SmartHawk

6.6

高危

50 个模型检测该样本为恶意！

重新分析

下载样本

f55994af4fa97755811de3b4226be0d40816da375be2f2d7e737d76d0df66b2b

338f1d5dde63c673389950df4cc97290.exe

分析耗时

36s

最近分析

文件大小

4.0MB

静态报毒动态报毒 @F3@AUTAVTGI AI SCORE=84 AIDETECTVM ARTEMIS ATTRIBUTE BLUETEAL BSCOPE CLOUD CONFIDENCE CPQNI DANGEROUSSIG GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE JKPE LJAT MALICIOUS PE MALWARE1 POSSIBLETHREAT QQPASS QQROB R002C0WE820 R337624 REDCAP RELINE SANDSQUAREV SCORE THEMIDA TROJANPSW UNSAFE WACATAC ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!338F1D5DDE63	20200811	6.0.6.653
Alibaba	TrojanPSW:MSIL/Reline.e27951ef	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:DangerousSig [Trj]	20200811	18.4.3895.0
Tencent	Msil.Trojan-qqpass.Qqrob.Ljat	20200811	1.0.0.1
Kingsoft		20200811	2013.8.14.323
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1620738911.656626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620738912.328626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620738912.390626 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620738908.390626 IsDebuggerPresent		failed	0	0
1620738908.390626 IsDebuggerPresent		failed	0	0

This executable is signed

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620738908.546626 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 个事件)

section
section	.imports
section	.themida
section	.boot

One or more processes crashed (3 个事件)

Time & API	Arguments	Status
1620738906.656626 __exception__	stacktrace: 338f1d5dde63c673389950df4cc97290+0xc6008d @ 0x18b008d 338f1d5dde63c673389950df4cc97290+0xc6012a @ 0x18b012a registers.esp: 3276260 registers.edi: 22847488 registers.eax: 3276260 registers.ebp: 3276340 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2010805291 registers.ecx: 3293511680 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 2e e1 e4 89 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x778eb727	success
1620738906.703626 __exception__	stacktrace: registers.esp: 3276380 registers.edi: 24347463 registers.eax: 1750617430 registers.ebp: 22847488 registers.edx: 22614 registers.ebx: 2147483650 registers.esi: 24358654 registers.ecx: 20 exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 ce ac e7 ff exception.symbol: 338f1d5dde63c673389950df4cc97290+0xc6a582 exception.instruction: in eax, dx exception.module: 338f1d5dde63c673389950df4cc97290.exe exception.exception_code: 0xc0000096 exception.offset: 13018498 exception.address: 0x18ba582	success
1620738906.703626 __exception__	stacktrace: registers.esp: 3276380 registers.edi: 24347463 registers.eax: 1447909480 registers.ebp: 22847488 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 24358654 registers.ecx: 10 exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: 338f1d5dde63c673389950df4cc97290+0xc6a5f6 exception.instruction: in eax, dx exception.module: 338f1d5dde63c673389950df4cc97290.exe exception.exception_code: 0xc0000096 exception.offset: 13018614 exception.address: 0x18ba5f6	success

Allocates read-write-execute memory (usually to unpack itself) (50 out of 151 个事件)

Time & API	Arguments	Status
1620738906.046626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76357000	success
1620738906.046626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778ee000	success
1620738906.046626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1620738906.046626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f1000	success
1620738906.046626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x7636c000	success
1620738906.062626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f1000	success
1620738906.062626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1620738906.062626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f1000	success
1620738906.062626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1620738906.062626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f1000	success
1620738906.078626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76355000	success
1620738906.078626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778eb000	success
1620738906.078626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1620738906.078626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f0000	success
1620738906.078626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1620738906.078626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f1000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x763cf000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778ed000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76355000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778ec000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x775af000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x775b8000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x7636c000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778eb000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778fb000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76355000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778fb000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76373000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76378000	success
1620738906.109626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x763ce000	success
1620738906.124626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76375000	success
1620738906.124626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1620738906.124626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778ed000	success
1620738906.140626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76355000	success
1620738906.140626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1620738906.140626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f1000	success
1620738906.140626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76583000	success
1620738906.140626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1620738906.140626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f1000	success
1620738906.140626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1620738906.156626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1620738906.156626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f1000	success
1620738906.171626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1620738906.187626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1620738906.187626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f8000	success
1620738906.203626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1620738906.203626 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x778f8000	success

The binary likely contains encrypted or compressed data indicative of a packer (4 个事件)

entropy

7.996709103994824

section

{'size_of_data': '0x0000d874', 'virtual_address': '0x00002000', 'entropy': 7.996709103994824, 'name': ' ', 'virtual_size': '0x00026000'}

description

A section with a high entropy has been found

entropy

7.9996890051666245

section

{'size_of_data': '0x00098a85', 'virtual_address': '0x00028000', 'entropy': 7.9996890051666245, 'name': ' ', 'virtual_size': '0x0091d302'}

description

A section with a high entropy has been found

entropy

7.963437328976173

section

{'size_of_data': '0x0015d6aa', 'virtual_address': '0x00ccc000', 'entropy': 7.963437328976173, 'name': '.boot', 'virtual_size': '0x0015d800'}

description

A section with a high entropy has been found

entropy

0.916446513097257

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620738910.578626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Checks for the presence of known windows from debuggers and forensic tools (15 个事件)

Time & API	Arguments	Status
1620738906.703626 FindWindowA	class_name: FilemonClass window_name:	failed
1620738906.703626 FindWindowA	class_name: FilemonClass window_name:	failed
1620738906.703626 FindWindowA	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:	failed
1620738906.703626 FindWindowA	class_name: PROCMON_WINDOW_CLASS window_name:	failed
1620738906.703626 FindWindowA	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:	failed
1620738906.796626 FindWindowA	class_name: RegmonClass window_name:	failed
1620738906.796626 FindWindowA	class_name: RegmonClass window_name:	failed
1620738906.796626 FindWindowA	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:	failed
1620738906.796626 FindWindowA	class_name: 18467-41 window_name:	failed
1620738910.796626 FindWindowA	class_name: Regmonclass window_name:	failed
1620738910.796626 FindWindowA	class_name: Regmonclass window_name:	failed
1620738911.109626 FindWindowA	class_name: 18467-41 window_name:	failed
1620738911.421626 FindWindowA	class_name: Filemonclass window_name:	failed
1620738911.421626 FindWindowA	class_name: Filemonclass window_name:	failed
1620738911.421626 FindWindowA	class_name: PROCMON_WINDOW_CLASS window_name:	failed

Checks the version of Bios, possibly for anti-virtualization (2 个事件)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects Virtual Machines through their custom firmware (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620738906.703626 NtQuerySystemInformation	information_class: 76 (SystemFirmwareTableInformation)	failed	3221225507	0

Detects VMWare through the in instruction feature (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620738906.703626 __exception__	stacktrace: registers.esp: 3276380 registers.edi: 24347463 registers.eax: 1447909480 registers.ebp: 22847488 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 24358654 registers.ecx: 10 exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: 338f1d5dde63c673389950df4cc97290+0xc6a5f6 exception.instruction: in eax, dx exception.module: 338f1d5dde63c673389950df4cc97290.exe exception.exception_code: 0xc0000096 exception.offset: 13018614 exception.address: 0x18ba5f6	success	0	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.33684988
FireEye	Generic.mg.338f1d5dde63c673
McAfee	Artemis!338F1D5DDE63
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005649f31 )
Alibaba	TrojanPSW:MSIL/Reline.e27951ef
K7GW	Trojan ( 005649f31 )
Cybereason	malicious.4c8179
TrendMicro	TROJ_GEN.R002C0WE820
BitDefenderTheta	Gen:NN.ZexaF.34152.@F3@auTaVTgi
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:DangerousSig [Trj]
GData	Trojan.GenericKD.33684988
Kaspersky	Trojan-PSW.MSIL.Reline.z
BitDefender	Trojan.GenericKD.33684988
Paloalto	generic.ml
Tencent	Msil.Trojan-qqpass.Qqrob.Ljat
Ad-Aware	Trojan.GenericKD.33684988
F-Secure	Trojan.TR/Redcap.cpqni
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Cyren	W32/Trojan.JKPE-4277
Avira	TR/Redcap.cpqni
Antiy-AVL	Trojan[Exploit]/Win64.Sandsquarev
Arcabit	Trojan.Generic.D201FDFC
AegisLab	Trojan.Win32.Malicious.4!c
ZoneAlarm	Trojan-PSW.MSIL.Reline.z
Microsoft	Exploit:Win64/Sandsquarev.B
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Blueteal.R337624
VBA32	BScope.Trojan.Wacatac
ALYac	Trojan.GenericKD.33684988
MAX	malware (ai score=84)
ESET-NOD32	a variant of Win32/Packed.Themida.HKS
TrendMicro-HouseCall	TROJ_GEN.R002C0WE820
Rising	Exploit.Sandsquarev!8.10CDA (CLOUD)
Yandex	Trojan.Themida!
Ikarus	Trojan.Win32.Themida
eGambit	Unsafe.AI_Score_84%
Fortinet	W32/PossibleThreat
AVG	Win32:DangerousSig [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Trojan.9ad

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2048-03-27 19:11:33

Imports

Library kernel32.dll:

• 0xd48078 GetModuleHandleA

Library mscoree.dll:

• 0xd48080 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.