| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20191029 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Kryptik.bcp | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191029 | 2013.8.14.323 |
| McAfee | Packed-KS!30B63AF93F29 | 20191029 | 6.0.6.653 |
| Tencent | None | 20191029 | 1.0.0.1 |
| file | C:\Windows\win32dc\FlatOut(serial).exe |
| file | C:\Windows\win32dc\DAoC cdfix.exe |
| file | C:\Windows\win32dc\Quake3 + codes.exe |
| file | C:\Windows\win32dc\Doom 3(cheat).exe |
| file | C:\Windows\win32dc\Doom 3_fix.exe |
| file | C:\Windows\win32dc\DAoC_cheat.exe |
| section | {'name': 'UPX1', 'virtual_address': '0x0000f000', 'virtual_size': '0x00013000', 'size_of_data': '0x00012a00', 'entropy': 7.963038258348486} | entropy | 7.963038258348486 | description | 发现高熵的节 | |||||||||
| entropy | 0.9738562091503268 | description | 此PE文件的整体熵值较高 | |||||||||||
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
| host | 114.114.114.114 | |||
| host | 209.202.252.54 | |||
| dead_host | 104.152.54.52:6667 |
| ALYac | GenPack:Generic.Malware.Sdld.FD559172 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | GenPack:Generic.Malware.Sdld.FD559172 |
| AhnLab-V3 | Malware/Win32.Upantix.C2168224 |
| Arcabit | GenPack:Generic.Malware.Sdld.FDD88844 |
| Avast | Win32:Malware-gen |
| Avira | TR/Dldr.Delphi.Gen |
| Baidu | Win32.Trojan.Kryptik.bcp |
| BitDefender | GenPack:Generic.Malware.Sdld.FD559172 |
| CAT-QuickHeal | Trojan.Upantix.AL3 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.93f299 |
| Cylance | Unsafe |
| Cyren | W32/NewMalware-LSU-based!Maximu |
| DrWeb | Trojan.Packed2.39727 |
| ESET-NOD32 | Win32/Kryptik.FKSZ.Gen |
| Emsisoft | GenPack:Generic.Malware.Sdld.FD559172 (B) |
| Endgame | malicious (moderate confidence) |
| F-Prot | W32/NewMalware-LSU-based!Maximu |
| F-Secure | Trojan.TR/Dldr.Delphi.Gen |
| FireEye | Generic.mg.30b63af93f2994bd |
| Fortinet | W32/Bundpil.72F8!tr |
| GData | GenPack:Generic.Malware.Sdld.FD559172 |
| Ikarus | Trojan.Win32.Dynamer |
| Invincea | heuristic |
| Jiangmin | Packed.Upantix.adgw |
| K7AntiVirus | Trojan ( 0050a9591 ) |
| K7GW | Trojan ( 0050a9591 ) |
| Kaspersky | HEUR:Packed.Win32.Upantix.gen |
| MAX | malware (ai score=81) |
| McAfee | Packed-KS!30B63AF93F29 |
| McAfee-GW-Edition | BehavesLike.Win32.SpyLydra.dc |
| MicroWorld-eScan | GenPack:Generic.Malware.Sdld.FD559172 |
| Microsoft | Backdoor:MSIL/Bladabindi.AJ!bit |
| NANO-Antivirus | Trojan.Win32.Upantix.ekofiv |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.DFA9.Malware.Gen |
| Rising | Trojan.Kryptik!1.A862 (CLASSIC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/EncPk-ANQ |
| Symantec | SMG.Heur!gen |
| Trapmine | malicious.moderate.ml.score |
| VBA32 | Malware-Cryptor.General.3 |
| VIPRE | Trojan.Win32.Generic!BT |
| Yandex | Trojan.Kryptik!rrMJZq4zV/U |
| Zillya | Trojan.Kryptik.Win32.1046502 |
| ZoneAlarm | HEUR:Packed.Win32.Upantix.gen |
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x0000e000 | 0x00000000 | 0.0 |
| UPX1 | 0x0000f000 | 0x00013000 | 0x00012a00 | 7.963038258348486 |
| .rsrc | 0x00022000 | 0x00001000 | 0x00000800 | 3.8057924052084515 |
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00022154 | 0x000002e8 | LANG_SPANISH | SUBLANG_SPANISH_MODERN | None |
| RT_RCDATA | 0x00012448 | 0x000000a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x00012448 | 0x000000a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00022440 | 0x00000014 | LANG_SPANISH | SUBLANG_SPANISH_MODERN | None |
| IP |
|---|
| 114.114.114.114 |
| 104.152.54.52 |
| 209.202.252.54 |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | |
| us.undernet.org |
A 45.58.183.18
A 104.152.54.52 A 172.83.156.122 |
45.58.183.18 |
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49163 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49165 | 104.152.54.52 us.undernet.org | 6667 |
| 209.202.252.54 | 21 | 192.168.56.101 | 49169 |
| 192.168.56.101 | 49166 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49167 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49168 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49169 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49170 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49171 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49172 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49173 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49174 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49175 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49176 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49177 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49178 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49179 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49180 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49181 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49182 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49183 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49184 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49185 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49186 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49187 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49188 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49189 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49190 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49191 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49192 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49193 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49194 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49195 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49196 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49197 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49198 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49199 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49200 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49201 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49202 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49203 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49204 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49205 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49206 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49207 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49208 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49209 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49210 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49211 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49212 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49213 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49214 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49215 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49216 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49217 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49218 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49219 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49220 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49221 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49222 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49223 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49224 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49225 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49226 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49227 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49228 | 104.152.54.52 us.undernet.org | 6667 |
| 192.168.56.101 | 49229 | 104.152.54.52 us.undernet.org | 6667 |
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
No HTTP requests performed.
No ICMP traffic performed.
No IRC requests performed.
No Suricata Alerts
No Suricata TLS
No Snort Alerts
| Name | 71980379651d9021_doom 3(cheat).exe |
|---|---|
| Filepath | C:\Windows\win32dc\Doom 3(cheat).exe |
| Size | 236.2KB |
| Processes | 1064 (0462509bb71a662bcb0bccf854b277fae925264df5d94159b0e32069b81a6b70.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 9b32d83f3a171332c371df0b04213826 |
| SHA1 | 946cece550d79a94a692249f885af900a3862e33 |
| SHA256 | 71980379651d9021082a58e8304552f2235e86e2dbaadf57887691d2afb5147f |
| CRC32 | 7E07AAC0 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 571711da91441b85_flatout(serial).exe |
|---|---|
| Filepath | C:\Windows\win32dc\FlatOut(serial).exe |
| Size | 238.2KB |
| Processes | 1064 (0462509bb71a662bcb0bccf854b277fae925264df5d94159b0e32069b81a6b70.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 8b0dded08d376562d6853aa505c1a9d8 |
| SHA1 | 29cae83969f4f3ad38f976a1e3030d050ff2f618 |
| SHA256 | 571711da91441b8528ec2dada36909d3f318115a0777fc74ce7a3dc024fe030c |
| CRC32 | EF48ABE4 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 9f585e3f78d0278c_daoc_cheat.exe |
|---|---|
| Filepath | C:\Windows\win32dc\DAoC_cheat.exe |
| Size | 237.2KB |
| Processes | 1064 (0462509bb71a662bcb0bccf854b277fae925264df5d94159b0e32069b81a6b70.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | b425d5ad6884709ae97bc47100951691 |
| SHA1 | 0342bf2e01c260a14bc260c2b1b7b8e1a9dee495 |
| SHA256 | 9f585e3f78d0278c1525f76afb5f0f1fab94de0b414c19e865db853f3fd198c4 |
| CRC32 | EA2BF849 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | abc1ef3e6699e06d_daoc cdfix.exe |
|---|---|
| Filepath | C:\Windows\win32dc\DAoC cdfix.exe |
| Size | 235.2KB |
| Processes | 1064 (0462509bb71a662bcb0bccf854b277fae925264df5d94159b0e32069b81a6b70.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 278cbd659a2504133b48365e10708f77 |
| SHA1 | 6c8eb68fc5361c2eb33498959b74d51496301ad6 |
| SHA256 | abc1ef3e6699e06dc0d07c03aed2b487a02714696914f69e1153ae7f994cfda2 |
| CRC32 | 7D532868 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | b6194e5f75eec6c0_quake3 + codes.exe |
|---|---|
| Filepath | C:\Windows\win32dc\Quake3 + codes.exe |
| Size | 234.2KB |
| Processes | 1064 (0462509bb71a662bcb0bccf854b277fae925264df5d94159b0e32069b81a6b70.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 6abcec35992ae90e898724553fe3954f |
| SHA1 | bfa51de033f44ae3fb72df72df1c9f850bcf4ebf |
| SHA256 | b6194e5f75eec6c075bcf2c610a09e3a164534b18ef40a8115a942a7a18fe647 |
| CRC32 | E057672C |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | f6072cb5608f0538_doom 3_fix.exe |
|---|---|
| Filepath | C:\Windows\win32dc\Doom 3_fix.exe |
| Size | 236.2KB |
| Processes | 1064 (0462509bb71a662bcb0bccf854b277fae925264df5d94159b0e32069b81a6b70.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 7f9b5c0889edafc97e8f669ca529e253 |
| SHA1 | 53f892bf63bb67e84f95d47b110daa3a1de82f56 |
| SHA256 | f6072cb5608f0538b69c17fc83f3d6cac58af91488d8bc3ab8f0ccfaf318cc2e |
| CRC32 | 35CC7CDB |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |