2.6
中危
68 个模型检测该样本为恶意！
重新分析
更多

0cf7179788261ecfca56543e2d57b15e1d5f0677043daaa5584a4adbf76b2b11

0cf7179788261ecfca56543e2d57b15e1d5f0677043daaa5584a4adbf76b2b11.exe

分析耗时

136s

最近分析

377天前

文件大小

5.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN VTFLOODER
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.53
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Malware:Win32/km_28eea.None 20190527 0.3.0.5
Avast Win32:Evo-gen [Trj] 20240215 23.9.8494.0
Baidu Win32.Trojan-Downloader.Tiny.c 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (W) 20231026 1.0
Kingsoft malware.kb.b.993 20230906 None
McAfee Generic-FAVK!26FE2CA66DDA 20240215 6.0.6.653
Tencent Trojan.Win32.VtFlooder.a 20240215 1.0.0.1
静态指标
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机 (1 个事件)
Time & API Arguments Status Return Repeated
1727545338.452875
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压） (17 个事件)
Time & API Arguments Status Return Repeated
1727545338.421875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545372.484875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545402.437875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545449.437875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545450.968875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545451.593875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545451.984875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545452.343875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545453.609875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545453.968875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545454.390875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545454.749875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545455.202875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545455.827875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545456.187875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545456.624875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
1727545457.015875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e50000
region_size: 8192
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1064
success 0 0
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': 'UPX1', 'virtual_address': '0x00007000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000e00', 'entropy': 7.222721013023769} entropy 7.222721013023769 description 发现高熵的节
entropy 0.875 description 此PE文件的整体熵值较高
可执行文件使用UPX压缩 (3 个事件)
section UPX0 description 节名称指示UPX
section UPX1 description 节名称指示UPX
section UPX2 description 节名称指示UPX
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 68 个反病毒引擎识别为恶意 (50 out of 68 个事件)
ALYac Trojan.GenericKDZ.105312
APEX Malicious
AVG Win32:Evo-gen [Trj]
Acronis suspicious
AhnLab-V3 Trojan/Win32.Agent.R110400
Alibaba Malware:Win32/km_28eea.None
Antiy-AVL Trojan/Win32.Badur
Arcabit Trojan.Generic.D19B60
Avast Win32:Evo-gen [Trj]
Avira TR/Crypt.XPACK.Gen
Baidu Win32.Trojan-Downloader.Tiny.c
BitDefender Trojan.GenericKDZ.105312
BitDefenderTheta Gen:NN.ZexaF.36744.amGfaS!UjJi
Bkav W32.AIDetectMalware
CAT-QuickHeal Trojan.Mauvaise.SL1
ClamAV Win.Malware.Vtflooder-6722904-1
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.a4bf0b
Cylance unsafe
Cynet Malicious (score: 100)
DeepInstinct MALICIOUS
DrWeb Trojan.Flood.22062
ESET-NOD32 Win32/Flooder.Tiny.A
Elastic malicious (moderate confidence)
Emsisoft Trojan.GenericKDZ.105312 (B)
F-Secure Trojan.TR/Crypt.XPACK.Gen
FireEye Generic.mg.26fe2ca66dda895c
Fortinet W32/Generic.AC.3F7BD8!tr
GData Win32.Trojan.Vflooder.A
Google Detected
Gridinsoft Trojan.Win32.Agent.bot!s2
Ikarus Trojan.Win32.TrojanClicker
Jiangmin Trojan/Vtflooder.l
K7AntiVirus Trojan ( 005a74e21 )
K7GW Trojan ( 005a74e21 )
Kaspersky Trojan.Win32.Vtflooder.cft
Kingsoft malware.kb.b.993
Lionic Trojan.Win32.Generic.m4vu
MAX malware (ai score=86)
Malwarebytes Generic.Malware.AI.DDS
MaxSecure Trojan.Malware.300983.susgen
McAfee Generic-FAVK!26FE2CA66DDA
MicroWorld-eScan Trojan.GenericKDZ.105312
Microsoft Trojan:Win32/Vflooder
NANO-Antivirus Trojan.Win32.Crypted.dbpklq
Panda Generic Suspicious
Rising Trojan.Win32.Vflooder.b (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Kazy
Sangfor Trojan.Win32.Save.a
SentinelOne Static AI - Malicious PE
连接到不再响应请求的 IP 地址（合法服务通常会保持运行） (4 个事件)
dead_host 74.125.34.46:80
dead_host 104.244.42.1:80
dead_host 104.244.42.129:80
dead_host 104.244.42.193:80
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2014-07-19 19:52:59

PE Imphash

8c9bb9d690553503983713582e1e58f7

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00006000 0x00000000 0.0
UPX1 0x00007000 0x00001000 0x00000e00 7.222721013023769
UPX2 0x00008000 0x00001000 0x00000200 3.417706440053802

Imports

Library KERNEL32.DLL:
• 0x40808c LoadLibraryA
• 0x408090 GetProcAddress
• 0x408094 VirtualProtect
• 0x408098 VirtualAlloc
• 0x40809c VirtualFree
• 0x4080a0 ExitProcess
Library ntdll.dll:
• 0x4080a8 _wtoi
Library ole32.dll:
Library SHLWAPI.dll:
• 0x4080b8 StrStrA
Library USER32.dll:
• 0x4080c0 wsprintfA
Library WINHTTP.dll:
• 0x4080c8 WinHttpOpen
L!This program cannot be run in DOS mode.
wy3*3*3*3*6*:4*8*3*(*(:
*0*(::*2*Rich3*
UR+Eo2
WQF*,Cx
mNL.|LZ
PUR!n%j<EZds7s<
0P#aKR
d>7,Y0
*`0Wj%3
x @ah4t!
EPQh(%TH
QUvlVOI(#>
$F{A._
,_|#PCi
T(]5"7f
hl#@2t!
DUR`oYF}@p#
d-uL.;"
@]h83lo
e=)'&L
eK81eT2fPJhEl
RSnpB8
n]j@pI
,tXB$0t2r
jhtLlE
ZK8pt VuQHtA
77gGt"6$u
-?%015d
-Dispositi
: form-data; name="apikey"
k3.Type'
0fb57e825ca7f65
71f12frbb0692
20773190978b8
93c9ecfeaG`file"
miD/x-msdownloi
'ransfer-Encodg4b
ary3--
rA==2
2SigeQ3w
cGEu#O
w.-i\]u%toElI=Y
N[ m.)
PcM7Ye921
7tA8VUsE/et/
gntKx'-_/
}rstuvwxyz{$>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopq
Sle_.ep
lstrnACreateTh
VirtualFe
GetMod[6
TickCount
ExitProcess
(SizeHAll
seHandd
MwrtiByoWideChar]NxmA{_wtoi
N=cpyTStfkw
mOnHGpbi
DnwsprifA
YPEttpWaedmU
[onnect
B`.roth
XPTPSWXaD$j
KERNEL32.DLL
ntdll.dll
ole32.dll
SHLWAPI.dll
USER32.dll
WINHTTP.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
CreateStreamOnHGlobal
StrStrA
wsprintfA
WinHttpOpen

Process Tree

0cf7179788261ecfca56543e2d57b15e1d5f0677043daaa5584a4adbf76b2b11.exe, PID: 1064, Parent PID: 2284

default registry file network process services synchronisation iexplore office pdf

TCP

Source Source Port Destination Destination Port
192.168.56.101 49162 104.244.42.65 twitter.com 80
192.168.56.101 49163 74.125.34.46 www.virustotal.com 80
192.168.56.101 49165 104.244.42.1 twitter.com 80
192.168.56.101 49167 74.125.34.46 www.virustotal.com 80
192.168.56.101 49170 74.125.34.46 www.virustotal.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 65473 114.114.114.114 53
192.168.56.101 49642 114.114.114.114 53
192.168.56.101 56933 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 57665 114.114.114.114 53
192.168.56.101 51758 114.114.114.114 53
192.168.56.101 52215 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Name 77d3f2f724e2d98f6edde208d0908a911ce64249
Size 5.3KB
Type data
MD5 3673cef0764029d1ec006b5bbb682b42
SHA1 77d3f2f724e2d98f6edde208d0908a911ce64249
SHA256 b37031bff98efa142449ab4f0077cc5b8382fda535e160f3e34e18c86ad7157e
CRC32 311C81EC
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name e4595f0fbefa38e217c57641611d6cb81064a87d
Size 5.3KB
Type data
MD5 5442f8ee84bd4be421d58a08e3cf98c3
SHA1 e4595f0fbefa38e217c57641611d6cb81064a87d
SHA256 bbb04e66cf2982d4490e078889493ee0fefafc16d36c67b146b8c8ec79b7c77d
CRC32 07B4BE60
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name 204d6121f91e1d6c43354b4f70e67a5a1b71dd7d
Size 5.3KB
Type data
MD5 0a1590c892bacf1d38f2224cf9061ddb
SHA1 204d6121f91e1d6c43354b4f70e67a5a1b71dd7d
SHA256 c99dd2b1849ae6e12edc68d4d2f043a6afc5664a07182841157740b06161cd45
CRC32 DDD7A881
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name d0f31b1fb3612266bea08b5455c84f8cbd5ee9ef
Size 5.3KB
Type data
MD5 299b645a18f8da16dcd7f129af401dcd
SHA1 d0f31b1fb3612266bea08b5455c84f8cbd5ee9ef
SHA256 1faac65c116c073eae5b889929e01b2bc0cdd8d9f91a01ef968c55d99dace119
CRC32 60202203
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name 0542d1ccc45b4f8c6d1293e107603854e453a291
Size 5.3KB
Type data
MD5 4c107fe6b0fbe1376eea61fe02d86697
SHA1 0542d1ccc45b4f8c6d1293e107603854e453a291
SHA256 310e7d414cc0d0dd554fc23cd17fb4c8534cb045e9d235b79080c582158a0ad6
CRC32 90419F8D
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name c75e4ecf4686b98a3c5097f5364ede20fa228cf4
Size 5.3KB
Type data
MD5 a7ac01ead9e12e6c01d8e7f63943a86f
SHA1 c75e4ecf4686b98a3c5097f5364ede20fa228cf4
SHA256 d017e5b09e69c10209714ab4d567f7b3f848192c74041fb20ba90ebeb323ffc0
CRC32 C6F4DE5C
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name 5d39c063f05035dcacd83859f94e96c75d4d59b0
Size 5.3KB
Type data
MD5 37d2ce65d0e28b413d4f316f4b67716e
SHA1 5d39c063f05035dcacd83859f94e96c75d4d59b0
SHA256 28456461d6bfd17bfdfdaedd6e2372088b3f738114704cedd9ed702d05e937f4
CRC32 FEAB00FA
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name a6e80ff2a27e429dcb11e288f762e8ecb09e1847
Size 5.3KB
Type data
MD5 10e2a4b8db6a4e9f134ced7a2d21968c
SHA1 a6e80ff2a27e429dcb11e288f762e8ecb09e1847
SHA256 53fc96351c26152202e93978119e83c9646ad7671de00cc981f40d0728843e02
CRC32 50B148B4
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name adb458808990ea5a297255a337924baf3dd5e20a
Size 5.3KB
Type data
MD5 a6b1b7f267272ca50b4c119e56f940c7
SHA1 adb458808990ea5a297255a337924baf3dd5e20a
SHA256 8ee63aeb8ada396772d3fec3ae631f86ebb960a1a7c6bbc36d26c0e76d3115b6
CRC32 F010CB29
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name eedef26b6dfdb1ba5f3b22eb143b51b05c34307d
Size 5.3KB
Type data
MD5 37deb5327ed59aa09a95d8ccbfb08584
SHA1 eedef26b6dfdb1ba5f3b22eb143b51b05c34307d
SHA256 46a6d7bb114a80938dbeb956ed4033d859c9bcafdfd569c019650d9fabf12ccf
CRC32 78ADC461
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name 9d84578804c9d9ccce73734dd16b001128faad62
Size 5.3KB
Type data
MD5 22c1614e5510206e882935857351cea3
SHA1 9d84578804c9d9ccce73734dd16b001128faad62
SHA256 2b3eddc1b3dc227058b702f19d5c2e92137649262ba67ebdc214ebd656b8c04c
CRC32 F39D6647
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name 6da9275b44355b724af93ad130b07b7610398536
Size 5.3KB
Type data
MD5 e270e67ef967d69a22f201944e511b47
SHA1 6da9275b44355b724af93ad130b07b7610398536
SHA256 1a1d7a308a590fa485b6352c2b9061cd1531e1706056106e8933b495372689e9
CRC32 5B2D02DB
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name 95229d03543152f595c39295c215d41d033c8855
Size 5.3KB
Type data
MD5 d7a62a54d4eaf8a91be8489d0b9bdc1d
SHA1 95229d03543152f595c39295c215d41d033c8855
SHA256 075a800606f0f05148db7dc585804f7b6a99242878c0d1159eaebc194a1f6f03
CRC32 83A5F793
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name 59aa391c57afcd7624cd8425f45e3468e86c9cbf
Size 5.3KB
Type data
MD5 abb08b4dbf48df620462735eb3b995a4
SHA1 59aa391c57afcd7624cd8425f45e3468e86c9cbf
SHA256 31763463487d8ccb29ffee44fee603a523d2f8ef39a7d7e062c29fd17b0ade37
CRC32 3BB10A5A
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name bdec9fcd45725660f6cd49653c306ce97df8aae5
Size 5.3KB
Type data
MD5 d868407195dece00291a3ac69a456450
SHA1 bdec9fcd45725660f6cd49653c306ce97df8aae5
SHA256 116af1aa937678889006de420b278d152703c7ae717c54c964db0aaefd0f4c2c
CRC32 41890884
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name 19305128c7eee2b304bf928131f1202dadd33979
Size 5.3KB
Type data
MD5 2b1fdfaaa84a391126db13a46862a878
SHA1 19305128c7eee2b304bf928131f1202dadd33979
SHA256 ab4221f74936b3d69903fb83fd8b55d57ac368b9dfbe96172cddd5e5a71bb857
CRC32 A5353659
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis
Name 8c2a98272d6456acc110b63a44e88d7308d4f08d
Size 5.3KB
Type data
MD5 a90879d0a4e86acb75f9e2bfe0d23d7d
SHA1 8c2a98272d6456acc110b63a44e88d7308d4f08d
SHA256 1f5bf39fd22d59dacac543f0540a4a3113a19d4f99f55759dfcf97e235b854cd
CRC32 6D181EC6
ssdeep None
Yara
  • embedded_pe - Contains an embedded PE32 file
  • embedded_win_api - A non-Windows executable contains win32 API functions names
VirusTotal Search for analysis