SmartHawk

9.2

极危

59 个模型检测该样本为恶意！

重新分析

下载样本

a327d63bea241fd175c5dda029f2cf997e13565393c5d0bf0f7ce4df5c7a7bb1

632cdeb4b603df4ca0d77ebf4ba4d240.exe

分析耗时

101s

最近分析

文件大小

654.5KB

静态报毒动态报毒 0NA103HP20 100% ACFK AI SCORE=87 BUTV6Q CONFIDENCE FAREIT FORMBOK FORMBOOK GENERICKD HIGH CONFIDENCE HSUTPR IGENT KCLOUD KRYPTIK LFCWC MALICIOUS PE MALWARE@#3VMLJ8L7WJPLA PWSX QJPD R + TROJ R348928 SCORE SIGGEN10 STATIC AI SUSGEN TSCOPE UNSAFE WLPK YAKBEEXMSIL ZMUTZY 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/FormBook.abc88128	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20201122	20.10.5736.0
Kingsoft	Win32.Troj.Undef.(kcloud)	20201122	2017.9.26.565
McAfee	Fareit-FYV!632CDEB4B603	20201120	6.0.6.653
Tencent	Msil.Trojan.Crypt.Wlpk	20201122	1.0.0.1

Checks if process is being debugged by a debugger (50 out of 68 个事件)

Time & API	Arguments	Status	Return	Repeated
1619633903.320501 IsDebuggerPresent		failed	0	0
1619633903.320501 IsDebuggerPresent		failed	0	0
1619633945.961501 IsDebuggerPresent		failed	0	0
1619633946.461501 IsDebuggerPresent		failed	0	0
1619633946.961501 IsDebuggerPresent		failed	0	0
1619633947.461501 IsDebuggerPresent		failed	0	0
1619633947.961501 IsDebuggerPresent		failed	0	0
1619633948.461501 IsDebuggerPresent		failed	0	0
1619633948.961501 IsDebuggerPresent		failed	0	0
1619633949.461501 IsDebuggerPresent		failed	0	0
1619633949.961501 IsDebuggerPresent		failed	0	0
1619633950.461501 IsDebuggerPresent		failed	0	0
1619633950.961501 IsDebuggerPresent		failed	0	0
1619633951.461501 IsDebuggerPresent		failed	0	0
1619633951.961501 IsDebuggerPresent		failed	0	0
1619633952.461501 IsDebuggerPresent		failed	0	0
1619633952.961501 IsDebuggerPresent		failed	0	0
1619633953.461501 IsDebuggerPresent		failed	0	0
1619633953.961501 IsDebuggerPresent		failed	0	0
1619633954.461501 IsDebuggerPresent		failed	0	0
1619633954.961501 IsDebuggerPresent		failed	0	0
1619633955.461501 IsDebuggerPresent		failed	0	0
1619633955.961501 IsDebuggerPresent		failed	0	0
1619633956.461501 IsDebuggerPresent		failed	0	0
1619633956.961501 IsDebuggerPresent		failed	0	0
1619633957.461501 IsDebuggerPresent		failed	0	0
1619633957.961501 IsDebuggerPresent		failed	0	0
1619633958.461501 IsDebuggerPresent		failed	0	0
1619633958.961501 IsDebuggerPresent		failed	0	0
1619633959.461501 IsDebuggerPresent		failed	0	0
1619633959.961501 IsDebuggerPresent		failed	0	0
1619633960.461501 IsDebuggerPresent		failed	0	0
1619633960.961501 IsDebuggerPresent		failed	0	0
1619633961.461501 IsDebuggerPresent		failed	0	0
1619633961.961501 IsDebuggerPresent		failed	0	0
1619633962.461501 IsDebuggerPresent		failed	0	0
1619633962.961501 IsDebuggerPresent		failed	0	0
1619633963.461501 IsDebuggerPresent		failed	0	0
1619633963.961501 IsDebuggerPresent		failed	0	0
1619633964.461501 IsDebuggerPresent		failed	0	0
1619633964.961501 IsDebuggerPresent		failed	0	0
1619633965.461501 IsDebuggerPresent		failed	0	0
1619633965.961501 IsDebuggerPresent		failed	0	0
1619633966.461501 IsDebuggerPresent		failed	0	0
1619633966.961501 IsDebuggerPresent		failed	0	0
1619633967.461501 IsDebuggerPresent		failed	0	0
1619633967.961501 IsDebuggerPresent		failed	0	0
1619633968.461501 IsDebuggerPresent		failed	0	0
1619633968.961501 IsDebuggerPresent		failed	0	0
1619633969.461501 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619633903.336501 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 97 个事件)

Time & API	Arguments	Status	Return
1619633902.430501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x008a0000	success	0
1619633902.430501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a60000	success	0
1619633903.055501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02030000	success	0
1619633903.055501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02210000	success	0
1619633903.086501 NtProtectVirtualMemory	process_identifier: 1908 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619633903.320501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02030000	success	0
1619633903.320501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02130000	success	0
1619633903.320501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0048a000	success	0
1619633903.320501 NtProtectVirtualMemory	process_identifier: 1908 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619633903.320501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00482000	success	0
1619633903.570501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00512000	success	0
1619633903.649501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00535000	success	0
1619633903.649501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053b000	success	0
1619633903.649501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00537000	success	0
1619633903.805501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00513000	success	0
1619633903.836501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0051c000	success	0
1619633904.508501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00514000	success	0
1619633904.508501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00516000	success	0
1619633904.664501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00850000	success	0
1619633904.945501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052a000	success	0
1619633904.945501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00527000	success	0
1619633905.820501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00517000	success	0
1619633905.820501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00518000	success	0
1619633906.289501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00519000	success	0
1619633906.461501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a50000	success	0
1619633906.461501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0051a000	success	0
1619633906.602501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020d0000	success	0
1619633906.695501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00851000	success	0
1619633906.742501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00526000	success	0
1619633906.758501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020d1000	success	0
1619633906.805501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00852000	success	0
1619633906.820501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020d2000	success	0
1619633906.836501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00853000	success	0
1619633906.867501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00855000	success	0
1619633906.867501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00856000	success	0
1619633942.508501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00858000	success	0
1619633942.695501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0048c000	success	0
1619633942.836501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020d3000	success	0
1619633942.836501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0051d000	success	0
1619633942.836501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00859000	success	0
1619633942.992501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020d4000	success	0
1619633942.992501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0085a000	success	0
1619633943.008501 NtProtectVirtualMemory	process_identifier: 1908 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 460800 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05380400	failed	3221225550
1619633945.524501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0085b000	success	0
1619633945.524501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0085c000	success	0
1619633945.524501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0085d000	success	0
1619633945.617501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0085e000	success	0
1619633945.617501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0085f000	success	0
1619633945.758501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020d5000	success	0
1619633945.774501 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04e30000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.922579049813385

section

{'size_of_data': '0x000a3000', 'virtual_address': '0x00002000', 'entropy': 7.922579049813385, 'name': '.text', 'virtual_size': '0x000a2ec4'}

description

A section with a high entropy has been found

entropy

0.9969418960244648

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619633942.992501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619633946.477501 NtAllocateVirtualMemory	process_identifier: 2168 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000909c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619633946.477501 WriteProcessMemory	process_identifier: 2168 buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $Ëðúò£úò£úò£gY£Êúò£gl£úò£go£úò£Richúò£PELüÉKà ºÀâÐ@Ð@.textd¸º ` process_handle: 0x0000909c base_address: 0x00400000	success	1	0
1619633946.477501 WriteProcessMemory	process_identifier: 2168 buffer: @ process_handle: 0x0000909c base_address: 0x7efde008	success	1	0

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619633946.477501 WriteProcessMemory	process_identifier: 2168 buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $Ëðúò£úò£úò£gY£Êúò£gl£úò£go£úò£Richúò£PELüÉKà ºÀâÐ@Ð@.textd¸º ` process_handle: 0x0000909c base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1908 called NtSetContextThread to modify thread in remote process 2168
1619633946.477501 NtSetContextThread	thread_handle: 0x000069f4 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4317888 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2168	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1908 resumed a thread in remote process 2168
1619633946.570501 NtResumeThread	thread_handle: 0x000069f4 suspend_count: 1 process_identifier: 2168	success	0	0

Executed a process and injected code into it, probably while unpacking (13 个事件)

Time & API	Arguments	Status	Return
1619633903.320501 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 1908	success	0
1619633903.320501 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 1908	success	0
1619633903.336501 NtResumeThread	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 1908	success	0
1619633945.930501 NtResumeThread	thread_handle: 0x00009f28 suspend_count: 1 process_identifier: 1908	success	0
1619633945.945501 NtResumeThread	thread_handle: 0x00003610 suspend_count: 1 process_identifier: 1908	success	0
1619633946.477501 CreateProcessInternalW	thread_identifier: 1632 thread_handle: 0x000069f4 process_identifier: 2168 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: "{path}" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000909c inherit_handles: 0	success	1
1619633946.477501 NtGetContextThread	thread_handle: 0x000069f4	success	0
1619633946.477501 NtAllocateVirtualMemory	process_identifier: 2168 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000909c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619633946.477501 WriteProcessMemory	process_identifier: 2168 buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $Ëðúò£úò£úò£gY£Êúò£gl£úò£go£úò£Richúò£PELüÉKà ºÀâÐ@Ð@.textd¸º ` process_handle: 0x0000909c base_address: 0x00400000	success	1
1619633946.477501 WriteProcessMemory	process_identifier: 2168 buffer: process_handle: 0x0000909c base_address: 0x00401000	success	1
1619633946.477501 WriteProcessMemory	process_identifier: 2168 buffer: @ process_handle: 0x0000909c base_address: 0x7efde008	success	1
1619633946.477501 NtSetContextThread	thread_handle: 0x000069f4 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4317888 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2168	success	0
1619633946.570501 NtResumeThread	thread_handle: 0x000069f4 suspend_count: 1 process_identifier: 2168	success	0

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43720488
FireEye	Generic.mg.632cdeb4b603df4c
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Trojan.Agent.FormBook
Malwarebytes	Trojan.MalPack.PNG.Generic
Zillya	Trojan.Kryptik.Win32.2427615
Sangfor	Malware
K7AntiVirus	Trojan ( 0056d2f31 )
Alibaba	Trojan:Win32/FormBook.abc88128
K7GW	Trojan ( 0056d2f31 )
CrowdStrike	win/malicious_confidence_100% (W)
Invincea	Mal/Generic-R + Troj/Formbok-IN
Cyren	W32/Trojan.ACFK-7521
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.43720488
NANO-Antivirus	Trojan.Win32.Crypt.hsutpr
Paloalto	generic.ml
ViRobot	Trojan.Win32.S.Agent.670208.AV
Ad-Aware	Trojan.GenericKD.43720488
Emsisoft	Trojan.Crypt (A)
Comodo	Malware@#3vmlj8l7wjpla
F-Secure	Trojan.TR/Dropper.MSIL.lfcwc
DrWeb	Trojan.Siggen10.8482
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_FRS.0NA103HP20
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
Sophos	Troj/Formbok-IN
Ikarus	Trojan.MSIL.Inject
Jiangmin	Trojan.MSIL.qjpd
Webroot	W32.Trojan.Gen
Avira	TR/Dropper.MSIL.lfcwc
MAX	malware (ai score=87)
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Kryptik.oa
Microsoft	Trojan:Win32/FormBook!MSR
AegisLab	Trojan.MSIL.Crypt.4!c
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.43720488
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.MSIL.R348928
McAfee	Fareit-FYV!632CDEB4B603
VBA32	TScope.Trojan.MSIL
Cylance	Unsafe
ESET-NOD32	a variant of MSIL/Kryptik.XKX
TrendMicro-HouseCall	TROJ_FRS.0NA103HP20
Tencent	Msil.Trojan.Crypt.Wlpk

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-24 08:03:07

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.41.34	203.208.40.98
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49182	203.208.41.34 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.