2.9
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.61
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200417 | 2013.8.14.323 |
| McAfee | PWSZbot-FPU!5318731E2FA1 | 20200417 | 6.0.6.653 |
| Tencent | Trojan.Win32.Bublik.burh | 20200417 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\winupdate.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\winupdate.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\winupdate.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x00007000', 'virtual_size': '0x00002000', 'size_of_data': '0x00001600', 'entropy': 7.242005489938234} | entropy | 7.242005489938234 | description | 发现高熵的节 | |||||||||
| entropy | 0.21568627450980393 | description | 此PE文件的整体熵值较高 | |||||||||||
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 212.32.237.92:443 |
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意
(50 out of 56 个事件)
| ALYac | Gen:Variant.Ulise.43315 |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.43315 |
| AhnLab-V3 | Trojan/Win32.Bublik.C3061774 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Ulise.DA933 |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Gen:Variant.Ulise.43315 |
| BitDefenderTheta | Gen:NN.ZexaF.34106.cqY@aKaQKGki |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | Trojanpws.Zbot.28739 |
| Comodo | TrojWare.Win32.TrojanDownloader.Waski.J@8d1q19 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.e2fa18 |
| Cylance | Unsafe |
| Cyren | W32/S-dfcd8426!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Gen:Variant.Ulise.43315 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-dfcd8426!Eldorado |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.5318731e2fa1811a |
| Fortinet | W32/Waski.A!tr |
| GData | Gen:Variant.Ulise.43315 |
| Ikarus | Trojan-Spy.Zbot |
| Invincea | heuristic |
| Jiangmin | Trojan/Bublik.gsj |
| K7AntiVirus | Trojan ( 0050357f1 ) |
| K7GW | Trojan ( 0050357f1 ) |
| Kaspersky | Trojan.Win32.Bublik.burd |
| MAX | malware (ai score=82) |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | PWSZbot-FPU!5318731E2FA1 |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.nm |
| MicroWorld-eScan | Gen:Variant.Ulise.43315 |
| Microsoft | PWS:Win32/Zbot.MS!MTB |
| NANO-Antivirus | Trojan.Win32.DownLoad3.csplaw |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM02.0.9EC5.Malware.Gen |
| Rising | Spyware.Zbot!8.16B (TFE:dGZlOgUoHouaQCZE3w) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-BBUH |
| Tencent | Trojan.Win32.Bublik.burh |
| Trapmine | malicious.high.ml.score |
| TrendMicro | TROJ_UPATRE.SMBX |
| TrendMicro-HouseCall | TROJ_UPATRE.SMBX |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-01-16 16:59:27
PE Imphash
f636ef8d4985addf9d7e4bf2a5d4d9a6
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00006000 | 0x00002200 | 4.888069432009134 |
| UPX1 | 0x00007000 | 0x00002000 | 0x00001600 | 7.242005489938234 |
| .rsrc | 0x00009000 | 0x00003000 | 0x00002800 | 4.908659007038251 |
| .imports | 0x0000c000 | 0x00001000 | 0x00000600 | 3.9557174128936743 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000090ec | 0x00002428 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000b518 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x0000b530 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.DLL:
• 0x502000 GetStartupInfoA
• 0x502004 MultiByteToWideChar
• 0x502008 lstrlen
• 0x50200c MapViewOfFile
• 0x502010 UnmapViewOfFile
• 0x502014 lstrlenA
• 0x502018 CloseHandle
• 0x50201c GetModuleHandleA
• 0x502020 GetProcAddress
• 0x502024 CreateDirectoryA
Library MSVCRT.dll:
• 0x50202c _exit
• 0x502030 _controlfp
• 0x502034 _XcptFilter
• 0x502038 exit
• 0x50203c __p__acmdln
• 0x502040 __getmainargs
• 0x502044 _initterm
• 0x502048 __setusermatherr
• 0x50204c _adjust_fdiv
• 0x502050 __p__commode
• 0x502054 __p__fmode
• 0x502058 __set_app_type
• 0x50205c _except_handler3
Library USER32.dll:
• 0x502070 ModifyMenuA
• 0x502074 RemoveMenu
• 0x502078 EndDialog
• 0x50207c SetWindowTextA
• 0x502080 SetScrollInfo
• 0x502084 CheckMenuItem
• 0x502088 ReleaseDC
• 0x50208c GetDC
• 0x502090 MoveWindow
• 0x502094 GetClientRect
• 0x502098 EnableMenuItem
• 0x50209c GetMenuItemID
• 0x5020a0 DeferWindowPos
• 0x5020a4 EndDeferWindowPos
• 0x5020a8 TranslateAcceleratorA
• 0x5020ac SetMenuItemInfoA
• 0x5020b0 LoadStringA
• 0x5020b4 InsertMenuItemA
• 0x5020b8 GetPropA
• 0x5020bc RemovePropA
• 0x5020c0 SetPropA
• 0x5020c4 ScrollWindow
• 0x5020c8 CreateCursor
• 0x5020cc DestroyCursor
• 0x5020d0 GetSubMenu
• 0x5020d4 BeginDeferWindowPos
• 0x5020d8 DestroyAcceleratorTable
• 0x5020dc ShowCursor
• 0x5020e0 RegisterWindowMessageA
• 0x5020e4 AppendMenuA
• 0x5020e8 DragDetect
• 0x5020ec GetCapture
• 0x5020f0 CreateDialogIndirectParamA
• 0x5020f4 ReleaseCapture
• 0x5020f8 FindWindowA
• 0x5020fc CreateAcceleratorTableA
• 0x502100 CharUpperA
• 0x502104 DrawTextExA
• 0x502108 DialogBoxParamA
• 0x50210c DrawEdge
L!This program cannot be run in DOS mode.
qHy'q&
qHy%q!
qHy#q&
qHy$q&
qRich'
.imports
uP uP uu
uPuP PU
Pu PuP
PPuP u
w^uuPuP
P PuuP
P PPuu
PP uu uPPu
PP PP u P
[uSAVWAf9
GGEGGEM;r
uPuuP u
FG3@_^]
uuuP P uPu
};7A1P]
-P6t)K
:OCtj8E2qm',L0
;W-tn.)
w%;R0FS
;PCej(\;kNw
j ;Oquvyz6~
>"VUpuY+
*7V6E)
AAj%\aC
u)^nJs
HPw~#C{,
TO'4#v#>diL
vVL|6`
Vq^#@{ry)^cEA/Q
GHDI vU *h
&VafO-+
FJX}+5
,yASlvV6Ay
A>0K'vCJD,QTPF=XKL
X;k]3PtjR
#fdHtqw\#KJda,
jWnV2KC{
Ci/u+!i
,2sH ^
}/2qQZlnW
O vudS
<T!z)^CL
M|N~lf=
ll}T-nq`+6
5JfO{J7:'Ds
\SL76#C
A>0K! C8
})^+]kS
)>5$oK"#C\
fMiyF.|x
6]^B/rn
M- )NqSmi
)m#w&\w
@L8~PP
Puuuuu
IuX[_[+S
u uu uPuP uuP
FUjh(#P
QUREPMQ
<"u>"u
fFu%4 P
^0x[A-F0-9a-f]{1,8}$
0x8732ffda
!K;3`C
!KJ/W*`UE/UP;
C7(&&G:&:
1.+%W8=
4ZPUJ55D
N]8;`8
T([!%Q;YI0
A[G7VM
L'>1GX\[
F' ]+O
GetStartupInfoA
MultiByteToWideChar
lstrlen
MapViewOfFile
UnmapViewOfFile
lstrlenA
CloseHandle
GetModuleHandleA
GetProcAddress
CreateDirectoryA
_controlfp
_XcptFilter
__p__acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
CoInitialize
CoUninitialize
CoCreateInstanceEx
ModifyMenuA
RemoveMenu
EndDialog
SetWindowTextA
SetScrollInfo
CheckMenuItem
ReleaseDC
MoveWindow
GetClientRect
EnableMenuItem
GetMenuItemID
DeferWindowPos
EndDeferWindowPos
TranslateAcceleratorA
SetMenuItemInfoA
LoadStringA
InsertMenuItemA
GetPropA
RemovePropA
SetPropA
ScrollWindow
CreateCursor
DestroyCursor
GetSubMenu
BeginDeferWindowPos
DestroyAcceleratorTable
ShowCursor
RegisterWindowMessageA
AppendMenuA
DragDetect
GetCapture
CreateDialogIndirectParamA
ReleaseCapture
FindWindowA
CreateAcceleratorTableA
CharUpperA
DrawTextExA
DialogBoxParamA
DrawEdge
`.rdata
@.data
"VUpuY+
*7V6E)
'j%\ma unJs2^w
vQ/HPw~'{,
59K v
TO'4#v#>diL
vVcL|6`
Vq^@6{rGcE/Q
&VafO-+
FJX}+5
+4x7;yV
O/ywV6Ay
A>0K''?JD,QTPF=X7KL
c!-6/l
#fdHtqw\KJda
u^#_oI
u+!m|Ci
wd"e+eA
}/2oQZlnW
;n+OOCudS
<T!z TCL
ll}T-nq`+6
5J*{J:'Ds
M}76#;
;B{! |w
O q;h/
fMiyF.Bx
6]^B/rn
la;- gqSn
{m#w&\w
BN6)ly6
!L8:UC
Gz#2|WS2
IuX[_[+S6
]zNfWuiF
S\e<of_
O<0g>"
SUT,`:
Wh$[h`
i'yit'/h(f$p
&jY6%zl^P,i2
:(/^0x[A-t[
-9a-f]{1,8}5
8732f/lCa
!K;3`C
J/W*`UE/UP;
&&G:&:
1.+%W8=
/4ZPUJ55D
4M4M$G
tN]8;`8
T([!%Q;YI0
L'>1GX\[
F' ]+O
)%P(Z(2
yh'&dd2LL&d2L&d22L&&dd2LL&(l2
GetStartupInfoAMultiByteToWideCh
lstrlen
apViewOfFi
(GkwCloseHand
ProcAddress./
ateDictoryA,
con\olfp
X;kcptq1
o{acm^n
g_inng\_
t_fdivFimmea
typece_hr3f
CoIpializem
#i[ku;CExd4
p56,ifyMQu3Reve
EtDPog
(lnck4aYIrmDlisC
,tReab.<=-
DefY:P
TrslAccy
`Cursmc
ub`#kFBeg2/Zw
dh!8ER9&7Mak|agA Yd
D=gMtKeFZ={cldPa,s
c5Uzru
Ed PEL
B`.nrdfaD
@.&C0MI=0'
@(WO Vy
GPGWHU
XPTPSWXaD$j
KKMM""
uuDD--
117722
}}^^mm
@I'6*(******************++""
!!##**********************::v
@DZ5Lar|||
'@WmAYG_
_p\\\n
`s]]]m
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>
KERNEL32.DLL
MSVCRT.dll
ole32.dll
OLEAUT32.dll
USER32.dll
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
CoInitialize
KERNEL32.DLL
GetStartupInfoA
MultiByteToWideChar
lstrlen
MapViewOfFile
UnmapViewOfFile
lstrlenA
CloseHandle
GetModuleHandleA
GetProcAddress
CreateDirectoryA
MSVCRT.dll
_controlfp
_XcptFilter
__p__acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
ole32.dll
CoInitialize
CoUninitialize
CoCreateInstanceEx
OLEAUT32.dll
USER32.dll
ModifyMenuA
RemoveMenu
EndDialog
SetWindowTextA
SetScrollInfo
CheckMenuItem
ReleaseDC
MoveWindow
GetClientRect
EnableMenuItem
GetMenuItemID
DeferWindowPos
EndDeferWindowPos
TranslateAcceleratorA
SetMenuItemInfoA
LoadStringA
InsertMenuItemA
GetPropA
RemovePropA
SetPropA
ScrollWindow
CreateCursor
DestroyCursor
GetSubMenu
BeginDeferWindowPos
DestroyAcceleratorTable
ShowCursor
RegisterWindowMessageA
AppendMenuA
DragDetect
GetCapture
CreateDialogIndirectParamA
ReleaseCapture
FindWindowA
CreateAcceleratorTableA
CharUpperA
DrawTextExA
DialogBoxParamA
DrawEdge
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \
\ f a x . p d f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ i s a r c \
\ w i n u p d a t e . e x e
C : \ Z 5 u u P 8 J D . e x e
C : \ 2 L o e k Z X y . e x e
C : \ F j V g g 3 P 4 . e x e
C : \ j A i 0 y m t m . e x e
C : \ 6 5 1 0 5 0 a 5 d 6 a 1 0 f 5 2 a 3 9 1 4 7 0 c 8 a 8 1 a f f 2 b 6 9 7 7 f 7 6 b 0 4 2 4 0 f b 3 3 2 b 9 a a 1 4 0 4 2 6 2 e a
C : \ b 0 5 d 4 6 a 3 d a 2 9 e 7 6 1 b e b e 1 a 2 a 7 9 0 4 7 7 6 3 a 6 1 f b 8 d a 5 2 b 7 1 9 7 7 a f 7 0 e a b 7 4 a 7 e 6 b a b
C : \ c 7 e d 9 6 6 1 8 1 b 0 c 7 8 3 b f b 4 f c a e a c 9 9 2 f 9 a e 9 c 0 3 0 d 4 d f d 7 e 3 1 b 2 e d 0 c 1 b 1 7 0 c f 6 3 1 e
C : \ 9 f c 8 b f e e 9 b f c 3 a 7 9 e 5 d 6 7 5 7 6 e e d 0 9 5 2 b 9 f e 3 e 1 9 1 f 1 7 8 3 c 9 6 4 5 f 2 2 9 f 3 1 e 4 4 0 9 c 5
C : \ h D _ g S x b y . e x e
C : \ n 0 m v h A B H . e x e
C : \ 7 C Q c p x L 5 . e x e
C : \ U m R I h D O P . e x e
C : \ j q J 6 h b 3 C . e x e
C : \ E J m D S A U 5 . e x e
C : \ d p O u 1 R F s . e x e
C : \ g s 9 I F e T R . e x e
C : \ K m b 0 z A e 9 . e x e
C : \ B T h v l o x E . e x e
C : \ S u w t g j 5 m . e x e
C : \ 6 0 b 3 8 3 3 6 2 1 e f b 1 c f d e 6 2 a b c 4 5 1 b e a e 7 7 b 5 4 c 4 e 0 b 5 d 0 0 1 0 4 2 3 0 2 7 b 2 e 3 9 7 8 4 f e 4 9
C : \ 4 2 b 7 7 d 0 e 9 8 4 0 8 6 c e a 1 1 6 e 2 9 f 9 c e b f 9 e 3 9 4 9 5 3 9 a f 2 d b a e 4 c 7 e d 5 7 5 3 b 3 4 e 1 e 7 1 3 4
C : \ _ p i 6 3 y v z . e x e
C : \ A F y K f v D q . e x e
C : \ 2 A g X M N g n . e x e
C : \ M T B 6 c k p U . e x e
C : \ 0 c E E v z A Z . e x e
C : \ P I c D a k A T . e x e
C : \ L Q i w b 9 e _ . e x e
C : \ f r 8 7 d S p X . e x e
C : \ 4 Y 2 b L i N c . e x e
C : \ k h C E 3 H R 9 . e x e
C : \ 7 Y p T w o C H . e x e
C : \ 3 J M L L c E g . e x e
C : \ 3 c d 5 9 b b 3 b 6 9 2 c f 8 6 d d d d c 1 d 3 9 b 0 f 3 1 4 7 8 4 c 9 2 7 d 6 5 a b f 4 5 f 8 4 e b 9 1 9 0 a 6 2 d a e b c a
C : \ y s d S m H i e . e x e
C : \ A D _ B E y i j . e x e
C : \ Y u i M K V M Q . e x e
C : \ e 9 c 7 a 8 0 7 2 f 0 7 9 e 7 9 4 1 e b f 0 8 6 f 3 7 0 8 0 c 5 e f 7 3 2 4 b 4 a 6 c a e 5 2 7 2 a b 1 f f 7 c 9 1 8 2 3 f e 9
C : \ L D Z w c 7 6 Y . e x e
C : \ x W u T A 9 Y C . e x e
C : \ y I t S I Z I l . e x e
C : \ 2 A A r k Z F k . e x e
C : \ A a M b S G D Q . e x e
C : \ c 1 6 F K J H G . e x e
C : \ e Y s _ E m n 1 . e x e
C : \ 9 l S 5 4 m j t . e x e
C : \ i H w U g C y j . e x e
C : \ d r W g F V v _ . e x e
C : \ z 0 c J V v z o . e x e
C : \ F W V 3 a A m m . e x e
C : \ c R 5 N r l F 0 . e x e
C : \ E 8 C r W e B z . e x e
C : \ b n b 3 O p 4 a . e x e
C : \ f B 0 P 2 m Z U . e x e
C : \ 7 I 6 _ 1 w O 5 . e x e
C : \ K r m t p N p O . e x e
C : \ 8 6 V q t J w 8 . e x e
C : \ W z 0 b _ d p t . e x e
C : \ z R e b A L T I . e x e
C : \ 4 u Q j w c U i . e x e
C : \ 0 j H d T 6 8 R . e x e
C : \ 3 l C 5 a P 0 R . e x e
C : \ k j n u D g T 7 . e x e
C : \ w z t f U q e i . e x e
C : \ 2 8 Q W 9 2 l v . e x e
C : \ w G b p S e f U . e x e
C : \ k a 7 n L 8 d U . e x e
C : \ l G U j B t a j . e x e
C : \ 4 W 3 p i 9 L l . e x e
C : \ w j q B a L y I . e x e
C : \ D V V 1 b E D X . e x e
C : \ k U f Z c N S T . e x e
C : \ c d d 1 c 3 2 5 8 d c 7 3 6 a 3 c e 7 2 5 5 c 8 4 5 4 c 3 9 e 7 b 3 1 3 0 b 2 1 d 3 0 7 7 1 f 0 1 6 e 4 0 7 1 0 7 2 0 3 e e 2 1
C : \ 0 o f 9 b d r F . e x e
C : \ Z D r 4 x H S g . e x e
C : \ u 1 M w 2 A o w . e x e
C : \ 2 c 3 P b Q S w . e x e
C : \ S j z a K z b Q . e x e
C : \ v a 5 7 z v 9 4 . e x e
C : \ G Y C h I 5 H 7 . e x e
C : \ N P C 8 u 2 a F . e x e
C : \ w H 3 u 5 2 E i . e x e
C : \ A u r H m O l y . e x e
C : \ g h _ F U z F V . e x e
C : \ l y m Q y 3 K M . e x e
C : \ n q T H J s g _ . e x e
C : \ O 0 H e r n g x . e x e
C : \ O 4 e F 7 L u r . e x e
C : \ f 4 n Q m t 8 I . e x e
C : \ I 3 h L _ a u N . e x e
C : \ 0 K L X h L V K . e x e
C : \ i B W j 8 B A l . e x e
C : \ S n J d x Y T v . e x e
C : \ v a e k Y Z 3 G . e x e
C : \ L k j 4 A 5 C P . e x e
C : \ T F 0 _ k 0 o 7 . e x e
C : \ q O 2 6 U B U c . e x e
C : \ 2 Y q q 6 r v m . e x e
C : \ U A F x S 6 u k . e x e
C : \ U 5 B G q c u g . e x e
C : \ T y H R b w r g . e x e
C : \ g S V A 6 Z t T . e x e
C : \ 7 p h 7 6 Q x y . e x e
C : \ I k 9 g A Z y V . e x e
C : \ l E w B T a S a . e x e
C : \ X Z F O _ m T j . e x e
C : \ O H b D 9 n S 2 . e x e
C : \ a u r t a k f 3 . e x e
C : \ 2 W X S I 5 A e . e x e
C : \ G 5 Y v q Z Y M . e x e
C : \ y 8 d _ i V Y 8 . e x e
C : \ 0 9 d 9 5 8 2 9 3 5 f 8 5 1 c f 9 9 e a d e 2 0 e 3 9 1 e 2 c 3 8 b 9 a f c b f 2 c e 1 7 1 3 7 d d 9 d c 4 1 f d d 6 b 8 5 1 0
C : \ a 0 d d d 8 9 c 8 8 9 4 f 4 9 c c b 9 6 a 5 5 c 0 6 c 9 6 9 6 6 d e b 8 8 4 5 a 7 4 f b 0 2 c 6 3 a d 1 c d e 9 0 0 c a 0 1 2 b
C : \ 7 7 a 0 1 d 7 a d 7 b 1 4 0 b 2 1 f c 0 a e 6 f 3 b e 0 1 2 3 e 2 3 9 f 7 6 f 2 1 f a e 4 1 f 8 6 b 2 a 4 a 9 c b 1 5 d 3 a c d
C : \ U s e r s \ L i s a \ D e s k t o p \ E d B q A a f i . e x e
C : \ 1 e e 7 3 7 f 1 2 4 6 2 7 5 e 1 d e a e d f 7 8 e 1 3 9 d 6 7 6 c 6 7 4 3 a f 9 9 8 0 3 0 a 5 b 8 b 2 5 3 4 8 8 4 e b 7 6 9 2 d
C : \ U s e r s \ L i s a \ D e s k t o p \ T m g z O I j F . e x e
C : \ 3 D k X Q 8 v B . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ o f m G h N M N . e x e
C : \ 2 e e a d f 6 4 2 3 2 b a 4 d d 1 e 2 6 1 0 9 3 a 4 e 1 e 5 9 6 c 1 b 1 3 1 9 6 b 3 4 b a c 6 6 b e 2 4 3 1 a 0 b 0 f e 8 2 a 4
C : \ d 6 8 9 5 2 d 4 0 b 1 3 2 2 b 6 a d 4 4 a 5 f f 0 d 1 e 6 b 1 4 6 f 8 a 9 4 c 2 e 2 6 8 d 7 7 c b 1 e 4 1 0 4 0 a 9 9 4 f 4 4 0
C : \ U s e r s \ L i s a \ D e s k t o p \ q E o 2 H d I 6 . e x e
C : \ 8 G c 0 8 R j C . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ K r M F K 2 P G . e x e
C : \ 1 P f R J i x s . e x e
C : \ 7 a 9 a a 2 0 f 7 8 a 3 3 c a 5 7 7 b f b 0 5 6 6 3 6 2 a 7 b 2 c b 2 4 5 1 c d 9 5 9 7 4 7 6 5 e 5 5 1 2 5 a 8 8 c 5 c f f 7 a
C : \ 3 5 3 7 3 3 2 8 7 7 e 3 6 5 3 0 4 7 f c 4 0 1 6 8 3 c 2 6 8 e f 2 8 6 c 8 4 a 8 8 0 7 8 3 8 c c 4 c a d 2 e 6 0 6 1 b c 2 0 9 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y d f F r f V n . e x e
C : \ K D n 0 T T Q F . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ w N 5 l f q 7 l . e x e
C : \ N 8 O y V t V 1 . e x e
C : \ f b c 1 7 4 4 a 0 f 4 a 2 e 3 3 9 0 e 9 a 5 b 6 0 f f 6 f 2 f 2 8 f 0 2 8 c b 6 5 4 2 0 f e 2 6 0 a 1 2 7 7 4 9 5 0 d 4 3 f 2 5
C : \ 6 5 f f d 7 1 b 5 3 d d f 4 e 5 f 6 6 a 1 d 2 2 0 8 5 4 b 6 6 5 2 0 9 a 5 6 e 7 b 6 f 1 e f b c b 9 3 0 a c 0 d f f 0 d d b 3 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F W O B I b K W . e x e
C : \ 4 f n d m 4 7 _ . e x e
C : \ U O E 3 A L j 4 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x E U S a H V 2 . e x e
C : \ 7 e 3 d 1 4 3 0 3 c 5 0 a 3 4 c d b 8 c b 6 a 3 2 a 6 7 0 0 a d 2 b 5 9 a 5 4 e 3 5 a f 3 2 9 9 0 b 3 3 3 1 4 2 0 f b 3 4 7 1 4
C : \ 7 f 3 4 f 7 1 5 b 3 c 2 b d 4 0 b d 4 3 b b 1 6 7 a 9 b e a 3 f c 5 3 8 0 2 9 1 0 d c 0 9 1 d d 8 3 4 6 8 d c 4 c 8 3 0 d 7 3 7
C : \ f e 0 4 d 0 e b d 6 7 c 1 0 6 2 6 9 7 4 2 9 a 0 b 4 0 a d 4 c 6 8 5 7 a 8 1 b 0 f 5 a 5 c 3 9 4 d a f d 3 6 c 4 b 2 d f d 0 6 b
C : \ U s e r s \ L i s a \ D e s k t o p \ f f h I A 3 d B . e x e
C : \ v Q L T 6 c V k . e x e
C : \ 7 6 1 d 0 e 2 6 d 0 6 6 2 0 0 a 1 a 4 3 7 1 6 f e 2 9 8 e 2 f 6 b 1 4 d a 3 4 5 2 e 2 c c f d e 3 8 8 5 2 a 4 c a 4 2 6 5 a 8 a
C : \ 1 4 7 d c 0 a e 8 a 1 e 4 2 8 f e 0 3 7 f 5 7 1 6 a 5 3 f 8 c 9 6 3 e 6 4 2 4 9 9 4 e a d e 3 b c c 8 0 1 a d 6 9 3 f 3 0 d 7 7
C : \ C S 3 d 9 C a D . e x e
C : \ d e b 7 c 7 5 0 1 0 8 7 5 a 4 f e c 6 e c 4 8 8 b 3 2 1 8 d f 1 d 7 9 4 0 4 0 b e e 9 3 4 c 2 d e 8 4 a 5 1 a 0 8 0 2 0 4 7 8 d
C : \ 1 9 b 6 e b 6 2 5 8 6 0 2 9 0 d b 3 5 d 8 5 c c f e f a 0 f e 0 c 7 c 5 7 d f 5 e 9 9 5 9 0 0 1 0 4 4 9 6 0 6 3 0 a 5 4 f 5 5 e
C : \ Z h e f W C P x . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ O n J K M i R 3 . e x e
C : \ 8 8 9 5 8 8 4 2 6 3 3 f 9 1 0 4 9 b 2 d 4 d 8 9 9 8 b 6 3 4 5 0 e 3 3 f 2 5 3 1 2 a e 1 9 d 7 2 4 c 1 a 2 1 7 4 1 9 7 2 3 8 9 c
C : \ U s e r s \ L i s a \ D e s k t o p \ S A J v D r B i . e x e
C : \ f b 2 3 c 8 3 a 8 5 0 7 c 3 7 1 f 5 d 8 c 1 1 7 a b f 1 1 c a 8 f 4 b 1 2 5 7 0 d e 8 4 9 5 a 0 9 5 a 2 0 9 1 f 1 9 f 8 c 2 e 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ s q H F L O s h . e x e
C : \ m F h g h L 1 X . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ t E t 3 h S O 0 C J . e x e
C : \ 2 1 4 e e 8 e b 6 8 1 8 b 3 5 6 1 5 6 c 8 e 8 7 f b d f d b 6 8 6 e 6 d a 6 0 8 a 9 6 6 2 0 f c 6 a c 9 0 5 5 1 f f e e d 9 9 3
C : \ 2 f 3 a c 9 a 9 6 9 e 4 a 8 0 5 a 0 9 0 f b 5 f c f 0 1 6 d f 9 7 4 2 b e 9 c 8 6 9 e 9 2 3 a f d b e b 5 d 0 c d e e 2 9 4 5 6
C : \ 6 9 4 9 a 8 6 a 4 b 3 8 d b 1 9 f 3 d e b 6 c a e 2 1 1 e c 4 8 d 3 2 4 8 e b a b 9 3 6 5 8 5 1 5 3 3 4 3 2 6 c 2 e 6 8 1 c 9 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ f d b f 2 e f e 9 5 1 e 9 b f 0 a 7 9 3 6 c f a 0 5 f e 8 6 1 3 a 0 3 2 1 a 7 b 3 1 b 8 7 3 d f 6 c 1 a 5 6 5 7 4 d b f e c 2 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w i n u p d a t e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e b 0 5 0 1 e 7 c d 0 4 c f 0 2 _ w i n u p d a t e . e x e
C : \ 7 0 1 9 c 8 a 5 d 9 2 b b c d 2 e 3 c 6 0 4 3 1 7 4 f c e 9 2 4 2 4 d b d e 8 5 d 1 a c 4 5 7 b f 3 7 b 9 8 e d b 5 6 7 0 0 9 1
C : \ 2 1 6 f 0 d 1 0 1 3 3 e e 7 f 2 9 4 5 d 6 4 3 7 2 a 6 6 1 d 1 3 1 6 f 7 0 f 6 4 5 5 c 5 2 d f 2 3 3 7 9 7 9 4 0 a 0 1 f d 9 f 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ r u 9 A Q v q O . e x e
C : \ 4 1 2 a 6 6 1 3 8 4 6 3 2 8 c f 0 6 6 2 f f c d 0 e 8 0 5 6 b 4 3 a e a b e 1 b 9 8 b c 1 1 2 e 4 f 9 b 0 d 0 6 5 6 c 4 a f 0 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l v n J I v Z T . e x e
C : \ 3 4 9 c 1 4 1 9 f c 9 7 f 9 b 5 f e a e b d 7 1 6 0 b 3 7 a 6 3 1 6 c 1 e e 1 c 6 e d e 7 4 a 0 6 1 2 b 8 4 6 7 f 5 5 d 7 9 d 9
C : \ 5 9 b c 4 9 6 f b d f 7 d 1 7 7 0 5 6 c 3 3 8 3 5 5 f 5 0 8 0 e e 3 4 a 8 a 7 6 1 f a d c f b 1 9 7 d 6 f b 3 2 3 1 6 8 0 6 1 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ C J i R U y j t . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x g 4 V o N 5 1 . e x e
c : \ t a s k \ 8 9 1 A 0 7 3 6 5 F E D 0 F 2 4 0 8 2 4 0 7 3 3 5 A 6 8 B D 4 1 . e x e
C : \ 4 f b 0 0 b 0 f 8 1 b e 7 e a 6 f 0 b 8 7 5 2 e a 2 2 6 2 f 3 8 f a 6 c 2 9 c d 9 b 9 9 b 3 0 2 1 6 c e 4 9 d 1 b 3 1 4 e e b 1
C : \ a 5 b c a 1 5 9 c e 3 7 1 b c e c 0 7 a 7 b 5 6 e b d 6 a 1 7 8 e b c d 2 6 8 6 0 6 6 8 3 1 5 c 3 8 8 2 a a 6 b a 2 4 4 6 9 f 8
C : \ 7 7 3 d 3 2 6 d 1 1 d f 9 a 2 a 4 9 c 0 3 3 4 c 3 f 6 4 8 7 a e 6 b d d 2 e a 4 4 3 4 1 2 2 c 2 a 0 2 f 4 0 3 9 3 3 5 9 0 1 5 1
C : \ 5 b 6 f c 6 7 d 9 d 6 c 8 5 2 6 a d 1 5 8 0 b e 7 d 9 1 6 3 2 3 0 7 2 d 5 d c 5 f 3 2 b 5 6 b 7 8 e 9 a e e f 0 9 c 9 0 a 7 6 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w i n u p d a t e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 6 e 3 b 3 0 b c 9 4 9 d 6 5 f b 3 2 c 8 6 f f 1 4 5 0 4 3 1 c 5 1 7 c 4 a b 6 3 e 9 6 c e 7 b d 8 d 5 1 7 4 2 8 e f 1 5 c 7 6 . e x e
Process Tree
-
00346b34cf8d32c8ac77ff3ab3aa4c55fd4ad972e4e720c0450d13fc97e5e28f.exe (2600)
"C:\Users\Administrator\AppData\Local\Temp\00346b34cf8d32c8ac77ff3ab3aa4c55fd4ad972e4e720c0450d13fc97e5e28f.exe"
- winupdate.exe (1332) "C:\Users\ADMINI~1\AppData\Local\Temp\winupdate.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 212.32.237.92 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| artschoolwiki.com | ||
| homevisitor.co.uk | A 212.32.237.92 | 23.82.12.29 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49165 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49166 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49168 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49169 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49170 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49172 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49173 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49174 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49177 | 212.32.237.92 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49179 | 212.32.237.92 homevisitor.co.uk | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 4502b089035dcf00_winupdate.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\winupdate.exe |
| Size | 38.3KB |
| Processes | 2600 (00346b34cf8d32c8ac77ff3ab3aa4c55fd4ad972e4e720c0450d13fc97e5e28f.exe) |
| Type | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed |
| MD5 | 2d1f1e3b4168332d097bacd43390f336 |
| SHA1 | 21f9cf0a479e54f9a8c2d66ee98cd61c226f1966 |
| SHA256 | 4502b089035dcf00b760ea98452437feafa6d099a6b5394e86d29af99a90cf1f |
| CRC32 | C889BB85 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.