API tools faq
paste
paladin316

Exes_c4e59bc692172715fc7699d3435552b8_exe_2019-07-03_05_30.json

paladin316
Jul 3rd, 2019
2,148
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 16.13 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_c4e59bc692172715fc7699d3435552b8.exe"
  7. [*] File Size: 1257365
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "4a74d4b6d06dac3f3aea4b69f6327bc64923ff0ad68e62252a3d4955bb152d6e"
  10. [*] MD5: "c4e59bc692172715fc7699d3435552b8"
  11. [*] SHA1: "4d81703cee8a248ec3574b90acbe897a392b2284"
  12. [*] SHA512: "4d09b9b1eb385054a1ebf9c6d67e41e518a3695fc7a94b78d35b22a01180f68cd406ae33d890e300813a5391ecb26beaa9992d6d783362701eac8048fbfd8c6c"
  13. [*] CRC32: "E36A4418"
  14. [*] SSDEEP: "24576:2StnRZ/7AH3BFG4sY4Hi+b+dLVn63M2ThFtmrMRdcDywtawS:2StnRg3etdH+LV68KMsaDh"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: .rsrc, entropy: 8.00, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00132d95, virtual_size: 0x0013a000"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "File has been identified by 54 Antiviruses on VirusTotal as malicious",
  29. "Details": [
  30. {
  31. "MicroWorld-eScan": "Gen:Win32.ExplorerHijack.mjGea4F!yZei"
  32. },
  33. {
  34. "CAT-QuickHeal": "Trojan.Generic"
  35. },
  36. {
  37. "McAfee": "Artemis!C4E59BC69217"
  38. },
  39. {
  40. "Cylance": "Unsafe"
  41. },
  42. {
  43. "Alibaba": "Trojan:Win32/AgentBypass.397548cc"
  44. },
  45. {
  46. "K7GW": "Trojan ( 005329b91 )"
  47. },
  48. {
  49. "K7AntiVirus": "Trojan ( 005329b91 )"
  50. },
  51. {
  52. "Arcabit": "Gen:Win32.ExplorerHijack.mjGea4F!yZei"
  53. },
  54. {
  55. "TrendMicro": "Cryp_Xed-12"
  56. },
  57. {
  58. "Symantec": "Trojan.Gen.MBT"
  59. },
  60. {
  61. "APEX": "Malicious"
  62. },
  63. {
  64. "Paloalto": "generic.ml"
  65. },
  66. {
  67. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  68. },
  69. {
  70. "BitDefender": "Gen:Win32.ExplorerHijack.mjGea4F!yZei"
  71. },
  72. {
  73. "NANO-Antivirus": "Trojan.Win32.ExplorerHijack.frbxzb"
  74. },
  75. {
  76. "AegisLab": "Trojan.Win32.Generic.4!c"
  77. },
  78. {
  79. "Avast": "Win32:Malware-gen"
  80. },
  81. {
  82. "Endgame": "malicious (high confidence)"
  83. },
  84. {
  85. "Sophos": "Mal/EncPk-BW"
  86. },
  87. {
  88. "Comodo": "Packed.Win32.Klone.~KMG@1knj1d"
  89. },
  90. {
  91. "F-Secure": "Trojan.TR/Downloader.Gen"
  92. },
  93. {
  94. "DrWeb": "Trojan.DownLoader28.39617"
  95. },
  96. {
  97. "VIPRE": "Packed.Win32.Upack (v)"
  98. },
  99. {
  100. "Invincea": "heuristic"
  101. },
  102. {
  103. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  104. },
  105. {
  106. "Trapmine": "malicious.high.ml.score"
  107. },
  108. {
  109. "FireEye": "Generic.mg.c4e59bc692172715"
  110. },
  111. {
  112. "Emsisoft": "Gen:Win32.ExplorerHijack.mjGea4F!yZei (B)"
  113. },
  114. {
  115. "SentinelOne": "DFI - Malicious PE"
  116. },
  117. {
  118. "Cyren": "W32/Trojan.GMIZ-2030"
  119. },
  120. {
  121. "Jiangmin": "Trojan.PSW.Coins.ccb"
  122. },
  123. {
  124. "Avira": "TR/Downloader.Gen"
  125. },
  126. {
  127. "Microsoft": "Trojan:Win32/AgentBypass.gen!I"
  128. },
  129. {
  130. "ViRobot": "Trojan.Win32.Z.Onlinegames.1257365"
  131. },
  132. {
  133. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  134. },
  135. {
  136. "GData": "Gen:Win32.ExplorerHijack.mjGea4F!yZei"
  137. },
  138. {
  139. "AhnLab-V3": "Packed/Upack"
  140. },
  141. {
  142. "Acronis": "suspicious"
  143. },
  144. {
  145. "VBA32": "BScope.Trojan.Downloader"
  146. },
  147. {
  148. "ALYac": "Gen:Win32.ExplorerHijack.mjGea4F!yZei"
  149. },
  150. {
  151. "MAX": "malware (ai score=100)"
  152. },
  153. {
  154. "Ad-Aware": "Gen:Win32.ExplorerHijack.mjGea4F!yZei"
  155. },
  156. {
  157. "ESET-NOD32": "a variant of Generik.JUWIGVY"
  158. },
  159. {
  160. "TrendMicro-HouseCall": "Cryp_Xed-12"
  161. },
  162. {
  163. "Tencent": "Win32.Trojan-gamethief.Onlinegames.Taev"
  164. },
  165. {
  166. "Yandex": "Trojan.Agent!9yQR3YNRkGw"
  167. },
  168. {
  169. "Ikarus": "Trojan-PSW.OnlineGames"
  170. },
  171. {
  172. "eGambit": "Unsafe.AI_Score_99%"
  173. },
  174. {
  175. "Fortinet": "W32/Onlinegames.QZO!tr"
  176. },
  177. {
  178. "AVG": "Win32:Malware-gen"
  179. },
  180. {
  181. "Cybereason": "malicious.692172"
  182. },
  183. {
  184. "Panda": "Trj/GdSda.A"
  185. },
  186. {
  187. "CrowdStrike": "win/malicious_confidence_90% (W)"
  188. },
  189. {
  190. "Qihoo-360": "HEUR/QVM14.0.B5F7.Malware.Gen"
  191. }
  192. ]
  193. }
  194. ]
  195.  
  196. [*] Started Service: []
  197.  
  198. [*] Executed Commands: []
  199.  
  200. [*] Mutexes: []
  201.  
  202. [*] Modified Files: []
  203.  
  204. [*] Deleted Files: []
  205.  
  206. [*] Modified Registry Keys: []
  207.  
  208. [*] Deleted Registry Keys: []
  209.  
  210. [*] DNS Communications: []
  211.  
  212. [*] Domains: []
  213.  
  214. [*] Network Communication - ICMP: []
  215.  
  216. [*] Network Communication - HTTP: []
  217.  
  218. [*] Network Communication - SMTP: []
  219.  
  220. [*] Network Communication - Hosts: []
  221.  
  222. [*] Network Communication - IRC: []
  223.  
  224. [*] Static Analysis: {
  225. "pe": {
  226. "peid_signatures": [
  227. [
  228. "Upack V0.37 -> Dwing"
  229. ],
  230. [
  231. "Upack_Patch or any Version -> Dwing"
  232. ],
  233. [
  234. "WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)"
  235. ]
  236. ],
  237. "imports": [
  238. {
  239. "imports": [
  240. {
  241. "name": "LoadLibraryA",
  242. "address": "0x852d65"
  243. },
  244. {
  245. "name": "GetProcAddress",
  246. "address": "0x852d69"
  247. }
  248. ],
  249. "dll": "KERNEL32.DLL"
  250. }
  251. ],
  252. "digital_signers": null,
  253. "exported_dll_name": null,
  254. "actual_checksum": "0x00140da5",
  255. "overlay": null,
  256. "imagebase": "0x00400000",
  257. "reported_checksum": "0x00000000",
  258. "icon_hash": null,
  259. "entrypoint": "0x00852ab9",
  260. "timestamp": "1970-01-01 01:08:16",
  261. "osversion": "4.0",
  262. "sections": [
  263. {
  264. "name": ".Upack",
  265. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  266. "virtual_address": "0x00001000",
  267. "size_of_data": "0x00000000",
  268. "entropy": "0.00",
  269. "raw_address": "0x00000000",
  270. "virtual_size": "0x0031f000",
  271. "characteristics_raw": "0xe0000060"
  272. },
  273. {
  274. "name": ".rsrc",
  275. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  276. "virtual_address": "0x00320000",
  277. "size_of_data": "0x00132d95",
  278. "entropy": "8.00",
  279. "raw_address": "0x00000200",
  280. "virtual_size": "0x0013a000",
  281. "characteristics_raw": "0xe0000060"
  282. }
  283. ],
  284. "resources": [],
  285. "dirents": [
  286. {
  287. "virtual_address": "0x00000000",
  288. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  289. "size": "0x00000000"
  290. },
  291. {
  292. "virtual_address": "0x00452d6d",
  293. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  294. "size": "0x00000014"
  295. },
  296. {
  297. "virtual_address": "0x00320000",
  298. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  299. "size": "0x000001e0"
  300. },
  301. {
  302. "virtual_address": "0x00000000",
  303. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  304. "size": "0x00000000"
  305. },
  306. {
  307. "virtual_address": "0x00000000",
  308. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  309. "size": "0x00000000"
  310. },
  311. {
  312. "virtual_address": "0x00000048",
  313. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  314. "size": "0x00000008"
  315. },
  316. {
  317. "virtual_address": "0x00000000",
  318. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  319. "size": "0x00000000"
  320. },
  321. {
  322. "virtual_address": "0x00000000",
  323. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  324. "size": "0x00000000"
  325. },
  326. {
  327. "virtual_address": "0x00000000",
  328. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  329. "size": "0x00000000"
  330. },
  331. {
  332. "virtual_address": "0x00000000",
  333. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  334. "size": "0x00000000"
  335. },
  336. {
  337. "virtual_address": "0x00000000",
  338. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  339. "size": "0x00000000"
  340. },
  341. {
  342. "virtual_address": "0x00000000",
  343. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  344. "size": "0x00000000"
  345. },
  346. {
  347. "virtual_address": "0x00000000",
  348. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  349. "size": "0x00000000"
  350. },
  351. {
  352. "virtual_address": "0x00000000",
  353. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  354. "size": "0x00000000"
  355. },
  356. {
  357. "virtual_address": "0x00000000",
  358. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  359. "size": "0x00000000"
  360. },
  361. {
  362. "virtual_address": "0x00000000",
  363. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  364. "size": "0x00000000"
  365. }
  366. ],
  367. "exports": [],
  368. "guest_signers": {},
  369. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  370. "icon_fuzzy": null,
  371. "icon": null,
  372. "pdbpath": null,
  373. "imported_dll_count": 1,
  374. "versioninfo": []
  375. }
  376. }
  377.  
  378. [*] Resolved APIs: []
  379.  
  380. [*] Static Analysis: {
  381. "pe": {
  382. "peid_signatures": [
  383. [
  384. "Upack V0.37 -> Dwing"
  385. ],
  386. [
  387. "Upack_Patch or any Version -> Dwing"
  388. ],
  389. [
  390. "WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)"
  391. ]
  392. ],
  393. "imports": [
  394. {
  395. "imports": [
  396. {
  397. "name": "LoadLibraryA",
  398. "address": "0x852d65"
  399. },
  400. {
  401. "name": "GetProcAddress",
  402. "address": "0x852d69"
  403. }
  404. ],
  405. "dll": "KERNEL32.DLL"
  406. }
  407. ],
  408. "digital_signers": null,
  409. "exported_dll_name": null,
  410. "actual_checksum": "0x00140da5",
  411. "overlay": null,
  412. "imagebase": "0x00400000",
  413. "reported_checksum": "0x00000000",
  414. "icon_hash": null,
  415. "entrypoint": "0x00852ab9",
  416. "timestamp": "1970-01-01 01:08:16",
  417. "osversion": "4.0",
  418. "sections": [
  419. {
  420. "name": ".Upack",
  421. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  422. "virtual_address": "0x00001000",
  423. "size_of_data": "0x00000000",
  424. "entropy": "0.00",
  425. "raw_address": "0x00000000",
  426. "virtual_size": "0x0031f000",
  427. "characteristics_raw": "0xe0000060"
  428. },
  429. {
  430. "name": ".rsrc",
  431. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  432. "virtual_address": "0x00320000",
  433. "size_of_data": "0x00132d95",
  434. "entropy": "8.00",
  435. "raw_address": "0x00000200",
  436. "virtual_size": "0x0013a000",
  437. "characteristics_raw": "0xe0000060"
  438. }
  439. ],
  440. "resources": [],
  441. "dirents": [
  442. {
  443. "virtual_address": "0x00000000",
  444. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  445. "size": "0x00000000"
  446. },
  447. {
  448. "virtual_address": "0x00452d6d",
  449. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  450. "size": "0x00000014"
  451. },
  452. {
  453. "virtual_address": "0x00320000",
  454. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  455. "size": "0x000001e0"
  456. },
  457. {
  458. "virtual_address": "0x00000000",
  459. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  460. "size": "0x00000000"
  461. },
  462. {
  463. "virtual_address": "0x00000000",
  464. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  465. "size": "0x00000000"
  466. },
  467. {
  468. "virtual_address": "0x00000048",
  469. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  470. "size": "0x00000008"
  471. },
  472. {
  473. "virtual_address": "0x00000000",
  474. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  475. "size": "0x00000000"
  476. },
  477. {
  478. "virtual_address": "0x00000000",
  479. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  480. "size": "0x00000000"
  481. },
  482. {
  483. "virtual_address": "0x00000000",
  484. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  485. "size": "0x00000000"
  486. },
  487. {
  488. "virtual_address": "0x00000000",
  489. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  490. "size": "0x00000000"
  491. },
  492. {
  493. "virtual_address": "0x00000000",
  494. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  495. "size": "0x00000000"
  496. },
  497. {
  498. "virtual_address": "0x00000000",
  499. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  500. "size": "0x00000000"
  501. },
  502. {
  503. "virtual_address": "0x00000000",
  504. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  505. "size": "0x00000000"
  506. },
  507. {
  508. "virtual_address": "0x00000000",
  509. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  510. "size": "0x00000000"
  511. },
  512. {
  513. "virtual_address": "0x00000000",
  514. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  515. "size": "0x00000000"
  516. },
  517. {
  518. "virtual_address": "0x00000000",
  519. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  520. "size": "0x00000000"
  521. }
  522. ],
  523. "exports": [],
  524. "guest_signers": {},
  525. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  526. "icon_fuzzy": null,
  527. "icon": null,
  528. "pdbpath": null,
  529. "imported_dll_count": 1,
  530. "versioninfo": []
  531. }
  532. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!