API tools faq
paste
paladin316

Formbook_8a7e582e85cb994d6f0d728cf8de1a95_exe_2019-06-28_19_30.json

paladin316
Jun 28th, 2019
2,242
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 18.75 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Noon"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Formbook_8a7e582e85cb994d6f0d728cf8de1a95.exe"
  7. [*] File Size: 406016
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "5b3e128e3d2f94bf536d156207f1c0758dd0ae178496be9e5c82db419bf138e2"
  10. [*] MD5: "8a7e582e85cb994d6f0d728cf8de1a95"
  11. [*] SHA1: "551b6792a7651524790411bdc36211b273bcf6fa"
  12. [*] SHA512: "baff739c3f1213f72d7b64291795156d1ad9fdc9fe8ddb28c244262b6ad2a46af8b1d2786195be6d9aced2f8da256c1190bc02d37689d8d3b8f2640ca97d88f0"
  13. [*] CRC32: "7DA270AD"
  14. [*] SSDEEP: "6144:lzjEOTisysc2NZCCKu6GeJ/DLzhUa6g0OjWctCF/ykEnIfOSzd4X6V5Ql1:l+syPiZCCKfJLnhfNNegeOod4XAQ"
  15.  
  16. [*] Process Execution: [
  17. "Formbook_8a7e582e85cb994d6f0d728cf8de1a95.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: <D\\x08NHId5, entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0005b400, virtual_size: 0x0005b234"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "File has been identified by 56 Antiviruses on VirusTotal as malicious",
  31. "Details": [
  32. {
  33. "MicroWorld-eScan": "Gen:Variant.Razy.514109"
  34. },
  35. {
  36. "FireEye": "Generic.mg.8a7e582e85cb994d"
  37. },
  38. {
  39. "CAT-QuickHeal": "Trojan.Fuery"
  40. },
  41. {
  42. "Qihoo-360": "Win32/Trojan.Spy.beb"
  43. },
  44. {
  45. "McAfee": "RDN/Generic.grp"
  46. },
  47. {
  48. "Cylance": "Unsafe"
  49. },
  50. {
  51. "Zillya": "Trojan.Noon.Win32.8417"
  52. },
  53. {
  54. "AegisLab": "Trojan.MSIL.Noon.4!c"
  55. },
  56. {
  57. "K7AntiVirus": "Trojan ( 0053b0851 )"
  58. },
  59. {
  60. "Alibaba": "Trojan:Win32/Malmail.ali1000112"
  61. },
  62. {
  63. "K7GW": "Trojan ( 0053b0851 )"
  64. },
  65. {
  66. "Cybereason": "malicious.e85cb9"
  67. },
  68. {
  69. "Arcabit": "Trojan.Razy.D7D83D"
  70. },
  71. {
  72. "TrendMicro": "Trojan.MSIL.BOILOD.SM4.hp"
  73. },
  74. {
  75. "F-Prot": "W32/MSIL_Kryptik.GZ.gen!Eldorado"
  76. },
  77. {
  78. "Symantec": "ML.Attribute.HighConfidence"
  79. },
  80. {
  81. "APEX": "Malicious"
  82. },
  83. {
  84. "Paloalto": "generic.ml"
  85. },
  86. {
  87. "Kaspersky": "HEUR:Trojan-Spy.MSIL.Noon.gen"
  88. },
  89. {
  90. "BitDefender": "Gen:Variant.Razy.514109"
  91. },
  92. {
  93. "NANO-Antivirus": "Trojan.Win32.Noon.fqlnwc"
  94. },
  95. {
  96. "Ad-Aware": "Gen:Variant.Razy.514109"
  97. },
  98. {
  99. "Sophos": "Mal/Generic-S"
  100. },
  101. {
  102. "F-Secure": "Trojan.TR/AD.Swotter.gwore"
  103. },
  104. {
  105. "DrWeb": "Trojan.PWS.Banker1.31609"
  106. },
  107. {
  108. "VIPRE": "Trojan.Win32.Generic!BT"
  109. },
  110. {
  111. "Invincea": "heuristic"
  112. },
  113. {
  114. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  115. },
  116. {
  117. "Trapmine": "malicious.moderate.ml.score"
  118. },
  119. {
  120. "Emsisoft": "Gen:Variant.Razy.514109 (B)"
  121. },
  122. {
  123. "Ikarus": "Trojan.MSIL.Crypt"
  124. },
  125. {
  126. "Cyren": "W32/MSIL_Kryptik.GZ.gen!Eldorado"
  127. },
  128. {
  129. "Webroot": "W32.Trojan.Gen"
  130. },
  131. {
  132. "Avira": "TR/AD.Swotter.gwore"
  133. },
  134. {
  135. "MAX": "malware (ai score=99)"
  136. },
  137. {
  138. "Antiy-AVL": "Trojan[Spy]/MSIL.Noon"
  139. },
  140. {
  141. "Microsoft": "Trojan:Win32/Occamy.C"
  142. },
  143. {
  144. "Endgame": "malicious (high confidence)"
  145. },
  146. {
  147. "ZoneAlarm": "HEUR:Trojan-Spy.MSIL.Noon.gen"
  148. },
  149. {
  150. "GData": "Gen:Variant.Razy.514109"
  151. },
  152. {
  153. "AhnLab-V3": "Trojan/Win32.Occamy.C3263271"
  154. },
  155. {
  156. "Acronis": "suspicious"
  157. },
  158. {
  159. "VBA32": "TrojanSpy.MSIL.Noon"
  160. },
  161. {
  162. "ALYac": "Gen:Variant.Razy.514109"
  163. },
  164. {
  165. "Malwarebytes": "Trojan.PCrypt.MSIL"
  166. },
  167. {
  168. "Panda": "Trj/Genetic.gen"
  169. },
  170. {
  171. "ESET-NOD32": "a variant of MSIL/Kryptik.RKA"
  172. },
  173. {
  174. "TrendMicro-HouseCall": "Trojan.MSIL.BOILOD.SM4.hp"
  175. },
  176. {
  177. "Tencent": "Win32.Trojan.Inject.Auto"
  178. },
  179. {
  180. "Yandex": "Trojan.Kryptik!UHFGtnM8eOk"
  181. },
  182. {
  183. "SentinelOne": "DFI - Suspicious PE"
  184. },
  185. {
  186. "Fortinet": "MSIL/Kryptik.QVF!tr"
  187. },
  188. {
  189. "AVG": "Win32:Trojan-gen"
  190. },
  191. {
  192. "Avast": "Win32:Trojan-gen"
  193. },
  194. {
  195. "CrowdStrike": "win/malicious_confidence_100% (W)"
  196. },
  197. {
  198. "MaxSecure": "Trojan.Malware.73691310.susgen"
  199. }
  200. ]
  201. },
  202. {
  203. "Description": "Anomalous binary characteristics",
  204. "Details": [
  205. {
  206. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  207. },
  208. {
  209. "anomaly": "Unprintable characters found in section name"
  210. }
  211. ]
  212. }
  213. ]
  214.  
  215. [*] Started Service: []
  216.  
  217. [*] Executed Commands: []
  218.  
  219. [*] Mutexes: []
  220.  
  221. [*] Modified Files: []
  222.  
  223. [*] Deleted Files: []
  224.  
  225. [*] Modified Registry Keys: []
  226.  
  227. [*] Deleted Registry Keys: []
  228.  
  229. [*] DNS Communications: []
  230.  
  231. [*] Domains: []
  232.  
  233. [*] Network Communication - ICMP: []
  234.  
  235. [*] Network Communication - HTTP: []
  236.  
  237. [*] Network Communication - SMTP: []
  238.  
  239. [*] Network Communication - Hosts: []
  240.  
  241. [*] Network Communication - IRC: []
  242.  
  243. [*] Static Analysis: {
  244. "dotnet": {
  245. "customattrs": [],
  246. "assemblyinfo": {},
  247. "assemblyrefs": [],
  248. "typerefs": []
  249. },
  250. "pe": {
  251. "peid_signatures": null,
  252. "imports": [
  253. {
  254. "imports": [
  255. {
  256. "name": "_CorExeMain",
  257. "address": "0x46a000"
  258. }
  259. ],
  260. "dll": "mscoree.dll"
  261. }
  262. ],
  263. "digital_signers": null,
  264. "exported_dll_name": null,
  265. "actual_checksum": "0x0006c952",
  266. "overlay": null,
  267. "imagebase": "0x00400000",
  268. "reported_checksum": "0x00000000",
  269. "icon_hash": null,
  270. "entrypoint": "0x0046a00a",
  271. "timestamp": "1982-09-16 06:03:52",
  272. "osversion": "4.0",
  273. "sections": [
  274. {
  275. "name": "<D\\x08NHId5",
  276. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  277. "virtual_address": "0x00002000",
  278. "size_of_data": "0x0005b400",
  279. "entropy": "8.00",
  280. "raw_address": "0x00000400",
  281. "virtual_size": "0x0005b234",
  282. "characteristics_raw": "0xe0000040"
  283. },
  284. {
  285. "name": ".text",
  286. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  287. "virtual_address": "0x0005e000",
  288. "size_of_data": "0x00007000",
  289. "entropy": "6.43",
  290. "raw_address": "0x0005b800",
  291. "virtual_size": "0x00006fd0",
  292. "characteristics_raw": "0x60000020"
  293. },
  294. {
  295. "name": ".rsrc",
  296. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  297. "virtual_address": "0x00066000",
  298. "size_of_data": "0x00000600",
  299. "entropy": "4.29",
  300. "raw_address": "0x00062800",
  301. "virtual_size": "0x000005e8",
  302. "characteristics_raw": "0x40000040"
  303. },
  304. {
  305. "name": ".reloc",
  306. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  307. "virtual_address": "0x00068000",
  308. "size_of_data": "0x00000200",
  309. "entropy": "0.10",
  310. "raw_address": "0x00062e00",
  311. "virtual_size": "0x0000000c",
  312. "characteristics_raw": "0x42000040"
  313. },
  314. {
  315. "name": "",
  316. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  317. "virtual_address": "0x0006a000",
  318. "size_of_data": "0x00000200",
  319. "entropy": "0.14",
  320. "raw_address": "0x00063000",
  321. "virtual_size": "0x00000010",
  322. "characteristics_raw": "0x60000020"
  323. }
  324. ],
  325. "resources": [],
  326. "dirents": [
  327. {
  328. "virtual_address": "0x00000000",
  329. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  330. "size": "0x00000000"
  331. },
  332. {
  333. "virtual_address": "0x0005e66c",
  334. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  335. "size": "0x0000004f"
  336. },
  337. {
  338. "virtual_address": "0x00066000",
  339. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  340. "size": "0x000005e8"
  341. },
  342. {
  343. "virtual_address": "0x00000000",
  344. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  345. "size": "0x00000000"
  346. },
  347. {
  348. "virtual_address": "0x00000000",
  349. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  350. "size": "0x00000000"
  351. },
  352. {
  353. "virtual_address": "0x00068000",
  354. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  355. "size": "0x0000000c"
  356. },
  357. {
  358. "virtual_address": "0x00000000",
  359. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  360. "size": "0x00000000"
  361. },
  362. {
  363. "virtual_address": "0x00000000",
  364. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  365. "size": "0x00000000"
  366. },
  367. {
  368. "virtual_address": "0x00000000",
  369. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  370. "size": "0x00000000"
  371. },
  372. {
  373. "virtual_address": "0x00000000",
  374. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  375. "size": "0x00000000"
  376. },
  377. {
  378. "virtual_address": "0x00000000",
  379. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  380. "size": "0x00000000"
  381. },
  382. {
  383. "virtual_address": "0x00000000",
  384. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  385. "size": "0x00000000"
  386. },
  387. {
  388. "virtual_address": "0x0006a000",
  389. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  390. "size": "0x00000008"
  391. },
  392. {
  393. "virtual_address": "0x00000000",
  394. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  395. "size": "0x00000000"
  396. },
  397. {
  398. "virtual_address": "0x0005e000",
  399. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  400. "size": "0x00000048"
  401. },
  402. {
  403. "virtual_address": "0x00000000",
  404. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  405. "size": "0x00000000"
  406. }
  407. ],
  408. "exports": [],
  409. "guest_signers": {},
  410. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  411. "icon_fuzzy": null,
  412. "icon": null,
  413. "pdbpath": null,
  414. "imported_dll_count": 1,
  415. "versioninfo": []
  416. }
  417. }
  418.  
  419. [*] Resolved APIs: [
  420. "advapi32.dll.RegOpenKeyExW",
  421. "advapi32.dll.RegQueryInfoKeyW",
  422. "advapi32.dll.RegEnumKeyExW",
  423. "advapi32.dll.RegEnumValueW",
  424. "advapi32.dll.RegCloseKey",
  425. "advapi32.dll.RegQueryValueExW",
  426. "kernel32.dll.QueryActCtxW",
  427. "shlwapi.dll.UrlIsW"
  428. ]
  429.  
  430. [*] Static Analysis: {
  431. "dotnet": {
  432. "customattrs": [],
  433. "assemblyinfo": {},
  434. "assemblyrefs": [],
  435. "typerefs": []
  436. },
  437. "pe": {
  438. "peid_signatures": null,
  439. "imports": [
  440. {
  441. "imports": [
  442. {
  443. "name": "_CorExeMain",
  444. "address": "0x46a000"
  445. }
  446. ],
  447. "dll": "mscoree.dll"
  448. }
  449. ],
  450. "digital_signers": null,
  451. "exported_dll_name": null,
  452. "actual_checksum": "0x0006c952",
  453. "overlay": null,
  454. "imagebase": "0x00400000",
  455. "reported_checksum": "0x00000000",
  456. "icon_hash": null,
  457. "entrypoint": "0x0046a00a",
  458. "timestamp": "1982-09-16 06:03:52",
  459. "osversion": "4.0",
  460. "sections": [
  461. {
  462. "name": "<D\\x08NHId5",
  463. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  464. "virtual_address": "0x00002000",
  465. "size_of_data": "0x0005b400",
  466. "entropy": "8.00",
  467. "raw_address": "0x00000400",
  468. "virtual_size": "0x0005b234",
  469. "characteristics_raw": "0xe0000040"
  470. },
  471. {
  472. "name": ".text",
  473. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  474. "virtual_address": "0x0005e000",
  475. "size_of_data": "0x00007000",
  476. "entropy": "6.43",
  477. "raw_address": "0x0005b800",
  478. "virtual_size": "0x00006fd0",
  479. "characteristics_raw": "0x60000020"
  480. },
  481. {
  482. "name": ".rsrc",
  483. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  484. "virtual_address": "0x00066000",
  485. "size_of_data": "0x00000600",
  486. "entropy": "4.29",
  487. "raw_address": "0x00062800",
  488. "virtual_size": "0x000005e8",
  489. "characteristics_raw": "0x40000040"
  490. },
  491. {
  492. "name": ".reloc",
  493. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  494. "virtual_address": "0x00068000",
  495. "size_of_data": "0x00000200",
  496. "entropy": "0.10",
  497. "raw_address": "0x00062e00",
  498. "virtual_size": "0x0000000c",
  499. "characteristics_raw": "0x42000040"
  500. },
  501. {
  502. "name": "",
  503. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  504. "virtual_address": "0x0006a000",
  505. "size_of_data": "0x00000200",
  506. "entropy": "0.14",
  507. "raw_address": "0x00063000",
  508. "virtual_size": "0x00000010",
  509. "characteristics_raw": "0x60000020"
  510. }
  511. ],
  512. "resources": [],
  513. "dirents": [
  514. {
  515. "virtual_address": "0x00000000",
  516. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  517. "size": "0x00000000"
  518. },
  519. {
  520. "virtual_address": "0x0005e66c",
  521. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  522. "size": "0x0000004f"
  523. },
  524. {
  525. "virtual_address": "0x00066000",
  526. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  527. "size": "0x000005e8"
  528. },
  529. {
  530. "virtual_address": "0x00000000",
  531. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  532. "size": "0x00000000"
  533. },
  534. {
  535. "virtual_address": "0x00000000",
  536. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  537. "size": "0x00000000"
  538. },
  539. {
  540. "virtual_address": "0x00068000",
  541. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  542. "size": "0x0000000c"
  543. },
  544. {
  545. "virtual_address": "0x00000000",
  546. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  547. "size": "0x00000000"
  548. },
  549. {
  550. "virtual_address": "0x00000000",
  551. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  552. "size": "0x00000000"
  553. },
  554. {
  555. "virtual_address": "0x00000000",
  556. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  557. "size": "0x00000000"
  558. },
  559. {
  560. "virtual_address": "0x00000000",
  561. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  562. "size": "0x00000000"
  563. },
  564. {
  565. "virtual_address": "0x00000000",
  566. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  567. "size": "0x00000000"
  568. },
  569. {
  570. "virtual_address": "0x00000000",
  571. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  572. "size": "0x00000000"
  573. },
  574. {
  575. "virtual_address": "0x0006a000",
  576. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  577. "size": "0x00000008"
  578. },
  579. {
  580. "virtual_address": "0x00000000",
  581. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  582. "size": "0x00000000"
  583. },
  584. {
  585. "virtual_address": "0x0005e000",
  586. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  587. "size": "0x00000048"
  588. },
  589. {
  590. "virtual_address": "0x00000000",
  591. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  592. "size": "0x00000000"
  593. }
  594. ],
  595. "exports": [],
  596. "guest_signers": {},
  597. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  598. "icon_fuzzy": null,
  599. "icon": null,
  600. "pdbpath": null,
  601. "imported_dll_count": 1,
  602. "versioninfo": []
  603. }
  604. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!