API tools faq
paste
paladin316

Dridex_0b2c355e45dc8fc2dff5a2b46aa81e5b_exe_2019-07-03_21_30.json

paladin316
Jul 3rd, 2019
2,287
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.32 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Dridex_0b2c355e45dc8fc2dff5a2b46aa81e5b.exe"
  7. [*] File Size: 171416
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "3456415723656eef7b0a8b0f655bf5ad0da411df02839dcfb148ea3b7fdffdf0"
  10. [*] MD5: "0b2c355e45dc8fc2dff5a2b46aa81e5b"
  11. [*] SHA1: "e485b5133a03328bd7642f138c67ebe9befe2706"
  12. [*] SHA512: "262dec8537c42e037117da4a93741afb5531e45e5df0586eb92af21066159bd3d946e6756a3fd16b362b5841ca02ce8aa0715dd4c583cf64f1d5b4f1ada4d619"
  13. [*] CRC32: "2C428963"
  14. [*] SSDEEP: "3072:t4ZzDB2/lp3XsmEfBt4PT1nXrpRwANHHpZh6kAp0TxsljlGsQgL:+VDm9XsFZty1XrLwANpZhq+Tx4ga"
  15.  
  16. [*] Process Execution: [
  17. "Dridex_0b2c355e45dc8fc2dff5a2b46aa81e5b.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "The binary likely contains encrypted or compressed data.",
  27. "Details": [
  28. {
  29. "section": "name: .V4Y, entropy: 7.93, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00021000, virtual_size: 0x00020012"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "File has been identified by 21 Antiviruses on VirusTotal as malicious",
  35. "Details": [
  36. {
  37. "FireEye": "Generic.mg.0b2c355e45dc8fc2"
  38. },
  39. {
  40. "McAfee": "Artemis!0B2C355E45DC"
  41. },
  42. {
  43. "Cylance": "Unsafe"
  44. },
  45. {
  46. "CrowdStrike": "win/malicious_confidence_90% (W)"
  47. },
  48. {
  49. "K7GW": "Trojan ( 005485311 )"
  50. },
  51. {
  52. "K7AntiVirus": "Trojan ( 005485311 )"
  53. },
  54. {
  55. "Symantec": "Packed.Generic.534"
  56. },
  57. {
  58. "ESET-NOD32": "a variant of Win32/GenKryptik.DMKC"
  59. },
  60. {
  61. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  62. },
  63. {
  64. "Alibaba": "Trojan:Win32/EmotetedCryptc.2d6214f6"
  65. },
  66. {
  67. "Avast": "FileRepMalware"
  68. },
  69. {
  70. "Rising": "Trojan.Bitrep!8.F596/N3#77% (RDM+:cmRtazrwT4kSSw79NI3NZO/JmbXY)"
  71. },
  72. {
  73. "Sophos": "Mal/Qbot-R"
  74. },
  75. {
  76. "Invincea": "heuristic"
  77. },
  78. {
  79. "McAfee-GW-Edition": "Artemis!Trojan"
  80. },
  81. {
  82. "Webroot": "W32.Trojan.Gen"
  83. },
  84. {
  85. "Endgame": "malicious (high confidence)"
  86. },
  87. {
  88. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  89. },
  90. {
  91. "SentinelOne": "DFI - Malicious PE"
  92. },
  93. {
  94. "eGambit": "Unsafe.AI_Score_90%"
  95. },
  96. {
  97. "AVG": "FileRepMalware"
  98. }
  99. ]
  100. }
  101. ]
  102.  
  103. [*] Started Service: []
  104.  
  105. [*] Executed Commands: []
  106.  
  107. [*] Mutexes: [
  108. "DBWinMutex"
  109. ]
  110.  
  111. [*] Modified Files: []
  112.  
  113. [*] Deleted Files: []
  114.  
  115. [*] Modified Registry Keys: []
  116.  
  117. [*] Deleted Registry Keys: []
  118.  
  119. [*] DNS Communications: []
  120.  
  121. [*] Domains: []
  122.  
  123. [*] Network Communication - ICMP: []
  124.  
  125. [*] Network Communication - HTTP: []
  126.  
  127. [*] Network Communication - SMTP: []
  128.  
  129. [*] Network Communication - Hosts: []
  130.  
  131. [*] Network Communication - IRC: []
  132.  
  133. [*] Static Analysis: {
  134. "pe": {
  135. "peid_signatures": null,
  136. "imports": [
  137. {
  138. "imports": [
  139. {
  140. "name": "JetPrepareUpdate",
  141. "address": "0x404000"
  142. }
  143. ],
  144. "dll": "ESENT.dll"
  145. },
  146. {
  147. "imports": [
  148. {
  149. "name": "memset",
  150. "address": "0x404058"
  151. }
  152. ],
  153. "dll": "msvcrt.dll"
  154. },
  155. {
  156. "imports": [
  157. {
  158. "name": null,
  159. "address": "0x40403c"
  160. }
  161. ],
  162. "dll": "SHLWAPI.dll"
  163. },
  164. {
  165. "imports": [
  166. {
  167. "name": "VarDecFromR4",
  168. "address": "0x40402c"
  169. }
  170. ],
  171. "dll": "OLEAUT32.dll"
  172. },
  173. {
  174. "imports": [
  175. {
  176. "name": "GetCurrentProcessorNumber",
  177. "address": "0x404008"
  178. },
  179. {
  180. "name": "GetCommandLineA",
  181. "address": "0x40400c"
  182. },
  183. {
  184. "name": "AddAtomA",
  185. "address": "0x404010"
  186. },
  187. {
  188. "name": "GetProcessShutdownParameters",
  189. "address": "0x404014"
  190. },
  191. {
  192. "name": "GetThreadId",
  193. "address": "0x404018"
  194. },
  195. {
  196. "name": "GetModuleFileNameW",
  197. "address": "0x40401c"
  198. },
  199. {
  200. "name": "GetTickCount",
  201. "address": "0x404020"
  202. },
  203. {
  204. "name": "GetCurrentThread",
  205. "address": "0x404024"
  206. }
  207. ],
  208. "dll": "KERNEL32.dll"
  209. },
  210. {
  211. "imports": [
  212. {
  213. "name": "GetPwrCapabilities",
  214. "address": "0x404034"
  215. }
  216. ],
  217. "dll": "POWRPROF.dll"
  218. },
  219. {
  220. "imports": [
  221. {
  222. "name": "IsClipboardFormatAvailable",
  223. "address": "0x404044"
  224. },
  225. {
  226. "name": "IsWindowUnicode",
  227. "address": "0x404048"
  228. },
  229. {
  230. "name": "GetClipboardSequenceNumber",
  231. "address": "0x40404c"
  232. },
  233. {
  234. "name": "GetCapture",
  235. "address": "0x404050"
  236. }
  237. ],
  238. "dll": "USER32.dll"
  239. }
  240. ],
  241. "digital_signers": null,
  242. "exported_dll_name": null,
  243. "actual_checksum": "0x000362ba",
  244. "overlay": {
  245. "size": "0x00001d98",
  246. "offset": "0x00028000"
  247. },
  248. "imagebase": "0x00400000",
  249. "reported_checksum": "0x000362ba",
  250. "icon_hash": null,
  251. "entrypoint": "0x00403982",
  252. "timestamp": "2019-07-12 23:16:52",
  253. "osversion": "4.0",
  254. "sections": [
  255. {
  256. "name": ".text",
  257. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  258. "virtual_address": "0x00001000",
  259. "size_of_data": "0x00003000",
  260. "entropy": "5.82",
  261. "raw_address": "0x00001000",
  262. "virtual_size": "0x00002b6e",
  263. "characteristics_raw": "0x60000020"
  264. },
  265. {
  266. "name": ".rdata",
  267. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  268. "virtual_address": "0x00004000",
  269. "size_of_data": "0x00001000",
  270. "entropy": "3.57",
  271. "raw_address": "0x00004000",
  272. "virtual_size": "0x00000e79",
  273. "characteristics_raw": "0x40000040"
  274. },
  275. {
  276. "name": ".data",
  277. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  278. "virtual_address": "0x00005000",
  279. "size_of_data": "0x00001000",
  280. "entropy": "0.21",
  281. "raw_address": "0x00005000",
  282. "virtual_size": "0x000018e0",
  283. "characteristics_raw": "0xc0000040"
  284. },
  285. {
  286. "name": ".V4Y",
  287. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  288. "virtual_address": "0x00007000",
  289. "size_of_data": "0x00021000",
  290. "entropy": "7.93",
  291. "raw_address": "0x00006000",
  292. "virtual_size": "0x00020012",
  293. "characteristics_raw": "0xc0000040"
  294. },
  295. {
  296. "name": ".reloc",
  297. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  298. "virtual_address": "0x00028000",
  299. "size_of_data": "0x00001000",
  300. "entropy": "0.79",
  301. "raw_address": "0x00027000",
  302. "virtual_size": "0x0000014c",
  303. "characteristics_raw": "0x42000040"
  304. }
  305. ],
  306. "resources": [],
  307. "dirents": [
  308. {
  309. "virtual_address": "0x00000000",
  310. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  311. "size": "0x00000000"
  312. },
  313. {
  314. "virtual_address": "0x00004610",
  315. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  316. "size": "0x000000a0"
  317. },
  318. {
  319. "virtual_address": "0x00000000",
  320. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  321. "size": "0x00000000"
  322. },
  323. {
  324. "virtual_address": "0x00000000",
  325. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  326. "size": "0x00000000"
  327. },
  328. {
  329. "virtual_address": "0x00028000",
  330. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  331. "size": "0x00001d98"
  332. },
  333. {
  334. "virtual_address": "0x00028000",
  335. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  336. "size": "0x0000014c"
  337. },
  338. {
  339. "virtual_address": "0x00004060",
  340. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  341. "size": "0x00000038"
  342. },
  343. {
  344. "virtual_address": "0x00000000",
  345. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  346. "size": "0x00000000"
  347. },
  348. {
  349. "virtual_address": "0x00000000",
  350. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  351. "size": "0x00000000"
  352. },
  353. {
  354. "virtual_address": "0x00000000",
  355. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  356. "size": "0x00000000"
  357. },
  358. {
  359. "virtual_address": "0x00000000",
  360. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  361. "size": "0x00000000"
  362. },
  363. {
  364. "virtual_address": "0x00000000",
  365. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  366. "size": "0x00000000"
  367. },
  368. {
  369. "virtual_address": "0x00004000",
  370. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  371. "size": "0x00000060"
  372. },
  373. {
  374. "virtual_address": "0x00000000",
  375. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  376. "size": "0x00000000"
  377. },
  378. {
  379. "virtual_address": "0x00000000",
  380. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  381. "size": "0x00000000"
  382. },
  383. {
  384. "virtual_address": "0x00000000",
  385. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  386. "size": "0x00000000"
  387. }
  388. ],
  389. "exports": [],
  390. "guest_signers": {},
  391. "imphash": "1d7a644f480a5182c7c8f41a391ec21f",
  392. "icon_fuzzy": null,
  393. "icon": null,
  394. "pdbpath": "tYHInCrNwNs.pdb",
  395. "imported_dll_count": 7,
  396. "versioninfo": []
  397. }
  398. }
  399.  
  400. [*] Resolved APIs: [
  401. "kernel32.dll.LoadLibraryA",
  402. "kernel32.dll.GetProcAddress",
  403. "kernel32.dll.VirtualAlloc",
  404. "kernel32.dll.VirtualProtect",
  405. "kernel32.dll.FreeConsole",
  406. "kernel32.dll.Sleep",
  407. "kernel32.dll.OutputDebugStringW"
  408. ]
  409.  
  410. [*] Static Analysis: {
  411. "pe": {
  412. "peid_signatures": null,
  413. "imports": [
  414. {
  415. "imports": [
  416. {
  417. "name": "JetPrepareUpdate",
  418. "address": "0x404000"
  419. }
  420. ],
  421. "dll": "ESENT.dll"
  422. },
  423. {
  424. "imports": [
  425. {
  426. "name": "memset",
  427. "address": "0x404058"
  428. }
  429. ],
  430. "dll": "msvcrt.dll"
  431. },
  432. {
  433. "imports": [
  434. {
  435. "name": null,
  436. "address": "0x40403c"
  437. }
  438. ],
  439. "dll": "SHLWAPI.dll"
  440. },
  441. {
  442. "imports": [
  443. {
  444. "name": "VarDecFromR4",
  445. "address": "0x40402c"
  446. }
  447. ],
  448. "dll": "OLEAUT32.dll"
  449. },
  450. {
  451. "imports": [
  452. {
  453. "name": "GetCurrentProcessorNumber",
  454. "address": "0x404008"
  455. },
  456. {
  457. "name": "GetCommandLineA",
  458. "address": "0x40400c"
  459. },
  460. {
  461. "name": "AddAtomA",
  462. "address": "0x404010"
  463. },
  464. {
  465. "name": "GetProcessShutdownParameters",
  466. "address": "0x404014"
  467. },
  468. {
  469. "name": "GetThreadId",
  470. "address": "0x404018"
  471. },
  472. {
  473. "name": "GetModuleFileNameW",
  474. "address": "0x40401c"
  475. },
  476. {
  477. "name": "GetTickCount",
  478. "address": "0x404020"
  479. },
  480. {
  481. "name": "GetCurrentThread",
  482. "address": "0x404024"
  483. }
  484. ],
  485. "dll": "KERNEL32.dll"
  486. },
  487. {
  488. "imports": [
  489. {
  490. "name": "GetPwrCapabilities",
  491. "address": "0x404034"
  492. }
  493. ],
  494. "dll": "POWRPROF.dll"
  495. },
  496. {
  497. "imports": [
  498. {
  499. "name": "IsClipboardFormatAvailable",
  500. "address": "0x404044"
  501. },
  502. {
  503. "name": "IsWindowUnicode",
  504. "address": "0x404048"
  505. },
  506. {
  507. "name": "GetClipboardSequenceNumber",
  508. "address": "0x40404c"
  509. },
  510. {
  511. "name": "GetCapture",
  512. "address": "0x404050"
  513. }
  514. ],
  515. "dll": "USER32.dll"
  516. }
  517. ],
  518. "digital_signers": null,
  519. "exported_dll_name": null,
  520. "actual_checksum": "0x000362ba",
  521. "overlay": {
  522. "size": "0x00001d98",
  523. "offset": "0x00028000"
  524. },
  525. "imagebase": "0x00400000",
  526. "reported_checksum": "0x000362ba",
  527. "icon_hash": null,
  528. "entrypoint": "0x00403982",
  529. "timestamp": "2019-07-12 23:16:52",
  530. "osversion": "4.0",
  531. "sections": [
  532. {
  533. "name": ".text",
  534. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  535. "virtual_address": "0x00001000",
  536. "size_of_data": "0x00003000",
  537. "entropy": "5.82",
  538. "raw_address": "0x00001000",
  539. "virtual_size": "0x00002b6e",
  540. "characteristics_raw": "0x60000020"
  541. },
  542. {
  543. "name": ".rdata",
  544. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  545. "virtual_address": "0x00004000",
  546. "size_of_data": "0x00001000",
  547. "entropy": "3.57",
  548. "raw_address": "0x00004000",
  549. "virtual_size": "0x00000e79",
  550. "characteristics_raw": "0x40000040"
  551. },
  552. {
  553. "name": ".data",
  554. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  555. "virtual_address": "0x00005000",
  556. "size_of_data": "0x00001000",
  557. "entropy": "0.21",
  558. "raw_address": "0x00005000",
  559. "virtual_size": "0x000018e0",
  560. "characteristics_raw": "0xc0000040"
  561. },
  562. {
  563. "name": ".V4Y",
  564. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  565. "virtual_address": "0x00007000",
  566. "size_of_data": "0x00021000",
  567. "entropy": "7.93",
  568. "raw_address": "0x00006000",
  569. "virtual_size": "0x00020012",
  570. "characteristics_raw": "0xc0000040"
  571. },
  572. {
  573. "name": ".reloc",
  574. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  575. "virtual_address": "0x00028000",
  576. "size_of_data": "0x00001000",
  577. "entropy": "0.79",
  578. "raw_address": "0x00027000",
  579. "virtual_size": "0x0000014c",
  580. "characteristics_raw": "0x42000040"
  581. }
  582. ],
  583. "resources": [],
  584. "dirents": [
  585. {
  586. "virtual_address": "0x00000000",
  587. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  588. "size": "0x00000000"
  589. },
  590. {
  591. "virtual_address": "0x00004610",
  592. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  593. "size": "0x000000a0"
  594. },
  595. {
  596. "virtual_address": "0x00000000",
  597. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  598. "size": "0x00000000"
  599. },
  600. {
  601. "virtual_address": "0x00000000",
  602. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  603. "size": "0x00000000"
  604. },
  605. {
  606. "virtual_address": "0x00028000",
  607. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  608. "size": "0x00001d98"
  609. },
  610. {
  611. "virtual_address": "0x00028000",
  612. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  613. "size": "0x0000014c"
  614. },
  615. {
  616. "virtual_address": "0x00004060",
  617. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  618. "size": "0x00000038"
  619. },
  620. {
  621. "virtual_address": "0x00000000",
  622. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  623. "size": "0x00000000"
  624. },
  625. {
  626. "virtual_address": "0x00000000",
  627. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  628. "size": "0x00000000"
  629. },
  630. {
  631. "virtual_address": "0x00000000",
  632. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  633. "size": "0x00000000"
  634. },
  635. {
  636. "virtual_address": "0x00000000",
  637. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  638. "size": "0x00000000"
  639. },
  640. {
  641. "virtual_address": "0x00000000",
  642. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  643. "size": "0x00000000"
  644. },
  645. {
  646. "virtual_address": "0x00004000",
  647. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  648. "size": "0x00000060"
  649. },
  650. {
  651. "virtual_address": "0x00000000",
  652. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  653. "size": "0x00000000"
  654. },
  655. {
  656. "virtual_address": "0x00000000",
  657. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  658. "size": "0x00000000"
  659. },
  660. {
  661. "virtual_address": "0x00000000",
  662. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  663. "size": "0x00000000"
  664. }
  665. ],
  666. "exports": [],
  667. "guest_signers": {},
  668. "imphash": "1d7a644f480a5182c7c8f41a391ec21f",
  669. "icon_fuzzy": null,
  670. "icon": null,
  671. "pdbpath": "tYHInCrNwNs.pdb",
  672. "imported_dll_count": 7,
  673. "versioninfo": []
  674. }
  675. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!