3.6
中危
40 个模型检测该样本为恶意！
重新分析
更多

0e7ca7211cdac296ed0b50ca565b91b320db3152d32e23f88c6c46e2ea003e48

42a3f2e5e69ab0689a4d37f31cf4c6da.exe

分析耗时

24s

最近分析

文件大小

1.1MB
静态报毒 动态报毒 ARTEMIS ATOSEV CLOUD CONFIDENCE FILEREPMALWARE GENERICKD GXZKK HIGH CONFIDENCE HOTEPP PATCHEDWINSWRORT R002C0WGN20 ROZENA SCORE SHELMA SUSGEN UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Application/Shelma.96ef9e19 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_60% (D) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast 20200812 18.4.3895.0
Tencent 20200813 1.0.0.1
Kingsoft 20200813 2013.8.14.323
McAfee Artemis!42A3F2E5E69A 20200812 6.0.6.653
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .symtab
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620726227.367988
__exception__
stacktrace: 
0x700030
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c

registers.r14: 1453503984
registers.r9: 0
registers.rcx: 110
registers.rsi: 110
registers.r10: 0
registers.rbx: 7340537
registers.rdi: 0
registers.r11: 514
registers.r8: 8791708348904
registers.rdx: 2009605728
registers.rbp: 7340042
registers.r15: 170
registers.r12: 46
registers.rsp: 2292072
registers.rax: 0
registers.r13: 2
exception.instruction_r: ac 3c 61 7c 02 2c 20 41 c1 c9 0d 41 01 c1 e2 ed
exception.instruction: lodsb al, byte ptr [rsi]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x700030
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620726222.570988
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0000000000700000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (8 个事件)
entropy 7.985311556856773 section {'size_of_data': '0x0000ea00', 'virtual_address': '0x000ee000', 'entropy': 7.985311556856773, 'name': '/19', 'virtual_size': '0x0000e85a'} description A section with a high entropy has been found
entropy 7.865649151358698 section {'size_of_data': '0x00003e00', 'virtual_address': '0x000fd000', 'entropy': 7.865649151358698, 'name': '/32', 'virtual_size': '0x00003c39'} description A section with a high entropy has been found
entropy 7.898202081730385 section {'size_of_data': '0x00001000', 'virtual_address': '0x00101000', 'entropy': 7.898202081730385, 'name': '/46', 'virtual_size': '0x00000fc5'} description A section with a high entropy has been found
entropy 7.96444755637649 section {'size_of_data': '0x00002200', 'virtual_address': '0x00102000', 'entropy': 7.96444755637649, 'name': '/63', 'virtual_size': '0x000021c0'} description A section with a high entropy has been found
entropy 7.995697406292085 section {'size_of_data': '0x0001d200', 'virtual_address': '0x00106000', 'entropy': 7.995697406292085, 'name': '/99', 'virtual_size': '0x0001d151'} description A section with a high entropy has been found
entropy 7.982027949536252 section {'size_of_data': '0x0000d400', 'virtual_address': '0x00124000', 'entropy': 7.982027949536252, 'name': '/112', 'virtual_size': '0x0000d2a9'} description A section with a high entropy has been found
entropy 7.759553009701297 section {'size_of_data': '0x00004c00', 'virtual_address': '0x00132000', 'entropy': 7.759553009701297, 'name': '/124', 'virtual_size': '0x00004a64'} description A section with a high entropy has been found
entropy 0.2345415778251599 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Detects the presence of Wine emulator (1 个事件)
Time & API Arguments Status Return Repeated
1620726222.539988
LdrGetProcedureAddress
ordinal: 0
module: ntdll
module_address: 0x0000000077b50000
function_address: 0x0000000077ba1350
function_name: wine_get_version
failed -1073741511 0
File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34214456
CAT-QuickHeal Trojan.Win64
ALYac Trojan.GenericKD.34214456
Cylance Unsafe
Zillya Trojan.Rozena.Win64.4017
K7AntiVirus Trojan ( 0056afe11 )
Alibaba Trojan:Application/Shelma.96ef9e19
K7GW Trojan ( 0056afe11 )
CrowdStrike win/malicious_confidence_60% (D)
Symantec Trojan.Gen.MBT
TrendMicro-HouseCall TROJ_GEN.R002C0WGN20
GData Trojan.GenericKD.34214456
Kaspersky Trojan.Win64.Shelma.exl
BitDefender Trojan.GenericKD.34214456
NANO-Antivirus Trojan.Win64.PatchedWinSwrort.hotepp
Ad-Aware Trojan.GenericKD.34214456
F-Secure Trojan.TR/AD.PatchedWinSwrort.gxzkk
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0WGN20
FireEye Trojan.GenericKD.34214456
Sophos Mal/Generic-S
APEX Malicious
Avira TR/AD.PatchedWinSwrort.gxzkk
Antiy-AVL Trojan/Win64.Shelma
Arcabit Trojan.Generic.D20A1238
AegisLab Trojan.Win64.Shelma.4!c
ZoneAlarm Trojan.Win64.Shelma.exl
Microsoft VirTool:Win64/Atosev.A
Cynet Malicious (score: 100)
McAfee Artemis!42A3F2E5E69A
VBA32 Trojan.Win64.Shelma
Ikarus Trojan.Win64.Rozena
ESET-NOD32 a variant of Win64/Rozena.DW
Rising Trojan.Rozena!8.6D (CLOUD)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W64/Rozena.CL!tr
AVG FileRepMalware
Cybereason malicious.25dbbb
Panda Trj/CI.A
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1970-01-01 08:00:00

Imports

Library winmm.dll:
• 0x4cd000 timeEndPeriod
• 0x4cd008 timeBeginPeriod
Library ws2_32.dll:
Library kernel32.dll:
• 0x4cd028 WriteFile
• 0x4cd030 WriteConsoleW
• 0x4cd038 WaitForSingleObject
• 0x4cd040 VirtualQuery
• 0x4cd048 VirtualFree
• 0x4cd050 VirtualAlloc
• 0x4cd058 SwitchToThread
• 0x4cd060 SetWaitableTimer
• 0x4cd078 SetEvent
• 0x4cd080 SetErrorMode
• 0x4cd090 LoadLibraryA
• 0x4cd098 LoadLibraryW
• 0x4cd0a0 GetSystemInfo
• 0x4cd0a8 GetStdHandle
• 0x4cd0c0 GetProcAddress
• 0x4cd0d0 GetConsoleMode
• 0x4cd0e0 ExitProcess
• 0x4cd0e8 DuplicateHandle
• 0x4cd0f0 CreateThread
• 0x4cd0f8 CreateEventA
• 0x4cd100 CloseHandle

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 51811 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 60124 239.255.255.250 3702
192.168.56.101 62194 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.