1.1
低危

0f69e72ca85764ad176bc0e0c42d424a1547c0d68ef2af648789d386b9af6f43

0f69e72ca85764ad176bc0e0c42d424a1547c0d68ef2af648789d386b9af6f43.exe

分析耗时

193s

最近分析

371天前

文件大小

30.4KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER UPATRE
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.67
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Agent-AUID [Trj] 20200422 18.4.3895.0
Baidu Win32.Trojan-Downloader.Waski.a 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200423 2013.8.14.323
McAfee Downloader-FGQ!5E2F0CEEB885 20200423 6.0.6.653
Tencent Trojan.Win32.Bublik.burh 20200423 1.0.0.1
静态指标
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00000efc', 'size_of_data': '0x00001000', 'entropy': 6.867463969308896} entropy 6.867463969308896 description 发现高熵的节
entropy 0.23529411764705882 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意 (50 out of 62 个事件)
APEX Malicious
AVG Win32:Agent-AUID [Trj]
Acronis suspicious
Ad-Aware Trojan.Upatre.Gen.3
AhnLab-V3 Trojan/Win32.Bublik.C243177
Antiy-AVL Trojan/Win32.Bublik
Arcabit Trojan.Upatre.Gen.3
Avast Win32:Agent-AUID [Trj]
Avira TR/Dropper.Gen
Baidu Win32.Trojan-Downloader.Waski.a
BitDefender Trojan.Upatre.Gen.3
BitDefenderTheta Gen:NN.ZexaF.34106.bqY@aOUkIyni
Bkav W32.FamVT.GeND.Trojan
CAT-QuickHeal TrojanDownloader.Upatre.A4
CMC Trojan.Win32.Bublik!O
ClamAV Win.Trojan.Downloader-62779
Comodo TrojWare.Win32.Spy.Zbot.XGXB@56ryk0
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.eb885f
Cylance Unsafe
Cyren W32/A-e8a0dbfc!Eldorado
DrWeb Trojan.DownLoad3.28161
ESET-NOD32 Win32/TrojanDownloader.Waski.A
Emsisoft Trojan.Upatre.Gen.3 (B)
Endgame malicious (high confidence)
F-Prot W32/A-e8a0dbfc!Eldorado
F-Secure Trojan.TR/Dropper.Gen
FireEye Generic.mg.5e2f0ceeb885f71c
Fortinet W32/Waski.A!tr
GData Trojan.Upatre.Gen.3
Ikarus Trojan-Spy.Zbot
Invincea heuristic
Jiangmin Trojan/Bublik.gsj
K7AntiVirus Trojan-Downloader ( 0048f6391 )
K7GW Trojan-Downloader ( 0048f6391 )
Kaspersky Trojan.Win32.Bublik.burd
MAX malware (ai score=86)
Malwarebytes Spyware.Zbot
MaxSecure Trojan.Upatre.Gen
McAfee Downloader-FGQ!5E2F0CEEB885
McAfee-GW-Edition BehavesLike.Win32.PWSZbot.nm
MicroWorld-eScan Trojan.Upatre.Gen.3
Microsoft PWS:Win32/Zbot.MS!MTB
NANO-Antivirus Trojan.Win32.DownLoad3.csplaw
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM02.0.C09D.Malware.Gen
Rising Spyware.Zbot!8.16B (RDMK:cmRtazo76TcFSaHX7iXQjZk+Mg0n)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/DwnLdr-LHL
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2014-01-16 16:59:27

PE Imphash

c626dccf7fb6f72d572fabe34daf0ccc

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00000efc 0x00001000 6.867463969308896
.rdata 0x00002000 0x00000944 0x00000a00 5.312126111158428
.data 0x00003000 0x00000430 0x00000200 4.010685037734623
.rsrc 0x00004000 0x00002678 0x00002800 4.774966130968202

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00004238 0x00002428 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x00006660 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MANIFEST 0x000040f0 0x00000148 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library USER32.dll:
0x502070 ModifyMenuA
0x502074 RemoveMenu
0x502078 EndDialog
0x50207c SetWindowTextA
0x502080 SetScrollInfo
0x502084 CheckMenuItem
0x502088 ReleaseDC
0x50208c GetDC
0x502090 MoveWindow
0x502094 GetClientRect
0x502098 EnableMenuItem
0x50209c GetMenuItemID
0x5020a0 DeferWindowPos
0x5020a4 EndDeferWindowPos
0x5020ac SetMenuItemInfoA
0x5020b0 LoadStringA
0x5020b4 InsertMenuItemA
0x5020b8 GetPropA
0x5020bc RemovePropA
0x5020c0 SetPropA
0x5020c4 ScrollWindow
0x5020c8 CreateCursor
0x5020cc DestroyCursor
0x5020d0 GetSubMenu
0x5020d4 BeginDeferWindowPos
0x5020dc ShowCursor
0x5020e4 AppendMenuA
0x5020e8 DragDetect
0x5020ec GetCapture
0x5020f4 ReleaseCapture
0x5020f8 FindWindowA
0x502100 CharUpperA
0x502104 DrawTextExA
0x502108 DialogBoxParamA
0x50210c DrawEdge
Library KERNEL32.dll:
0x502000 GetStartupInfoA
0x502004 MultiByteToWideChar
0x502008 lstrlen
0x50200c MapViewOfFile
0x502010 UnmapViewOfFile
0x502014 lstrlenA
0x502018 CloseHandle
0x50201c GetModuleHandleA
0x502020 GetProcAddress
0x502024 CreateDirectoryA
Library ole32.dll:
0x502114 CoInitialize
0x502118 CoUninitialize
0x50211c CoCreateInstanceEx
Library OLEAUT32.dll:
0x502064 SysAllocStringLen
0x502068 SysFreeString
Library MSVCRT.dll:
0x50202c _exit
0x502030 _controlfp
0x502034 _XcptFilter
0x502038 exit
0x50203c __p__acmdln
0x502040 __getmainargs
0x502044 _initterm
0x502048 __setusermatherr
0x50204c _adjust_fdiv
0x502050 __p__commode
0x502054 __p__fmode
0x502058 __set_app_type
0x50205c _except_handler3

L!This program cannot be run in DOS mode.
qHy'q&
qHy%q!
qHy#q&
qHy$q&
qRich'
`.rdata
@.data
uP uP uu
uPuP PU
Pu PuP
PPuP u
w^uuPuP
P PuuP
P PPuu
PP uu uPPu
PP PP u P
[uSAVWAf9
GGEGGEM;r
uPuuP u
FG3@_^]
uuuP P uPu
};7A1P]
-P6t)K
:OCtj8E2qm',L0
;W-tn.)
w%;R0FS
;PCej(\;kNw
j;Oquvyz6~
>"VUpuY+
*7V6E)
AAj%\aC
u)^nJs
HPw~#C{,
TO'4#v#>diL
vVL|6`
Vq^#@{ry)^cEA/Q
GHDI vU *h
&VafO-+
FJX}+5
,yASlvV6Ay
A>0K'vCJD,QTPF=XKL
X;k]3PtjR
#fdHtqw\#KJda,
jWnV2KC{
Ci/u+!i
,2sH ^
}/2qQZlnW
O vudS
<T!z)^CL
M|N~lf=
ll}T-nq`+6
5JfO{J7:'Ds
\SL76#C
A>0K! C8
})^+]kS
)>5$oK"#C\
fMiyF.|x
6]^B/rn
M- )NqSmi
)m#w&\w
@L8~PP
Puuuuu
IuX[_[+S
u uu uPuP uuP
FUjh(#P
QUREPMQ
<"u>"u
fFu%4 P
^0x[A-F0-9a-f]{1,8}$
0x8732ffda
!K;3`C
!KJ/W*`UE/UP;
C7(&&G:&:
1.+%W8=
4ZPUJ55D
N]8;`8
T([!%Q;YI0
A[G7VM
L'>1GX\[
F']+O
DrawEdge
DrawTextExA
CharUpperA
CreateAcceleratorTableA
FindWindowA
ReleaseCapture
CreateDialogIndirectParamA
GetCapture
DragDetect
AppendMenuA
RegisterWindowMessageA
ShowCursor
DestroyCursor
CreateCursor
ScrollWindow
SetPropA
RemovePropA
GetPropA
InsertMenuItemA
LoadStringA
SetMenuItemInfoA
TranslateAcceleratorA
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
EnableMenuItem
CheckMenuItem
DestroyAcceleratorTable
GetSubMenu
GetMenuItemID
ModifyMenuA
RemoveMenu
EndDialog
SetWindowTextA
SetScrollInfo
DialogBoxParamA
ReleaseDC
MoveWindow
GetClientRect
USER32.dll
CreateDirectoryA
MultiByteToWideChar
lstrlen
MapViewOfFile
UnmapViewOfFile
lstrlenA
CloseHandle
GetModuleHandleA
GetProcAddress
KERNEL32.dll
CoUninitialize
CoInitialize
CoCreateInstanceEx
ole32.dll
OLEAUT32.dll
_XcptFilter
__p__acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetStartupInfoA
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
KKMM""
uuDD--
117722
}}^^mm
@I'6*(******************++""
!!##**********************::v
@DZ5Lar|||
'@WmAYG_
_p\\\n
`s]]]m
C:\Documents and Settings\Administrator\
\fax.pdf.exe
C:\Documents and Settings\isarc\
\winupdate.exe
C:\Z5uuP8JD.exe
C:\2LoekZXy.exe
C:\FjVgg3P4.exe
C:\jAi0ymtm.exe
C:\651050a5d6a10f52a391470c8a81aff2b6977f76b04240fb332b9aa1404262ea
C:\b05d46a3da29e761bebe1a2a79047763a61fb8da52b71977af70eab74a7e6bab
C:\c7ed966181b0c783bfb4fcaeac992f9ae9c030d4dfd7e31b2ed0c1b170cf631e
C:\9fc8bfee9bfc3a79e5d67576eed0952b9fe3e191f1783c9645f229f31e4409c5
C:\hD_gSxby.exe
C:\n0mvhABH.exe
C:\7CQcpxL5.exe
C:\UmRIhDOP.exe
C:\jqJ6hb3C.exe
C:\EJmDSAU5.exe
C:\dpOu1RFs.exe
C:\gs9IFeTR.exe
C:\Kmb0zAe9.exe
C:\BThvloxE.exe
C:\Suwtgj5m.exe
C:\60b3833621efb1cfde62abc451beae77b54c4e0b5d0010423027b2e39784fe49
C:\42b77d0e984086cea116e29f9cebf9e3949539af2dbae4c7ed5753b34e1e7134
C:\_pi63yvz.exe
C:\AFyKfvDq.exe
C:\2AgXMNgn.exe
C:\MTB6ckpU.exe
C:\0cEEvzAZ.exe
C:\PIcDakAT.exe
C:\LQiwb9e_.exe
C:\fr87dSpX.exe
C:\4Y2bLiNc.exe
C:\khCE3HR9.exe
C:\7YpTwoCH.exe
C:\3JMLLcEg.exe
C:\3cd59bb3b692cf86ddddc1d39b0f314784c927d65abf45f84eb9190a62daebca
C:\ysdSmHie.exe
C:\AD_BEyij.exe
C:\YuiMKVMQ.exe
C:\e9c7a8072f079e7941ebf086f37080c5ef7324b4a6cae5272ab1ff7c91823fe9
C:\LDZwc76Y.exe
C:\xWuTA9YC.exe
C:\yItSIZIl.exe
C:\2AArkZFk.exe
C:\AaMbSGDQ.exe
C:\c16FKJHG.exe
C:\eYs_Emn1.exe
C:\9lS54mjt.exe
C:\iHwUgCyj.exe
C:\drWgFVv_.exe
C:\z0cJVvzo.exe
C:\FWV3aAmm.exe
C:\cR5NrlF0.exe
C:\E8CrWeBz.exe
C:\bnb3Op4a.exe
C:\fB0P2mZU.exe
C:\7I6_1wO5.exe
C:\KrmtpNpO.exe
C:\86VqtJw8.exe
C:\Wz0b_dpt.exe
C:\zRebALTI.exe
C:\4uQjwcUi.exe
C:\0jHdT68R.exe
C:\3lC5aP0R.exe
C:\kjnuDgT7.exe
C:\wztfUqei.exe
C:\28QW92lv.exe
C:\wGbpSefU.exe
C:\ka7nL8dU.exe
C:\lGUjBtaj.exe
C:\4W3pi9Ll.exe
C:\wjqBaLyI.exe
C:\DVV1bEDX.exe
C:\kUfZcNST.exe
C:\cdd1c3258dc736a3ce7255c8454c39e7b3130b21d30771f016e407107203ee21
C:\0of9bdrF.exe
C:\ZDr4xHSg.exe
C:\k7OPV8KH.exe
C:\SIpf6egk.exe
C:\GXBYbJR8.exe
C:\XP5jjBM4.exe
C:\n8oW_EfO.exe
C:\LsLxtEPP.exe
C:\nC0F_8Qg.exe
C:\Zjq0I2wL.exe
C:\NOmur18t.exe
C:\789c57e03060512c32eb6e6c3e04fcbf427bd51f1a45bcfb46c941a89cba747e
C:\FbiM4RBH.exe
C:\ufqolyrW.exe
C:\9f827ed7630222a60bad99fc3e8fe3f2520b812210a650c290f8dcd6d167c048
C:\c55862325ddf8afa1558ee0131ddf32db4b8432f16b713e7fff900503f9598f7
C:\daf3b92099799499d4bc871e8d9284aad534f34252214ddf1aff62ef8942e330
C:\f0197e78adcbc16d4d399658f88e6579aefaa403e78535f22f49bebc744762a3
C:\cY2WT2XW.exe
C:\AUanOhMS.exe
C:\y371vO43.exe
C:\Qu9k0fKx.exe
C:\ATLlujdx.exe
C:\tQFP8Hyn.exe
C:\JLpGbTh1.exe
C:\SJ_mDmUV.exe
C:\xsRSZ0Tx.exe
C:\7dMF4_sj.exe
C:\ygd4i1\gjazb3.exe
C:\gbO2jju0.exe
C:\603967647583e802448e4723b7aec3e3f942762c058d6e7f58619237fc8721c6
C:\f1ebc994f404b1fb0d9a5f37a5dfb3313eb9fd07b0a64c915c64661532f27ab2
C:\356db5545bdc42afc52471afc8768d9a97923468bd92c8df4881de7f9cc478ac
c:\work\2249224\6cb09a0a4d9f9f4de1a3469f0ccf297f.exe
C:\f72d76cfcedae97c1be2593e8b7c497460d65eb990de29832cbd9740d815adcb
C:\7f07d103e5d93d5dc80aaffc833320b02f243a627937e3c918e25be77f6854b6
C:\2bbcab129ae6aa3b08b70c515e47bedc1286554602ed8314019582a5af42659e
C:\0e4f400aed812bf5b1ad3b72d99c1ba8df1160c1e7ff0eab3611996939346e64
C:\MB9sctkO.exe
C:\33defb77717e3cda304316033dca5e67d930a028eda26746723d629e1c660365
C:\b0137c55cdf19057252238e16594e987c88dcad260b0bace21ee3301b7240a1a
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HtUBNnrEj.exe
C:\84bb00e49773c87de3545d49a5319a324af2038184576fcbf21bbbafb7654a72
C:\bbef9f2f2ba40ea4d3721aaaae12bc96add52be864324a6c0d5acf842b52cecc
C:\e5489a0ccb00879a3eb7201d95d812d553aab158bcccc108320e84be6f32782b
C:\3289ffc127db6804436885518b3969385ab4d74e55fe74e8a2ec5342b85b83bc
C:\Users\John\AppData\Local\Temp\joYjcwEoabeB.exe
C:\173ddeb63e9dd58a711c2dabf33590f6190f4aec2dc4c6088a4dfb260f5576fe
C:\4f55ac0a050334fd4af879d5a3f0eb1c24ff49b54e98dfbad708e1d5f22608cd
C:\67a55a3451a8cb758c062a0359f31136cb6dedb978795ed77370d748d5eb4994
C:\Users\admin\Downloads\winupdate.exe
C:\Users\Petra\AppData\Local\Temp\winupdate.pe32
C:\Users\admin\Downloads\ce09adf47aa0cc8b_winupdate.exe
C:\9fa1f0c7562b287a2252e2e4bfd96e493d47cad675615adecb16583a744ecb71
C:\Users\admin\Downloads\winupdate.exe
C:\7339d6e9ff1ea89a7644125778ee4cb0a23d34661b1d335d6a304c900c3cfa9c
C:\Users\Petra\AppData\Local\Temp\winupdate.pe32
C:\e37b651e0966eb1d1ed4af14d50ef8570e27ffc6e7bd0de397ac62f71ab82ba1
C:\dc8c8b862dccba77a60aa2fd934539551bbfe25bc90caec15ecd545c52bf9ea1
C:\Users\admin\Downloads\winupdate.exe
C:\d2e98d3eb7f34640954051be9823620e4ad474d97bbefc7e58a2bf473d56f21a
C:\Users\admin\Downloads\winupdate.exe
C:\6e2db72e26b00df6bd5fbeb58bcadcb71b615be6e8753a70d0023573e68e0af5
C:\e279ce24894a5022ebe1f1a3f2f9df47a6bc806ca37ff96e3bd85ecd74f7e289
C:\Users\admin\Downloads\winupdate.exe
C:\20a403a2b82646e6d21a28d282a9589bc2a6d75d9fb20fc66b43a3123563aef1
c:\task\4707EA709223BAC16863FE3F06E096C4.exe
c:\task\3DE4F0DF72DDCBB010C7A62AB99CDEC0.exe
c:\task\90FCEDA0C04EE8B3D041FAFE59909376.exe
C:\Users\Petra\AppData\Local\Temp\eb887cf9f05e6b49b3a6.pe32
C:\471e590a1cfea6eec16d0ae2f675a7880a1db330eee62fdb1f3aa4dfc29476a5
C:\Users\RA491~1.VUL\AppData\Local\Temp\21df7389ff78cd0cb3d4b268ab6a73f0.exe
C:\Users\admin\Downloads\winupdate.exe
C:\58099db4d9580028ece1f9e78a0ae8ac89afc3ea1c84faa9839e43f284d961a1
C:\Users\Petra\AppData\Local\Temp\winupdate.pe32
C:\c421714be5af35fbace7109f163ba60f0168a3bb366497362a68cfb9786f8933
C:\Users\admin\Downloads\winupdate.exe
C:\6017d58f08ebe278fe140af220f3e25ab07a04e5123d11b585b92205eaf8ce17
C:\Users\admin\Downloads\winupdate.exe
C:\7ca4da871f42015f044ac74acd57914a2f48306a1d9d2b0260aecb5c35a2003b
C:\6aa96ad819c8a737bd995301e2b4570ee977408d72f2401f17c2c0842cb55132
C:\Users\admin\Downloads\winupdate.exe
C:\df15526b4e9bdb20df3cbfda29bc8c8afb26152d9ecfb443334c1db796e83e9e
C:\42b7fdc4a903b12030a057fb20255c572676528520c367f10add26d3cbb3f5e0
C:\Users\admin\Downloads\winupdate.exe
C:\Users\admin\Downloads\7f764a95c63a7c5a05561ff3b3d36e90459a29a940c4d57a8bfbc5dd4d389748.exe
C:\Users\admin\Downloads\7cefb544cee2a8067265008d80d62ac9ed1b13fe858260e10ee20d59c8a0f76f.exe
C:\Users\admin\Downloads\68f3c7e4c3d53c121e439bec7f74344fac454f31bda154af42c86d4b473585bb.exe
C:\Users\admin\Downloads\94942d205e2d074d66743e48997908242cccaf096dde4756c0e04b71e5ac0fb5.exe
C:\7d66e6f18b675df6e97f2e0aa79ea713c69680dfbc51fa300cbe5e061f4b3edf
C:\Users\admin\Downloads\winupdate.exe
C:\Users\admin\Downloads\6fceebf6e16095b0a5ab964c6836e037a86d657aaab548b7e89ac88cf2eec218.exe
C:\8a408a7b0c0c6d03dcb60db5a0dd129b982d8f8a329b56fd807efce8cc26e6a6

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.