5.4
中危
24 个模型检测该样本为恶意！
重新分析
更多

44d961f8647d856ae040bf6c7797f1edee4712a1af7396776560f2aeafea6434

2507254d81da75f3c5840e9ecd418615.exe

分析耗时

76s

最近分析

文件大小

3.5MB
静态报毒 动态报毒 ARTEMIS IXGSET0HJRW MALICIOUS MALWARE@#3UT7229XRXGZM PYTHON R066H0CL220 ROZENA SUSGEN UNSAFE VEIL WACATAC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Generic.40774151 20190527 0.3.0.5
Avast Win64:Malware-gen 20210209 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20210209 2017.9.26.565
McAfee Artemis!2507254D81DA 20210209 6.0.6.653
Tencent 20210209 1.0.0.1
CrowdStrike 20210203 1.0
静态指标
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1620120994.286896
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000000650000
success 0 0
1620120994.301896
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0000000000750000
success 0 0
1620120994.301896
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x0000000000750000
success 0 0
Creates executable files on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI28642\python27.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI28642\MSVCR90.dll
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620120995.926896
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.296986119925669 section {'size_of_data': '0x0000ec00', 'virtual_address': '0x00025000', 'entropy': 7.296986119925669, 'name': '.rsrc', 'virtual_size': '0x0000ea38'} description A section with a high entropy has been found
entropy 0.3172043010752688 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 47.240.45.183
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1620120998.489896
RegSetValueExA
key_handle: 0x000000000000036c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620120998.489896
RegSetValueExA
key_handle: 0x000000000000036c
value: —šó×@×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620120998.489896
RegSetValueExA
key_handle: 0x000000000000036c
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620120998.489896
RegSetValueExW
key_handle: 0x000000000000036c
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620120998.489896
RegSetValueExA
key_handle: 0x0000000000000384
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620120998.489896
RegSetValueExA
key_handle: 0x0000000000000384
value: —šó×@×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620120998.489896
RegSetValueExA
key_handle: 0x0000000000000384
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620120998.551896
RegSetValueExW
key_handle: 0x0000000000000368
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Generates some ICMP traffic
File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 个事件)
Cylance Unsafe
Alibaba Trojan:Win32/Generic.40774151
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win64:Malware-gen
Kaspersky HEUR:Trojan.Win32.Generic
Paloalto generic.ml
AegisLab Trojan.Win32.Generic.4!c
Sophos ATK/Veil-AZ
Comodo Malware@#3ut7229xrxgzm
McAfee-GW-Edition BehavesLike.Win64.Dropper.wc
Jiangmin Backdoor/Python.c
eGambit Trojan.Generic
Gridinsoft Ransom.Win64.Wacatac.oa
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm HEUR:Trojan.Win32.Generic
McAfee Artemis!2507254D81DA
VBA32 Trojan.Wacatac
TrendMicro-HouseCall TROJ_GEN.R066H0CL220
Yandex Trojan.Agent!IXgsET0HJrw
Ikarus Trojan.Python.Rozena
MaxSecure Trojan.Malware.7164915.susgen
Fortinet W32/Generic.A!tr
AVG Win64:Malware-gen
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 47.240.45.183:60002
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-05-25 17:24:04

Imports

Library KERNEL32.dll:
• 0x140017000 GetVersionExA
• 0x140017008 GetProcAddress
• 0x140017010 LoadLibraryA
• 0x140017018 GetModuleFileNameA
• 0x140017020 GetModuleFileNameW
• 0x140017028 GetExitCodeProcess
• 0x140017030 WaitForSingleObject
• 0x140017038 CreateProcessW
• 0x140017040 GetCommandLineW
• 0x140017048 GetStartupInfoW
• 0x140017050 GetTempPathA
• 0x140017058 GetLastError
• 0x140017060 LoadLibraryExA
• 0x140017068 Sleep
• 0x140017070 RemoveDirectoryA
• 0x140017078 CreateDirectoryA
• 0x140017080 RtlUnwindEx
• 0x140017088 SetStdHandle
• 0x140017090 EnterCriticalSection
• 0x1400170a0 LeaveCriticalSection
• 0x1400170a8 GetFileType
• 0x1400170b0 DecodePointer
• 0x1400170b8 EncodePointer
• 0x1400170c0 SetConsoleCtrlHandler
• 0x1400170c8 HeapFree
• 0x1400170d0 FindClose
• 0x1400170d8 FileTimeToSystemTime
• 0x1400170e0 FileTimeToLocalFileTime
• 0x1400170e8 GetDriveTypeA
• 0x1400170f0 FindFirstFileExA
• 0x1400170f8 HeapAlloc
• 0x140017100 DeleteFileA
• 0x140017108 FindNextFileA
• 0x140017110 GetCommandLineA
• 0x140017118 TerminateProcess
• 0x140017120 GetCurrentProcess
• 0x140017128 UnhandledExceptionFilter
• 0x140017138 IsDebuggerPresent
• 0x140017140 RtlVirtualUnwind
• 0x140017148 RtlLookupFunctionEntry
• 0x140017150 RtlCaptureContext
• 0x140017158 SetHandleCount
• 0x140017160 GetStdHandle
• 0x140017168 DeleteCriticalSection
• 0x140017170 GetModuleHandleW
• 0x140017178 ExitProcess
• 0x140017180 FlsGetValue
• 0x140017188 FlsSetValue
• 0x140017190 FlsFree
• 0x140017198 SetLastError
• 0x1400171a0 GetCurrentThreadId
• 0x1400171a8 FlsAlloc
• 0x1400171b0 HeapSetInformation
• 0x1400171b8 GetVersion
• 0x1400171c0 HeapCreate
• 0x1400171c8 WideCharToMultiByte
• 0x1400171d0 GetFullPathNameA
• 0x1400171d8 CloseHandle
• 0x1400171e8 PeekNamedPipe
• 0x1400171f0 CreateFileA
• 0x1400171f8 GetCurrentDirectoryW
• 0x140017200 GetFileAttributesA
• 0x140017208 MultiByteToWideChar
• 0x140017210 ReadFile
• 0x140017218 SetFilePointer
• 0x140017220 WriteFile
• 0x140017228 GetConsoleCP
• 0x140017230 GetConsoleMode
• 0x140017238 FreeEnvironmentStringsW
• 0x140017240 GetEnvironmentStringsW
• 0x140017248 QueryPerformanceCounter
• 0x140017250 GetTickCount
• 0x140017258 GetCurrentProcessId
• 0x140017260 GetSystemTimeAsFileTime
• 0x140017268 GetCPInfo
• 0x140017270 GetACP
• 0x140017278 GetOEMCP
• 0x140017280 IsValidCodePage
• 0x140017288 HeapReAlloc
• 0x140017290 LoadLibraryW
• 0x140017298 FlushFileBuffers
• 0x1400172a0 CompareStringW
• 0x1400172a8 SetEnvironmentVariableA
• 0x1400172b0 GetDriveTypeW
• 0x1400172b8 SetEndOfFile
• 0x1400172c0 GetProcessHeap
• 0x1400172c8 GetTimeZoneInformation
• 0x1400172d0 LCMapStringW
• 0x1400172d8 WriteConsoleW
• 0x1400172e0 GetStringTypeW
• 0x1400172e8 HeapSize
• 0x1400172f0 CreateFileW
• 0x1400172f8 SetEnvironmentVariableW
Library WS2_32.dll:
• 0x140017308 ntohl

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.