5.6
高危
61 个模型检测该样本为恶意！
重新分析
更多

528a4096915bcf08fabc83acbeb0c39615762316706fee5ba19b1a14bb9df3f5

472221c471c0aa13372bbf2814eddb86.exe

分析耗时

134s

最近分析

文件大小

23.5KB
静态报毒 动态报毒 100% 61QAMLKKXVU A@566YGC AI SCORE=100 ALI1000030 AUTOIT BINANHB BLADABI BLADABINDI BMW@AYW1BBL CLASSIC CONFIDENCE DISFA DOTNET DOTNETDL DTZNYX ELDORADO FAMVT FIGN GEN7 HIGH CONFIDENCE KCLOUD MALICIOUS PE MAMC NJRAT PBFE R + TROJ R91438 RATENJAY SCORE STARTER STATIC AI SUSGEN UNSAFE ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/starter.ali1000030 20190527 0.3.0.5
Avast MSIL:Agent-DRD [Trj] 20201228 21.1.5827.0
Baidu MSIL.Backdoor.Bladabindi.a 20190318 1.0.0.2
Kingsoft Heur.SSC.2815426.1216.(kcloud) 20201229 2017.9.26.565
McAfee Trojan-FIGN 20201228 6.0.6.653
Tencent Msil.Trojan.Disfa.Pbfe 20201229 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619464023.85925
IsDebuggerPresent
failed 0 0
Command line console output was observed (2 个事件)
Time & API Arguments Status Return Repeated
1619469336.11825
WriteConsoleA
buffer: ÖØÒªÐÅÏ¢: Òѳɹ¦Ö´ÐÐÃüÁî¡£ µ«²»ÔÞ³ÉʹÓà "netsh firewall"£» ¶øÓ¦¸ÃʹÓà "netsh advfirewall firewall"¡£ ÓйØʹÓà "netsh advfirewall firewall" ÃüÁî ¶ø·Ç "netsh firewall" µÄÏêϸÐÅÏ¢£¬Çë²ÎÔÄ http://go.microsoft.com/fwlink/?linkid=121488 É쵀 KB ÎÄÕ 947709¡£
console_handle: 0x00000007
success 1 0
1619469336.11825
WriteConsoleA
buffer: È·¶¨¡£
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619464034.39125
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
Connects to a Dynamic DNS Domain (1 个事件)
domain alougt84.hopto.org
Allocates read-write-execute memory (usually to unpack itself) (18 个事件)
Time & API Arguments Status Return Repeated
1619464023.17225
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00590000
success 0 0
1619464023.17225
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005f0000
success 0 0
1619464023.79725
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73c51000
success 0 0
1619464023.85925
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0043a000
success 0 0
1619464023.85925
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73c52000
success 0 0
1619464023.85925
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00432000
success 0 0
1619464024.15625
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00482000
success 0 0
1619464024.21925
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00483000
success 0 0
1619464024.23425
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005bb000
success 0 0
1619464024.23425
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005b7000
success 0 0
1619464024.26625
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048c000
success 0 0
1619464024.31325
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e0000
success 0 0
1619464024.54725
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00484000
success 0 0
1619464024.82825
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00485000
success 0 0
1619464024.82825
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00486000
success 0 0
1619464024.85925
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005aa000
success 0 0
1619464024.92225
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005a2000
success 0 0
1619464034.26625
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048a000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe
Creates a suspicious process (2 个事件)
cmdline "C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe"
cmdline C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe
Created a process named as a common system process (2 个事件)
Time & API Arguments Status Return Repeated
1619464035.54725
CreateProcessInternalW
thread_identifier: 784
thread_handle: 0x000002e0
process_identifier: 1404
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000364
inherit_handles: 0
success 1 0
1619464035.57825
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\svchost.exe
show_type: 1
success 1 0
网络通信
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.FamVT.binANHb.Worm
Elastic malicious (high confidence)
DrWeb BackDoor.Bladabindi.15042
MicroWorld-eScan Trojan.MSIL.Agent.NE
FireEye Generic.mg.472221c471c0aa13
CAT-QuickHeal Backdoor.Bladabindi.AL3
ALYac Trojan.MSIL.Agent.NE
Malwarebytes Backdoor.NJRat
VIPRE Backdoor.MSIL.Bladabindi.a (v)
AegisLab Trojan.Win32.Generic.mAmC
K7AntiVirus Trojan ( 700000121 )
BitDefender Trojan.MSIL.Agent.NE
K7GW Trojan ( 700000121 )
Cybereason malicious.471c0a
BitDefenderTheta Gen:NN.ZemsilF.34700.bmW@ayw1BBl
Cyren W32/MSIL_Bladabindi.AU.gen!Eldorado
Symantec Backdoor.Ratenjay
TotalDefense Win32/DotNetDl.A!generic
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky Trojan.MSIL.Disfa.bqd
Alibaba Trojan:Win32/starter.ali1000030
NANO-Antivirus Trojan.Win32.Disfa.dtznyx
ViRobot Backdoor.Win32.Bladabindi.Gen.A
Avast MSIL:Agent-DRD [Trj]
Rising Backdoor.Njrat!1.9E49 (CLASSIC)
Ad-Aware Trojan.MSIL.Agent.NE
Sophos Mal/Generic-R + Troj/DotNet-P
Comodo Backdoor.MSIL.Bladabindi.A@566ygc
F-Secure Trojan.TR/Dropper.Gen7
Baidu MSIL.Backdoor.Bladabindi.a
Zillya Backdoor.Agent.Win32.55242
McAfee-GW-Edition BehavesLike.Win32.Trojan.mm
Emsisoft Trojan.Bladabindi (A)
Ikarus Trojan.MSIL.Bladabindi
Jiangmin TrojanDropper.Autoit.dce
Webroot W32.Trojan.Gen
Avira TR/Dropper.Gen7
MAX malware (ai score=100)
Antiy-AVL Trojan[Backdoor]/MSIL.Bladabindi.as
Kingsoft Heur.SSC.2815426.1216.(kcloud)
Microsoft Backdoor:MSIL/Bladabindi
Gridinsoft Trojan.Win32.Agent.ba
ZoneAlarm Trojan.MSIL.Disfa.bqd
GData MSIL.Backdoor.Bladabindi.AV
AhnLab-V3 Backdoor/Win32.Bladabindi.R91438
Acronis suspicious
McAfee Trojan-FIGN
VBA32 Trojan.MSIL.Disfa
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-03-14 23:46:32

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.