1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.55
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Crypt-QBY [Trj] | 20191013 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191013 | 2013.8.14.323 |
| McAfee | PWSZbot-FEV!2B42C7B0F1BE | 20191013 | 6.0.6.653 |
| Tencent | None | 20191013 | 1.0.0.1 |
静态指标
文件包含未知的 PE 资源名称，可能指示打包器
(1 个事件)
| resource name | PNG |
动态指标
在 PE 资源中识别到外语
(2 个事件)
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x00006aa8 | size | 0x00000ea8 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x00007950 | size | 0x00000014 | ||||||||||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 50 个反病毒引擎识别为恶意
(50 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Crypt-QBY [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Agent.C214041 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Crypt-QBY [Trj] |
| Avira | HEUR/AGEN.1006645 |
| BitDefender | Trojan.Ppatre.Gen.1 |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A5 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.0f1be9 |
| Cylance | Unsafe |
| Cyren | W32/S-db6096ce!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-db6096ce!Eldorado |
| F-Secure | Heuristic.HEUR/AGEN.1006645 |
| FireEye | Generic.mg.2b42c7b0f1be9b4b |
| Fortinet | W32/Generic.AC.3F7857!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan-Downloader.Win32.Small |
| Invincea | heuristic |
| Jiangmin | TrojanSpy.Zbot.dyea |
| K7AntiVirus | Trojan-Downloader ( 00457c511 ) |
| K7GW | Trojan-Downloader ( 00457c511 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=82) |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | PWSZbot-FEV!2B42C7B0F1BE |
| McAfee-GW-Edition | BehavesLike.Win32.Ransomware.mm |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| NANO-Antivirus | Trojan.Win32.DownLoad3.cmmqbt |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM20.1.85CB.Malware.Gen |
| Rising | Malware.FakePDF@CV!1.9C28 (CLASSIC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-AEJP |
| Symantec | Trojan.Gen.2 |
| VBA32 | SScope.Malware-Cryptor.Fareit.2913 |
| Yandex | Trojan.Agent!Vb4n6RSeE3Q |
| Zillya | Trojan.Bublik.Win32.12678 |
| ZoneAlarm | HEUR:Trojan.Win32.Generic |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-11-01 20:10:09
PE Imphash
33d83a79f3cbc53be8b6b26690442a41
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0000144b | 0x00001600 | 5.848638286508751 |
| .rdata | 0x00003000 | 0x000005a2 | 0x00000600 | 4.7874073256805 |
| .data | 0x00004000 | 0x00001278 | 0x00001400 | 4.198982471023779 |
| .rsrc | 0x00006000 | 0x00001ac0 | 0x00001c00 | 6.459814184545044 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| PNG | 0x00006138 | 0x0000096d | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x00006aa8 | 0x00000ea8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_GROUP_ICON | 0x00007950 | 0x00000014 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_MANIFEST | 0x00007964 | 0x00000159 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library gdiplus.dll:
• 0x353090 GdipBitmapGetPixel
• 0x353094 GdipGetImageHeight
• 0x353098 GdipGetImageWidth
• 0x35309c GdipDisposeImage
• 0x3530a0 GdipFree
• 0x3530a4 GdipCloneImage
• 0x3530a8 GdipAlloc
• 0x3530ac GdipCreateBitmapFromStreamICM
• 0x3530b0 GdipCreateBitmapFromStream
• 0x3530b4 GdiplusShutdown
• 0x3530b8 GdiplusStartup
Library KERNEL32.dll:
• 0x353000 LoadResource
• 0x353004 HeapAlloc
• 0x353008 GetProcessHeap
• 0x35300c LockResource
• 0x353010 SizeofResource
• 0x353014 FindResourceA
• 0x353018 GetModuleHandleW
• 0x35301c CloseHandle
• 0x353020 WriteFile
• 0x353024 CreateFileW
• 0x353028 OutputDebugStringW
• 0x35302c lstrcatW
• 0x353030 LoadLibraryW
• 0x353034 GetProcAddress
• 0x353038 GetCurrentProcess
• 0x35303c FreeLibrary
• 0x353040 LoadLibraryA
Library USER32.dll:
• 0x353048 RegisterClassExW
• 0x35304c CreateWindowExW
• 0x353050 ShowWindow
• 0x353054 UpdateWindow
• 0x353058 GetMessageW
• 0x35305c DispatchMessageW
• 0x353060 BeginPaint
• 0x353064 GetClientRect
• 0x353068 FillRect
• 0x35306c EndPaint
• 0x353070 LoadCursorW
• 0x353074 wvsprintfW
• 0x353078 SendMessageW
• 0x35307c PostQuitMessage
• 0x353080 InvalidateRect
• 0x353084 DefWindowProcW
• 0x353088 LoadIconW
L!This program cannot be run in DOS mode.
(X I6LI6LI6LI7LI6L1LI6L?LI6L?LI6L?LI6LRichI6L
`.rdata
@.data
3;t&L$
t$ t$$
VVVL$(Q
T$ RVVVD$,P
_^0VWt.S
@;r[_^Vj
0SUVW\$
F<|0xl0xL$0Q
WUVD$@VirtD$DualAD$HllocD$L
T$0RWUV
D$0D$@VirtD$DualFD$Hree
D$08R5
D$D|$$+
j@D$H@8h
++T$ $
X ((L$
t$ w G
ANu(L$ |$
uD$DHh
L$(D$
D$ @<
+;sQd$
UT$8_^][0
U|SVW}
D$@t$H
QVP8R5
T$ RT$
8++;sFq
;r^_3]
r^[_3]
PE^[_]
$VWh05
_^$SUVW
F3_3^]
3+t;Ht
D$ _^[t
NtQueryInformationProcess
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipAlloc
GdipCloneImage
GdipFree
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipBitmapGetPixel
gdiplus.dll
LoadLibraryW
GetProcAddress
GetCurrentProcess
FreeLibrary
LoadLibraryA
lstrcatW
OutputDebugStringW
CreateFileW
WriteFile
CloseHandle
GetModuleHandleW
FindResourceA
LoadResource
SizeofResource
LockResource
GetProcessHeap
HeapAlloc
KERNEL32.dll
wvsprintfW
SendMessageW
PostQuitMessage
InvalidateRect
DefWindowProcW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
GetMessageW
DispatchMessageW
BeginPaint
GetClientRect
FillRect
EndPaint
USER32.dll
PB"BBBBBBBBUBBBBBBBJBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBXBBB
BcfUbfOo,FL
BBBBBBB]^
E474E4
e4E48M4E48M4E4
E4BBBBBBBBBBBBBBBBBBBBBBBBHBBbB'
BBBBBBBB^B
BBBBBBF@BBB@BBBFBBBBJBB@BBB
BBBbBBBBBBbBBBBBBNBBBBB,ZBB
BJBB@BB@BBBB@BB@BBBBBB@BBBBBBBBBBBfBBBBBBJBBbBBBBBBBBBBBBBBBBBBBHBBNBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBFBBBBBBBBBBBBBBBBBBBBBBBBBBBBBMBBBS"BBB@BBBBBBBBBBBBBBBBBBBBFBBN
nnBBBBBFBBBBBBCBBBBBBBBBBBBBBJBBJnnBBBBBBBDBBBBBBBBBBBBBBBBBBBBBBJBBZ
.BBBbBBBJBBB
BBBBBBBBBBBBBBBBBJBBJ
.BBBBBBHBBB
BBB@BBBBBBBBBBBBBBJBB
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB$Ze
C3S@J%
B3rCBB($FFJB2]C
bFJBBFBBGFJB3FJB
DFJBOB@BBBFJBOFJBOPFJB
KFJB2@ORBBB
bOBBBR
FJBs]2]C$ZJ){:HFJB3EFJBs_3_jH
h_H]FJB
AFJBZ0BBB
H3\":H_ORBBB
FJBs2]
FJB]3@FJB
OB@BBBFJB
OFJBJFJB
]"zK/{GbXBBB3M"M@"\@FJBs]?
]r]FBB#FJBZ
OWFJBFJBs_%t3OFJB
"O5bBBOXFJBH?
"O5bBBOXFJB_s]%3FJB[FJBFJBsX?bOBDRR[HOAfJB]s%
IFJBrBbBBH
YH^HOBBFsYs^NFJB^
%^b\?YORBBB
OBBBJEfJBFJB3YH
\(FJB(@FJB
HOBBBCFJB
HOIfJBHKFJB2@
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
&BBI&BB
&BB&BB&BB
&BB&BB
&BBA&BB&BB
&BB&BBBBBB\&BBBBBBY&BBBBBB
BBBBBBOBOB.B
BBnBBBBBMBBBBB,BB,BBBBBBLBBBBBBBBLBBnBBB,BFBBBBBBBnBBB
BBBBB/BoBBBBBB,BB.BBBBBBBBBMBBB
BBBBBnBLBLBBoB.BnBBoBBBB
BBBBOBBBBBBBBLBeBBBMBBBBOBOBBB
BBBBBMBBBBB,BBB,BBBA
BBBBBBBBBB
BBHFBB[fBBBBBBBBBB
&BBBFBB@
BBBBBBBBBB&BBKFBBC
BBBBBBBBBBBBBJFBBBBBBBBBBBBBBBBBBBBBB
&BBI&BB
&BB&BB&BB
&BB&BB
&BBA&BB&BB
&BB&BBBBBB\&BBBBBBY&BBBBBB
BBBBBB
BBIBKLL
mLoBBBk
LoBBBKL(
mkBBBk
KnBBabMoH
LHnOBBB*
,KnBBoBb*
BB$",L
b(OM.B(K$
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBbBABBBABBRBBBBBBBBBBBBBbBbBBBDBBRBBBBBBBBBBBBBbBcBBKBBBIJBB
bBBBBBBBBn,,
,.On,o.
,.On,o.
FFFF,.
FFFFFF
FFFFFFFF
l,M.oF
Foj..,,
FFFFFF
mHjHjkIIHjkHjkIIHjkHjkIIHjkHjkIIHjkHjkIIHjB@BBNBBBdDDD
DDDQDDDDd
dddd0dVdddd
$d$$$$/$
$BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
IDATXG
m`s8Ji
qL$Z(t
5iQC ABu(@U
|m|<9J
-NM^&dwk/k<~3^B()
g=rF=z /!-
gl:c0Ck1iL
<m*R6&m%XFS
{>LedfF~S~iwIycr%
'oDnf/'w^r<5}
2@|42v
jL8Hz<1
V?M !Im
03MWY (:3t
n!v'!S
?XlP /#t?$;h9
apMlob
q7pd*!)
WEKj9FN
[BBYblIhD-
bqkKU!Q<y
^b]5\X_
yOoDfO
/6wW?]&v
niJzTl
tcp58=1,A`
+\=,Dc~( t
5fr s+j
,o\U_Z
-\4hM"W^
%K*(N^
N!UQBY
k"Wsi!VV
Ua_gx[
fX+M4Tz
,eD~4>
Y7#Xj
,r5:i90;o/
ltmvN]~mg;kmq
Rs+mu${
qM^x7ICvtLS
IENDB`PAD(
#######
###;KK>
26;2+##########
#########
#####+bEXL
+######+
#####3
######3#
PD[>J22Ib|tLx63
#######3#>>
vDDP>2
########3+ug
DW[[FvV####
########3#J~~3#5gJIk#
3333333333+g +zT
##++++######
3333333333#J%Tz+33#3333######
33333333333+
#33############
33333333333@II#333###########
33333333333@+333333#########
33333333@?a
+233333#3#######
33@j+23333333#######
j@33333333#######
+jj23333333333####
+I@3333333333##
2+@2333333333#
al233333333
$$$2333
&&&&$$
7:::::::****************ss****@$$$$$
788888881;111n;;;11p;11111111;
))))))
o,,,,,,,L6,6Lr66rq6,,,,,,,E
)f/HHHH/
8(((((,Lx|>>Eq6,(,((,EM&/-999N/
K((((((XmV#R?DlV((((((EMC/N9<<<<<
,444444X|JJVT
DRmXF4444F4VMC-9<UUU
(444444X3?
DPIDP#F04440tM
4000000y2WIWRIuRI
0000050
5y{kkJ0? D~`f9f
0%%%%%%_
3^%%%%%y`f\f#
%%%%%%%%^_a%G_a%%G=%%%%%%^`f\f#
%%%%%%%%%BB%%%BB%GG%BB%GGGGG%G`f
G.......'''''''''''''''''''''.
-----------------d-)/
&&&&$$$&
$$$$$$$
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="true"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGC
5 n t d l l . d l l
G K E R N E L 3 2 . d l l
C : \ D O C U M E ~ 1 \ A D M I N I ~ 1 . V M G \ L O C A L S ~ 1 \ T e m p \ 5 8 5 8 D 6 3 9 E B D 8 F F 2 5 6 B 8 7 4 8 B 3 0 E 6 4 8 1 0 A A D 2 2 5 D 5 4
C : \ 9 3 3 2 3 b b d 4 e 2 2 8 9 0 2 1 a a 3 6 1 7 7 0 d 8 5 0 b 6 9 e 6 b c 3 2 c b 0 b 9 c 5 8 f 8 1 7 a 6 b 1 3 9 9 1 d f a c 9 b
C : \ U i k 3 Y 3 B Z . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ f x l A n 0 Q U . e x e
C : \ d e d 6 c 8 7 4 c 2 5 9 d 2 b 5 6 3 1 5 9 d e 5 d 4 7 b 9 7 4 b a c c b f b 8 3 0 d 0 d 7 4 2 1 3 7 2 3 5 7 d e b 2 2 3 d 7 b 2
C : \ a 8 e 7 5 9 5 b b 8 4 a c 7 e 6 a 9 6 6 a c b 8 2 7 4 8 9 5 d 4 6 a 4 d 6 a 7 c 6 5 a 1 8 a c 3 c 1 c e 5 5 4 1 1 f 7 f 0 9 7 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ J d a u 3 Y R C . e x e
C : \ 6 2 5 3 1 4 c 8 4 4 4 1 e 1 1 e 5 c 5 5 0 d 7 7 1 c 2 b 4 6 a 2 4 8 9 6 5 1 5 6 9 1 2 c 3 e 2 8 8 b 0 c d 2 7 f 2 8 9 5 e 8 e 7
C : \ e e e 2 0 5 2 c b 3 2 8 f 9 d f 4 9 3 f 2 0 9 b 8 f 5 3 7 b 9 f b b 9 6 a c 5 e 4 5 f 5 9 0 6 9 1 9 3 1 3 4 4 d a 0 e c 2 2 b f
C : \ c 6 3 0 c a e 7 7 f 6 a b 6 6 c d a 2 8 3 3 d 7 e 1 9 f f a 4 3 7 8 e d b 2 6 f 8 f 6 1 3 d 8 0 0 c 8 c f c 3 e d e 8 e e b 7 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ y v v 2 3 1 D f . e x e
C : \ 0 4 1 6 f 6 7 b 1 c 6 8 3 5 a b e 0 9 c 4 7 3 b c e f 4 4 a 2 2 9 0 a 8 9 2 0 5 5 8 8 0 6 7 d e 0 7 1 c 2 7 5 2 f b 4 4 d 9 c 9
C : \ 4 7 b 1 d a 8 3 c a 4 7 1 c f 0 9 4 8 b 6 6 3 2 c f 2 b c 0 4 0 f 0 9 b a 3 1 5 a 1 f 5 6 3 6 8 3 0 4 5 c 0 c 8 4 8 e e 7 6 4 9
C : \ 6 3 b 5 5 9 b a c 2 1 9 1 b 1 f 5 b 4 2 e b 3 1 1 7 b 7 8 8 a 5 c 1 4 e 1 7 c 3 1 e d 7 b 3 f d 8 f e 3 7 a 7 d 7 d f 4 5 3 1 5
C : \ 3 4 b 2 a a b c 6 d f f 7 6 7 5 2 4 4 8 2 6 e d 3 5 f d d 5 a 3 2 0 d 6 3 b f 9 e 6 c 4 5 1 5 2 0 c 0 6 9 c a 3 b a 1 6 8 7 c c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ E 3 P 2 B L p w . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ a 5 3 2 0 4 2 9 6 e 5 b 8 b e f 4 0 a 4 c a f 9 e 8 f f a 9 b 5 c d 7 0 1 c 5 d 1 5 0 1 6 b 0 3 1 d b 9 f 0 4 a c b 3 3 5 1 0 5
C : \ e 4 4 9 c 5 d 1 4 8 0 3 9 2 6 e c 7 c d a f 2 2 d e 5 5 5 1 a 4 c 7 0 9 6 1 6 5 3 1 b a 0 b c 0 1 a 3 c 3 4 9 1 4 6 1 3 c b 8 5
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 4 4 c 5 3 b 4 f 6 d 8 a 7 4 e f 2 0 2 3 9 e 7 2 1 4 4 3 9 5 b 7 0 9 9 6 c c 0 4 8 9 f 7 c b 9 8 3 9 e b 6 a c f 4 0 0 e 6 a e b . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 2 f c a 3 a 4 9 6 2 b 2 1 f 5 e a 0 4 0 7 3 2 f c 3 c c b a 6 9 f 8 7 1 5 3 e f a e a f 8 8 d 1 0 2 c f 5 5 3 6 8 e 5 9 f b 0 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ W u u I v t I G . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 4 b 9 d 9 d 3 4 3 4 2 e 8 c c 0 5 a 2 d 5 b a 2 d a 5 5 7 0 d 5 6 e 7 5 3 7 b 7 a 4 5 a 8 c f f f a 5 c 3 8 2 e 9 3 1 0 0 4 7 0
C : \ Z O x L P K s H . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ e e 2 8 c 3 9 e 8 0 7 0 2 d 2 8 1 2 f 9 4 b 5 b 2 b e 8 c 4 2 5 e 9 9 2 b 1 0 6 5 4 4 7 7 b a 2 a f 1 6 9 8 e 2 3 8 7 5 0 4 6 b
C : \ 8 5 2 9 d 9 d 4 3 f 8 e 9 2 f 7 7 c 3 a c 7 5 2 0 2 3 9 8 3 a 8 4 6 8 6 5 c 9 d 0 a a 7 6 2 9 5 7 5 f f 7 f e e 9 c d 9 9 9 3 d
C : \ 2 8 5 8 2 e e b 3 c e 6 a b 4 d 7 e 1 e e 6 7 c e 6 6 0 c 1 f e a 3 2 9 5 5 2 d 8 6 b e a 3 b c 2 5 1 f 3 1 2 b f f 7 2 8 f e 0
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 7 6 8 b 5 6 9 9 a 3 9 c b 9 7 2 7 c e 2 7 6 6 6 b a b 8 9 9 c a f 0 d d 4 9 1 1 3 2 2 5 e 5 f 8 e 0 6 6 a a 8 e 4 e 7 b c b 9 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 5 8 5 c c 7 9 5 4 4 3 0 f 7 7 e 5 0 a 2 2 a e 4 8 4 1 a d 0 5 d 5 6 b 3 1 e a 8 3 4 1 0 b 7 1 6 b 6 1 b b 7 5 9 5 0 8 f 4 5 c e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ A e B 0 H 6 e W . e x e
C : \ 5 c c e f 6 b 7 c 7 2 9 0 7 2 9 f 9 7 b e d 1 0 4 b 2 1 7 b a 6 e 9 b f c a 4 5 3 3 d 5 c e e 8 b 5 5 9 c c 8 8 1 5 c 9 0 8 8 c
C : \ f e 4 c e 9 f 2 d a 5 3 8 f 8 4 1 5 b 4 2 9 0 b 4 9 9 9 5 7 9 8 c b b d a a 1 6 d d e 7 d c c e 8 9 3 c 3 9 6 f 8 5 e e b 2 c 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ v q S z 4 y e T . e x e
C : \ f e 6 c 1 a 6 f d 6 9 9 c a 4 7 b 8 6 e a 9 9 6 b a 2 1 0 d 9 7 f e 8 4 3 7 e 7 8 e 3 c 3 d 4 b b d 6 6 e e f b d 1 9 0 0 a 1 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ e 9 3 9 f 1 3 b 4 6 d 3 9 6 a c 1 5 a b 3 3 f 7 8 e 9 9 0 8 0 9 6 3 7 9 f d f f 0 c 2 c 7 a 2 9 c 2 0 4 d 2 f b b 9 1 0 3 d d a
C : \ f 5 9 e 1 7 2 a c e 5 3 7 5 b 1 0 2 2 a 7 5 5 6 9 d 9 9 1 c 4 0 4 0 d d f c d 2 4 e f 5 b 0 3 7 b 8 7 7 0 1 8 7 9 9 b 5 d 4 f f
C : \ P 8 G K c 9 m j . e x e
C : \ f 8 9 c c 8 f 9 7 0 c 4 0 b 6 1 f 2 d 5 4 1 5 1 4 a 5 9 e a e c c c 9 4 0 1 6 5 5 9 1 1 7 d 4 f b 5 9 3 3 5 5 c e b 6 4 4 a f b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 6 1 d b c 2 a d 7 a 7 e 3 4 a 6 7 6 1 2 7 c 4 7 b a 6 4 a 3 a 4 3 b 2 c 5 a f a e f 1 3 1 7 b c d 9 8 8 0 9 d f f b 5 6 8 9 9 e
C : \ e d d 2 e a 9 f 0 7 1 0 9 3 d c a 3 4 2 e f 7 d 6 6 9 5 8 c f 4 b e 8 7 b 0 a d 2 2 8 8 3 0 1 0 7 d a 1 6 a c a 3 a 7 4 f 1 1 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ b 3 4 8 6 d 6 d 3 3 c 2 d 2 7 0 c c 5 b 3 3 5 7 a c 9 d 5 b 2 9 f a e a 6 9 6 e a 7 6 0 e 9 f 9 c 6 d 3 c 6 9 0 f 8 2 f a 9 9 4
C : \ 6 e 3 b 6 f 1 6 b d 2 5 b 9 5 c e 6 a 4 7 b 7 d 2 3 4 3 a c 6 4 f f a a 1 9 8 8 5 3 0 3 8 f 0 b a 0 e 9 f 3 9 0 6 0 7 2 a c 8 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 1 3 2 f 9 8 f 9 d 4 0 8 e f 5 e d 9 5 9 2 9 4 d e f 7 d 4 1 b 3 2 d d 1 8 9 3 7 a 8 b e c 5 e 4 1 5 6 f 3 6 0 a c 6 7 5 a e 0 f
C : \ 7 a b 2 c 5 0 8 1 3 4 3 0 4 f d 6 1 3 b e a 0 3 1 d e 7 c 0 2 0 e 0 1 6 f 9 f a 9 f d 6 f 7 1 2 f c a 1 2 0 1 1 7 7 d f e b 0 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ c a 9 9 e 7 c 1 3 3 3 7 3 5 e 1 0 5 e 6 f 8 5 1 9 7 4 1 a 2 d b 0 b 0 7 8 0 f a 5 0 a 5 a 9 f 1 3 5 9 4 2 2 1 0 f 8 1 6 7 9 e c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ b d 4 a a 7 2 5 b 2 c f f 8 b a 4 9 7 f c 4 c c f e 1 b 1 f 0 a 7 d f c a f 0 5 4 5 5 2 6 e 4 a 1 3 f d 0 7 7 8 b 8 3 7 7 e 4 9
C : \ a 4 6 e f c d 6 2 5 d 4 0 a 0 4 3 8 4 e b 6 8 d e 3 2 d b 3 e 3 5 4 f 1 c 7 b 6 2 8 0 c f 4 c b 2 4 e 1 1 a 8 6 9 6 9 1 9 e 9 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 3 3 a 5 a 2 7 a 3 a 3 d 2 9 d 5 a 8 1 a d e c f 5 3 4 5 7 3 4 6 1 0 c 2 6 b 2 0 0 7 5 1 b 4 7 5 8 f a d f d 3 1 7 8 f 6 6 b 2 4
C : \ 6 b 5 d 1 3 0 e c 2 9 6 6 e 3 6 c b 6 4 9 6 a c b 0 9 c 3 4 0 b b d e 8 3 a 2 1 6 e 2 9 4 8 3 8 1 d 4 5 5 1 b 7 c 0 6 a 9 a f c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ d 4 6 5 7 5 0 2 3 0 3 6 e 6 a 2 a 9 2 4 8 7 7 5 3 f 6 2 c 0 e d a 1 b 3 a 8 d a 4 2 4 9 8 3 a 0 1 b a a d a 1 4 c 0 e c 0 2 e 3
C : \ d 8 2 5 f 4 e 6 0 d e f c 3 9 c f 5 2 5 c 4 2 b 8 6 3 1 d 8 8 d d 3 e b 5 d 7 1 4 d e 9 a 8 c 6 7 2 7 4 b 9 9 7 9 5 3 2 c 9 c e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 5 2 6 5 e d 6 0 2 e 8 9 a 9 0 6 d a 3 e 2 f 3 b f 7 d f 3 6 b 7 c e 5 e c 9 2 9 4 4 1 e f f 8 c c e 7 9 1 4 f 1 d 2 6 f 3 e 2 f
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 9 d e 1 2 c 4 3 b c b 9 3 2 0 c f b 8 9 1 d 4 2 6 d 7 7 b 1 d e 0 3 4 0 c e 3 c 0 4 0 4 9 c 1 3 f 9 9 f b c 6 8 4 1 d 3 b 6 9 a . e x e
C : \ 5 5 f f c 2 3 f 2 d 4 c c f 2 6 3 1 4 c b 0 7 1 a d b 7 e 2 a f 1 2 c c 0 0 b c 5 0 7 c 5 2 8 c 8 0 2 7 f 2 2 f 1 a a 6 0 f a 5
C : \ e 3 2 9 a 4 2 f 6 8 d b c b a a 1 0 4 3 d c d 1 1 8 5 a 5 9 f 7 2 6 8 4 6 3 0 c 9 2 4 0 d f f 2 2 8 c b c 6 8 c 6 1 a f a a b 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 9 3 d c 9 b 6 9 1 0 c 5 6 b 3 f 0 a f e 4 9 9 7 c e d 7 c 1 1 1 8 d 6 d 9 6 d 7 6 8 6 0 c 6 b 5 8 9 1 9 7 0 4 8 b d c 2 7 d b a
C : \ c 8 2 f 1 6 d 0 8 5 2 1 6 0 f c c 5 a b 1 0 8 3 e 9 d 0 d 0 f f d 8 b 9 d 3 a 1 5 d 1 5 4 8 9 f d e 9 b 7 1 f 7 9 e f d e 4 b a
C : \ U s e r s \ A D M I N I ~ 1 \ A p p D a t a \ L o c a l \ T e m p \ 7 3 b c a e 9 0 1 f e e 5 c c 2 c 0 9 d 8 e a 3 e 7 9 f d 6 1 0 d 9 d 7 4 6 f 8 . e x e
C : \ U s e r s \ A D M I N I ~ 1 \ A p p D a t a \ L o c a l \ T e m p \ e 6 5 d b 3 1 8 b 4 7 b 5 c 6 b 4 d 3 5 7 5 b 6 9 e 7 e c 6 e 1 9 2 0 f 6 4 f 9 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 d 1 e a 9 e 4 9 f 7 f 8 f 9 a b e e b 6 d 2 f 2 8 d 1 1 a 8 3 . v i r u s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ H R U x 5 M a h . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.