6.4
高危
55 个模型检测该样本为恶意！
重新分析
更多

a48c29c81a378e0b32e1c6cd9f347a7cc55fcecbca6071f8e54a99346b193587

64787927432984d844de8d020add0324.exe

分析耗时

88s

最近分析

文件大小

45.5KB
静态报毒 动态报毒 A@4JWDQR AI SCORE=86 AIDETECTVM BIFROSE CMKFAA5TBSDI CONFIDENCE CRYPTO DF3BIV ELDORADO EWFVWJ FILEREPMALWARE FLCMD GENASA GENCIRC HIGH CONFIDENCE KCLOUD MALICIOUS PE MALWARE1 MALWTHREAT METERPRETER OCCAMY QRUE1U5WYD R12476 ROZENA ROZENAA SCORE STATIC AI SUSGEN SWPATCH SWRORT TDGI4TGA UNSAFE ZEXAF ZPACK 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee RDN/BackDoor-CEP 20201229 6.0.6.653
Alibaba Trojan:Win32/Meterpreter.aa92c995 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
Avast Win32:SwPatch [Wrm] 20201229 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Undef.(kcloud) 20201229 2017.9.26.565
Tencent Malware.Win32.Gencirc.10b3ef40 20201229 1.0.0.1
静态指标
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619610601.031125
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:2909459587&cup2hreq=0ecea871f5bfeb155521d6451bbdc6ea09a558d0c928084afa3492c642ee7f5d
Performs some HTTP requests (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:2909459587&cup2hreq=0ecea871f5bfeb155521d6451bbdc6ea09a558d0c928084afa3492c642ee7f5d
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:2909459587&cup2hreq=0ecea871f5bfeb155521d6451bbdc6ea09a558d0c928084afa3492c642ee7f5d
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619610600.937125
NtAllocateVirtualMemory
process_identifier: 1888
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00380000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619610601.062125
GetAdaptersAddresses
flags: 15
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.966454134824506 section {'size_of_data': '0x0000a800', 'virtual_address': '0x0000e000', 'entropy': 7.966454134824506, 'name': 'UPX1', 'virtual_size': '0x0000b000'} description A section with a high entropy has been found
entropy 0.9438202247191011 description Overall entropy of this PE file is high
The executable is compressed using UPX (2 个事件)
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 167.250.49.155
host 172.217.24.14
File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.Swrort.1
MicroWorld-eScan Generic.RozenaA.1CE8936B
FireEye Generic.mg.64787927432984d8
CAT-QuickHeal Trojan.Swrort.A
McAfee RDN/BackDoor-CEP
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 0053cb5b1 )
Alibaba Trojan:Win32/Meterpreter.aa92c995
K7GW Trojan ( 0053cb5b1 )
CrowdStrike win/malicious_confidence_80% (W)
Arcabit Generic.RozenaA.1CE8936B
BitDefenderTheta Gen:NN.ZexaF.34700.cmKfaa5Tbsdi
Cyren W32/Swrort.D.gen!Eldorado
Symantec Trojan Horse
APEX Malicious
Avast Win32:SwPatch [Wrm]
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Generic.RozenaA.1CE8936B
NANO-Antivirus Trojan.Win32.Shellcode.ewfvwj
Paloalto generic.ml
Rising Trojan.Crypto!8.364 (TFE:5:qRUE1u5wYD)
Ad-Aware Generic.RozenaA.1CE8936B
Emsisoft Generic.RozenaA.1CE8936B (B)
Comodo TrojWare.Win32.Rozena.A@4jwdqr
F-Secure Trojan.TR/Crypt.ZPACK.Gen
VIPRE Trojan.Win32.Swrort.B (v)
McAfee-GW-Edition RDN/BackDoor-CEP
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Generic.flcmd
eGambit Trojan.Generic
Avira TR/Crypt.ZPACK.Gen
Antiy-AVL Trojan/Win32.Meterpreter
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft Trojan:Win32/Occamy.CA4
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Generic.RozenaA.1CE8936B
Cynet Malicious (score: 100)
AhnLab-V3 Backdoor/Win32.Bifrose.R12476
VBA32 Trojan.Swrort
ALYac Generic.RozenaA.1CE8936B
MAX malware (ai score=86)
Malwarebytes Trojan.Rozena
ESET-NOD32 a variant of Win32/Rozena.ADH
Tencent Malware.Win32.Gencirc.10b3ef40
Yandex Trojan.GenAsa!O0/tdGI4TGA
Ikarus Exploit.PDF
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 216.58.200.238:443
dead_host 167.250.49.155:123
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2009-09-04 20:10:17

Imports

Library ADVAPI32.dll:
• 0x41983c FreeSid
Library KERNEL32.DLL:
• 0x419844 LoadLibraryA
• 0x419848 ExitProcess
• 0x41984c GetProcAddress
• 0x419850 VirtualProtect
Library MSVCRT.dll:
• 0x419858 _iob
Library WS2_32.dll:
• 0x419860 WSARecv
Library WSOCK32.dll:
• 0x419868 WSAGetLastError

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49182 203.208.41.98 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 54178 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.