API tools faq
paste
paladin316

Exes_4ec475b74ec6053a27df25b6709617f4_exe_2019-06-30_23_30.json

paladin316
Jun 30th, 2019
2,204
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 22.26 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_4ec475b74ec6053a27df25b6709617f4.exe"
  7. [*] File Size: 634880
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "7a9cfd7a3ea4e176157dd7461b001bda327b85eb1e495dd1d6832882a760bf4e"
  10. [*] MD5: "4ec475b74ec6053a27df25b6709617f4"
  11. [*] SHA1: "292a5216305486f1c1ba65c289444e47cf62a380"
  12. [*] SHA512: "312fceef79d267e573ad121aaed06657319c9eee4f8cf7032bfaee61fc1a60231a0186024d685e2cd560cbddd1da7e08710f4ef600ee1a76093d4b78f1cb6700"
  13. [*] CRC32: "C0510FF1"
  14. [*] SSDEEP: "12288:vT+ud0CwpD6pv394fYzydHjYVVXuG89o8I6FVMee/Pc:vDis/+fYedEVVXuG89oWFCE"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "File has been identified by 26 Antiviruses on VirusTotal as malicious",
  21. "Details": [
  22. {
  23. "MicroWorld-eScan": "Gen:Variant.Ursu.512192"
  24. },
  25. {
  26. "Cylance": "Unsafe"
  27. },
  28. {
  29. "Invincea": "heuristic"
  30. },
  31. {
  32. "APEX": "Malicious"
  33. },
  34. {
  35. "Avast": "Win32:Malware-gen"
  36. },
  37. {
  38. "GData": "Gen:Variant.Ursu.512192"
  39. },
  40. {
  41. "Kaspersky": "Backdoor.MSIL.NanoBot.aryh"
  42. },
  43. {
  44. "BitDefender": "Gen:Variant.Ursu.512192"
  45. },
  46. {
  47. "Endgame": "malicious (high confidence)"
  48. },
  49. {
  50. "Emsisoft": "Gen:Variant.Ursu.512192 (B)"
  51. },
  52. {
  53. "DrWeb": "Trojan.PWS.Siggen2.20206"
  54. },
  55. {
  56. "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.jh"
  57. },
  58. {
  59. "Trapmine": "malicious.high.ml.score"
  60. },
  61. {
  62. "FireEye": "Generic.mg.4ec475b74ec6053a"
  63. },
  64. {
  65. "SentinelOne": "DFI - Malicious PE"
  66. },
  67. {
  68. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  69. },
  70. {
  71. "Arcabit": "Trojan.Ursu.D7D0C0"
  72. },
  73. {
  74. "ZoneAlarm": "Backdoor.MSIL.NanoBot.aryh"
  75. },
  76. {
  77. "MAX": "malware (ai score=85)"
  78. },
  79. {
  80. "Ad-Aware": "Gen:Variant.Ursu.512192"
  81. },
  82. {
  83. "ESET-NOD32": "a variant of Win32/GenKryptik.DMAA"
  84. },
  85. {
  86. "Rising": "Trojan.Formbook!8.F858 (TFE:dGZlOgVhoPNuZBxXZQ)"
  87. },
  88. {
  89. "AVG": "Win32:Malware-gen"
  90. },
  91. {
  92. "Cybereason": "malicious.630548"
  93. },
  94. {
  95. "Panda": "Trj/Genetic.gen"
  96. },
  97. {
  98. "CrowdStrike": "win/malicious_confidence_100% (D)"
  99. }
  100. ]
  101. }
  102. ]
  103.  
  104. [*] Started Service: []
  105.  
  106. [*] Executed Commands: []
  107.  
  108. [*] Mutexes: []
  109.  
  110. [*] Modified Files: []
  111.  
  112. [*] Deleted Files: []
  113.  
  114. [*] Modified Registry Keys: []
  115.  
  116. [*] Deleted Registry Keys: []
  117.  
  118. [*] DNS Communications: []
  119.  
  120. [*] Domains: []
  121.  
  122. [*] Network Communication - ICMP: []
  123.  
  124. [*] Network Communication - HTTP: []
  125.  
  126. [*] Network Communication - SMTP: []
  127.  
  128. [*] Network Communication - Hosts: []
  129.  
  130. [*] Network Communication - IRC: []
  131.  
  132. [*] Static Analysis: {
  133. "pe": {
  134. "peid_signatures": null,
  135. "imports": [
  136. {
  137. "imports": [
  138. {
  139. "name": null,
  140. "address": "0x401000"
  141. },
  142. {
  143. "name": null,
  144. "address": "0x401004"
  145. },
  146. {
  147. "name": "MethCallEngine",
  148. "address": "0x401008"
  149. },
  150. {
  151. "name": null,
  152. "address": "0x40100c"
  153. },
  154. {
  155. "name": null,
  156. "address": "0x401010"
  157. },
  158. {
  159. "name": null,
  160. "address": "0x401014"
  161. },
  162. {
  163. "name": null,
  164. "address": "0x401018"
  165. },
  166. {
  167. "name": null,
  168. "address": "0x40101c"
  169. },
  170. {
  171. "name": null,
  172. "address": "0x401020"
  173. },
  174. {
  175. "name": null,
  176. "address": "0x401024"
  177. },
  178. {
  179. "name": null,
  180. "address": "0x401028"
  181. },
  182. {
  183. "name": null,
  184. "address": "0x40102c"
  185. },
  186. {
  187. "name": null,
  188. "address": "0x401030"
  189. },
  190. {
  191. "name": "EVENT_SINK_AddRef",
  192. "address": "0x401034"
  193. },
  194. {
  195. "name": null,
  196. "address": "0x401038"
  197. },
  198. {
  199. "name": null,
  200. "address": "0x40103c"
  201. },
  202. {
  203. "name": "EVENT_SINK_Release",
  204. "address": "0x401040"
  205. },
  206. {
  207. "name": null,
  208. "address": "0x401044"
  209. },
  210. {
  211. "name": "EVENT_SINK_QueryInterface",
  212. "address": "0x401048"
  213. },
  214. {
  215. "name": "__vbaExceptHandler",
  216. "address": "0x40104c"
  217. },
  218. {
  219. "name": null,
  220. "address": "0x401050"
  221. },
  222. {
  223. "name": null,
  224. "address": "0x401054"
  225. },
  226. {
  227. "name": null,
  228. "address": "0x401058"
  229. },
  230. {
  231. "name": null,
  232. "address": "0x40105c"
  233. },
  234. {
  235. "name": null,
  236. "address": "0x401060"
  237. },
  238. {
  239. "name": null,
  240. "address": "0x401064"
  241. },
  242. {
  243. "name": null,
  244. "address": "0x401068"
  245. },
  246. {
  247. "name": null,
  248. "address": "0x40106c"
  249. },
  250. {
  251. "name": null,
  252. "address": "0x401070"
  253. },
  254. {
  255. "name": null,
  256. "address": "0x401074"
  257. },
  258. {
  259. "name": null,
  260. "address": "0x401078"
  261. },
  262. {
  263. "name": null,
  264. "address": "0x40107c"
  265. },
  266. {
  267. "name": null,
  268. "address": "0x401080"
  269. },
  270. {
  271. "name": null,
  272. "address": "0x401084"
  273. },
  274. {
  275. "name": null,
  276. "address": "0x401088"
  277. },
  278. {
  279. "name": null,
  280. "address": "0x40108c"
  281. }
  282. ],
  283. "dll": "MSVBVM60.DLL"
  284. }
  285. ],
  286. "digital_signers": null,
  287. "exported_dll_name": null,
  288. "actual_checksum": "0x000a1234",
  289. "overlay": null,
  290. "imagebase": "0x00400000",
  291. "reported_checksum": "0x000a1234",
  292. "icon_hash": null,
  293. "entrypoint": "0x00401178",
  294. "timestamp": "2019-06-29 19:21:24",
  295. "osversion": "4.0",
  296. "sections": [
  297. {
  298. "name": ".text",
  299. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  300. "virtual_address": "0x00001000",
  301. "size_of_data": "0x00094000",
  302. "entropy": "6.75",
  303. "raw_address": "0x00001000",
  304. "virtual_size": "0x0009371c",
  305. "characteristics_raw": "0x60000020"
  306. },
  307. {
  308. "name": ".data",
  309. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  310. "virtual_address": "0x00095000",
  311. "size_of_data": "0x00000000",
  312. "entropy": "0.00",
  313. "raw_address": "0x00000000",
  314. "virtual_size": "0x00005bb0",
  315. "characteristics_raw": "0xc0000040"
  316. },
  317. {
  318. "name": ".rsrc",
  319. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  320. "virtual_address": "0x0009b000",
  321. "size_of_data": "0x00006000",
  322. "entropy": "4.23",
  323. "raw_address": "0x00095000",
  324. "virtual_size": "0x00005958",
  325. "characteristics_raw": "0x40000040"
  326. }
  327. ],
  328. "resources": [],
  329. "dirents": [
  330. {
  331. "virtual_address": "0x00000000",
  332. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  333. "size": "0x00000000"
  334. },
  335. {
  336. "virtual_address": "0x000945e4",
  337. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  338. "size": "0x00000028"
  339. },
  340. {
  341. "virtual_address": "0x0009b000",
  342. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  343. "size": "0x00005958"
  344. },
  345. {
  346. "virtual_address": "0x00000000",
  347. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  348. "size": "0x00000000"
  349. },
  350. {
  351. "virtual_address": "0x00000000",
  352. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  353. "size": "0x00000000"
  354. },
  355. {
  356. "virtual_address": "0x00000000",
  357. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  358. "size": "0x00000000"
  359. },
  360. {
  361. "virtual_address": "0x00000000",
  362. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  363. "size": "0x00000000"
  364. },
  365. {
  366. "virtual_address": "0x00000000",
  367. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  368. "size": "0x00000000"
  369. },
  370. {
  371. "virtual_address": "0x00000000",
  372. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  373. "size": "0x00000000"
  374. },
  375. {
  376. "virtual_address": "0x00000000",
  377. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  378. "size": "0x00000000"
  379. },
  380. {
  381. "virtual_address": "0x00000000",
  382. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  383. "size": "0x00000000"
  384. },
  385. {
  386. "virtual_address": "0x00000220",
  387. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  388. "size": "0x00000020"
  389. },
  390. {
  391. "virtual_address": "0x00001000",
  392. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  393. "size": "0x00000094"
  394. },
  395. {
  396. "virtual_address": "0x00000000",
  397. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  398. "size": "0x00000000"
  399. },
  400. {
  401. "virtual_address": "0x00000000",
  402. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  403. "size": "0x00000000"
  404. },
  405. {
  406. "virtual_address": "0x00000000",
  407. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  408. "size": "0x00000000"
  409. }
  410. ],
  411. "exports": [],
  412. "guest_signers": {},
  413. "imphash": "746bf43b0b56a074bf9818bdc78892a5",
  414. "icon_fuzzy": null,
  415. "icon": null,
  416. "pdbpath": null,
  417. "imported_dll_count": 1,
  418. "versioninfo": []
  419. }
  420. }
  421.  
  422. [*] Resolved APIs: []
  423.  
  424. [*] Static Analysis: {
  425. "pe": {
  426. "peid_signatures": null,
  427. "imports": [
  428. {
  429. "imports": [
  430. {
  431. "name": null,
  432. "address": "0x401000"
  433. },
  434. {
  435. "name": null,
  436. "address": "0x401004"
  437. },
  438. {
  439. "name": "MethCallEngine",
  440. "address": "0x401008"
  441. },
  442. {
  443. "name": null,
  444. "address": "0x40100c"
  445. },
  446. {
  447. "name": null,
  448. "address": "0x401010"
  449. },
  450. {
  451. "name": null,
  452. "address": "0x401014"
  453. },
  454. {
  455. "name": null,
  456. "address": "0x401018"
  457. },
  458. {
  459. "name": null,
  460. "address": "0x40101c"
  461. },
  462. {
  463. "name": null,
  464. "address": "0x401020"
  465. },
  466. {
  467. "name": null,
  468. "address": "0x401024"
  469. },
  470. {
  471. "name": null,
  472. "address": "0x401028"
  473. },
  474. {
  475. "name": null,
  476. "address": "0x40102c"
  477. },
  478. {
  479. "name": null,
  480. "address": "0x401030"
  481. },
  482. {
  483. "name": "EVENT_SINK_AddRef",
  484. "address": "0x401034"
  485. },
  486. {
  487. "name": null,
  488. "address": "0x401038"
  489. },
  490. {
  491. "name": null,
  492. "address": "0x40103c"
  493. },
  494. {
  495. "name": "EVENT_SINK_Release",
  496. "address": "0x401040"
  497. },
  498. {
  499. "name": null,
  500. "address": "0x401044"
  501. },
  502. {
  503. "name": "EVENT_SINK_QueryInterface",
  504. "address": "0x401048"
  505. },
  506. {
  507. "name": "__vbaExceptHandler",
  508. "address": "0x40104c"
  509. },
  510. {
  511. "name": null,
  512. "address": "0x401050"
  513. },
  514. {
  515. "name": null,
  516. "address": "0x401054"
  517. },
  518. {
  519. "name": null,
  520. "address": "0x401058"
  521. },
  522. {
  523. "name": null,
  524. "address": "0x40105c"
  525. },
  526. {
  527. "name": null,
  528. "address": "0x401060"
  529. },
  530. {
  531. "name": null,
  532. "address": "0x401064"
  533. },
  534. {
  535. "name": null,
  536. "address": "0x401068"
  537. },
  538. {
  539. "name": null,
  540. "address": "0x40106c"
  541. },
  542. {
  543. "name": null,
  544. "address": "0x401070"
  545. },
  546. {
  547. "name": null,
  548. "address": "0x401074"
  549. },
  550. {
  551. "name": null,
  552. "address": "0x401078"
  553. },
  554. {
  555. "name": null,
  556. "address": "0x40107c"
  557. },
  558. {
  559. "name": null,
  560. "address": "0x401080"
  561. },
  562. {
  563. "name": null,
  564. "address": "0x401084"
  565. },
  566. {
  567. "name": null,
  568. "address": "0x401088"
  569. },
  570. {
  571. "name": null,
  572. "address": "0x40108c"
  573. }
  574. ],
  575. "dll": "MSVBVM60.DLL"
  576. }
  577. ],
  578. "digital_signers": null,
  579. "exported_dll_name": null,
  580. "actual_checksum": "0x000a1234",
  581. "overlay": null,
  582. "imagebase": "0x00400000",
  583. "reported_checksum": "0x000a1234",
  584. "icon_hash": null,
  585. "entrypoint": "0x00401178",
  586. "timestamp": "2019-06-29 19:21:24",
  587. "osversion": "4.0",
  588. "sections": [
  589. {
  590. "name": ".text",
  591. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  592. "virtual_address": "0x00001000",
  593. "size_of_data": "0x00094000",
  594. "entropy": "6.75",
  595. "raw_address": "0x00001000",
  596. "virtual_size": "0x0009371c",
  597. "characteristics_raw": "0x60000020"
  598. },
  599. {
  600. "name": ".data",
  601. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  602. "virtual_address": "0x00095000",
  603. "size_of_data": "0x00000000",
  604. "entropy": "0.00",
  605. "raw_address": "0x00000000",
  606. "virtual_size": "0x00005bb0",
  607. "characteristics_raw": "0xc0000040"
  608. },
  609. {
  610. "name": ".rsrc",
  611. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  612. "virtual_address": "0x0009b000",
  613. "size_of_data": "0x00006000",
  614. "entropy": "4.23",
  615. "raw_address": "0x00095000",
  616. "virtual_size": "0x00005958",
  617. "characteristics_raw": "0x40000040"
  618. }
  619. ],
  620. "resources": [],
  621. "dirents": [
  622. {
  623. "virtual_address": "0x00000000",
  624. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  625. "size": "0x00000000"
  626. },
  627. {
  628. "virtual_address": "0x000945e4",
  629. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  630. "size": "0x00000028"
  631. },
  632. {
  633. "virtual_address": "0x0009b000",
  634. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  635. "size": "0x00005958"
  636. },
  637. {
  638. "virtual_address": "0x00000000",
  639. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  640. "size": "0x00000000"
  641. },
  642. {
  643. "virtual_address": "0x00000000",
  644. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  645. "size": "0x00000000"
  646. },
  647. {
  648. "virtual_address": "0x00000000",
  649. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  650. "size": "0x00000000"
  651. },
  652. {
  653. "virtual_address": "0x00000000",
  654. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  655. "size": "0x00000000"
  656. },
  657. {
  658. "virtual_address": "0x00000000",
  659. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  660. "size": "0x00000000"
  661. },
  662. {
  663. "virtual_address": "0x00000000",
  664. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  665. "size": "0x00000000"
  666. },
  667. {
  668. "virtual_address": "0x00000000",
  669. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  670. "size": "0x00000000"
  671. },
  672. {
  673. "virtual_address": "0x00000000",
  674. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  675. "size": "0x00000000"
  676. },
  677. {
  678. "virtual_address": "0x00000220",
  679. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  680. "size": "0x00000020"
  681. },
  682. {
  683. "virtual_address": "0x00001000",
  684. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  685. "size": "0x00000094"
  686. },
  687. {
  688. "virtual_address": "0x00000000",
  689. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  690. "size": "0x00000000"
  691. },
  692. {
  693. "virtual_address": "0x00000000",
  694. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  695. "size": "0x00000000"
  696. },
  697. {
  698. "virtual_address": "0x00000000",
  699. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  700. "size": "0x00000000"
  701. }
  702. ],
  703. "exports": [],
  704. "guest_signers": {},
  705. "imphash": "746bf43b0b56a074bf9818bdc78892a5",
  706. "icon_fuzzy": null,
  707. "icon": null,
  708. "pdbpath": null,
  709. "imported_dll_count": 1,
  710. "versioninfo": []
  711. }
  712. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!