paladin316

Exes_e908270ed1cad4b5f2081c90ec972b13_exe_2019-07-02_01_30.json

Jul 1st, 2019
2,264
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.76 KB | None | 0 0
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_e908270ed1cad4b5f2081c90ec972b13.exe"
  7. [*] File Size: 552960
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f"
  10. [*] MD5: "e908270ed1cad4b5f2081c90ec972b13"
  11. [*] SHA1: "aa3a11069ef6f4d765c4f9fd54405434b554660b"
  12. [*] SHA512: "ef8b4d3560bff36d34a274c4489cf000229421336d367a08c7d6423ec7195800752582091b7049fe9c4d088f9751e55e3158e6839ce593a2dc47521e739da3be"
  13. [*] CRC32: "8DC17533"
  14. [*] SSDEEP: "12288:CDJAkL8AWhyl8gY1Me0U22THSzoPQxeFLx:C9AkLMhyl8/qU22THg"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "File has been identified by 37 Antiviruses on VirusTotal as malicious",
  21. "Details": [
  22. {
  23. "MicroWorld-eScan": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
  24. },
  25. {
  26. "FireEye": "Generic.mg.e908270ed1cad4b5"
  27. },
  28. {
  29. "ALYac": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
  30. },
  31. {
  32. "Malwarebytes": "Trojan.MalPack.VB.Generic"
  33. },
  34. {
  35. "BitDefender": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
  36. },
  37. {
  38. "Invincea": "heuristic"
  39. },
  40. {
  41. "F-Prot": "W32/VBKrypt.RN.gen!Eldorado"
  42. },
  43. {
  44. "Symantec": "ML.Attribute.HighConfidence"
  45. },
  46. {
  47. "APEX": "Malicious"
  48. },
  49. {
  50. "Paloalto": "generic.ml"
  51. },
  52. {
  53. "ClamAV": "Win.Malware.Fareit-7004554-0"
  54. },
  55. {
  56. "Kaspersky": "Backdoor.Win32.NetWiredRC.hmp"
  57. },
  58. {
  59. "Alibaba": "Backdoor:Win32/NetWiredRC.16f106e8"
  60. },
  61. {
  62. "ViRobot": "Trojan.Win32.Z.Ponystealer.552960.I"
  63. },
  64. {
  65. "AegisLab": "Trojan.Win32.NetWiredRC.4!c"
  66. },
  67. {
  68. "Rising": "Backdoor.NetWiredRC!8.2AF (CLOUD)"
  69. },
  70. {
  71. "Ad-Aware": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
  72. },
  73. {
  74. "Sophos": "Mal/FareitVB-N"
  75. },
  76. {
  77. "F-Secure": "Trojan.TR/Injector.wqrsy"
  78. },
  79. {
  80. "TrendMicro": "TrojanSpy.Win32.FAREIT.SMB.hp"
  81. },
  82. {
  83. "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.hm"
  84. },
  85. {
  86. "Emsisoft": "Gen:Heur.PonyStealer.Hm0@gGLfsZki (B)"
  87. },
  88. {
  89. "SentinelOne": "DFI - Suspicious PE"
  90. },
  91. {
  92. "Cyren": "W32/VBKrypt.RN.gen!Eldorado"
  93. },
  94. {
  95. "Avira": "TR/Injector.wqrsy"
  96. },
  97. {
  98. "Fortinet": "W32/GenKryptik.DKUS!tr"
  99. },
  100. {
  101. "ZoneAlarm": "Backdoor.Win32.NetWiredRC.hmp"
  102. },
  103. {
  104. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  105. },
  106. {
  107. "McAfee": "Fareit-FPH!E908270ED1CA"
  108. },
  109. {
  110. "MAX": "malware (ai score=100)"
  111. },
  112. {
  113. "ESET-NOD32": "a variant of Win32/Injector.EGHY"
  114. },
  115. {
  116. "TrendMicro-HouseCall": "TrojanSpy.Win32.FAREIT.SMB.hp"
  117. },
  118. {
  119. "Ikarus": "Trojan.VB.Crypt"
  120. },
  121. {
  122. "GData": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
  123. },
  124. {
  125. "AVG": "FileRepMalware"
  126. },
  127. {
  128. "Cybereason": "malicious.69ef6f"
  129. },
  130. {
  131. "CrowdStrike": "win/malicious_confidence_100% (W)"
  132. }
  133. ]
  134. }
  135. ]
  136.  
  137. [*] Started Service: []
  138.  
  139. [*] Executed Commands: []
  140.  
  141. [*] Mutexes: []
  142.  
  143. [*] Modified Files: []
  144.  
  145. [*] Deleted Files: []
  146.  
  147. [*] Modified Registry Keys: []
  148.  
  149. [*] Deleted Registry Keys: []
  150.  
  151. [*] DNS Communications: []
  152.  
  153. [*] Domains: []
  154.  
  155. [*] Network Communication - ICMP: []
  156.  
  157. [*] Network Communication - HTTP: []
  158.  
  159. [*] Network Communication - SMTP: []
  160.  
  161. [*] Network Communication - Hosts: []
  162.  
  163. [*] Network Communication - IRC: []
  164.  
  165. [*] Static Analysis: {
  166. "pe": {
  167. "peid_signatures": null,
  168. "imports": [
  169. {
  170. "imports": [
  171. {
  172. "name": null,
  173. "address": "0x401000"
  174. },
  175. {
  176. "name": null,
  177. "address": "0x401004"
  178. },
  179. {
  180. "name": null,
  181. "address": "0x401008"
  182. },
  183. {
  184. "name": null,
  185. "address": "0x40100c"
  186. },
  187. {
  188. "name": null,
  189. "address": "0x401010"
  190. },
  191. {
  192. "name": "MethCallEngine",
  193. "address": "0x401014"
  194. },
  195. {
  196. "name": null,
  197. "address": "0x401018"
  198. },
  199. {
  200. "name": null,
  201. "address": "0x40101c"
  202. },
  203. {
  204. "name": null,
  205. "address": "0x401020"
  206. },
  207. {
  208. "name": null,
  209. "address": "0x401024"
  210. },
  211. {
  212. "name": null,
  213. "address": "0x401028"
  214. },
  215. {
  216. "name": null,
  217. "address": "0x40102c"
  218. },
  219. {
  220. "name": null,
  221. "address": "0x401030"
  222. },
  223. {
  224. "name": null,
  225. "address": "0x401034"
  226. },
  227. {
  228. "name": null,
  229. "address": "0x401038"
  230. },
  231. {
  232. "name": null,
  233. "address": "0x40103c"
  234. },
  235. {
  236. "name": null,
  237. "address": "0x401040"
  238. },
  239. {
  240. "name": null,
  241. "address": "0x401044"
  242. },
  243. {
  244. "name": null,
  245. "address": "0x401048"
  246. },
  247. {
  248. "name": null,
  249. "address": "0x40104c"
  250. },
  251. {
  252. "name": null,
  253. "address": "0x401050"
  254. },
  255. {
  256. "name": "EVENT_SINK_AddRef",
  257. "address": "0x401054"
  258. },
  259. {
  260. "name": null,
  261. "address": "0x401058"
  262. },
  263. {
  264. "name": null,
  265. "address": "0x40105c"
  266. },
  267. {
  268. "name": null,
  269. "address": "0x401060"
  270. },
  271. {
  272. "name": "EVENT_SINK_Release",
  273. "address": "0x401064"
  274. },
  275. {
  276. "name": null,
  277. "address": "0x401068"
  278. },
  279. {
  280. "name": "EVENT_SINK_QueryInterface",
  281. "address": "0x40106c"
  282. },
  283. {
  284. "name": "__vbaExceptHandler",
  285. "address": "0x401070"
  286. },
  287. {
  288. "name": null,
  289. "address": "0x401074"
  290. },
  291. {
  292. "name": null,
  293. "address": "0x401078"
  294. },
  295. {
  296. "name": null,
  297. "address": "0x40107c"
  298. },
  299. {
  300. "name": null,
  301. "address": "0x401080"
  302. },
  303. {
  304. "name": null,
  305. "address": "0x401084"
  306. },
  307. {
  308. "name": null,
  309. "address": "0x401088"
  310. },
  311. {
  312. "name": null,
  313. "address": "0x40108c"
  314. },
  315. {
  316. "name": null,
  317. "address": "0x401090"
  318. },
  319. {
  320. "name": null,
  321. "address": "0x401094"
  322. },
  323. {
  324. "name": null,
  325. "address": "0x401098"
  326. },
  327. {
  328. "name": null,
  329. "address": "0x40109c"
  330. },
  331. {
  332. "name": null,
  333. "address": "0x4010a0"
  334. },
  335. {
  336. "name": null,
  337. "address": "0x4010a4"
  338. },
  339. {
  340. "name": null,
  341. "address": "0x4010a8"
  342. },
  343. {
  344. "name": null,
  345. "address": "0x4010ac"
  346. },
  347. {
  348. "name": null,
  349. "address": "0x4010b0"
  350. },
  351. {
  352. "name": null,
  353. "address": "0x4010b4"
  354. }
  355. ],
  356. "dll": "MSVBVM60.DLL"
  357. }
  358. ],
  359. "digital_signers": null,
  360. "exported_dll_name": null,
  361. "actual_checksum": "0x0008ec90",
  362. "overlay": null,
  363. "imagebase": "0x00400000",
  364. "reported_checksum": "0x0008ec90",
  365. "icon_hash": null,
  366. "entrypoint": "0x004011d4",
  367. "timestamp": "2019-06-27 21:21:20",
  368. "osversion": "4.0",
  369. "sections": [
  370. {
  371. "name": ".text",
  372. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  373. "virtual_address": "0x00001000",
  374. "size_of_data": "0x00083000",
  375. "entropy": "5.64",
  376. "raw_address": "0x00001000",
  377. "virtual_size": "0x00082e04",
  378. "characteristics_raw": "0x60000020"
  379. },
  380. {
  381. "name": ".data",
  382. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  383. "virtual_address": "0x00084000",
  384. "size_of_data": "0x00000000",
  385. "entropy": "0.00",
  386. "raw_address": "0x00000000",
  387. "virtual_size": "0x000071f4",
  388. "characteristics_raw": "0xc0000040"
  389. },
  390. {
  391. "name": ".rsrc",
  392. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  393. "virtual_address": "0x0008c000",
  394. "size_of_data": "0x00003000",
  395. "entropy": "4.15",
  396. "raw_address": "0x00084000",
  397. "virtual_size": "0x00002a26",
  398. "characteristics_raw": "0x40000040"
  399. }
  400. ],
  401. "resources": [],
  402. "dirents": [
  403. {
  404. "virtual_address": "0x00000000",
  405. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  406. "size": "0x00000000"
  407. },
  408. {
  409. "virtual_address": "0x00083ca4",
  410. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  411. "size": "0x00000028"
  412. },
  413. {
  414. "virtual_address": "0x0008c000",
  415. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  416. "size": "0x00002a26"
  417. },
  418. {
  419. "virtual_address": "0x00000000",
  420. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  421. "size": "0x00000000"
  422. },
  423. {
  424. "virtual_address": "0x00000000",
  425. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  426. "size": "0x00000000"
  427. },
  428. {
  429. "virtual_address": "0x00000000",
  430. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  431. "size": "0x00000000"
  432. },
  433. {
  434. "virtual_address": "0x00000000",
  435. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  436. "size": "0x00000000"
  437. },
  438. {
  439. "virtual_address": "0x00000000",
  440. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  441. "size": "0x00000000"
  442. },
  443. {
  444. "virtual_address": "0x00000000",
  445. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  446. "size": "0x00000000"
  447. },
  448. {
  449. "virtual_address": "0x00000000",
  450. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  451. "size": "0x00000000"
  452. },
  453. {
  454. "virtual_address": "0x00000000",
  455. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  456. "size": "0x00000000"
  457. },
  458. {
  459. "virtual_address": "0x00000220",
  460. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  461. "size": "0x00000020"
  462. },
  463. {
  464. "virtual_address": "0x00001000",
  465. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  466. "size": "0x000000bc"
  467. },
  468. {
  469. "virtual_address": "0x00000000",
  470. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  471. "size": "0x00000000"
  472. },
  473. {
  474. "virtual_address": "0x00000000",
  475. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  476. "size": "0x00000000"
  477. },
  478. {
  479. "virtual_address": "0x00000000",
  480. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  481. "size": "0x00000000"
  482. }
  483. ],
  484. "exports": [],
  485. "guest_signers": {},
  486. "imphash": "21a2465d56c70c062b5eae0fca05fe67",
  487. "icon_fuzzy": null,
  488. "icon": null,
  489. "pdbpath": null,
  490. "imported_dll_count": 1,
  491. "versioninfo": []
  492. }
  493. }
  494.  
  495. [*] Resolved APIs: []
  496.  
  497. [*] Static Analysis: {
  498. "pe": {
  499. "peid_signatures": null,
  500. "imports": [
  501. {
  502. "imports": [
  503. {
  504. "name": null,
  505. "address": "0x401000"
  506. },
  507. {
  508. "name": null,
  509. "address": "0x401004"
  510. },
  511. {
  512. "name": null,
  513. "address": "0x401008"
  514. },
  515. {
  516. "name": null,
  517. "address": "0x40100c"
  518. },
  519. {
  520. "name": null,
  521. "address": "0x401010"
  522. },
  523. {
  524. "name": "MethCallEngine",
  525. "address": "0x401014"
  526. },
  527. {
  528. "name": null,
  529. "address": "0x401018"
  530. },
  531. {
  532. "name": null,
  533. "address": "0x40101c"
  534. },
  535. {
  536. "name": null,
  537. "address": "0x401020"
  538. },
  539. {
  540. "name": null,
  541. "address": "0x401024"
  542. },
  543. {
  544. "name": null,
  545. "address": "0x401028"
  546. },
  547. {
  548. "name": null,
  549. "address": "0x40102c"
  550. },
  551. {
  552. "name": null,
  553. "address": "0x401030"
  554. },
  555. {
  556. "name": null,
  557. "address": "0x401034"
  558. },
  559. {
  560. "name": null,
  561. "address": "0x401038"
  562. },
  563. {
  564. "name": null,
  565. "address": "0x40103c"
  566. },
  567. {
  568. "name": null,
  569. "address": "0x401040"
  570. },
  571. {
  572. "name": null,
  573. "address": "0x401044"
  574. },
  575. {
  576. "name": null,
  577. "address": "0x401048"
  578. },
  579. {
  580. "name": null,
  581. "address": "0x40104c"
  582. },
  583. {
  584. "name": null,
  585. "address": "0x401050"
  586. },
  587. {
  588. "name": "EVENT_SINK_AddRef",
  589. "address": "0x401054"
  590. },
  591. {
  592. "name": null,
  593. "address": "0x401058"
  594. },
  595. {
  596. "name": null,
  597. "address": "0x40105c"
  598. },
  599. {
  600. "name": null,
  601. "address": "0x401060"
  602. },
  603. {
  604. "name": "EVENT_SINK_Release",
  605. "address": "0x401064"
  606. },
  607. {
  608. "name": null,
  609. "address": "0x401068"
  610. },
  611. {
  612. "name": "EVENT_SINK_QueryInterface",
  613. "address": "0x40106c"
  614. },
  615. {
  616. "name": "__vbaExceptHandler",
  617. "address": "0x401070"
  618. },
  619. {
  620. "name": null,
  621. "address": "0x401074"
  622. },
  623. {
  624. "name": null,
  625. "address": "0x401078"
  626. },
  627. {
  628. "name": null,
  629. "address": "0x40107c"
  630. },
  631. {
  632. "name": null,
  633. "address": "0x401080"
  634. },
  635. {
  636. "name": null,
  637. "address": "0x401084"
  638. },
  639. {
  640. "name": null,
  641. "address": "0x401088"
  642. },
  643. {
  644. "name": null,
  645. "address": "0x40108c"
  646. },
  647. {
  648. "name": null,
  649. "address": "0x401090"
  650. },
  651. {
  652. "name": null,
  653. "address": "0x401094"
  654. },
  655. {
  656. "name": null,
  657. "address": "0x401098"
  658. },
  659. {
  660. "name": null,
  661. "address": "0x40109c"
  662. },
  663. {
  664. "name": null,
  665. "address": "0x4010a0"
  666. },
  667. {
  668. "name": null,
  669. "address": "0x4010a4"
  670. },
  671. {
  672. "name": null,
  673. "address": "0x4010a8"
  674. },
  675. {
  676. "name": null,
  677. "address": "0x4010ac"
  678. },
  679. {
  680. "name": null,
  681. "address": "0x4010b0"
  682. },
  683. {
  684. "name": null,
  685. "address": "0x4010b4"
  686. }
  687. ],
  688. "dll": "MSVBVM60.DLL"
  689. }
  690. ],
  691. "digital_signers": null,
  692. "exported_dll_name": null,
  693. "actual_checksum": "0x0008ec90",
  694. "overlay": null,
  695. "imagebase": "0x00400000",
  696. "reported_checksum": "0x0008ec90",
  697. "icon_hash": null,
  698. "entrypoint": "0x004011d4",
  699. "timestamp": "2019-06-27 21:21:20",
  700. "osversion": "4.0",
  701. "sections": [
  702. {
  703. "name": ".text",
  704. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  705. "virtual_address": "0x00001000",
  706. "size_of_data": "0x00083000",
  707. "entropy": "5.64",
  708. "raw_address": "0x00001000",
  709. "virtual_size": "0x00082e04",
  710. "characteristics_raw": "0x60000020"
  711. },
  712. {
  713. "name": ".data",
  714. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  715. "virtual_address": "0x00084000",
  716. "size_of_data": "0x00000000",
  717. "entropy": "0.00",
  718. "raw_address": "0x00000000",
  719. "virtual_size": "0x000071f4",
  720. "characteristics_raw": "0xc0000040"
  721. },
  722. {
  723. "name": ".rsrc",
  724. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  725. "virtual_address": "0x0008c000",
  726. "size_of_data": "0x00003000",
  727. "entropy": "4.15",
  728. "raw_address": "0x00084000",
  729. "virtual_size": "0x00002a26",
  730. "characteristics_raw": "0x40000040"
  731. }
  732. ],
  733. "resources": [],
  734. "dirents": [
  735. {
  736. "virtual_address": "0x00000000",
  737. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  738. "size": "0x00000000"
  739. },
  740. {
  741. "virtual_address": "0x00083ca4",
  742. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  743. "size": "0x00000028"
  744. },
  745. {
  746. "virtual_address": "0x0008c000",
  747. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  748. "size": "0x00002a26"
  749. },
  750. {
  751. "virtual_address": "0x00000000",
  752. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  753. "size": "0x00000000"
  754. },
  755. {
  756. "virtual_address": "0x00000000",
  757. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  758. "size": "0x00000000"
  759. },
  760. {
  761. "virtual_address": "0x00000000",
  762. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  763. "size": "0x00000000"
  764. },
  765. {
  766. "virtual_address": "0x00000000",
  767. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  768. "size": "0x00000000"
  769. },
  770. {
  771. "virtual_address": "0x00000000",
  772. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  773. "size": "0x00000000"
  774. },
  775. {
  776. "virtual_address": "0x00000000",
  777. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  778. "size": "0x00000000"
  779. },
  780. {
  781. "virtual_address": "0x00000000",
  782. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  783. "size": "0x00000000"
  784. },
  785. {
  786. "virtual_address": "0x00000000",
  787. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  788. "size": "0x00000000"
  789. },
  790. {
  791. "virtual_address": "0x00000220",
  792. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  793. "size": "0x00000020"
  794. },
  795. {
  796. "virtual_address": "0x00001000",
  797. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  798. "size": "0x000000bc"
  799. },
  800. {
  801. "virtual_address": "0x00000000",
  802. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  803. "size": "0x00000000"
  804. },
  805. {
  806. "virtual_address": "0x00000000",
  807. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  808. "size": "0x00000000"
  809. },
  810. {
  811. "virtual_address": "0x00000000",
  812. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  813. "size": "0x00000000"
  814. }
  815. ],
  816. "exports": [],
  817. "guest_signers": {},
  818. "imphash": "21a2465d56c70c062b5eae0fca05fe67",
  819. "icon_fuzzy": null,
  820. "icon": null,
  821. "pdbpath": null,
  822. "imported_dll_count": 1,
  823. "versioninfo": []
  824. }
  825. }
Advertisement
Add Comment
Please, Sign In to add comment