API tools faq
paste
paladin316

ccgrabber_dll_2019-06-24_21_30.json

paladin316
Jun 24th, 2019
2,193
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 22.01 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Spyeyes"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "ccgrabber.dll"
  7. [*] File Size: 20480
  8. [*] File Type: "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "283255c08fbce7c14b64b583133387b672bec581ee3eb693d290da9c1d144cb5"
  10. [*] MD5: "b5cce2695d42f1511115791b25fe0cc5"
  11. [*] SHA1: "5827e8d1b22a7fd01a6e9b24b57a2a80091b3319"
  12. [*] SHA512: "95fd0dff504ba42976a59a4054b339e426e5718a550f256cda69accff6c76a428ddee2037ce5c1197d4b1861584e6aba799de78a32d111f518f8ffc78f402080"
  13. [*] CRC32: "DA17D96A"
  14. [*] SSDEEP: "96:W3XdAbxwYi3SEwVv3wCqhK4cnIcBLSRp:Wgdvp3shjc9B+Rp"
  15.  
  16. [*] Process Execution: [
  17. "rundll32.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "File has been identified by 48 Antiviruses on VirusTotal as malicious",
  23. "Details": [
  24. {
  25. "MicroWorld-eScan": "Trojan.Generic.5744298"
  26. },
  27. {
  28. "FireEye": "Trojan.Generic.5744298"
  29. },
  30. {
  31. "McAfee": "PWS-Spyeye.m.dll"
  32. },
  33. {
  34. "Alibaba": "TrojanSpy:Win32/SpyEyes.40197d58"
  35. },
  36. {
  37. "K7GW": "Spyware ( 001e277a1 )"
  38. },
  39. {
  40. "K7AntiVirus": "Spyware ( 001e277a1 )"
  41. },
  42. {
  43. "Arcabit": "Trojan.Generic.D57A6AA"
  44. },
  45. {
  46. "Symantec": "Trojan.Spyeye"
  47. },
  48. {
  49. "TotalDefense": "Win32/SpyEye.VH"
  50. },
  51. {
  52. "Avast": "Win32:SpyeyePlugin-A [Trj]"
  53. },
  54. {
  55. "ClamAV": "Win.Spyware.ye-1033"
  56. },
  57. {
  58. "Kaspersky": "Trojan-Spy.Win32.SpyEyes.eub"
  59. },
  60. {
  61. "BitDefender": "Trojan.Generic.5744298"
  62. },
  63. {
  64. "NANO-Antivirus": "Trojan.Win32.SpyEyes.cqjfw"
  65. },
  66. {
  67. "ViRobot": "Trojan.Win32.A.SpyEyes.20480.D"
  68. },
  69. {
  70. "Tencent": "Win32.Trojan.Spy.Pgwq"
  71. },
  72. {
  73. "Ad-Aware": "Trojan.Generic.5744298"
  74. },
  75. {
  76. "Sophos": "Troj/SpyEyeDl-A"
  77. },
  78. {
  79. "Comodo": "Malware@#3ao4fuln50xvi"
  80. },
  81. {
  82. "F-Secure": "Trojan.TR/Spy.SpyEyes.eub.1"
  83. },
  84. {
  85. "DrWeb": "BackDoor.Spy.871"
  86. },
  87. {
  88. "Zillya": "Trojan.SpyEyes.Win32.1178"
  89. },
  90. {
  91. "TrendMicro": "TSPY_SPYEYE.DLL"
  92. },
  93. {
  94. "McAfee-GW-Edition": "PWS-Spyeye.m.dll"
  95. },
  96. {
  97. "CMC": "Trojan-Spy.Win32.SpyEyes!O"
  98. },
  99. {
  100. "Emsisoft": "Trojan.Generic.5744298 (B)"
  101. },
  102. {
  103. "ESET-NOD32": "Win32/Spy.SpyEye"
  104. },
  105. {
  106. "Avira": "TR/Spy.SpyEyes.eub.1"
  107. },
  108. {
  109. "Antiy-AVL": "Trojan[Spy]/Win32.SpyEyes"
  110. },
  111. {
  112. "Microsoft": "Trojan:Win32/EyeStye.plugin"
  113. },
  114. {
  115. "AegisLab": "Trojan.Win32.SpyEyes.l!c"
  116. },
  117. {
  118. "ZoneAlarm": "Trojan-Spy.Win32.SpyEyes.eub"
  119. },
  120. {
  121. "GData": "Trojan.Generic.5744298"
  122. },
  123. {
  124. "TACHYON": "Trojan/W32.Small.20480.TA"
  125. },
  126. {
  127. "AhnLab-V3": "Spyware/Win32.SpyEyes.R68187"
  128. },
  129. {
  130. "VBA32": "TrojanSpy.SpyEyes"
  131. },
  132. {
  133. "ALYac": "Trojan.Generic.5744298"
  134. },
  135. {
  136. "MAX": "malware (ai score=100)"
  137. },
  138. {
  139. "Cylance": "Unsafe"
  140. },
  141. {
  142. "TrendMicro-HouseCall": "TSPY_SPYEYE.DLL"
  143. },
  144. {
  145. "Rising": "Trojan.Win32.Generic.12805156 (C64:YzY0Oj8OhAPTsFBd)"
  146. },
  147. {
  148. "Yandex": "TrojanSpy.SpyEyes!Z50buWQ9rcQ"
  149. },
  150. {
  151. "Ikarus": "Trojan-Spy.Win32.SpyEyes"
  152. },
  153. {
  154. "MaxSecure": "Trojan.Malware.2232300.susgen"
  155. },
  156. {
  157. "Fortinet": "W32/SpyEye.BI!tr"
  158. },
  159. {
  160. "Webroot": "W32.Trojan.Gen"
  161. },
  162. {
  163. "AVG": "Win32:SpyeyePlugin-A [Trj]"
  164. },
  165. {
  166. "Qihoo-360": "Win32/Trojan.Spy.4c4"
  167. }
  168. ]
  169. }
  170. ]
  171.  
  172. [*] Started Service: []
  173.  
  174. [*] Executed Commands: []
  175.  
  176. [*] Mutexes: []
  177.  
  178. [*] Modified Files: []
  179.  
  180. [*] Deleted Files: []
  181.  
  182. [*] Modified Registry Keys: []
  183.  
  184. [*] Deleted Registry Keys: []
  185.  
  186. [*] DNS Communications: []
  187.  
  188. [*] Domains: []
  189.  
  190. [*] Network Communication - ICMP: []
  191.  
  192. [*] Network Communication - HTTP: []
  193.  
  194. [*] Network Communication - SMTP: []
  195.  
  196. [*] Network Communication - Hosts: []
  197.  
  198. [*] Network Communication - IRC: []
  199.  
  200. [*] Static Analysis: {
  201. "pe": {
  202. "peid_signatures": [
  203. [
  204. "Armadillo v1.xx - v2.xx"
  205. ]
  206. ],
  207. "imports": [
  208. {
  209. "imports": [
  210. {
  211. "name": "_initterm",
  212. "address": "0x10002018"
  213. },
  214. {
  215. "name": "_adjust_fdiv",
  216. "address": "0x1000201c"
  217. },
  218. {
  219. "name": "isdigit",
  220. "address": "0x10002020"
  221. },
  222. {
  223. "name": "strtok",
  224. "address": "0x10002024"
  225. },
  226. {
  227. "name": "_snprintf",
  228. "address": "0x10002028"
  229. },
  230. {
  231. "name": "malloc",
  232. "address": "0x1000202c"
  233. },
  234. {
  235. "name": "strstr",
  236. "address": "0x10002030"
  237. },
  238. {
  239. "name": "free",
  240. "address": "0x10002034"
  241. }
  242. ],
  243. "dll": "MSVCRT.dll"
  244. },
  245. {
  246. "imports": [
  247. {
  248. "name": "GetProcessHeap",
  249. "address": "0x10002000"
  250. },
  251. {
  252. "name": "HeapAlloc",
  253. "address": "0x10002004"
  254. },
  255. {
  256. "name": "lstrcpyA",
  257. "address": "0x10002008"
  258. },
  259. {
  260. "name": "HeapFree",
  261. "address": "0x1000200c"
  262. },
  263. {
  264. "name": "lstrlenA",
  265. "address": "0x10002010"
  266. }
  267. ],
  268. "dll": "KERNEL32.dll"
  269. }
  270. ],
  271. "digital_signers": null,
  272. "exported_dll_name": "Plugin_CreditGrab.dll",
  273. "actual_checksum": "0x000086ad",
  274. "overlay": null,
  275. "imagebase": "0x10000000",
  276. "reported_checksum": "0x00000000",
  277. "icon_hash": null,
  278. "entrypoint": "0x100018af",
  279. "timestamp": "2011-01-26 07:48:00",
  280. "osversion": "4.0",
  281. "sections": [
  282. {
  283. "name": ".text",
  284. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  285. "virtual_address": "0x00001000",
  286. "size_of_data": "0x00001000",
  287. "entropy": "4.39",
  288. "raw_address": "0x00001000",
  289. "virtual_size": "0x00000952",
  290. "characteristics_raw": "0x60000020"
  291. },
  292. {
  293. "name": ".rdata",
  294. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  295. "virtual_address": "0x00002000",
  296. "size_of_data": "0x00001000",
  297. "entropy": "1.06",
  298. "raw_address": "0x00002000",
  299. "virtual_size": "0x00000286",
  300. "characteristics_raw": "0x40000040"
  301. },
  302. {
  303. "name": ".data",
  304. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  305. "virtual_address": "0x00003000",
  306. "size_of_data": "0x00001000",
  307. "entropy": "0.55",
  308. "raw_address": "0x00003000",
  309. "virtual_size": "0x00000360",
  310. "characteristics_raw": "0xc0000040"
  311. },
  312. {
  313. "name": ".reloc",
  314. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  315. "virtual_address": "0x00004000",
  316. "size_of_data": "0x00001000",
  317. "entropy": "0.42",
  318. "raw_address": "0x00004000",
  319. "virtual_size": "0x000000ca",
  320. "characteristics_raw": "0x42000040"
  321. }
  322. ],
  323. "resources": [],
  324. "dirents": [
  325. {
  326. "virtual_address": "0x00002170",
  327. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  328. "size": "0x00000116"
  329. },
  330. {
  331. "virtual_address": "0x0000203c",
  332. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  333. "size": "0x0000003c"
  334. },
  335. {
  336. "virtual_address": "0x00000000",
  337. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  338. "size": "0x00000000"
  339. },
  340. {
  341. "virtual_address": "0x00000000",
  342. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  343. "size": "0x00000000"
  344. },
  345. {
  346. "virtual_address": "0x00000000",
  347. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  348. "size": "0x00000000"
  349. },
  350. {
  351. "virtual_address": "0x00004000",
  352. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  353. "size": "0x000000a8"
  354. },
  355. {
  356. "virtual_address": "0x00000000",
  357. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  358. "size": "0x00000000"
  359. },
  360. {
  361. "virtual_address": "0x00000000",
  362. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  363. "size": "0x00000000"
  364. },
  365. {
  366. "virtual_address": "0x00000000",
  367. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  368. "size": "0x00000000"
  369. },
  370. {
  371. "virtual_address": "0x00000000",
  372. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  373. "size": "0x00000000"
  374. },
  375. {
  376. "virtual_address": "0x00000000",
  377. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  378. "size": "0x00000000"
  379. },
  380. {
  381. "virtual_address": "0x00000000",
  382. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  383. "size": "0x00000000"
  384. },
  385. {
  386. "virtual_address": "0x00002000",
  387. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  388. "size": "0x0000003c"
  389. },
  390. {
  391. "virtual_address": "0x00000000",
  392. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  393. "size": "0x00000000"
  394. },
  395. {
  396. "virtual_address": "0x00000000",
  397. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  398. "size": "0x00000000"
  399. },
  400. {
  401. "virtual_address": "0x00000000",
  402. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  403. "size": "0x00000000"
  404. }
  405. ],
  406. "exports": [
  407. {
  408. "ordinal": 1,
  409. "name": "Callback_OnBeforeProcessUrl",
  410. "address": "0x10001000"
  411. },
  412. {
  413. "ordinal": 2,
  414. "name": "FreeMem",
  415. "address": "0x100017c0"
  416. },
  417. {
  418. "ordinal": 3,
  419. "name": "GetPluginId",
  420. "address": "0x100017d0"
  421. },
  422. {
  423. "ordinal": 4,
  424. "name": "IsGlobal",
  425. "address": "0x10001740"
  426. },
  427. {
  428. "ordinal": 5,
  429. "name": "SpyEye_Init",
  430. "address": "0x10001740"
  431. },
  432. {
  433. "ordinal": 6,
  434. "name": "SpyEye_Start",
  435. "address": "0x10001740"
  436. },
  437. {
  438. "ordinal": 7,
  439. "name": "SpyEye_Stop",
  440. "address": "0x10001740"
  441. },
  442. {
  443. "ordinal": 8,
  444. "name": "TakeBotGuid",
  445. "address": "0x10001750"
  446. },
  447. {
  448. "ordinal": 9,
  449. "name": "TakeGateToCollector",
  450. "address": "0x10001160"
  451. }
  452. ],
  453. "guest_signers": {},
  454. "imphash": "7726ced1e426468f57cd0d9235966b8a",
  455. "icon_fuzzy": null,
  456. "icon": null,
  457. "pdbpath": null,
  458. "imported_dll_count": 2,
  459. "versioninfo": []
  460. }
  461. }
  462.  
  463. [*] Resolved APIs: []
  464.  
  465. [*] Static Analysis: {
  466. "pe": {
  467. "peid_signatures": [
  468. [
  469. "Armadillo v1.xx - v2.xx"
  470. ]
  471. ],
  472. "imports": [
  473. {
  474. "imports": [
  475. {
  476. "name": "_initterm",
  477. "address": "0x10002018"
  478. },
  479. {
  480. "name": "_adjust_fdiv",
  481. "address": "0x1000201c"
  482. },
  483. {
  484. "name": "isdigit",
  485. "address": "0x10002020"
  486. },
  487. {
  488. "name": "strtok",
  489. "address": "0x10002024"
  490. },
  491. {
  492. "name": "_snprintf",
  493. "address": "0x10002028"
  494. },
  495. {
  496. "name": "malloc",
  497. "address": "0x1000202c"
  498. },
  499. {
  500. "name": "strstr",
  501. "address": "0x10002030"
  502. },
  503. {
  504. "name": "free",
  505. "address": "0x10002034"
  506. }
  507. ],
  508. "dll": "MSVCRT.dll"
  509. },
  510. {
  511. "imports": [
  512. {
  513. "name": "GetProcessHeap",
  514. "address": "0x10002000"
  515. },
  516. {
  517. "name": "HeapAlloc",
  518. "address": "0x10002004"
  519. },
  520. {
  521. "name": "lstrcpyA",
  522. "address": "0x10002008"
  523. },
  524. {
  525. "name": "HeapFree",
  526. "address": "0x1000200c"
  527. },
  528. {
  529. "name": "lstrlenA",
  530. "address": "0x10002010"
  531. }
  532. ],
  533. "dll": "KERNEL32.dll"
  534. }
  535. ],
  536. "digital_signers": null,
  537. "exported_dll_name": "Plugin_CreditGrab.dll",
  538. "actual_checksum": "0x000086ad",
  539. "overlay": null,
  540. "imagebase": "0x10000000",
  541. "reported_checksum": "0x00000000",
  542. "icon_hash": null,
  543. "entrypoint": "0x100018af",
  544. "timestamp": "2011-01-26 07:48:00",
  545. "osversion": "4.0",
  546. "sections": [
  547. {
  548. "name": ".text",
  549. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  550. "virtual_address": "0x00001000",
  551. "size_of_data": "0x00001000",
  552. "entropy": "4.39",
  553. "raw_address": "0x00001000",
  554. "virtual_size": "0x00000952",
  555. "characteristics_raw": "0x60000020"
  556. },
  557. {
  558. "name": ".rdata",
  559. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  560. "virtual_address": "0x00002000",
  561. "size_of_data": "0x00001000",
  562. "entropy": "1.06",
  563. "raw_address": "0x00002000",
  564. "virtual_size": "0x00000286",
  565. "characteristics_raw": "0x40000040"
  566. },
  567. {
  568. "name": ".data",
  569. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  570. "virtual_address": "0x00003000",
  571. "size_of_data": "0x00001000",
  572. "entropy": "0.55",
  573. "raw_address": "0x00003000",
  574. "virtual_size": "0x00000360",
  575. "characteristics_raw": "0xc0000040"
  576. },
  577. {
  578. "name": ".reloc",
  579. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  580. "virtual_address": "0x00004000",
  581. "size_of_data": "0x00001000",
  582. "entropy": "0.42",
  583. "raw_address": "0x00004000",
  584. "virtual_size": "0x000000ca",
  585. "characteristics_raw": "0x42000040"
  586. }
  587. ],
  588. "resources": [],
  589. "dirents": [
  590. {
  591. "virtual_address": "0x00002170",
  592. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  593. "size": "0x00000116"
  594. },
  595. {
  596. "virtual_address": "0x0000203c",
  597. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  598. "size": "0x0000003c"
  599. },
  600. {
  601. "virtual_address": "0x00000000",
  602. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  603. "size": "0x00000000"
  604. },
  605. {
  606. "virtual_address": "0x00000000",
  607. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  608. "size": "0x00000000"
  609. },
  610. {
  611. "virtual_address": "0x00000000",
  612. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  613. "size": "0x00000000"
  614. },
  615. {
  616. "virtual_address": "0x00004000",
  617. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  618. "size": "0x000000a8"
  619. },
  620. {
  621. "virtual_address": "0x00000000",
  622. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  623. "size": "0x00000000"
  624. },
  625. {
  626. "virtual_address": "0x00000000",
  627. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  628. "size": "0x00000000"
  629. },
  630. {
  631. "virtual_address": "0x00000000",
  632. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  633. "size": "0x00000000"
  634. },
  635. {
  636. "virtual_address": "0x00000000",
  637. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  638. "size": "0x00000000"
  639. },
  640. {
  641. "virtual_address": "0x00000000",
  642. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  643. "size": "0x00000000"
  644. },
  645. {
  646. "virtual_address": "0x00000000",
  647. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  648. "size": "0x00000000"
  649. },
  650. {
  651. "virtual_address": "0x00002000",
  652. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  653. "size": "0x0000003c"
  654. },
  655. {
  656. "virtual_address": "0x00000000",
  657. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  658. "size": "0x00000000"
  659. },
  660. {
  661. "virtual_address": "0x00000000",
  662. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  663. "size": "0x00000000"
  664. },
  665. {
  666. "virtual_address": "0x00000000",
  667. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  668. "size": "0x00000000"
  669. }
  670. ],
  671. "exports": [
  672. {
  673. "ordinal": 1,
  674. "name": "Callback_OnBeforeProcessUrl",
  675. "address": "0x10001000"
  676. },
  677. {
  678. "ordinal": 2,
  679. "name": "FreeMem",
  680. "address": "0x100017c0"
  681. },
  682. {
  683. "ordinal": 3,
  684. "name": "GetPluginId",
  685. "address": "0x100017d0"
  686. },
  687. {
  688. "ordinal": 4,
  689. "name": "IsGlobal",
  690. "address": "0x10001740"
  691. },
  692. {
  693. "ordinal": 5,
  694. "name": "SpyEye_Init",
  695. "address": "0x10001740"
  696. },
  697. {
  698. "ordinal": 6,
  699. "name": "SpyEye_Start",
  700. "address": "0x10001740"
  701. },
  702. {
  703. "ordinal": 7,
  704. "name": "SpyEye_Stop",
  705. "address": "0x10001740"
  706. },
  707. {
  708. "ordinal": 8,
  709. "name": "TakeBotGuid",
  710. "address": "0x10001750"
  711. },
  712. {
  713. "ordinal": 9,
  714. "name": "TakeGateToCollector",
  715. "address": "0x10001160"
  716. }
  717. ],
  718. "guest_signers": {},
  719. "imphash": "7726ced1e426468f57cd0d9235966b8a",
  720. "icon_fuzzy": null,
  721. "icon": null,
  722. "pdbpath": null,
  723. "imported_dll_count": 2,
  724. "versioninfo": []
  725. }
  726. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!