b10fc"
  1054. },
  1055. {
  1056. "name": "GetProcessAffinityMask",
  1057. "address": "0x22b1100"
  1058. },
  1059. {
  1060. "name": "SetProcessAffinityMask",
  1061. "address": "0x22b1104"
  1062. },
  1063. {
  1064. "name": "SetThreadAffinityMask",
  1065. "address": "0x22b1108"
  1066. },
  1067. {
  1068. "name": "Sleep",
  1069. "address": "0x22b110c"
  1070. },
  1071. {
  1072. "name": "ExitProcess",
  1073. "address": "0x22b1110"
  1074. },
  1075. {
  1076. "name": "FreeLibrary",
  1077. "address": "0x22b1114"
  1078. },
  1079. {
  1080. "name": "LoadLibraryA",
  1081. "address": "0x22b1118"
  1082. },
  1083. {
  1084. "name": "GetModuleHandleA",
  1085. "address": "0x22b111c"
  1086. },
  1087. {
  1088. "name": "GetProcAddress",
  1089. "address": "0x22b1120"
  1090. }
  1091. ],
  1092. "dll": "kernel32.dll"
  1093. },
  1094. {
  1095. "imports": [
  1096. {
  1097. "name": "GetProcessWindowStation",
  1098. "address": "0x22b1128"
  1099. },
  1100. {
  1101. "name": "GetUserObjectInformationW",
  1102. "address": "0x22b112c"
  1103. }
  1104. ],
  1105. "dll": "user32.dll"
  1106. }
  1107. ],
  1108. "digital_signers": null,
  1109. "exported_dll_name": "staticdata.dll",
  1110. "actual_checksum": "0x00a082ea",
  1111. "overlay": null,
  1112. "imagebase": "0x00400000",
  1113. "reported_checksum": "0x00000000",
  1114. "icon_hash": null,
  1115. "entrypoint": "0x02254eb2",
  1116. "timestamp": "2019-06-21 11:07:58",
  1117. "osversion": "5.0",
  1118. "sections": [
  1119. {
  1120. "name": ".text",
  1121. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1122. "virtual_address": "0x00001000",
  1123. "size_of_data": "0x00000000",
  1124. "entropy": "0.00",
  1125. "raw_address": "0x00000000",
  1126. "virtual_size": "0x003b6064",
  1127. "characteristics_raw": "0x60000020"
  1128. },
  1129. {
  1130. "name": ".itext",
  1131. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1132. "virtual_address": "0x003b8000",
  1133. "size_of_data": "0x00000000",
  1134. "entropy": "0.00",
  1135. "raw_address": "0x00000000",
  1136. "virtual_size": "0x000043a8",
  1137. "characteristics_raw": "0x60000020"
  1138. },
  1139. {
  1140. "name": ".data",
  1141. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1142. "virtual_address": "0x003bd000",
  1143. "size_of_data": "0x00000000",
  1144. "entropy": "0.00",
  1145. "raw_address": "0x00000000",
  1146. "virtual_size": "0x000128e0",
  1147. "characteristics_raw": "0xc0000040"
  1148. },
  1149. {
  1150. "name": ".bss",
  1151. "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1152. "virtual_address": "0x003d0000",
  1153. "size_of_data": "0x00000000",
  1154. "entropy": "0.00",
  1155. "raw_address": "0x00000000",
  1156. "virtual_size": "0x00007df8",
  1157. "characteristics_raw": "0xc0000000"
  1158. },
  1159. {
  1160. "name": ".idata",
  1161. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1162. "virtual_address": "0x003d8000",
  1163. "size_of_data": "0x00000000",
  1164. "entropy": "0.00",
  1165. "raw_address": "0x00000000",
  1166. "virtual_size": "0x0000430c",
  1167. "characteristics_raw": "0xc0000040"
  1168. },
  1169. {
  1170. "name": ".didata",
  1171. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1172. "virtual_address": "0x003dd000",
  1173. "size_of_data": "0x00000000",
  1174. "entropy": "0.00",
  1175. "raw_address": "0x00000000",
  1176. "virtual_size": "0x0000097e",
  1177. "characteristics_raw": "0xc0000040"
  1178. },
  1179. {
  1180. "name": ".edata",
  1181. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1182. "virtual_address": "0x003de000",
  1183. "size_of_data": "0x00000000",
  1184. "entropy": "0.00",
  1185. "raw_address": "0x00000000",
  1186. "virtual_size": "0x000000b4",
  1187. "characteristics_raw": "0x40000040"
  1188. },
  1189. {
  1190. "name": ".rdata",
  1191. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1192. "virtual_address": "0x003df000",
  1193. "size_of_data": "0x00000000",
  1194. "entropy": "0.00",
  1195. "raw_address": "0x00000000",
  1196. "virtual_size": "0x00000045",
  1197. "characteristics_raw": "0x40000040"
  1198. },
  1199. {
  1200. "name": ".vmp0",
  1201. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1202. "virtual_address": "0x003e0000",
  1203. "size_of_data": "0x00000000",
  1204. "entropy": "0.00",
  1205. "raw_address": "0x00000000",
  1206. "virtual_size": "0x0178bdf5",
  1207. "characteristics_raw": "0x60000060"
  1208. },
  1209. {
  1210. "name": ".vmp1",
  1211. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1212. "virtual_address": "0x01b6c000",
  1213. "size_of_data": "0x009f4c00",
  1214. "entropy": "7.98",
  1215. "raw_address": "0x00000400",
  1216. "virtual_size": "0x009f4b00",
  1217. "characteristics_raw": "0x60000060"
  1218. },
  1219. {
  1220. "name": ".reloc",
  1221. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1222. "virtual_address": "0x02561000",
  1223. "size_of_data": "0x00000600",
  1224. "entropy": "4.53",
  1225. "raw_address": "0x009f5000",
  1226. "virtual_size": "0x000005d4",
  1227. "characteristics_raw": "0x40000040"
  1228. },
  1229. {
  1230. "name": ".rsrc",
  1231. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1232. "virtual_address": "0x02562000",
  1233. "size_of_data": "0x0000ea00",
  1234. "entropy": "7.47",
  1235. "raw_address": "0x009f5600",
  1236. "virtual_size": "0x0000e8aa",
  1237. "characteristics_raw": "0x40000040"
  1238. }
  1239. ],
  1240. "resources": [],
  1241. "dirents": [
  1242. {
  1243. "virtual_address": "0x01dc67a4",
  1244. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1245. "size": "0x000000b4"
  1246. },
  1247. {
  1248. "virtual_address": "0x01b73de4",
  1249. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1250. "size": "0x00000294"
  1251. },
  1252. {
  1253. "virtual_address": "0x02562000",
  1254. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1255. "size": "0x0000e8aa"
  1256. },
  1257. {
  1258. "virtual_address": "0x00000000",
  1259. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1260. "size": "0x00000000"
  1261. },
  1262. {
  1263. "virtual_address": "0x00000000",
  1264. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1265. "size": "0x00000000"
  1266. },
  1267. {
  1268. "virtual_address": "0x02561000",
  1269. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1270. "size": "0x000005d4"
  1271. },
  1272. {
  1273. "virtual_address": "0x00000000",
  1274. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1275. "size": "0x00000000"
  1276. },
  1277. {
  1278. "virtual_address": "0x00000000",
  1279. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1280. "size": "0x00000000"
  1281. },
  1282. {
  1283. "virtual_address": "0x00000000",
  1284. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1285. "size": "0x00000000"
  1286. },
  1287. {
  1288. "virtual_address": "0x00000000",
  1289. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1290. "size": "0x00000000"
  1291. },
  1292. {
  1293. "virtual_address": "0x00000000",
  1294. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1295. "size": "0x00000000"
  1296. },
  1297. {
  1298. "virtual_address": "0x00000000",
  1299. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1300. "size": "0x00000000"
  1301. },
  1302. {
  1303. "virtual_address": "0x01eb1000",
  1304. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1305. "size": "0x00000134"
  1306. },
  1307. {
  1308. "virtual_address": "0x01efd06c",
  1309. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1310. "size": "0x000001a0"
  1311. },
  1312. {
  1313. "virtual_address": "0x00000000",
  1314. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1315. "size": "0x00000000"
  1316. },
  1317. {
  1318. "virtual_address": "0x00000000",
  1319. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1320. "size": "0x00000000"
  1321. }
  1322. ],
  1323. "exports": [
  1324. {
  1325. "ordinal": 4,
  1326. "name": "JLI_CmdToArgs",
  1327. "address": "0x7abc38"
  1328. },
  1329. {
  1330. "ordinal": 3,
  1331. "name": "TMethodImplementationIntercept",
  1332. "address": "0x456c40"
  1333. },
  1334. {
  1335. "ordinal": 2,
  1336. "name": "__dbk_fcall_wrapper",
  1337. "address": "0x40f02c"
  1338. },
  1339. {
  1340. "ordinal": 1,
  1341. "name": "dbkFCallWrapperAddr",
  1342. "address": "0x7d35ac"
  1343. }
  1344. ],
  1345. "guest_signers": {},
  1346. "imphash": "c0089258e755c13e2ed2a9b9197513dd",
  1347. "icon_fuzzy": null,
  1348. "icon": null,
  1349. "pdbpath": null,
  1350. "imported_dll_count": 32,
  1351. "versioninfo": []
  1352. }
  1353. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!