API tools faq
paste
paladin316

Gozi_90d05fe9ee4668c6dffd6941241255fc_exe_2019-06-28_05_30.json

paladin316
Jun 28th, 2019
2,190
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 34.33 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Gozi_90d05fe9ee4668c6dffd6941241255fc.exe"
  7. [*] File Size: 336384
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "9b105604844dc1c8cde873ff09a0be4767fb72d37c4550e8c23a760d32b5d699"
  10. [*] MD5: "90d05fe9ee4668c6dffd6941241255fc"
  11. [*] SHA1: "3bb0f567831e02bc2290f133ec707d4db028d324"
  12. [*] SHA512: "7786da6272829a9afe05e86efa1b2107b83de5aedd975d78bd1e348e9aa96a24b6275398eb7e9cdf4e32d865eb7da1c4805bd6b34862f7d70604c05ad757bd12"
  13. [*] CRC32: "B7FD3CDA"
  14. [*] SSDEEP: "6144:B4ihJ2pFnv1mVbDjPRSHMxgsYObOze2FKh5DAn1w8OtywXMnMhKdnNwod4FWuF:BvIp+bvPDbph5b8Ot7UMhKZ1"
  15.  
  16. [*] Process Execution: [
  17. "Gozi_90d05fe9ee4668c6dffd6941241255fc.exe",
  18. "control.exe",
  19. "rundll32.exe",
  20. "explorer.exe"
  21. ]
  22.  
  23. [*] Signatures Detected: [
  24. {
  25. "Description": "Creates RWX memory",
  26. "Details": []
  27. },
  28. {
  29. "Description": "Possible date expiration check, exits too soon after checking local time",
  30. "Details": [
  31. {
  32. "process": "control.exe, PID 2652"
  33. }
  34. ]
  35. },
  36. {
  37. "Description": "The binary likely contains encrypted or compressed data.",
  38. "Details": [
  39. {
  40. "section": "name: .rsrc, entropy: 7.83, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0004be00, virtual_size: 0x0004bda0"
  41. }
  42. ]
  43. },
  44. {
  45. "Description": "Deletes its original binary from disk",
  46. "Details": []
  47. },
  48. {
  49. "Description": "Executed a process and injected code into it, probably while unpacking",
  50. "Details": [
  51. {
  52. "Injection": "Gozi_90d05fe9ee4668c6dffd6941241255fc.exe(2360) -> control.exe(2652)"
  53. }
  54. ]
  55. },
  56. {
  57. "Description": "Sniffs keystrokes",
  58. "Details": [
  59. {
  60. "SetWindowsHookExA": "Process: explorer.exe(2044)"
  61. }
  62. ]
  63. },
  64. {
  65. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  66. "Details": [
  67. {
  68. "regkeyval": "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client32"
  69. },
  70. {
  71. "regkeyval": "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client64"
  72. }
  73. ]
  74. },
  75. {
  76. "Description": "Installs itself for autorun at Windows startup",
  77. "Details": [
  78. {
  79. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\aecaM1M0"
  80. },
  81. {
  82. "data": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\ApiMM1M0\\aeevpisp.exe"
  83. }
  84. ]
  85. },
  86. {
  87. "Description": "File has been identified by 24 Antiviruses on VirusTotal as malicious",
  88. "Details": [
  89. {
  90. "Qihoo-360": "HEUR/QVM19.1.26E1.Malware.Gen"
  91. },
  92. {
  93. "Cylance": "Unsafe"
  94. },
  95. {
  96. "CrowdStrike": "win/malicious_confidence_100% (D)"
  97. },
  98. {
  99. "K7GW": "Trojan ( 00549d461 )"
  100. },
  101. {
  102. "K7AntiVirus": "Trojan ( 00549d461 )"
  103. },
  104. {
  105. "Symantec": "ML.Attribute.HighConfidence"
  106. },
  107. {
  108. "APEX": "Malicious"
  109. },
  110. {
  111. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  112. },
  113. {
  114. "Rising": "Trojan.Kryptik!8.8 (TFE:dGZlOgETiZ6BUioEag)"
  115. },
  116. {
  117. "Endgame": "malicious (high confidence)"
  118. },
  119. {
  120. "Invincea": "heuristic"
  121. },
  122. {
  123. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  124. },
  125. {
  126. "Trapmine": "malicious.high.ml.score"
  127. },
  128. {
  129. "FireEye": "Generic.mg.90d05fe9ee4668c6"
  130. },
  131. {
  132. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  133. },
  134. {
  135. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  136. },
  137. {
  138. "Acronis": "suspicious"
  139. },
  140. {
  141. "VBA32": "Trojan.FakeAV.01657"
  142. },
  143. {
  144. "Malwarebytes": "Trojan.MalPack.VAK"
  145. },
  146. {
  147. "SentinelOne": "DFI - Malicious PE"
  148. },
  149. {
  150. "eGambit": "Unsafe.AI_Score_98%"
  151. },
  152. {
  153. "AVG": "FileRepMalware"
  154. },
  155. {
  156. "Cybereason": "malicious.7831e0"
  157. },
  158. {
  159. "Avast": "FileRepMalware"
  160. }
  161. ]
  162. },
  163. {
  164. "Description": "Creates a copy of itself",
  165. "Details": [
  166. {
  167. "copy": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\ApiMM1M0\\aeevpisp.exe"
  168. }
  169. ]
  170. }
  171. ]
  172.  
  173. [*] Started Service: []
  174.  
  175. [*] Executed Commands: [
  176. "C:\\Windows\\system32\\control.exe /?",
  177. "\"C:\\Windows\\system32\\rundll32.exe\" Shell32.dll,Control_RunDLL /?",
  178. "%SystemRoot%\\system32\\rundll32.exe Shell32.dll,Control_RunDLL /?"
  179. ]
  180.  
  181. [*] Mutexes: [
  182. "\\xe6\\xa5\\xa7\\xe6\\x91\\xb9\\xe6\\x99\\xae\\xe6\\xb9\\xb7\\xe7\\x9d\\xa8\\xe6\\xa9\\xa6o\\xe7\\x89\\xa6\\xe6\\x8d\\xb4\\xe6\\xa1\\xb2\\xe7\\x91\\xa3\\xe6\\x95\\xb4\\xe7\\x81\\xaa\\xe7\\x99\\xa3\\xe7\\x81\\xa7b\\xe6\\xa9\\xaa\\xe6\\xbd\\xb8\\xe6\\x85\\xb3\\xe6\\xa1\\xaa\\xe7\\x95\\xb9\\xe6\\xad\\xaa\\xe6\\x85\\xa5\\xe7\\xa8\\x80\\xe6\\xb9\\xb8\\xe6\\xb9\\xba\\xe6\\x95\\xa2\\xe6\\xb9\\xb6\\xe6\\xad\\xa8\\xe6\\x9d\\xabm",
  183. "{BA1A8490-D16A-FCA5-2B8E-95F08FA29924}",
  184. "Local\\{CA7E941A-A1DF-8C74-7B9E-6580DFB269B4}",
  185. "Local\\{143F7FD9-631F-66FD-8D88-47FA113C6BCE}",
  186. "Local\\{C24B3540-3918-44E4-D316-7DB8B7AA016C}",
  187. "{DABB3154-7159-1C84-CBAE-35102FC23944}",
  188. "{D6E9679E-3D17-786F-776A-C12C9B3E8520}"
  189. ]
  190.  
  191. [*] Modified Files: [
  192. "\\??\\mailslot\\sl938",
  193. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\ApiMM1M0\\aeevpisp.exe",
  194. "\\??\\pipe\\{A6CCF2CA-CD7B-C8EA-873A-517CAB0E1570}"
  195. ]
  196.  
  197. [*] Deleted Files: [
  198. "C:\\Users\\user\\AppData\\Local\\Temp\\Gozi_90d05fe9ee4668c6dffd6941241255fc.exe"
  199. ]
  200.  
  201. [*] Modified Registry Keys: [
  202. "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18",
  203. "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client32",
  204. "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client64",
  205. "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\0EEC6689-1584-7006-0F22-19A4B3765D18\\Client",
  206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\aecaM1M0",
  207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableSPDY3_0",
  208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\\rkcybere.rkr",
  209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA"
  210. ]
  211.  
  212. [*] Deleted Registry Keys: []
  213.  
  214. [*] DNS Communications: [
  215. {
  216. "type": "A",
  217. "request": "11totalzaelooop11.club",
  218. "answers": [
  219. {
  220. "data": "",
  221. "type": "NXDOMAIN"
  222. }
  223. ]
  224. }
  225. ]
  226.  
  227. [*] Domains: [
  228. {
  229. "ip": "",
  230. "domain": "11totalzaelooop11.club"
  231. }
  232. ]
  233.  
  234. [*] Network Communication - ICMP: []
  235.  
  236. [*] Network Communication - HTTP: []
  237.  
  238. [*] Network Communication - SMTP: []
  239.  
  240. [*] Network Communication - Hosts: []
  241.  
  242. [*] Network Communication - IRC: []
  243.  
  244. [*] Static Analysis: {
  245. "pe": {
  246. "peid_signatures": null,
  247. "imports": [
  248. {
  249. "imports": [
  250. {
  251. "name": "GetSystemDirectoryW",
  252. "address": "0x407960"
  253. },
  254. {
  255. "name": "CreateMailslotW",
  256. "address": "0x407964"
  257. },
  258. {
  259. "name": "LoadLibraryA",
  260. "address": "0x407968"
  261. },
  262. {
  263. "name": "GetCurrentThread",
  264. "address": "0x40796c"
  265. },
  266. {
  267. "name": "SetCurrentDirectoryA",
  268. "address": "0x407970"
  269. },
  270. {
  271. "name": "OpenMutexW",
  272. "address": "0x407974"
  273. },
  274. {
  275. "name": "CreateProcessA",
  276. "address": "0x407978"
  277. },
  278. {
  279. "name": "FindClose",
  280. "address": "0x40797c"
  281. },
  282. {
  283. "name": "LoadLibraryW",
  284. "address": "0x407980"
  285. },
  286. {
  287. "name": "WriteConsoleA",
  288. "address": "0x407984"
  289. },
  290. {
  291. "name": "GetCurrentProcess",
  292. "address": "0x407988"
  293. },
  294. {
  295. "name": "GetFileAttributesA",
  296. "address": "0x40798c"
  297. },
  298. {
  299. "name": "lstrcmp",
  300. "address": "0x407990"
  301. },
  302. {
  303. "name": "GetConsoleTitleW",
  304. "address": "0x407994"
  305. },
  306. {
  307. "name": "GetLongPathNameW",
  308. "address": "0x407998"
  309. },
  310. {
  311. "name": "FreeConsole",
  312. "address": "0x40799c"
  313. },
  314. {
  315. "name": "CreateFileW",
  316. "address": "0x4079a0"
  317. },
  318. {
  319. "name": "VirtualAlloc",
  320. "address": "0x4079a4"
  321. },
  322. {
  323. "name": "lstrcpyA",
  324. "address": "0x4079a8"
  325. },
  326. {
  327. "name": "GetVolumeInformationA",
  328. "address": "0x4079ac"
  329. },
  330. {
  331. "name": "OpenFileMappingA",
  332. "address": "0x4079b0"
  333. },
  334. {
  335. "name": "FindFirstFileA",
  336. "address": "0x4079b4"
  337. },
  338. {
  339. "name": "CreateThread",
  340. "address": "0x4079b8"
  341. },
  342. {
  343. "name": "GetVolumeNameForVolumeMountPointW",
  344. "address": "0x4079bc"
  345. },
  346. {
  347. "name": "VirtualProtect",
  348. "address": "0x4079c0"
  349. }
  350. ],
  351. "dll": "kernel32.dll"
  352. },
  353. {
  354. "imports": [
  355. {
  356. "name": "AuthzAddSidsToContext",
  357. "address": "0x4079c8"
  358. },
  359. {
  360. "name": "AuthzFreeContext",
  361. "address": "0x4079cc"
  362. },
  363. {
  364. "name": "AuthzInitializeContextFromSid",
  365. "address": "0x4079d0"
  366. }
  367. ],
  368. "dll": "authz.dll"
  369. }
  370. ],
  371. "digital_signers": null,
  372. "exported_dll_name": null,
  373. "actual_checksum": "0x0005506e",
  374. "overlay": null,
  375. "imagebase": "0x00400000",
  376. "reported_checksum": "0x00000000",
  377. "icon_hash": null,
  378. "entrypoint": "0x0040100c",
  379. "timestamp": "2017-12-27 05:20:09",
  380. "osversion": "5.1",
  381. "sections": [
  382. {
  383. "name": ".text",
  384. "characteristics": "IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  385. "virtual_address": "0x00001000",
  386. "size_of_data": "0x00001400",
  387. "entropy": "4.93",
  388. "raw_address": "0x00000200",
  389. "virtual_size": "0x00001338",
  390. "characteristics_raw": "0x60000000"
  391. },
  392. {
  393. "name": ".kdata",
  394. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  395. "virtual_address": "0x00003000",
  396. "size_of_data": "0x00004e00",
  397. "entropy": "1.39",
  398. "raw_address": "0x00001600",
  399. "virtual_size": "0x00004cbc",
  400. "characteristics_raw": "0xc0000040"
  401. },
  402. {
  403. "name": ".rsrc",
  404. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  405. "virtual_address": "0x00008000",
  406. "size_of_data": "0x0004be00",
  407. "entropy": "7.83",
  408. "raw_address": "0x00006400",
  409. "virtual_size": "0x0004bda0",
  410. "characteristics_raw": "0xc00000c0"
  411. }
  412. ],
  413. "resources": [],
  414. "dirents": [
  415. {
  416. "virtual_address": "0x00000000",
  417. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  418. "size": "0x00000000"
  419. },
  420. {
  421. "virtual_address": "0x000079dc",
  422. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  423. "size": "0x00000028"
  424. },
  425. {
  426. "virtual_address": "0x00008000",
  427. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  428. "size": "0x0004bda0"
  429. },
  430. {
  431. "virtual_address": "0x00000000",
  432. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  433. "size": "0x00000000"
  434. },
  435. {
  436. "virtual_address": "0x00000000",
  437. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  438. "size": "0x00000000"
  439. },
  440. {
  441. "virtual_address": "0x00000000",
  442. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  443. "size": "0x00000000"
  444. },
  445. {
  446. "virtual_address": "0x00000000",
  447. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  448. "size": "0x00000000"
  449. },
  450. {
  451. "virtual_address": "0x00000000",
  452. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  453. "size": "0x00000000"
  454. },
  455. {
  456. "virtual_address": "0x00000000",
  457. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  458. "size": "0x00000000"
  459. },
  460. {
  461. "virtual_address": "0x00000000",
  462. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  463. "size": "0x00000000"
  464. },
  465. {
  466. "virtual_address": "0x00000000",
  467. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  468. "size": "0x00000000"
  469. },
  470. {
  471. "virtual_address": "0x00000000",
  472. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  473. "size": "0x00000000"
  474. },
  475. {
  476. "virtual_address": "0x00000000",
  477. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  478. "size": "0x00000000"
  479. },
  480. {
  481. "virtual_address": "0x00000000",
  482. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  483. "size": "0x00000000"
  484. },
  485. {
  486. "virtual_address": "0x00000000",
  487. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  488. "size": "0x00000000"
  489. },
  490. {
  491. "virtual_address": "0x00000000",
  492. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  493. "size": "0x00000000"
  494. }
  495. ],
  496. "exports": [],
  497. "guest_signers": {},
  498. "imphash": "4946827c5bff5df45fd8fefc98d58fdf",
  499. "icon_fuzzy": null,
  500. "icon": null,
  501. "pdbpath": null,
  502. "imported_dll_count": 2,
  503. "versioninfo": []
  504. }
  505. }
  506.  
  507. [*] Resolved APIs: [
  508. "kernel32.dll.SortGetHandle",
  509. "kernel32.dll.SortCloseHandle",
  510. "kernel32.dll.HeapAlloc",
  511. "kernel32.dll.HeapFree",
  512. "kernel32.dll.GetTickCount",
  513. "kernel32.dll.HeapCreate",
  514. "kernel32.dll.ExitThread",
  515. "kernel32.dll.GetLastError",
  516. "kernel32.dll.GetModuleHandleA",
  517. "kernel32.dll.Sleep",
  518. "kernel32.dll.GetProcAddress",
  519. "kernel32.dll.VirtualProtect",
  520. "kernel32.dll.CreateFileA",
  521. "kernel32.dll.WriteFile",
  522. "kernel32.dll.ReadFile",
  523. "kernel32.dll.CreateMailslotA",
  524. "kernel32.dll.CloseHandle",
  525. "kernel32.dll.GetCurrentProcessId",
  526. "kernel32.dll.HeapReAlloc",
  527. "kernel32.dll.lstrlenA",
  528. "kernel32.dll.WaitForSingleObject",
  529. "kernel32.dll.TerminateThread",
  530. "kernel32.dll.GetModuleFileNameW",
  531. "kernel32.dll.VirtualAlloc",
  532. "kernel32.dll.LoadLibraryA",
  533. "kernel32.dll.GetExitCodeThread",
  534. "kernel32.dll.CreateThread",
  535. "user32.dll.wsprintfA",
  536. "ntdll.dll.memset",
  537. "ntdll.dll.memcpy",
  538. "ntdll.dll.ZwOpenProcess",
  539. "ntdll.dll.ZwOpenProcessToken",
  540. "ntdll.dll.NtCreateSection",
  541. "ntdll.dll.ZwClose",
  542. "ntdll.dll.RtlNtStatusToDosError",
  543. "ntdll.dll.NtUnmapViewOfSection",
  544. "ntdll.dll.NtMapViewOfSection",
  545. "ntdll.dll.NtQuerySystemInformation",
  546. "ntdll.dll.mbstowcs",
  547. "ntdll.dll.ZwQueryInformationProcess",
  548. "ntdll.dll.ZwQueryInformationToken",
  549. "ntdll.dll.RtlFreeUnicodeString",
  550. "ntdll.dll.RtlUpcaseUnicodeString",
  551. "ntdll.dll.RtlUnwind",
  552. "ntdll.dll.NtQueryVirtualMemory",
  553. "shlwapi.dll.StrRChrA",
  554. "shlwapi.dll.PathCombineW",
  555. "shlwapi.dll.PathFindExtensionA",
  556. "shlwapi.dll.PathFindExtensionW",
  557. "shlwapi.dll.StrChrA",
  558. "shlwapi.dll.StrStrIW",
  559. "shlwapi.dll.PathFindFileNameW",
  560. "kernel32.dll.SetWaitableTimer",
  561. "kernel32.dll.MoveFileExW",
  562. "kernel32.dll.SetEvent",
  563. "kernel32.dll.CreateEventA",
  564. "kernel32.dll.CreateProcessA",
  565. "kernel32.dll.CreateFileW",
  566. "kernel32.dll.lstrlenW",
  567. "kernel32.dll.ResetEvent",
  568. "kernel32.dll.CreateFileMappingW",
  569. "kernel32.dll.lstrcmpiW",
  570. "kernel32.dll.lstrcatW",
  571. "kernel32.dll.DeleteFileW",
  572. "kernel32.dll.CreateWaitableTimerA",
  573. "kernel32.dll.MapViewOfFile",
  574. "kernel32.dll.GetFileSize",
  575. "kernel32.dll.ExitProcess",
  576. "kernel32.dll.HeapDestroy",
  577. "kernel32.dll.SleepEx",
  578. "kernel32.dll.InterlockedDecrement",
  579. "kernel32.dll.InterlockedIncrement",
  580. "kernel32.dll.GetSystemTimeAsFileTime",
  581. "kernel32.dll.OpenProcess",
  582. "kernel32.dll.GetTempPathA",
  583. "kernel32.dll.GetCurrentThreadId",
  584. "kernel32.dll.GetTempFileNameA",
  585. "kernel32.dll.lstrcmpiA",
  586. "kernel32.dll.SetLastError",
  587. "kernel32.dll.GetFileTime",
  588. "kernel32.dll.FindNextFileA",
  589. "kernel32.dll.FindClose",
  590. "kernel32.dll.FindFirstFileA",
  591. "kernel32.dll.CompareFileTime",
  592. "kernel32.dll.VirtualProtectEx",
  593. "kernel32.dll.SuspendThread",
  594. "kernel32.dll.ResumeThread",
  595. "kernel32.dll.lstrcmpA",
  596. "kernel32.dll.lstrcpyA",
  597. "kernel32.dll.GetLongPathNameW",
  598. "kernel32.dll.GetVersion",
  599. "kernel32.dll.ExpandEnvironmentStringsA",
  600. "kernel32.dll.lstrcatA",
  601. "kernel32.dll.LocalFree",
  602. "kernel32.dll.SetEndOfFile",
  603. "kernel32.dll.CreateDirectoryW",
  604. "kernel32.dll.FlushFileBuffers",
  605. "kernel32.dll.lstrcpyW",
  606. "kernel32.dll.SetFilePointer",
  607. "kernel32.dll.VirtualFree",
  608. "kernel32.dll.GetModuleFileNameA",
  609. "user32.dll.wsprintfW",
  610. "user32.dll.GetCursorPos",
  611. "advapi32.dll.RegDeleteValueW",
  612. "advapi32.dll.RegEnumKeyExA",
  613. "advapi32.dll.RegOpenKeyW",
  614. "advapi32.dll.GetTokenInformation",
  615. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorA",
  616. "advapi32.dll.RegSetValueExA",
  617. "advapi32.dll.RegQueryValueExA",
  618. "advapi32.dll.RegCreateKeyA",
  619. "advapi32.dll.RegCloseKey",
  620. "advapi32.dll.RegOpenKeyExA",
  621. "advapi32.dll.RegQueryValueExW",
  622. "advapi32.dll.RegOpenKeyA",
  623. "advapi32.dll.GetSidSubAuthority",
  624. "advapi32.dll.GetSidSubAuthorityCount",
  625. "advapi32.dll.OpenProcessToken",
  626. "shell32.dll.ShellExecuteExW",
  627. "ole32.dll.CoUninitialize",
  628. "ole32.dll.CoInitializeEx",
  629. "kernel32.dll.IsWow64Process",
  630. "user32.dll.FindWindowA",
  631. "user32.dll.GetWindowThreadProcessId",
  632. "kernel32.dll.Wow64EnableWow64FsRedirection",
  633. "ntdll.dll.ZwWow64QueryInformationProcess64",
  634. "ntdll.dll.ZwWow64ReadVirtualMemory64",
  635. "ntdll.dll.sprintf",
  636. "ntdll.dll.strcpy",
  637. "ntdll.dll._snprintf",
  638. "ntdll.dll._wcsupr",
  639. "ntdll.dll._strupr",
  640. "ntdll.dll.memmove",
  641. "ntdll.dll.wcscpy",
  642. "ntdll.dll.ZwQueryKey",
  643. "ntdll.dll.RtlImageNtHeader",
  644. "ntdll.dll.wcstombs",
  645. "ntdll.dll.RtlAdjustPrivilege",
  646. "ntdll.dll._snwprintf",
  647. "ntdll.dll.__C_specific_handler",
  648. "ntdll.dll.__chkstk",
  649. "kernel32.dll.GetExitCodeProcess",
  650. "kernel32.dll.GetVersionExA",
  651. "kernel32.dll.FileTimeToLocalFileTime",
  652. "kernel32.dll.QueueUserWorkItem",
  653. "kernel32.dll.GetLocalTime",
  654. "kernel32.dll.FileTimeToSystemTime",
  655. "kernel32.dll.CreateDirectoryA",
  656. "kernel32.dll.RemoveDirectoryA",
  657. "kernel32.dll.DeleteFileA",
  658. "kernel32.dll.GetCurrentThread",
  659. "kernel32.dll.GetWindowsDirectoryA",
  660. "kernel32.dll.CopyFileW",
  661. "kernel32.dll.TerminateProcess",
  662. "kernel32.dll.DuplicateHandle",
  663. "kernel32.dll.SwitchToThread",
  664. "kernel32.dll.UnmapViewOfFile",
  665. "kernel32.dll.OpenWaitableTimerA",
  666. "kernel32.dll.OpenMutexA",
  667. "kernel32.dll.WaitForMultipleObjects",
  668. "kernel32.dll.CreateMutexA",
  669. "kernel32.dll.ReleaseMutex",
  670. "kernel32.dll.InitializeCriticalSection",
  671. "kernel32.dll.LeaveCriticalSection",
  672. "kernel32.dll.EnterCriticalSection",
  673. "kernel32.dll.UnregisterWait",
  674. "kernel32.dll.TlsGetValue",
  675. "kernel32.dll.LoadLibraryExW",
  676. "kernel32.dll.TlsSetValue",
  677. "kernel32.dll.RegisterWaitForSingleObject",
  678. "kernel32.dll.TlsAlloc",
  679. "kernel32.dll.OpenEventA",
  680. "kernel32.dll.GetDriveTypeW",
  681. "kernel32.dll.GetLogicalDriveStringsW",
  682. "kernel32.dll.WideCharToMultiByte",
  683. "kernel32.dll.CreateFileMappingA",
  684. "kernel32.dll.OpenFileMappingA",
  685. "kernel32.dll.lstrcpynA",
  686. "kernel32.dll.GlobalLock",
  687. "kernel32.dll.GlobalUnlock",
  688. "kernel32.dll.Thread32First",
  689. "kernel32.dll.Thread32Next",
  690. "kernel32.dll.QueueUserAPC",
  691. "kernel32.dll.OpenThread",
  692. "kernel32.dll.CreateToolhelp32Snapshot",
  693. "kernel32.dll.CallNamedPipeA",
  694. "kernel32.dll.WaitNamedPipeA",
  695. "kernel32.dll.ConnectNamedPipe",
  696. "kernel32.dll.GetOverlappedResult",
  697. "kernel32.dll.DisconnectNamedPipe",
  698. "kernel32.dll.CreateNamedPipeA",
  699. "kernel32.dll.CancelIo",
  700. "kernel32.dll.GetSystemTime",
  701. "kernel32.dll.RemoveVectoredExceptionHandler",
  702. "kernel32.dll.AddVectoredExceptionHandler",
  703. "kernel32.dll.LocalAlloc",
  704. "kernel32.dll.FreeLibrary",
  705. "kernel32.dll.RaiseException",
  706. "kernel32.dll.DeleteCriticalSection",
  707. "kernel32.dll.ExpandEnvironmentStringsW",
  708. "kernel32.dll.RemoveDirectoryW",
  709. "kernel32.dll.FindNextFileW",
  710. "kernel32.dll.GetFileAttributesW",
  711. "kernel32.dll.SetFilePointerEx",
  712. "kernel32.dll.FindFirstFileW",
  713. "kernel32.dll.GetComputerNameW",
  714. "advapi32.dll.GetUserNameA",
  715. "psapi.dll.EnumProcessModules",
  716. "shlwapi.dll.StrToIntExA",
  717. "shlwapi.dll.StrTrimA",
  718. "user32.dll.GetShellWindow",
  719. "ntdll.dll.RtlExitUserThread",
  720. "kernel32.dll.CreateRemoteThread",
  721. "advapi32.dll.GetUserNameW",
  722. "shlwapi.dll.PathFindFileNameA",
  723. "shlwapi.dll.StrChrW",
  724. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  725. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  726. "comctl32.dll.#386",
  727. "psapi.dll.GetProcessImageFileNameW",
  728. "advapi32.dll.UnregisterTraceGuids",
  729. "comctl32.dll.#321",
  730. "kernel32.dll.FlsGetValue",
  731. "ole32.dll.CreateStreamOnHGlobal",
  732. "shlwapi.dll.StrStrIA",
  733. "user32.dll.SetWindowsHookExA",
  734. "winhttp.dll.WinHttpOpen",
  735. "user32.dll.RegisterClassA",
  736. "user32.dll.CreateWindowExA",
  737. "user32.dll.GetWindowLongPtrA",
  738. "user32.dll.DefWindowProcA",
  739. "user32.dll.SetWindowLongPtrA",
  740. "user32.dll.SetClipboardViewer",
  741. "user32.dll.IsClipboardFormatAvailable",
  742. "user32.dll.GetClipboardOwner",
  743. "user32.dll.RegisterDeviceNotificationA",
  744. "shlwapi.dll.PathFileExistsW",
  745. "advapi32.dll.RegSetValueExW",
  746. "user32.dll.GetMessageA",
  747. "winhttp.dll.WinHttpConnect",
  748. "winhttp.dll.WinHttpOpenRequest",
  749. "winhttp.dll.WinHttpQueryOption",
  750. "winhttp.dll.WinHttpSetOption",
  751. "winhttp.dll.WinHttpSendRequest",
  752. "ws2_32.dll.GetAddrInfoW",
  753. "winhttp.dll.WinHttpCloseHandle",
  754. "rpcrt4.dll.RpcBindingFree",
  755. "shell32.dll.Control_RunDLLW",
  756. "uxtheme.dll.ThemeInitApiHook",
  757. "user32.dll.IsProcessDPIAware",
  758. "dwmapi.dll.DwmIsCompositionEnabled",
  759. "cryptbase.dll.SystemFunction036"
  760. ]
  761.  
  762. [*] Static Analysis: {
  763. "pe": {
  764. "peid_signatures": null,
  765. "imports": [
  766. {
  767. "imports": [
  768. {
  769. "name": "GetSystemDirectoryW",
  770. "address": "0x407960"
  771. },
  772. {
  773. "name": "CreateMailslotW",
  774. "address": "0x407964"
  775. },
  776. {
  777. "name": "LoadLibraryA",
  778. "address": "0x407968"
  779. },
  780. {
  781. "name": "GetCurrentThread",
  782. "address": "0x40796c"
  783. },
  784. {
  785. "name": "SetCurrentDirectoryA",
  786. "address": "0x407970"
  787. },
  788. {
  789. "name": "OpenMutexW",
  790. "address": "0x407974"
  791. },
  792. {
  793. "name": "CreateProcessA",
  794. "address": "0x407978"
  795. },
  796. {
  797. "name": "FindClose",
  798. "address": "0x40797c"
  799. },
  800. {
  801. "name": "LoadLibraryW",
  802. "address": "0x407980"
  803. },
  804. {
  805. "name": "WriteConsoleA",
  806. "address": "0x407984"
  807. },
  808. {
  809. "name": "GetCurrentProcess",
  810. "address": "0x407988"
  811. },
  812. {
  813. "name": "GetFileAttributesA",
  814. "address": "0x40798c"
  815. },
  816. {
  817. "name": "lstrcmp",
  818. "address": "0x407990"
  819. },
  820. {
  821. "name": "GetConsoleTitleW",
  822. "address": "0x407994"
  823. },
  824. {
  825. "name": "GetLongPathNameW",
  826. "address": "0x407998"
  827. },
  828. {
  829. "name": "FreeConsole",
  830. "address": "0x40799c"
  831. },
  832. {
  833. "name": "CreateFileW",
  834. "address": "0x4079a0"
  835. },
  836. {
  837. "name": "VirtualAlloc",
  838. "address": "0x4079a4"
  839. },
  840. {
  841. "name": "lstrcpyA",
  842. "address": "0x4079a8"
  843. },
  844. {
  845. "name": "GetVolumeInformationA",
  846. "address": "0x4079ac"
  847. },
  848. {
  849. "name": "OpenFileMappingA",
  850. "address": "0x4079b0"
  851. },
  852. {
  853. "name": "FindFirstFileA",
  854. "address": "0x4079b4"
  855. },
  856. {
  857. "name": "CreateThread",
  858. "address": "0x4079b8"
  859. },
  860. {
  861. "name": "GetVolumeNameForVolumeMountPointW",
  862. "address": "0x4079bc"
  863. },
  864. {
  865. "name": "VirtualProtect",
  866. "address": "0x4079c0"
  867. }
  868. ],
  869. "dll": "kernel32.dll"
  870. },
  871. {
  872. "imports": [
  873. {
  874. "name": "AuthzAddSidsToContext",
  875. "address": "0x4079c8"
  876. },
  877. {
  878. "name": "AuthzFreeContext",
  879. "address": "0x4079cc"
  880. },
  881. {
  882. "name": "AuthzInitializeContextFromSid",
  883. "address": "0x4079d0"
  884. }
  885. ],
  886. "dll": "authz.dll"
  887. }
  888. ],
  889. "digital_signers": null,
  890. "exported_dll_name": null,
  891. "actual_checksum": "0x0005506e",
  892. "overlay": null,
  893. "imagebase": "0x00400000",
  894. "reported_checksum": "0x00000000",
  895. "icon_hash": null,
  896. "entrypoint": "0x0040100c",
  897. "timestamp": "2017-12-27 05:20:09",
  898. "osversion": "5.1",
  899. "sections": [
  900. {
  901. "name": ".text",
  902. "characteristics": "IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  903. "virtual_address": "0x00001000",
  904. "size_of_data": "0x00001400",
  905. "entropy": "4.93",
  906. "raw_address": "0x00000200",
  907. "virtual_size": "0x00001338",
  908. "characteristics_raw": "0x60000000"
  909. },
  910. {
  911. "name": ".kdata",
  912. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  913. "virtual_address": "0x00003000",
  914. "size_of_data": "0x00004e00",
  915. "entropy": "1.39",
  916. "raw_address": "0x00001600",
  917. "virtual_size": "0x00004cbc",
  918. "characteristics_raw": "0xc0000040"
  919. },
  920. {
  921. "name": ".rsrc",
  922. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  923. "virtual_address": "0x00008000",
  924. "size_of_data": "0x0004be00",
  925. "entropy": "7.83",
  926. "raw_address": "0x00006400",
  927. "virtual_size": "0x0004bda0",
  928. "characteristics_raw": "0xc00000c0"
  929. }
  930. ],
  931. "resources": [],
  932. "dirents": [
  933. {
  934. "virtual_address": "0x00000000",
  935. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  936. "size": "0x00000000"
  937. },
  938. {
  939. "virtual_address": "0x000079dc",
  940. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  941. "size": "0x00000028"
  942. },
  943. {
  944. "virtual_address": "0x00008000",
  945. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  946. "size": "0x0004bda0"
  947. },
  948. {
  949. "virtual_address": "0x00000000",
  950. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  951. "size": "0x00000000"
  952. },
  953. {
  954. "virtual_address": "0x00000000",
  955. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  956. "size": "0x00000000"
  957. },
  958. {
  959. "virtual_address": "0x00000000",
  960. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  961. "size": "0x00000000"
  962. },
  963. {
  964. "virtual_address": "0x00000000",
  965. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  966. "size": "0x00000000"
  967. },
  968. {
  969. "virtual_address": "0x00000000",
  970. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  971. "size": "0x00000000"
  972. },
  973. {
  974. "virtual_address": "0x00000000",
  975. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  976. "size": "0x00000000"
  977. },
  978. {
  979. "virtual_address": "0x00000000",
  980. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  981. "size": "0x00000000"
  982. },
  983. {
  984. "virtual_address": "0x00000000",
  985. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  986. "size": "0x00000000"
  987. },
  988. {
  989. "virtual_address": "0x00000000",
  990. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  991. "size": "0x00000000"
  992. },
  993. {
  994. "virtual_address": "0x00000000",
  995. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  996. "size": "0x00000000"
  997. },
  998. {
  999. "virtual_address": "0x00000000",
  1000. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1001. "size": "0x00000000"
  1002. },
  1003. {
  1004. "virtual_address": "0x00000000",
  1005. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1006. "size": "0x00000000"
  1007. },
  1008. {
  1009. "virtual_address": "0x00000000",
  1010. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1011. "size": "0x00000000"
  1012. }
  1013. ],
  1014. "exports": [],
  1015. "guest_signers": {},
  1016. "imphash": "4946827c5bff5df45fd8fefc98d58fdf",
  1017. "icon_fuzzy": null,
  1018. "icon": null,
  1019. "pdbpath": null,
  1020. "imported_dll_count": 2,
  1021. "versioninfo": []
  1022. }
  1023. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!