API tools faq
paste
paladin316

Exes_3a8efda2d6d14d91322255c60cba3b6a_exe_2019-07-03_11_30.json

paladin316
Jul 3rd, 2019
2,212
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.21 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_3a8efda2d6d14d91322255c60cba3b6a.exe"
  7. [*] File Size: 606208
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "797814d51dfb597d6ef68d9bcb744fa37eb8f9d52a474bb7b54650f9a36eefa5"
  10. [*] MD5: "3a8efda2d6d14d91322255c60cba3b6a"
  11. [*] SHA1: "deb60ad59ba3b84cd8d689d645f8dbb221d7b5d8"
  12. [*] SHA512: "f5f3443628138da56ecad5ecad522874b6a0a1b4d8297f52a6fcec746f98df94484f1142f6eeedda9fada266dd37614c32ebd6fbec5c25dc66e87e60738d7ba2"
  13. [*] CRC32: "5BA4636D"
  14. [*] SSDEEP: "12288:nIaxCaJQo/Umk8cOj6ZigoDgQIdPBad2NBLbF9H55:dxCaJQo6ZQgtG8bjn"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "File has been identified by 16 Antiviruses on VirusTotal as malicious",
  21. "Details": [
  22. {
  23. "FireEye": "Generic.mg.3a8efda2d6d14d91"
  24. },
  25. {
  26. "Cybereason": "malicious.59ba3b"
  27. },
  28. {
  29. "Cyren": "W32/VBKrypt.SB.gen!Eldorado"
  30. },
  31. {
  32. "Symantec": "ML.Attribute.HighConfidence"
  33. },
  34. {
  35. "APEX": "Malicious"
  36. },
  37. {
  38. "Avast": "Win32:CrypterX-gen [Trj]"
  39. },
  40. {
  41. "Invincea": "heuristic"
  42. },
  43. {
  44. "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.hm"
  45. },
  46. {
  47. "SentinelOne": "DFI - Suspicious PE"
  48. },
  49. {
  50. "F-Prot": "W32/VBKrypt.SB.gen!Eldorado"
  51. },
  52. {
  53. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  54. },
  55. {
  56. "Endgame": "malicious (high confidence)"
  57. },
  58. {
  59. "ESET-NOD32": "a variant of Win32/GenKryptik.DMHH"
  60. },
  61. {
  62. "Fortinet": "W32/Injector.EGIR!tr"
  63. },
  64. {
  65. "AVG": "Win32:CrypterX-gen [Trj]"
  66. },
  67. {
  68. "CrowdStrike": "win/malicious_confidence_100% (W)"
  69. }
  70. ]
  71. }
  72. ]
  73.  
  74. [*] Started Service: []
  75.  
  76. [*] Executed Commands: []
  77.  
  78. [*] Mutexes: []
  79.  
  80. [*] Modified Files: []
  81.  
  82. [*] Deleted Files: []
  83.  
  84. [*] Modified Registry Keys: []
  85.  
  86. [*] Deleted Registry Keys: []
  87.  
  88. [*] DNS Communications: []
  89.  
  90. [*] Domains: []
  91.  
  92. [*] Network Communication - ICMP: []
  93.  
  94. [*] Network Communication - HTTP: []
  95.  
  96. [*] Network Communication - SMTP: []
  97.  
  98. [*] Network Communication - Hosts: []
  99.  
  100. [*] Network Communication - IRC: []
  101.  
  102. [*] Static Analysis: {
  103. "pe": {
  104. "peid_signatures": null,
  105. "imports": [
  106. {
  107. "imports": [
  108. {
  109. "name": null,
  110. "address": "0x401000"
  111. },
  112. {
  113. "name": "MethCallEngine",
  114. "address": "0x401004"
  115. },
  116. {
  117. "name": null,
  118. "address": "0x401008"
  119. },
  120. {
  121. "name": null,
  122. "address": "0x40100c"
  123. },
  124. {
  125. "name": null,
  126. "address": "0x401010"
  127. },
  128. {
  129. "name": null,
  130. "address": "0x401014"
  131. },
  132. {
  133. "name": null,
  134. "address": "0x401018"
  135. },
  136. {
  137. "name": null,
  138. "address": "0x40101c"
  139. },
  140. {
  141. "name": null,
  142. "address": "0x401020"
  143. },
  144. {
  145. "name": null,
  146. "address": "0x401024"
  147. },
  148. {
  149. "name": null,
  150. "address": "0x401028"
  151. },
  152. {
  153. "name": "EVENT_SINK_AddRef",
  154. "address": "0x40102c"
  155. },
  156. {
  157. "name": null,
  158. "address": "0x401030"
  159. },
  160. {
  161. "name": null,
  162. "address": "0x401034"
  163. },
  164. {
  165. "name": null,
  166. "address": "0x401038"
  167. },
  168. {
  169. "name": null,
  170. "address": "0x40103c"
  171. },
  172. {
  173. "name": null,
  174. "address": "0x401040"
  175. },
  176. {
  177. "name": null,
  178. "address": "0x401044"
  179. },
  180. {
  181. "name": "EVENT_SINK_Release",
  182. "address": "0x401048"
  183. },
  184. {
  185. "name": null,
  186. "address": "0x40104c"
  187. },
  188. {
  189. "name": "EVENT_SINK_QueryInterface",
  190. "address": "0x401050"
  191. },
  192. {
  193. "name": "__vbaExceptHandler",
  194. "address": "0x401054"
  195. },
  196. {
  197. "name": null,
  198. "address": "0x401058"
  199. },
  200. {
  201. "name": null,
  202. "address": "0x40105c"
  203. },
  204. {
  205. "name": null,
  206. "address": "0x401060"
  207. },
  208. {
  209. "name": null,
  210. "address": "0x401064"
  211. },
  212. {
  213. "name": null,
  214. "address": "0x401068"
  215. },
  216. {
  217. "name": null,
  218. "address": "0x40106c"
  219. },
  220. {
  221. "name": null,
  222. "address": "0x401070"
  223. },
  224. {
  225. "name": null,
  226. "address": "0x401074"
  227. },
  228. {
  229. "name": null,
  230. "address": "0x401078"
  231. },
  232. {
  233. "name": null,
  234. "address": "0x40107c"
  235. },
  236. {
  237. "name": null,
  238. "address": "0x401080"
  239. },
  240. {
  241. "name": null,
  242. "address": "0x401084"
  243. },
  244. {
  245. "name": null,
  246. "address": "0x401088"
  247. }
  248. ],
  249. "dll": "MSVBVM60.DLL"
  250. }
  251. ],
  252. "digital_signers": null,
  253. "exported_dll_name": null,
  254. "actual_checksum": "0x000994c8",
  255. "overlay": null,
  256. "imagebase": "0x00400000",
  257. "reported_checksum": "0x000994c8",
  258. "icon_hash": null,
  259. "entrypoint": "0x00401164",
  260. "timestamp": "2019-07-02 20:54:28",
  261. "osversion": "4.0",
  262. "sections": [
  263. {
  264. "name": ".text",
  265. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  266. "virtual_address": "0x00001000",
  267. "size_of_data": "0x0008f000",
  268. "entropy": "5.31",
  269. "raw_address": "0x00001000",
  270. "virtual_size": "0x0008e178",
  271. "characteristics_raw": "0x60000020"
  272. },
  273. {
  274. "name": ".data",
  275. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  276. "virtual_address": "0x00090000",
  277. "size_of_data": "0x00000000",
  278. "entropy": "0.00",
  279. "raw_address": "0x00000000",
  280. "virtual_size": "0x00003694",
  281. "characteristics_raw": "0xc0000040"
  282. },
  283. {
  284. "name": ".rsrc",
  285. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  286. "virtual_address": "0x00094000",
  287. "size_of_data": "0x00004000",
  288. "entropy": "4.29",
  289. "raw_address": "0x00090000",
  290. "virtual_size": "0x00003b86",
  291. "characteristics_raw": "0x40000040"
  292. }
  293. ],
  294. "resources": [],
  295. "dirents": [
  296. {
  297. "virtual_address": "0x00000000",
  298. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  299. "size": "0x00000000"
  300. },
  301. {
  302. "virtual_address": "0x0008f044",
  303. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  304. "size": "0x00000028"
  305. },
  306. {
  307. "virtual_address": "0x00094000",
  308. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  309. "size": "0x00003b86"
  310. },
  311. {
  312. "virtual_address": "0x00000000",
  313. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  314. "size": "0x00000000"
  315. },
  316. {
  317. "virtual_address": "0x00000000",
  318. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  319. "size": "0x00000000"
  320. },
  321. {
  322. "virtual_address": "0x00000000",
  323. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  324. "size": "0x00000000"
  325. },
  326. {
  327. "virtual_address": "0x00000000",
  328. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  329. "size": "0x00000000"
  330. },
  331. {
  332. "virtual_address": "0x00000000",
  333. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  334. "size": "0x00000000"
  335. },
  336. {
  337. "virtual_address": "0x00000000",
  338. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  339. "size": "0x00000000"
  340. },
  341. {
  342. "virtual_address": "0x00000000",
  343. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  344. "size": "0x00000000"
  345. },
  346. {
  347. "virtual_address": "0x00000000",
  348. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  349. "size": "0x00000000"
  350. },
  351. {
  352. "virtual_address": "0x00000220",
  353. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  354. "size": "0x00000020"
  355. },
  356. {
  357. "virtual_address": "0x00001000",
  358. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  359. "size": "0x00000090"
  360. },
  361. {
  362. "virtual_address": "0x00000000",
  363. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  364. "size": "0x00000000"
  365. },
  366. {
  367. "virtual_address": "0x00000000",
  368. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  369. "size": "0x00000000"
  370. },
  371. {
  372. "virtual_address": "0x00000000",
  373. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  374. "size": "0x00000000"
  375. }
  376. ],
  377. "exports": [],
  378. "guest_signers": {},
  379. "imphash": "2d627fb3ddda301a0be4772146c85a1b",
  380. "icon_fuzzy": null,
  381. "icon": null,
  382. "pdbpath": null,
  383. "imported_dll_count": 1,
  384. "versioninfo": []
  385. }
  386. }
  387.  
  388. [*] Resolved APIs: []
  389.  
  390. [*] Static Analysis: {
  391. "pe": {
  392. "peid_signatures": null,
  393. "imports": [
  394. {
  395. "imports": [
  396. {
  397. "name": null,
  398. "address": "0x401000"
  399. },
  400. {
  401. "name": "MethCallEngine",
  402. "address": "0x401004"
  403. },
  404. {
  405. "name": null,
  406. "address": "0x401008"
  407. },
  408. {
  409. "name": null,
  410. "address": "0x40100c"
  411. },
  412. {
  413. "name": null,
  414. "address": "0x401010"
  415. },
  416. {
  417. "name": null,
  418. "address": "0x401014"
  419. },
  420. {
  421. "name": null,
  422. "address": "0x401018"
  423. },
  424. {
  425. "name": null,
  426. "address": "0x40101c"
  427. },
  428. {
  429. "name": null,
  430. "address": "0x401020"
  431. },
  432. {
  433. "name": null,
  434. "address": "0x401024"
  435. },
  436. {
  437. "name": null,
  438. "address": "0x401028"
  439. },
  440. {
  441. "name": "EVENT_SINK_AddRef",
  442. "address": "0x40102c"
  443. },
  444. {
  445. "name": null,
  446. "address": "0x401030"
  447. },
  448. {
  449. "name": null,
  450. "address": "0x401034"
  451. },
  452. {
  453. "name": null,
  454. "address": "0x401038"
  455. },
  456. {
  457. "name": null,
  458. "address": "0x40103c"
  459. },
  460. {
  461. "name": null,
  462. "address": "0x401040"
  463. },
  464. {
  465. "name": null,
  466. "address": "0x401044"
  467. },
  468. {
  469. "name": "EVENT_SINK_Release",
  470. "address": "0x401048"
  471. },
  472. {
  473. "name": null,
  474. "address": "0x40104c"
  475. },
  476. {
  477. "name": "EVENT_SINK_QueryInterface",
  478. "address": "0x401050"
  479. },
  480. {
  481. "name": "__vbaExceptHandler",
  482. "address": "0x401054"
  483. },
  484. {
  485. "name": null,
  486. "address": "0x401058"
  487. },
  488. {
  489. "name": null,
  490. "address": "0x40105c"
  491. },
  492. {
  493. "name": null,
  494. "address": "0x401060"
  495. },
  496. {
  497. "name": null,
  498. "address": "0x401064"
  499. },
  500. {
  501. "name": null,
  502. "address": "0x401068"
  503. },
  504. {
  505. "name": null,
  506. "address": "0x40106c"
  507. },
  508. {
  509. "name": null,
  510. "address": "0x401070"
  511. },
  512. {
  513. "name": null,
  514. "address": "0x401074"
  515. },
  516. {
  517. "name": null,
  518. "address": "0x401078"
  519. },
  520. {
  521. "name": null,
  522. "address": "0x40107c"
  523. },
  524. {
  525. "name": null,
  526. "address": "0x401080"
  527. },
  528. {
  529. "name": null,
  530. "address": "0x401084"
  531. },
  532. {
  533. "name": null,
  534. "address": "0x401088"
  535. }
  536. ],
  537. "dll": "MSVBVM60.DLL"
  538. }
  539. ],
  540. "digital_signers": null,
  541. "exported_dll_name": null,
  542. "actual_checksum": "0x000994c8",
  543. "overlay": null,
  544. "imagebase": "0x00400000",
  545. "reported_checksum": "0x000994c8",
  546. "icon_hash": null,
  547. "entrypoint": "0x00401164",
  548. "timestamp": "2019-07-02 20:54:28",
  549. "osversion": "4.0",
  550. "sections": [
  551. {
  552. "name": ".text",
  553. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  554. "virtual_address": "0x00001000",
  555. "size_of_data": "0x0008f000",
  556. "entropy": "5.31",
  557. "raw_address": "0x00001000",
  558. "virtual_size": "0x0008e178",
  559. "characteristics_raw": "0x60000020"
  560. },
  561. {
  562. "name": ".data",
  563. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  564. "virtual_address": "0x00090000",
  565. "size_of_data": "0x00000000",
  566. "entropy": "0.00",
  567. "raw_address": "0x00000000",
  568. "virtual_size": "0x00003694",
  569. "characteristics_raw": "0xc0000040"
  570. },
  571. {
  572. "name": ".rsrc",
  573. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  574. "virtual_address": "0x00094000",
  575. "size_of_data": "0x00004000",
  576. "entropy": "4.29",
  577. "raw_address": "0x00090000",
  578. "virtual_size": "0x00003b86",
  579. "characteristics_raw": "0x40000040"
  580. }
  581. ],
  582. "resources": [],
  583. "dirents": [
  584. {
  585. "virtual_address": "0x00000000",
  586. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  587. "size": "0x00000000"
  588. },
  589. {
  590. "virtual_address": "0x0008f044",
  591. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  592. "size": "0x00000028"
  593. },
  594. {
  595. "virtual_address": "0x00094000",
  596. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  597. "size": "0x00003b86"
  598. },
  599. {
  600. "virtual_address": "0x00000000",
  601. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  602. "size": "0x00000000"
  603. },
  604. {
  605. "virtual_address": "0x00000000",
  606. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  607. "size": "0x00000000"
  608. },
  609. {
  610. "virtual_address": "0x00000000",
  611. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  612. "size": "0x00000000"
  613. },
  614. {
  615. "virtual_address": "0x00000000",
  616. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  617. "size": "0x00000000"
  618. },
  619. {
  620. "virtual_address": "0x00000000",
  621. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  622. "size": "0x00000000"
  623. },
  624. {
  625. "virtual_address": "0x00000000",
  626. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  627. "size": "0x00000000"
  628. },
  629. {
  630. "virtual_address": "0x00000000",
  631. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  632. "size": "0x00000000"
  633. },
  634. {
  635. "virtual_address": "0x00000000",
  636. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  637. "size": "0x00000000"
  638. },
  639. {
  640. "virtual_address": "0x00000220",
  641. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  642. "size": "0x00000020"
  643. },
  644. {
  645. "virtual_address": "0x00001000",
  646. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  647. "size": "0x00000090"
  648. },
  649. {
  650. "virtual_address": "0x00000000",
  651. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  652. "size": "0x00000000"
  653. },
  654. {
  655. "virtual_address": "0x00000000",
  656. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  657. "size": "0x00000000"
  658. },
  659. {
  660. "virtual_address": "0x00000000",
  661. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  662. "size": "0x00000000"
  663. }
  664. ],
  665. "exports": [],
  666. "guest_signers": {},
  667. "imphash": "2d627fb3ddda301a0be4772146c85a1b",
  668. "icon_fuzzy": null,
  669. "icon": null,
  670. "pdbpath": null,
  671. "imported_dll_count": 1,
  672. "versioninfo": []
  673. }
  674. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!