2.5
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.57
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Dropper-gen [Drp] | 20200106 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200106 | 2013.8.14.323 |
| McAfee | Downloader-FBVX!369FEC4065D1 | 20200106 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b09d99 | 20200106 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545295.45325 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545295.79725 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545295.37525 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545295.75025 IsDebuggerPresent |
failed | 0 | 0 |
一个或多个进程崩溃
(4 个事件)
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\wujek.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\wujek.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\wujek.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
创建已知的 Dyreza 银行木马文件、注册表项和/或互斥体
(1 个事件)
| file | C:\Users\Regina\AppData\Local\Temp\Temp1_Fax_115-871.zip\Fax_115-871.scr |
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意
(50 out of 58 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Dropper-gen [Drp] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Cryptodef.C3030515 |
| Antiy-AVL | Trojan[Ransom]/Win32.Cryptodef |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Dropper-gen [Drp] |
| Avira | TR/Crypt.XPACK.Gen |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | AI:Packer.0EECEDEA1E |
| Bkav | W32.FamVT.GeND.Trojan |
| Comodo | TrojWare.Win32.TrojanDownloader.Waski.DA@5iyglc |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.065d17 |
| Cylance | Unsafe |
| Cyren | W32/Upatre.HQ.gen!Eldorado |
| DrWeb | Trojan.DownLoader25.4327 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Upatre.HQ.gen!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.369fec4065d174ec |
| Fortinet | W32/Waski.A!tr.dldr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Cryptodef.bk |
| K7AntiVirus | Trojan-Downloader ( 0055c6c71 ) |
| K7GW | Trojan-Downloader ( 004b972f1 ) |
| Kaspersky | Trojan-Ransom.Win32.Cryptodef.aoo |
| MAX | malware (ai score=84) |
| McAfee | Downloader-FBVX!369FEC4065D1 |
| McAfee-GW-Edition | Downloader-FBVX!369FEC4065D1 |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.Cryptodef.decmtn |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM20.1.6125.Malware.Gen |
| Rising | Ransom.Cryptodef!8.672 (TFE:2:YiK3GcCGMbU) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Zbot-QL |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10b09d99 |
| Trapmine | malicious.high.ml.score |
| TrendMicro | TROJ_UPATRE.SMBE |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1995-08-16 06:20:40
PE Imphash
1fa1ed0f1cf7ef2cc5e5ba9203b3f842
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000007dc | 0x00000800 | 5.8585405434666455 |
| .rdata | 0x00002000 | 0x000005e4 | 0x00000800 | 3.73953163400877 |
| .data | 0x00003000 | 0x00000e6c | 0x00001000 | 6.517814518780301 |
| .rsrc | 0x00004000 | 0x00002d00 | 0x00003000 | 0.1262653593710422 |
Imports
Library KERNEL32.DLL:
• 0x40200c GetModuleHandleA
• 0x402010 ExitProcess
• 0x402014 lstrcpyA
• 0x402018 LoadLibraryA
• 0x40201c GetStartupInfoA
• 0x402020 CloseHandle
• 0x402024 lstrcatA
• 0x402028 MapViewOfFile
• 0x40202c GetCommandLineW
• 0x402030 CreateDirectoryA
Library MSVCRT.dll:
• 0x402038 _controlfp
• 0x40203c _except_handler3
• 0x402040 __set_app_type
• 0x402044 __p__fmode
• 0x402048 __p__commode
• 0x40204c _adjust_fdiv
• 0x402050 __setusermatherr
• 0x402054 _initterm
• 0x402058 __getmainargs
• 0x40205c _acmdln
• 0x402060 exit
• 0x402064 _XcptFilter
• 0x402068 _exit
Library SHELL32.dll:
• 0x402070 CommandLineToArgvW
Library USER32.dll:
• 0x402078 SetScrollInfo
• 0x40207c SetPropA
• 0x402080 GetPropA
• 0x402084 GetCursorPos
• 0x402088 SetWindowTextA
• 0x40208c LoadCursorA
• 0x402090 SendMessageA
• 0x402094 DefWindowProcA
• 0x402098 RegisterClassExA
• 0x40209c CreateWindowExA
• 0x4020a0 TranslateMessage
• 0x4020a4 MessageBoxW
• 0x4020a8 UpdateWindow
• 0x4020ac ShowWindow
• 0x4020b0 PostQuitMessage
• 0x4020b4 GetMessageA
• 0x4020b8 EndPaint
• 0x4020bc DispatchMessageA
• 0x4020c0 RemovePropA
• 0x4020c4 BeginPaint
• 0x4020c8 ScrollWindow
L!This program cannot be run in DOS mode.
`.rdata
@.data
3Q5-;@
@PE@@h h Ujh!@
hSVWe3
EEP5P>@
EPEPEP
0u>"u:Fu
<"u>"u
> vFuj
WAVAf9
;wME;r
@@_0E
PQPVj h
3PQPVj h
3i_^P-;@
X+PQ_Y
3'EP@h @h
qa*i`#$DqG
@Eh@UE
td]@% @
YY3%< @
wegukod
retro face
klavesn
trokasil
wghediuwekf
SHDBCYWED6
gexasion
bibelism
static
button
RichEdit
Kernel32.dll
Riched32.dll
ScrollWindow
SetPropA
RemovePropA
GetPropA
GetCursorPos
SetWindowTextA
SetScrollInfo
LoadCursorA
SendMessageA
DefWindowProcA
RegisterClassExA
CreateWindowExA
TranslateMessage
MessageBoxW
BeginPaint
DispatchMessageA
EndPaint
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
CreateDirectoryA
GetCommandLineW
MapViewOfFile
lstrcatA
CloseHandle
GetModuleHandleA
LoadLibraryA
lstrcpyA
ExitProcess
KERNEL32.DLL
ImageList_Create
COMCTL32.dll
CommandLineToArgvW
SHELL32.dll
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetStartupInfoA
12 54 1
pq
mno
ijkl
defgh
7890abc
|123456
/(_:<[}
Y;AsX<
5GFH)]lx
RLq&O=
@o=*I,<e
GbDp/lGA
H{J%XEmK
JKpAi{YGQKeS*N
NK+ $f+EH\q
za*zi#$VqIN
sQta*eB5IE"'LD
, '~4)pjHJ
%Ja}FiM
4f2}<-p
CqG#;-
}<zI_%<+tFXrzR0-!
G3g7jO$1qf
Y]~OfGydV
fxqh|2qQ(WQ
W MG62k
O>yu]Y
Q*j/(.jqH
s-\L~YhA
jfjM4>6JH9[%wuG
[1!j1`
jQ?mb3D
CoE-c&
JYhyT>O=
AYe'\qr0{:,%@
RLJ;-av;
qaxN<zT B
-.Wxik%ms
GAcMM;(l*.3
Xn^d4O$x0
ba*?v1
2v4cl0ItAb_zhAa[wtL>p2
;mko4Cz
jiwrm9Zz:
iY|o&E
*BZRTtXF9g[^@;}e
N<*;EV
hnyGM0-
A?!_Q_:52v
uxJ^{SO=
~Mc*iv7E|Dq
V,VSr"=
N1q,,P2l=`Y
C : \ U s e r s \ R e g i n a \ A p p D a t a \ L o c a l \ T e m p \ T e m p 1 _ F a x _ 1 1 5 - 8 7 1 . z i p \ F a x _ 1 1 5 - 8 7 1 . s c r
C : \ U s e r s \ L i s a \ D e s k t o p \ e 9 x Y A c K s . e x e
C : \ 9 6 c e e 6 d 1 c 9 2 d 4 c 4 d f c a 2 8 1 f f f 2 0 a b a 8 6 b 7 c 4 7 4 4 0 b a 8 b a c 7 c e 7 e 6 8 d e 8 b b a e 9 3 f 9
C : \ e 8 4 6 c d d 4 6 e 8 1 4 1 8 8 c 2 1 6 f c 1 d 8 4 b d f 2 1 6 a f e 8 8 8 0 5 4 b 4 6 6 7 b 4 4 9 2 d 5 9 c 9 2 4 2 7 6 5 f 8
C : \ 6 8 b 4 2 a e 0 a 0 8 4 6 e 5 2 c 8 6 d 3 a f 9 f 3 4 b a 4 9 d 5 0 f 6 e f f f 7 5 d 6 2 6 4 e 0 d 7 8 b 0 6 7 7 8 c b 2 0 9 8
C : \ U s e r s \ L i s a \ D e s k t o p \ U C S Y A a A Z . e x e
C : \ 9 7 c e e 4 b c 4 0 a 6 0 b e 2 0 9 5 4 d 5 2 0 1 a 4 a 5 b 2 0 5 e 4 3 6 1 4 b 6 e b 5 8 6 f b e a 0 9 e 7 4 d 1 9 1 0 9 b 0 6
C : \ U s e r s \ L i s a \ D e s k t o p \ A h H 5 C u z S . e x e
C : \ U s e r s \ J o h n n y C a g e \ D e s k t o p \ E 9 1 r 1 0 M g O D . e x e
C : \ 3 0 d d c e 6 1 1 f 5 b d 8 3 c 5 9 a 9 3 c f 7 2 d 1 a 7 3 d e e 4 5 7 7 e 8 1 4 9 7 d e 7 6 8 1 6 9 e f 6 9 c a 8 6 f 1 e a d
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ 6 8 A 7 3 9 0 6 1 8 8 C 8 7 1 2 B 4 2 E C B B A F 8 B C 2 4 3 4 . b i n . e x e
C : \ 3 e d 5 8 e 3 4 9 f 8 8 c 6 f f e 6 e 0 8 4 2 d 5 0 8 d a 6 6 d 6 a d 9 d c 1 1 6 3 6 e 6 e 1 f 4 8 1 f c 1 e 1 2 0 1 2 f 4 0 a
C : \ 6 5 8 d 2 c c 3 7 0 a 4 d 3 d c 2 5 7 0 2 f a 8 1 5 5 1 f b 5 7 3 2 9 7 b 4 4 0 c 3 9 0 9 b 6 c 3 b 4 4 a 6 9 3 3 3 8 6 0 1 f 9
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ 8 E 3 6 A 5 A 0 B 8 D C 6 F D C D B F 8 7 2 C 6 5 7 D E 5 1 F 9 . b i n . e x e
C : \ 0 4 e 5 f 2 3 3 2 5 b 7 a d a 9 2 e 7 7 3 3 9 1 3 4 b 7 6 d e 6 3 e a e 6 c f c c b 2 c 7 5 3 1 1 0 6 6 0 9 3 3 d 6 9 8 1 d e a
C : \ d 8 b 5 b d 1 5 3 f d 6 4 c f d 2 0 7 e b a 0 0 c 2 9 7 8 e 7 5 4 0 c f a b 9 3 0 7 9 7 d 6 1 9 5 8 7 8 d 1 a 8 d 0 0 d f 1 8 0
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ 6 A 0 3 A 4 A C F 4 2 9 3 8 5 9 4 F F 9 B 2 E D 1 0 3 B 0 1 8 7 . b i n . e x e
C : \ V I D 6 6 5 2 3 5 6 6 1 . e x e
C : \ 3 f 3 e 1 4 d 2 8 3 b 4 a 9 e e 4 b 2 6 8 9 2 c 4 5 4 5 8 4 c f f d 8 2 4 a f d f 5 f 3 7 5 d 1 e e 3 c 5 c c a 4 4 6 a 5 8 0 0
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ D 5 5 8 F D B D F 0 7 0 C 3 0 9 B 9 E 1 1 3 B C 7 C A 9 2 4 F 2 . b i n . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N N J b O 9 G A . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ k 4 X Q m Q z S i s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 9 e a f a 8 f a 2 9 0 9 5 7 b _ w u j e k . e x e
C : \ 0 0 5 4 0 c e a b f b 9 2 d 6 0 7 a 0 5 8 8 8 9 c 1 1 5 7 7 1 8 e 1 7 0 1 1 f 0 0 0 9 4 5 6 7 9 e f 3 7 7 9 4 d d 7 1 a 3 7 b 3
C : \ a 4 9 3 b e d 1 d f d 5 6 b 3 8 1 f 8 b 8 7 6 e f 6 0 e 2 a c a 5 d 3 8 2 d c 9 f 1 9 5 8 e b 4 b 2 4 d 7 9 a 7 4 b 5 6 e e 9 a
C : \ a 0 9 f f 0 1 9 9 a 9 f 9 f 6 c 6 c f a 5 9 2 3 7 3 9 e 5 3 a 9 8 b 9 9 f 4 6 2 a 6 4 1 3 5 c 0 c 5 d 2 3 6 8 7 7 c 1 a 5 3 8 5
C : \ 8 4 f e 8 8 f 9 6 9 d 3 7 4 a 7 1 8 4 e e 5 a 6 b 7 3 9 7 4 5 b d a b f e b 2 2 f c 1 7 9 e 7 5 9 2 5 4 5 2 2 e 6 d a 2 7 f c a
C : \ e 5 8 2 a c 2 7 d 4 9 a 0 a d 6 9 f 3 a 1 8 b 4 e 6 d c 1 4 5 6 9 8 3 9 c e 9 f 7 d 0 8 6 f 1 4 3 b 8 4 9 c 3 7 6 e 7 4 9 3 a f
C : \ e 2 c c b f e e d e e 9 e b 6 0 f 2 a 8 a b f 5 4 6 c 1 c d 1 d 3 6 a 0 4 d a f d f a 2 e 6 6 c c a 0 3 9 2 1 6 b 1 b 7 f 0 d 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 6 c e a 8 a 4 b 7 5 d 4 9 f f _ w u j e k . e x e
C : \ 9 f d 4 1 7 3 9 0 b 5 0 a b 8 8 3 f f c 1 d 5 4 d 2 0 f 5 0 c a 4 d b e f a 9 2 3 5 e 2 a c 3 2 3 7 7 6 2 1 6 6 f 0 f e 6 7 1 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ 9 8 f 5 f 7 2 0 0 2 4 4 a a d 4 d d e 8 3 4 4 2 7 6 0 3 e 7 6 3 2 2 9 8 0 3 3 6 9 4 e 7 b 4 f 0 3 9 0 b 5 e 4 4 6 0 a 4 f 8 e 7
C : \ 9 c c 3 1 1 3 9 4 a 0 9 3 e 1 c f 0 6 b 9 5 1 9 5 0 e 6 c 8 c 7 5 1 5 b 2 f 7 e e 7 f 3 5 e 1 2 7 d 1 a c e f 5 7 7 e c 3 1 1 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ U M D 0 G I Q g . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 4 6 9 3 0 0 a f 5 2 1 f f b 8 2 a 6 1 5 2 9 b f 2 e 0 a 3 6 0 a 0 1 3 d 8 7 f 5 8 d 3 2 d 4 b 8 b 4 7 2 7 3 7 0 6 5 1 0 c 1 c . e x e
C : \ 9 c 7 8 d f f 7 a 0 0 0 d 3 5 b a 1 1 a 8 9 3 7 a e 1 5 0 6 8 3 6 8 8 f 7 5 f 2 2 4 1 7 2 d 9 4 a 4 5 d b a 2 f 6 1 d 1 7 2 3 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ 1 9 a 6 f 2 3 4 1 1 0 a 5 8 1 e 9 7 5 c 2 6 2 f 1 5 1 a 3 1 7 8 8 2 4 1 f e 8 4 2 c d a 9 5 7 e a 9 f 6 7 e 8 f 3 4 e a 3 5 0 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ 8 8 f 6 0 6 1 d 8 8 9 8 8 8 b 4 0 8 d e 6 4 d d 4 1 7 a 1 9 c a 5 6 d 1 9 a 0 a a 7 7 f 9 2 1 8 d 5 b 4 c 2 4 7 9 4 d 0 e c a 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q f j L C g G x . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 5 d b 6 0 3 e 4 6 9 f 4 4 7 0 6 5 6 e 6 6 8 b 3 8 7 5 9 4 3 0 4 f 9 0 4 2 5 9 7 f 2 0 3 b 3 4 0 4 0 5 0 e 1 4 5 3 0 6 e 9 8 5 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 5 b 1 a 1 0 e 8 0 c 2 b 7 0 6 _ w u j e k . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 0 2 0 b 7 9 5 9 3 c c 2 8 f 0 _ w u j e k . e x e
C : \ a d b e d 3 a 9 b b c 8 f 8 7 b 6 6 3 b c 2 4 d 0 3 8 e b c d 4 4 f a 7 8 f 4 0 4 3 0 b 4 b 7 9 2 c a 9 a b 1 4 d 4 1 4 3 b a 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ n R 2 q c Q 3 h . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 f 8 3 9 7 4 2 5 3 7 9 1 5 0 f _ w u j e k . e x e
C : \ 0 a d 7 b 8 5 4 e 5 2 a 1 6 c 5 4 b a 8 4 e 4 f 5 f a 9 8 9 d 9 a b 6 6 2 8 b 7 5 5 0 1 a 4 a 7 9 b b 0 8 f d 0 4 3 4 1 5 9 2 7
C : \ b 9 2 4 3 9 2 3 6 3 2 c b a 9 c a 5 6 5 c 1 6 1 6 f 4 9 6 a 8 a 1 1 f 3 b 2 e 7 a 6 1 e 6 7 6 a a 5 8 6 a 1 d f 5 0 1 b f 5 f 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ a c 4 9 3 3 7 2 0 6 e e f f 5 4 9 b 3 3 8 4 4 0 0 3 f d 2 0 f 5 3 1 e 2 f 1 5 9 c c 0 e 7 9 2 3 9 a 1 6 9 f f b 4 d 2 3 7 f 0 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 8 b 1 9 d 8 e 0 5 8 2 5 3 8 3 _ w u j e k . e x e
C : \ 1 8 1 1 b 7 3 c 4 7 4 7 4 0 5 6 6 9 1 7 5 7 3 e 0 d 4 7 9 a c 0 a 7 d d 3 3 2 8 e f 5 8 c d 7 b 1 4 4 b 6 f 4 c e 9 f 6 8 2 f 9
C : \ b 0 4 9 5 a e 3 d 0 d 2 d 8 e d 0 0 3 5 1 f 7 c 5 f 2 a a f 2 9 f f 2 c 9 3 f 5 c b 2 a 4 4 5 1 d 6 d 1 9 3 2 b c 9 f 1 6 2 6 2
C : \ 1 b 5 0 b 8 a c 4 4 b c 9 2 0 f 5 1 a a 3 2 f 6 a 3 4 0 a 5 6 6 c 3 1 7 4 b 0 7 9 6 5 e d 5 0 2 4 5 7 1 8 f 5 8 4 7 d 3 e d 6 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ 1 7 d 1 b d 7 0 4 3 1 7 c f f e e 3 b a 3 8 9 c 6 c c 5 3 f 7 1 d b d 5 9 4 5 f 0 a b 8 d a b 2 9 7 1 b 0 3 3 f d 8 e 6 7 b d 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ f 7 c a 5 9 9 3 3 8 1 3 a f b 2 0 4 7 e 0 1 7 b a 3 2 9 c f 2 b 6 e 5 3 9 d 9 3 6 2 2 e 7 7 c c d f f 0 d 9 0 8 1 8 f b 3 d 1 7
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ 9 I 8 5 K l r p . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 6 4 e b f 1 5 5 b 6 1 2 6 9 f 9 e 8 7 7 e 2 a c c e a 7 2 6 6 7 d 3 c 7 6 2 d 1 4 b a 1 d 6 d 5 0 2 9 8 7 1 f e b b 2 c c 7 a . e x e
C : \ 8 f d 1 0 e 5 9 1 b c a d 9 0 7 3 f 2 7 8 9 8 d 3 2 3 9 a c a e d 0 e d f c 7 6 3 6 5 e c 9 b 8 e f 9 4 4 5 7 b a c 8 9 f f b 3
C : \ 8 8 6 3 b e 9 d f 2 e 6 a f 2 2 d 7 e b e d d 3 2 f 0 0 5 a 7 3 5 6 f 7 f a 3 5 f 7 6 f d 6 3 5 3 8 7 c 1 d f 4 3 e 2 d 4 e d c
C : \ 8 b a b f 3 8 a e f a 4 a 6 4 9 2 9 8 4 b b e e d 1 7 d 0 8 0 4 9 8 8 8 3 f 3 5 c 3 9 a 5 c 6 f 9 c 3 2 8 d d c f d 6 1 1 c 2 2
C : \ 5 3 b 5 7 8 2 1 5 3 4 1 c 5 5 b 2 f c d e 9 6 f f 0 f d b 9 a 8 4 4 5 0 f 7 f 3 a 8 8 e e 2 f 2 b 5 4 1 b d 2 8 d 7 4 c 7 1 3 6
C : \ 1 1 7 9 4 5 6 7 5 1 a d 9 c e 6 1 7 1 7 5 3 3 1 1 e c a 9 c 0 9 7 c d e 9 2 5 0 8 6 3 6 a 3 5 f f 6 b 9 0 9 7 4 d c 3 5 d 6 3 7
C : \ e 2 a 6 c d 2 2 2 c 9 b 8 a e 2 9 4 3 f d c b e 3 8 d a 9 f 8 a 6 5 f e 9 2 c e e 9 1 d 1 c f 3 5 3 b 3 b 6 a 3 b 8 2 6 2 c b 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ s v C 9 h 3 0 g . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b c 2 a 2 b 2 e a f d c 1 1 5 c _ w u j e k . e x e
C : \ 4 9 3 5 a 5 9 2 8 1 3 1 d d 5 f f 2 f b 6 6 e 2 3 a 2 3 2 1 0 a 3 4 4 4 9 5 6 c 0 9 8 9 f a 8 2 e 1 3 8 5 3 2 5 f e 0 b 6 8 4 c
C : \ 9 b a a 9 6 a 9 5 7 2 d 7 0 e 0 d f c 5 6 a 3 2 4 1 d 0 b 0 1 1 6 3 8 4 4 8 b e 7 1 9 1 4 8 0 2 6 f f 7 5 0 1 4 e 7 3 b 9 8 8 8
C : \ c 1 8 a 4 8 d 3 9 b 3 e 6 d b 2 b e 8 9 a b 6 e 4 2 c 8 d f 1 5 b a 0 5 a e 1 1 4 b f 5 6 3 e 9 9 8 9 c a 4 9 1 7 0 5 1 a b 9 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ 4 7 f 3 5 7 b 7 d 9 6 b 0 b 9 3 6 1 0 5 6 9 0 0 9 e 3 6 0 c 2 7 6 e 2 6 9 b 4 1 3 0 3 5 6 0 b a f 2 f a c 3 7 5 3 6 e 2 c 6 c 3
C : \ d d b 3 d 9 4 3 6 1 5 a 0 a 2 7 6 b 8 6 a 1 a 1 e 7 8 a b d b 4 b d 6 5 1 f 5 7 d c 9 7 a 6 7 2 a 6 5 8 a 1 4 0 a b 1 8 9 e 0 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ a 5 8 1 d c f 5 b 1 a 9 7 d 4 b f 9 8 2 b 8 d 6 5 9 9 5 8 7 9 9 0 8 c 9 0 1 9 4 5 1 c 3 d 7 3 8 1 2 d 0 8 b d 3 6 6 8 5 0 7 c d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P 0 P U b h v 5 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 2 7 2 b 2 e 2 d c a c 8 0 4 a 6 d c a 4 1 5 3 b 9 5 2 5 f 4 0 7 0 0 f e 7 a 5 4 f 1 2 e 6 c d 4 4 d 8 4 3 c 9 d e e 2 8 4 b 5 4
C : \ d b 7 8 e 9 8 c 4 0 c 8 a 9 7 c e 3 d c 9 0 6 b 4 c d 5 7 2 9 b e 9 2 f 9 8 2 0 5 b 6 3 6 0 0 a f d 5 6 b 1 2 c e b 4 9 1 0 a 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ 4 5 b 6 6 1 d 9 a 2 e 6 1 9 d f 2 1 4 9 9 9 9 6 2 e 5 e 9 f 8 3 1 7 a a d f 7 6 1 6 8 f e 4 4 7 1 6 c 7 e d b a 8 3 8 c d 9 a 5
C : \ 3 a c 2 0 3 5 0 5 b 1 d 3 0 3 7 5 2 2 5 0 b f 7 d f a 9 9 e 4 d f b 8 d 4 9 e b f 5 f 3 f 6 b d c 6 7 8 2 0 3 e 4 0 c 3 f a e 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ 0 8 4 4 4 8 a 4 6 e b e c 9 b 7 6 4 b f 2 5 0 0 e 5 1 e 1 0 e d a d 0 9 f c 9 4 c 6 b a 4 c 7 a 2 d a 0 0 1 b 5 0 a 5 f c 1 f c
C : \ c 8 c 8 4 f 8 6 f 5 e e 9 7 e 7 a 8 f 8 0 9 a c a 5 3 b 1 7 7 5 3 8 b e 0 4 b 2 d 1 f a f 0 4 e f d e c f 6 3 4 a e 0 6 3 1 c c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 9 L C B C e U 9 . e x e
C : \ 5 d 9 5 7 7 7 e 3 0 7 6 c 8 7 f d 6 5 f 8 d f 9 c 5 a 9 e 0 9 b b 1 6 8 7 8 6 0 4 3 d 6 d 2 3 b 5 0 9 f 8 a 2 c 5 6 1 8 2 7 5 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ I M t 1 Z 5 8 8 . e x e
C : \ 7 f 8 3 2 5 2 8 9 0 b 5 2 0 2 8 8 c 0 1 c 6 8 f 4 f 5 2 b 1 8 4 8 c a 1 1 8 8 8 8 2 b 3 2 9 2 0 e d f a 2 f b b b 6 8 b 5 a e 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w u j e k . p e 3 2
C : \ c 4 1 5 c a c a 5 8 2 0 2 d 9 1 7 d 5 3 d 4 2 5 3 0 e 9 d 2 5 b 6 f 6 2 e d f 0 0 d b c 2 0 5 c b 7 e b 7 a a b c f e c 4 b 3 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w u j e k . e x e
Process Tree
-
048d5f8026848d873a9508e29edf832f904f09cbe701bbbdf488f72b46115103.exe (1332)
"C:\Users\Administrator\AppData\Local\Temp\048d5f8026848d873a9508e29edf832f904f09cbe701bbbdf488f72b46115103.exe"
- wujek.exe (1260) "C:\Users\ADMINI~1\AppData\Local\Temp\wujek.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 9df2c51afed201e3_wujek.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\wujek.exe |
| Size | 34.8KB |
| Processes | 1332 (048d5f8026848d873a9508e29edf832f904f09cbe701bbbdf488f72b46115103.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | d203dc46bc33fe2f8b9e9007113e5a65 |
| SHA1 | 4df08c69a01f5b6045bc5dbbc2c3d37342c77327 |
| SHA256 | 9df2c51afed201e33301fddb01e9448a79b038a7e5d4709fc71e1c96b6a5a370 |
| CRC32 | 9794A8DC |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.