API tools faq
paste
paladin316

mshta_exe_2019-07-02_14_30.json

paladin316
Jul 2nd, 2019
2,137
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 22.31 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 6.0
  5.  
  6. [*] File Name: "mshta.exe"
  7. [*] File Size: 1084424
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "7594ad0bbe6cf2a2343675b42ed6a8c4571a465b8735efd3b954116d9694005b"
  10. [*] MD5: "795b3c1ba5fb25640efa0367214a2d08"
  11. [*] SHA1: "f1b1b7ca5820d319545331b0094a92f75fddcdb9"
  12. [*] SHA512: "273cc1b0bab09eea4e0d52dc3cdd44e5bcddb3b3a8f3f43026be1e8039919056ce43b2317e6d316bd206891a25d8f28114c49389931a8e77882410d5520ea795"
  13. [*] CRC32: "60F28DF9"
  14. [*] SSDEEP: "24576:IBXu9HGaVHeCrsqI9Nc2UtgHPPGbpeE50Yfs:Iw9VHeCrdI9OjKvPGbpr55E"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: UPX1, entropy: 7.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00055c00, virtual_size: 0x00056000"
  24. },
  25. {
  26. "section": "name: .rsrc, entropy: 7.96, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x000b2c00, virtual_size: 0x000b3000"
  27. }
  28. ]
  29. },
  30. {
  31. "Description": "The executable is compressed using UPX",
  32. "Details": [
  33. {
  34. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00133000"
  35. }
  36. ]
  37. },
  38. {
  39. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  40. "Details": [
  41. {
  42. "target": "clamav:Win.Malware.Generic-6961740-0, sha256:7594ad0bbe6cf2a2343675b42ed6a8c4571a465b8735efd3b954116d9694005b, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  43. }
  44. ]
  45. }
  46. ]
  47.  
  48. [*] Started Service: []
  49.  
  50. [*] Executed Commands: []
  51.  
  52. [*] Mutexes: []
  53.  
  54. [*] Modified Files: []
  55.  
  56. [*] Deleted Files: []
  57.  
  58. [*] Modified Registry Keys: []
  59.  
  60. [*] Deleted Registry Keys: []
  61.  
  62. [*] DNS Communications: []
  63.  
  64. [*] Domains: []
  65.  
  66. [*] Network Communication - ICMP: []
  67.  
  68. [*] Network Communication - HTTP: []
  69.  
  70. [*] Network Communication - SMTP: []
  71.  
  72. [*] Network Communication - Hosts: []
  73.  
  74. [*] Network Communication - IRC: []
  75.  
  76. [*] Static Analysis: {
  77. "pe": {
  78. "peid_signatures": null,
  79. "imports": [
  80. {
  81. "imports": [
  82. {
  83. "name": "LoadLibraryA",
  84. "address": "0x63c914"
  85. },
  86. {
  87. "name": "GetProcAddress",
  88. "address": "0x63c918"
  89. },
  90. {
  91. "name": "VirtualProtect",
  92. "address": "0x63c91c"
  93. },
  94. {
  95. "name": "VirtualAlloc",
  96. "address": "0x63c920"
  97. },
  98. {
  99. "name": "VirtualFree",
  100. "address": "0x63c924"
  101. },
  102. {
  103. "name": "ExitProcess",
  104. "address": "0x63c928"
  105. }
  106. ],
  107. "dll": "KERNEL32.DLL"
  108. },
  109. {
  110. "imports": [
  111. {
  112. "name": "GetAce",
  113. "address": "0x63c930"
  114. }
  115. ],
  116. "dll": "ADVAPI32.dll"
  117. },
  118. {
  119. "imports": [
  120. {
  121. "name": "ImageList_Remove",
  122. "address": "0x63c938"
  123. }
  124. ],
  125. "dll": "COMCTL32.dll"
  126. },
  127. {
  128. "imports": [
  129. {
  130. "name": "GetOpenFileNameW",
  131. "address": "0x63c940"
  132. }
  133. ],
  134. "dll": "COMDLG32.dll"
  135. },
  136. {
  137. "imports": [
  138. {
  139. "name": "LineTo",
  140. "address": "0x63c948"
  141. }
  142. ],
  143. "dll": "GDI32.dll"
  144. },
  145. {
  146. "imports": [
  147. {
  148. "name": "IcmpSendEcho",
  149. "address": "0x63c950"
  150. }
  151. ],
  152. "dll": "IPHLPAPI.DLL"
  153. },
  154. {
  155. "imports": [
  156. {
  157. "name": "WNetUseConnectionW",
  158. "address": "0x63c958"
  159. }
  160. ],
  161. "dll": "MPR.dll"
  162. },
  163. {
  164. "imports": [
  165. {
  166. "name": "CoGetObject",
  167. "address": "0x63c960"
  168. }
  169. ],
  170. "dll": "ole32.dll"
  171. },
  172. {
  173. "imports": [
  174. {
  175. "name": "VariantInit",
  176. "address": "0x63c968"
  177. }
  178. ],
  179. "dll": "OLEAUT32.dll"
  180. },
  181. {
  182. "imports": [
  183. {
  184. "name": "GetProcessMemoryInfo",
  185. "address": "0x63c970"
  186. }
  187. ],
  188. "dll": "PSAPI.DLL"
  189. },
  190. {
  191. "imports": [
  192. {
  193. "name": "DragFinish",
  194. "address": "0x63c978"
  195. }
  196. ],
  197. "dll": "SHELL32.dll"
  198. },
  199. {
  200. "imports": [
  201. {
  202. "name": "GetDC",
  203. "address": "0x63c980"
  204. }
  205. ],
  206. "dll": "USER32.dll"
  207. },
  208. {
  209. "imports": [
  210. {
  211. "name": "LoadUserProfileW",
  212. "address": "0x63c988"
  213. }
  214. ],
  215. "dll": "USERENV.dll"
  216. },
  217. {
  218. "imports": [
  219. {
  220. "name": "IsThemeActive",
  221. "address": "0x63c990"
  222. }
  223. ],
  224. "dll": "UxTheme.dll"
  225. },
  226. {
  227. "imports": [
  228. {
  229. "name": "VerQueryValueW",
  230. "address": "0x63c998"
  231. }
  232. ],
  233. "dll": "VERSION.dll"
  234. },
  235. {
  236. "imports": [
  237. {
  238. "name": "FtpOpenFileW",
  239. "address": "0x63c9a0"
  240. }
  241. ],
  242. "dll": "WININET.dll"
  243. },
  244. {
  245. "imports": [
  246. {
  247. "name": "timeGetTime",
  248. "address": "0x63c9a8"
  249. }
  250. ],
  251. "dll": "WINMM.dll"
  252. },
  253. {
  254. "imports": [
  255. {
  256. "name": "connect",
  257. "address": "0x63c9b0"
  258. }
  259. ],
  260. "dll": "WSOCK32.dll"
  261. }
  262. ],
  263. "digital_signers": null,
  264. "exported_dll_name": null,
  265. "actual_checksum": "0x0010d3fe",
  266. "overlay": {
  267. "size": "0x00000008",
  268. "offset": "0x00108c00"
  269. },
  270. "imagebase": "0x00400000",
  271. "reported_checksum": "0x00000000",
  272. "icon_hash": null,
  273. "entrypoint": "0x00589980",
  274. "timestamp": "2019-05-03 22:14:25",
  275. "osversion": "5.1",
  276. "sections": [
  277. {
  278. "name": "UPX0",
  279. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  280. "virtual_address": "0x00001000",
  281. "size_of_data": "0x00000000",
  282. "entropy": "0.00",
  283. "raw_address": "0x00000400",
  284. "virtual_size": "0x00133000",
  285. "characteristics_raw": "0xe0000080"
  286. },
  287. {
  288. "name": "UPX1",
  289. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  290. "virtual_address": "0x00134000",
  291. "size_of_data": "0x00055c00",
  292. "entropy": "7.94",
  293. "raw_address": "0x00000400",
  294. "virtual_size": "0x00056000",
  295. "characteristics_raw": "0xe0000040"
  296. },
  297. {
  298. "name": ".rsrc",
  299. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  300. "virtual_address": "0x0018a000",
  301. "size_of_data": "0x000b2c00",
  302. "entropy": "7.96",
  303. "raw_address": "0x00056000",
  304. "virtual_size": "0x000b3000",
  305. "characteristics_raw": "0xc0000040"
  306. }
  307. ],
  308. "resources": [],
  309. "dirents": [
  310. {
  311. "virtual_address": "0x00000000",
  312. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  313. "size": "0x00000000"
  314. },
  315. {
  316. "virtual_address": "0x0023c798",
  317. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  318. "size": "0x00000424"
  319. },
  320. {
  321. "virtual_address": "0x0018a000",
  322. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  323. "size": "0x000b2798"
  324. },
  325. {
  326. "virtual_address": "0x00000000",
  327. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  328. "size": "0x00000000"
  329. },
  330. {
  331. "virtual_address": "0x00000000",
  332. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  333. "size": "0x00000000"
  334. },
  335. {
  336. "virtual_address": "0x0023cbbc",
  337. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  338. "size": "0x0000000c"
  339. },
  340. {
  341. "virtual_address": "0x00000000",
  342. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  343. "size": "0x00000000"
  344. },
  345. {
  346. "virtual_address": "0x00000000",
  347. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  348. "size": "0x00000000"
  349. },
  350. {
  351. "virtual_address": "0x00000000",
  352. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  353. "size": "0x00000000"
  354. },
  355. {
  356. "virtual_address": "0x00000000",
  357. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  358. "size": "0x00000000"
  359. },
  360. {
  361. "virtual_address": "0x00189b64",
  362. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  363. "size": "0x00000048"
  364. },
  365. {
  366. "virtual_address": "0x00000000",
  367. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  368. "size": "0x00000000"
  369. },
  370. {
  371. "virtual_address": "0x00000000",
  372. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  373. "size": "0x00000000"
  374. },
  375. {
  376. "virtual_address": "0x00000000",
  377. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  378. "size": "0x00000000"
  379. },
  380. {
  381. "virtual_address": "0x00000000",
  382. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  383. "size": "0x00000000"
  384. },
  385. {
  386. "virtual_address": "0x00000000",
  387. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  388. "size": "0x00000000"
  389. }
  390. ],
  391. "exports": [],
  392. "guest_signers": {},
  393. "imphash": "fc6683d30d9f25244a50fd5357825e79",
  394. "icon_fuzzy": null,
  395. "icon": null,
  396. "pdbpath": null,
  397. "imported_dll_count": 18,
  398. "versioninfo": []
  399. }
  400. }
  401.  
  402. [*] Resolved APIs: []
  403.  
  404. [*] Static Analysis: {
  405. "pe": {
  406. "peid_signatures": null,
  407. "imports": [
  408. {
  409. "imports": [
  410. {
  411. "name": "LoadLibraryA",
  412. "address": "0x63c914"
  413. },
  414. {
  415. "name": "GetProcAddress",
  416. "address": "0x63c918"
  417. },
  418. {
  419. "name": "VirtualProtect",
  420. "address": "0x63c91c"
  421. },
  422. {
  423. "name": "VirtualAlloc",
  424. "address": "0x63c920"
  425. },
  426. {
  427. "name": "VirtualFree",
  428. "address": "0x63c924"
  429. },
  430. {
  431. "name": "ExitProcess",
  432. "address": "0x63c928"
  433. }
  434. ],
  435. "dll": "KERNEL32.DLL"
  436. },
  437. {
  438. "imports": [
  439. {
  440. "name": "GetAce",
  441. "address": "0x63c930"
  442. }
  443. ],
  444. "dll": "ADVAPI32.dll"
  445. },
  446. {
  447. "imports": [
  448. {
  449. "name": "ImageList_Remove",
  450. "address": "0x63c938"
  451. }
  452. ],
  453. "dll": "COMCTL32.dll"
  454. },
  455. {
  456. "imports": [
  457. {
  458. "name": "GetOpenFileNameW",
  459. "address": "0x63c940"
  460. }
  461. ],
  462. "dll": "COMDLG32.dll"
  463. },
  464. {
  465. "imports": [
  466. {
  467. "name": "LineTo",
  468. "address": "0x63c948"
  469. }
  470. ],
  471. "dll": "GDI32.dll"
  472. },
  473. {
  474. "imports": [
  475. {
  476. "name": "IcmpSendEcho",
  477. "address": "0x63c950"
  478. }
  479. ],
  480. "dll": "IPHLPAPI.DLL"
  481. },
  482. {
  483. "imports": [
  484. {
  485. "name": "WNetUseConnectionW",
  486. "address": "0x63c958"
  487. }
  488. ],
  489. "dll": "MPR.dll"
  490. },
  491. {
  492. "imports": [
  493. {
  494. "name": "CoGetObject",
  495. "address": "0x63c960"
  496. }
  497. ],
  498. "dll": "ole32.dll"
  499. },
  500. {
  501. "imports": [
  502. {
  503. "name": "VariantInit",
  504. "address": "0x63c968"
  505. }
  506. ],
  507. "dll": "OLEAUT32.dll"
  508. },
  509. {
  510. "imports": [
  511. {
  512. "name": "GetProcessMemoryInfo",
  513. "address": "0x63c970"
  514. }
  515. ],
  516. "dll": "PSAPI.DLL"
  517. },
  518. {
  519. "imports": [
  520. {
  521. "name": "DragFinish",
  522. "address": "0x63c978"
  523. }
  524. ],
  525. "dll": "SHELL32.dll"
  526. },
  527. {
  528. "imports": [
  529. {
  530. "name": "GetDC",
  531. "address": "0x63c980"
  532. }
  533. ],
  534. "dll": "USER32.dll"
  535. },
  536. {
  537. "imports": [
  538. {
  539. "name": "LoadUserProfileW",
  540. "address": "0x63c988"
  541. }
  542. ],
  543. "dll": "USERENV.dll"
  544. },
  545. {
  546. "imports": [
  547. {
  548. "name": "IsThemeActive",
  549. "address": "0x63c990"
  550. }
  551. ],
  552. "dll": "UxTheme.dll"
  553. },
  554. {
  555. "imports": [
  556. {
  557. "name": "VerQueryValueW",
  558. "address": "0x63c998"
  559. }
  560. ],
  561. "dll": "VERSION.dll"
  562. },
  563. {
  564. "imports": [
  565. {
  566. "name": "FtpOpenFileW",
  567. "address": "0x63c9a0"
  568. }
  569. ],
  570. "dll": "WININET.dll"
  571. },
  572. {
  573. "imports": [
  574. {
  575. "name": "timeGetTime",
  576. "address": "0x63c9a8"
  577. }
  578. ],
  579. "dll": "WINMM.dll"
  580. },
  581. {
  582. "imports": [
  583. {
  584. "name": "connect",
  585. "address": "0x63c9b0"
  586. }
  587. ],
  588. "dll": "WSOCK32.dll"
  589. }
  590. ],
  591. "digital_signers": null,
  592. "exported_dll_name": null,
  593. "actual_checksum": "0x0010d3fe",
  594. "overlay": {
  595. "size": "0x00000008",
  596. "offset": "0x00108c00"
  597. },
  598. "imagebase": "0x00400000",
  599. "reported_checksum": "0x00000000",
  600. "icon_hash": null,
  601. "entrypoint": "0x00589980",
  602. "timestamp": "2019-05-03 22:14:25",
  603. "osversion": "5.1",
  604. "sections": [
  605. {
  606. "name": "UPX0",
  607. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  608. "virtual_address": "0x00001000",
  609. "size_of_data": "0x00000000",
  610. "entropy": "0.00",
  611. "raw_address": "0x00000400",
  612. "virtual_size": "0x00133000",
  613. "characteristics_raw": "0xe0000080"
  614. },
  615. {
  616. "name": "UPX1",
  617. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  618. "virtual_address": "0x00134000",
  619. "size_of_data": "0x00055c00",
  620. "entropy": "7.94",
  621. "raw_address": "0x00000400",
  622. "virtual_size": "0x00056000",
  623. "characteristics_raw": "0xe0000040"
  624. },
  625. {
  626. "name": ".rsrc",
  627. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  628. "virtual_address": "0x0018a000",
  629. "size_of_data": "0x000b2c00",
  630. "entropy": "7.96",
  631. "raw_address": "0x00056000",
  632. "virtual_size": "0x000b3000",
  633. "characteristics_raw": "0xc0000040"
  634. }
  635. ],
  636. "resources": [],
  637. "dirents": [
  638. {
  639. "virtual_address": "0x00000000",
  640. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  641. "size": "0x00000000"
  642. },
  643. {
  644. "virtual_address": "0x0023c798",
  645. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  646. "size": "0x00000424"
  647. },
  648. {
  649. "virtual_address": "0x0018a000",
  650. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  651. "size": "0x000b2798"
  652. },
  653. {
  654. "virtual_address": "0x00000000",
  655. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  656. "size": "0x00000000"
  657. },
  658. {
  659. "virtual_address": "0x00000000",
  660. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  661. "size": "0x00000000"
  662. },
  663. {
  664. "virtual_address": "0x0023cbbc",
  665. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  666. "size": "0x0000000c"
  667. },
  668. {
  669. "virtual_address": "0x00000000",
  670. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  671. "size": "0x00000000"
  672. },
  673. {
  674. "virtual_address": "0x00000000",
  675. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  676. "size": "0x00000000"
  677. },
  678. {
  679. "virtual_address": "0x00000000",
  680. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  681. "size": "0x00000000"
  682. },
  683. {
  684. "virtual_address": "0x00000000",
  685. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  686. "size": "0x00000000"
  687. },
  688. {
  689. "virtual_address": "0x00189b64",
  690. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  691. "size": "0x00000048"
  692. },
  693. {
  694. "virtual_address": "0x00000000",
  695. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  696. "size": "0x00000000"
  697. },
  698. {
  699. "virtual_address": "0x00000000",
  700. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  701. "size": "0x00000000"
  702. },
  703. {
  704. "virtual_address": "0x00000000",
  705. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  706. "size": "0x00000000"
  707. },
  708. {
  709. "virtual_address": "0x00000000",
  710. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  711. "size": "0x00000000"
  712. },
  713. {
  714. "virtual_address": "0x00000000",
  715. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  716. "size": "0x00000000"
  717. }
  718. ],
  719. "exports": [],
  720. "guest_signers": {},
  721. "imphash": "fc6683d30d9f25244a50fd5357825e79",
  722. "icon_fuzzy": null,
  723. "icon": null,
  724. "pdbpath": null,
  725. "imported_dll_count": 18,
  726. "versioninfo": []
  727. }
  728. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!