SmartHawk

3.6

中危

28 个模型检测该样本为恶意！

重新分析

下载样本

5ef0b6ab46bb6853ddf281a6b12ca1b6c9d77a6b25a8db00e5f0771e793357a5

26725fa739de06bd63ec275400696c15.exe

分析耗时

20s

最近分析

文件大小

64.0KB

静态报毒动态报毒 AIDETECTVM ARTEMIS BYBZ CONFIDENCE CRNMVECSUF8 DYNAMER FILEREPMALWARE GENASA GENERIC ML PUA GENERIC@ML HIGH CONFIDENCE KILLWIN KUDJ MALWARE1 MALWARE@#25X93RTA0SBKV PCOGFZU0VXKS5RHKAHVPCG RAMNIT RDML RUJD SCORE STATIC AI SUSPICIOUS PE TNRZ TZOM UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Alibaba	Trojan:Win32/Ramnit.2dc2cae0	20190527	0.3.0.5
Kingsoft		20201116	2013.8.14.323
McAfee	Artemis!26725FA739DE	20201116	6.0.6.653
Tencent		20201116	1.0.0.1
Avast		20201116	20.10.5736.0
CrowdStrike	win/malicious_confidence_80% (D)	20190702	1.0

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269225.13451 IsDebuggerPresent		failed	0	0

Command line console output was observed (4 个事件)

Time & API	Arguments	Status	Return
1619268796.109479 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x0000000000000007	success	1
1619268796.109479 WriteConsoleW	buffer: RD console_handle: 0x0000000000000007	success	1
1619268796.109479 WriteConsoleW	buffer: /S /Q "C:\Program Files (x86)\Rohde-Schwarz\ROMES_Install" console_handle: 0x0000000000000007	success	1
1619268796.203479 WriteConsoleW	buffer: 系统找不到指定的路径。 console_handle: 0x000000000000000b	success	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.code

The executable uses a known packer (1 个事件)

packer

PureBasic 4.x -> Neil Hodgson

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4F73.tmp\RemoveFolder.cmd

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269226.63451 NtTerminateProcess	status_code: 0xffffffff process_identifier: 376 process_handle: 0x000000e0	failed	0	0
1619269226.63451 NtTerminateProcess	status_code: 0xffffffff process_identifier: 376 process_handle: 0x000000e0	failed	3221225738	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Deletes executed files from disk (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4F73.tmp
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4F73.tmp\RemoveFolder.cmd

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.26725fa739de06bd
Cylance	Unsafe
Sangfor	Malware
Cybereason	malicious.b2d460
Cyren	W32/Ramnit.RUJD-1019
Paloalto	generic.ml
Alibaba	Trojan:Win32/Ramnit.2dc2cae0
AegisLab	Trojan.VBS.KillWin.tnRZ
Rising	Trojan.Generic@ML.100 (RDML:pcoGFZU0VXKS5rHKahVPcg)
Comodo	Malware@#25x93rta0sbkv
Zillya	Worm.Bybz.Win32.2461
Invincea	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Kudj.kh
Jiangmin	Trojan.Generic.tzom
Antiy-AVL	Worm/Win32.Bybz
Microsoft	Trojan:Win32/Dynamer!rfn
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C1408094
Acronis	suspicious
McAfee	Artemis!26725FA739DE
VBA32	Worm.Bybz
Yandex	Trojan.GenAsa!CRnmVECsuF8
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_86%
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_80% (D)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-03-23 20:52:55

Imports

Library MSVCRT.dll:

• 0x4116bc memset

• 0x4116c0 strncmp

• 0x4116c4 memmove

• 0x4116c8 strncpy

• 0x4116cc strstr

• 0x4116d0 _strnicmp

• 0x4116d4 _stricmp

• 0x4116d8 strlen

• 0x4116dc strcmp

• 0x4116e0 strcpy

• 0x4116e4 strcat

• 0x4116e8 sprintf

• 0x4116ec fabs

• 0x4116f0 ceil

• 0x4116f4 malloc

• 0x4116f8 floor

• 0x4116fc free

• 0x411700 fclose

• 0x411704 memcpy

• 0x411708 tolower

Library KERNEL32.dll:

• 0x411710 GetModuleHandleA

• 0x411714 HeapCreate

• 0x411718 SetConsoleCtrlHandler

• 0x41171c GetCommandLineA

• 0x411720 RemoveDirectoryA

• 0x411724 GetTempFileNameA

• 0x411728 GetShortPathNameA

• 0x41172c GetWindowsDirectoryA

• 0x411730 GetSystemDirectoryA

• 0x411734 HeapDestroy

• 0x411738 ExitProcess

• 0x41173c GetNativeSystemInfo

• 0x411740 FindResourceA

• 0x411744 LoadResource

• 0x411748 SizeofResource

• 0x41174c HeapAlloc

• 0x411750 HeapFree

• 0x411754 Sleep

• 0x411758 LoadLibraryA

• 0x41175c GetProcAddress

• 0x411760 FreeLibrary

• 0x411764 GetCurrentThreadId

• 0x411768 GetCurrentProcessId

• 0x41176c CloseHandle

• 0x411770 InitializeCriticalSection

• 0x411774 GetModuleFileNameA

• 0x411778 GetEnvironmentVariableA

• 0x41177c SetEnvironmentVariableA

• 0x411780 GetCurrentProcess

• 0x411784 DuplicateHandle

• 0x411788 CreatePipe

• 0x41178c GetStdHandle

• 0x411790 CreateProcessA

• 0x411794 WaitForSingleObject

• 0x411798 EnterCriticalSection

• 0x41179c LeaveCriticalSection

• 0x4117a0 PeekNamedPipe

• 0x4117a4 TerminateProcess

• 0x4117a8 GetExitCodeProcess

• 0x4117ac SetUnhandledExceptionFilter

• 0x4117b0 GetVersionExA

• 0x4117b4 HeapReAlloc

• 0x4117b8 SetLastError

• 0x4117bc TlsAlloc

• 0x4117c0 GetCurrentDirectoryA

• 0x4117c4 SetCurrentDirectoryA

• 0x4117c8 GetTempPathA

• 0x4117cc SetFileAttributesA

• 0x4117d0 DeleteFileA

• 0x4117d4 CreateDirectoryA

• 0x4117d8 WriteFile

• 0x4117dc CreateFileA

• 0x4117e0 SetFilePointer

• 0x4117e4 ReadFile

• 0x4117e8 DeleteCriticalSection

Library USER32.DLL:

• 0x4117f0 CharLowerA

• 0x4117f4 MessageBoxA

• 0x4117f8 SendMessageA

• 0x4117fc PostMessageA

• 0x411800 GetWindowThreadProcessId

• 0x411804 IsWindowVisible

• 0x411808 GetWindowLongA

• 0x41180c GetForegroundWindow

• 0x411810 IsWindowEnabled

• 0x411814 EnableWindow

• 0x411818 EnumWindows

• 0x41181c SetWindowPos

• 0x411820 DestroyWindow

• 0x411824 GetDC

• 0x411828 GetWindowTextLengthA

• 0x41182c GetWindowTextA

• 0x411830 SetRect

• 0x411834 DrawTextA

• 0x411838 GetSystemMetrics

• 0x41183c ReleaseDC

• 0x411840 GetSysColor

• 0x411844 GetSysColorBrush

• 0x411848 CreateWindowExA

• 0x41184c CallWindowProcA

• 0x411850 SetWindowLongA

• 0x411854 SetFocus

• 0x411858 RedrawWindow

• 0x41185c RemovePropA

• 0x411860 DefWindowProcA

• 0x411864 SetPropA

• 0x411868 GetParent

• 0x41186c GetPropA

• 0x411870 GetWindow

• 0x411874 SetActiveWindow

• 0x411878 UnregisterClassA

• 0x41187c DestroyAcceleratorTable

• 0x411880 LoadIconA

• 0x411884 LoadCursorA

• 0x411888 RegisterClassA

• 0x41188c AdjustWindowRectEx

• 0x411890 ShowWindow

• 0x411894 CreateAcceleratorTableA

• 0x411898 PeekMessageA

• 0x41189c MsgWaitForMultipleObjects

• 0x4118a0 GetMessageA

• 0x4118a4 GetActiveWindow

• 0x4118a8 TranslateAcceleratorA

• 0x4118ac TranslateMessage

• 0x4118b0 DispatchMessageA

• 0x4118b4 GetFocus

• 0x4118b8 GetClientRect

• 0x4118bc FillRect

• 0x4118c0 EnumChildWindows

• 0x4118c4 DefFrameProcA

• 0x4118c8 GetWindowRect

• 0x4118cc IsChild

• 0x4118d0 GetClassNameA

• 0x4118d4 GetKeyState

• 0x4118d8 DestroyIcon

• 0x4118dc RegisterWindowMessageA

Library GDI32.DLL:

• 0x4118e4 GetStockObject

• 0x4118e8 SelectObject

• 0x4118ec SetBkColor

• 0x4118f0 SetTextColor

• 0x4118f4 GetTextExtentPoint32A

• 0x4118f8 CreateSolidBrush

• 0x4118fc DeleteObject

• 0x411900 GetObjectA

• 0x411904 CreateCompatibleDC

• 0x411908 GetDIBits

• 0x41190c DeleteDC

• 0x411910 GetObjectType

• 0x411914 CreateDIBSection

• 0x411918 BitBlt

• 0x41191c CreateBitmap

• 0x411920 SetPixel

Library COMCTL32.DLL:

• 0x411928 InitCommonControlsEx

Library OLE32.DLL:

• 0x411930 CoInitialize

• 0x411934 CoTaskMemFree

• 0x411938 RevokeDragDrop

Library SHELL32.DLL:

• 0x411940 ShellExecuteExA

Library WINMM.DLL:

• 0x411948 timeBeginPeriod

Library SHLWAPI.DLL:

• 0x411950 PathQuoteSpacesA

• 0x411954 PathGetArgsA

• 0x411958 PathAddBackslashA

• 0x41195c PathUnquoteSpacesA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.