1.8
低危

2a14605738114064e7b8bd4af38c0a2fcae66201d38b7ad9cfbd82c8561ebfef

4ac26e2da9f834d717c9402ae4ccb02f.exe

分析耗时

6s

最近分析

文件大小

388.0KB
静态报毒 动态报毒 1BIPF8T AI SCORE=80 AUSL BFIOFWHP518 ELDORADO EMOTET GENCIRC GENERICKD GENETIC HIGH CONFIDENCE HSZQAZ KRYPTIK MALWARE@#1UTIZI4AK4VCF R + TROJ R349162 TROJANBANKER TROJANX VXCZRQBDBEF WTWWB YQ0@A0R8NCGI ZENPAK ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Baidu 20190318 1.0.0.2
Avast Win32:TrojanX-gen [Trj] 20201024 18.4.3895.0
Alibaba Trojan:Win32/Emotet.709f5fc2 20190527 0.3.0.5
Tencent Malware.Win32.Gencirc.10cdee43 20201024 1.0.0.1
Kingsoft 20201024 2013.8.14.323
McAfee Emotet-FRV!4AC26E2DA9F8 20201024 6.0.6.653
CrowdStrike 20190702 1.0
静态指标
行为判定
动态指标
The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)
entropy 7.215295273983518 section {'size_of_data': '0x0000f000', 'virtual_address': '0x00052000', 'entropy': 7.215295273983518, 'name': '.rsrc', 'virtual_size': '0x0000e7e8'} description A section with a high entropy has been found
网络通信
File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34417811
FireEye Trojan.GenericKD.34417811
ALYac Trojan.Agent.Emotet
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Trojan.GenericKD.34417811
K7GW Riskware ( 0040eff71 )
BitDefenderTheta Gen:NN.ZexaF.34590.yq0@a0R8ncgi
Cyren W32/Emotet.ARB.gen!Eldorado
Symantec Trojan.Emotet
ESET-NOD32 Win32/Emotet.CD
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
ClamAV Win.Dropper.Emotet-9781421-0
Kaspersky HEUR:Trojan-Banker.Win32.Emotet.vho
Alibaba Trojan:Win32/Emotet.709f5fc2
NANO-Antivirus Trojan.Win32.Emotet.hszqaz
ViRobot Trojan.Win32.Emotet.397312.C
Tencent Malware.Win32.Gencirc.10cdee43
Ad-Aware Trojan.GenericKD.34417811
Sophos Troj/Emotet-CLS
Comodo Malware@#1utizi4ak4vcf
DrWeb Trojan.Emotet.1005
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-R + Troj/Emotet-CLS
McAfee-GW-Edition BehavesLike.Win32.Emotet.fh
Emsisoft Trojan.GenericKD.34417811 (B)
Jiangmin Trojan.Banker.Emotet.oez
Avira TR/Emotet.wtwwb
MAX malware (ai score=80)
Microsoft Trojan:Win32/Emotet.PED!MTB
AhnLab-V3 Malware/Win32.RL_Generic.R349162
ZoneAlarm HEUR:Trojan-Banker.Win32.Emotet.vho
GData Win32.Trojan.PSE.1BIPF8T
McAfee Emotet-FRV!4AC26E2DA9F8
TACHYON Banker/W32.Emotet.397312.I
VBA32 TrojanBanker.Emotet
Panda Trj/Genetic.gen
Rising Trojan.Kryptik!8.8 (TFE:5:vXCzrqbdBEF)
Yandex Trojan.Emotet!bfiOfWHp518
Fortinet W32/Zenpak.AUSL!tr
AVG Win32:TrojanX-gen [Trj]
Paloalto generic.ml
Qihoo-360 Win32/Trojan.10c
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-25 01:31:16

Imports

Library MFC42.DLL:
0x4480b8
0x4480bc
0x4480c0
0x4480c4
0x4480c8
0x4480cc
0x4480d0
0x4480d4
0x4480d8
0x4480dc
0x4480e0
0x4480e4
0x4480e8
0x4480ec
0x4480f0
0x4480f4
0x4480f8
0x4480fc
0x448100
0x448104
0x448108
0x44810c
0x448110
0x448114
0x448118
0x44811c
0x448120
0x448124
0x448128
0x44812c
0x448130
0x448134
0x448138
0x44813c
0x448140
0x448144
0x448148
0x44814c
0x448150
0x448154
0x448158
0x44815c
0x448160
0x448164
0x448168
0x44816c
0x448170
0x448174
0x448178
0x44817c
0x448180
0x448184
0x448188
0x44818c
0x448190
0x448194
0x448198
0x44819c
0x4481a0
0x4481a4
0x4481a8
0x4481ac
0x4481b0
0x4481b4
0x4481b8
0x4481bc
0x4481c0
0x4481c4
0x4481c8
0x4481cc
0x4481d0
0x4481d4
0x4481d8
0x4481dc
0x4481e0
0x4481e4
0x4481e8
0x4481ec
0x4481f0
0x4481f4
0x4481f8
0x4481fc
0x448200
0x448204
0x448208
0x44820c
0x448210
0x448214
0x448218
0x44821c
0x448220
0x448224
0x448228
0x44822c
0x448230
0x448234
0x448238
0x44823c
0x448240
0x448244
0x448248
0x44824c
0x448250
0x448254
0x448258
0x44825c
0x448260
0x448264
0x448268
0x44826c
0x448270
0x448274
0x448278
0x44827c
0x448280
0x448284
0x448288
0x44828c
0x448290
Library MSVCRT.dll:
0x4482b8 __getmainargs
0x4482bc _acmdln
0x4482c0 exit
0x4482c4 _XcptFilter
0x4482c8 _exit
0x4482cc _onexit
0x4482d0 __dllonexit
0x4482d4 localtime
0x4482d8 strncmp
0x4482dc memmove
0x4482e0 _isctype
0x4482e4 _initterm
0x4482e8 tolower
0x4482ec toupper
0x4482f0 free
0x4482f4 _ftol
0x4482f8 atoi
0x4482fc _purecall
0x448300 vsprintf
0x448304 malloc
0x448308 _wcslwr
0x44830c __CxxFrameHandler
0x448310 _setmbcp
0x448314 __setusermatherr
0x448318 _adjust_fdiv
0x44831c __p__commode
0x448320 __p__fmode
0x448324 __set_app_type
0x448328 _except_handler3
0x44832c realloc
0x448330 _controlfp
Library KERNEL32.dll:
0x448000 LockFile
0x448004 GetFileSize
0x448008 FlushFileBuffers
0x44800c SetEndOfFile
0x448010 WriteFile
0x448014 SetFilePointer
0x448018 GetLastError
0x44801c ReadFile
0x448020 Sleep
0x448024 CloseHandle
0x448028 AreFileApisANSI
0x44802c MultiByteToWideChar
0x448030 WideCharToMultiByte
0x448034 ExitProcess
0x448038 LockFileEx
0x44803c GetVersionExA
0x448040 CreateFileA
0x448044 CreateFileW
0x448048 GetTempPathA
0x44804c GetTempPathW
0x448050 GetFileAttributesA
0x448054 DeleteFileA
0x448058 GetFileAttributesW
0x44805c DeleteFileW
0x448060 GetFullPathNameA
0x448064 GetFullPathNameW
0x448068 LoadLibraryA
0x44806c LoadLibraryW
0x448070 FormatMessageA
0x448074 GetProcAddress
0x448078 FreeLibrary
0x448080 GetTickCount
0x448084 GetCurrentProcessId
0x448088 GetSystemTime
0x44809c GetCurrentThreadId
0x4480a8 GetModuleHandleA
0x4480ac GetStartupInfoA
0x4480b0 UnlockFile
Library USER32.dll:
0x448338 AppendMenuA
0x44833c SendMessageA
0x448340 ShowWindow
0x448344 LoadIconA
0x448348 EnableWindow
0x44834c GetSystemMenu

Hosts

No hosts contacted.

DNS

No domains contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.