8.0
高危
2 个模型检测该样本为恶意！
重新分析
更多

6f8e7d18c4549ce7b3b3f6784ba540958870005f1cb1ee00961d51625ad30475

497fdd5a6a2dd84cd0758508af34d17f.exe

分析耗时

91s

最近分析

文件大小

978.2KB
静态报毒 动态报毒 100% CONFIDENCE MALICIOUS PE
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20200913 6.0.6.653
Alibaba 20190527 0.3.0.5
Tencent 20200913 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200913 2013.8.14.323
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1620733476.575498
IsDebuggerPresent
failed 0 0
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path C:\Build\JenkinsHome\jobs\desktop_apps_ng\workspace\build\loader\Release\loader.pdb
The file contains an unknown PE resource name possibly indicative of a packer (2 个事件)
resource name ASSETS
resource name TYPELIB
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Encryption keys have been identified in this analysis
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://www.google-analytics.com/collect
Performs some HTTP requests (3 个事件)
request GET http://mrds.mail.ru/update/2/version.txt?type=loader_run&BID=%7B3F5FE231-92EF-4162-A74F-8CE472C88BAF%7D&kind=atom&masterid=%7B0DCD14B1-834A-4885-BC32-11CF98BBE6C8%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.88&old_mr1lad=5e80601214bc8bb0-200-200-&send_stats=1&dsa=0
request GET http://mrds.mail.ru/update/2/version.txt?type=loader_install&BID=%7B3F5FE231-92EF-4162-A74F-8CE472C88BAF%7D&kind=atom&masterid=%7B0DCD14B1-834A-4885-BC32-11CF98BBE6C8%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.88&old_mr1lad=5e80601214bc8bb0-200-200-&send_stats=1&statistic=0
request POST https://www.google-analytics.com/collect
Sends data using the HTTP POST Method (1 个事件)
request POST https://www.google-analytics.com/collect
Resolves a suspicious Top Level Domain (TLD) (2 个事件)
domain mrds.mail.ru description Russian Federation domain TLD
domain browser.cdnmail.ru description Russian Federation domain TLD
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620733472.262498
NtAllocateVirtualMemory
process_identifier: 3068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00600000
success 0 0
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1620733472.450498
GetDiskFreeSpaceExW
root_path: C:\Users\Administrator.Oskar-PC\AppData\Local
free_bytes_available: 19608223744
total_number_of_free_bytes: 0
total_number_of_bytes: 0
success 1 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\mini_loader_scoped_dir_1620710672\loader.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\mini_loader_scoped_dir_1620710672\loader.exe
File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 个事件)
SentinelOne DFI - Malicious PE
CrowdStrike win/malicious_confidence_100% (D)
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620733472.184498
GetAdaptersAddresses
flags: 15
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.847095356197482 section {'size_of_data': '0x00068e00', 'virtual_address': '0x00082000', 'entropy': 7.847095356197482, 'name': '.rsrc', 'virtual_size': '0x00068d20'} description A section with a high entropy has been found
entropy 0.4394971189104243 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 113.108.239.196
host 172.217.24.14
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\loader_ldir_6087609\loader.exe:Zone.Identifier
Generates some ICMP traffic
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-11-26 20:22:32

Imports

Library KERNEL32.dll:
• 0x45c060 LoadLibraryW
• 0x45c064 FreeLibrary
• 0x45c068 CreateDirectoryW
• 0x45c06c GetTempPathW
• 0x45c070 GetFileAttributesW
• 0x45c074 GetTickCount
• 0x45c078 GetStartupInfoW
• 0x45c07c CreateProcessW
• 0x45c080 GetACP
• 0x45c084 SetLastError
• 0x45c088 HeapFree
• 0x45c08c HeapSize
• 0x45c090 HeapReAlloc
• 0x45c094 HeapAlloc
• 0x45c098 GetProcessHeap
• 0x45c0a0 MultiByteToWideChar
• 0x45c0a4 WideCharToMultiByte
• 0x45c0a8 GetCurrentProcess
• 0x45c0ac GetVersionExW
• 0x45c0b0 GetNativeSystemInfo
• 0x45c0bc GlobalAlloc
• 0x45c0c0 GlobalLock
• 0x45c0c8 GlobalUnlock
• 0x45c0cc lstrcmpW
• 0x45c0d0 MulDiv
• 0x45c0d4 ReadFile
• 0x45c0d8 SetFilePointer
• 0x45c0dc GetFileSize
• 0x45c0e0 CreateTimerQueue
• 0x45c0e4 UnregisterWaitEx
• 0x45c0e8 QueryDepthSList
• 0x45c0ec ReleaseSemaphore
• 0x45c0f0 DuplicateHandle
• 0x45c0f4 CopyFileW
• 0x45c0fc GetThreadTimes
• 0x45c100 UnregisterWait
• 0x45c124 GetThreadPriority
• 0x45c128 SetThreadPriority
• 0x45c12c SwitchToThread
• 0x45c130 WriteFile
• 0x45c134 SetEndOfFile
• 0x45c138 WriteConsoleW
• 0x45c13c SetStdHandle
• 0x45c140 CreateThread
• 0x45c14c GetCommandLineA
• 0x45c150 GetOEMCP
• 0x45c154 IsValidCodePage
• 0x45c158 FindNextFileW
• 0x45c15c FindFirstFileExW
• 0x45c160 FindClose
• 0x45c164 EnumSystemLocalesW
• 0x45c168 GetUserDefaultLCID
• 0x45c16c IsValidLocale
• 0x45c170 GetConsoleCP
• 0x45c174 FlushFileBuffers
• 0x45c178 GetFileType
• 0x45c17c ReadConsoleW
• 0x45c180 GetConsoleMode
• 0x45c184 SetFilePointerEx
• 0x45c188 GetCurrentThread
• 0x45c18c GetStdHandle
• 0x45c190 DeleteFileW
• 0x45c194 GetDiskFreeSpaceExW
• 0x45c198 SetEvent
• 0x45c19c GetCurrentThreadId
• 0x45c1a4 GetModuleFileNameW
• 0x45c1a8 RemoveDirectoryW
• 0x45c1b4 GetModuleHandleA
• 0x45c1b8 CreateFileW
• 0x45c1bc GetModuleHandleExW
• 0x45c1c0 ExitProcess
• 0x45c1c4 LoadLibraryExW
• 0x45c1cc RtlUnwind
• 0x45c1d0 VirtualFree
• 0x45c1d4 VirtualAlloc
• 0x45c1e4 OutputDebugStringW
• 0x45c1e8 GetCPInfo
• 0x45c1ec GetLocaleInfoW
• 0x45c1f0 LCMapStringW
• 0x45c1f4 EncodePointer
• 0x45c1f8 TlsFree
• 0x45c1fc TlsSetValue
• 0x45c200 TlsGetValue
• 0x45c204 TlsAlloc
• 0x45c208 Sleep
• 0x45c20c GetStringTypeW
• 0x45c214 InitializeSListHead
• 0x45c218 GetCurrentProcessId
• 0x45c220 IsDebuggerPresent
• 0x45c224 GetModuleHandleW
• 0x45c228 GetProcAddress
• 0x45c22c CreateEventW
• 0x45c230 LocalFree
• 0x45c234 GetCommandLineW
• 0x45c238 GetExitCodeProcess
• 0x45c240 DecodePointer
• 0x45c244 RaiseException
• 0x45c248 CloseHandle
• 0x45c24c GetLastError
• 0x45c250 SignalObjectAndWait
• 0x45c25c TerminateProcess
• 0x45c26c ResetEvent
• 0x45c270 GetSystemInfo
• 0x45c274 VirtualProtect
• 0x45c278 VirtualQuery
• 0x45c27c LoadLibraryExA
Library USER32.dll:
• 0x45c2cc PostThreadMessageW
• 0x45c2d0 SendMessageW
• 0x45c2d4 wsprintfW
• 0x45c2d8 GetCursorPos
• 0x45c2dc UnregisterClassW
• 0x45c2e0 DefWindowProcW
• 0x45c2e4 LoadCursorW
• 0x45c2e8 RegisterClassExW
• 0x45c2ec PeekMessageW
• 0x45c2f0 TranslateMessage
• 0x45c2f4 DispatchMessageW
• 0x45c2f8 SetWindowLongW
• 0x45c2fc DestroyWindow
• 0x45c300 SetTimer
• 0x45c304 InvalidateRgn
• 0x45c308 KillTimer
• 0x45c310 GetWindow
• 0x45c314 GetFocus
• 0x45c318 GetDC
• 0x45c31c SetWindowPos
• 0x45c320 FillRect
• 0x45c324 ScreenToClient
• 0x45c328 GetSystemMetrics
• 0x45c32c SetWindowTextW
• 0x45c330 ShowWindow
• 0x45c334 IsWindow
• 0x45c33c RedrawWindow
• 0x45c340 ClientToScreen
• 0x45c348 IsChild
• 0x45c34c GetSysColor
• 0x45c350 MoveWindow
• 0x45c358 SetFocus
• 0x45c35c CharNextW
• 0x45c360 GetClassNameW
• 0x45c364 SetCapture
• 0x45c368 GetClientRect
• 0x45c36c GetDlgItem
• 0x45c370 GetDesktopWindow
• 0x45c378 GetParent
• 0x45c380 ReleaseCapture
• 0x45c384 InvalidateRect
• 0x45c388 ReleaseDC
• 0x45c38c BeginPaint
• 0x45c390 EndPaint
• 0x45c394 GetWindowTextW
• 0x45c398 CallWindowProcW
• 0x45c39c CreateWindowExW
• 0x45c3a0 GetClassInfoExW
• 0x45c3a4 PostQuitMessage
• 0x45c3a8 GetWindowLongW
Library GDI32.dll:
• 0x45c034 BitBlt
• 0x45c03c SelectObject
• 0x45c040 CreateCompatibleDC
• 0x45c044 GetStockObject
• 0x45c048 GetDeviceCaps
• 0x45c04c DeleteDC
• 0x45c050 GetObjectW
• 0x45c054 DeleteObject
• 0x45c058 CreateSolidBrush
Library SHELL32.dll:
• 0x45c2b4 SHGetFolderPathW
• 0x45c2b8 CommandLineToArgvW
Library ole32.dll:
• 0x45c3b8 StringFromCLSID
• 0x45c3bc CoCreateGuid
• 0x45c3c0 CoTaskMemFree
• 0x45c3cc CoCreateInstance
• 0x45c3d0 OleInitialize
• 0x45c3d4 CoGetClassObject
• 0x45c3d8 CoTaskMemAlloc
• 0x45c3dc StringFromGUID2
• 0x45c3e0 CLSIDFromProgID
• 0x45c3e8 CLSIDFromString
• 0x45c3ec OleLockRunning
• 0x45c3f0 OleUninitialize
Library OLEAUT32.dll:
• 0x45c284 SysAllocString
• 0x45c288 LoadTypeLib
• 0x45c28c SysFreeString
• 0x45c290 VariantClear
• 0x45c294 SysStringLen
• 0x45c298 VariantInit
• 0x45c2a0 DispCallFunc
• 0x45c2a4 SysAllocStringLen
• 0x45c2a8 LoadRegTypeLib
• 0x45c2ac VariantCopy
Library ADVAPI32.dll:
• 0x45c000 CryptDestroyKey
• 0x45c00c CryptCreateHash
• 0x45c010 CryptHashData
• 0x45c014 CryptDestroyHash
• 0x45c018 CryptReleaseContext
• 0x45c01c RegSetValueExW
• 0x45c024 RegCreateKeyExW
• 0x45c028 RegQueryValueExW
• 0x45c02c RegCloseKey
Library SHLWAPI.dll:
• 0x45c2c0 StrToIntExW
• 0x45c2c4 PathFindFileNameW
Library WS2_32.dll:
• 0x45c3b0 ntohl

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49176 217.69.139.245 mrds.mail.ru 80
192.168.56.101 49178 217.69.139.245 mrds.mail.ru 80
192.168.56.101 49180 5.181.61.0 browser.cdnmail.ru 443
192.168.56.101 49177 58.63.233.33 www.google-analytics.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://mrds.mail.ru/update/2/version.txt?type=loader_install&BID=%7B3F5FE231-92EF-4162-A74F-8CE472C88BAF%7D&kind=atom&masterid=%7B0DCD14B1-834A-4885-BC32-11CF98BBE6C8%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.88&old_mr1lad=5e80601214bc8bb0-200-200-&send_stats=1&statistic=0 
GET /update/2/version.txt?type=loader_install&BID=%7B3F5FE231-92EF-4162-A74F-8CE472C88BAF%7D&kind=atom&masterid=%7B0DCD14B1-834A-4885-BC32-11CF98BBE6C8%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.88&old_mr1lad=5e80601214bc8bb0-200-200-&send_stats=1&statistic=0 HTTP/1.1
Connection: Close
User-Agent: AtomLoader
Host: mrds.mail.ru
http://mrds.mail.ru/update/2/version.txt?type=loader_run&BID=%7B3F5FE231-92EF-4162-A74F-8CE472C88BAF%7D&kind=atom&masterid=%7B0DCD14B1-834A-4885-BC32-11CF98BBE6C8%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.88&old_mr1lad=5e80601214bc8bb0-200-200-&send_stats=1&dsa=0 
GET /update/2/version.txt?type=loader_run&BID=%7B3F5FE231-92EF-4162-A74F-8CE472C88BAF%7D&kind=atom&masterid=%7B0DCD14B1-834A-4885-BC32-11CF98BBE6C8%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.88&old_mr1lad=5e80601214bc8bb0-200-200-&send_stats=1&dsa=0 HTTP/1.1
Connection: Close
User-Agent: AtomLoader
Host: mrds.mail.ru

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.