4.0
中危
39 个模型检测该样本为恶意！
重新分析
更多

8d1baf0c8b986b24d03c608c4edaa1053d3dc90065bfcd2a827651a6effb0bdb

4b71bd82a86dda1bd49cf66473717526.exe

分析耗时

77s

最近分析

文件大小

325.9KB
静态报毒 动态报毒 A VARIANT OF GENERIK AI SCORE=81 GENERICKD GENOME HUODWE IYWOWMN L3QFUY2TRQD MALICIOUS METERPRETER NJJUW QVM202 R023C0DI620 ROZENA SPXGQ@0 SWRORT UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee RDN/Generic.dx 20200914 6.0.6.653
Alibaba Trojan:Win32/Swrort.800bc49e 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Tencent 20200915 1.0.0.1
Kingsoft 20200915 2013.8.14.323
CrowdStrike 20190702 1.0
静态指标
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620946608.026139
NtAllocateVirtualMemory
process_identifier: 2340
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0000000000630000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620946614.838139
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 47.105.143.181
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1620946617.385139
RegSetValueExA
key_handle: 0x000000000000032c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620946617.385139
RegSetValueExA
key_handle: 0x000000000000032c
value: ²;ë:H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620946617.385139
RegSetValueExA
key_handle: 0x000000000000032c
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620946617.385139
RegSetValueExW
key_handle: 0x000000000000032c
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620946617.401139
RegSetValueExA
key_handle: 0x0000000000000344
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620946617.401139
RegSetValueExA
key_handle: 0x0000000000000344
value: ²;ë:H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620946617.401139
RegSetValueExA
key_handle: 0x0000000000000344
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620946617.494139
RegSetValueExW
key_handle: 0x0000000000000328
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 47.105.143.181:8885
File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 个事件)
MicroWorld-eScan Trojan.GenericKD.34493772
FireEye Generic.mg.4b71bd82a86dda1b
McAfee RDN/Generic.dx
Cylance Unsafe
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Swrort.800bc49e
K7GW Riskware ( 0040eff71 )
Arcabit Trojan.Generic.D20E554C
Invincea Mal/Generic-S
Symantec Trojan.Gen.MBT
APEX Malicious
Kaspersky Trojan.Win32.Swrort.blr
BitDefender Trojan.GenericKD.34493772
NANO-Antivirus Trojan.Win64.Swrort.huodwe
ViRobot Trojan.Win32.Z.Swrort.333678
Ad-Aware Trojan.GenericKD.34493772
Comodo TrojWare.Win32.Genome.spxgq@0
F-Secure Trojan.TR/Swrort.njjuw
DrWeb Exploit.ShellCode.46
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R023C0DI620
Sophos Mal/Generic-S
Webroot W32.Trojan.Gen
Avira TR/Swrort.njjuw
Antiy-AVL Trojan/Win32.Swrort
Microsoft Trojan:Win64/Meterpreter.E
ZoneAlarm Trojan.Win32.Swrort.blr
GData Trojan.GenericKD.34493772
VBA32 Trojan.Swrort
ALYac Trojan.Agent.Rozena
MAX malware (ai score=81)
ESET-NOD32 a variant of Generik.IYWOWMN
TrendMicro-HouseCall TROJ_GEN.R023C0DI620
Rising Trojan.Meterpreter!8.E532 (TFE:5:l3qfuy2TRqD)
Ikarus Trojan.Win64.Meterpreter
Fortinet W32/Swrort.BLR!tr
AVG Win64:Malware-gen
Panda Trj/CI.A
Qihoo-360 Generic/HEUR/QVM202.0.B817.Malware.Gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-09-04 15:31:07

Imports

Library KERNEL32.dll:
• 0x4081ec GetCurrentProcess
• 0x4081f4 GetCurrentProcessId
• 0x4081fc GetCurrentThreadId
• 0x408204 GetLastError
• 0x40820c GetStartupInfoA
• 0x40821c GetTickCount
• 0x40823c RtlAddFunctionTable
• 0x408244 RtlCaptureContext
• 0x408254 RtlVirtualUnwind
• 0x408264 Sleep
• 0x40826c TerminateProcess
• 0x408274 TlsGetValue
• 0x408284 VirtualAlloc
• 0x40828c VirtualProtect
• 0x408294 VirtualQuery
Library msvcrt.dll:
• 0x4082ac __getmainargs
• 0x4082b4 __initenv
• 0x4082bc __iob_func
• 0x4082c4 __lconv_init
• 0x4082cc __set_app_type
• 0x4082d4 __setusermatherr
• 0x4082dc _acmdln
• 0x4082e4 _amsg_exit
• 0x4082ec _cexit
• 0x4082f4 _fmode
• 0x4082fc _initterm
• 0x408304 _onexit
• 0x40830c abort
• 0x408314 calloc
• 0x40831c clock
• 0x408324 exit
• 0x40832c fprintf
• 0x408334 free
• 0x40833c fwrite
• 0x408344 malloc
• 0x40834c memcpy
• 0x408354 signal
• 0x40835c strlen
• 0x408364 strncmp
• 0x40836c vfprintf

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.