0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.60
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200403 | 2013.8.14.323 |
| McAfee | Downloader-FUD | 20200403 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b89e83 | 20200403 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意
(50 out of 57 个事件)
| ALYac | Trojan.GenericKD.1324410 |
| APEX | Malicious |
| AVG | Win32:Agent-ASDC [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1324410 |
| AhnLab-V3 | Trojan/Win32.Bublik.R84216 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Generic.D14357A |
| Avira | TR/Agent.ZRGP |
| BitDefender | Trojan.GenericKD.1324410 |
| BitDefenderTheta | AI:Packer.CD9E112520 |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | Trojan.GenericCS.S9838069 |
| ClamAV | Win.Trojan.Zbot-64721 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.MAUA@5rueuc |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.679ba7 |
| Cyren | W32/Trojan.YHRS-2358 |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.GenericKD.1324410 (B) |
| Endgame | malicious (high confidence) |
| F-Secure | Trojan:W32/Agent.DUOC |
| FireEye | Generic.mg.19a8bba679ba7a46 |
| Fortinet | W32/Agent.ABI!tr |
| GData | Trojan.GenericKD.1324410 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Bublik.gdz |
| K7AntiVirus | Trojan-Downloader ( 00457c511 ) |
| K7GW | Trojan-Downloader ( 00457c511 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=88) |
| Malwarebytes | Trojan.Upatre.Generic |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FUD |
| McAfee-GW-Edition | BehavesLike.Win32.Downloader.nm |
| MicroWorld-eScan | Trojan.GenericKD.1324410 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.ckoegm |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM20.1.500F.Malware.Gen |
| Rising | Downloader.Small!8.B41 (TFE:dGZlOgIZhyqGyFCLPw) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Bredo-AJS |
| Symantec | Downloader |
| Tencent | Malware.Win32.Gencirc.10b89e83 |
| TotalDefense | Win32/Tnega.ATBG |
| Trapmine | malicious.high.ml.score |
| TrendMicro | TSPY_UPATRE.VAX |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2012-04-04 22:40:43
PE Imphash
78f4abb8610ca1c22ad9f81ecfabcc3c
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00002a31 | 0x00002c00 | 6.125518039650218 |
| .data | 0x00004000 | 0x00000d02 | 0x00000e00 | 4.052293820757714 |
| .rsrc | 0x00005000 | 0x00002840 | 0x00002a00 | 5.040049616306608 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00007780 | 0x000000ba | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x00005618 | 0x00001c10 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MENU | 0x00007240 | 0x000000d8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00007318 | 0x000000e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00007228 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x00005480 | 0x00000198 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x00005320 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library user32.dll:
• 0x40402c TranslateMessage
• 0x404030 BeginPaint
• 0x404034 DispatchMessageA
• 0x404038 DrawTextA
• 0x40403c CreateWindowExA
• 0x404040 GetMessageA
• 0x404044 PostQuitMessage
• 0x404048 ShowWindow
• 0x40404c UpdateWindow
• 0x404050 RegisterClassExA
• 0x404054 DefWindowProcA
• 0x404058 MessageBoxA
• 0x40405c SendMessageA
• 0x404060 DestroyWindow
• 0x404064 LoadIconA
• 0x404068 LoadCursorA
• 0x40406c SetWindowPos
• 0x404070 GetWindowRect
• 0x404074 EndPaint
• 0x404078 DialogBoxParamA
Library kernel32.dll:
• 0x404008 GetLastError
• 0x40400c lstrcpyA
• 0x404010 GetModuleHandleA
• 0x404014 GetCommandLineA
• 0x404018 GetCurrentDirectoryA
• 0x40401c CloseHandle
• 0x404020 GetCurrentProcess
• 0x404024 CreateFileA
Library gdi32.dll:
• 0x404000 CreateFontIndirectA
L!This program cannot be run in DOS mode.
`.data
<W}=^t
iP)(V4l
thmad Wj.
-P}h 3:
+u]UuM
GFu;uu_+
u!M9MEvh
E;Es%N
E$^clw
.uH(3se
2aa}tmecu
@hCiPx 2cp
dM=sa<
@\3mo*@
p1<WmE<V
A|1Flo
h* )e@
@V-ieh
@cfOak
h^RGe s
-Wb+h@
@Qm /2
hb u\@
hklhe;
@>N%VtVh
@h<XU+H;
d}r>f:h
@hrZ J
1Zdr;u
#1Xesxu
RAFab@
a mL%ao
>"Rl,u
FGIu5FA@
FFFF=F@
@;sy;s
FGIu=F@
dPuRG+
D'nUP
/chp,|
>l'UVW}
FG3@_^]
@j$'io VT8
EM+PEM+X+Pj
GV+=F@
QRRhF@
u~:A@
GGGGBBBBIuj j
R,tCAjp!ei
_OhJiS
Pve2|"j
fNH""R
Are" iont
;B"eC"
dxdsrn"f(oaue!hm"Cp
0orel#
pmpCl#Q
svtL#@Bsiii)
lisclass
better
jufodoas
static
miijob
button
lofegaswer huijd
DialogBoxParamA
SetWindowPos
GetWindowRect
LoadCursorA
LoadIconA
DestroyWindow
SendMessageA
MessageBoxA
DefWindowProcA
RegisterClassExA
CreateWindowExA
TranslateMessage
BeginPaint
DispatchMessageA
DrawTextA
EndPaint
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
user32.dll
GetCurrentProcess
CloseHandle
GetCurrentDirectoryA
GetCommandLineA
GetModuleHandleA
lstrcpyA
GetLastError
CreateFileA
kernel32.dll
CreateFontIndirectA
gdi32.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
xxxyyy
- - - - - - - - - F:- - SH- - - - - - - - - - - - *
. . . . . . . . F:. F:yq. . ,
- . . . . . . . ,
. 0!0!0!0!0!0!0!0!~t0!yq1"0!0!dX0!0!0!0!0!0!0!.
0!1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"0!
2#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#2#
4$I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;4$
"""""""
"""#"""
"""DB""
"""BB""
""$BD""
""$"$""
""$"$""
"""""""
"""""""
"""""""
#33""""
"""""""
DDDDDDD
F"RRR%d
FVfffRd
F&DDD%d
DDFfdDD
DDDDDDD
""""""""""!
""""""
""""!!
""""" @"""""""2""""""$D""""""$$""""""D$B"""""B"B"""""B"B"""""B"B""""""""""
"""""""""""""""""""
22"""#
3""""#332""""""""""""
I D R _ V E R S I O N 1
V S _ V E R S I O N _ I N F O
F i l e I n f o
F F F F 0 4 E 3
F i l e V e r s i o n
2 . 0 . 1 . 7
P r o d u c t V e r s i o n
2 . 0 . 1 . 0
C o m p a n y N a m e
S a n n y L t d .
P r o d u c t N a m e
L o o k F o r
V F i l e I n f o
T r a n s l a t i o n
& A b o u t
A b o u t
M S S a n s S e r i f
C : \ D O C U M E ~ 1 \ a d m i n \ L O C A L S ~ 1 \ T e m p \ T e m p o r a r y D i r e c t o r y 2 f o r T A X _ g r a n t s . z i p \ T A X _ 1 0 0 8 2 0 1 3 . e x e
C : \ 0 a 5 8 0 6 8 d 0 7 8 9 9 8 c a 0 6 0 a f 7 4 5 a 2 8 6 d 3 0 9 e f 8 f c c 1 8 3 2 9 3 4 b 3 4 f 9 8 c 9 b 8 f 8 d 8 5 8 1 4 b
C : \ d f b 6 5 4 3 4 0 d 0 d 2 7 5 1 0 e 0 8 b 0 1 8 f 3 e 4 e 3 e 7 8 a 5 0 6 7 f 0 1 d 3 2 9 1 9 5 8 a 5 4 1 f 1 a 9 9 1 6 f 6 8 5
C : \ q a p 3 9 b K z . e x e
C : \ g c 6 M u s T Z . e x e
C : \ 4 d f f 8 9 5 3 a 1 b 6 e b 9 8 2 a 1 3 8 8 a 0 0 b a 6 d 6 8 6 0 2 a 7 4 b 6 2 e 2 e b e 8 3 4 9 e a 7 8 e 7 7 5 4 0 6 9 8 3 d
C : \ 8 b 8 b 2 4 e b 5 8 c a a 8 c d a 2 a 7 a d d b f 5 6 e 0 b 9 2 5 1 a c 6 1 0 c e f 4 d 5 0 e 9 7 0 b c d 5 4 d f d 3 b 1 8 2 6
C : \ R H 0 V m z 3 R . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ D v V a s 5 p R P f . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a a 1 5 8 d 5 0 5 6 d e b 0 c e 8 1 c 2 e a 7 8 d b 2 d 6 9 2 d . e x e
C : \ 8 8 5 4 6 5 5 5 2 9 1 8 5 8 4 4 2 8 3 7 3 7 9 0 2 c 8 2 3 0 3 5 b 4 8 f 5 6 7 e e 6 f 0 4 0 a 2 c 7 7 a 6 b 3 6 3 7 5 0 5 5 1 9
C : \ c 8 4 0 5 5 2 d a e d 8 2 4 e d 7 0 4 0 f 6 8 4 2 b 5 8 a 4 9 4 8 3 b e 4 7 5 a 6 c d 4 c 1 4 c a 4 d c 9 9 d b e 4 6 5 f 5 3 1
C : \ 7 2 4 8 7 6 0 4 c c 8 b 9 8 9 5 8 f 3 c 3 c c d 0 4 3 3 3 1 9 a b 5 c 0 8 2 0 4 8 6 8 1 7 b 8 3 c 7 1 4 3 0 d e 9 0 b 6 7 0 d 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ 9 3 7 6 3 e 5 f 5 c 9 8 b 1 e 8 b d 6 6 1 2 9 3 9 a 8 b 1 0 7 d e e 0 d 9 6 d a 8 c d e 7 7 e c c 9 e c 5 0 2 0 f a 4 2 2 0 6 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 5 b c 6 6 a 7 a 5 1 b 7 e c 8 _ r e w o k . e x e
C : \ f 4 b c f 1 4 6 c 2 f a f 5 9 8 2 6 2 d 8 7 1 d e 0 a f 2 f e f 1 2 d d 9 7 f 2 3 d 5 d 2 a a b 0 3 3 7 1 b a 1 b 0 0 e d 3 d d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ 8 d b 0 5 1 e 6 d f c a 0 7 a 7 0 5 2 3 4 f 9 b 5 5 2 3 7 0 6 e d 6 3 e 6 7 e b f 8 4 e e 8 c 7 b 3 9 a 7 8 4 c 8 3 5 6 a b 3 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ 4 b 2 b 3 6 b 2 3 4 1 b 4 2 7 5 5 c d 5 e b b 4 c a 2 f 9 8 5 b 7 e 8 1 c 4 b 8 8 7 f c 1 c 8 2 7 2 c c 2 f 6 1 e 9 4 a d d 3 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ 6 7 6 6 9 8 c 6 1 8 2 e b 4 5 2 4 9 0 7 8 2 a 8 e 3 2 9 0 7 5 1 7 6 3 2 a 8 7 b 1 4 3 c 1 d 5 6 f 7 3 2 7 8 3 d 3 a c d 8 2 1 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ b b 6 4 f 0 2 0 5 6 e d d 2 7 f 4 2 b 6 5 4 7 5 e a 7 2 6 7 f e d 9 d a 1 5 d b f f 3 5 f 4 6 d d b 0 9 d 9 4 d 4 0 e 1 d 4 d a
C : \ 0 a 3 0 8 2 a 8 7 3 c 7 9 7 a a f d 8 e 4 1 7 1 f e 2 d a 6 8 1 c b 1 2 e f d 8 1 e 3 6 0 6 5 f f b 3 7 6 1 6 b 6 9 0 f e 1 d a
C : \ c d a 3 b 2 6 a 0 4 8 7 0 7 1 d 7 1 8 c 1 9 1 6 e d e 1 c 7 6 8 d 2 8 b e 4 f a b 1 b 3 2 e a a b 3 a a c 5 f 7 7 9 4 c e e d d
C : \ 7 8 7 f c 1 1 1 3 f f 4 f 3 3 4 e d f d d 1 a 8 0 3 a 0 d 4 1 3 9 3 b f 5 4 9 f a f 4 2 9 5 3 8 a 8 b 4 d 9 8 8 9 a e 5 4 4 2 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ b 4 8 6 4 f c a 9 2 0 e d 3 7 b b 4 7 3 9 1 2 4 7 8 2 2 7 4 f 1 7 4 5 9 6 3 1 1 1 e a 8 0 f 9 4 1 1 8 e d 4 d a e f d 5 d f 9 5
C : \ 1 a f 2 8 2 1 4 e e 0 7 a c c 1 0 c 0 4 8 5 a e 2 c c 3 b b 6 f 6 6 b 7 a e 6 d 8 f c 4 3 3 8 b 2 9 e 0 1 0 b f e d 7 d b b b f
C : \ 1 1 c a 4 e c 6 0 f a b 3 8 b d 6 7 b 7 e a d 4 7 b 0 8 a 7 4 4 f 6 b b d 3 2 8 5 9 c 0 f 0 c f c e d 2 5 d e b 5 a 6 9 3 4 8 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ 4 9 1 f e 4 c 6 f 3 a 0 4 9 3 5 6 f e 0 a 0 6 f a 6 b 4 a 0 2 3 c d 9 6 a 0 3 1 4 4 2 0 1 a 6 2 3 9 b 9 3 c 8 2 8 c d 8 7 6 b 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ e 3 a f 2 f 0 a 8 5 4 2 8 0 a e 9 a 7 0 6 9 f d e 5 b 3 d a b c 5 f 0 7 e 0 4 3 6 b 9 1 6 d 2 4 4 2 3 8 7 0 c 8 6 8 8 1 0 1 9 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ a 7 2 e 8 0 d 5 7 8 6 b 1 e 0 e 2 3 9 1 1 9 6 7 0 3 f e 3 f a e 0 2 9 d 8 7 d 5 c 5 0 3 9 c f 7 d 6 3 d 4 d d 2 1 4 e 5 7 e d 1
C : \ M 3 z K _ N 1 T . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 9 2 3 0 c a 1 1 d 1 2 7 8 d f f 2 3 5 f 4 a 4 f 5 b e c f 4 9 . e x e
C : \ 3 a 9 9 d 7 c d f d 6 c a 2 0 4 f a e 9 5 4 d 2 b c 0 3 4 2 7 0 5 d 1 1 6 1 7 5 3 7 0 d b d 3 9 1 6 0 6 7 3 1 c 7 b b e c 4 4 b
C : \ 3 c 2 f 5 6 b f 1 a d 3 e 9 d c 6 a c a d e 4 0 4 4 7 4 a 8 f 0 6 e 6 7 2 7 a 9 3 b 9 9 5 5 9 a 2 7 e 2 9 6 5 b 5 f 3 8 6 a 8 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ c d 0 d f 3 e f a 8 d f 2 2 2 8 6 f f a b 9 e a 2 9 5 c 1 8 8 2 9 3 e 9 3 d e 5 d 8 7 1 0 d 5 3 1 6 c 7 2 c 6 e 8 1 4 6 e 6 6 e
C : \ l 9 P N f c t g . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a c 5 e 1 4 9 6 c 1 7 6 a 6 f 2 2 a 5 f 2 c 2 0 5 3 1 2 4 0 d 5 . e x e
C : \ 7 4 4 f 6 e 8 d 3 d 0 4 9 e 4 6 8 0 2 7 3 b b 7 4 8 4 a e 4 e a f 0 8 a f 5 7 9 c 5 a b 3 e 4 9 4 e b 2 1 1 6 d 9 a 3 c a 6 b e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ e 7 5 5 a 8 5 f e b a 8 3 d e 8 6 a 7 9 b 4 1 2 4 a 9 2 9 d b 3 6 a a d 3 6 5 b 6 e b 3 7 2 e 4 4 c 0 1 1 1 f a 7 0 1 c b 4 e 7
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ b f f 7 d 7 0 f 9 6 7 1 c 7 a 4 5 a 0 4 2 2 6 7 6 f 8 8 d 2 5 d 9 c d a 0 b 1 7 2 e e 8 3 3 8 2 0 b e 6 8 e 0 6 e c c 7 9 9 b 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ j 1 R D p p B j . e x e
C : \ a 3 b 2 6 0 a a e 1 2 3 7 2 5 e 3 c b e 6 0 d 8 b e a 9 3 d 3 b e d b 8 7 1 8 e 7 a b 9 1 7 b b 8 c e 0 6 2 1 4 e a f b 2 c e 4
C : \ d d 3 c 3 0 1 3 2 8 1 d 9 c f 7 5 8 3 f 0 7 4 4 4 d a 9 e 0 5 2 1 0 f 4 1 0 3 d 4 c 6 8 a e 9 f 6 5 9 5 2 c 6 9 1 5 7 2 2 c e d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ 7 a 4 4 a c b 7 b 8 8 7 7 a 5 3 d e 4 0 0 7 7 5 d 3 c c 9 4 c 4 9 c c 1 a 1 0 5 7 9 e 2 8 b 4 c 2 7 e 7 c 1 0 c 4 1 3 a d c 0 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b f a 1 1 c a 3 2 5 3 7 9 3 e 0 _ r e w o k . e x e
C : \ 9 b 3 7 9 e 9 e 2 a 4 d b 9 5 a 4 c 2 3 1 2 3 1 1 f 7 f f c c b 7 2 3 1 3 1 2 6 5 1 1 b c b e 1 7 7 a 8 c 5 6 d 5 5 8 3 1 c c f
C : \ 6 c 4 1 f 7 a 5 c 8 7 c a 0 6 3 4 2 e 8 d 1 8 7 1 4 e d 6 9 8 b 1 a b 3 5 0 3 3 4 1 b 6 d b f 5 e 0 d d 3 0 b c a 2 9 0 6 e c 6
C : \ 6 2 3 a 7 9 b 2 0 5 f 6 8 3 4 5 5 c d e f c 0 b a 2 c 7 b 4 0 2 4 f 7 0 0 2 3 3 1 4 2 6 3 8 b 9 1 2 e b 2 4 d a f 3 e f d f 8 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ f 9 1 7 d 8 e e 3 b 8 e d f 5 6 2 8 6 4 9 c 1 f 3 3 3 a 3 3 6 f 1 e c c 3 a f 8 4 2 c a 7 8 c d c 9 3 3 3 0 f b c 9 1 2 3 3 3 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 8 6 6 0 6 0 0 d 3 3 3 8 1 c 9 _ r e w o k . e x e
C : \ 6 4 0 2 c 3 0 5 d 6 9 0 5 3 b 8 5 9 f c 0 8 b a 0 5 8 7 f 9 6 a c 3 5 4 8 b 2 e 1 a 2 9 1 9 c c 2 1 a d 2 0 6 3 b 3 5 a c 9 0 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ a 3 b 8 2 3 7 4 2 0 a 8 d f 7 3 f 5 6 1 3 e 3 c 4 3 d b f 5 8 f 6 b a 2 7 c 5 0 7 f f 4 1 f e f 5 2 f 7 1 6 1 4 7 0 c f b 4 5 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ e 4 b 1 a 1 5 b 3 8 f d 9 3 d e 3 1 e 8 c c c d b 2 f 7 3 8 8 f 3 0 a 7 8 2 f 6 b f 7 3 9 c d 9 7 f b c e 7 a 5 2 2 9 3 9 3 8 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ f f 8 f 9 a 3 c 8 3 1 8 6 4 0 9 a 9 d 7 7 d 9 c 2 8 2 c 7 0 9 c 6 f 9 d 2 1 a 1 1 f 4 6 5 7 a 5 1 a 7 a 3 4 8 7 e 4 7 8 3 c a 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ f c 7 9 1 e e 2 c e 4 c 1 6 3 7 c a a 1 7 9 e 0 a 4 a 0 7 8 d c 4 2 f 6 b e 0 2 0 3 4 6 6 c b 9 1 d f 3 d c 3 7 f c a 0 6 1 a 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ 0 1 8 0 7 c 7 0 a f 0 e a 5 3 1 9 3 a 2 1 7 7 5 7 4 1 9 1 5 4 7 7 9 a 3 5 4 a b 1 a d 4 1 7 c b 4 2 a 1 1 1 f e c 9 0 3 7 3 d 0
C : \ a 0 c 7 7 a 2 0 9 9 a e d 1 6 b 1 3 1 a c 2 0 1 a 8 8 6 9 8 a 5 b e e 5 b 8 6 1 c a 7 d 6 5 e e 3 f e 4 b b 5 2 1 f d f 5 c f d
C : \ 9 p A H Q H X Y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c f b 0 f c 7 3 0 1 7 1 4 9 7 e 6 7 9 e 6 f 8 0 b c b 5 f d 8 1 . v i r u s . e x e
C : \ J 8 2 a F P l h . e x e
C : \ 0 5 f d 0 4 b a 6 e b b d 8 8 8 6 d e 8 d a 4 7 d 5 1 1 0 9 6 3 0 b 3 a b 0 5 b 1 4 6 e 5 4 d 9 7 3 c d f 6 2 3 d 4 5 3 d e e 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ 6 a 8 3 d 1 2 1 7 d 5 a 4 c 4 b f f 9 4 2 3 a 1 8 1 8 0 6 f f c c 6 7 4 b 8 a e 5 2 e 3 b b 6 3 3 c 2 8 7 e f 1 4 a 7 f 1 b c 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ 0 9 e 1 2 6 b a a 6 9 2 3 9 f 8 0 0 9 5 5 5 8 d 5 8 2 0 3 1 d 2 4 b 3 3 8 3 2 6 e 1 2 5 c 0 a a 0 2 8 3 e 1 4 d 0 6 3 f c a 2 1
C : \ 0 5 b f 7 3 3 d 3 6 c 1 2 9 b 7 9 f e 4 f a 9 c a e 2 c 4 4 6 e b 7 e a 5 c 9 4 1 2 9 d a 6 b d d d f 3 5 0 a c c 8 6 5 9 b 9 e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 c 5 f 2 9 9 a 9 b 1 e d a e a _ r e w o k . e x e
C : \ e f c f 2 e a f 7 b c f 9 8 7 5 1 e 4 6 c 8 f c a 6 c d 8 a e 0 5 2 7 7 6 2 1 c e 1 b 3 7 6 9 5 2 2 5 a 3 1 a 9 9 f e e d a 4 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ Q Q Z f 4 w 6 u . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 1 2 e 6 f 8 3 e f 5 8 a 8 6 2 f 9 6 9 5 e 9 9 5 a e 5 f a 7 7 . e x e
C : \ 9 3 c 6 3 0 d c 6 2 9 c 9 4 c 6 9 7 e 2 5 1 8 4 c 3 3 7 c e 2 8 b 9 9 5 6 b 3 3 6 e 0 b 0 6 5 4 8 8 b 2 0 d 8 4 4 c 3 3 4 b 1 b
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 1 e 7 2 d d 5 f 7 4 d 5 c f 5 7 5 4 b 7 c 1 2 8 f d 5 7 4 d 8 4 7 b 0 6 9 2 f 1 6 f f b 2 3 3 2 f 7 3 9 c 1 6 9 3 5 c 4 d 6 c 6 . e x e
C : \ d 1 b b e 4 4 7 3 0 d 9 f 0 d d 6 d 0 9 f d 0 6 e 6 8 6 5 6 a d 1 7 9 7 c 4 c 3 5 6 e e 6 b 3 d 2 1 4 0 b 4 a 7 c 3 3 5 4 d e 5
C : \ 9 6 f 3 1 4 c 8 1 7 5 7 8 6 b 4 5 0 f 2 e 0 c 0 5 c e 5 8 d c 4 0 9 d 5 2 f 1 1 6 a b b 0 c c b d a 4 f 6 f 1 f 8 4 b 9 2 b 5 a
C : \ S e B t O y 8 n . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 4 a 4 8 7 6 e 2 1 b 3 8 e 9 e f 1 c 5 1 5 0 0 7 5 e 1 2 c 8 c . v i r u s . e x e
C : \ 9 7 1 1 d 1 1 0 a 7 0 c 9 8 b 0 c 7 f 4 0 d 0 3 e 9 f e 4 4 1 c d 6 3 d 1 e 1 0 0 3 a c 4 3 b b 7 3 4 0 7 d b 7 2 7 a 8 2 8 1 8
C : \ c 0 c 2 0 e d e 9 3 2 c 5 f 6 2 a 1 f 4 c c 4 4 0 e e a f 8 7 5 9 e d d a 2 f b 8 3 8 d 9 1 5 4 7 7 c 3 3 1 2 e 9 3 a 5 9 4 e 6
C : \ 1 9 0 8 d d 9 0 c 4 0 e 7 a 8 2 0 4 2 8 4 1 c 9 a 6 e 8 e 5 3 c b e 2 c 5 7 5 b 1 7 a 1 8 3 d f 3 1 7 8 f 0 1 0 5 9 5 a d 7 8 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ r e w o k . p e 3 2
C : \ 7 4 6 b 1 f b b d 9 f 8 3 5 9 9 b d 0 e 2 1 8 5 2 d 0 4 0 2 f 1 8 f f 1 d d 1 4 2 8 a 5 e 5 1 d 3 4 b b a 2 7 4 2 c 8 5 a 3 5 8
C : \ 9 f d 5 1 9 c 6 d 1 e e 1 9 b 9 c a 5 0 5 e d 0 8 2 d 2 0 a b 5 a d c 0 c e 2 d f 4 a 0 e d 3 a 4 3 d 1 d 7 8 4 9 8 f 5 7 c 2 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ r e w o k . e x e
C : \ X H j w v Y u A . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 9 1 8 0 0 d 1 3 2 6 4 0 3 0 1 0 1 7 3 e 8 8 3 6 6 b 7 2 b 1 1 . e x e
c : \ t a s k \ 6 8 5 F D 4 A 3 C E 1 E F B 6 B E 9 F D F A D 8 E 5 D 9 0 9 9 5 . e x e
c : \ t a s k \ 5 1 9 E 8 7 9 7 2 3 9 4 4 4 1 3 5 5 F 4 6 B F 9 4 7 B 6 D E D 1 . e x e
C : \ G c y D Y k d u . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 5 c 0 c f d 6 7 5 5 1 0 d 1 2 c 6 a 6 3 1 e d 2 6 a f 2 6 9 5 . e x e
C : \ a 2 9 8 0 9 f 9 9 1 4 b 4 1 f 9 f 6 8 8 b 3 4 4 3 3 8 5 a d 6 d 0 f 7 3 c 6 a b e 5 c f 7 9 b 1 9 9 9 2 5 8 1 8 d 4 2 8 3 e e 4
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.