API tools faq
paste
paladin316

Exes_48f89e3260e1898b16680584aeb4a05d_exe_2019-06-28_20_30.json

paladin316
Jun 28th, 2019
2,294
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 42.50 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_48f89e3260e1898b16680584aeb4a05d.exe"
  7. [*] File Size: 350720
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "6e5dd7ec7a770214afef19f1db6b05a5a23246df19564733980aab8463798cbd"
  10. [*] MD5: "48f89e3260e1898b16680584aeb4a05d"
  11. [*] SHA1: "a7052710351691a0d9f653576a8f4f898e3e16aa"
  12. [*] SHA512: "b506f3f1acc9050c4eea75e781936b952b33f0312fa2de3f6f690d999f420188bedb03f4c0d70eb53bcc6327b62953ba2143e1fb37774f3a7d4970034f192e8c"
  13. [*] CRC32: "DA78BE00"
  14. [*] SSDEEP: "6144:nFsKI2DhWbzvu6iD23qISEsnbehWUiesjZpoMjZ+ok2AFAcWslzyUsJVmti+9pJ:ufHvLiq3qISEKeJi7Fe5thz2dJVmti+N"
  15.  
  16. [*] Process Execution: [
  17. "Exes_48f89e3260e1898b16680584aeb4a05d.exe",
  18. "cmd.exe",
  19. "PING.EXE",
  20. "services.exe",
  21. "svchost.exe",
  22. "rundll32.exe",
  23. "cmd.exe",
  24. "WMIC.exe",
  25. "svchost.exe",
  26. "WmiPrvSE.exe"
  27. ]
  28.  
  29. [*] Signatures Detected: [
  30. {
  31. "Description": "Attempts to connect to a dead IP:Port (3 unique times)",
  32. "Details": [
  33. {
  34. "IP": "43.251.101.147:5200"
  35. },
  36. {
  37. "IP": "127.0.0.1:1314"
  38. },
  39. {
  40. "IP": "104.193.88.123:80"
  41. }
  42. ]
  43. },
  44. {
  45. "Description": "Creates RWX memory",
  46. "Details": []
  47. },
  48. {
  49. "Description": "A process attempted to delay the analysis task.",
  50. "Details": [
  51. {
  52. "Process": "svchost.exe tried to sleep 265 seconds, actually delayed analysis time by 0 seconds"
  53. },
  54. {
  55. "Process": "WmiPrvSE.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  56. }
  57. ]
  58. },
  59. {
  60. "Description": "Starts servers listening on 127.0.0.1:1314",
  61. "Details": []
  62. },
  63. {
  64. "Description": "Performs some HTTP requests",
  65. "Details": [
  66. {
  67. "url": "http://www.baidu.com/"
  68. },
  69. {
  70. "url": "http://tbip.alicdn.com/api/queryip"
  71. }
  72. ]
  73. },
  74. {
  75. "Description": "The binary likely contains encrypted or compressed data.",
  76. "Details": [
  77. {
  78. "section": "name: UPX1, entropy: 7.84, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00055000, virtual_size: 0x00055000"
  79. }
  80. ]
  81. },
  82. {
  83. "Description": "The executable is compressed using UPX",
  84. "Details": [
  85. {
  86. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00084000"
  87. }
  88. ]
  89. },
  90. {
  91. "Description": "Deletes its original binary from disk",
  92. "Details": []
  93. },
  94. {
  95. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  96. "Details": [
  97. {
  98. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 6256184 times"
  99. }
  100. ]
  101. },
  102. {
  103. "Description": "Network activity contains more than one unique useragent.",
  104. "Details": [
  105. {
  106. "Process": "svchost.exe"
  107. },
  108. {
  109. "User-Agent": "Internal"
  110. },
  111. {
  112. "Process": "svchost.exe"
  113. },
  114. {
  115. "User-Agent": "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
  116. }
  117. ]
  118. },
  119. {
  120. "Description": "Installs itself for autorun at Windows startup",
  121. "Details": [
  122. {
  123. "service name": ".Net CLR"
  124. },
  125. {
  126. "service path": "%SystemRoot%\\System32\\svchost.exe -k netsvcs"
  127. },
  128. {
  129. "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\.Net CLR\\Parameters\\ServiceDll"
  130. },
  131. {
  132. "data": "C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\Remote.hlp"
  133. }
  134. ]
  135. },
  136. {
  137. "Description": "Creates a hidden or system file",
  138. "Details": [
  139. {
  140. "file": "C:\\ProgramData\\Microsoft\\Windows\\GameExplorer"
  141. },
  142. {
  143. "file": "C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\Remote.hlp"
  144. },
  145. {
  146. "file": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\"
  147. },
  148. {
  149. "file": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\"
  150. },
  151. {
  152. "file": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\"
  153. },
  154. {
  155. "file": "C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\TimeConfig.ini"
  156. }
  157. ]
  158. },
  159. {
  160. "Description": "File has been identified by 43 Antiviruses on VirusTotal as malicious",
  161. "Details": [
  162. {
  163. "MicroWorld-eScan": "Generic.Malware.SFPVPkWkg.8A98E9F0"
  164. },
  165. {
  166. "Qihoo-360": "HEUR/QVM11.1.2AA3.Malware.Gen"
  167. },
  168. {
  169. "McAfee": "GenericRXED-EM!8EB666C14E7F"
  170. },
  171. {
  172. "Cylance": "Unsafe"
  173. },
  174. {
  175. "BitDefender": "Generic.Malware.SFPVPkWkg.8A98E9F0"
  176. },
  177. {
  178. "Cybereason": "malicious.260e18"
  179. },
  180. {
  181. "Arcabit": "Generic.Malware.SFPVPkWkg.8A98E9F0"
  182. },
  183. {
  184. "Symantec": "ML.Attribute.HighConfidence"
  185. },
  186. {
  187. "ESET-NOD32": "Win32/Agent.AATE"
  188. },
  189. {
  190. "APEX": "Malicious"
  191. },
  192. {
  193. "Paloalto": "generic.ml"
  194. },
  195. {
  196. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  197. },
  198. {
  199. "Alibaba": "Trojan:Win32/Generic.7d0051a2"
  200. },
  201. {
  202. "Avast": "Other:Malware-gen [Trj]"
  203. },
  204. {
  205. "Tencent": "Win32.Trojan.Generic.Pgng"
  206. },
  207. {
  208. "Ad-Aware": "Generic.Malware.SFPVPkWkg.8A98E9F0"
  209. },
  210. {
  211. "Sophos": "Mal/Behav-156"
  212. },
  213. {
  214. "F-Secure": "Trojan.TR/Crypt.XPACK.Gen"
  215. },
  216. {
  217. "DrWeb": "Trojan.DownLoader28.11195"
  218. },
  219. {
  220. "Invincea": "heuristic"
  221. },
  222. {
  223. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  224. },
  225. {
  226. "FireEye": "Generic.mg.48f89e3260e1898b"
  227. },
  228. {
  229. "Emsisoft": "Generic.Malware.SFPVPkWkg.8A98E9F0 (B)"
  230. },
  231. {
  232. "Jiangmin": "Trojan.Blamon.pn"
  233. },
  234. {
  235. "Avira": "TR/Crypt.XPACK.Gen"
  236. },
  237. {
  238. "Fortinet": "W32/Injector.BBYK!tr"
  239. },
  240. {
  241. "Antiy-AVL": "Trojan/Win32.Fuerboos"
  242. },
  243. {
  244. "Endgame": "malicious (moderate confidence)"
  245. },
  246. {
  247. "Microsoft": "Trojan:Win32/Dynamer!rfn"
  248. },
  249. {
  250. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  251. },
  252. {
  253. "AhnLab-V3": "Malware/Win32.Generic.C3260799"
  254. },
  255. {
  256. "Acronis": "suspicious"
  257. },
  258. {
  259. "VBA32": "BScope.Trojan.KillFiles"
  260. },
  261. {
  262. "ALYac": "Generic.Malware.SFPVPkWkg.8A98E9F0"
  263. },
  264. {
  265. "MAX": "malware (ai score=80)"
  266. },
  267. {
  268. "Rising": "Trojan.Injector!1.A1C3 (RDM+:cmRtazqb+YeQJRKI0dXfaPgcXy4N)"
  269. },
  270. {
  271. "Yandex": "Trojan.Blamon!"
  272. },
  273. {
  274. "SentinelOne": "DFI - Malicious PE"
  275. },
  276. {
  277. "eGambit": "Trojan.Generic"
  278. },
  279. {
  280. "GData": "Win32.Trojan.Agent.WP"
  281. },
  282. {
  283. "AVG": "Other:Malware-gen [Trj]"
  284. },
  285. {
  286. "CrowdStrike": "win/malicious_confidence_100% (D)"
  287. },
  288. {
  289. "MaxSecure": "Trojan.Malware.74306860.susgen"
  290. }
  291. ]
  292. },
  293. {
  294. "Description": "Attempts to modify proxy settings",
  295. "Details": []
  296. }
  297. ]
  298.  
  299. [*] Started Service: [
  300. ".Net CLR"
  301. ]
  302.  
  303. [*] Executed Commands: [
  304. "C:\\Windows\\System32\\\\Delete00.bat",
  305. "C:\\Windows\\SysWOW64\\svchost.exe -k netsvcs",
  306. "C:\\Windows\\system32\\svchost.exe -k netsvcs",
  307. "rundll32 C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\Remote.hlp,init default QzpcUHJvZ3JhbURhdGFcTWljcm9zb2Z0XFdpbmRvd3NcR2FtZUV4cGxvcmVyXFJlbW90ZS5obHB8Lk5ldCBDTFI=",
  308. "cmd.exe /c Wmic Path Win32_VideoController Get Description",
  309. "C:\\Windows\\system32\\PING.EXE ping 127.0.0.1",
  310. "C:\\Windows\\System32\\Wbem\\WMIC.exe Wmic Path Win32_VideoController Get Description",
  311. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
  312. ]
  313.  
  314. [*] Mutexes: [
  315. "XXNBbin1",
  316. "Local\\_!MSFTHISTORY!_",
  317. "Local\\c:!windows!system32!config!systemprofile!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  318. "Local\\c:!windows!system32!config!systemprofile!appdata!roaming!microsoft!windows!cookies!",
  319. "Local\\c:!windows!system32!config!systemprofile!appdata!local!microsoft!windows!history!history.ie5!",
  320. "Local\\WininetStartupMutex",
  321. "Local\\WininetProxyRegistryMutex",
  322. "IESQMMUTEX_0_208"
  323. ]
  324.  
  325. [*] Modified Files: [
  326. "C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\Remote.hlp",
  327. "C:\\Windows\\System32\\Delete00.bat",
  328. "C:\\Windows\\sysnative\\LogFiles\\Scm\\844e0dfc-7472-4ca9-96dc-9859ed19b312",
  329. "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
  330. "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  331. "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  332. "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  333. "C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\TimeConfig.ini",
  334. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
  335. ]
  336.  
  337. [*] Deleted Files: [
  338. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_48f89e3260e1898b16680584aeb4a05d.exe",
  339. "C:\\Windows\\System32\\Delete00.bat"
  340. ]
  341.  
  342. [*] Modified Registry Keys: [
  343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DontshowUI",
  344. "HKEY_LOCAL_MACHINE\\software\\microsoft\\remote\\Desktop",
  345. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\remote\\Desktop\\(Default)",
  346. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\\netsvcs",
  347. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\.Net CLR\\Description",
  348. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\.Net CLR\\DisplayName",
  349. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\.Net CLR\\Parameters",
  350. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\.Net CLR\\Parameters\\ServiceDll",
  351. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
  352. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\DontshowUI",
  353. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
  354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Script\\Settings",
  355. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\JITDebug",
  356. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\svchost_RASAPI32",
  357. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\svchost_RASAPI32\\EnableFileTracing",
  358. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\svchost_RASAPI32\\EnableConsoleTracing",
  359. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\svchost_RASAPI32\\FileTracingMask",
  360. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\svchost_RASAPI32\\ConsoleTracingMask",
  361. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\svchost_RASAPI32\\MaxFileSize",
  362. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\svchost_RASAPI32\\FileDirectory",
  363. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
  364. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
  365. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings"
  366. ]
  367.  
  368. [*] Deleted Registry Keys: [
  369. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
  370. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
  371. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"
  372. ]
  373.  
  374. [*] DNS Communications: [
  375. {
  376. "type": "A",
  377. "request": "www.baidu.com",
  378. "answers": [
  379. {
  380. "data": "www.a.shifen.com",
  381. "type": "CNAME"
  382. },
  383. {
  384. "data": "104.193.88.77",
  385. "type": "A"
  386. },
  387. {
  388. "data": "104.193.88.123",
  389. "type": "A"
  390. },
  391. {
  392. "data": "www.wshifen.com",
  393. "type": "CNAME"
  394. }
  395. ]
  396. },
  397. {
  398. "type": "A",
  399. "request": "tbip.alicdn.com",
  400. "answers": [
  401. {
  402. "data": "66.231.239.111",
  403. "type": "A"
  404. },
  405. {
  406. "data": "tbip.alicdn.com.danuoyi.tbcache.com",
  407. "type": "CNAME"
  408. },
  409. {
  410. "data": "66.231.239.121",
  411. "type": "A"
  412. }
  413. ]
  414. }
  415. ]
  416.  
  417. [*] Domains: [
  418. {
  419. "ip": "66.231.239.111",
  420. "domain": "tbip.alicdn.com"
  421. },
  422. {
  423. "ip": "104.193.88.77",
  424. "domain": "www.baidu.com"
  425. }
  426. ]
  427.  
  428. [*] Network Communication - ICMP: []
  429.  
  430. [*] Network Communication - HTTP: [
  431. {
  432. "count": 1,
  433. "body": "",
  434. "uri": "http://www.baidu.com/",
  435. "user-agent": "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)",
  436. "method": "GET",
  437. "host": "www.baidu.com",
  438. "version": "1.1",
  439. "path": "/",
  440. "data": "GET / HTTP/1.1\r\nAccept: */*\r\nReferer: http://www.baidu.com/\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\r\nHost: www.baidu.com\r\nCache-Control: no-cache\r\n\r\n",
  441. "port": 80
  442. },
  443. {
  444. "count": 1,
  445. "body": "",
  446. "uri": "http://tbip.alicdn.com/api/queryip",
  447. "user-agent": "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)",
  448. "method": "GET",
  449. "host": "tbip.alicdn.com",
  450. "version": "1.1",
  451. "path": "/api/queryip",
  452. "data": "GET /api/queryip HTTP/1.1\r\nAccept: */*\r\nReferer: http://tbip.alicdn.com/api/queryip\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)\r\nHost: tbip.alicdn.com\r\nCache-Control: no-cache\r\n\r\n",
  453. "port": 80
  454. }
  455. ]
  456.  
  457. [*] Network Communication - SMTP: []
  458.  
  459. [*] Network Communication - Hosts: []
  460.  
  461. [*] Network Communication - IRC: []
  462.  
  463. [*] Static Analysis: {
  464. "pe": {
  465. "peid_signatures": [
  466. [
  467. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  468. ]
  469. ],
  470. "imports": [
  471. {
  472. "imports": [
  473. {
  474. "name": "LoadLibraryA",
  475. "address": "0x4da3b8"
  476. },
  477. {
  478. "name": "GetProcAddress",
  479. "address": "0x4da3bc"
  480. },
  481. {
  482. "name": "VirtualProtect",
  483. "address": "0x4da3c0"
  484. },
  485. {
  486. "name": "VirtualAlloc",
  487. "address": "0x4da3c4"
  488. },
  489. {
  490. "name": "VirtualFree",
  491. "address": "0x4da3c8"
  492. },
  493. {
  494. "name": "ExitProcess",
  495. "address": "0x4da3cc"
  496. }
  497. ],
  498. "dll": "KERNEL32.DLL"
  499. },
  500. {
  501. "imports": [
  502. {
  503. "name": "RegOpenKeyA",
  504. "address": "0x4da3d4"
  505. }
  506. ],
  507. "dll": "ADVAPI32.dll"
  508. },
  509. {
  510. "imports": [
  511. {
  512. "name": "free",
  513. "address": "0x4da3dc"
  514. }
  515. ],
  516. "dll": "MSVCRT.dll"
  517. },
  518. {
  519. "imports": [
  520. {
  521. "name": "SHGetSpecialFolderPathA",
  522. "address": "0x4da3e4"
  523. }
  524. ],
  525. "dll": "SHELL32.dll"
  526. },
  527. {
  528. "imports": [
  529. {
  530. "name": "PathFileExistsA",
  531. "address": "0x4da3ec"
  532. }
  533. ],
  534. "dll": "SHLWAPI.dll"
  535. },
  536. {
  537. "imports": [
  538. {
  539. "name": "wsprintfA",
  540. "address": "0x4da3f4"
  541. }
  542. ],
  543. "dll": "USER32.dll"
  544. },
  545. {
  546. "imports": [
  547. {
  548. "name": "WSACleanup",
  549. "address": "0x4da3fc"
  550. }
  551. ],
  552. "dll": "WS2_32.dll"
  553. }
  554. ],
  555. "digital_signers": null,
  556. "exported_dll_name": null,
  557. "actual_checksum": "0x0005d14a",
  558. "overlay": null,
  559. "imagebase": "0x00400000",
  560. "reported_checksum": "0x00000000",
  561. "icon_hash": null,
  562. "entrypoint": "0x004d9e20",
  563. "timestamp": "2019-05-07 12:42:03",
  564. "osversion": "4.0",
  565. "sections": [
  566. {
  567. "name": "UPX0",
  568. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  569. "virtual_address": "0x00001000",
  570. "size_of_data": "0x00000000",
  571. "entropy": "0.00",
  572. "raw_address": "0x00000400",
  573. "virtual_size": "0x00084000",
  574. "characteristics_raw": "0xe0000080"
  575. },
  576. {
  577. "name": "UPX1",
  578. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  579. "virtual_address": "0x00085000",
  580. "size_of_data": "0x00055000",
  581. "entropy": "7.84",
  582. "raw_address": "0x00000400",
  583. "virtual_size": "0x00055000",
  584. "characteristics_raw": "0xe0000040"
  585. },
  586. {
  587. "name": ".rsrc",
  588. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  589. "virtual_address": "0x000da000",
  590. "size_of_data": "0x00000600",
  591. "entropy": "4.68",
  592. "raw_address": "0x00055400",
  593. "virtual_size": "0x00001000",
  594. "characteristics_raw": "0xc0000040"
  595. }
  596. ],
  597. "resources": [],
  598. "dirents": [
  599. {
  600. "virtual_address": "0x00000000",
  601. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  602. "size": "0x00000000"
  603. },
  604. {
  605. "virtual_address": "0x000da318",
  606. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  607. "size": "0x000001e4"
  608. },
  609. {
  610. "virtual_address": "0x000da000",
  611. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  612. "size": "0x00000318"
  613. },
  614. {
  615. "virtual_address": "0x00000000",
  616. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  617. "size": "0x00000000"
  618. },
  619. {
  620. "virtual_address": "0x00000000",
  621. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  622. "size": "0x00000000"
  623. },
  624. {
  625. "virtual_address": "0x000da4fc",
  626. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  627. "size": "0x0000000c"
  628. },
  629. {
  630. "virtual_address": "0x00000000",
  631. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  632. "size": "0x00000000"
  633. },
  634. {
  635. "virtual_address": "0x00000000",
  636. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  637. "size": "0x00000000"
  638. },
  639. {
  640. "virtual_address": "0x00000000",
  641. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  642. "size": "0x00000000"
  643. },
  644. {
  645. "virtual_address": "0x00000000",
  646. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  647. "size": "0x00000000"
  648. },
  649. {
  650. "virtual_address": "0x00000000",
  651. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  652. "size": "0x00000000"
  653. },
  654. {
  655. "virtual_address": "0x00000000",
  656. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  657. "size": "0x00000000"
  658. },
  659. {
  660. "virtual_address": "0x00000000",
  661. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  662. "size": "0x00000000"
  663. },
  664. {
  665. "virtual_address": "0x00000000",
  666. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  667. "size": "0x00000000"
  668. },
  669. {
  670. "virtual_address": "0x00000000",
  671. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  672. "size": "0x00000000"
  673. },
  674. {
  675. "virtual_address": "0x00000000",
  676. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  677. "size": "0x00000000"
  678. }
  679. ],
  680. "exports": [],
  681. "guest_signers": {},
  682. "imphash": "3711d94b37d80b5764c686cbebb364ba",
  683. "icon_fuzzy": null,
  684. "icon": null,
  685. "pdbpath": null,
  686. "imported_dll_count": 7,
  687. "versioninfo": []
  688. }
  689. }
  690.  
  691. [*] Resolved APIs: [
  692. "kernel32.dll.SetFileAttributesA",
  693. "kernel32.dll.SetFilePointer",
  694. "kernel32.dll.ReadFile",
  695. "kernel32.dll.GetFileSize",
  696. "kernel32.dll.GetModuleFileNameA",
  697. "kernel32.dll.WaitForSingleObject",
  698. "kernel32.dll.CreateProcessA",
  699. "kernel32.dll.GetStartupInfoA",
  700. "kernel32.dll.GetCommandLineA",
  701. "kernel32.dll.FreeLibrary",
  702. "kernel32.dll.GetProcAddress",
  703. "kernel32.dll.LoadLibraryA",
  704. "kernel32.dll.LCMapStringA",
  705. "kernel32.dll.CreateFileA",
  706. "kernel32.dll.WriteFile",
  707. "kernel32.dll.CloseHandle",
  708. "kernel32.dll.CreateDirectoryA",
  709. "kernel32.dll.IsBadReadPtr",
  710. "kernel32.dll.HeapFree",
  711. "kernel32.dll.HeapReAlloc",
  712. "kernel32.dll.HeapAlloc",
  713. "kernel32.dll.ExitProcess",
  714. "kernel32.dll.GetModuleHandleA",
  715. "kernel32.dll.GetProcessHeap",
  716. "kernel32.dll.RtlMoveMemory",
  717. "kernel32.dll.lstrcpynA",
  718. "kernel32.dll.WinExec",
  719. "kernel32.dll.GetWindowsDirectoryA",
  720. "kernel32.dll.GetSystemDirectoryA",
  721. "kernel32.dll.GetTempPathA",
  722. "advapi32.dll.StartServiceA",
  723. "advapi32.dll.RegCreateKeyExA",
  724. "advapi32.dll.RegOpenKeyA",
  725. "advapi32.dll.RegCreateKeyA",
  726. "advapi32.dll.CreateServiceA",
  727. "advapi32.dll.RegSetValueExA",
  728. "advapi32.dll.RegCloseKey",
  729. "advapi32.dll.RegQueryValueExA",
  730. "advapi32.dll.RegOpenKeyExA",
  731. "advapi32.dll.CloseServiceHandle",
  732. "advapi32.dll.QueryServiceStatus",
  733. "advapi32.dll.OpenServiceA",
  734. "advapi32.dll.OpenSCManagerA",
  735. "msvcrt.dll.free",
  736. "msvcrt.dll.malloc",
  737. "msvcrt.dll.??3@YAXPAX@Z",
  738. "msvcrt.dll.strrchr",
  739. "msvcrt.dll.??2@YAPAXI@Z",
  740. "msvcrt.dll._ftol",
  741. "msvcrt.dll.atoi",
  742. "msvcrt.dll._CIfmod",
  743. "msvcrt.dll.sprintf",
  744. "msvcrt.dll.strchr",
  745. "msvcrt.dll.realloc",
  746. "msvcrt.dll.modf",
  747. "msvcrt.dll.memmove",
  748. "msvcrt.dll.strncmp",
  749. "msvcrt.dll.__CxxFrameHandler",
  750. "shell32.dll.SHGetSpecialFolderPathA",
  751. "shlwapi.dll.PathFileExistsA",
  752. "user32.dll.PeekMessageA",
  753. "user32.dll.GetMessageA",
  754. "user32.dll.TranslateMessage",
  755. "user32.dll.DispatchMessageA",
  756. "user32.dll.wsprintfA",
  757. "user32.dll.MessageBoxA",
  758. "ws2_32.dll.#115",
  759. "ws2_32.dll.#57",
  760. "ws2_32.dll.#116",
  761. "kernel32.dll.OpenMutexA",
  762. "kernel32.dll.CreateMutexA",
  763. "dnsapi.dll.DnsApiFree",
  764. "ole32.dll.CoInitializeEx",
  765. "cryptbase.dll.SystemFunction036",
  766. "ole32.dll.CoInitializeSecurity",
  767. "sechost.dll.LookupAccountNameLocalW",
  768. "advapi32.dll.LookupAccountSidW",
  769. "sechost.dll.LookupAccountSidLocalW",
  770. "ole32.dll.CoCreateInstance",
  771. "kernel32.dll.SortGetHandle",
  772. "kernel32.dll.SortCloseHandle",
  773. "kernel32.dll.VirtualProtect",
  774. "kernel32.dll.VirtualAlloc",
  775. "kernel32.dll.VirtualFree",
  776. "ws2_32.dll.#21",
  777. "kernel32.dll.EnterCriticalSection",
  778. "kernel32.dll.LeaveCriticalSection",
  779. "kernel32.dll.GetQueuedCompletionStatus",
  780. "kernel32.dll.PostQueuedCompletionStatus",
  781. "kernel32.dll.GetSystemInfo",
  782. "kernel32.dll.LocalFree",
  783. "kernel32.dll.CreateIoCompletionPort",
  784. "kernel32.dll.InitializeCriticalSection",
  785. "kernel32.dll.LocalAlloc",
  786. "kernel32.dll.CreateEventW",
  787. "kernel32.dll.GetLastError",
  788. "kernel32.dll.SetEvent",
  789. "kernel32.dll.lstrcpyA",
  790. "kernel32.dll.lstrlenA",
  791. "kernel32.dll.lstrcatA",
  792. "msvcrt.dll.memcpy",
  793. "msvcrt.dll._adjust_fdiv",
  794. "msvcrt.dll._initterm",
  795. "msvcrt.dll._beginthreadex",
  796. "msvcrt.dll.memset",
  797. "ws2_32.dll.#9",
  798. "ws2_32.dll.#2",
  799. "ws2_32.dll.#13",
  800. "ws2_32.dll.WSAIoctl",
  801. "ws2_32.dll.WSARecv",
  802. "ws2_32.dll.#111",
  803. "ws2_32.dll.WSASend",
  804. "ws2_32.dll.#19",
  805. "ws2_32.dll.#10",
  806. "ws2_32.dll.#4",
  807. "ws2_32.dll.#18",
  808. "ws2_32.dll.#11",
  809. "ws2_32.dll.#3",
  810. "ws2_32.dll.#22",
  811. "ws2_32.dll.#52",
  812. "ws2_32.dll.#5",
  813. "ws2_32.dll.#6",
  814. "ws2_32.dll.#15",
  815. "ws2_32.dll.#12",
  816. "ws2_32.dll.#16",
  817. "ws2_32.dll.WSASocketW",
  818. "gdiplus.dll.GdiplusStartup",
  819. "kernel32.dll.IsProcessorFeaturePresent",
  820. "user32.dll.GetWindowInfo",
  821. "user32.dll.GetAncestor",
  822. "user32.dll.GetMonitorInfoA",
  823. "user32.dll.EnumDisplayMonitors",
  824. "user32.dll.EnumDisplayDevicesA",
  825. "gdi32.dll.ExtTextOutW",
  826. "gdi32.dll.GdiIsMetaPrintDC",
  827. "remote.hlp.ServiceMain",
  828. "winsta.dll.WinStationQueryInformationW",
  829. "advapi32.dll.CreateWellKnownSid",
  830. "rpcrt4.dll.RpcStringBindingComposeW",
  831. "rpcrt4.dll.RpcBindingFromStringBindingW",
  832. "rpcrt4.dll.RpcStringFreeW",
  833. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  834. "rpcrt4.dll.NdrClientCall2",
  835. "rpcrt4.dll.RpcBindingFree",
  836. "sechost.dll.ConvertSidToStringSidW",
  837. "sspicli.dll.GetUserNameExW",
  838. "avicap32.dll.capGetDriverDescriptionA",
  839. "ntdll.dll.ZwQuerySystemInformation",
  840. "oleaut32.dll.#500",
  841. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  842. "advapi32.dll.RegOpenKeyW",
  843. "advapi32.dll.RegQueryValueW",
  844. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  845. "ole32.dll.CoGetObjectContext",
  846. "advapi32.dll.EventActivityIdControl",
  847. "advapi32.dll.EventWriteTransfer",
  848. "kernel32.dll.InitializeSRWLock",
  849. "kernel32.dll.AcquireSRWLockExclusive",
  850. "kernel32.dll.AcquireSRWLockShared",
  851. "kernel32.dll.ReleaseSRWLockExclusive",
  852. "kernel32.dll.ReleaseSRWLockShared",
  853. "kernel32.dll.SetFileInformationByHandle",
  854. "shell32.dll.SHGetFolderPathW",
  855. "kernel32.dll.GetModuleHandleW",
  856. "advapi32.dll.AddMandatoryAce",
  857. "ntmarta.dll.GetMartaExtensionInterface",
  858. "ws2_32.dll.accept",
  859. "ws2_32.dll.bind",
  860. "ws2_32.dll.closesocket",
  861. "ws2_32.dll.connect",
  862. "ws2_32.dll.getpeername",
  863. "ws2_32.dll.getsockname",
  864. "ws2_32.dll.getsockopt",
  865. "ws2_32.dll.ntohl",
  866. "ws2_32.dll.htonl",
  867. "ws2_32.dll.htons",
  868. "ws2_32.dll.inet_addr",
  869. "ws2_32.dll.inet_ntoa",
  870. "ws2_32.dll.ioctlsocket",
  871. "ws2_32.dll.listen",
  872. "ws2_32.dll.ntohs",
  873. "ws2_32.dll.recv",
  874. "ws2_32.dll.recvfrom",
  875. "ws2_32.dll.select",
  876. "ws2_32.dll.send",
  877. "ws2_32.dll.sendto",
  878. "ws2_32.dll.setsockopt",
  879. "ws2_32.dll.shutdown",
  880. "ws2_32.dll.socket",
  881. "ws2_32.dll.gethostbyname",
  882. "ws2_32.dll.gethostname",
  883. "ws2_32.dll.WSAGetLastError",
  884. "ws2_32.dll.WSASetLastError",
  885. "ws2_32.dll.WSAStartup",
  886. "ws2_32.dll.WSACleanup",
  887. "ws2_32.dll.__WSAFDIsSet",
  888. "ws2_32.dll.getaddrinfo",
  889. "ws2_32.dll.freeaddrinfo",
  890. "ws2_32.dll.getnameinfo",
  891. "ws2_32.dll.WSALookupServiceBeginW",
  892. "ws2_32.dll.WSALookupServiceNextW",
  893. "ws2_32.dll.WSALookupServiceEnd",
  894. "ws2_32.dll.WSANSPIoctl",
  895. "ws2_32.dll.WSAStringToAddressA",
  896. "ws2_32.dll.WSAStringToAddressW",
  897. "ws2_32.dll.WSAAddressToStringA",
  898. "dnsapi.dll.DnsGetProxyInformation",
  899. "dnsapi.dll.DnsFreeProxyName",
  900. "iphlpapi.dll.GetIpForwardTable2",
  901. "iphlpapi.dll.FreeMibTable",
  902. "iphlpapi.dll.GetIfEntry2",
  903. "iphlpapi.dll.ConvertInterfaceGuidToLuid",
  904. "iphlpapi.dll.ResolveIpNetEntry2",
  905. "iphlpapi.dll.GetIpNetEntry2",
  906. "shlwapi.dll.#260",
  907. "rasapi32.dll.RasEnumEntriesW",
  908. "rasapi32.dll.RasConnectionNotificationW",
  909. "rtutils.dll.TraceRegisterExA",
  910. "rtutils.dll.TracePrintfExA",
  911. "profapi.dll.#104",
  912. "shlwapi.dll.PathCanonicalizeW",
  913. "shlwapi.dll.PathRemoveFileSpecW",
  914. "shlwapi.dll.PathFindFileNameW",
  915. "sensapi.dll.IsNetworkAlive",
  916. "advapi32.dll.RegDeleteTreeA",
  917. "advapi32.dll.RegDeleteTreeW",
  918. "ole32.dll.CoTaskMemAlloc",
  919. "oleaut32.dll.#8",
  920. "oleaut32.dll.#9",
  921. "oleaut32.dll.DllGetClassObject",
  922. "oleaut32.dll.DllCanUnloadNow",
  923. "ole32.dll.CoTaskMemFree",
  924. "ole32.dll.StringFromIID",
  925. "iphlpapi.dll.GetAdaptersAddresses",
  926. "dhcpcsvc.dll.DhcpRequestParams",
  927. "user32.dll.GetInputState",
  928. "oleaut32.dll.#2",
  929. "oleaut32.dll.#6",
  930. "ole32.dll.CoUninitialize",
  931. "kernel32.dll.GetLogicalDriveStringsA",
  932. "kernel32.dll.SetThreadUILanguage",
  933. "kernel32.dll.CopyFileExW",
  934. "kernel32.dll.IsDebuggerPresent",
  935. "kernel32.dll.SetConsoleInputExeNameW",
  936. "advapi32.dll.SaferIdentifyLevel",
  937. "advapi32.dll.SaferComputeTokenFromLevel",
  938. "advapi32.dll.SaferCloseLevel",
  939. "uxtheme.dll.ThemeInitApiHook",
  940. "user32.dll.IsProcessDPIAware",
  941. "remote.hlp.init",
  942. "dwmapi.dll.DwmIsCompositionEnabled",
  943. "user32.dll.FindWindowExA",
  944. "user32.dll.GetUserObjectInformationA",
  945. "user32.dll.CloseDesktop",
  946. "kernel32.dll.GlobalAlloc",
  947. "mswsock.dll.WSPStartup",
  948. "wshtcpip.dll.WSHOpenSocket",
  949. "wshtcpip.dll.WSHOpenSocket2",
  950. "wshtcpip.dll.WSHJoinLeaf",
  951. "wshtcpip.dll.WSHNotify",
  952. "wshtcpip.dll.WSHGetSocketInformation",
  953. "wshtcpip.dll.WSHSetSocketInformation",
  954. "wshtcpip.dll.WSHGetSockaddrType",
  955. "wshtcpip.dll.WSHGetWildcardSockaddr",
  956. "wshtcpip.dll.WSHGetBroadcastSockaddr",
  957. "wshtcpip.dll.WSHAddressToString",
  958. "wshtcpip.dll.WSHStringToAddress",
  959. "wshtcpip.dll.WSHIoctl",
  960. "urlmon.dll.DllCanUnloadNow",
  961. "urlmon.dll.IEDllLoader",
  962. "urlmon.dll.CoInternetCreateZoneManager",
  963. "urlmon.dll.CoInternetGetSession",
  964. "urlmon.dll.CopyBindInfo",
  965. "urlmon.dll.CreateURLMoniker",
  966. "urlmon.dll.RegisterBindStatusCallback",
  967. "urlmon.dll.ReleaseBindInfo",
  968. "urlmon.dll.RevokeBindStatusCallback",
  969. "urlmon.dll.UrlMkGetSessionOption",
  970. "urlmon.dll.CoInternetCreateSecurityManager",
  971. "urlmon.dll.CreateUri",
  972. "urlmon.dll.CoInternetCombineUrl",
  973. "urlmon.dll.CoInternetGetSecurityUrl",
  974. "urlmon.dll.IsValidURL",
  975. "wininet.dll.InternetCrackUrlW",
  976. "wininet.dll.InternetCreateUrlW",
  977. "ole32.dll.CoGetClassObject",
  978. "ole32.dll.CoGetMarshalSizeMax",
  979. "ole32.dll.CoMarshalInterface",
  980. "ole32.dll.CoUnmarshalInterface",
  981. "ole32.dll.CoGetPSClsid",
  982. "ole32.dll.CoReleaseMarshalData",
  983. "ole32.dll.DcomChannelSetHResult",
  984. "kernel32.dll.FlsAlloc",
  985. "kernel32.dll.FlsGetValue",
  986. "kernel32.dll.FlsSetValue",
  987. "kernel32.dll.FlsFree",
  988. "msoxmlmf.dll.DllGetClassObject",
  989. "msoxmlmf.dll.DllCanUnloadNow",
  990. "kernel32.dll.GetThreadPreferredUILanguages",
  991. "kernel32.dll.SetThreadPreferredUILanguages",
  992. "kernel32.dll.LocaleNameToLCID",
  993. "kernel32.dll.GetLocaleInfoEx",
  994. "kernel32.dll.LCIDToLocaleName",
  995. "kernel32.dll.GetSystemDefaultLocaleName",
  996. "oleaut32.dll.#283",
  997. "oleaut32.dll.#284",
  998. "kernel32.dll.RegOpenKeyExW",
  999. "wmi2xml.dll.OpenWbemTextSource",
  1000. "wmi2xml.dll.CloseWbemTextSource",
  1001. "wmi2xml.dll.WbemObjectToText",
  1002. "wmi2xml.dll.TextToWbemObject",
  1003. "kernel32.dll.RegCloseKey",
  1004. "ntdll.dll.EtwUnregisterTraceGuids",
  1005. "cryptsp.dll.CryptReleaseContext",
  1006. "fastprox.dll.DllGetClassObject",
  1007. "fastprox.dll.DllCanUnloadNow",
  1008. "kernel32.dll.RegQueryValueExW",
  1009. "oleaut32.dll.#289",
  1010. "oleaut32.dll.#287",
  1011. "oleaut32.dll.#288",
  1012. "oleaut32.dll.#290",
  1013. "oleaut32.dll.#285",
  1014. "devobj.dll.DevObjCreateDeviceInfoList",
  1015. "devobj.dll.DevObjGetClassDevs",
  1016. "devobj.dll.DevObjEnumDeviceInfo",
  1017. "devobj.dll.DevObjDestroyDeviceInfoList",
  1018. "setupapi.dll.CM_Open_DevNode_Key_Ex",
  1019. "devobj.dll.DevObjGetDeviceProperty",
  1020. "cfgmgr32.dll.CM_Connect_MachineA",
  1021. "cfgmgr32.dll.CM_Disconnect_Machine",
  1022. "cfgmgr32.dll.CM_Locate_DevNodeW",
  1023. "cfgmgr32.dll.CM_Get_DevNode_Registry_PropertyW",
  1024. "cfgmgr32.dll.CM_Get_Child",
  1025. "cfgmgr32.dll.CM_Get_Sibling",
  1026. "cfgmgr32.dll.CM_Get_DevNode_Status",
  1027. "cfgmgr32.dll.CM_Get_First_Log_Conf",
  1028. "cfgmgr32.dll.CM_Get_Next_Res_Des",
  1029. "cfgmgr32.dll.CM_Get_Res_Des_Data",
  1030. "cfgmgr32.dll.CM_Get_Res_Des_Data_Size",
  1031. "cfgmgr32.dll.CM_Free_Log_Conf_Handle",
  1032. "cfgmgr32.dll.CM_Free_Res_Des_Handle",
  1033. "cfgmgr32.dll.CM_Get_Device_IDA",
  1034. "cfgmgr32.dll.CM_Get_Device_ID_Size",
  1035. "cfgmgr32.dll.CM_Get_Parent",
  1036. "user32.dll.GetSystemMetrics",
  1037. "user32.dll.MonitorFromWindow",
  1038. "user32.dll.MonitorFromRect",
  1039. "user32.dll.MonitorFromPoint",
  1040. "user32.dll.EnumDisplayDevicesW",
  1041. "user32.dll.GetMonitorInfoW",
  1042. "dxgi.dll.DXGIReportAdapterConfiguration",
  1043. "setupapi.dll.SetupDiGetClassDevsW",
  1044. "setupapi.dll.SetupDiEnumDeviceInterfaces",
  1045. "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
  1046. "setupapi.dll.SetupDiDestroyDeviceInfoList",
  1047. "gdi32.dll.D3DKMTOpenAdapterFromDeviceName",
  1048. "gdi32.dll.D3DKMTQueryAdapterInfo",
  1049. "gdi32.dll.D3DKMTGetDisplayModeList",
  1050. "gdi32.dll.D3DKMTCloseAdapter",
  1051. "wintrust.dll.WinVerifyTrust",
  1052. "oleaut32.dll.#286",
  1053. "ole32.dll.StringFromCLSID"
  1054. ]
  1055.  
  1056. [*] Static Analysis: {
  1057. "pe": {
  1058. "peid_signatures": [
  1059. [
  1060. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  1061. ]
  1062. ],
  1063. "imports": [
  1064. {
  1065. "imports": [
  1066. {
  1067. "name": "LoadLibraryA",
  1068. "address": "0x4da3b8"
  1069. },
  1070. {
  1071. "name": "GetProcAddress",
  1072. "address": "0x4da3bc"
  1073. },
  1074. {
  1075. "name": "VirtualProtect",
  1076. "address": "0x4da3c0"
  1077. },
  1078. {
  1079. "name": "VirtualAlloc",
  1080. "address": "0x4da3c4"
  1081. },
  1082. {
  1083. "name": "VirtualFree",
  1084. "address": "0x4da3c8"
  1085. },
  1086. {
  1087. "name": "ExitProcess",
  1088. "address": "0x4da3cc"
  1089. }
  1090. ],
  1091. "dll": "KERNEL32.DLL"
  1092. },
  1093. {
  1094. "imports": [
  1095. {
  1096. "name": "RegOpenKeyA",
  1097. "address": "0x4da3d4"
  1098. }
  1099. ],
  1100. "dll": "ADVAPI32.dll"
  1101. },
  1102. {
  1103. "imports": [
  1104. {
  1105. "name": "free",
  1106. "address": "0x4da3dc"
  1107. }
  1108. ],
  1109. "dll": "MSVCRT.dll"
  1110. },
  1111. {
  1112. "imports": [
  1113. {
  1114. "name": "SHGetSpecialFolderPathA",
  1115. "address": "0x4da3e4"
  1116. }
  1117. ],
  1118. "dll": "SHELL32.dll"
  1119. },
  1120. {
  1121. "imports": [
  1122. {
  1123. "name": "PathFileExistsA",
  1124. "address": "0x4da3ec"
  1125. }
  1126. ],
  1127. "dll": "SHLWAPI.dll"
  1128. },
  1129. {
  1130. "imports": [
  1131. {
  1132. "name": "wsprintfA",
  1133. "address": "0x4da3f4"
  1134. }
  1135. ],
  1136. "dll": "USER32.dll"
  1137. },
  1138. {
  1139. "imports": [
  1140. {
  1141. "name": "WSACleanup",
  1142. "address": "0x4da3fc"
  1143. }
  1144. ],
  1145. "dll": "WS2_32.dll"
  1146. }
  1147. ],
  1148. "digital_signers": null,
  1149. "exported_dll_name": null,
  1150. "actual_checksum": "0x0005d14a",
  1151. "overlay": null,
  1152. "imagebase": "0x00400000",
  1153. "reported_checksum": "0x00000000",
  1154. "icon_hash": null,
  1155. "entrypoint": "0x004d9e20",
  1156. "timestamp": "2019-05-07 12:42:03",
  1157. "osversion": "4.0",
  1158. "sections": [
  1159. {
  1160. "name": "UPX0",
  1161. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1162. "virtual_address": "0x00001000",
  1163. "size_of_data": "0x00000000",
  1164. "entropy": "0.00",
  1165. "raw_address": "0x00000400",
  1166. "virtual_size": "0x00084000",
  1167. "characteristics_raw": "0xe0000080"
  1168. },
  1169. {
  1170. "name": "UPX1",
  1171. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1172. "virtual_address": "0x00085000",
  1173. "size_of_data": "0x00055000",
  1174. "entropy": "7.84",
  1175. "raw_address": "0x00000400",
  1176. "virtual_size": "0x00055000",
  1177. "characteristics_raw": "0xe0000040"
  1178. },
  1179. {
  1180. "name": ".rsrc",
  1181. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1182. "virtual_address": "0x000da000",
  1183. "size_of_data": "0x00000600",
  1184. "entropy": "4.68",
  1185. "raw_address": "0x00055400",
  1186. "virtual_size": "0x00001000",
  1187. "characteristics_raw": "0xc0000040"
  1188. }
  1189. ],
  1190. "resources": [],
  1191. "dirents": [
  1192. {
  1193. "virtual_address": "0x00000000",
  1194. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1195. "size": "0x00000000"
  1196. },
  1197. {
  1198. "virtual_address": "0x000da318",
  1199. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1200. "size": "0x000001e4"
  1201. },
  1202. {
  1203. "virtual_address": "0x000da000",
  1204. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1205. "size": "0x00000318"
  1206. },
  1207. {
  1208. "virtual_address": "0x00000000",
  1209. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1210. "size": "0x00000000"
  1211. },
  1212. {
  1213. "virtual_address": "0x00000000",
  1214. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1215. "size": "0x00000000"
  1216. },
  1217. {
  1218. "virtual_address": "0x000da4fc",
  1219. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1220. "size": "0x0000000c"
  1221. },
  1222. {
  1223. "virtual_address": "0x00000000",
  1224. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1225. "size": "0x00000000"
  1226. },
  1227. {
  1228. "virtual_address": "0x00000000",
  1229. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1230. "size": "0x00000000"
  1231. },
  1232. {
  1233. "virtual_address": "0x00000000",
  1234. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1235. "size": "0x00000000"
  1236. },
  1237. {
  1238. "virtual_address": "0x00000000",
  1239. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1240. "size": "0x00000000"
  1241. },
  1242. {
  1243. "virtual_address": "0x00000000",
  1244. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1245. "size": "0x00000000"
  1246. },
  1247. {
  1248. "virtual_address": "0x00000000",
  1249. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1250. "size": "0x00000000"
  1251. },
  1252. {
  1253. "virtual_address": "0x00000000",
  1254. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1255. "size": "0x00000000"
  1256. },
  1257. {
  1258. "virtual_address": "0x00000000",
  1259. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1260. "size": "0x00000000"
  1261. },
  1262. {
  1263. "virtual_address": "0x00000000",
  1264. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1265. "size": "0x00000000"
  1266. },
  1267. {
  1268. "virtual_address": "0x00000000",
  1269. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1270. "size": "0x00000000"
  1271. }
  1272. ],
  1273. "exports": [],
  1274. "guest_signers": {},
  1275. "imphash": "3711d94b37d80b5764c686cbebb364ba",
  1276. "icon_fuzzy": null,
  1277. "icon": null,
  1278. "pdbpath": null,
  1279. "imported_dll_count": 7,
  1280. "versioninfo": []
  1281. }
  1282. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!