API tools faq
paste
paladin316

1_exe_2019-07-03_20_30.json

paladin316
Jul 3rd, 2019
2,097
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 18.87 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Razy"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "1.exe"
  7. [*] File Size: 196096
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "9d69be25c3d6baa85cc73ef8c915946f429ab34afda067a0a0be5e62c1da1691"
  10. [*] MD5: "0e0cdca03771f6c187132f147674a7d0"
  11. [*] SHA1: "1315c68e748dc3a72578899f5a525263d0a3c6a9"
  12. [*] SHA512: "3d7989190d4ad4b8d22a4ae6ac69e6991d41390bb86545edd4854352489841e737b224e7fe912abd9425da82b7b3d2fba76f64e3188b234f35b572c0d2a89fae"
  13. [*] CRC32: "8C5E91E9"
  14. [*] SSDEEP: "3072:msl2l021LkRUlVopzOju833+a9xk5GhnIwyiSoic1ogIDzSK1XzcdlgfiI5oP2CD:mVOZiVopM9xksC3oirFcdVI5oPz8rv"
  15.  
  16. [*] Process Execution: [
  17. "1.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "The binary likely contains encrypted or compressed data.",
  23. "Details": [
  24. {
  25. "section": "name: .text, entropy: 6.81, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0002ec00, virtual_size: 0x0002eb04"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "File has been identified by 53 Antiviruses on VirusTotal as malicious",
  31. "Details": [
  32. {
  33. "MicroWorld-eScan": "Gen:Variant.Razy.506926"
  34. },
  35. {
  36. "FireEye": "Gen:Variant.Razy.506926"
  37. },
  38. {
  39. "CAT-QuickHeal": "Trojan.Multi"
  40. },
  41. {
  42. "ALYac": "Gen:Variant.Razy.506926"
  43. },
  44. {
  45. "Malwarebytes": "Spyware.PasswordStealer"
  46. },
  47. {
  48. "Alibaba": "Trojan:MSIL/Generic.f64c8f1e"
  49. },
  50. {
  51. "K7GW": "Password-Stealer ( 0054780e1 )"
  52. },
  53. {
  54. "K7AntiVirus": "Password-Stealer ( 0054780e1 )"
  55. },
  56. {
  57. "Arcabit": "Trojan.Razy.D7BC2E"
  58. },
  59. {
  60. "TrendMicro": "TROJ_GEN.R002C0WF519"
  61. },
  62. {
  63. "NANO-Antivirus": "Trojan.Win32.Cordis.frcjwc"
  64. },
  65. {
  66. "Symantec": "Trojan.Gen.MBT"
  67. },
  68. {
  69. "APEX": "Malicious"
  70. },
  71. {
  72. "Paloalto": "generic.ml"
  73. },
  74. {
  75. "Kaspersky": "HEUR:Trojan-PSW.MSIL.Cordis.gen"
  76. },
  77. {
  78. "BitDefender": "Gen:Variant.Razy.506926"
  79. },
  80. {
  81. "AegisLab": "Trojan.Multi.Generic.4!c"
  82. },
  83. {
  84. "Avast": "Win32:Trojan-gen"
  85. },
  86. {
  87. "Tencent": "Msil.Trojan-qqpass.Qqrob.Fii"
  88. },
  89. {
  90. "Ad-Aware": "Gen:Variant.Razy.506926"
  91. },
  92. {
  93. "Sophos": "Mal/Generic-S"
  94. },
  95. {
  96. "Comodo": "Malware@#w6q9p6070sg6"
  97. },
  98. {
  99. "F-Secure": "Trojan.TR/Dropper.Gen"
  100. },
  101. {
  102. "DrWeb": "Trojan.PWS.Siggen2.17538"
  103. },
  104. {
  105. "Invincea": "heuristic"
  106. },
  107. {
  108. "McAfee-GW-Edition": "Artemis!Trojan"
  109. },
  110. {
  111. "Trapmine": "malicious.moderate.ml.score"
  112. },
  113. {
  114. "Emsisoft": "Gen:Variant.Razy.506926 (B)"
  115. },
  116. {
  117. "Ikarus": "Trojan.MSIL.Spy"
  118. },
  119. {
  120. "Cyren": "W32/Trojan.CKHX-7821"
  121. },
  122. {
  123. "ESET-NOD32": "a variant of MSIL/PSW.Agent.RCD"
  124. },
  125. {
  126. "Avira": "TR/Dropper.Gen"
  127. },
  128. {
  129. "MAX": "malware (ai score=100)"
  130. },
  131. {
  132. "Microsoft": "Trojan:Win32/Occamy.C"
  133. },
  134. {
  135. "Endgame": "malicious (high confidence)"
  136. },
  137. {
  138. "ViRobot": "Trojan.Win32.Z.Razy.196096.AQ"
  139. },
  140. {
  141. "ZoneAlarm": "HEUR:Trojan-PSW.MSIL.Cordis.gen"
  142. },
  143. {
  144. "GData": "Gen:Variant.Razy.506926"
  145. },
  146. {
  147. "AhnLab-V3": "Trojan/Win32.Agent.C2926564"
  148. },
  149. {
  150. "Acronis": "suspicious"
  151. },
  152. {
  153. "McAfee": "RDN/Generic PWS.y"
  154. },
  155. {
  156. "VBA32": "TScope.Trojan.MSIL"
  157. },
  158. {
  159. "Cylance": "Unsafe"
  160. },
  161. {
  162. "TrendMicro-HouseCall": "TROJ_GEN.R002C0WF519"
  163. },
  164. {
  165. "Rising": "Stealer.Agent!8.C2 (CLOUD)"
  166. },
  167. {
  168. "SentinelOne": "DFI - Malicious PE"
  169. },
  170. {
  171. "MaxSecure": "Trojan.Malware.73723072.susgen"
  172. },
  173. {
  174. "Fortinet": "MSIL/Agent.RCD!tr.pws"
  175. },
  176. {
  177. "AVG": "Win32:Trojan-gen"
  178. },
  179. {
  180. "Cybereason": "malicious.03771f"
  181. },
  182. {
  183. "Panda": "Trj/GdSda.A"
  184. },
  185. {
  186. "CrowdStrike": "win/malicious_confidence_90% (W)"
  187. },
  188. {
  189. "Qihoo-360": "Win32/Trojan.PSW.10c"
  190. }
  191. ]
  192. }
  193. ]
  194.  
  195. [*] Started Service: []
  196.  
  197. [*] Executed Commands: []
  198.  
  199. [*] Mutexes: []
  200.  
  201. [*] Modified Files: []
  202.  
  203. [*] Deleted Files: []
  204.  
  205. [*] Modified Registry Keys: []
  206.  
  207. [*] Deleted Registry Keys: []
  208.  
  209. [*] DNS Communications: []
  210.  
  211. [*] Domains: []
  212.  
  213. [*] Network Communication - ICMP: []
  214.  
  215. [*] Network Communication - HTTP: []
  216.  
  217. [*] Network Communication - SMTP: []
  218.  
  219. [*] Network Communication - Hosts: []
  220.  
  221. [*] Network Communication - IRC: []
  222.  
  223. [*] Static Analysis: {
  224. "dotnet": {
  225. "customattrs": null,
  226. "assemblyinfo": {
  227. "version": "1.0.0.0",
  228. "name": "file"
  229. },
  230. "assemblyrefs": [
  231. {
  232. "version": "4.0.0.0",
  233. "name": "mscorlib"
  234. },
  235. {
  236. "version": "65535.65535.65535.65535",
  237. "name": "mscorlib"
  238. },
  239. {
  240. "version": "4.0.0.0",
  241. "name": "System.Drawing"
  242. },
  243. {
  244. "version": "4.0.0.0",
  245. "name": "System.Management"
  246. },
  247. {
  248. "version": "4.0.0.0",
  249. "name": "System"
  250. },
  251. {
  252. "version": "4.0.0.0",
  253. "name": "System.Xml"
  254. },
  255. {
  256. "version": "4.0.0.0",
  257. "name": "System.Windows.Forms"
  258. },
  259. {
  260. "version": "4.0.0.0",
  261. "name": "System.IO.Compression.FileSystem"
  262. },
  263. {
  264. "version": "4.0.0.0",
  265. "name": "System.Core"
  266. }
  267. ],
  268. "typerefs": []
  269. },
  270. "pe": {
  271. "peid_signatures": null,
  272. "imports": [
  273. {
  274. "imports": [
  275. {
  276. "name": "_CorExeMain",
  277. "address": "0x402000"
  278. }
  279. ],
  280. "dll": "mscoree.dll"
  281. }
  282. ],
  283. "digital_signers": null,
  284. "exported_dll_name": null,
  285. "actual_checksum": "0x0003f8e0",
  286. "overlay": null,
  287. "imagebase": "0x00400000",
  288. "reported_checksum": "0x0003f8e0",
  289. "icon_hash": null,
  290. "entrypoint": "0x00430afe",
  291. "timestamp": "2019-06-04 10:42:06",
  292. "osversion": "4.0",
  293. "sections": [
  294. {
  295. "name": ".text",
  296. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  297. "virtual_address": "0x00002000",
  298. "size_of_data": "0x0002ec00",
  299. "entropy": "6.81",
  300. "raw_address": "0x00000400",
  301. "virtual_size": "0x0002eb04",
  302. "characteristics_raw": "0x60000020"
  303. },
  304. {
  305. "name": ".sdata",
  306. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  307. "virtual_address": "0x00032000",
  308. "size_of_data": "0x00000200",
  309. "entropy": "6.70",
  310. "raw_address": "0x0002f000",
  311. "virtual_size": "0x000001f2",
  312. "characteristics_raw": "0xc0000040"
  313. },
  314. {
  315. "name": ".rsrc",
  316. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  317. "virtual_address": "0x00034000",
  318. "size_of_data": "0x00000a00",
  319. "entropy": "4.52",
  320. "raw_address": "0x0002f200",
  321. "virtual_size": "0x00000998",
  322. "characteristics_raw": "0x40000040"
  323. },
  324. {
  325. "name": ".reloc",
  326. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  327. "virtual_address": "0x00036000",
  328. "size_of_data": "0x00000200",
  329. "entropy": "0.06",
  330. "raw_address": "0x0002fc00",
  331. "virtual_size": "0x0000000c",
  332. "characteristics_raw": "0x42000040"
  333. }
  334. ],
  335. "resources": [],
  336. "dirents": [
  337. {
  338. "virtual_address": "0x00000000",
  339. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  340. "size": "0x00000000"
  341. },
  342. {
  343. "virtual_address": "0x00030ab0",
  344. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  345. "size": "0x0000004b"
  346. },
  347. {
  348. "virtual_address": "0x00034000",
  349. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  350. "size": "0x00000998"
  351. },
  352. {
  353. "virtual_address": "0x00000000",
  354. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  355. "size": "0x00000000"
  356. },
  357. {
  358. "virtual_address": "0x00000000",
  359. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  360. "size": "0x00000000"
  361. },
  362. {
  363. "virtual_address": "0x00036000",
  364. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  365. "size": "0x0000000c"
  366. },
  367. {
  368. "virtual_address": "0x00030a72",
  369. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  370. "size": "0x0000001c"
  371. },
  372. {
  373. "virtual_address": "0x00000000",
  374. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  375. "size": "0x00000000"
  376. },
  377. {
  378. "virtual_address": "0x00000000",
  379. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  380. "size": "0x00000000"
  381. },
  382. {
  383. "virtual_address": "0x00000000",
  384. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  385. "size": "0x00000000"
  386. },
  387. {
  388. "virtual_address": "0x00000000",
  389. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  390. "size": "0x00000000"
  391. },
  392. {
  393. "virtual_address": "0x00000000",
  394. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  395. "size": "0x00000000"
  396. },
  397. {
  398. "virtual_address": "0x00002000",
  399. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  400. "size": "0x00000008"
  401. },
  402. {
  403. "virtual_address": "0x00000000",
  404. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  405. "size": "0x00000000"
  406. },
  407. {
  408. "virtual_address": "0x00002008",
  409. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  410. "size": "0x00000048"
  411. }
  412. ],
  413. "exports": [],
  414. "guest_signers": {},
  415. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  416. "icon_fuzzy": null,
  417. "icon": null,
  418. "pdbpath": "file.pdb",
  419. "imported_dll_count": 1,
  420. "versioninfo": []
  421. }
  422. }
  423.  
  424. [*] Resolved APIs: [
  425. "advapi32.dll.RegOpenKeyExW",
  426. "advapi32.dll.RegQueryInfoKeyW",
  427. "advapi32.dll.RegEnumKeyExW",
  428. "advapi32.dll.RegEnumValueW",
  429. "advapi32.dll.RegCloseKey",
  430. "advapi32.dll.RegQueryValueExW",
  431. "shlwapi.dll.UrlIsW"
  432. ]
  433.  
  434. [*] Static Analysis: {
  435. "dotnet": {
  436. "customattrs": null,
  437. "assemblyinfo": {
  438. "version": "1.0.0.0",
  439. "name": "file"
  440. },
  441. "assemblyrefs": [
  442. {
  443. "version": "4.0.0.0",
  444. "name": "mscorlib"
  445. },
  446. {
  447. "version": "65535.65535.65535.65535",
  448. "name": "mscorlib"
  449. },
  450. {
  451. "version": "4.0.0.0",
  452. "name": "System.Drawing"
  453. },
  454. {
  455. "version": "4.0.0.0",
  456. "name": "System.Management"
  457. },
  458. {
  459. "version": "4.0.0.0",
  460. "name": "System"
  461. },
  462. {
  463. "version": "4.0.0.0",
  464. "name": "System.Xml"
  465. },
  466. {
  467. "version": "4.0.0.0",
  468. "name": "System.Windows.Forms"
  469. },
  470. {
  471. "version": "4.0.0.0",
  472. "name": "System.IO.Compression.FileSystem"
  473. },
  474. {
  475. "version": "4.0.0.0",
  476. "name": "System.Core"
  477. }
  478. ],
  479. "typerefs": []
  480. },
  481. "pe": {
  482. "peid_signatures": null,
  483. "imports": [
  484. {
  485. "imports": [
  486. {
  487. "name": "_CorExeMain",
  488. "address": "0x402000"
  489. }
  490. ],
  491. "dll": "mscoree.dll"
  492. }
  493. ],
  494. "digital_signers": null,
  495. "exported_dll_name": null,
  496. "actual_checksum": "0x0003f8e0",
  497. "overlay": null,
  498. "imagebase": "0x00400000",
  499. "reported_checksum": "0x0003f8e0",
  500. "icon_hash": null,
  501. "entrypoint": "0x00430afe",
  502. "timestamp": "2019-06-04 10:42:06",
  503. "osversion": "4.0",
  504. "sections": [
  505. {
  506. "name": ".text",
  507. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  508. "virtual_address": "0x00002000",
  509. "size_of_data": "0x0002ec00",
  510. "entropy": "6.81",
  511. "raw_address": "0x00000400",
  512. "virtual_size": "0x0002eb04",
  513. "characteristics_raw": "0x60000020"
  514. },
  515. {
  516. "name": ".sdata",
  517. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  518. "virtual_address": "0x00032000",
  519. "size_of_data": "0x00000200",
  520. "entropy": "6.70",
  521. "raw_address": "0x0002f000",
  522. "virtual_size": "0x000001f2",
  523. "characteristics_raw": "0xc0000040"
  524. },
  525. {
  526. "name": ".rsrc",
  527. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  528. "virtual_address": "0x00034000",
  529. "size_of_data": "0x00000a00",
  530. "entropy": "4.52",
  531. "raw_address": "0x0002f200",
  532. "virtual_size": "0x00000998",
  533. "characteristics_raw": "0x40000040"
  534. },
  535. {
  536. "name": ".reloc",
  537. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  538. "virtual_address": "0x00036000",
  539. "size_of_data": "0x00000200",
  540. "entropy": "0.06",
  541. "raw_address": "0x0002fc00",
  542. "virtual_size": "0x0000000c",
  543. "characteristics_raw": "0x42000040"
  544. }
  545. ],
  546. "resources": [],
  547. "dirents": [
  548. {
  549. "virtual_address": "0x00000000",
  550. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  551. "size": "0x00000000"
  552. },
  553. {
  554. "virtual_address": "0x00030ab0",
  555. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  556. "size": "0x0000004b"
  557. },
  558. {
  559. "virtual_address": "0x00034000",
  560. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  561. "size": "0x00000998"
  562. },
  563. {
  564. "virtual_address": "0x00000000",
  565. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  566. "size": "0x00000000"
  567. },
  568. {
  569. "virtual_address": "0x00000000",
  570. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  571. "size": "0x00000000"
  572. },
  573. {
  574. "virtual_address": "0x00036000",
  575. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  576. "size": "0x0000000c"
  577. },
  578. {
  579. "virtual_address": "0x00030a72",
  580. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  581. "size": "0x0000001c"
  582. },
  583. {
  584. "virtual_address": "0x00000000",
  585. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  586. "size": "0x00000000"
  587. },
  588. {
  589. "virtual_address": "0x00000000",
  590. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  591. "size": "0x00000000"
  592. },
  593. {
  594. "virtual_address": "0x00000000",
  595. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  596. "size": "0x00000000"
  597. },
  598. {
  599. "virtual_address": "0x00000000",
  600. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  601. "size": "0x00000000"
  602. },
  603. {
  604. "virtual_address": "0x00000000",
  605. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  606. "size": "0x00000000"
  607. },
  608. {
  609. "virtual_address": "0x00002000",
  610. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  611. "size": "0x00000008"
  612. },
  613. {
  614. "virtual_address": "0x00000000",
  615. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  616. "size": "0x00000000"
  617. },
  618. {
  619. "virtual_address": "0x00002008",
  620. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  621. "size": "0x00000048"
  622. }
  623. ],
  624. "exports": [],
  625. "guest_signers": {},
  626. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  627. "icon_fuzzy": null,
  628. "icon": null,
  629. "pdbpath": "file.pdb",
  630. "imported_dll_count": 1,
  631. "versioninfo": []
  632. }
  633. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!