API tools faq
paste
paladin316

mshta_exe_2019-07-02_13_30.json

paladin316
Jul 2nd, 2019
2,123
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.97 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 2.0
  5.  
  6. [*] File Name: "mshta.exe"
  7. [*] File Size: 1084424
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "7594ad0bbe6cf2a2343675b42ed6a8c4571a465b8735efd3b954116d9694005b"
  10. [*] MD5: "795b3c1ba5fb25640efa0367214a2d08"
  11. [*] SHA1: "f1b1b7ca5820d319545331b0094a92f75fddcdb9"
  12. [*] SHA512: "273cc1b0bab09eea4e0d52dc3cdd44e5bcddb3b3a8f3f43026be1e8039919056ce43b2317e6d316bd206891a25d8f28114c49389931a8e77882410d5520ea795"
  13. [*] CRC32: "60F28DF9"
  14. [*] SSDEEP: "24576:IBXu9HGaVHeCrsqI9Nc2UtgHPPGbpeE50Yfs:Iw9VHeCrdI9OjKvPGbpr55E"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: UPX1, entropy: 7.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00055c00, virtual_size: 0x00056000"
  24. },
  25. {
  26. "section": "name: .rsrc, entropy: 7.96, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x000b2c00, virtual_size: 0x000b3000"
  27. }
  28. ]
  29. },
  30. {
  31. "Description": "The executable is compressed using UPX",
  32. "Details": [
  33. {
  34. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00133000"
  35. }
  36. ]
  37. }
  38. ]
  39.  
  40. [*] Started Service: []
  41.  
  42. [*] Executed Commands: []
  43.  
  44. [*] Mutexes: []
  45.  
  46. [*] Modified Files: []
  47.  
  48. [*] Deleted Files: []
  49.  
  50. [*] Modified Registry Keys: []
  51.  
  52. [*] Deleted Registry Keys: []
  53.  
  54. [*] DNS Communications: []
  55.  
  56. [*] Domains: []
  57.  
  58. [*] Network Communication - ICMP: []
  59.  
  60. [*] Network Communication - HTTP: []
  61.  
  62. [*] Network Communication - SMTP: []
  63.  
  64. [*] Network Communication - Hosts: []
  65.  
  66. [*] Network Communication - IRC: []
  67.  
  68. [*] Static Analysis: {
  69. "pe": {
  70. "peid_signatures": null,
  71. "imports": [
  72. {
  73. "imports": [
  74. {
  75. "name": "LoadLibraryA",
  76. "address": "0x63c914"
  77. },
  78. {
  79. "name": "GetProcAddress",
  80. "address": "0x63c918"
  81. },
  82. {
  83. "name": "VirtualProtect",
  84. "address": "0x63c91c"
  85. },
  86. {
  87. "name": "VirtualAlloc",
  88. "address": "0x63c920"
  89. },
  90. {
  91. "name": "VirtualFree",
  92. "address": "0x63c924"
  93. },
  94. {
  95. "name": "ExitProcess",
  96. "address": "0x63c928"
  97. }
  98. ],
  99. "dll": "KERNEL32.DLL"
  100. },
  101. {
  102. "imports": [
  103. {
  104. "name": "GetAce",
  105. "address": "0x63c930"
  106. }
  107. ],
  108. "dll": "ADVAPI32.dll"
  109. },
  110. {
  111. "imports": [
  112. {
  113. "name": "ImageList_Remove",
  114. "address": "0x63c938"
  115. }
  116. ],
  117. "dll": "COMCTL32.dll"
  118. },
  119. {
  120. "imports": [
  121. {
  122. "name": "GetOpenFileNameW",
  123. "address": "0x63c940"
  124. }
  125. ],
  126. "dll": "COMDLG32.dll"
  127. },
  128. {
  129. "imports": [
  130. {
  131. "name": "LineTo",
  132. "address": "0x63c948"
  133. }
  134. ],
  135. "dll": "GDI32.dll"
  136. },
  137. {
  138. "imports": [
  139. {
  140. "name": "IcmpSendEcho",
  141. "address": "0x63c950"
  142. }
  143. ],
  144. "dll": "IPHLPAPI.DLL"
  145. },
  146. {
  147. "imports": [
  148. {
  149. "name": "WNetUseConnectionW",
  150. "address": "0x63c958"
  151. }
  152. ],
  153. "dll": "MPR.dll"
  154. },
  155. {
  156. "imports": [
  157. {
  158. "name": "CoGetObject",
  159. "address": "0x63c960"
  160. }
  161. ],
  162. "dll": "ole32.dll"
  163. },
  164. {
  165. "imports": [
  166. {
  167. "name": "VariantInit",
  168. "address": "0x63c968"
  169. }
  170. ],
  171. "dll": "OLEAUT32.dll"
  172. },
  173. {
  174. "imports": [
  175. {
  176. "name": "GetProcessMemoryInfo",
  177. "address": "0x63c970"
  178. }
  179. ],
  180. "dll": "PSAPI.DLL"
  181. },
  182. {
  183. "imports": [
  184. {
  185. "name": "DragFinish",
  186. "address": "0x63c978"
  187. }
  188. ],
  189. "dll": "SHELL32.dll"
  190. },
  191. {
  192. "imports": [
  193. {
  194. "name": "GetDC",
  195. "address": "0x63c980"
  196. }
  197. ],
  198. "dll": "USER32.dll"
  199. },
  200. {
  201. "imports": [
  202. {
  203. "name": "LoadUserProfileW",
  204. "address": "0x63c988"
  205. }
  206. ],
  207. "dll": "USERENV.dll"
  208. },
  209. {
  210. "imports": [
  211. {
  212. "name": "IsThemeActive",
  213. "address": "0x63c990"
  214. }
  215. ],
  216. "dll": "UxTheme.dll"
  217. },
  218. {
  219. "imports": [
  220. {
  221. "name": "VerQueryValueW",
  222. "address": "0x63c998"
  223. }
  224. ],
  225. "dll": "VERSION.dll"
  226. },
  227. {
  228. "imports": [
  229. {
  230. "name": "FtpOpenFileW",
  231. "address": "0x63c9a0"
  232. }
  233. ],
  234. "dll": "WININET.dll"
  235. },
  236. {
  237. "imports": [
  238. {
  239. "name": "timeGetTime",
  240. "address": "0x63c9a8"
  241. }
  242. ],
  243. "dll": "WINMM.dll"
  244. },
  245. {
  246. "imports": [
  247. {
  248. "name": "connect",
  249. "address": "0x63c9b0"
  250. }
  251. ],
  252. "dll": "WSOCK32.dll"
  253. }
  254. ],
  255. "digital_signers": null,
  256. "exported_dll_name": null,
  257. "actual_checksum": "0x0010d3fe",
  258. "overlay": {
  259. "size": "0x00000008",
  260. "offset": "0x00108c00"
  261. },
  262. "imagebase": "0x00400000",
  263. "reported_checksum": "0x00000000",
  264. "icon_hash": null,
  265. "entrypoint": "0x00589980",
  266. "timestamp": "2019-05-03 22:14:25",
  267. "osversion": "5.1",
  268. "sections": [
  269. {
  270. "name": "UPX0",
  271. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  272. "virtual_address": "0x00001000",
  273. "size_of_data": "0x00000000",
  274. "entropy": "0.00",
  275. "raw_address": "0x00000400",
  276. "virtual_size": "0x00133000",
  277. "characteristics_raw": "0xe0000080"
  278. },
  279. {
  280. "name": "UPX1",
  281. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  282. "virtual_address": "0x00134000",
  283. "size_of_data": "0x00055c00",
  284. "entropy": "7.94",
  285. "raw_address": "0x00000400",
  286. "virtual_size": "0x00056000",
  287. "characteristics_raw": "0xe0000040"
  288. },
  289. {
  290. "name": ".rsrc",
  291. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  292. "virtual_address": "0x0018a000",
  293. "size_of_data": "0x000b2c00",
  294. "entropy": "7.96",
  295. "raw_address": "0x00056000",
  296. "virtual_size": "0x000b3000",
  297. "characteristics_raw": "0xc0000040"
  298. }
  299. ],
  300. "resources": [],
  301. "dirents": [
  302. {
  303. "virtual_address": "0x00000000",
  304. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  305. "size": "0x00000000"
  306. },
  307. {
  308. "virtual_address": "0x0023c798",
  309. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  310. "size": "0x00000424"
  311. },
  312. {
  313. "virtual_address": "0x0018a000",
  314. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  315. "size": "0x000b2798"
  316. },
  317. {
  318. "virtual_address": "0x00000000",
  319. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  320. "size": "0x00000000"
  321. },
  322. {
  323. "virtual_address": "0x00000000",
  324. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  325. "size": "0x00000000"
  326. },
  327. {
  328. "virtual_address": "0x0023cbbc",
  329. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  330. "size": "0x0000000c"
  331. },
  332. {
  333. "virtual_address": "0x00000000",
  334. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  335. "size": "0x00000000"
  336. },
  337. {
  338. "virtual_address": "0x00000000",
  339. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  340. "size": "0x00000000"
  341. },
  342. {
  343. "virtual_address": "0x00000000",
  344. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  345. "size": "0x00000000"
  346. },
  347. {
  348. "virtual_address": "0x00000000",
  349. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  350. "size": "0x00000000"
  351. },
  352. {
  353. "virtual_address": "0x00189b64",
  354. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  355. "size": "0x00000048"
  356. },
  357. {
  358. "virtual_address": "0x00000000",
  359. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  360. "size": "0x00000000"
  361. },
  362. {
  363. "virtual_address": "0x00000000",
  364. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  365. "size": "0x00000000"
  366. },
  367. {
  368. "virtual_address": "0x00000000",
  369. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  370. "size": "0x00000000"
  371. },
  372. {
  373. "virtual_address": "0x00000000",
  374. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  375. "size": "0x00000000"
  376. },
  377. {
  378. "virtual_address": "0x00000000",
  379. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  380. "size": "0x00000000"
  381. }
  382. ],
  383. "exports": [],
  384. "guest_signers": {},
  385. "imphash": "fc6683d30d9f25244a50fd5357825e79",
  386. "icon_fuzzy": null,
  387. "icon": null,
  388. "pdbpath": null,
  389. "imported_dll_count": 18,
  390. "versioninfo": []
  391. }
  392. }
  393.  
  394. [*] Resolved APIs: []
  395.  
  396. [*] Static Analysis: {
  397. "pe": {
  398. "peid_signatures": null,
  399. "imports": [
  400. {
  401. "imports": [
  402. {
  403. "name": "LoadLibraryA",
  404. "address": "0x63c914"
  405. },
  406. {
  407. "name": "GetProcAddress",
  408. "address": "0x63c918"
  409. },
  410. {
  411. "name": "VirtualProtect",
  412. "address": "0x63c91c"
  413. },
  414. {
  415. "name": "VirtualAlloc",
  416. "address": "0x63c920"
  417. },
  418. {
  419. "name": "VirtualFree",
  420. "address": "0x63c924"
  421. },
  422. {
  423. "name": "ExitProcess",
  424. "address": "0x63c928"
  425. }
  426. ],
  427. "dll": "KERNEL32.DLL"
  428. },
  429. {
  430. "imports": [
  431. {
  432. "name": "GetAce",
  433. "address": "0x63c930"
  434. }
  435. ],
  436. "dll": "ADVAPI32.dll"
  437. },
  438. {
  439. "imports": [
  440. {
  441. "name": "ImageList_Remove",
  442. "address": "0x63c938"
  443. }
  444. ],
  445. "dll": "COMCTL32.dll"
  446. },
  447. {
  448. "imports": [
  449. {
  450. "name": "GetOpenFileNameW",
  451. "address": "0x63c940"
  452. }
  453. ],
  454. "dll": "COMDLG32.dll"
  455. },
  456. {
  457. "imports": [
  458. {
  459. "name": "LineTo",
  460. "address": "0x63c948"
  461. }
  462. ],
  463. "dll": "GDI32.dll"
  464. },
  465. {
  466. "imports": [
  467. {
  468. "name": "IcmpSendEcho",
  469. "address": "0x63c950"
  470. }
  471. ],
  472. "dll": "IPHLPAPI.DLL"
  473. },
  474. {
  475. "imports": [
  476. {
  477. "name": "WNetUseConnectionW",
  478. "address": "0x63c958"
  479. }
  480. ],
  481. "dll": "MPR.dll"
  482. },
  483. {
  484. "imports": [
  485. {
  486. "name": "CoGetObject",
  487. "address": "0x63c960"
  488. }
  489. ],
  490. "dll": "ole32.dll"
  491. },
  492. {
  493. "imports": [
  494. {
  495. "name": "VariantInit",
  496. "address": "0x63c968"
  497. }
  498. ],
  499. "dll": "OLEAUT32.dll"
  500. },
  501. {
  502. "imports": [
  503. {
  504. "name": "GetProcessMemoryInfo",
  505. "address": "0x63c970"
  506. }
  507. ],
  508. "dll": "PSAPI.DLL"
  509. },
  510. {
  511. "imports": [
  512. {
  513. "name": "DragFinish",
  514. "address": "0x63c978"
  515. }
  516. ],
  517. "dll": "SHELL32.dll"
  518. },
  519. {
  520. "imports": [
  521. {
  522. "name": "GetDC",
  523. "address": "0x63c980"
  524. }
  525. ],
  526. "dll": "USER32.dll"
  527. },
  528. {
  529. "imports": [
  530. {
  531. "name": "LoadUserProfileW",
  532. "address": "0x63c988"
  533. }
  534. ],
  535. "dll": "USERENV.dll"
  536. },
  537. {
  538. "imports": [
  539. {
  540. "name": "IsThemeActive",
  541. "address": "0x63c990"
  542. }
  543. ],
  544. "dll": "UxTheme.dll"
  545. },
  546. {
  547. "imports": [
  548. {
  549. "name": "VerQueryValueW",
  550. "address": "0x63c998"
  551. }
  552. ],
  553. "dll": "VERSION.dll"
  554. },
  555. {
  556. "imports": [
  557. {
  558. "name": "FtpOpenFileW",
  559. "address": "0x63c9a0"
  560. }
  561. ],
  562. "dll": "WININET.dll"
  563. },
  564. {
  565. "imports": [
  566. {
  567. "name": "timeGetTime",
  568. "address": "0x63c9a8"
  569. }
  570. ],
  571. "dll": "WINMM.dll"
  572. },
  573. {
  574. "imports": [
  575. {
  576. "name": "connect",
  577. "address": "0x63c9b0"
  578. }
  579. ],
  580. "dll": "WSOCK32.dll"
  581. }
  582. ],
  583. "digital_signers": null,
  584. "exported_dll_name": null,
  585. "actual_checksum": "0x0010d3fe",
  586. "overlay": {
  587. "size": "0x00000008",
  588. "offset": "0x00108c00"
  589. },
  590. "imagebase": "0x00400000",
  591. "reported_checksum": "0x00000000",
  592. "icon_hash": null,
  593. "entrypoint": "0x00589980",
  594. "timestamp": "2019-05-03 22:14:25",
  595. "osversion": "5.1",
  596. "sections": [
  597. {
  598. "name": "UPX0",
  599. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  600. "virtual_address": "0x00001000",
  601. "size_of_data": "0x00000000",
  602. "entropy": "0.00",
  603. "raw_address": "0x00000400",
  604. "virtual_size": "0x00133000",
  605. "characteristics_raw": "0xe0000080"
  606. },
  607. {
  608. "name": "UPX1",
  609. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  610. "virtual_address": "0x00134000",
  611. "size_of_data": "0x00055c00",
  612. "entropy": "7.94",
  613. "raw_address": "0x00000400",
  614. "virtual_size": "0x00056000",
  615. "characteristics_raw": "0xe0000040"
  616. },
  617. {
  618. "name": ".rsrc",
  619. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  620. "virtual_address": "0x0018a000",
  621. "size_of_data": "0x000b2c00",
  622. "entropy": "7.96",
  623. "raw_address": "0x00056000",
  624. "virtual_size": "0x000b3000",
  625. "characteristics_raw": "0xc0000040"
  626. }
  627. ],
  628. "resources": [],
  629. "dirents": [
  630. {
  631. "virtual_address": "0x00000000",
  632. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  633. "size": "0x00000000"
  634. },
  635. {
  636. "virtual_address": "0x0023c798",
  637. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  638. "size": "0x00000424"
  639. },
  640. {
  641. "virtual_address": "0x0018a000",
  642. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  643. "size": "0x000b2798"
  644. },
  645. {
  646. "virtual_address": "0x00000000",
  647. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  648. "size": "0x00000000"
  649. },
  650. {
  651. "virtual_address": "0x00000000",
  652. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  653. "size": "0x00000000"
  654. },
  655. {
  656. "virtual_address": "0x0023cbbc",
  657. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  658. "size": "0x0000000c"
  659. },
  660. {
  661. "virtual_address": "0x00000000",
  662. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  663. "size": "0x00000000"
  664. },
  665. {
  666. "virtual_address": "0x00000000",
  667. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  668. "size": "0x00000000"
  669. },
  670. {
  671. "virtual_address": "0x00000000",
  672. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  673. "size": "0x00000000"
  674. },
  675. {
  676. "virtual_address": "0x00000000",
  677. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  678. "size": "0x00000000"
  679. },
  680. {
  681. "virtual_address": "0x00189b64",
  682. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  683. "size": "0x00000048"
  684. },
  685. {
  686. "virtual_address": "0x00000000",
  687. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  688. "size": "0x00000000"
  689. },
  690. {
  691. "virtual_address": "0x00000000",
  692. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  693. "size": "0x00000000"
  694. },
  695. {
  696. "virtual_address": "0x00000000",
  697. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  698. "size": "0x00000000"
  699. },
  700. {
  701. "virtual_address": "0x00000000",
  702. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  703. "size": "0x00000000"
  704. },
  705. {
  706. "virtual_address": "0x00000000",
  707. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  708. "size": "0x00000000"
  709. }
  710. ],
  711. "exports": [],
  712. "guest_signers": {},
  713. "imphash": "fc6683d30d9f25244a50fd5357825e79",
  714. "icon_fuzzy": null,
  715. "icon": null,
  716. "pdbpath": null,
  717. "imported_dll_count": 18,
  718. "versioninfo": []
  719. }
  720. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!