SmartHawk

11.2

0-day

54 个模型检测该样本为恶意！

重新分析

下载样本

611086722efb829d07f7059226cd4a0ab3544945c63c622eb11133027517654e

4bf5626cdced13d2a43c38a33389dd2f.exe

分析耗时

218s

最近分析

文件大小

164.0KB

静态报毒动态报毒 AI SCORE=81 AIDETECTVM ANTIVM ARTEMIS ATTRIBUTE AVEMARIA AZORULT CLASSIC CONFIDENCE DROPPERX ELYA EMKM GDSDA HIGH CONFIDENCE HIGHCONFIDENCE JAIK KM0@ACJA3TDI KRYPTIK MALWARE1 MALWARE@#3HET32M0EAON MINT NRRW OCCAMY PHQR PVQYP8RUXYU QVM20 R336922 SCORE SIGGEN2 STATIC AI SUSGEN SUSPICIOUS PE SZMCA UNSAFE ZEVBAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!4BF5626CDCED	20201211	6.0.6.653
Alibaba	TrojanSpy:Win32/AveMaria.1d70840d	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Avast	Win32:DropperX-gen [Drp]	20201210	21.1.5827.0
Baidu		20190318	1.0.0.2
Kingsoft		20201211	2017.9.26.565
Tencent	Win32.Trojan-spy.Avemaria.Phqr	20201211	1.0.0.1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619471165.088125 GlobalMemoryStatusEx		success	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

CHECKLIST

One or more processes crashed (50 out of 54518 个事件)

Time & API	Arguments	Status
1619471159.47925 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331189 registers.ebp: 1804769211 registers.edx: 1637352 registers.ebx: 39330517 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 5f b6 15 7e 05 68 6d ba 50 94 8a 2a b4 f1 00 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25812c9	success
1619471159.47925 __exception__	stacktrace: registers.esp: 1635336 registers.edi: 0 registers.eax: 0 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 39326084 registers.esi: 0 registers.ecx: 39330517 exception.instruction_r: 6f ab 55 d6 54 b1 9b 9f ba 12 6d 47 da 3b d5 1b exception.instruction: outsd dx, dword ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25810f7	success
1619471159.47925 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 0 registers.eax: 16 registers.ebp: 39321777 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: cf e9 63 dd ff ff 5e 31 c0 e9 9b f5 ff ff 2d 07 exception.instruction: iretd exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x25822ba	success
1619471159.47925 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaee RtlCaptureContext-0x5e ntdll+0x46acd @ 0x77d76acd 0x25822d5 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 __vbaBoolErrVar+0x2c1e __vbaExceptHandler-0x139 msvbvm60+0xe46a6 @ 0x72a246a6 CreateIExprSrvObj+0x9f2 _CIexp-0x2058 msvbvm60+0xebcb9 @ 0x72a2bcb9 WinSqmSetIfMaxDWORD+0x35 RtlGetThreadErrorMode-0x23b ntdll+0x71ecd @ 0x77da1ecd registers.esp: 1635324 registers.edi: 0 registers.eax: 16 registers.ebp: 1635404 registers.edx: 2010606285 registers.ebx: 39322111 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: e5 0c 4b fc da 09 43 f3 0b 46 ab c7 ec 3b e2 0b exception.instruction: in eax, 0xc exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2580169	success
1619471159.47925 __exception__	stacktrace: registers.esp: 1633500 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39329034 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: fa 53 91 a9 f1 66 d8 c3 85 c6 2e f0 69 e2 13 a2 exception.instruction: cli exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581cbf	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633520 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39326369 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: ec 35 48 84 d5 fa 18 b4 eb 69 8e ba 2e 8a 93 61 exception.instruction: in al, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581201	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 39329673 registers.eax: 194593917 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 2684 exception.instruction_r: 6e 7c e1 54 1c 29 b1 da bb 02 09 38 11 bc 6c 40 exception.instruction: outsb dx, byte ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581ef1	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331193 registers.ebp: 39322692 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 58 12 cc ea 86 01 1a ed 93 cb 0e 87 dc 37 b2 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x258042e	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331193 registers.ebp: 1804769211 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 39323023 registers.ecx: 39321600 exception.instruction_r: ed 42 87 35 af 80 6a 8e d7 51 a7 fd 46 0d 2b b0 exception.instruction: in eax, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25804df	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331193 registers.ebp: 3560839858 registers.edx: 1637352 registers.ebx: 39330517 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 5f b6 15 7e 05 68 6d ba 50 94 8a 2a b4 f1 00 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25812c9	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635336 registers.edi: 0 registers.eax: 0 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 39326084 registers.esi: 0 registers.ecx: 39330517 exception.instruction_r: 6f ab 55 d6 54 b1 9b 9f ba 12 6d 47 da 3b d5 1b exception.instruction: outsd dx, dword ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25810f7	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 0 registers.eax: 16 registers.ebp: 39321777 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: cf e9 63 dd ff ff 5e 31 c0 e9 9b f5 ff ff 2d 07 exception.instruction: iretd exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x25822ba	success
1619471159.49525 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaee RtlCaptureContext-0x5e ntdll+0x46acd @ 0x77d76acd 0x25822d5 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 __vbaBoolErrVar+0x2c1e __vbaExceptHandler-0x139 msvbvm60+0xe46a6 @ 0x72a246a6 CreateIExprSrvObj+0x9f2 _CIexp-0x2058 msvbvm60+0xebcb9 @ 0x72a2bcb9 WinSqmSetIfMaxDWORD+0x35 RtlGetThreadErrorMode-0x23b ntdll+0x71ecd @ 0x77da1ecd registers.esp: 1635324 registers.edi: 0 registers.eax: 16 registers.ebp: 1635404 registers.edx: 2010606285 registers.ebx: 39322111 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: e5 0c 4b fc da 09 43 f3 0b 46 ab c7 ec 3b e2 0b exception.instruction: in eax, 0xc exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2580169	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633500 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39329034 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: fa 53 91 a9 f1 66 d8 c3 85 c6 2e f0 69 e2 13 a2 exception.instruction: cli exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581cbf	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633520 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39326369 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: ec 35 48 84 d5 fa 18 b4 eb 69 8e ba 2e 8a 93 61 exception.instruction: in al, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581201	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 39329673 registers.eax: 194593917 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 2684 exception.instruction_r: 6e 7c e1 54 1c 29 b1 da bb 02 09 38 11 bc 6c 40 exception.instruction: outsb dx, byte ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581ef1	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331197 registers.ebp: 39322692 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 58 12 cc ea 86 01 1a ed 93 cb 0e 87 dc 37 b2 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x258042e	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331197 registers.ebp: 3560839858 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 39323023 registers.ecx: 39321600 exception.instruction_r: ed 42 87 35 af 80 6a 8e d7 51 a7 fd 46 0d 2b b0 exception.instruction: in eax, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25804df	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331197 registers.ebp: 3656851989 registers.edx: 1637352 registers.ebx: 39330517 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 5f b6 15 7e 05 68 6d ba 50 94 8a 2a b4 f1 00 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25812c9	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635336 registers.edi: 0 registers.eax: 0 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 39326084 registers.esi: 0 registers.ecx: 39330517 exception.instruction_r: 6f ab 55 d6 54 b1 9b 9f ba 12 6d 47 da 3b d5 1b exception.instruction: outsd dx, dword ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25810f7	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 0 registers.eax: 16 registers.ebp: 39321777 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: cf e9 63 dd ff ff 5e 31 c0 e9 9b f5 ff ff 2d 07 exception.instruction: iretd exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x25822ba	success
1619471159.49525 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaee RtlCaptureContext-0x5e ntdll+0x46acd @ 0x77d76acd 0x25822d5 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 __vbaBoolErrVar+0x2c1e __vbaExceptHandler-0x139 msvbvm60+0xe46a6 @ 0x72a246a6 CreateIExprSrvObj+0x9f2 _CIexp-0x2058 msvbvm60+0xebcb9 @ 0x72a2bcb9 WinSqmSetIfMaxDWORD+0x35 RtlGetThreadErrorMode-0x23b ntdll+0x71ecd @ 0x77da1ecd registers.esp: 1635324 registers.edi: 0 registers.eax: 16 registers.ebp: 1635404 registers.edx: 2010606285 registers.ebx: 39322111 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: e5 0c 4b fc da 09 43 f3 0b 46 ab c7 ec 3b e2 0b exception.instruction: in eax, 0xc exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2580169	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633500 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39329034 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: fa 53 91 a9 f1 66 d8 c3 85 c6 2e f0 69 e2 13 a2 exception.instruction: cli exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581cbf	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633520 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39326369 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: ec 35 48 84 d5 fa 18 b4 eb 69 8e ba 2e 8a 93 61 exception.instruction: in al, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581201	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 39329673 registers.eax: 194593917 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 2684 exception.instruction_r: 6e 7c e1 54 1c 29 b1 da bb 02 09 38 11 bc 6c 40 exception.instruction: outsb dx, byte ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581ef1	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331201 registers.ebp: 39322692 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 58 12 cc ea 86 01 1a ed 93 cb 0e 87 dc 37 b2 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x258042e	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331201 registers.ebp: 3656851989 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 39323023 registers.ecx: 39321600 exception.instruction_r: ed 42 87 35 af 80 6a 8e d7 51 a7 fd 46 0d 2b b0 exception.instruction: in eax, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25804df	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331201 registers.ebp: 1723832532 registers.edx: 1637352 registers.ebx: 39330517 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 5f b6 15 7e 05 68 6d ba 50 94 8a 2a b4 f1 00 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25812c9	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635336 registers.edi: 0 registers.eax: 0 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 39326084 registers.esi: 0 registers.ecx: 39330517 exception.instruction_r: 6f ab 55 d6 54 b1 9b 9f ba 12 6d 47 da 3b d5 1b exception.instruction: outsd dx, dword ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25810f7	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 0 registers.eax: 16 registers.ebp: 39321777 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: cf e9 63 dd ff ff 5e 31 c0 e9 9b f5 ff ff 2d 07 exception.instruction: iretd exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x25822ba	success
1619471159.49525 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaee RtlCaptureContext-0x5e ntdll+0x46acd @ 0x77d76acd 0x25822d5 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 __vbaBoolErrVar+0x2c1e __vbaExceptHandler-0x139 msvbvm60+0xe46a6 @ 0x72a246a6 CreateIExprSrvObj+0x9f2 _CIexp-0x2058 msvbvm60+0xebcb9 @ 0x72a2bcb9 WinSqmSetIfMaxDWORD+0x35 RtlGetThreadErrorMode-0x23b ntdll+0x71ecd @ 0x77da1ecd registers.esp: 1635324 registers.edi: 0 registers.eax: 16 registers.ebp: 1635404 registers.edx: 2010606285 registers.ebx: 39322111 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: e5 0c 4b fc da 09 43 f3 0b 46 ab c7 ec 3b e2 0b exception.instruction: in eax, 0xc exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2580169	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633500 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39329034 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: fa 53 91 a9 f1 66 d8 c3 85 c6 2e f0 69 e2 13 a2 exception.instruction: cli exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581cbf	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633520 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39326369 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: ec 35 48 84 d5 fa 18 b4 eb 69 8e ba 2e 8a 93 61 exception.instruction: in al, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581201	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 39329673 registers.eax: 194593917 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 2684 exception.instruction_r: 6e 7c e1 54 1c 29 b1 da bb 02 09 38 11 bc 6c 40 exception.instruction: outsb dx, byte ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581ef1	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331205 registers.ebp: 39322692 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 58 12 cc ea 86 01 1a ed 93 cb 0e 87 dc 37 b2 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x258042e	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331205 registers.ebp: 1723832532 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 39323023 registers.ecx: 39321600 exception.instruction_r: ed 42 87 35 af 80 6a 8e d7 51 a7 fd 46 0d 2b b0 exception.instruction: in eax, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25804df	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331205 registers.ebp: 4023445151 registers.edx: 1637352 registers.ebx: 39330517 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 5f b6 15 7e 05 68 6d ba 50 94 8a 2a b4 f1 00 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25812c9	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635336 registers.edi: 0 registers.eax: 0 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 39326084 registers.esi: 0 registers.ecx: 39330517 exception.instruction_r: 6f ab 55 d6 54 b1 9b 9f ba 12 6d 47 da 3b d5 1b exception.instruction: outsd dx, dword ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25810f7	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 0 registers.eax: 16 registers.ebp: 39321777 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: cf e9 63 dd ff ff 5e 31 c0 e9 9b f5 ff ff 2d 07 exception.instruction: iretd exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x25822ba	success
1619471159.49525 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaee RtlCaptureContext-0x5e ntdll+0x46acd @ 0x77d76acd 0x25822d5 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 __vbaBoolErrVar+0x2c1e __vbaExceptHandler-0x139 msvbvm60+0xe46a6 @ 0x72a246a6 CreateIExprSrvObj+0x9f2 _CIexp-0x2058 msvbvm60+0xebcb9 @ 0x72a2bcb9 WinSqmSetIfMaxDWORD+0x35 RtlGetThreadErrorMode-0x23b ntdll+0x71ecd @ 0x77da1ecd registers.esp: 1635324 registers.edi: 0 registers.eax: 16 registers.ebp: 1635404 registers.edx: 2010606285 registers.ebx: 39322111 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: e5 0c 4b fc da 09 43 f3 0b 46 ab c7 ec 3b e2 0b exception.instruction: in eax, 0xc exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2580169	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633500 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39329034 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: fa 53 91 a9 f1 66 d8 c3 85 c6 2e f0 69 e2 13 a2 exception.instruction: cli exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581cbf	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633520 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39326369 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: ec 35 48 84 d5 fa 18 b4 eb 69 8e ba 2e 8a 93 61 exception.instruction: in al, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581201	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 39329673 registers.eax: 194593917 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 2684 exception.instruction_r: 6e 7c e1 54 1c 29 b1 da bb 02 09 38 11 bc 6c 40 exception.instruction: outsb dx, byte ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581ef1	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331209 registers.ebp: 39322692 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 58 12 cc ea 86 01 1a ed 93 cb 0e 87 dc 37 b2 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x258042e	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331209 registers.ebp: 4023445151 registers.edx: 1637352 registers.ebx: 1923204860 registers.esi: 39323023 registers.ecx: 39321600 exception.instruction_r: ed 42 87 35 af 80 6a 8e d7 51 a7 fd 46 0d 2b b0 exception.instruction: in eax, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25804df	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1637156 registers.edi: 39349325 registers.eax: 39331209 registers.ebp: 3813938918 registers.edx: 1637352 registers.ebx: 39330517 registers.esi: 5905232 registers.ecx: 39321600 exception.instruction_r: ee 5f b6 15 7e 05 68 6d ba 50 94 8a 2a b4 f1 00 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25812c9	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635336 registers.edi: 0 registers.eax: 0 registers.ebp: 1636032 registers.edx: 2010606285 registers.ebx: 39326084 registers.esi: 0 registers.ecx: 39330517 exception.instruction_r: 6f ab 55 d6 54 b1 9b 9f ba 12 6d 47 da 3b d5 1b exception.instruction: outsd dx, dword ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x25810f7	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1635352 registers.edi: 0 registers.eax: 16 registers.ebp: 39321777 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: cf e9 63 dd ff ff 5e 31 c0 e9 9b f5 ff ff 2d 07 exception.instruction: iretd exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x25822ba	success
1619471159.49525 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaee RtlCaptureContext-0x5e ntdll+0x46acd @ 0x77d76acd 0x25822d5 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 4bf5626cdced13d2a43c38a33389dd2f+0x12a6 @ 0x4012a6 __vbaBoolErrVar+0x2c1e __vbaExceptHandler-0x139 msvbvm60+0xe46a6 @ 0x72a246a6 CreateIExprSrvObj+0x9f2 _CIexp-0x2058 msvbvm60+0xebcb9 @ 0x72a2bcb9 WinSqmSetIfMaxDWORD+0x35 RtlGetThreadErrorMode-0x23b ntdll+0x71ecd @ 0x77da1ecd registers.esp: 1635324 registers.edi: 0 registers.eax: 16 registers.ebp: 1635404 registers.edx: 2010606285 registers.ebx: 39322111 registers.esi: 0 registers.ecx: 187073004 exception.instruction_r: e5 0c 4b fc da 09 43 f3 0b 46 ab c7 ec 3b e2 0b exception.instruction: in eax, 0xc exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2580169	success
1619471159.49525 __exception__	stacktrace: registers.esp: 1633500 registers.edi: 0 registers.eax: 3372816332 registers.ebp: 39329034 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 39322111 exception.instruction_r: fa 53 91 a9 f1 66 d8 c3 85 c6 2e f0 69 e2 13 a2 exception.instruction: cli exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2581cbf	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 个事件)

domain

christs.duckdns.org

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1619471159.18225 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00530000	success
1619471159.18225 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619471159.47925 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02580000	success
1619471164.979125 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e90000	success
1619471164.979125 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619470788.654644 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004160000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619471159.04225 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x003e0000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.776461697387795

section

{'size_of_data': '0x00022000', 'virtual_address': '0x00001000', 'entropy': 7.776461697387795, 'name': '.text', 'virtual_size': '0x00021dfc'}

description

A section with a high entropy has been found

entropy

0.85

description

Overall entropy of this PE file is high

One or more of the buffers contains an embedded PE file (1 个事件)

buffer

Buffer with sha1: 124fbcf494ce87e8ed2c10f6ef787f6eea8d2d2a

Communicates with host for which no DNS query was performed (2 个事件)

host	203.208.41.65
host	203.208.41.98

Creates an Alternate Data Stream (ADS) (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start

Installs itself for autorun at Windows startup (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 called NtSetContextThread to modify thread in remote process 1824
1619471164.47925 NtSetContextThread	thread_handle: 0x00000150 registers.eip: 5582848 registers.esp: 1638384 registers.edi: 0 registers.eax: 4217095 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 1824	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 resumed a thread in remote process 1824
1619471164.62025 NtResumeThread	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1824	success	0	0

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619471164.44825 CreateProcessInternalW	thread_identifier: 2116 thread_handle: 0x00000150 process_identifier: 1824 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4bf5626cdced13d2a43c38a33389dd2f.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4bf5626cdced13d2a43c38a33389dd2f.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000154 inherit_handles: 0	success	1
1619471164.44825 NtGetContextThread	thread_handle: 0x00000150	success	0
1619471164.44825 NtUnmapViewOfSection	process_identifier: 1824 region_size: 4096 process_handle: 0x00000154 base_address: 0x00400000	success	0
1619471164.44825 NtMapViewOfSection	section_handle: 0x000000e0 process_identifier: 1824 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000154 allocation_type: 0 () section_offset: 0 view_size: 1409024 base_address: 0x00400000	success	0
1619471164.47925 NtSetContextThread	thread_handle: 0x00000150 registers.eip: 5582848 registers.esp: 1638384 registers.edi: 0 registers.eax: 4217095 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 1824	success	0
1619471164.62025 NtResumeThread	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1824	success	0

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Siggen2.49044
MicroWorld-eScan	Gen:Heur.Mint.SP.Azorult.1
FireEye	Generic.mg.4bf5626cdced13d2
McAfee	Artemis!4BF5626CDCED
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 00566eaf1 )
Alibaba	TrojanSpy:Win32/AveMaria.1d70840d
K7GW	Trojan ( 00566eaf1 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Mint.SP.Azorult.1
BitDefenderTheta	Gen:NN.ZevbaF.34670.km0@aCJA3tDi
Cyren	W32/Trojan.NRRW-8282
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.EMKM
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Spy.Win32.AveMaria.ddp
BitDefender	Gen:Heur.Mint.SP.Azorult.1
AegisLab	Trojan.Win32.Jaik.4!c
Avast	Win32:DropperX-gen [Drp]
Rising	Trojan.Injector!1.C6AF (CLASSIC)
Ad-Aware	Gen:Heur.Mint.SP.Azorult.1
Sophos	Mal/Generic-S
Comodo	Malware@#3het32m0eaon
F-Secure	Trojan.TR/Injector.szmca
Zillya	Trojan.AveMaria.Win32.517
McAfee-GW-Edition	BehavesLike.Win32.Trojan.cc
Emsisoft	Gen:Heur.Mint.SP.Azorult.1 (B)
Ikarus	Trojan.Win32.Injector
Jiangmin	Heur:Trojan/AntiVM
Webroot	W32.Trojan.Gen
Avira	TR/Injector.szmca
Antiy-AVL	Trojan[Spy]/Win32.AveMaria
Gridinsoft	Trojan.Win32.Keylogger.ba
Microsoft	Trojan:Win32/Occamy.AA
ZoneAlarm	Trojan-Spy.Win32.AveMaria.ddp
GData	Gen:Heur.Mint.SP.Azorult.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kryptik.R336922
VBA32	TrojanSpy.AveMaria
MAX	malware (ai score=81)
Malwarebytes	Spyware.KeyLogger
Tencent	Win32.Trojan-spy.Avemaria.Phqr
Yandex	Trojan.Injector!pVqYP8rUXYU
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_91%
Fortinet	W32/ELYA!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-17 18:03:34

Imports

Library MSVBVM60.DLL:

• 0x401000 __vbaVarSub

• 0x401004 _CIcos

• 0x401008 _adj_fptan

• 0x40100c __vbaVarMove

• 0x401010 __vbaAryMove

• 0x401014 __vbaFreeVar

• 0x401018 __vbaStrVarMove

• 0x40101c __vbaFreeVarList

• 0x401020 _adj_fdiv_m64

• 0x401024

• 0x401028 __vbaStrErrVarCopy

• 0x40102c _adj_fprem1

• 0x401030 __vbaVarCmpNe

• 0x401034 __vbaStrCat

• 0x401038 __vbaHresultCheckObj

• 0x40103c __vbaLenVar

• 0x401040 _adj_fdiv_m32

• 0x401044 __vbaAryDestruct

• 0x401048 __vbaExitProc

• 0x40104c __vbaVarForInit

• 0x401050 __vbaOnError

• 0x401054 __vbaObjSet

• 0x401058

• 0x40105c _adj_fdiv_m16i

• 0x401060 __vbaObjSetAddref

• 0x401064 _adj_fdivr_m16i

• 0x401068 __vbaBoolVarNull

• 0x40106c _CIsin

• 0x401070 __vbaErase

• 0x401074 __vbaVarZero

• 0x401078 __vbaChkstk

• 0x40107c

• 0x401080 EVENT_SINK_AddRef

• 0x401084

• 0x401088 __vbaAryConstruct2

• 0x40108c __vbaVarTstEq

• 0x401090 __vbaCyI4

• 0x401094 __vbaVarLikeVar

• 0x401098 __vbaVarOr

• 0x40109c __vbaRedimPreserve

• 0x4010a0 _adj_fpatan

• 0x4010a4 __vbaRedim

• 0x4010a8 EVENT_SINK_Release

• 0x4010ac _CIsqrt

• 0x4010b0 EVENT_SINK_QueryInterface

• 0x4010b4 __vbaExceptHandler

• 0x4010b8 _adj_fprem

• 0x4010bc _adj_fdivr_m64

• 0x4010c0 __vbaFPException

• 0x4010c4 __vbaUbound

• 0x4010c8 __vbaStrVarVal

• 0x4010cc __vbaVarCat

• 0x4010d0

• 0x4010d4 _CIlog

• 0x4010d8 _adj_fdiv_m32i

• 0x4010dc _adj_fdivr_m32i

• 0x4010e0 __vbaStrCopy

• 0x4010e4 __vbaFreeStrList

• 0x4010e8 _adj_fdivr_m32

• 0x4010ec _adj_fdiv_r

• 0x4010f0

• 0x4010f4 __vbaVarTstNe

• 0x4010f8 __vbaI4Var

• 0x4010fc __vbaAryLock

• 0x401100 __vbaVarDup

• 0x401104 __vbaVarCopy

• 0x401108

• 0x40110c _CIatan

• 0x401110 __vbaCastObj

• 0x401114 __vbaStrMove

• 0x401118 _allmul

• 0x40111c __vbaLenVarB

• 0x401120 _CItan

• 0x401124 __vbaAryUnlock

• 0x401128 __vbaVarForNext

• 0x40112c _CIexp

• 0x401130 __vbaI4ErrVar

• 0x401134 __vbaFreeObj

• 0x401138 __vbaFreeStr

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
christs.duckdns.org	A 192.169.69.25	192.169.69.25
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 172.217.24.14	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.