SmartHawk

5.2

中危

54 个模型检测该样本为恶意！

重新分析

下载样本

1585a976d6f02fb64a61ae1342056bc5ac3dec2212d6a97fcbe4e024aeb5b29f

5c56ff5e66c76645ec98d972e5896151.exe

分析耗时

82s

最近分析

文件大小

772.0KB

静态报毒动态报毒 100% AI SCORE=81 CONFIDENCE DELF DELPHI DOWNLOADER33 FAMVT FAREIT GDSDA GENERIC@ML GENERICKD HKZXVA LAMER MALWARE@#2EI982CYLNUJK OCMKZEGRCGC OQJKETCH R339814 RDMK REMCOS SCORE SCSMAVJBIGRYTGYIQLKKYG SXES TKCQW UNSAFE USMANEAGHC WACATAC WDQF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FVP!5C56FF5E66C7	20201226	6.0.6.653
Alibaba	Backdoor:MSIL/Remcos.7d8f955a	20190527	0.3.0.5
Avast	Win32:Trojan-gen	20201226	21.1.5827.0
Baidu		20190318	1.0.0.2
Kingsoft		20201226	2017.9.26.565
Tencent	Win32.Backdoor.Remcos.Sxes	20201226	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.itext

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (3 个事件)

Time & API	Arguments	Status
1619513306.235408 __exception__	stacktrace: 5c56ff5e66c76645ec98d972e5896151+0x490f7 @ 0x4490f7 5c56ff5e66c76645ec98d972e5896151+0x4b4c6 @ 0x44b4c6 5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1 5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106 5c56ff5e66c76645ec98d972e5896151+0x4e997 @ 0x44e997 5c56ff5e66c76645ec98d972e5896151+0x1f8be @ 0x41f8be gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a LoadStringW+0x210 SystemParametersInfoW-0xa user32+0x190c9 @ 0x775a90c9 WCSToMBEx+0xd2 MBToWCSEx-0xd5 user32+0x1cfef @ 0x775acfef CloseThemeData-0x143d uxtheme+0x10b64 @ 0x75220b64 CloseThemeData+0x322 GetThemeColor-0x4fd uxtheme+0x122c3 @ 0x752222c3 WCSToMBEx+0x17e MBToWCSEx-0x29 user32+0x1d09b @ 0x775ad09b CallWindowProcA+0x24 GetClassNameA-0x8c user32+0x27953 @ 0x775b7953 LoadBitmapA+0x2ed DefFrameProcA-0xc user32+0x27faf @ 0x775b7faf DefFrameProcA+0x1b DefMDIChildProcA-0x136 user32+0x27fd6 @ 0x775b7fd6 5c56ff5e66c76645ec98d972e5896151+0x60ed8 @ 0x460ed8 5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1 5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106 5c56ff5e66c76645ec98d972e5896151+0x4e997 @ 0x44e997 5c56ff5e66c76645ec98d972e5896151+0x1f8be @ 0x41f8be gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetDC+0x52 ReleaseDC-0x130 user32+0x17316 @ 0x775a7316 GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x775a6de8 LoadStringW+0xee SystemParametersInfoW-0x12c user32+0x18fa7 @ 0x775a8fa7 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77d4011a 5c56ff5e66c76645ec98d972e5896151+0x4b4c6 @ 0x44b4c6 5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1 5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106 5c56ff5e66c76645ec98d972e5896151+0x4b153 @ 0x44b153 5c56ff5e66c76645ec98d972e5896151+0x4e80e @ 0x44e80e 5c56ff5e66c76645ec98d972e5896151+0x4e881 @ 0x44e881 5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1 5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106 5c56ff5e66c76645ec98d972e5896151+0x4b153 @ 0x44b153 5c56ff5e66c76645ec98d972e5896151+0x49dbf @ 0x449dbf 5c56ff5e66c76645ec98d972e5896151+0x5dcff @ 0x45dcff 5c56ff5e66c76645ec98d972e5896151+0x5dcd5 @ 0x45dcd5 5c56ff5e66c76645ec98d972e5896151+0x6688c @ 0x46688c 5c56ff5e66c76645ec98d972e5896151+0x9a85d @ 0x49a85d BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634580 registers.edi: 0 registers.eax: 0 registers.ebp: 1634652 registers.edx: 0 registers.ebx: 4896364 registers.esi: 4896360 registers.ecx: 1634656 exception.instruction_r: f6 40 1c 10 74 31 83 78 30 00 74 2b 8b 48 18 81 exception.symbol: 5c56ff5e66c76645ec98d972e5896151+0x6371c exception.instruction: test byte ptr [eax + 0x1c], 0x10 exception.module: 5c56ff5e66c76645ec98d972e5896151.exe exception.exception_code: 0xc0000005 exception.offset: 407324 exception.address: 0x46371c	success
1619513306.266408 __exception__	stacktrace: 5c56ff5e66c76645ec98d972e5896151+0x490f7 @ 0x4490f7 5c56ff5e66c76645ec98d972e5896151+0x4b4c6 @ 0x44b4c6 5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1 5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106 5c56ff5e66c76645ec98d972e5896151+0x4e997 @ 0x44e997 5c56ff5e66c76645ec98d972e5896151+0x1f8be @ 0x41f8be gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x775a6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x775a6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77d4011a 5c56ff5e66c76645ec98d972e5896151+0x4b4c6 @ 0x44b4c6 5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1 5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106 5c56ff5e66c76645ec98d972e5896151+0x4b153 @ 0x44b153 5c56ff5e66c76645ec98d972e5896151+0x4e80e @ 0x44e80e 5c56ff5e66c76645ec98d972e5896151+0x4e881 @ 0x44e881 5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1 5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106 5c56ff5e66c76645ec98d972e5896151+0x4b153 @ 0x44b153 5c56ff5e66c76645ec98d972e5896151+0x49dbf @ 0x449dbf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1636264 registers.edi: 0 registers.eax: 0 registers.ebp: 1636336 registers.edx: 0 registers.ebx: 4896364 registers.esi: 4896360 registers.ecx: 1636340 exception.instruction_r: f6 40 1c 10 74 31 83 78 30 00 74 2b 8b 48 18 81 exception.symbol: 5c56ff5e66c76645ec98d972e5896151+0x6371c exception.instruction: test byte ptr [eax + 0x1c], 0x10 exception.module: 5c56ff5e66c76645ec98d972e5896151.exe exception.exception_code: 0xc0000005 exception.offset: 407324 exception.address: 0x46371c	success
1619513364.360408 __exception__	stacktrace: 0x36d41aa 0x3b2fe6c registers.esp: 62061596 registers.edi: 0 registers.eax: 0 registers.ebp: 62061624 registers.edx: 0 registers.ebx: 0 registers.esi: 62061640 registers.ecx: 4294967294 exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44 exception.instruction: mov eax, dword ptr [eax + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x36d8e16	success

Time & API

Arguments

Status

Return

Repeated

1619513306.235408
__exception__

stacktrace:

5c56ff5e66c76645ec98d972e5896151+0x490f7 @ 0x4490f7
5c56ff5e66c76645ec98d972e5896151+0x4b4c6 @ 0x44b4c6
5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1
5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106
5c56ff5e66c76645ec98d972e5896151+0x4e997 @ 0x44e997
5c56ff5e66c76645ec98d972e5896151+0x1f8be @ 0x41f8be
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
LoadStringW+0x210 SystemParametersInfoW-0xa user32+0x190c9 @ 0x775a90c9
WCSToMBEx+0xd2 MBToWCSEx-0xd5 user32+0x1cfef @ 0x775acfef
CloseThemeData-0x143d uxtheme+0x10b64 @ 0x75220b64
CloseThemeData+0x322 GetThemeColor-0x4fd uxtheme+0x122c3 @ 0x752222c3
WCSToMBEx+0x17e MBToWCSEx-0x29 user32+0x1d09b @ 0x775ad09b
CallWindowProcA+0x24 GetClassNameA-0x8c user32+0x27953 @ 0x775b7953
LoadBitmapA+0x2ed DefFrameProcA-0xc user32+0x27faf @ 0x775b7faf
DefFrameProcA+0x1b DefMDIChildProcA-0x136 user32+0x27fd6 @ 0x775b7fd6
5c56ff5e66c76645ec98d972e5896151+0x60ed8 @ 0x460ed8
5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1
5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106
5c56ff5e66c76645ec98d972e5896151+0x4e997 @ 0x44e997
5c56ff5e66c76645ec98d972e5896151+0x1f8be @ 0x41f8be
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetDC+0x52 ReleaseDC-0x130 user32+0x17316 @ 0x775a7316
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x775a6de8
LoadStringW+0xee SystemParametersInfoW-0x12c user32+0x18fa7 @ 0x775a8fa7
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77d4011a
5c56ff5e66c76645ec98d972e5896151+0x4b4c6 @ 0x44b4c6
5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1
5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106
5c56ff5e66c76645ec98d972e5896151+0x4b153 @ 0x44b153
5c56ff5e66c76645ec98d972e5896151+0x4e80e @ 0x44e80e
5c56ff5e66c76645ec98d972e5896151+0x4e881 @ 0x44e881
5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1
5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106
5c56ff5e66c76645ec98d972e5896151+0x4b153 @ 0x44b153
5c56ff5e66c76645ec98d972e5896151+0x49dbf @ 0x449dbf
5c56ff5e66c76645ec98d972e5896151+0x5dcff @ 0x45dcff
5c56ff5e66c76645ec98d972e5896151+0x5dcd5 @ 0x45dcd5
5c56ff5e66c76645ec98d972e5896151+0x6688c @ 0x46688c
5c56ff5e66c76645ec98d972e5896151+0x9a85d @ 0x49a85d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634580
registers.edi: 0
registers.eax: 0
registers.ebp: 1634652
registers.edx: 0
registers.ebx: 4896364
registers.esi: 4896360
registers.ecx: 1634656
exception.instruction_r: f6 40 1c 10 74 31 83 78 30 00 74 2b 8b 48 18 81
exception.symbol: 5c56ff5e66c76645ec98d972e5896151+0x6371c
exception.instruction: test byte ptr [eax + 0x1c], 0x10
exception.module: 5c56ff5e66c76645ec98d972e5896151.exe
exception.exception_code: 0xc0000005
exception.offset: 407324
exception.address: 0x46371c

success

1619513306.266408
__exception__

stacktrace:

5c56ff5e66c76645ec98d972e5896151+0x490f7 @ 0x4490f7
5c56ff5e66c76645ec98d972e5896151+0x4b4c6 @ 0x44b4c6
5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1
5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106
5c56ff5e66c76645ec98d972e5896151+0x4e997 @ 0x44e997
5c56ff5e66c76645ec98d972e5896151+0x1f8be @ 0x41f8be
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x775a6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x775a6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77d4011a
5c56ff5e66c76645ec98d972e5896151+0x4b4c6 @ 0x44b4c6
5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1
5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106
5c56ff5e66c76645ec98d972e5896151+0x4b153 @ 0x44b153
5c56ff5e66c76645ec98d972e5896151+0x4e80e @ 0x44e80e
5c56ff5e66c76645ec98d972e5896151+0x4e881 @ 0x44e881
5c56ff5e66c76645ec98d972e5896151+0x4f1e1 @ 0x44f1e1
5c56ff5e66c76645ec98d972e5896151+0x5f106 @ 0x45f106
5c56ff5e66c76645ec98d972e5896151+0x4b153 @ 0x44b153
5c56ff5e66c76645ec98d972e5896151+0x49dbf @ 0x449dbf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1636264
registers.edi: 0
registers.eax: 0
registers.ebp: 1636336
registers.edx: 0
registers.ebx: 4896364
registers.esi: 4896360
registers.ecx: 1636340
exception.instruction_r: f6 40 1c 10 74 31 83 78 30 00 74 2b 8b 48 18 81
exception.symbol: 5c56ff5e66c76645ec98d972e5896151+0x6371c
exception.instruction: test byte ptr [eax + 0x1c], 0x10
exception.module: 5c56ff5e66c76645ec98d972e5896151.exe
exception.exception_code: 0xc0000005
exception.offset: 407324
exception.address: 0x46371c

success

1619513364.360408
__exception__

stacktrace:

0x36d41aa
0x3b2fe6c

registers.esp: 62061596
registers.edi: 0
registers.eax: 0
registers.ebp: 62061624
registers.edx: 0
registers.ebx: 0
registers.esi: 62061640
registers.ecx: 4294967294
exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44
exception.instruction: mov eax, dword ptr [eax + 0x3c]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x36d8e16

success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513305.532408 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00520000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513332.360408 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619513334.923408 RegSetValueExA	key_handle: 0x000003cc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619513334.923408 RegSetValueExA	key_handle: 0x000003cc value: pÍ£6;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619513334.923408 RegSetValueExA	key_handle: 0x000003cc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619513334.923408 RegSetValueExW	key_handle: 0x000003cc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619513334.923408 RegSetValueExA	key_handle: 0x000003e4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619513334.923408 RegSetValueExA	key_handle: 0x000003e4 value: pÍ£6;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619513334.923408 RegSetValueExA	key_handle: 0x000003e4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619513334.954408 RegSetValueExW	key_handle: 0x000003c8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

31.13.71.23:443

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Bkav	W32.FamVT.OqjketCH.Trojan
DrWeb	Trojan.DownLoader33.52076
MicroWorld-eScan	Trojan.GenericKD.33992259
FireEye	Trojan.GenericKD.33992259
McAfee	Fareit-FVP!5C56FF5E66C7
Cylance	Unsafe
Zillya	Downloader.Delf.Win32.59282
Sangfor	Malware
K7AntiVirus	Trojan-Downloader ( 00565f131 )
Alibaba	Backdoor:MSIL/Remcos.7d8f955a
K7GW	Trojan-Downloader ( 00565f131 )
Cybereason	malicious.e66c76
Arcabit	Trojan.Generic.D206AE43
Cyren	W32/Trojan.WDQF-5440
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/TrojanDownloader.Delf.CXM
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
BitDefender	Trojan.GenericKD.33992259
NANO-Antivirus	Trojan.Win32.Delf.hkzxva
Paloalto	generic.ml
Rising	Trojan.Generic@ML.100 (RDMK:sCsmaVJBiGrYtgyiqLkkYg)
Ad-Aware	Trojan.GenericKD.33992259
Sophos	Mal/Generic-S
Comodo	Malware@#2ei982cylnujk
F-Secure	Trojan.TR/Dldr.Delphi.tkcqw
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Backdoor.Win32.REMCOS.USMANEAGHC
McAfee-GW-Edition	Fareit-FVP!5C56FF5E66C7
Emsisoft	Trojan.GenericKD.33992259 (B)
Jiangmin	Backdoor.Remcos.bqm
Avira	TR/Dldr.Delphi.tkcqw
Antiy-AVL	Trojan[Backdoor]/Win32.Remcos
Gridinsoft	Ransom.Win32.Wacatac.vb
Microsoft	PWS:Win32/Fareit.ART!MTB
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Trojan.GenericKD.33992259
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Delf.R339814
VBA32	Trojan.Wacatac
MAX	malware (ai score=81)
Malwarebytes	Trojan.Downloader
TrendMicro-HouseCall	Backdoor.Win32.REMCOS.USMANEAGHC
Tencent	Win32.Backdoor.Remcos.Sxes
Yandex	Trojan.DL.Delf!OcmKzEGRcgc
Ikarus	Trojan-Downloader.Win32.Delf
MaxSecure	Virus.W32.Lamer.I
Fortinet	W32/Delf.BZL!tr
Webroot	W32.Trojan.Gen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library oleaut32.dll:

• 0x4ac838 SysFreeString

• 0x4ac83c SysReAllocStringLen

• 0x4ac840 SysAllocStringLen

Library advapi32.dll:

• 0x4ac848 RegQueryValueExA

• 0x4ac84c RegOpenKeyExA

• 0x4ac850 RegCloseKey

Library user32.dll:

• 0x4ac858 GetKeyboardType

• 0x4ac85c DestroyWindow

• 0x4ac860 LoadStringA

• 0x4ac864 MessageBoxA

• 0x4ac868 CharNextA

Library kernel32.dll:

• 0x4ac870 GetACP

• 0x4ac874 Sleep

• 0x4ac878 VirtualFree

• 0x4ac87c VirtualAlloc

• 0x4ac880 GetCurrentThreadId

• 0x4ac884 InterlockedDecrement

• 0x4ac888 InterlockedIncrement

• 0x4ac88c VirtualQuery

• 0x4ac890 WideCharToMultiByte

• 0x4ac894 MultiByteToWideChar

• 0x4ac898 lstrlenA

• 0x4ac89c lstrcpynA

• 0x4ac8a0 LoadLibraryExA

• 0x4ac8a4 GetThreadLocale

• 0x4ac8a8 GetStartupInfoA

• 0x4ac8ac GetProcAddress

• 0x4ac8b0 GetModuleHandleA

• 0x4ac8b4 GetModuleFileNameA

• 0x4ac8b8 GetLocaleInfoA

• 0x4ac8bc GetCommandLineA

• 0x4ac8c0 FreeLibrary

• 0x4ac8c4 FindFirstFileA

• 0x4ac8c8 FindClose

• 0x4ac8cc ExitProcess

• 0x4ac8d0 CompareStringA

• 0x4ac8d4 WriteFile

• 0x4ac8d8 UnhandledExceptionFilter

• 0x4ac8dc RtlUnwind

• 0x4ac8e0 RaiseException

• 0x4ac8e4 GetStdHandle

Library kernel32.dll:

• 0x4ac8ec TlsSetValue

• 0x4ac8f0 TlsGetValue

• 0x4ac8f4 LocalAlloc

• 0x4ac8f8 GetModuleHandleA

Library user32.dll:

• 0x4ac900 CreateWindowExA

• 0x4ac904 WindowFromPoint

• 0x4ac908 WaitMessage

• 0x4ac90c UpdateWindow

• 0x4ac910 UnregisterClassA

• 0x4ac914 UnhookWindowsHookEx

• 0x4ac918 TranslateMessage

• 0x4ac91c TranslateMDISysAccel

• 0x4ac920 TrackPopupMenu

• 0x4ac924 SystemParametersInfoA

• 0x4ac928 ShowWindow

• 0x4ac92c ShowScrollBar

• 0x4ac930 ShowOwnedPopups

• 0x4ac934 SetWindowsHookExA

• 0x4ac938 SetWindowTextA

• 0x4ac93c SetWindowPos

• 0x4ac940 SetWindowPlacement

• 0x4ac944 SetWindowLongW

• 0x4ac948 SetWindowLongA

• 0x4ac94c SetTimer

• 0x4ac950 SetScrollRange

• 0x4ac954 SetScrollPos

• 0x4ac958 SetScrollInfo

• 0x4ac95c SetRect

• 0x4ac960 SetPropA

• 0x4ac964 SetParent

• 0x4ac968 SetMenuItemInfoA

• 0x4ac96c SetMenu

• 0x4ac970 SetForegroundWindow

• 0x4ac974 SetFocus

• 0x4ac978 SetCursor

• 0x4ac97c SetClipboardData

• 0x4ac980 SetClassLongA

• 0x4ac984 SetCapture

• 0x4ac988 SetActiveWindow

• 0x4ac98c SendMessageW

• 0x4ac990 SendMessageA

• 0x4ac994 ScrollWindow

• 0x4ac998 ScreenToClient

• 0x4ac99c RemovePropA

• 0x4ac9a0 RemoveMenu

• 0x4ac9a4 ReleaseDC

• 0x4ac9a8 ReleaseCapture

• 0x4ac9ac RegisterWindowMessageA

• 0x4ac9b0 RegisterClipboardFormatA

• 0x4ac9b4 RegisterClassA

• 0x4ac9b8 RedrawWindow

• 0x4ac9bc PtInRect

• 0x4ac9c0 PostQuitMessage

• 0x4ac9c4 PostMessageA

• 0x4ac9c8 PeekMessageW

• 0x4ac9cc PeekMessageA

• 0x4ac9d0 OpenClipboard

• 0x4ac9d4 OffsetRect

• 0x4ac9d8 OemToCharA

• 0x4ac9dc MessageBoxA

• 0x4ac9e0 MessageBeep

• 0x4ac9e4 MapWindowPoints

• 0x4ac9e8 MapVirtualKeyA

• 0x4ac9ec LoadStringA

• 0x4ac9f0 LoadKeyboardLayoutA

• 0x4ac9f4 LoadIconA

• 0x4ac9f8 LoadCursorA

• 0x4ac9fc LoadBitmapA

• 0x4aca00 KillTimer

• 0x4aca04 IsZoomed

• 0x4aca08 IsWindowVisible

• 0x4aca0c IsWindowUnicode

• 0x4aca10 IsWindowEnabled

• 0x4aca14 IsWindow

• 0x4aca18 IsRectEmpty

• 0x4aca1c IsIconic

• 0x4aca20 IsDialogMessageW

• 0x4aca24 IsDialogMessageA

• 0x4aca28 IsChild

• 0x4aca2c InvalidateRect

• 0x4aca30 IntersectRect

• 0x4aca34 InsertMenuItemA

• 0x4aca38 InsertMenuA

• 0x4aca3c InflateRect

• 0x4aca40 GetWindowThreadProcessId

• 0x4aca44 GetWindowTextA

• 0x4aca48 GetWindowRect

• 0x4aca4c GetWindowPlacement

• 0x4aca50 GetWindowLongW

• 0x4aca54 GetWindowLongA

• 0x4aca58 GetWindowDC

• 0x4aca5c GetTopWindow

• 0x4aca60 GetSystemMetrics

• 0x4aca64 GetSystemMenu

• 0x4aca68 GetSysColorBrush

• 0x4aca6c GetSysColor

• 0x4aca70 GetSubMenu

• 0x4aca74 GetScrollRange

• 0x4aca78 GetScrollPos

• 0x4aca7c GetScrollInfo

• 0x4aca80 GetPropA

• 0x4aca84 GetParent

• 0x4aca88 GetWindow

• 0x4aca8c GetMessageTime

• 0x4aca90 GetMessagePos

• 0x4aca94 GetMenuStringA

• 0x4aca98 GetMenuState

• 0x4aca9c GetMenuItemInfoA

• 0x4acaa0 GetMenuItemID

• 0x4acaa4 GetMenuItemCount

• 0x4acaa8 GetMenu

• 0x4acaac GetLastActivePopup

• 0x4acab0 GetKeyboardState

• 0x4acab4 GetKeyboardLayoutNameA

• 0x4acab8 GetKeyboardLayoutList

• 0x4acabc GetKeyboardLayout

• 0x4acac0 GetKeyState

• 0x4acac4 GetKeyNameTextA

• 0x4acac8 GetIconInfo

• 0x4acacc GetForegroundWindow

• 0x4acad0 GetFocus

• 0x4acad4 GetDlgItem

• 0x4acad8 GetDesktopWindow

• 0x4acadc GetDCEx

• 0x4acae0 GetDC

• 0x4acae4 GetCursorPos

• 0x4acae8 GetCursor

• 0x4acaec GetClipboardData

• 0x4acaf0 GetClientRect

• 0x4acaf4 GetClassLongA

• 0x4acaf8 GetClassInfoA

• 0x4acafc GetCapture

• 0x4acb00 GetActiveWindow

• 0x4acb04 FrameRect

• 0x4acb08 FindWindowA

• 0x4acb0c FillRect

• 0x4acb10 EqualRect

• 0x4acb14 EnumWindows

• 0x4acb18 EnumThreadWindows

• 0x4acb1c EnumClipboardFormats

• 0x4acb20 EnumChildWindows

• 0x4acb24 EndPaint

• 0x4acb28 EnableWindow

• 0x4acb2c EnableScrollBar

• 0x4acb30 EnableMenuItem

• 0x4acb34 EmptyClipboard

• 0x4acb38 DrawTextA

• 0x4acb3c DrawMenuBar

• 0x4acb40 DrawIconEx

• 0x4acb44 DrawIcon

• 0x4acb48 DrawFrameControl

• 0x4acb4c DrawFocusRect

• 0x4acb50 DrawEdge

• 0x4acb54 DispatchMessageW

• 0x4acb58 DispatchMessageA

• 0x4acb5c DestroyWindow

• 0x4acb60 DestroyMenu

• 0x4acb64 DestroyIcon

• 0x4acb68 DestroyCursor

• 0x4acb6c DeleteMenu

• 0x4acb70 DefWindowProcA

• 0x4acb74 DefMDIChildProcA

• 0x4acb78 DefFrameProcA

• 0x4acb7c CreatePopupMenu

• 0x4acb80 CreateMenu

• 0x4acb84 CreateIcon

• 0x4acb88 CloseClipboard

• 0x4acb8c ClientToScreen

• 0x4acb90 CheckMenuItem

• 0x4acb94 CallWindowProcA

• 0x4acb98 CallNextHookEx

• 0x4acb9c BeginPaint

• 0x4acba0 CharNextA

• 0x4acba4 CharLowerBuffA

• 0x4acba8 CharLowerA

• 0x4acbac CharUpperBuffA

• 0x4acbb0 CharToOemA

• 0x4acbb4 AdjustWindowRectEx

• 0x4acbb8 ActivateKeyboardLayout

Library gdi32.dll:

• 0x4acbc0 UnrealizeObject

• 0x4acbc4 StretchBlt

• 0x4acbc8 SetWindowOrgEx

• 0x4acbcc SetWinMetaFileBits

• 0x4acbd0 SetViewportOrgEx

• 0x4acbd4 SetTextColor

• 0x4acbd8 SetStretchBltMode

• 0x4acbdc SetROP2

• 0x4acbe0 SetPixel

• 0x4acbe4 SetMapMode

• 0x4acbe8 SetEnhMetaFileBits

• 0x4acbec SetDIBColorTable

• 0x4acbf0 SetBrushOrgEx

• 0x4acbf4 SetBkMode

• 0x4acbf8 SetBkColor

• 0x4acbfc SelectPalette

• 0x4acc00 SelectObject

• 0x4acc04 SaveDC

• 0x4acc08 RestoreDC

• 0x4acc0c Rectangle

• 0x4acc10 RectVisible

• 0x4acc14 RealizePalette

• 0x4acc18 Polyline

• 0x4acc1c PlayEnhMetaFile

• 0x4acc20 PatBlt

• 0x4acc24 MoveToEx

• 0x4acc28 MaskBlt

• 0x4acc2c LineTo

• 0x4acc30 LPtoDP

• 0x4acc34 IntersectClipRect

• 0x4acc38 GetWindowOrgEx

• 0x4acc3c GetWinMetaFileBits

• 0x4acc40 GetTextMetricsA

• 0x4acc44 GetTextExtentPointA

• 0x4acc48 GetTextExtentPoint32A

• 0x4acc4c GetSystemPaletteEntries

• 0x4acc50 GetStockObject

• 0x4acc54 GetRgnBox

• 0x4acc58 GetPixel

• 0x4acc5c GetPaletteEntries

• 0x4acc60 GetObjectA

• 0x4acc64 GetEnhMetaFilePaletteEntries

• 0x4acc68 GetEnhMetaFileHeader

• 0x4acc6c GetEnhMetaFileDescriptionA

• 0x4acc70 GetEnhMetaFileBits

• 0x4acc74 GetDeviceCaps

• 0x4acc78 GetDIBits

• 0x4acc7c GetDIBColorTable

• 0x4acc80 GetDCOrgEx

• 0x4acc84 GetCurrentPositionEx

• 0x4acc88 GetClipBox

• 0x4acc8c GetBrushOrgEx

• 0x4acc90 GetBitmapBits

• 0x4acc94 ExtTextOutA

• 0x4acc98 ExcludeClipRect

• 0x4acc9c DeleteObject

• 0x4acca0 DeleteEnhMetaFile

• 0x4acca4 DeleteDC

• 0x4acca8 CreateSolidBrush

• 0x4accac CreatePenIndirect

• 0x4accb0 CreatePalette

• 0x4accb4 CreateHalftonePalette

• 0x4accb8 CreateFontIndirectA

• 0x4accbc CreateEnhMetaFileA

• 0x4accc0 CreateDIBitmap

• 0x4accc4 CreateDIBSection

• 0x4accc8 CreateCompatibleDC

• 0x4acccc CreateCompatibleBitmap

• 0x4accd0 CreateBrushIndirect

• 0x4accd4 CreateBitmap

• 0x4accd8 CopyEnhMetaFileA

• 0x4accdc CloseEnhMetaFile

• 0x4acce0 BitBlt

Library version.dll:

• 0x4acce8 VerQueryValueA

• 0x4accec GetFileVersionInfoSizeA

• 0x4accf0 GetFileVersionInfoA

Library kernel32.dll:

• 0x4accf8 lstrcpyA

• 0x4accfc lstrcmpA

• 0x4acd00 WriteFile

• 0x4acd04 WaitForSingleObject

• 0x4acd08 VirtualQuery

• 0x4acd0c VirtualProtect

• 0x4acd10 VirtualAlloc

• 0x4acd14 SizeofResource

• 0x4acd18 SetThreadLocale

• 0x4acd1c SetFilePointer

• 0x4acd20 SetEvent

• 0x4acd24 SetErrorMode

• 0x4acd28 SetEndOfFile

• 0x4acd2c ResetEvent

• 0x4acd30 ReadFile

• 0x4acd34 MultiByteToWideChar

• 0x4acd38 MulDiv

• 0x4acd3c LockResource

• 0x4acd40 LoadResource

• 0x4acd44 LoadLibraryA

• 0x4acd48 LeaveCriticalSection

• 0x4acd4c InitializeCriticalSection

• 0x4acd50 GlobalUnlock

• 0x4acd54 GlobalSize

• 0x4acd58 GlobalLock

• 0x4acd5c GlobalFree

• 0x4acd60 GlobalFindAtomA

• 0x4acd64 GlobalDeleteAtom

• 0x4acd68 GlobalAlloc

• 0x4acd6c GlobalAddAtomA

• 0x4acd70 GetVersionExA

• 0x4acd74 GetVersion

• 0x4acd78 GetUserDefaultLCID

• 0x4acd7c GetTickCount

• 0x4acd80 GetThreadLocale

• 0x4acd84 GetStdHandle

• 0x4acd88 GetProcAddress

• 0x4acd8c GetModuleHandleA

• 0x4acd90 GetModuleFileNameA

• 0x4acd94 GetLocaleInfoA

• 0x4acd98 GetLocalTime

• 0x4acd9c GetLastError

• 0x4acda0 GetFullPathNameA

• 0x4acda4 GetDiskFreeSpaceA

• 0x4acda8 GetDateFormatA

• 0x4acdac GetCurrentThreadId

• 0x4acdb0 GetCurrentProcessId

• 0x4acdb4 GetComputerNameA

• 0x4acdb8 GetCPInfo

• 0x4acdbc FreeResource

• 0x4acdc0 InterlockedExchange

• 0x4acdc4 FreeLibrary

• 0x4acdc8 FormatMessageA

• 0x4acdcc FindResourceA

• 0x4acdd0 EnumCalendarInfoA

• 0x4acdd4 EnterCriticalSection

• 0x4acdd8 DeleteCriticalSection

• 0x4acddc CreateThread

• 0x4acde0 CreateFileA

• 0x4acde4 CreateEventA

• 0x4acde8 CompareStringA

• 0x4acdec CloseHandle

Library advapi32.dll:

• 0x4acdf4 RegQueryValueExA

• 0x4acdf8 RegOpenKeyExA

• 0x4acdfc RegFlushKey

• 0x4ace00 RegCloseKey

Library oleaut32.dll:

• 0x4ace08 GetErrorInfo

• 0x4ace0c GetActiveObject

• 0x4ace10 SysFreeString

Library ole32.dll:

• 0x4ace18 CreateStreamOnHGlobal

• 0x4ace1c IsAccelerator

• 0x4ace20 OleDraw

• 0x4ace24 OleSetMenuDescriptor

• 0x4ace28 CoTaskMemFree

• 0x4ace2c ProgIDFromCLSID

• 0x4ace30 StringFromCLSID

• 0x4ace34 CoCreateInstance

• 0x4ace38 CoGetClassObject

• 0x4ace3c CoUninitialize

• 0x4ace40 CoInitialize

• 0x4ace44 IsEqualGUID

Library kernel32.dll:

• 0x4ace4c Sleep

Library oleaut32.dll:

• 0x4ace54 SafeArrayPtrOfIndex

• 0x4ace58 SafeArrayGetUBound

• 0x4ace5c SafeArrayGetLBound

• 0x4ace60 SafeArrayCreate

• 0x4ace64 VariantChangeType

• 0x4ace68 VariantCopy

• 0x4ace6c VariantClear

• 0x4ace70 VariantInit

Library comctl32.dll:

• 0x4ace78 _TrackMouseEvent

• 0x4ace7c ImageList_SetIconSize

• 0x4ace80 ImageList_GetIconSize

• 0x4ace84 ImageList_Write

• 0x4ace88 ImageList_Read

• 0x4ace8c ImageList_DragShowNolock

• 0x4ace90 ImageList_DragMove

• 0x4ace94 ImageList_DragLeave

• 0x4ace98 ImageList_DragEnter

• 0x4ace9c ImageList_EndDrag

• 0x4acea0 ImageList_BeginDrag

• 0x4acea4 ImageList_Remove

• 0x4acea8 ImageList_DrawEx

• 0x4aceac ImageList_Draw

• 0x4aceb0 ImageList_GetBkColor

• 0x4aceb4 ImageList_SetBkColor

• 0x4aceb8 ImageList_Add

• 0x4acebc ImageList_GetImageCount

• 0x4acec0 ImageList_Destroy

• 0x4acec4 ImageList_Create

Library comdlg32.dll:

• 0x4acecc GetSaveFileNameA

• 0x4aced0 GetOpenFileNameA

Library advapi32.dll:

• 0x4aced8 QueryServiceStatus

• 0x4acedc OpenServiceA

• 0x4acee0 OpenSCManagerA

• 0x4acee4 CloseServiceHandle

Library URL.DLL:

• 0x4aceec InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
drive.google.com	A 31.13.71.23	31.13.71.23
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.