API tools faq
paste
paladin316

Exes_9a689ae99482b1936fc0ecb6d7182b1a_exe_2019-06-30_15_30.json

paladin316
Jun 30th, 2019
2,343
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.79 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Windigo"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_9a689ae99482b1936fc0ecb6d7182b1a.exe"
  7. [*] File Size: 1876992
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  9. [*] SHA256: "dfc82145a9126011dc2b44893cbb9afe120cb36142496739babaa0ef21793343"
  10. [*] MD5: "9a689ae99482b1936fc0ecb6d7182b1a"
  11. [*] SHA1: "9122a2bcd911028fe25dbdf43089ffb31041ca9a"
  12. [*] SHA512: "60521007749698720b6c7badc37643b9e7cb6a5946156c181f9be1347b2a7789b3a191a16acb2bcfc3ed1b6683d8611dc0dbc13c23ff723707d90637cb8259a7"
  13. [*] CRC32: "9FB84CD7"
  14. [*] SSDEEP: "49152:QE+ieEyZfNjOK0hvkYa9n3faV6ph7b1hzKi:tbeVZfhCvkBysZh2"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: UPX1, entropy: 7.88, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x001ca000, virtual_size: 0x001ca000"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "The executable is compressed using UPX",
  29. "Details": [
  30. {
  31. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x0029e000"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "File has been identified by 51 Antiviruses on VirusTotal as malicious",
  37. "Details": [
  38. {
  39. "MicroWorld-eScan": "Trojan.GenericKD.41206215"
  40. },
  41. {
  42. "FireEye": "Generic.mg.9a689ae99482b193"
  43. },
  44. {
  45. "CAT-QuickHeal": "Trojandownloader.Windigo"
  46. },
  47. {
  48. "McAfee": "Artemis!9A689AE99482"
  49. },
  50. {
  51. "Malwarebytes": "Trojan.Downloader"
  52. },
  53. {
  54. "VIPRE": "Trojan.Win32.Generic!BT"
  55. },
  56. {
  57. "Alibaba": "TrojanDownloader:Win32/Windigo.61623723"
  58. },
  59. {
  60. "K7GW": "Riskware ( 0040eff71 )"
  61. },
  62. {
  63. "K7AntiVirus": "Riskware ( 0040eff71 )"
  64. },
  65. {
  66. "Arcabit": "Trojan.Generic.D274C1C7"
  67. },
  68. {
  69. "Invincea": "heuristic"
  70. },
  71. {
  72. "Symantec": "Trojan.Gen.2"
  73. },
  74. {
  75. "APEX": "Malicious"
  76. },
  77. {
  78. "Avast": "Win32:Trojan-gen"
  79. },
  80. {
  81. "Kaspersky": "Trojan-Downloader.Win32.Windigo.e"
  82. },
  83. {
  84. "BitDefender": "Trojan.GenericKD.41206215"
  85. },
  86. {
  87. "NANO-Antivirus": "Trojan.Win32.Windigo.fpkqjh"
  88. },
  89. {
  90. "Paloalto": "generic.ml"
  91. },
  92. {
  93. "AegisLab": "Trojan.Win32.Windigo.4!c"
  94. },
  95. {
  96. "Tencent": "Win32.Trojan-downloader.Windigo.Hupk"
  97. },
  98. {
  99. "Ad-Aware": "Trojan.GenericKD.41206215"
  100. },
  101. {
  102. "Sophos": "Mal/Generic-S"
  103. },
  104. {
  105. "Comodo": "Malware@#vidphzoq5jg8"
  106. },
  107. {
  108. "F-Secure": "Trojan.TR/Dldr.Agent.wwdzi"
  109. },
  110. {
  111. "DrWeb": "Trojan.DownLoader28.6967"
  112. },
  113. {
  114. "TrendMicro": "TROJ_GEN.R053C0WDH19"
  115. },
  116. {
  117. "McAfee-GW-Edition": "BehavesLike.Win32.Sdbot.tc"
  118. },
  119. {
  120. "Trapmine": "suspicious.low.ml.score"
  121. },
  122. {
  123. "Emsisoft": "Trojan.GenericKD.41206215 (B)"
  124. },
  125. {
  126. "Cyren": "W32/Trojan.PXSX-0000"
  127. },
  128. {
  129. "Jiangmin": "TrojanDownloader.Windigo.a"
  130. },
  131. {
  132. "Webroot": "W32.Trojan.Gen"
  133. },
  134. {
  135. "Avira": "TR/Dldr.Agent.wwdzi"
  136. },
  137. {
  138. "Antiy-AVL": "Trojan[Downloader]/Win32.Windigo"
  139. },
  140. {
  141. "Microsoft": "Trojan:Win32/Tiggre!rfn"
  142. },
  143. {
  144. "Endgame": "malicious (moderate confidence)"
  145. },
  146. {
  147. "ZoneAlarm": "Trojan-Downloader.Win32.Windigo.e"
  148. },
  149. {
  150. "GData": "Trojan.GenericKD.41206215"
  151. },
  152. {
  153. "VBA32": "TrojanDownloader.Windigo"
  154. },
  155. {
  156. "ALYac": "Trojan.GenericKD.41206215"
  157. },
  158. {
  159. "Cylance": "Unsafe"
  160. },
  161. {
  162. "ESET-NOD32": "a variant of Win32/TrojanDownloader.Agent.EJU"
  163. },
  164. {
  165. "TrendMicro-HouseCall": "TROJ_GEN.R053C0WDH19"
  166. },
  167. {
  168. "Rising": "Downloader.Agent!8.B23 (CLOUD)"
  169. },
  170. {
  171. "Yandex": "Trojan.DL.Windigo!"
  172. },
  173. {
  174. "Ikarus": "Trojan-Downloader.Win32.Agent"
  175. },
  176. {
  177. "Fortinet": "W32/Agent.EJU!tr.dldr"
  178. },
  179. {
  180. "AVG": "Win32:Trojan-gen"
  181. },
  182. {
  183. "Cybereason": "malicious.99482b"
  184. },
  185. {
  186. "Panda": "Trj/Genetic.gen"
  187. },
  188. {
  189. "Qihoo-360": "Win32/Trojan.bcb"
  190. }
  191. ]
  192. }
  193. ]
  194.  
  195. [*] Started Service: []
  196.  
  197. [*] Executed Commands: []
  198.  
  199. [*] Mutexes: []
  200.  
  201. [*] Modified Files: []
  202.  
  203. [*] Deleted Files: []
  204.  
  205. [*] Modified Registry Keys: []
  206.  
  207. [*] Deleted Registry Keys: []
  208.  
  209. [*] DNS Communications: []
  210.  
  211. [*] Domains: []
  212.  
  213. [*] Network Communication - ICMP: []
  214.  
  215. [*] Network Communication - HTTP: []
  216.  
  217. [*] Network Communication - SMTP: []
  218.  
  219. [*] Network Communication - Hosts: []
  220.  
  221. [*] Network Communication - IRC: []
  222.  
  223. [*] Static Analysis: {
  224. "pe": {
  225. "peid_signatures": [
  226. [
  227. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  228. ]
  229. ],
  230. "imports": [
  231. {
  232. "imports": [
  233. {
  234. "name": "LoadLibraryA",
  235. "address": "0x869028"
  236. },
  237. {
  238. "name": "GetProcAddress",
  239. "address": "0x86902c"
  240. },
  241. {
  242. "name": "VirtualProtect",
  243. "address": "0x869030"
  244. },
  245. {
  246. "name": "VirtualAlloc",
  247. "address": "0x869034"
  248. },
  249. {
  250. "name": "VirtualFree",
  251. "address": "0x869038"
  252. },
  253. {
  254. "name": "ExitProcess",
  255. "address": "0x86903c"
  256. }
  257. ],
  258. "dll": "KERNEL32.DLL"
  259. }
  260. ],
  261. "digital_signers": null,
  262. "exported_dll_name": null,
  263. "actual_checksum": "0x001d1c34",
  264. "overlay": null,
  265. "imagebase": "0x00400000",
  266. "reported_checksum": "0x00000000",
  267. "icon_hash": null,
  268. "entrypoint": "0x00868df0",
  269. "timestamp": "1970-01-01 00:00:00",
  270. "osversion": "4.0",
  271. "sections": [
  272. {
  273. "name": "UPX0",
  274. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  275. "virtual_address": "0x00001000",
  276. "size_of_data": "0x00000000",
  277. "entropy": "0.00",
  278. "raw_address": "0x00000200",
  279. "virtual_size": "0x0029e000",
  280. "characteristics_raw": "0xe0000080"
  281. },
  282. {
  283. "name": "UPX1",
  284. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  285. "virtual_address": "0x0029f000",
  286. "size_of_data": "0x001ca000",
  287. "entropy": "7.88",
  288. "raw_address": "0x00000200",
  289. "virtual_size": "0x001ca000",
  290. "characteristics_raw": "0xe0000040"
  291. },
  292. {
  293. "name": "UPX2",
  294. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  295. "virtual_address": "0x00469000",
  296. "size_of_data": "0x00000200",
  297. "entropy": "1.76",
  298. "raw_address": "0x001ca200",
  299. "virtual_size": "0x00001000",
  300. "characteristics_raw": "0xc0000040"
  301. }
  302. ],
  303. "resources": [],
  304. "dirents": [
  305. {
  306. "virtual_address": "0x00000000",
  307. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  308. "size": "0x00000000"
  309. },
  310. {
  311. "virtual_address": "0x00469000",
  312. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  313. "size": "0x000000ac"
  314. },
  315. {
  316. "virtual_address": "0x00000000",
  317. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  318. "size": "0x00000000"
  319. },
  320. {
  321. "virtual_address": "0x00000000",
  322. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  323. "size": "0x00000000"
  324. },
  325. {
  326. "virtual_address": "0x00000000",
  327. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  328. "size": "0x00000000"
  329. },
  330. {
  331. "virtual_address": "0x00000000",
  332. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  333. "size": "0x00000000"
  334. },
  335. {
  336. "virtual_address": "0x00000000",
  337. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  338. "size": "0x00000000"
  339. },
  340. {
  341. "virtual_address": "0x00000000",
  342. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  343. "size": "0x00000000"
  344. },
  345. {
  346. "virtual_address": "0x00000000",
  347. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  348. "size": "0x00000000"
  349. },
  350. {
  351. "virtual_address": "0x00000000",
  352. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  353. "size": "0x00000000"
  354. },
  355. {
  356. "virtual_address": "0x00000000",
  357. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  358. "size": "0x00000000"
  359. },
  360. {
  361. "virtual_address": "0x00000000",
  362. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  363. "size": "0x00000000"
  364. },
  365. {
  366. "virtual_address": "0x00000000",
  367. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  368. "size": "0x00000000"
  369. },
  370. {
  371. "virtual_address": "0x00000000",
  372. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  373. "size": "0x00000000"
  374. },
  375. {
  376. "virtual_address": "0x00000000",
  377. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  378. "size": "0x00000000"
  379. },
  380. {
  381. "virtual_address": "0x00000000",
  382. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  383. "size": "0x00000000"
  384. }
  385. ],
  386. "exports": [],
  387. "guest_signers": {},
  388. "imphash": "e58ab46f2a279ded0846d81bf0fa21f7",
  389. "icon_fuzzy": null,
  390. "icon": null,
  391. "pdbpath": null,
  392. "imported_dll_count": 1,
  393. "versioninfo": []
  394. }
  395. }
  396.  
  397. [*] Resolved APIs: []
  398.  
  399. [*] Static Analysis: {
  400. "pe": {
  401. "peid_signatures": [
  402. [
  403. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  404. ]
  405. ],
  406. "imports": [
  407. {
  408. "imports": [
  409. {
  410. "name": "LoadLibraryA",
  411. "address": "0x869028"
  412. },
  413. {
  414. "name": "GetProcAddress",
  415. "address": "0x86902c"
  416. },
  417. {
  418. "name": "VirtualProtect",
  419. "address": "0x869030"
  420. },
  421. {
  422. "name": "VirtualAlloc",
  423. "address": "0x869034"
  424. },
  425. {
  426. "name": "VirtualFree",
  427. "address": "0x869038"
  428. },
  429. {
  430. "name": "ExitProcess",
  431. "address": "0x86903c"
  432. }
  433. ],
  434. "dll": "KERNEL32.DLL"
  435. }
  436. ],
  437. "digital_signers": null,
  438. "exported_dll_name": null,
  439. "actual_checksum": "0x001d1c34",
  440. "overlay": null,
  441. "imagebase": "0x00400000",
  442. "reported_checksum": "0x00000000",
  443. "icon_hash": null,
  444. "entrypoint": "0x00868df0",
  445. "timestamp": "1970-01-01 00:00:00",
  446. "osversion": "4.0",
  447. "sections": [
  448. {
  449. "name": "UPX0",
  450. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  451. "virtual_address": "0x00001000",
  452. "size_of_data": "0x00000000",
  453. "entropy": "0.00",
  454. "raw_address": "0x00000200",
  455. "virtual_size": "0x0029e000",
  456. "characteristics_raw": "0xe0000080"
  457. },
  458. {
  459. "name": "UPX1",
  460. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  461. "virtual_address": "0x0029f000",
  462. "size_of_data": "0x001ca000",
  463. "entropy": "7.88",
  464. "raw_address": "0x00000200",
  465. "virtual_size": "0x001ca000",
  466. "characteristics_raw": "0xe0000040"
  467. },
  468. {
  469. "name": "UPX2",
  470. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  471. "virtual_address": "0x00469000",
  472. "size_of_data": "0x00000200",
  473. "entropy": "1.76",
  474. "raw_address": "0x001ca200",
  475. "virtual_size": "0x00001000",
  476. "characteristics_raw": "0xc0000040"
  477. }
  478. ],
  479. "resources": [],
  480. "dirents": [
  481. {
  482. "virtual_address": "0x00000000",
  483. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  484. "size": "0x00000000"
  485. },
  486. {
  487. "virtual_address": "0x00469000",
  488. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  489. "size": "0x000000ac"
  490. },
  491. {
  492. "virtual_address": "0x00000000",
  493. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  494. "size": "0x00000000"
  495. },
  496. {
  497. "virtual_address": "0x00000000",
  498. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  499. "size": "0x00000000"
  500. },
  501. {
  502. "virtual_address": "0x00000000",
  503. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  504. "size": "0x00000000"
  505. },
  506. {
  507. "virtual_address": "0x00000000",
  508. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  509. "size": "0x00000000"
  510. },
  511. {
  512. "virtual_address": "0x00000000",
  513. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  514. "size": "0x00000000"
  515. },
  516. {
  517. "virtual_address": "0x00000000",
  518. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  519. "size": "0x00000000"
  520. },
  521. {
  522. "virtual_address": "0x00000000",
  523. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  524. "size": "0x00000000"
  525. },
  526. {
  527. "virtual_address": "0x00000000",
  528. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  529. "size": "0x00000000"
  530. },
  531. {
  532. "virtual_address": "0x00000000",
  533. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  534. "size": "0x00000000"
  535. },
  536. {
  537. "virtual_address": "0x00000000",
  538. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  539. "size": "0x00000000"
  540. },
  541. {
  542. "virtual_address": "0x00000000",
  543. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  544. "size": "0x00000000"
  545. },
  546. {
  547. "virtual_address": "0x00000000",
  548. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  549. "size": "0x00000000"
  550. },
  551. {
  552. "virtual_address": "0x00000000",
  553. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  554. "size": "0x00000000"
  555. },
  556. {
  557. "virtual_address": "0x00000000",
  558. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  559. "size": "0x00000000"
  560. }
  561. ],
  562. "exports": [],
  563. "guest_signers": {},
  564. "imphash": "e58ab46f2a279ded0846d81bf0fa21f7",
  565. "icon_fuzzy": null,
  566. "icon": null,
  567. "pdbpath": null,
  568. "imported_dll_count": 1,
  569. "versioninfo": []
  570. }
  571. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!