[*] MalFamily: ""

[*] MalScore: 10.0

[*] File Name: "Exes_70a5e4589a73955f232f268b2f72afb1.exe"
[*] File Size: 643072
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "de535442beb49845644de71f520bcc701667178bbc96da39f84a653fa1750680"
[*] MD5: "70a5e4589a73955f232f268b2f72afb1"
[*] SHA1: "a8e6308a7a0d1f3a4345e2da4e9e563b1e26f18d"
[*] SHA512: "fa03452e8d5cded476d737008a84695d845f76f45eb75ead1b0c8ac13fb460bbb088c70e2349581decff4bdf43991d3dd7ea3c1096165d9fd1f187ea90abb835"
[*] CRC32: "6F02DE0C"
[*] SSDEEP: "12288:RZsT8Ys+GgRQstXib3mAdGXYyYxFfyRcj/fhGv:Y4p+GaQstW33dsxrw3h"

[*] Process Execution: [
    "Exes_70a5e4589a73955f232f268b2f72afb1.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details": [
            {
                "Spam": "Exes_70a5e4589a73955f232f268b2f72afb1.exe (200) called API CreateProcessInternalW 42655 times"
            }
        ]
    },
    {
        "Description": "File has been identified by 26 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "McAfee": "Fareit-FPH!70A5E4589A73"
            },
            {
                "F-Prot": "W32/Wacatac.F.gen!Eldorado"
            },
            {
                "Symantec": "ML.Attribute.HighConfidence"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "Backdoor.Win32.NetWiredRC.hna"
            },
            {
                "AegisLab": "Trojan.Win32.NetWiredRC.4!c"
            },
            {
                "Avast": "Win32:Malware-gen"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Sophos": "Mal/Generic-S"
            },
            {
                "DrWeb": "Trojan.PWS.Banker1.33239"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.jm"
            },
            {
                "Trapmine": "malicious.moderate.ml.score"
            },
            {
                "FireEye": "Generic.mg.70a5e4589a73955f"
            },
            {
                "Cyren": "W32/Wacatac.F.gen!Eldorado"
            },
            {
                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
            },
            {
                "ZoneAlarm": "Backdoor.Win32.NetWiredRC.hna"
            },
            {
                "Malwarebytes": "Trojan.MalPack.VB.Generic"
            },
            {
                "ESET-NOD32": "a variant of Win32/GenKryptik.DMBU"
            },
            {
                "Rising": "Trojan.Injector!8.C4 (CLOUD)"
            },
            {
                "Ikarus": "Trojan.VB.Crypt"
            },
            {
                "Fortinet": "W32/Injector.EGIR!tr"
            },
            {
                "AVG": "Win32:Malware-gen"
            },
            {
                "Cybereason": "malicious.a7a0d1"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: [
    "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\Exes_70a5e4589a73955f232f268b2f72afb1.exe\""
]

[*] Mutexes: [
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1"
]

[*] Modified Files: []

[*] Deleted Files: []

[*] Modified Registry Keys: []

[*] Deleted Registry Keys: []

[*] DNS Communications: []

[*] Domains: []

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "MethCallEngine",
                        "address": "0x401000"
                    },
                    {
                        "name": null,
                        "address": "0x401004"
                    },
                    {
                        "name": null,
                        "address": "0x401008"
                    },
                    {
                        "name": null,
                        "address": "0x40100c"
                    },
                    {
                        "name": null,
                        "address": "0x401010"
                    },
                    {
                        "name": null,
                        "address": "0x401014"
                    },
                    {
                        "name": null,
                        "address": "0x401018"
                    },
                    {
                        "name": null,
                        "address": "0x40101c"
                    },
                    {
                        "name": null,
                        "address": "0x401020"
                    },
                    {
                        "name": null,
                        "address": "0x401024"
                    },
                    {
                        "name": null,
                        "address": "0x401028"
                    },
                    {
                        "name": null,
                        "address": "0x40102c"
                    },
                    {
                        "name": "EVENT_SINK_AddRef",
                        "address": "0x401030"
                    },
                    {
                        "name": null,
                        "address": "0x401034"
                    },
                    {
                        "name": null,
                        "address": "0x401038"
                    },
                    {
                        "name": "EVENT_SINK_Release",
                        "address": "0x40103c"
                    },
                    {
                        "name": null,
                        "address": "0x401040"
                    },
                    {
                        "name": "EVENT_SINK_QueryInterface",
                        "address": "0x401044"
                    },
                    {
                        "name": "__vbaExceptHandler",
                        "address": "0x401048"
                    },
                    {
                        "name": null,
                        "address": "0x40104c"
                    },
                    {
                        "name": null,
                        "address": "0x401050"
                    },
                    {
                        "name": null,
                        "address": "0x401054"
                    },
                    {
                        "name": null,
                        "address": "0x401058"
                    },
                    {
                        "name": null,
                        "address": "0x40105c"
                    },
                    {
                        "name": null,
                        "address": "0x401060"
                    },
                    {
                        "name": null,
                        "address": "0x401064"
                    },
                    {
                        "name": null,
                        "address": "0x401068"
                    },
                    {
                        "name": null,
                        "address": "0x40106c"
                    },
                    {
                        "name": null,
                        "address": "0x401070"
                    }
                ],
                "dll": "MSVBVM60.DLL"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x000a6a41",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x000a6a41",
        "icon_hash": null,
        "entrypoint": "0x00401130",
        "timestamp": "2019-06-30 21:00:22",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00098000",
                "entropy": "5.48",
                "raw_address": "0x00001000",
                "virtual_size": "0x00097330",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00099000",
                "size_of_data": "0x00000000",
                "entropy": "0.00",
                "raw_address": "0x00000000",
                "virtual_size": "0x00005444",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0009f000",
                "size_of_data": "0x00004000",
                "entropy": "4.06",
                "raw_address": "0x00099000",
                "virtual_size": "0x0000396e",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00098214",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000028"
            },
            {
                "virtual_address": "0x0009f000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x0000396e"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000220",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000020"
            },
            {
                "virtual_address": "0x00001000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000078"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "2977270fae1bfe1cc3a3258b5bc0e2ed",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "oleaut32.dll.OleLoadPictureEx",
    "oleaut32.dll.DispCallFunc",
    "oleaut32.dll.LoadTypeLibEx",
    "oleaut32.dll.UnRegisterTypeLib",
    "oleaut32.dll.CreateTypeLib2",
    "oleaut32.dll.VarDateFromUdate",
    "oleaut32.dll.VarUdateFromDate",
    "oleaut32.dll.GetAltMonthNames",
    "oleaut32.dll.VarNumFromParseNum",
    "oleaut32.dll.VarParseNumFromStr",
    "oleaut32.dll.VarDecFromR4",
    "oleaut32.dll.VarDecFromR8",
    "oleaut32.dll.VarDecFromDate",
    "oleaut32.dll.VarDecFromI4",
    "oleaut32.dll.VarDecFromCy",
    "oleaut32.dll.VarR4FromDec",
    "oleaut32.dll.GetRecordInfoFromTypeInfo",
    "oleaut32.dll.GetRecordInfoFromGuids",
    "oleaut32.dll.SafeArrayGetRecordInfo",
    "oleaut32.dll.SafeArraySetRecordInfo",
    "oleaut32.dll.SafeArrayGetIID",
    "oleaut32.dll.SafeArraySetIID",
    "oleaut32.dll.SafeArrayCopyData",
    "oleaut32.dll.SafeArrayAllocDescriptorEx",
    "oleaut32.dll.SafeArrayCreateEx",
    "oleaut32.dll.VarFormat",
    "oleaut32.dll.VarFormatDateTime",
    "oleaut32.dll.VarFormatNumber",
    "oleaut32.dll.VarFormatPercent",
    "oleaut32.dll.VarFormatCurrency",
    "oleaut32.dll.VarWeekdayName",
    "oleaut32.dll.VarMonthName",
    "oleaut32.dll.VarAdd",
    "oleaut32.dll.VarAnd",
    "oleaut32.dll.VarCat",
    "oleaut32.dll.VarDiv",
    "oleaut32.dll.VarEqv",
    "oleaut32.dll.VarIdiv",
    "oleaut32.dll.VarImp",
    "oleaut32.dll.VarMod",
    "oleaut32.dll.VarMul",
    "oleaut32.dll.VarOr",
    "oleaut32.dll.VarPow",
    "oleaut32.dll.VarSub",
    "oleaut32.dll.VarXor",
    "oleaut32.dll.VarAbs",
    "oleaut32.dll.VarFix",
    "oleaut32.dll.VarInt",
    "oleaut32.dll.VarNeg",
    "oleaut32.dll.VarNot",
    "oleaut32.dll.VarRound",
    "oleaut32.dll.VarCmp",
    "oleaut32.dll.VarDecAdd",
    "oleaut32.dll.VarDecCmp",
    "oleaut32.dll.VarBstrCat",
    "oleaut32.dll.VarCyMulI4",
    "oleaut32.dll.VarBstrCmp",
    "ole32.dll.CoCreateInstanceEx",
    "ole32.dll.CLSIDFromProgIDEx",
    "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
    "user32.dll.GetSystemMetrics",
    "user32.dll.MonitorFromWindow",
    "user32.dll.MonitorFromRect",
    "user32.dll.MonitorFromPoint",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.GetMonitorInfoA",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "gdi32.dll.GetLayout",
    "gdi32.dll.GdiRealizationInfo",
    "gdi32.dll.FontIsLinked",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "gdi32.dll.GetTextFaceAliasW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "gdi32.dll.GetFontAssocStatus",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegEnumKeyExW",
    "gdi32.dll.GdiIsMetaPrintDC",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoRegisterInitializeSpy",
    "ole32.dll.CoRevokeInitializeSpy",
    "gdi32.dll.GetTextExtentExPointWPri",
    "kernel32.dll.NlsGetCacheUpdateCount",
    "kernel32.dll.GetCalendarInfoW",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.Sleep",
    "user32.dll.GetCursorPos",
    "user32.dll.EnumWindows",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.SetLastError",
    "kernel32.dll.VirtualAllocEx",
    "kernel32.dll.CloseHandle",
    "shell32.dll.ShellExecuteW",
    "kernel32.dll.WriteFile",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.VirtualProtectEx",
    "kernel32.dll.CreateProcessInternalW",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.GetLongPathNameW",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.ReadFile",
    "ntdll.dll.NtProtectVirtualMemory",
    "kernel32.dll.GetCommandLineW"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "MethCallEngine",
                        "address": "0x401000"
                    },
                    {
                        "name": null,
                        "address": "0x401004"
                    },
                    {
                        "name": null,
                        "address": "0x401008"
                    },
                    {
                        "name": null,
                        "address": "0x40100c"
                    },
                    {
                        "name": null,
                        "address": "0x401010"
                    },
                    {
                        "name": null,
                        "address": "0x401014"
                    },
                    {
                        "name": null,
                        "address": "0x401018"
                    },
                    {
                        "name": null,
                        "address": "0x40101c"
                    },
                    {
                        "name": null,
                        "address": "0x401020"
                    },
                    {
                        "name": null,
                        "address": "0x401024"
                    },
                    {
                        "name": null,
                        "address": "0x401028"
                    },
                    {
                        "name": null,
                        "address": "0x40102c"
                    },
                    {
                        "name": "EVENT_SINK_AddRef",
                        "address": "0x401030"
                    },
                    {
                        "name": null,
                        "address": "0x401034"
                    },
                    {
                        "name": null,
                        "address": "0x401038"
                    },
                    {
                        "name": "EVENT_SINK_Release",
                        "address": "0x40103c"
                    },
                    {
                        "name": null,
                        "address": "0x401040"
                    },
                    {
                        "name": "EVENT_SINK_QueryInterface",
                        "address": "0x401044"
                    },
                    {
                        "name": "__vbaExceptHandler",
                        "address": "0x401048"
                    },
                    {
                        "name": null,
                        "address": "0x40104c"
                    },
                    {
                        "name": null,
                        "address": "0x401050"
                    },
                    {
                        "name": null,
                        "address": "0x401054"
                    },
                    {
                        "name": null,
                        "address": "0x401058"
                    },
                    {
                        "name": null,
                        "address": "0x40105c"
                    },
                    {
                        "name": null,
                        "address": "0x401060"
                    },
                    {
                        "name": null,
                        "address": "0x401064"
                    },
                    {
                        "name": null,
                        "address": "0x401068"
                    },
                    {
                        "name": null,
                        "address": "0x40106c"
                    },
                    {
                        "name": null,
                        "address": "0x401070"
                    }
                ],
                "dll": "MSVBVM60.DLL"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x000a6a41",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x000a6a41",
        "icon_hash": null,
        "entrypoint": "0x00401130",
        "timestamp": "2019-06-30 21:00:22",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00098000",
                "entropy": "5.48",
                "raw_address": "0x00001000",
                "virtual_size": "0x00097330",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00099000",
                "size_of_data": "0x00000000",
                "entropy": "0.00",
                "raw_address": "0x00000000",
                "virtual_size": "0x00005444",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0009f000",
                "size_of_data": "0x00004000",
                "entropy": "4.06",
                "raw_address": "0x00099000",
                "virtual_size": "0x0000396e",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00098214",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000028"
            },
            {
                "virtual_address": "0x0009f000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x0000396e"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000220",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000020"
            },
            {
                "virtual_address": "0x00001000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000078"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "2977270fae1bfe1cc3a3258b5bc0e2ed",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}