SmartHawk

5.8

高危

60 个模型检测该样本为恶意！

重新分析

下载样本

ee9b5cc7ddc98e8b4172d9d294bcf24c62c6adc60efb49e97210182722671cd9

3b065d227684e399af0a5f04485183bc.exe

分析耗时

104s

最近分析

文件大小

242.5KB

静态报毒动态报毒 100% AI SCORE=86 ALI2000008 AUTO AVQJ BPTV CONFIDENCE DROPPERX FAREIT FORMBOK FORMBOOK GENERICKD GENKD HIGH CONFIDENCE HOUVEL IGENERIC KRYPTIK KTSE LOKI MALDOC MALICIOUS PE MALWARE@#3AA34CFM3UDI MXRESICN NJJTD NOON NR6NMI PMW@AMVSKPJ QVM03 R + TROJ SCORE SIGGEN2 STATIC AI TSCOPE UHBAZCLMS UNSAFE VOJPAKUYPYW ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Maldoc.ali2000008	20190527	0.3.0.5
Avast	Win32:DropperX-gen [Drp]	20210102	21.1.5827.0
Tencent	Win32.Trojan.Inject.Auto	20210104	1.0.0.1
Baidu		20190318	1.0.0.2
McAfee	Fareit-FVK!3B065D227684	20210102	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Checks if process is being debugged by a debugger (20 个事件)

Time & API	Arguments	Status	Return	Repeated
1620741873.207124 IsDebuggerPresent		failed	0	0
1620741873.207124 IsDebuggerPresent		failed	0	0
1620741882.535626 IsDebuggerPresent		failed	0	0
1620741882.535626 IsDebuggerPresent		failed	0	0
1620741890.582874 IsDebuggerPresent		failed	0	0
1620741890.582874 IsDebuggerPresent		failed	0	0
1620741898.504249 IsDebuggerPresent		failed	0	0
1620741898.520249 IsDebuggerPresent		failed	0	0
1620741904.488124 IsDebuggerPresent		failed	0	0
1620741904.488124 IsDebuggerPresent		failed	0	0
1620741911.754626 IsDebuggerPresent		failed	0	0
1620741911.770626 IsDebuggerPresent		failed	0	0
1620741922.254374 IsDebuggerPresent		failed	0	0
1620741922.254374 IsDebuggerPresent		failed	0	0
1620741930.988249 IsDebuggerPresent		failed	0	0
1620741931.004249 IsDebuggerPresent		failed	0	0
1620741941.129874 IsDebuggerPresent		failed	0	0
1620741941.145874 IsDebuggerPresent		failed	0	0
1620741950.441999 IsDebuggerPresent		failed	0	0
1620741950.441999 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620741873.285124 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 280 个事件)

Time & API	Arguments	Status
1620741872.582124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00320000	success
1620741872.582124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00340000	success
1620741872.879124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02220000	success
1620741872.879124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02340000	success
1620741873.051124 NtProtectVirtualMemory	process_identifier: 2128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1620741873.207124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02380000	success
1620741873.207124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02540000	success
1620741873.223124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044a000	success
1620741873.223124 NtProtectVirtualMemory	process_identifier: 2128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1620741873.223124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00442000	success
1620741873.660124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00462000	success
1620741873.801124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00485000	success
1620741873.817124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0048b000	success
1620741873.817124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00487000	success
1620741874.020124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00463000	success
1620741874.113124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046c000	success
1620741874.238124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00740000	success
1620741874.285124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00476000	success
1620741874.332124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047a000	success
1620741874.332124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00477000	success
1620741874.410124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00464000	success
1620741874.801124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00465000	success
1620741875.020124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00741000	success
1620741875.160124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x008b0000	success
1620741876.207124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00900000	success
1620741876.801124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00742000	success
1620741876.910124 NtAllocateVirtualMemory	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00466000	success
1620741877.238249 NtAllocateVirtualMemory	process_identifier: 2236 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02680000	success
1620741882.301626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x003b0000	success
1620741882.301626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00470000	success
1620741882.457626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00b70000	success
1620741882.457626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c80000	success
1620741882.488626 NtProtectVirtualMemory	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1620741882.535626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x005c0000	success
1620741882.535626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00610000	success
1620741882.551626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003da000	success
1620741882.551626 NtProtectVirtualMemory	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1620741882.551626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d2000	success
1620741882.629626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e2000	success
1620741882.645626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00415000	success
1620741882.645626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041b000	success
1620741882.645626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00417000	success
1620741882.676626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e3000	success
1620741882.676626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ec000	success
1620741882.692626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00530000	success
1620741882.692626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f6000	success
1620741882.692626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success
1620741882.692626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f7000	success
1620741882.863626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e4000	success
1620741882.973626 NtAllocateVirtualMemory	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e5000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.555449198107292

section

{'size_of_data': '0x0003c400', 'virtual_address': '0x00002000', 'entropy': 7.555449198107292, 'name': '.text', 'virtual_size': '0x0003c334'}

description

A section with a high entropy has been found

entropy

0.9958677685950413

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (10 个事件)

Time & API	Arguments	Status	Return
1620741876.738124 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620741884.254626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620741891.395874 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620741899.067249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620741905.113124 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620741912.270626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620741923.082374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620741931.645249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620741942.238874 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620741951.566999 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1

Terminates another process (18 个事件)

Time & API	Arguments	Status
1620741884.442626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000028c	failed
1620741884.442626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000028c	success
1620741891.676874 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000294	failed
1620741891.676874 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000294	success
1620741899.254249 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000028c	failed
1620741899.254249 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000028c	success
1620741905.379124 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000028c	failed
1620741905.379124 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000028c	success
1620741912.770626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000288	failed
1620741912.770626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000288	success
1620741923.379374 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000288	failed
1620741923.379374 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000288	success
1620741931.863249 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000294	failed
1620741931.863249 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000294	success
1620741942.504874 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000288	failed
1620741942.520874 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000288	success
1620741952.659999 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000298	failed
1620741952.659999 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000298	success

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Manipulates memory of a non-child process indicative of process injection (9 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2128 manipulating memory of non-child process 2104
Process injection	Process 3552 manipulating memory of non-child process 3612
Process injection	Process 2604 manipulating memory of non-child process 3348
1620741876.520124 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000240 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1620741876.520124 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000240 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1620741931.520249 NtAllocateVirtualMemory	process_identifier: 3612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000240 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1620741931.520249 NtAllocateVirtualMemory	process_identifier: 3612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000240 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1620741951.284999 NtAllocateVirtualMemory	process_identifier: 3348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000244 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1620741951.284999 NtAllocateVirtualMemory	process_identifier: 3348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000244 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\s.exe:Zone.Identifier

Generates some ICMP traffic

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Siggen2.52323
MicroWorld-eScan	Trojan.GenericKD.34219264
FireEye	Generic.mg.3b065d227684e399
CAT-QuickHeal	Trojan.IGENERIC
ALYac	Trojan.Agent.FormBook
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0056081c1 )
Alibaba	Trojan:Win32/Maldoc.ali2000008
K7GW	Trojan ( 0056081c1 )
Cybereason	malicious.27684e
Arcabit	Trojan.Generic.D20A2500
BitDefenderTheta	Gen:NN.ZemsilF.34700.pmW@amvsKpj
Cyren	W32/Trojan.BPTV-7567
Symantec	Trojan Horse
ESET-NOD32	Win32/Formbook.AA
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender	Trojan.GenericKD.34219264
NANO-Antivirus	Trojan.Win32.Noon.houvel
Paloalto	generic.ml
ViRobot	Trojan.Win32.Z.Agent.248320.LE
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.GenericKD.34219264
Sophos	Mal/Generic-R + Troj/Formbok-HI
Comodo	Malware@#3aa34cfm3udi
F-Secure	Trojan.TR/Formbook.njjtd
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.MSIL.LOKI.UHBAZCLMS
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Emsisoft	Trojan.GenericKD.34219264 (B)
Ikarus	Trojan.Inject
Jiangmin	TrojanSpy.MSIL.avqj
eGambit	Unsafe.AI_Score_97%
Avira	TR/Formbook.njjtd
MAX	malware (ai score=86)
Antiy-AVL	Trojan/Win32.Formbook
Microsoft	Trojan:MSIL/Formbook.VN!MTB
AegisLab	Trojan.MSIL.Noon.l!c
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	Win32.Trojan-Stealer.FormBook.NR6NMI
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	Fareit-FVK!3B065D227684
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.Crypt
Zoner	Trojan.Win32.94580
TrendMicro-HouseCall	TrojanSpy.MSIL.LOKI.UHBAZCLMS

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-22 22:57:12

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net A 51.105.208.173
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	50005	239.255.255.250	3702
192.168.56.101	58368	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.