SmartHawk

3.4

中危

49 个模型检测该样本为恶意！

重新分析

下载样本

5fa8237700455a67c1db31c12aa20e6b5536af561ae732248326cd94990ac388

0db5d48b126fac60592c74cc2373807e.exe

分析耗时

90s

最近分析

文件大小

693.5KB

静态报毒动态报毒 0NA103I820 100% AGENTTESLA AI SCORE=99 BUPNG6 CONFIDENCE CRYSAN ELDORADO ETZEY@0 FAREIT GDSDA GENERICKD GENOME GNMHQ IGENT KRYPTIK MALICIOUS PE MALWAREX R350446 RM0@A4E9MCI SCORE SIGGEN2 TSCOPE UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FZD!0DB5D48B126F	20200914	6.0.6.653
Alibaba	TrojanSpy:MSIL/AgentTesla.5fe0e57f	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20200915	18.4.3895.0
Kingsoft		20200915	2013.8.14.323
Tencent	Msil.Backdoor.Crysan.Jcn	20200915	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Checks if process is being debugged by a debugger (49 个事件)

Time & API	Arguments	Status	Return	Repeated
1620129789.586875 IsDebuggerPresent		failed	0	0
1620129789.586875 IsDebuggerPresent		failed	0	0
1620129840.227875 IsDebuggerPresent		failed	0	0
1620129840.711875 IsDebuggerPresent		failed	0	0
1620129841.242875 IsDebuggerPresent		failed	0	0
1620129841.711875 IsDebuggerPresent		failed	0	0
1620129842.242875 IsDebuggerPresent		failed	0	0
1620129842.711875 IsDebuggerPresent		failed	0	0
1620129843.242875 IsDebuggerPresent		failed	0	0
1620129843.711875 IsDebuggerPresent		failed	0	0
1620129844.242875 IsDebuggerPresent		failed	0	0
1620129844.711875 IsDebuggerPresent		failed	0	0
1620129845.242875 IsDebuggerPresent		failed	0	0
1620129845.711875 IsDebuggerPresent		failed	0	0
1620129846.242875 IsDebuggerPresent		failed	0	0
1620129846.711875 IsDebuggerPresent		failed	0	0
1620129847.242875 IsDebuggerPresent		failed	0	0
1620129847.711875 IsDebuggerPresent		failed	0	0
1620129848.242875 IsDebuggerPresent		failed	0	0
1620129848.727875 IsDebuggerPresent		failed	0	0
1620129849.242875 IsDebuggerPresent		failed	0	0
1620129849.727875 IsDebuggerPresent		failed	0	0
1620129850.242875 IsDebuggerPresent		failed	0	0
1620129850.727875 IsDebuggerPresent		failed	0	0
1620129851.242875 IsDebuggerPresent		failed	0	0
1620129851.727875 IsDebuggerPresent		failed	0	0
1620129852.242875 IsDebuggerPresent		failed	0	0
1620129852.727875 IsDebuggerPresent		failed	0	0
1620129853.242875 IsDebuggerPresent		failed	0	0
1620129853.727875 IsDebuggerPresent		failed	0	0
1620129854.242875 IsDebuggerPresent		failed	0	0
1620129854.727875 IsDebuggerPresent		failed	0	0
1620129855.242875 IsDebuggerPresent		failed	0	0
1620129855.727875 IsDebuggerPresent		failed	0	0
1620129856.242875 IsDebuggerPresent		failed	0	0
1620129856.727875 IsDebuggerPresent		failed	0	0
1620129857.242875 IsDebuggerPresent		failed	0	0
1620129857.727875 IsDebuggerPresent		failed	0	0
1620129858.242875 IsDebuggerPresent		failed	0	0
1620129858.727875 IsDebuggerPresent		failed	0	0
1620129859.242875 IsDebuggerPresent		failed	0	0
1620129859.727875 IsDebuggerPresent		failed	0	0
1620129860.242875 IsDebuggerPresent		failed	0	0
1620129860.727875 IsDebuggerPresent		failed	0	0
1620129861.242875 IsDebuggerPresent		failed	0	0
1620129861.727875 IsDebuggerPresent		failed	0	0
1620129862.242875 IsDebuggerPresent		failed	0	0
1620129862.727875 IsDebuggerPresent		failed	0	0
1620129863.258875 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620129789.633875 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 93 个事件)

Time & API	Arguments	Status	Return
1620129788.805875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x004e0000	success	0
1620129788.805875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e0000	success	0
1620129789.086875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f40000	success	0
1620129789.086875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02080000	success	0
1620129789.320875 NtProtectVirtualMemory	process_identifier: 428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success	0
1620129789.586875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x005d0000	success	0
1620129789.586875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005d0000	success	0
1620129789.586875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056a000	success	0
1620129789.586875 NtProtectVirtualMemory	process_identifier: 428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success	0
1620129789.586875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00562000	success	0
1620129790.023875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00582000	success	0
1620129790.336875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a5000	success	0
1620129790.336875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ab000	success	0
1620129790.336875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a7000	success	0
1620129790.508875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00583000	success	0
1620129790.555875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058c000	success	0
1620129791.102875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00584000	success	0
1620129791.117875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00586000	success	0
1620129791.242875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fe0000	success	0
1620129791.367875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059a000	success	0
1620129791.367875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00597000	success	0
1620129791.477875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00596000	success	0
1620129791.523875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fe1000	success	0
1620129791.867875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058a000	success	0
1620129791.930875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056c000	success	0
1620129792.023875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00587000	success	0
1620129792.648875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059b000	success	0
1620129792.945875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00588000	success	0
1620129793.117875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02150000	success	0
1620129826.320875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02081000	success	0
1620129826.555875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00563000	success	0
1620129826.555875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fe2000	success	0
1620129826.570875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00589000	success	0
1620129826.727875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04f80000	success	0
1620129826.727875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04f81000	success	0
1620129826.789875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04f82000	success	0
1620129826.836875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fe3000	success	0
1620129826.867875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04f83000	success	0
1620129826.883875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fe4000	success	0
1620129826.914875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fe7000	success	0
1620129827.008875 NtProtectVirtualMemory	process_identifier: 428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 434176 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05da0400	failed	3221225550
1620129839.320875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fe8000	success	0
1620129839.320875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04f84000	success	0
1620129839.320875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058d000	success	0
1620129839.320875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fe9000	success	0
1620129839.352875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fea000	success	0
1620129839.398875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01feb000	success	0
1620129839.508875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fec000	success	0
1620129839.789875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04f85000	success	0
1620129839.789875 NtAllocateVirtualMemory	process_identifier: 428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fed000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.7108836329038635

section

{'size_of_data': '0x000a9000', 'virtual_address': '0x00002000', 'entropy': 7.7108836329038635, 'name': '.text', 'virtual_size': '0x000a8fb0'}

description

A section with a high entropy has been found

entropy

0.9754689754689755

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620129826.992875 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	23.204.147.10
host	23.73.130.115

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 个事件)

MicroWorld-eScan	Trojan.GenericKD.34488416
FireEye	Generic.mg.0db5d48b126fac60
McAfee	Fareit-FZD!0DB5D48B126F
Malwarebytes	Trojan.MalPack.PNG.Generic
Sangfor	Malware
K7AntiVirus	Trojan ( 0056de0b1 )
Alibaba	TrojanSpy:MSIL/AgentTesla.5fe0e57f
K7GW	Trojan ( 0056de0b1 )
Cybereason	malicious.b126fa
Arcabit	Trojan.Generic.D20E4060
BitDefenderTheta	Gen:NN.ZemsilF.34242.Rm0@a4e9mCi
Cyren	W32/MSIL_Kryptik.BOH.gen!Eldorado
Symantec	Packed.Generic.570
ESET-NOD32	a variant of MSIL/Kryptik.XPZ
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Cynet	Malicious (score: 85)
Kaspersky	HEUR:Backdoor.MSIL.Crysan.gen
BitDefender	Trojan.GenericKD.34488416
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.34488416
Emsisoft	Trojan.GenericKD.34488416 (B)
Comodo	TrojWare.Win32.Genome.etzey@0
DrWeb	Trojan.PWS.Siggen2.54533
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.gnmhq
MAX	malware (ai score=99)
Antiy-AVL	Trojan[Backdoor]/MSIL.Crysan
Microsoft	TrojanSpy:MSIL/AgentTesla.AQ!MTB
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Backdoor.MSIL.Crysan.gen
GData	Trojan.GenericKD.34488416
AhnLab-V3	Trojan/Win32.Inject.R350446
VBA32	TScope.Trojan.MSIL
ALYac	Spyware.AgentTesla
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_FRS.0NA103I820
Tencent	Msil.Backdoor.Crysan.Jcn
Yandex	Trojan.Igent.bUpng6.2
Ikarus	Trojan.MSIL.Inject
Fortinet	MSIL/Kryptik.XRP!tr
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Generic/Trojan.ca6

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-07 14:11:22

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	58368	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.