1.8
低危
DACN
0.14
FACILE
1.00
IMCLNet
0.69
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
一个或多个进程崩溃
(50 out of 1024 个事件)
动态指标
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Windows\System32\28-9-2024.exe |
搜索运行中的进程，可能用于识别沙箱规避、代码注入或内存转储的进程
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545351.922625 Process32NextW |
snapshot_handle:
0x000001dc
process_name: taskhost.exe process_identifier: 2188 |
success | 1 | 0 |
将读写内存保护更改为可读执行（可能是为了避免在同时设置所有 RWX 标志时被检测）
(2 个事件)
重复搜索未找到的进程，您可能希望在分析期间运行一个网络浏览器
(50 out of 84 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
从系统中删除大量文件，表明 ransomware、清除恶意软件或系统破坏
(50 out of 1329 个事件)
| file | G:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\‰??‘????.??? |
| file | M:\¤???‘??.??? |
| file | F:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\‰?a??.??? |
| file | T:\?4‰0?6.?–?.“b? |
| file | X:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\???“?c??.??? |
| file | Z:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\c????.??? |
| file | Q:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\‰??‘????.??? |
| file | O:\????.??? |
| file | Y:\?4?694-24–.?‰‰.“b? |
| file | E:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\???“?c??.??? |
| file | U:\??3¤??.?‰‰.“b? |
| file | V:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\”??‰????.??? |
| file | F:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\?a?a?…?¨a‘a??.??? |
| file | X:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\???‘????.??? |
| file | C:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\???‘????.??? |
| file | D:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\‰??‘????.??? |
| file | W:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\‰??‘????.??? |
| file | W:\¤?c’???‘? a?? 3?‘‘????\Administrator\???‰?ca‘??? ¤a‘a\”??‰????.??? |
| file | X:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\????.??? |
| file | U:\??b’.‘?‘ |
| file | N:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\????.??? |
| file | A:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\2??.??? |
| file | F:\|’??– μ3′ 3ca??a‰.??? |
| file | Z:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\2??.??? |
| file | Z:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\?a?a?…?¨a‘a??.??? |
| file | P:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???“?c??.??? |
| file | Y:\a????“a.?‰‰.“b? |
| file | O:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???“?c??.??? |
| file | C:\Users\Administrator\AppData\Local\Temp\???a“.??? |
| file | O:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\c????.??? |
| file | Z:\?4‰0?6.?–?.“b? |
| file | N:\a????“a.?–?.“b? |
| file | I:\a????“a.?–?.“b? |
| file | Y:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\2??.??? |
| file | R:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\¨ˉ??§￥4.??? |
| file | M:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\????.??? |
| file | V:\??b’.‘?‘ |
| file | C:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\”??‰????.??? |
| file | W:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???“?c??.??? |
| file | C:\Users\Administrator\AppData\Local\Temp\??c????.?‰‰ |
| file | D:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\?a?a?…?¨a‘a??.??? |
| file | M:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‘????.??? |
| file | A:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\”??‰????.??? |
| file | H:\a????“a.?–?.“b? |
| file | P:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\?a?a?…?¨a‘a??.??? |
| file | U:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\‰??‘????.??? |
| file | N:\‘…’?b? .?b |
| file | B:\¤???‘??.??? |
| file | C:\¤?c’???‘? a?? 3?‘‘????\Administrator\???‰?ca‘??? ¤a‘a\”??‰????.??? |
| file | H:\¤???‘??.??? |
尝试解除Cuckoo监控的Windows函数的钩子
(1 个事件)
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2008-01-12 22:58:39
PE Imphash
f8e48da0416b83e62d9f7f6781673c24
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0001f000 | 0x0001f000 | 5.720496580761835 |
| .rsrc | 0x00020000 | 0x00006000 | 0x00006000 | 5.533785946520309 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000200e8 | 0x000025a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00022690 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x000226a8 | 0x000004d8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library MSVBVM60.DLL:
• 0x401000 MethCallEngine
• 0x401004 None
• 0x401008 None
• 0x40100c None
• 0x401010 None
• 0x401014 None
• 0x401018 None
• 0x40101c None
• 0x401020 None
• 0x401024 None
• 0x401028 EVENT_SINK_AddRef
• 0x40102c None
• 0x401030 DllFunctionCall
• 0x401034 EVENT_SINK_Release
• 0x401038 None
• 0x40103c EVENT_SINK_QueryInterface
• 0x401040 __vbaExceptHandler
• 0x401044 None
• 0x401048 None
• 0x40104c None
• 0x401050 None
• 0x401054 None
• 0x401058 ProcCallEngine
• 0x40105c None
• 0x401060 None
• 0x401064 None
• 0x401068 None
• 0x40106c None
• 0x401070 None
• 0x401074 None
• 0x401078 None
• 0x40107c None
• 0x401080 None
• 0x401084 None
• 0x401088 None
• 0x40108c None
• 0x401090 None
• 0x401094 None
• 0x401098 None
L424415492123620193264522606760377387083460542552277588268240876037738708346054255227758826824087
Project1
O\9'C
ziSU5I%
AO:O3f
DesertAttack
GmbrGaara
$.' ",#
(7),01444 '9=82<.342
!22222222222222222222222222222222222222222222222222
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
3PG<^dL
[#yG>'Moj
M'4#%tn[V:
XhWz=p6V
>}+| |Zo
8`FqCI
sO%<<g&[`
KRg,Az
z+Zyp)m<EiRAon
';?j]{L}6
\kc<!*&3`p:nI^
NOkrhnGUzqk
Vk.Rtc
xrG wW?5
j)6hsb
$hgHH"`12p>XaF8v
iOhRI"
]dX2mvq
KAL["-
txwyt,jz
izy+R*>EA#
i+hw:[l.Fq
0xWNHd[hW
?-f}RIAvFA
~=k&Lck7I3
@S0};YYZ
Z44ZB"V-\}
^:C,Vur
hP]nc4
~s_8s\
y,QB/\
[)B<1n
eclO?J<g
H$wX%e8}
sz. VDVV
Q:+/TH
:M-\So-aP
:i;+5xB
i,o,7q }
,;YJl-Kv
"3_\(! Fn
t)7RVG]
P2I+D:Rk
[]t=6Z%Yyr
2s[;c`h
z ^+BT
3(rXylo
Yrs^wpE
\hK<3_]V>Z
Jf]9lABCmiP6i%W
,Q$x_:D
| ;V"+d
[hX2<13y
^+%xqPJ
U(S#jUKf
qE#YvBH]
~{@T`N.2q}
f3R]L}JI`H/
ZCMkY<I
p7BU2Z97mb`Z
NJ\wyybv
QE&Fq@
i|/tVhb`#C[
cwoy/9."l1?
${f{K WC
xP1]Dy
RM{Yh:d:v
d|9a2;
p_9IkME
Zo'N(kO
,Yb}=jT~_
#,WR}+
e]2&'&L
Esv`YQ'
Zv}&.g
6uHd1'c
EIu>bq
R[-E.f=X'<)e
[MFA?<Wi?
mR5u"F<
8'k:OcZRnXy~>{
5uuvR0IX
^xT"7Afs\N0
}OWfu;K('+
4mb4{}D
U{j${?
"$c9OU
vVl7_xVauHD
Utx_EG=R
EwC7<Ij'[
LNu_Z[
('QK18
FM]|ik6i5%cjA
O&M)BA[$Y
~62u{Z'se}f
=AW"d_yjYG
/I.{^b
RH/,na
d]R}" k
Gj'N%~
uNbS# \
()jdn%p
|'v._G?
p7/=1;z9_
0~iaW^<
XY(-~RTrx?w
y7p'v-[Ou
)b^>ze(I),GP*gs&Am5 L)
jm3D5;
e.gy<v
tk(m-"H
WK.l#R]d
F"Ij~Dpc
F :UMN
Q^DOFBI
+|1>5jO:3G24
s/GPjR~l
&o{pFG?PMzY
hSW4)Hm
dO/7e2
%,iYK
}iB|U!O
;QgKImIi"p
i@>`9]O=
I?0>;;d$5;7dA
1' zWxl:6
zab_8"u-|
O9<WpH
3HTMGJK
7:nJC,
>VMvVyY
AK@E{G
c#xzCw>E
+nwa0[v#NA
Q\gNybq^
V6'pHplp Nk
_$fKwCols
Syx$u!*
ZMs-YQ
aN3d~yS*]rz
'V{YY#y
^0OQMv
x{]VGc
;/0)X^y
.6xUcpC5
)Ij]Ft5
1)**waE
<Wgq(71
@$q_&U.
9>oAA}
&l*7c^rzZ^H70P
|i7Krp
^~2jSr*J
n*@S5cB
}KGu#Fgg;\O
Zp:qOu':$
j5V\kSO
I8Sw|UVO=R\mG9
N4*Gw#1
][<QwQ
s7YtGwk$c"$`
~K6x$~4
A qWxwV=
TN6v4BM"@
hCCmGRV
Hl}NymtiW)
UFl' 2E5^|
]5~}t^Kq
\k:yc7W
CUc&yWV%9c
1I5++VNP}1
g55'K{Ki!8I}
XsTN<.
=1KV@QE
I%n"%,
?)nB~:cb
Ko`W,9
799>d Q;
?3]Dn,
0qE+}I@
=#PVeHSP0
12SFEI\wjM
{3nE9BWWc@
bFlxW_\H<6e
RA+Zs$
yo:<o 0?\sSr
Cw<pB#
=MGmt(\
[B2K~X^'Sb*w
\$y(x<)SkOaZ:Ot
EIo_[?<~u
`+N=SLdK
3`r; &dGWF
*@I_'^.W
~?*#W7C
S%}1WtF
%%Xd8Pb
jPq@ |C:M
EkhuD-=
!F/S,q
oOgR3ql!
u+k<mOIw~
t`_-dg
fqF*G-k{CF
1IWu8V+?u(
;9.dd E
xfx[Q0d{w$s
SKl'|R
CK2r$MF#H
9856{e
#px=Edk
I*0qbs
vUAB_NUkSp
~\u:1D[>
"Gk4U>[+1U
NO@ yi
Ws$ tt9
61_ZOk P*k
IP0?Pk
i>-}~e#
{N[,U}
Z56I2/
Ve[V3hm
U=M%YkK!,
:R}l1:o
-fsG_9A3A*
R:+JVXu[3}
`sK^m4^3
Rx5`ki
FgFGu>
&_AXCym*
k.r1wh1++?i
VR-FCO
}fB~O55
^+|pvR?
.'Pse'$4
?Znn"YcQ\(2:` (
y }Mo+E0O+=
ULO_mU
%?b2b9]
k|1*3K
7[p^A081
{E;Ql\2%;}j{HTII<X>3-o[E3Ln
YuFVX-,&
3U*FcRRB=@?geh&{
^'=82"
N5(4rCp~\Rn|
i%fn[L)9j
>o8i]C
yMtDfgR
p_f>0X
*T M_zJ[
xI6Z I
|Kw}P%
p1_A~wSl0G
-!PF)X
#~8#rtD
Tv\Np~U
6 ~"+KGch%?C
?h}1n|
cRB7(>J~
R)SfFD:
||.<kn
j;0UQ q
c$%~f<)$T
3* $^~
biGoTe
_WOZuQ
\X.hOC*VV5
^/tk ,5b
q;*}_`ivoum"o,@N
M>W%.L$}v
^!BG5i5
]E"%1C4
(\aI'?
quK_:+r@k
h:]i?j!u:
cVA<Z]{
Mh1Rw+wl,
[Iea{u
U0P=>7"B
]'KI C
;1UIn'H
EAeXR3
I;d5.J%
nZ#(e AFEr
;fDZ^c
Foqi3750
2#`N9^U1_\O
%UfmcT
R2~XqZ
C`q4H9=
XtPtsZL
m2; 4k'=v
R$("0F
&5'U,-g
fnW.R ,y3
;I%/,u
yj$bq~
i['T-5i
Qsj60kBn g
^_|}Nx-{7v
HRmfk87
Id>tn.A<
W^gisPiC5
h; /FuE
qwV6[oo
|@^Y8TPq9#p
8VFGsntEs
%-b,OF4|3
.{[C{Pu
C%wM2+o2>P
/|ZoC5Vi
fK]NfG-
SRK=VuV
yFjRj*=m9s
L]~$tq*
\v}?so
u=[F^;}
8LmOTY2
{zum(x
fm8N^}NnJ:
rrOkLomB*9
/#}~~e
u&Sq9 *
hx[>`~i Op
ox{H, [B
7M4>- @
j(.,J&
:`dKE+a[
C[!4;Rb%
~'Rj*i]
@A Sf`T
%i{{s#wc
Tr\#K{/t
Xf)ad;~1y
|TQI9lt(#
Oo|NJi
mm3K;9
[%buI6 x
#1,A8c
]XKMo$7
5Xm%|Y%
V9:v?5 &tu
M}5P xU
ov6=/k
z3vT&w2N2[
H&\h)<;gooi
:~tzjw
DypX()E
V*|@Kbm
$1zrXL
_)7%K!
$<Wo/;]
8$gZoI
svC/No?
zqDKa_
W n3Zs^
WZ$6Dl
(8XRi]).
b].u2@;"P
'T[XyA%Td;Tp:p:
2w]n$!
?)=xUu/
xW6HAl
zs_N*Sx'\
w*WQs}
o:sZuj2V
;H |!7uMT[-K
C1cnsp
Ckj^=AGa
px>4hEI
8;=o*J
*I+J!h:d
!H.nDv
{t2{67
]Z-/H>{(bd
/quXmlr
UUFc<bE
EJ2A?0F23=1Umh
jZ>q,8wpN
Vk4VS8
3zR1(f
^B`K3 U
k/;^k)4&2CB"a_
n\E9'c
t9._MZJ'z
?$lmJm
h4F6`p6
N}1NWQ^Mm
R#x,r2
wA]KlwqpTH
pg}oq$/$/
;<VIst
Z{|j}$
KHK0UU
>QKvLurKy<E
<mVH2R="h_
]Z-/H>{(bd
m^NC$,kE-I
GLM%y)}7k
_Em,ZHpn.`O-8t
N>nSTS^
#*ZBQHCJ
Ayd1wW
bx7[\*)oeu=A
%-lJbPf$m
WMOWe=
!6E@p1
fb3>`"k
msP!GU.
=u4n/.
{vFQpO
2=M{B,WZ
/Qn9]n
58<7\kBKo
Q-%|a}wVSze
3GWbhQ
-mkQG=i
WZMwm4yi79$v|mI8\2z};k^[yQhIn]MI@
o-]%*Zk=
|nhPppGc*ZMY;j|cU
~xoqp/q
P,5kSkY[^[
Qi&ivV
I{X\'--$Vw
'9Q9QESwV%+j|]
*|?<xVE>[
=z_ <?
;]BK[hnm
Mn[x7w1oGx4rc
^)}"y_I23mW=}r8hp
.=:r396F
:n-KO4_
I?+vO<`p=Y,l
?oRNk4
YY{H[5iI
?2;2{v_
|kzcVfB(X%
CLPKyuq
[YbHC%
I"dm"8
[d~:gh
OM?yI&
~$|SZMijl
3T|).n
H;n/u>c
8uToyA }%
@&pGu=Of
y#1>Dv
2<SV|g(5H&y
gyV<{x]
> \^jP/
{w];8?m
j)Yfq`t_^i~
;|_5-1d+o
~%G{M?>
2^iy]>A
IhzF.X
[t~:gh
-l2D-%.2
N';i,y
N2xTvA+
I)wq%e`)
KazakageSearch
lstDir
GaraKazekage
TimerSebarkanDiri
O\9'C
VB5! *
Kazekage
GaaraTheKazekage
Project1
.......................................................................................................................................................................................................................................................................
Jantung
Moonster
Pemusnah
Penyebaran
Penyerangan
Project1
SU5I%
TO\9'C
zi^^znM&KW
lstDir
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
GmbrGaara
TimerSebarkanDiri
GaraKazekage
KazakageSearch
DesertAttack
kernel32
GetSystemDirectoryA
SetFileAttributesA
wininet.dll
InternetGetConnectedState
kernel32.dll
GetWindowsDirectoryA
DeleteFileA
advapi32.dll
GetUserNameA
UserAktif
KillAV
VBA6.DLL
FindWindowA
FindNextFileA
+3q"=h
user32
SendMessageA
FindWindowExA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
EnableWindow
9 `
FindFirstFileA
FindClose
CopyFileA
GetFileAttributesA
GetDriveTypeA
0 0
0 0
0 0
0 0
0 0
0 0
0 0
9
9 ~
0 ~
0 ~
0 ~
0 ~
9 0 R
0 ~
0 ~
0 ~
9 0 R
0 ~
0 ~
0 ~
0 ~
9 0 R
0 ~
0 ~
0 ~
0 ~
0 ~
0 ~
0 ~
9 0 R
0 ~
0 ~
0 ~
0 0
9 0 R
& 9
& 9
0 0 \
0 0 =
0 0 \
0 0 \
0 0 =
0 0 \
9 0 R
& 0 R
9 `
9 `
9 `
9 `
9 `
9 9
0 0 R
0
9 0 R
9 0 R
9
9
0 0 \
0
0
0
0
0
0 0 \
0
0 0 \
0 0 \
0 9
9 `
9 `
9 `
9 `
t\/X5d
t\/X5d
1x/p5L
hXlhltG
>lpltCl
$`1x/l6
hXlhltG
>lpltCl
$`1x/l6
T`1x5T
0`1h50
0`1h50
0`1h50
lllh*1l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
qh<lll
Xlhqp/l
pXldqt/l
ld#l*FTlh
pXldqt/l
ld#l*FTlh
q4<l4q<
*#$l(*#
' %lhH
lx>\#t*#llp*#h
xtlph\X6
lx>p#t*FX
lx>p#t*FX
lx>\#t*#llp*#h
xtlph\X6
lx>\#t*#llp*#h
xtlph\X6
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
t`/x5X
l|\<,L
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
lhld*1h
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
l4ll^:
qh<lhqx2
FP]/@ 0
F`]/P @
Fp]/` P
F]/p `
F0]/
@0 P@0
*#Tl*#P
TPd`\X)
qh<lht
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
ld>T#`*#\
#`*FDl2
1`>`#d
1`>`#d
d`X\T`6
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
F<,`$ld
*#\l`*#X
d\`XT`PTL($)
*#\l`*#X
d\`X`T)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
#`*Pld
*#\l`*#X
d\`XT`TP)
ld>T#`*#\
ld>T#`*#\
pXl>#3lp
pXl>#32
lp>#,*#
#*#lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
lp>#,*#
\<,|\lL<
\<,|\lL<
\<,l|\L,<
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4`,l
`X\T0,)
FD4Tl>0#*#X
`\XT06
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
#*#`l>\#*#
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>`#*#l*#
td>\FD4
l>#*FX
l>#*FX
zZcf7'
tXl,>$#(32
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
#0*#(>
#$*# >
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
lt> #0*#(
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
>$FT40
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
.')Okx}[t7E[
- 2($E)$N,-Opz|
}Wl7Hk
,,)cccBBBjjj
-# >'%L!&F14afkpibbfJUtuu}
AAEnnq
*(? ?'!F##F""G=CsPze`~b}g~h_}^_^fzBDj
+!$D'#E' C*&@HMrcy_~`
e><m%!F
$#;<:N@>GMQ^
## D'%E#$G'$A#$C4@\y_^g==n)%M&"A$!D
+#!G95W&%BU\tZ~a{5:g$$B'"C%#B
EDRuwluuXk'$D&"B "C
8=Gmut0.L'"?"$C(!A'&T03`
xwyaqMY)'C"#B&
[ajy**K&%G&#C42{
}|br0=Cn{3.S23y0 S!$Q55=
& %$V`wz7:[$&L*%E;2s
$(+8]h{S_|3<^0,H&$Q
3*%NWSRT^]XauXUz.,n
5 ":)'U=7:=-3^enzw|KMWjo|jumu@>c43|
bbp5.q4-n-+^;:<;8<`]`g@=i;:
?=6*-g;<<8&&>+5?;6
!573v31}5688>=HHatbe8:
=A5GH[41u01w9799963/Yceghqh~-,F7>
<DJ) a6574}98=:}1+ekwdgLOggc8/z
5)$Rzvz
!?97979<24Y1.c`c44T0*Z$&Q"
,1,e+,d:7;8::+-L2.tNKmTYiHGK.1-ef_
.1X*(G$&Q+*j
((W.,f0-t:9::()M5662b77=386
OPTKNfKRq;1x8:y-,N5.v;8
=1+i-+f4296'$J@:-3_~~{[`k$"
GFJBDCTOK
#%{20SJNp96@8@G{<7=9RQ\
\`WMQW;8L)'S'(U1.m55,*a8<42`81cGWlv~$ !KHQPNCz'!
/4:IHh00S@<;;@@87I>
C@g31z32k
7,*])(Y-'U/*i<3x<:81W+)V]b<Hk/=Gglg#$%<7j)+[=:7;97::$%M
:4z32|75>:8860t%*Z-+f@:&.M,-f//\lGLlltAMW
:;3QW[5:6$%+jtq5:u+*V>7;=85-.k22q85\DCL
nls;8k23689;97<78778)+T+*R:8DFm]f8;b~
tzeyq{_o}|+3??9.,[9331}+.m95?@nZZY
0.]4/|85:899::98*,V&#N98:6v*+Y-0`u{89Vw>FWEL`::.,g/2y66
;6GBKOY
lok&%U12s./x66=655'(I)%O6465,*V54oCIi{98^rKEC?S24U<83.s787252x
'&C86:8;6-.j837:*+T'$F94780-W..rA@gv/-`_jabGDhn@>WDOk:1x<:2,o54+,d))`3+a
!E@7;6;.-r/,b@6781,l*&J5/w783.Y,/vKI|Xdy,)g9;^;/J04Q8:;:0.j78=;:895-*w/+\
$#2<;7:=:0/l))`65<:::75w<8e,)i8844c2/o4571I%,UMDYgV^SMLLlh1/[2,T3<O0*l>=;7<6@;998:8:>:?6B<w
$?C]<:97}#!Q()W.-p<7::::..u43x6531w:6z./o0/
,'K'+S75EDuwdhjj[Wl1+i('L63pB6.3{99,,l*,d75?9?A
0.<(*W64:9;;:823w./z8730t:6967554_-&S41
<?MNzyTUr.4[30y*,G0/o74/1u;7:51/u-,`
!:0/y<<9899::11p31v871/y35<:74*(a.([+.k=:@>DJl^e~:2a53w;5..[00v7:21u76}9:<;2/w)(J
0-C,*c9944
++n;88:/0q34:80/v33x::85*)a3.n()_88:8HH77kOTr99]52b20t66><-)d91{6631y11u97=:89-1k
"#K55{32ZST\##BA556t10z<865
1/s30u78;9/,h3/q2/u1/{9798:;=:20t22q86A@A?0.s/0r34{31y41x&*]*)a95|:5+'a
&83T@AK
H:962@931x*,c1.t2.r589610p22x2/y22s54
99:<20{11r65
A>BAA?4600w/,r7112w0)gIJN &/=<W
acrD;99/1l)'j+,a20s21}3/r88961/t<;20{31r32};:<8/+t//t:7AADDA>5644t74j7446:9#&=
95M1+^'"H
0.<*'[25272/x69:64/u>7=711y20z>9=;0,x64z9?ADGCC;;8+0m
*=6y;<00yipv
2)^948522|>4%"U//o9;<887/0z98:86283|=8FA?A7;8;55>;GKN[0+C)('
+%U875687wNOf
80;:;99898=<:;9;96>AFB,-^A=;787
+(g98?<LLa
"<8:<63~$'>85}:8::==JH[X_ab_ $<;598x
:7u99rbdd
y66Pon~74s673.llly*)[@9>BOJ
aef''F
==Q:9;:_
.1TD>MGosu
$ W6<8
22TJEosx
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Pa%i5N23-
Uru4<E
7*Idu9M;
w3_^[r#MV
S7(hu#j
Hu6"
sG*DS,u
[b)+Nq(8V
2z7T2=H
$U^Ynboek
Z`Ca&\.q
y_sT]"
rjxY(X
J>>FA.
@1/ 2H
#hS{@;X
,+KjH@sQ#'7
DuH:- Wt
? P(L&H
%uC0KX@
RIP3EZ
zl> @^
t5;*V0(E
'nPPCx2tMsa^}(K
!Z-'6;2=2 @uV
dT)}&nAH+6J^ |
I--,@h
PWQS r
msvb]f\"
]A<f8Q@2I &ZhlkoM
5kEWo*0+m)
`3Q-vP2X:
[+HAqp
licat@on eqr
u.T>he<cd
%s5lyvn}tAba6idS8DLG5Ld,al J3*WI'c,bus32M'agBoxAwFx3tf
kx8l?ExitPL
GtMT)l
t@Ac&v
P"<SH0&zI
`t$$|$(3
r+|$(|$
USQWVRW
ZPR3C
Z^_Y[]
Y*M3MMB
MMM2M}
UUUUM3
]^_[USWV
t5;Et0
EEHERPu
HEuuEEZV~
^ZYY3@^_[
msvbvm
Nu3H^_[
Q@@Pu
Application error
Application corrupt.
The procedure %s could not be located in the DLL %s.
The ordinal %d could not be located in the DLL %s.
user32
MessageBoxA
wsprintfA
kernel32
ExitProcess
CloseHandle
OpenProcess
GetModuleHandleA
VirtualProtect
1 & ' ( . 2 5
( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (
( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (
( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (
: ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (
( ( ( ( ( (
( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (
( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (
@ @ @ @ @ @
@ n g s \ A d m i n i s t r a
@ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ E l P a r a m
E r r o r :
W s c r i p t . S h e l l
r e g w r i t e
\ s m s s . e x e
= { 2 5 5 9 ~ 1
\ G a a r a . e x e
\ c s r s s . e x e
6 5 5 0 0
6 5 5 0 0
L o c a t i o n U R L
6 9 4 - 2 4
/ . . . . . . . .
= = = = = = = = = = = = = = = = =
: 2 . 0
( 3 . 0 6
: 1 2 8
( 5 1 2
: 9 . 0
9 . 0 .
1 0 ) .
(
2 5 5 0 0
R E G _ D W O R D
3 2 5 - 1 1
1 - 0 8 0 0 2
1 0 3 1 8 } \
R e g D e l e t e
3 2 5 - 1 1
1 - 0 8 0 0 2
1 0 3 1 8 } \
7 - 0 8 0 0 2
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
C o m m e n t s
h t t p : / w w w . n a r u t o g a m e s . c o m
F i l e D e s c r i p t i o n
K a z e k a g e - G a m e s - A c t i o n
P r o d u c t N a m e
G a a r a T h e K a z e k a g e B y : P a r a y s u t k i V M C o m m u n i t y
M i s s i o n
D e s t r o y H o k a g e F i l e , K S p o o l d , A u t o i t V 3 , A u t o r u n e r , B l u e F a n t a s i , S y s , V B S v i r , P o r n F i l e , a n d K i c k A n b u - T e a m - S a m p i t
F i l e V e r s i o n
0 6 . 0 1 . 2 0 0 8 ( A ) U p d a t e
P r o d u c t V e r s i o n
0 6 . 0 1 . 2 0 0 8 ( A ) U p d a t e
I n t e r n a l N a m e
K a z e k a g e W a s H e r e
F i l e D e s c r i p t i o n
K a z e k a g e G a m e s A c t i o n
L e g a l C o p y r i g h t
K o t a C a n t i k - P a r a y C i t y
O r i g i n a l F i l e n a m e
K a z e k a g e o f t h e S a n d
V a r F i l e I n f o
T r a n s l a t i o n
Process Tree
- 0dcdea4b860bf3aadedeb4794659c6b981abb0c52bedbb85e3316177aebbf8f0.exe (2948) "C:\Users\Administrator\AppData\Local\Temp\0dcdea4b860bf3aadedeb4794659c6b981abb0c52bedbb85e3316177aebbf8f0.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 8ca925d1a4e440b1_28-9-2024.exe |
|---|---|
| Filepath | C:\Windows\SysWOW64\28-9-2024.exe |
| Size | 152.0KB |
| Processes | 2948 (0dcdea4b860bf3aadedeb4794659c6b981abb0c52bedbb85e3316177aebbf8f0.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed |
| MD5 | 79bd7ac3512538a1b31b40ff193c5219 |
| SHA1 | b0e1e866707087adec0efc52d560597b5218393d |
| SHA256 | 8ca925d1a4e440b129fac80e29ab6980421c715159856d9240ee6839f75d3add |
| CRC32 | 9BDB0F4E |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.