Last active
June 28, 2019 03:11
-
-
Save ryanbekabe/cc49d150e155326ec5c9063d5e206cb6 to your computer and use it in GitHub Desktop.
Sample Report Cuckoo Sandbox with MongoDB
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "_id": "5d02dd4559bfaf1280fee9c9", | |
| "info": { | |
| "added": "2019-06-14T06:30:44.142Z", | |
| "started": "2019-06-14T06:30:45.788Z", | |
| "duration": 157, | |
| "analysis_path": "/home/cuckoo/.cuckoo/storage/analyses/1180", | |
| "ended": "2019-06-14T06:33:23.091Z", | |
| "owner": null, | |
| "score": 11, | |
| "id": 1180, | |
| "category": "file", | |
| "git": { | |
| "head": "c41c7c5cb09416b7cfc6159811792679e20762f2", | |
| "fetch_head": "c41c7c5cb09416b7cfc6159811792679e20762f2" | |
| }, | |
| "monitor": "e071e63a66e831163a40abc45109fdf71fee829e", | |
| "package": "exe", | |
| "route": "none", | |
| "custom": null, | |
| "machine": { | |
| "status": "stopped", | |
| "name": "cuckoo", | |
| "label": "cuckoo", | |
| "manager": "VirtualBox", | |
| "started_on": "2019-06-14 06:30:45", | |
| "shutdown_on": "2019-06-14 06:33:23" | |
| }, | |
| "platform": "windows", | |
| "version": "2.0.6", | |
| "options": "procmemdump=yes,route=none" | |
| }, | |
| "procmemory": [{ | |
| "regions": [{ | |
| "protect": "rw", | |
| "end": "0x00020000", | |
| "addr": "0x00010000", | |
| "state": 4096, | |
| "offset": 24, | |
| "type": 262144, | |
| "size": 65536 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00030000", | |
| "addr": "0x00020000", | |
| "state": 4096, | |
| "offset": 65584, | |
| "type": 262144, | |
| "size": 65536 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00230000", | |
| "addr": "0x0022c000", | |
| "state": 4096, | |
| "offset": 131144, | |
| "type": 131072, | |
| "size": 16384 | |
| }, { | |
| "protect": "r", | |
| "end": "0x00234000", | |
| "addr": "0x00230000", | |
| "state": 4096, | |
| "offset": 147552, | |
| "type": 262144, | |
| "size": 16384 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00241000", | |
| "addr": "0x00240000", | |
| "state": 4096, | |
| "offset": 163960, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwx", | |
| "end": "0x00251000", | |
| "addr": "0x00250000", | |
| "state": 4096, | |
| "offset": 168080, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwx", | |
| "end": "0x00261000", | |
| "addr": "0x00260000", | |
| "state": 4096, | |
| "offset": 172200, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwx", | |
| "end": "0x00271000", | |
| "addr": "0x00270000", | |
| "state": 4096, | |
| "offset": 176320, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x002e7000", | |
| "addr": "0x00280000", | |
| "state": 4096, | |
| "offset": 180440, | |
| "type": 262144, | |
| "size": 421888 | |
| }, { | |
| "protect": "r", | |
| "end": "0x002f2000", | |
| "addr": "0x002f0000", | |
| "state": 4096, | |
| "offset": 602352, | |
| "type": 262144, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x003b3000", | |
| "addr": "0x003b0000", | |
| "state": 4096, | |
| "offset": 610568, | |
| "type": 262144, | |
| "size": 12288 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x003d0000", | |
| "addr": "0x003c0000", | |
| "state": 4096, | |
| "offset": 622880, | |
| "type": 131072, | |
| "size": 65536 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x003d1000", | |
| "addr": "0x003d0000", | |
| "state": 4096, | |
| "offset": 688440, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x003e1000", | |
| "addr": "0x003e0000", | |
| "state": 4096, | |
| "offset": 692560, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x003f1000", | |
| "addr": "0x003f0000", | |
| "state": 4096, | |
| "offset": 696680, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x00401000", | |
| "addr": "0x00400000", | |
| "state": 4096, | |
| "offset": 700800, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x00406000", | |
| "addr": "0x00401000", | |
| "state": 4096, | |
| "offset": 704920, | |
| "type": 16777216, | |
| "size": 20480 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00407000", | |
| "addr": "0x00406000", | |
| "state": 4096, | |
| "offset": 725424, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x0040b000", | |
| "addr": "0x00407000", | |
| "state": 4096, | |
| "offset": 729544, | |
| "type": 16777216, | |
| "size": 16384 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x0040d000", | |
| "addr": "0x0040b000", | |
| "state": 4096, | |
| "offset": 745952, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x00418000", | |
| "addr": "0x0040d000", | |
| "state": 4096, | |
| "offset": 754168, | |
| "type": 16777216, | |
| "size": 45056 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00421000", | |
| "addr": "0x00420000", | |
| "state": 4096, | |
| "offset": 799248, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00431000", | |
| "addr": "0x00430000", | |
| "state": 4096, | |
| "offset": 803368, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00441000", | |
| "addr": "0x00440000", | |
| "state": 4096, | |
| "offset": 807488, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00451000", | |
| "addr": "0x00450000", | |
| "state": 4096, | |
| "offset": 811608, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00462000", | |
| "addr": "0x00460000", | |
| "state": 4096, | |
| "offset": 815728, | |
| "type": 131072, | |
| "size": 8192 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00472000", | |
| "addr": "0x00470000", | |
| "state": 4096, | |
| "offset": 823944, | |
| "type": 131072, | |
| "size": 8192 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00490000", | |
| "addr": "0x00480000", | |
| "state": 4096, | |
| "offset": 832160, | |
| "type": 131072, | |
| "size": 65536 | |
| }, { | |
| "protect": "rwx", | |
| "end": "0x00494000", | |
| "addr": "0x00490000", | |
| "state": 4096, | |
| "offset": 897720, | |
| "type": 131072, | |
| "size": 16384 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x004a1000", | |
| "addr": "0x004a0000", | |
| "state": 4096, | |
| "offset": 914128, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x004b1000", | |
| "addr": "0x004b0000", | |
| "state": 4096, | |
| "offset": 918248, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwx", | |
| "end": "0x004c4000", | |
| "addr": "0x004c0000", | |
| "state": 4096, | |
| "offset": 922368, | |
| "type": 131072, | |
| "size": 16384 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x004d1000", | |
| "addr": "0x004d0000", | |
| "state": 4096, | |
| "offset": 938776, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwx", | |
| "end": "0x004e4000", | |
| "addr": "0x004e0000", | |
| "state": 4096, | |
| "offset": 942896, | |
| "type": 131072, | |
| "size": 16384 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x00500000", | |
| "addr": "0x004f0000", | |
| "state": 4096, | |
| "offset": 959304, | |
| "type": 131072, | |
| "size": 65536 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x0055a000", | |
| "addr": "0x00500000", | |
| "state": 4096, | |
| "offset": 1024864, | |
| "type": 131072, | |
| "size": 368640 | |
| }, { | |
| "protect": "r", | |
| "end": "0x00701000", | |
| "addr": "0x00600000", | |
| "state": 4096, | |
| "offset": 1393528, | |
| "type": 262144, | |
| "size": 1052672 | |
| }, { | |
| "protect": "r", | |
| "end": "0x00723000", | |
| "addr": "0x00710000", | |
| "state": 4096, | |
| "offset": 2446224, | |
| "type": 262144, | |
| "size": 77824 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x01320000", | |
| "addr": "0x01310000", | |
| "state": 4096, | |
| "offset": 2524072, | |
| "type": 131072, | |
| "size": 65536 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x01330000", | |
| "addr": "0x01320000", | |
| "state": 4096, | |
| "offset": 2589632, | |
| "type": 131072, | |
| "size": 65536 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x01530000", | |
| "addr": "0x0152f000", | |
| "state": 4096, | |
| "offset": 2655192, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x01536000", | |
| "addr": "0x01530000", | |
| "state": 4096, | |
| "offset": 2659312, | |
| "type": 262144, | |
| "size": 24576 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x01541000", | |
| "addr": "0x01540000", | |
| "state": 4096, | |
| "offset": 2683912, | |
| "type": 262144, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x01945000", | |
| "addr": "0x01550000", | |
| "state": 4096, | |
| "offset": 2688032, | |
| "type": 262144, | |
| "size": 4149248 | |
| }, { | |
| "protect": "r", | |
| "end": "0x01c1f000", | |
| "addr": "0x01950000", | |
| "state": 4096, | |
| "offset": 6837304, | |
| "type": 262144, | |
| "size": 2945024 | |
| }, { | |
| "protect": "r", | |
| "end": "0x01c31000", | |
| "addr": "0x01c30000", | |
| "state": 4096, | |
| "offset": 9782352, | |
| "type": 262144, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x01c41000", | |
| "addr": "0x01c40000", | |
| "state": 4096, | |
| "offset": 9786472, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x01c51000", | |
| "addr": "0x01c50000", | |
| "state": 4096, | |
| "offset": 9790592, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x01c61000", | |
| "addr": "0x01c60000", | |
| "state": 4096, | |
| "offset": 9794712, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x01cb3000", | |
| "addr": "0x01cb0000", | |
| "state": 4096, | |
| "offset": 9798832, | |
| "type": 131072, | |
| "size": 12288 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x021b0000", | |
| "addr": "0x021af000", | |
| "state": 4096, | |
| "offset": 9811144, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x025b0000", | |
| "addr": "0x025af000", | |
| "state": 4096, | |
| "offset": 9815264, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x63dc1000", | |
| "addr": "0x63dc0000", | |
| "state": 4096, | |
| "offset": 9819384, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x63dfa000", | |
| "addr": "0x63dc1000", | |
| "state": 4096, | |
| "offset": 9823504, | |
| "type": 16777216, | |
| "size": 233472 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x63e01000", | |
| "addr": "0x63dfa000", | |
| "state": 4096, | |
| "offset": 10057000, | |
| "type": 16777216, | |
| "size": 28672 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x63e08000", | |
| "addr": "0x63e01000", | |
| "state": 4096, | |
| "offset": 10085696, | |
| "type": 16777216, | |
| "size": 28672 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x63e0a000", | |
| "addr": "0x63e08000", | |
| "state": 4096, | |
| "offset": 10114392, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x63e0b000", | |
| "addr": "0x63e0a000", | |
| "state": 4096, | |
| "offset": 10122608, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x63e1f000", | |
| "addr": "0x63e0b000", | |
| "state": 4096, | |
| "offset": 10126728, | |
| "type": 16777216, | |
| "size": 81920 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x63e20000", | |
| "addr": "0x63e1f000", | |
| "state": 4096, | |
| "offset": 10208672, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x63e57000", | |
| "addr": "0x63e20000", | |
| "state": 4096, | |
| "offset": 10212792, | |
| "type": 16777216, | |
| "size": 225280 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x63e58000", | |
| "addr": "0x63e57000", | |
| "state": 4096, | |
| "offset": 10438096, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x63e5b000", | |
| "addr": "0x63e58000", | |
| "state": 4096, | |
| "offset": 10442216, | |
| "type": 16777216, | |
| "size": 12288 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x63e6c000", | |
| "addr": "0x63e5b000", | |
| "state": 4096, | |
| "offset": 10454528, | |
| "type": 16777216, | |
| "size": 69632 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x63e7b000", | |
| "addr": "0x63e6c000", | |
| "state": 4096, | |
| "offset": 10524184, | |
| "type": 16777216, | |
| "size": 61440 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x63e7d000", | |
| "addr": "0x63e7b000", | |
| "state": 4096, | |
| "offset": 10585648, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x63e8b000", | |
| "addr": "0x63e7d000", | |
| "state": 4096, | |
| "offset": 10593864, | |
| "type": 16777216, | |
| "size": 57344 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x63ed5000", | |
| "addr": "0x63e8b000", | |
| "state": 4096, | |
| "offset": 10651232, | |
| "type": 16777216, | |
| "size": 303104 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x63fb3000", | |
| "addr": "0x63ed5000", | |
| "state": 4096, | |
| "offset": 10954360, | |
| "type": 16777216, | |
| "size": 909312 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x63fb4000", | |
| "addr": "0x63fb3000", | |
| "state": 4096, | |
| "offset": 11863696, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x63fbc000", | |
| "addr": "0x63fb4000", | |
| "state": 4096, | |
| "offset": 11867816, | |
| "type": 16777216, | |
| "size": 32768 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x63fbd000", | |
| "addr": "0x63fbc000", | |
| "state": 4096, | |
| "offset": 11900608, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x63fbf000", | |
| "addr": "0x63fbd000", | |
| "state": 4096, | |
| "offset": 11904728, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x63fc5000", | |
| "addr": "0x63fbf000", | |
| "state": 4096, | |
| "offset": 11912944, | |
| "type": 16777216, | |
| "size": 24576 | |
| }, { | |
| "protect": "r", | |
| "end": "0x70eb1000", | |
| "addr": "0x70eb0000", | |
| "state": 4096, | |
| "offset": 11937544, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x70eb5000", | |
| "addr": "0x70eb1000", | |
| "state": 4096, | |
| "offset": 11941664, | |
| "type": 16777216, | |
| "size": 16384 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x70eb6000", | |
| "addr": "0x70eb5000", | |
| "state": 4096, | |
| "offset": 11958072, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x70eb8000", | |
| "addr": "0x70eb6000", | |
| "state": 4096, | |
| "offset": 11962192, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x70ec1000", | |
| "addr": "0x70ec0000", | |
| "state": 4096, | |
| "offset": 11970408, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x70ed1000", | |
| "addr": "0x70ec1000", | |
| "state": 4096, | |
| "offset": 11974528, | |
| "type": 16777216, | |
| "size": 65536 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x70ed2000", | |
| "addr": "0x70ed1000", | |
| "state": 4096, | |
| "offset": 12040088, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x70ed4000", | |
| "addr": "0x70ed2000", | |
| "state": 4096, | |
| "offset": 12044208, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x723e1000", | |
| "addr": "0x723e0000", | |
| "state": 4096, | |
| "offset": 12052424, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x723ef000", | |
| "addr": "0x723e1000", | |
| "state": 4096, | |
| "offset": 12056544, | |
| "type": 16777216, | |
| "size": 57344 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x723f0000", | |
| "addr": "0x723ef000", | |
| "state": 4096, | |
| "offset": 12113912, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x723f2000", | |
| "addr": "0x723f0000", | |
| "state": 4096, | |
| "offset": 12118032, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x725b1000", | |
| "addr": "0x725b0000", | |
| "state": 4096, | |
| "offset": 12126248, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x725bf000", | |
| "addr": "0x725b1000", | |
| "state": 4096, | |
| "offset": 12130368, | |
| "type": 16777216, | |
| "size": 57344 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x725c0000", | |
| "addr": "0x725bf000", | |
| "state": 4096, | |
| "offset": 12187736, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x725c2000", | |
| "addr": "0x725c0000", | |
| "state": 4096, | |
| "offset": 12191856, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x72701000", | |
| "addr": "0x72700000", | |
| "state": 4096, | |
| "offset": 12200072, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x72706000", | |
| "addr": "0x72701000", | |
| "state": 4096, | |
| "offset": 12204192, | |
| "type": 16777216, | |
| "size": 20480 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x72707000", | |
| "addr": "0x72706000", | |
| "state": 4096, | |
| "offset": 12224696, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7270d000", | |
| "addr": "0x72707000", | |
| "state": 4096, | |
| "offset": 12228816, | |
| "type": 16777216, | |
| "size": 24576 | |
| }, { | |
| "protect": "r", | |
| "end": "0x72731000", | |
| "addr": "0x72730000", | |
| "state": 4096, | |
| "offset": 12253416, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x72734000", | |
| "addr": "0x72731000", | |
| "state": 4096, | |
| "offset": 12257536, | |
| "type": 16777216, | |
| "size": 12288 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x72735000", | |
| "addr": "0x72734000", | |
| "state": 4096, | |
| "offset": 12269848, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x72737000", | |
| "addr": "0x72735000", | |
| "state": 4096, | |
| "offset": 12273968, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x72741000", | |
| "addr": "0x72740000", | |
| "state": 4096, | |
| "offset": 12282184, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x72759000", | |
| "addr": "0x72741000", | |
| "state": 4096, | |
| "offset": 12286304, | |
| "type": 16777216, | |
| "size": 98304 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7275a000", | |
| "addr": "0x72759000", | |
| "state": 4096, | |
| "offset": 12384632, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7275c000", | |
| "addr": "0x7275a000", | |
| "state": 4096, | |
| "offset": 12388752, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x73cb1000", | |
| "addr": "0x73cb0000", | |
| "state": 4096, | |
| "offset": 12396968, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x73cc2000", | |
| "addr": "0x73cb1000", | |
| "state": 4096, | |
| "offset": 12401088, | |
| "type": 16777216, | |
| "size": 69632 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x73cc3000", | |
| "addr": "0x73cc2000", | |
| "state": 4096, | |
| "offset": 12470744, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x73cc6000", | |
| "addr": "0x73cc3000", | |
| "state": 4096, | |
| "offset": 12474864, | |
| "type": 16777216, | |
| "size": 12288 | |
| }, { | |
| "protect": "r", | |
| "end": "0x74eb1000", | |
| "addr": "0x74eb0000", | |
| "state": 4096, | |
| "offset": 12487176, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x74ee5000", | |
| "addr": "0x74eb1000", | |
| "state": 4096, | |
| "offset": 12491296, | |
| "type": 16777216, | |
| "size": 212992 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x74ee6000", | |
| "addr": "0x74ee5000", | |
| "state": 4096, | |
| "offset": 12704312, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x74ee7000", | |
| "addr": "0x74ee6000", | |
| "state": 4096, | |
| "offset": 12708432, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x74ee8000", | |
| "addr": "0x74ee7000", | |
| "state": 4096, | |
| "offset": 12712552, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x74eeb000", | |
| "addr": "0x74ee8000", | |
| "state": 4096, | |
| "offset": 12716672, | |
| "type": 16777216, | |
| "size": 12288 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75111000", | |
| "addr": "0x75110000", | |
| "state": 4096, | |
| "offset": 12728984, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75123000", | |
| "addr": "0x75111000", | |
| "state": 4096, | |
| "offset": 12733104, | |
| "type": 16777216, | |
| "size": 73728 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x75124000", | |
| "addr": "0x75123000", | |
| "state": 4096, | |
| "offset": 12806856, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75126000", | |
| "addr": "0x75124000", | |
| "state": 4096, | |
| "offset": 12810976, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x754e1000", | |
| "addr": "0x754e0000", | |
| "state": 4096, | |
| "offset": 12819192, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x754f7000", | |
| "addr": "0x754e1000", | |
| "state": 4096, | |
| "offset": 12823312, | |
| "type": 16777216, | |
| "size": 90112 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x754f8000", | |
| "addr": "0x754f7000", | |
| "state": 4096, | |
| "offset": 12913448, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x754fa000", | |
| "addr": "0x754f8000", | |
| "state": 4096, | |
| "offset": 12917568, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75561000", | |
| "addr": "0x75560000", | |
| "state": 4096, | |
| "offset": 12925784, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75569000", | |
| "addr": "0x75561000", | |
| "state": 4096, | |
| "offset": 12929904, | |
| "type": 16777216, | |
| "size": 32768 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7556a000", | |
| "addr": "0x75569000", | |
| "state": 4096, | |
| "offset": 12962696, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7556c000", | |
| "addr": "0x7556a000", | |
| "state": 4096, | |
| "offset": 12966816, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75601000", | |
| "addr": "0x75600000", | |
| "state": 4096, | |
| "offset": 12975032, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x7560b000", | |
| "addr": "0x75601000", | |
| "state": 4096, | |
| "offset": 12979152, | |
| "type": 16777216, | |
| "size": 40960 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7560c000", | |
| "addr": "0x7560b000", | |
| "state": 4096, | |
| "offset": 13020136, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7560e000", | |
| "addr": "0x7560c000", | |
| "state": 4096, | |
| "offset": 13024256, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75891000", | |
| "addr": "0x75890000", | |
| "state": 4096, | |
| "offset": 13032472, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x758d4000", | |
| "addr": "0x75891000", | |
| "state": 4096, | |
| "offset": 13036592, | |
| "type": 16777216, | |
| "size": 274432 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x758d6000", | |
| "addr": "0x758d4000", | |
| "state": 4096, | |
| "offset": 13311048, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x758da000", | |
| "addr": "0x758d6000", | |
| "state": 4096, | |
| "offset": 13319264, | |
| "type": 16777216, | |
| "size": 16384 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75911000", | |
| "addr": "0x75910000", | |
| "state": 4096, | |
| "offset": 13335672, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75983000", | |
| "addr": "0x75911000", | |
| "state": 4096, | |
| "offset": 13339792, | |
| "type": 16777216, | |
| "size": 466944 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x75984000", | |
| "addr": "0x75983000", | |
| "state": 4096, | |
| "offset": 13806760, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x75987000", | |
| "addr": "0x75984000", | |
| "state": 4096, | |
| "offset": 13810880, | |
| "type": 16777216, | |
| "size": 12288 | |
| }, { | |
| "protect": "r", | |
| "end": "0x759b0000", | |
| "addr": "0x75987000", | |
| "state": 4096, | |
| "offset": 13823192, | |
| "type": 16777216, | |
| "size": 167936 | |
| }, { | |
| "protect": "r", | |
| "end": "0x759b1000", | |
| "addr": "0x759b0000", | |
| "state": 4096, | |
| "offset": 13991152, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75af6000", | |
| "addr": "0x759b1000", | |
| "state": 4096, | |
| "offset": 13995272, | |
| "type": 16777216, | |
| "size": 1331200 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x75afa000", | |
| "addr": "0x75af6000", | |
| "state": 4096, | |
| "offset": 15326496, | |
| "type": 16777216, | |
| "size": 16384 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75b0c000", | |
| "addr": "0x75afa000", | |
| "state": 4096, | |
| "offset": 15342904, | |
| "type": 16777216, | |
| "size": 73728 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75b11000", | |
| "addr": "0x75b10000", | |
| "state": 4096, | |
| "offset": 15416656, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75bd6000", | |
| "addr": "0x75b11000", | |
| "state": 4096, | |
| "offset": 15420776, | |
| "type": 16777216, | |
| "size": 806912 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x75bd7000", | |
| "addr": "0x75bd6000", | |
| "state": 4096, | |
| "offset": 16227712, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75be4000", | |
| "addr": "0x75bd7000", | |
| "state": 4096, | |
| "offset": 16231832, | |
| "type": 16777216, | |
| "size": 53248 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75bf1000", | |
| "addr": "0x75bf0000", | |
| "state": 4096, | |
| "offset": 16285104, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75c87000", | |
| "addr": "0x75bf1000", | |
| "state": 4096, | |
| "offset": 16289224, | |
| "type": 16777216, | |
| "size": 614400 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x75c88000", | |
| "addr": "0x75c87000", | |
| "state": 4096, | |
| "offset": 16903648, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75c91000", | |
| "addr": "0x75c88000", | |
| "state": 4096, | |
| "offset": 16907768, | |
| "type": 16777216, | |
| "size": 36864 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75ca1000", | |
| "addr": "0x75ca0000", | |
| "state": 4096, | |
| "offset": 16944656, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75ca7000", | |
| "addr": "0x75ca1000", | |
| "state": 4096, | |
| "offset": 16948776, | |
| "type": 16777216, | |
| "size": 24576 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x75ca8000", | |
| "addr": "0x75ca7000", | |
| "state": 4096, | |
| "offset": 16973376, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75caa000", | |
| "addr": "0x75ca8000", | |
| "state": 4096, | |
| "offset": 16977496, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75cb1000", | |
| "addr": "0x75cb0000", | |
| "state": 4096, | |
| "offset": 16985712, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75cc4000", | |
| "addr": "0x75cb1000", | |
| "state": 4096, | |
| "offset": 16989832, | |
| "type": 16777216, | |
| "size": 77824 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x75cc5000", | |
| "addr": "0x75cc4000", | |
| "state": 4096, | |
| "offset": 17067680, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x75cc7000", | |
| "addr": "0x75cc5000", | |
| "state": 4096, | |
| "offset": 17071800, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75cc9000", | |
| "addr": "0x75cc7000", | |
| "state": 4096, | |
| "offset": 17080016, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75ce1000", | |
| "addr": "0x75ce0000", | |
| "state": 4096, | |
| "offset": 17088232, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75d49000", | |
| "addr": "0x75ce1000", | |
| "state": 4096, | |
| "offset": 17092352, | |
| "type": 16777216, | |
| "size": 425984 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x75d4a000", | |
| "addr": "0x75d49000", | |
| "state": 4096, | |
| "offset": 17518360, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75da9000", | |
| "addr": "0x75d4a000", | |
| "state": 4096, | |
| "offset": 17522480, | |
| "type": 16777216, | |
| "size": 389120 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75f51000", | |
| "addr": "0x75f50000", | |
| "state": 4096, | |
| "offset": 17911624, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x75fab000", | |
| "addr": "0x75f51000", | |
| "state": 4096, | |
| "offset": 17915744, | |
| "type": 16777216, | |
| "size": 368640 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x75fad000", | |
| "addr": "0x75fab000", | |
| "state": 4096, | |
| "offset": 18284408, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75fed000", | |
| "addr": "0x75fad000", | |
| "state": 4096, | |
| "offset": 18292624, | |
| "type": 16777216, | |
| "size": 262144 | |
| }, { | |
| "protect": "r", | |
| "end": "0x75ff1000", | |
| "addr": "0x75ff0000", | |
| "state": 4096, | |
| "offset": 18554792, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x76068000", | |
| "addr": "0x75ff1000", | |
| "state": 4096, | |
| "offset": 18558912, | |
| "type": 16777216, | |
| "size": 487424 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7606a000", | |
| "addr": "0x76068000", | |
| "state": 4096, | |
| "offset": 19046360, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x7606c000", | |
| "addr": "0x7606a000", | |
| "state": 4096, | |
| "offset": 19054576, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x76073000", | |
| "addr": "0x7606c000", | |
| "state": 4096, | |
| "offset": 19062792, | |
| "type": 16777216, | |
| "size": 28672 | |
| }, { | |
| "protect": "r", | |
| "end": "0x760b1000", | |
| "addr": "0x760b0000", | |
| "state": 4096, | |
| "offset": 19091488, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x76479000", | |
| "addr": "0x760b1000", | |
| "state": 4096, | |
| "offset": 19095608, | |
| "type": 16777216, | |
| "size": 3964928 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7647d000", | |
| "addr": "0x76479000", | |
| "state": 4096, | |
| "offset": 23060560, | |
| "type": 16777216, | |
| "size": 16384 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x76480000", | |
| "addr": "0x7647d000", | |
| "state": 4096, | |
| "offset": 23076968, | |
| "type": 16777216, | |
| "size": 12288 | |
| }, { | |
| "protect": "r", | |
| "end": "0x76cf9000", | |
| "addr": "0x76480000", | |
| "state": 4096, | |
| "offset": 23089280, | |
| "type": 16777216, | |
| "size": 8884224 | |
| }, { | |
| "protect": "r", | |
| "end": "0x76f01000", | |
| "addr": "0x76f00000", | |
| "state": 4096, | |
| "offset": 31973528, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x76f84000", | |
| "addr": "0x76f01000", | |
| "state": 4096, | |
| "offset": 31977648, | |
| "type": 16777216, | |
| "size": 536576 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x76f85000", | |
| "addr": "0x76f84000", | |
| "state": 4096, | |
| "offset": 32514248, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x76f86000", | |
| "addr": "0x76f85000", | |
| "state": 4096, | |
| "offset": 32518368, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x76fcc000", | |
| "addr": "0x76f86000", | |
| "state": 4096, | |
| "offset": 32522488, | |
| "type": 16777216, | |
| "size": 286720 | |
| }, { | |
| "protect": "r", | |
| "end": "0x76fd1000", | |
| "addr": "0x76fd0000", | |
| "state": 4096, | |
| "offset": 32809232, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x76fd3000", | |
| "addr": "0x76fd1000", | |
| "state": 4096, | |
| "offset": 32813352, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x76fd4000", | |
| "addr": "0x76fd3000", | |
| "state": 4096, | |
| "offset": 32821568, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x76fd6000", | |
| "addr": "0x76fd4000", | |
| "state": 4096, | |
| "offset": 32825688, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x772a1000", | |
| "addr": "0x772a0000", | |
| "state": 4096, | |
| "offset": 32833904, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x77326000", | |
| "addr": "0x772a1000", | |
| "state": 4096, | |
| "offset": 32838024, | |
| "type": 16777216, | |
| "size": 544768 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x77328000", | |
| "addr": "0x77326000", | |
| "state": 4096, | |
| "offset": 33382816, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7732f000", | |
| "addr": "0x77328000", | |
| "state": 4096, | |
| "offset": 33391032, | |
| "type": 16777216, | |
| "size": 28672 | |
| }, { | |
| "protect": "r", | |
| "end": "0x77341000", | |
| "addr": "0x77340000", | |
| "state": 4096, | |
| "offset": 33419728, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x77358000", | |
| "addr": "0x77341000", | |
| "state": 4096, | |
| "offset": 33423848, | |
| "type": 16777216, | |
| "size": 94208 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x77359000", | |
| "addr": "0x77358000", | |
| "state": 4096, | |
| "offset": 33518080, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7735f000", | |
| "addr": "0x77359000", | |
| "state": 4096, | |
| "offset": 33522200, | |
| "type": 16777216, | |
| "size": 24576 | |
| }, { | |
| "protect": "r", | |
| "end": "0x77361000", | |
| "addr": "0x77360000", | |
| "state": 4096, | |
| "offset": 33546800, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x773a9000", | |
| "addr": "0x77361000", | |
| "state": 4096, | |
| "offset": 33550920, | |
| "type": 16777216, | |
| "size": 294912 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x773aa000", | |
| "addr": "0x773a9000", | |
| "state": 4096, | |
| "offset": 33845856, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x773ab000", | |
| "addr": "0x773aa000", | |
| "state": 4096, | |
| "offset": 33849976, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x773ae000", | |
| "addr": "0x773ab000", | |
| "state": 4096, | |
| "offset": 33854096, | |
| "type": 16777216, | |
| "size": 12288 | |
| }, { | |
| "protect": "r", | |
| "end": "0x773b1000", | |
| "addr": "0x773b0000", | |
| "state": 4096, | |
| "offset": 33866408, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x77450000", | |
| "addr": "0x773b1000", | |
| "state": 4096, | |
| "offset": 33870528, | |
| "type": 16777216, | |
| "size": 651264 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x77451000", | |
| "addr": "0x77450000", | |
| "state": 4096, | |
| "offset": 34521816, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x77452000", | |
| "addr": "0x77451000", | |
| "state": 4096, | |
| "offset": 34525936, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x77454000", | |
| "addr": "0x77452000", | |
| "state": 4096, | |
| "offset": 34530056, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x77457000", | |
| "addr": "0x77454000", | |
| "state": 4096, | |
| "offset": 34538272, | |
| "type": 16777216, | |
| "size": 12288 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7745c000", | |
| "addr": "0x77457000", | |
| "state": 4096, | |
| "offset": 34550584, | |
| "type": 16777216, | |
| "size": 20480 | |
| }, { | |
| "protect": "r", | |
| "end": "0x774c1000", | |
| "addr": "0x774c0000", | |
| "state": 4096, | |
| "offset": 34571088, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x77597000", | |
| "addr": "0x774c1000", | |
| "state": 4096, | |
| "offset": 34575208, | |
| "type": 16777216, | |
| "size": 876544 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x77598000", | |
| "addr": "0x77597000", | |
| "state": 4096, | |
| "offset": 35451776, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x77599000", | |
| "addr": "0x77598000", | |
| "state": 4096, | |
| "offset": 35455896, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7759b000", | |
| "addr": "0x77599000", | |
| "state": 4096, | |
| "offset": 35460016, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x7759c000", | |
| "addr": "0x7759b000", | |
| "state": 4096, | |
| "offset": 35468232, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7759e000", | |
| "addr": "0x7759c000", | |
| "state": 4096, | |
| "offset": 35472352, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "rwc", | |
| "end": "0x775a0000", | |
| "addr": "0x7759e000", | |
| "state": 4096, | |
| "offset": 35480568, | |
| "type": 16777216, | |
| "size": 8192 | |
| }, { | |
| "protect": "r", | |
| "end": "0x775fc000", | |
| "addr": "0x775a0000", | |
| "state": 4096, | |
| "offset": 35488784, | |
| "type": 16777216, | |
| "size": 376832 | |
| }, { | |
| "protect": "r", | |
| "end": "0x77651000", | |
| "addr": "0x77650000", | |
| "state": 4096, | |
| "offset": 35865640, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x77677000", | |
| "addr": "0x77651000", | |
| "state": 4096, | |
| "offset": 35869760, | |
| "type": 16777216, | |
| "size": 155648 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x77678000", | |
| "addr": "0x77677000", | |
| "state": 4096, | |
| "offset": 36025432, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x77685000", | |
| "addr": "0x77678000", | |
| "state": 4096, | |
| "offset": 36029552, | |
| "type": 16777216, | |
| "size": 53248 | |
| }, { | |
| "protect": "r", | |
| "end": "0x77691000", | |
| "addr": "0x77690000", | |
| "state": 4096, | |
| "offset": 36082824, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "rx", | |
| "end": "0x776e2000", | |
| "addr": "0x77691000", | |
| "state": 4096, | |
| "offset": 36086944, | |
| "type": 16777216, | |
| "size": 331776 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x776e3000", | |
| "addr": "0x776e2000", | |
| "state": 4096, | |
| "offset": 36418744, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x776e7000", | |
| "addr": "0x776e3000", | |
| "state": 4096, | |
| "offset": 36422864, | |
| "type": 16777216, | |
| "size": 16384 | |
| }, { | |
| "protect": "r", | |
| "end": "0x77701000", | |
| "addr": "0x77700000", | |
| "state": 4096, | |
| "offset": 36439272, | |
| "type": 16777216, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7f6f5000", | |
| "addr": "0x7f6f0000", | |
| "state": 4096, | |
| "offset": 36443392, | |
| "type": 262144, | |
| "size": 20480 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7ffd3000", | |
| "addr": "0x7ffb0000", | |
| "state": 4096, | |
| "offset": 36463896, | |
| "type": 262144, | |
| "size": 143360 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7ffda000", | |
| "addr": "0x7ffd9000", | |
| "state": 4096, | |
| "offset": 36607280, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7ffdb000", | |
| "addr": "0x7ffda000", | |
| "state": 4096, | |
| "offset": 36611400, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7ffdd000", | |
| "addr": "0x7ffdc000", | |
| "state": 4096, | |
| "offset": 36615520, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7ffdf000", | |
| "addr": "0x7ffde000", | |
| "state": 4096, | |
| "offset": 36619640, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "rw", | |
| "end": "0x7ffe0000", | |
| "addr": "0x7ffdf000", | |
| "state": 4096, | |
| "offset": 36623760, | |
| "type": 131072, | |
| "size": 4096 | |
| }, { | |
| "protect": "r", | |
| "end": "0x7ffe1000", | |
| "addr": "0x7ffe0000", | |
| "state": 4096, | |
| "offset": 36627880, | |
| "type": 131072, | |
| "size": 4096 | |
| }], | |
| "yara": [], | |
| "num": 1, | |
| "file": "/home/cuckoo/.cuckoo/storage/analyses/1180/memory/1008-1.dmp", | |
| "urls": ["http://www.expedia.com/favicon.ico", "http://uk.ask.com/favicon.ico", "http://www.priceminister.com/", "http://www.iask.com/favicon.ico", "http://www.merlin.com.pl/favicon.ico", "http://www.cnet.com/favicon.ico", "http://search.nifty.com/", "http://ns.adobe.com/exif/1.0/", "http://www.etmall.com.tw/", "http://search.goo.ne.jp/", "http://fr.wikipedia.org/favicon.ico", "http://busca.estadao.com.br/favicon.ico", "http://search.hanafos.com/favicon.ico", "http://search.chol.com/favicon.ico", "http://amazon.fr/", "http://www.amazon.co.jp/", "http://www.mtv.com/favicon.ico", "http://busqueda.aol.com.mx/", "http://search.live.com/results.aspx?FORM=SOLTDF", "http://msdn.microsoft.com/", "http://msdn.microsoft.com/workshop/security/privacy/overview/privacyimportxml.asp)", "http://www.sify.com/favicon.ico", "http://yellowpages.superpages.com/", "http://suche.freenet.de/", "http://search.aol.com/", "http://browse.guardian.co.uk/", "http://www.mercadolibre.com.mx/", "http://www.asharqalawsat.com/", "http://www.facebook.com/", "http://si.wikipedia.org/favicon.ico", "http://www.rtl.de/favicon.ico", "http://search.msn.com/results.aspx?q=", "http://www.microsoft.com.", "http://search.naver.com/favicon.ico", "http://en.wikipedia.org/favicon.ico", "http://si.wikipedia.org/w/api.php?action=opensearch", "http://udn.com/favicon.ico", "http://rover.ebay.com", "http://search.ebay.fr/", "http://www.univision.com/", "http://pt.wikipedia.org/w/api.php?action=opensearch", "http://it.wikipedia.org/favicon.ico", "http://uk.ask.com/", "http://www.google.co.uk/", "http://cnweb.search.live.com/results.aspx?q=", "http://www.google.cz/", "http://www.google.co.jp/", "http://search.ebay.co.uk/", "http://www.weather.com/", "http://www.taobao.com/favicon.ico", "http://www.news.com.au/favicon.ico", "http://search.orange.co.uk/favicon.ico", "http://video.globo.com/", "http://search.ebay.de/", "http://www.taobao.com/", "http://corp.naukri.com/favicon.ico", "http://www.servicios.clarin.com/", "http://localhost", "http://www.rambler.ru/favicon.ico", "http://www.linternaute.com/favicon.ico", "http://ns.adobe.com/photoshop/1.0/", "http://www.shopzilla.com/", "http://www.amazon.com/gp/search?ie=UTF8", "http://search.live.com/results.aspx?FORM=SO2TDF", "http://busca.orange.es/", "http://www.excite.co.jp/", "http://cs.wikipedia.org/", "http://www.gismeteo.ru/favicon.ico", "http://www.cjmall.com/favicon.ico", "http://suche.t-online.de/", "http://www.ya.com/favicon.ico", "http://www.priceminister.com/favicon.ico", "http://www.mercadolibre.com.mx/favicon.ico", "http://ns.adobe.com/tiff/1.0/", "http://www.otto.de/favicon.ico", "http://www.iask.com/", "http://www.arrakis.com/", "http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity", "http://search.hanafos.com/", "http://search.gamer.com.tw/", "http://www.tiscali.it/favicon.ico", "http://ns.adobe.com/xap/1.0/", "http://www.soso.com/favicon.ico", "http://recherche.tf1.fr/", "http://si.wikipedia.org/", "http://search.livedoor.com/", "http://search.centrum.cz/", "http://www.auction.co.kr/auction.ico", "http://www.t-online.de/favicon.ico", "http://ja.wikipedia.org/favicon.ico", "http://www.abril.com.br/favicon.ico", "http://clients5.google.com/complete/search?hl=", "http://www.ozon.ru/", "http://search.alice.it/", "http://www.microsoft.com/windowsxp/expertzone/", "http://search.yahoo.co.jp/favicon.ico", "http://cnet.search.com/", "http://www.walmart.com/", "http://espn.go.com/favicon.ico", "http://msdn.microsoft.com/workshop/security/szone/overview/templates.asp)", "http://search.interpark.com/", "http://www.gmarket.co.kr/favicon.ico", "http://www.neckermann.de/favicon.ico", "http://sitesearch.timesonline.co.uk/", "http://cn.bing.com/search?q=", "http://video.globo.com/favicon.ico", "http://es.wikipedia.org/", "http://img.atlas.cz/favicon.ico", "http://searchresults.news.com.au/", "http://search.rediff.com/", "http://search.lycos.co.uk/", "http://en.wikipedia.org/", "http://www.google.com.tw/", "http://www.tchibo.de/", "http://www.google.com/", "http://buscador.terra.es/", "http://search.msn.co.jp/results.aspx?q=", "http://www.mercadolivre.com.br/favicon.ico", "http://ja.wikipedia.org/", "http://search.chol.com/", "http://search.espn.go.com/", "http://www.google.com.sa/", "http://jobsearch.monster.com/", "http://buscador.terra.com/", "http://www.google.co.in/", "http://www.google.fr/", "http://www.cdiscount.com/favicon.ico", "http://asp.usatoday.com/", "http://vachercher.lycos.fr/", "http://www.yam.com/favicon.ico", "http://search.sify.com/", "http://search.ebay.com/favicon.ico", "http://www.paginasamarillas.es/", "http://nl.wikipedia.org/", "http://search.alice.it/favicon.ico", "http://www.ask.com/", "http://www.so-net.ne.jp/share/favicon.ico", "http://espanol.search.yahoo.com/", "http://www.alarabiya.net/favicon.ico", "http://ocnsearch.goo.ne.jp/", "http://list.taobao.com/", "http://buscador.terra.com.br/", "http://search.msn.co.uk/results.aspx?q=", "http://www.google.de/", "http://busca.igbusca.com.br//app/static/images/favicon.ico", "http://www.rambler.ru/", "http://purl.org/dc/elements/1.1/", "http://www.cdiscount.com/", "http://www.mercadolivre.com.br/", "http://www.facebook.com/favicon.ico", "http://search.ebay.es/", "http://sads.myspace.com/", "http://suche.web.de/", "http://recherche.tf1.fr/favicon.ico", "http://cs.wikipedia.org/w/api.php?action=opensearch", "http://search.dreamwiz.com/", "http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService", "http://www.yandex.ru/", "http://www.baidu.com/favicon.ico", "http://ariadna.elmundo.es/", "http://www.rtl.de/", "http://es.search.yahoo.com/", "http://p.zhongsou.com/", "http://es.wikipedia.org/favicon.ico", "http://www.timesonline.co.uk/img/favicon.ico", "http://buscar.ozu.es/", "http://so-net.search.goo.ne.jp/", "http://cgi.search.biglobe.ne.jp/favicon.ico", "http://list.taobao.com/browse/search_visual.htm?n=15", "http://www.soso.com/", "http://www.afisha.ru/App_Themes/Default/images/favicon.ico", "http://img.shopzilla.com/shopzilla/shopzilla.ico", "http://wellformedweb.org/CommentAPI/", "http://search.orange.co.uk/", "http://ariadna.elmundo.es/favicon.ico", "http://it.wikipedia.org/", "http://www3.fnac.com/favicon.ico", "http://en.wikipedia.org/w/api.php?action=opensearch", "http://support.microsoft.com", "http://in.search.yahoo.com/", "http://www.etmall.com.tw/favicon.ico", "http://www.ceneo.pl/favicon.ico", "http://service2.bfast.com/", "http://tw.search.yahoo.com/", "http://es.ask.com/", "http://www.ozu.es/favicon.ico", "http://ru.wikipedia.org/", "http://google.pchome.com.tw/", "http://p.zhongsou.com/favicon.ico", "http://search.ebay.com/", "http://search1.taobao.com/", "http://br.search.yahoo.com/", "http://suche.lycos.de/", "http://www.asharqalawsat.com/favicon.ico", "http://mail.live.com/", "http://ru.search.yahoo.com", "http://de.wikipedia.org/", "http://find.joins.com/", "http://ns.adobe.com/xap/1.0/mm/", "http://www.google.ru/", "http://busca.uol.com.br/favicon.ico", "http://search.seznam.cz/", "http://de.wikipedia.org/w/api.php?action=opensearch", "http://www.expedia.com/", "http://www.clarin.com/favicon.ico", "http://busca.uol.com.br/", "http://mail.live.com/?rru=compose%3Fsubject%3D", "http://buscador.terra.com/favicon.ico", "http://search.nate.com/", "http://purl.org/rss/1.0/modules/slash/", "http://ie8.ebay.com/open-search/output-xml.php?q=", "http://www.kkbox.com.tw/favicon.ico", "http://www.ocn.ne.jp/favicon.ico", "http://corp.naukri.com/", "http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended", "http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity", "http://www.recherche.aol.fr/", "http://pl.wikipedia.org/w/api.php?action=opensearch", "http://www.weather.com/favicon.ico", "http://search.centrum.cz/favicon.ico", "http://search.yam.com/", "http://search.live.com/results.aspx?q=", "http://search.empas.com/favicon.ico", "http://images.joins.com/ui_c/fvc_joins.ico", "http://cgi.search.biglobe.ne.jp/", "http://msk.afisha.ru/", "http://es.wikipedia.org/w/api.php?action=opensearch", "http://www.google.pl/", "http://www.arrakis.com/favicon.ico", "http://search.microsoft.com/", "http://search.goo.ne.jp/favicon.ico", "http://image.excite.co.jp/jp/favicon/lep.ico", "http://www.merlin.com.pl/", "http://www.amazon.de/", "http://www.sogou.com/", "http://cerca.lycos.it/", "http://www.orange.fr/", "http://spaces.live.com/BlogIt.aspx", "http://www.microsofttranslator.com/?ref=IE8Activity", "http://www.rakuten.co.jp/favicon.ico", "http://www.nate.com/favicon.ico", "http://de.wikipedia.org/favicon.ico", "http://ru.wikipedia.org/w/api.php?action=opensearch", "http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity", "http://search.daum.net/favicon.ico", "http://nl.wikipedia.org/favicon.ico", "http://it.search.yahoo.com/", "http://www.google.it/", "http://suche.web.de/favicon.ico", "http://www.paginasamarillas.es/favicon.ico", "http://search.seznam.cz/favicon.ico", "http://search.livedoor.com/favicon.ico", "http://search.lycos.com/", "http://fr.wikipedia.org/w/api.php?action=opensearch", "http://search.dreamwiz.com/favicon.ico", "http://www.kkbox.com.tw/", "http://suche.aol.de/", "http://it.search.dada.net/", "http://search.empas.com/", "http://yellowpages.superpages.com/favicon.ico", "http://arianna.libero.it/", "http://www.dailymail.co.uk/", "http://ru.wikipedia.org/favicon.ico", "http://search.auction.co.kr/", "http://search.lycos.com/favicon.ico", "http://www3.fnac.com/", "http://search.yahoo.co.jp", "http://asp.usatoday.com/favicon.ico", "http://search.msn.com.cn/results.aspx?q=", "http://cn.bing.com/favicon.ico", "http://search2.estadao.com.br/", "http://search.cn.yahoo.com/", "http://ie.search.yahoo.com/os?command=", "http://www.tesco.com/", "http://search-dyn.tiscali.it/", "http://search.ipop.co.kr/favicon.ico", "http://arianna.libero.it/favicon.ico", "http://www.myspace.com/favicon.ico", "http://search.gismeteo.ru/", "http://www.dailymail.co.uk/favicon.ico", "http://www.microsoft.com/schemas/rss/core/2005/internal", "http://home.altervista.org/", "http://it.search.dada.net/favicon.ico", "http://www.gmarket.co.kr/", "http://price.ru/favicon.ico", "http://www.google.com.br/", "http://buscar.ya.com/", "http://images.monster.com/favicon.ico", "http://search.ebay.it/", "http://www.alarabiya.net/", "http://www.najdi.si/", "http://www.maktoob.com/favicon.ico", "http://purl.org/rss/1.0/modules/content/", "http://ns.adobe.com/pdf/1.3/", "http://price.ru/", "http://www.najdi.si/favicon.ico", "http://kr.search.yahoo.com/", "http://www.aol.com/favicon.ico", "http://www.ozon.ru/favicon.ico", "http://pl.wikipedia.org/", "http://www.target.com/favicon.ico", "http://fr.search.yahoo.com/", "http://search.daum.net/", "http://de.search.yahoo.com/", "http://suche.freenet.de/favicon.ico", "http://busca.buscape.com.br/favicon.ico", "http://www.microsoft.com/favicon.ico", "http://auone.jp/favicon.ico", "http://buscador.lycos.es/", "http://search.yahoo.com/", "http://www.sogou.com/favicon.ico", "http://search.rediff.com/favicon.ico", "http://search.auone.jp/", "http://web.ask.com/", "http://search.books.com.tw/", "http://search.ebay.in/", "http://search.about.com/", "http://www.neckermann.de/", "http://browse.guardian.co.uk/favicon.ico", "http://www.tesco.com/favicon.ico", "http://ns.adobe.com/iX/1.0/", "https://www.example.com.", "http://www.target.com/", "http://www.amazon.com/favicon.ico", "http://recherche.linternaute.com/", "http://pt.wikipedia.org/favicon.ico", "http://openimage.interpark.com/interpark.ico", "http://www.google.si/", "http://www.yandex.ru/favicon.ico", "http://www.google.com/favicon.ico", "http://www.walmart.com/favicon.ico", "http://udn.com/", "http://esearch.rakuten.co.jp/", "http://www.google.es/", "http://www.cnet.co.uk/", "http://www.mtv.com/", "http://search.live.com/results.aspx?FORM=IEFM1", "http://www.abril.com.br/", "http://www.baidu.com/", "http://www.amazon.co.uk/", "http://it.wikipedia.org/w/api.php?action=opensearch", "http://www.tchibo.de/favicon.ico", "http://www.pchome.com.tw/favicon.ico", "http://pt.wikipedia.org/", "http://fr.wikipedia.org/", "http://ja.wikipedia.org/w/api.php?action=opensearch", "http://www.chennaionline.com/ncommon/images/collogo.ico", "http://www.cjmall.com/", "http://uk.search.yahoo.com/", "http://search.yahoo.com/favicon.ico", "http://busca.igbusca.com.br/", "https://localhost", "http://www.nifty.com/favicon.ico", "http://search.naver.com/", "http://home.altervista.org/favicon.ico", "http://search.gamer.com.tw/favicon.ico", "http://busca.buscape.com.br/", "http://search.atlas.cz/", "http://www.ceneo.pl/", "http://search.aol.co.uk/", "http://pl.wikipedia.org/favicon.ico", "http://search.ipop.co.kr/", "http://search.books.com.tw/favicon.ico", "http://search.aol.in/", "https://example.com", "http://cs.wikipedia.org/favicon.ico", "http://spaces.live.com/", "http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity", "http://z.about.com/m/a08.ico", "http://www.univision.com/favicon.ico", "http://nl.wikipedia.org/w/api.php?action=opensearch"], | |
| "extracted": [{ | |
| "yara": [{ | |
| "meta": { | |
| "description": "Possibly employs anti-virtualization techniques", | |
| "author": "nex" | |
| }, | |
| "name": "vmdetect", | |
| "offsets": { | |
| "virtualbox6": [ | |
| ["40298", 10], | |
| ["40556", 10] | |
| ], | |
| "virtualbox5": [ | |
| ["40174", 9], | |
| ["40512", 9] | |
| ], | |
| "virtualbox4": [ | |
| ["40214", 8], | |
| ["40468", 8] | |
| ], | |
| "virtualbox3": [ | |
| ["37536", 12], | |
| ["37565", 12], | |
| ["37705", 20], | |
| ["41100", 20], | |
| ["41291", 12], | |
| ["41312", 12], | |
| ["41358", 12], | |
| ["41379", 12], | |
| ["41488", 20], | |
| ["41528", 20] | |
| ], | |
| "virtualbox2": [ | |
| ["37688", 19], | |
| ["40254", 11], | |
| ["41064", 19], | |
| ["41421", 19], | |
| ["41464", 19] | |
| ], | |
| "virtualbox1": [ | |
| ["40708", 18] | |
| ], | |
| "xen6": [ | |
| ["42676", 13], | |
| ["42682", 13] | |
| ], | |
| "virtualbox_mac_1b": [ | |
| ["37426", 4], | |
| ["37476", 4] | |
| ], | |
| "vmware_mac_4b": [ | |
| ["38450", 2], | |
| ["38532", 2] | |
| ], | |
| "vmware_mac_3b": [ | |
| ["38440", 1], | |
| ["38522", 1] | |
| ], | |
| "vmware24": [ | |
| ["37803", 5], | |
| ["37823", 16], | |
| ["37832", 7], | |
| ["38028", 5], | |
| ["38070", 5], | |
| ["38083", 5], | |
| ["38119", 5], | |
| ["38132", 5], | |
| ["38148", 5], | |
| ["38268", 5], | |
| ["38384", 5], | |
| ["38556", 5], | |
| ["38636", 5], | |
| ["38688", 5], | |
| ["41884", 6], | |
| ["42153", 5], | |
| ["42166", 5], | |
| ["42275", 5], | |
| ["42300", 7], | |
| ["42663", 5], | |
| ["42669", 5] | |
| ], | |
| "vmware_mac_1b": [ | |
| ["38430", 0], | |
| ["38512", 0] | |
| ], | |
| "vmware20": [ | |
| ["38201", 17], | |
| ["38256", 17], | |
| ["42208", 17] | |
| ], | |
| "vmware5": [ | |
| ["38322", 15], | |
| ["38373", 15], | |
| ["42249", 15] | |
| ], | |
| "vmware4": [ | |
| ["38323", 14], | |
| ["38374", 14], | |
| ["42250", 14] | |
| ], | |
| "vmware_mac_2b": [ | |
| ["38462", 3], | |
| ["38544", 3] | |
| ] | |
| }, | |
| "strings": ["MDA6MDU6Njk=", "MDA6MEM6Mjk=", "MDA6MUM6MTQ=", "MDA6NTA6NTY=", "MDg6MDA6Mjc=", "Vk13YXJl", "Vk1XQVJF", "Vk1XYXJl", "VkJveE1vdXNl", "VkJveEd1ZXN0", "VkJveFNG", "VkJveFNlcnZpY2U=", "VkJveFRyYXk=", "WGVuVk1N", "aGdmcy5zeXM=", "bWhnZnMuc3lz", "dm13YXJl", "dm1tb3VzZQ==", "dmJveGhvb2suZGxs", "dmJveHNlcnZpY2U=", "dmJveHRyYXk="] | |
| }], | |
| "sha1": "3f1d3e276e2aa0a6f930803140ae919e5ecdbf5c", | |
| "name": "1008-3f1d3e276e2aa0a6.exe_", | |
| "type": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows", | |
| "extracted_id": "5d02dd4559bfaf1280fee9c0", | |
| "sha256": "3901b91bda860b624467cb5678e8d47f70476c7a9752a9364a3044a03c7c547a", | |
| "urls": [], | |
| "crc32": "0C1405F3", | |
| "path": "/home/cuckoo/.cuckoo/storage/analyses/1180/memory/1008-3f1d3e276e2aa0a6.exe_", | |
| "ssdeep": null, | |
| "size": 102400, | |
| "sha512": "55e1f6c291d14a9dc3440cbe8d023f2f591bedbb5c2a7127f88b647b535480646dd4ad30f0510a6ac837b82a1e1ad2f32c3d474ce9c2af8999524814849fa363", | |
| "md5": "10edbc14794583239d0b7e698d1e35e7" | |
| }], | |
| "pid": 1008 | |
| }], | |
| "target": { | |
| "category": "file", | |
| "file_id": "5cdb795059bfaf4ded9b0b4f", | |
| "file": { | |
| "yara": [{ | |
| "meta": { | |
| "description": "Possibly employs anti-virtualization techniques", | |
| "author": "nex" | |
| }, | |
| "name": "vmdetect", | |
| "offsets": { | |
| "virtualbox6": [ | |
| ["29546", 10], | |
| ["29804", 10] | |
| ], | |
| "virtualbox5": [ | |
| ["29422", 9], | |
| ["29760", 9] | |
| ], | |
| "virtualbox4": [ | |
| ["29462", 8], | |
| ["29716", 8] | |
| ], | |
| "virtualbox3": [ | |
| ["26784", 12], | |
| ["26813", 12], | |
| ["26953", 20], | |
| ["30348", 20], | |
| ["30539", 12], | |
| ["30560", 12], | |
| ["30606", 12], | |
| ["30627", 12], | |
| ["30736", 20], | |
| ["30776", 20] | |
| ], | |
| "virtualbox2": [ | |
| ["26936", 19], | |
| ["29502", 11], | |
| ["30312", 19], | |
| ["30669", 19], | |
| ["30712", 19] | |
| ], | |
| "virtualbox1": [ | |
| ["29956", 18] | |
| ], | |
| "xen6": [ | |
| ["31924", 13], | |
| ["31930", 13] | |
| ], | |
| "virtualbox_mac_1b": [ | |
| ["26674", 4], | |
| ["26724", 4] | |
| ], | |
| "vmware_mac_4b": [ | |
| ["27698", 2], | |
| ["27780", 2] | |
| ], | |
| "vmware_mac_3b": [ | |
| ["27688", 1], | |
| ["27770", 1] | |
| ], | |
| "vmware24": [ | |
| ["27051", 5], | |
| ["27071", 16], | |
| ["27080", 7], | |
| ["27276", 5], | |
| ["27318", 5], | |
| ["27331", 5], | |
| ["27367", 5], | |
| ["27380", 5], | |
| ["27396", 5], | |
| ["27516", 5], | |
| ["27632", 5], | |
| ["27804", 5], | |
| ["27884", 5], | |
| ["27936", 5], | |
| ["31132", 6], | |
| ["31401", 5], | |
| ["31414", 5], | |
| ["31523", 5], | |
| ["31548", 7], | |
| ["31911", 5], | |
| ["31917", 5] | |
| ], | |
| "vmware_mac_1b": [ | |
| ["27678", 0], | |
| ["27760", 0] | |
| ], | |
| "vmware20": [ | |
| ["27449", 17], | |
| ["27504", 17], | |
| ["31456", 17] | |
| ], | |
| "vmware5": [ | |
| ["27570", 15], | |
| ["27621", 15], | |
| ["31497", 15] | |
| ], | |
| "vmware4": [ | |
| ["27571", 14], | |
| ["27622", 14], | |
| ["31498", 14] | |
| ], | |
| "vmware_mac_2b": [ | |
| ["27710", 3], | |
| ["27792", 3] | |
| ] | |
| }, | |
| "strings": ["MDA6MDU6Njk=", "MDA6MEM6Mjk=", "MDA6MUM6MTQ=", "MDA6NTA6NTY=", "MDg6MDA6Mjc=", "Vk13YXJl", "Vk1XQVJF", "Vk1XYXJl", "VkJveE1vdXNl", "VkJveEd1ZXN0", "VkJveFNG", "VkJveFNlcnZpY2U=", "VkJveFRyYXk=", "WGVuVk1N", "aGdmcy5zeXM=", "bWhnZnMuc3lz", "dm13YXJl", "dm1tb3VzZQ==", "dmJveGhvb2suZGxs", "dmJveHNlcnZpY2U=", "dmJveHRyYXk="] | |
| }], | |
| "sha1": "124f46228d1e220d88ae5e9a24d6e713039a64f9", | |
| "name": "pafish.exe", | |
| "type": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows", | |
| "sha256": "2180f4a13add5e346e8cf6994876a9d2f5eac3fcb695db8569537010d24cd6d5", | |
| "urls": [], | |
| "crc32": "6F030481", | |
| "path": "/home/cuckoo/.cuckoo/storage/binaries/2180f4a13add5e346e8cf6994876a9d2f5eac3fcb695db8569537010d24cd6d5", | |
| "ssdeep": null, | |
| "size": 76800, | |
| "sha512": "4b6d56b81dd3cd42bb53fc8d68b5c8ef0d6c85ebcc503cd042ae5c19e8965e6477f259a02bafb9c5c66956ae1023fc30e3be5bbcd526eacc8480f93d74c1ab7c", | |
| "md5": "9159edb64c4a21d8888d088bf2db23f3" | |
| } | |
| }, | |
| "shots": [], | |
| "extracted": [], | |
| "signatures": [{ | |
| "markcount": 2, | |
| "families": [], | |
| "description": "Queries for the computername", | |
| "severity": 1, | |
| "marks": [{ | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "GetComputerNameW", | |
| "return_value": "1", | |
| "arguments": { | |
| "computer_name": "WIN-QQK6CL8VR7N" | |
| }, | |
| "time": "2019-06-14T20:31:03.167Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 465 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "GetComputerNameW", | |
| "return_value": "1", | |
| "arguments": { | |
| "computer_name": "WIN-QQK6CL8VR7N" | |
| }, | |
| "time": "2019-06-14T20:31:05.140Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 564 | |
| }], | |
| "references": [], | |
| "name": "antivm_queries_computername" | |
| }, { | |
| "markcount": 1, | |
| "families": [], | |
| "description": "Checks if process is being debugged by a debugger", | |
| "severity": 1, | |
| "marks": [{ | |
| "call": { | |
| "category": "system", | |
| "status": 0, | |
| "stacktrace": [], | |
| "last_error": 183, | |
| "nt_status": -1073741515, | |
| "api": "IsDebuggerPresent", | |
| "return_value": "0", | |
| "arguments": {}, | |
| "time": "2019-06-14T20:31:00.694Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 31 | |
| }], | |
| "references": [], | |
| "name": "checks_debugger" | |
| }, { | |
| "markcount": 128, | |
| "families": [], | |
| "description": "Command line console output was observed", | |
| "severity": 1, | |
| "marks": [{ | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "* Pafish (", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.624Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 9 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "Paranoid fish", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.624Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 10 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "Some anti(debugger/VM/sandbox) tricks\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.634Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 12 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "used by malware for the general public.\r\n\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.634Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 13 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Windows version: 6.1 build 7600\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.644Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 14 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] CPU: GenuineIntel\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.644Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 15 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": " Hypervisor: KVMKVMKVM\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.644Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 16 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": " CPU brand: Intel Core Processor (Haswell, no TSX, IBRS)\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.644Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 17 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "\r\n[-] Debuggers detection\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.694Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 30 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Using IsDebuggerPresent() ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.704Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 32 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "OK\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.704Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 33 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "\r\n[-] CPU information based detections\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.714Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 34 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking the difference between CPU timestamp counters (rdtsc) ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.814Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 45 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.864Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 52 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking the difference between CPU timestamp counters (rdtsc) forcing VM exit ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.974Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 67 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:00.994Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 74 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking hypervisor bit in cpuid feature bits ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.014Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 79 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.054Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 86 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking cpuid hypervisor vendor for known VM vendors ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.074Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 91 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.084Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 98 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "\r\n[-] Generic sandbox detection\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.104Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 103 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Using mouse activity ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.114Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 107 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.154Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 114 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking username ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.174Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 120 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "OK\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.194Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 121 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking file path ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.194Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 122 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "OK\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.194Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 123 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking common sample names in drives root ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.375Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 136 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "OK\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.395Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 137 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking if disk size <= 60GB via DeviceIoControl() ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.415Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 141 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.445Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 148 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking if disk size <= 60GB via GetDiskFreeSpaceExA() ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.465Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 154 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.525Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 161 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking if Sleep() is patched using GetTickCount() ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.555Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 167 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "OK\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.565Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 168 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking if NumberOfProcessors is < 2 via raw access ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.565Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 169 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.605Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 176 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking if NumberOfProcessors is < 2 via GetSystemInfo() ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.615Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 182 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.665Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 189 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking if pysical memory is < 1Gb ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.685Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 195 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.715Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 202 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking operating system uptime using GetTickCount() ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.735Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 207 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "OK\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.735Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 208 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking if operating system IsNativeVhdBoot() ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.745Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 211 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "OK\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.755Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 212 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "\r\n[-] Hooks detection\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.795Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 213 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking function ShellExecuteExW method 1 ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.795Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 214 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "traced!\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.825Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 221 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "[*] Checking function CreateProcessA method 1 ... ", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.845Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 226 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "WriteConsoleA", | |
| "return_value": "1", | |
| "arguments": { | |
| "buffer": "OK\r\n", | |
| "console_handle": "0x00000007" | |
| }, | |
| "time": "2019-06-14T20:31:01.855Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 227 | |
| }], | |
| "references": [], | |
| "name": "console_output" | |
| }, { | |
| "markcount": 1, | |
| "families": [], | |
| "description": "Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate)", | |
| "severity": 1, | |
| "marks": [{ | |
| "category": "registry", | |
| "ioc": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\SystemBiosDate", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "recon_fingerprint" | |
| }, { | |
| "markcount": 1, | |
| "families": [], | |
| "description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available", | |
| "severity": 1, | |
| "marks": [{ | |
| "call": { | |
| "category": "system", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "GlobalMemoryStatusEx", | |
| "return_value": "1", | |
| "arguments": {}, | |
| "time": "2019-06-14T20:31:01.685Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 194 | |
| }], | |
| "references": [], | |
| "name": "antivm_memory_available" | |
| }, { | |
| "markcount": 2, | |
| "families": [], | |
| "description": "Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation", | |
| "severity": 2, | |
| "marks": [{ | |
| "call": { | |
| "category": "file", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "DeviceIoControl", | |
| "return_value": "1", | |
| "arguments": { | |
| "input_buffer": "", | |
| "device_handle": "0x000000d0", | |
| "control_code": 475228, | |
| "output_buffer": "\u0000\u0000\u0000\u0000\b\u0000\u0000\u0000" | |
| }, | |
| "time": "2019-06-14T20:31:01.405Z", | |
| "tid": 1836, | |
| "flags": { | |
| "control_code": "IOCTL_DISK_GET_LENGTH_INFO" | |
| } | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 139 | |
| }, { | |
| "call": { | |
| "category": "misc", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "GetDiskFreeSpaceExW", | |
| "return_value": "1", | |
| "arguments": { | |
| "root_path": "C:\\", | |
| "free_bytes_available": "0", | |
| "total_number_of_free_bytes": "0", | |
| "total_number_of_bytes": "34252779520" | |
| }, | |
| "time": "2019-06-14T20:31:01.455Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 153 | |
| }], | |
| "references": [], | |
| "name": "antivm_disk_size" | |
| }, { | |
| "markcount": 2, | |
| "families": [], | |
| "description": "Executes one or more WMI queries", | |
| "severity": 2, | |
| "marks": [{ | |
| "category": "wmi", | |
| "ioc": "SELECT DeviceId FROM Win32_PnPEntity", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "wmi", | |
| "ioc": "SELECT SerialNumber FROM Win32_Bios", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "has_wmi" | |
| }, { | |
| "markcount": 5, | |
| "families": [], | |
| "description": "Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping", | |
| "severity": 2, | |
| "marks": [{ | |
| "call": { | |
| "category": "process", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "Process32NextW", | |
| "return_value": "1", | |
| "arguments": { | |
| "process_name": "python.exe", | |
| "snapshot_handle": "0x0000011c", | |
| "process_identifier": 2012 | |
| }, | |
| "time": "2019-06-14T20:31:02.897Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 436 | |
| }, { | |
| "call": { | |
| "category": "process", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "Process32NextW", | |
| "return_value": "1", | |
| "arguments": { | |
| "process_name": "taskhost.exe", | |
| "snapshot_handle": "0x0000011c", | |
| "process_identifier": 1756 | |
| }, | |
| "time": "2019-06-14T20:31:02.897Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 437 | |
| }, { | |
| "call": { | |
| "category": "process", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "Process32NextW", | |
| "return_value": "1", | |
| "arguments": { | |
| "process_name": "sdclt.exe", | |
| "snapshot_handle": "0x0000011c", | |
| "process_identifier": 976 | |
| }, | |
| "time": "2019-06-14T20:31:02.907Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 438 | |
| }, { | |
| "call": { | |
| "category": "process", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "Process32NextW", | |
| "return_value": "1", | |
| "arguments": { | |
| "process_name": "pafish.exe", | |
| "snapshot_handle": "0x0000011c", | |
| "process_identifier": 1008 | |
| }, | |
| "time": "2019-06-14T20:31:02.907Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 439 | |
| }, { | |
| "call": { | |
| "category": "process", | |
| "status": 1, | |
| "stacktrace": [], | |
| "api": "Process32NextW", | |
| "return_value": "1", | |
| "arguments": { | |
| "process_name": "conhost.exe", | |
| "snapshot_handle": "0x0000011c", | |
| "process_identifier": 1492 | |
| }, | |
| "time": "2019-06-14T20:31:02.907Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 440 | |
| }], | |
| "references": [], | |
| "name": "injection_process_search" | |
| }, { | |
| "markcount": 1, | |
| "families": [], | |
| "description": "Checks adapter addresses which can be used to detect virtual network interfaces", | |
| "severity": 2, | |
| "marks": [{ | |
| "call": { | |
| "category": "network", | |
| "status": 0, | |
| "stacktrace": [], | |
| "last_error": 0, | |
| "nt_status": -1073741275, | |
| "api": "GetAdaptersAddresses", | |
| "return_value": "111", | |
| "arguments": { | |
| "flags": 0, | |
| "family": 0 | |
| }, | |
| "time": "2019-06-14T20:31:02.436Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 365 | |
| }], | |
| "references": [], | |
| "name": "antivm_network_adapters" | |
| }, { | |
| "markcount": 2, | |
| "families": [], | |
| "description": "The binary likely contains encrypted or compressed data indicative of a packer", | |
| "severity": 2, | |
| "marks": [{ | |
| "entropy": 7.854124193008595, | |
| "section": { | |
| "size_of_data": "0x00009000", | |
| "virtual_address": "0x0000f000", | |
| "entropy": 7.854124193008595, | |
| "name": ".rsrc", | |
| "virtual_size": "0x00008ef0" | |
| }, | |
| "type": "generic", | |
| "description": "A section with a high entropy has been found" | |
| }, { | |
| "entropy": 0.4864864864864865, | |
| "type": "generic", | |
| "description": "Overall entropy of this PE file is high" | |
| }], | |
| "references": ["http://www.forensickb.com/2013/03/file-entropy-explained.html", "http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"], | |
| "name": "packer_entropy" | |
| }, { | |
| "markcount": 371, | |
| "families": [], | |
| "description": "Potentially malicious URLs were found in the process memory dump", | |
| "severity": 2, | |
| "marks": [{ | |
| "category": "url", | |
| "ioc": "http://www.expedia.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://uk.ask.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.priceminister.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.iask.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.merlin.com.pl/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.cnet.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.nifty.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://ns.adobe.com/exif/1.0/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.etmall.com.tw/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.goo.ne.jp/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://fr.wikipedia.org/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://busca.estadao.com.br/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.hanafos.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.chol.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://amazon.fr/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.amazon.co.jp/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.mtv.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://busqueda.aol.com.mx/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.live.com/results.aspx?FORM=SOLTDF", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://msdn.microsoft.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://msdn.microsoft.com/workshop/security/privacy/overview/privacyimportxml.asp)", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.sify.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://yellowpages.superpages.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://suche.freenet.de/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.aol.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://browse.guardian.co.uk/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.mercadolibre.com.mx/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.asharqalawsat.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.facebook.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://si.wikipedia.org/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.rtl.de/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.msn.com/results.aspx?q=", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.microsoft.com.", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.naver.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://en.wikipedia.org/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://si.wikipedia.org/w/api.php?action=opensearch", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://udn.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://rover.ebay.com", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.ebay.fr/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.univision.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://pt.wikipedia.org/w/api.php?action=opensearch", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://it.wikipedia.org/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://uk.ask.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.google.co.uk/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://cnweb.search.live.com/results.aspx?q=", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.google.cz/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.google.co.jp/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://search.ebay.co.uk/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.weather.com/", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "url", | |
| "ioc": "http://www.taobao.com/favicon.ico", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "memdump_urls" | |
| }, { | |
| "markcount": 2, | |
| "families": [], | |
| "description": "Executes one or more WMI queries which can be used to identify virtual machines", | |
| "severity": 2, | |
| "marks": [{ | |
| "category": "wmi", | |
| "ioc": "SELECT SerialNumber FROM Win32_Bios", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "wmi", | |
| "ioc": "SELECT DeviceId FROM Win32_PnPEntity", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "wmi_antivm" | |
| }, { | |
| "markcount": 4, | |
| "families": [], | |
| "description": "Looks for known filepaths where sandboxes execute samples", | |
| "severity": 3, | |
| "marks": [{ | |
| "category": "file", | |
| "ioc": "C:\\sample.exe", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "D:\\sample.exe", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\malware.exe", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "D:\\malware.exe", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "antisandbox_file" | |
| }, { | |
| "markcount": 2, | |
| "families": [], | |
| "description": "Checks the version of Bios, possibly for anti-virtualization", | |
| "severity": 3, | |
| "marks": [{ | |
| "category": "registry", | |
| "ioc": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\SystemBiosVersion", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "registry", | |
| "ioc": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\VideoBiosVersion", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "antivm_generic_bios" | |
| }, { | |
| "markcount": 2, | |
| "families": [], | |
| "description": "Attempts to detect a virtual machine by the use of a pseudo device", | |
| "severity": 3, | |
| "marks": [{ | |
| "call": { | |
| "category": "file", | |
| "status": 0, | |
| "stacktrace": [], | |
| "last_error": 0, | |
| "nt_status": 0, | |
| "api": "NtCreateFile", | |
| "return_value": "3221225524", | |
| "arguments": { | |
| "create_disposition": 1, | |
| "file_handle": "0x00000000", | |
| "filepath": "\\??\\HGFS", | |
| "desired_access": "0x80100080", | |
| "file_attributes": 128, | |
| "filepath_r": "\\??\\HGFS", | |
| "create_options": 96, | |
| "status_info": "4294967295", | |
| "share_access": 1 | |
| }, | |
| "time": "2019-06-14T20:31:04.950Z", | |
| "tid": 1836, | |
| "flags": { | |
| "create_disposition": "FILE_OPEN", | |
| "desired_access": "FILE_READ_ATTRIBUTES|SYNCHRONIZE", | |
| "file_attributes": "FILE_ATTRIBUTE_NORMAL", | |
| "create_options": "FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT", | |
| "status_info": "", | |
| "share_access": "FILE_SHARE_READ" | |
| } | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 540 | |
| }, { | |
| "call": { | |
| "category": "file", | |
| "status": 0, | |
| "stacktrace": [], | |
| "last_error": 2, | |
| "nt_status": -1073741772, | |
| "api": "NtCreateFile", | |
| "return_value": "3221225524", | |
| "arguments": { | |
| "create_disposition": 1, | |
| "file_handle": "0x00000000", | |
| "filepath": "\\??\\vmci", | |
| "desired_access": "0x80100080", | |
| "file_attributes": 128, | |
| "filepath_r": "\\??\\vmci", | |
| "create_options": 96, | |
| "status_info": "4294967295", | |
| "share_access": 1 | |
| }, | |
| "time": "2019-06-14T20:31:04.960Z", | |
| "tid": 1836, | |
| "flags": { | |
| "create_disposition": "FILE_OPEN", | |
| "desired_access": "FILE_READ_ATTRIBUTES|SYNCHRONIZE", | |
| "file_attributes": "FILE_ATTRIBUTE_NORMAL", | |
| "create_options": "FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT", | |
| "status_info": "", | |
| "share_access": "FILE_SHARE_READ" | |
| } | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 541 | |
| }], | |
| "references": [], | |
| "name": "antivm_shared_device" | |
| }, { | |
| "markcount": 1, | |
| "families": [], | |
| "description": "Detects Joe or Anubis Sandboxes through the presence of a file", | |
| "severity": 3, | |
| "marks": [{ | |
| "category": "file", | |
| "ioc": "C:\\sample.exe", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "antisandbox_joe_anubis_files" | |
| }, { | |
| "markcount": 4, | |
| "families": [], | |
| "description": "Detects VirtualBox through the presence of a device", | |
| "severity": 3, | |
| "marks": [{ | |
| "category": "file", | |
| "ioc": "\\??\\VBoxMiniRdrDN", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "\\\\?\\pipe\\VBoxMiniRdDN", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "\\??\\VBoxTrayIPC", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "\\\\?\\pipe\\VBoxTrayIPC", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "antivm_vbox_devices" | |
| }, { | |
| "markcount": 16, | |
| "families": [], | |
| "description": "Detects VirtualBox through the presence of a file", | |
| "severity": 3, | |
| "marks": [{ | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxdisp.dll", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxhook.dll", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxmrxnp.dll", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxogl.dll", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxoglarrayspu.dll", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxoglcrutil.dll", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxoglerrorspu.dll", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxoglfeedbackspu.dll", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxoglpackspu.dll", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\drivers\\VBoxSF.sys", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\VBoxControl.exe", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxservice.exe", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\vboxtray.exe", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\drivers\\VBoxGuest.sys", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\drivers\\VBoxMouse.sys", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\drivers\\VBoxVideo.sys", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "antivm_vbox_files" | |
| }, { | |
| "markcount": 4, | |
| "families": [], | |
| "description": "Detects VirtualBox through the presence of a registry key", | |
| "severity": 3, | |
| "marks": [{ | |
| "category": "registry", | |
| "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Oracle\\VirtualBox Guest Additions", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "registry", | |
| "ioc": "HKEY_LOCAL_MACHINE\\HARDWARE\\ACPI\\FADT\\VBOX__", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "registry", | |
| "ioc": "HKEY_LOCAL_MACHINE\\HARDWARE\\ACPI\\DSDT\\VBOX__", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "registry", | |
| "ioc": "HKEY_LOCAL_MACHINE\\HARDWARE\\ACPI\\RSDT\\VBOX__", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "antivm_vbox_keys" | |
| }, { | |
| "markcount": 1, | |
| "families": [], | |
| "description": "Detects VirtualBox using WNetGetProviderName trick", | |
| "severity": 3, | |
| "marks": [{ | |
| "call": { | |
| "category": "network", | |
| "status": 0, | |
| "stacktrace": [], | |
| "last_error": 1222, | |
| "nt_status": -1073741511, | |
| "api": "WNetGetProviderNameW", | |
| "return_value": "1222", | |
| "arguments": { | |
| "net_type": "0x00250000" | |
| }, | |
| "time": "2019-06-14T20:31:02.546Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 389 | |
| }], | |
| "references": [], | |
| "name": "antivm_vbox_provname" | |
| }, { | |
| "markcount": 2, | |
| "families": [], | |
| "description": "Detects VirtualBox through the presence of a window", | |
| "severity": 3, | |
| "marks": [{ | |
| "call": { | |
| "category": "ui", | |
| "status": 0, | |
| "stacktrace": [], | |
| "last_error": 2, | |
| "nt_status": -1073741772, | |
| "api": "FindWindowA", | |
| "return_value": "0", | |
| "arguments": { | |
| "class_name": "VBoxTrayToolWndClass", | |
| "window_name": "" | |
| }, | |
| "time": "2019-06-14T20:31:02.526Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 385 | |
| }, { | |
| "call": { | |
| "category": "ui", | |
| "status": 0, | |
| "stacktrace": [], | |
| "last_error": 2, | |
| "nt_status": -1073741772, | |
| "api": "FindWindowA", | |
| "return_value": "0", | |
| "arguments": { | |
| "class_name": "#0", | |
| "window_name": "VBoxTrayToolWnd" | |
| }, | |
| "time": "2019-06-14T20:31:02.526Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 386 | |
| }], | |
| "references": [], | |
| "name": "antivm_vbox_window" | |
| }, { | |
| "markcount": 4, | |
| "families": [], | |
| "description": "Detects VMWare through the presence of various files", | |
| "severity": 3, | |
| "marks": [{ | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\drivers\\vmmouse.sys", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "C:\\Windows\\System32\\drivers\\vmhgfs.sys", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "\\??\\HGFS", | |
| "type": "ioc", | |
| "description": null | |
| }, { | |
| "category": "file", | |
| "ioc": "\\??\\vmci", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "antivm_vmware_files" | |
| }, { | |
| "markcount": 1, | |
| "families": [], | |
| "description": "Detects VMWare through the presence of a registry key", | |
| "severity": 3, | |
| "marks": [{ | |
| "category": "registry", | |
| "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\VMware, Inc.\\VMware Tools", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "antivm_vmware_keys" | |
| }, { | |
| "markcount": 2, | |
| "families": [], | |
| "description": "Detects the presence of Wine emulator", | |
| "severity": 3, | |
| "marks": [{ | |
| "call": { | |
| "category": "system", | |
| "status": 0, | |
| "stacktrace": [], | |
| "last_error": 126, | |
| "nt_status": -1073741515, | |
| "api": "LdrGetProcedureAddress", | |
| "return_value": "3221225785", | |
| "arguments": { | |
| "ordinal": 0, | |
| "module": "kernel32", | |
| "module_address": "0x75b10000", | |
| "function_address": "0x00409375", | |
| "function_name": "wine_get_unix_file_name" | |
| }, | |
| "time": "2019-06-14T20:31:01.915Z", | |
| "tid": 1836, | |
| "flags": {} | |
| }, | |
| "pid": 1008, | |
| "type": "call", | |
| "cid": 235 | |
| }, { | |
| "category": "registry", | |
| "ioc": "HKEY_CURRENT_USER\\SOFTWARE\\Wine", | |
| "type": "ioc", | |
| "description": null | |
| }], | |
| "references": [], | |
| "name": "antiemu_wine" | |
| }], | |
| "static": { | |
| "pdb_path": null, | |
| "pe_imports": [{ | |
| "imports": [{ | |
| "name": "GetUserNameA", | |
| "address": "0x40c2a8" | |
| }, { | |
| "name": "RegCloseKey", | |
| "address": "0x40c2ac" | |
| }, { | |
| "name": "RegOpenKeyExA", | |
| "address": "0x40c2b0" | |
| }, { | |
| "name": "RegQueryValueExA", | |
| "address": "0x40c2b4" | |
| }], | |
| "dll": "ADVAPI32.dll" | |
| }, { | |
| "imports": [{ | |
| "name": "GetAdaptersAddresses", | |
| "address": "0x40c2bc" | |
| }], | |
| "dll": "IPHLPAPI.DLL" | |
| }, { | |
| "imports": [{ | |
| "name": "CloseHandle", | |
| "address": "0x40c2c4" | |
| }, { | |
| "name": "CreateFileA", | |
| "address": "0x40c2c8" | |
| }, { | |
| "name": "CreateProcessA", | |
| "address": "0x40c2cc" | |
| }, { | |
| "name": "CreateToolhelp32Snapshot", | |
| "address": "0x40c2d0" | |
| }, { | |
| "name": "DeleteCriticalSection", | |
| "address": "0x40c2d4" | |
| }, { | |
| "name": "DeleteFileW", | |
| "address": "0x40c2d8" | |
| }, { | |
| "name": "DeviceIoControl", | |
| "address": "0x40c2dc" | |
| }, { | |
| "name": "EnterCriticalSection", | |
| "address": "0x40c2e0" | |
| }, { | |
| "name": "GetConsoleScreenBufferInfo", | |
| "address": "0x40c2e4" | |
| }, { | |
| "name": "GetCurrentProcess", | |
| "address": "0x40c2e8" | |
| }, { | |
| "name": "GetCurrentProcessId", | |
| "address": "0x40c2ec" | |
| }, { | |
| "name": "GetCurrentThreadId", | |
| "address": "0x40c2f0" | |
| }, { | |
| "name": "GetDiskFreeSpaceExA", | |
| "address": "0x40c2f4" | |
| }, { | |
| "name": "GetDriveTypeA", | |
| "address": "0x40c2f8" | |
| }, { | |
| "name": "GetFileAttributesA", | |
| "address": "0x40c2fc" | |
| }, { | |
| "name": "GetLastError", | |
| "address": "0x40c300" | |
| }, { | |
| "name": "GetLogicalDriveStringsA", | |
| "address": "0x40c304" | |
| }, { | |
| "name": "GetModuleFileNameA", | |
| "address": "0x40c308" | |
| }, { | |
| "name": "GetModuleHandleA", | |
| "address": "0x40c30c" | |
| }, { | |
| "name": "GetProcAddress", | |
| "address": "0x40c310" | |
| }, { | |
| "name": "GetStartupInfoA", | |
| "address": "0x40c314" | |
| }, { | |
| "name": "GetStdHandle", | |
| "address": "0x40c318" | |
| }, { | |
| "name": "GetSystemInfo", | |
| "address": "0x40c31c" | |
| }, { | |
| "name": "GetSystemTimeAsFileTime", | |
| "address": "0x40c320" | |
| }, { | |
| "name": "GetTickCount", | |
| "address": "0x40c324" | |
| }, { | |
| "name": "GetVersionExA", | |
| "address": "0x40c328" | |
| }, { | |
| "name": "GlobalMemoryStatusEx", | |
| "address": "0x40c32c" | |
| }, { | |
| "name": "InitializeCriticalSection", | |
| "address": "0x40c330" | |
| }, { | |
| "name": "IsDebuggerPresent", | |
| "address": "0x40c334" | |
| }, { | |
| "name": "LeaveCriticalSection", | |
| "address": "0x40c338" | |
| }, { | |
| "name": "LocalAlloc", | |
| "address": "0x40c33c" | |
| }, { | |
| "name": "LocalFree", | |
| "address": "0x40c340" | |
| }, { | |
| "name": "OutputDebugStringA", | |
| "address": "0x40c344" | |
| }, { | |
| "name": "Process32First", | |
| "address": "0x40c348" | |
| }, { | |
| "name": "Process32Next", | |
| "address": "0x40c34c" | |
| }, { | |
| "name": "QueryPerformanceCounter", | |
| "address": "0x40c350" | |
| }, { | |
| "name": "SetConsoleTextAttribute", | |
| "address": "0x40c354" | |
| }, { | |
| "name": "SetLastError", | |
| "address": "0x40c358" | |
| }, { | |
| "name": "SetUnhandledExceptionFilter", | |
| "address": "0x40c35c" | |
| }, { | |
| "name": "Sleep", | |
| "address": "0x40c360" | |
| }, { | |
| "name": "TerminateProcess", | |
| "address": "0x40c364" | |
| }, { | |
| "name": "TlsGetValue", | |
| "address": "0x40c368" | |
| }, { | |
| "name": "UnhandledExceptionFilter", | |
| "address": "0x40c36c" | |
| }, { | |
| "name": "VirtualProtect", | |
| "address": "0x40c370" | |
| }, { | |
| "name": "VirtualQuery", | |
| "address": "0x40c374" | |
| }, { | |
| "name": "lstrcmpiA", | |
| "address": "0x40c378" | |
| }], | |
| "dll": "KERNEL32.dll" | |
| }, { | |
| "imports": [{ | |
| "name": "WNetGetProviderNameA", | |
| "address": "0x40c380" | |
| }], | |
| "dll": "MPR.DLL" | |
| }, { | |
| "imports": [{ | |
| "name": "__dllonexit", | |
| "address": "0x40c388" | |
| }, { | |
| "name": "__getmainargs", | |
| "address": "0x40c38c" | |
| }, { | |
| "name": "__initenv", | |
| "address": "0x40c390" | |
| }, { | |
| "name": "__lconv_init", | |
| "address": "0x40c394" | |
| }, { | |
| "name": "__set_app_type", | |
| "address": "0x40c398" | |
| }, { | |
| "name": "__setusermatherr", | |
| "address": "0x40c39c" | |
| }, { | |
| "name": "_acmdln", | |
| "address": "0x40c3a0" | |
| }, { | |
| "name": "_amsg_exit", | |
| "address": "0x40c3a4" | |
| }, { | |
| "name": "_cexit", | |
| "address": "0x40c3a8" | |
| }, { | |
| "name": "_fmode", | |
| "address": "0x40c3ac" | |
| }, { | |
| "name": "_initterm", | |
| "address": "0x40c3b0" | |
| }, { | |
| "name": "_iob", | |
| "address": "0x40c3b4" | |
| }, { | |
| "name": "_lock", | |
| "address": "0x40c3b8" | |
| }, { | |
| "name": "_onexit", | |
| "address": "0x40c3bc" | |
| }, { | |
| "name": "calloc", | |
| "address": "0x40c3c0" | |
| }, { | |
| "name": "exit", | |
| "address": "0x40c3c4" | |
| }, { | |
| "name": "fclose", | |
| "address": "0x40c3c8" | |
| }, { | |
| "name": "fopen", | |
| "address": "0x40c3cc" | |
| }, { | |
| "name": "fprintf", | |
| "address": "0x40c3d0" | |
| }, { | |
| "name": "fputs", | |
| "address": "0x40c3d4" | |
| }, { | |
| "name": "free", | |
| "address": "0x40c3d8" | |
| }, { | |
| "name": "fwrite", | |
| "address": "0x40c3dc" | |
| }, { | |
| "name": "getchar", | |
| "address": "0x40c3e0" | |
| }, { | |
| "name": "malloc", | |
| "address": "0x40c3e4" | |
| }, { | |
| "name": "mbstowcs", | |
| "address": "0x40c3e8" | |
| }, { | |
| "name": "memcmp", | |
| "address": "0x40c3ec" | |
| }, { | |
| "name": "memcpy", | |
| "address": "0x40c3f0" | |
| }, { | |
| "name": "printf", | |
| "address": "0x40c3f4" | |
| }, { | |
| "name": "puts", | |
| "address": "0x40c3f8" | |
| }, { | |
| "name": "signal", | |
| "address": "0x40c3fc" | |
| }, { | |
| "name": "sprintf", | |
| "address": "0x40c400" | |
| }, { | |
| "name": "strlen", | |
| "address": "0x40c404" | |
| }, { | |
| "name": "strncat", | |
| "address": "0x40c408" | |
| }, { | |
| "name": "strncmp", | |
| "address": "0x40c40c" | |
| }, { | |
| "name": "strncpy", | |
| "address": "0x40c410" | |
| }, { | |
| "name": "strstr", | |
| "address": "0x40c414" | |
| }, { | |
| "name": "_unlock", | |
| "address": "0x40c418" | |
| }, { | |
| "name": "abort", | |
| "address": "0x40c41c" | |
| }, { | |
| "name": "toupper", | |
| "address": "0x40c420" | |
| }, { | |
| "name": "vfprintf", | |
| "address": "0x40c424" | |
| }, { | |
| "name": "wcsstr", | |
| "address": "0x40c428" | |
| }, { | |
| "name": "_vsnprintf", | |
| "address": "0x40c42c" | |
| }], | |
| "dll": "msvcrt.dll" | |
| }, { | |
| "imports": [{ | |
| "name": "CoCreateInstance", | |
| "address": "0x40c434" | |
| }, { | |
| "name": "CoInitializeEx", | |
| "address": "0x40c438" | |
| }, { | |
| "name": "CoInitializeSecurity", | |
| "address": "0x40c43c" | |
| }, { | |
| "name": "CoUninitialize", | |
| "address": "0x40c440" | |
| }], | |
| "dll": "ole32.dll" | |
| }, { | |
| "imports": [{ | |
| "name": "SysAllocString", | |
| "address": "0x40c448" | |
| }, { | |
| "name": "SysFreeString", | |
| "address": "0x40c44c" | |
| }], | |
| "dll": "OLEAUT32.dll" | |
| }, { | |
| "imports": [{ | |
| "name": "ShellExecuteExW", | |
| "address": "0x40c454" | |
| }], | |
| "dll": "SHELL32.dll" | |
| }, { | |
| "imports": [{ | |
| "name": "FindWindowA", | |
| "address": "0x40c45c" | |
| }, { | |
| "name": "GetCursorPos", | |
| "address": "0x40c460" | |
| }], | |
| "dll": "USER32.dll" | |
| }, { | |
| "imports": [{ | |
| "name": "freeaddrinfo", | |
| "address": "0x40c468" | |
| }, { | |
| "name": "getaddrinfo", | |
| "address": "0x40c46c" | |
| }], | |
| "dll": "WS2_32.dll" | |
| }], | |
| "peid_signatures": null, | |
| "keys": [], | |
| "signature": [], | |
| "pe_timestamp": "2016-08-27 18:37:13", | |
| "pe_exports": [], | |
| "imported_dll_count": 10, | |
| "pe_imphash": "5fd4caa76ea3c961f2d530674634f64d", | |
| "pe_resources": [{ | |
| "name": "RT_ICON", | |
| "language": "LANG_ENGLISH", | |
| "filetype": "PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced", | |
| "sublanguage": "SUBLANG_ENGLISH_US", | |
| "offset": "0x00017a10", | |
| "size": "0x000001f1" | |
| }, { | |
| "name": "RT_ICON", | |
| "language": "LANG_ENGLISH", | |
| "filetype": "PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced", | |
| "sublanguage": "SUBLANG_ENGLISH_US", | |
| "offset": "0x00017a10", | |
| "size": "0x000001f1" | |
| }, { | |
| "name": "RT_ICON", | |
| "language": "LANG_ENGLISH", | |
| "filetype": "PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced", | |
| "sublanguage": "SUBLANG_ENGLISH_US", | |
| "offset": "0x00017a10", | |
| "size": "0x000001f1" | |
| }, { | |
| "name": "RT_ICON", | |
| "language": "LANG_ENGLISH", | |
| "filetype": "PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced", | |
| "sublanguage": "SUBLANG_ENGLISH_US", | |
| "offset": "0x00017a10", | |
| "size": "0x000001f1" | |
| }, { | |
| "name": "RT_ICON", | |
| "language": "LANG_ENGLISH", | |
| "filetype": "PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced", | |
| "sublanguage": "SUBLANG_ENGLISH_US", | |
| "offset": "0x00017a10", | |
| "size": "0x000001f1" | |
| }, { | |
| "name": "RT_ICON", | |
| "language": "LANG_ENGLISH", | |
| "filetype": "PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced", | |
| "sublanguage": "SUBLANG_ENGLISH_US", | |
| "offset": "0x00017a10", | |
| "size": "0x000001f1" | |
| }, { | |
| "name": "RT_GROUP_ICON", | |
| "language": "LANG_ENGLISH", | |
| "filetype": "MS Windows icon resource - 6 icons, 256x256, 16 colors", | |
| "sublanguage": "SUBLANG_ENGLISH_US", | |
| "offset": "0x00017c08", | |
| "size": "0x0000005a" | |
| }, { | |
| "name": "RT_VERSION", | |
| "language": "LANG_ENGLISH", | |
| "filetype": "data", | |
| "sublanguage": "SUBLANG_ENGLISH_US", | |
| "offset": "0x00017c68", | |
| "size": "0x00000288" | |
| }], | |
| "pe_versioninfo": [{ | |
| "name": "LegalCopyright", | |
| "value": "" | |
| }, { | |
| "name": "InternalName", | |
| "value": "" | |
| }, { | |
| "name": "FileVersion", | |
| "value": "" | |
| }, { | |
| "name": "CompanyName", | |
| "value": "" | |
| }, { | |
| "name": "LegalTrademarks", | |
| "value": "" | |
| }, { | |
| "name": "ProductName", | |
| "value": "Paranoid Fish" | |
| }, { | |
| "name": "ProductVersion", | |
| "value": "" | |
| }, { | |
| "name": "FileDescription", | |
| "value": "Paranoid Fish is paranoid" | |
| }, { | |
| "name": "OriginalFilename", | |
| "value": "" | |
| }, { | |
| "name": "Translation", | |
| "value": "0x0409 0x04e4" | |
| }], | |
| "pe_sections": [{ | |
| "size_of_data": "0x00005000", | |
| "virtual_address": "0x00001000", | |
| "entropy": 5.837356922279207, | |
| "name": ".text", | |
| "virtual_size": "0x00004f04" | |
| }, { | |
| "size_of_data": "0x00000200", | |
| "virtual_address": "0x00006000", | |
| "entropy": 0.5160853718179212, | |
| "name": ".data", | |
| "virtual_size": "0x00000030" | |
| }, { | |
| "size_of_data": "0x00003400", | |
| "virtual_address": "0x00007000", | |
| "entropy": 5.841272613826215, | |
| "name": ".rdata", | |
| "virtual_size": "0x000032b8" | |
| }, { | |
| "size_of_data": "0x00000000", | |
| "virtual_address": "0x0000b000", | |
| "entropy": 0, | |
| "name": ".bss", | |
| "virtual_size": "0x00000400" | |
| }, { | |
| "size_of_data": "0x00000e00", | |
| "virtual_address": "0x0000c000", | |
| "entropy": 4.764537139404206, | |
| "name": ".idata", | |
| "virtual_size": "0x00000d24" | |
| }, { | |
| "size_of_data": "0x00000200", | |
| "virtual_address": "0x0000d000", | |
| "entropy": 0.2672080280062829, | |
| "name": ".CRT", | |
| "virtual_size": "0x00000034" | |
| }, { | |
| "size_of_data": "0x00000200", | |
| "virtual_address": "0x0000e000", | |
| "entropy": 0.2044881574398449, | |
| "name": ".tls", | |
| "virtual_size": "0x00000020" | |
| }, { | |
| "size_of_data": "0x00009000", | |
| "virtual_address": "0x0000f000", | |
| "entropy": 7.854124193008595, | |
| "name": ".rsrc", | |
| "virtual_size": "0x00008ef0" | |
| }] | |
| }, | |
| "dropped": [{ | |
| "yara": [{ | |
| "meta": { | |
| "description": "A non-Windows executable contains win32 API functions names", | |
| "author": "nex" | |
| }, | |
| "name": "embedded_win_api", | |
| "offsets": { | |
| "api7": [ | |
| ["986", 0] | |
| ] | |
| }, | |
| "strings": ["U2hlbGxFeGVjdXRl"] | |
| }, { | |
| "meta": { | |
| "description": "Possibly employs anti-virtualization techniques", | |
| "author": "nex" | |
| }, | |
| "name": "vmdetect", | |
| "offsets": { | |
| "virtualbox_mac_1b": [ | |
| ["1071", 0] | |
| ] | |
| }, | |
| "strings": ["MDg6MDA6Mjc="] | |
| }], | |
| "sha1": "184b43b4ca9da8bd86b3a74006ce601eb8005189", | |
| "name": "694e192e2bf7c06f_pafish.log", | |
| "filepath": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.log", | |
| "sha512": "c69eb9299bdc07735e7caa67ef3a3457e837a45b0101d01386f5753087c72c897bc9d34325d56442cc0922b0848cd20946a54d256b49d737e99033423d18eda9", | |
| "object_id": "5cdc219759bfaf0f424f4994", | |
| "urls": [], | |
| "crc32": "2D75BDDD", | |
| "path": "/home/cuckoo/.cuckoo/storage/analyses/1180/files/694e192e2bf7c06f_pafish.log", | |
| "ssdeep": null, | |
| "sha256": "694e192e2bf7c06f43105877ccb2915d64c99bbe3aedbc9f927e700cb7c6df04", | |
| "type": "ASCII text, with CRLF line terminators", | |
| "pids": [1008], | |
| "md5": "5cba38c8ed5b582529f6c938d80801a6", | |
| "size": 1150 | |
| }], | |
| "behavior": { | |
| "generic": [{ | |
| "process_path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.exe", | |
| "process_name": "pafish.exe", | |
| "pid": 1008, | |
| "summary": { | |
| "file_created": ["C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_mouse_act", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_CPU_VM_hypervisor_bit", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_CPU_VM_hv_vendor_name", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_pysicalmemory_less_1Gb", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_drive_size2", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.log", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_virtualbox", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_CPU_VM_rdtsc", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_NumberOfProcessors_less_2_GetSystemInfo", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_drive_size", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_CPU_VM_rdtsc_force_vm_exit", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_hooks_shellexecuteexw_m1", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_NumberOfProcessors_less_2_raw"], | |
| "dll_loaded": ["kernel32.dll"], | |
| "file_opened": ["C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_virtualbox", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.log", "\\??\\PhysicalDrive0"], | |
| "regkey_opened": ["HKEY_LOCAL_MACHINE\\HARDWARE\\Description\\System", "HKEY_LOCAL_MACHINE\\HARDWARE\\ACPI\\FADT\\VBOX__", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Oracle\\VirtualBox Guest Additions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\VMware, Inc.\\VMware Tools", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxSF", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}", "HKEY_CURRENT_USER\\SOFTWARE\\Wine", "HKEY_LOCAL_MACHINE\\HARDWARE\\ACPI\\DSDT\\VBOX__", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxGuest", "HKEY_CURRENT_USER\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}", "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxMouse", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxService", "HKEY_LOCAL_MACHINE\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxVideo", "HKEY_LOCAL_MACHINE\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "HKEY_LOCAL_MACHINE\\HARDWARE\\ACPI\\RSDT\\VBOX__"], | |
| "resolves_host": ["hi-hooks-shellexecuteexw-m1.pafish", "hi-sandbox-drive-size2.pafish", "hi-sandbox-pysicalmemory-less-1Gb.pafish", "hi-sandbox-drive-size.pafish", "hi-CPU-VM-rdtsc.pafish", "analysis-start.pafish", "analysis-end.pafish", "hi-virtualbox.pafish", "hi-CPU-VM-hypervisor-bit.pafish", "hi-CPU-VM-rdtsc-force-vm-exit.pafish", "hi-sandbox-NumberOfProcessors-less-2-GetSystemInfo.pafish", "hi-sandbox-mouse-act.pafish", "hi-sandbox-NumberOfProcessors-less-2-raw.pafish", "hi-CPU-VM-hv-vendor-name.pafish"], | |
| "file_written": ["C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.log"], | |
| "file_exists": ["C:\\Windows\\System32\\vboxoglfeedbackspu.dll", "C:\\Windows\\System32\\drivers\\VBoxSF.sys", "C:\\Windows\\System32\\drivers\\VBoxMouse.sys", "C:\\sample.exe", "C:\\program files\\oracle\\virtualbox guest additions\\", "C:\\Windows\\System32\\vboxoglerrorspu.dll", "C:\\Windows\\System32\\drivers\\VBoxVideo.sys", "C:\\Windows\\System32\\vboxoglpassthroughspu.dll", "C:\\Windows\\System32\\vboxoglpackspu.dll", "C:\\Windows\\System32\\drivers\\VBoxGuest.sys", "C:\\Windows\\System32\\vboxoglcrutil.dll", "C:\\malware.exe", "C:\\Windows\\System32\\drivers\\vmmouse.sys", "C:\\Windows\\System32\\vboxdisp.dll", "C:\\Windows\\System32\\vboxmrxnp.dll", "D:\\sample.exe", "C:\\Windows\\System32\\vboxogl.dll", "D:\\malware.exe", "C:\\Windows\\System32\\VBoxControl.exe", "C:\\Windows\\System32\\vboxservice.exe", "C:\\Windows\\System32\\vboxhook.dll", "C:\\Windows\\System32\\vboxtray.exe", "C:\\Windows\\System32\\drivers\\vmhgfs.sys", "C:\\Windows\\System32\\vboxoglarrayspu.dll"], | |
| "file_failed": ["\\??\\vmci", "\\??\\VBoxTrayIPC", "\\??\\HGFS", "\\\\?\\pipe\\VBoxTrayIPC", "\\\\?\\pipe\\VBoxMiniRdDN", "\\??\\VBoxMiniRdrDN"], | |
| "wmi_query": ["SELECT DeviceId FROM Win32_PnPEntity", "SELECT SerialNumber FROM Win32_Bios"], | |
| "guid": ["{4590f811-1d3a-11d0-891f-00aa004b2e24}", "{8bc3f05e-d86b-11d0-a075-00c04fb68820}", "{7c857801-7381-11cf-884d-00aa004b2e24}", "{d5f569d0-593b-101a-b569-08002b2dbf7a}", "{f309ad18-d86a-11d0-a075-00c04fb68820}", "{dc12a687-737f-11cf-884d-00aa004b2e24}"], | |
| "regkey_read": ["HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\VideoBiosVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\SystemBiosDate", "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\SystemBiosVersion", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"] | |
| }, | |
| "first_seen": "2019-06-14T20:30:59.792Z", | |
| "ppid": 1216 | |
| }, { | |
| "process_path": "C:\\Windows\\System32\\lsass.exe", | |
| "process_name": "lsass.exe", | |
| "pid": 484, | |
| "summary": {}, | |
| "first_seen": "2019-06-14T20:30:58.060Z", | |
| "ppid": 388 | |
| }], | |
| "apistats": { | |
| "1008": { | |
| "CreateToolhelp32Snapshot": 1, | |
| "NtDuplicateObject": 2, | |
| "getaddrinfo": 15, | |
| "CoUninitialize": 2, | |
| "RegCloseKey": 17, | |
| "CoCreateInstanceEx": 2, | |
| "LdrUnloadDll": 1, | |
| "WNetGetProviderNameW": 1, | |
| "GetSystemInfo": 1, | |
| "RegQueryValueExA": 5, | |
| "DeviceIoControl": 1, | |
| "IsDebuggerPresent": 1, | |
| "GetSystemWindowsDirectoryW": 1, | |
| "NtClose": 58, | |
| "GetAdaptersAddresses": 12, | |
| "FindWindowA": 2, | |
| "GetFileAttributesW": 24, | |
| "IWbemServices_ExecQuery": 2, | |
| "RegQueryValueExW": 4, | |
| "NtMapViewOfSection": 1, | |
| "Process32NextW": 32, | |
| "RegOpenKeyExW": 8, | |
| "NtDelayExecution": 23, | |
| "NtAllocateVirtualMemory": 1, | |
| "RegOpenKeyExA": 21, | |
| "NtWriteFile": 17, | |
| "LdrGetDllHandle": 53, | |
| "Process32FirstW": 1, | |
| "CoGetClassObject": 2, | |
| "GetCursorPos": 2, | |
| "GetComputerNameW": 2, | |
| "CoCreateInstance": 2, | |
| "SetFilePointer": 34, | |
| "GetUserNameA": 1, | |
| "NtCreateFile": 38, | |
| "GetSystemTimeAsFileTime": 2, | |
| "GlobalMemoryStatusEx": 1, | |
| "CoInitializeEx": 2, | |
| "NtCreateSection": 1, | |
| "SetUnhandledExceptionFilter": 1, | |
| "WriteConsoleA": 130, | |
| "NtOpenKey": 18, | |
| "LdrGetProcedureAddress": 49, | |
| "CoInitializeSecurity": 2, | |
| "GetDiskFreeSpaceExW": 1, | |
| "GetFileType": 30, | |
| "LdrLoadDll": 1, | |
| "UuidCreate": 2, | |
| "NtQueryValueKey": 10 | |
| } | |
| }, | |
| "processes": [{ | |
| "process_path": "C:\\Windows\\System32\\lsass.exe", | |
| "calls": [], | |
| "track": false, | |
| "command_line": "C:\\Windows\\system32\\lsass.exe", | |
| "process_name": "lsass.exe", | |
| "pid": 484, | |
| "modules": [{ | |
| "basename": "lsass.exe", | |
| "imgsize": 36864, | |
| "baseaddr": "0xd80000", | |
| "filepath": "C:\\Windows\\system32\\lsass.exe" | |
| }, { | |
| "basename": "ntdll.dll", | |
| "imgsize": 1294336, | |
| "baseaddr": "0x774c0000", | |
| "filepath": "C:\\Windows\\SYSTEM32\\ntdll.dll" | |
| }, { | |
| "basename": "kernel32.dll", | |
| "imgsize": 868352, | |
| "baseaddr": "0x75b10000", | |
| "filepath": "C:\\Windows\\system32\\kernel32.dll" | |
| }, { | |
| "basename": "KERNELBASE.dll", | |
| "imgsize": 303104, | |
| "baseaddr": "0x75890000", | |
| "filepath": "C:\\Windows\\system32\\KERNELBASE.dll" | |
| }, { | |
| "basename": "msvcrt.dll", | |
| "imgsize": 704512, | |
| "baseaddr": "0x773b0000", | |
| "filepath": "C:\\Windows\\system32\\msvcrt.dll" | |
| }, { | |
| "basename": "RPCRT4.dll", | |
| "imgsize": 659456, | |
| "baseaddr": "0x75bf0000", | |
| "filepath": "C:\\Windows\\system32\\RPCRT4.dll" | |
| }, { | |
| "basename": "SspiSrv.dll", | |
| "imgsize": 28672, | |
| "baseaddr": "0x75500000", | |
| "filepath": "C:\\Windows\\system32\\SspiSrv.dll" | |
| }, { | |
| "basename": "lsasrv.dll", | |
| "imgsize": 1048576, | |
| "baseaddr": "0x753c0000", | |
| "filepath": "C:\\Windows\\system32\\lsasrv.dll" | |
| }, { | |
| "basename": "sechost.dll", | |
| "imgsize": 102400, | |
| "baseaddr": "0x75cb0000", | |
| "filepath": "C:\\Windows\\SYSTEM32\\sechost.dll" | |
| }, { | |
| "basename": "SspiCli.dll", | |
| "imgsize": 106496, | |
| "baseaddr": "0x754e0000", | |
| "filepath": "C:\\Windows\\system32\\SspiCli.dll" | |
| }, { | |
| "basename": "ADVAPI32.dll", | |
| "imgsize": 655360, | |
| "baseaddr": "0x75910000", | |
| "filepath": "C:\\Windows\\system32\\ADVAPI32.dll" | |
| }, { | |
| "basename": "USER32.dll", | |
| "imgsize": 823296, | |
| "baseaddr": "0x75ce0000", | |
| "filepath": "C:\\Windows\\system32\\USER32.dll" | |
| }, { | |
| "basename": "GDI32.dll", | |
| "imgsize": 319488, | |
| "baseaddr": "0x77360000", | |
| "filepath": "C:\\Windows\\system32\\GDI32.dll" | |
| }, { | |
| "basename": "LPK.dll", | |
| "imgsize": 40960, | |
| "baseaddr": "0x75ca0000", | |
| "filepath": "C:\\Windows\\system32\\LPK.dll" | |
| }, { | |
| "basename": "USP10.dll", | |
| "imgsize": 643072, | |
| "baseaddr": "0x75f50000", | |
| "filepath": "C:\\Windows\\system32\\USP10.dll" | |
| }, { | |
| "basename": "SAMSRV.dll", | |
| "imgsize": 569344, | |
| "baseaddr": "0x75330000", | |
| "filepath": "C:\\Windows\\system32\\SAMSRV.dll" | |
| }, { | |
| "basename": "cryptdll.dll", | |
| "imgsize": 69632, | |
| "baseaddr": "0x75310000", | |
| "filepath": "C:\\Windows\\system32\\cryptdll.dll" | |
| }, { | |
| "basename": "MSASN1.dll", | |
| "imgsize": 49152, | |
| "baseaddr": "0x75680000", | |
| "filepath": "C:\\Windows\\system32\\MSASN1.dll" | |
| }, { | |
| "basename": "wevtapi.dll", | |
| "imgsize": 270336, | |
| "baseaddr": "0x752c0000", | |
| "filepath": "C:\\Windows\\system32\\wevtapi.dll" | |
| }, { | |
| "basename": "IMM32.DLL", | |
| "imgsize": 126976, | |
| "baseaddr": "0x77340000", | |
| "filepath": "C:\\Windows\\system32\\IMM32.DLL" | |
| }, { | |
| "basename": "MSCTF.dll", | |
| "imgsize": 835584, | |
| "baseaddr": "0x76f00000", | |
| "filepath": "C:\\Windows\\system32\\MSCTF.dll" | |
| }, { | |
| "basename": "cngaudit.dll", | |
| "imgsize": 24576, | |
| "baseaddr": "0x752b0000", | |
| "filepath": "C:\\Windows\\system32\\cngaudit.dll" | |
| }, { | |
| "basename": "AUTHZ.dll", | |
| "imgsize": 110592, | |
| "baseaddr": "0x75290000", | |
| "filepath": "C:\\Windows\\system32\\AUTHZ.dll" | |
| }, { | |
| "basename": "ncrypt.dll", | |
| "imgsize": 229376, | |
| "baseaddr": "0x75250000", | |
| "filepath": "C:\\Windows\\system32\\ncrypt.dll" | |
| }, { | |
| "basename": "bcrypt.dll", | |
| "imgsize": 94208, | |
| "baseaddr": "0x75230000", | |
| "filepath": "C:\\Windows\\system32\\bcrypt.dll" | |
| }, { | |
| "basename": "msprivs.DLL", | |
| "imgsize": 8192, | |
| "baseaddr": "0x75220000", | |
| "filepath": "C:\\Windows\\system32\\msprivs.DLL" | |
| }, { | |
| "basename": "netjoin.dll", | |
| "imgsize": 176128, | |
| "baseaddr": "0x751f0000", | |
| "filepath": "C:\\Windows\\system32\\netjoin.dll" | |
| }, { | |
| "basename": "negoexts.DLL", | |
| "imgsize": 110592, | |
| "baseaddr": "0x751d0000", | |
| "filepath": "C:\\Windows\\system32\\negoexts.DLL" | |
| }, { | |
| "basename": "Secur32.dll", | |
| "imgsize": 32768, | |
| "baseaddr": "0x751c0000", | |
| "filepath": "C:\\Windows\\system32\\Secur32.dll" | |
| }, { | |
| "basename": "cryptbase.dll", | |
| "imgsize": 49152, | |
| "baseaddr": "0x75560000", | |
| "filepath": "C:\\Windows\\system32\\cryptbase.dll" | |
| }, { | |
| "basename": "kerberos.DLL", | |
| "imgsize": 557056, | |
| "baseaddr": "0x75130000", | |
| "filepath": "C:\\Windows\\system32\\kerberos.DLL" | |
| }, { | |
| "basename": "CRYPTSP.dll", | |
| "imgsize": 90112, | |
| "baseaddr": "0x75110000", | |
| "filepath": "C:\\Windows\\system32\\CRYPTSP.dll" | |
| }, { | |
| "basename": "WS2_32.dll", | |
| "imgsize": 217088, | |
| "baseaddr": "0x77650000", | |
| "filepath": "C:\\Windows\\system32\\WS2_32.dll" | |
| }, { | |
| "basename": "NSI.dll", | |
| "imgsize": 24576, | |
| "baseaddr": "0x76fd0000", | |
| "filepath": "C:\\Windows\\system32\\NSI.dll" | |
| }, { | |
| "basename": "mswsock.dll", | |
| "imgsize": 245760, | |
| "baseaddr": "0x750d0000", | |
| "filepath": "C:\\Windows\\system32\\mswsock.dll" | |
| }, { | |
| "basename": "wship6.dll", | |
| "imgsize": 24576, | |
| "baseaddr": "0x750c0000", | |
| "filepath": "C:\\Windows\\System32\\wship6.dll" | |
| }, { | |
| "basename": "msv1_0.DLL", | |
| "imgsize": 270336, | |
| "baseaddr": "0x75070000", | |
| "filepath": "C:\\Windows\\system32\\msv1_0.DLL" | |
| }, { | |
| "basename": "netlogon.DLL", | |
| "imgsize": 573440, | |
| "baseaddr": "0x74fe0000", | |
| "filepath": "C:\\Windows\\system32\\netlogon.DLL" | |
| }, { | |
| "basename": "DNSAPI.dll", | |
| "imgsize": 278528, | |
| "baseaddr": "0x74f90000", | |
| "filepath": "C:\\Windows\\system32\\DNSAPI.dll" | |
| }, { | |
| "basename": "logoncli.dll", | |
| "imgsize": 139264, | |
| "baseaddr": "0x74f60000", | |
| "filepath": "C:\\Windows\\system32\\logoncli.dll" | |
| }, { | |
| "basename": "schannel.DLL", | |
| "imgsize": 233472, | |
| "baseaddr": "0x74f20000", | |
| "filepath": "C:\\Windows\\system32\\schannel.DLL" | |
| }, { | |
| "basename": "CRYPT32.dll", | |
| "imgsize": 1163264, | |
| "baseaddr": "0x75770000", | |
| "filepath": "C:\\Windows\\system32\\CRYPT32.dll" | |
| }, { | |
| "basename": "wdigest.DLL", | |
| "imgsize": 180224, | |
| "baseaddr": "0x74ef0000", | |
| "filepath": "C:\\Windows\\system32\\wdigest.DLL" | |
| }, { | |
| "basename": "rsaenh.dll", | |
| "imgsize": 241664, | |
| "baseaddr": "0x74eb0000", | |
| "filepath": "C:\\Windows\\system32\\rsaenh.dll" | |
| }, { | |
| "basename": "tspkg.DLL", | |
| "imgsize": 73728, | |
| "baseaddr": "0x74e70000", | |
| "filepath": "C:\\Windows\\system32\\tspkg.DLL" | |
| }, { | |
| "basename": "pku2u.DLL", | |
| "imgsize": 212992, | |
| "baseaddr": "0x74e30000", | |
| "filepath": "C:\\Windows\\system32\\pku2u.DLL" | |
| }, { | |
| "basename": "bcryptprimitives.dll", | |
| "imgsize": 249856, | |
| "baseaddr": "0x74df0000", | |
| "filepath": "C:\\Windows\\system32\\bcryptprimitives.dll" | |
| }, { | |
| "basename": "RpcRtRemote.dll", | |
| "imgsize": 57344, | |
| "baseaddr": "0x75600000", | |
| "filepath": "C:\\Windows\\system32\\RpcRtRemote.dll" | |
| }, { | |
| "basename": "efslsaext.dll", | |
| "imgsize": 53248, | |
| "baseaddr": "0x74ea0000", | |
| "filepath": "C:\\Windows\\system32\\efslsaext.dll" | |
| }, { | |
| "basename": "scecli.DLL", | |
| "imgsize": 188416, | |
| "baseaddr": "0x74dc0000", | |
| "filepath": "C:\\Windows\\system32\\scecli.DLL" | |
| }, { | |
| "basename": "credssp.dll", | |
| "imgsize": 32768, | |
| "baseaddr": "0x74db0000", | |
| "filepath": "C:\\Windows\\system32\\credssp.dll" | |
| }, { | |
| "basename": "WINSTA.dll", | |
| "imgsize": 167936, | |
| "baseaddr": "0x755d0000", | |
| "filepath": "C:\\Windows\\system32\\WINSTA.dll" | |
| }, { | |
| "basename": "wshtcpip.dll", | |
| "imgsize": 20480, | |
| "baseaddr": "0x74ba0000", | |
| "filepath": "C:\\Windows\\System32\\wshtcpip.dll" | |
| }, { | |
| "basename": "IPHLPAPI.DLL", | |
| "imgsize": 114688, | |
| "baseaddr": "0x72740000", | |
| "filepath": "C:\\Windows\\system32\\IPHLPAPI.DLL" | |
| }, { | |
| "basename": "WINNSI.DLL", | |
| "imgsize": 28672, | |
| "baseaddr": "0x72730000", | |
| "filepath": "C:\\Windows\\system32\\WINNSI.DLL" | |
| }, { | |
| "basename": "netutils.dll", | |
| "imgsize": 36864, | |
| "baseaddr": "0x73e80000", | |
| "filepath": "C:\\Windows\\system32\\netutils.dll" | |
| }, { | |
| "basename": "USERENV.dll", | |
| "imgsize": 94208, | |
| "baseaddr": "0x74c70000", | |
| "filepath": "C:\\Windows\\system32\\USERENV.dll" | |
| }, { | |
| "basename": "profapi.dll", | |
| "imgsize": 45056, | |
| "baseaddr": "0x75610000", | |
| "filepath": "C:\\Windows\\system32\\profapi.dll" | |
| }, { | |
| "basename": "samcli.dll", | |
| "imgsize": 61440, | |
| "baseaddr": "0x73e60000", | |
| "filepath": "C:\\Windows\\system32\\samcli.dll" | |
| }, { | |
| "basename": "SAMLIB.dll", | |
| "imgsize": 73728, | |
| "baseaddr": "0x749d0000", | |
| "filepath": "C:\\Windows\\system32\\SAMLIB.dll" | |
| }, { | |
| "basename": "dssenh.dll", | |
| "imgsize": 159744, | |
| "baseaddr": "0x70ee0000", | |
| "filepath": "C:\\Windows\\system32\\dssenh.dll" | |
| }, { | |
| "basename": "GPAPI.dll", | |
| "imgsize": 90112, | |
| "baseaddr": "0x74c50000", | |
| "filepath": "C:\\Windows\\system32\\GPAPI.dll" | |
| }, { | |
| "basename": "WLDAP32.dll", | |
| "imgsize": 282624, | |
| "baseaddr": "0x77600000", | |
| "filepath": "C:\\Windows\\system32\\WLDAP32.dll" | |
| }, { | |
| "basename": "monitor-x86.dll", | |
| "imgsize": 2117632, | |
| "baseaddr": "0x63dc0000", | |
| "filepath": "C:\\tmpgojdca\\bin\\monitor-x86.dll" | |
| }], | |
| "time": 70, | |
| "tid": 768, | |
| "first_seen": "2019-06-14T20:30:58.060Z", | |
| "ppid": 388, | |
| "type": "process" | |
| }, { | |
| "process_path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.exe", | |
| "calls": ["5d02dd4559bfaf1280fee9c2", "5d02dd4559bfaf1280fee9c3", "5d02dd4559bfaf1280fee9c4", "5d02dd4559bfaf1280fee9c5", "5d02dd4559bfaf1280fee9c6", "5d02dd4559bfaf1280fee9c7", "5d02dd4559bfaf1280fee9c8"], | |
| "track": true, | |
| "command_line": "\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.exe\" ", | |
| "process_name": "pafish.exe", | |
| "pid": 1008, | |
| "modules": [{ | |
| "basename": "pafish.exe", | |
| "imgsize": 98304, | |
| "baseaddr": "0x400000", | |
| "filepath": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.exe" | |
| }, { | |
| "basename": "ntdll.dll", | |
| "imgsize": 1294336, | |
| "baseaddr": "0x774c0000", | |
| "filepath": "C:\\Windows\\SYSTEM32\\ntdll.dll" | |
| }, { | |
| "basename": "kernel32.dll", | |
| "imgsize": 868352, | |
| "baseaddr": "0x75b10000", | |
| "filepath": "C:\\Windows\\system32\\kernel32.dll" | |
| }, { | |
| "basename": "KERNELBASE.dll", | |
| "imgsize": 303104, | |
| "baseaddr": "0x75890000", | |
| "filepath": "C:\\Windows\\system32\\KERNELBASE.dll" | |
| }, { | |
| "basename": "ADVAPI32.dll", | |
| "imgsize": 655360, | |
| "baseaddr": "0x75910000", | |
| "filepath": "C:\\Windows\\system32\\ADVAPI32.dll" | |
| }, { | |
| "basename": "msvcrt.dll", | |
| "imgsize": 704512, | |
| "baseaddr": "0x773b0000", | |
| "filepath": "C:\\Windows\\system32\\msvcrt.dll" | |
| }, { | |
| "basename": "sechost.dll", | |
| "imgsize": 102400, | |
| "baseaddr": "0x75cb0000", | |
| "filepath": "C:\\Windows\\SYSTEM32\\sechost.dll" | |
| }, { | |
| "basename": "RPCRT4.dll", | |
| "imgsize": 659456, | |
| "baseaddr": "0x75bf0000", | |
| "filepath": "C:\\Windows\\system32\\RPCRT4.dll" | |
| }, { | |
| "basename": "IPHLPAPI.DLL", | |
| "imgsize": 114688, | |
| "baseaddr": "0x72740000", | |
| "filepath": "C:\\Windows\\system32\\IPHLPAPI.DLL" | |
| }, { | |
| "basename": "NSI.dll", | |
| "imgsize": 24576, | |
| "baseaddr": "0x76fd0000", | |
| "filepath": "C:\\Windows\\system32\\NSI.dll" | |
| }, { | |
| "basename": "WINNSI.DLL", | |
| "imgsize": 28672, | |
| "baseaddr": "0x72730000", | |
| "filepath": "C:\\Windows\\system32\\WINNSI.DLL" | |
| }, { | |
| "basename": "MPR.DLL", | |
| "imgsize": 73728, | |
| "baseaddr": "0x723e0000", | |
| "filepath": "C:\\Windows\\system32\\MPR.DLL" | |
| }, { | |
| "basename": "ole32.dll", | |
| "imgsize": 1425408, | |
| "baseaddr": "0x759b0000", | |
| "filepath": "C:\\Windows\\system32\\ole32.dll" | |
| }, { | |
| "basename": "GDI32.dll", | |
| "imgsize": 319488, | |
| "baseaddr": "0x77360000", | |
| "filepath": "C:\\Windows\\system32\\GDI32.dll" | |
| }, { | |
| "basename": "USER32.dll", | |
| "imgsize": 823296, | |
| "baseaddr": "0x75ce0000", | |
| "filepath": "C:\\Windows\\system32\\USER32.dll" | |
| }, { | |
| "basename": "LPK.dll", | |
| "imgsize": 40960, | |
| "baseaddr": "0x75ca0000", | |
| "filepath": "C:\\Windows\\system32\\LPK.dll" | |
| }, { | |
| "basename": "USP10.dll", | |
| "imgsize": 643072, | |
| "baseaddr": "0x75f50000", | |
| "filepath": "C:\\Windows\\system32\\USP10.dll" | |
| }, { | |
| "basename": "OLEAUT32.dll", | |
| "imgsize": 585728, | |
| "baseaddr": "0x772a0000", | |
| "filepath": "C:\\Windows\\system32\\OLEAUT32.dll" | |
| }, { | |
| "basename": "SHELL32.dll", | |
| "imgsize": 12881920, | |
| "baseaddr": "0x760b0000", | |
| "filepath": "C:\\Windows\\system32\\SHELL32.dll" | |
| }, { | |
| "basename": "SHLWAPI.dll", | |
| "imgsize": 356352, | |
| "baseaddr": "0x77690000", | |
| "filepath": "C:\\Windows\\system32\\SHLWAPI.dll" | |
| }, { | |
| "basename": "WS2_32.dll", | |
| "imgsize": 217088, | |
| "baseaddr": "0x77650000", | |
| "filepath": "C:\\Windows\\system32\\WS2_32.dll" | |
| }, { | |
| "basename": "IMM32.DLL", | |
| "imgsize": 126976, | |
| "baseaddr": "0x77340000", | |
| "filepath": "C:\\Windows\\system32\\IMM32.DLL" | |
| }, { | |
| "basename": "MSCTF.dll", | |
| "imgsize": 835584, | |
| "baseaddr": "0x76f00000", | |
| "filepath": "C:\\Windows\\system32\\MSCTF.dll" | |
| }, { | |
| "basename": "monitor-x86.dll", | |
| "imgsize": 2117632, | |
| "baseaddr": "0x63dc0000", | |
| "filepath": "C:\\tmpgojdca\\bin\\monitor-x86.dll" | |
| }], | |
| "time": 30, | |
| "tid": 1836, | |
| "first_seen": "2019-06-14T20:30:59.792Z", | |
| "ppid": 1216, | |
| "type": "process" | |
| }], | |
| "processtree": [{ | |
| "track": false, | |
| "pid": 484, | |
| "process_name": "lsass.exe", | |
| "command_line": "C:\\Windows\\system32\\lsass.exe", | |
| "first_seen": "2019-06-14T20:30:58.060Z", | |
| "ppid": 388, | |
| "children": [] | |
| }, { | |
| "track": true, | |
| "pid": 1008, | |
| "process_name": "pafish.exe", | |
| "command_line": "\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.exe\" ", | |
| "first_seen": "2019-06-14T20:30:59.792Z", | |
| "ppid": 1216, | |
| "children": [] | |
| }], | |
| "summary": { | |
| "file_created": ["C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_mouse_act", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_CPU_VM_hypervisor_bit", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_CPU_VM_hv_vendor_name", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_pysicalmemory_less_1Gb", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_drive_size2", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.log", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_virtualbox", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_CPU_VM_rdtsc", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_NumberOfProcessors_less_2_GetSystemInfo", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_drive_size", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_CPU_VM_rdtsc_force_vm_exit", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_hooks_shellexecuteexw_m1", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_sandbox_NumberOfProcessors_less_2_raw"], | |
| "dll_loaded": ["kernel32.dll"], | |
| "file_opened": ["C:\\Users\\Administrator\\AppData\\Local\\Temp\\hi_virtualbox", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.log", "\\??\\PhysicalDrive0"], | |
| "regkey_opened": ["HKEY_LOCAL_MACHINE\\HARDWARE\\Description\\System", "HKEY_LOCAL_MACHINE\\HARDWARE\\ACPI\\FADT\\VBOX__", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Oracle\\VirtualBox Guest Additions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\VMware, Inc.\\VMware Tools", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxSF", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}", "HKEY_CURRENT_USER\\SOFTWARE\\Wine", "HKEY_LOCAL_MACHINE\\HARDWARE\\ACPI\\DSDT\\VBOX__", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxGuest", "HKEY_CURRENT_USER\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}", "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxMouse", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxService", "HKEY_LOCAL_MACHINE\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\VBoxVideo", "HKEY_LOCAL_MACHINE\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "HKEY_LOCAL_MACHINE\\HARDWARE\\ACPI\\RSDT\\VBOX__"], | |
| "resolves_host": ["hi-hooks-shellexecuteexw-m1.pafish", "hi-sandbox-drive-size2.pafish", "hi-sandbox-pysicalmemory-less-1Gb.pafish", "hi-sandbox-drive-size.pafish", "hi-CPU-VM-rdtsc.pafish", "analysis-start.pafish", "analysis-end.pafish", "hi-virtualbox.pafish", "hi-CPU-VM-hypervisor-bit.pafish", "hi-CPU-VM-rdtsc-force-vm-exit.pafish", "hi-sandbox-NumberOfProcessors-less-2-GetSystemInfo.pafish", "hi-sandbox-mouse-act.pafish", "hi-sandbox-NumberOfProcessors-less-2-raw.pafish", "hi-CPU-VM-hv-vendor-name.pafish"], | |
| "file_written": ["C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.log"], | |
| "file_exists": ["C:\\Windows\\System32\\vboxoglfeedbackspu.dll", "C:\\Windows\\System32\\drivers\\VBoxSF.sys", "C:\\Windows\\System32\\drivers\\VBoxMouse.sys", "C:\\sample.exe", "C:\\program files\\oracle\\virtualbox guest additions\\", "C:\\Windows\\System32\\vboxoglerrorspu.dll", "C:\\Windows\\System32\\drivers\\VBoxVideo.sys", "C:\\Windows\\System32\\vboxoglpassthroughspu.dll", "C:\\Windows\\System32\\vboxoglpackspu.dll", "C:\\Windows\\System32\\drivers\\VBoxGuest.sys", "C:\\Windows\\System32\\vboxoglcrutil.dll", "C:\\malware.exe", "C:\\Windows\\System32\\drivers\\vmmouse.sys", "C:\\Windows\\System32\\vboxdisp.dll", "C:\\Windows\\System32\\vboxmrxnp.dll", "D:\\sample.exe", "C:\\Windows\\System32\\vboxogl.dll", "D:\\malware.exe", "C:\\Windows\\System32\\VBoxControl.exe", "C:\\Windows\\System32\\vboxservice.exe", "C:\\Windows\\System32\\vboxhook.dll", "C:\\Windows\\System32\\vboxtray.exe", "C:\\Windows\\System32\\drivers\\vmhgfs.sys", "C:\\Windows\\System32\\vboxoglarrayspu.dll"], | |
| "file_failed": ["\\??\\vmci", "\\??\\VBoxTrayIPC", "\\??\\HGFS", "\\\\?\\pipe\\VBoxTrayIPC", "\\\\?\\pipe\\VBoxMiniRdDN", "\\??\\VBoxMiniRdrDN"], | |
| "wmi_query": ["SELECT DeviceId FROM Win32_PnPEntity", "SELECT SerialNumber FROM Win32_Bios"], | |
| "guid": ["{4590f811-1d3a-11d0-891f-00aa004b2e24}", "{8bc3f05e-d86b-11d0-a075-00c04fb68820}", "{7c857801-7381-11cf-884d-00aa004b2e24}", "{d5f569d0-593b-101a-b569-08002b2dbf7a}", "{f309ad18-d86a-11d0-a075-00c04fb68820}", "{dc12a687-737f-11cf-884d-00aa004b2e24}"], | |
| "regkey_read": ["HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\VideoBiosVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\SystemBiosDate", "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\SystemBiosVersion", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"] | |
| } | |
| }, | |
| "debug": { | |
| "action": [], | |
| "dbgview": [], | |
| "errors": [], | |
| "log": ["2019-06-14 06:30:44,230 [analyzer] DEBUG: Starting analyzer from: C:\\tmpgojdca\n", "2019-06-14 06:30:44,240 [analyzer] DEBUG: Pipe server name: \\??\\PIPE\\CaAFHehVaazEuTcVhrkZDg\n", "2019-06-14 06:30:44,240 [analyzer] DEBUG: Log pipe server name: \\??\\PIPE\\FAAxfZgyRsPHKziuHWpCWkLRwpsPV\n", "2019-06-14 06:30:44,670 [analyzer] DEBUG: Started auxiliary module DbgView\n", "2019-06-14 06:30:57,578 [analyzer] DEBUG: Started auxiliary module Disguise\n", "2019-06-14 06:30:58,210 [analyzer] DEBUG: Loaded monitor into process with pid 484\n", "2019-06-14 06:30:58,240 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets\n", "2019-06-14 06:30:58,299 [analyzer] DEBUG: Started auxiliary module Human\n", "2019-06-14 06:30:58,309 [analyzer] DEBUG: Started auxiliary module InstallCertificate\n", "2019-06-14 06:30:58,309 [analyzer] DEBUG: Started auxiliary module Reboot\n", "2019-06-14 06:30:58,750 [analyzer] DEBUG: Started auxiliary module RecentFiles\n", "2019-06-14 06:30:58,760 [modules.auxiliary.screenshots] INFO: Python Image Library (either PIL or Pillow) is not installed, screenshots are disabled.\n", "2019-06-14 06:30:58,760 [analyzer] DEBUG: Started auxiliary module Screenshots\n", "2019-06-14 06:30:58,760 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n\n", "2019-06-14 06:30:59,391 [lib.api.process] INFO: Successfully executed process from path u'C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\pafish.exe' with arguments '' and pid 1008\n", "2019-06-14 06:31:00,562 [analyzer] DEBUG: Loaded monitor into process with pid 1008\n", "2019-06-14 06:31:00,602 [analyzer] INFO: Added new file to list with pid 1008 and path C:\\Users\\Administrator\\AppData\\Local\\Temp\\pafish.log\n", "2019-06-14 06:32:58,872 [analyzer] INFO: Analysis timeout hit, terminating analysis.\n", "2019-06-14 06:33:07,456 [lib.api.process] INFO: Memory dump of process with pid 1008 completed\n", "2019-06-14 06:33:07,565 [analyzer] INFO: Analysis completed.\n"], | |
| "cuckoo": ["2019-06-14 06:30:45,924 [cuckoo.core.scheduler] INFO: Task #1180: acquired machine cuckoo (label=cuckoo)\n", "2019-06-14 06:30:45,935 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 19942 (interface=vboxnet0, host=192.168.56.101)\n", "2019-06-14 06:30:45,936 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer\n", "2019-06-14 06:30:45,990 [cuckoo.machinery.virtualbox] DEBUG: Starting vm cuckoo\n", "2019-06-14 06:30:46,182 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine cuckoo to its current snapshot\n", "2019-06-14 06:30:50,178 [cuckoo.core.guest] INFO: Starting analysis on guest (id=cuckoo, ip=192.168.56.101)\n", "2019-06-14 06:30:51,182 [cuckoo.core.guest] DEBUG: cuckoo: not ready yet\n", "2019-06-14 06:30:52,186 [cuckoo.core.guest] DEBUG: cuckoo: not ready yet\n", "2019-06-14 06:30:53,193 [cuckoo.core.guest] DEBUG: cuckoo: not ready yet\n", "2019-06-14 06:30:53,226 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.8 (id=cuckoo, ip=192.168.56.101)\n", "2019-06-14 06:30:53,274 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=cuckoo, ip=192.168.56.101, monitor=latest, size=3967696)\n", "2019-06-14 06:30:55,297 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:30:56,345 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:30:57,361 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:30:57,499 [cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized.\n", "2019-06-14 06:30:58,412 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:30:59,426 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:00,444 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:01,463 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:02,496 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:03,544 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:04,558 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:05,575 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:06,589 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:07,603 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:08,621 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:09,636 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:10,651 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:11,792 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:12,836 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:13,451 [cuckoo.core.resultserver] DEBUG: New process (pid=1008, ppid=1216, name=pafish.exe)\n", "2019-06-14 06:31:13,874 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:14,968 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:15,985 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:17,026 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:18,067 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:19,088 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:20,104 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:21,123 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:22,136 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:23,150 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:24,172 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:25,206 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:26,222 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:27,265 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:28,287 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:29,303 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:30,318 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:31,333 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:32,350 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:33,383 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:34,406 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:35,437 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:36,462 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:37,490 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:38,519 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:39,547 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:40,561 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:41,576 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:42,590 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:43,614 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:44,628 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:45,648 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:46,704 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:47,722 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:48,738 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:49,753 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:50,775 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:51,799 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:52,814 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:53,831 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:54,847 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:55,863 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:56,886 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:57,904 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:58,931 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:31:59,949 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:00,966 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:01,983 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:03,000 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:04,026 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:05,060 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:06,078 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:07,096 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:08,111 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:09,131 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:10,146 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:11,161 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:12,180 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:13,198 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:14,214 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:15,231 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:16,246 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:17,266 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:18,285 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:19,311 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:20,328 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:21,349 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:22,370 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:23,403 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:24,420 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:25,440 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:26,466 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:27,490 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:28,511 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:29,530 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:30,547 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:31,567 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:32,581 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:33,600 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:34,615 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:35,629 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:36,641 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:37,675 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:38,689 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:39,707 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:40,717 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:41,734 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:42,751 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:43,768 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:44,787 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:45,802 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:46,820 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:47,840 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:48,855 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:49,872 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:50,890 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:51,907 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:52,921 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:53,937 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:54,954 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:55,972 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:56,988 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:58,004 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:32:59,026 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:00,050 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:01,078 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:02,092 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:03,109 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:04,124 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:05,137 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:06,154 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:07,170 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:08,188 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:09,212 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:10,233 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:11,247 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:12,266 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:13,282 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:14,308 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:15,324 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:16,344 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:17,386 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:18,404 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:19,418 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:19,455 [cuckoo.core.resultserver] DEBUG: File upload request for memory/1008-1.dmp\n", "2019-06-14 06:33:20,444 [cuckoo.core.guest] DEBUG: cuckoo: analysis still processing\n", "2019-06-14 06:33:21,062 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 36631976\n", "2019-06-14 06:33:21,155 [cuckoo.core.resultserver] DEBUG: File upload request for files/694e192e2bf7c06f_pafish.log\n", "2019-06-14 06:33:21,186 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 1150\n", "2019-06-14 06:33:21,459 [cuckoo.core.guest] INFO: cuckoo: analysis completed successfully\n", "2019-06-14 06:33:21,521 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer\n", "2019-06-14 06:33:21,522 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm cuckoo\n", "2019-06-14 06:33:23,053 [cuckoo.core.scheduler] DEBUG: Released database task #1180\n", "2019-06-14 06:33:23,114 [cuckoo.core.plugins] DEBUG: Executed processing module \"AnalysisInfo\" for task #1180\n", "2019-06-14 06:33:23,139 [cuckoo.core.plugins] DEBUG: Executed processing module \"BehaviorAnalysis\" for task #1180\n", "2019-06-14 06:33:23,150 [cuckoo.core.plugins] DEBUG: Executed processing module \"Dropped\" for task #1180\n", "2019-06-14 06:33:23,151 [cuckoo.core.plugins] DEBUG: Executed processing module \"DroppedBuffer\" for task #1180\n", "2019-06-14 06:33:23,609 [cuckoo.core.plugins] DEBUG: Executed processing module \"MetaInfo\" for task #1180\n", "2019-06-14 06:33:23,986 [cuckoo.core.plugins] DEBUG: Executed processing module \"ProcessMemory\" for task #1180\n", "2019-06-14 06:33:23,986 [cuckoo.core.plugins] DEBUG: Executed processing module \"Procmon\" for task #1180\n", "2019-06-14 06:33:23,987 [cuckoo.core.plugins] DEBUG: Executed processing module \"Screenshots\" for task #1180\n", "2019-06-14 06:33:24,751 [cuckoo.core.plugins] DEBUG: Executed processing module \"Static\" for task #1180\n", "2019-06-14 06:33:24,757 [cuckoo.core.plugins] DEBUG: Executed processing module \"Strings\" for task #1180\n", "2019-06-14 06:33:24,761 [cuckoo.core.plugins] DEBUG: Executed processing module \"TargetInfo\" for task #1180\n", "2019-06-14 06:33:24,765 [cuckoo.core.plugins] DEBUG: Executed processing module \"NetworkAnalysis\" for task #1180\n", "2019-06-14 06:33:24,765 [cuckoo.core.plugins] DEBUG: Executed processing module \"Extracted\" for task #1180\n", "2019-06-14 06:33:24,766 [cuckoo.core.plugins] DEBUG: Executed processing module \"TLSMasterSecrets\" for task #1180\n", "2019-06-14 06:33:24,771 [cuckoo.core.plugins] DEBUG: Executed processing module \"Debug\" for task #1180\n", "2019-06-14 06:33:24,775 [cuckoo.core.plugins] DEBUG: Running 540 signatures\n", "2019-06-14 06:33:25,377 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antisandbox_file\n", "2019-06-14 06:33:25,378 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_generic_bios\n", "2019-06-14 06:33:25,378 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_queries_computername\n", "2019-06-14 06:33:25,379 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_disk_size\n", "2019-06-14 06:33:25,379 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_shared_device\n", "2019-06-14 06:33:25,379 [cuckoo.core.plugins] DEBUG: Analysis matched signature: checks_debugger\n", "2019-06-14 06:33:25,379 [cuckoo.core.plugins] DEBUG: Analysis matched signature: console_output\n", "2019-06-14 06:33:25,379 [cuckoo.core.plugins] DEBUG: Analysis matched signature: recon_fingerprint\n", "2019-06-14 06:33:25,380 [cuckoo.core.plugins] DEBUG: Analysis matched signature: has_wmi\n", "2019-06-14 06:33:25,380 [cuckoo.core.plugins] DEBUG: Analysis matched signature: injection_process_search\n", "2019-06-14 06:33:25,380 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_memory_available\n", "2019-06-14 06:33:25,380 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_network_adapters\n", "2019-06-14 06:33:25,380 [cuckoo.core.plugins] DEBUG: Analysis matched signature: packer_entropy\n", "2019-06-14 06:33:25,380 [cuckoo.core.plugins] DEBUG: Analysis matched signature: memdump_urls\n", "2019-06-14 06:33:25,381 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antisandbox_joe_anubis_files\n", "2019-06-14 06:33:25,381 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_vbox_devices\n", "2019-06-14 06:33:25,381 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_vbox_files\n", "2019-06-14 06:33:25,381 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_vbox_keys\n", "2019-06-14 06:33:25,381 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_vbox_provname\n", "2019-06-14 06:33:25,382 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_vbox_window\n", "2019-06-14 06:33:25,382 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_vmware_files\n", "2019-06-14 06:33:25,382 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_vmware_keys\n", "2019-06-14 06:33:25,382 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antiemu_wine\n", "2019-06-14 06:33:25,382 [cuckoo.core.plugins] DEBUG: Analysis matched signature: wmi_antivm\n", "2019-06-14 06:33:25,540 [cuckoo.core.plugins] DEBUG: Executed reporting module \"JsonDump\"\n"] | |
| }, | |
| "metadata": { | |
| "output": { | |
| "memdumps": [{ | |
| "basename": "1008-1.dmp", | |
| "sha256": "b1f5a4a8f43b4cd2072ce903eb56edd7b4f4cf13691d558a6142ff175852b82a", | |
| "dirname": "memory" | |
| }], | |
| "pcap": { | |
| "basename": "dump.pcap", | |
| "sha256": "5c6a97a058e5bc3f6b49e054a8e8969aeaab125e8ea689a9f7da861f2af95617", | |
| "dirname": "" | |
| }, | |
| "dropped": [{ | |
| "basename": "694e192e2bf7c06f_pafish.log", | |
| "sha256": "694e192e2bf7c06f43105877ccb2915d64c99bbe3aedbc9f927e700cb7c6df04", | |
| "dirname": "files" | |
| }] | |
| } | |
| }, | |
| "strings": ["!This program cannot be run in DOS mode.", "P`.data", ".rdata", "[email protected]", ".idata", "libgcj-16.dll", "_Jv_RegisterClasses", "analysis-start", "%lu.%lu build %lu", "[*] Windows version: %s", "[*] CPU: %s", " Hypervisor: %s", " CPU brand: %s", "Windows version: %s", "CPU: %s (HV: %s) %s", "CPU: %s %s", "Debuggers detection", "hi_debugger_isdebuggerpresent", "Debugger traced using IsDebuggerPresent()", "Using IsDebuggerPresent()", "hi_debugger_outputdebugstring", "Debugger traced using OutputDebugString()", "Using OutputDebugString()", "CPU information based detections", "hi_CPU_VM_rdtsc", "CPU VM traced by checking the difference between CPU timestamp counters (rdtsc)", "Checking the difference between CPU timestamp counters (rdtsc)", "hi_CPU_VM_rdtsc_force_vm_exit", "CPU VM traced by checking the difference between CPU timestamp counters (rdtsc) forcing VM exit", "Checking the difference between CPU timestamp counters (rdtsc) forcing VM exit", "hi_CPU_VM_hypervisor_bit", "CPU VM traced by checking hypervisor bit in cpuid feature bits", "Checking hypervisor bit in cpuid feature bits", "hi_CPU_VM_hv_vendor_name", "CPU VM traced by checking cpuid hypervisor vendor for known VM vendors", "Checking cpuid hypervisor vendor for known VM vendors", "Generic sandbox detection", "hi_sandbox_mouse_act", "Sandbox traced using mouse activity", "Using mouse activity", "hi_sandbox_username", "Sandbox traced by checking username", "Checking username", "hi_sandbox_path", "Sandbox traced by checking file path", "Checking file path", "hi_sandbox_common_names", "Sandbox traced by checking common sample names in drives root", "Checking common sample names in drives root", "hi_sandbox_drive_size", "Sandbox traced by checking disk size <= 60GB via DeviceIoControl()", "Checking if disk size <= 60GB via DeviceIoControl()", "hi_sandbox_drive_size2", "Sandbox traced by checking disk size <= 60GB via GetDiskFreeSpaceExA()", "Checking if disk size <= 60GB via GetDiskFreeSpaceExA()", "hi_sandbox_sleep_gettickcount", "Sandbox traced by checking if Sleep() was patched using GetTickCount()", "Checking if Sleep() is patched using GetTickCount()", "hi_sandbox_NumberOfProcessors_less_2_raw", "Sandbox traced by checking if NumberOfProcessors is less than 2 via raw access", "Checking if NumberOfProcessors is < 2 via raw access", "hi_sandbox_NumberOfProcessors_less_2_GetSystemInfo", "Sandbox traced by checking if NumberOfProcessors is less than 2 via GetSystemInfo()", "Checking if NumberOfProcessors is < 2 via GetSystemInfo()", "hi_sandbox_pysicalmemory_less_1Gb", "Sandbox traced by checking if pysical memory is less than 1Gb", "Checking if pysical memory is < 1Gb", "hi_sandbox_uptime", "Sandbox traced by checking operating system uptime using GetTickCount()", "Checking operating system uptime using GetTickCount()", "hi_sandbox_IsNativeVhdBoot", "Sandbox traced by checking IsNativeVhdBoot()", "Checking if operating system IsNativeVhdBoot()", "Hooks detection", "hi_hooks_shellexecuteexw_m1", "Hooks traced using ShellExecuteExW method 1", "Checking function ShellExecuteExW method 1", "hi_hooks_createprocessa_m1", "Hooks traced using CreateProcessA method 1", "Checking function CreateProcessA method 1", "Sandboxie detection", "hi_sandboxie", "Sandboxie traced using GetModuleHandle(sbiedll.dll)", "Using GetModuleHandle(sbiedll.dll)", "Wine detection", "hi_wine", "Wine traced using GetProcAddress(wine_get_unix_file_name) from kernel32.dll", "Using GetProcAddress(wine_get_unix_file_name) from kernel32.dll", "Wine traced using Reg key HKCU\\SOFTWARE\\Wine", "Reg key (HKCU\\SOFTWARE\\Wine)", "VirtualBox detection", "hi_virtualbox", "VirtualBox traced using Reg key HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0 \"Identifier\"", "Scsi port->bus->target id->logical unit id-> 0 identifier", "VirtualBox traced using Reg key HKLM\\HARDWARE\\Description\\System \"SystemBiosVersion\"", "Reg key (HKLM\\HARDWARE\\Description\\System \"SystemBiosVersion\")", "VirtualBox traced using Reg key HKLM\\SOFTWARE\\Oracle\\VirtualBox Guest Additions", "Reg key (HKLM\\SOFTWARE\\Oracle\\VirtualBox Guest Additions)", "VirtualBox traced using Reg key HKLM\\HARDWARE\\Description\\System \"VideoBiosVersion\"", "Reg key (HKLM\\HARDWARE\\Description\\System \"VideoBiosVersion\")", "VirtualBox traced using Reg key HKLM\\HARDWARE\\ACPI\\DSDT\\VBOX__", "Reg key (HKLM\\HARDWARE\\ACPI\\DSDT\\VBOX__)", "VirtualBox traced using Reg key HKLM\\HARDWARE\\ACPI\\FADT\\VBOX__", "Reg key (HKLM\\HARDWARE\\ACPI\\FADT\\VBOX__)", "VirtualBox traced using Reg key HKLM\\HARDWARE\\ACPI\\RSDT\\VBOX__", "Reg key (HKLM\\HARDWARE\\ACPI\\RSDT\\VBOX__)", "Reg key (HKLM\\SYSTEM\\ControlSet001\\Services\\VBox*)", "VirtualBox traced using Reg key HKLM\\HARDWARE\\DESCRIPTION\\System \"SystemBiosDate\"", "Reg key (HKLM\\HARDWARE\\DESCRIPTION\\System \"SystemBiosDate\")", "Driver files in C:\\WINDOWS\\system32\\drivers\\VBox*", "Additional system files", "VirtualBox traced using MAC address starting with 08:00:27", "Looking for a MAC address starting with 08:00:27", "Looking for pseudo devices", "VirtualBox traced using VBoxTray windows", "Looking for VBoxTray windows", "VirtualBox traced using its network share", "Looking for VBox network share", "Looking for VBox processes (vboxservice.exe, vboxtray.exe)", "VirtualBox device identifiers traced using WMI", "Looking for VBox devices using WMI", "VMware detection", "hi_vmware", "VMWare traced using Reg key HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0,1,2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0 \"Identifier\"", "Scsi port 0,1,2 ->bus->target id->logical unit id-> 0 identifier", "VMware traced using Reg key HKLM\\SOFTWARE\\VMware, Inc.\\VMware Tools", "Reg key (HKLM\\SOFTWARE\\VMware, Inc.\\VMware Tools)", "VMware traced using file C:\\WINDOWS\\system32\\drivers\\vmmouse.sys", "Looking for C:\\WINDOWS\\system32\\drivers\\vmmouse.sys", "VMware traced using file C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys", "Looking for C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys", "VMware traced using MAC address starting with 00:05:69, 00:0C:29, 00:1C:14 or 00:50:56", "Looking for a MAC address starting with 00:05:69, 00:0C:29, 00:1C:14 or 00:50:56", "VMware traced using network adapter name", "Looking for network adapter name", "VMware serial number traced using WMI", "Looking for VMware serial number", "Qemu detection", "hi_qemu", "Qemu traced using Reg key HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0 \"Identifier\"", "Qemu traced using Reg key HKLM\\HARDWARE\\Description\\System \"SystemBiosVersion\"", "Qemu traced using CPU brand string 'QEMU Virtual CPU'", "cpuid CPU brand string 'QEMU Virtual CPU'", "Bochs detection", "hi_bochs", "Bochs traced using Reg key HKLM\\HARDWARE\\Description\\System \"SystemBiosVersion\"", "Bochs traced using CPU AMD wrong value for processor name", "cpuid AMD wrong value for processor name", "Bochs traced using CPU Intel wrong value for processor name", "cpuid Intel wrong value for processor name", "Cuckoo detection", "hi_cuckoo", "Cuckoo hooks information structure traced in the TLS", "Looking in the TLS for the hooks information structure", "[-] Feel free to RE me, check log file for more information.", "analysis-end", "* Pafish (", "Paranoid fish", "Some anti(debugger/VM/sandbox) tricks", "used by malware for the general public.", "traced!", "[pafish] %s", "pafish.log", "[-] %s", "[*] %s ... ", "kernel32", "Wow64DisableWow64FsRedirection", "Wow64RevertWow64FsRedirection", "IsWow64Process", "useless", "sbiedll.dll", "Identifier", "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "SystemBiosVersion", "HARDWARE\\Description\\System", "SOFTWARE\\Oracle\\VirtualBox Guest Additions", "VIRTUALBOX", "VideoBiosVersion", "HARDWARE\\ACPI\\DSDT\\VBOX__", "HARDWARE\\ACPI\\FADT\\VBOX__", "HARDWARE\\ACPI\\RSDT\\VBOX__", "SYSTEM\\ControlSet001\\Services\\VBoxGuest", "SYSTEM\\ControlSet001\\Services\\VBoxMouse", "SYSTEM\\ControlSet001\\Services\\VBoxService", "SYSTEM\\ControlSet001\\Services\\VBoxSF", "SYSTEM\\ControlSet001\\Services\\VBoxVideo", "VirtualBox traced using Reg key HKLM\\%s", "06/23/99", "SystemBiosDate", "HARDWARE\\DESCRIPTION\\System", "C:\\WINDOWS\\system32\\drivers\\VBoxMouse.sys", "C:\\WINDOWS\\system32\\drivers\\VBoxGuest.sys", "C:\\WINDOWS\\system32\\drivers\\VBoxSF.sys", "C:\\WINDOWS\\system32\\drivers\\VBoxVideo.sys", "VirtualBox traced using driver file %s", "C:\\WINDOWS\\system32\\vboxdisp.dll", "C:\\WINDOWS\\system32\\vboxhook.dll", "C:\\WINDOWS\\system32\\vboxmrxnp.dll", "C:\\WINDOWS\\system32\\vboxogl.dll", "C:\\WINDOWS\\system32\\vboxoglarrayspu.dll", "C:\\WINDOWS\\system32\\vboxoglcrutil.dll", "C:\\WINDOWS\\system32\\vboxoglerrorspu.dll", "C:\\WINDOWS\\system32\\vboxoglfeedbackspu.dll", "C:\\WINDOWS\\system32\\vboxoglpackspu.dll", "C:\\WINDOWS\\system32\\vboxoglpassthroughspu.dll", "C:\\WINDOWS\\system32\\vboxservice.exe", "C:\\WINDOWS\\system32\\vboxtray.exe", "C:\\WINDOWS\\system32\\VBoxControl.exe", "C:\\program files\\oracle\\virtualbox guest additions\\", "VirtualBox traced using system file %s", "\\\\.\\VBoxMiniRdrDN", "\\\\.\\pipe\\VBoxMiniRdDN", "\\\\.\\VBoxTrayIPC", "\\\\.\\pipe\\VBoxTrayIPC", "VirtualBox traced using device %s", "VBoxTrayToolWndClass", "VBoxTrayToolWnd", "VirtualBox Shared Folders", "vboxservice.exe", "VirtualBox traced using vboxservice.exe process", "vboxtray.exe", "VirtualBox traced using vboxtray.exe process", "SANDBOX", "MALWARE", "\\SAMPLE", "\\VIRUS", "%ssample.exe", "%smalware.exe", "\\\\.\\PhysicalDrive0", "kernel32", "IsNativeVhdBoot", "kernel32.dll", "wine_get_unix_file_name", "SOFTWARE\\Wine", "VMWARE", "Identifier", "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "SOFTWARE\\VMware, Inc.\\VMware Tools", "C:\\WINDOWS\\system32\\drivers\\vmmouse.sys", "C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys", "VMware", "\\\\.\\HGFS", "\\\\.\\vmci", "VMWare traced using device %s", "Identifier", "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", "SystemBiosVersion", "HARDWARE\\Description\\System", "QEMU Virtual CPU", "%c%c%c%c", "KVMKVMKVM", "Microsoft Hv", "VMwareVMware", "XenVMMXenVMM", "prl hyperv ", "VBoxVBoxVBox", "SystemBiosVersion", "HARDWARE\\Description\\System", "AMD Athlon(tm) processor", " Intel(R) Pentium(R) 4 CPU ", "Unknown error", "_matherr(): %s in %s(%g, %g) (retval=%g)", "Argument domain error (DOMAIN)", "Argument singularity (SIGN)", "Overflow range error (OVERFLOW)", "The result is too small to be represented (UNDERFLOW)", "Total loss of significance (TLOSS)", "Partial loss of significance (PLOSS)", "Mingw-w64 runtime failure:", "Address %p has no image-section", " VirtualQuery failed for %d bytes at address %p", " VirtualProtect failed with code 0x%x", " Unknown pseudo relocation protocol version %d.", " Unknown pseudo relocation bit size %d.", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 6.1.1 20160815", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 5.4.0 20160609", "GCC: (GNU) 6.1.1 20160815", "GetUserNameA", "RegCloseKey", "RegOpenKeyExA", "RegQueryValueExA", "GetAdaptersAddresses", "CloseHandle", "CreateFileA", "CreateProcessA", "CreateToolhelp32Snapshot", "DeleteCriticalSection", "DeleteFileW", "DeviceIoControl", "EnterCriticalSection", "GetConsoleScreenBufferInfo", "GetCurrentProcess", "GetCurrentProcessId", "GetCurrentThreadId", "GetDiskFreeSpaceExA", "GetDriveTypeA", "GetFileAttributesA", "GetLastError", "GetLogicalDriveStringsA", "GetModuleFileNameA", "GetModuleHandleA", "GetProcAddress", "GetStartupInfoA", "GetStdHandle", "GetSystemInfo", "GetSystemTimeAsFileTime", "GetTickCount", "GetVersionExA", "GlobalMemoryStatusEx", "InitializeCriticalSection", "IsDebuggerPresent", "LeaveCriticalSection", "LocalAlloc", "LocalFree", "OutputDebugStringA", "Process32First", "Process32Next", "QueryPerformanceCounter", "SetConsoleTextAttribute", "SetLastError", "SetUnhandledExceptionFilter", "TerminateProcess", "TlsGetValue", "UnhandledExceptionFilter", "VirtualProtect", "VirtualQuery", "lstrcmpiA", "WNetGetProviderNameA", "__dllonexit", "__getmainargs", "__initenv", "__lconv_init", "__set_app_type", "__setusermatherr", "_acmdln", "_amsg_exit", "_cexit", "_fmode", "_initterm", "_onexit", "calloc", "fclose", "fprintf", "fwrite", "getchar", "malloc", "mbstowcs", "memcmp", "memcpy", "printf", "signal", "sprintf", "strlen", "strncat", "strncmp", "strncpy", "strstr", "_unlock", "toupper", "vfprintf", "wcsstr", "_vsnprintf", "CoCreateInstance", "CoInitializeEx", "CoInitializeSecurity", "CoUninitialize", "SysAllocString", "SysFreeString", "ShellExecuteExW", "FindWindowA", "GetCursorPos", "freeaddrinfo", "getaddrinfo", "ADVAPI32.dll", "IPHLPAPI.DLL", "KERNEL32.dll", "MPR.DLL", "msvcrt.dll", "ole32.dll", "OLEAUT32.dll", "SHELL32.dll", "USER32.dll", "WS2_32.dll", "'R,4B:", "s)%0;7", " &0V/(z", "yn<^272S", "=BS{U\\", "Zz;7rv", "hAn`5u", "x&\u001f\u001f.^", "^RzDd!", "\\jab|,", "`(,?QZ", "<w~<O*f", "xT U9-^", "ZbeJK_", "9h' a", "sySumI", "w05v4;", "{M=VYD", "\u001fXwyyd1S", "E>`b|,", "nmjN]~", "G`WcI=", ">tX~ /", "?^Gi[E", "xa2W DO", "cp(e|:", "/NdoCT)", "*J`,WF", "qAt/n-", "hkibXy7", "S&wv+b+", "eIDATh", "R^A)o/", "1=yDXG p", "sIDATX", "/ffclFae&", "gx|OP\u001fxFu", "!Eh,*d", "gq*Kb9", "JBG%`d", "DeviceId", "PCI\\VEN_80EE&DEV_CAFE", "root\\cimv2", "SELECT DeviceId FROM Win32_PnPEntity", "sSerialNumber", "VMware", "root\\cimv2", "SELECT SerialNumber FROM Win32_Bios", "VS_VERSION_INFO", "StringFileInfo", "040904E4", "CompanyName", "FileVersion", "FileDescription", "Paranoid Fish is paranoid", "InternalName", "LegalCopyright", "LegalTrademarks", "OriginalFilename", "ProductName", "Paranoid Fish", "ProductVersion", "VarFileInfo", "Translation"], | |
| "network": { | |
| "tls": [], | |
| "udp": [{ | |
| "src": "192.168.56.101", | |
| "dst": "239.255.255.250", | |
| "offset": 826, | |
| "time": 3.5624828338623047, | |
| "dport": 1900, | |
| "sport": 49160 | |
| }], | |
| "dns_servers": [], | |
| "http": [], | |
| "pcap_id": "5d02dd4559bfaf1280fee9bc", | |
| "icmp": [], | |
| "smtp": [], | |
| "tcp": [], | |
| "smtp_ex": [], | |
| "sorted_pcap_id": "5d02dd4559bfaf1280fee9be", | |
| "mitm": [], | |
| "hosts": [], | |
| "pcap_sha256": "5c6a97a058e5bc3f6b49e054a8e8969aeaab125e8ea689a9f7da861f2af95617", | |
| "dns": [], | |
| "http_ex": [], | |
| "domains": [], | |
| "dead_hosts": [], | |
| "sorted_pcap_sha256": "c00ea07190eaafe12d877677b84fb8cece5064e9d631b876077db46e894de794", | |
| "irc": [], | |
| "https_ex": [] | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment