API tools faq
paste
paladin316

gg_exe_2019-07-03_21_30.json

paladin316
Jul 3rd, 2019
2,088
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.33 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "gg.exe"
  7. [*] File Size: 197120
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "a24ae0ef06c437e3ad2d832ead13c836f084dc730c8fcbd0fa6fb9b65dd5ea83"
  10. [*] MD5: "c02ba6cafe8542998d826353053ff8ed"
  11. [*] SHA1: "091da3e802158d2c511e1200cbbca2abfe703dfc"
  12. [*] SHA512: "dc607ce0c025c4c1ed4000ba50a7fdeeef9648a9c787972db086dd41a70d28720704d4184707f09bad7c206e8c96db2006ed18e437a379c0710340c064f0aa27"
  13. [*] CRC32: "8FBFE11A"
  14. [*] SSDEEP: "6144:1zIavkRsXi+z1tAKqlU9wXsPWSrkOTuhx:13IKq18PJT"
  15.  
  16. [*] Process Execution: [
  17. "gg.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: .text, entropy: 6.81, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0002f000, virtual_size: 0x0002eeb4"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "File has been identified by 34 Antiviruses on VirusTotal as malicious",
  31. "Details": [
  32. {
  33. "MicroWorld-eScan": "Gen:Variant.Razy.506926"
  34. },
  35. {
  36. "FireEye": "Gen:Variant.Razy.506926"
  37. },
  38. {
  39. "McAfee": "Artemis!C02BA6CAFE85"
  40. },
  41. {
  42. "Malwarebytes": "Spyware.PasswordStealer"
  43. },
  44. {
  45. "Alibaba": "TrojanPSW:MSIL/Cordis.67e3a985"
  46. },
  47. {
  48. "Arcabit": "Trojan.Razy.D7BC2E"
  49. },
  50. {
  51. "Symantec": "ML.Attribute.HighConfidence"
  52. },
  53. {
  54. "APEX": "Malicious"
  55. },
  56. {
  57. "Kaspersky": "HEUR:Trojan-PSW.MSIL.Cordis.gen"
  58. },
  59. {
  60. "BitDefender": "Gen:Variant.Razy.506926"
  61. },
  62. {
  63. "Rising": "Stealer.Agent!8.C2 (TFE:dGZlOg3z6DM7X8qRQQ)"
  64. },
  65. {
  66. "Ad-Aware": "Gen:Variant.Razy.506926"
  67. },
  68. {
  69. "Emsisoft": "Gen:Variant.Razy.506926 (B)"
  70. },
  71. {
  72. "F-Secure": "Trojan.TR/Dropper.Gen"
  73. },
  74. {
  75. "Invincea": "heuristic"
  76. },
  77. {
  78. "McAfee-GW-Edition": "Artemis"
  79. },
  80. {
  81. "Trapmine": "malicious.moderate.ml.score"
  82. },
  83. {
  84. "Sophos": "Mal/Generic-S"
  85. },
  86. {
  87. "Ikarus": "Trojan.MSIL.Spy"
  88. },
  89. {
  90. "ESET-NOD32": "a variant of MSIL/PSW.Agent.RCD"
  91. },
  92. {
  93. "Avira": "TR/Dropper.Gen"
  94. },
  95. {
  96. "Microsoft": "PWS:MSIL/Arcane.YA!MTB"
  97. },
  98. {
  99. "Endgame": "malicious (high confidence)"
  100. },
  101. {
  102. "ZoneAlarm": "HEUR:Trojan-PSW.MSIL.Cordis.gen"
  103. },
  104. {
  105. "GData": "Gen:Variant.Razy.506926"
  106. },
  107. {
  108. "AhnLab-V3": "Trojan/Win32.Agent.C2926564"
  109. },
  110. {
  111. "Acronis": "suspicious"
  112. },
  113. {
  114. "ALYac": "Gen:Variant.Razy.506926"
  115. },
  116. {
  117. "MAX": "malware (ai score=85)"
  118. },
  119. {
  120. "Cylance": "Unsafe"
  121. },
  122. {
  123. "SentinelOne": "DFI - Malicious PE"
  124. },
  125. {
  126. "Fortinet": "MSIL/Agent.RCD!tr.pws"
  127. },
  128. {
  129. "Cybereason": "malicious.afe854"
  130. },
  131. {
  132. "CrowdStrike": "win/malicious_confidence_100% (D)"
  133. }
  134. ]
  135. }
  136. ]
  137.  
  138. [*] Started Service: []
  139.  
  140. [*] Executed Commands: []
  141.  
  142. [*] Mutexes: []
  143.  
  144. [*] Modified Files: []
  145.  
  146. [*] Deleted Files: []
  147.  
  148. [*] Modified Registry Keys: []
  149.  
  150. [*] Deleted Registry Keys: []
  151.  
  152. [*] DNS Communications: []
  153.  
  154. [*] Domains: []
  155.  
  156. [*] Network Communication - ICMP: []
  157.  
  158. [*] Network Communication - HTTP: []
  159.  
  160. [*] Network Communication - SMTP: []
  161.  
  162. [*] Network Communication - Hosts: []
  163.  
  164. [*] Network Communication - IRC: []
  165.  
  166. [*] Static Analysis: {
  167. "dotnet": {
  168. "customattrs": null,
  169. "assemblyinfo": {
  170. "version": "1.0.0.0",
  171. "name": "file"
  172. },
  173. "assemblyrefs": [
  174. {
  175. "version": "4.0.0.0",
  176. "name": "mscorlib"
  177. },
  178. {
  179. "version": "65535.65535.65535.65535",
  180. "name": "mscorlib"
  181. },
  182. {
  183. "version": "4.0.0.0",
  184. "name": "System.Drawing"
  185. },
  186. {
  187. "version": "4.0.0.0",
  188. "name": "System.Management"
  189. },
  190. {
  191. "version": "4.0.0.0",
  192. "name": "System"
  193. },
  194. {
  195. "version": "4.0.0.0",
  196. "name": "System.Xml"
  197. },
  198. {
  199. "version": "4.0.0.0",
  200. "name": "System.Windows.Forms"
  201. },
  202. {
  203. "version": "4.0.0.0",
  204. "name": "System.IO.Compression.FileSystem"
  205. },
  206. {
  207. "version": "4.0.0.0",
  208. "name": "System.Core"
  209. }
  210. ],
  211. "typerefs": []
  212. },
  213. "pe": {
  214. "peid_signatures": null,
  215. "imports": [
  216. {
  217. "imports": [
  218. {
  219. "name": "_CorExeMain",
  220. "address": "0x402000"
  221. }
  222. ],
  223. "dll": "mscoree.dll"
  224. }
  225. ],
  226. "digital_signers": null,
  227. "exported_dll_name": null,
  228. "actual_checksum": "0x0003a647",
  229. "overlay": null,
  230. "imagebase": "0x00400000",
  231. "reported_checksum": "0x0003a647",
  232. "icon_hash": null,
  233. "entrypoint": "0x00430eae",
  234. "timestamp": "2019-06-05 13:23:54",
  235. "osversion": "4.0",
  236. "sections": [
  237. {
  238. "name": ".text",
  239. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  240. "virtual_address": "0x00002000",
  241. "size_of_data": "0x0002f000",
  242. "entropy": "6.81",
  243. "raw_address": "0x00000400",
  244. "virtual_size": "0x0002eeb4",
  245. "characteristics_raw": "0x60000020"
  246. },
  247. {
  248. "name": ".sdata",
  249. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  250. "virtual_address": "0x00032000",
  251. "size_of_data": "0x00000200",
  252. "entropy": "6.68",
  253. "raw_address": "0x0002f400",
  254. "virtual_size": "0x000001f2",
  255. "characteristics_raw": "0xc0000040"
  256. },
  257. {
  258. "name": ".rsrc",
  259. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  260. "virtual_address": "0x00034000",
  261. "size_of_data": "0x00000a00",
  262. "entropy": "4.52",
  263. "raw_address": "0x0002f600",
  264. "virtual_size": "0x00000998",
  265. "characteristics_raw": "0x40000040"
  266. },
  267. {
  268. "name": ".reloc",
  269. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  270. "virtual_address": "0x00036000",
  271. "size_of_data": "0x00000200",
  272. "entropy": "0.08",
  273. "raw_address": "0x00030000",
  274. "virtual_size": "0x0000000c",
  275. "characteristics_raw": "0x42000040"
  276. }
  277. ],
  278. "resources": [],
  279. "dirents": [
  280. {
  281. "virtual_address": "0x00000000",
  282. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  283. "size": "0x00000000"
  284. },
  285. {
  286. "virtual_address": "0x00030e60",
  287. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  288. "size": "0x0000004b"
  289. },
  290. {
  291. "virtual_address": "0x00034000",
  292. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  293. "size": "0x00000998"
  294. },
  295. {
  296. "virtual_address": "0x00000000",
  297. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  298. "size": "0x00000000"
  299. },
  300. {
  301. "virtual_address": "0x00000000",
  302. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  303. "size": "0x00000000"
  304. },
  305. {
  306. "virtual_address": "0x00036000",
  307. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  308. "size": "0x0000000c"
  309. },
  310. {
  311. "virtual_address": "0x00030e1b",
  312. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  313. "size": "0x0000001c"
  314. },
  315. {
  316. "virtual_address": "0x00000000",
  317. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  318. "size": "0x00000000"
  319. },
  320. {
  321. "virtual_address": "0x00000000",
  322. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  323. "size": "0x00000000"
  324. },
  325. {
  326. "virtual_address": "0x00000000",
  327. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  328. "size": "0x00000000"
  329. },
  330. {
  331. "virtual_address": "0x00000000",
  332. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  333. "size": "0x00000000"
  334. },
  335. {
  336. "virtual_address": "0x00000000",
  337. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  338. "size": "0x00000000"
  339. },
  340. {
  341. "virtual_address": "0x00002000",
  342. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  343. "size": "0x00000008"
  344. },
  345. {
  346. "virtual_address": "0x00000000",
  347. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  348. "size": "0x00000000"
  349. },
  350. {
  351. "virtual_address": "0x00002008",
  352. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  353. "size": "0x00000048"
  354. }
  355. ],
  356. "exports": [],
  357. "guest_signers": {},
  358. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  359. "icon_fuzzy": null,
  360. "icon": null,
  361. "pdbpath": "file.pdb",
  362. "imported_dll_count": 1,
  363. "versioninfo": []
  364. }
  365. }
  366.  
  367. [*] Resolved APIs: [
  368. "advapi32.dll.RegOpenKeyExW",
  369. "advapi32.dll.RegQueryInfoKeyW",
  370. "advapi32.dll.RegEnumKeyExW",
  371. "advapi32.dll.RegEnumValueW",
  372. "advapi32.dll.RegCloseKey",
  373. "advapi32.dll.RegQueryValueExW",
  374. "shlwapi.dll.UrlIsW"
  375. ]
  376.  
  377. [*] Static Analysis: {
  378. "dotnet": {
  379. "customattrs": null,
  380. "assemblyinfo": {
  381. "version": "1.0.0.0",
  382. "name": "file"
  383. },
  384. "assemblyrefs": [
  385. {
  386. "version": "4.0.0.0",
  387. "name": "mscorlib"
  388. },
  389. {
  390. "version": "65535.65535.65535.65535",
  391. "name": "mscorlib"
  392. },
  393. {
  394. "version": "4.0.0.0",
  395. "name": "System.Drawing"
  396. },
  397. {
  398. "version": "4.0.0.0",
  399. "name": "System.Management"
  400. },
  401. {
  402. "version": "4.0.0.0",
  403. "name": "System"
  404. },
  405. {
  406. "version": "4.0.0.0",
  407. "name": "System.Xml"
  408. },
  409. {
  410. "version": "4.0.0.0",
  411. "name": "System.Windows.Forms"
  412. },
  413. {
  414. "version": "4.0.0.0",
  415. "name": "System.IO.Compression.FileSystem"
  416. },
  417. {
  418. "version": "4.0.0.0",
  419. "name": "System.Core"
  420. }
  421. ],
  422. "typerefs": []
  423. },
  424. "pe": {
  425. "peid_signatures": null,
  426. "imports": [
  427. {
  428. "imports": [
  429. {
  430. "name": "_CorExeMain",
  431. "address": "0x402000"
  432. }
  433. ],
  434. "dll": "mscoree.dll"
  435. }
  436. ],
  437. "digital_signers": null,
  438. "exported_dll_name": null,
  439. "actual_checksum": "0x0003a647",
  440. "overlay": null,
  441. "imagebase": "0x00400000",
  442. "reported_checksum": "0x0003a647",
  443. "icon_hash": null,
  444. "entrypoint": "0x00430eae",
  445. "timestamp": "2019-06-05 13:23:54",
  446. "osversion": "4.0",
  447. "sections": [
  448. {
  449. "name": ".text",
  450. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  451. "virtual_address": "0x00002000",
  452. "size_of_data": "0x0002f000",
  453. "entropy": "6.81",
  454. "raw_address": "0x00000400",
  455. "virtual_size": "0x0002eeb4",
  456. "characteristics_raw": "0x60000020"
  457. },
  458. {
  459. "name": ".sdata",
  460. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  461. "virtual_address": "0x00032000",
  462. "size_of_data": "0x00000200",
  463. "entropy": "6.68",
  464. "raw_address": "0x0002f400",
  465. "virtual_size": "0x000001f2",
  466. "characteristics_raw": "0xc0000040"
  467. },
  468. {
  469. "name": ".rsrc",
  470. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  471. "virtual_address": "0x00034000",
  472. "size_of_data": "0x00000a00",
  473. "entropy": "4.52",
  474. "raw_address": "0x0002f600",
  475. "virtual_size": "0x00000998",
  476. "characteristics_raw": "0x40000040"
  477. },
  478. {
  479. "name": ".reloc",
  480. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  481. "virtual_address": "0x00036000",
  482. "size_of_data": "0x00000200",
  483. "entropy": "0.08",
  484. "raw_address": "0x00030000",
  485. "virtual_size": "0x0000000c",
  486. "characteristics_raw": "0x42000040"
  487. }
  488. ],
  489. "resources": [],
  490. "dirents": [
  491. {
  492. "virtual_address": "0x00000000",
  493. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  494. "size": "0x00000000"
  495. },
  496. {
  497. "virtual_address": "0x00030e60",
  498. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  499. "size": "0x0000004b"
  500. },
  501. {
  502. "virtual_address": "0x00034000",
  503. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  504. "size": "0x00000998"
  505. },
  506. {
  507. "virtual_address": "0x00000000",
  508. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  509. "size": "0x00000000"
  510. },
  511. {
  512. "virtual_address": "0x00000000",
  513. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  514. "size": "0x00000000"
  515. },
  516. {
  517. "virtual_address": "0x00036000",
  518. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  519. "size": "0x0000000c"
  520. },
  521. {
  522. "virtual_address": "0x00030e1b",
  523. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  524. "size": "0x0000001c"
  525. },
  526. {
  527. "virtual_address": "0x00000000",
  528. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  529. "size": "0x00000000"
  530. },
  531. {
  532. "virtual_address": "0x00000000",
  533. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  534. "size": "0x00000000"
  535. },
  536. {
  537. "virtual_address": "0x00000000",
  538. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  539. "size": "0x00000000"
  540. },
  541. {
  542. "virtual_address": "0x00000000",
  543. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  544. "size": "0x00000000"
  545. },
  546. {
  547. "virtual_address": "0x00000000",
  548. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  549. "size": "0x00000000"
  550. },
  551. {
  552. "virtual_address": "0x00002000",
  553. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  554. "size": "0x00000008"
  555. },
  556. {
  557. "virtual_address": "0x00000000",
  558. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  559. "size": "0x00000000"
  560. },
  561. {
  562. "virtual_address": "0x00002008",
  563. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  564. "size": "0x00000048"
  565. }
  566. ],
  567. "exports": [],
  568. "guest_signers": {},
  569. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  570. "icon_fuzzy": null,
  571. "icon": null,
  572. "pdbpath": "file.pdb",
  573. "imported_dll_count": 1,
  574. "versioninfo": []
  575. }
  576. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!