6.8
高危

0e28fb20d3f34f9f095e7d758d18a91d9ee164f782f48b084ede46b9ef0d560a

4c7146c3a346dc1ed483b0235853c36f.exe

分析耗时

79s

最近分析

文件大小

327.0KB
静态报毒 动态报毒 100% AI SCORE=100 BANKERX CLOUD CONFIDENCE ELDORADO EMOTET ESUM GENCIRC GENERICKD GENETIC GENKRYPTIK HFZC HGIASOCA HIGH CONFIDENCE HUENPD KCLOUD KRYPTIK MALWARE@#6GM0K3SAP9W R + TROJ RKGP1R02BS0 SCORE SMD4 SUSGEN TROJANBANKER TRUJ UNSAFE UQ0@AI@0BKCI VJZVN VOBFUSAGENTHAA ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FSD!4C7146C3A346 20210301 6.0.6.653
Alibaba Trojan:Win32/Emotet.c43139d8 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:BankerX-gen [Trj] 20210301 21.1.5827.0
Tencent Malware.Win32.Gencirc.10cdfdc6 20210301 1.0.0.1
Kingsoft Win32.Troj.Banker.(kcloud) 20210301 2017.9.26.565
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1620946625.542812
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (3 个事件)
Time & API Arguments Status Return Repeated
1620946617.057812
CryptGenKey
crypto_handle: 0x02c82a38
algorithm_identifier: 0x0000660e ()
provider_handle: 0x02c80438
flags: 1
key: f¢PäÁ_ÎN »‚G„Ofd
success 1 0
1620946625.573812
CryptExportKey
crypto_handle: 0x02c82a38
crypto_export_handle: 0x02c809f8
buffer: f¤Žž¶Yãmµyÿ\ðÀ» 1ÌԒÁßrV ¤e'–½“Ñg%êzûp҇ÖíYÀe츉ŽÀ´DÒ«‹Þ +­[¾ð VŒŠš…é¶T?ÚgXN°ë®,ޝ‘ÕDO¢á8=)R
blob_type: 1
flags: 64
success 1 0
1620946661.542812
CryptExportKey
crypto_handle: 0x02c82a38
crypto_export_handle: 0x02c809f8
buffer: f¤Q9o5ªjǾæõ«½¶ùõ`ªŒ¦7}ï©X…›B»)çÁ}™„’¨²PùêÆÞ"xÍä†ä|ÌWu(ˆ5wÅXÔR¢š°ôâ÷c¨…,;†5 dªïv‹MÃNïT"
blob_type: 1
flags: 64
success 1 0
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name None
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620946616.370812
NtAllocateVirtualMemory
process_identifier: 732
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00640000
success 0 0
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1620946616.385812
NtProtectVirtualMemory
process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 28672
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x00871000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620946626.307812
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)
entropy 6.997827945825134 section {'size_of_data': '0x00010000', 'virtual_address': '0x00049000', 'entropy': 6.997827945825134, 'name': '.rsrc', 'virtual_size': '0x0000ffd0'} description A section with a high entropy has been found
Expresses interest in specific running processes (1 个事件)
process 4c7146c3a346dc1ed483b0235853c36f.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1620946625.838812
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (4 个事件)
host 172.217.24.14
host 185.215.227.107
host 51.38.124.206
host 52.218.109.228
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1620946628.885812
RegSetValueExA
key_handle: 0x000003b4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620946628.885812
RegSetValueExA
key_handle: 0x000003b4
value: 0I¤ç«H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620946628.885812
RegSetValueExA
key_handle: 0x000003b4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620946628.885812
RegSetValueExW
key_handle: 0x000003b4
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620946628.885812
RegSetValueExA
key_handle: 0x000003cc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620946628.885812
RegSetValueExA
key_handle: 0x000003cc
value: 0I¤ç«H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620946628.885812
RegSetValueExA
key_handle: 0x000003cc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620946628.901812
RegSetValueExW
key_handle: 0x000003b0
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.VobfusAgentHAA.Trojan
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34520348
McAfee Emotet-FSD!4C7146C3A346
Cylance Unsafe
Zillya Trojan.Emotet.Win32.28381
Sangfor Trojan.Win32.Emotet.ARJ
K7AntiVirus Trojan ( 0056de091 )
Alibaba Trojan:Win32/Emotet.c43139d8
K7GW Trojan ( 0056de091 )
Cybereason malicious.3a346d
Arcabit Trojan.Generic.D20EBD1C
Cyren W32/Kryptik.BWJ.gen!Eldorado
Symantec Trojan.Emotet
APEX Malicious
Avast Win32:BankerX-gen [Trj]
ClamAV Win.Malware.Emotet-9753021-0
Kaspersky HEUR:Trojan-Banker.Win32.Emotet.gen
BitDefender Trojan.GenericKD.34520348
NANO-Antivirus Trojan.Win32.Emotet.huenpd
Paloalto generic.ml
AegisLab Trojan.Win32.Emotet.truJ
Tencent Malware.Win32.Gencirc.10cdfdc6
Ad-Aware Trojan.GenericKD.34520348
Sophos Mal/Generic-R + Troj/Emotet-CLZ
Comodo Malware@#6gm0k3sap9w
F-Secure Trojan.TR/AD.Emotet.vjzvn
DrWeb Trojan.Emotet.1016
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.EMOTET.SMD4.hp
McAfee-GW-Edition BehavesLike.Win32.Emotet.fh
FireEye Generic.mg.4c7146c3a346dc1e
Emsisoft Trojan.Emotet (A)
Ikarus Trojan-Banker.Emotet
Jiangmin Trojan.Banker.Emotet.oih
Avira TR/AD.Emotet.vjzvn
MAX malware (ai score=100)
Antiy-AVL Trojan[Banker]/Win32.Emotet
Kingsoft Win32.Troj.Banker.(kcloud)
Gridinsoft Trojan.Win32.Emotet.oa
Microsoft Trojan:Win32/Emotet.ARJ!MTB
ViRobot Trojan.Win32.Emotet.334848.A
ZoneAlarm HEUR:Trojan-Banker.Win32.Emotet.gen
GData Trojan.GenericKD.34520348
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.Generic.C4192704
BitDefenderTheta Gen:NN.ZexaF.34590.uq0@ai@0Bkci
ALYac Trojan.Agent.Emotet
TACHYON Banker/W32.Emotet.334848
VBA32 TrojanBanker.Emotet
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 51.38.124.206:80
dead_host 185.215.227.107:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-09-05 01:43:15

Imports

Library KERNEL32.dll:
0x4340bc GetCommandLineA
0x4340c0 GetStartupInfoA
0x4340c4 HeapFree
0x4340c8 Sleep
0x4340cc RaiseException
0x4340d0 VirtualProtect
0x4340d4 VirtualAlloc
0x4340d8 GetSystemInfo
0x4340dc VirtualQuery
0x4340e0 HeapReAlloc
0x4340e4 HeapSize
0x4340e8 GetACP
0x4340ec IsValidCodePage
0x4340f0 LCMapStringA
0x4340f4 LCMapStringW
0x4340f8 TerminateProcess
0x434104 IsDebuggerPresent
0x434108 VirtualFree
0x43410c HeapCreate
0x434110 GetStdHandle
0x434114 HeapAlloc
0x434124 SetHandleCount
0x434128 GetFileType
0x434138 GetStringTypeA
0x43413c GetStringTypeW
0x434144 GetConsoleCP
0x434148 GetConsoleMode
0x43414c SetStdHandle
0x434150 WriteConsoleA
0x434154 GetConsoleOutputCP
0x434158 WriteConsoleW
0x43415c CompareStringW
0x434164 RtlUnwind
0x434168 GetTickCount
0x43416c GetFileTime
0x434170 GetFileSizeEx
0x434174 GetFileAttributesA
0x43417c SetErrorMode
0x434184 GetOEMCP
0x434188 GetCPInfo
0x43418c GetModuleHandleW
0x434190 CreateFileA
0x434194 GetFullPathNameA
0x43419c FindFirstFileA
0x4341a0 FindClose
0x4341a4 GetCurrentProcess
0x4341a8 DuplicateHandle
0x4341ac GetFileSize
0x4341b0 SetEndOfFile
0x4341b4 UnlockFile
0x4341b8 LockFile
0x4341bc FlushFileBuffers
0x4341c0 SetFilePointer
0x4341c4 WriteFile
0x4341c8 ReadFile
0x4341cc GetThreadLocale
0x4341d4 TlsFree
0x4341dc LocalReAlloc
0x4341e0 TlsSetValue
0x4341e4 TlsAlloc
0x4341ec GlobalHandle
0x4341f0 GlobalReAlloc
0x4341f8 TlsGetValue
0x434200 LocalAlloc
0x434204 GlobalFlags
0x434208 GlobalGetAtomNameA
0x43420c GlobalFindAtomA
0x434210 lstrcmpW
0x434214 GetVersionExA
0x43421c GetModuleFileNameW
0x434220 FormatMessageA
0x434224 LocalFree
0x434228 MultiByteToWideChar
0x43422c MulDiv
0x434234 GlobalUnlock
0x434238 GlobalFree
0x43423c FreeResource
0x434240 GetCurrentProcessId
0x434244 GetLastError
0x434248 SetLastError
0x43424c GlobalAddAtomA
0x434250 CloseHandle
0x434254 GlobalDeleteAtom
0x434258 GetCurrentThread
0x43425c GetCurrentThreadId
0x434268 GetModuleFileNameA
0x43426c GetLocaleInfoA
0x434270 LoadLibraryA
0x434274 CompareStringA
0x434278 InterlockedExchange
0x43427c GlobalLock
0x434280 lstrcmpA
0x434284 GlobalAlloc
0x434288 FreeLibrary
0x43428c GetModuleHandleA
0x434290 WideCharToMultiByte
0x434294 lstrlenA
0x434298 LoadLibraryW
0x43429c GetProcAddress
0x4342a0 ExitProcess
0x4342a4 FindResourceA
0x4342a8 LoadResource
0x4342ac LockResource
0x4342b0 SizeofResource
0x4342b8 GetVersion
Library USER32.dll:
0x434310 PostThreadMessageA
0x434314 IsRectEmpty
0x43431c CharNextA
0x434320 CharUpperA
0x434324 GetSysColorBrush
0x434328 ReleaseCapture
0x43432c LoadCursorA
0x434330 SetCapture
0x434334 EndPaint
0x434338 BeginPaint
0x43433c GetWindowDC
0x434340 ReleaseDC
0x434344 GetDC
0x434348 ClientToScreen
0x43434c GrayStringA
0x434350 DrawTextExA
0x434354 DrawTextA
0x434358 TabbedTextOutA
0x43435c ShowWindow
0x434360 MoveWindow
0x434364 SetWindowTextA
0x434368 IsDialogMessageA
0x434370 SendDlgItemMessageA
0x434374 WinHelpA
0x434378 IsChild
0x43437c GetClassLongA
0x434380 GetClassNameA
0x434384 SetPropA
0x434388 GetPropA
0x43438c RemovePropA
0x434390 SetFocus
0x434398 GetWindowTextA
0x43439c GetTopWindow
0x4343a0 GetMessageTime
0x4343a4 GetMessagePos
0x4343a8 MapWindowPoints
0x4343ac SetMenu
0x4343b0 SetForegroundWindow
0x4343b4 UpdateWindow
0x4343b8 CreateWindowExA
0x4343bc GetClassInfoExA
0x4343c0 GetClassInfoA
0x4343c4 RegisterClassA
0x4343c8 AdjustWindowRectEx
0x4343cc EqualRect
0x4343d0 PtInRect
0x4343d4 GetDlgCtrlID
0x4343d8 DefWindowProcA
0x4343dc CallWindowProcA
0x4343e0 GetMenu
0x4343e4 SetWindowLongA
0x4343e8 OffsetRect
0x4343ec IntersectRect
0x4343f0 GetWindowPlacement
0x4343f4 GetWindowRect
0x4343f8 GetSysColor
0x434400 DestroyMenu
0x434404 CopyRect
0x434408 DrawIcon
0x43440c AppendMenuA
0x434410 SendMessageA
0x434414 GetSystemMenu
0x434418 UnhookWindowsHookEx
0x43441c GetMenuItemID
0x434420 GetMenuItemCount
0x434424 GetSubMenu
0x434428 GetWindow
0x434430 MapDialogRect
0x434434 SetWindowPos
0x434438 GetDesktopWindow
0x43443c SetActiveWindow
0x434444 DestroyWindow
0x434448 UnregisterClassA
0x43444c MessageBeep
0x434450 GetNextDlgGroupItem
0x434454 InvalidateRgn
0x434458 InvalidateRect
0x43445c GetForegroundWindow
0x434460 SetRect
0x434464 IsIconic
0x434468 GetClientRect
0x43446c EnableWindow
0x434470 LoadIconA
0x434474 GetSystemMetrics
0x434478 PostQuitMessage
0x43447c PostMessageA
0x434480 CheckMenuItem
0x434484 EnableMenuItem
0x434488 GetMenuState
0x43448c ModifyMenuA
0x434490 GetParent
0x434494 GetFocus
0x434498 LoadBitmapA
0x4344a0 SetMenuItemBitmaps
0x4344a4 ValidateRect
0x4344a8 GetCursorPos
0x4344ac PeekMessageA
0x4344b0 GetKeyState
0x4344b4 IsWindowVisible
0x4344b8 GetActiveWindow
0x4344bc DispatchMessageA
0x4344c0 TranslateMessage
0x4344c4 GetMessageA
0x4344c8 CallNextHookEx
0x4344cc SetWindowsHookExA
0x4344d0 SetCursor
0x4344d4 MessageBoxA
0x4344d8 IsWindowEnabled
0x4344dc GetLastActivePopup
0x4344e0 GetWindowLongA
0x4344e8 EndDialog
0x4344ec GetNextDlgTabItem
0x4344f0 GetDlgItem
0x4344f4 IsWindow
0x4344f8 GetCapture
Library GDI32.dll:
0x434038 ExtSelectClipRgn
0x43403c DeleteDC
0x434040 GetStockObject
0x434044 GetBkColor
0x434048 GetTextColor
0x434050 GetRgnBox
0x434054 GetMapMode
0x434058 ScaleWindowExtEx
0x43405c SetWindowExtEx
0x434060 ScaleViewportExtEx
0x434064 SetViewportExtEx
0x434068 OffsetViewportOrgEx
0x43406c SetViewportOrgEx
0x434070 SelectObject
0x434074 Escape
0x434078 TextOutA
0x43407c RectVisible
0x434080 PtVisible
0x434084 CreateBitmap
0x434088 GetWindowExtEx
0x43408c GetViewportExtEx
0x434090 DeleteObject
0x434094 SetMapMode
0x434098 RestoreDC
0x43409c SaveDC
0x4340a0 SetBkColor
0x4340a4 SetTextColor
0x4340a8 GetClipBox
0x4340ac ExtTextOutA
0x4340b0 GetObjectA
0x4340b4 GetDeviceCaps
Library COMDLG32.dll:
0x434030 GetFileTitleA
Library WINSPOOL.DRV:
0x434500 DocumentPropertiesA
0x434504 ClosePrinter
0x434508 OpenPrinterA
Library ADVAPI32.dll:
0x434000 RegEnumKeyA
0x434004 RegQueryValueA
0x434008 RegOpenKeyA
0x43400c RegCloseKey
0x434010 RegDeleteKeyA
0x434014 RegOpenKeyExA
0x434018 RegSetValueExA
0x43401c RegCreateKeyExA
0x434020 RegQueryValueExA
Library COMCTL32.dll:
0x434028
Library SHLWAPI.dll:
0x4342f8 PathFindFileNameA
0x4342fc PathStripToRootA
0x434300 PathIsUNCA
0x434304 PathFindExtensionA
Library oledlg.dll:
0x434550
Library ole32.dll:
0x434510 CoRevokeClassObject
0x434514 OleInitialize
0x43451c OleUninitialize
0x434530 CoTaskMemAlloc
0x434534 CoTaskMemFree
0x434538 CLSIDFromString
0x43453c CLSIDFromProgID
0x434540 OleFlushClipboard
0x434548 CoGetClassObject
Library OLEAUT32.dll:
0x4342c0 SysAllocStringLen
0x4342c4 VariantClear
0x4342c8 VariantChangeType
0x4342cc VariantInit
0x4342d0 SysStringLen
0x4342e4 SafeArrayDestroy
0x4342e8 SysAllocString
0x4342ec VariantCopy
0x4342f0 SysFreeString

Exports

Ordinal Address Name
1 0x4015f0 DDltyusifghffDDCseRFFF

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
52.218.109.228 80 192.168.56.101 49182

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 49714 239.255.255.250 3702
192.168.56.101 53658 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.