2.2
中危
10 个模型检测该样本为恶意！
重新分析
更多

bf46107f5fa97d130d67b19fa8825fbbb6c77ff81499b21c870db1e555606e45

2313c2072e0e4af319113734f8a38966.exe

分析耗时

85s

最近分析

文件大小

4.1MB
静态报毒 动态报毒 ARTEMIS BUZUS MULTIPACKED@1Z141Z3 SCORE SDBOT UNSAFE
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!B3CBEB2E5777 20200527 6.0.6.653
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20200527 18.4.3895.0
Kingsoft 20200527 2013.8.14.323
Tencent 20200527 1.0.0.1
CrowdStrike 20190702 1.0
静态指标
The executable uses a known packer (1 个事件)
packer WinZip Self-Extractor 2.2 personal edition -> WinZip Computing
行为判定
动态指标
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 个事件)
McAfee Artemis!B3CBEB2E5777
Avast Win32:Malware-gen
ClamAV Win.Trojan.Buzus-2366
AegisLab Trojan.Win32.Generic.4!c
Comodo Heur.Packed.MultiPacked@1z141z3
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition Artemis!Trojan
Jiangmin Backdoor/SdBot.drk
eGambit Unsafe.AI_Score_72%
AVG Win32:Malware-gen
Generates some ICMP traffic
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2004-02-12 00:08:18

Imports

Library SHELL32.dll:
• 0x407110 ShellExecuteA
• 0x407114 FindExecutableA
Library USER32.dll:
• 0x40711c GetWindowWord
• 0x407120 SetWindowWord
• 0x407124 BeginPaint
• 0x407128 GetSysColor
• 0x40712c GetClientRect
• 0x407130 SetRect
• 0x407134 EndPaint
• 0x407138 LoadCursorA
• 0x40713c GetLastActivePopup
• 0x407140 ShowWindow
• 0x407144 PostMessageA
• 0x407148 SendMessageA
• 0x40714c EnableWindow
• 0x407150 DestroyWindow
• 0x407154 SetWindowTextA
• 0x407158 SetForegroundWindow
• 0x40715c SetActiveWindow
• 0x407160 SendDlgItemMessageA
• 0x407164 UpdateWindow
• 0x407168 OemToCharBuffA
• 0x40716c CharUpperBuffA
• 0x407170 DefWindowProcA
• 0x407174 KillTimer
• 0x40717c GetDlgItemTextA
• 0x407180 EndDialog
• 0x407184 GetWindowRect
• 0x407188 GetSystemMetrics
• 0x40718c SetWindowPos
• 0x407190 GetKeyState
• 0x407194 PeekMessageA
• 0x407198 TranslateMessage
• 0x40719c DispatchMessageA
• 0x4071a0 GetParent
• 0x4071a4 SetDlgItemTextA
• 0x4071a8 GetDlgItem
• 0x4071ac InvalidateRect
• 0x4071b0 wsprintfA
• 0x4071b4 MessageBoxA
• 0x4071b8 SetCursor
• 0x4071bc CharNextA
• 0x4071c0 RegisterClassA
• 0x4071c4 SetTimer
Library KERNEL32.dll:
• 0x407044 VirtualAlloc
• 0x407048 HeapFree
• 0x40704c HeapAlloc
• 0x407050 HeapReAlloc
• 0x407054 RtlUnwind
• 0x407058 GetCommandLineA
• 0x40705c GetModuleHandleA
• 0x407060 SetErrorMode
• 0x407064 GetSystemDirectoryA
• 0x407068 LoadLibraryA
• 0x40706c GetProcAddress
• 0x407070 FreeLibrary
• 0x407074 _lwrite
• 0x407078 lstrcmpiA
• 0x407080 _lcreat
• 0x407084 CreateFileA
• 0x407088 CloseHandle
• 0x40708c ExitProcess
• 0x407090 GetSystemTime
• 0x407094 WriteFile
• 0x407098 GetModuleFileNameA
• 0x40709c GetVersion
• 0x4070a0 GlobalMemoryStatus
• 0x4070a4 lstrcatA
• 0x4070a8 FindClose
• 0x4070ac FindFirstFileA
• 0x4070b8 CreateDirectoryA
• 0x4070bc SetFileTime
• 0x4070c8 LocalAlloc
• 0x4070cc _lopen
• 0x4070d0 GetDriveTypeA
• 0x4070d4 WinExec
• 0x4070d8 lstrcpyA
• 0x4070dc lstrlenA
• 0x4070e0 _lclose
• 0x4070e4 GlobalLock
• 0x4070e8 GlobalAlloc
• 0x4070ec GlobalFree
• 0x4070f0 GlobalUnlock
• 0x4070f4 GlobalHandle
• 0x4070f8 LocalFree
• 0x407104 _llseek
• 0x407108 _lread
Library GDI32.dll:
• 0x407010 SetBkColor
• 0x407014 SetTextColor
• 0x407018 SetTextAlign
• 0x40701c GetBkColor
• 0x407024 ExtTextOutA
• 0x407028 CreateDCA
• 0x40702c GetDeviceCaps
• 0x407030 CreateFontIndirectA
• 0x407034 DeleteDC
• 0x407038 SelectObject
• 0x40703c DeleteObject
Library ADVAPI32.dll:
• 0x407000 RegQueryValueA
Library COMCTL32.dll:
• 0x407008

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.