1.6
低危

4b8b49bdfa435d0faba2e3964b04e20bbfc86aa4ffc3c3b8e1449894892f125b

47efa008c600b2b0394ce3230345a901.exe

分析耗时

8s

最近分析

文件大小

404.5KB
静态报毒 动态报毒 AGEN AGENTTESLA APLT AUTO AVSARHER BTJEKX CONFIDENCE ELDORADO FAREIT GDSDA HEYE HHVQWC HIGH CONFIDENCE KRYPTIK MALWARE@#39K9BU9R95EWP MSILRANDOMKRYPT R066C0PHK20 S + TROJ SCORE SIGGEN9 SUSGEN TROJANX TSCOPE UNSAFE WACATAC YAKBEEXMSIL ZEMSILF ZM0@A0PG1FH 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTF!47EFA008C600 20201228 6.0.6.653
Alibaba TrojanSpy:MSIL/Kryptik.8b9f32a9 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:TrojanX-gen [Trj] 20201228 21.1.5827.0
Kingsoft 20201228 2017.9.26.565
Tencent Win32.Trojan.Inject.Auto 20201228 1.0.0.1
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
静态指标
行为判定
动态指标
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.943847451339958 section {'size_of_data': '0x00064800', 'virtual_address': '0x00002000', 'entropy': 7.943847451339958, 'name': '.text', 'virtual_size': '0x00064660'} description A section with a high entropy has been found
entropy 0.995049504950495 description Overall entropy of this PE file is high
网络通信
File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Heur.MSILRandomKrypt.3
FireEye Generic.mg.47efa008c600b2b0
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
McAfee Fareit-FTF!47EFA008C600
Cylance Unsafe
K7AntiVirus Trojan ( 005639811 )
Alibaba TrojanSpy:MSIL/Kryptik.8b9f32a9
K7GW Trojan ( 005639811 )
Cybereason malicious.8c600b
Arcabit Trojan.MSILRandomKrypt.3
BitDefenderTheta Gen:NN.ZemsilF.34700.zm0@a0PG1Fh
Cyren W32/MSIL_Agent.BEQ.gen!Eldorado
Symantec Trojan Horse
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Trojan-Spy.MSIL.Heye.gen
BitDefender Gen:Heur.MSILRandomKrypt.3
NANO-Antivirus Trojan.Win32.Heye.hhvqwc
Paloalto generic.ml
Ad-Aware Gen:Heur.MSILRandomKrypt.3
Sophos Mal/Generic-S + Troj/MSIL-OOK
Comodo Malware@#39k9bu9r95ewp
F-Secure Heuristic.HEUR/AGEN.1133788
DrWeb Trojan.Siggen9.30330
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R066C0PHK20
McAfee-GW-Edition BehavesLike.Win32.Generic.gc
Emsisoft Gen:Heur.MSILRandomKrypt.3 (B)
Jiangmin TrojanSpy.MSIL.aplt
Avira HEUR/AGEN.1133788
Antiy-AVL Trojan/Win32.Wacatac
Microsoft Trojan:MSIL/AgentTesla!rfn
ZoneAlarm HEUR:Trojan-Spy.MSIL.Heye.gen
GData Gen:Heur.MSILRandomKrypt.3
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.Generic.C4039618
VBA32 TScope.Trojan.MSIL
ALYac Spyware.AgentTesla
Malwarebytes Spyware.AgentTesla
ESET-NOD32 a variant of MSIL/Kryptik.VGC
TrendMicro-HouseCall TROJ_GEN.R066C0PHK20
Tencent Win32.Trojan.Inject.Auto
Yandex Trojan.AvsArher.bTJEKx
Ikarus Trojan.Inject
MaxSecure Trojan.Malware.74720969.susgen
Fortinet MSIL/Autorun.80A5!tr
AVG Win32:TrojanX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_80% (W)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-03-30 05:45:45

Imports

Library mscoree.dll:
0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

No domains contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.