Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- [*] MalFamily: ""
- [*] MalScore: 10.0
- [*] File Name: "Exes_ef909106d56ffc1b4e15236170fd19c8.exe"
- [*] File Size: 98816
- [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- [*] SHA256: "64ca261551836e70e8912a14c1b819b9afda48e07f259397589f85e8c40248a3"
- [*] MD5: "ef909106d56ffc1b4e15236170fd19c8"
- [*] SHA1: "58aa960b2411eb55ba22ecdeb4ace607edcbb5ec"
- [*] SHA512: "b44f1d818669d418a5019814be70226e8ec12b95e156af65643caf9c74ad679022d40a307ffeb2f7a8f6489740919e346772aaed6967f2cd2ad7f1ea0461e7a1"
- [*] CRC32: "7A48A07A"
- [*] SSDEEP: "1536:e/xi+1VgZ634EEbdK2dYPbsAjzy6zk1yX9ewCooW++aoYvGUxNs5H/Q5/X3KR+DC:eR0mZ3rRlpJomKu/U3IRP"
- [*] Process Execution: [
- "Exes_ef909106d56ffc1b4e15236170fd19c8.exe"
- ]
- [*] Signatures Detected: [
- {
- "Description": "Creates RWX memory",
- "Details": []
- },
- {
- "Description": "The binary likely contains encrypted or compressed data.",
- "Details": [
- {
- "section": "name: .pdata, entropy: 7.92, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00011e00, virtual_size: 0x00011db0"
- }
- ]
- },
- {
- "Description": "File has been identified by 37 Antiviruses on VirusTotal as malicious",
- "Details": [
- {
- "MicroWorld-eScan": "Trojan.GenericKD.41369849"
- },
- {
- "FireEye": "Generic.mg.ef909106d56ffc1b"
- },
- {
- "McAfee": "Emotet-FMS!EF909106D56F"
- },
- {
- "Malwarebytes": "Trojan.MalPack.VAK"
- },
- {
- "BitDefender": "Trojan.GenericKD.41369849"
- },
- {
- "Arcabit": "Trojan.Razy.D7EE33"
- },
- {
- "TrendMicro": "Trojan.Win32.ELENOOKA.SM.hp"
- },
- {
- "Symantec": "Packed.Generic.493"
- },
- {
- "APEX": "Malicious"
- },
- {
- "GData": "Trojan.GenericKD.41369849"
- },
- {
- "Kaspersky": "Trojan-Banker.Win32.Emotet.diro"
- },
- {
- "Rising": "Backdoor.Tofsee!8.1E9 (TFE:dGZlOgLYnZihtUJlXA)"
- },
- {
- "Endgame": "malicious (high confidence)"
- },
- {
- "Sophos": "Mal/Elenoocka-G"
- },
- {
- "Invincea": "heuristic"
- },
- {
- "McAfee-GW-Edition": "BehavesLike.Win32.Generic.nc"
- },
- {
- "Emsisoft": "Trojan.GenericKD.41369849 (B)"
- },
- {
- "SentinelOne": "DFI - Malicious PE"
- },
- {
- "ESET-NOD32": "a variant of Win32/Kryptik.GTZG"
- },
- {
- "Webroot": "W32.Trojan.Gen"
- },
- {
- "MAX": "malware (ai score=84)"
- },
- {
- "Microsoft": "Trojan:Win32/Emotet.LK!ml"
- },
- {
- "ZoneAlarm": "Trojan-Banker.Win32.Emotet.diro"
- },
- {
- "AhnLab-V3": "Malware/Win32.RL_Trojan.R276005"
- },
- {
- "Acronis": "suspicious"
- },
- {
- "ALYac": "Gen:Variant.Razy.519731"
- },
- {
- "VBA32": "BScope.Trojan.Fuerboos"
- },
- {
- "Cylance": "Unsafe"
- },
- {
- "TrendMicro-HouseCall": "Trojan.Win32.ELENOOKA.SM.hp"
- },
- {
- "Tencent": "Win32.Trojan-banker.Emotet.Aoiy"
- },
- {
- "eGambit": "Unsafe.AI_Score_99%"
- },
- {
- "Fortinet": "W32/GenKryptik.DKRH!tr"
- },
- {
- "Ad-Aware": "Trojan.GenericKD.41369849"
- },
- {
- "AVG": "FileRepMalware"
- },
- {
- "Cybereason": "malicious.b2411e"
- },
- {
- "CrowdStrike": "win/malicious_confidence_100% (D)"
- },
- {
- "Qihoo-360": "HEUR/QVM19.1.DD2D.Malware.Gen"
- }
- ]
- }
- ]
- [*] Started Service: []
- [*] Executed Commands: []
- [*] Mutexes: []
- [*] Modified Files: []
- [*] Deleted Files: []
- [*] Modified Registry Keys: []
- [*] Deleted Registry Keys: []
- [*] DNS Communications: []
- [*] Domains: []
- [*] Network Communication - ICMP: []
- [*] Network Communication - HTTP: []
- [*] Network Communication - SMTP: []
- [*] Network Communication - Hosts: []
- [*] Network Communication - IRC: []
- [*] Static Analysis: {
- "pe": {
- "peid_signatures": null,
- "imports": [
- {
- "imports": [
- {
- "name": "vSetDdrawflag",
- "address": "0x406000"
- },
- {
- "name": "AlphaBlend",
- "address": "0x406004"
- },
- {
- "name": "GradientFill",
- "address": "0x406008"
- },
- {
- "name": "TransparentBlt",
- "address": "0x40600c"
- },
- {
- "name": "DllInitialize",
- "address": "0x406010"
- }
- ],
- "dll": "msimg32.dll"
- },
- {
- "imports": [
- {
- "name": "CoRegCleanup",
- "address": "0x406018"
- },
- {
- "name": "SetSetupSave",
- "address": "0x40601c"
- },
- {
- "name": "ComPlusMigrate",
- "address": "0x406020"
- },
- {
- "name": "SetSetupOpen",
- "address": "0x406024"
- },
- {
- "name": "DowngradeAPL",
- "address": "0x406028"
- }
- ],
- "dll": "clbcatq.dll"
- },
- {
- "imports": [
- {
- "name": "OpenSemaphoreA",
- "address": "0x406030"
- },
- {
- "name": "FindFirstFileA",
- "address": "0x406034"
- },
- {
- "name": "GetCurrentProcessId",
- "address": "0x406038"
- },
- {
- "name": "LoadLibraryW",
- "address": "0x40603c"
- },
- {
- "name": "WaitForMultipleObjectsEx",
- "address": "0x406040"
- },
- {
- "name": "GetShortPathNameA",
- "address": "0x406044"
- },
- {
- "name": "HeapAlloc",
- "address": "0x406048"
- },
- {
- "name": "VirtualFree",
- "address": "0x40604c"
- },
- {
- "name": "LoadLibraryA",
- "address": "0x406050"
- },
- {
- "name": "EncodePointer",
- "address": "0x406054"
- },
- {
- "name": "VirtualAlloc",
- "address": "0x406058"
- },
- {
- "name": "GetSystemTime",
- "address": "0x40605c"
- },
- {
- "name": "GetACP",
- "address": "0x406060"
- },
- {
- "name": "FindVolumeClose",
- "address": "0x406064"
- }
- ],
- "dll": "kernel32.dll"
- }
- ],
- "digital_signers": null,
- "exported_dll_name": null,
- "actual_checksum": "0x0001da8d",
- "overlay": null,
- "imagebase": "0x00400000",
- "reported_checksum": "0x0001da8d",
- "icon_hash": null,
- "entrypoint": "0x00401004",
- "timestamp": "2014-03-07 18:46:41",
- "osversion": "5.1",
- "sections": [
- {
- "name": ".text",
- "characteristics": "IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00001000",
- "size_of_data": "0x00004800",
- "entropy": "4.47",
- "raw_address": "0x00000400",
- "virtual_size": "0x00004629",
- "characteristics_raw": "0x60000000"
- },
- {
- "name": ".pdata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00006000",
- "size_of_data": "0x00011e00",
- "entropy": "7.92",
- "raw_address": "0x00004c00",
- "virtual_size": "0x00011db0",
- "characteristics_raw": "0x40000040"
- },
- {
- "name": ".fdata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00018000",
- "size_of_data": "0x00000600",
- "entropy": "0.64",
- "raw_address": "0x00016a00",
- "virtual_size": "0x0000059f",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".rsrc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00019000",
- "size_of_data": "0x00000600",
- "entropy": "2.30",
- "raw_address": "0x00017000",
- "virtual_size": "0x00000460",
- "characteristics_raw": "0x800000c0"
- },
- {
- "name": ".relos",
- "characteristics": "IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0001a000",
- "size_of_data": "0x00000c00",
- "entropy": "6.51",
- "raw_address": "0x00017600",
- "virtual_size": "0x00000acc",
- "characteristics_raw": "0x42000000"
- }
- ],
- "resources": [],
- "dirents": [
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x0001793c",
- "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
- "size": "0x00000050"
- },
- {
- "virtual_address": "0x00019000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
- "size": "0x00000460"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x0001a000",
- "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
- "size": "0x00000acc"
- },
- {
- "virtual_address": "0x00001300",
- "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
- "size": "0x0000001c"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_TLS",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_IAT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
- "size": "0x00000000"
- }
- ],
- "exports": [],
- "guest_signers": {},
- "imphash": "7d9e4b3617796576bc0f6b0498729367",
- "icon_fuzzy": null,
- "icon": null,
- "pdbpath": null,
- "imported_dll_count": 3,
- "versioninfo": []
- }
- }
- [*] Resolved APIs: [
- "kernel32.dll.HeapAlloc",
- "kernel32.dll.HeapFree",
- "kernel32.dll.GetTickCount",
- "mscoree.dll.CLRCreateInstance",
- "advapi32.dll.RegOpenKeyExW",
- "advapi32.dll.RegQueryInfoKeyW",
- "advapi32.dll.RegEnumKeyExW",
- "advapi32.dll.RegEnumValueW",
- "advapi32.dll.RegCloseKey",
- "advapi32.dll.RegQueryValueExW"
- ]
- [*] Static Analysis: {
- "pe": {
- "peid_signatures": null,
- "imports": [
- {
- "imports": [
- {
- "name": "vSetDdrawflag",
- "address": "0x406000"
- },
- {
- "name": "AlphaBlend",
- "address": "0x406004"
- },
- {
- "name": "GradientFill",
- "address": "0x406008"
- },
- {
- "name": "TransparentBlt",
- "address": "0x40600c"
- },
- {
- "name": "DllInitialize",
- "address": "0x406010"
- }
- ],
- "dll": "msimg32.dll"
- },
- {
- "imports": [
- {
- "name": "CoRegCleanup",
- "address": "0x406018"
- },
- {
- "name": "SetSetupSave",
- "address": "0x40601c"
- },
- {
- "name": "ComPlusMigrate",
- "address": "0x406020"
- },
- {
- "name": "SetSetupOpen",
- "address": "0x406024"
- },
- {
- "name": "DowngradeAPL",
- "address": "0x406028"
- }
- ],
- "dll": "clbcatq.dll"
- },
- {
- "imports": [
- {
- "name": "OpenSemaphoreA",
- "address": "0x406030"
- },
- {
- "name": "FindFirstFileA",
- "address": "0x406034"
- },
- {
- "name": "GetCurrentProcessId",
- "address": "0x406038"
- },
- {
- "name": "LoadLibraryW",
- "address": "0x40603c"
- },
- {
- "name": "WaitForMultipleObjectsEx",
- "address": "0x406040"
- },
- {
- "name": "GetShortPathNameA",
- "address": "0x406044"
- },
- {
- "name": "HeapAlloc",
- "address": "0x406048"
- },
- {
- "name": "VirtualFree",
- "address": "0x40604c"
- },
- {
- "name": "LoadLibraryA",
- "address": "0x406050"
- },
- {
- "name": "EncodePointer",
- "address": "0x406054"
- },
- {
- "name": "VirtualAlloc",
- "address": "0x406058"
- },
- {
- "name": "GetSystemTime",
- "address": "0x40605c"
- },
- {
- "name": "GetACP",
- "address": "0x406060"
- },
- {
- "name": "FindVolumeClose",
- "address": "0x406064"
- }
- ],
- "dll": "kernel32.dll"
- }
- ],
- "digital_signers": null,
- "exported_dll_name": null,
- "actual_checksum": "0x0001da8d",
- "overlay": null,
- "imagebase": "0x00400000",
- "reported_checksum": "0x0001da8d",
- "icon_hash": null,
- "entrypoint": "0x00401004",
- "timestamp": "2014-03-07 18:46:41",
- "osversion": "5.1",
- "sections": [
- {
- "name": ".text",
- "characteristics": "IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00001000",
- "size_of_data": "0x00004800",
- "entropy": "4.47",
- "raw_address": "0x00000400",
- "virtual_size": "0x00004629",
- "characteristics_raw": "0x60000000"
- },
- {
- "name": ".pdata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00006000",
- "size_of_data": "0x00011e00",
- "entropy": "7.92",
- "raw_address": "0x00004c00",
- "virtual_size": "0x00011db0",
- "characteristics_raw": "0x40000040"
- },
- {
- "name": ".fdata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00018000",
- "size_of_data": "0x00000600",
- "entropy": "0.64",
- "raw_address": "0x00016a00",
- "virtual_size": "0x0000059f",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".rsrc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00019000",
- "size_of_data": "0x00000600",
- "entropy": "2.30",
- "raw_address": "0x00017000",
- "virtual_size": "0x00000460",
- "characteristics_raw": "0x800000c0"
- },
- {
- "name": ".relos",
- "characteristics": "IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0001a000",
- "size_of_data": "0x00000c00",
- "entropy": "6.51",
- "raw_address": "0x00017600",
- "virtual_size": "0x00000acc",
- "characteristics_raw": "0x42000000"
- }
- ],
- "resources": [],
- "dirents": [
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x0001793c",
- "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
- "size": "0x00000050"
- },
- {
- "virtual_address": "0x00019000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
- "size": "0x00000460"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x0001a000",
- "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
- "size": "0x00000acc"
- },
- {
- "virtual_address": "0x00001300",
- "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
- "size": "0x0000001c"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_TLS",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_IAT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
- "size": "0x00000000"
- }
- ],
- "exports": [],
- "guest_signers": {},
- "imphash": "7d9e4b3617796576bc0f6b0498729367",
- "icon_fuzzy": null,
- "icon": null,
- "pdbpath": null,
- "imported_dll_count": 3,
- "versioninfo": []
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment