3.1
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.52
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Crypt-QFY [Trj] | 20200102 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200102 | 2013.8.14.323 |
| McAfee | Downloader-FWT!55F06A05701F | 20200101 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07832 | 20200102 | 1.0.0.1 |
静态指标
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545342.734875 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545343.28125 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | .code |
| section | .data4 |
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压）
(6 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
一个或多个缓冲区包含嵌入的PE文件
(1 个事件)
| buffer | Buffer with sha1: e2db0558de4e481ac8060a0a953d2eaf875af3cc |
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 23.82.12.30:443 |
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.GenericKD.1414386 |
| APEX | Malicious |
| AVG | Win32:Crypt-QFY [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1414386 |
| AhnLab-V3 | Trojan/Win32.Zbot.R88085 |
| Antiy-AVL | Trojan/Win32.Agent |
| Arcabit | Trojan.Generic.D1594F2 |
| Avast | Win32:Crypt-QFY [Trj] |
| Avira | TR/Dldr.Small.DMKB |
| BitDefender | Trojan.GenericKD.1414386 |
| BitDefenderTheta | AI:Packer.21814C3E1E |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A5 |
| CMC | Trojan.Win32.Agent!O |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Waski.AOP@6axqm9 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.5701f5 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.YEEY-2842 |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.GenericKD.1414386 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.GOT |
| F-Secure | Trojan.TR/Dldr.Small.DMKB |
| FireEye | Generic.mg.55f06a05701f56ea |
| Fortinet | W32/Agent.AEUD!tr |
| GData | Trojan.GenericKD.1414386 |
| Ikarus | Trojan-Spy.Win32.Zbot |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.azscg |
| K7AntiVirus | Trojan-Downloader ( 0040f6bd1 ) |
| K7GW | Trojan-Downloader ( 0040f6bd1 ) |
| Kaspersky | Trojan.Win32.Bublik.ekpl |
| MAX | malware (ai score=82) |
| Malwarebytes | Trojan.Zbot |
| McAfee | Downloader-FWT!55F06A05701F |
| McAfee-GW-Edition | BehavesLike.Win32.Cutwail.nt |
| MicroWorld-eScan | Trojan.GenericKD.1414386 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.cqmnce |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM19.1.4A8F.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-AEWH |
| Symantec | Trojan.Zbot |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2004-09-06 12:16:19
PE Imphash
6bfa456b0f1ed5d6434e09b0fa57d0ca
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000878 | 0x00000a00 | 6.190137927232866 |
| .code | 0x00002000 | 0x000003eb | 0x00000400 | 6.78366790149546 |
| .data | 0x00003000 | 0x000000d9 | 0x00000200 | 2.0751483715138876 |
| .data4 | 0x00004000 | 0x0000183c | 0x00001a00 | 3.4411211299118594 |
| .idata | 0x00006000 | 0x00000540 | 0x00000600 | 3.9124491280021756 |
| .rsrc | 0x00007000 | 0x00001bc8 | 0x00001c00 | 5.692218104312493 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00007130 | 0x00000ea8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00007fd8 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00007fec | 0x00000328 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x00008314 | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library user32.dll:
• 0x40619c GetMessageA
• 0x4061a0 DefWindowProcA
• 0x4061a4 PostQuitMessage
• 0x4061a8 GetDoubleClickTime
• 0x4061ac GetQueueStatus
• 0x4061b0 LoadIconA
• 0x4061b4 RegisterClassA
Library GDI32.dll:
• 0x4062f4 IntersectClipRect
• 0x4062f8 ExcludeClipRect
• 0x4062fc UpdateColors
• 0x406300 GetTextExtentPoint32A
• 0x406304 CreateCompatibleDC
• 0x406308 DeleteObject
• 0x40630c TextOutA
• 0x406310 SetBkColor
• 0x406314 SetTextColor
• 0x406318 Rectangle
• 0x40631c CreateSolidBrush
• 0x406320 GetStockObject
• 0x406324 CreateFontIndirectA
• 0x406328 GetTextExtentExPointA
• 0x40632c GetTextMetricsA
• 0x406330 CreateFontA
Library ADVAPI32.dll:
• 0x40624c RegQueryValueExA
• 0x406250 RegOpenKeyA
• 0x406254 GetUserNameA
• 0x406258 CopySid
• 0x40625c GetLengthSid
Library IMM32.dll:
• 0x40646c ImmGetCompositionStringW
• 0x406470 ImmSetCompositionFontA
• 0x406474 ImmGetContext
• 0x406478 ImmSetCompositionWindow
Library kernel32.dll:
• 0x4060f4 GetModuleHandleA
• 0x4060f8 GetProcAddress
• 0x4060fc HeapCreate
• 0x406100 HeapAlloc
• 0x406104 GetACP
• 0x406108 ExitProcess
• 0x40610c FreeLibrary
L!This program cannot be run in DOS mode.
`.data
.data4
@.idata
O/3O/7
<[IJRQQQ[
`^ab#P
bGqE[Pd`M
CreateWindowExA
LoadLibraryExA
LoadCursorA
TranslateMessage
user32.dll
mciSendStringA
set waveaudio door open
Winmm.dll
user32.dll
GDI32.dll
Msacm32.dll
ADVAPI32.dll
IMM32.dll
kernel32.dll
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
GetACP
ExitProcess
FreeLibrary
GetMessageA
DefWindowProcA
PostQuitMessage
GetDoubleClickTime
GetQueueStatus
LoadIconA
RegisterClassA
RegQueryValueExA
RegOpenKeyA
GetUserNameA
CopySid
GetLengthSid
IntersectClipRect
ExcludeClipRect
UpdateColors
GetTextExtentPoint32A
CreateCompatibleDC
DeleteObject
TextOutA
SetBkColor
SetTextColor
Rectangle
CreateSolidBrush
GetStockObject
CreateFontIndirectA
GetTextExtentExPointA
GetTextMetricsA
CreateFontA
ImmGetCompositionStringW
ImmSetCompositionFontA
ImmGetContext
ImmSetCompositionWindow
acmMetrics
acmStreamOpen
#######
###>LLJ
47>4,##########
#########
#####,EZM
,######,
#####2
######2#
PD]}JC44KxXMt7
#######2#J}J{F|
sDDPJ4
########2,rR
2U{DY]]FsX####
########2#CzzC2#6RCKj#
2222222222,R R
##,,,,######
2222222222#C%Uv,22#2222######
22222222222,
#2#############
22222222222<KK#2#2###########
22222222222<,222##2#########
22222222<+d
,42222##2#######
224<i,42222222#######
i<22222222#######
4,ii42222222222####
$4,K<22222222222##
$$$$$$$$$$<<4222222222#
$$$$$$$$$$,
dk<4222222222
$di$++$$2222222
888888888&8&&
9=======))))))))))))))))pp)))<$$$$$$
9:::::::3>333W>>>33W>33333333>
******
m-------M7-7Mo77on7-------E
*T11II11
:(((((-MtxJJEn
7-(-((-EN&1.;;;G1
L((((((Z}lX
#S+DkX((((((EN1G;?????
-555555ZxC
DSlZF5555F5XN.;?VVV
(555555Z}2+4DPKDP#4F05550qN
5000000u~4YK~4YSKrRK~0000060
6u4wjjC0+ Dzbg;T
0%%%%%%a
2`%%%%%ubg^T
%%%%%%%%`ad%Had%%H@%%%%%%`bg^T#
%%%%%%%%%BB%%%BB%HH%BB%HHHHH%Hbg^
H///////'''''''''''''''''''''/
.................f.*1
&&&&$$$&
$$$$$$$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
@ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
H P C o r p
F i l e D e s c r s i p t i o n
c a l c . e x e
F i l e V e r s i o n
6 . 3 . 3 . 1
I n t e r n a l N a m e
c a l c . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 1 1
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
c a l c . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
c a l c . e x e
P r o d u c t V e r s i o n
6 . 3 . 3 . 1
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
C : \ D o c u m e n t s a n d S e t t i n g s \ j b a l d w i n . C A R P E N T E R B U S \ L o c a l S e t t i n g s \ T e m p o r a r y I n t e r n e t F i l e s \ C o n t e n t . O u t l o o k \ J B I L S 8 Q M \ F a x _ 2 1 8 _ 6 7 7 - 6 8 3 - 6 3 3 9 _ 0 0 1 \ F a x _ 2 1 8 _ 1 1 2 1 2 0 1 3 _ 0 0 1 . e x e
C : \ 6 7 K c u r D m . e x e
C : \ 2 a _ O v w H m . e x e
C : \ w q 1 l P q M D . e x e
C : \ u 7 e s x T M T . e x e
C : \ z 3 S C t W e D . e x e
C : \ L C 6 N O T 8 C . e x e
C : \ u S Z E t G A p . e x e
C : \ 1 1 6 3 f d 1 6 f b f 5 c 9 4 6 1 b 1 7 7 8 4 e 2 c b d 3 1 3 c a 2 6 1 6 7 4 7 7 2 2 7 f f e c 4 6 1 9 a 3 2 b 7 5 e 9 e e f f
C : \ 0 8 4 4 2 2 0 b c 1 c e 5 7 9 0 3 b 2 4 b 0 a d d b f b 2 d f 9 a 4 f 0 8 8 3 d d 1 e d 3 6 2 2 1 3 2 7 a 7 e f 2 b 6 6 d 8 1 4
C : \ d d 7 5 5 e 5 f c 2 a e 0 c e a 6 4 2 6 1 b 1 9 5 2 b 3 9 e 2 6 6 4 b 8 4 8 1 8 4 5 f 1 5 1 1 0 b 5 8 e 4 e d 9 b e d 8 b 3 8 b
C : \ 6 4 d 3 9 b d b 8 9 b 4 c 5 4 e a 2 5 d c 6 a 9 f d 4 0 7 b e d b 4 f 8 6 a 9 f 8 9 9 e 7 8 2 6 7 d 4 0 d a e d 6 5 0 f e 6 c d
C : \ w 1 p t z B w 9 . e x e
C : \ G o R r V f e f . e x e
C : \ 2 6 d 7 c 1 6 c 4 9 b c 9 9 5 e 8 2 4 5 d c 4 d f d 9 8 b 9 1 4 9 f 2 f e 4 f c 1 3 1 3 e 4 8 4 f 7 e 6 1 7 9 7 7 6 f c 7 7 a e
C : \ 1 7 1 f 7 0 8 e 7 6 9 f a d 9 9 e 2 1 5 6 8 2 d f b 5 6 0 5 b e 1 c 0 e 2 4 a a 4 0 1 a 8 7 8 6 6 2 d f c 9 0 b 7 9 3 4 0 b 7 9
C : \ f P 6 P Z C T L . e x e
C : \ i u x Y 6 D 8 L . e x e
C : \ j f 2 s g j b 8 . e x e
C : \ R T s 2 _ B 6 D . e x e
C : \ b 4 3 3 8 2 3 0 e f 9 1 6 1 3 e 9 0 5 8 e 7 0 0 b 9 8 3 c a a d 1 1 b 8 c 6 8 d 5 e b f 3 2 9 4 c 3 5 a d 4 8 6 2 3 7 3 7 0 f a
C : \ 2 L 3 0 U 1 b n . e x e
C : \ j e 4 c O c e g . e x e
C : \ h 2 2 F W y G h . e x e
C : \ w t N c f R V p . e x e
C : \ l v _ O z E x 4 . e x e
C : \ h _ M m 9 D Q n . e x e
C : \ b I a e D N 5 b . e x e
C : \ 6 n F L C W Z 0 . e x e
C : \ o m R G a T a I . e x e
C : \ y B L F z h j q . e x e
C : \ B 5 y o E O V k . e x e
C : \ 3 Z 9 W V S 5 5 . e x e
C : \ 2 L L P I d T 1 . e x e
C : \ m n G E s v Z C . e x e
C : \ u d j H 0 t V z . e x e
C : \ a x a 1 E T D N . e x e
C : \ B r O b D v G v . e x e
C : \ I e m K 0 v p 8 . e x e
C : \ 9 I n R t H h g . e x e
C : \ A 0 k d Y i O r . e x e
C : \ U C H e J k s 8 . e x e
C : \ g e Q p 2 A W W . e x e
C : \ W 9 k i R I 6 j . e x e
C : \ A Z y s a U G X . e x e
C : \ 2 L 5 p e r e 9 . e x e
C : \ X I 2 4 1 I A u . e x e
C : \ 5 X H i z g U E . e x e
C : \ N h L f y V 4 6 . e x e
C : \ m p f b A q l I . e x e
C : \ 1 G I 3 b 6 R P . e x e
C : \ x m B F W j f p . e x e
C : \ D s A H q L R s . e x e
C : \ i p 6 C z 8 3 5 . e x e
C : \ h A s I M E F r . e x e
C : \ 3 u k y F D P U . e x e
C : \ 0 R g 7 B k g U . e x e
C : \ z B 7 2 k 1 i H . e x e
C : \ c s S q u E o C . e x e
C : \ f e z o i W k 4 . e x e
C : \ A 0 G b G E j B . e x e
C : \ N k h D 2 2 n W . e x e
C : \ d I y D i c F 5 . e x e
C : \ Y Z Y I 5 I f T . e x e
C : \ f B r 8 1 8 7 E . e x e
C : \ 2 w F T N m V l . e x e
C : \ o h 3 q 8 D 3 8 . e x e
C : \ o X o B U t P W . e x e
C : \ y H J w s V s s . e x e
C : \ t P 1 p 0 4 z M . e x e
C : \ o c 2 2 g a M G . e x e
C : \ 8 m W N F c B E . e x e
C : \ z e 4 D B R 5 G . e x e
C : \ C z V D J D P x . e x e
C : \ 4 D n u 8 4 9 S . e x e
C : \ o w E g 8 M f Z . e x e
C : \ s v p E g u n v . e x e
C : \ O 7 A _ s r _ g . e x e
C : \ 9 O d t u O r f . e x e
C : \ V 9 b B j S M j . e x e
C : \ P _ D F I W O z . e x e
C : \ 6 Y Q k i x 7 9 . e x e
C : \ t I L U 8 7 C w . e x e
C : \ _ T x K d V t n . e x e
C : \ x h M 5 L J L m . e x e
C : \ A o t 8 B Y P q . e x e
C : \ s L D 1 k Z o d . e x e
C : \ P u J q a J k b . e x e
C : \ t J I v F D k l . e x e
C : \ 0 Q i l r S n E . e x e
C : \ f 1 3 a c a 4 f e 6 c e 6 2 0 0 0 a 7 9 2 6 3 7 9 0 d f 7 9 d f 4 4 b 9 3 3 4 0 3 d 3 4 3 5 d 6 b d 6 4 2 1 8 4 6 a e 4 a 0 2 0
C : \ 8 e 6 2 7 1 c 6 f 5 2 1 b d f 9 3 f 8 8 d 0 3 f 4 7 c 9 d 0 2 c f 4 c c 3 8 2 2 9 9 5 8 0 2 b f 0 9 3 8 3 1 c f 7 a a 8 9 1 f 3
C : \ N P L A h v F x . e x e
C : \ 7 h R 7 s C r j . e x e
C : \ P V C Z c x y c . e x e
C : \ s I O x W 3 O J . e x e
C : \ z o x 3 M C v b . e x e
C : \ r L 1 y e m L P . e x e
C : \ i b 3 2 2 6 z x . e x e
C : \ 8 7 f 0 a e c 2 1 9 3 6 0 2 6 a e 4 e 4 7 f a 0 2 a 7 6 6 c 5 9 f e 3 2 4 1 5 9 e b 7 1 5 f 3 6 1 9 b 6 2 6 7 0 4 5 a 7 c 7 9 a
C : \ 3 b a 5 4 6 5 6 c e 6 5 d e 4 f 0 8 a b 8 0 b b 4 a e e f 4 6 a 1 d f 9 a 3 2 3 5 7 a d 9 9 8 1 a 6 f 1 5 4 c d d 2 9 8 9 e 9 7
C : \ c d 8 8 9 2 6 8 c 2 b 9 4 6 8 8 3 c b c 3 5 5 9 7 5 f f 9 6 0 e f b 3 d 0 e f 5 1 2 5 8 0 7 4 7 d 4 9 6 f d 0 a 7 b a 4 1 4 1 3
C : \ 1 3 e 5 d 9 c 8 3 f e a 5 2 a 7 9 7 f 0 8 f 2 c f 7 0 c 4 f a b 2 3 3 1 9 b f d 6 d f 7 3 b a a 0 b 7 a 7 f e 5 1 a 4 9 9 e 5 e
C : \ m 1 r p 8 t \ t l y b j u . e x e
C : \ f 4 6 3 7 2 3 d 0 2 d d a a 4 7 c 6 a c f c 5 9 b 9 2 5 a 8 b a 6 9 6 5 1 2 2 0 b 8 2 2 0 2 b 4 0 5 f b b 5 4 7 2 a 0 6 4 9 2 3
C : \ d 6 0 c 3 3 9 f c 0 c 5 3 d 9 4 5 c d 8 e 9 2 7 f 1 c 6 1 7 c 3 4 1 7 2 7 2 f 1 2 a b f b e d 5 2 0 e 6 a a 3 2 f b 6 e 2 3 f c
C : \ 3 a 2 6 9 3 d 5 a e 5 2 9 3 6 1 5 d a 1 c 3 6 c d d 6 4 1 6 b 5 6 3 a 2 c 5 b 2 e 4 d 6 4 c 9 8 4 4 8 4 7 0 2 2 c 8 6 b 6 a d 6
C : \ e d 1 6 5 b d c 2 8 8 c d b e e a 9 1 9 d a 0 f 9 4 6 0 4 8 f 3 5 7 6 d 9 0 8 3 5 6 c e d 7 6 b b 8 f f 3 5 2 9 0 7 3 5 8 8 5 2
C : \ B 2 A v A T 6 Q . e x e
C : \ f 1 1 3 6 f 8 2 9 f f 9 0 a 5 5 4 4 0 d 9 9 2 8 5 d f 8 2 2 7 c 2 6 f 8 7 7 7 1 3 6 b d c c d 3 8 8 a 7 2 8 5 2 2 f 0 1 b 1 f f
C : \ e 7 6 8 d 2 a 6 2 9 0 d 4 5 a 8 6 3 5 8 4 9 5 9 3 3 c 5 d 9 5 6 0 6 6 d 2 7 f e f 1 4 9 2 e 5 a c 7 2 c 3 8 2 0 d 8 f 6 e 0 1 3
C : \ a 2 d e 1 7 4 4 6 f a 7 d a e 2 7 7 c 9 f d 6 9 7 3 1 0 d 8 1 8 1 a 4 1 5 2 6 8 4 d 6 e 3 6 d f a a 8 d a 4 2 3 8 2 5 b d e 4 c
C : \ a 9 a f 2 1 3 2 0 7 f 1 4 9 c 3 2 e 6 f 3 b e 6 7 a 9 7 8 4 4 2 d d b c 2 a 1 c e e 0 c 3 f 4 d f 0 d 5 7 e a 0 f 8 b b e 2 4 9
C : \ 7 e 7 5 c b e 7 d 7 8 1 1 5 5 5 8 a 6 7 c 7 a 4 4 a 2 9 f 3 b b a 9 d 6 1 7 4 3 4 5 0 e 3 0 9 8 5 4 c d f 3 e f a 1 9 c 1 0 b d
c : \ t a s k \ 0 F C 7 C 5 C 2 7 0 F D 7 2 E D 5 0 1 1 9 E 8 D 5 9 7 8 7 E 2 0 . e x e
c : \ t a s k \ C F B D 9 5 D B 4 5 8 5 2 A 7 C 0 1 D 5 2 7 3 1 A B E 4 4 5 6 6 . e x e
c : \ t a s k \ 5 1 A 9 1 C D 6 D 9 1 D 6 7 E 9 A 6 D 4 9 7 E 1 E 5 A 2 5 B F 0 . e x e
c : \ t a s k \ 4 B B B A E 7 B 7 0 3 C 5 4 D 8 B 4 D 4 A 7 C 9 1 6 0 9 A 5 2 D . e x e
c : \ t a s k \ 5 9 7 F 5 F 3 7 6 1 B 0 5 3 6 A 8 6 7 7 E A C 8 7 1 7 F 0 5 3 6 . e x e
C : \ C l Y P x s e Y . e x e
C : \ 4 9 9 2 6 f d f 5 4 b 7 f 1 4 1 c c 0 5 5 3 3 0 0 8 5 1 2 9 0 0 c 0 2 7 1 8 0 2 6 1 2 b 9 0 2 e c d e e 1 7 0 8 0 a 5 8 2 e 9 9
C : \ 6 4 c e f 4 9 2 8 2 6 d 0 d d 6 d c e 6 8 1 c a 4 1 3 0 e c d c 4 7 b 8 8 a 6 8 2 3 6 f 4 7 f b 1 f c 0 4 0 8 f 8 e 2 2 6 5 9 1
C : \ f f c c f 1 c 5 3 e 3 6 b f 3 0 7 4 d d d 5 e 4 7 5 5 1 3 3 0 b 8 a 6 9 c 1 9 b f 1 4 0 f 2 1 d 7 4 7 1 c 8 d e d 9 5 2 4 b c 8
C : \ X C l f b l w e . e x e
C : \ c 4 0 0 4 f 8 6 f 4 3 9 2 9 8 6 c 1 1 7 d 1 a 9 1 2 a 8 2 e 3 9 4 b c b a 1 9 8 1 7 8 7 6 b e c 1 1 7 4 5 f 2 5 e 1 d b 5 c 0 3
C : \ e 7 a 3 1 9 c c 7 2 8 c 1 e 2 2 2 3 c 7 3 8 d b 1 7 2 9 e 2 8 b 9 d 2 c f 6 5 7 0 0 c 2 7 b f 9 9 0 9 7 0 0 5 f 4 7 e 5 1 b 8 a
C : \ j t i Q b Y N l . e x e
C : \ c 6 4 7 e d 7 d c f 3 d 6 b 8 1 2 9 3 a 9 7 2 b c 1 0 9 9 3 f c 7 2 b 0 5 d 9 8 8 b 8 6 c 6 c 1 c f 7 c b 5 2 a e 3 2 4 9 c 5 3
c : \ t a s k \ 2 4 C 0 A F 1 5 8 C 9 6 F F 0 3 4 7 D B 3 8 7 2 6 D 1 D 2 7 9 6 . e x e
C : \ d 2 m Z t k s M . e x e
C : \ 6 6 b b a 1 e f b 3 2 9 b b 4 c b a 3 6 3 9 2 1 1 d b c 2 4 8 7 8 0 c 0 6 9 f 3 6 a 7 b 6 3 2 4 1 2 6 3 f e 7 5 5 3 b 3 c 7 c 3
C : \ J s 0 W o l G O . e x e
C : \ f 5 0 d f 5 3 4 f a 5 6 4 c 9 a e 1 4 9 4 3 1 b d 4 a 5 b 4 7 c 9 4 4 3 2 0 c 1 c d b 9 2 1 d 8 0 f 1 a 2 6 8 1 2 a 3 e d b 0 c
C : \ u U H M w t 0 J . e x e
C : \ 2 9 8 0 9 a 8 e d c e b 8 c 6 1 3 c 5 a a 3 8 9 e f e 5 5 0 2 b a f 2 5 5 5 7 5 0 0 d 4 5 2 f 8 e 3 6 0 7 1 6 a 4 a c 6 4 b a 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ a 6 1 1 6 a 4 d e 9 f 7 6 2 0 8 4 4 8 c 1 6 c 1 a 6 8 7 0 7 e 0 c 4 7 2 f 4 8 6 4 b e a e c 5 7 5 1 1 1 9 1 3 e a 9 e 0 2 6 9 9
C : \ 7 e c e 1 4 3 b b c 1 f 9 6 0 2 e e 2 d e 2 b 7 6 b e 2 9 1 6 8 4 5 d 9 0 a f c 7 9 6 8 e 7 9 8 b 6 1 1 b 2 0 4 e 3 d 4 4 d 9 2
C : \ c 7 f 7 1 a f 9 9 7 2 c 6 6 1 1 5 e 9 e c 6 0 c f 0 f d f 5 1 4 1 3 8 a 8 b c 2 f 0 2 b 3 e 0 a 7 a 5 6 4 0 e 1 1 0 0 5 2 1 0 f
C : \ E W e G Y Z A X . e x e
C : \ 1 3 9 b 8 8 c 5 2 2 3 a 6 f 5 f f 3 8 f 9 c f c 1 2 e f 8 4 1 1 8 a f 9 4 d 7 e 7 f e f 6 7 5 d a 4 c 6 b 6 5 1 4 4 b f d 0 e 5
C : \ 6 2 2 c b d e 0 9 8 c 6 8 0 9 5 2 c d 2 8 3 b 2 7 8 8 b 3 f 9 5 5 e 5 d 3 e 0 7 8 3 f 5 b e 3 6 f 7 9 e c 5 a 8 4 7 c 0 c 6 a 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ l W c S K p Q x . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ c 3 9 4 e 3 f f 2 9 5 6 f d e b a 8 c 1 c f 8 0 3 d 3 0 6 3 b 9 6 c 5 3 9 2 0 b 9 8 e 4 a d a b 9 2 2 1 8 1 e e a e c e 2 c 4 b
C : \ d 3 7 d b 8 d 6 8 8 6 5 c c 1 c a 5 a f 4 7 3 6 5 a b 0 2 0 1 7 f 1 8 a c 5 d 1 a b 4 d 4 4 b 4 9 d d 2 8 0 a 8 7 4 e 5 2 d d b
C : \ f 9 8 b 7 9 a c c f f f b 6 0 9 7 3 a d 7 3 6 a 7 d f 7 f 5 f d e c 3 7 4 5 4 d e 9 3 9 0 b 4 a f b 6 8 f 3 d 8 3 6 b 5 f 4 5 7
C : \ 7 9 7 0 6 b 4 9 1 5 a d 0 0 b 4 c 9 a e 7 5 1 4 3 3 9 f 2 0 a f d 9 5 2 c 7 3 8 1 3 6 6 7 f e c f 2 5 4 e 7 d 8 6 6 a 0 3 c 1 c
C : \ o W l x p i R X . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 b 1 6 3 e 7 5 2 f 8 d 4 0 6 b b c c 3 c 7 2 0 6 e 4 5 3 3 1 f . e x e
C : \ 1 8 c 7 0 8 6 f 2 c d 1 8 e 1 1 7 9 e 3 1 b a 6 b 5 c 6 4 e 6 e a a c 3 8 7 3 7 4 0 9 2 f d 2 f 6 a e 1 6 0 0 6 1 b c e f 8 1 b
C : \ d c 4 9 4 3 c 2 5 4 5 f e a 1 9 8 0 f 5 9 2 f 7 1 6 b 3 e 1 e 4 2 3 a e 6 5 1 7 4 d e e c 2 9 1 6 d 2 3 0 0 6 7 5 3 d e 2 0 0 0
C : \ d e 1 2 5 f 0 1 c 7 d d 0 9 4 0 3 d 5 9 1 7 2 6 f 9 f 7 1 6 a d b 0 8 0 6 d a 0 0 2 d 2 8 c 5 6 a 6 f e 7 f f 6 e 2 e 2 2 0 0 8
C : \ U s e r s \ J a s o n \ A p p D a t a \ L o c a l \ T e m p \ 1 b b 3 d 2 3 d a b 4 c b d 2 e c f c d f b 5 1 b d 9 0 5 a e 1 5 1 2 d c 0 6 7 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d t t c o d e x g i g a s . p e 3 2
C : \ c 0 7 d 3 b 1 3 1 b 5 0 f c 0 6 c 1 9 0 4 7 0 6 4 5 2 9 8 f a e 6 f 0 5 f e 8 9 e 2 0 e 8 5 2 1 6 b 8 a c 1 3 e 2 6 8 d 5 2 5 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 2 6 3 f 9 2 f 6 d 3 6 d a 5 3 6 2 c 9 d 3 e 7 e 5 8 4 3 f 0 4 6 c e 4 5 0 0 4 1 7 5 f a 8 6 4 b 2 8 2 3 9 e 5 4 d f 5 e a 7 0 6
C : \ e 0 c 7 4 2 b 1 c 1 b b 8 1 9 3 b d f a 8 e d a a 0 4 9 6 6 5 8 c 2 b 9 7 a 0 6 9 8 5 4 8 5 6 e 2 4 d f 1 9 5 5 9 d 3 a 1 2 b 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 7 3 7 7 3 4 8 0 9 1 7 c f 9 4 0 2 8 0 8 7 0 5 1 f 4 f 3 c 4 f c e f b 3 b 0 c 4 9 8 0 6 f 1 9 a b a 9 2 c 7 8 e b e 7 1 3 3 e 0
C : \ 0 6 f a 5 2 2 f 9 5 b 6 9 a 8 5 2 e e 9 f c a 3 9 f 0 2 f 7 7 4 5 5 3 6 f a 9 a a 1 7 9 b 3 c 5 9 2 a 9 0 1 6 3 3 2 4 b 4 4 4 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 4 7 c 7 e c d 0 8 4 d 1 d 5 5 _ b u d h a . e x e
C : \ 6 2 3 c f 0 1 6 2 e 1 4 b 0 f 5 d 4 d 7 9 2 d 6 4 0 c 4 6 2 5 1 6 8 6 f b 7 0 c 6 c d f f c 4 0 a a 6 9 9 4 c d d 1 c 8 9 8 f b
C : \ 1 d 1 6 8 0 8 e 6 8 2 8 3 c 2 d d c 6 1 9 9 d 8 7 2 3 2 2 6 3 c 3 9 7 b b b 9 f c 2 b d 7 6 5 8 7 d e 2 3 8 5 0 2 f 9 f b 2 d d
C : \ 7 c 0 4 7 d 9 5 6 7 b 7 8 2 6 a a 8 4 f 7 4 7 6 f 5 1 1 1 9 5 c 7 0 9 8 a 0 4 d 7 a a f 5 b 8 0 1 c 9 3 5 7 d 7 b f 9 6 4 e c 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 3 6 b d 9 4 0 4 6 0 c 4 a 2 9 _ b u d h a . e x e
C : \ 2 7 e b c 0 2 d 6 0 3 e b b 3 5 b d b 4 f 7 2 b c 7 a f 6 1 c 9 3 b a 3 1 a c 9 e a 5 a 3 2 7 2 c 4 6 e c 3 0 5 d a 8 d 2 c 1 1
C : \ 5 1 5 a 7 8 0 6 4 8 6 f 8 d 1 7 e 3 c 6 3 0 3 c 9 4 6 6 2 9 4 9 2 8 4 e 4 d 8 f 8 0 4 e 6 2 9 7 8 1 5 1 b 5 4 1 8 1 2 2 3 4 3 8
C : \ U s e r s \ a r y a \ A p p D a t a \ L o c a l \ T e m p \ a 9 b 5 2 4 1 b 8 d 5 3 7 1 7 d 9 1 3 3 2 1 6 1 a a 3 5 e 8 2 c 7 8 5 5 6 a 0 6 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d t t c o d e x g i g a s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 5 6 8 3 b c 4 8 1 5 f d 7 a 2 _ b u d h a . e x e
C : \ 7 e 7 2 4 5 9 e 0 8 4 d 9 6 2 4 b d 6 9 a 8 a e 0 c 1 d a a 6 e 9 d f d c c 4 2 a 7 1 a c 7 c 0 b b 5 2 1 2 5 7 d f a 6 a d 4 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ a 1 e c 8 d 7 b 4 7 2 7 0 d 6 b 8 b 7 f b 6 5 6 6 5 0 2 e 6 3 e c a 9 2 6 c a 1 1 f 9 d d 3 3 d 6 2 d 7 3 8 f 0 f d 0 a c 6 5 d
C : \ U s e r s \ a r y a \ A p p D a t a \ L o c a l \ T e m p \ 5 e 4 e 1 6 0 b 6 3 2 3 c d 2 3 0 1 a c b 5 0 7 e 3 3 b 1 2 9 8 0 6 c 8 a c 3 e . e x e
C : \ a f 6 0 8 c 2 2 7 3 8 5 0 b 3 c 1 e 6 e 6 a 3 f 1 f 2 1 6 b a 5 9 8 2 8 d 4 c d 8 d a c 0 3 2 8 5 d 7 8 1 a 0 1 9 9 9 5 e a 7 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 4 2 d 2 0 c 4 9 8 9 c 6 5 6 f 6 c 0 4 c a d a e 6 8 4 f f a 3 d b 9 f 8 0 3 9 1 d 1 d 1 c c 1 1 6 2 5 7 1 f a 1 1 2 b a 6 f 3 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 9 a b 7 e d 1 f 6 7 d b 5 a a _ b u d h a . e x e
C : \ f c b c 9 2 1 f 2 d 6 b 7 5 4 c 7 9 e f 4 f 5 5 2 9 d 9 f 0 e 6 6 5 4 b 0 3 2 8 3 c 8 6 d 2 2 2 3 f 3 8 2 d 6 c e 5 d c e 7 9 e
C : \ 7 5 a 8 2 1 6 d 3 b 4 7 0 0 e a f 7 c 8 d 4 d 2 6 a 3 e 9 4 2 d 7 3 5 2 2 7 a 5 4 b 1 f 2 d b 8 1 9 a b 5 f 8 9 f 9 0 b 6 8 9 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 5 6 a 7 6 c 8 7 7 0 f 2 4 e 9 _ b u d h a . e x e
C : \ a c 9 6 8 a 6 3 b d 0 f 9 e 1 5 7 4 0 8 2 7 7 1 d 5 3 f f f a 9 8 a 0 f f 5 9 4 8 4 5 2 9 5 f b 7 a 3 9 7 5 c 2 7 3 e 4 2 7 0 c
C : \ U s e r s \ J o h n \ A p p D a t a \ L o c a l \ T e m p \ j m i n c o o w o V I K . e x e
C : \ c 6 6 8 e 3 f 9 e 7 e e e b 1 d d 3 e 6 a b a e b 2 8 3 1 e 0 5 0 a e 7 7 b 0 4 d f 5 6 e 9 9 6 5 2 9 5 e b c c 0 c 9 5 1 d 8 2
Process Tree
-
0db72b7d0b3d6fc04a0c23afd23d8917ff2ccbcabeaa271aa86444e53ac1e2f7.exe (1332)
"C:\Users\Administrator\AppData\Local\Temp\0db72b7d0b3d6fc04a0c23afd23d8917ff2ccbcabeaa271aa86444e53ac1e2f7.exe"
- budha.exe (2656) "C:\Users\ADMINI~1\AppData\Local\Temp\budha.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 23.82.12.30 |
| 50.115.112.90 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| cyclivate.com | A 23.82.12.30 | 23.82.12.30 |
| teamresults.org | A 50.115.112.90 | 50.115.112.90 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 23.82.12.30 cyclivate.com | 443 |
| 192.168.56.101 | 49165 | 23.82.12.30 cyclivate.com | 443 |
| 192.168.56.101 | 49166 | 23.82.12.30 cyclivate.com | 443 |
| 192.168.56.101 | 49169 | 50.115.112.90 teamresults.org | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 8.8.8.8 | 53 |
| 192.168.56.101 | 52215 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62361 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62361 | 8.8.8.8 | 53 |
| 192.168.56.101 | 58985 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58985 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 964abdd93ac206a4_budha.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
| Size | 36.1KB |
| Processes | 1332 (0db72b7d0b3d6fc04a0c23afd23d8917ff2ccbcabeaa271aa86444e53ac1e2f7.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | a0164fb0db052b40601f5c870c12720a |
| SHA1 | 6498f92cf7ff6d8bfd90e7310999ae5df67ac441 |
| SHA256 | 964abdd93ac206a4b061fcdd792735a376358584a0c9c17d536590e43e6aae1c |
| CRC32 | C6D19D0A |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | e2db0558de4e481ac8060a0a953d2eaf875af3cc |
|---|---|
| Size | 5.0KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | eb4ce187738642cf5b580a74d36c8def |
| SHA1 | e2db0558de4e481ac8060a0a953d2eaf875af3cc |
| SHA256 | 64b11075ea0d05126584b4d8a9cceef22cd913380f9088ee1828db73907fa734 |
| CRC32 | 094DAF27 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |