6.0
高危
61 个模型检测该样本为恶意！
重新分析
更多

2a948702ec5d98fde8d8be6900cbf8c94d928400e205383a95a465a9b1618b40

21095770411666e1e95eb11a0e49d46a.exe

分析耗时

129s

最近分析

文件大小

362.0KB
静态报毒 动态报毒 AGEN AHTF AI SCORE=99 AIDETECTVM ATTRIBUTE AUTOG AZORULT BANKER1 BSCOPE BSYMEM CCAJ CLOUD CONFIDENCE DTCX DWMD FPXARK FUERBOOS GENCIRC GENERICRXHR GENKRYPTIK GSVN HAWKEY HIGH CONFIDENCE HIGHCONFIDENCE KRYPTIK MALWARE1 MALWARE@#2T8QQ6UN4RGLZ PWSX R268906 REMCOS SCORE SONBOKLI SUSGEN SUSPICIOUS PE THEHAI UNSAFE UPATRE WU0@A0IICDNI ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXHR-YJ!210957704116 20200731 6.0.6.653
Alibaba Trojan:Win32/Kryptik.784d4405 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Tencent Malware.Win32.Gencirc.10b9a8ac 20200731 1.0.0.1
Kingsoft 20200731 2013.8.14.323
Avast Win32:PWSX-gen [Trj] 20200731 18.4.3895.0
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 10193 个事件)
Time & API Arguments Status Return Repeated
1620818991.322875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.181875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.181875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.197875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.212875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.212875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.228875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.228875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.228875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.228875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.228875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.228875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.228875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.244875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.275875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.275875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.275875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.275875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.291875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.291875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.291875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.291875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.306875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.306875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.306875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.322875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.337875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.337875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.337875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.369875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
1620818992.369875
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002c0000
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description 21095770411666e1e95eb11a0e49d46a.exe tried to sleep 133 seconds, actually delayed analysis time by 133 seconds
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 185.84.181.80
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1620819021.9005
SetWindowsHookExA
thread_identifier: 0
callback_function: 0x0040512a
module_address: 0x00000000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 852417 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 428 called NtSetContextThread to modify thread in remote process 2224
Time & API Arguments Status Return Repeated
1620819018.712875
NtSetContextThread
thread_handle: 0x000000c4
registers.eip: 2010382788
registers.esp: 1767808
registers.edi: 0
registers.eax: 4274596
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2224
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.DWMD
FireEye Generic.mg.21095770411666e1
McAfee GenericRXHR-YJ!210957704116
Cylance Unsafe
Zillya Trojan.Azorult.Win32.10
Sangfor Malware
K7AntiVirus Trojan ( 0054d89d1 )
Alibaba Trojan:Win32/Kryptik.784d4405
K7GW Trojan ( 0054d89d1 )
Cybereason malicious.041166
TrendMicro Backdoor.Win32.REMCOS.THEHAI
Cyren W32/Hawkey.CCAJ-7827
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
GData Trojan.Agent.DWMD
Kaspersky Trojan.Win32.Crypt.ahtf
BitDefender Trojan.Agent.DWMD
NANO-Antivirus Exploit.Win32.Shellcode.fpxark
AegisLab Trojan.Win32.Generic.4!c
Tencent Malware.Win32.Gencirc.10b9a8ac
Ad-Aware Trojan.Agent.DWMD
Sophos Troj/AutoG-AJ
Comodo Malware@#2t8qq6un4rglz
F-Secure Heuristic.HEUR/AGEN.1129342
DrWeb Trojan.PWS.Banker1.30285
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Emsisoft Trojan.Agent.DWMD (B)
Ikarus Trojan.Inject
F-Prot W32/Hawkey.A
eGambit Unsafe.AI_Score_99%
Avira HEUR/AGEN.1129342
Antiy-AVL Trojan/Win32.Fuerboos
Arcabit Trojan.Agent.DWMD
ZoneAlarm Trojan.Win32.Crypt.ahtf
Microsoft TrojanDownloader:Win32/Upatre
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.Sonbokli.R268906
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34144.wu0@a0iIcDni
ALYac Trojan.Agent.DWMD
MAX malware (ai score=99)
VBA32 BScope.Trojan.Fuerboos
Malwarebytes Trojan.MalPack.GS
Panda Trj/CI.A
Zoner Trojan.Win32.78016
ESET-NOD32 a variant of Win32/Kryptik.GSVN
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 个事件)
dead_host 192.168.56.101:49178
dead_host 185.84.181.80:56477
dead_host 192.168.56.101:49177
dead_host 192.168.56.101:49176
dead_host 192.168.56.101:49183
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-05-06 18:33:14

Imports

Library SHELL32.dll:
• 0x41b0fc SHFormatDrive
Library KERNEL32.dll:
• 0x41b000 GetProcessHeap
• 0x41b004 SetFilePointerEx
• 0x41b010 EnumResourceNamesA
• 0x41b014 SetCommBreak
• 0x41b018 GetSystemInfo
• 0x41b01c FindResourceA
• 0x41b020 LoadLibraryA
• 0x41b024 FreeLibrary
• 0x41b028 CompareStringA
• 0x41b02c InterlockedExchange
• 0x41b030 GetModuleHandleA
• 0x41b034 SetLastError
• 0x41b038 SetStdHandle
• 0x41b03c GetConsoleMode
• 0x41b040 GetConsoleCP
• 0x41b044 FlushFileBuffers
• 0x41b048 GetUserDefaultLCID
• 0x41b04c IsValidLocale
• 0x41b050 HeapSize
• 0x41b054 HeapReAlloc
• 0x41b058 HeapAlloc
• 0x41b05c RtlUnwind
• 0x41b064 IsDebuggerPresent
• 0x41b068 GetOEMCP
• 0x41b06c GetACP
• 0x41b070 HeapFree
• 0x41b074 FatalAppExitA
• 0x41b078 GetCommandLineA
• 0x41b07c GetLastError
• 0x41b080 GetCurrentThread
• 0x41b084 GetCurrentThreadId
• 0x41b088 EncodePointer
• 0x41b08c DecodePointer
• 0x41b090 ExitProcess
• 0x41b094 GetModuleHandleExW
• 0x41b098 AreFileApisANSI
• 0x41b09c CloseHandle
• 0x41b0a0 GetStdHandle
• 0x41b0a4 GetFileType
• 0x41b0ac GetModuleFileNameA
• 0x41b0b0 WriteFile
• 0x41b0b8 GetCurrentProcessId
• 0x41b0d0 Sleep
• 0x41b0d4 GetCurrentProcess
• 0x41b0d8 TerminateProcess
• 0x41b0dc TlsAlloc
• 0x41b0e0 TlsGetValue
• 0x41b0e4 TlsSetValue
• 0x41b0e8 TlsFree
• 0x41b0ec GetTickCount
Library USER32.dll:
• 0x41b104 DestroyWindow
• 0x41b108 BringWindowToTop
• 0x41b10c DrawTextExA
• 0x41b118 MapWindowPoints
• 0x41b11c CreateIcon
Library ole32.dll:
• 0x41b124 CoInstall
• 0x41b128 CreateClassMoniker
• 0x41b138 OleCreateLinkEx
• 0x41b13c CoRevertToSelf

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 51809 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.