2.8
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.65
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545281.5315 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545282.047125 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压）
(6 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(1 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x00008000', 'virtual_size': '0x00002000', 'size_of_data': '0x00001e00', 'entropy': 7.392865543021051} | entropy | 7.392865543021051 | description | 发现高熵的节 | |||||||||
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
一个或多个缓冲区包含嵌入的PE文件
(1 个事件)
| buffer | Buffer with sha1: 79164aeb742e484966aeb899d69b96f762f351e9 |
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
生成一些 ICMP 流量
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2005-05-27 20:06:52
PE Imphash
d3c26f90ce9ccaec5f2c02122d099be1
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00007000 | 0x00006800 | 3.441906760625218 |
| UPX1 | 0x00008000 | 0x00002000 | 0x00001e00 | 7.392865543021051 |
| .rsrc | 0x0000a000 | 0x00002000 | 0x00001600 | 4.490007367531996 |
| .imports | 0x0000c000 | 0x00001000 | 0x00000400 | 3.473598610762303 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000a134 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000afe0 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x0000aff8 | 0x000001e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x0000b1e4 | 0x00000193 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.DLL:
• 0x4050f0 GetModuleHandleA
• 0x4050f4 GetProcAddress
• 0x4050f8 HeapCreate
• 0x4050fc HeapAlloc
• 0x405100 GetACP
• 0x405104 ExitProcess
• 0x405108 FreeLibrary
• 0x40510c GetTickCount
• 0x405110 GetCPInfo
• 0x405114 InterlockedDecrement
• 0x405118 InterlockedIncrement
• 0x40511c TlsAlloc
• 0x405120 TlsGetValue
• 0x405124 TlsSetValue
• 0x405128 TlsFree
• 0x40512c GetModuleHandleW
• 0x405130 SetLastError
• 0x405134 RaiseException
• 0x405138 GetOEMCP
• 0x40513c IsValidCodePage
• 0x405140 Sleep
• 0x405144 HeapSize
• 0x405148 SetHandleCount
• 0x40514c GetStdHandle
• 0x405150 GetStartupInfoW
• 0x405154 FreeEnvironmentStringsW
• 0x405158 WideCharToMultiByte
• 0x40515c GetEnvironmentStringsW
• 0x405160 InitializeCriticalSection
Library user32.dll:
• 0x405368 GetMessageA
• 0x40536c DefWindowProcA
• 0x405370 PostQuitMessage
• 0x405374 LoadIconA
• 0x405378 RegisterClassA
L!This program cannot be run in DOS mode.
.imports
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Sj
gigigigi
++r+r++2++Q
gaggif
/ghg}~
q}igzigi)guggg}
FIu1% T@
LoadCursorA
Winmm.dll
mciSendStringA
TranslateMessage
StAtUs type mpeGvideo alIas myFttt
CreateWindowExA
LoadLibraryExA
user32.dll
Ew"?1??
111111&$
E~G?|?|
E?}=<E
"GG~?~|"GEA?~
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
GetACP
ExitProcess
FreeLibrary
GetTickCount
GetCPInfo
InterlockedDecrement
InterlockedIncrement
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
RaiseException
GetOEMCP
IsValidCodePage
HeapSize
SetHandleCount
GetStdHandle
GetStartupInfoW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
InitializeCriticalSection
acmStreamOpen
acmFilterChooseA
GetMessageA
DefWindowProcA
PostQuitMessage
LoadIconA
RegisterClassA
.idata
@Ow;_T
*!20,
2Nd 5k
GW``*!]_
LNopfsv
0%FFGAuf
0!FIu9
LoadCursorA
vWinmm.dll
mcijSendStr
TranslateMessage!JAtUoos type m
Gvideo alIa
Cre5dowExvrOcPRFTLib]r6y
user32
E'?Ws)1
D!Kw7c
co}fG=
.L2+0! X7`
((K2$+ `(gL2P*02$ (($L (2
C+$L2),.L2!//sM2
&9EYt_"a
Eo{I:5
tIL$Y) 0Ei
qaI,$%1.
-#}eW!*KG
H "!?}&~[~w
MYm}9W#
9Oa19`;I@bB
\qdBX4pG}
&G6r|y
p{;DPahP
&44MBL`pM4Mf4
2Sw#lQ
GetModuleHandleA
ProcAddr
Exi/+6
F'e!-?TickCount
KrDkedDec2me$
InTlspwo
CValue
xW$/LastErrRaiseExption/OEMIsKidd5
eP8>%YgSizeIU{
tupmxEnviwnm
*ToMByt>,\
c{s7Cacm0mOp;X
FilJdooA
P,tQui!!
OIcj(|
Reg8RlK'Q
l`K4'J
XPTPSWXaD$j
.q^O$2
N6Jp1..@Y^mnt]"
pJp?Q]66Np.
"_6>Q^
'+C1@O0
""""""""""C4C
""""""""""
"""""""""""&
"""""""""""@
GGG"""""""""5""""""
GGGGG"""""G2
."""""""
GGGGGGGGG".."""""""
GGGGGGGGG".""""""""""
GGGGGGGGG
.."G""""""""""
GGGGGG
"G"""""""""
GGGG"""""""""
GGGGGGG""""""
GGGGGG"""""
.GGGGGGGGGG
}lllllll~
~~~~~~~~
wXXXXXXXmxtXtmyyzttzrtXXXXXXXiu{G
lHHHHHXmn[fofYppqirg
stXHXHHXiuS
eHHHHHHIJZaf^]
A2g6h$^\HHHHHHijSb
:WWWWWVk
X<<<<<<IYZ1[\]1^_`6A[aIQ<<<<Q<^Sb
:WcdddV
H<<<<<<IJ"K2LM.6N@6N
.OPQ <<< RSTUVWWV
< )=.>?@=.>A@BC@D= + EF
+,,,,,,)-./00-1 2345367,,,,,,89
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
KERNEL32.DLL
Msacm32.dll
user32.dll
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
acmStreamOpen
LoadIconA
KERNEL32.DLL
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
GetACP
ExitProcess
FreeLibrary
GetTickCount
GetCPInfo
InterlockedDecrement
InterlockedIncrement
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
RaiseException
GetOEMCP
IsValidCodePage
HeapSize
SetHandleCount
GetStdHandle
GetStartupInfoW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
InitializeCriticalSection
Msacm32.dll
acmStreamOpen
acmFilterChooseA
user32.dll
GetMessageA
DefWindowProcA
PostQuitMessage
LoadIconA
RegisterClassA
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 7
C o m p a n y N a m e
H a m a r C o r p
F i l e V e r s i o n
6 . 2 . 3 . 2
O r i g i n a l F i l e n a m e
h a m a r . e x e
P r o d u c t N a m e
h a m a r . e x e
P r o d u c t V e r s i o n
6 . 2 . 3 . 2
V a r F i l e I n f o
T r a n s l a t i o n
C : \ D O C U M E ~ 1 \ C o m p 3 \ L O C A L S ~ 1 \ T e m p \ R a r $ E X a 0 . 7 3 4 \ C r e d i t _ R e p o r t _ 4 2 8 7 3 6 2 1 6 3 . e x e
C : \ e u U B Q j i 9 . e x e
C : \ z k t Q k O H P . e x e
C : \ p C 4 d p 8 Q F . e x e
C : \ 5 d V A Q Z O 0 . e x e
C : \ j h h d v 0 i M . e x e
C : \ t A Y C q A q 1 . e x e
C : \ i t Z a 9 K l N . e x e
C : \ M f y F 0 n k P . e x e
C : \ L A f g _ G R A . e x e
c : \ w i n d o w s \ t e m p \ b d 4 7 c 6 3 3 b 7 3 e f 9 c 2 2 1 5 0 f 2 a 1 5 b 6 d 6 5 d 7 . b a a d 4 b 8 b 4 6 9 a 8 a 8 b 8 6 1 2 b 2 7 4 d 4 b 0 f 9 6 d 1 5 3 a 5 a 9 e . e x e
C : \ n U k A M b r w . e x e
C : \ H 9 w w 3 O q L . e x e
C : \ e t B e b k b g . e x e
C : \ X C M A Y t L J . e x e
C : \ 8 a 5 0 e 5 9 1 e e 5 f c e c e a b 3 a a d 5 4 4 1 a 9 9 a 6 d 6 4 2 2 0 e d f f e d 7 1 9 e 0 a 4 4 a 9 1 1 6 8 e b 3 a 3 b d
C : \ p 7 f Q T K c 6 . e x e
C : \ i 8 A 5 K F C 7 . e x e
C : \ r u e a K O h a . e x e
C : \ S J T d f 9 K v . e x e
C : \ 5 f k s 9 3 s e . e x e
C : \ E E m J G Y Y C . e x e
C : \ f e p q R G a B . e x e
C : \ A c k t l M c X . e x e
C : \ z X c 7 Y F 7 X . e x e
C : \ 6 7 9 f 4 9 5 4 e 2 5 e 9 d 6 d 3 4 a c 8 4 b 0 7 5 0 2 e 7 4 c a c c 8 b d d 3 4 a 6 d 2 b 9 0 3 d 4 4 3 c 2 6 e 3 e b 9 e 3 d
C : \ b c 5 8 6 a 8 1 f 5 7 5 8 5 b 4 6 2 6 8 b 5 4 c a 9 4 5 4 0 a c f 3 7 e 7 c 8 e 0 e 3 0 3 c a e 5 e b 3 1 2 c f 6 3 a 3 6 5 f f
C : \ 9 3 9 9 a 3 3 1 1 e 9 e 6 7 0 d 4 f 2 8 9 d e 4 b b 5 5 c a d d 3 f 2 9 1 3 5 6 c 9 0 4 0 f 5 8 7 e 6 8 1 7 4 a 9 e d 0 2 8 a a
C : \ 8 b 1 6 0 1 b 0 a 4 1 f a 6 2 9 8 b 4 5 b 3 d c d 9 2 1 4 2 8 8 4 f 0 1 7 e 8 4 8 b 1 9 4 7 d e c f 5 b a 8 9 e 2 2 f 9 8 a d 7
C : \ 7 8 1 f 3 3 b 1 8 4 2 c e 1 4 d c 0 9 6 4 c 8 a c a d 3 8 e 1 5 3 0 5 3 8 8 a 8 d 0 6 f 1 7 8 3 3 5 7 f 6 d 3 c c a 3 8 6 f 8 0
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 5 d 3 f 8 1 7 7 a 6 d 2 4 7 7 2 4 8 a 0 a d b e 4 2 a c 1 a 6 2 b 8 f 9 0 b 6 c 5 b c 7 0 3 c b e 8 1 3 e b 1 9 3 6 8 f 6 d 6 4 . e x e
C : \ 8 a e 2 e 2 1 7 6 8 a 3 d 4 3 c 4 2 8 0 c 9 0 8 d 9 1 5 e 1 3 a c f a 7 3 2 5 b c f 9 7 f 7 9 d b 9 1 4 6 e c d 0 a 5 d 1 a 4 c
C : \ U s e r s \ L i s a \ D e s k t o p \ X k H u C r 1 U . e x e
C : \ 8 0 d f 8 1 9 3 4 3 9 0 6 a 8 8 0 5 6 6 2 2 1 b 4 d 4 0 a a e d 2 9 3 6 5 e 3 6 6 c d 5 9 6 f 1 f 3 2 2 0 5 5 b 0 b 4 c e 4 7 7
C : \ U s e r s \ L i s a \ D e s k t o p \ G S h e K u z d . e x e
C : \ B _ N B i i l K . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ U x A v f e e a . e x e
C : \ d d 6 5 3 6 6 c 6 b 5 3 7 f c 6 c 8 8 6 1 c b f 8 a e 8 2 9 2 1 b 1 3 a f 0 3 f a 3 0 2 d 1 5 0 6 a 7 1 3 e b 3 b 4 7 c e b e f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l 1 B J u r c H . e x e
C : \ 4 2 3 2 4 c a 0 b 0 5 b 3 8 4 8 1 2 5 0 b 1 d 2 a a 1 a 6 d 3 8 f f 8 0 1 7 9 d 8 6 7 3 3 e 9 6 5 6 e a c 0 a e 2 8 e 3 5 3 f a
C : \ a 0 0 4 e c 3 3 5 f c b d c 7 b 8 d 2 8 f 6 6 e 7 2 0 5 7 9 7 6 a 0 1 8 b f 7 a 6 b 9 1 7 a 6 b 9 c 3 f f 5 2 6 9 a 8 a 0 0 3 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 5 9 U z i L J H . e x e
C : \ 2 7 d 5 2 a 5 f 0 8 4 9 d 6 b 9 5 d 7 1 0 0 9 8 3 2 1 d b 5 4 6 b 5 0 5 2 a 5 e d 5 a 8 e 4 e 7 d a 8 a 0 9 f b 4 1 0 a c a 4 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ R Q R A K z U 4 . e x e
C : \ 2 3 0 d c a 1 5 1 4 8 6 7 b 3 a 1 7 f b f f 3 4 2 7 8 a d f d e 7 e 2 2 e 5 4 2 a 8 4 a 2 d b e b d 8 7 8 2 5 3 3 a 5 f 0 3 2 c
C : \ U s e r s \ L i s a \ D e s k t o p \ 1 p e l g 5 X 0 . e x e
C : \ a 0 e 0 a 8 d b 1 c 7 5 4 5 e d 7 b 2 e 3 d 6 5 a 2 4 e f 1 2 9 6 7 0 1 4 a 6 9 3 a e 6 5 0 d 9 7 d 4 a 8 2 5 0 1 7 6 c 0 a e 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 2 H H o F B S J . e x e
C : \ R e t F I q E v . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 6 0 i B E i G E . e x e
C : \ 8 1 5 0 c b b f d c 3 c 3 8 6 7 1 7 0 1 2 2 3 a 5 1 d f 6 3 f 4 9 7 9 d 3 9 e 2 d e c 5 8 9 5 8 7 5 1 a 5 7 1 9 d 9 1 e d f 8 e
c : \ t a s k \ 5 4 0 5 E D B 3 F 7 1 2 9 F D 0 8 1 6 5 A 1 B 4 F 7 A 0 F 2 D E . e x e
c : \ t a s k \ 6 D 3 5 9 6 A 2 B 5 B 0 6 8 A C 8 6 B 6 C 4 8 9 D 2 E 0 8 8 0 2 . e x e
C : \ c 5 e 2 4 e 0 7 4 d e 6 c 1 f f 0 c 7 1 b 8 c f 6 5 7 d 8 9 0 a 9 b d d 8 f 9 7 d a c 6 2 9 3 0 4 d 2 4 0 b c 6 4 0 6 5 2 e b 3
C : \ 1 6 e 3 9 b 2 7 6 0 8 2 2 1 a 0 a f 1 f 0 a d b d 1 2 4 1 7 3 7 6 7 e 0 1 e 3 b 8 c 7 3 f e 2 8 b a e 9 4 f e 8 6 1 9 0 6 a 5 5
C : \ c a 8 4 1 4 2 e 6 5 b c a e 3 5 5 6 0 1 7 0 e e c 2 c 5 e 8 e 5 9 1 9 5 c 7 4 9 7 d 9 1 8 9 e 4 f 7 6 a 1 6 9 e c 0 7 e e 9 a d
C : \ 8 4 1 5 7 9 3 3 9 8 8 b 7 9 c 6 4 5 2 d 1 5 8 b d 4 4 5 9 5 c f d 5 b 0 6 6 2 2 9 1 a 6 0 6 3 a b b b 8 a 3 1 3 e 8 a a 9 6 b c
C : \ l L p f 1 o o a . e x e
C : \ b d 1 d d b 8 9 3 5 0 8 7 f 6 c b 9 f f 3 6 7 6 b b 5 8 d c 8 1 7 2 c 8 2 8 2 4 3 5 4 7 d 9 c c f d 2 0 6 4 0 1 8 d d 4 2 8 d 2
C : \ _ A t f U q G M . e x e
C : \ 6 e 4 7 c 1 9 9 8 5 c 7 6 3 0 9 1 f 3 8 f 0 f 2 e f 5 1 1 9 8 5 7 8 8 1 d e 2 c 2 8 4 8 3 3 1 1 6 8 f b 7 7 e 1 8 1 e e 7 7 f 6
C : \ c c 5 6 f 4 2 7 b 9 4 4 4 7 1 2 2 e 1 e 7 5 9 0 4 a 0 9 5 a f 1 6 0 f d 9 4 3 9 f 6 7 f a b 9 f c c 3 c c 2 6 c f 6 3 9 9 d 9 5
C : \ 3 c 9 7 b 1 c 8 4 7 7 e d d 6 3 7 7 b b b f 7 2 0 b 9 4 2 0 2 b 3 a b 3 0 f 3 b 3 b c 5 0 1 d a c 2 8 f b a 2 5 c 0 c 3 8 0 a 5
C : \ 7 4 9 4 5 1 6 3 e 6 d c d 7 d 0 a 2 5 4 a c 6 1 e a 0 e e d b 2 d 5 5 d 2 f 4 f a 3 8 1 a 8 9 1 5 5 7 a d 8 a 0 7 a d a 3 6 d f
C : \ i L R V _ P q X . e x e
C : \ 2 c 3 b 1 c 6 8 0 c 5 6 1 8 8 b c f 1 d 8 4 e 6 e 0 2 0 5 3 c c a 0 0 1 1 f 2 d a e 6 6 7 c 2 6 6 c 6 a 3 6 4 d 3 4 f 8 9 6 d 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ b 9 f c f 5 c 6 4 4 2 9 b e 4 c 7 f a d 8 e 0 5 d b b d a 2 a c 5 9 f f 8 d 7 d d 1 9 4 4 a 7 4 d a d 9 0 b 4 1 6 f 6 3 f b 4 d
C : \ 9 7 3 f e 9 a 6 f 7 3 2 e 0 d 1 0 7 c 6 1 a a b 4 d c c a f 3 1 1 9 8 e 4 7 a 1 e c 5 0 8 4 5 6 5 c c d a 2 e 1 e 4 5 d 9 3 1 f
c : \ V I D 6 8 4 1 5 8 8 6 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 6 4 9 4 0 b a 6 9 1 8 d 1 6 a 7 4 c e 1 5 0 9 d e c 4 0 1 0 e e c 3 6 0 6 a a 9 f 8 9 2 b 8 d 0 6 1 2 b 7 f e 2 3 7 7 9 b a b f
C : \ d c f b 2 1 4 a d 1 2 6 1 1 e 6 a b b 6 8 7 8 2 8 8 3 c 2 5 2 e b 1 8 4 1 e 7 f 4 8 d 5 5 4 d 2 5 e b 3 4 5 d 9 9 6 4 6 0 1 d e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 5 0 b a f b 8 4 5 d 2 9 2 e 2 1 1 8 2 c 3 1 0 7 5 f a e c 2 0 e 2 8 0 9 b 8 2 b 4 2 d e 1 3 3 b f 0 e c 3 a 5 c e f a 1 b 6 8 1
C : \ c 8 5 2 6 3 4 1 6 a 4 6 3 a 9 3 a d 9 4 1 a c a 1 9 8 6 c b 1 0 4 1 d 1 9 1 3 5 b 9 4 a a 2 c 7 d c 2 c 6 3 6 9 8 6 c 9 5 5 5 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 1 2 8 a f 3 5 4 e 3 a 2 9 c 2 f f a 7 5 b d d 1 7 2 c 2 8 1 5 6 3 5 9 6 8 1 3 5 d 0 6 e b c c 4 2 b 1 a 7 d 8 3 5 6 c 0 2 a d f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ d d 2 9 8 1 c 8 4 7 2 e 3 3 e d 3 9 d e 0 1 0 b b 8 6 c 9 8 7 3 9 0 b 9 c f 4 2 3 9 8 1 6 4 1 e f a f a 5 4 7 6 4 7 c 9 9 0 b 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ c 8 2 F A 8 l G . e x e
C : \ d c 7 9 9 9 f 3 5 c 1 b c 8 1 a e c d a f c 5 4 d 4 b 2 c 6 3 b 0 f 9 f 2 7 0 1 9 1 a 0 6 9 c f e 9 0 2 4 c 6 f f 3 d f f 6 7 9
C : \ d 3 4 a b a c b 8 9 2 c f 6 1 b d e 8 a 3 d 2 e 8 4 7 7 3 5 4 a d 0 1 f 0 5 3 4 f 8 3 4 1 a e 9 c 3 9 8 0 a 4 d 9 b 3 9 7 0 3 f
C : \ b 7 a 9 0 e 4 b 8 a 2 2 6 2 3 e 0 7 a 8 9 b b c a a 7 f 0 e 8 4 1 a a 2 c 6 d 3 3 7 4 f 7 6 7 4 c 2 c 6 9 3 5 0 1 1 b b 2 f c 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 2 4 5 5 1 c 6 8 f d d f 5 5 9 b f 6 7 b 6 0 3 6 c 4 e 4 2 8 5 0 3 1 c 6 d 2 f 8 8 3 c 4 c f 4 4 4 1 b 2 8 6 6 7 5 8 b 0 a b 9 0
C : \ b 3 9 a 9 7 3 8 d 1 1 f 0 e 2 6 d a 2 b 0 b 8 3 c 6 b 5 2 6 5 5 3 f 5 5 9 5 f 9 c 2 e 2 3 c 2 9 c c 4 e 9 9 8 6 3 d a d 0 8 b 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ L I V 8 h 6 Y J . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 9 4 b a 1 8 b 1 9 1 6 2 b 1 a b 9 3 8 f 7 d a 7 c 1 e a 9 0 c 3 d 1 2 8 4 2 d 4 a e 2 8 3 3 1 b 3 f 0 3 5 d 6 b f 8 5 4 a 4 7 8
C : \ a 3 5 c 9 6 d f 2 e a a 1 d 1 7 9 3 7 7 5 2 1 7 4 0 c 2 6 3 a 6 7 9 1 4 3 b f c c 8 4 3 1 f 6 1 9 2 0 d c f d f 2 2 a e f 1 f 9
C : \ Z 6 y Q I _ P u . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 1 b 1 3 1 3 4 d 7 1 0 3 d 0 b 5 a 7 2 c 0 2 8 f 6 2 5 a e c 2 a 8 7 2 e 5 0 8 1 8 6 7 2 6 8 4 c 1 c 5 6 2 4 3 3 4 8 1 2 9 2 3 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ a 2 7 f 2 0 9 0 3 0 4 f 2 b 3 d d a f 6 0 c 0 6 8 4 a e c 8 a 8 7 6 a a b 4 a 7 8 6 5 a f 3 c 9 c 7 f b f 0 7 d f d 4 5 1 2 9 b
C : \ a b 1 4 1 1 d 8 2 c d 4 b b 3 1 3 3 a 7 e b 7 d 3 3 3 b 1 f b 5 f 9 2 9 2 b 2 3 1 0 7 4 5 a f e 4 1 f f 8 2 b 6 1 8 2 7 d c 4 f
C : \ 7 a b b 0 d e 3 7 b 4 8 f 8 b d d 3 f 1 7 0 6 2 b 0 3 9 e 0 b e 8 0 a 7 c 5 0 9 3 a 0 c c 9 4 d 7 3 5 4 0 8 c 0 3 a 5 e e 8 4 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ U K Q D k 4 N U . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ d e 4 9 9 7 a 8 8 1 3 3 a b e 0 e 4 e 3 9 a 1 2 0 6 6 e 3 c b a 7 8 f b 6 0 a 7 6 4 a c f 9 a 8 9 2 4 1 2 4 6 d 9 a 0 5 0 d a 2
C : \ 2 c 7 1 3 a 7 2 b c 2 7 1 2 9 e 6 c 0 3 0 e d 4 a f d 3 1 c b 1 d 4 f 1 6 5 7 a 8 0 6 8 4 e 5 a 5 8 5 3 6 f 1 4 c 0 d 1 d 4 c 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 l K B F 7 L V . e x e
C : \ F n s M m q U k . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ L C l h 6 k U R . e x e
C : \ 4 1 9 6 9 a 4 1 e 6 d e e a d c 4 f 5 e f e 2 e e 7 a e 1 9 c 7 d 5 4 2 e 8 9 4 b 0 b 6 1 7 3 5 4 c 7 d 8 b 8 6 8 e 8 4 a 8 7 5
C : \ U s e r s \ L i s a \ D e s k t o p \ D q B R 6 x x S . e x e
C : \ 0 5 5 8 e e 3 4 5 9 e a 8 a e 4 1 e 5 2 7 2 5 5 c 5 e 1 5 2 3 6 d 6 c 0 d 1 3 f 8 7 4 4 1 f 3 4 c a 6 2 5 a e 1 1 2 b a b 3 d 1
C : \ 2 1 9 8 8 6 d 1 3 c c e c 9 c 2 4 c c c 2 a 9 9 3 e 5 c d 0 f 8 e 0 9 2 6 0 a 4 8 b 6 1 8 7 1 9 4 e 6 9 a d f 6 c 9 a 3 6 a 9 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ U T 1 U k x X 1 . e x e
C : \ d b a e 2 8 1 0 5 b c 0 f 1 0 a 6 4 3 6 3 8 b 6 d e d e d 7 4 d b c 9 d f 7 9 d 1 9 c a b 2 8 7 d d c e d 6 8 f 6 f 0 8 e 8 5 3
C : \ 6 P l c M s b 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c f c 3 8 3 a 9 2 7 0 2 9 7 e 5 c 6 3 d 2 c 3 c a a c d 4 e 7 4 . e x e
C : \ 6 e 8 c 9 1 b 1 8 d f 4 2 a 2 e a a c 4 0 1 8 c 7 f 4 d 6 2 0 5 a 0 7 4 f a e 9 a 2 c 2 3 0 9 1 d 9 0 5 6 6 c 4 f c 2 6 0 0 a c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ H p u e 9 u i q . e x e
Process Tree
-
0247de045615db753aff25c18980260a52e6f8c48784e44a0e9a154d7fffc395.exe (1932)
"C:\Users\Administrator\AppData\Local\Temp\0247de045615db753aff25c18980260a52e6f8c48784e44a0e9a154d7fffc395.exe"
- budha.exe (2736) "C:\Users\ADMINI~1\AppData\Local\Temp\budha.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com |
AAAA fd3e:4f5a:5b81::1 AAAA fd3e:4f5a:5b81::1 |
131.107.255.255 |
| thebatdoc.com | ||
| vinicwine.com |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 8.8.8.8 | 53 |
| 192.168.56.101 | 62361 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62361 | 8.8.8.8 | 53 |
| 192.168.56.101 | 58985 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58985 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.101 | 114.114.114.114 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 43fbf8ccb1dac954_budha.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
| Size | 53.3KB |
| Processes | 1932 (0247de045615db753aff25c18980260a52e6f8c48784e44a0e9a154d7fffc395.exe) |
| Type | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed |
| MD5 | b5acb68b57c4f59df4424b737933d324 |
| SHA1 | 453ada2657473db7e3a657538fdc980ed4955722 |
| SHA256 | 43fbf8ccb1dac95413848e38e81225d2e80d40ec0f47d015ed83d5c599fb5886 |
| CRC32 | 0E250675 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 79164aeb742e484966aeb899d69b96f762f351e9 |
|---|---|
| Size | 5.0KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 1fc55551d37994ea420b031219c86364 |
| SHA1 | 79164aeb742e484966aeb899d69b96f762f351e9 |
| SHA256 | 3bdc16f11593e4a134a0ef32ebbb857e73ed12e3aaa3d7f5f3141855f08d4191 |
| CRC32 | 51211DC9 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |