2.5
中危
58 个模型检测该样本为恶意！
重新分析
更多

0b4e59a62f533c76b45ba14627b2f23dc0c5109de1a530c5614e92102079e82a

0b4e59a62f533c76b45ba14627b2f23dc0c5109de1a530c5614e92102079e82a.exe

分析耗时

135s

最近分析

381天前

文件大小

9.8KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER UPATRE
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.53
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Downloader-WID [Trj] 20200215 18.4.3895.0
Baidu Win32.Trojan-Downloader.Waski.k 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200215 2013.8.14.323
McAfee Downloader-FBRM!43D03AFE9E15 20200215 6.0.6.653
Tencent Malware.Win32.Gencirc.10b0cf89 20200215 1.0.0.1
行为判定
动态指标
在文件系统上创建可执行文件 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\ffengh.exe
投放一个二进制文件并执行它 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\ffengh.exe
将可执行文件投放到用户的 AppData 文件夹 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\ffengh.exe
一个进程创建了一个隐藏窗口 (1 个事件)
Time & API Arguments Status Return Repeated
1727545330.641375
ShellExecuteExW
filepath: C:\Users\Administrator\AppData\Local\Temp\ffengh.exe
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\ffengh.exe
parameters:
show_type: 0
success 1 0
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': 'dFsRjAef', 'virtual_address': '0x00005000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000800', 'entropy': 7.0467083094170135} entropy 7.0467083094170135 description 发现高熵的节
entropy 0.8 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (4 个事件)
host 114.114.114.114
host 8.8.8.8
host 152.195.38.76
host 152.199.38.90
连接到不再响应请求的 IP 地址（合法服务通常会保持运行） (1 个事件)
dead_host 44.221.84.105:443
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意 (50 out of 58 个事件)
ALYac Generic.Malware.dld!!.547374FF
APEX Malicious
AVG Win32:Downloader-WID [Trj]
Acronis suspicious
Ad-Aware Generic.Malware.dld!!.547374FF
AhnLab-V3 Trojan/Win32.RL_Upatre.R287158
Antiy-AVL Trojan[Downloader]/Win32.Waski.a
Arcabit Generic.Malware.dld!!.D85A2EFF
Avast Win32:Downloader-WID [Trj]
Avira TR/Downloader.Gen
Baidu Win32.Trojan-Downloader.Waski.k
BitDefender Generic.Malware.dld!!.547374FF
BitDefenderTheta AI:Packer.35DDEF3C1E
CAT-QuickHeal Trojan.GenericRI.S7182325
Comodo TrojWare.Win32.TrojanDownloader.Small.CDC@8mzsfr
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.4ea400
Cylance Unsafe
Cyren W32/Upatre.KJ.gen!Eldorado
DrWeb Trojan.DownLoader26.64201
ESET-NOD32 a variant of Win32/TrojanDownloader.Small.PRL
Emsisoft Generic.Malware.dld!!.547374FF (B)
Endgame malicious (high confidence)
F-Prot W32/S-a33a727a!Eldorado
F-Secure Trojan.TR/Downloader.Gen
FireEye Generic.mg.46ad2dd4ea400bb6
Fortinet W32/Ppatre.RP!tr
GData Generic.Malware.dld!!.547374FF
Ikarus Trojan-Proxy.Win32.Agent
Invincea heuristic
Jiangmin TrojanDownloader.Genome.acpr
K7AntiVirus Trojan-Downloader ( 0050fef41 )
K7GW Trojan-Downloader ( 00456a071 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=87)
Malwarebytes Trojan.Upatre.Generic
MaxSecure Trojan.Upatre.Gen
McAfee Downloader-FBRM!43D03AFE9E15
McAfee-GW-Edition BehavesLike.Win32.Downloader.zt
MicroWorld-eScan Generic.Malware.dld!!.547374FF
Microsoft Trojan:Win32/Wacatac.C!ml
NANO-Antivirus Trojan.Win32.DownLoad3.cqsjfu
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM11.1.4205.Malware.Gen
Rising Trojan.Waski!1.A489 (RDMK:cmRtazrwFEPlfivb7/JOoR5P1xmi)
Sangfor Malware
SentinelOne DFI - Suspicious PE
Sophos Troj/Upatre-XZ
Tencent Malware.Win32.Gencirc.10b0cf89
Trapmine malicious.high.ml.score
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-09-11 22:39:41

PE Imphash

c44b18f44e45a4c2d9ee845a0ebc9518

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
zBMapXDf 0x00001000 0x00004000 0x00000000 0.0
dFsRjAef 0x00005000 0x00001000 0x00000800 7.0467083094170135
N"), 0x00006000 0x00001000 0x00000200 2.6472350874163353

Imports

Library KERNEL32.DLL:
• 0x406064 LoadLibraryA
• 0x406068 ExitProcess
• 0x40606c GetProcAddress
• 0x406070 VirtualProtect
Library SHELL32.dll:
• 0x406078 ShellExecuteW
Library USER32.dll:
• 0x406080 wsprintfW
Library WININET.dll:
• 0x406088 InternetOpenW
L!This program cannot be run in DOS mode.
zBMapXDf
dFsRjAef
<I_3^@[VP
6`ou98v]
=LUrEPQmeC
m[2} N
43u*V.<6
Yc?P}
;;2noMt
l?Lj<VFlBS
UUl"H#
4@~iVx
][lss1r!+b#
y/uoc5m/Ox
a;l=cmi
@8]'"TU*
HeapCr
GetModuleFim
}CloseHandl-Cur:ntDi
ctoryW
TempPPh
l{lstr+n
xitProcess.[Sizen
Alccm6Wr
DShlmut
LwspKf
OptioHttp
~gquntW%Cnec
foERFE
eB`.rd$a
XPTPSWXaD$j
KERNEL32.DLL
SHELL32.dll
USER32.dll
WININET.dll
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
ShellExecuteW
wsprintfW
InternetOpenW
C:\jyKeWK7u.exe
C:\dh8L0ara.exe
C:\mEBvN3c5.exe
C:\JvMsZFFZ.exe
C:\McABjoW6.exe
C:\1dyqjn0F.exe
C:\H5AEYxD0.exe
C:\0AbKnam8.exe
C:\B03zefOp.exe
C:\9ZpF2_3i.exe
C:\P3vrXEND.exe
C:\0297d28487194c2f62aa09ab6a022ff00e73916e9a1ea4f2d9abb51f6cccf497
C:\94bc066917c5fc54cc862cac7c771c1f16cef714082aea4017b6908ec4510e6b
C:\e3253b088a8a032c8a45e16b301ec0ef8a53ce80e054aa88bdc5f5912cb649b9
C:\332b16c7042658d5841372205b99d6a76f7bb2ac98c7506d6e8176b64a85332b
C:\3c1f5b90862c91f5e83db7311765ab3a5ec00754362424d1d4db3734cd46ece9
C:\c0fa55afeb22d44ff2b094816a65fc6eacfe72cdc9100f16511ba7912e092ad9
C:\1247a227e30cc64b6ec2f4897a01b00decb19cb1066827f631137fed9dc00f2c
C:\Users\admin\Downloads\important_document.exe
C:\suq7gE_Q.exe
C:\Users\admin\Downloads\important_document.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\factura.exe
C:\Users\admin\Downloads\invoice.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\sample.exe
C:\iHN4Vnos.exe
C:\Users\admin\Downloads\invoice.exe
C:\b29c5ec2fa765debf526428d46b7b2ffe20ddf40acf74c63a67dc04ce9502528
C:\4143ae8b7f1c4f80f2a1f463be32582d73c8e6eaf9545bf00b4307028a89bf8f
C:\Users\admin\Downloads\factura.exe
C:\Users\admin\Downloads\factura.exe
C:\LInLZPSF.exe
C:\Users\admin\Downloads\important_document.exe
C:\c9ab4a18e7629123bb735536c7446312053b8e3f404468b51e72dffff4e92dd1
C:\baa1d40077ff3d9f32a5d80726387220974938e8262037b04b3e757423f1a9df
C:\6a226f5ffea7bd755402578a3d68bc61286d63899816b928c6bbfbc2792b0fb3
C:\LrXugs0u.exe
C:\5e8b24fe90b8d53e8047febdc1eac2fd75c9ba0d8cbd9160d332ca22da0027fe
C:\adbcd7a097ac517399636899fc97e8501521d72d7499a319a83d7eced80126fb
C:\ebac7c6e7fc6b4c35f1ba2eaaf600df6ae9ff500110cd3565a229853768bc57c
C:\xZv5jBCx.exe
C:\Users\admin\Downloads\invoice.exe
C:\bf22ae1182d5cfca92ae4e1863b4e88a2a5bff57a3cb7beb96cc913b596bfe8e
C:\d978dfff868aa2d08ba5df34c33e4db6d504898a106da0c0824b2164e1510fac
C:\b80b9f85bf97b4a0314b49e826245b87b5eb1011d9dd7fd1a4bfb63e36932873
C:\8e97b37275eb51f13be4b9aaae26cef6bf3849b9c78d8ab376413f29eb9d5371
C:\95b418fed9540f9f76ea884d5b5ea6b985e04a9f855139ef0e0dd68e4070d6ce
C:\Users\admin\Downloads\sample.exe
C:\makvIx59.exe
C:\Users\admin\Downloads\4c36837a7da28060c8ffb4a46dfdc288.virus.exe
C:\e2b8c53395a0d3643e37fdd1b35e94fa132b8ec7a97f8d09365fa91700e013e6
C:\Users\admin\Downloads\ffengh.exe
C:\60dfaebad28c5716a7c272f6e50a7c5421f57687cf27c2fbf51c2bc54ffd14a5
C:\c43d2843543134c3f5ffffba9130ad02e16af1232bfba242a1a49ebb955176ef
C:\e701c84d599d390107efa7a6e0698f44ab6f96e81bb2764e66b64b12428df184
C:\b0185ee7d4639d95cf6beb53306a7609c23c600819ce592460c56f9abbca6b76
C:\Users\Joe Cage\Desktop\PR6nxExU8q.exe
C:\32eab3360c9d3a2e220b86e8f30d85823d08d7d7cf7e81c59e9536fcf62a9e43
C:\65e9318d7c25eca7defb34a3b1e25c4df27e03e14a65f69db6b6277b7f34eda7
C:\985f109ddaf23997f39c585f57b54c0139f3a0f4fe0f851505ebbab40aef0e10
C:\Users\admin\Downloads\ffengh.exe
C:\980b7aec075c2fbc793786aaf0aa6a03c98c8c17d1729a6bddb9853f1c2f6d39
C:\Users\admin\Downloads\ffengh.exe
C:\cd99f5a671da73f0e7995dbf9b9d75c6d7176a6e270e464b3194cb9851177d34
C:\Users\admin\Downloads\ffengh.exe
C:\e49a5834976b22c530f2751c01fe62dff7370702eeda9bbae9cc466333ffb551

Process Tree

0b4e59a62f533c76b45ba14627b2f23dc0c5109de1a530c5614e92102079e82a.exe, PID: 1332, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

ffengh.exe, PID: 1640, Parent PID: 1332

default registry file network process services synchronisation iexplore office pdf

TCP

Source Source Port Destination Destination Port
192.168.56.101 49164 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49165 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49166 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49168 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49169 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49170 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49172 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49173 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49174 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49176 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49177 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49178 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49180 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49181 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49182 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49184 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49185 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49186 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49188 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49189 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49190 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49192 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49193 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49194 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49196 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49197 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49198 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49200 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49201 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49202 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49204 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49205 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49206 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49208 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49209 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49210 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49212 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49213 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49214 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49216 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49217 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49218 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49220 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49221 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49222 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49224 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49225 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49226 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49228 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49229 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49230 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49232 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49233 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49234 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49236 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49237 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49238 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49240 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49241 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49242 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49244 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49245 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49246 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49248 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49249 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49251 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49253 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49255 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49256 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49259 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49260 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49261 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49263 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49264 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49265 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49267 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49268 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49269 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49271 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49272 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49273 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49275 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49276 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49277 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49279 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49280 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49281 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49283 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49284 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49285 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49287 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49288 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49289 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49291 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49292 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49293 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49295 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49296 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49297 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49299 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49300 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49301 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49303 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49304 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49305 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49307 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49308 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49309 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49311 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49312 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49313 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49315 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49316 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49317 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49319 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49320 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49321 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49323 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49324 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49325 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49327 44.221.84.105 drippingstrawberry.com 443
192.168.56.101 49328 44.221.84.105 drippingstrawberry.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53
192.168.56.101 57665 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 33814764fb13174c_ffengh.exe
Filepath C:\Users\Administrator\AppData\Local\Temp\ffengh.exe
Size 10.1KB
Processes 1332 (0b4e59a62f533c76b45ba14627b2f23dc0c5109de1a530c5614e92102079e82a.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 be97a89769f12a7d8a671016f8982ee3
SHA1 2490108e3ae2bf82d8fe1305e90d1142b8db11db
SHA256 33814764fb13174ce3239b6b3d8f1588021da3ab6bf0164d58f3029dc6adb398
CRC32 C32E4774
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.