3.2
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.56
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Trojan-gen | 20191009 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.ck | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191009 | 2013.8.14.323 |
| McAfee | GenericRXIM-MU!285F2A69B87A | 20191009 | 6.0.6.653 |
| Tencent | None | 20191009 | 1.0.0.1 |
静态指标
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545291.343 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545291.843 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
| section | .imports |
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压）
(6 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
一个或多个缓冲区包含嵌入的PE文件
(1 个事件)
| buffer | Buffer with sha1: eaecc563f2962807505b30ca1585802932c2733d |
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
在用户文件夹中创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 154.216.69.73:443 |
文件已被 VirusTotal 上 54 个反病毒引擎识别为恶意
(50 out of 54 个事件)
| ALYac | Gen:Variant.Ulise.39106 |
| APEX | Malicious |
| AVG | Win32:Trojan-gen |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.39106 |
| AhnLab-V3 | Trojan/Win32.Agent.C3088949 |
| Antiy-AVL | Trojan/Win32.Agent |
| Arcabit | Trojan.Ulise.D98C2 |
| Avast | Win32:Trojan-gen |
| Avira | TR/Agent.emh |
| Baidu | Win32.Trojan-Downloader.Small.ck |
| BitDefender | Gen:Variant.Ulise.39106 |
| CAT-QuickHeal | Trojan.AgentCS.S5617528 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Agent.BNYA@835oo7 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.9b87a1 |
| Cylance | Unsafe |
| Cyren | W32/S-924fb52d!Eldorado |
| DrWeb | Trojan.Packed.3036 |
| ESET-NOD32 | a variant of Win32/Kryptik.BNYA |
| Emsisoft | Gen:Variant.Ulise.39106 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-924fb52d!Eldorado |
| F-Secure | Trojan.TR/Agent.emh |
| FireEye | Generic.mg.285f2a69b87a1709 |
| Fortinet | W32/Zbot.QNYM!tr |
| GData | Gen:Variant.Ulise.39106 |
| Ikarus | Packer.Win32.Krap |
| Invincea | heuristic |
| Jiangmin | Trojan.Agent.bvpq |
| K7AntiVirus | Spyware ( 0040f70e1 ) |
| K7GW | Spyware ( 0040f70e1 ) |
| Kaspersky | Trojan.Win32.Agent.ibbb |
| MAX | malware (ai score=81) |
| Malwarebytes | Backdoor.Bot |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericRXIM-MU!285F2A69B87A |
| McAfee-GW-Edition | BehavesLike.Win32.Cutwail.qz |
| MicroWorld-eScan | Gen:Variant.Ulise.39106 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.Agent.cqjtkw |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.6F35.Malware.Gen |
| Rising | Downloader.Small!8.B41 (TFE:2:UmKJ3SHWGwB) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/AutoG-Y |
| Symantec | ML.Attribute.HighConfidence |
| Trapmine | malicious.high.ml.score |
| VBA32 | TrojanSpy.Zbot |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2004-10-14 13:48:53
PE Imphash
731679601c856adef7f532ff8eb87d13
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x00007000 | 0x00007000 | 3.498563800505639 |
| .MPRESS2 | 0x00008000 | 0x00001000 | 0x00000600 | 4.526742280409833 |
| .rsrc | 0x00009000 | 0x00002000 | 0x00001600 | 4.604240763500994 |
| .imports | 0x0000b000 | 0x00001000 | 0x00000400 | 4.315566605452838 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00009078 | 0x00000ea8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x00007020 | 0x000000e8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00009fa0 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00009ff4 | 0x00000318 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x0000a34c | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library user32.dll:
• 0x4051c8 CreateWindowExA
• 0x4051cc GetMessageA
• 0x4051d0 DispatchMessageA
• 0x4051d4 DefWindowProcA
• 0x4051d8 PostQuitMessage
• 0x4051dc GetForegroundWindow
• 0x4051e0 SetForegroundWindow
• 0x4051e4 CreateMenu
• 0x4051e8 GetSystemMenu
• 0x4051ec GetDoubleClickTime
• 0x4051f0 UpdateWindow
• 0x4051f4 GetQueueStatus
• 0x4051f8 GetClipboardOwner
• 0x4051fc FindWindowA
• 0x405200 LoadIconA
• 0x405204 LoadCursorA
• 0x405208 RegisterClassA
Library GDI32.dll:
• 0x405388 CreateBitmap
• 0x40538c IntersectClipRect
• 0x405390 ExcludeClipRect
• 0x405394 UpdateColors
• 0x405398 DeleteDC
• 0x40539c GetTextExtentPoint32A
• 0x4053a0 CreateCompatibleDC
• 0x4053a4 DeleteObject
• 0x4053a8 TextOutA
• 0x4053ac SetBkColor
• 0x4053b0 SetTextColor
• 0x4053b4 Rectangle
• 0x4053b8 CreateSolidBrush
• 0x4053bc GetStockObject
• 0x4053c0 SelectObject
• 0x4053c4 CreateFontIndirectA
• 0x4053c8 GetTextExtentExPointA
• 0x4053cc SetMapMode
• 0x4053d0 GetDeviceCaps
Library Winmm.dll:
• 0x40556c mciSendStringA
Library Msacm32.dll:
• 0x40554c acmStreamOpen
Library kernel32.dll:
• 0x4050f0 GetModuleHandleA
• 0x4050f4 CreateSemaphoreW
• 0x4050f8 GetProcAddress
• 0x4050fc HeapCreate
• 0x405100 HeapAlloc
• 0x405104 ExitProcess
• 0x405108 FreeLibrary
Library OLE32.dll:
• 0x405528 CoCreateInstance
L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
user32.dll
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
GetForegroundWindow
SetForegroundWindow
CreateMenu
GetSystemMenu
GetDoubleClickTime
UpdateWindow
GetQueueStatus
GetClipboardOwner
FindWindowA
LoadIconA
LoadCursorA
RegisterClassA
GDI32.dll
CreateBitmap
IntersectClipRect
ExcludeClipRect
UpdateColors
DeleteDC
GetTextExtentPoint32A
CreateCompatibleDC
DeleteObject
TextOutA
SetBkColor
SetTextColor
Rectangle
CreateSolidBrush
GetStockObject
SelectObject
CreateFontIndirectA
GetTextExtentExPointA
SetMapMode
GetDeviceCaps
Winmm.dll
mciSendStringA
Msacm32.dll
acmStreamOpen
kernel32.dll
GetModuleHandleA
CreateSemaphoreW
GetProcAddress
HeapCreate
HeapAlloc
ExitProcess
FreeLibrary
OLE32.dll
CoCreateInstance
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
E%)E%-
2Q?@HGGQ
g@N[vf
X=g;QFvZVCy
LoadLibraryExA
status recsound c:\\fwfew\qef
TranslateMessage
user32.dll
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
user32.dll
LoadIconA
GDI32.dll
DeleteDC
Winmm.dll
mciSendStringA
Msacm32.dll
acmStreamOpen
OLE32.dll
CoCreateInstance
t7Kt'Kt
\\\\\\mmm\
\\\\\\onmnmmmmm\
\\\\\ooooooonnmmmmmm\
\\\\\\qqqppqoqoooonnmmmmmm\
\\\\\\sqqqqqpqmqopoooooonnmmmmmm\
CCCCCCCCC\\\sssssssqsssqoqqqqoqoqnoonnmmmmmm\
Cssssssssssssssssssqqqssqoqmqooqnooonnmmmmmm\
!"+578Xsssssssssssqqspqqqoqoooooonnmmmmmm\
"#-78Ksssssssssqqssqppqpqpoqn_VF?
Wmmmm\
!++57DsssssssssqsqsqsfZPF>)
Pnmmmm\
!"+578ssssssssdaMH<0
Qmmmmm\
!!++57issssR00))'
1?HTfmmmmm\
!"#-6XssssR0)*'$
'0>FPZdooooommmmmmmm\
!#+-NssssT0>BHMU_iqqpqqpooqnoooZQ_nmmmm\
!!"+AsssssqssqqqqsqpqpmZQFB$
mmmmm\
!"-ssssssssseaRLB4$
mmmmm\
!pssssFE0)'
1mmmmm\
assssF0)*$
))BFQVdnnnmmmmmm\
LssssM0)4?BMLXZhppoqoooqnoonmmmmmm\
AsssqmpqsqqqqqqppqppoqTV??$
_nmmm\
0qssssssssqsqsqpqpppoq
Pnmmm\
pssssdXsqsq>
Lqppppoq
Vnmmm\
(%$mqsss00Tsqs>
dpppqnoUVVooonnmmmm\
%%'_ssssB00oqsL
'mpppqqooooonnnnmmm\
Cs &%%&((QssssE0*>qqM
FqppnohVP??
Hnmmm\
Cs% %%&&((,(FssssE0*)PsL
ZpqpoB
Cs%%&&%,,,..:ssssE0*0'eM
1mmmm\
Cs,,,,,,....1ssssR0)N$4H
4poomVUVoomnmmmmm\
Cs1,1,1111111hsssT00aL''
Vqoqnoooonnmmmmm\
Cs33133133434_qssT0)am0
fooWUF?>
mmmmm\
CsF<:99<94:93VsssT/*RsZ
_mmmm\
FqL<:::::::::HqssZ0.HdqB
Ummmm\
Li_>=========Bsss400'0so$
4qh,.?FmQUVZommommmm\
LXsBBBBBBBBBBBqssaRRPZoqmqqqpqqpoooqnoomnnmmmm\
FqVFFFFFFFFFFmqssssspsqqsqpqpppppoppponnnmmmm\
Q`pHFFFFGFGCG_sssssssqsqssqppppppppppoonnmnmm\
FqbFHIIIIHIHZqsssssssppppppppqppppppoonnnmmm
TqZLILLLLLLVsssssspppppsqpqppqooqonnX
LdqVOOMMOMOOqsssssssimhi__Z_MMMMMMMqF
Hiq^QQQQQOQZZZZQQRPQRPPQPQQQQQMQQQsF
FesfTTTTTQVQQTTTTTTTTTTTTTTTTVQTTsH
HXqqcQVVXVXUUUUUUUUUUUUUUUUUVVXUqC
XHcqsnc^ZZZZZZZZZZZZZZZZZZZZZZZqF
THapqsqqqqqqqqqqqqqqqqqqqqqqssF
LLCFFFFFFFFFFFFFFFFFFFFFFFFFF
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
user32.dll
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
GetForegroundWindow
SetForegroundWindow
CreateMenu
GetSystemMenu
GetDoubleClickTime
UpdateWindow
GetQueueStatus
GetClipboardOwner
FindWindowA
LoadIconA
LoadCursorA
RegisterClassA
GDI32.dll
CreateBitmap
IntersectClipRect
ExcludeClipRect
UpdateColors
DeleteDC
GetTextExtentPoint32A
CreateCompatibleDC
DeleteObject
TextOutA
SetBkColor
SetTextColor
Rectangle
CreateSolidBrush
GetStockObject
SelectObject
CreateFontIndirectA
GetTextExtentExPointA
SetMapMode
GetDeviceCaps
Winmm.dll
mciSendStringA
Msacm32.dll
acmStreamOpen
kernel32.dll
GetModuleHandleA
CreateSemaphoreW
GetProcAddress
HeapCreate
HeapAlloc
ExitProcess
FreeLibrary
OLE32.dll
CoCreateInstance
A b o u t
M S S a n s S e r i f
Z _ c f i n k p
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
M S F T C o r p
F i l e D e s c r s i p t i o n
c a l c . e x e
F i l e V e r s i o n
2 . 1 . 1 . 2
I n t e r n a l N a m e
c a l c . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 1 1
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
c a l c . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
P r o d u c t V e r s i o n
3 . 1 . 1 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
C : \ U s e r s \ L i s a \ D e s k t o p \ f A i Q A R V m . e x e
C : \ 0 0 e c c 3 0 1 0 5 d c b f 3 1 2 4 7 9 b 2 e e 1 4 8 8 b e f 8 a f e 4 8 0 e f a a 0 c 2 1 8 d 2 3 6 d d c f 4 0 4 1 4 0 9 c 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 0 t X T o 1 u c . e x e
C : \ a a 9 b b 3 8 1 a d 9 c d d 0 e 8 4 4 a 2 3 e 4 5 a 8 6 8 a 7 1 1 c 0 f b a 8 8 0 6 5 2 4 8 d 0 a b 1 d e 2 1 8 7 2 1 c 5 e 6 e
C : \ _ t Z P e r W T . e x e
C : \ 3 9 9 d 4 0 4 b c 1 7 5 7 e 8 6 a 2 8 b 9 0 a 4 5 c 2 b 6 1 f 3 7 d 1 c f 5 4 7 a e e 2 9 8 e 9 c 2 2 4 2 8 d 7 6 5 a 3 b f c 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l M y b M m I w . e x e
C : \ W d o o K I 6 5 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ r 1 F 8 Y E M 8 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c q S G O 1 9 V . e x e
C : \ 8 o S r 6 4 q _ . e x e
C : \ 9 e a f 8 4 7 5 6 a 5 0 d 1 d f 0 b 2 f b 3 5 6 2 f 1 8 7 a 0 e d 6 1 b b 5 3 c 6 8 3 1 e 5 c f 5 5 e d 1 5 7 1 e 7 9 5 f f f 0
C : \ d e 4 3 a 1 a 1 b 3 9 a 6 d 1 f 4 2 9 7 d 7 e f 6 3 6 4 e d 5 f c f f 7 b 8 b 3 8 1 d 4 7 5 1 9 6 4 5 6 b 3 9 7 f 3 3 0 3 7 9 8
C : \ e 5 e 9 3 4 5 2 b b 7 5 1 c 4 1 5 f e f 7 6 0 0 8 6 e c 4 b 2 1 1 e 1 d 1 4 a 4 1 7 a 0 5 f e 8 b e 8 4 6 4 1 7 9 8 b 4 5 d 6 b
C : \ _ 6 G U s D 5 P . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ s e t A A m x l . e x e
C : \ 9 5 y 8 T j 4 8 . e x e
C : \ 3 8 a 2 2 7 3 1 3 9 e 0 0 d 2 0 4 e 6 3 7 9 0 6 6 f 9 b 8 6 6 b 6 c 3 0 e b 8 d 2 2 0 b 3 2 7 b 9 3 7 6 8 6 9 2 c b 9 f c 3 4 2
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 4 d 4 5 b a 1 9 0 0 c f 9 9 f f 5 4 4 c d b 2 b 9 1 b 5 e 9 1 2 0 9 4 b c 2 6 e f 4 8 c f 6 6 6 f 2 d a a e 4 4 2 c 0 3 a e e d . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ f C E 1 t L a V . e x e
C : \ Y 3 W 4 H i s K . e x e
C : \ f 3 1 5 d 4 b a 9 f 2 4 6 b 0 d d d b 6 2 6 2 e 5 6 d b 6 5 6 a 0 f c d 3 5 0 9 7 0 9 c b 5 5 f a 1 3 3 3 4 5 0 4 3 d 7 8 2 1 f
C : \ c 0 5 d 6 7 a 6 3 f 7 e b 0 2 5 5 b 6 5 f 4 8 1 1 e 6 6 8 9 9 b 3 9 e d b a 7 4 d b a 0 6 5 0 b 9 9 8 1 3 8 0 9 5 1 d a c 4 d 1
C : \ 7 2 1 6 5 f 9 0 e f 4 1 0 5 f 5 6 f 6 a 1 2 9 5 3 a e b f a 8 a 0 3 0 5 c d 4 1 f e d c 2 7 0 4 8 4 d 5 9 4 a 6 7 5 5 d 2 4 1 0
C : \ U s e r s \ L i s a \ D e s k t o p \ g C 7 9 Q h U J . e x e
C : \ w h v n _ E M P . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ m r J 5 l 6 N f . e x e
C : \ w i e n i 8 g V . e x e
C : \ 2 8 c c 5 e 0 5 6 9 0 a c d 7 8 d 2 8 a 6 9 6 2 5 0 c b 6 5 5 7 3 7 1 1 b 0 5 f c 2 5 3 c e 4 2 a 1 b 2 4 5 a e 2 2 8 8 9 b 5 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 7 1 7 9 3 7 7 e 4 f e d a 8 1 a 5 3 9 4 0 e c f 8 7 b 1 0 a 7 8 5 f 6 e d b b b 1 3 c 8 3 6 1 9 7 9 1 1 1 f 0 b 5 3 2 d f 6 9 9
C : \ U s e r s \ j o h n \ A p p D a t a \ L o c a l \ T e m p \ 1 0 B 9 7 4 2 9 1 8 5 B 4 7 6 B A 9 C 4 3 8 F 4 5 8 1 F 8 A B C . e x e
C : \ b 3 G k G 7 h M . e x e
C : \ e 9 8 4 0 e e 5 2 5 5 6 9 6 8 b 9 0 9 7 9 8 f 2 4 1 2 3 d c 5 9 8 3 9 8 a 5 0 6 8 0 c b e 6 d 7 8 7 b 4 7 0 1 2 f a c 7 9 b 9 3
C : \ a 6 6 8 c 6 2 5 3 c 9 f b e a a d f 0 5 1 9 5 7 6 c 1 a 2 e 1 1 e c 1 d 4 5 3 3 3 a 7 a 1 f 0 3 5 5 a 6 c 7 8 0 c 2 8 e 7 c 6 f
C : \ h y 6 8 H 9 1 8 . e x e
C : \ c 4 1 f e 1 e 8 d 1 b d f c 0 7 3 8 a e a 6 e 9 b 2 1 d 3 8 b 2 8 c 7 8 7 2 8 d f 3 c 8 1 8 1 4 f 4 d 8 7 2 7 b 5 1 1 d 9 f 6 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 9 f c e b 0 3 7 5 8 4 1 b 8 7 b 3 9 b 2 4 a a 8 9 a d 9 c c 8 6 8 0 0 2 1 b 0 3 5 0 a 8 5 c e c a 5 5 0 c 1 7 8 9 2 f 9 a b 3 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 9 1 c d 7 c 9 2 9 d 1 e f f a 6 3 c 1 a 1 1 b 0 e b b f 7 a 6 f 3 e 4 5 3 6 b a 5 e 8 b 2 7 b 4 e c b 8 2 5 8 d 9 1 9 1 9 1 0 0
C : \ c 4 6 6 c a 6 3 1 a 8 6 e b 5 e 2 9 1 4 5 4 5 d f 1 f b e b 7 9 1 b a 4 f 0 1 a 9 e 1 d f a a 7 8 3 4 4 6 5 b 4 6 2 b 3 6 8 6 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 0 9 d 5 c b 4 2 7 a 5 e 1 c 9 3 3 a 5 3 a a 3 3 8 2 7 6 2 a c 0 5 e 5 f b b 8 3 f 3 9 7 7 d e 6 1 2 8 2 e 6 2 e f 3 7 3 1 9 1 2
C : \ d 2 6 a 7 4 9 3 2 8 2 5 b 9 1 f c 8 d 3 e f 4 8 7 f e 8 6 b a 0 2 9 0 c 7 8 2 f f 9 b a 4 8 3 b b 9 b d 2 a 9 6 5 7 b d 2 2 5 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ e a 1 c 0 f d 1 0 b f a f 1 9 f b 1 9 b e b d 8 9 1 a 3 7 b a d d d 8 e 4 8 2 f a e f 8 5 f b 4 8 b e d 7 6 9 0 b 2 c 8 e f d 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ a 6 e a 2 b a 2 d 8 0 1 5 3 4 6 b a e 3 c 5 7 0 7 4 6 8 0 e 0 0 2 4 0 e a b b 1 4 d 0 4 e b 2 1 7 4 4 b 2 9 d 1 4 9 f 2 f 1 e a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 1 b 7 6 6 3 0 5 8 8 7 c 2 c 7 2 f 8 9 3 0 7 d a 5 4 a 5 e 3 d c 2 f 7 9 f 0 0 3 c 3 8 7 3 2 2 5 9 1 8 a b 5 e a 4 8 a 2 b 2 4 4
C : \ a 6 6 a b 2 9 4 2 2 4 a f 0 a 0 8 c 8 4 c 4 0 e 5 9 7 2 d 2 8 b 7 2 0 4 a 3 a 2 0 b b f a f d 4 b 7 8 1 e 0 f 6 2 4 7 9 c 3 8 4
C : \ 3 c 9 e 8 a 6 1 5 4 e 0 4 4 9 8 a 0 0 e f 5 4 0 2 2 e 4 7 3 6 9 7 d d a 4 7 6 6 8 0 7 a 5 4 e 8 7 5 8 7 7 a c 1 b d 4 3 f 6 6 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ b 9 6 4 d 5 1 d 4 a 6 1 e b e 8 b 6 6 8 6 b d a d d 7 1 8 f 6 9 6 7 f 7 4 e 0 9 9 4 8 6 9 7 b 3 a 5 d e c 7 7 3 6 2 1 5 e 8 2 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 4 f 4 3 1 6 f 6 d 6 c 8 c 9 a 1 c 2 1 8 d 0 4 9 6 b c 1 a 5 8 c 7 0 c f 5 8 f c 2 2 a 7 8 e 7 a 0 4 d 6 c 2 a 6 b 2 9 8 7 d d d
C : \ 4 c 4 7 3 a 8 0 4 3 5 5 1 c 4 2 a 2 3 6 7 3 7 e c c a d b 9 e 1 7 2 1 0 4 5 f 1 1 a f 0 8 3 6 a 1 c f 5 1 a 4 2 0 1 2 2 2 a d e
C : \ b T 6 u w P A w . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 1 0 7 e 0 5 7 4 b e d 1 2 0 7 d 2 d a 8 0 2 6 2 7 6 4 8 8 a 6 1 e b 9 0 3 3 0 5 0 f 4 f f c e 1 6 2 e 0 c 3 b 0 a 0 8 9 8 4 0 c
C : \ 9 3 c b 4 a 8 9 0 8 d d 6 c b 2 0 c 4 9 2 e 9 7 6 b 6 9 4 7 6 5 6 a 1 1 d 6 9 0 8 3 f 1 f 5 8 6 3 c 4 0 5 8 5 b 9 2 a 9 3 6 6 6
C : \ t w z z u R r 1 . e x e
C : \ 0 1 c 6 4 d 4 7 7 9 9 7 e a a 6 4 3 3 8 7 4 7 1 0 b a 4 7 4 b f 9 c 2 c b 2 d f 5 5 e 6 7 2 7 0 0 d b 9 4 f c 2 b e 5 7 9 c a 1
C : \ 3 2 6 4 a 1 0 4 1 d 5 2 1 8 8 0 a 5 3 6 2 a e c e 7 b f 8 4 f 4 8 e 4 0 6 1 0 6 7 8 4 6 c 0 9 c d 5 2 e f e 4 c 4 9 1 0 1 a 0 2
C : \ c c b 3 c 5 9 9 b 6 9 9 2 7 9 f 8 8 7 0 6 d e 2 8 8 c b 9 5 f c b e a 2 5 a d 5 9 1 6 c d 4 e 1 e 2 e 0 d 7 2 8 0 9 e 6 d 5 e 1
C : \ 5 4 c 7 a 6 d 7 b d 6 d d d 1 4 e d b 6 0 5 f f 1 c 8 4 e 9 e f 6 e 7 5 1 6 9 d 1 e f e b 4 4 6 2 b 2 e f 5 1 e c b 4 c f 3 1 6
C : \ 2 c 0 5 d b d 7 3 e 4 3 c e a 1 4 f 7 2 9 3 e f 0 b 3 1 5 5 1 3 4 a b 0 9 d 8 3 8 6 d 4 b 9 8 d b 4 d c e 3 3 6 0 5 1 c 1 f 3 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 5 a 4 3 3 3 3 2 d 0 7 a 9 3 e 0 8 7 7 0 f e e 9 1 5 a 7 0 7 f 9 4 2 6 f 3 d 6 a 5 d a a 2 1 f d 1 b 8 9 3 8 7 3 7 4 d 5 3 9 c f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 8 1 7 c c 6 b 3 5 8 a a e f 7 e 0 1 5 9 6 2 f b c e b 5 5 6 1 9 a a c 1 1 6 a a b 4 d 1 4 9 1 a a 4 9 3 0 9 5 8 7 3 3 8 2 5 4 4 . e x e
C : \ f 6 3 1 7 3 8 a e 4 c 4 f c 6 0 2 2 8 1 e b 5 4 d 8 5 9 1 f a 9 d 4 e d c 0 8 d 1 1 b 4 9 a 7 a a 5 5 9 d 1 8 b f f a a 4 5 7 5
C : \ U s e r s \ L i s a \ D e s k t o p \ y e E s a R k 4 . e x e
C : \ V Z B w 1 C X 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 4 a 9 j M A t R . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ a 5 7 5 c a 4 d c 0 6 e 9 7 3 8 e 3 3 b 6 2 c 8 7 d 0 f d 7 9 2 c c 8 6 4 c d 9 b 1 f 6 e 1 5 f 9 a 9 1 3 2 3 4 5 8 3 c c c 3 b
C : \ U s e r s \ A l a n \ A p p D a t a \ L o c a l \ T e m p \ a 1 1 b 8 b 0 2 b 0 2 9 7 e b d a e 7 0 9 f 6 0 4 5 8 d d f 9 6 d 7 0 c 4 c 1 b . e x e
C : \ t Y H u r V v W . e x e
C : \ a c 6 4 5 f b 8 8 6 9 6 e b f a 9 1 b f 7 1 e 4 9 c a e d 2 a 6 0 4 6 b 5 b 7 4 3 3 2 a 1 5 2 7 6 d c d a 4 a e 0 7 a 5 3 7 1 7
C : \ c 1 5 b 5 1 c 1 8 9 2 1 8 4 9 1 d a 3 0 6 6 9 5 0 1 9 8 4 4 b c c 1 3 3 8 3 0 8 1 c f e d e f a 5 b 4 2 1 2 4 e 0 a 1 5 e 1 8 4
C : \ y B j A c O Y t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 3 9 2 7 8 6 9 0 2 8 c 1 5 e a 3 f 8 1 3 4 5 f 4 7 d 4 6 0 4 7 2 d 3 5 9 6 e 8 c 4 d e e 1 b 8 e 7 5 6 d 8 b 1 7 e 3 8 c 9 b 2 a
C : \ U s e r s \ L i s a \ D e s k t o p \ m K 7 P J F 1 F . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ c p E c F W 3 4 . e x e
C : \ 3 8 f 8 5 9 2 2 5 3 a 0 0 c a 5 e d 2 0 e a 5 d 2 9 3 2 f d d 0 6 8 b b c 3 b e 9 1 c f 4 d 6 e d 4 a 8 4 f b b d b 1 4 f 5 e f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 2 f 6 f 5 3 3 b 4 f 5 8 0 1 1 4 a 2 1 2 e c d e e 8 9 1 f 4 0 b 3 b 3 9 9 f 8 7 f e b a 8 7 e 8 3 7 6 7 0 2 2 4 1 e e 3 4 f 9 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ e c d 3 e 0 d c f 7 4 b 7 7 9 3 e b f f 2 c 6 5 7 e 4 4 9 6 f b f 7 e 6 1 9 4 5 a 7 a 5 9 b e f e 1 4 8 e 9 d c 5 a 9 2 2 e 8 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 2 b 2 3 1 0 f 9 0 7 2 2 d 8 5 1 6 2 8 1 5 5 4 d 4 a 4 3 6 1 b 2 b 4 b 7 3 8 b b 8 2 f 0 2 3 9 7 5 f 0 6 a 1 8 4 f b 2 5 c 4 e 8
C : \ 0 a 6 e a e f 2 f 4 0 d 1 d 4 9 6 5 3 3 a d c 5 c d c 2 3 9 7 f c b 8 d 4 3 6 f 1 7 b 2 a a 3 c e 6 e a c c f 0 8 9 d 0 8 6 3 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ c b 3 3 4 5 5 b d 9 0 4 d b 0 0 7 f 6 4 f a 9 5 1 0 b 3 d 6 0 f 1 b b 2 d e 5 0 d 3 7 e 1 b 5 7 8 a 1 6 3 7 6 4 6 d 2 e 8 e e 9
C : \ 2 _ o b 3 _ e a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 0 8 8 1 a a 8 d e 3 6 4 0 f 9 c d f e a e 4 4 b 9 b 2 9 1 e 6 . v i r u s . e x e
C : \ 1 b 8 1 f f 9 5 3 1 0 5 e d 8 e 1 c 6 5 4 8 3 1 9 4 d 1 6 1 0 2 6 4 7 3 5 5 f 1 7 0 9 1 6 2 6 e 1 4 3 2 5 e 9 1 e 6 4 9 b b 6 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ f 5 4 9 d 4 4 3 d 9 2 6 e 9 b d a d a 0 9 3 2 5 d c 6 d f 7 c 3 8 7 2 1 c 6 7 4 3 6 1 3 0 1 e 2 2 7 1 1 4 6 3 4 8 2 5 2 e d 8 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 9 1 5 b 2 6 0 5 4 5 9 a 5 d e f 2 1 d d e 4 b 2 9 e 0 0 b 6 c a 7 0 e 3 2 1 3 2 b b b f b a 4 4 a f 3 f 9 8 9 1 0 3 5 0 a 7 0 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 4 a e d 6 2 c d 3 7 4 9 1 8 0 5 0 4 8 b a e 7 6 2 7 3 4 9 c 7 8 7 0 f c 8 0 6 0 8 8 6 6 7 1 7 f 7 6 2 1 0 e f 3 a d b 0 a 9 7 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 0 5 8 4 c 7 7 7 e 6 6 5 6 f 1 2 f d f 6 6 3 6 4 4 8 3 8 3 2 2 5 b 6 0 2 9 d 4 6 4 d 2 6 0 4 9 1 2 7 1 c 6 2 5 5 8 4 0 2 9 e 2 9
C : \ 7 e 3 2 7 6 0 3 2 e d c 6 9 2 c 0 9 4 c d f 6 f d b 1 4 7 8 0 6 b d 8 f 1 e c 2 0 4 c 9 e f d 4 d 7 8 b b a 1 d 0 f e 1 4 2 8 d
C : \ 4 3 5 a 8 4 5 a a d 2 a 3 c 1 a 8 5 7 5 2 8 5 4 f b 2 8 f a c 2 d 8 c 2 5 6 b 6 f 4 e 3 1 1 b 2 f 0 3 0 7 7 1 8 d 0 a f 9 3 c c
C : \ e 8 f 6 c 2 e 6 7 d 0 f 8 5 0 5 f 6 f c 8 d 2 b e 5 e 3 0 3 c 0 7 c 4 e a 5 3 3 b 8 2 5 1 d 3 b f a 8 4 a e 1 e e 9 e 1 a 4 2 b
C : \ c 5 f 7 d c 8 9 c 6 f a d 6 d 1 f 6 c 6 4 3 b f 3 2 8 a c 7 0 c f 6 b f a c c b c f b e a d b 4 1 b 6 5 f c 0 3 6 9 3 4 e 2 7 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ e 1 1 2 6 6 9 5 d 3 4 5 7 9 4 6 5 5 8 b 1 2 b c a 1 8 a 4 b 6 1 4 a c 3 3 3 4 5 0 a 9 b 6 c 0 a 5 e 8 e 1 1 d 2 4 b 9 c c d e 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 0 4 e e 6 1 1 2 9 3 8 8 7 4 a e 8 5 6 b c 7 3 c f 3 b a d c 4 c f 9 1 d 7 c 4 c f d b d 7 2 9 6 b e 5 2 1 7 0 2 f f 3 1 5 4 2 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 1 2 b 1 e 9 1 2 f 2 2 2 8 1 e 2 f 2 b 0 a 2 8 b 0 8 c 7 3 4 2 3 4 5 6 d 4 9 4 0 4 5 b 1 d 9 5 0 4 5 9 1 c 9 2 2 a 5 e 2 4 1 e f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ d 9 1 8 6 e f b c 4 8 d 9 d 9 b 5 0 d 8 0 b 8 c 0 7 9 0 e 1 f a 4 2 e 5 0 2 4 d c 2 1 d 9 8 f 1 8 d 8 f b 6 b f c 0 a 8 c 6 b 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ a 7 a 9 8 f 9 4 d 9 c f 3 c d e e e 1 1 3 1 0 b a 6 b e 0 c 0 f 7 c d d 3 f b 9 2 7 2 4 e 6 e 6 e 5 7 f 7 0 0 4 0 a b 8 1 2 f 2
C : \ U s e r s \ L i s a \ D e s k t o p \ g k T N U Y F L . e x e
C : \ U s e r s \ E l i o t t \ A p p D a t a \ L o c a l \ T e m p \ 3 d 5 5 f 6 1 c f b f 3 2 3 c e c 0 3 a 0 4 c 3 b 4 8 9 4 7 c c 4 8 3 5 5 f 1 2 . e x e
C : \ 3 8 3 3 4 0 a e d 3 2 6 c 7 b 9 4 7 6 1 c 8 1 a 8 d 1 e f f c 0 b 1 a 8 d 5 9 6 6 f 2 f d 3 f 6 a 1 9 f d 7 2 2 9 6 3 5 c a 5 3
C : \ 1 6 6 4 7 0 b 2 7 1 5 8 d f 8 f 8 0 3 0 6 8 3 e f 4 b d f 4 2 4 2 2 f f c 4 e 0 9 0 7 b 5 2 4 c f b c 2 b e 3 e 1 a 3 c 3 c 6 c
C : \ 2 9 9 6 b 6 4 2 3 0 0 d c 4 d 3 8 c 5 5 a 5 0 8 b 8 2 e 6 8 a 7 3 8 1 b 2 d a 8 3 2 e 7 e 6 a 3 2 a e 7 2 8 5 8 d 2 f 0 2 9 b 3
C : \ 7 d c e 9 3 7 4 5 6 3 e 8 1 c f 7 c 4 a 3 7 0 c 1 a 0 8 a 6 6 4 1 0 a 9 f 2 b 4 e c 4 4 0 7 3 b b 0 2 d b 6 9 9 a 7 4 5 c e f e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ S h R h 0 V z E . e x e
Process Tree
-
03f13804c6cfb27ba917e261774a97857c2a25643e211fbe4954d3d63dc6c17c.exe (2264)
"C:\Users\Administrator\AppData\Local\Temp\03f13804c6cfb27ba917e261774a97857c2a25643e211fbe4954d3d63dc6c17c.exe"
- budha.exe (616) "C:\Users\ADMINI~1\AppData\Local\Temp\budha.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 154.216.69.73 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| repairvideo.net | A 154.216.69.73 | 154.216.69.73 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 942a564ddc55b07a_budha.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
| Size | 51.3KB |
| Processes | 2264 (03f13804c6cfb27ba917e261774a97857c2a25643e211fbe4954d3d63dc6c17c.exe) |
| Type | MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS |
| MD5 | 4ec3095ad28770de5ac5ec171c829296 |
| SHA1 | 334a79b92e933fe92f5e55544ed6ea877bdf4dab |
| SHA256 | 942a564ddc55b07a5a13c5dc156a182d61b069ed269bcf5b973a924b726e037e |
| CRC32 | E810B5D3 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | eaecc563f2962807505b30ca1585802932c2733d |
|---|---|
| Size | 5.0KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | c51e18b3ed027dc96a9e9052b231bf63 |
| SHA1 | eaecc563f2962807505b30ca1585802932c2733d |
| SHA256 | b00fc69d91ded0308b019d98cb13fe13d308bbe0927424d067dfe128ece2b5e4 |
| CRC32 | CBC15044 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |