API tools faq
paste
paladin316

Exes_cb95a8fc3e50377b222be0289b90a0f4_exe_2019-07-02_05_30.json

paladin316
Jul 2nd, 2019
2,079
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.01 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Small"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_cb95a8fc3e50377b222be0289b90a0f4.exe"
  7. [*] File Size: 355280
  8. [*] File Type: "MS-DOS executable, MZ for MS-DOS"
  9. [*] SHA256: "31739ac593945cb154bb410bcaee57a2384c0aa69e097eca8c8c14244fb4f307"
  10. [*] MD5: "cb95a8fc3e50377b222be0289b90a0f4"
  11. [*] SHA1: "c3c60e075ec892eff9be1d79541d657c4e13093d"
  12. [*] SHA512: "4a68ba84b5c85d45a1a9161ac3a5a2d49be4ef9aa417ce7e1bd8b98169f0ea3ac1f9f1e9c9ec12ffb2487286cfebbb877a3970b0ef34e908b7e7d4e7afa9a91d"
  13. [*] CRC32: "BE826987"
  14. [*] SSDEEP: "6144:YRqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4y1QPf:cqmpplpGoGL3etQoMiXM8gxf/Sj4yQf"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "File has been identified by 62 Antiviruses on VirusTotal as malicious",
  21. "Details": [
  22. {
  23. "Bkav": "W32.DownloadProratA.Trojan"
  24. },
  25. {
  26. "MicroWorld-eScan": "Trojan.Generic.7807554"
  27. },
  28. {
  29. "CMC": "Trojan-Dropper.Win32.Small!O"
  30. },
  31. {
  32. "CAT-QuickHeal": "Backdoor.Prorat.AZ2"
  33. },
  34. {
  35. "ALYac": "Trojan.Generic.7807554"
  36. },
  37. {
  38. "Cylance": "Unsafe"
  39. },
  40. {
  41. "Zillya": "Dropper.Agent.Win32.103592"
  42. },
  43. {
  44. "SUPERAntiSpyware": "Trojan.Agent/Gen-Small"
  45. },
  46. {
  47. "TheHacker": "Trojan/Dropper.Agent.bczn"
  48. },
  49. {
  50. "K7GW": "Trojan ( 0036e6f71 )"
  51. },
  52. {
  53. "K7AntiVirus": "Trojan ( 0036e6f71 )"
  54. },
  55. {
  56. "Arcabit": "Trojan.Generic.D772242"
  57. },
  58. {
  59. "TrendMicro": "TROJ_DROPPER.CKK"
  60. },
  61. {
  62. "Baidu": "Win32.Backdoor.Prorat.e"
  63. },
  64. {
  65. "NANO-Antivirus": "Trojan.Win32.Small.gnhm"
  66. },
  67. {
  68. "Cyren": "W32/ProratP.G"
  69. },
  70. {
  71. "Symantec": "Trojan Horse"
  72. },
  73. {
  74. "TotalDefense": "Win32/SillyDl.SR"
  75. },
  76. {
  77. "TrendMicro-HouseCall": "TROJ_DROPPER.CKK"
  78. },
  79. {
  80. "Avast": "Win32:Small-BHA [Trj]"
  81. },
  82. {
  83. "ClamAV": "Win.Trojan.Prorat-11"
  84. },
  85. {
  86. "Kaspersky": "Trojan-Dropper.Win32.Agent.bczn"
  87. },
  88. {
  89. "BitDefender": "Trojan.Generic.7807554"
  90. },
  91. {
  92. "Babable": "Malware.HighConfidence"
  93. },
  94. {
  95. "AegisLab": "Troj.Dropper.W32.Agent.bczn!c"
  96. },
  97. {
  98. "Rising": "Backdoor.Win32.ProRat.i (CLASSIC)"
  99. },
  100. {
  101. "Ad-Aware": "Trojan.Generic.7807554"
  102. },
  103. {
  104. "Emsisoft": "Trojan.Generic.7807554 (B)"
  105. },
  106. {
  107. "Comodo": "Backdoor.Win32.Prorat.~RJ"
  108. },
  109. {
  110. "F-Secure": "Trojan.Generic.7807554"
  111. },
  112. {
  113. "DrWeb": "Trojan.MulDrop.2765"
  114. },
  115. {
  116. "VIPRE": "Trojan.Win32.Small.E (v)"
  117. },
  118. {
  119. "Invincea": "heuristic"
  120. },
  121. {
  122. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  123. },
  124. {
  125. "Sophos": "Troj/Prorat-O"
  126. },
  127. {
  128. "SentinelOne": "static engine - malicious"
  129. },
  130. {
  131. "F-Prot": "W32/ProratP.G"
  132. },
  133. {
  134. "Jiangmin": "TrojanDropper.Small.bjq"
  135. },
  136. {
  137. "Webroot": "W32.Trojan.Gen"
  138. },
  139. {
  140. "Avira": "BDS/Prorat.19.N"
  141. },
  142. {
  143. "Antiy-AVL": "Trojan[Backdoor]/Win32.VB.aoi"
  144. },
  145. {
  146. "Kingsoft": "Win32.Troj.Agent.(kcloud)"
  147. },
  148. {
  149. "Microsoft": "TrojanDropper:Win32/Small"
  150. },
  151. {
  152. "Endgame": "malicious (high confidence)"
  153. },
  154. {
  155. "ViRobot": "Dropper.Small.372947"
  156. },
  157. {
  158. "ZoneAlarm": "Trojan-Dropper.Win32.Agent.bczn"
  159. },
  160. {
  161. "GData": "Trojan.Generic.7807554"
  162. },
  163. {
  164. "AhnLab-V3": "Dropper/Win32.Agent.R10217"
  165. },
  166. {
  167. "McAfee": "Artemis!CB95A8FC3E50"
  168. },
  169. {
  170. "AVware": "Trojan.Win32.Small.E (v)"
  171. },
  172. {
  173. "MAX": "malware (ai score=100)"
  174. },
  175. {
  176. "VBA32": "TrojanDropper.Agent"
  177. },
  178. {
  179. "ESET-NOD32": "Win32/Prorat"
  180. },
  181. {
  182. "Tencent": "Win32.Trojan-dropper.Agent.Tayn"
  183. },
  184. {
  185. "Yandex": "Trojan.DR.Small.AVF1"
  186. },
  187. {
  188. "Ikarus": "Trojan-Dropper.Agent"
  189. },
  190. {
  191. "Fortinet": "W32/Small.RC!tr"
  192. },
  193. {
  194. "AVG": "Win32:Small-BHA [Trj]"
  195. },
  196. {
  197. "Cybereason": "malicious.c3e503"
  198. },
  199. {
  200. "Panda": "Trj/Genetic.gen"
  201. },
  202. {
  203. "CrowdStrike": "malicious_confidence_100% (D)"
  204. },
  205. {
  206. "Qihoo-360": "Malware.Radar05.Gen"
  207. }
  208. ]
  209. },
  210. {
  211. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  212. "Details": [
  213. {
  214. "target": "clamav:Win.Trojan.Prorat-11, sha256:31739ac593945cb154bb410bcaee57a2384c0aa69e097eca8c8c14244fb4f307, type:MS-DOS executable, MZ for MS-DOS"
  215. }
  216. ]
  217. },
  218. {
  219. "Description": "Anomalous binary characteristics",
  220. "Details": [
  221. {
  222. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  223. },
  224. {
  225. "anomaly": "Entrypoint of binary points to a non-executable code section"
  226. }
  227. ]
  228. }
  229. ]
  230.  
  231. [*] Started Service: []
  232.  
  233. [*] Executed Commands: []
  234.  
  235. [*] Mutexes: []
  236.  
  237. [*] Modified Files: []
  238.  
  239. [*] Deleted Files: []
  240.  
  241. [*] Modified Registry Keys: []
  242.  
  243. [*] Deleted Registry Keys: []
  244.  
  245. [*] DNS Communications: []
  246.  
  247. [*] Domains: []
  248.  
  249. [*] Network Communication - ICMP: []
  250.  
  251. [*] Network Communication - HTTP: []
  252.  
  253. [*] Network Communication - SMTP: []
  254.  
  255. [*] Network Communication - Hosts: []
  256.  
  257. [*] Network Communication - IRC: []
  258.  
  259. [*] Static Analysis: {
  260. "pe": {
  261. "peid_signatures": [
  262. [
  263. "FSG v1.33"
  264. ],
  265. [
  266. "FSG v1.33 (Eng) -> dulek/xt"
  267. ],
  268. [
  269. "FSG v1.33 (Eng) -> dulek/xt"
  270. ]
  271. ],
  272. "imports": [
  273. {
  274. "imports": [
  275. {
  276. "name": "LoadLibraryA",
  277. "address": "0x403f3b"
  278. },
  279. {
  280. "name": "GetProcAddress",
  281. "address": "0x403f3f"
  282. }
  283. ],
  284. "dll": "KERNEL32.dll"
  285. }
  286. ],
  287. "digital_signers": null,
  288. "exported_dll_name": null,
  289. "actual_checksum": "0x0006209e",
  290. "overlay": {
  291. "size": "0x00055a89",
  292. "offset": "0x00001147"
  293. },
  294. "imagebase": "0x00400000",
  295. "reported_checksum": "0x00000000",
  296. "icon_hash": null,
  297. "entrypoint": "0x00403e4e",
  298. "timestamp": "1987-09-11 01:35:02",
  299. "osversion": "4.0",
  300. "sections": [
  301. {
  302. "name": "t",
  303. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  304. "virtual_address": "0x00001000",
  305. "size_of_data": "0x00000000",
  306. "entropy": "0.00",
  307. "raw_address": "0x00000000",
  308. "virtual_size": "0x00002000",
  309. "characteristics_raw": "0xc00000e0"
  310. },
  311. {
  312. "name": "c",
  313. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  314. "virtual_address": "0x00003000",
  315. "size_of_data": "0x00000f47",
  316. "entropy": "5.92",
  317. "raw_address": "0x00000200",
  318. "virtual_size": "0x00001000",
  319. "characteristics_raw": "0xc00000e0"
  320. }
  321. ],
  322. "resources": [],
  323. "dirents": [
  324. {
  325. "virtual_address": "0x00000000",
  326. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  327. "size": "0x00000000"
  328. },
  329. {
  330. "virtual_address": "0x00003f13",
  331. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  332. "size": "0x00000034"
  333. },
  334. {
  335. "virtual_address": "0x00003000",
  336. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  337. "size": "0x00000960"
  338. },
  339. {
  340. "virtual_address": "0x00000000",
  341. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  342. "size": "0x00000000"
  343. },
  344. {
  345. "virtual_address": "0x00000000",
  346. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  347. "size": "0x00000000"
  348. },
  349. {
  350. "virtual_address": "0x00000000",
  351. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  352. "size": "0x00000000"
  353. },
  354. {
  355. "virtual_address": "0x00000000",
  356. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  357. "size": "0x00000000"
  358. },
  359. {
  360. "virtual_address": "0x00000000",
  361. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  362. "size": "0x00000000"
  363. },
  364. {
  365. "virtual_address": "0x00000000",
  366. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  367. "size": "0x00000000"
  368. },
  369. {
  370. "virtual_address": "0x00000000",
  371. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  372. "size": "0x00000000"
  373. },
  374. {
  375. "virtual_address": "0x00000000",
  376. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  377. "size": "0x00000000"
  378. },
  379. {
  380. "virtual_address": "0x00000000",
  381. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  382. "size": "0x00000000"
  383. },
  384. {
  385. "virtual_address": "0x00000000",
  386. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  387. "size": "0x00000000"
  388. },
  389. {
  390. "virtual_address": "0x00000000",
  391. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  392. "size": "0x00000000"
  393. },
  394. {
  395. "virtual_address": "0x00000000",
  396. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  397. "size": "0x00000000"
  398. },
  399. {
  400. "virtual_address": "0x00000000",
  401. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  402. "size": "0x00000000"
  403. }
  404. ],
  405. "exports": [],
  406. "guest_signers": {},
  407. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  408. "icon_fuzzy": null,
  409. "icon": null,
  410. "pdbpath": null,
  411. "imported_dll_count": 1,
  412. "versioninfo": []
  413. }
  414. }
  415.  
  416. [*] Resolved APIs: []
  417.  
  418. [*] Static Analysis: {
  419. "pe": {
  420. "peid_signatures": [
  421. [
  422. "FSG v1.33"
  423. ],
  424. [
  425. "FSG v1.33 (Eng) -> dulek/xt"
  426. ],
  427. [
  428. "FSG v1.33 (Eng) -> dulek/xt"
  429. ]
  430. ],
  431. "imports": [
  432. {
  433. "imports": [
  434. {
  435. "name": "LoadLibraryA",
  436. "address": "0x403f3b"
  437. },
  438. {
  439. "name": "GetProcAddress",
  440. "address": "0x403f3f"
  441. }
  442. ],
  443. "dll": "KERNEL32.dll"
  444. }
  445. ],
  446. "digital_signers": null,
  447. "exported_dll_name": null,
  448. "actual_checksum": "0x0006209e",
  449. "overlay": {
  450. "size": "0x00055a89",
  451. "offset": "0x00001147"
  452. },
  453. "imagebase": "0x00400000",
  454. "reported_checksum": "0x00000000",
  455. "icon_hash": null,
  456. "entrypoint": "0x00403e4e",
  457. "timestamp": "1987-09-11 01:35:02",
  458. "osversion": "4.0",
  459. "sections": [
  460. {
  461. "name": "t",
  462. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  463. "virtual_address": "0x00001000",
  464. "size_of_data": "0x00000000",
  465. "entropy": "0.00",
  466. "raw_address": "0x00000000",
  467. "virtual_size": "0x00002000",
  468. "characteristics_raw": "0xc00000e0"
  469. },
  470. {
  471. "name": "c",
  472. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  473. "virtual_address": "0x00003000",
  474. "size_of_data": "0x00000f47",
  475. "entropy": "5.92",
  476. "raw_address": "0x00000200",
  477. "virtual_size": "0x00001000",
  478. "characteristics_raw": "0xc00000e0"
  479. }
  480. ],
  481. "resources": [],
  482. "dirents": [
  483. {
  484. "virtual_address": "0x00000000",
  485. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  486. "size": "0x00000000"
  487. },
  488. {
  489. "virtual_address": "0x00003f13",
  490. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  491. "size": "0x00000034"
  492. },
  493. {
  494. "virtual_address": "0x00003000",
  495. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  496. "size": "0x00000960"
  497. },
  498. {
  499. "virtual_address": "0x00000000",
  500. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  501. "size": "0x00000000"
  502. },
  503. {
  504. "virtual_address": "0x00000000",
  505. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  506. "size": "0x00000000"
  507. },
  508. {
  509. "virtual_address": "0x00000000",
  510. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  511. "size": "0x00000000"
  512. },
  513. {
  514. "virtual_address": "0x00000000",
  515. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  516. "size": "0x00000000"
  517. },
  518. {
  519. "virtual_address": "0x00000000",
  520. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  521. "size": "0x00000000"
  522. },
  523. {
  524. "virtual_address": "0x00000000",
  525. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  526. "size": "0x00000000"
  527. },
  528. {
  529. "virtual_address": "0x00000000",
  530. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  531. "size": "0x00000000"
  532. },
  533. {
  534. "virtual_address": "0x00000000",
  535. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  536. "size": "0x00000000"
  537. },
  538. {
  539. "virtual_address": "0x00000000",
  540. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  541. "size": "0x00000000"
  542. },
  543. {
  544. "virtual_address": "0x00000000",
  545. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  546. "size": "0x00000000"
  547. },
  548. {
  549. "virtual_address": "0x00000000",
  550. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  551. "size": "0x00000000"
  552. },
  553. {
  554. "virtual_address": "0x00000000",
  555. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  556. "size": "0x00000000"
  557. },
  558. {
  559. "virtual_address": "0x00000000",
  560. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  561. "size": "0x00000000"
  562. }
  563. ],
  564. "exports": [],
  565. "guest_signers": {},
  566. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  567. "icon_fuzzy": null,
  568. "icon": null,
  569. "pdbpath": null,
  570. "imported_dll_count": 1,
  571. "versioninfo": []
  572. }
  573. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!