11.0
0-day
53 个模型检测该样本为恶意！
重新分析
更多

de07a802bbe62a4a81aae7e8bef4075210cbad15dba3ecda3bbe93bdb7bc5f5f

3536ee9e70c2a1abd5f41448ead0d0f8.exe

分析耗时

66s

最近分析

文件大小

1.4MB
静态报毒 动态报毒 AGEN AI SCORE=86 AIDETECTVM AUTO CONFIDENCE COSMU DGZLOGSHU1B2NZXIWW EDOE EKLE EKSTAK FNANJL FOREIGN GENERICKD GENERICRXHE GENKRYPTIK HIGH CONFIDENCE MALWARE1 MALWARE@#1DKNHCXW5CTDW OCCAMY SCORE SIGGEN2 ULISE UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXHE-JX!3536EE9E70C2 20200708 6.0.6.653
Alibaba Trojan:Win32/Injector.cb79fba8 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200708 18.4.3895.0
Tencent Win32.Trojan.Inject.Auto 20200708 1.0.0.1
Kingsoft 20200708 2013.8.14.323
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619351434.342125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619351434.342125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619345031.421372
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619345030.765372
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00670000
success 0 0
Foreign language identified in PE resource (1 个事件)
name RT_MANIFEST language LANG_ARABIC offset 0x00163970 filetype XML 1.0 document, ASCII text, with CRLF line terminators sublanguage SUBLANG_ARABIC_EGYPT size 0x000002f0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Macromedia\StikyNot.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Macromedia\StikyNot.exe
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619351434.935125
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619345071.968372
NtAllocateVirtualMemory
process_identifier: 2228
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001c0
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive reg_value C:\Users\Administrator.Oskar-PC\AppData\Local\Macromedia\StikyNot.exe
Potential code injection by writing to the memory of another process (3 个事件)
Time & API Arguments Status Return Repeated
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ”*ø¡°@@ОàXCODE$’” `DATA”°˜@ÀBSS] ÀžÀ.idatažÐž@À.relocXà¦@PÆ@P
process_handle: 0x000001c0
base_address: 0x00400000
success 1 0
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer: @2‹À@@@\@ì @l$@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ<P@‹À‹À@@J7<äºÏ¿}ªiFîµä[Jú-EœÝ]³QçëdÈAÈÈAÇA ÇAÀÈAàÉAüÆAìÈAðÆA„ÈAlÇA`ÈA¤ÆA`ÉAèÉA€ÈA°ÈA ÊA<ÇA”ÇAœÉAdÇAlÆAÈÉAPÈA(ÇAÄÉA¼ÈAìÉA´ÈAÈAœÈApÉAÉA$ÉAÉAÔÇAXÈA ÇA¸ÆA@ÉAÄÈAÇAÊA$ÈA\ÈAÆAÈAŒÉAÊAÀÆAÈA´°AHÈA¨ÈA@ÈA0ÊA|ÈALÉA¼ÉAÔÈAôÇAÜÉAxÉAÇAtÈAÈA°ÉA$ÊA¸ÇA ÉAÄÊA\ÉA|ÉA0ÈAèÈAäÉAˆÈApÈA˜ÈAXÇAøÆAHÉA0ÇAäÈAÌÈA|ÆA<ÈA4ÈAÈAŒÆAŒÈAèÆA|ÇAÇA˜ÇA8ÇAhÉAÌÉAÉADÈAàÈA,ÉA ÈA°ÇAÉA¨ÉA¸°A¸ÈAäÆAüÇA@ÊAÜÇA8ÉA°°AÊA¼ÆAÐÈA(ÊA´ÆA(ÈAdÉAdÆAÄÇALÊAèÇAÉA<ÉAÊAxÈAìÆAÐÉA„ÉAØÈA<ÊAØÇAˆÉA°ÆAÜÈA¬ÉA$ÇA0ÉAÈAdÊAØ°ALÈATÉA ÉAüÈA¼°AÈA˜ÆA ÇA ÊA¬ÈAXÉAôÈAÊA ÈAlÈA”ÉAÇA,ÊA8ÈAÉA4ÉAðÈAÇAœÆA ÆA4ÇAÊA¬ÆALÇAHÊAäÇA ÈA´ÇA¬ÇAˆÆAøÇAtÉA ÉAÉAPÉAHÇA”ÈAôÆAÈÆA@ÇA\ÇA¬°A¼ÊAÀÉADÊAàÇAôÉAÔÉA4ÊA¤ÉAøÉAÇAøÈA,ÈA˜ÉAüÉATÈAðÇA(ÉAlÉADÉAÈAÄÆAœÇA€ÆAhÈA¸ÉAðÉA¤ÈAØÉA8ÊA”ÆA,ÇAÉAhÆA€ÉADÇAPÊAìÇA¼ÇA
process_handle: 0x000001c0
base_address: 0x0041b000
success 1 0
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer: ,ÒÜÐ ÔHÑXÔXјÔhÑàÔxÑÕ€Ñ8ՐѺÖðÑ*× Òp× Ò:ÒRÒjÒ‚ÒžÒ¬Ò¼ÒÈÒÖÒæÒÓÓ$Ó:ÓPÓbÓtӊӜӮӼÓÊÓÖÓòÓþÓÔ,Ô>ÔLÔfÔzÔŠÔ¦Ô¶ÔÌÔîÔÕ Õ.ÕFÕRÕZÕfÕxÕˆÕ˜Õ¦Õ¶ÕÆÕØÕìÕÖÖ.ÖBÖPÖ`ÖrÖ~֌֚֮ÖÄÖÔÖäÖðÖ× ×6×B×V×^×z׊×kernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetTickCountQueryPerformanceCounterGetVersionGetCurrentThreadIdWideCharToMultiByteMultiByteToWideCharGetThreadLocaleGetStartupInfoAGetModuleFileNameAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxACharNextAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenSysAllocStringLenkernel32.dllGetModuleHandleAadvapi32.dllRegOpenKeyExARegEnumKeyAFreeSidkernel32.dllWriteFileSleepLocalFreeLoadLibraryExWLoadLibraryAGlobalUnlockGlobalLockGetTickCountGetSystemInfoGetProcAddressGetModuleHandleAGetModuleFileNameAGetFileAttributesWGetCurrentProcessIdGetCurrentProcessFreeLibraryFindNextFileWFindFirstFileWFindCloseExitProcessDeleteFileWCreateDirectoryWCopyFileWgdi32.dllSelectObjectDeleteObjectDeleteDCCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSystemMetricsGetDCCharToOemBuffAole32.dllOleInitializeCoCreateInstance
process_handle: 0x000001c0
base_address: 0x0041d000
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ”*ø¡°@@ОàXCODE$’” `DATA”°˜@ÀBSS] ÀžÀ.idatažÐž@À.relocXà¦@PÆ@P
process_handle: 0x000001c0
base_address: 0x00400000
success 1 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619351437.514125
RegSetValueExA
key_handle: 0x00000358
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619351437.514125
RegSetValueExA
key_handle: 0x00000358
value:  :êâ¤9×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619351437.514125
RegSetValueExA
key_handle: 0x00000358
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619351437.529125
RegSetValueExW
key_handle: 0x00000358
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619351437.529125
RegSetValueExA
key_handle: 0x00000370
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619351437.529125
RegSetValueExA
key_handle: 0x00000370
value:  :êâ¤9×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619351437.529125
RegSetValueExA
key_handle: 0x00000370
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619351437.560125
RegSetValueExW
key_handle: 0x00000354
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 784 called NtSetContextThread to modify thread in remote process 2228
Time & API Arguments Status Return Repeated
1619345071.968372
NtSetContextThread
thread_handle: 0x00000168
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4301304
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2228
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 784 resumed a thread in remote process 2228
Time & API Arguments Status Return Repeated
1619345072.218372
NtResumeThread
thread_handle: 0x00000168
suspend_count: 1
process_identifier: 2228
success 0 0
Generates some ICMP traffic
Executed a process and injected code into it, probably while unpacking (14 个事件)
Time & API Arguments Status Return Repeated
1619345031.452372
NtResumeThread
thread_handle: 0x00000184
suspend_count: 1
process_identifier: 784
success 0 0
1619345071.968372
CreateProcessInternalW
thread_identifier: 2856
thread_handle: 0x00000168
process_identifier: 2228
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3536ee9e70c2a1abd5f41448ead0d0f8.exe
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3536ee9e70c2a1abd5f41448ead0d0f8.exe"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3536ee9e70c2a1abd5f41448ead0d0f8.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000001c0
inherit_handles: 0
success 1 0
1619345071.968372
NtGetContextThread
thread_handle: 0x00000168
success 0 0
1619345071.968372
NtUnmapViewOfSection
process_identifier: 2228
region_size: 4096
process_handle: 0x000001c0
base_address: 0x00400000
success 0 0
1619345071.968372
NtAllocateVirtualMemory
process_identifier: 2228
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001c0
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ”*ø¡°@@ОàXCODE$’” `DATA”°˜@ÀBSS] ÀžÀ.idatažÐž@À.relocXà¦@PÆ@P
process_handle: 0x000001c0
base_address: 0x00400000
success 1 0
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer:
process_handle: 0x000001c0
base_address: 0x00401000
success 1 0
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer: @2‹À@@@\@ì @l$@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ<P@‹À‹À@@J7<äºÏ¿}ªiFîµä[Jú-EœÝ]³QçëdÈAÈÈAÇA ÇAÀÈAàÉAüÆAìÈAðÆA„ÈAlÇA`ÈA¤ÆA`ÉAèÉA€ÈA°ÈA ÊA<ÇA”ÇAœÉAdÇAlÆAÈÉAPÈA(ÇAÄÉA¼ÈAìÉA´ÈAÈAœÈApÉAÉA$ÉAÉAÔÇAXÈA ÇA¸ÆA@ÉAÄÈAÇAÊA$ÈA\ÈAÆAÈAŒÉAÊAÀÆAÈA´°AHÈA¨ÈA@ÈA0ÊA|ÈALÉA¼ÉAÔÈAôÇAÜÉAxÉAÇAtÈAÈA°ÉA$ÊA¸ÇA ÉAÄÊA\ÉA|ÉA0ÈAèÈAäÉAˆÈApÈA˜ÈAXÇAøÆAHÉA0ÇAäÈAÌÈA|ÆA<ÈA4ÈAÈAŒÆAŒÈAèÆA|ÇAÇA˜ÇA8ÇAhÉAÌÉAÉADÈAàÈA,ÉA ÈA°ÇAÉA¨ÉA¸°A¸ÈAäÆAüÇA@ÊAÜÇA8ÉA°°AÊA¼ÆAÐÈA(ÊA´ÆA(ÈAdÉAdÆAÄÇALÊAèÇAÉA<ÉAÊAxÈAìÆAÐÉA„ÉAØÈA<ÊAØÇAˆÉA°ÆAÜÈA¬ÉA$ÇA0ÉAÈAdÊAØ°ALÈATÉA ÉAüÈA¼°AÈA˜ÆA ÇA ÊA¬ÈAXÉAôÈAÊA ÈAlÈA”ÉAÇA,ÊA8ÈAÉA4ÉAðÈAÇAœÆA ÆA4ÇAÊA¬ÆALÇAHÊAäÇA ÈA´ÇA¬ÇAˆÆAøÇAtÉA ÉAÉAPÉAHÇA”ÈAôÆAÈÆA@ÇA\ÇA¬°A¼ÊAÀÉADÊAàÇAôÉAÔÉA4ÊA¤ÉAøÉAÇAøÈA,ÈA˜ÉAüÉATÈAðÇA(ÉAlÉADÉAÈAÄÆAœÇA€ÆAhÈA¸ÉAðÉA¤ÈAØÉA8ÊA”ÆA,ÇAÉAhÆA€ÉADÇAPÊAìÇA¼ÇA
process_handle: 0x000001c0
base_address: 0x0041b000
success 1 0
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer:
process_handle: 0x000001c0
base_address: 0x0041c000
failed 0 0
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer: ,ÒÜÐ ÔHÑXÔXјÔhÑàÔxÑÕ€Ñ8ՐѺÖðÑ*× Òp× Ò:ÒRÒjÒ‚ÒžÒ¬Ò¼ÒÈÒÖÒæÒÓÓ$Ó:ÓPÓbÓtӊӜӮӼÓÊÓÖÓòÓþÓÔ,Ô>ÔLÔfÔzÔŠÔ¦Ô¶ÔÌÔîÔÕ Õ.ÕFÕRÕZÕfÕxÕˆÕ˜Õ¦Õ¶ÕÆÕØÕìÕÖÖ.ÖBÖPÖ`ÖrÖ~֌֚֮ÖÄÖÔÖäÖðÖ× ×6×B×V×^×z׊×kernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetTickCountQueryPerformanceCounterGetVersionGetCurrentThreadIdWideCharToMultiByteMultiByteToWideCharGetThreadLocaleGetStartupInfoAGetModuleFileNameAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxACharNextAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenSysAllocStringLenkernel32.dllGetModuleHandleAadvapi32.dllRegOpenKeyExARegEnumKeyAFreeSidkernel32.dllWriteFileSleepLocalFreeLoadLibraryExWLoadLibraryAGlobalUnlockGlobalLockGetTickCountGetSystemInfoGetProcAddressGetModuleHandleAGetModuleFileNameAGetFileAttributesWGetCurrentProcessIdGetCurrentProcessFreeLibraryFindNextFileWFindFirstFileWFindCloseExitProcessDeleteFileWCreateDirectoryWCopyFileWgdi32.dllSelectObjectDeleteObjectDeleteDCCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSystemMetricsGetDCCharToOemBuffAole32.dllOleInitializeCoCreateInstance
process_handle: 0x000001c0
base_address: 0x0041d000
success 1 0
1619345071.968372
WriteProcessMemory
process_identifier: 2228
buffer:
process_handle: 0x000001c0
base_address: 0x0041e000
success 1 0
1619345071.968372
NtSetContextThread
thread_handle: 0x00000168
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4301304
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2228
success 0 0
1619345072.218372
NtResumeThread
thread_handle: 0x00000168
suspend_count: 1
process_identifier: 2228
success 0 0
1619351434.342125
NtResumeThread
thread_handle: 0x000000e8
suspend_count: 1
process_identifier: 2228
success 0 0
File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)
Bkav W32.AIDetectVM.malware1
MicroWorld-eScan Trojan.GenericKD.31695729
FireEye Generic.mg.3536ee9e70c2a1ab
McAfee GenericRXHE-JX!3536EE9E70C2
Cylance Unsafe
Zillya Trojan.Ekstak.Win32.22553
K7AntiVirus Trojan ( 005479b51 )
Alibaba Trojan:Win32/Injector.cb79fba8
K7GW Trojan ( 005479b51 )
Cybereason malicious.e70c2a
Arcabit Trojan.Generic.D1E3A371
Symantec Trojan Horse
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Ulise-6918818-0
Kaspersky HEUR:Trojan.Win32.Ekstak.gen
BitDefender Trojan.GenericKD.31695729
NANO-Antivirus Trojan.Win32.Ekstak.fnanjl
Avast Win32:Trojan-gen
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKD.31695729
Sophos Mal/Generic-S
Comodo Malware@#1dknhcxw5ctdw
F-Secure Heuristic.HEUR/AGEN.1134075
DrWeb Trojan.PWS.Siggen2.8271
VIPRE Trojan.Win32.Generic!BT
TrendMicro Trojan.Win32.COSMU.SM
Emsisoft Trojan.Injector (A)
Jiangmin Trojan.Ekstak.xva
Avira HEUR/AGEN.1134075
Antiy-AVL Trojan/Win32.Ekstak
Microsoft Trojan:Win32/Occamy.CDE
Endgame malicious (high confidence)
AegisLab Trojan.Win32.Ekstak.4!c
ZoneAlarm HEUR:Trojan.Win32.Ekstak.gen
GData Trojan.GenericKD.31695729
Cynet Malicious (score: 85)
AhnLab-V3 Malware/Win32.Trojanspy.C3020928
BitDefenderTheta AI:Packer.E17A24C119
ALYac Trojan.GenericKD.31695729
MAX malware (ai score=86)
VBA32 Trojan.Ekstak
Zoner Trojan.Win32.75218
ESET-NOD32 a variant of Win32/Injector.EDOE
TrendMicro-HouseCall Trojan.Win32.COSMU.SM
Rising Ransom.Foreign!8.292 (TFE:dGZlOgSHu1b2NZXIWw)
Yandex Trojan.Ekstak!
Ikarus Trojan.Inject
Fortinet W32/GenKryptik.EKLE!tr
AVG Win32:Trojan-gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a31c8 VirtualFree
• 0x4a31cc VirtualAlloc
• 0x4a31d0 LocalFree
• 0x4a31d4 LocalAlloc
• 0x4a31d8 GetVersion
• 0x4a31dc GetCurrentThreadId
• 0x4a31e8 VirtualQuery
• 0x4a31ec WideCharToMultiByte
• 0x4a31f0 MultiByteToWideChar
• 0x4a31f4 lstrlenA
• 0x4a31f8 lstrcpynA
• 0x4a31fc LoadLibraryExA
• 0x4a3200 GetThreadLocale
• 0x4a3204 GetStartupInfoA
• 0x4a3208 GetProcAddress
• 0x4a320c GetModuleHandleA
• 0x4a3210 GetModuleFileNameA
• 0x4a3214 GetLocaleInfoA
• 0x4a3218 GetLastError
• 0x4a321c GetCommandLineA
• 0x4a3220 FreeLibrary
• 0x4a3224 FindFirstFileA
• 0x4a3228 FindClose
• 0x4a322c ExitProcess
• 0x4a3230 WriteFile
• 0x4a3238 SetFilePointer
• 0x4a323c SetEndOfFile
• 0x4a3240 RtlUnwind
• 0x4a3244 ReadFile
• 0x4a3248 RaiseException
• 0x4a324c GetStdHandle
• 0x4a3250 GetFileSize
• 0x4a3254 GetFileType
• 0x4a3258 CreateFileA
• 0x4a325c CloseHandle
Library user32.dll:
• 0x4a3264 GetKeyboardType
• 0x4a3268 LoadStringA
• 0x4a326c MessageBoxA
• 0x4a3270 CharNextA
Library advapi32.dll:
• 0x4a3278 RegQueryValueExA
• 0x4a327c RegOpenKeyExA
• 0x4a3280 RegCloseKey
Library oleaut32.dll:
• 0x4a3288 SysFreeString
• 0x4a328c SysReAllocStringLen
• 0x4a3290 SysAllocStringLen
Library kernel32.dll:
• 0x4a3298 TlsSetValue
• 0x4a329c TlsGetValue
• 0x4a32a0 LocalAlloc
• 0x4a32a4 GetModuleHandleA
Library advapi32.dll:
• 0x4a32ac RegSetValueExA
• 0x4a32b0 RegQueryValueExA
• 0x4a32b4 RegOpenKeyExA
• 0x4a32b8 RegOpenKeyA
• 0x4a32bc RegCloseKey
• 0x4a32c0 GetUserNameA
Library kernel32.dll:
• 0x4a32c8 lstrcpyA
• 0x4a32cc WriteFile
• 0x4a32d0 WinExec
• 0x4a32d4 WaitForSingleObject
• 0x4a32d8 VirtualQuery
• 0x4a32dc VirtualAlloc
• 0x4a32e0 Sleep
• 0x4a32e4 SizeofResource
• 0x4a32e8 SetThreadLocale
• 0x4a32ec SetFilePointer
• 0x4a32f0 SetEvent
• 0x4a32f4 SetErrorMode
• 0x4a32f8 SetEndOfFile
• 0x4a32fc ResetEvent
• 0x4a3300 ReadFile
• 0x4a3304 MultiByteToWideChar
• 0x4a3308 MulDiv
• 0x4a330c LockResource
• 0x4a3310 LoadResource
• 0x4a3314 LoadLibraryA
• 0x4a3320 GlobalUnlock
• 0x4a3324 GlobalSize
• 0x4a3328 GlobalReAlloc
• 0x4a332c GlobalHandle
• 0x4a3330 GlobalLock
• 0x4a3334 GlobalFree
• 0x4a3338 GlobalFindAtomA
• 0x4a333c GlobalDeleteAtom
• 0x4a3340 GlobalAlloc
• 0x4a3344 GlobalAddAtomA
• 0x4a3348 GetVersionExA
• 0x4a334c GetVersion
• 0x4a3350 GetUserDefaultLCID
• 0x4a3354 GetTickCount
• 0x4a3358 GetThreadLocale
• 0x4a335c GetSystemInfo
• 0x4a3360 GetStringTypeExA
• 0x4a3364 GetStdHandle
• 0x4a3368 GetProcAddress
• 0x4a336c GetModuleHandleA
• 0x4a3370 GetModuleFileNameA
• 0x4a3374 GetLocaleInfoA
• 0x4a3378 GetLocalTime
• 0x4a337c GetLastError
• 0x4a3380 GetFullPathNameA
• 0x4a3384 GetDiskFreeSpaceA
• 0x4a3388 GetDateFormatA
• 0x4a338c GetCurrentThreadId
• 0x4a3390 GetCurrentProcessId
• 0x4a3394 GetCurrentProcess
• 0x4a3398 GetComputerNameA
• 0x4a339c GetCPInfo
• 0x4a33a0 GetACP
• 0x4a33a4 FreeResource
• 0x4a33a8 InterlockedExchange
• 0x4a33ac FreeLibrary
• 0x4a33b0 FormatMessageA
• 0x4a33b4 FindResourceA
• 0x4a33b8 FindFirstFileA
• 0x4a33bc FindClose
• 0x4a33c8 ExitProcess
• 0x4a33cc EnumCalendarInfoA
• 0x4a33d4 DeleteFileA
• 0x4a33dc CreateThread
• 0x4a33e0 CreateFileA
• 0x4a33e4 CreateEventA
• 0x4a33e8 CreateDirectoryA
• 0x4a33ec CompareStringA
• 0x4a33f0 CloseHandle
Library mpr.dll:
Library version.dll:
• 0x4a3404 VerQueryValueA
• 0x4a340c GetFileVersionInfoA
Library gdi32.dll:
• 0x4a3414 UnrealizeObject
• 0x4a3418 StretchBlt
• 0x4a341c SetWindowOrgEx
• 0x4a3420 SetWinMetaFileBits
• 0x4a3424 SetViewportOrgEx
• 0x4a3428 SetTextColor
• 0x4a342c SetStretchBltMode
• 0x4a3430 SetROP2
• 0x4a3434 SetPixel
• 0x4a3438 SetEnhMetaFileBits
• 0x4a343c SetDIBColorTable
• 0x4a3440 SetBrushOrgEx
• 0x4a3444 SetBkMode
• 0x4a3448 SetBkColor
• 0x4a344c SelectPalette
• 0x4a3450 SelectObject
• 0x4a3454 SaveDC
• 0x4a3458 RestoreDC
• 0x4a345c Rectangle
• 0x4a3460 RectVisible
• 0x4a3464 RealizePalette
• 0x4a3468 Polyline
• 0x4a346c PlayEnhMetaFile
• 0x4a3470 PatBlt
• 0x4a3474 MoveToEx
• 0x4a3478 MaskBlt
• 0x4a347c LineTo
• 0x4a3480 IntersectClipRect
• 0x4a3484 GetWindowOrgEx
• 0x4a3488 GetWinMetaFileBits
• 0x4a348c GetTextMetricsA
• 0x4a3490 GetTextExtentPointA
• 0x4a349c GetStockObject
• 0x4a34a0 GetRgnBox
• 0x4a34a4 GetPixelFormat
• 0x4a34a8 GetPixel
• 0x4a34ac GetPaletteEntries
• 0x4a34b0 GetObjectA
• 0x4a34b4 GetGraphicsMode
• 0x4a34c4 GetEnhMetaFileBits
• 0x4a34c8 GetDeviceCaps
• 0x4a34cc GetDIBits
• 0x4a34d0 GetDIBColorTable
• 0x4a34d4 GetDCOrgEx
• 0x4a34dc GetClipBox
• 0x4a34e0 GetBrushOrgEx
• 0x4a34e4 GetBkColor
• 0x4a34e8 GetBitmapBits
• 0x4a34ec GdiFlush
• 0x4a34f0 ExtTextOutA
• 0x4a34f4 ExcludeClipRect
• 0x4a34f8 DeleteObject
• 0x4a34fc DeleteEnhMetaFile
• 0x4a3500 DeleteDC
• 0x4a3504 CreateSolidBrush
• 0x4a3508 CreateRectRgn
• 0x4a350c CreatePenIndirect
• 0x4a3510 CreatePalette
• 0x4a3518 CreateFontIndirectA
• 0x4a351c CreateEnhMetaFileA
• 0x4a3520 CreateDIBitmap
• 0x4a3524 CreateDIBSection
• 0x4a3528 CreateCompatibleDC
• 0x4a3530 CreateBrushIndirect
• 0x4a3534 CreateBitmap
• 0x4a3538 CopyEnhMetaFileA
• 0x4a353c CombineRgn
• 0x4a3540 CloseEnhMetaFile
• 0x4a3544 BitBlt
Library user32.dll:
• 0x4a354c CreateWindowExA
• 0x4a3550 WindowFromPoint
• 0x4a3554 WinHelpA
• 0x4a3558 WaitMessage
• 0x4a355c UpdateWindow
• 0x4a3560 UnregisterClassA
• 0x4a3564 UnhookWindowsHookEx
• 0x4a3568 TranslateMessage
• 0x4a3570 TrackPopupMenu
• 0x4a3578 ShowWindow
• 0x4a357c ShowScrollBar
• 0x4a3580 ShowOwnedPopups
• 0x4a3584 ShowCursor
• 0x4a3588 SetWindowsHookExA
• 0x4a358c SetWindowTextA
• 0x4a3590 SetWindowPos
• 0x4a3594 SetWindowPlacement
• 0x4a3598 SetWindowLongA
• 0x4a359c SetTimer
• 0x4a35a0 SetScrollRange
• 0x4a35a4 SetScrollPos
• 0x4a35a8 SetScrollInfo
• 0x4a35ac SetRect
• 0x4a35b0 SetPropA
• 0x4a35b4 SetParent
• 0x4a35b8 SetMenuItemInfoA
• 0x4a35bc SetMenu
• 0x4a35c0 SetForegroundWindow
• 0x4a35c4 SetFocus
• 0x4a35c8 SetCursor
• 0x4a35cc SetClipboardData
• 0x4a35d0 SetClassLongA
• 0x4a35d4 SetCapture
• 0x4a35d8 SetActiveWindow
• 0x4a35dc SendMessageA
• 0x4a35e0 ScrollWindow
• 0x4a35e4 ScreenToClient
• 0x4a35e8 RemovePropA
• 0x4a35ec RemoveMenu
• 0x4a35f0 ReleaseDC
• 0x4a35f4 ReleaseCapture
• 0x4a3600 RegisterClassA
• 0x4a3604 RedrawWindow
• 0x4a3608 PtInRect
• 0x4a360c PostQuitMessage
• 0x4a3610 PostMessageA
• 0x4a3614 PeekMessageA
• 0x4a3618 OpenClipboard
• 0x4a361c OffsetRect
• 0x4a3620 OemToCharA
• 0x4a3624 MessageBoxA
• 0x4a3628 MessageBeep
• 0x4a362c MapWindowPoints
• 0x4a3630 MapVirtualKeyA
• 0x4a3634 LockWindowUpdate
• 0x4a3638 LoadStringA
• 0x4a363c LoadKeyboardLayoutA
• 0x4a3640 LoadImageA
• 0x4a3644 LoadIconA
• 0x4a3648 LoadCursorA
• 0x4a364c LoadBitmapA
• 0x4a3650 KillTimer
• 0x4a3654 IsZoomed
• 0x4a3658 IsWindowVisible
• 0x4a365c IsWindowEnabled
• 0x4a3660 IsWindow
• 0x4a3664 IsRectEmpty
• 0x4a3668 IsIconic
• 0x4a366c IsDialogMessageA
• 0x4a3670 IsChild
• 0x4a3674 InvalidateRect
• 0x4a3678 IntersectRect
• 0x4a367c InsertMenuItemA
• 0x4a3680 InsertMenuA
• 0x4a3684 InflateRect
• 0x4a368c GetWindowTextA
• 0x4a3690 GetWindowRect
• 0x4a3694 GetWindowPlacement
• 0x4a3698 GetWindowLongA
• 0x4a369c GetWindowDC
• 0x4a36a0 GetTopWindow
• 0x4a36a4 GetSystemMetrics
• 0x4a36a8 GetSystemMenu
• 0x4a36ac GetSysColorBrush
• 0x4a36b0 GetSysColor
• 0x4a36b4 GetSubMenu
• 0x4a36b8 GetScrollRange
• 0x4a36bc GetScrollPos
• 0x4a36c0 GetScrollInfo
• 0x4a36c4 GetPropA
• 0x4a36c8 GetParent
• 0x4a36cc GetWindow
• 0x4a36d0 GetMessageTime
• 0x4a36d4 GetMessagePos
• 0x4a36d8 GetMenuStringA
• 0x4a36dc GetMenuState
• 0x4a36e0 GetMenuItemInfoA
• 0x4a36e4 GetMenuItemID
• 0x4a36e8 GetMenuItemCount
• 0x4a36ec GetMenu
• 0x4a36f0 GetLastActivePopup
• 0x4a36f4 GetKeyboardState
• 0x4a36fc GetKeyboardLayout
• 0x4a3700 GetKeyState
• 0x4a3704 GetKeyNameTextA
• 0x4a3708 GetIconInfo
• 0x4a370c GetForegroundWindow
• 0x4a3710 GetFocus
• 0x4a3714 GetDesktopWindow
• 0x4a3718 GetDCEx
• 0x4a371c GetDC
• 0x4a3720 GetCursorPos
• 0x4a3724 GetCursor
• 0x4a3728 GetClipboardData
• 0x4a372c GetClientRect
• 0x4a3730 GetClassNameA
• 0x4a3734 GetClassInfoA
• 0x4a3738 GetCapture
• 0x4a373c GetActiveWindow
• 0x4a3740 FrameRect
• 0x4a3744 FindWindowA
• 0x4a3748 FillRect
• 0x4a374c EqualRect
• 0x4a3750 EnumWindows
• 0x4a3754 EnumThreadWindows
• 0x4a375c EndPaint
• 0x4a3760 EnableWindow
• 0x4a3764 EnableScrollBar
• 0x4a3768 EnableMenuItem
• 0x4a376c EmptyClipboard
• 0x4a3770 DrawTextA
• 0x4a3774 DrawMenuBar
• 0x4a3778 DrawIconEx
• 0x4a377c DrawIcon
• 0x4a3780 DrawFrameControl
• 0x4a3784 DrawFocusRect
• 0x4a3788 DrawEdge
• 0x4a378c DispatchMessageA
• 0x4a3790 DestroyWindow
• 0x4a3794 DestroyMenu
• 0x4a3798 DestroyIcon
• 0x4a379c DestroyCursor
• 0x4a37a0 DeleteMenu
• 0x4a37a4 DefWindowProcA
• 0x4a37a8 DefMDIChildProcA
• 0x4a37ac DefFrameProcA
• 0x4a37b0 CreatePopupMenu
• 0x4a37b4 CreateMenu
• 0x4a37b8 CreateIcon
• 0x4a37bc CloseClipboard
• 0x4a37c0 ClientToScreen
• 0x4a37c4 CheckMenuItem
• 0x4a37c8 CallWindowProcA
• 0x4a37cc CallNextHookEx
• 0x4a37d0 BeginPaint
• 0x4a37d4 CharNextA
• 0x4a37d8 CharLowerBuffA
• 0x4a37dc CharLowerA
• 0x4a37e0 CharUpperBuffA
• 0x4a37e4 CharToOemA
• 0x4a37e8 AdjustWindowRectEx
Library kernel32.dll:
• 0x4a37f4 Sleep
Library oleaut32.dll:
• 0x4a37fc SafeArrayPtrOfIndex
• 0x4a3800 SafeArrayGetUBound
• 0x4a3804 SafeArrayGetLBound
• 0x4a3808 SafeArrayCreate
• 0x4a380c VariantChangeType
• 0x4a3810 VariantCopyInd
• 0x4a3814 VariantCopy
• 0x4a3818 VariantClear
• 0x4a381c VariantInit
Library ole32.dll:
• 0x4a3828 IsAccelerator
• 0x4a382c OleDraw
• 0x4a3834 CoTaskMemFree
• 0x4a3838 ProgIDFromCLSID
• 0x4a383c StringFromCLSID
• 0x4a3840 CoCreateInstance
• 0x4a3844 CoGetClassObject
• 0x4a3848 CoUninitialize
• 0x4a384c CoInitialize
• 0x4a3850 IsEqualGUID
Library oleaut32.dll:
• 0x4a3858 GetErrorInfo
• 0x4a385c GetActiveObject
• 0x4a3860 SysFreeString
Library comctl32.dll:
• 0x4a3870 ImageList_Write
• 0x4a3874 ImageList_Read
• 0x4a3884 ImageList_DragMove
• 0x4a3888 ImageList_DragLeave
• 0x4a388c ImageList_DragEnter
• 0x4a3890 ImageList_EndDrag
• 0x4a3894 ImageList_BeginDrag
• 0x4a3898 ImageList_Remove
• 0x4a389c ImageList_DrawEx
• 0x4a38a0 ImageList_Replace
• 0x4a38a4 ImageList_Draw
• 0x4a38b4 ImageList_Add
• 0x4a38c0 ImageList_Destroy
• 0x4a38c4 ImageList_Create
• 0x4a38c8 InitCommonControls
Library shell32.dll:
• 0x4a38d0 ShellExecuteExA
• 0x4a38d4 ShellExecuteA
Library wininet.dll:
• 0x4a38dc InternetSetOptionA
• 0x4a38ec FindCloseUrlCache
• 0x4a38f0 DeleteUrlCacheEntry
Library URLMON.DLL:
Library shfolder.dll:
• 0x4a3904 SHGetFolderPathA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.