0.9
低危

267c67fde8f45f50b6ebf6d5d06822d9e96e5100d1609ec6ac31c23edc56bc83

267c67fde8f45f50b6ebf6d5d06822d9e96e5100d1609ec6ac31c23edc56bc83.exe

分析耗时

195s

最近分析

357天前

文件大小

52.9KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER BUBLIK
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.78
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Agent-AUID [Trj] 20200501 18.4.3895.0
Baidu Win32.Trojan-Downloader.Waski.a 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200502 2013.8.14.323
McAfee GenericRXAA-AA!21195EFE1CD3 20200502 6.0.6.653
Tencent Malware.Win32.Gencirc.10b8bc37 20200502 1.0.0.1
静态指标
行为判定
动态指标
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意 (50 out of 59 个事件)
ALYac Trojan.GenericKD.1629455
APEX Malicious
AVG Win32:Agent-AUID [Trj]
Acronis suspicious
Ad-Aware Trojan.GenericKD.1629455
AhnLab-V3 Spyware/Win32.Zbot.R101794
Antiy-AVL Trojan/Win32.Bublik
Arcabit Trojan.Generic.D18DD0F
Avast Win32:Agent-AUID [Trj]
Avira TR/Yarwi.AD.113
Baidu Win32.Trojan-Downloader.Waski.a
BitDefender Trojan.GenericKD.1629455
BitDefenderTheta Gen:NN.ZexaF.34108.dmZ@amAd47ji
Bkav W32.BoletoCPAD.Trojan
ClamAV Win.Downloader.Upatre-5744087-0
Comodo TrojWare.Win32.Bublik.CEZE@595kvx
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.e1cd30
Cylance Unsafe
Cyren W32/Trojan.AMHK-2378
DrWeb Trojan.DownLoad3.28161
ESET-NOD32 Win32/TrojanDownloader.Waski.A
Emsisoft Trojan.GenericKD.1629455 (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.HYS
F-Secure Trojan.TR/Yarwi.AD.113
FireEye Generic.mg.21195efe1cd305f0
Fortinet W32/Bublik.A!tr
GData Trojan.GenericKD.1629455
Ikarus Trojan-Spy.Agent
Invincea heuristic
Jiangmin Trojan/Bublik.gzy
K7AntiVirus Trojan-Downloader ( 004b972f1 )
K7GW Trojan-Downloader ( 004b972f1 )
Kaspersky Trojan.Win32.Bublik.cgdz
MAX malware (ai score=82)
Malwarebytes Trojan.Upatre
MaxSecure Trojan.Upatre.Gen
McAfee GenericRXAA-AA!21195EFE1CD3
McAfee-GW-Edition BehavesLike.Win32.FakeAlert.qt
MicroWorld-eScan Trojan.GenericKD.1629455
Microsoft TrojanDownloader:Win32/Upatre.AA
NANO-Antivirus Trojan.Win32.Bublik.cwblbs
Qihoo-360 HEUR/QVM20.1.F31C.Malware.Gen
Rising Downloader.Upatre!8.B5 (TFE:dGZlOgJlb5XOy6XN7g)
SentinelOne DFI - Malicious PE
Sophos Troj/Upatre-AT
Tencent Malware.Win32.Gencirc.10b8bc37
TotalDefense Win32/Tnega.DbBYYPC
Trapmine malicious.moderate.ml.score
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2003-10-18 06:09:41

PE Imphash

e3ba6c037c9f90379e6d8a4d6f1fe2f5

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001452 0x00001600 6.437351686822693
.data 0x00003000 0x000006ea 0x00000800 3.9671719186037753
.rsrc 0x00004000 0x00002778 0x00002800 4.383032983678426

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000040f0 0x000025a8 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MENU 0x000066b0 0x000000c4 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x00006698 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library USER32.dll:
0x403018 GetWindowTextW
0x40301c SetCapture
0x403020 GetActiveWindow
0x403024 IsChild
0x403028 SendMessageA
0x40302c MessageBoxA
0x403030 DefWindowProcA
0x403034 TrackPopupMenu
0x403038 LoadBitmapA
0x40303c TranslateMessage
0x403040 DispatchMessageA
0x403044 GetMessageA
0x403048 PostQuitMessage
0x40304c ShowWindow
0x403050 UpdateWindow
0x403054 FlashWindowEx
0x403058 GetKeyState
0x403060 RegisterClassA
0x403064 CreateWindowExA
0x403068 GetDlgItemTextA
Library KERNEL32.dll:
0x403000 HeapAlloc
0x403004 GetModuleHandleA
0x403008 HeapCreate
0x40300c CloseHandle
0x403010 ExitProcess

L!This program cannot be run in DOS mode.
`.data
TVt[S!
@Y9v@H<E
^z^f=W
I3(#d6!FI
d?`9KE_!
tdLSB<
fuSAWVAf9
GEGEGMG;r
$uzUuY};
wjt& v`
^UV3W}
FG3@_^]
5K ;tFtfw
3E0_i?t
WU>Rzjv
V5JVWSSu
YIuKXG[O_^
ptVL,Eo,9(fi
*H_<>i
jg5d4@
jf5d4@
3P5d4@
3PPPUR
t%5<0@
MQ3PPPUR
f0f;1u
T$4L$0+
K#InF`f
d[F(G|6v6&`J
0i>#<5Ge
w_#=9oh
v<:qL#5,L
'q>(.G_
%;lJ432Gb
3=i>50
[g(V{Kr
_\"ffh#E@|f
z\"'u}`h#
S=<FdU
"fevuT
C/vuoN\
Qvu@`T
WB\n`:!{Kj&4VZV
Zfh#=ph~\
i?47W<
Bf`2pp
\"fnwgh#]
Cjw}'7xT,)
&wuT*?yWJ
Mz{Yma$%
hwvuT\
.{\x#,
$xruT~'Gz\y:w}
\/T"UYB
/GifvP'YM)2wh
=fJ)UvDz
>GxI#>0+PF=V#
instability
frantically
contents
button
sacdea
acasec
mcasic
static
XF2b~h0@
:`)2~.<f?'
bad allocation
posteriority
GetDlgItemTextA
RegisterClassA
TranslateAcceleratorA
GetKeyState
FlashWindowEx
TrackPopupMenu
GetWindowTextW
SetCapture
GetActiveWindow
IsChild
SendMessageA
MessageBoxA
DefWindowProcA
CreateWindowExA
LoadBitmapA
TranslateMessage
DispatchMessageA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
CloseHandle
HeapCreate
GetModuleHandleA
HeapAlloc
ExitProcess
KERNEL32.dll
yyyzzz
/////////G<//XJ////////////,
0 0 0 0 0 0 0 0 G<w0 G<0 0 .
/ 0 0 0 0 0 0 0 .
0 2!2!2!2!2!2!2!2!w2!YN2!2!f[2!2!2!2!2!2!2!0
2!3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"2!
4#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#4#
5$K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?K?5$5$5$
L!This program cannot be run in DOS mode.
i2h:2h:2h:2i:gh::1h::3h:)%:"h:)%:Ph:)%:
h::3h::*h::3h::3h:Rich2h:
`.data
@.reloc
otools\inc\nlg\private\inc\msfsa\faarray_cont_t.h
otools\inc\nlg\private\inc\msfsa\falextools_t.h
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
bad exception
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
Unknown exception
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
nlg\lib\msfsa\faallocator.cpp
nlg\lib\msfsa\farsdfa_pack_triv.cpp
otools\inc\nlg\private\inc\msfsa\faarray_cont_2xresize_t.h
nlg\lib\msfsa\famultimap_pack.cpp
Internal error.
Object cannot be initialized.
Limit size has been exceeded.
Out of memory.
Object is not ready.
]ut5p?
W3+t#Hu7Vu
^3[UQE
V3WM0u
UVW39~
<|uCt7
t79V$t2h
M 3UE9J
MA3;~\U
E;}q}M
PE @PE
MPE+@PE
G;}|}]}$
F;}^U9]
z;~\;}T;]
Yt]U]U]
EVW3EP
Lhttp://notepad-plus-plus.org/
http://notepad-plus-plus.org/contributors
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any la
C:\Users\Owner\AppData\Local\Temp\Rar$EXa0.743\Invoice_04022014.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ru3rgVfcb.exe
C:\TcDJhlbR.exe
C:\T1HsN06_.exe
C:\gPAu8JZj.exe
C:\QDnrVZ7R.exe
C:\4ffa2c083bb3b8c6433bb8a6944b04ed3b87b059ad75d2ac685454235ba91131
C:\MWEQb4yo.exe
C:\VHi6iQxK.exe
C:\t8zfjivC.exe
C:\sAStxB9b.exe
C:\5raXL1FT.exe
RESOURCE_FATOKENIZER
KERNEL32.DLL
smscoree.dll
nruntime error
TLOSS error
SING error
DOMAIN error
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
- abort() has been called
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
WUSER32.DLL
((((( H
CONOUT$
C:\Users\admin\Downloads\d83ab8b4bce4709ebe621e60ab422755f93b0d12c537ee8812ffc6f33e804dac.exe
C:\b2fdd473e9242f4abd16691874377fc256c3c95f04b0edf3378dd5c1eec8ebf5
C:\Raiden\Goat\FTP\Sample\F7ED8B675428B7C151B8A6D9BB52C91E.bin.exe
C:\Users\admin\Downloads\c397c8de5ea4d557e30fcfb658cad814.virus.exe
C:\9e2ed0ac5524d99d7c537acaef6a32bcd08f29d8607037cf81abc33a36a49bb5
C:\7298384b4c8d91716f25fe7858da4381f23411d3fe1db5e7ab29c1c851136bf4
C:\Users\admin\Downloads\laccm.exe
C:\71019e9f284d0d8cde48b62b3522195d98463533840bb093d15245e47d683f56
C:\Users\admin\Downloads\laccm.exe
C:\0ca1feaa242a4c02c0d1d552eb8047bd8076c334e894c0d6aad237664bbc114c
C:\Users\admin\Downloads\laccm.exe
C:\ecdd9a82a5f5c79d4eea1a61aab395bf352c21d8e2aaa56faea5c5dc7fca6a0f
C:\Users\admin\Downloads\laccm.exe
C:\3e4ae4e1fa72c6e0c7234977caab7504f56c004b811a2f6e06e1aad522930835
C:\fd698f55c0904dda16dd031ddcdf26cbb1d086f9ece0e4473dd4f9a2dda8bda6
C:\Users\admin\Downloads\laccm.exe
C:\a92d48917ae795c1f3bc0d9692aff4e9f8b84294915ff64d7e30d2ccaddf3940
C:\0c1381f3795c978cb51fc51e2c6d5a7656c9de74e6b30f2735c7eb4348375d39
C:\e394aa92e86f82d17a79204fed1a61be2d8c9eaa13e49640b94417352613d0b2
C:\Users\admin\Downloads\laccm.exe
C:\Users\RA491~1.VUL\AppData\Local\Temp\fc90d2e4f0c11d3e069f5a7ac7f5f093.exe
C:\929090f9a791e7fde3e1d45035d5f8d55f4e493e7a7cd1b800362190913abaeb
C:\3afa4582f6ccdd49f79d284f2698324478b8762bff0bd2cb3c5c061423036ad4
C:\8d799505b77011e96e985bd7430067f1d98205b178cd0dddca9b57d14762ee8a
c:\task\03B3D6FC74D25FAC60248368B4DE2FBC.exe
c:\task\15437CD53F34A7505E549E7D6A9E3C59.exe
c:\task\BBD456A02D862AFD0C3524BC6607E46E.exe
c:\task\CFCE0BDA8A0CC0089BDEBC830FC648B1.exe
c:\task\0EF048F25D57188398B47195D2082E97.exe
c:\task\A817C8961F6F561F21686E50CE696900.exe
C:\ecfe79a28d196b407dce4634f7b723279b6cd6543e76022e0e6188159644c5a4
C:\6e17fadbcb91cd5bd4cd70d94ea116210aa06d9a55c599511edff8c7ced6f416
C:\Users\admin\Downloads\laccm.exe
C:\4a9babdae353cca96f4ecc203f296f53d6d7ddce7d8eeed125511179ded17b22
C:\60de00f9ef55421bbf1623e3028d2dade1c66c6b0ef78e27ae9e35fc8be38ea8
C:\Documents and Settings\Administrator\Desktop\Y0WdAu0h.exe
C:\dd9da2b33daaaf51c706443f10e1a665e8460feeb2e49c7948aa2a460aa9d9b7
C:\e5a85d794ee6296488d35816315c1fecb9d5633e5ff2ce6c8e2c93e45a179876

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.