2.2
中危

07735b49ca8ee475661825128ae67dc3774c22de6a3767d5659c3e1269c7b542

07735b49ca8ee475661825128ae67dc3774c22de6a3767d5659c3e1269c7b542.exe

分析耗时

133s

最近分析

397天前

文件大小

21.9KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER UPATRE
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.57
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Agent-AUID [Trj] 20191004 18.4.3895.0
Baidu Win32.Trojan-Downloader.Waski.a 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191004 2013.8.14.323
McAfee Downloader-FSH 20191004 6.0.6.653
Tencent None 20191004 1.0.0.1
静态指标
检查进程是否被调试器调试 (2 个事件)
Time & API Arguments Status Return Repeated
1727545310.297125
IsDebuggerPresent
failed 0 0
1727545310.719
IsDebuggerPresent
failed 0 0
行为判定
动态指标
分配可读-可写-可执行内存(通常用于自解压) (2 个事件)
Time & API Arguments Status Return Repeated
1727545310.344125
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00401000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1932
success 0 0
1727545310.75
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00401000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 600
success 0 0
在文件系统上创建可执行文件 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\cahst.exe
投放一个二进制文件并执行它 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\cahst.exe
将可执行文件投放到用户的 AppData 文件夹 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\cahst.exe
一个进程创建了一个隐藏窗口 (1 个事件)
Time & API Arguments Status Return Repeated
1727545310.547125
ShellExecuteExW
filepath: C:\Users\Administrator\AppData\Local\Temp\cahst.exe
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\cahst.exe
parameters:
show_type: 0
success 1 0
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00000fb1', 'size_of_data': '0x00001000', 'entropy': 6.859888525734461} entropy 6.859888525734461 description 发现高熵的节
entropy 0.25 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 60 个反病毒引擎识别为恶意 (50 out of 60 个事件)
ALYac Trojan.GenericKD.1630655
APEX Malicious
AVG Win32:Agent-AUID [Trj]
Acronis suspicious
Ad-Aware Trojan.GenericKD.1630655
AhnLab-V3 Spyware/Win32.Zbot.R101794
Antiy-AVL Trojan/Win32.AGeneric
Arcabit Trojan.Generic.D18E1BF
Avast Win32:Agent-AUID [Trj]
Avira TR/Yarwi.hotwk
Baidu Win32.Trojan-Downloader.Waski.a
BitDefender Trojan.GenericKD.1630655
CAT-QuickHeal TrojanDownloader.Upatre.A4
ClamAV Win.Downloader.Upatre-5744092-0
Comodo TrojWare.Win32.Bublik.CEZE@595kvx
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.b95bfb
Cylance Unsafe
Cyren W32/Trojan.FIMA-0757
DrWeb Trojan.DownLoad3.28161
ESET-NOD32 Win32/TrojanDownloader.Waski.B
Emsisoft Trojan.GenericKD.1630655 (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.HYZ
F-Secure Trojan.TR/Yarwi.hotwk
FireEye Generic.mg.016a484b95bfbb41
Fortinet W32/Bublik.A!tr
GData Trojan.GenericKD.1630655
Ikarus Trojan.Zbot
Invincea heuristic
Jiangmin Trojan/Generic.azsga
K7AntiVirus Trojan-Downloader ( 0040f7f11 )
K7GW Trojan-Downloader ( 0040f7f11 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=80)
Malwarebytes Trojan.Downloader
McAfee Downloader-FSH
McAfee-GW-Edition BehavesLike.Win32.Downloader.mm
MicroWorld-eScan Trojan.GenericKD.1630655
Microsoft TrojanDownloader:Win32/Upatre.AA
NANO-Antivirus Trojan.Win32.DownLoad3.cwefez
Panda Generic Malware
Qihoo-360 HEUR/QVM20.1.5359.Malware.Gen
Rising Trojan.Waski!1.A489 (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Waski
SentinelOne DFI - Malicious PE
Sophos Troj/Upatre-AW
Symantec Trojan.Zbot
TotalDefense Win32/Zbot.IKeTOXC
Trapmine malicious.high.ml.score
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2006-12-19 15:45:55

PE Imphash

5939011907b3c0ec6752dec24351da96

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00000fb1 0x00001000 6.859888525734461
.data 0x00002000 0x000006b2 0x00000800 3.841345881360375
.rsrc 0x00003000 0x00002778 0x00002800 4.059209907170034

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000030f0 0x000025a8 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MENU 0x000056b0 0x000000c4 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x00005698 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library USER32.dll:
0x402024 DefWindowProcA
0x402028 CreateWindowExA
0x40202c LoadBitmapA
0x402030 TranslateMessage
0x402034 SendMessageA
0x402038 GetMessageA
0x40203c PostQuitMessage
0x402040 ShowWindow
0x402044 UpdateWindow
0x402048 LoadCursorA
0x40204c TrackPopupMenu
0x402050 FlashWindowEx
0x402054 GetKeyState
0x40205c RegisterClassA
0x402060 GetWindowTextA
0x402064 DispatchMessageA
0x402068 GetDlgItemTextA
Library KERNEL32.dll:
0x402000 HeapAlloc
0x402004 GetModuleHandleA
0x402008 FindFirstFileA
0x40200c FindClose
0x402010 HeapCreate
0x402014 FindNextFileA
0x402018 CloseHandle
0x40201c ExitProcess

L!This program cannot be run in DOS mode.
`.data
K# 8h>9
AXKNdKn" adnnA
WAVAf9
GEGEGMG;r
3UV3W}
FG3@_^]
dVWSSu
YIuKXG[O_^
P3^Y5($@
jg5($@
jf5($@
3P5($@
3PPPUR
t%50 @
MQ3PPPUR
XKN?2g
"(#997%
25;&>3
39?+"'
>3.=8=d<
<$0=8:3
i'4>BC$r
a<kbAA
" 9c`nn
NLH a?XK!Mn"Jad;q
!RS}#"Jbe
42X#aK!
p.;"4!>
C+2I&dK.
4Ga:BX
K<sv&4;
x4N>#Wdn,1!
wM$_4nT&,,
m2Wg,z<5[
,!i#n"Ji
;iXKNa;rUw
}+~""al
KlH(:;F
^mnAAk
fAA[1);rU
bd?8)AX!y
{mnnAB
!q[" a288
N.OS2" ne=
xz1nAAZ
+JH(:;F
xOd+NWg
d5SYdKn_40`
UhWGB&
l!7h><X%
Jn#$GK!]
KNdI>J aonAA\
N;ru1jr
w3;y)\KN
fuEh'9<
XKN92g
nd2}8N
NK^]qu
njgb f
instability
frantically
contents
button
sacdea
acasec
mcasic
static
Mjt1EtP6Kle'P
bad allocation
posteriority
GetDlgItemTextA
GetWindowTextA
RegisterClassA
TranslateAcceleratorA
GetKeyState
FlashWindowEx
TrackPopupMenu
LoadCursorA
SendMessageA
DefWindowProcA
CreateWindowExA
LoadBitmapA
TranslateMessage
DispatchMessageA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
CloseHandle
FindNextFileA
HeapCreate
FindClose
FindFirstFileA
GetModuleHandleA
HeapAlloc
ExitProcess
KERNEL32.dll
vvvwww
////////F;|s/F;//-
.///////-
/1 1 1 1 1 1 1 1 |s1 UJ1 1 bW1 1 1 1 1 1 1 /
1 2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!1
3"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"4"3"
4#G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;G;4#4#4#
Lhttp://notepad-plus-plus.org/
http://notepad-plus-plus.org/contributors
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any la
C:\Users\charlie\Desktop\16\MarchStatement.scr
C:\534b690abecb573d00549e07cfcb73bd4175dd1952c7d2a7414c3ee048d3551a
C:\6cf86d0ebeaed6f4b8852d61bf0caace5338ee3243369a4f7b3ea93bd0437469
C:\aR_ycW8z.exe
C:\tAamUqWW.exe
C:\Stty2YNH.exe
C:\TyKfplMn.exe
C:\SmoV74G5.exe
C:\LnzaG0Tg.exe
C:\HQZBoFm_.exe
C:\O7o2yGmR.exe
C:\k9laWyQ9.exe
C:\UillewoU.exe
C:\52jruNqG.exe
C:\_ph4iEzt.exe
C:\3ABU0QOj.exe
C:\52C167VL.exe
C:\PyCRvYx9.exe
C:\LIC6FA9Z.exe
C:\uHwKF8GM.exe
C:\gtMZw5wH.exe
C:\2RA9GmPt.exe
C:\kxjgq9UZ.exe
C:\btmEb8le.exe
C:\1dGSSHhA.exe
C:\ecNgCFnc.exe
C:\5deqmT6w.exe
C:\sUFjoYF7.exe
C:\ZS9LWB8C.exe
C:\i7xvNbK6.exe
C:\mTJwQHQM.exe
C:\Z_twLUod.exe
C:\Btjkpb3x.exe
C:\RtJRQ5AZ.exe
C:\SEQrQ_Uv.exe
C:\BSJ0HDlk.exe
C:\wb_F78dK.exe
C:\Ce677IOl.exe
C:\2e21b9bf6439ae813f1593ef99e1483d04cae2f965e18508541ce1edd1d1b573
C:\vUqJ3N99.exe
C:\qDLCCotN.exe
C:\5FfNNv9W.exe
C:\FXJXUVGg.exe
C:\hq2okKrS.exe
C:\9HPS2DnZ.exe
C:\28ea3ddcccac8551d4014f3d0cc1fcc7550dc4f20161357bb68fa70fbd9e9b46
C:\Users\admin\Downloads\invoice.exe
C:\cb93d114041adc87b03d96bdb45a32a3c6e6efd75c3c7db7a1528465215e2b93
C:\3tQMahaR.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\invoice.exe
C:\Users\admin\Downloads\important_document.exe
C:\27bbb2eac73061d1719bfb177154bbab1ae09fc095f5a430218bdb17fb28469a
C:\e5b095315850504c47b054ed4077e49811fa1b9edd36a7d39aaad32c8243161b
C:\Users\admin\Downloads\sample.exe
C:\fddfc520bdb62b1ff7db6c94ee59019879f9a2c4eb33d34b8ebcbfac3c2c939f
C:\345e3bb198f67a18551687e9e766f6a37ccee918600ed4e934191fd328bd2338
C:\Users\admin\Downloads\factura.exe
C:\9243f6dd1c1ffedb09b2136d24fcc67f5d7736943b2134fc0b9286a5fca11aae
C:\av6drLwu.exe
C:\Users\admin\Downloads\factura.exe
C:\VM1YAAnV.exe
C:\e05b17136103adffb74d8a7b52bdfdc881d8f6a4f889e90fc7466a1e3ff37aaf
C:\cPRYFjiT.exe
C:\Users\admin\Downloads\important_document.exe
C:\328643c26ede33470d168e83673b9c75d5905d05b3ab74ebd1ad262f65c44478
C:\iLp9hRT0.exe
C:\ba27d1effabb30c83ce5540e4be9af40a26fc07ca779da7e04ba57379345a41c
C:\Users\admin\Downloads\cahst.exe
C:\2e00adfcb37c5f6924e643077b17f0b08af12380acfcc070d302cb7b3bc912d2
C:\Users\admin\Downloads\cahst.exe
C:\546fbc0039632cd7cadf70133235a559936876bb15d503fda40315d1265e784d
C:\Users\admin\Downloads\cahst.exe
C:\5e7bbac0f182d2b806409cf06cfe0388d5edc6daad65e185d5e598aadbede772
C:\Users\admin\Downloads\cahst.exe
C:\856e9d0bad8a553da3b875683c38ac4bbd018cb41421daee8b44b06694602747
C:\Users\admin\Downloads\cahst.exe
C:\949a428aea0307f21cb45aaa16588913e3fbd69aa4b3035565371cf0322f4645
C:\Users\admin\Downloads\cahst.exe

Process Tree


07735b49ca8ee475661825128ae67dc3774c22de6a3767d5659c3e1269c7b542.exe, PID: 1932, Parent PID: 1612

default registry file network process services synchronisation iexplore office pdf

cahst.exe, PID: 600, Parent PID: 1932

default registry file network process services synchronisation iexplore office pdf

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 57665 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 512a8113b6e41398_cahst.exe
Filepath C:\Users\Administrator\AppData\Local\Temp\cahst.exe
Size 22.2KB
Processes 1932 (07735b49ca8ee475661825128ae67dc3774c22de6a3767d5659c3e1269c7b542.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fa71698d0aa3082c50d534266623bdaf
SHA1 775e84830f1eda052b002a124107fcd2ec26a905
SHA256 512a8113b6e413983c21ebc1be8668aea2d02dd507fbdea99a58a809be9b4d8e
CRC32 A062D69B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.