API tools faq
paste
paladin316

Exes_5ffe63438d46bd1dd88ff9bc660dbaa1_exe_2019-08-11_07_30.txt

paladin316
Aug 11th, 2019
2,139
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 26.95 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe"
  7. * File Size: 2336339
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "1756811dacff2ca82977c57f6ed58eed8bd0d36103f724425b222f9650be8dd2"
  10. * MD5: "5ffe63438d46bd1dd88ff9bc660dbaa1"
  11. * SHA1: "6aa49903c87d1c8e5aabc2862a84ea51e3a51000"
  12. * SHA512: "3c838c10a82ce10afed6544ab49f900aaeaa5be4647af12c6c8a3ff16c40224d0bab0aa1e49e2bd4566d5077b0a28b74094c695d08933ed49ab58475f31dfb33"
  13. * CRC32: "156D308B"
  14. * SSDEEP: "49152:TwTZiOwvyfNf20zmtbKIy0l3xxeMLpbm6sUeWp85yBqi:TaZiOwcsh3xxeim/lWSyBqi"
  15.  
  16. * Process Execution:
  17. "Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Reads data out of its own binary image",
  25. "Details":
  26.  
  27. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00000000, length: 0x00000002"
  28.  
  29.  
  30. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0000003c, length: 0x00000002"
  31.  
  32.  
  33. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00000100, length: 0x00000004"
  34.  
  35.  
  36. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00000106, length: 0x00000002"
  37.  
  38.  
  39. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00000114, length: 0x00000002"
  40.  
  41.  
  42. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00000208, length: 0x00000008"
  43.  
  44.  
  45. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00000230, length: 0x00000008"
  46.  
  47.  
  48. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00000258, length: 0x00000008"
  49.  
  50.  
  51. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00000280, length: 0x00000008"
  52.  
  53.  
  54. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000002a8, length: 0x00000008"
  55.  
  56.  
  57. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000002d0, length: 0x00000008"
  58.  
  59.  
  60. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000002f8, length: 0x00000008"
  61.  
  62.  
  63. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00000320, length: 0x00000008"
  64.  
  65.  
  66. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00025600, length: 0x0000092b"
  67.  
  68.  
  69. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00025f1a, length: 0x00000025"
  70.  
  71.  
  72. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00025f37, length: 0x00004f98"
  73.  
  74.  
  75. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002aebb, length: 0x00000011"
  76.  
  77.  
  78. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002aecf, length: 0x0000031a"
  79.  
  80.  
  81. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002aed3, length: 0x00000008"
  82.  
  83.  
  84. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002b1e9, length: 0x00000018"
  85.  
  86.  
  87. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002b1f1, length: 0x00000011"
  88.  
  89.  
  90. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002b201, length: 0x00000543"
  91.  
  92.  
  93. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002b209, length: 0x00000008"
  94.  
  95.  
  96. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002b744, length: 0x0000001b"
  97.  
  98.  
  99. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002b750, length: 0x00000011"
  100.  
  101.  
  102. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002b75f, length: 0x0000c01c"
  103.  
  104.  
  105. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0002b76b, length: 0x00000008"
  106.  
  107.  
  108. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0003777b, length: 0x0000001b"
  109.  
  110.  
  111. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0003778b, length: 0x00000011"
  112.  
  113.  
  114. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00037796, length: 0x00001eda"
  115.  
  116.  
  117. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000377a6, length: 0x00000008"
  118.  
  119.  
  120. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00039670, length: 0x0000001b"
  121.  
  122.  
  123. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00039684, length: 0x00000011"
  124.  
  125.  
  126. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0003968b, length: 0x000018d0"
  127.  
  128.  
  129. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0003969f, length: 0x00000008"
  130.  
  131.  
  132. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0003af5b, length: 0x0000001b"
  133.  
  134.  
  135. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0003af73, length: 0x00000011"
  136.  
  137.  
  138. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0003af76, length: 0x0000d0ac"
  139.  
  140.  
  141. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0003af8e, length: 0x00000008"
  142.  
  143.  
  144. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00048022, length: 0x00000021"
  145.  
  146.  
  147. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0004803e, length: 0x00000011"
  148.  
  149.  
  150. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00048043, length: 0x0000479f"
  151.  
  152.  
  153. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0004805f, length: 0x00000008"
  154.  
  155.  
  156. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0004c7e2, length: 0x00000022"
  157.  
  158.  
  159. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0004c802, length: 0x00000011"
  160.  
  161.  
  162. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0004c804, length: 0x0000479f"
  163.  
  164.  
  165. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0004c824, length: 0x00000008"
  166.  
  167.  
  168. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00050fa3, length: 0x000117e8"
  169.  
  170.  
  171. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00050fc7, length: 0x00000011"
  172.  
  173.  
  174. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00050fe0, length: 0x00000008"
  175.  
  176.  
  177. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0006278b, length: 0x000005ed"
  178.  
  179.  
  180. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000627b3, length: 0x00000011"
  181.  
  182.  
  183. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000627cc, length: 0x00000008"
  184.  
  185.  
  186. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00062d78, length: 0x00006626"
  187.  
  188.  
  189. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00062da4, length: 0x00000011"
  190.  
  191.  
  192. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00062dc4, length: 0x00000008"
  193.  
  194.  
  195. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0006939e, length: 0x00006627"
  196.  
  197.  
  198. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000693ce, length: 0x00000011"
  199.  
  200.  
  201. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000693ef, length: 0x00000008"
  202.  
  203.  
  204. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0006f9c5, length: 0x00001422"
  205.  
  206.  
  207. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0006f9f9, length: 0x00000011"
  208.  
  209.  
  210. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0006fa14, length: 0x00000008"
  211.  
  212.  
  213. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00070de7, length: 0x0006c63e"
  214.  
  215.  
  216. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00070e1f, length: 0x00000011"
  217.  
  218.  
  219. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00070e3c, length: 0x00000008"
  220.  
  221.  
  222. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000dd425, length: 0x00069405"
  223.  
  224.  
  225. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000dd461, length: 0x00000011"
  226.  
  227.  
  228. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x000dd47d, length: 0x00000008"
  229.  
  230.  
  231. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0014682a, length: 0x00000232"
  232.  
  233.  
  234. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0014686a, length: 0x00000011"
  235.  
  236.  
  237. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00146883, length: 0x00000008"
  238.  
  239.  
  240. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00146a5c, length: 0x00000258"
  241.  
  242.  
  243. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00146aa0, length: 0x00000011"
  244.  
  245.  
  246. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00146ab9, length: 0x00000008"
  247.  
  248.  
  249. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00146cb4, length: 0x0000576e"
  250.  
  251.  
  252. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00146cfc, length: 0x00000008"
  253.  
  254.  
  255. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0014c422, length: 0x00000b5a"
  256.  
  257.  
  258. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0014c46e, length: 0x00000008"
  259.  
  260.  
  261. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0014cf7c, length: 0x000055d5"
  262.  
  263.  
  264. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0014cfcc, length: 0x00000008"
  265.  
  266.  
  267. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00152551, length: 0x00000201"
  268.  
  269.  
  270. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001525a5, length: 0x00000008"
  271.  
  272.  
  273. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00152752, length: 0x00000bf4"
  274.  
  275.  
  276. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001527aa, length: 0x00000008"
  277.  
  278.  
  279. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00153346, length: 0x00000225"
  280.  
  281.  
  282. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001533bc, length: 0x00000008"
  283.  
  284.  
  285. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0015356b, length: 0x00000234"
  286.  
  287.  
  288. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001535cf, length: 0x00000008"
  289.  
  290.  
  291. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0015379f, length: 0x000015d0"
  292.  
  293.  
  294. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00153807, length: 0x00000008"
  295.  
  296.  
  297. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00154d6f, length: 0x000060e5"
  298.  
  299.  
  300. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00154ddb, length: 0x00000008"
  301.  
  302.  
  303. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0015ae54, length: 0x00000501"
  304.  
  305.  
  306. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0015aec4, length: 0x00000008"
  307.  
  308.  
  309. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0015b355, length: 0x0001773c"
  310.  
  311.  
  312. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0015b3c9, length: 0x00000008"
  313.  
  314.  
  315. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00172a91, length: 0x000152a4"
  316.  
  317.  
  318. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00172b09, length: 0x00000008"
  319.  
  320.  
  321. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00187d35, length: 0x00001c40"
  322.  
  323.  
  324. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00187db1, length: 0x00000008"
  325.  
  326.  
  327. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00189975, length: 0x0001c0b0"
  328.  
  329.  
  330. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001899f5, length: 0x00000008"
  331.  
  332.  
  333. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001a5a25, length: 0x0000b42d"
  334.  
  335.  
  336. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001a5aa9, length: 0x00000008"
  337.  
  338.  
  339. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001b0eda, length: 0x00000008"
  340.  
  341.  
  342. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001b7a3e, length: 0x00000008"
  343.  
  344.  
  345. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001bbe1a, length: 0x00000008"
  346.  
  347.  
  348. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001bd173, length: 0x00000008"
  349.  
  350.  
  351. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001c7d78, length: 0x00000008"
  352.  
  353.  
  354. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001ccc74, length: 0x00000008"
  355.  
  356.  
  357. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x001ccdfa, length: 0x00000008"
  358.  
  359.  
  360. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x0022d288, length: 0x00000008"
  361.  
  362.  
  363. "self_read": "process: Exes_5ffe63438d46bd1dd88ff9bc660dbaa1.exe, pid: 696, offset: 0x00231c5a, length: 0x00000008"
  364.  
  365.  
  366.  
  367.  
  368. "Description": "Creates a hidden or system file",
  369. "Details":
  370.  
  371. "file": "C:\\Windows\\Fonts\\Mysq1\\svchost.exe"
  372.  
  373.  
  374.  
  375.  
  376. "Description": "File has been identified by 60 Antiviruses on VirusTotal as malicious",
  377. "Details":
  378.  
  379. "Bkav": "HW32.Packed."
  380.  
  381.  
  382. "MicroWorld-eScan": "Dropped:Trojan.GenericKD.4882758"
  383.  
  384.  
  385. "FireEye": "Generic.mg.5ffe63438d46bd1d"
  386.  
  387.  
  388. "CAT-QuickHeal": "Udsdangerousobject.Multi"
  389.  
  390.  
  391. "McAfee": "Artemis!5FFE63438D46"
  392.  
  393.  
  394. "Cylance": "Unsafe"
  395.  
  396.  
  397. "AegisLab": "Trojan.Win32.ShadowBrokers.4!c"
  398.  
  399.  
  400. "Alibaba": "Trojan:Win32/starter.ali1000030"
  401.  
  402.  
  403. "K7GW": "Riskware ( 0040eff71 )"
  404.  
  405.  
  406. "K7AntiVirus": "Riskware ( 0040eff71 )"
  407.  
  408.  
  409. "Arcabit": "Trojan.Generic.D4A8146"
  410.  
  411.  
  412. "TrendMicro": "Trojan.Win32.EQUATED.LZCWS"
  413.  
  414.  
  415. "F-Prot": "W32/Agent.AQS.gen!Eldorado"
  416.  
  417.  
  418. "Symantec": "Trojan.Gen.MBT"
  419.  
  420.  
  421. "APEX": "Malicious"
  422.  
  423.  
  424. "Paloalto": "generic.ml"
  425.  
  426.  
  427. "ClamAV": "Win.Malware.Johnnie-6858836-0"
  428.  
  429.  
  430. "Kaspersky": "Trojan.Win32.Reconyc.jmms"
  431.  
  432.  
  433. "BitDefender": "Dropped:Trojan.GenericKD.4882758"
  434.  
  435.  
  436. "NANO-Antivirus": "Trojan.Win32.Reconyc.fqgnur"
  437.  
  438.  
  439. "Avast": "Other:Malware-gen Trj"
  440.  
  441.  
  442. "Tencent": "Win32.Trojan.Reconyc.Tcda"
  443.  
  444.  
  445. "Endgame": "malicious (moderate confidence)"
  446.  
  447.  
  448. "Emsisoft": "Dropped:Trojan.GenericKD.4882758 (B)"
  449.  
  450.  
  451. "Comodo": "Malware@#14zw39llfrmpf"
  452.  
  453.  
  454. "F-Secure": "Heuristic.HEUR/AGEN.1020415"
  455.  
  456.  
  457. "DrWeb": "Trojan.Equation.5"
  458.  
  459.  
  460. "Zillya": "Trojan.SchoolGirl.Win32.86"
  461.  
  462.  
  463. "Invincea": "heuristic"
  464.  
  465.  
  466. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.vc"
  467.  
  468.  
  469. "Trapmine": "suspicious.low.ml.score"
  470.  
  471.  
  472. "Sophos": "Mal/Generic-S"
  473.  
  474.  
  475. "Ikarus": "Trojan.Starter"
  476.  
  477.  
  478. "Cyren": "W32/Agent.AQS.gen!Eldorado"
  479.  
  480.  
  481. "Jiangmin": "Trojan.Qhost.it"
  482.  
  483.  
  484. "Avira": "HEUR/AGEN.1020415"
  485.  
  486.  
  487. "MAX": "malware (ai score=100)"
  488.  
  489.  
  490. "Antiy-AVL": "Trojan/Win32.Shadowbrokers.gg"
  491.  
  492.  
  493. "Microsoft": "Trojan:Win32/Eqtonex"
  494.  
  495.  
  496. "ViRobot": "Trojan.Win32.Z.Starter.2336339"
  497.  
  498.  
  499. "ZoneAlarm": "Trojan.Win32.Reconyc.jmms"
  500.  
  501.  
  502. "GData": "Dropped:Trojan.GenericKD.4882758"
  503.  
  504.  
  505. "AhnLab-V3": "Trojan/Win32.Shadowbrokers.R215159"
  506.  
  507.  
  508. "Acronis": "suspicious"
  509.  
  510.  
  511. "VBA32": "TScope.Trojan.Delf"
  512.  
  513.  
  514. "ALYac": "Dropped:Trojan.GenericKD.4882758"
  515.  
  516.  
  517. "Ad-Aware": "Dropped:Trojan.GenericKD.4882758"
  518.  
  519.  
  520. "ESET-NOD32": "a variant of Generik.NBRUJUK"
  521.  
  522.  
  523. "TrendMicro-HouseCall": "Trojan.Win32.EQUATED.LZCWS"
  524.  
  525.  
  526. "Rising": "Trojan.Reconyc!8.153 (CLOUD)"
  527.  
  528.  
  529. "Yandex": "Trojan.BtcMine!"
  530.  
  531.  
  532. "SentinelOne": "DFI - Suspicious PE"
  533.  
  534.  
  535. "MaxSecure": "Trojan.Malware.10810532.susgen"
  536.  
  537.  
  538. "Fortinet": "W32/Reconyc.JMMS!tr"
  539.  
  540.  
  541. "Webroot": "W32.Trojan.GenKD"
  542.  
  543.  
  544. "AVG": "Other:Malware-gen Trj"
  545.  
  546.  
  547. "Cybereason": "malicious.38d46b"
  548.  
  549.  
  550. "Panda": "Trj/CI.A"
  551.  
  552.  
  553. "CrowdStrike": "win/malicious_confidence_90% (W)"
  554.  
  555.  
  556. "Qihoo-360": "HEUR/QVM05.1.16D7.Malware.Gen"
  557.  
  558.  
  559.  
  560.  
  561. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  562. "Details":
  563.  
  564. "target": "clamav:Win.Malware.Johnnie-6858836-0, sha256:1756811dacff2ca82977c57f6ed58eed8bd0d36103f724425b222f9650be8dd2, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  565.  
  566.  
  567. "dropped": "clamav:Win.Exploit.EQGRP-6322722-0, sha256:b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b , guest_paths:C:\\Windows\\Fonts\\Mysq1\\mance.exe, type:PE32 executable (console) Intel 80386, for MS Windows"
  568.  
  569.  
  570. "dropped": "clamav:Win.Exploit.EternalBlue-6320312-0, sha256:85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 , guest_paths:C:\\Windows\\Fonts\\Mysq1\\Eter.exe, type:PE32 executable (console) Intel 80386, for MS Windows"
  571.  
  572.  
  573. "dropped": "clamav:Xml.Exploit.EQGRP-6322720-0, sha256:6c55b736646135c0acbad702fde64574a0a55a77be3f39287774c7e518de3da9 , guest_paths:C:\\Windows\\Fonts\\Mysq1\\mance.xml, type:XML 1.0 document, ASCII text, with CRLF line terminators"
  574.  
  575.  
  576. "dropped": "clamav:Xml.Exploit.EQGRP-6322720-0, sha256:cf33a92a05ba3c807447a5f6b7e45577ed53174699241da360876d4f4a2eb2de , guest_paths:C:\\Windows\\Fonts\\Mysq1\\puls.xml, type:XML 1.0 document, ASCII text, with CRLF line terminators"
  577.  
  578.  
  579. "dropped": "clamav:Win.Trojan.Agent-6284384-0, sha256:5f30aa2fe338191b972705412b8043b0a134cdb287d754771fc225f2309e82ee , guest_paths:C:\\Windows\\Fonts\\Mysq1\\libeay32.dll, type:PE32 executable (DLL) (console) Intel 80386, for MS Windows"
  580.  
  581.  
  582. "dropped": "clamav:Win.Exploit.Eternal-6320394-0, sha256:ca63dbb99d9da431bf23aca80dc787df67bb01104fb9358a7813ed2fce479362 , guest_paths:C:\\Windows\\Fonts\\Mysq1\\tibe-2.dll, type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  583.  
  584.  
  585. "dropped": "clamav:Win.Trojan.Agent-867774, sha256:1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc , guest_paths:C:\\Windows\\Fonts\\Mysq1\\taskhost.exe, type:PE32 executable (console) Intel 80386, for MS Windows"
  586.  
  587.  
  588. "dropped": "clamav:Xml.Exploit.EQGRP-6322720-0, sha256:756f44f1d667132b043bfd3da16b91c9f6681e5d778c5f07bb031d62ff00d380 , guest_paths:C:\\Windows\\Fonts\\Mysq1\\Eter.xml, type:XML 1.0 document text"
  589.  
  590.  
  591. "dropped": "clamav:Win.Exploit.EQGRP-6322722-0, sha256:0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887 , guest_paths:C:\\Windows\\Fonts\\Mysq1\\coli-0.dll, type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  592.  
  593.  
  594. "dropped": "clamav:Win.Exploit.EQGRP-6322722-0, sha256:15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13 , guest_paths:C:\\Windows\\Fonts\\Mysq1\\puls.exe, type:PE32 executable (console) Intel 80386, for MS Windows"
  595.  
  596.  
  597.  
  598.  
  599. "Description": "Anomalous binary characteristics",
  600. "Details":
  601.  
  602. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  603.  
  604.  
  605. "anomaly": "Actual checksum does not match that reported in PE header"
  606.  
  607.  
  608.  
  609.  
  610.  
  611. * Started Service:
  612.  
  613. * Mutexes:
  614. "0073E7750F"
  615.  
  616.  
  617. * Modified Files:
  618. "C:\\Windows\\Fonts\\Mysq1\\p.txt"
  619.  
  620.  
  621. * Deleted Files:
  622.  
  623. * Modified Registry Keys:
  624.  
  625. * Deleted Registry Keys:
  626.  
  627. * DNS Communications:
  628.  
  629. * Domains:
  630.  
  631. * Network Communication - ICMP:
  632.  
  633. * Network Communication - HTTP:
  634.  
  635. * Network Communication - SMTP:
  636.  
  637. * Network Communication - Hosts:
  638.  
  639. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!