1.3
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.97
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-ASIV [Trj] | 20200326 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.c | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200326 | 2013.8.14.323 |
| McAfee | GenericRXIH-CT!A8348DC6466B | 20200325 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b078bd | 20200326 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x00009000', 'virtual_size': '0x00003000', 'size_of_data': '0x00002800', 'entropy': 7.750771030870659} | entropy | 7.750771030870659 | description | 发现高熵的节 | |||||||||
| entropy | 0.47619047619047616 | description | 此PE文件的整体熵值较高 | |||||||||||
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.Agent.BALW |
| APEX | Malicious |
| AVG | Win32:Agent-ASIV [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Agent.BALW |
| AhnLab-V3 | Malware/RL.Generic.R256208 |
| Antiy-AVL | Trojan/Win32.ShipUp |
| Arcabit | Trojan.Agent.BALW |
| Avast | Win32:Agent-ASIV [Trj] |
| Avira | HEUR/AGEN.1044611 |
| Baidu | Win32.Trojan-Downloader.Small.c |
| BitDefender | Trojan.Agent.BALW |
| BitDefenderTheta | Gen:NN.ZexaF.34104.fmNfaqWz3vfi |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Trojan.Generic |
| ClamAV | Win.Trojan.Zbot-64721 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.53fd94 |
| Cylance | Unsafe |
| Cyren | W32/Upatre.HS.gen!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.Agent.BALW (B) |
| Endgame | malicious (moderate confidence) |
| F-Prot | W32/Upatre.HS.gen!Eldorado |
| F-Secure | Heuristic.HEUR/AGEN.1044611 |
| FireEye | Generic.mg.2c0f0ca53fd94dc2 |
| Fortinet | W32/Mdrop.AAB!tr |
| GData | Trojan.Agent.BALW |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.edzjq |
| K7AntiVirus | Trojan-Downloader ( 00457c511 ) |
| K7GW | Trojan-Downloader ( 00457c511 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=84) |
| Malwarebytes | Trojan.Injector |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericRXIH-CT!A8348DC6466B |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.mt |
| MicroWorld-eScan | Trojan.Agent.BALW |
| Microsoft | Trojan:Win32/Wacatac.C!ml |
| NANO-Antivirus | Trojan.Win32.DownLoad3.cjxpzu |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM11.1.2307.Malware.Gen |
| Rising | Downloader.Small!8.B41 (TFE:dGZlOgUqcqQ6nqVYfw) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Mdrop-FLP |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-02 20:59:11
PE Imphash
b87535261f3aabcbc0671e73baadce5c
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00008000 | 0x00000000 | 0.0 |
| UPX1 | 0x00009000 | 0x00003000 | 0x00002800 | 7.750771030870659 |
| .rsrc | 0x0000c000 | 0x00003000 | 0x00002c00 | 5.07456226037999 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000c150 | 0x00002668 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000e7bc | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x0000e7d4 | 0x00000198 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x0000e970 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library gdi32.dll:
• 0x50eb1c CreateFontIndirectA
Library KERNEL32.DLL:
• 0x50eb24 LoadLibraryA
• 0x50eb28 ExitProcess
• 0x50eb2c GetProcAddress
• 0x50eb30 VirtualProtect
Library user32.dll:
• 0x50eb38 EndPaint
L!This program cannot be run in DOS mode.
^|S^|=
^|I>|h^|+
^|Rich
c,.Y.P/O19v
"8u&7F
IuZw;v;Es"nZG}
KuRGF!u_+
Pf__Y{6s_8b
?%|5tsR^
VdO<m^e
z]qq ~
Ni*gLVK
xJ9uqL
%oMZ7^
uIH</SSD
.f}Dm\t`
<hU(n
` a2Ou
mcnEC3nmD
Jou"kR
+f{~h
tJ^[qg]
ZwV?6NBZ
9C~ tVe
gggNaEv[VR
g>*g|sL%
Tz` ?d
wnK'RIl
g2Z)JxJ
0LY |'"
*goLeB
x78af2z.K
&?+q{CI{
?gKWhT
b6f>6.'!Z
V_45o.
kscdS
h@^:lu
3cppuE-a[P3tepP}1f,
am[Qu(*sA
2ce*Vx i
C2ma/n
<-2ShPsrtWd@@aCm
0(djcHl9s
,2(F"yup2=cc
tst<0xA
2 xcE7l
eo;1s+Wsus7;a
T*lUfJ+
j@h5h=
l@a5m&
@;sy;s
+L{lw@
~uru# 4B
M3@jZM1{ W?
r`E`0)V
I,dr!]v
,m>/Wn^}og@
u _0j(
V4V"lW
La0$vk {
>Rsa C[SXP
"Zpt}=fcj<
(I^wWu
G'1q5/NL(
LIEdc`
CE?ikQ7
hXPt|W
_Ehl<lSVh
B.'c9]e
WUiV%>hK.R
/.M _<
PEpi /SO1
<ckUyj9XrW
rTq|p x'sp
/p/01$
u$<2D>3
"_u9NL
n8tP/D
ctc|uuBQ
jj|j(h6m@
AMY,h!\FBY
_j"h|@,e&JE6}p|*
8hDD;[
h(8vfX=)
u.EPdC
hCE47um=6jz
~$8u3f
o7=>yuJ_H
oP*6[D"X
%Th@dI C
hTVUWa5
h`FzZY
S5Pgd Bru
j<dl{rQ
=^l<uUulq
2xto`uXz
0,aYd\{
QOH{zJ;
V povrK
/mnG@ICW#
P =dO#
thVVjk+
cr eto Rllj
R f`22
Wyb [`
Cu5Mz3
|hZFe4M8&
'arokXbegi
last."
Jib~+:dbutto<wa0
^-nnGP"
CL&d22L&&dl2L
R,tCAjp!ei
_OhJiS
Xpps-"
tAWtsgeu;[chli
#VErTir
bWut@$x
- B^
M'l#PB
t@ _^,#
vus`clt
1EJ2TE
GetLastErrorl
ModuleHand
[kc FA
5essag
Close
Nex)De
rea!t}
ontI.y}{ect
<PGtQui
Upd;Wvvow
ch)B2w;
Trsl8T,B
mEx:Rera.n{
mh*}oy\Loa>
IcgnX4h
j2@.&Sw /8't-mOs2
XPTPSWXaD$j
+ F<e]xq:/
9.OGhaRH
VNvnmf
gdDA;8
lVOUOUOUOUOUOVOVOVOVOVOVOVPXQ_X\VUOVPVPWPTN
wwwsssxxx
dZdZ:-,
- - - - - - - - /"
- .!w- -
- - - - - - - +
- / / / / / / / / / {0!/ / `T/ / / / / / / -
/ 0!0!0!0!0!0!0!1"J=REQD5&1"J=RE0 / 1"1"I<SFSF9*0!0!0!0!0!0!0!/
1"2"2"2"2"2"2"2"1!)
2"3#3#3#-
2#5%5%5%5%5%5%5%4%
2#3#3#3#3#3#3#3#G9H9H9B3A3A2B3B3A2A2A2A2-
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
gdi32.dll
KERNEL32.DLL
user32.dll
CreateFontIndirectA
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
EndPaint
L!This program cannot be run in DOS mode.
W*6D6D6D6)W6D?6D6E6Dd
6D6D6Dd
6DRich6D
`.text
.rdata
@.data
.rdata6
@.rdata4
@.rdata3
@.rdata2
@.rsrc
]U]U@E
]U]UQE
]UQEPh
lUR\Ph
skRpP=
3_^[]U
`fuPMlbACgseLp
kl`dcjcr>qxE'B
k`dicrpxE
K`nndA
pdaeGie@
ourauA
euWmeopEifbtpqxA
XfuMxgtlzK`nCodW
k`dicrpxEA
esnn22
owcv/dg
rvwcmo/dg
z`lco|
qlstJdmA;gnc
Rila/Qhe0JgF6gd
_`pfmo
_snf22
_uPibeuIer
v kgi hn"b
lnKSkd
`5>b>b>bb>b5b
a$a5b>b%b>b5b>b
Cqgb
W6q_hdwD VjV
D F`V~
B*S3_
2-H ]|H g
`q+C~:7yC ]] |] ~ow#W
cX~5NY
Zr^\+,
rAj\Q.W1
HCklFD
/QGCKp@FQ{
?{+cHo
5vrgT `
*QHO6:j)&
eqjNjkv)5`fo
OOaXhp
Ejk)-p\
`y 1ycr
*xj9R3MG ]Y [$z_
(v}55lARB
B~* CD ~
"3CD |
q9G}+C
t;Nd_Q\PQA*)
W{q@hL
1?(S-W
b Q|8f|
a}V#+c@
{W+WOGbHU
g8pC zc(O|j_G
9z |<|Q4q@'|?4zbm`Bzjby}`
Fe>0N6b
*8ryGeM
wy;6>9U
p)#x9x]
NktRRRRRND6PA
ROAjj|S
PPOp~t(L
UNQhfE
Mmo0_x
eW'x'X:xR
NCxjGBC
tc.$`3b
P;sPjm
jR@ eGU~dApTvljXl
mm:o'}*_5
s2gi3c'
Pl_^yTdF+A
A@ Q`
)D{G'c4
^aP3@4
4D$Om2o
AmtfQHd
qT#ibpL#
bpL#?3
]dpVeL
FR@ a
E^3QIm
z0e$wk'|1
'7F3Z|
aA%O|A
u)?83^TAJ
QX`jM^00
U@ yrc
kH zoF
vpH [L
/]{Ec@
yHOW;W
N~^?47
;aC v<xP<Bv:Mb~
a]B=zMe$3q
3ccA$`@
v%>W#Q
x(]Y [
xE(x[ 3q7NCxk 4I;.C
c/3x51
[tbW^Zp
Lyj+u6bH
YL4ABM
V_Q3o@6;M$1Q
'tV5+5P
Esh0Hw6
A6 sf
~C|G `j
Sbq@tSq6PSfq@FtCwt
^l${D .
-7(_/O'
Lo\5j4O;
]dEV.p@F|@
dGsRD`
Ck)1V+
QP6WQ<
AYEo=v
\/(7 yLW
PSlmyPjX
{TV 37
)Qap^#
8d20d
`'SBz^
I D R _ V E R S I O N 1
V S _ V E R S I O N _ I N F O
F i l e I n f o
F F F F 0 4 E 3
F i l e V e r s i o n
2 . 0 . 1 . 7
P r o d u c t V e r s i o n
2 . 0 . 1 . 0
C o m p a n y N a m e
S a n n y L t d .
P r o d u c t N a m e
L o o k F o r
V F i l e I n f o
T r a n s l a t i o n
C : \ U s e r s \ j b a y u e l o \ A p p D a t a \ L o c a l \ T e m p \ R a r $ E X 0 0 . 0 6 0 \ I n v o i c e _ O C T - 0 2 - 2 0 1 3 . e x e
C : \ 1 5 f 7 b 8 4 a 4 c d c b 5 0 2 e d d c 6 5 7 a 7 3 e f a 5 7 4 e 9 2 c e 8 e e 6 c 1 c b d 2 9 4 a f b 7 8 e e 6 8 b 3 4 0 a f
C : \ j d Q T w 6 v 9 . e x e
C : \ S i c l i o 3 q . e x e
C : \ k k U F L u b y . e x e
C : \ D p A A K V 4 u . e x e
C : \ x z s 9 W i J w . e x e
C : \ l m 6 c f 0 B d . e x e
C : \ r A P O i j g M . e x e
C : \ L P t z E t a u . e x e
C : \ c 3 d 3 f f 1 4 f 9 5 b 3 a 8 f 7 7 1 6 d 1 8 c 2 0 0 4 9 8 9 d 4 3 1 d 9 d f e 2 1 c f 3 6 8 e 9 0 d 6 9 9 8 e 3 7 4 0 0 d 8 d
C : \ n 0 S d Z l z y . e x e
C : \ h n g G c o a 0 . e x e
C : \ t t T g X t c a . e x e
C : \ 6 1 q A Q j K W . e x e
C : \ d f f 2 b e 9 2 3 8 b b 5 e 0 2 4 2 6 6 0 8 5 c f 4 d e e d 3 c 3 c 9 a 6 f 6 1 8 b e 1 f 7 2 d 5 c 6 d d 0 b 7 f 8 e d a 3 c 2
C : \ b 5 0 0 6 4 e a 3 e e 9 1 2 8 6 f e 3 3 c 2 f e 0 6 2 5 e 5 7 7 8 f 3 f e e e a c 5 0 7 d 1 e 9 8 8 3 b 7 f f 2 9 0 3 d e 6 c 7
C : \ 0 Y D Y V X 8 K . e x e
C : \ M P m f n s p F . e x e
C : \ n c e 7 c 9 H g . e x e
C : \ H z n 2 w L x p . e x e
C : \ L S s C V y 8 I . e x e
C : \ g w O E U 6 Z z . e x e
C : \ W Q j M y C W V . e x e
C : \ _ o Z 1 X 5 V b . e x e
C : \ D j 9 G D s J S . e x e
C : \ C d p 9 k F O q . e x e
C : \ U O G o y J 1 r . e x e
C : \ 9 n p _ 0 z p F . e x e
C : \ r A L h _ 5 o 6 . e x e
C : \ x V f m q V p E . e x e
C : \ M j D N b u u X . e x e
C : \ F W g N M 5 k V . e x e
C : \ 4 M I G w j O Z . e x e
C : \ 2 e 9 5 b 1 2 a 0 9 e c 8 d 4 9 d 8 e f 2 1 7 2 2 5 a 5 e 1 9 a 3 b 3 1 f e 1 9 6 e 7 a 6 7 9 6 6 8 c 4 6 e 4 7 a b 2 0 5 e a 7
C : \ F 4 1 3 p o N v . e x e
C : \ x a w p _ i q F . e x e
C : \ V I F T a B Y p . e x e
C : \ I U C G d Q t r . e x e
C : \ t 6 m p W Z n U . e x e
C : \ 3 L j l 2 O E J . e x e
C : \ Z R o 1 8 4 a i . e x e
C : \ h v m 8 E c B I . e x e
C : \ N 6 u H V N R U . e x e
C : \ e 9 a 2 b f 8 7 1 5 1 b 2 3 6 b 8 2 b 4 f 8 8 6 e 0 5 5 e 5 0 9 f c a 3 c 3 0 1 4 5 1 e 7 d 5 3 b 6 f e b 8 8 4 2 6 0 e 4 5 4 4
C : \ N 0 j 4 Q r B 2 . e x e
C : \ F B J H m o t D . e x e
C : \ x a H y O I u E . e x e
C : \ c a _ r K a D C . e x e
C : \ h N b p T M V L . e x e
C : \ b G n m o p 1 x . e x e
C : \ D O C U M E ~ 1 \ c u c k o o \ L O C A L S ~ 1 \ T e m p \ a f d 0 d f 9 6 0 7 0 c 0 4 9 8 3 8 0 4 3 8 2 3 c 0 5 6 4 5 f a b 2 1 c 4 3 b 5
C : \ v d A 3 c 9 A t . e x e
C : \ s R V z B X y T . e x e
C : \ u X Q B 8 8 u M . e x e
C : \ n P L L I j 6 F . e x e
C : \ 2 c 0 4 d 7 9 9 2 6 1 6 8 f 9 e f d e 8 3 4 0 6 b 4 a 3 6 1 4 5 6 0 b d f 0 c 2 8 a 8 4 6 0 f 1 7 0 e f b 3 8 1 8 2 7 b 5 6 2 0
C : \ 1 c d 9 a 4 6 8 0 c f 7 1 7 a 7 1 1 9 6 0 c b 3 9 0 0 0 0 b 0 e 3 e 5 2 9 b 9 3 4 8 e 9 e 0 5 7 d 6 3 3 5 d f d 6 c b 9 0 7 9 c
C : \ a f 2 8 4 a 7 7 0 0 6 6 c 0 6 5 d d c e 6 6 2 e 0 1 5 8 f a e f 7 7 5 6 b a f 5 4 f 1 2 a d 3 f 3 e 2 f 6 e 4 c 8 d 6 0 8 2 e 3
C : \ 1 f 8 6 7 0 8 4 7 0 9 e b e 3 7 1 c b 6 2 b c e 9 e 0 c 9 5 b 9 3 0 a d f 5 c b 8 2 3 8 2 0 5 1 9 9 e 6 0 6 b 2 5 6 e 3 0 7 8 4
C : \ U s e r s \ L i s a \ D e s k t o p \ n H T r 4 T T O . e x e
C : \ 6 c 4 5 8 6 d 5 3 f f b 6 c 7 e 3 1 0 c 4 2 3 3 4 c 2 0 a d d 3 5 8 c 5 f c 4 2 9 8 a 3 b 9 0 f 0 f 5 8 c e 6 5 b 7 0 0 9 b a 5
C : \ U s e r s \ L i s a \ D e s k t o p \ Z 1 D A c O a 2 . e x e
C : \ 2 a 0 7 8 5 3 c 7 2 e 6 1 3 a 7 a 1 6 6 7 b a d 0 6 2 9 0 9 0 a 4 6 3 f d 8 5 8 5 d 2 b 9 8 e f b b e d 0 0 1 a c c 8 e 8 a a 2
C : \ c e a 0 9 1 9 3 e c c 1 0 4 c e 9 5 4 f b 4 f b 3 e 5 b 6 8 2 2 3 3 f 3 9 b f 0 c 1 0 9 8 1 4 3 b e 8 c f e 6 6 5 7 0 2 7 9 0 a
C : \ U s e r s \ L i s a \ D e s k t o p \ s q C Z 2 6 w 9 . e x e
C : \ 5 4 2 e a d d 8 4 f 2 9 a 1 9 2 d 1 b b 5 1 f 1 3 6 f 7 7 1 7 f 6 9 8 0 2 f c 1 d c 0 7 9 7 e b 9 3 f 2 d d 2 7 0 2 2 8 e 6 0 0
C : \ m S f P q z w b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ M 8 N i 8 C j b . e x e
C : \ 0 3 6 0 d d 1 5 1 f 3 0 d f f 8 8 f 9 1 b e b 1 5 1 4 d a e 5 f c d a d 1 8 4 2 1 7 0 e 5 1 e 6 b 5 e 7 6 3 c e 8 1 7 7 e a 1 7
C : \ e 0 c f 4 5 5 b a 2 5 e 4 0 7 4 4 5 1 7 2 f 5 e c a 4 4 9 5 d 8 c 6 c 1 9 b 4 2 a d e 5 8 6 1 4 b 6 6 3 6 6 6 8 3 e c c 3 c 8 6
C : \ U s e r s \ L i s a \ D e s k t o p \ a L F y w O e f . e x e
C : \ 7 s p e E H w d . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ x 0 S T j B l x . e x e
C : \ H 4 U R o H N S . e x e
C : \ f 9 4 a e 2 a 4 8 8 e 3 0 3 8 7 1 c 6 c e 0 2 b 0 0 9 4 7 2 7 1 2 9 2 4 4 f 5 d f 0 1 3 4 3 2 b a 0 5 9 0 0 9 2 1 5 6 8 0 9 b f
C : \ U s e r s \ L i s a \ D e s k t o p \ i 8 K R J v W P . e x e
C : \ 9 e I o X V _ c . e x e
C : \ c a 8 c 9 f 0 0 f e 5 8 a 2 d 7 d 4 5 8 d 9 3 0 1 9 8 2 e b 5 a 1 6 f 2 3 e c f a 0 b 7 6 4 e 6 3 b b c c f e 1 2 4 7 c 6 3 0 c
C : \ a c d a 1 6 b 2 7 6 4 6 6 f 3 7 4 e 0 b 2 d 4 7 3 f c e 2 b 4 0 0 d f b b f 8 e c 2 0 f 5 2 d f c 7 9 3 7 f 8 e f 1 4 8 2 7 3 f
C : \ l V j Q 5 b L S . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c y j E J G P Q . e x e
C : \ U s e r s \ J o e C a g e \ A p p D a t a \ L o c a l \ T e m p \ 4 9 f 1 e 6 8 a 0 7 0 8 0 8 b 7 0 3 2 7 5 9 1 4 1 3 e e c 6 3 0 8 9 1 1 a a b d 2 a b 8 3 9 8 2 d a 4 7 f 8 b 6 9 7 7 e 1 4 1 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 3 5 1 4 0 1 4 b c f 7 8 c f 0 b 4 d 3 c 7 f 8 d f b 3 8 f 4 0 . e x e
C : \ 3 f c 0 3 e 1 b a 5 7 c c 1 5 2 8 9 9 4 6 e 8 6 d 0 e 3 9 1 d 8 3 5 2 0 0 3 2 9 7 c 4 6 0 d 5 3 8 6 c 7 b d 7 b 3 9 2 6 7 2 d 0
C : \ c 7 6 6 0 2 d 6 4 6 0 d 0 9 9 d 6 e a 1 8 5 1 7 5 5 d c 4 d 9 3 5 a e 3 7 f 9 5 5 7 c 9 f 9 7 6 1 7 4 c 6 a 8 9 8 f 4 6 1 4 e 3
C : \ 8 5 b 7 2 8 5 7 5 3 2 7 7 1 6 8 3 0 3 8 6 2 6 9 c 0 7 6 8 d 9 1 e 0 1 6 2 d 5 d d d 9 a 9 d f 6 0 d d 5 f 3 3 b 4 3 9 b c 4 3 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a s i h . e x e
C : \ x d 1 _ o H r D . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ A z R 4 a e z H . e x e
C : \ 9 6 0 f d 1 9 2 d 5 1 6 f a c f e a 4 c 4 4 3 2 d f 2 5 4 c e f d c 0 6 8 5 1 8 6 1 d f 4 8 3 1 8 c 3 3 3 6 2 6 8 5 5 6 b 7 a 5
C : \ e f 2 9 3 f 6 2 4 2 7 c 2 5 9 7 7 7 a e 1 2 5 7 b 7 5 4 7 a 1 3 4 8 c 0 0 2 2 b 2 e f 7 f 2 6 6 5 8 a 6 5 e 0 6 8 9 4 e 3 3 1 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a s i h . e x e
C : \ 8 3 a 5 c 9 8 d d b 9 b c d 7 2 a 2 c 2 2 b 3 0 5 d 9 1 9 c 4 c f e 5 5 4 c 2 4 e 7 7 9 c 5 5 b 8 8 9 7 3 0 e 9 0 7 8 5 f 8 6 0
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ e b 1 d c a b 7 e 8 8 b e 9 6 3 a 5 5 1 6 7 4 4 9 e 8 5 5 8 3 e . e x e
C : \ 0 d f 0 b b b e 3 d 8 9 6 7 1 7 0 0 4 c d 6 f d b a f f f 2 b 8 1 4 8 6 d c 6 2 5 7 8 2 b 7 1 7 7 6 1 0 1 0 5 a 8 0 3 6 e 1 3 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a s i h . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ r J 8 9 b I v R . e x e
C : \ f 2 T 9 j L y R . e x e
C : \ f 1 2 e d 6 e e 1 c 0 8 8 2 1 c 6 2 b b f 9 f 0 3 8 5 7 7 f 6 f 2 4 9 7 1 2 4 c 6 8 3 e 9 6 0 9 a 0 c c d c 7 0 a 1 a 5 9 9 f c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a s i h . e x e
C : \ f 2 9 b 0 f 1 5 b f 7 d 4 4 2 3 0 f 3 8 5 c 0 7 9 b e b 4 a 3 4 4 e f 7 c 3 a f 8 7 b d 6 d a 8 0 4 7 f 0 d 9 4 1 a f b 2 6 f c
C : \ d e f 5 2 7 1 e 5 7 3 1 9 0 f 9 2 4 b a 8 3 2 b 6 9 7 f 5 d 7 3 9 b 7 f c a 7 8 9 4 6 5 f b 5 0 e b 5 9 a f 1 8 8 2 4 1 f e d 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a s i h . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q P D u C D Q u . e x e
C : \ 2 4 2 b e 1 f 8 8 b 1 2 3 1 f 0 c a e 6 c 0 b a 8 b d 7 1 1 8 3 1 2 8 a 1 3 5 4 f c 2 a 2 8 2 c 0 c 3 1 8 8 e f 2 d 2 b 5 5 c 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a s i h . e x e
C : \ 8 1 6 9 e d f 8 a 1 2 a 7 a 6 3 8 b 2 b e a 9 5 5 3 e d 2 9 d 4 6 2 d c 9 a 6 9 d 9 1 4 9 6 4 4 8 d 0 4 e b d 7 5 1 1 3 9 f 1 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a s i h . e x e
C : \ f f b e f 6 c 5 2 b 6 f c b 6 7 3 f 6 2 9 c b b 5 5 9 2 d 7 1 6 2 b 3 9 1 a e e 0 9 0 4 9 e a 6 b a 7 3 2 7 6 0 6 3 6 4 f c 4 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 9 2 2 5 c b a 4 6 d 9 8 8 2 4 8 6 1 e 4 3 3 2 2 e 7 b 5 0 7 a f d a 8 7 c 7 4 0 3 4 a c c d d c b d 7 a 3 2 8 0 e f 0 1 5 8 d . e x e
C : \ 8 e 5 9 4 2 e f 5 7 1 f 8 0 4 1 b 2 2 0 9 2 e 8 d b d 8 6 9 c e f 9 8 b 9 f 7 3 b 4 6 1 7 5 9 c 7 5 9 4 f 6 0 f e 9 a 9 e 5 1 c
C : \ 9 6 c 9 7 1 a 6 c 6 0 8 b 6 c e 7 c 5 8 4 8 f 2 b 5 3 e 3 f 2 8 f 0 d 6 8 2 0 5 9 e 9 c b 7 5 7 b c a 3 f 9 8 e 2 9 d 0 f 2 e 4
C : \ f 5 a 5 7 4 e 6 6 1 3 6 1 2 6 5 5 7 9 2 5 c 0 7 c 5 4 f c 6 f b d 6 d a 9 f a 9 d 0 1 c c 6 b 6 9 6 6 2 f a c f 7 e c 7 0 0 c 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ b 0 A O E c 2 m . e x e
C : \ q D C v Y p b E . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 0 a 4 f 7 1 b c 5 e b 4 3 e 0 a 0 b 4 f 0 e a d 9 6 6 0 5 6 2 6 . v i r u s
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ e b 1 d c a b 7 e 8 8 b e 9 6 3 a 5 5 1 6 7 4 4 9 e 8 5 5 8 3 e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a s i h . e x e
C : \ e w 8 7 x w I o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 4 d 4 0 4 c 8 4 d 7 d e 7 8 9 9 e 6 a a 1 0 d 7 b 6 2 b 4 e d . e x e
C : \ 7 4 9 8 a f 1 a 5 1 b f 8 7 b 4 4 f 6 f a 9 b 6 0 9 0 9 3 f 5 a f b f e 6 c b a 4 f 3 a d 4 5 8 f 6 c 9 d 8 f b 1 8 3 5 5 4 2 c
C : \ f 1 9 3 4 4 c 7 c 5 e 7 4 0 b 0 7 2 b 2 a 0 4 3 f c e 1 5 b d 7 e 5 a 1 a 4 9 7 e b 2 6 b e 5 b e 3 a 1 5 7 e 3 e 9 0 9 7 4 4 7
C : \ a b 2 9 1 c 9 a e e a 7 4 5 b d d 3 0 f 6 7 d d 1 6 2 9 e 2 7 8 8 0 4 f 1 9 0 2 3 6 e e 0 3 c 2 c d 3 0 2 4 e 9 9 f f 8 8 6 7 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F R K u 5 P x 0 . e x e
C : \ a 6 K 8 5 h 2 F . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e b d 9 0 0 6 6 4 1 4 b b 7 9 1 b 0 3 c c 7 4 8 4 d 0 f e c 9 5 . v i r u s . e x e
C : \ f h f e d b W z . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 6 3 5 b 1 d 2 2 5 f 6 9 f 5 b e 1 6 7 2 7 f c e f 0 f 7 d 9 e . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ e b 1 d c a b 7 e 8 8 b e 9 6 3 a 5 5 1 6 7 4 4 9 e 8 5 5 8 3 e . e x e
C : \ f 0 e 9 d d a b b 4 2 f 1 2 d b f e 9 7 e 6 e 4 6 6 c 4 c 5 e 4 4 f f 3 e 4 e 0 2 a 9 9 2 a b e 8 1 1 b 1 8 c 9 2 4 6 2 8 b 7 1
C : \ 4 1 c f 8 1 5 b c d 6 f a 2 d 3 9 1 f 8 9 f c 2 9 2 7 9 6 b 5 f b 8 5 a 3 e 4 1 6 f 6 a f 4 9 2 6 6 1 7 4 c d 2 a a a a c 7 0 b
C : \ c 5 1 d c d c 4 f 1 d 8 6 a 2 f 6 6 3 b 1 0 4 c a e f b 5 d f e c 9 c e e 3 b 2 f a f 0 6 6 0 2 5 6 a b 4 3 c 7 8 9 9 9 d e 6 c
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ I O X l w v J g . e x e
C : \ R u x Q k 1 6 i . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f d 3 5 d 1 7 b e 0 c f 9 a 0 2 6 d 7 c 1 7 2 1 b c e 0 b 7 0 0 . v i r u s . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 7 2 2 a f b 1 6 d 4 3 f a 7 3 7 f c c 1 3 c 1 5 2 f f 6 7 a f 8 6 9 d 4 6 1 4 8 8 b 0 7 1 a f 5 1 c e 8 4 8 c f 7 1 6 f e b 4 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e c d 3 c 8 3 8 f 7 3 7 9 b 9 9 _ a s i h . e x e
C : \ s n n e Q 2 i _ . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 a b e f 5 7 3 b a c c 3 9 a f f 0 8 e e e a 2 6 6 9 5 d 6 5 c . v i r u s . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.