API tools faq
paste
paladin316

Exes_cb95a8fc3e50377b222be0289b90a0f4_exe_2019-07-02_01_30.json

paladin316
Jul 1st, 2019
2,170
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 16.71 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Small"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_cb95a8fc3e50377b222be0289b90a0f4.exe"
  7. [*] File Size: 355280
  8. [*] File Type: "MS-DOS executable, MZ for MS-DOS"
  9. [*] SHA256: "31739ac593945cb154bb410bcaee57a2384c0aa69e097eca8c8c14244fb4f307"
  10. [*] MD5: "cb95a8fc3e50377b222be0289b90a0f4"
  11. [*] SHA1: "c3c60e075ec892eff9be1d79541d657c4e13093d"
  12. [*] SHA512: "4a68ba84b5c85d45a1a9161ac3a5a2d49be4ef9aa417ce7e1bd8b98169f0ea3ac1f9f1e9c9ec12ffb2487286cfebbb877a3970b0ef34e908b7e7d4e7afa9a91d"
  13. [*] CRC32: "BE826987"
  14. [*] SSDEEP: "6144:YRqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4y1QPf:cqmpplpGoGL3etQoMiXM8gxf/Sj4yQf"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "File has been identified by 62 Antiviruses on VirusTotal as malicious",
  21. "Details": [
  22. {
  23. "Bkav": "W32.DownloadProratA.Trojan"
  24. },
  25. {
  26. "MicroWorld-eScan": "Trojan.Generic.7807554"
  27. },
  28. {
  29. "CMC": "Trojan-Dropper.Win32.Small!O"
  30. },
  31. {
  32. "CAT-QuickHeal": "Backdoor.Prorat.AZ2"
  33. },
  34. {
  35. "ALYac": "Trojan.Generic.7807554"
  36. },
  37. {
  38. "Cylance": "Unsafe"
  39. },
  40. {
  41. "Zillya": "Dropper.Agent.Win32.103592"
  42. },
  43. {
  44. "SUPERAntiSpyware": "Trojan.Agent/Gen-Small"
  45. },
  46. {
  47. "TheHacker": "Trojan/Dropper.Agent.bczn"
  48. },
  49. {
  50. "K7GW": "Trojan ( 0036e6f71 )"
  51. },
  52. {
  53. "K7AntiVirus": "Trojan ( 0036e6f71 )"
  54. },
  55. {
  56. "Arcabit": "Trojan.Generic.D772242"
  57. },
  58. {
  59. "TrendMicro": "TROJ_DROPPER.CKK"
  60. },
  61. {
  62. "Baidu": "Win32.Backdoor.Prorat.e"
  63. },
  64. {
  65. "NANO-Antivirus": "Trojan.Win32.Small.gnhm"
  66. },
  67. {
  68. "Cyren": "W32/ProratP.G"
  69. },
  70. {
  71. "Symantec": "Trojan Horse"
  72. },
  73. {
  74. "TotalDefense": "Win32/SillyDl.SR"
  75. },
  76. {
  77. "TrendMicro-HouseCall": "TROJ_DROPPER.CKK"
  78. },
  79. {
  80. "Avast": "Win32:Small-BHA [Trj]"
  81. },
  82. {
  83. "ClamAV": "Win.Trojan.Prorat-11"
  84. },
  85. {
  86. "Kaspersky": "Trojan-Dropper.Win32.Agent.bczn"
  87. },
  88. {
  89. "BitDefender": "Trojan.Generic.7807554"
  90. },
  91. {
  92. "Babable": "Malware.HighConfidence"
  93. },
  94. {
  95. "AegisLab": "Troj.Dropper.W32.Agent.bczn!c"
  96. },
  97. {
  98. "Rising": "Backdoor.Win32.ProRat.i (CLASSIC)"
  99. },
  100. {
  101. "Ad-Aware": "Trojan.Generic.7807554"
  102. },
  103. {
  104. "Emsisoft": "Trojan.Generic.7807554 (B)"
  105. },
  106. {
  107. "Comodo": "Backdoor.Win32.Prorat.~RJ"
  108. },
  109. {
  110. "F-Secure": "Trojan.Generic.7807554"
  111. },
  112. {
  113. "DrWeb": "Trojan.MulDrop.2765"
  114. },
  115. {
  116. "VIPRE": "Trojan.Win32.Small.E (v)"
  117. },
  118. {
  119. "Invincea": "heuristic"
  120. },
  121. {
  122. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  123. },
  124. {
  125. "Sophos": "Troj/Prorat-O"
  126. },
  127. {
  128. "SentinelOne": "static engine - malicious"
  129. },
  130. {
  131. "F-Prot": "W32/ProratP.G"
  132. },
  133. {
  134. "Jiangmin": "TrojanDropper.Small.bjq"
  135. },
  136. {
  137. "Webroot": "W32.Trojan.Gen"
  138. },
  139. {
  140. "Avira": "BDS/Prorat.19.N"
  141. },
  142. {
  143. "Antiy-AVL": "Trojan[Backdoor]/Win32.VB.aoi"
  144. },
  145. {
  146. "Kingsoft": "Win32.Troj.Agent.(kcloud)"
  147. },
  148. {
  149. "Microsoft": "TrojanDropper:Win32/Small"
  150. },
  151. {
  152. "Endgame": "malicious (high confidence)"
  153. },
  154. {
  155. "ViRobot": "Dropper.Small.372947"
  156. },
  157. {
  158. "ZoneAlarm": "Trojan-Dropper.Win32.Agent.bczn"
  159. },
  160. {
  161. "GData": "Trojan.Generic.7807554"
  162. },
  163. {
  164. "AhnLab-V3": "Dropper/Win32.Agent.R10217"
  165. },
  166. {
  167. "McAfee": "Artemis!CB95A8FC3E50"
  168. },
  169. {
  170. "AVware": "Trojan.Win32.Small.E (v)"
  171. },
  172. {
  173. "MAX": "malware (ai score=100)"
  174. },
  175. {
  176. "VBA32": "TrojanDropper.Agent"
  177. },
  178. {
  179. "ESET-NOD32": "Win32/Prorat"
  180. },
  181. {
  182. "Tencent": "Win32.Trojan-dropper.Agent.Tayn"
  183. },
  184. {
  185. "Yandex": "Trojan.DR.Small.AVF1"
  186. },
  187. {
  188. "Ikarus": "Trojan-Dropper.Agent"
  189. },
  190. {
  191. "Fortinet": "W32/Small.RC!tr"
  192. },
  193. {
  194. "AVG": "Win32:Small-BHA [Trj]"
  195. },
  196. {
  197. "Cybereason": "malicious.c3e503"
  198. },
  199. {
  200. "Panda": "Trj/Genetic.gen"
  201. },
  202. {
  203. "CrowdStrike": "malicious_confidence_100% (D)"
  204. },
  205. {
  206. "Qihoo-360": "Malware.Radar05.Gen"
  207. }
  208. ]
  209. },
  210. {
  211. "Description": "Anomalous binary characteristics",
  212. "Details": [
  213. {
  214. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  215. },
  216. {
  217. "anomaly": "Entrypoint of binary points to a non-executable code section"
  218. }
  219. ]
  220. }
  221. ]
  222.  
  223. [*] Started Service: []
  224.  
  225. [*] Executed Commands: []
  226.  
  227. [*] Mutexes: []
  228.  
  229. [*] Modified Files: []
  230.  
  231. [*] Deleted Files: []
  232.  
  233. [*] Modified Registry Keys: []
  234.  
  235. [*] Deleted Registry Keys: []
  236.  
  237. [*] DNS Communications: []
  238.  
  239. [*] Domains: []
  240.  
  241. [*] Network Communication - ICMP: []
  242.  
  243. [*] Network Communication - HTTP: []
  244.  
  245. [*] Network Communication - SMTP: []
  246.  
  247. [*] Network Communication - Hosts: []
  248.  
  249. [*] Network Communication - IRC: []
  250.  
  251. [*] Static Analysis: {
  252. "pe": {
  253. "peid_signatures": [
  254. [
  255. "FSG v1.33"
  256. ],
  257. [
  258. "FSG v1.33 (Eng) -> dulek/xt"
  259. ],
  260. [
  261. "FSG v1.33 (Eng) -> dulek/xt"
  262. ]
  263. ],
  264. "imports": [
  265. {
  266. "imports": [
  267. {
  268. "name": "LoadLibraryA",
  269. "address": "0x403f3b"
  270. },
  271. {
  272. "name": "GetProcAddress",
  273. "address": "0x403f3f"
  274. }
  275. ],
  276. "dll": "KERNEL32.dll"
  277. }
  278. ],
  279. "digital_signers": null,
  280. "exported_dll_name": null,
  281. "actual_checksum": "0x0006209e",
  282. "overlay": {
  283. "size": "0x00055a89",
  284. "offset": "0x00001147"
  285. },
  286. "imagebase": "0x00400000",
  287. "reported_checksum": "0x00000000",
  288. "icon_hash": null,
  289. "entrypoint": "0x00403e4e",
  290. "timestamp": "1987-09-11 01:35:02",
  291. "osversion": "4.0",
  292. "sections": [
  293. {
  294. "name": "t",
  295. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  296. "virtual_address": "0x00001000",
  297. "size_of_data": "0x00000000",
  298. "entropy": "0.00",
  299. "raw_address": "0x00000000",
  300. "virtual_size": "0x00002000",
  301. "characteristics_raw": "0xc00000e0"
  302. },
  303. {
  304. "name": "c",
  305. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  306. "virtual_address": "0x00003000",
  307. "size_of_data": "0x00000f47",
  308. "entropy": "5.92",
  309. "raw_address": "0x00000200",
  310. "virtual_size": "0x00001000",
  311. "characteristics_raw": "0xc00000e0"
  312. }
  313. ],
  314. "resources": [],
  315. "dirents": [
  316. {
  317. "virtual_address": "0x00000000",
  318. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  319. "size": "0x00000000"
  320. },
  321. {
  322. "virtual_address": "0x00003f13",
  323. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  324. "size": "0x00000034"
  325. },
  326. {
  327. "virtual_address": "0x00003000",
  328. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  329. "size": "0x00000960"
  330. },
  331. {
  332. "virtual_address": "0x00000000",
  333. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  334. "size": "0x00000000"
  335. },
  336. {
  337. "virtual_address": "0x00000000",
  338. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  339. "size": "0x00000000"
  340. },
  341. {
  342. "virtual_address": "0x00000000",
  343. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  344. "size": "0x00000000"
  345. },
  346. {
  347. "virtual_address": "0x00000000",
  348. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  349. "size": "0x00000000"
  350. },
  351. {
  352. "virtual_address": "0x00000000",
  353. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  354. "size": "0x00000000"
  355. },
  356. {
  357. "virtual_address": "0x00000000",
  358. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  359. "size": "0x00000000"
  360. },
  361. {
  362. "virtual_address": "0x00000000",
  363. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  364. "size": "0x00000000"
  365. },
  366. {
  367. "virtual_address": "0x00000000",
  368. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  369. "size": "0x00000000"
  370. },
  371. {
  372. "virtual_address": "0x00000000",
  373. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  374. "size": "0x00000000"
  375. },
  376. {
  377. "virtual_address": "0x00000000",
  378. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  379. "size": "0x00000000"
  380. },
  381. {
  382. "virtual_address": "0x00000000",
  383. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  384. "size": "0x00000000"
  385. },
  386. {
  387. "virtual_address": "0x00000000",
  388. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  389. "size": "0x00000000"
  390. },
  391. {
  392. "virtual_address": "0x00000000",
  393. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  394. "size": "0x00000000"
  395. }
  396. ],
  397. "exports": [],
  398. "guest_signers": {},
  399. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  400. "icon_fuzzy": null,
  401. "icon": null,
  402. "pdbpath": null,
  403. "imported_dll_count": 1,
  404. "versioninfo": []
  405. }
  406. }
  407.  
  408. [*] Resolved APIs: []
  409.  
  410. [*] Static Analysis: {
  411. "pe": {
  412. "peid_signatures": [
  413. [
  414. "FSG v1.33"
  415. ],
  416. [
  417. "FSG v1.33 (Eng) -> dulek/xt"
  418. ],
  419. [
  420. "FSG v1.33 (Eng) -> dulek/xt"
  421. ]
  422. ],
  423. "imports": [
  424. {
  425. "imports": [
  426. {
  427. "name": "LoadLibraryA",
  428. "address": "0x403f3b"
  429. },
  430. {
  431. "name": "GetProcAddress",
  432. "address": "0x403f3f"
  433. }
  434. ],
  435. "dll": "KERNEL32.dll"
  436. }
  437. ],
  438. "digital_signers": null,
  439. "exported_dll_name": null,
  440. "actual_checksum": "0x0006209e",
  441. "overlay": {
  442. "size": "0x00055a89",
  443. "offset": "0x00001147"
  444. },
  445. "imagebase": "0x00400000",
  446. "reported_checksum": "0x00000000",
  447. "icon_hash": null,
  448. "entrypoint": "0x00403e4e",
  449. "timestamp": "1987-09-11 01:35:02",
  450. "osversion": "4.0",
  451. "sections": [
  452. {
  453. "name": "t",
  454. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  455. "virtual_address": "0x00001000",
  456. "size_of_data": "0x00000000",
  457. "entropy": "0.00",
  458. "raw_address": "0x00000000",
  459. "virtual_size": "0x00002000",
  460. "characteristics_raw": "0xc00000e0"
  461. },
  462. {
  463. "name": "c",
  464. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  465. "virtual_address": "0x00003000",
  466. "size_of_data": "0x00000f47",
  467. "entropy": "5.92",
  468. "raw_address": "0x00000200",
  469. "virtual_size": "0x00001000",
  470. "characteristics_raw": "0xc00000e0"
  471. }
  472. ],
  473. "resources": [],
  474. "dirents": [
  475. {
  476. "virtual_address": "0x00000000",
  477. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  478. "size": "0x00000000"
  479. },
  480. {
  481. "virtual_address": "0x00003f13",
  482. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  483. "size": "0x00000034"
  484. },
  485. {
  486. "virtual_address": "0x00003000",
  487. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  488. "size": "0x00000960"
  489. },
  490. {
  491. "virtual_address": "0x00000000",
  492. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  493. "size": "0x00000000"
  494. },
  495. {
  496. "virtual_address": "0x00000000",
  497. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  498. "size": "0x00000000"
  499. },
  500. {
  501. "virtual_address": "0x00000000",
  502. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  503. "size": "0x00000000"
  504. },
  505. {
  506. "virtual_address": "0x00000000",
  507. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  508. "size": "0x00000000"
  509. },
  510. {
  511. "virtual_address": "0x00000000",
  512. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  513. "size": "0x00000000"
  514. },
  515. {
  516. "virtual_address": "0x00000000",
  517. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  518. "size": "0x00000000"
  519. },
  520. {
  521. "virtual_address": "0x00000000",
  522. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  523. "size": "0x00000000"
  524. },
  525. {
  526. "virtual_address": "0x00000000",
  527. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  528. "size": "0x00000000"
  529. },
  530. {
  531. "virtual_address": "0x00000000",
  532. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  533. "size": "0x00000000"
  534. },
  535. {
  536. "virtual_address": "0x00000000",
  537. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  538. "size": "0x00000000"
  539. },
  540. {
  541. "virtual_address": "0x00000000",
  542. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  543. "size": "0x00000000"
  544. },
  545. {
  546. "virtual_address": "0x00000000",
  547. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  548. "size": "0x00000000"
  549. },
  550. {
  551. "virtual_address": "0x00000000",
  552. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  553. "size": "0x00000000"
  554. }
  555. ],
  556. "exports": [],
  557. "guest_signers": {},
  558. "imphash": "87bed5a7cba00c7e1f4015f1bdae2183",
  559. "icon_fuzzy": null,
  560. "icon": null,
  561. "pdbpath": null,
  562. "imported_dll_count": 1,
  563. "versioninfo": []
  564. }
  565. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!