API tools faq
paste
paladin316

Loki_a574a4bdf357c321453a2b9361c77c1c_exe_json.json

paladin316
Jun 19th, 2019
2,186
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 53.19 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Loki_a574a4bdf357c321453a2b9361c77c1c.exe"
  7. [*] File Size: 510976
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "b14ad99dec546e8687c644ffb09d076d34b0343524739912afa6ef4cc11c7a9b"
  10. [*] MD5: "a574a4bdf357c321453a2b9361c77c1c"
  11. [*] SHA1: "876259d132f762d7300d1623b4d7625172c03e8e"
  12. [*] SHA512: "0b6b9b1b336806220d4003d5e169f5f1ef546e946281ac51d4236882be5e92a3dfc484054464702121f6e507f60bd63c63dbcfd8e59ec6dc9c50eeae3200e12e"
  13. [*] CRC32: "68A1F921"
  14. [*] SSDEEP: "6144:6ssSXxqSNWOzD2nleo0SVCRyVMC4Byi6sOtMX:6ssShDWOenlezhY6v"
  15.  
  16. [*] Process Execution: [
  17. "Loki_a574a4bdf357c321453a2b9361c77c1c.exe",
  18. "Loki_a574a4bdf357c321453a2b9361c77c1c.exe",
  19. "services.exe",
  20. "sc.exe",
  21. "svchost.exe",
  22. "GoogleUpdate.exe"
  23. ]
  24.  
  25. [*] Signatures Detected: [
  26. {
  27. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  28. "Details": [
  29. {
  30. "IP": "172.217.0.35:443"
  31. }
  32. ]
  33. },
  34. {
  35. "Description": "Creates RWX memory",
  36. "Details": []
  37. },
  38. {
  39. "Description": "A process attempted to delay the analysis task.",
  40. "Details": [
  41. {
  42. "Process": "Loki_a574a4bdf357c321453a2b9361c77c1c.exe tried to sleep 1380 seconds, actually delayed analysis time by 0 seconds"
  43. }
  44. ]
  45. },
  46. {
  47. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  48. "Details": [
  49. {
  50. "ioc": "http://crl.globalsign.net/root-r2.crl0"
  51. }
  52. ]
  53. },
  54. {
  55. "Description": "A process created a hidden window",
  56. "Details": [
  57. {
  58. "Process": "Loki_a574a4bdf357c321453a2b9361c77c1c.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\Loki_a574a4bdf357c321453a2b9361c77c1c.exe"
  59. }
  60. ]
  61. },
  62. {
  63. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  64. "Details": [
  65. {
  66. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  67. },
  68. {
  69. "http_version_old": "HTTP traffic uses version 1.0"
  70. },
  71. {
  72. "suspicious_request": "http://exsimpetroleum.com/wp-content/admin/Panel/five/fre.php"
  73. },
  74. {
  75. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  76. },
  77. {
  78. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  79. },
  80. {
  81. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  82. }
  83. ]
  84. },
  85. {
  86. "Description": "Performs some HTTP requests",
  87. "Details": [
  88. {
  89. "url": "http://exsimpetroleum.com/wp-content/admin/Panel/five/fre.php"
  90. },
  91. {
  92. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  93. },
  94. {
  95. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  96. },
  97. {
  98. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  99. }
  100. ]
  101. },
  102. {
  103. "Description": "The binary likely contains encrypted or compressed data.",
  104. "Details": [
  105. {
  106. "section": "name: UPX1, entropy: 7.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00021a00, virtual_size: 0x00022000"
  107. }
  108. ]
  109. },
  110. {
  111. "Description": "The executable is compressed using UPX",
  112. "Details": [
  113. {
  114. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x0007d000"
  115. }
  116. ]
  117. },
  118. {
  119. "Description": "Deletes its original binary from disk",
  120. "Details": []
  121. },
  122. {
  123. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  124. "Details": [
  125. {
  126. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 12146415 times"
  127. }
  128. ]
  129. },
  130. {
  131. "Description": "Steals private information from local Internet browsers",
  132. "Details": [
  133. {
  134. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  135. }
  136. ]
  137. },
  138. {
  139. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  140. "Details": [
  141. {
  142. "modified_name": "loki_a574a4bdf357c321453a2b9361c77c1c.exe",
  143. "modified_path": "C:\\Users\\user\\AppData\\Local\\Temp\\loki_a574a4bdf357c321453a2b9361c77c1c.exe",
  144. "original_name": "Loki_a574a4bdf357c321453a2b9361c77c1c.exe",
  145. "original_path": "C:\\Users\\user\\AppData\\Local\\Temp\\Loki_a574a4bdf357c321453a2b9361c77c1c.exe"
  146. }
  147. ]
  148. },
  149. {
  150. "Description": "Creates a hidden or system file",
  151. "Details": [
  152. {
  153. "file": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
  154. },
  155. {
  156. "file": "C:\\Users\\user\\AppData\\Roaming\\474604"
  157. }
  158. ]
  159. },
  160. {
  161. "Description": "File has been identified by 34 Antiviruses on VirusTotal as malicious",
  162. "Details": [
  163. {
  164. "MicroWorld-eScan": "Gen:Variant.Razy.519650"
  165. },
  166. {
  167. "FireEye": "Generic.mg.a574a4bdf357c321"
  168. },
  169. {
  170. "K7AntiVirus": "Trojan ( 005502841 )"
  171. },
  172. {
  173. "BitDefender": "Gen:Variant.Razy.519650"
  174. },
  175. {
  176. "K7GW": "Trojan ( 005502841 )"
  177. },
  178. {
  179. "Cybereason": "malicious.df357c"
  180. },
  181. {
  182. "Symantec": "ML.Attribute.HighConfidence"
  183. },
  184. {
  185. "APEX": "Malicious"
  186. },
  187. {
  188. "Avast": "Win32:TrojanX-gen [Trj]"
  189. },
  190. {
  191. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  192. },
  193. {
  194. "Tencent": "Win32.Trojan.Generic.Lmam"
  195. },
  196. {
  197. "Endgame": "malicious (moderate confidence)"
  198. },
  199. {
  200. "Emsisoft": "Gen:Variant.Razy.519650 (B)"
  201. },
  202. {
  203. "F-Secure": "Trojan.TR/Crypt.XPACK.Gen2"
  204. },
  205. {
  206. "DrWeb": "Trojan.PWS.Spy.21277"
  207. },
  208. {
  209. "Invincea": "heuristic"
  210. },
  211. {
  212. "Fortinet": "W32/Kryptik.GTWJ!tr"
  213. },
  214. {
  215. "Trapmine": "suspicious.low.ml.score"
  216. },
  217. {
  218. "Ikarus": "Trojan-Spy.LokiBot"
  219. },
  220. {
  221. "ESET-NOD32": "a variant of Win32/Kryptik.GTWJ"
  222. },
  223. {
  224. "Avira": "TR/Crypt.XPACK.Gen2"
  225. },
  226. {
  227. "MAX": "malware (ai score=81)"
  228. },
  229. {
  230. "Arcabit": "Trojan.Razy.D7EDE2"
  231. },
  232. {
  233. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  234. },
  235. {
  236. "Acronis": "suspicious"
  237. },
  238. {
  239. "ALYac": "Gen:Variant.Razy.519650"
  240. },
  241. {
  242. "Ad-Aware": "Gen:Variant.Razy.519650"
  243. },
  244. {
  245. "Cylance": "Unsafe"
  246. },
  247. {
  248. "Rising": "Trojan.Kryptik!8.8/N3#86% (RDM+:cmRtazrc/sQY8R7in5MNiksAYpM4)"
  249. },
  250. {
  251. "SentinelOne": "DFI - Suspicious PE"
  252. },
  253. {
  254. "GData": "Gen:Variant.Razy.519650"
  255. },
  256. {
  257. "AVG": "Win32:TrojanX-gen [Trj]"
  258. },
  259. {
  260. "CrowdStrike": "win/malicious_confidence_90% (W)"
  261. },
  262. {
  263. "Qihoo-360": "Win32/Trojan.a92"
  264. }
  265. ]
  266. },
  267. {
  268. "Description": "Harvests credentials from local FTP client softwares",
  269. "Details": [
  270. {
  271. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
  272. },
  273. {
  274. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  275. },
  276. {
  277. "file": "C:\\Users\\user\\AppData\\Roaming\\Far Manager\\Profile\\PluginsData\\42E4AEB1-A230-44F4-B33C-F195BB654931.db"
  278. },
  279. {
  280. "file": "C:\\Program Files (x86)\\FTPGetter\\Profile\\servers.xml"
  281. },
  282. {
  283. "file": "C:\\Users\\user\\AppData\\Roaming\\FTPGetter\\servers.xml"
  284. },
  285. {
  286. "file": "C:\\Users\\user\\AppData\\Roaming\\Estsoft\\ALFTP\\ESTdb2.dat"
  287. },
  288. {
  289. "key": "HKEY_CURRENT_USER\\Software\\Far\\Plugins\\FTP\\Hosts"
  290. },
  291. {
  292. "key": "HKEY_CURRENT_USER\\Software\\Far2\\Plugins\\FTP\\Hosts"
  293. },
  294. {
  295. "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
  296. },
  297. {
  298. "key": "HKEY_CURRENT_USER\\Software\\LinasFTP\\Site Manager"
  299. }
  300. ]
  301. },
  302. {
  303. "Description": "Harvests information related to installed instant messenger clients",
  304. "Details": [
  305. {
  306. "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
  307. }
  308. ]
  309. },
  310. {
  311. "Description": "Harvests information related to installed mail clients",
  312. "Details": [
  313. {
  314. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  315. },
  316. {
  317. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046\\Email"
  318. },
  319. {
  320. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  321. },
  322. {
  323. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  324. },
  325. {
  326. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff\\Email"
  327. },
  328. {
  329. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326\\Email"
  330. },
  331. {
  332. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  333. },
  334. {
  335. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  336. },
  337. {
  338. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  339. },
  340. ftware\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  341. },
  342. {
  343. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670\\Email"
  344. },
  345. {
  346. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604\\Email"
  347. },
  348. {
  349. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  350. },
  351. {
  352. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  353. },
  354. {
  355. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  356. },
  357. {
  358. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  359. },
  360. {
  361. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  362. },
  363. {
  364. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046\\Email"
  365. }
  366. ]
  367. },
  368. {
  369. "Description": "Collects information to fingerprint the system",
  370. "Details": []
  371. },
  372. {
  373. "Description": "Created network traffic indicative of malicious activity",
  374. "Details": [
  375. {
  376. "signature": "ET TROJAN LokiBot User-Agent (Charon/Inferno)"
  377. },
  378. {
  379. "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1"
  380. },
  381. {
  382. "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M1"
  383. },
  384. {
  385. "signature": "ET TROJAN LokiBot Fake 404 Response"
  386. },
  387. {
  388. "signature": "ET TROJAN LokiBot Checkin"
  389. }
  390. ]
  391. }
  392. ]
  393.  
  394. [*] Started Service: [
  395. "VaultSvc",
  396. "W32Time"
  397. ]
  398.  
  399. [*] Executed Commands: [
  400. "\"C:\\Users\\user\\AppData\\Local\\Temp\\Loki_a574a4bdf357c321453a2b9361c77c1c.exe\"",
  401. "C:\\Windows\\system32\\lsass.exe",
  402. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  403. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  404. "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /svc"
  405. ]
  406.  
  407. [*] Mutexes: [
  408. "DBWinMutex",
  409. "6EFA73A4746045B65DEE781E",
  410. "Global\\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}",
  411. "Global\\G{6885AE8E-C070-458d-9711-37B9BEAB65F6}",
  412. "Global\\G{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}",
  413. "Global\\G{0A175FBE-AEEC-4fea-855A-2AA549A88846}"
  414. ]
  415.  
  416. [*] Modified Files: [
  417. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
  418. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe",
  419. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  420. "\\??\\PIPE\\lsarpc",
  421. "\\??\\PIPE\\wkssvc",
  422. "\\??\\pipe\\GoogleCrashServices\\S-1-5-18"
  423. ]
  424.  
  425. [*] Deleted Files: [
  426. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
  427. "C:\\Users\\user\\AppData\\Local\\Temp\\loki_a574a4bdf357c321453a2b9361c77c1c.exe",
  428. "C:\\Program Files (x86)\\Google\\Update\\Install\\{A01675F1-1F84-4945-B8A9-4E1FDEB013B2}\\74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  429. "C:\\Program Files (x86)\\Google\\Update\\Install\\{A01675F1-1F84-4945-B8A9-4E1FDEB013B2}"
  430. ]
  431.  
  432. [*] Modified Registry Keys: [
  433. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  434. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Start",
  435. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining",
  436. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\PersistedPings\\{58A98958-14D1-456C-9C08-525849BCE920}",
  437. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{58A98958-14D1-456C-9C08-525849BCE920}\\PersistedPingString",
  438. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{58A98958-14D1-456C-9C08-525849BCE920}\\PersistedPingTime",
  439. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\pv",
  440. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\pv",
  441. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState",
  442. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState\\StateValue",
  443. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000_CLASSES\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  444. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\proxy\\source",
  445. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\RollCallDayStartSec",
  446. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\DayOfLastRollCall",
  447. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\ping_freshness",
  448. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\(Default)",
  449. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\hint",
  450. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\name",
  451. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\LastCheckSuccess",
  452. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  453. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ActivePingDayStartSec",
  454. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\RollCallDayStartSec",
  455. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastActivity",
  456. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastRollCall",
  457. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ping_freshness",
  458. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\(Default)",
  459. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\hint",
  460. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\name",
  461. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\LastCheckSuccess",
  462. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\LastChecked",
  463. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState",
  464. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\StateValue"
  465. ]
  466.  
  467. [*] Deleted Registry Keys: [
  468. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\uid",
  469. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\old-uid",
  470. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\tttoken",
  471. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableCount",
  472. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableSince",
  473. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  474. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\tttoken",
  475. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableCount",
  476. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableSince"
  477. ]
  478.  
  479. [*] DNS Communications: [
  480. {
  481. "type": "A",
  482. "request": "exsimpetroleum.com",
  483. "answers": [
  484. {
  485. "data": "101.100.204.200",
  486. "type": "A"
  487. }
  488. ]
  489. }
  490. ]
  491.  
  492. [*] Domains: [
  493. {
  494. "ip": "101.100.204.200",
  495. "domain": "exsimpetroleum.com"
  496. }
  497. ]
  498.  
  499. [*] Network Communication - ICMP: []
  500.  
  501. [*] Network Communication - HTTP: [
  502. {
  503. "count": 2,
  504. "body": "",
  505. "uri": "http://exsimpetroleum.com/wp-content/admin/Panel/five/fre.php",
  506. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  507. "method": "POST",
  508. "host": "exsimpetroleum.com",
  509. "version": "1.0",
  510. "path": "/wp-content/admin/Panel/five/fre.php",
  511. "data": "POST /wp-content/admin/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: exsimpetroleum.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: DEAAB24\r\nContent-Length: 176\r\nConnection: close\r\n\r\n",
  512. "port": 80
  513. },
  514. {
  515. "count": 23,
  516. "body": "",
  517. "uri": "http://exsimpetroleum.com/wp-content/admin/Panel/five/fre.php",
  518. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  519. "method": "POST",
  520. "host": "exsimpetroleum.com",
  521. "version": "1.0",
  522. "path": "/wp-content/admin/Panel/five/fre.php",
  523. "data": "POST /wp-content/admin/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: exsimpetroleum.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: DEAAB24\r\nContent-Length: 149\r\nConnection: close\r\n\r\n",
  524. "port": 80
  525. },
  526. {
  527. "count": 1,
  528. "body": "",
  529. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  530. "user-agent": "Microsoft-CryptoAPI/6.1",
  531. "method": "GET",
  532. "host": "ocsp.digicert.com",
  533. "version": "1.1",
  534. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  535. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  536. "port": 80
  537. },
  538. {
  539. "count": 1,
  540. "body": "",
  541. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  542. "user-agent": "Microsoft-CryptoAPI/6.1",
  543. "method": "GET",
  544. "host": "ocsp.digicert.com",
  545. "version": "1.1",
  546. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  547. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  548. "port": 80
  549. },
  550. {
  551. "count": 1,
  552. "body": "",
  553. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  554. "user-agent": "Microsoft-CryptoAPI/6.1",
  555. "method": "GET",
  556. "host": "ocsp.digicert.com",
  557. "version": "1.1",
  558. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  559. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  560. "port": 80
  561. }
  562. ]
  563.  
  564. [*] Network Communication - SMTP: []
  565.  
  566. [*] Network Communication - Hosts: []
  567.  
  568. [*] Network Communication - IRC: []
  569.  
  570. [*] Static Analysis: {
  571. "pe": {
  572. "peid_signatures": null,
  573. "imports": [
  574. {
  575. "imports": [
  576. {
  577. "name": "CertStrToNameA",
  578. "address": "0x4facb4"
  579. }
  580. ],
  581. "dll": "CRYPT32.dll"
  582. },
  583. {
  584. "imports": [
  585. {
  586. "name": "gluSphere",
  587. "address": "0x4facbc"
  588. }
  589. ],
  590. "dll": "GLU32.dll"
  591. },
  592. {
  593. "imports": [
  594. {
  595. "name": "LoadLibraryA",
  596. "address": "0x4facc4"
  597. },
  598. {
  599. "name": "ExitProcess",
  600. "address": "0x4facc8"
  601. },
  602. {
  603. "name": "GetProcAddress",
  604. "address": "0x4faccc"
  605. },
  606. {
  607. "name": "VirtualProtect",
  608. "address": "0x4facd0"
  609. }
  610. ],
  611. "dll": "KERNEL32.DLL"
  612. },
  613. {
  614. "imports": [
  615. {
  616. "name": "ioctlsocket",
  617. "address": "0x4facd8"
  618. }
  619. ],
  620. "dll": "WSOCK32.dll"
  621. }
  622. ],
  623. "digital_signers": null,
  624. "exported_dll_name": null,
  625. "actual_checksum": "0x0007d674",
  626. "overlay": null,
  627. "imagebase": "0x00400000",
  628. "reported_checksum": "0x00000000",
  629. "icon_hash": null,
  630. "entrypoint": "0x0049f600",
  631. "timestamp": "2019-06-15 05:30:14",
  632. "osversion": "5.1",
  633. "sections": [
  634. {
  635. "name": "UPX0",
  636. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  637. "virtual_address": "0x00001000",
  638. "size_of_data": "0x00000000",
  639. "entropy": "0.00",
  640. "raw_address": "0x00000400",
  641. "virtual_size": "0x0007d000",
  642. "characteristics_raw": "0xe0000080"
  643. },
  644. {
  645. "name": "UPX1",
  646. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  647. "virtual_address": "0x0007e000",
  648. "size_of_data": "0x00021a00",
  649. "entropy": "7.94",
  650. "raw_address": "0x00000400",
  651. "virtual_size": "0x00022000",
  652. "characteristics_raw": "0xe0000040"
  653. },
  654. {
  655. "name": ".rsrc",
  656. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  657. "virtual_address": "0x000a0000",
  658. "size_of_data": "0x0005ae00",
  659. "entropy": "1.66",
  660. "raw_address": "0x00021e00",
  661. "virtual_size": "0x0005b000",
  662. "characteristics_raw": "0xc0000040"
  663. }
  664. ],
  665. "resources": [
  666. {
  667. "name": "YTIJV",
  668. "language": "LANG_NEUTRAL",
  669. "filetype": null,
  670. "sublanguage": "SUBLANG_NEUTRAL",
  671. "entropy": "0.00",
  672. "offset": "0x0003f2c0",
  673. "size": "0x00000189"
  674. },
  675. {
  676. "name": "YTIJV",
  677. "language": "LANG_NEUTRAL",
  678. "filetype": null,
  679. "sublanguage": "SUBLANG_NEUTRAL",
  680. "entropy": "0.00",
  681. "offset": "0x0003f2c0",
  682. "size": "0x00000189"
  683. }
  684. ],
  685. "dirents": [
  686. {
  687. "virtual_address": "0x00000000",
  688. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  689. "size": "0x00000000"
  690. },
  691. {
  692. "virtual_address": "0x000fac50",
  693. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  694. "size": "0x0000011c"
  695. },
  696. {
  697. "virtual_address": "0x000a0000",
  698. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  699. "size": "0x0005ac50"
  700. },
  701. {
  702. "virtual_address": "0x00000000",
  703. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  704. "size": "0x00000000"
  705. },
  706. {
  707. "virtual_address": "0x00000000",
  708. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  709. "size": "0x00000000"
  710. },
  711. {
  712. "virtual_address": "0x000fad6c",
  713. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  714. "size": "0x00000010"
  715. },
  716. {
  717. "virtual_address": "0x00000000",
  718. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  719. "size": "0x00000000"
  720. },
  721. {
  722. "virtual_address": "0x00000000",
  723. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  724. "size": "0x00000000"
  725. },
  726. {
  727. "virtual_address": "0x00000000",
  728. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  729. "size": "0x00000000"
  730. },
  731. {
  732. "virtual_address": "0x00000000",
  733. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  734. "size": "0x00000000"
  735. },
  736. {
  737. "virtual_address": "0x0009f7e4",
  738. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  739. "size": "0x0000005c"
  740. },
  741. {
  742. "virtual_address": "0x00000000",
  743. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  744. "size": "0x00000000"
  745. },
  746. {
  747. "virtual_address": "0x00000000",
  748. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  749. "size": "0x00000000"
  750. },
  751. {
  752. "virtual_address": "0x00000000",
  753. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  754. "size": "0x00000000"
  755. },
  756. {
  757. "virtual_address": "0x00000000",
  758. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  759. "size": "0x00000000"
  760. },
  761. {
  762. "virtual_address": "0x00000000",
  763. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  764. "size": "0x00000000"
  765. }
  766. ],
  767. "exports": [],
  768. "guest_signers": {},
  769. "imphash": "4d1183fbed53283bb2ceb0499e480476",
  770. "icon_fuzzy": null,
  771. "icon": null,
  772. "pdbpath": null,
  773. "imported_dll_count": 4,
  774. "versioninfo": []
  775. }
  776. }
  777.  
  778. [*] Resolved APIs: [
  779. "kernel32.dll.CompareStringW",
  780. "kernel32.dll.LCMapStringW",
  781. "kernel32.dll.SetStdHandle",
  782. "kernel32.dll.GetFileType",
  783. "kernel32.dll.GetStringTypeW",
  784. "kernel32.dll.GetProcessHeap",
  785. "kernel32.dll.HeapSize",
  786. "kernel32.dll.HeapReAlloc",
  787. "kernel32.dll.FlushFileBuffers",
  788. "kernel32.dll.GetConsoleCP",
  789. "kernel32.dll.GetConsoleMode",
  790. "kernel32.dll.SetFilePointerEx",
  791. "kernel32.dll.WriteConsoleW",
  792. "kernel32.dll.CreateFileW",
  793. "kernel32.dll.LoadLibraryA",
  794. "kernel32.dll.VirtualProtect",
  795. "kernel32.dll.QueryPerformanceCounter",
  796. "kernel32.dll.GetCurrentProcessId",
  797. "kernel32.dll.GetCurrentThreadId",
  798. "kernel32.dll.GetSystemTimeAsFileTime",
  799. "kernel32.dll.InitializeSListHead",
  800. "kernel32.dll.IsDebuggerPresent",
  801. "kernel32.dll.UnhandledExceptionFilter",
  802. "kernel32.dll.SetUnhandledExceptionFilter",
  803. "kernel32.dll.GetStartupInfoW",
  804. "kernel32.dll.IsProcessorFeaturePresent",
  805. "kernel32.dll.GetModuleHandleW",
  806. "kernel32.dll.GetCurrentProcess",
  807. "kernel32.dll.TerminateProcess",
  808. "kernel32.dll.RtlUnwind",
  809. "kernel32.dll.GetLastError",
  810. "kernel32.dll.SetLastError",
  811. "kernel32.dll.EnterCriticalSection",
  812. "kernel32.dll.LeaveCriticalSection",
  813. "kernel32.dll.DeleteCriticalSection",
  814. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  815. "kernel32.dll.TlsAlloc",
  816. "kernel32.dll.TlsGetValue",
  817. "kernel32.dll.TlsSetValue",
  818. "kernel32.dll.TlsFree",
  819. "kernel32.dll.FreeLibrary",
  820. "kernel32.dll.GetProcAddress",
  821. "kernel32.dll.LoadLibraryExW",
  822. "kernel32.dll.GetStdHandle",
  823. "kernel32.dll.WriteFile",
  824. "kernel32.dll.GetModuleFileNameA",
  825. "kernel32.dll.MultiByteToWideChar",
  826. "kernel32.dll.WideCharToMultiByte",
  827. "kernel32.dll.ExitProcess",
  828. "kernel32.dll.GetModuleHandleExW",
  829. "kernel32.dll.GetCommandLineA",
  830. "kernel32.dll.GetCommandLineW",
  831. "kernel32.dll.GetACP",
  832. "kernel32.dll.HeapFree",
  833. "kernel32.dll.HeapAlloc",
  834. "kernel32.dll.CloseHandle",
  835. "kernel32.dll.FindClose",
  836. "kernel32.dll.FindFirstFileExA",
  837. "kernel32.dll.FindNextFileA",
  838. "kernel32.dll.IsValidCodePage",
  839. "kernel32.dll.GetOEMCP",
  840. "kernel32.dll.GetCPInfo",
  841. "kernel32.dll.GetEnvironmentStringsW",
  842. "kernel32.dll.FreeEnvironmentStringsW",
  843. "kernel32.dll.SetEnvironmentVariableA",
  844. "kernel32.dll.RaiseException",
  845. "crypt32.dll.CertVerifyCRLRevocation",
  846. "crypt32.dll.CryptEncryptMessage",
  847. "crypt32.dll.CryptUnregisterOIDFunction",
  848. "crypt32.dll.CertCompareIntegerBlob",
  849. "crypt32.dll.CryptExportPublicKeyInfo",
  850. "crypt32.dll.CryptGetMessageCertificates",
  851. "crypt32.dll.CryptMsgGetAndVerifySigner",
  852. "crypt32.dll.CryptMsgCountersignEncoded",
  853. "crypt32.dll.CertVerifyCTLUsage",
  854. "crypt32.dll.CryptMsgVerifyCountersignatureEncoded",
  855. "crypt32.dll.CertStrToNameA",
  856. "crypt32.dll.CertAddEncodedCTLToStore",
  857. "crypt32.dll.CryptVerifyMessageSignatureWithKey",
  858. "crypt32.dll.CertOpenSystemStoreW",
  859. "crypt32.dll.CertSerializeCertificateStoreElement",
  860. "crypt32.dll.CertGetIssuerCertificateFromStore",
  861. "crypt32.dll.CertComparePublicKeyInfo",
  862. "crypt32.dll.CertSetCTLContextProperty",
  863. "glu32.dll.gluEndCurve",
  864. "glu32.dll.gluNurbsSurface",
  865. "glu32.dll.gluUnProject",
  866. "glu32.dll.gluBuild2DMipmaps",
  867. "glu32.dll.gluGetNurbsProperty",
  868. "glu32.dll.gluBeginTrim",
  869. "glu32.dll.gluSphere",
  870. "glu32.dll.gluQuadricCallback",
  871. "glu32.dll.gluLoadSamplingMatrices",
  872. "glu32.dll.gluNurbsProperty",
  873. "glu32.dll.gluTessProperty",
  874. "glu32.dll.gluTessCallback",
  875. "glu32.dll.gluTessEndPolygon",
  876. "glu32.dll.gluErrorString",
  877. "glu32.dll.gluQuadricNormals",
  878. "glu32.dll.gluEndTrim",
  879. "glu32.dll.gluBeginCurve",
  880. "glu32.dll.gluScaleImage",
  881. "wsock32.dll.#13",
  882. "wsock32.dll.#56",
  883. "wsock32.dll.#1140",
  884. "wsock32.dll.#1113",
  885. "wsock32.dll.#19",
  886. "wsock32.dll.#1107",
  887. "wsock32.dll.#116",
  888. "wsock32.dll.#111",
  889. "wsock32.dll.#11",
  890. "wsock32.dll.#3",
  891. "wsock32.dll.#1116",
  892. "wsock32.dll.#55",
  893. "wsock32.dll.#1119",
  894. "wsock32.dll.#22",
  895. "wsock32.dll.#18",
  896. "wsock32.dll.#112",
  897. "wsock32.dll.#53",
  898. "wsock32.dll.#6",
  899. "wsock32.dll.#109",
  900. "wsock32.dll.#12",
  901. "wsock32.dll.#1117",
  902. "wsock32.dll.#10",
  903. "kernel32.dll.FlsAlloc",
  904. "kernel32.dll.FlsSetValue",
  905. "kernel32.dll.FlsGetValue",
  906. "kernel32.dll.LCMapStringEx",
  907. "cryptsp.dll.CryptAcquireContextW",
  908. "cryptsp.dll.CryptCreateHash",
  909. "cryptsp.dll.CryptHashData",
  910. "cryptsp.dll.CryptGetHashParam",
  911. "cryptsp.dll.CryptDestroyHash",
  912. "cryptsp.dll.CryptReleaseContext",
  913. "vaultcli.dll.VaultEnumerateItems",
  914. "vaultcli.dll.VaultEnumerateVaults",
  915. "vaultcli.dll.VaultFree",
  916. "vaultcli.dll.VaultGetItem",
  917. "vaultcli.dll.VaultOpenVault",
  918. "vaultcli.dll.VaultCloseVault",
  919. "sechost.dll.LookupAccountSidLocalW",
  920. "netapi32.dll.NetUserGetInfo",
  921. "cryptsp.dll.CryptImportKey",
  922. "cryptsp.dll.CryptSetKeyParam",
  923. "cryptsp.dll.CryptDecrypt",
  924. "cryptsp.dll.CryptDestroyKey",
  925. "ole32.dll.CoInitializeEx",
  926. "cryptbase.dll.SystemFunction036",
  927. "ole32.dll.CoInitializeSecurity",
  928. "sechost.dll.LookupAccountNameLocalW",
  929. "advapi32.dll.LookupAccountSidW",
  930. "ole32.dll.CoCreateInstance",
  931. "kernel32.dll.SortGetHandle",
  932. "kernel32.dll.SortCloseHandle",
  933. "w32time.dll.SvchostEntry_W32Time",
  934. "w32time.dll.SvchostPushServiceGlobals",
  935. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  936. "ws2_32.dll.#115",
  937. "ws2_32.dll.WSASocketW",
  938. "ws2_32.dll.WSAIoctl",
  939. "ws2_32.dll.#111",
  940. "userenv.dll.RegisterGPNotification",
  941. "gpapi.dll.RegisterGPNotificationInternal",
  942. "sechost.dll.OpenSCManagerW",
  943. "sechost.dll.OpenServiceW",
  944. "sechost.dll.CloseServiceHandle",
  945. "sechost.dll.QueryServiceConfigW",
  946. "dsrole.dll.DsRoleGetPrimaryDomainInformation",
  947. "dsrole.dll.DsRoleFreeMemory",
  948. "sspicli.dll.LsaRegisterPolicyChangeNotification",
  949. "w32time.dll.TimeProvClose",
  950. "w32time.dll.TimeProvCommand",
  951. "w32time.dll.TimeProvOpen",
  952. "ws2_32.dll.getaddrinfo",
  953. "ws2_32.dll.freeaddrinfo",
  954. "ws2_32.dll.#23",
  955. "ws2_32.dll.#21",
  956. "ws2_32.dll.#2",
  957. "ws2_32.dll.WSAEventSelect",
  958. "ws2_32.dll.GetAddrInfoW",
  959. "vmictimeprovider.dll.TimeProvClose",
  960. "vmictimeprovider.dll.TimeProvCommand",
  961. "vmictimeprovider.dll.TimeProvOpen",
  962. "advapi32.dll.EventRegister",
  963. "advapi32.dll.EventEnabled",
  964. "advapi32.dll.EventWrite",
  965. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  966. "ws2_32.dll.FreeAddrInfoW",
  967. "ws2_32.dll.WSAAddressToStringW",
  968. "ws2_32.dll.#3",
  969. "ws2_32.dll.#116",
  970. "advapi32.dll.EventUnregister",
  971. "sspicli.dll.LsaUnregisterPolicyChangeNotification",
  972. "userenv.dll.UnregisterGPNotification",
  973. "gpapi.dll.UnregisterGPNotificationInternal",
  974. "kernel32.dll.InitializeCriticalSectionEx",
  975. "kernel32.dll.FlsFree",
  976. "kernel32.dll.InitOnceExecuteOnce",
  977. "kernel32.dll.CreateEventExW",
  978. "kernel32.dll.CreateSemaphoreW",
  979. "kernel32.dll.CreateSemaphoreExW",
  980. "kernel32.dll.CreateThreadpoolTimer",
  981. "kernel32.dll.SetThreadpoolTimer",
  982. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  983. "kernel32.dll.CloseThreadpoolTimer",
  984. "kernel32.dll.CreateThreadpoolWait",
  985. "kernel32.dll.SetThreadpoolWait",
  986. "kernel32.dll.CloseThreadpoolWait",
  987. "kernel32.dll.FlushProcessWriteBuffers",
  988. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  989. "kernel32.dll.GetCurrentProcessorNumber",
  990. "kernel32.dll.CreateSymbolicLinkW",
  991. "kernel32.dll.GetTickCount64",
  992. "kernel32.dll.GetFileInformationByHandleEx",
  993. "kernel32.dll.SetFileInformationByHandle",
  994. "kernel32.dll.InitializeConditionVariable",
  995. "kernel32.dll.WakeConditionVariable",
  996. "kernel32.dll.WakeAllConditionVariable",
  997. "kernel32.dll.SleepConditionVariableCS",
  998. "kernel32.dll.InitializeSRWLock",
  999. "kernel32.dll.AcquireSRWLockExclusive",
  1000. "kernel32.dll.TryAcquireSRWLockExclusive",
  1001. "kernel32.dll.ReleaseSRWLockExclusive",
  1002. "kernel32.dll.SleepConditionVariableSRW",
  1003. "kernel32.dll.CreateThreadpoolWork",
  1004. "kernel32.dll.SubmitThreadpoolWork",
  1005. "kernel32.dll.CloseThreadpoolWork",
  1006. "kernel32.dll.CompareStringEx",
  1007. "kernel32.dll.GetLocaleInfoEx",
  1008. "goopdate.dll.DllEntry",
  1009. "kernel32.dll.RtlCaptureStackBackTrace",
  1010. "wkscli.dll.NetWkstaGetInfo",
  1011. "cscapi.dll.CscNetApiGetInterface",
  1012. "ntmarta.dll.GetMartaExtensionInterface",
  1013. "kernel32.dll.CreateMutexExW",
  1014. "dbghelp.dll.MiniDumpWriteDump",
  1015. "rpcrt4.dll.UuidCreate",
  1016. "cryptsp.dll.CryptGenRandom",
  1017. "ole32.dll.CoGetClassObject",
  1018. "ole32.dll.CoGetMarshalSizeMax",
  1019. "ole32.dll.CoMarshalInterface",
  1020. "ole32.dll.CoUnmarshalInterface",
  1021. "ole32.dll.StringFromIID",
  1022. "ole32.dll.CoGetPSClsid",
  1023. "ole32.dll.CoTaskMemAlloc",
  1024. "ole32.dll.CoTaskMemFree",
  1025. "ole32.dll.CoReleaseMarshalData",
  1026. "ole32.dll.DcomChannelSetHResult",
  1027. "psmachine.dll.DllGetClassObject",
  1028. "psmachine.dll.DllCanUnloadNow",
  1029. "advapi32.dll.RegOpenKeyW",
  1030. "ntdll.dll.RtlGetVersion",
  1031. "kernel32.dll.GetNativeSystemInfo",
  1032. "winhttp.dll.WinHttpAddRequestHeaders",
  1033. "winhttp.dll.WinHttpCheckPlatform",
  1034. "winhttp.dll.WinHttpCloseHandle",
  1035. "winhttp.dll.WinHttpConnect",
  1036. "winhttp.dll.WinHttpCrackUrl",
  1037. "winhttp.dll.WinHttpCreateUrl",
  1038. "winhttp.dll.WinHttpDetectAutoProxyConfigUrl",
  1039. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1040. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1041. "winhttp.dll.WinHttpGetProxyForUrl",
  1042. "winhttp.dll.WinHttpOpen",
  1043. "winhttp.dll.WinHttpOpenRequest",
  1044. "winhttp.dll.WinHttpQueryAuthSchemes",
  1045. "winhttp.dll.WinHttpQueryDataAvailable",
  1046. "winhttp.dll.WinHttpQueryHeaders",
  1047. "winhttp.dll.WinHttpQueryOption",
  1048. "winhttp.dll.WinHttpReadData",
  1049. "winhttp.dll.WinHttpReceiveResponse",
  1050. "winhttp.dll.WinHttpSendRequest",
  1051. "winhttp.dll.WinHttpSetDefaultProxyConfiguration",
  1052. "winhttp.dll.WinHttpSetCredentials",
  1053. "winhttp.dll.WinHttpSetOption",
  1054. "winhttp.dll.WinHttpSetStatusCallback",
  1055. "winhttp.dll.WinHttpSetTimeouts",
  1056. "winhttp.dll.WinHttpWriteData",
  1057. "shlwapi.dll.StrCmpNW",
  1058. "shlwapi.dll.#153",
  1059. "ws2_32.dll.#9",
  1060. "ws2_32.dll.#6",
  1061. "ws2_32.dll.#5",
  1062. "schannel.dll.SpUserModeInitialize",
  1063. "advapi32.dll.RegCreateKeyExW",
  1064. "advapi32.dll.RegQueryValueExW",
  1065. "advapi32.dll.RegCloseKey",
  1066. "ws2_32.dll.WSASend",
  1067. "ws2_32.dll.WSARecv",
  1068. "advapi32.dll.RevertToSelf",
  1069. "secur32.dll.FreeContextBuffer",
  1070. "ncrypt.dll.SslOpenProvider",
  1071. "ncrypt.dll.GetSChannelInterface",
  1072. "bcryptprimitives.dll.GetHashInterface",
  1073. "ncrypt.dll.SslIncrementProviderReferenceCount",
  1074. "ncrypt.dll.SslImportKey",
  1075. "bcryptprimitives.dll.GetCipherInterface",
  1076. "ncrypt.dll.SslLookupCipherSuiteInfo",
  1077. "user32.dll.LoadStringW",
  1078. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  1079. "ncrypt.dll.BCryptGetProperty",
  1080. "ncrypt.dll.BCryptCreateHash",
  1081. "ncrypt.dll.BCryptHashData",
  1082. "ncrypt.dll.BCryptFinishHash",
  1083. "ncrypt.dll.BCryptDestroyHash",
  1084. "crypt32.dll.CertGetCertificateChain",
  1085. "userenv.dll.GetUserProfileDirectoryW",
  1086. "sechost.dll.ConvertSidToStringSidW",
  1087. "sechost.dll.ConvertStringSidToSidW",
  1088. "winsta.dll.WinStationRegisterNotificationEvent",
  1089. "advapi32.dll.CreateWellKnownSid",
  1090. "rpcrt4.dll.RpcStringBindingComposeW",
  1091. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1092. "rpcrt4.dll.RpcStringFreeW",
  1093. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1094. "rpcrt4.dll.RpcAsyncInitializeHandle",
  1095. "rpcrt4.dll.NdrClientCall2",
  1096. "rpcrt4.dll.NdrAsyncClientCall",
  1097. "cryptsp.dll.CryptAcquireContextA",
  1098. "cryptsp.dll.CryptVerifySignatureA",
  1099. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  1100. "ncrypt.dll.BCryptImportKeyPair",
  1101. "ncrypt.dll.BCryptVerifySignature",
  1102. "ncrypt.dll.BCryptDestroyKey",
  1103. "crypt32.dll.CertVerifyCertificateChainPolicy",
  1104. "crypt32.dll.CertFreeCertificateChain",
  1105. "crypt32.dll.CertDuplicateCertificateContext",
  1106. "ncrypt.dll.SslEncryptPacket",
  1107. "ncrypt.dll.SslDecryptPacket",
  1108. "kernel32.dll.WTSGetActiveConsoleSessionId",
  1109. "winsta.dll.WinStationQueryInformationW",
  1110. "rpcrt4.dll.I_RpcExceptionFilter",
  1111. "rpcrt4.dll.RpcBindingFree",
  1112. "kernel32.dll.IsWow64Process",
  1113. "psapi.dll.GetProcessImageFileNameW",
  1114. "oleaut32.dll.#500",
  1115. "crypt32.dll.CertFreeCertificateContext",
  1116. "ncrypt.dll.SslFreeObject"
  1117. ]
  1118.  
  1119. [*] Static Analysis: {
  1120. "pe": {
  1121. "peid_signatures": null,
  1122. "imports": [
  1123. {
  1124. "imports": [
  1125. {
  1126. "name": "CertStrToNameA",
  1127. "address": "0x4facb4"
  1128. }
  1129. ],
  1130. "dll": "CRYPT32.dll"
  1131. },
  1132. {
  1133. "imports": [
  1134. {
  1135. "name": "gluSphere",
  1136. "address": "0x4facbc"
  1137. }
  1138. ],
  1139. "dll": "GLU32.dll"
  1140. },
  1141. {
  1142. "imports": [
  1143. {
  1144. "name": "LoadLibraryA",
  1145. "address": "0x4facc4"
  1146. },
  1147. {
  1148. "name": "ExitProcess",
  1149. "address": "0x4facc8"
  1150. },
  1151. {
  1152. "name": "GetProcAddress",
  1153. "address": "0x4faccc"
  1154. },
  1155. {
  1156. "name": "VirtualProtect",
  1157. "address": "0x4facd0"
  1158. }
  1159. ],
  1160. "dll": "KERNEL32.DLL"
  1161. },
  1162. {
  1163. "imports": [
  1164. {
  1165. "name": "ioctlsocket",
  1166. "address": "0x4facd8"
  1167. }
  1168. ],
  1169. "dll": "WSOCK32.dll"
  1170. }
  1171. ],
  1172. "digital_signers": null,
  1173. "exported_dll_name": null,
  1174. "actual_checksum": "0x0007d674",
  1175. "overlay": null,
  1176. "imagebase": "0x00400000",
  1177. "reported_checksum": "0x00000000",
  1178. "icon_hash": null,
  1179. "entrypoint": "0x0049f600",
  1180. "timestamp": "2019-06-15 05:30:14",
  1181. "osversion": "5.1",
  1182. "sections": [
  1183. {
  1184. "name": "UPX0",
  1185. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1186. "virtual_address": "0x00001000",
  1187. "size_of_data": "0x00000000",
  1188. "entropy": "0.00",
  1189. "raw_address": "0x00000400",
  1190. "virtual_size": "0x0007d000",
  1191. "characteristics_raw": "0xe0000080"
  1192. },
  1193. {
  1194. "name": "UPX1",
  1195. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1196. "virtual_address": "0x0007e000",
  1197. "size_of_data": "0x00021a00",
  1198. "entropy": "7.94",
  1199. "raw_address": "0x00000400",
  1200. "virtual_size": "0x00022000",
  1201. "characteristics_raw": "0xe0000040"
  1202. },
  1203. {
  1204. "name": ".rsrc",
  1205. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1206. "virtual_address": "0x000a0000",
  1207. "size_of_data": "0x0005ae00",
  1208. "entropy": "1.66",
  1209. "raw_address": "0x00021e00",
  1210. "virtual_size": "0x0005b000",
  1211. "characteristics_raw": "0xc0000040"
  1212. }
  1213. ],
  1214. "resources": [
  1215. {
  1216. "name": "YTIJV",
  1217. "language": "LANG_NEUTRAL",
  1218. "filetype": null,
  1219. "sublanguage": "SUBLANG_NEUTRAL",
  1220. "entropy": "0.00",
  1221. "offset": "0x0003f2c0",
  1222. "size": "0x00000189"
  1223. },
  1224. {
  1225. "name": "YTIJV",
  1226. "language": "LANG_NEUTRAL",
  1227. "filetype": null,
  1228. "sublanguage": "SUBLANG_NEUTRAL",
  1229. "entropy": "0.00",
  1230. "offset": "0x0003f2c0",
  1231. "size": "0x00000189"
  1232. }
  1233. ],
  1234. "dirents": [
  1235. {
  1236. "virtual_address": "0x00000000",
  1237. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1238. "size": "0x00000000"
  1239. },
  1240. {
  1241. "virtual_address": "0x000fac50",
  1242. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1243. "size": "0x0000011c"
  1244. },
  1245. {
  1246. "virtual_address": "0x000a0000",
  1247. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1248. "size": "0x0005ac50"
  1249. },
  1250. {
  1251. "virtual_address": "0x00000000",
  1252. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1253. "size": "0x00000000"
  1254. },
  1255. {
  1256. "virtual_address": "0x00000000",
  1257. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1258. "size": "0x00000000"
  1259. },
  1260. {
  1261. "virtual_address": "0x000fad6c",
  1262. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1263. "size": "0x00000010"
  1264. },
  1265. {
  1266. "virtual_address": "0x00000000",
  1267. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1268. "size": "0x00000000"
  1269. },
  1270. {
  1271. "virtual_address": "0x00000000",
  1272. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1273. "size": "0x00000000"
  1274. },
  1275. {
  1276. "virtual_address": "0x00000000",
  1277. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1278. "size": "0x00000000"
  1279. },
  1280. {
  1281. "virtual_address": "0x00000000",
  1282. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1283. "size": "0x00000000"
  1284. },
  1285. {
  1286. "virtual_address": "0x0009f7e4",
  1287. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1288. "size": "0x0000005c"
  1289. },
  1290. {
  1291. "virtual_address": "0x00000000",
  1292. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1293. "size": "0x00000000"
  1294. },
  1295. {
  1296. "virtual_address": "0x00000000",
  1297. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1298. "size": "0x00000000"
  1299. },
  1300. {
  1301. "virtual_address": "0x00000000",
  1302. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1303. "size": "0x00000000"
  1304. },
  1305. {
  1306. "virtual_address": "0x00000000",
  1307. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1308. "size": "0x00000000"
  1309. },
  1310. {
  1311. "virtual_address": "0x00000000",
  1312. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1313. "size": "0x00000000"
  1314. }
  1315. ],
  1316. "exports": [],
  1317. "guest_signers": {},
  1318. "imphash": "4d1183fbed53283bb2ceb0499e480476",
  1319. "icon_fuzzy": null,
  1320. "icon": null,
  1321. "pdbpath": null,
  1322. "imported_dll_count": 4,
  1323. "versioninfo": []
  1324. }
  1325. }
  1326.  
  1327. ": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1328. "size": "0x00000000"
  1329. },
  1330. {
  1331. "virtual_address": "0x000fad6c",
  1332. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1333. "size": "0x00000010"
  1334. },
  1335. {
  1336. "virtual_address": "0x00000000",
  1337. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1338. "size": "0x00000000"
  1339. },
  1340. {
  1341. "virtual_address": "0x00000000",
  1342. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1343. "size": "0x00000000"
  1344. },
  1345. {
  1346. "virtual_address": "0x00000000",
  1347. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1348. "size": "0x00000000"
  1349. },
  1350. {
  1351. "virtual_address": "0x00000000",
  1352. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1353. "size": "0x00000000"
  1354. },
  1355. {
  1356. "virtual_address": "0x0009f7e4",
  1357. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1358. "size": "0x0000005c"
  1359. },
  1360. {
  1361. "virtual_address": "0x00000000",
  1362. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1363. "size": "0x00000000"
  1364. },
  1365. {
  1366. "virtual_address": "0x00000000",
  1367. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1368. "size": "0x00000000"
  1369. },
  1370. {
  1371. "virtual_address": "0x00000000",
  1372. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1373. "size": "0x00000000"
  1374. },
  1375. {
  1376. "virtual_address": "0x00000000",
  1377. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1378. "size": "0x00000000"
  1379. },
  1380. {
  1381. "virtual_address": "0x00000000",
  1382. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1383. "size": "0x00000000"
  1384. }
  1385. ],
  1386. "exports": [],
  1387. "guest_signers": {},
  1388. "imphash": "4d1183fbed53283bb2ceb0499e480476",
  1389. "icon_fuzzy": null,
  1390. "icon": null,
  1391. "pdbpath": null,
  1392. "imported_dll_count": 4,
  1393. "versioninfo": []
  1394. }
  1395. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!