API tools faq
paste
paladin316

Exes_a9602a5006474edb62e4b7a5f38cbf45_exe_2019-06-28_01_30.json

paladin316
Jun 27th, 2019
2,270
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 19.87 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_a9602a5006474edb62e4b7a5f38cbf45.exe"
  7. [*] File Size: 1944576
  8. [*] File Type: "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
  9. [*] SHA256: "eaa361880e9d8e0609cb9e5dce4ad969f6c77737e3c78d9dd714bebc17af0a4d"
  10. [*] MD5: "a9602a5006474edb62e4b7a5f38cbf45"
  11. [*] SHA1: "49b7a7484c716ac86421602641bbab7b66a56d52"
  12. [*] SHA512: "2276c9e8363a4e777b3e9c32caab9b48baa5cb9c6ad8063901bc78b83f8049d4b72576dcca9859a05570d6183b23df7a262d115dcd1653ab580fd17b754517b8"
  13. [*] CRC32: "B5C115AA"
  14. [*] SSDEEP: "49152:p3z0Tne7vO54eT3GngNFE3ON6oAJPkRssnOWcb:p3z0B5Uni6ONMPnsG"
  15.  
  16. [*] Process Execution: [
  17. "Exes_a9602a5006474edb62e4b7a5f38cbf45.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "Exes_a9602a5006474edb62e4b7a5f38cbf45.exe, PID 1812"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "The binary likely contains encrypted or compressed data.",
  31. "Details": [
  32. {
  33. "section": "name: UPX1, entropy: 7.88, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x001da800, virtual_size: 0x001db000"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "The executable is compressed using UPX",
  39. "Details": [
  40. {
  41. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x002b8000"
  42. }
  43. ]
  44. },
  45. {
  46. "Description": "File has been identified by 37 Antiviruses on VirusTotal as malicious",
  47. "Details": [
  48. {
  49. "MicroWorld-eScan": "Trojan.GenericKD.32053495"
  50. },
  51. {
  52. "FireEye": "Trojan.GenericKD.32053495"
  53. },
  54. {
  55. "CAT-QuickHeal": "Trojan.Fuery"
  56. },
  57. {
  58. "McAfee": "Artemis!A9602A500647"
  59. },
  60. {
  61. "Cylance": "Unsafe"
  62. },
  63. {
  64. "K7GW": "Riskware ( 0040eff71 )"
  65. },
  66. {
  67. "K7AntiVirus": "Riskware ( 0040eff71 )"
  68. },
  69. {
  70. "Arcabit": "Trojan.Generic.D1E918F7"
  71. },
  72. {
  73. "TrendMicro": "TROJ_FRS.0NZ900EU19"
  74. },
  75. {
  76. "Symantec": "Trojan.Gen.MBT"
  77. },
  78. {
  79. "Avast": "Win32:Malware-gen"
  80. },
  81. {
  82. "BitDefender": "Trojan.GenericKD.32053495"
  83. },
  84. {
  85. "Paloalto": "generic.ml"
  86. },
  87. {
  88. "AegisLab": "Trojan.Win32.Graftor.4!c"
  89. },
  90. {
  91. "Endgame": "malicious (moderate confidence)"
  92. },
  93. {
  94. "Emsisoft": "Trojan.GenericKD.32053495 (B)"
  95. },
  96. {
  97. "VIPRE": "Trojan.Win32.Generic!BT"
  98. },
  99. {
  100. "McAfee-GW-Edition": "BehavesLike.Win32.Trojan.tc"
  101. },
  102. {
  103. "Trapmine": "suspicious.low.ml.score"
  104. },
  105. {
  106. "Sophos": "Mal/Generic-S"
  107. },
  108. {
  109. "Cyren": "W32/Trojan.ACBA-2452"
  110. },
  111. {
  112. "Jiangmin": "TrojanDownloader.Windigo.a"
  113. },
  114. {
  115. "Webroot": "W32.Trojan.Gen"
  116. },
  117. {
  118. "Antiy-AVL": "Trojan[Downloader]/Win32.Windigo"
  119. },
  120. {
  121. "Microsoft": "Trojan:Win32/Occamy.C"
  122. },
  123. {
  124. "ViRobot": "Trojan.Win32.Z.Graftor.1944576"
  125. },
  126. {
  127. "GData": "Trojan.GenericKD.32053495"
  128. },
  129. {
  130. "AhnLab-V3": "Trojan/Win32.CoinMiner.C3267335"
  131. },
  132. {
  133. "ALYac": "Trojan.GenericKD.32053495"
  134. },
  135. {
  136. "Ad-Aware": "Trojan.GenericKD.32053495"
  137. },
  138. {
  139. "Malwarebytes": "Trojan.Crypt"
  140. },
  141. {
  142. "TrendMicro-HouseCall": "TROJ_FRS.0NZ900EU19"
  143. },
  144. {
  145. "Rising": "Trojan.Fuery!8.EAFB (CLOUD)"
  146. },
  147. {
  148. "Fortinet": "W32/FRS.0NZ900EU19!tr"
  149. },
  150. {
  151. "AVG": "Win32:Malware-gen"
  152. },
  153. {
  154. "Panda": "Trj/Genetic.gen"
  155. },
  156. {
  157. "Qihoo-360": "Trojan.Generic"
  158. }
  159. ]
  160. }
  161. ]
  162.  
  163. [*] Started Service: []
  164.  
  165. [*] Executed Commands: []
  166.  
  167. [*] Mutexes: []
  168.  
  169. [*] Modified Files: []
  170.  
  171. [*] Deleted Files: []
  172.  
  173. [*] Modified Registry Keys: []
  174.  
  175. [*] Deleted Registry Keys: []
  176.  
  177. [*] DNS Communications: []
  178.  
  179. [*] Domains: []
  180.  
  181. [*] Network Communication - ICMP: []
  182.  
  183. [*] Network Communication - HTTP: []
  184.  
  185. [*] Network Communication - SMTP: []
  186.  
  187. [*] Network Communication - Hosts: []
  188.  
  189. [*] Network Communication - IRC: []
  190.  
  191. [*] Static Analysis: {
  192. "pe": {
  193. "peid_signatures": [
  194. [
  195. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  196. ]
  197. ],
  198. "imports": [
  199. {
  200. "imports": [
  201. {
  202. "name": "LoadLibraryA",
  203. "address": "0x894028"
  204. },
  205. {
  206. "name": "GetProcAddress",
  207. "address": "0x89402c"
  208. },
  209. {
  210. "name": "VirtualProtect",
  211. "address": "0x894030"
  212. },
  213. {
  214. "name": "VirtualAlloc",
  215. "address": "0x894034"
  216. },
  217. {
  218. "name": "VirtualFree",
  219. "address": "0x894038"
  220. },
  221. {
  222. "name": "ExitProcess",
  223. "address": "0x89403c"
  224. }
  225. ],
  226. "dll": "KERNEL32.DLL"
  227. }
  228. ],
  229. "digital_signers": null,
  230. "exported_dll_name": null,
  231. "actual_checksum": "0x001dfad0",
  232. "overlay": null,
  233. "imagebase": "0x00400000",
  234. "reported_checksum": "0x00000000",
  235. "icon_hash": null,
  236. "entrypoint": "0x00893510",
  237. "timestamp": "1970-01-01 00:00:00",
  238. "osversion": "4.0",
  239. "sections": [
  240. {
  241. "name": "UPX0",
  242. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  243. "virtual_address": "0x00001000",
  244. "size_of_data": "0x00000000",
  245. "entropy": "0.00",
  246. "raw_address": "0x00000200",
  247. "virtual_size": "0x002b8000",
  248. "characteristics_raw": "0xe0000080"
  249. },
  250. {
  251. "name": "UPX1",
  252. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  253. "virtual_address": "0x002b9000",
  254. "size_of_data": "0x001da800",
  255. "entropy": "7.88",
  256. "raw_address": "0x00000200",
  257. "virtual_size": "0x001db000",
  258. "characteristics_raw": "0xe0000040"
  259. },
  260. {
  261. "name": "UPX2",
  262. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  263. "virtual_address": "0x00494000",
  264. "size_of_data": "0x00000200",
  265. "entropy": "1.77",
  266. "raw_address": "0x001daa00",
  267. "virtual_size": "0x00001000",
  268. "characteristics_raw": "0xc0000040"
  269. }
  270. ],
  271. "resources": [],
  272. "dirents": [
  273. {
  274. "virtual_address": "0x00000000",
  275. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  276. "size": "0x00000000"
  277. },
  278. {
  279. "virtual_address": "0x00494000",
  280. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  281. "size": "0x000000ac"
  282. },
  283. {
  284. "virtual_address": "0x00000000",
  285. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  286. "size": "0x00000000"
  287. },
  288. {
  289. "virtual_address": "0x00000000",
  290. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  291. "size": "0x00000000"
  292. },
  293. {
  294. "virtual_address": "0x00000000",
  295. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  296. "size": "0x00000000"
  297. },
  298. {
  299. "virtual_address": "0x00000000",
  300. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  301. "size": "0x00000000"
  302. },
  303. {
  304. "virtual_address": "0x00000000",
  305. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  306. "size": "0x00000000"
  307. },
  308. {
  309. "virtual_address": "0x00000000",
  310. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  311. "size": "0x00000000"
  312. },
  313. {
  314. "virtual_address": "0x00000000",
  315. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  316. "size": "0x00000000"
  317. },
  318. {
  319. "virtual_address": "0x00000000",
  320. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  321. "size": "0x00000000"
  322. },
  323. {
  324. "virtual_address": "0x00000000",
  325. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  326. "size": "0x00000000"
  327. },
  328. {
  329. "virtual_address": "0x00000000",
  330. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  331. "size": "0x00000000"
  332. },
  333. {
  334. "virtual_address": "0x00000000",
  335. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  336. "size": "0x00000000"
  337. },
  338. {
  339. "virtual_address": "0x00000000",
  340. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  341. "size": "0x00000000"
  342. },
  343. {
  344. "virtual_address": "0x00000000",
  345. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  346. "size": "0x00000000"
  347. },
  348. {
  349. "virtual_address": "0x00000000",
  350. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  351. "size": "0x00000000"
  352. }
  353. ],
  354. "exports": [],
  355. "guest_signers": {},
  356. "imphash": "e58ab46f2a279ded0846d81bf0fa21f7",
  357. "icon_fuzzy": null,
  358. "icon": null,
  359. "pdbpath": null,
  360. "imported_dll_count": 1,
  361. "versioninfo": []
  362. }
  363. }
  364.  
  365. [*] Resolved APIs: [
  366. "kernel32.dll.WriteFile",
  367. "kernel32.dll.WriteConsoleW",
  368. "kernel32.dll.WaitForSingleObject",
  369. "kernel32.dll.VirtualQuery",
  370. "kernel32.dll.VirtualFree",
  371. "kernel32.dll.VirtualAlloc",
  372. "kernel32.dll.SwitchToThread",
  373. "kernel32.dll.SetWaitableTimer",
  374. "kernel32.dll.SetUnhandledExceptionFilter",
  375. "kernel32.dll.SetProcessPriorityBoost",
  376. "kernel32.dll.SetEvent",
  377. "kernel32.dll.SetErrorMode",
  378. "kernel32.dll.SetConsoleCtrlHandler",
  379. "kernel32.dll.LoadLibraryA",
  380. "kernel32.dll.LoadLibraryW",
  381. "kernel32.dll.GetSystemInfo",
  382. "kernel32.dll.GetSystemDirectoryA",
  383. "kernel32.dll.GetStdHandle",
  384. "kernel32.dll.GetQueuedCompletionStatus",
  385. "kernel32.dll.GetProcessAffinityMask",
  386. "kernel32.dll.GetProcAddress",
  387. "kernel32.dll.GetEnvironmentStringsW",
  388. "kernel32.dll.GetConsoleMode",
  389. "kernel32.dll.FreeEnvironmentStringsW",
  390. "kernel32.dll.ExitProcess",
  391. "kernel32.dll.DuplicateHandle",
  392. "kernel32.dll.CreateThread",
  393. "kernel32.dll.CreateIoCompletionPort",
  394. "kernel32.dll.CreateEventA",
  395. "kernel32.dll.CloseHandle",
  396. "kernel32.dll.AddVectoredExceptionHandler",
  397. "kernel32.dll.AddVectoredContinueHandler",
  398. "kernel32.dll.GetQueuedCompletionStatusEx",
  399. "kernel32.dll.LoadLibraryExA",
  400. "kernel32.dll.LoadLibraryExW",
  401. "advapi32.dll.SystemFunction036",
  402. "ntdll.dll.NtWaitForSingleObject",
  403. "winmm.dll.timeBeginPeriod",
  404. "winmm.dll.timeEndPeriod",
  405. "ws2_32.dll.WSAGetOverlappedResult",
  406. "cryptbase.dll.SystemFunction001",
  407. "cryptbase.dll.SystemFunction002",
  408. "cryptbase.dll.SystemFunction003",
  409. "cryptbase.dll.SystemFunction004",
  410. "cryptbase.dll.SystemFunction005",
  411. "cryptbase.dll.SystemFunction028",
  412. "cryptbase.dll.SystemFunction029",
  413. "cryptbase.dll.SystemFunction034",
  414. "cryptbase.dll.SystemFunction036",
  415. "cryptbase.dll.SystemFunction040",
  416. "cryptbase.dll.SystemFunction041",
  417. "kernel32.dll.SetHandleInformation",
  418. "kernel32.dll.GetSystemDirectoryW",
  419. "ws2_32.dll.WSAStartup",
  420. "kernel32.dll.CancelIoEx",
  421. "kernel32.dll.SetFileCompletionNotificationModes",
  422. "ws2_32.dll.WSAEnumProtocolsW",
  423. "kernel32.dll.GetCommandLineW",
  424. "kernel32.dll.GetEnvironmentVariableW",
  425. "kernel32.dll.WTSGetActiveConsoleSessionId",
  426. "kernel32.dll.FormatMessageW",
  427. "wtsapi32.dll.WTSQuerySessionInformationW",
  428. "winsta.dll.WinStationQueryInformationW",
  429. "advapi32.dll.LookupAccountSidW",
  430. "sechost.dll.LookupAccountSidLocalW",
  431. "advapi32.dll.CreateWellKnownSid",
  432. "rpcrt4.dll.RpcStringBindingComposeW",
  433. "rpcrt4.dll.RpcBindingFromStringBindingW",
  434. "rpcrt4.dll.RpcStringFreeW",
  435. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  436. "sechost.dll.LookupAccountNameLocalW",
  437. "rpcrt4.dll.NdrClientCall2",
  438. "rpcrt4.dll.I_RpcExceptionFilter",
  439. "rpcrt4.dll.RpcBindingFree",
  440. "advapi32.dll.LookupAccountNameW",
  441. "advapi32.dll.ConvertSidToStringSidW",
  442. "kernel32.dll.LocalFree",
  443. "advapi32.dll.RegOpenKeyExW",
  444. "kernel32.dll.GetTimeZoneInformation"
  445. ]
  446.  
  447. [*] Static Analysis: {
  448. "pe": {
  449. "peid_signatures": [
  450. [
  451. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  452. ]
  453. ],
  454. "imports": [
  455. {
  456. "imports": [
  457. {
  458. "name": "LoadLibraryA",
  459. "address": "0x894028"
  460. },
  461. {
  462. "name": "GetProcAddress",
  463. "address": "0x89402c"
  464. },
  465. {
  466. "name": "VirtualProtect",
  467. "address": "0x894030"
  468. },
  469. {
  470. "name": "VirtualAlloc",
  471. "address": "0x894034"
  472. },
  473. {
  474. "name": "VirtualFree",
  475. "address": "0x894038"
  476. },
  477. {
  478. "name": "ExitProcess",
  479. "address": "0x89403c"
  480. }
  481. ],
  482. "dll": "KERNEL32.DLL"
  483. }
  484. ],
  485. "digital_signers": null,
  486. "exported_dll_name": null,
  487. "actual_checksum": "0x001dfad0",
  488. "overlay": null,
  489. "imagebase": "0x00400000",
  490. "reported_checksum": "0x00000000",
  491. "icon_hash": null,
  492. "entrypoint": "0x00893510",
  493. "timestamp": "1970-01-01 00:00:00",
  494. "osversion": "4.0",
  495. "sections": [
  496. {
  497. "name": "UPX0",
  498. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  499. "virtual_address": "0x00001000",
  500. "size_of_data": "0x00000000",
  501. "entropy": "0.00",
  502. "raw_address": "0x00000200",
  503. "virtual_size": "0x002b8000",
  504. "characteristics_raw": "0xe0000080"
  505. },
  506. {
  507. "name": "UPX1",
  508. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  509. "virtual_address": "0x002b9000",
  510. "size_of_data": "0x001da800",
  511. "entropy": "7.88",
  512. "raw_address": "0x00000200",
  513. "virtual_size": "0x001db000",
  514. "characteristics_raw": "0xe0000040"
  515. },
  516. {
  517. "name": "UPX2",
  518. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  519. "virtual_address": "0x00494000",
  520. "size_of_data": "0x00000200",
  521. "entropy": "1.77",
  522. "raw_address": "0x001daa00",
  523. "virtual_size": "0x00001000",
  524. "characteristics_raw": "0xc0000040"
  525. }
  526. ],
  527. "resources": [],
  528. "dirents": [
  529. {
  530. "virtual_address": "0x00000000",
  531. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  532. "size": "0x00000000"
  533. },
  534. {
  535. "virtual_address": "0x00494000",
  536. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  537. "size": "0x000000ac"
  538. },
  539. {
  540. "virtual_address": "0x00000000",
  541. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  542. "size": "0x00000000"
  543. },
  544. {
  545. "virtual_address": "0x00000000",
  546. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  547. "size": "0x00000000"
  548. },
  549. {
  550. "virtual_address": "0x00000000",
  551. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  552. "size": "0x00000000"
  553. },
  554. {
  555. "virtual_address": "0x00000000",
  556. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  557. "size": "0x00000000"
  558. },
  559. {
  560. "virtual_address": "0x00000000",
  561. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  562. "size": "0x00000000"
  563. },
  564. {
  565. "virtual_address": "0x00000000",
  566. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  567. "size": "0x00000000"
  568. },
  569. {
  570. "virtual_address": "0x00000000",
  571. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  572. "size": "0x00000000"
  573. },
  574. {
  575. "virtual_address": "0x00000000",
  576. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  577. "size": "0x00000000"
  578. },
  579. {
  580. "virtual_address": "0x00000000",
  581. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  582. "size": "0x00000000"
  583. },
  584. {
  585. "virtual_address": "0x00000000",
  586. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  587. "size": "0x00000000"
  588. },
  589. {
  590. "virtual_address": "0x00000000",
  591. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  592. "size": "0x00000000"
  593. },
  594. {
  595. "virtual_address": "0x00000000",
  596. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  597. "size": "0x00000000"
  598. },
  599. {
  600. "virtual_address": "0x00000000",
  601. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  602. "size": "0x00000000"
  603. },
  604. {
  605. "virtual_address": "0x00000000",
  606. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  607. "size": "0x00000000"
  608. }
  609. ],
  610. "exports": [],
  611. "guest_signers": {},
  612. "imphash": "e58ab46f2a279ded0846d81bf0fa21f7",
  613. "icon_fuzzy": null,
  614. "icon": null,
  615. "pdbpath": null,
  616. "imported_dll_count": 1,
  617. "versioninfo": []
  618. }
  619. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!