SmartHawk

10.8

0-day

55 个模型检测该样本为恶意！

重新分析

下载样本

f5041ea07d530c171a670d71769deb2185c8620462b4e26c59a923784f3bd17a

2013298bbd1a4bf0bd41d04ad192be62.exe

分析耗时

88s

最近分析

文件大小

596.0KB

静态报毒动态报毒 AGEN AI SCORE=83 ALI2000015 ARTEMIS ATTRIBUTE AUTOIT CLASSIC CONFIDENCE DELF DELFINJECT DWRV E7W4QVA4CVQ EMTN EMUK EUFV FAREIT GANDCRAB GENASA HIGH CONFIDENCE HIGHCONFIDENCE HPCXYF KCLOUD KRYPTIK LMGFACULBXPI MALREP MALWARE@#NVEQZHBGU7Z1 R346457 SCORE STATIC AI SUSPICIOUS PE THIAABO TSCOPE UNSAFE ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201228	21.1.5827.0
Kingsoft	Win32.Troj.Undef.(kcloud)	20201228	2017.9.26.565
McAfee	Artemis!2013298BBD1A	20201228	6.0.6.653
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Checks if process is being debugged by a debugger (25 个事件)

Time & API	Arguments	Status	Return	Repeated
1619271863.715646 IsDebuggerPresent		failed	0	0
1619271864.199646 IsDebuggerPresent		failed	0	0
1619271877.574646 IsDebuggerPresent		failed	0	0
1619271877.762646 IsDebuggerPresent		failed	0	0
1619271877.902646 IsDebuggerPresent		failed	0	0
1619271878.574646 IsDebuggerPresent		failed	0	0
1619271878.683646 IsDebuggerPresent		failed	0	0
1619271878.683646 IsDebuggerPresent		failed	0	0
1619271878.965646 IsDebuggerPresent		failed	0	0
1619271880.433646 IsDebuggerPresent		failed	0	0
1619271883.918646 IsDebuggerPresent		failed	0	0
1619271892.824646 IsDebuggerPresent		failed	0	0
1619271892.824646 IsDebuggerPresent		failed	0	0
1619271894.668646 IsDebuggerPresent		failed	0	0
1619271895.058646 IsDebuggerPresent		failed	0	0
1619271897.699646 IsDebuggerPresent		failed	0	0
1619271900.058646 IsDebuggerPresent		failed	0	0
1619271904.996646 IsDebuggerPresent		failed	0	0
1619271910.137646 IsDebuggerPresent		failed	0	0
1619271910.496646 IsDebuggerPresent		failed	0	0
1619271916.558646 IsDebuggerPresent		failed	0	0
1619272285.65025 IsDebuggerPresent		failed	0	0
1619271856.980769 IsDebuggerPresent		failed	0	0
1619271857.012769 IsDebuggerPresent		failed	0	0
1619271857.058769 IsDebuggerPresent		failed	0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 个事件)

file	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.dll
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe\PATH

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619272284.853125 GlobalMemoryStatusEx		success	1	0

The executable uses a known packer (1 个事件)

packer

UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619271919.199646 __exception__	stacktrace: 0x182e04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 registers.r14: 1498014977536 registers.r9: 0 registers.rcx: 1376 registers.rsi: -6148914691236517206 registers.r10: 0 registers.rbx: 254209520 registers.rdi: 17302540 registers.r11: 254213440 registers.r8: 2009563532 registers.rdx: 1420 registers.rbp: 254209376 registers.r15: 254209880 registers.r12: 254210280 registers.rsp: 254209240 registers.rax: 1584640 registers.r13: 1498015924224 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 a3 77 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x182e04	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (9 个事件)

Time & API	Arguments	Status
1619272283.760125 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d0000	success
1619272283.963125 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 77824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00510000	success
1619272283.963125 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00540000	success
1619272285.77525 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 208896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02000000	success
1619272285.77525 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003f0000	success
1619272285.94725 NtProtectVirtualMemory	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619272286.055627 NtAllocateVirtualMemory	process_identifier: 324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00800000	success
1619272286.087627 NtAllocateVirtualMemory	process_identifier: 324 region_size: 77824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00880000	success
1619272286.102627 NtAllocateVirtualMemory	process_identifier: 324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x008a0000	success

An application raised an exception which may be indicative of an exploit crash (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 2080 crashed
1619271919.199646 __exception__	stacktrace: 0x182e04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 registers.r14: 1498014977536 registers.r9: 0 registers.rcx: 1376 registers.rsi: -6148914691236517206 registers.r10: 0 registers.rbx: 254209520 registers.rdi: 17302540 registers.r11: 254213440 registers.r8: 2009563532 registers.rdx: 1420 registers.rbp: 254209376 registers.r15: 254209880 registers.r12: 254210280 registers.rsp: 254209240 registers.rax: 1584640 registers.r13: 1498015924224 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 a3 77 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x182e04	success	0	0

Steals private information from local Internet browsers (24 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF13b1af.TMP
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Last Version
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6083B69D-820.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Policy\User Policy
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index

Creates (office) documents on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\SWIFTMT103.pdf

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\SWIFTMT103.pdf

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (8 个事件)

Time & API	Arguments	Status	Return
1619272283.963125 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x000000f4 process_identifier: 2852	success	1
1619272283.963125 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x000000f4 process_identifier: 364	success	1
1619272283.963125 Process32NextW	process_name: taskhost.exe snapshot_handle: 0x000000f4 process_identifier: 2536	success	1
1619272283.963125 Process32NextW	process_name: 2013298bbd1a4bf0bd41d04ad192be62.exe snapshot_handle: 0x000000f4 process_identifier: 1316	success	1
1619272285.94725 Process32NextW	process_name: chrome.exe snapshot_handle: 0x000000d8 process_identifier: 2080	success	1
1619272285.94725 Process32NextW	process_name: 2013298bbd1a4bf0bd41d04ad192be62.exe snapshot_handle: 0x000000d8 process_identifier: 1704	success	1
1619272285.94725 Process32NextW	process_name: 2013298bbd1a4bf0bd41d04ad192be62.exe snapshot_handle: 0x000000d8 process_identifier: 324	success	1
1619272285.94725 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000d8 process_identifier: 580	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.866344081158897

section

{'size_of_data': '0x00091200', 'virtual_address': '0x00073000', 'entropy': 7.866344081158897, 'name': 'UPX1', 'virtual_size': '0x00092000'}

description

A section with a high entropy has been found

entropy

0.9756302521008403

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

2013298bbd1a4bf0bd41d04ad192be62.exe

The executable is compressed using UPX (2 个事件)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	43.226.229.43

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1316 called NtSetContextThread to modify thread in remote process 1704
1619272285.103125 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 6291591 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1704	success	0	0

One or more non-safelisted processes were created (2 个事件)

parent_process	chrome.exe				martian_process	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1060,15031422247710088254,7379468732611753755,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1068 /prefetch:2
parent_process	chrome.exe				martian_process	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef2494f50,0x7fef2494f60,0x7fef2494f70

Resumed a suspended thread in a remote process potentially indicative of process injection (5 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1316 resumed a thread in remote process 1704
Process injection	Process 2764 resumed a thread in remote process 2080
1619272285.447125 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1704	success	0	0
1619271921.887769 NtResumeThread	thread_handle: 0x0000000000000144 suspend_count: 2 process_identifier: 2080	success	0	0
1619271923.418769 NtResumeThread	thread_handle: 0x0000000000000144 suspend_count: 2 process_identifier: 2080	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

43.226.229.43:2030

Executed a process and injected code into it, probably while unpacking (17 个事件)

Time & API	Arguments	Status	Return
1619272284.931125 CreateProcessInternalW	thread_identifier: 2116 thread_handle: 0x000001a8 process_identifier: 2080 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Program Files\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\ADMINI~1.OSK\AppData\Local\Temp\SWIFTMT103.pdf filepath_r: C:\Program Files\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x000001b0 inherit_handles: 0	success	1
1619272285.041125 CreateProcessInternalW	thread_identifier: 2272 thread_handle: 0x00000110 process_identifier: 1704 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2013298bbd1a4bf0bd41d04ad192be62.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000108 inherit_handles: 0	success	1
1619272285.041125 NtUnmapViewOfSection	process_identifier: 1704 region_size: 4096 process_handle: 0x00000108 base_address: 0x00400000	success	0
1619272285.041125 NtMapViewOfSection	section_handle: 0x00000130 process_identifier: 1704 commit_size: 2306048 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000108 allocation_type: 0 () section_offset: 0 view_size: 2306048 base_address: 0x00400000	success	0
1619272285.103125 NtGetContextThread	thread_handle: 0x00000110	success	0
1619272285.103125 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 6291591 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1704	success	0
1619272285.447125 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1704	success	0
1619272285.588125 CreateProcessInternalW	thread_identifier: 1176 thread_handle: 0x00000100 process_identifier: 324 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2013298bbd1a4bf0bd41d04ad192be62.exe" 2 1704 1289437 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000013c inherit_handles: 0	success	1
1619271855.965646 NtResumeThread	thread_handle: 0x0000000000000078 suspend_count: 1 process_identifier: 2080	success	0
1619271856.137646 CreateProcessInternalW	thread_identifier: 2636 thread_handle: 0x00000000000000c0 process_identifier: 2764 current_directory: filepath: C:\Program Files\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef2494f50,0x7fef2494f60,0x7fef2494f70 filepath_r: C:\Program Files\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000000000000c4 inherit_handles: 1	success	1
1619271919.183646 CreateProcessInternalW	thread_identifier: 3592 thread_handle: 0x0000000000000584 process_identifier: 3588 current_directory: filepath: C:\Program Files\Google\Chrome\Application\chrome.exe track: 1 command_line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1060,15031422247710088254,7379468732611753755,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1068 /prefetch:2 filepath_r: C:\Program Files\Google\Chrome\Application\chrome.exe stack_pivoted: 0 creation_flags: 17302540 (CREATE_BREAKAWAY_FROM_JOB\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|DETACHED_PROCESS\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x000000000000058c inherit_handles: 1	success	1
1619271857.371769 NtResumeThread	thread_handle: 0x0000000000000120 suspend_count: 1 process_identifier: 2764	success	0
1619271919.840769 NtGetContextThread	thread_handle: 0x0000000000000144	success	0
1619271921.887769 NtResumeThread	thread_handle: 0x0000000000000144 suspend_count: 2 process_identifier: 2080	success	0
1619271921.902769 NtGetContextThread	thread_handle: 0x0000000000000144	success	0
1619271923.418769 NtResumeThread	thread_handle: 0x0000000000000144 suspend_count: 2 process_identifier: 2080	success	0
1619271923.418769 NtGetContextThread	thread_handle: 0x0000000000000144	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.EUFV
FireEye	Generic.mg.2013298bbd1a4bf0
ALYac	Trojan.Agent.EUFV
Malwarebytes	Trojan.Downloader.UPX
Sangfor	Malware
K7AntiVirus	Trojan ( 0056b6131 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Trojan ( 0056b6131 )
Cybereason	malicious.bbd1a4
Arcabit	Trojan.Agent.EUFV
BitDefenderTheta	Gen:NN.ZelphiF.34700.LmGfaCulBXpi
Cyren	W32/Trojan.DWRV-2454
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.Agent.EUFV
NANO-Antivirus	Trojan.Win32.Stealer.hpcxyf
Paloalto	generic.ml
Ad-Aware	Trojan.Agent.EUFV
Emsisoft	Trojan.Agent.EUFV (B)
Comodo	Malware@#nveqzhbgu7z1
F-Secure	Heuristic.HEUR/AGEN.1105414
DrWeb	Trojan.PWS.Stealer.19347
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.MALREP.THIAABO
McAfee-GW-Edition	Fareit-FPQ!C23F6837ADCE
Sophos	Mal/Generic-S
Ikarus	Trojan-Dropper.Win32.Autoit
Jiangmin	Trojan.Kryptik.byu
eGambit	Unsafe.AI_Score_76%
Avira	HEUR/AGEN.1105414
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Injector.cc
Microsoft	Ransom:Win32/GandCrab.SK!MTB
AegisLab	Trojan.Win32.Kryptik.4!c
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.Agent.EUFV
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R346457
McAfee	Artemis!2013298BBD1A
VBA32	TScope.Trojan.Delf
Cylance	Unsafe
ESET-NOD32	a variant of Win32/Injector.EMUK
TrendMicro-HouseCall	Trojan.Win32.MALREP.THIAABO
Rising	Trojan.Injector!1.C99D (CLASSIC)
Yandex	Trojan.GenAsa!e7w4qVa4cvQ

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library KERNEL32.DLL:

• 0x5086fc LoadLibraryA

• 0x508700 GetProcAddress

• 0x508704 VirtualProtect

• 0x508708 VirtualAlloc

• 0x50870c VirtualFree

• 0x508710 ExitProcess

Library advapi32.dll:

• 0x508718 RegCloseKey

Library comctl32.dll:

• 0x508720 ImageList_Add

Library comdlg32.dll:

• 0x508728 GetOpenFileNameA

Library gdi32.dll:

• 0x508730 SaveDC

Library oleaut32.dll:

• 0x508738 VariantCopy

Library user32.dll:

• 0x508740 GetDC

Library version.dll:

• 0x508748 VerQueryValueA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.