API tools faq
paste
paladin316

Exes_eb9ee845bfe03f141cd96cdfe51390e4_exe_2019-06-30_15_30.json

paladin316
Jun 30th, 2019
2,183
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 19.75 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_eb9ee845bfe03f141cd96cdfe51390e4.exe"
  7. [*] File Size: 281088
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "0861fa8b7d1a7ed9d1d1af964921d4c747dd28f81953425acd31fdccd34d789e"
  10. [*] MD5: "eb9ee845bfe03f141cd96cdfe51390e4"
  11. [*] SHA1: "f6620240c02657f5b63fdacd6d28013730456af3"
  12. [*] SHA512: "ce777eeb16b6863ef064b802a48fdc6512ee8b8f3b22f6c649e103ce63f74fbd6d20531225701de4105b978c618450dfcaf66061a10ff651e403f08904fc98fa"
  13. [*] CRC32: "34662C64"
  14. [*] SSDEEP: "6144:EVPGkJCT8FjmszzC8njautll5hzGAeOlCoa5XBVy0Fu//ypClS8UBk2/T8hSTu:ecT81zWQxf7hzqaM5XB40E/ivHT8hS"
  15.  
  16. [*] Process Execution: []
  17.  
  18. [*] Signatures Detected: [
  19. {
  20. "Description": "The binary likely contains encrypted or compressed data.",
  21. "Details": [
  22. {
  23. "section": "name: UPX1, entropy: 7.95, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00043000, virtual_size: 0x00043000"
  24. }
  25. ]
  26. },
  27. {
  28. "Description": "The executable is compressed using UPX",
  29. "Details": [
  30. {
  31. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00061000"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "File has been identified by 33 Antiviruses on VirusTotal as malicious",
  37. "Details": [
  38. {
  39. "MicroWorld-eScan": "Gen:Variant.Barys.59676"
  40. },
  41. {
  42. "ALYac": "Gen:Variant.Barys.59676"
  43. },
  44. {
  45. "Cylance": "Unsafe"
  46. },
  47. {
  48. "BitDefender": "Gen:Variant.Barys.59676"
  49. },
  50. {
  51. "ESET-NOD32": "a variant of Win32/Injector.EFTJ"
  52. },
  53. {
  54. "APEX": "Malicious"
  55. },
  56. {
  57. "Paloalto": "generic.ml"
  58. },
  59. {
  60. "Kaspersky": "HEUR:Trojan-PSW.Win32.Coins.gen"
  61. },
  62. {
  63. "AegisLab": "Trojan.Win32.Barys.4!c"
  64. },
  65. {
  66. "Avast": "FileRepMalware"
  67. },
  68. {
  69. "Ad-Aware": "Gen:Variant.Barys.59676"
  70. },
  71. {
  72. "Emsisoft": "Gen:Variant.Barys.59676 (B)"
  73. },
  74. {
  75. "Invincea": "heuristic"
  76. },
  77. {
  78. "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.dc"
  79. },
  80. {
  81. "Trapmine": "malicious.moderate.ml.score"
  82. },
  83. {
  84. "FireEye": "Generic.mg.eb9ee845bfe03f14"
  85. },
  86. {
  87. "Microsoft": "Trojan:Win32/Azden.A!cl"
  88. },
  89. {
  90. "Endgame": "malicious (moderate confidence)"
  91. },
  92. {
  93. "Arcabit": "Trojan.Barys.DE91C"
  94. },
  95. {
  96. "ZoneAlarm": "HEUR:Trojan-PSW.Win32.Coins.gen"
  97. },
  98. {
  99. "GData": "Gen:Variant.Barys.59676"
  100. },
  101. {
  102. "Sophos": "Mal/Fareit-Q"
  103. },
  104. {
  105. "AhnLab-V3": "Win-Trojan/Delphiless.Exp"
  106. },
  107. {
  108. "Acronis": "suspicious"
  109. },
  110. {
  111. "McAfee": "Artemis!EB9EE845BFE0"
  112. },
  113. {
  114. "MAX": "malware (ai score=87)"
  115. },
  116. {
  117. "Malwarebytes": "Spyware.LokiBot"
  118. },
  119. {
  120. "TrendMicro-HouseCall": "TrojanSpy.Win32.LOKI.SMD1.hp"
  121. },
  122. {
  123. "Fortinet": "W32/Injector.EFOM!tr"
  124. },
  125. {
  126. "AVG": "FileRepMalware"
  127. },
  128. {
  129. "Cybereason": "malicious.5bfe03"
  130. },
  131. {
  132. "CrowdStrike": "win/malicious_confidence_90% (W)"
  133. },
  134. {
  135. "Qihoo-360": "Win32/Trojan.PSW.3f3"
  136. }
  137. ]
  138. },
  139. {
  140. "Description": "Anomalous binary characteristics",
  141. "Details": [
  142. {
  143. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  144. }
  145. ]
  146. }
  147. ]
  148.  
  149. [*] Started Service: []
  150.  
  151. [*] Executed Commands: []
  152.  
  153. [*] Mutexes: []
  154.  
  155. [*] Modified Files: []
  156.  
  157. [*] Deleted Files: []
  158.  
  159. [*] Modified Registry Keys: []
  160.  
  161. [*] Deleted Registry Keys: []
  162.  
  163. [*] DNS Communications: []
  164.  
  165. [*] Domains: []
  166.  
  167. [*] Network Communication - ICMP: []
  168.  
  169. [*] Network Communication - HTTP: []
  170.  
  171. [*] Network Communication - SMTP: []
  172.  
  173. [*] Network Communication - Hosts: []
  174.  
  175. [*] Network Communication - IRC: []
  176.  
  177. [*] Static Analysis: {
  178. "pe": {
  179. "peid_signatures": null,
  180. "imports": [
  181. {
  182. "imports": [
  183. {
  184. "name": "LoadLibraryA",
  185. "address": "0x4a6460"
  186. },
  187. {
  188. "name": "GetProcAddress",
  189. "address": "0x4a6464"
  190. },
  191. {
  192. "name": "VirtualProtect",
  193. "address": "0x4a6468"
  194. },
  195. {
  196. "name": "VirtualAlloc",
  197. "address": "0x4a646c"
  198. },
  199. {
  200. "name": "VirtualFree",
  201. "address": "0x4a6470"
  202. },
  203. {
  204. "name": "ExitProcess",
  205. "address": "0x4a6474"
  206. }
  207. ],
  208. "dll": "KERNEL32.DLL"
  209. },
  210. {
  211. "imports": [
  212. {
  213. "name": "RegCloseKey",
  214. "address": "0x4a647c"
  215. }
  216. ],
  217. "dll": "advapi32.dll"
  218. },
  219. {
  220. "imports": [
  221. {
  222. "name": "ImageList_Add",
  223. "address": "0x4a6484"
  224. }
  225. ],
  226. "dll": "comctl32.dll"
  227. },
  228. {
  229. "imports": [
  230. {
  231. "name": "GetOpenFileNameA",
  232. "address": "0x4a648c"
  233. }
  234. ],
  235. "dll": "comdlg32.dll"
  236. },
  237. {
  238. "imports": [
  239. {
  240. "name": "SaveDC",
  241. "address": "0x4a6494"
  242. }
  243. ],
  244. "dll": "gdi32.dll"
  245. },
  246. {
  247. "imports": [
  248. {
  249. "name": "VariantCopy",
  250. "address": "0x4a649c"
  251. }
  252. ],
  253. "dll": "oleaut32.dll"
  254. },
  255. {
  256. "imports": [
  257. {
  258. "name": "GetDC",
  259. "address": "0x4a64a4"
  260. }
  261. ],
  262. "dll": "user32.dll"
  263. },
  264. {
  265. "imports": [
  266. {
  267. "name": "VerQueryValueA",
  268. "address": "0x4a64ac"
  269. }
  270. ],
  271. "dll": "version.dll"
  272. }
  273. ],
  274. "digital_signers": null,
  275. "exported_dll_name": null,
  276. "actual_checksum": "0x00046a2c",
  277. "overlay": null,
  278. "imagebase": "0x00400000",
  279. "reported_checksum": "0x00000000",
  280. "icon_hash": null,
  281. "entrypoint": "0x004a4d70",
  282. "timestamp": "1992-06-01 12:37:25",
  283. "osversion": "4.0",
  284. "sections": [
  285. {
  286. "name": "UPX0",
  287. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  288. "virtual_address": "0x00001000",
  289. "size_of_data": "0x00000000",
  290. "entropy": "0.00",
  291. "raw_address": "0x00000400",
  292. "virtual_size": "0x00061000",
  293. "characteristics_raw": "0xe0000080"
  294. },
  295. {
  296. "name": "UPX1",
  297. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  298. "virtual_address": "0x00062000",
  299. "size_of_data": "0x00043000",
  300. "entropy": "7.95",
  301. "raw_address": "0x00000400",
  302. "virtual_size": "0x00043000",
  303. "characteristics_raw": "0xe0000040"
  304. },
  305. {
  306. "name": ".rsrc",
  307. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  308. "virtual_address": "0x000a5000",
  309. "size_of_data": "0x00001600",
  310. "entropy": "3.79",
  311. "raw_address": "0x00043400",
  312. "virtual_size": "0x00002000",
  313. "characteristics_raw": "0xc0000040"
  314. }
  315. ],
  316. "resources": [],
  317. "dirents": [
  318. {
  319. "virtual_address": "0x00000000",
  320. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  321. "size": "0x00000000"
  322. },
  323. {
  324. "virtual_address": "0x000a63ac",
  325. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  326. "size": "0x00000224"
  327. },
  328. {
  329. "virtual_address": "0x000a5000",
  330. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  331. "size": "0x000013ac"
  332. },
  333. {
  334. "virtual_address": "0x00000000",
  335. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  336. "size": "0x00000000"
  337. },
  338. {
  339. "virtual_address": "0x00000000",
  340. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  341. "size": "0x00000000"
  342. },
  343. {
  344. "virtual_address": "0x00000000",
  345. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  346. "size": "0x00000000"
  347. },
  348. {
  349. "virtual_address": "0x00000000",
  350. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  351. "size": "0x00000000"
  352. },
  353. {
  354. "virtual_address": "0x00000000",
  355. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  356. "size": "0x00000000"
  357. },
  358. {
  359. "virtual_address": "0x00000000",
  360. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  361. "size": "0x00000000"
  362. },
  363. {
  364. "virtual_address": "0x000a4f28",
  365. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  366. "size": "0x00000018"
  367. },
  368. {
  369. "virtual_address": "0x00000000",
  370. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  371. "size": "0x00000000"
  372. },
  373. {
  374. "virtual_address": "0x00000000",
  375. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  376. "size": "0x00000000"
  377. },
  378. {
  379. "virtual_address": "0x00000000",
  380. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  381. "size": "0x00000000"
  382. },
  383. {
  384. "virtual_address": "0x00000000",
  385. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  386. "size": "0x00000000"
  387. },
  388. {
  389. "virtual_address": "0x00000000",
  390. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  391. "size": "0x00000000"
  392. },
  393. {
  394. "virtual_address": "0x00000000",
  395. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  396. "size": "0x00000000"
  397. }
  398. ],
  399. "exports": [],
  400. "guest_signers": {},
  401. "imphash": "c458ff2d515beb8f44158cd3636a7400",
  402. "icon_fuzzy": null,
  403. "icon": null,
  404. "pdbpath": null,
  405. "imported_dll_count": 8,
  406. "versioninfo": []
  407. }
  408. }
  409.  
  410. [*] Resolved APIs: []
  411.  
  412. [*] Static Analysis: {
  413. "pe": {
  414. "peid_signatures": null,
  415. "imports": [
  416. {
  417. "imports": [
  418. {
  419. "name": "LoadLibraryA",
  420. "address": "0x4a6460"
  421. },
  422. {
  423. "name": "GetProcAddress",
  424. "address": "0x4a6464"
  425. },
  426. {
  427. "name": "VirtualProtect",
  428. "address": "0x4a6468"
  429. },
  430. {
  431. "name": "VirtualAlloc",
  432. "address": "0x4a646c"
  433. },
  434. {
  435. "name": "VirtualFree",
  436. "address": "0x4a6470"
  437. },
  438. {
  439. "name": "ExitProcess",
  440. "address": "0x4a6474"
  441. }
  442. ],
  443. "dll": "KERNEL32.DLL"
  444. },
  445. {
  446. "imports": [
  447. {
  448. "name": "RegCloseKey",
  449. "address": "0x4a647c"
  450. }
  451. ],
  452. "dll": "advapi32.dll"
  453. },
  454. {
  455. "imports": [
  456. {
  457. "name": "ImageList_Add",
  458. "address": "0x4a6484"
  459. }
  460. ],
  461. "dll": "comctl32.dll"
  462. },
  463. {
  464. "imports": [
  465. {
  466. "name": "GetOpenFileNameA",
  467. "address": "0x4a648c"
  468. }
  469. ],
  470. "dll": "comdlg32.dll"
  471. },
  472. {
  473. "imports": [
  474. {
  475. "name": "SaveDC",
  476. "address": "0x4a6494"
  477. }
  478. ],
  479. "dll": "gdi32.dll"
  480. },
  481. {
  482. "imports": [
  483. {
  484. "name": "VariantCopy",
  485. "address": "0x4a649c"
  486. }
  487. ],
  488. "dll": "oleaut32.dll"
  489. },
  490. {
  491. "imports": [
  492. {
  493. "name": "GetDC",
  494. "address": "0x4a64a4"
  495. }
  496. ],
  497. "dll": "user32.dll"
  498. },
  499. {
  500. "imports": [
  501. {
  502. "name": "VerQueryValueA",
  503. "address": "0x4a64ac"
  504. }
  505. ],
  506. "dll": "version.dll"
  507. }
  508. ],
  509. "digital_signers": null,
  510. "exported_dll_name": null,
  511. "actual_checksum": "0x00046a2c",
  512. "overlay": null,
  513. "imagebase": "0x00400000",
  514. "reported_checksum": "0x00000000",
  515. "icon_hash": null,
  516. "entrypoint": "0x004a4d70",
  517. "timestamp": "1992-06-01 12:37:25",
  518. "osversion": "4.0",
  519. "sections": [
  520. {
  521. "name": "UPX0",
  522. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  523. "virtual_address": "0x00001000",
  524. "size_of_data": "0x00000000",
  525. "entropy": "0.00",
  526. "raw_address": "0x00000400",
  527. "virtual_size": "0x00061000",
  528. "characteristics_raw": "0xe0000080"
  529. },
  530. {
  531. "name": "UPX1",
  532. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  533. "virtual_address": "0x00062000",
  534. "size_of_data": "0x00043000",
  535. "entropy": "7.95",
  536. "raw_address": "0x00000400",
  537. "virtual_size": "0x00043000",
  538. "characteristics_raw": "0xe0000040"
  539. },
  540. {
  541. "name": ".rsrc",
  542. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  543. "virtual_address": "0x000a5000",
  544. "size_of_data": "0x00001600",
  545. "entropy": "3.79",
  546. "raw_address": "0x00043400",
  547. "virtual_size": "0x00002000",
  548. "characteristics_raw": "0xc0000040"
  549. }
  550. ],
  551. "resources": [],
  552. "dirents": [
  553. {
  554. "virtual_address": "0x00000000",
  555. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  556. "size": "0x00000000"
  557. },
  558. {
  559. "virtual_address": "0x000a63ac",
  560. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  561. "size": "0x00000224"
  562. },
  563. {
  564. "virtual_address": "0x000a5000",
  565. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  566. "size": "0x000013ac"
  567. },
  568. {
  569. "virtual_address": "0x00000000",
  570. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  571. "size": "0x00000000"
  572. },
  573. {
  574. "virtual_address": "0x00000000",
  575. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  576. "size": "0x00000000"
  577. },
  578. {
  579. "virtual_address": "0x00000000",
  580. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  581. "size": "0x00000000"
  582. },
  583. {
  584. "virtual_address": "0x00000000",
  585. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  586. "size": "0x00000000"
  587. },
  588. {
  589. "virtual_address": "0x00000000",
  590. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  591. "size": "0x00000000"
  592. },
  593. {
  594. "virtual_address": "0x00000000",
  595. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  596. "size": "0x00000000"
  597. },
  598. {
  599. "virtual_address": "0x000a4f28",
  600. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  601. "size": "0x00000018"
  602. },
  603. {
  604. "virtual_address": "0x00000000",
  605. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  606. "size": "0x00000000"
  607. },
  608. {
  609. "virtual_address": "0x00000000",
  610. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  611. "size": "0x00000000"
  612. },
  613. {
  614. "virtual_address": "0x00000000",
  615. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  616. "size": "0x00000000"
  617. },
  618. {
  619. "virtual_address": "0x00000000",
  620. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  621. "size": "0x00000000"
  622. },
  623. {
  624. "virtual_address": "0x00000000",
  625. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  626. "size": "0x00000000"
  627. },
  628. {
  629. "virtual_address": "0x00000000",
  630. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  631. "size": "0x00000000"
  632. }
  633. ],
  634. "exports": [],
  635. "guest_signers": {},
  636. "imphash": "c458ff2d515beb8f44158cd3636a7400",
  637. "icon_fuzzy": null,
  638. "icon": null,
  639. "pdbpath": null,
  640. "imported_dll_count": 8,
  641. "versioninfo": []
  642. }
  643. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!