API tools faq
paste
paladin316

Exes_4f551cb9a7c7d24104c19ac85e55defe_exe_2019-06-27_20_30.json

paladin316
Jun 27th, 2019
2,165
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 19.31 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_4f551cb9a7c7d24104c19ac85e55defe.exe"
  7. [*] File Size: 1435136
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  9. [*] SHA256: "f118e52a73227b85fbb0cb7d202c3753916e518c516286c441a2dc92ede1f023"
  10. [*] MD5: "4f551cb9a7c7d24104c19ac85e55defe"
  11. [*] SHA1: "becd31acf5ed0396433b7d836fe0d4c3fae29169"
  12. [*] SHA512: "801fa55da6c539984da48b8dc695ffc2e4cd7f2e546d72e87b441e13cc26a7122ad40a0367e9c41bb4e91655c739cd6016a440e751dd291e980ecf22e792cc66"
  13. [*] CRC32: "D1AF7461"
  14. [*] SSDEEP: "24576:Eh7ieYJfi9Kzl49zo0ozAgrJ4+OpSF43wtogcjgPjuE+NdLDVkANOmrf7S5hb:+7EUd6g+OpSwwtMjgqvfkaA"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: UPX1, entropy: 7.88, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0015e200, virtual_size: 0x0015f000"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "The executable is compressed using UPX",
  29. "Details": [
  30. {
  31. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00228000"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "File has been identified by 59 Antiviruses on VirusTotal as malicious",
  37. "Details": [
  38. {
  39. "Bkav": "W32.WannaMine.Worm"
  40. },
  41. {
  42. "MicroWorld-eScan": "Trojan.AgentWDCR.QNW"
  43. },
  44. {
  45. "CAT-QuickHeal": "Trojan.IGENERIC"
  46. },
  47. {
  48. "Qihoo-360": "Win32/Trojan.Spy.155"
  49. },
  50. {
  51. "McAfee": "Generic.bur"
  52. },
  53. {
  54. "Cylance": "Unsafe"
  55. },
  56. {
  57. "Zillya": "Dropper.Agent.Win32.382362"
  58. },
  59. {
  60. "K7AntiVirus": "Trojan ( 0053329c1 )"
  61. },
  62. {
  63. "BitDefender": "Trojan.AgentWDCR.QNW"
  64. },
  65. {
  66. "K7GW": "Trojan ( 0053329c1 )"
  67. },
  68. {
  69. "Cybereason": "malicious.9a7c7d"
  70. },
  71. {
  72. "TrendMicro": "TROJ_WATCHER.RCB"
  73. },
  74. {
  75. "Cyren": "W32/Trojan.ZKIW-7364"
  76. },
  77. {
  78. "Symantec": "Trojan Horse"
  79. },
  80. {
  81. "APEX": "Malicious"
  82. },
  83. {
  84. "Paloalto": "generic.ml"
  85. },
  86. {
  87. "Kaspersky": "Trojan-Dropper.Win32.Agent.bjwkfq"
  88. },
  89. {
  90. "Alibaba": "TrojanDropper:Win32/Agent.ee3656d6"
  91. },
  92. {
  93. "NANO-Antivirus": "Trojan.Win32.Gen8.fiydqa"
  94. },
  95. {
  96. "ViRobot": "Trojan.Win32.S.Agent.1435136"
  97. },
  98. {
  99. "AegisLab": "Trojan.Win32.Agent.4!c"
  100. },
  101. {
  102. "Rising": "Dropper.Agent!8.2F (CLOUD)"
  103. },
  104. {
  105. "Endgame": "malicious (moderate confidence)"
  106. },
  107. {
  108. "Sophos": "Troj/Agent-BAFK"
  109. },
  110. {
  111. "Comodo": "Malware@#oxanqjbjpk3d"
  112. },
  113. {
  114. "F-Secure": "Trojan.TR/AD.GoWatchdog.ledfg"
  115. },
  116. {
  117. "DrWeb": "Trojan.SpyBot.775"
  118. },
  119. {
  120. "VIPRE": "Trojan.Win32.Generic!BT"
  121. },
  122. {
  123. "Invincea": "heuristic"
  124. },
  125. {
  126. "McAfee-GW-Edition": "BehavesLike.Win32.Sdbot.tc"
  127. },
  128. {
  129. "FireEye": "Generic.mg.4f551cb9a7c7d241"
  130. },
  131. {
  132. "Emsisoft": "Trojan.AgentWDCR.QNW (B)"
  133. },
  134. {
  135. "SentinelOne": "DFI - Suspicious PE"
  136. },
  137. {
  138. "F-Prot": "W32/Agent.NBAU"
  139. },
  140. {
  141. "Jiangmin": "TrojanDownloader.Agent.fmmn"
  142. },
  143. {
  144. "Webroot": "W32.Trojan.Gen"
  145. },
  146. {
  147. "Avira": "TR/AD.GoWatchdog.ledfg"
  148. },
  149. {
  150. "MAX": "malware (ai score=100)"
  151. },
  152. {
  153. "Antiy-AVL": "Trojan[Dropper]/Win32.Agent"
  154. },
  155. {
  156. "Microsoft": "Trojan:Win32/Occamy.C!bit"
  157. },
  158. {
  159. "Arcabit": "Trojan.AgentWDCR.QNW"
  160. },
  161. {
  162. "ZoneAlarm": "Trojan-Dropper.Win32.Agent.bjwkfq"
  163. },
  164. {
  165. "GData": "Win32.Trojan.Agent.FIKMZO"
  166. },
  167. {
  168. "AhnLab-V3": "Trojan/Win32.Agent.C2742987"
  169. },
  170. {
  171. "Acronis": "suspicious"
  172. },
  173. {
  174. "VBA32": "TrojanDropper.Agent"
  175. },
  176. {
  177. "ALYac": "Trojan.Agent.gen"
  178. },
  179. {
  180. "Ad-Aware": "Trojan.AgentWDCR.QNW"
  181. },
  182. {
  183. "Panda": "Trj/WLT.E"
  184. },
  185. {
  186. "Zoner": "Trojan.Win32.75916"
  187. },
  188. {
  189. "ESET-NOD32": "Win32/Agent.TDX"
  190. },
  191. {
  192. "TrendMicro-HouseCall": "TROJ_WATCHER.RCB"
  193. },
  194. {
  195. "Tencent": "Win32.Trojan-dropper.Agent.Pfjp"
  196. },
  197. {
  198. "Yandex": "Trojan.DR.Agent!oCcNl64qMZc"
  199. },
  200. {
  201. "Ikarus": "Trojan.Win32.Agent"
  202. },
  203. {
  204. "Fortinet": "W32/Agent.TDX!tr"
  205. },
  206. {
  207. "AVG": "Win32:Trojan-gen"
  208. },
  209. {
  210. "Avast": "Win32:Trojan-gen"
  211. },
  212. {
  213. "CrowdStrike": "win/malicious_confidence_100% (W)"
  214. }
  215. ]
  216. }
  217. ]
  218.  
  219. [*] Started Service: []
  220.  
  221. [*] Executed Commands: []
  222.  
  223. [*] Mutexes: []
  224.  
  225. [*] Modified Files: []
  226.  
  227. [*] Deleted Files: []
  228.  
  229. [*] Modified Registry Keys: []
  230.  
  231. [*] Deleted Registry Keys: []
  232.  
  233. [*] DNS Communications: []
  234.  
  235. [*] Domains: []
  236.  
  237. [*] Network Communication - ICMP: []
  238.  
  239. [*] Network Communication - HTTP: []
  240.  
  241. [*] Network Communication - SMTP: []
  242.  
  243. [*] Network Communication - Hosts: []
  244.  
  245. [*] Network Communication - IRC: []
  246.  
  247. [*] Static Analysis: {
  248. "pe": {
  249. "peid_signatures": [
  250. [
  251. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  252. ]
  253. ],
  254. "imports": [
  255. {
  256. "imports": [
  257. {
  258. "name": "LoadLibraryA",
  259. "address": "0x788050"
  260. },
  261. {
  262. "name": "GetProcAddress",
  263. "address": "0x788054"
  264. },
  265. {
  266. "name": "VirtualProtect",
  267. "address": "0x788058"
  268. },
  269. {
  270. "name": "VirtualAlloc",
  271. "address": "0x78805c"
  272. },
  273. {
  274. "name": "VirtualFree",
  275. "address": "0x788060"
  276. },
  277. {
  278. "name": "ExitProcess",
  279. "address": "0x788064"
  280. }
  281. ],
  282. "dll": "KERNEL32.DLL"
  283. },
  284. {
  285. "imports": [
  286. {
  287. "name": "timeEndPeriod",
  288. "address": "0x78806c"
  289. }
  290. ],
  291. "dll": "winmm.dll"
  292. },
  293. {
  294. "imports": [
  295. {
  296. "name": "WSAGetOverlappedResult",
  297. "address": "0x788074"
  298. }
  299. ],
  300. "dll": "ws2_32.dll"
  301. }
  302. ],
  303. "digital_signers": null,
  304. "exported_dll_name": null,
  305. "actual_checksum": "0x00164d3f",
  306. "overlay": null,
  307. "imagebase": "0x00400000",
  308. "reported_checksum": "0x00000000",
  309. "icon_hash": null,
  310. "entrypoint": "0x00787000",
  311. "timestamp": "1970-01-01 00:00:00",
  312. "osversion": "4.0",
  313. "sections": [
  314. {
  315. "name": "UPX0",
  316. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  317. "virtual_address": "0x00001000",
  318. "size_of_data": "0x00000000",
  319. "entropy": "0.00",
  320. "raw_address": "0x00000200",
  321. "virtual_size": "0x00228000",
  322. "characteristics_raw": "0xe0000080"
  323. },
  324. {
  325. "name": "UPX1",
  326. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  327. "virtual_address": "0x00229000",
  328. "size_of_data": "0x0015e200",
  329. "entropy": "7.88",
  330. "raw_address": "0x00000200",
  331. "virtual_size": "0x0015f000",
  332. "characteristics_raw": "0xe0000040"
  333. },
  334. {
  335. "name": "UPX2",
  336. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  337. "virtual_address": "0x00388000",
  338. "size_of_data": "0x00000200",
  339. "entropy": "2.73",
  340. "raw_address": "0x0015e400",
  341. "virtual_size": "0x00001000",
  342. "characteristics_raw": "0xc0000040"
  343. }
  344. ],
  345. "resources": [],
  346. "dirents": [
  347. {
  348. "virtual_address": "0x00000000",
  349. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  350. "size": "0x00000000"
  351. },
  352. {
  353. "virtual_address": "0x00388000",
  354. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  355. "size": "0x00000120"
  356. },
  357. {
  358. "virtual_address": "0x00000000",
  359. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  360. "size": "0x00000000"
  361. },
  362. {
  363. "virtual_address": "0x00000000",
  364. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  365. "size": "0x00000000"
  366. },
  367. {
  368. "virtual_address": "0x00000000",
  369. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  370. "size": "0x00000000"
  371. },
  372. {
  373. "virtual_address": "0x00000000",
  374. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  375. "size": "0x00000000"
  376. },
  377. {
  378. "virtual_address": "0x00000000",
  379. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  380. "size": "0x00000000"
  381. },
  382. {
  383. "virtual_address": "0x00000000",
  384. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  385. "size": "0x00000000"
  386. },
  387. {
  388. "virtual_address": "0x00000000",
  389. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  390. "size": "0x00000000"
  391. },
  392. {
  393. "virtual_address": "0x00000000",
  394. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  395. "size": "0x00000000"
  396. },
  397. {
  398. "virtual_address": "0x00000000",
  399. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  400. "size": "0x00000000"
  401. },
  402. {
  403. "virtual_address": "0x00000000",
  404. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  405. "size": "0x00000000"
  406. },
  407. {
  408. "virtual_address": "0x00000000",
  409. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  410. "size": "0x00000000"
  411. },
  412. {
  413. "virtual_address": "0x00000000",
  414. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  415. "size": "0x00000000"
  416. },
  417. {
  418. "virtual_address": "0x00000000",
  419. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  420. "size": "0x00000000"
  421. },
  422. {
  423. "virtual_address": "0x00000000",
  424. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  425. "size": "0x00000000"
  426. }
  427. ],
  428. "exports": [],
  429. "guest_signers": {},
  430. "imphash": "2cd14f15921469c2e776cf169a885091",
  431. "icon_fuzzy": null,
  432. "icon": null,
  433. "pdbpath": null,
  434. "imported_dll_count": 3,
  435. "versioninfo": []
  436. }
  437. }
  438.  
  439. [*] Resolved APIs: []
  440.  
  441. [*] Static Analysis: {
  442. "pe": {
  443. "peid_signatures": [
  444. [
  445. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  446. ]
  447. ],
  448. "imports": [
  449. {
  450. "imports": [
  451. {
  452. "name": "LoadLibraryA",
  453. "address": "0x788050"
  454. },
  455. {
  456. "name": "GetProcAddress",
  457. "address": "0x788054"
  458. },
  459. {
  460. "name": "VirtualProtect",
  461. "address": "0x788058"
  462. },
  463. {
  464. "name": "VirtualAlloc",
  465. "address": "0x78805c"
  466. },
  467. {
  468. "name": "VirtualFree",
  469. "address": "0x788060"
  470. },
  471. {
  472. "name": "ExitProcess",
  473. "address": "0x788064"
  474. }
  475. ],
  476. "dll": "KERNEL32.DLL"
  477. },
  478. {
  479. "imports": [
  480. {
  481. "name": "timeEndPeriod",
  482. "address": "0x78806c"
  483. }
  484. ],
  485. "dll": "winmm.dll"
  486. },
  487. {
  488. "imports": [
  489. {
  490. "name": "WSAGetOverlappedResult",
  491. "address": "0x788074"
  492. }
  493. ],
  494. "dll": "ws2_32.dll"
  495. }
  496. ],
  497. "digital_signers": null,
  498. "exported_dll_name": null,
  499. "actual_checksum": "0x00164d3f",
  500. "overlay": null,
  501. "imagebase": "0x00400000",
  502. "reported_checksum": "0x00000000",
  503. "icon_hash": null,
  504. "entrypoint": "0x00787000",
  505. "timestamp": "1970-01-01 00:00:00",
  506. "osversion": "4.0",
  507. "sections": [
  508. {
  509. "name": "UPX0",
  510. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  511. "virtual_address": "0x00001000",
  512. "size_of_data": "0x00000000",
  513. "entropy": "0.00",
  514. "raw_address": "0x00000200",
  515. "virtual_size": "0x00228000",
  516. "characteristics_raw": "0xe0000080"
  517. },
  518. {
  519. "name": "UPX1",
  520. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  521. "virtual_address": "0x00229000",
  522. "size_of_data": "0x0015e200",
  523. "entropy": "7.88",
  524. "raw_address": "0x00000200",
  525. "virtual_size": "0x0015f000",
  526. "characteristics_raw": "0xe0000040"
  527. },
  528. {
  529. "name": "UPX2",
  530. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  531. "virtual_address": "0x00388000",
  532. "size_of_data": "0x00000200",
  533. "entropy": "2.73",
  534. "raw_address": "0x0015e400",
  535. "virtual_size": "0x00001000",
  536. "characteristics_raw": "0xc0000040"
  537. }
  538. ],
  539. "resources": [],
  540. "dirents": [
  541. {
  542. "virtual_address": "0x00000000",
  543. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  544. "size": "0x00000000"
  545. },
  546. {
  547. "virtual_address": "0x00388000",
  548. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  549. "size": "0x00000120"
  550. },
  551. {
  552. "virtual_address": "0x00000000",
  553. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  554. "size": "0x00000000"
  555. },
  556. {
  557. "virtual_address": "0x00000000",
  558. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  559. "size": "0x00000000"
  560. },
  561. {
  562. "virtual_address": "0x00000000",
  563. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  564. "size": "0x00000000"
  565. },
  566. {
  567. "virtual_address": "0x00000000",
  568. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  569. "size": "0x00000000"
  570. },
  571. {
  572. "virtual_address": "0x00000000",
  573. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  574. "size": "0x00000000"
  575. },
  576. {
  577. "virtual_address": "0x00000000",
  578. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  579. "size": "0x00000000"
  580. },
  581. {
  582. "virtual_address": "0x00000000",
  583. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  584. "size": "0x00000000"
  585. },
  586. {
  587. "virtual_address": "0x00000000",
  588. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  589. "size": "0x00000000"
  590. },
  591. {
  592. "virtual_address": "0x00000000",
  593. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  594. "size": "0x00000000"
  595. },
  596. {
  597. "virtual_address": "0x00000000",
  598. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  599. "size": "0x00000000"
  600. },
  601. {
  602. "virtual_address": "0x00000000",
  603. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  604. "size": "0x00000000"
  605. },
  606. {
  607. "virtual_address": "0x00000000",
  608. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  609. "size": "0x00000000"
  610. },
  611. {
  612. "virtual_address": "0x00000000",
  613. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  614. "size": "0x00000000"
  615. },
  616. {
  617. "virtual_address": "0x00000000",
  618. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  619. "size": "0x00000000"
  620. }
  621. ],
  622. "exports": [],
  623. "guest_signers": {},
  624. "imphash": "2cd14f15921469c2e776cf169a885091",
  625. "icon_fuzzy": null,
  626. "icon": null,
  627. "pdbpath": null,
  628. "imported_dll_count": 3,
  629. "versioninfo": []
  630. }
  631. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!