4.6
中危
41 个模型检测该样本为恶意！
重新分析
更多

bd4201d94f345690197a18abc380b3405cbbfcef9e4bd6df2569615678be8e94

24703dcfd3f26bc17d9d6a37ffb38b66.exe

分析耗时

75s

最近分析

文件大小

96.7KB
静态报毒 动态报毒 ADWARESIG AI SCORE=82 ARTEMIS ATTRIBUTE BROWSEFOX CLASSIC CONFIDENCE EQ@8HFP78 FALSESIGN FOXVCT GENERICKD GRAYWARE HIGH CONFIDENCE HIGHCONFIDENCE HQBO NSIS PRESENOKER R249786 RUSSAD SCORE UNSAFE XETAPP 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:AdwareSig [Adw] 20200908 18.4.3895.0
Tencent Win32.Trojan.Falsesign.Hqbo 20200908 1.0.0.1
Kingsoft 20200908 2013.8.14.323
McAfee Artemis!24703DCFD3F2 20200908 6.0.6.653
CrowdStrike win/malicious_confidence_80% (D) 20190702 1.0
行为判定
动态指标
Performs some HTTP requests (1 个事件)
request GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsd588C.tmp\INetC.dll
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsd588C.tmp\INetC.dll
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620119617.048408
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1620119619.626408
RegSetValueExA
key_handle: 0x00000438
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620119619.626408
RegSetValueExA
key_handle: 0x00000438
value: ð×âs•@×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620119619.626408
RegSetValueExA
key_handle: 0x00000438
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620119619.626408
RegSetValueExW
key_handle: 0x00000438
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620119619.626408
RegSetValueExA
key_handle: 0x00000460
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620119619.626408
RegSetValueExA
key_handle: 0x00000460
value: ð×âs•@×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620119619.626408
RegSetValueExA
key_handle: 0x00000460
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620119619.657408
RegSetValueExW
key_handle: 0x00000434
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43789041
FireEye Generic.mg.24703dcfd3f26bc1
ALYac Trojan.GenericKD.43789041
Cylance Unsafe
Sangfor Malware
K7AntiVirus Adware ( 005435291 )
K7GW Adware ( 005435291 )
Cybereason malicious.9283f2
Arcabit Trojan.Generic.D29C2AF1
Invincea Xetapp (PUA)
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:AdwareSig [Adw]
Kaspersky HEUR:Trojan-Ransom.Win32.Encoder.gen
BitDefender Trojan.GenericKD.43789041
NANO-Antivirus Trojan.Nsis.Encoder.foxvct
Paloalto generic.ml
AegisLab Trojan.Win32.Encoder.j!c
Tencent Win32.Trojan.Falsesign.Hqbo
Ad-Aware Trojan.GenericKD.43789041
Comodo Application.Win32.Xetapp.EQ@8hfp78
DrWeb Adware.Downware.19361
VIPRE Trojan.Win32.Generic!BT
Sophos Xetapp (PUA)
Antiy-AVL GrayWare[Downloader]/Win32.Adload.gen
Microsoft PUA:Win32/BrowseFox
ZoneAlarm HEUR:Trojan-Ransom.Win32.Encoder.gen
GData NSIS.Application.Xetapp.A
Cynet Malicious (score: 100)
AhnLab-V3 PUP/Win32.AdLoad.R249786
Acronis suspicious
McAfee Artemis!24703DCFD3F2
MAX malware (ai score=82)
VBA32 Adware.Presenoker
Malwarebytes Adware.RussAd
ESET-NOD32 Win32/Xetapp.E potentially unwanted
Rising PUF.Xetapp!1.B89D (CLASSIC)
AVG Win32:AdwareSig [Adw]
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_80% (D)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2016-08-24 10:45:13

Imports

Library ADVAPI32.DLL:
• 0x43837c OpenProcessToken
• 0x438380 RegCloseKey
• 0x438384 RegCreateKeyExW
• 0x438388 RegDeleteKeyW
• 0x43838c RegDeleteValueW
• 0x438390 RegEnumKeyW
• 0x438394 RegEnumValueW
• 0x438398 RegOpenKeyExW
• 0x43839c RegQueryValueExW
• 0x4383a0 RegSetValueExW
• 0x4383a4 SetFileSecurityW
Library COMCTL32.DLL:
• 0x4383b0 ImageList_AddMasked
• 0x4383b4 ImageList_Create
• 0x4383b8 ImageList_Destroy
• 0x4383bc InitCommonControls
Library GDI32.dll:
• 0x4383c8 CreateBrushIndirect
• 0x4383cc CreateFontIndirectW
• 0x4383d0 DeleteObject
• 0x4383d4 GetDeviceCaps
• 0x4383d8 SelectObject
• 0x4383dc SetBkColor
• 0x4383e0 SetBkMode
• 0x4383e4 SetTextColor
Library KERNEL32.dll:
• 0x4383f0 CloseHandle
• 0x4383f4 CompareFileTime
• 0x4383f8 CopyFileW
• 0x4383fc CreateDirectoryW
• 0x438400 CreateFileW
• 0x438404 CreateProcessW
• 0x438408 CreateThread
• 0x43840c DeleteFileW
• 0x438410 ExitProcess
• 0x438418 FindClose
• 0x43841c FindFirstFileW
• 0x438420 FindNextFileW
• 0x438424 FreeLibrary
• 0x438428 GetCommandLineW
• 0x43842c GetCurrentProcess
• 0x438430 GetDiskFreeSpaceW
• 0x438434 GetExitCodeProcess
• 0x438438 GetFileAttributesW
• 0x43843c GetFileSize
• 0x438440 GetFullPathNameW
• 0x438444 GetLastError
• 0x438448 GetModuleFileNameW
• 0x43844c GetModuleHandleA
• 0x438450 GetModuleHandleW
• 0x438458 GetProcAddress
• 0x43845c GetShortPathNameW
• 0x438460 GetSystemDirectoryW
• 0x438464 GetTempFileNameW
• 0x438468 GetTempPathW
• 0x43846c GetTickCount
• 0x438470 GetVersion
• 0x438478 GlobalAlloc
• 0x43847c GlobalFree
• 0x438480 GlobalLock
• 0x438484 GlobalUnlock
• 0x438488 LoadLibraryExW
• 0x43848c MoveFileExW
• 0x438490 MoveFileW
• 0x438494 MulDiv
• 0x438498 MultiByteToWideChar
• 0x43849c ReadFile
• 0x4384a0 RemoveDirectoryW
• 0x4384a4 SearchPathW
• 0x4384b0 SetErrorMode
• 0x4384b4 SetFileAttributesW
• 0x4384b8 SetFilePointer
• 0x4384bc SetFileTime
• 0x4384c0 Sleep
• 0x4384c4 WaitForSingleObject
• 0x4384c8 WideCharToMultiByte
• 0x4384cc WriteFile
• 0x4384d4 lstrcatW
• 0x4384d8 lstrcmpW
• 0x4384dc lstrcmpiA
• 0x4384e0 lstrcmpiW
• 0x4384e4 lstrcpyA
• 0x4384e8 lstrcpyW
• 0x4384ec lstrcpynW
• 0x4384f0 lstrlenA
• 0x4384f4 lstrlenW
Library OLE32.dll:
• 0x438500 CoCreateInstance
• 0x438504 CoTaskMemFree
• 0x438508 OleInitialize
• 0x43850c OleUninitialize
Library SHELL32.DLL:
• 0x438518 SHBrowseForFolderW
• 0x43851c SHFileOperationW
• 0x438520 SHGetFileInfoW
• 0x43852c ShellExecuteW
Library USER32.dll:
• 0x438538 AppendMenuW
• 0x43853c BeginPaint
• 0x438540 CallWindowProcW
• 0x438544 CharNextA
• 0x438548 CharNextW
• 0x43854c CharPrevW
• 0x438550 CheckDlgButton
• 0x438554 CloseClipboard
• 0x438558 CreateDialogParamW
• 0x43855c CreatePopupMenu
• 0x438560 CreateWindowExW
• 0x438564 DefWindowProcW
• 0x438568 DestroyWindow
• 0x43856c DialogBoxParamW
• 0x438570 DispatchMessageW
• 0x438574 DrawTextW
• 0x438578 EmptyClipboard
• 0x43857c EnableMenuItem
• 0x438580 EnableWindow
• 0x438584 EndDialog
• 0x438588 EndPaint
• 0x43858c ExitWindowsEx
• 0x438590 FillRect
• 0x438594 FindWindowExW
• 0x438598 GetClassInfoW
• 0x43859c GetClientRect
• 0x4385a0 GetDC
• 0x4385a4 GetDlgItem
• 0x4385a8 GetDlgItemTextW
• 0x4385ac GetMessagePos
• 0x4385b0 GetSysColor
• 0x4385b4 GetSystemMenu
• 0x4385b8 GetSystemMetrics
• 0x4385bc GetWindowLongW
• 0x4385c0 GetWindowRect
• 0x4385c4 InvalidateRect
• 0x4385c8 IsWindow
• 0x4385cc IsWindowEnabled
• 0x4385d0 IsWindowVisible
• 0x4385d4 LoadBitmapW
• 0x4385d8 LoadCursorW
• 0x4385dc LoadImageW
• 0x4385e0 MessageBoxIndirectW
• 0x4385e4 OpenClipboard
• 0x4385e8 PeekMessageW
• 0x4385ec PostQuitMessage
• 0x4385f0 RegisterClassW
• 0x4385f4 ReleaseDC
• 0x4385f8 ScreenToClient
• 0x4385fc SendMessageTimeoutW
• 0x438600 SendMessageW
• 0x438604 SetClassLongW
• 0x438608 SetClipboardData
• 0x43860c SetCursor
• 0x438610 SetDlgItemTextW
• 0x438614 SetForegroundWindow
• 0x438618 SetTimer
• 0x43861c SetWindowLongW
• 0x438620 SetWindowPos
• 0x438624 SetWindowTextW
• 0x438628 ShowWindow
• 0x438630 TrackPopupMenu
• 0x438634 wsprintfA
• 0x438638 wsprintfW

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49179 116.11.67.6 www.download.windowsupdate.com 80
192.168.56.101 49176 62.212.73.121 xetapp.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

URI Data
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.