1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.61
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | VirTool:Win32/CeeInject.56125bb6 | 20190527 | 0.3.0.5 |
| Avast | Win32:DropperX-gen [Drp] | 20200608 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Inject.bm | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200608 | 2013.8.14.323 |
| McAfee | Downloader-BIJ.a | 20200608 | 6.0.6.653 |
| Tencent | Win32.Trojan-downloader.Agent.Sxox | 20200608 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x00002cc4', 'size_of_data': '0x00003000', 'entropy': 7.734115535813199} | entropy | 7.734115535813199 | description | 发现高熵的节 | |||||||||
| entropy | 0.42857142857142855 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.Injector |
| APEX | Malicious |
| AVG | Win32:DropperX-gen [Drp] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Razy.448218 |
| AhnLab-V3 | Backdoor/Win32.CSon.R885 |
| Alibaba | VirTool:Win32/CeeInject.56125bb6 |
| Antiy-AVL | Trojan[Downloader]/Win32.Rubinurd.b |
| Arcabit | Trojan.Razy.D6D6DA |
| Avast | Win32:DropperX-gen [Drp] |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan.Inject.bm |
| BitDefender | Gen:Variant.Razy.448218 |
| BitDefenderTheta | AI:Packer.54A3CF691F |
| ClamAV | Win.Trojan.Rubinurd-67 |
| Comodo | TrojWare.Win32.Toga.B@6vx8t0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.0a7a67 |
| Cylance | Unsafe |
| Cyren | W32/A-1a76837c!Eldorado |
| DrWeb | Win32.HLLW.Autoruner.27746 |
| ESET-NOD32 | Win32/TrojanDownloader.Agent.PTT |
| Emsisoft | Gen:Variant.Razy.448218 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/A-1a76837c!Eldorado |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.5f3f3980a7a67cd0 |
| Fortinet | W32/Injector.BFSU!tr |
| GData | Win32.Trojan.Agent.ASM |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Small.akba |
| K7AntiVirus | Trojan-Downloader ( 0040f54b1 ) |
| K7GW | Trojan-Downloader ( 000918cf1 ) |
| Kaspersky | HEUR:Trojan.Win32.Miancha.gen |
| Lionic | Trojan.Win32.Generic.lk0q |
| MAX | malware (ai score=88) |
| Malwarebytes | Backdoor.Simbot |
| McAfee | Downloader-BIJ.a |
| McAfee-GW-Edition | BehavesLike.Win32.Backdoor.nm |
| MicroWorld-eScan | Gen:Variant.Razy.448218 |
| Microsoft | VirTool:Win32/CeeInject.gen!DU |
| NANO-Antivirus | Trojan.Win32.Autoruner.bbwavd |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.C3A9.Malware.Gen |
| Rising | Dropper.Generic!8.35E (TFE:dGZlOgUzB9g24BWYcQ) |
| SUPERAntiSpyware | Backdoor.Bot/Variant |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/DwnLdr-MDK |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2010-09-07 10:27:10
PE Imphash
f54bab47f74e370cf85ce98d899e8149
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00001755 | 0x00002000 | 5.851216394804272 |
| .rdata | 0x00003000 | 0x000005a5 | 0x00001000 | 2.233959569513802 |
| .data | 0x00004000 | 0x00000593 | 0x00001000 | 1.1476625760781263 |
| .rsrc | 0x00005000 | 0x00002cc4 | 0x00003000 | 7.734115535813199 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_RCDATA | 0x000050b4 | 0x00002800 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x000078b4 | 0x00000410 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.dll:
• 0x40301c ExitProcess
• 0x403020 ReadFile
• 0x403024 HeapAlloc
• 0x403028 GetProcessHeap
• 0x40302c GetFileSize
• 0x403030 CopyFileA
• 0x403034 GetModuleFileNameA
• 0x403038 LeaveCriticalSection
• 0x40303c GetProcAddress
• 0x403040 EnterCriticalSection
• 0x403044 VirtualProtect
• 0x403048 InitializeCriticalSection
• 0x40304c GetModuleHandleA
• 0x403050 LockResource
• 0x403054 LoadResource
• 0x403058 SetFilePointer
• 0x40305c FindResourceA
• 0x403060 GetLastError
• 0x403064 MoveFileA
• 0x403068 DeleteFileA
• 0x40306c lstrcmpiA
• 0x403070 GetLongPathNameA
• 0x403074 ExpandEnvironmentStringsA
• 0x403078 GetTickCount
• 0x40307c OutputDebugStringA
• 0x403080 lstrlenA
• 0x403084 TerminateProcess
• 0x403088 VirtualAllocEx
• 0x40308c HeapFree
• 0x403090 VirtualAlloc
• 0x403094 Sleep
• 0x403098 lstrcpyA
• 0x40309c lstrcatA
• 0x4030a0 CreateFileA
• 0x4030a4 WriteFile
• 0x4030a8 CloseHandle
• 0x4030ac SizeofResource
• 0x4030b0 WinExec
Library ADVAPI32.dll:
• 0x403000 CloseServiceHandle
• 0x403004 CryptGenRandom
• 0x403008 CryptReleaseContext
• 0x40300c EnumServicesStatusA
• 0x403010 OpenSCManagerA
• 0x403014 CryptAcquireContextA
Exports
| Ordinal | Address | Name |
|---|---|---|
| 1 | 0x404240 | szFile |
L!This program cannot be run in DOS mode.
.rdata
@.data
3fj@3Yu
t ESPh
SVWj@3Y3j?fY3f^
EPEPhL@@
MSQEuPV
YYPV5X0@
ESPuW=0@
ESPuh$
ESPuh/
ESPuhl
;t$uuh
jfhL@@
_^3[UQQe
H<EHC@
X^UQQV5
WEWP}}
;t'EPEPEPh
3?;3j u
A(;r3_^[
(c03`:R
S[0-'~dx
5+SXI4
;' bRM
Yy~'zDEW
xbq3NA
vR%x9BV
46Cw9k'g
>fAqYcvne
9tl}ZFu'B
tT"/\cw&
Rn#x+w
%|H\'&b
R`%UfV
::IV`4
N yCJ
Y8![Qcm
.hi<=Pi
.SDOqXpr }
G$uNqO+/yq,[Nj
Yz>{p&94UasmA)
9m) !Sx'GW
}1Ji/vi
N*1ik8`pQ
1*{{Ps[jY2v
}&S8 =3&M
71X/]b
4hE2|u
|@^}1rBmH]cB
|_^[]UE
=;Q"F&
LZm yT
vk`:$8v
_"NjdeLt(-
s,*,[S
8+C$h\?n_
*ih'cWZ&J
2L\nrD
`_hp6VMVzO
MIJt*O"
Fetx,j
EE~cSVu
3fj@3Yj@fY3fj@3Yu
]f]@~)M
GEQ@9E|
3tESPPPPu
uRFGHt
t+t'NW8u
;uH_^Q=
r)$h%@
DDDDDDDDDDDDDD
WinExec
CloseHandle
WriteFile
CreateFileA
lstrcatA
lstrcpyA
SetFilePointer
ExitProcess
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CopyFileA
GetModuleFileNameA
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetLastError
MoveFileA
DeleteFileA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetTickCount
OutputDebugStringA
lstrlenA
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
KERNEL32.dll
wsprintfA
MessageBoxA
USER32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
StrChrA
PathRemoveFileSpecA
SHLWAPI.dll
roudanx.exe
szFile
)a.bat
del "%s" /a
move "%s" "%s"
del %%0
rwbinru/dyd
RT_RCDATA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
kernel32
szFile
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
ZwUnmapViewOfSection
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinHttp
Are you sure?
regedit.exe /s
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
D(6oS-feu5*
,\}V4/S;'
S_Fugh*1
hP*7m:'
3AWIlt\RB
x /~!G
Ce8h[b
_D^$/y4Glv vQ
]h4Z1U
]7&8.6'#Z{
vH Bs!ws-:J
@ta!,W6jtK2iWf~
`uAQeSl)
jJ"nJhe
C)Iw)%Z
D7qzfwOzn*
` Q6@Bt
ceN eeL6*p+
-g^,*g"t
!)iBnAjh&7^Y#,o
-@<1]4
JD$y@(
3'IX`NyA
hODD?|7<
>pQNkIBj.hu4
4XwfBYh
pJ"uF}
J~mr#SVl{"r
LreZ35&Kv
2J{x~z(
N_GO&!49CT2
-o@5j9
CL0hu
+kQM<BK@{DCOF
,mUl]m7vv"
+|+.Alf5
N 1W@(B
?_9]'PA
Q8KhY8P@\*c
#]PZ"
\)h3*enh+P
Mq7;4D&G
Cz ~Wo+d1f'{T
iR*P*z!
tQ8atp_~(I
7V?uT- JF]
S~cIu!=!.@;$
*2'1!$qu
!On\Jo6hWo;WZ
^[ Qf%sqvI\dT
EU6"2:Se
vXM?-:.>
EqDrqj_
GPPCuTz-,#S
v(C JX1pb4}+
jp/TC>ZUa$^._>^
12O1O/"G@lR
[<l3B<G
'R'>"J#&^
x"s1+&,i
|MuA]Q6
da-p%gb
tN3ws)3c
RZ<5"xl
^1HinO
HAxY{@t
Uy1GUNy
0+oRa"s
>4}YXh
hdEJ-+ [U8
xC q{#i\G*
yHzdtu1i{
@5pRArVQC|L
mg["U b
9d?w rl[aZW>e
P>Zct5
(;R*.x
#|]wNQ| uzt7
7m=#<9
8u$<s d^
7&h0}Uv8
5VH}0"
2p /8V
!~OX+s&RVm)CsFy
sdJ4 B
c5HZ$pIAFRfab0
Fd/AdZgl`
k4P^}>.3C6fL
-+XVtm
z1C<%v
yv'mZrE
P?7-fG[b
b=P$e>\zOb
sLP Q9-W=^*jr
SEkxTW
)bb+*r87
-DN} vgqK*
uqt`{Sh.
|K:JIpI|}5
<]W3/@Y-w
Kzl!$%
T:#1OBK(p/m
=A9u(0
g:9_0`
!L"A>Glmd
^$nZN O>
RNBUauc!;w%
"m5J<i|G7
f\{;?k=|L0NS
1?+;d=
Q( $c
F4}05^t
VX)BAo&n^Q9IF-<*t'tsDf Hl%
)/$/bd;I
edfd#Rv.?yqVV
}zY(q6yiI11
;3tL"w(
emNKP=N2
NBK)-10:(nX3XL)T
Qe~ X`
4Dijj[
k{]r9?E[YIGR
o3 8r
y!d.KC>2
WQQ(&`Y=
eInZ@C
N0T9s~nZxm
5DfWBr?
M6s)lFU<.w
%!g6x
<(4HQu-
>|F|X6;B#f~s[+
7Lx4tpG
CL P`U_
cm2}{mf
igH{=Ps.&
I(W4S`do
lQuOtYx
K9(Pi-1
pIaV?:
&<L`%\4B&iR
n *K[h4
,A>q/kt
<Pu][6&g
E@4\g0@9
'oz#PK;
]AK-03
P@r 4:wr
b4FGnk6&|azM
=2cq`t<m`Q
(|d)U
SE<MQIm
Q&v')Xd
]*&[|~
#.#^G0/gi$
g#DIl*DmG&GV)nTT
(=DSL5Mg
IiV'%01kC
9jH;0BA
rH7W7N
q%_lb L
,/Q7M'=F
'z#BJEr
TADIhscsF^
xe@"C:
qJxS$+%v~];Q
!!zmrea
Jq8?&p
mi{] j
X`a;>m\
fIJ!%5PHJ
h((T2
W'-O.
>C)<5Q
tK5@d/zP#:
1>7<l/ZtH%+R
v<:D.IQ`OF>g,HFFvQv&S7N
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
R T _ R C D A T A
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 b 0
C o m p a n y N a m e
A d o b e S y s t e m s , I n c .
F i l e D e s c r i p t i o n
A d o b e ? F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r 1 0 . 1 r 5 3
F i l e V e r s i o n
1 0 , 1 , 5 3 , 6 4
I n t e r n a l N a m e
A d o b e ? F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r 1 0 . 1
L e g a l C o p y r i g h t
C o p y r i g h t ? 1 9 9 6 - 2 0 1 0 A d o b e , I n c .
L e g a l T r a d e m a r k s
A d o b e ? F l a s h ? P l a y e r
O r i g i n a l F i l e n a m e
F l a s h U t i l . e x e
P r o d u c t N a m e
F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r
P r o d u c t V e r s i o n
1 0 , 1 , 5 3 , 6 4
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.