1.4
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.60
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Trojan-gen | 20200311 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Tiny.c | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200311 | 2013.8.14.323 |
| McAfee | VTFlooder!149C15DFFD7A | 20200310 | 6.0.6.653 |
| Tencent | Trojan.Win32.VtFlooder.a | 20200311 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(1 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x00007000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000e00', 'entropy': 7.197834820825048} | entropy | 7.197834820825048 | description | 发现高熵的节 | |||||||||
可执行文件使用UPX压缩
(3 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
| section | UPX2 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意
(50 out of 64 个事件)
| ALYac | Gen:Variant.Ulise.1586 |
| APEX | Malicious |
| AVG | Win32:Trojan-gen |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.1586 |
| AhnLab-V3 | Trojan/Win32.Vflooder.C1453219 |
| Antiy-AVL | Trojan/Win32.TSGeneric |
| Arcabit | Trojan.Ulise.D632 |
| Avast | Win32:Trojan-gen |
| Avira | TR/Crypt.XPACK.Gen |
| Baidu | Win32.Trojan-Downloader.Tiny.c |
| BitDefender | Gen:Variant.Ulise.1586 |
| BitDefenderTheta | Gen:NN.ZexaF.34098.bqW@a8Rdq1g |
| Bkav | W32.FamVT.VtfodsVM.Trojan |
| CAT-QuickHeal | Trojan.Vflooder.E3 |
| ClamAV | Win.Malware.Vtflooder-6723768-0 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.ffd7ab |
| Cylance | Unsafe |
| Cyren | W32/S-528c72e4!Eldorado |
| DrWeb | Trojan.Flood.22062 |
| ESET-NOD32 | Win32/TrojanClicker.Tiny.NAM |
| Emsisoft | Gen:Variant.Ulise.1586 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-528c72e4!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.149c15dffd7ab30c |
| Fortinet | W32/TrojanClicker.NAM!tr |
| GData | Gen:Variant.Ulise.1586 |
| Ikarus | Trojan.Crypt |
| Invincea | heuristic |
| Jiangmin | Trojan/Badur.cky |
| K7AntiVirus | Spyware ( 0049c3e41 ) |
| K7GW | Spyware ( 0049c3e41 ) |
| Kaspersky | Trojan.Win32.Vtflooder.cft |
| MAX | malware (ai score=80) |
| Malwarebytes | Trojan.Flooder.UPX |
| MaxSecure | Trojan.Badur.ilcp |
| McAfee | VTFlooder!149C15DFFD7A |
| McAfee-GW-Edition | BehavesLike.Win32.VTFlooder.mz |
| MicroWorld-eScan | Gen:Variant.Ulise.1586 |
| Microsoft | Trojan:Win32/Vflooder.B |
| NANO-Antivirus | Trojan.Win32.Crypted.dbpklq |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.CEB1.Malware.Gen |
| Rising | Trojan.Vflooder!1.A171 (RDMK:cmRtazr5rWdnh2ZQGOqyPXSW+Liu) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-AHNL |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1970-01-06 02:18:59
PE Imphash
3d8c26f4cb1782a87c3bb42796fb6b85
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00006000 | 0x00005400 | 1.9572609306734294 |
| UPX1 | 0x00007000 | 0x00001000 | 0x00000e00 | 7.197834820825048 |
| UPX2 | 0x00008000 | 0x00001000 | 0x00000200 | 3.417706440053802 |
| .imports | 0x00009000 | 0x00001000 | 0x00000400 | 3.212395201352827 |
Imports
Library KERNEL32.DLL:
• 0x402000 Sleep
• 0x402004 lstrlenA
• 0x402008 CreateThread
• 0x40200c VirtualFree
• 0x402010 GetModuleFileNameW
• 0x402014 GetTickCount
• 0x402018 ExitProcess
• 0x40201c GetFileSize
• 0x402020 VirtualAlloc
• 0x402024 ReadFile
• 0x402028 CloseHandle
• 0x40202c CreateFileW
• 0x402030 lstrlenW
• 0x402034 MultiByteToWideChar
Library ole32.dll:
• 0x402088 CreateStreamOnHGlobal
Library SHLWAPI.dll:
• 0x40203c StrStrA
Library WINHTTP.dll:
• 0x402050 WinHttpCrackUrl
• 0x402054 WinHttpOpen
• 0x402058 WinHttpConnect
• 0x40205c WinHttpOpenRequest
• 0x402060 WinHttpSendRequest
• 0x402064 WinHttpQueryHeaders
• 0x402068 WinHttpReadData
• 0x40206c WinHttpCloseHandle
• 0x402070 WinHttpReceiveResponse
L!This program cannot be run in DOS mode.
wy3*3*3*3*6*:4*8*3*(*(:
*0*(::*2*Rich3*
.imports
EEEEMQj
27UREPh
E3EEEEEMQj
UREPMQ
RPQRh"@
EEPMQUREP
Qjhx#@
EMQUREPMQ
QjU REP
EUREPMQUR
9U}$EMT
--------%015d
Content-Disposition: form-data; name="apikey"
Content-Type: text/plain
f25133d9068704c23335fc39a7351828fa80c5dde894d731d5450cf8ab8569e8
Content-Disposition: form-data; name="file"; filename="1.exe"
Content-Type: application/x-msdownload
Content-Transfer-Encoding: binary
--------%015d--
|$$$}rstuvwxyz{$$$$$$$>?@ABCDEFGHIJKLMNOPQRSTUVW$$$$$$XYZ[\]^_`abcdefghijklmnopq
lstrlenA
CreateThread
VirtualFree
GetModuleFileNameW
GetTickCount
ExitProcess
GetFileSize
VirtualAlloc
ReadFile
CloseHandle
CreateFileW
lstrlenW
MultiByteToWideChar
memset
memcpy
CreateStreamOnHGlobal
StrStrA
wsprintfA
wsprintfW
WinHttpCrackUrl
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpReadData
WinHttpCloseHandle
WinHttpReceiveResponse
`.rdata
@.data
UR+Eo2
WQF*,Cx
mNL.|LZ
PUR!n%j<EZds7s<
0P#aKR
d>7,Y0
*`0Wj%3
x @ah4t!
EPQh(%TH
QUvlVOI(#>
$F{A._
,_|#PCi
T(]5"7f
hl#@2t!
DUR`oYFn@p#
PhxsP!!<
ef%eaPJl
"1d,0t
jchl%p/E
&^B_Y9
P5%~JkuX
Me:}~k
77Gt"6$u
VjYL%F6
-?A%015d
-Dispositi
: form-data; name=
k"apikey"3.Type'
xt[lain
f25133d9068704c2
35fc39a7
1828fa80cxde894d
f8C`ab8569
1.e{k)icaD/x-msd
ownloadransfer-Encod
ary3EN--
/srA=
wu]7.-i]u%toE
N[ m.t )
PYe92cM71
3A8VUsF7{pE//
itKx'b
}rstuvwx
yz{$>?@ABCDEFGHIJKLMNOPQR?STUVW XYZ[\]^_`cD
fghijklmnopq
nACreateTh
VirmtualFe
GetModu'F
TickCo_unt
ExitProcess
izeHAll
seHand
MrtiBy;
oWideCharxwmmA{_wtoi
cpy =;TSt
mOnHGwmpb <
Dwsprig]vfA
Pm{kEttpWaU
onnect
]5$^vive
T7 dy,$
B!`.roh
.&J}J(
XPTPSWXaD$j
KERNEL32.DLL
ntdll.dll
ole32.dll
SHLWAPI.dll
USER32.dll
WINHTTP.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
CreateStreamOnHGlobal
StrStrA
wsprintfA
WinHttpOpen
KERNEL32.DLL
lstrlenA
CreateThread
VirtualFree
GetModuleFileNameW
GetTickCount
ExitProcess
GetFileSize
VirtualAlloc
ReadFile
CloseHandle
CreateFileW
lstrlenW
MultiByteToWideChar
ntdll.dll
memset
memcpy
ole32.dll
CreateStreamOnHGlobal
SHLWAPI.dll
StrStrA
USER32.dll
wsprintfA
wsprintfW
WINHTTP.dll
WinHttpCrackUrl
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpReadData
WinHttpCloseHandle
WinHttpReceiveResponse
j j j j j j
j j j j j j
j j j j j j
t w i t t e r . c o m
/ p i d o r a s 6
C o n t e n t - T y p e : m u l t i p a r t / f o r m - d a t a ; b o u n d a r y = - - - - - - % 0 1 5 d
/ v t a p i / v 2 / f i l e / s c a n
w w w . v i r u s t o t a l . c o m
O p e r a / 9 . 8 0 ( W i n d o w s N T 6 . 0 ) P r e s t o / 2 . 1 2 . 3 8 8 V e r s i o n / 1 2 . 1 4
C o n t e n t - T y p e : a p p l i c a t i o n / x - w w w - f o r m - u r l e n c o d e d
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.