Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- [*] MalFamily: ""
- [*] MalScore: 10.0
- [*] File Name: "Exes_e908270ed1cad4b5f2081c90ec972b13.exe"
- [*] File Size: 552960
- [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- [*] SHA256: "412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f"
- [*] MD5: "e908270ed1cad4b5f2081c90ec972b13"
- [*] SHA1: "aa3a11069ef6f4d765c4f9fd54405434b554660b"
- [*] SHA512: "ef8b4d3560bff36d34a274c4489cf000229421336d367a08c7d6423ec7195800752582091b7049fe9c4d088f9751e55e3158e6839ce593a2dc47521e739da3be"
- [*] CRC32: "8DC17533"
- [*] SSDEEP: "12288:CDJAkL8AWhyl8gY1Me0U22THSzoPQxeFLx:C9AkLMhyl8/qU22THg"
- [*] Process Execution: []
- [*] Signatures Detected: [
- {
- "Description": "File has been identified by 37 Antiviruses on VirusTotal as malicious",
- "Details": [
- {
- "MicroWorld-eScan": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
- },
- {
- "FireEye": "Generic.mg.e908270ed1cad4b5"
- },
- {
- "ALYac": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
- },
- {
- "Malwarebytes": "Trojan.MalPack.VB.Generic"
- },
- {
- "BitDefender": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
- },
- {
- "Invincea": "heuristic"
- },
- {
- "F-Prot": "W32/VBKrypt.RN.gen!Eldorado"
- },
- {
- "Symantec": "ML.Attribute.HighConfidence"
- },
- {
- "APEX": "Malicious"
- },
- {
- "Paloalto": "generic.ml"
- },
- {
- "ClamAV": "Win.Malware.Fareit-7004554-0"
- },
- {
- "Kaspersky": "Backdoor.Win32.NetWiredRC.hmp"
- },
- {
- "Alibaba": "Backdoor:Win32/NetWiredRC.16f106e8"
- },
- {
- "ViRobot": "Trojan.Win32.Z.Ponystealer.552960.I"
- },
- {
- "AegisLab": "Trojan.Win32.NetWiredRC.4!c"
- },
- {
- "Rising": "Backdoor.NetWiredRC!8.2AF (CLOUD)"
- },
- {
- "Ad-Aware": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
- },
- {
- "Sophos": "Mal/FareitVB-N"
- },
- {
- "F-Secure": "Trojan.TR/Injector.wqrsy"
- },
- {
- "TrendMicro": "TrojanSpy.Win32.FAREIT.SMB.hp"
- },
- {
- "McAfee-GW-Edition": "BehavesLike.Win32.VBObfus.hm"
- },
- {
- "Emsisoft": "Gen:Heur.PonyStealer.Hm0@gGLfsZki (B)"
- },
- {
- "SentinelOne": "DFI - Suspicious PE"
- },
- {
- "Cyren": "W32/VBKrypt.RN.gen!Eldorado"
- },
- {
- "Avira": "TR/Injector.wqrsy"
- },
- {
- "Fortinet": "W32/GenKryptik.DKUS!tr"
- },
- {
- "ZoneAlarm": "Backdoor.Win32.NetWiredRC.hmp"
- },
- {
- "Microsoft": "Trojan:Win32/Wacatac.B!ml"
- },
- {
- "McAfee": "Fareit-FPH!E908270ED1CA"
- },
- {
- "MAX": "malware (ai score=100)"
- },
- {
- "ESET-NOD32": "a variant of Win32/Injector.EGHY"
- },
- {
- "TrendMicro-HouseCall": "TrojanSpy.Win32.FAREIT.SMB.hp"
- },
- {
- "Ikarus": "Trojan.VB.Crypt"
- },
- {
- "GData": "Gen:Heur.PonyStealer.Hm0@gGLfsZki"
- },
- {
- "AVG": "FileRepMalware"
- },
- {
- "Cybereason": "malicious.69ef6f"
- },
- {
- "CrowdStrike": "win/malicious_confidence_100% (W)"
- }
- ]
- }
- ]
- [*] Started Service: []
- [*] Executed Commands: []
- [*] Mutexes: []
- [*] Modified Files: []
- [*] Deleted Files: []
- [*] Modified Registry Keys: []
- [*] Deleted Registry Keys: []
- [*] DNS Communications: []
- [*] Domains: []
- [*] Network Communication - ICMP: []
- [*] Network Communication - HTTP: []
- [*] Network Communication - SMTP: []
- [*] Network Communication - Hosts: []
- [*] Network Communication - IRC: []
- [*] Static Analysis: {
- "pe": {
- "peid_signatures": null,
- "imports": [
- {
- "imports": [
- {
- "name": null,
- "address": "0x401000"
- },
- {
- "name": null,
- "address": "0x401004"
- },
- {
- "name": null,
- "address": "0x401008"
- },
- {
- "name": null,
- "address": "0x40100c"
- },
- {
- "name": null,
- "address": "0x401010"
- },
- {
- "name": "MethCallEngine",
- "address": "0x401014"
- },
- {
- "name": null,
- "address": "0x401018"
- },
- {
- "name": null,
- "address": "0x40101c"
- },
- {
- "name": null,
- "address": "0x401020"
- },
- {
- "name": null,
- "address": "0x401024"
- },
- {
- "name": null,
- "address": "0x401028"
- },
- {
- "name": null,
- "address": "0x40102c"
- },
- {
- "name": null,
- "address": "0x401030"
- },
- {
- "name": null,
- "address": "0x401034"
- },
- {
- "name": null,
- "address": "0x401038"
- },
- {
- "name": null,
- "address": "0x40103c"
- },
- {
- "name": null,
- "address": "0x401040"
- },
- {
- "name": null,
- "address": "0x401044"
- },
- {
- "name": null,
- "address": "0x401048"
- },
- {
- "name": null,
- "address": "0x40104c"
- },
- {
- "name": null,
- "address": "0x401050"
- },
- {
- "name": "EVENT_SINK_AddRef",
- "address": "0x401054"
- },
- {
- "name": null,
- "address": "0x401058"
- },
- {
- "name": null,
- "address": "0x40105c"
- },
- {
- "name": null,
- "address": "0x401060"
- },
- {
- "name": "EVENT_SINK_Release",
- "address": "0x401064"
- },
- {
- "name": null,
- "address": "0x401068"
- },
- {
- "name": "EVENT_SINK_QueryInterface",
- "address": "0x40106c"
- },
- {
- "name": "__vbaExceptHandler",
- "address": "0x401070"
- },
- {
- "name": null,
- "address": "0x401074"
- },
- {
- "name": null,
- "address": "0x401078"
- },
- {
- "name": null,
- "address": "0x40107c"
- },
- {
- "name": null,
- "address": "0x401080"
- },
- {
- "name": null,
- "address": "0x401084"
- },
- {
- "name": null,
- "address": "0x401088"
- },
- {
- "name": null,
- "address": "0x40108c"
- },
- {
- "name": null,
- "address": "0x401090"
- },
- {
- "name": null,
- "address": "0x401094"
- },
- {
- "name": null,
- "address": "0x401098"
- },
- {
- "name": null,
- "address": "0x40109c"
- },
- {
- "name": null,
- "address": "0x4010a0"
- },
- {
- "name": null,
- "address": "0x4010a4"
- },
- {
- "name": null,
- "address": "0x4010a8"
- },
- {
- "name": null,
- "address": "0x4010ac"
- },
- {
- "name": null,
- "address": "0x4010b0"
- },
- {
- "name": null,
- "address": "0x4010b4"
- }
- ],
- "dll": "MSVBVM60.DLL"
- }
- ],
- "digital_signers": null,
- "exported_dll_name": null,
- "actual_checksum": "0x0008ec90",
- "overlay": null,
- "imagebase": "0x00400000",
- "reported_checksum": "0x0008ec90",
- "icon_hash": null,
- "entrypoint": "0x004011d4",
- "timestamp": "2019-06-27 21:21:20",
- "osversion": "4.0",
- "sections": [
- {
- "name": ".text",
- "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00001000",
- "size_of_data": "0x00083000",
- "entropy": "5.64",
- "raw_address": "0x00001000",
- "virtual_size": "0x00082e04",
- "characteristics_raw": "0x60000020"
- },
- {
- "name": ".data",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00084000",
- "size_of_data": "0x00000000",
- "entropy": "0.00",
- "raw_address": "0x00000000",
- "virtual_size": "0x000071f4",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".rsrc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0008c000",
- "size_of_data": "0x00003000",
- "entropy": "4.15",
- "raw_address": "0x00084000",
- "virtual_size": "0x00002a26",
- "characteristics_raw": "0x40000040"
- }
- ],
- "resources": [],
- "dirents": [
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00083ca4",
- "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
- "size": "0x00000028"
- },
- {
- "virtual_address": "0x0008c000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
- "size": "0x00002a26"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_TLS",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000220",
- "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
- "size": "0x00000020"
- },
- {
- "virtual_address": "0x00001000",
- "name": "IMAGE_DIRECTORY_ENTRY_IAT",
- "size": "0x000000bc"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
- "size": "0x00000000"
- }
- ],
- "exports": [],
- "guest_signers": {},
- "imphash": "21a2465d56c70c062b5eae0fca05fe67",
- "icon_fuzzy": null,
- "icon": null,
- "pdbpath": null,
- "imported_dll_count": 1,
- "versioninfo": []
- }
- }
- [*] Resolved APIs: []
- [*] Static Analysis: {
- "pe": {
- "peid_signatures": null,
- "imports": [
- {
- "imports": [
- {
- "name": null,
- "address": "0x401000"
- },
- {
- "name": null,
- "address": "0x401004"
- },
- {
- "name": null,
- "address": "0x401008"
- },
- {
- "name": null,
- "address": "0x40100c"
- },
- {
- "name": null,
- "address": "0x401010"
- },
- {
- "name": "MethCallEngine",
- "address": "0x401014"
- },
- {
- "name": null,
- "address": "0x401018"
- },
- {
- "name": null,
- "address": "0x40101c"
- },
- {
- "name": null,
- "address": "0x401020"
- },
- {
- "name": null,
- "address": "0x401024"
- },
- {
- "name": null,
- "address": "0x401028"
- },
- {
- "name": null,
- "address": "0x40102c"
- },
- {
- "name": null,
- "address": "0x401030"
- },
- {
- "name": null,
- "address": "0x401034"
- },
- {
- "name": null,
- "address": "0x401038"
- },
- {
- "name": null,
- "address": "0x40103c"
- },
- {
- "name": null,
- "address": "0x401040"
- },
- {
- "name": null,
- "address": "0x401044"
- },
- {
- "name": null,
- "address": "0x401048"
- },
- {
- "name": null,
- "address": "0x40104c"
- },
- {
- "name": null,
- "address": "0x401050"
- },
- {
- "name": "EVENT_SINK_AddRef",
- "address": "0x401054"
- },
- {
- "name": null,
- "address": "0x401058"
- },
- {
- "name": null,
- "address": "0x40105c"
- },
- {
- "name": null,
- "address": "0x401060"
- },
- {
- "name": "EVENT_SINK_Release",
- "address": "0x401064"
- },
- {
- "name": null,
- "address": "0x401068"
- },
- {
- "name": "EVENT_SINK_QueryInterface",
- "address": "0x40106c"
- },
- {
- "name": "__vbaExceptHandler",
- "address": "0x401070"
- },
- {
- "name": null,
- "address": "0x401074"
- },
- {
- "name": null,
- "address": "0x401078"
- },
- {
- "name": null,
- "address": "0x40107c"
- },
- {
- "name": null,
- "address": "0x401080"
- },
- {
- "name": null,
- "address": "0x401084"
- },
- {
- "name": null,
- "address": "0x401088"
- },
- {
- "name": null,
- "address": "0x40108c"
- },
- {
- "name": null,
- "address": "0x401090"
- },
- {
- "name": null,
- "address": "0x401094"
- },
- {
- "name": null,
- "address": "0x401098"
- },
- {
- "name": null,
- "address": "0x40109c"
- },
- {
- "name": null,
- "address": "0x4010a0"
- },
- {
- "name": null,
- "address": "0x4010a4"
- },
- {
- "name": null,
- "address": "0x4010a8"
- },
- {
- "name": null,
- "address": "0x4010ac"
- },
- {
- "name": null,
- "address": "0x4010b0"
- },
- {
- "name": null,
- "address": "0x4010b4"
- }
- ],
- "dll": "MSVBVM60.DLL"
- }
- ],
- "digital_signers": null,
- "exported_dll_name": null,
- "actual_checksum": "0x0008ec90",
- "overlay": null,
- "imagebase": "0x00400000",
- "reported_checksum": "0x0008ec90",
- "icon_hash": null,
- "entrypoint": "0x004011d4",
- "timestamp": "2019-06-27 21:21:20",
- "osversion": "4.0",
- "sections": [
- {
- "name": ".text",
- "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00001000",
- "size_of_data": "0x00083000",
- "entropy": "5.64",
- "raw_address": "0x00001000",
- "virtual_size": "0x00082e04",
- "characteristics_raw": "0x60000020"
- },
- {
- "name": ".data",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00084000",
- "size_of_data": "0x00000000",
- "entropy": "0.00",
- "raw_address": "0x00000000",
- "virtual_size": "0x000071f4",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".rsrc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0008c000",
- "size_of_data": "0x00003000",
- "entropy": "4.15",
- "raw_address": "0x00084000",
- "virtual_size": "0x00002a26",
- "characteristics_raw": "0x40000040"
- }
- ],
- "resources": [],
- "dirents": [
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00083ca4",
- "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
- "size": "0x00000028"
- },
- {
- "virtual_address": "0x0008c000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
- "size": "0x00002a26"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_TLS",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000220",
- "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
- "size": "0x00000020"
- },
- {
- "virtual_address": "0x00001000",
- "name": "IMAGE_DIRECTORY_ENTRY_IAT",
- "size": "0x000000bc"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
- "size": "0x00000000"
- }
- ],
- "exports": [],
- "guest_signers": {},
- "imphash": "21a2465d56c70c062b5eae0fca05fe67",
- "icon_fuzzy": null,
- "icon": null,
- "pdbpath": null,
- "imported_dll_count": 1,
- "versioninfo": []
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment