2.1
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.72
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Kryptik-PAB [Trj] | 20200501 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.b | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200501 | 2013.8.14.323 |
| McAfee | Upatre-FAAC!1D918481BAFC | 20200501 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b9ccee | 20200501 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727110791.781125 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727110791.953625 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .code |
| section | RSRC |
| section | .r |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(20 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\vdigj.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\vdigj.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\vdigj.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.GenericKD.1949202 |
| APEX | Malicious |
| AVG | Win32:Kryptik-PAB [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1949202 |
| AhnLab-V3 | Trojan/Win32.Downloader.R122980 |
| Antiy-AVL | Trojan[Downloader]/Win32.Upatre |
| Arcabit | Trojan.Generic.D1DBE12 |
| Avast | Win32:Kryptik-PAB [Trj] |
| Avira | TR/Crypt.Epack.miod.1 |
| Baidu | Win32.Trojan-Downloader.Waski.b |
| BitDefender | Trojan.GenericKD.1949202 |
| BitDefenderTheta | Gen:NN.ZexaF.34108.cqX@ayYbvge |
| CAT-QuickHeal | TrojanDownloader.Upatre.AA3 |
| ClamAV | Win.Malware.Upatre-6769243-0 |
| Comodo | TrojWare.Win32.Crypt.C@7vajd0 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.1bafca |
| Cylance | Unsafe |
| Cyren | W32/Trojan.RLAO-7427 |
| DrWeb | Trojan.Upatre.112 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.GenericKD.1949202 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.LTK |
| F-Secure | Trojan-Downloader:W32/Upatre.J |
| FireEye | Generic.mg.1d918481bafca4e9 |
| Fortinet | W32/Upatre.HL!tr |
| GData | Trojan.GenericKD.1949202 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Upatre.by |
| K7AntiVirus | Trojan ( 004aff101 ) |
| K7GW | Trojan ( 004aff101 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=81) |
| Malwarebytes | Trojan.Upatre |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfee | Upatre-FAAC!1D918481BAFC |
| MicroWorld-eScan | Trojan.GenericKD.1949202 |
| Microsoft | TrojanDownloader:Win32/Upatre.AK |
| NANO-Antivirus | Trojan.Win32.RiskGen.dhwqgh |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.ED7C.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Upatre |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-AJNW |
| Symantec | Downloader.Upatre!gen9 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-04-23 15:37:18
PE Imphash
8deaef3e3b3c421e8712f0f1e57b5aa3
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .code | 0x00001000 | 0x00006200 | 0x00001600 | 0.9089200842723898 |
| .DATA | 0x00008000 | 0x00014200 | 0x00001a00 | 4.54003140048277 |
| RSRC | 0x0001d000 | 0x00008000 | 0x00007a00 | 4.038964778615179 |
| .r | 0x00025000 | 0x000001f0 | 0x00000000 | 0.0 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_STRING | 0x0001d190 | 0x00002e44 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x000241fc | 0x00000468 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x000241fc | 0x00000468 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00024664 | 0x00000022 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MENU | 0x00024703 | 0x00000145 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MENU | 0x00024703 | 0x00000145 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library msi.dll:
• 0x408000 MsiCloseHandle
Library netapi32.dll:
• 0x408008 NetUseAdd
• 0x40800c NetUseDel
• 0x408010 NetUseEnum
• 0x408014 NetUseGetInfo
• 0x408018 NetUserAdd
• 0x40801c NetUserChangePassword
• 0x408020 NetUserDel
• 0x408024 NetUserEnum
• 0x408028 NetUserGetGroups
• 0x40802c NetUserGetInfo
• 0x408030 NetUserGetLocalGroups
• 0x408034 NetUserModalsGet
• 0x408038 NetUserModalsSet
• 0x40803c NetUserSetGroups
• 0x408040 NetUserSetInfo
• 0x408044 NetShareAdd
• 0x408048 NetShareCheck
• 0x40804c NetShareDel
• 0x408050 NetShareDelSticky
• 0x408054 NetShareEnum
• 0x408058 NetShareEnumSticky
• 0x40805c NetShareGetInfo
• 0x408060 NetShareSetInfo
• 0x408064 NetStatisticsGet
• 0x408068 NetGetJoinableOUs
• 0x40806c NetGroupAdd
• 0x408070 NetGroupAddUser
• 0x408074 NetGroupDel
• 0x408078 NetGroupDelUser
• 0x40807c NetGroupEnum
• 0x408080 NetGroupGetInfo
Library kernel32.dll:
• 0x408088 MapViewOfFileEx
• 0x40808c Beep
• 0x408090 GetSystemDirectoryA
• 0x408094 LocalAlloc
• 0x408098 SetConsoleTitleW
• 0x40809c EnumCalendarInfoA
• 0x4080a0 CallNamedPipeA
• 0x4080a4 ReadFile
• 0x4080a8 CreateFileA
Library ole32.dll:
• 0x4080b0 CoGetMalloc
• 0x4080b4 CoGetDefaultContext
• 0x4080b8 CoLoadLibrary
• 0x4080bc CoRegisterChannelHook
L!This program cannot be run in DOS mode.
CCCCGB
BRichC
jXRhduse\
IuX[YZa`
MsiCloseHandle
msi.dll
NetUseAdd
NetUseDel
NetUseEnum
NetUseGetInfo
NetUserAdd
NetUserChangePassword
NetUserDel
NetUserEnum
NetUserGetGroups
NetUserGetInfo
NetUserGetLocalGroups
NetUserModalsGet
NetUserModalsSet
NetUserSetGroups
NetUserSetInfo
NetShareAdd
NetShareCheck
NetShareDel
NetShareDelSticky
NetShareEnum
NetShareEnumSticky
NetShareGetInfo
NetShareSetInfo
NetStatisticsGet
NetGetJoinableOUs
NetGroupAdd
NetGroupAddUser
NetGroupDel
NetGroupDelUser
NetGroupEnum
NetGroupGetInfo
netapi32.dll
MapViewOfFileEx
GetSystemDirectoryA
LocalAlloc
SetConsoleTitleW
EnumCalendarInfoA
CallNamedPipeA
ReadFile
CreateFileA
kernel32.dll
CoGetMalloc
CoGetDefaultContext
CoLoadLibrary
CoRegisterChannelHook
ole32.dll
&$:+4mXg
A:miyr
M-|R4o"0D}KZ
C ~V8Mn`0TO(
nO0uNYVqGb
%h?&tf
~K-b{Xc
Y/)nIU Ih
]u6=64W
^ mkm*n
tvn~fFN
9}mbK{s9}K29K29TK2W
K{k\.KW@
&>.6nfFmCm*VtB%
&.n~fFN
mbmm*m
&>.tn~fNFmCm
&>.tv~fV
&>6Tn~fm
u..,,4&>.n
me-_[.n~fF
TmClVTf
&>.vn~f
C&>.6jcG
FUbXACk3+vv~fv
!"#$%&'()*+,-./0123456789:;<=>?@AM
I"OW{H
0/[d"KPl
:(@jc +
[ OYO):
'bEW/_
x*-vh0hniyh?
qxCVvEJ
AL@q*#%
he(jVR+~
!|>]2l(C5J
=^ 92EctpOiY;r$!#b]NY{>W
@%iG0SLp
z*dIr_k_o)
U4So17
,gPKYr
[AcTCS"!\g
ZPyR(a2<
Cm7AORT
aHHM8gg)ku+
iV:HNk!
B( 6:&vm2
oRdF"q|1
~691bb)Q9
P@y,!zn0
{MCJ=o
O=W#xU]
U315)}skbo
(v~lDvf
wq+'=Q
57a4f;
fF8$>3
B)k6ih
p08!zIXMCG|'AJDu
LCp0c9!E<k"(6
\^_@e"
+ncdJET+e9y
ORq(%J8
u/`&8UKzK|7 Oej
Z7^|_d.
eL]&Q|8|~0o
[->E}
K#KzRGTu q&>
1&1KKjC
Z4NSET`;
4)TcWk
S%Qw)cU
5U! 6C:
,{mbX 4
t2{.r]
VLIZr2
4xr<;
X2NaDB
}Svf" Jz
vg14<P;^
pZm'@1
xsca` b~
vV#|bo6
p/buf<
LC=7"rC?h
?,YM2*
\X_N_7kmu
.y|R%F.
9Pp1m=[npI
]VcF6eR(
/T(h
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
Ugv4H)?>QU
UM`0JNa;Q
U9SQe=T
39WSpFbB]@Z@ZF^U
Geiz~h{H` ?1M>XF_/KU
qcucucwi}wU
U~ I?bCg
U9`'Qi
Ue-UFh>^$MWvU
,fzdzU
Uy<f8boU
UX*]fU
U\.`gU
U^3dqU
Ue9hlU
Ur?kY}3cU
1[p[p[p[p+F
9rSh`v
;cw-HMbcw
;]q]q8S%C
7 = = = = = = = = = ==R =ex = ?ex = =x=V = = = = = = = =
>&E&E&E&E&E&E&E&E&E&E&EWk&Ei~<Uivi~&E&Ei~&E&E&E&E&E&E&E&E&E&E&E&E"A
"B)G)G)G)G)G)G)G)G)G)GGa)G
)G)Gg|#C#C)G)G)G)G)G)G)G)G)G)G&E ?U
'F,I,I,I,I,I,I,I,I,I,I,I_t,I,If|f|F`5Q,I,I,I,I,I,I,I,I*G%D
,I0K0K0K0K0K0K0K0K0K0Kv0KoE]0K0K}Ia0K0K0K0K0K0K0K0K.J+I
2L7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P7P4N0KU
7R9R7P7P7P7P9R9R9R9R9R9R9R9R9R9R9R9R9R9R9R9R9R9R9R9R9R9R8Q7P7P7P7P7P7P7P7P9R9R9R8R6QU
9T:TDYDYDYDYG\G\G\G\G\G\G\G\G\G\G\G\G\G\G\G\G\G\G\G\G\G\F[DYDYDYDYDYDYDYEZG\G\>V:U;V
9U9U`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`l`lF\;V@Z
VWWWWWWWWWV
70J&BQg5O*F
@#C~{of{)H @8S)+I
0M3Osz>Y0ME^4
CZG\_rk}oewn
`r[oi|4
Zi!bq!c4
A A A A A A A A A A
C : \ U s e r s \ s o p h i e \ A p p D a t a \ L o c a l \ T e m p \ T e m p 1 _ A c c o u n t _ d o c u m e n t s _ p d f . z i p \ A c c o u n t _ d o c u m e n t s _ p d f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ o X K A X G 5 S y . e x e
C : \ 2 c 4 f 9 8 4 6 f 7 8 9 3 e c f 0 8 b 1 a c 4 2 7 4 3 4 8 d 4 1 a 1 2 c 5 c 5 d 2 8 a e e b 0 e 2 7 9 a 4 5 c e e 4 6 e f 8 0 9
C : \ 2 6 0 1 7 3 3 e 5 4 4 c e 3 d 6 3 1 2 c 0 6 b f 8 b 2 b 4 b d 9 9 1 e d b 1 0 4 e 2 e 3 3 b a 7 d b 3 0 e 3 0 2 b 2 9 f f a 9 e
C : \ u H V Y Z t n c . e x e
C : \ l r q 5 p W M h . e x e
C : \ v r h 4 x Z z F . e x e
C : \ p r n B m u m K . e x e
C : \ 7 1 G 0 1 5 0 8 . e x e
C : \ n A j G l c 1 f . e x e
C : \ 6 x w N h d c L . e x e
C : \ N t G f J F P X . e x e
C : \ s Z w W 2 y b c . e x e
C : \ w 4 3 j H o T L . e x e
C : \ G 9 B 5 S b p B . e x e
C : \ 6 r Q e 6 s E V . e x e
C : \ N l n d j d N O . e x e
C : \ M X U f q o m P . e x e
C : \ U M a 9 0 u G o . e x e
C : \ z E 1 L u Q i 2 . e x e
C : \ b D 1 x A _ m R . e x e
C : \ S 2 Q 1 s 4 f L . e x e
C : \ R p k H F W d u . e x e
C : \ F X _ 7 n g T j . e x e
C : \ 4 7 V 8 _ I x Z . e x e
C : \ 2 1 E t f L L s . e x e
C : \ 8 6 r w d T J F . e x e
C : \ u S 9 u i q 4 Q . e x e
C : \ s 1 P E L C b u . e x e
C : \ 6 L q P 0 0 g x . e x e
C : \ 3 D l w x B M Z . e x e
C : \ 2 1 G w D P L _ . e x e
C : \ Y c y z s E I e . e x e
C : \ g J p n a M L v . e x e
C : \ a d f 0 b 6 7 4 0 5 5 a c e 7 2 6 0 2 f 1 5 f d f b 3 5 a 3 2 4 d f b 7 e 3 4 d c 1 b 9 c 9 5 4 5 3 d c 7 6 6 a d 0 8 c c 4 0 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ v d i g j . p e 3 2
Process Tree
-
99790b80e55bf499e6a363522cd8ff56120b94fad8449a08af34007d21c039a0.exe (1612)
"C:\Users\Administrator\AppData\Local\Temp\99790b80e55bf499e6a363522cd8ff56120b94fad8449a08af34007d21c039a0.exe"
- vdigj.exe (2108) "C:\Users\ADMINI~1\AppData\Local\Temp\vdigj.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 7cb872feb63edc00_vdigj.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\vdigj.exe |
| Size | 46.0KB |
| Processes | 1612 (99790b80e55bf499e6a363522cd8ff56120b94fad8449a08af34007d21c039a0.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 2e8d69f89f2ddcb34c8232ccaccc42f5 |
| SHA1 | 0abb024e84ff509a2fdcba7c31ad7a537a23a7d6 |
| SHA256 | 7cb872feb63edc00900bbfe79ef67d4c8750d2a64b42370c4cd62463aa507b42 |
| CRC32 | E18DC40C |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.