4.4
中危
61 个模型检测该样本为恶意！
重新分析
更多

da97d22eb7016e9daa46962d9c6eb47d9227ad534a996531b793cd00f71b36a0

377a9b356f6e80ec29083be9f5b8f74f.exe

分析耗时

72s

最近分析

文件大小

620.0KB
静态报毒 动态报毒 AI SCORE=86 AIDETECTVM BANKERX BSCOPE BUNITU CONFIDENCE ENCPK GA@8SFC92 GENCIRC GENETIC HEZT HIGH CONFIDENCE HKIFET INJECT3 KRYPTIK MALICIOUS PE MALWARE1 MM0@AAVK3LJP NETB PINKSBOT QAKBOT QBOT QVM20 R337768 RAZY S13419017 SCORE SMTHA SPIDER SUSGEN THEBABO TROJANBANKER UNSAFE WACATAC WACATACPMF WRXKZG2X1SG XEJIR ZENPAK ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee W32/PinkSbot-GS!377A9B356F6E 20200722 6.0.6.653
Alibaba TrojanBanker:Win32/Bunitu.68172dde 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Kingsoft 20200722 2013.8.14.323
Tencent Malware.Win32.Gencirc.10cdcb39 20200722 1.0.0.1
Avast Win32:BankerX-gen [Trj] 20200722 18.4.3895.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619345037.204567
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619374460.898126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619374461.554126
__exception__
stacktrace: 
377a9b356f6e80ec29083be9f5b8f74f+0x3f07 @ 0x403f07
377a9b356f6e80ec29083be9f5b8f74f+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 3299248
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 377a9b356f6e80ec29083be9f5b8f74f+0x3449
exception.instruction: in eax, dx
exception.module: 377a9b356f6e80ec29083be9f5b8f74f.exe
exception.exception_code: 0xc0000096
exception.offset: 13385
exception.address: 0x403449
success 0 0
1619374461.554126
__exception__
stacktrace: 
377a9b356f6e80ec29083be9f5b8f74f+0x3f10 @ 0x403f10
377a9b356f6e80ec29083be9f5b8f74f+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637628
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 3299248
registers.ecx: 20
exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0
exception.symbol: 377a9b356f6e80ec29083be9f5b8f74f+0x34e2
exception.instruction: in eax, dx
exception.module: 377a9b356f6e80ec29083be9f5b8f74f.exe
exception.exception_code: 0xc0000096
exception.offset: 13538
exception.address: 0x4034e2
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619345037.141567
NtAllocateVirtualMemory
process_identifier: 2976
region_size: 225280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01de0000
success 0 0
1619345037.141567
NtAllocateVirtualMemory
process_identifier: 2976
region_size: 221184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02340000
success 0 0
1619345037.141567
NtProtectVirtualMemory
process_identifier: 2976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619374460.835126
NtAllocateVirtualMemory
process_identifier: 428
region_size: 225280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005a0000
success 0 0
1619374460.851126
NtAllocateVirtualMemory
process_identifier: 428
region_size: 221184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02230000
success 0 0
1619374460.851126
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
Foreign language identified in PE resource (15 个事件)
name RT_ICON language LANG_CHINESE offset 0x0009aa48 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0009aa48 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0009aa48 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0009aa48 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x0009aa48 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_DIALOG language LANG_CHINESE offset 0x0009af88 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000042
name RT_DIALOG language LANG_CHINESE offset 0x0009af88 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000042
name RT_DIALOG language LANG_CHINESE offset 0x0009af88 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000042
name RT_DIALOG language LANG_CHINESE offset 0x0009af88 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000042
name RT_GROUP_ICON language LANG_CHINESE offset 0x0009b24c filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000004c
name RT_VERSION language LANG_CHINESE offset 0x0009bd68 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000002b4
name RT_VERSION language LANG_CHINESE offset 0x0009bd68 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000002b4
name RT_VERSION language LANG_CHINESE offset 0x0009bd68 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000002b4
name RT_VERSION language LANG_CHINESE offset 0x0009bd68 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000002b4
name RT_VERSION language LANG_CHINESE offset 0x0009bd68 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000002b4
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619345037.938567
CreateProcessInternalW
thread_identifier: 648
thread_handle: 0x00000164
process_identifier: 428
current_directory:
filepath:
track: 1
command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\377a9b356f6e80ec29083be9f5b8f74f.exe /C
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000168
inherit_handles: 0
success 1 0
Expresses interest in specific running processes (1 个事件)
process vboxservice.exe
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Detects VMWare through the in instruction feature (1 个事件)
Time & API Arguments Status Return Repeated
1619374461.554126
__exception__
stacktrace: 
377a9b356f6e80ec29083be9f5b8f74f+0x3f07 @ 0x403f07
377a9b356f6e80ec29083be9f5b8f74f+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 3299248
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 377a9b356f6e80ec29083be9f5b8f74f+0x3449
exception.instruction: in eax, dx
exception.module: 377a9b356f6e80ec29083be9f5b8f74f.exe
exception.exception_code: 0xc0000096
exception.offset: 13385
exception.address: 0x403449
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.AIDetectVM.malware1
CAT-QuickHeal Trojan.WacatacPMF.S13419017
McAfee W32/PinkSbot-GS!377A9B356F6E
Cylance Unsafe
Zillya Trojan.Qbot.Win32.8212
Sangfor Malware
K7AntiVirus Trojan ( 0056715d1 )
Alibaba TrojanBanker:Win32/Bunitu.68172dde
K7GW Trojan ( 005670121 )
CrowdStrike win/malicious_confidence_90% (W)
Arcabit Trojan.Spider.4
TrendMicro Trojan.Win32.WACATAC.THEBABO
Symantec Packed.Generic.459
ESET-NOD32 a variant of Win32/Kryptik.HEZT
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 85)
GData Gen:Variant.Spider.4
Kaspersky HEUR:Trojan-Banker.Win32.Qbot.pef
BitDefender Gen:Variant.Spider.4
NANO-Antivirus Trojan.Win32.Inject3.hkifet
ViRobot Trojan.Win32.Z.Razy.634880.OQ
MicroWorld-eScan Gen:Variant.Spider.4
Ad-Aware Gen:Variant.Spider.4
Sophos Mal/EncPk-APV
Comodo TrojWare.Win32.Qbot.GA@8sfc92
F-Secure Trojan.TR/AD.Qbot.xejir
DrWeb Trojan.Inject3.40140
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Trapmine suspicious.low.ml.score
FireEye Generic.mg.377a9b356f6e80ec
Emsisoft Gen:Variant.Spider.4 (B)
SentinelOne DFI - Malicious PE
Cyren W32/Trojan.NETB-7685
Jiangmin Trojan.Zenpak.bsq
Avira TR/AD.Qbot.xejir
eGambit Unsafe.AI_Score_95%
Antiy-AVL Trojan/Win32.Qakbot
Microsoft Trojan:Win32/Bunitu.PVI!MTB
Endgame malicious (high confidence)
AegisLab Trojan.Win32.Qbot.7!c
ZoneAlarm HEUR:Trojan-Banker.Win32.Qbot.pef
TACHYON Backdoor/W32.Qbot.634880.L
AhnLab-V3 Trojan/Win32.Kryptik.R337768
ALYac Trojan.Agent.QakBot
MAX malware (ai score=86)
VBA32 BScope.Trojan.Inject
Malwarebytes Trojan.Qbot
Panda Trj/Genetic.gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-18 23:58:24

Imports

Library KERNEL32.dll:
• 0x490b60 GetModuleHandleA
• 0x490b64 GetStartupInfoA
• 0x490b68 GetCommandLineA
• 0x490b6c GetVersionExA
• 0x490b70 ExitProcess
• 0x490b74 GetProcAddress
• 0x490b78 WriteFile
• 0x490b7c GetStdHandle
• 0x490b80 GetModuleFileNameA
• 0x490b94 WideCharToMultiByte
• 0x490b98 GetLastError
• 0x490ba0 SetHandleCount
• 0x490ba4 GetFileType
• 0x490bac TlsFree
• 0x490bb0 SetLastError
• 0x490bb4 GetCurrentThreadId
• 0x490bb8 TlsSetValue
• 0x490bbc TlsGetValue
• 0x490bc0 TlsAlloc
• 0x490bc4 HeapDestroy
• 0x490bc8 HeapCreate
• 0x490bcc VirtualFree
• 0x490bd0 HeapFree
• 0x490bdc LoadLibraryA
• 0x490be0 GetACP
• 0x490be4 GetOEMCP
• 0x490be8 GetCPInfo
• 0x490bec HeapAlloc
• 0x490bf4 VirtualAlloc
• 0x490bf8 HeapReAlloc
• 0x490bfc LCMapStringA
• 0x490c00 MultiByteToWideChar
• 0x490c04 LCMapStringW
• 0x490c08 GetStringTypeA
• 0x490c0c GetStringTypeW
• 0x490c10 GetLocaleInfoA
• 0x490c14 RtlUnwind
• 0x490c18 VirtualProtect
• 0x490c1c GetSystemInfo
• 0x490c20 VirtualQuery
• 0x490c24 GetModuleHandleW
Library USER32.dll:
• 0x490c2c GetDC
• 0x490c30 SetDeskWallpaper
• 0x490c40 CharToOemBuffW
• 0x490c44 InsertMenuA
• 0x490c48 SetShellWindow
• 0x490c4c DefFrameProcW
• 0x490c50 DefMDIChildProcW
• 0x490c54 LoadCursorFromFileA
• 0x490c60 CreateMDIWindowA
• 0x490c64 LoadCursorA
• 0x490c68 SendMessageA
• 0x490c6c LoadImageW
• 0x490c70 ReleaseDC
• 0x490c74 SetMenuItemInfoW
• 0x490c78 DrawTextA
• 0x490c7c GetKeyboardState
• 0x490c80 ShowCursor
• 0x490c8c DefDlgProcW
• 0x490c90 ToUnicodeEx
• 0x490c94 mouse_event
• 0x490c98 GetDlgItemTextA
• 0x490c9c RemoveMenu
• 0x490ca0 GetClipboardData
• 0x490ca4 IMPGetIMEA
• 0x490ca8 CreateMDIWindowW
• 0x490cac CreatePopupMenu
• 0x490cb0 CallWindowProcA
• 0x490cb4 OemKeyScan
• 0x490cb8 SetWinEventHook
• 0x490cbc IsCharLowerW
• 0x490cc0 LoadMenuA
• 0x490cc4 DefDlgProcA
• 0x490cc8 EnumWindowStationsW
• 0x490ccc DrawIcon
• 0x490cd0 DdeAddData
• 0x490cd4 GetDoubleClickTime
• 0x490cd8 LoadIconA
• 0x490cdc GetCapture
• 0x490ce0 GetShellWindow
• 0x490ce4 GetMenuItemCount
• 0x490ce8 IsCharAlphaNumericW
• 0x490cec GetAsyncKeyState
• 0x490cf0 CharUpperW
• 0x490cf4 GetMenu
• 0x490cf8 DestroyIcon
• 0x490cfc GetTopWindow
• 0x490d00 GetSystemMetrics
• 0x490d0c GetSysColor
• 0x490d10 GetInputState
• 0x490d18 VkKeyScanW
• 0x490d1c GetDlgCtrlID
• 0x490d20 CharNextA
Library GDI32.dll:
• 0x490d28 SelectPalette
• 0x490d2c GetStringBitmapA
• 0x490d34 GdiResetDCEMF
• 0x490d38 DeleteObject
• 0x490d3c IntersectClipRect
• 0x490d44 GetCharWidthA
• 0x490d48 GetCharWidthW
• 0x490d4c GdiSetPixelFormat
• 0x490d50 GetWinMetaFileBits
• 0x490d54 EngFindResource
• 0x490d5c GetTextFaceW
• 0x490d64 CreateEnhMetaFileW
• 0x490d68 CLIPOBJ_cEnumStart
• 0x490d70 EngQueryEMFInfo
• 0x490d74 GetGlyphIndicesA
• 0x490d78 GetCharABCWidthsA
• 0x490d7c GdiAlphaBlend
• 0x490d80 EnumObjects
• 0x490d84 GetGlyphOutline
• 0x490d88 ScaleViewportExtEx
• 0x490d90 EndDoc
• 0x490d94 CreateICA
• 0x490da0 ExtEscape
• 0x490da8 GdiPrinterThunk
• 0x490dac SetGraphicsMode
• 0x490db4 GdiGetSpoolMessage
• 0x490dc4 EnableEUDC
• 0x490dc8 CreateEllipticRgn
• 0x490dcc RealizePalette
• 0x490dd0 BitBlt
• 0x490dd4 FONTOBJ_pfdg
• 0x490dd8 UpdateColors
• 0x490ddc GetStockObject
• 0x490de0 CreateMetaFileA
• 0x490de4 SetMetaRgn
• 0x490de8 UnrealizeObject
• 0x490dec SwapBuffers
• 0x490df0 StrokePath
• 0x490df4 CancelDC
• 0x490df8 EndPage
• 0x490dfc CreatePatternBrush
• 0x490e00 WidenPath
• 0x490e04 GetPolyFillMode
• 0x490e08 GetEnhMetaFileW
Library COMDLG32.dll:
• 0x490e10 GetFileTitleW
Library ADVAPI32.dll:
• 0x490e18 RegCloseKey
• 0x490e1c RegOpenKeyA
• 0x490e20 RegQueryValueExA
Library SHELL32.dll:
• 0x490e28 DragFinish
• 0x490e2c ShellExecuteExW
• 0x490e30 CheckEscapesW
• 0x490e34 DoEnvironmentSubstW
• 0x490e3c FindExecutableW
• 0x490e40 SHBindToParent
• 0x490e48 Shell_NotifyIcon
• 0x490e50 SHGetMalloc
• 0x490e58 SHGetFileInfo
• 0x490e5c DuplicateIcon
• 0x490e64 SHFileOperation
• 0x490e68 SHGetFileInfoA
• 0x490e74 SHFormatDrive
• 0x490e78 SHGetFolderLocation
• 0x490e7c SHBrowseForFolderA
• 0x490e80 ShellHookProc
• 0x490e84 SHBrowseForFolderW
• 0x490e88 DragQueryFile
• 0x490e8c SHAppBarMessage
• 0x490e90 SHFreeNameMappings
Library ole32.dll:
• 0x490e9c OleRun
• 0x490ea0 CoUninitialize
• 0x490ea4 CoInitializeEx
• 0x490ea8 CoCreateInstance
Library SHLWAPI.dll:
• 0x490eb0 PathIsUNCW
• 0x490eb4 StrChrA
• 0x490eb8 StrChrIA
• 0x490ebc StrStrA
Library COMCTL32.dll:
Library IMM32.dll:
• 0x490ecc ImmGetContext

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.