API tools faq
paste
paladin316

Exes_fb239c81b457225af2ef05346bed30f9_exe_2019-06-28_12_30.json

paladin316
Jun 28th, 2019
2,177
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 16.85 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Pswtool"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_fb239c81b457225af2ef05346bed30f9.exe"
  7. [*] File Size: 176128
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "e01b76e3bd26c8eb895cdd81712a14bc593f59c78df1f6ce1224a948f3d0ee9a"
  10. [*] MD5: "fb239c81b457225af2ef05346bed30f9"
  11. [*] SHA1: "f3a49e6ae66ce95f4e99126cd9e28f59a6db1c5e"
  12. [*] SHA512: "c20398bd1d750cb628576f6daf5ce6b7f505eaf117cf82def80155b7cc5cc60d0c10e93174f814bbd854d3c8bea50782d481a4f4d78f88153e730e7bffd092f9"
  13. [*] CRC32: "952AB580"
  14. [*] SSDEEP: "3072:5PS0iqsJmi2xvRpUR6eoXThFSTYIMzfwNwfLvVH8Tmq2Iu/XNgQMOe9U4f6huKUs:RJ6miCaahFO7GYNwf7J8Tm/jutOe9U4a"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: UPX1, entropy: 7.79, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0002a800, virtual_size: 0x0002b000"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "The executable is compressed using UPX",
  29. "Details": [
  30. {
  31. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00073000"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "File has been identified by 40 Antiviruses on VirusTotal as malicious",
  37. "Details": [
  38. {
  39. "MicroWorld-eScan": "Trojan.GenericKD.1364646"
  40. },
  41. {
  42. "McAfee": "RDN/Generic PWS.y!tf"
  43. },
  44. {
  45. "Cylance": "Unsafe"
  46. },
  47. {
  48. "Zillya": "Tool.WinPassViewer.Win32.21"
  49. },
  50. {
  51. "TheHacker": "Trojan/Agent.vcv"
  52. },
  53. {
  54. "K7GW": "Trojan ( 004bb7951 )"
  55. },
  56. {
  57. "K7AntiVirus": "Trojan ( 004bb7951 )"
  58. },
  59. {
  60. "Arcabit": "Trojan.Generic.D14D2A6"
  61. },
  62. {
  63. "TrendMicro": "HKTL_PWDUMP"
  64. },
  65. {
  66. "Symantec": "PasswordRevealer"
  67. },
  68. {
  69. "TrendMicro-HouseCall": "HKTL_PWDUMP"
  70. },
  71. {
  72. "Avast": "FileRepMalware [PUP]"
  73. },
  74. {
  75. "ClamAV": "Win.Trojan.Generickd-295"
  76. },
  77. {
  78. "Kaspersky": "not-a-virus:PSWTool.Win32.WinPassViewer.bd"
  79. },
  80. {
  81. "BitDefender": "Trojan.GenericKD.1364646"
  82. },
  83. {
  84. "NANO-Antivirus": "Trojan.Win32.Agent.cqkgqo"
  85. },
  86. {
  87. "Rising": "Trojan.Agent!8.B1E (CLOUD)"
  88. },
  89. {
  90. "Ad-Aware": "Trojan.GenericKD.1364646"
  91. },
  92. {
  93. "Emsisoft": "Trojan.GenericKD.1364646 (B)"
  94. },
  95. {
  96. "F-Secure": "Trojan.GenericKD.1364646"
  97. },
  98. {
  99. "DrWeb": "Tool.PassView.996"
  100. },
  101. {
  102. "VIPRE": "Trojan.Win32.Generic!BT"
  103. },
  104. {
  105. "Invincea": "heuristic"
  106. },
  107. {
  108. "McAfee-GW-Edition": "RDN/Generic PWS.y!tf"
  109. },
  110. {
  111. "Sophos": "Generic PUA PD (PUA)"
  112. },
  113. {
  114. "Webroot": "W32.Trojan.GenKD"
  115. },
  116. {
  117. "Avira": "HEUR/AGEN.1015433"
  118. },
  119. {
  120. "MAX": "malware (ai score=100)"
  121. },
  122. {
  123. "Antiy-AVL": "Trojan[PSWTool]/Win32.WinPassViewer"
  124. },
  125. {
  126. "Microsoft": "HackTool:Win32/Passbocen"
  127. },
  128. {
  129. "Endgame": "malicious (moderate confidence)"
  130. },
  131. {
  132. "ZoneAlarm": "not-a-virus:PSWTool.Win32.WinPassViewer.bd"
  133. },
  134. {
  135. "ALYac": "Trojan.GenericKD.1364646"
  136. },
  137. {
  138. "ESET-NOD32": "a variant of Win32/Agent.VCV"
  139. },
  140. {
  141. "Tencent": "Win32.Trojan.Generic.Eddj"
  142. },
  143. {
  144. "Yandex": "Riskware.PSWTool!"
  145. },
  146. {
  147. "Ikarus": "Trojan-PWS.Win32.OnLineGames"
  148. },
  149. {
  150. "AVG": "FileRepMalware [PUP]"
  151. },
  152. {
  153. "Cybereason": "malicious.1b4572"
  154. },
  155. {
  156. "Panda": "Trj/CI.A"
  157. }
  158. ]
  159. }
  160. ]
  161.  
  162. [*] Started Service: []
  163.  
  164. [*] Executed Commands: []
  165.  
  166. [*] Mutexes: []
  167.  
  168. [*] Modified Files: []
  169.  
  170. [*] Deleted Files: []
  171.  
  172. [*] Modified Registry Keys: []
  173.  
  174. [*] Deleted Registry Keys: []
  175.  
  176. [*] DNS Communications: []
  177.  
  178. [*] Domains: []
  179.  
  180. [*] Network Communication - ICMP: []
  181.  
  182. [*] Network Communication - HTTP: []
  183.  
  184. [*] Network Communication - SMTP: []
  185.  
  186. [*] Network Communication - Hosts: []
  187.  
  188. [*] Network Communication - IRC: []
  189.  
  190. [*] Static Analysis: {
  191. "pe": {
  192. "peid_signatures": [
  193. [
  194. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  195. ]
  196. ],
  197. "imports": [
  198. {
  199. "imports": [
  200. {
  201. "name": "LoadLibraryA",
  202. "address": "0x49f230"
  203. },
  204. {
  205. "name": "GetProcAddress",
  206. "address": "0x49f234"
  207. },
  208. {
  209. "name": "VirtualProtect",
  210. "address": "0x49f238"
  211. },
  212. {
  213. "name": "ExitProcess",
  214. "address": "0x49f23c"
  215. }
  216. ],
  217. "dll": "KERNEL32.DLL"
  218. },
  219. {
  220. "imports": [
  221. {
  222. "name": "OpenProcessToken",
  223. "address": "0x49f244"
  224. }
  225. ],
  226. "dll": "ADVAPI32.dll"
  227. }
  228. ],
  229. "digital_signers": null,
  230. "exported_dll_name": null,
  231. "actual_checksum": "0x0002ea63",
  232. "overlay": null,
  233. "imagebase": "0x00400000",
  234. "reported_checksum": "0x00000000",
  235. "icon_hash": null,
  236. "entrypoint": "0x0049e5f0",
  237. "timestamp": "2012-11-05 20:52:21",
  238. "osversion": "5.0",
  239. "sections": [
  240. {
  241. "name": "UPX0",
  242. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  243. "virtual_address": "0x00001000",
  244. "size_of_data": "0x00000000",
  245. "entropy": "0.00",
  246. "raw_address": "0x00000400",
  247. "virtual_size": "0x00073000",
  248. "characteristics_raw": "0xe0000080"
  249. },
  250. {
  251. "name": "UPX1",
  252. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  253. "virtual_address": "0x00074000",
  254. "size_of_data": "0x0002a800",
  255. "entropy": "7.79",
  256. "raw_address": "0x00000400",
  257. "virtual_size": "0x0002b000",
  258. "characteristics_raw": "0xe0000040"
  259. },
  260. {
  261. "name": ".rsrc",
  262. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  263. "virtual_address": "0x0009f000",
  264. "size_of_data": "0x00000400",
  265. "entropy": "3.89",
  266. "raw_address": "0x0002ac00",
  267. "virtual_size": "0x00001000",
  268. "characteristics_raw": "0xc0000040"
  269. }
  270. ],
  271. "resources": [],
  272. "dirents": [
  273. {
  274. "virtual_address": "0x00000000",
  275. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  276. "size": "0x00000000"
  277. },
  278. {
  279. "virtual_address": "0x0009f1f4",
  280. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  281. "size": "0x000000c4"
  282. },
  283. {
  284. "virtual_address": "0x0009f000",
  285. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  286. "size": "0x000001f4"
  287. },
  288. {
  289. "virtual_address": "0x00000000",
  290. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  291. "size": "0x00000000"
  292. },
  293. {
  294. "virtual_address": "0x00000000",
  295. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  296. "size": "0x00000000"
  297. },
  298. {
  299. "virtual_address": "0x0009f2b8",
  300. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  301. "size": "0x0000000c"
  302. },
  303. {
  304. "virtual_address": "0x00000000",
  305. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  306. "size": "0x00000000"
  307. },
  308. {
  309. "virtual_address": "0x00000000",
  310. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  311. "size": "0x00000000"
  312. },
  313. {
  314. "virtual_address": "0x00000000",
  315. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  316. "size": "0x00000000"
  317. },
  318. {
  319. "virtual_address": "0x00000000",
  320. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  321. "size": "0x00000000"
  322. },
  323. {
  324. "virtual_address": "0x00000000",
  325. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  326. "size": "0x00000000"
  327. },
  328. {
  329. "virtual_address": "0x00000000",
  330. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  331. "size": "0x00000000"
  332. },
  333. {
  334. "virtual_address": "0x00000000",
  335. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  336. "size": "0x00000000"
  337. },
  338. {
  339. "virtual_address": "0x00000000",
  340. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  341. "size": "0x00000000"
  342. },
  343. {
  344. "virtual_address": "0x00000000",
  345. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  346. "size": "0x00000000"
  347. },
  348. {
  349. "virtual_address": "0x00000000",
  350. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  351. "size": "0x00000000"
  352. }
  353. ],
  354. "exports": [],
  355. "guest_signers": {},
  356. "imphash": "4c0203f51e70a2c15ee29fba1bf41637",
  357. "icon_fuzzy": null,
  358. "icon": null,
  359. "pdbpath": null,
  360. "imported_dll_count": 2,
  361. "versioninfo": []
  362. }
  363. }
  364.  
  365. [*] Resolved APIs: []
  366.  
  367. [*] Static Analysis: {
  368. "pe": {
  369. "peid_signatures": [
  370. [
  371. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  372. ]
  373. ],
  374. "imports": [
  375. {
  376. "imports": [
  377. {
  378. "name": "LoadLibraryA",
  379. "address": "0x49f230"
  380. },
  381. {
  382. "name": "GetProcAddress",
  383. "address": "0x49f234"
  384. },
  385. {
  386. "name": "VirtualProtect",
  387. "address": "0x49f238"
  388. },
  389. {
  390. "name": "ExitProcess",
  391. "address": "0x49f23c"
  392. }
  393. ],
  394. "dll": "KERNEL32.DLL"
  395. },
  396. {
  397. "imports": [
  398. {
  399. "name": "OpenProcessToken",
  400. "address": "0x49f244"
  401. }
  402. ],
  403. "dll": "ADVAPI32.dll"
  404. }
  405. ],
  406. "digital_signers": null,
  407. "exported_dll_name": null,
  408. "actual_checksum": "0x0002ea63",
  409. "overlay": null,
  410. "imagebase": "0x00400000",
  411. "reported_checksum": "0x00000000",
  412. "icon_hash": null,
  413. "entrypoint": "0x0049e5f0",
  414. "timestamp": "2012-11-05 20:52:21",
  415. "osversion": "5.0",
  416. "sections": [
  417. {
  418. "name": "UPX0",
  419. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  420. "virtual_address": "0x00001000",
  421. "size_of_data": "0x00000000",
  422. "entropy": "0.00",
  423. "raw_address": "0x00000400",
  424. "virtual_size": "0x00073000",
  425. "characteristics_raw": "0xe0000080"
  426. },
  427. {
  428. "name": "UPX1",
  429. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  430. "virtual_address": "0x00074000",
  431. "size_of_data": "0x0002a800",
  432. "entropy": "7.79",
  433. "raw_address": "0x00000400",
  434. "virtual_size": "0x0002b000",
  435. "characteristics_raw": "0xe0000040"
  436. },
  437. {
  438. "name": ".rsrc",
  439. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  440. "virtual_address": "0x0009f000",
  441. "size_of_data": "0x00000400",
  442. "entropy": "3.89",
  443. "raw_address": "0x0002ac00",
  444. "virtual_size": "0x00001000",
  445. "characteristics_raw": "0xc0000040"
  446. }
  447. ],
  448. "resources": [],
  449. "dirents": [
  450. {
  451. "virtual_address": "0x00000000",
  452. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  453. "size": "0x00000000"
  454. },
  455. {
  456. "virtual_address": "0x0009f1f4",
  457. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  458. "size": "0x000000c4"
  459. },
  460. {
  461. "virtual_address": "0x0009f000",
  462. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  463. "size": "0x000001f4"
  464. },
  465. {
  466. "virtual_address": "0x00000000",
  467. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  468. "size": "0x00000000"
  469. },
  470. {
  471. "virtual_address": "0x00000000",
  472. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  473. "size": "0x00000000"
  474. },
  475. {
  476. "virtual_address": "0x0009f2b8",
  477. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  478. "size": "0x0000000c"
  479. },
  480. {
  481. "virtual_address": "0x00000000",
  482. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  483. "size": "0x00000000"
  484. },
  485. {
  486. "virtual_address": "0x00000000",
  487. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  488. "size": "0x00000000"
  489. },
  490. {
  491. "virtual_address": "0x00000000",
  492. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  493. "size": "0x00000000"
  494. },
  495. {
  496. "virtual_address": "0x00000000",
  497. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  498. "size": "0x00000000"
  499. },
  500. {
  501. "virtual_address": "0x00000000",
  502. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  503. "size": "0x00000000"
  504. },
  505. {
  506. "virtual_address": "0x00000000",
  507. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  508. "size": "0x00000000"
  509. },
  510. {
  511. "virtual_address": "0x00000000",
  512. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  513. "size": "0x00000000"
  514. },
  515. {
  516. "virtual_address": "0x00000000",
  517. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  518. "size": "0x00000000"
  519. },
  520. {
  521. "virtual_address": "0x00000000",
  522. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  523. "size": "0x00000000"
  524. },
  525. {
  526. "virtual_address": "0x00000000",
  527. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  528. "size": "0x00000000"
  529. }
  530. ],
  531. "exports": [],
  532. "guest_signers": {},
  533. "imphash": "4c0203f51e70a2c15ee29fba1bf41637",
  534. "icon_fuzzy": null,
  535. "icon": null,
  536. "pdbpath": null,
  537. "imported_dll_count": 2,
  538. "versioninfo": []
  539. }
  540. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!