6.2
高危
42 个模型检测该样本为恶意！
重新分析
更多

8255cac50835b7957f99c316b18db603429583e2c9f2fe605e5a4a9f19c6e9cb

015a4a7dce3d072abbd7a5517278b336.exe

分析耗时

44s

最近分析

文件大小

3.9MB
静态报毒 动态报毒 AI SCORE=87 ARTEMIS CASUR CONFIDENCE GENERICKD HGEASOGA KCLOUD MALICIOUS MALWARE@#2MD27V45D2MXY OCCAMY PATCHEDWINSWRORT PYTHON ROZENA SCORE SUSGEN SWRORT TROJANVEIL UNSAFE YZERS 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!015A4A7DCE3D 20210213 6.0.6.653
CrowdStrike win/malicious_confidence_80% (W) 20210203 1.0
Alibaba Trojan:Win32/Rozena.4c1a7606 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win64:Trojan-gen 20210213 21.1.5827.0
Kingsoft Win32.Troj.Undef.(kcloud) 20210213 2017.9.26.565
Tencent Win32.Trojan.Generic.Chm 20210213 1.0.0.1
静态指标
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619159520.485875
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .gfids
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619159548.1425
__exception__
stacktrace: 
0x600030
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c

registers.r14: 1453503984
registers.r9: 0
registers.rcx: 110
registers.rsi: 31244186271350894
registers.r10: 0
registers.rbx: 6291926
registers.rdi: 0
registers.r11: 514
registers.r8: 8791716488948
registers.rdx: 2009605728
registers.rbp: 6291466
registers.r15: 1152921504606846960
registers.r12: 0
registers.rsp: 1290776
registers.rax: 0
registers.r13: 1292144
exception.instruction_r: ac 3c 61 7c 02 2c 20 41 c1 c9 0d 41 01 c1 e2 ed
exception.instruction: lodsb al, byte ptr [rsi]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x600030
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619159522.5335
NtAllocateVirtualMemory
process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000000560000
success 0 0
1619159522.7985
NtAllocateVirtualMemory
process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0000000000600000
success 0 0
1619159522.7985
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x0000000000600000
success 0 0
Creates executable files on the filesystem (4 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI28682\msvcm90.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI28682\msvcr90.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI28682\msvcp90.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI28682\python27.dll
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619159526.6895
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.297139614323312 section {'size_of_data': '0x0000ec00', 'virtual_address': '0x00046000', 'entropy': 7.297139614323312, 'name': '.rsrc', 'virtual_size': '0x0000ea38'} description A section with a high entropy has been found
entropy 0.2209737827715356 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 139.199.158.84
host 172.217.24.14
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619159529.2835
RegSetValueExA
key_handle: 0x000000000000035c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619159529.2835
RegSetValueExA
key_handle: 0x000000000000035c
value: Ê·=ñ7×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619159529.2835
RegSetValueExA
key_handle: 0x000000000000035c
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619159529.2835
RegSetValueExW
key_handle: 0x000000000000035c
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619159529.2835
RegSetValueExA
key_handle: 0x0000000000000374
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619159529.2835
RegSetValueExA
key_handle: 0x0000000000000374
value: Ê·=ñ7×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619159529.2985
RegSetValueExA
key_handle: 0x0000000000000374
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619159529.3615
RegSetValueExW
key_handle: 0x0000000000000358
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 个事件)
Cynet Malicious (score: 100)
McAfee Artemis!015A4A7DCE3D
Cylance Unsafe
AegisLab Trojan.Win32.Generic.4!c
Sangfor Trojan.Win32.Occamy.C
CrowdStrike win/malicious_confidence_80% (W)
Alibaba Trojan:Win32/Rozena.4c1a7606
Symantec Trojan.Gen.MBT
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Trojan.GenericKD.33297357
MicroWorld-eScan Trojan.GenericKD.33297357
Avast Win64:Trojan-gen
Ad-Aware Trojan.GenericKD.33297357
Emsisoft Trojan.GenericKD.33297357 (B)
Comodo Malware@#2md27v45d2mxy
F-Secure Trojan.TR/AD.PatchedWinSwrort.yzers
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win64.TrojanVeil.wc
FireEye Trojan.GenericKD.33297357
Sophos Mal/Generic-S
Ikarus Trojan.Python.Rozena
GData Trojan.GenericKD.33297357
Avira TR/AD.PatchedWinSwrort.yzers
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win64.Agent.dg
Arcabit Trojan.Generic.D1FC13CD
ZoneAlarm HEUR:Trojan.Win32.Generic
Microsoft Trojan:Win32/Occamy.C
VBA32 Trojan.Casur
ALYac Trojan.Agent.Rozena
MAX malware (ai score=87)
Malwarebytes Generic.Malware/Suspicious
ESET-NOD32 Python/Rozena.BC
Tencent Win32.Trojan.Generic.Chm
MaxSecure Trojan.Malware.7164915.susgen
Fortinet W32/Generic.BC!tr
AVG Win64:Trojan-gen
Cybereason malicious.dce3d0
Panda Trj/CI.A
Qihoo-360 Win64/Trojan.Swrort.HgEASOgA
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (11 个事件)
dead_host 139.199.158.84:14433
dead_host 192.168.56.101:49181
dead_host 192.168.56.101:49180
dead_host 192.168.56.101:49188
dead_host 192.168.56.101:49178
dead_host 192.168.56.101:49187
dead_host 192.168.56.101:49186
dead_host 192.168.56.101:49183
dead_host 192.168.56.101:49185
dead_host 192.168.56.101:49182
dead_host 192.168.56.101:49184
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-01-05 20:15:27

Imports

Library KERNEL32.dll:
• 0x140023010 GetModuleFileNameW
• 0x140023018 GetProcAddress
• 0x140023020 GetCommandLineW
• 0x140023028 GetEnvironmentVariableW
• 0x140023030 SetEnvironmentVariableW
• 0x140023040 GetTempPathW
• 0x140023048 WaitForSingleObject
• 0x140023050 Sleep
• 0x140023058 SetDllDirectoryW
• 0x140023060 CreateProcessW
• 0x140023068 GetStartupInfoW
• 0x140023070 LoadLibraryExW
• 0x140023078 CreateDirectoryW
• 0x140023080 GetShortPathNameW
• 0x140023088 FormatMessageW
• 0x140023090 LoadLibraryA
• 0x140023098 MultiByteToWideChar
• 0x1400230a0 WideCharToMultiByte
• 0x1400230a8 GetExitCodeProcess
• 0x1400230b0 GetLastError
• 0x1400230b8 SetEndOfFile
• 0x1400230c0 HeapReAlloc
• 0x1400230c8 RtlCaptureContext
• 0x1400230d0 RtlLookupFunctionEntry
• 0x1400230d8 RtlVirtualUnwind
• 0x1400230e0 UnhandledExceptionFilter
• 0x1400230f0 GetCurrentProcess
• 0x1400230f8 TerminateProcess
• 0x140023108 QueryPerformanceCounter
• 0x140023110 GetCurrentProcessId
• 0x140023118 GetCurrentThreadId
• 0x140023120 GetSystemTimeAsFileTime
• 0x140023128 InitializeSListHead
• 0x140023130 IsDebuggerPresent
• 0x140023138 GetModuleHandleW
• 0x140023140 RtlUnwindEx
• 0x140023148 SetLastError
• 0x140023150 EnterCriticalSection
• 0x140023158 LeaveCriticalSection
• 0x140023160 DeleteCriticalSection
• 0x140023170 TlsAlloc
• 0x140023178 TlsGetValue
• 0x140023180 TlsSetValue
• 0x140023188 TlsFree
• 0x140023190 FreeLibrary
• 0x140023198 GetCommandLineA
• 0x1400231a0 ReadFile
• 0x1400231a8 CreateFileW
• 0x1400231b0 GetDriveTypeW
• 0x1400231b8 GetFileType
• 0x1400231c0 CloseHandle
• 0x1400231c8 PeekNamedPipe
• 0x1400231d8 FileTimeToSystemTime
• 0x1400231e0 GetFullPathNameW
• 0x1400231e8 GetFullPathNameA
• 0x1400231f0 RemoveDirectoryW
• 0x1400231f8 FindClose
• 0x140023200 FindFirstFileExW
• 0x140023208 FindNextFileW
• 0x140023210 SetStdHandle
• 0x140023218 SetConsoleCtrlHandler
• 0x140023220 DeleteFileW
• 0x140023228 GetStdHandle
• 0x140023230 WriteFile
• 0x140023238 ExitProcess
• 0x140023240 GetModuleHandleExW
• 0x140023248 GetACP
• 0x140023250 HeapFree
• 0x140023258 HeapAlloc
• 0x140023260 GetConsoleMode
• 0x140023268 ReadConsoleW
• 0x140023270 SetFilePointerEx
• 0x140023278 GetConsoleCP
• 0x140023280 CompareStringW
• 0x140023288 LCMapStringW
• 0x140023290 GetCurrentDirectoryW
• 0x140023298 FlushFileBuffers
• 0x1400232a0 SetEnvironmentVariableA
• 0x1400232a8 GetFileAttributesExW
• 0x1400232b0 IsValidCodePage
• 0x1400232b8 GetOEMCP
• 0x1400232c0 GetCPInfo
• 0x1400232c8 GetEnvironmentStringsW
• 0x1400232d0 FreeEnvironmentStringsW
• 0x1400232d8 GetStringTypeW
• 0x1400232e0 GetProcessHeap
• 0x1400232e8 WriteConsoleW
• 0x1400232f0 GetTimeZoneInformation
• 0x1400232f8 HeapSize
• 0x140023300 RaiseException
Library ADVAPI32.dll:
Library WS2_32.dll:
• 0x140023310 ntohl

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.