8.0
高危

8eb90c83dc42d0382a325f7498b8a98d481f021976a319b043404f5c14ce9e35

66bd6c1d222d0deab2383dac2bbcab84.exe

分析耗时

88s

最近分析

文件大小

100.0KB
静态报毒 动态报毒 AI SCORE=88 BANKERX BSCOPE CLASSIC CONFIDENCE ELDORADO EMOTET GENCIRC GENERICKD GENETIC HFLB HQWAJW KRYPTIK NONAME@0 R002C0DH820 R347652 SCORE SUSGEN UNSAFE ZFNFP 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Emotet.6cb9362c 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:BankerX-gen [Trj] 20200828 18.4.3895.0
Tencent Malware.Win32.Gencirc.10cde662 20200828 1.0.0.1
Kingsoft 20200828 2013.8.14.323
McAfee Emotet-FQS!66BD6C1D222D 20200828 6.0.6.653
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619610636.468875
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (4 个事件)
Time & API Arguments Status Return Repeated
1619610626.749875
CryptGenKey
crypto_handle: 0x0050b9c0
algorithm_identifier: 0x0000660e ()
provider_handle: 0x0050b180
flags: 1
key: fã†à𤀢¥ƒT uBð`
success 1 0
1619610637.906875
CryptExportKey
crypto_handle: 0x0050b9c0
crypto_export_handle: 0x0050b248
buffer: f¤í¼£çî­[H6OAå8Žõ Røš:ü˜6©þ…å.¿#" Ê6‡Ë@ü¼²óÚóç_2“N©=‰o¹]Ü 5tôxVhyÍQC¸åªÝ í\­:lü¾js ]j
blob_type: 1
flags: 64
success 1 0
1619610645.906875
CryptExportKey
crypto_handle: 0x0050b9c0
crypto_export_handle: 0x0050b248
buffer: f¤3¯ÌIƒ§¯nû±ÃEȍ\ôjV›¶Õ¿ !„¿³ [‰5 ÈÛ25ݖ<›¼_zBGÞ±i„VʔÅ- ҁÃÅ,\B¦å/ÍRâfà˜Y;`gÐS’ãëó÷¹b‚g
blob_type: 1
flags: 64
success 1 0
1619610670.827875
CryptExportKey
crypto_handle: 0x0050b9c0
crypto_export_handle: 0x0050b248
buffer: f¤Mvw¡ #Q S££îßwz¡ó,¯“‘•²ß"¶!ŽQ[ãvôÑÀœRh±ZÝG&ÛLÎÖÒB?K̺,vsûg‰tÒ®¿, ”æì]õm2ðT-.» ­†–’
blob_type: 1
flags: 64
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name None
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features Connection to IP address suspicious_request POST http://47.146.32.175/2KmUscoTxDP7WYCySg/
Performs some HTTP requests (1 个事件)
request POST http://47.146.32.175/2KmUscoTxDP7WYCySg/
Sends data using the HTTP POST Method (1 个事件)
request POST http://47.146.32.175/2KmUscoTxDP7WYCySg/
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619610625.999875
NtProtectVirtualMemory
process_identifier: 3056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f3000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619610639.515875
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.140341781573129 section {'size_of_data': '0x0000c000', 'virtual_address': '0x0000d000', 'entropy': 7.140341781573129, 'name': '.rsrc', 'virtual_size': '0x0000b8d8'} description A section with a high entropy has been found
entropy 0.5 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process 66bd6c1d222d0deab2383dac2bbcab84.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619610639.171875
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 200.55.243.138
host 212.51.142.238
host 47.146.32.175
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1619610642.093875
RegSetValueExA
key_handle: 0x00000388
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619610642.093875
RegSetValueExA
key_handle: 0x00000388
value: Ïzße<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619610642.093875
RegSetValueExA
key_handle: 0x00000388
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619610642.093875
RegSetValueExW
key_handle: 0x00000388
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619610642.093875
RegSetValueExA
key_handle: 0x000003a0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619610642.093875
RegSetValueExA
key_handle: 0x000003a0
value: Ïzße<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619610642.093875
RegSetValueExA
key_handle: 0x000003a0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619610642.124875
RegSetValueExW
key_handle: 0x00000384
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1619610642.515875
RegSetValueExA
key_handle: 0x000003ac
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619610642.515875
RegSetValueExA
key_handle: 0x000003ac
value: p3»ße<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619610642.515875
RegSetValueExA
key_handle: 0x000003ac
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619610642.515875
RegSetValueExW
key_handle: 0x000003ac
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619610642.515875
RegSetValueExA
key_handle: 0x000003b0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619610642.515875
RegSetValueExA
key_handle: 0x000003b0
value: p3»ße<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619610642.515875
RegSetValueExA
key_handle: 0x000003b0
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)
MicroWorld-eScan Trojan.GenericKD.43615494
FireEye Generic.mg.66bd6c1d222d0dea
CAT-QuickHeal Trojan.Multi
ALYac Trojan.Agent.Emotet
Cylance Unsafe
Zillya Backdoor.Emotet.Win32.904
Sangfor Malware
K7AntiVirus Trojan ( 0056d0281 )
Alibaba Trojan:Win32/Emotet.6cb9362c
K7GW Trojan ( 0056d0281 )
CrowdStrike win/malicious_confidence_60% (W)
Arcabit Trojan.Generic.D2998506
Cyren W32/Emotet.APB.gen!Eldorado
Symantec Trojan.Emotet
APEX Malicious
Avast Win32:BankerX-gen [Trj]
Kaspersky HEUR:Backdoor.Win32.Emotet.vho
BitDefender Trojan.GenericKD.43615494
NANO-Antivirus Trojan.Win32.Emotet.hqwajw
ViRobot Trojan.Win32.Z.Emotet.102400.UD
Tencent Malware.Win32.Gencirc.10cde662
Ad-Aware Trojan.GenericKD.43615494
TACHYON Backdoor/W32.Emotet.102400.B
Comodo fls.noname@0
F-Secure Trojan.TR/Crypt.Agent.zfnfp
DrWeb Trojan.Emotet.997
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DH820
Sophos Troj/Emotet-CKS
Jiangmin Trojan.Banker.Emotet.obw
Avira TR/Crypt.Agent.zfnfp
Antiy-AVL Trojan/Win32.Kryptik
Microsoft Trojan:Win32/Emotet.ARJ!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Backdoor.Win32.Emotet.vho
GData Trojan.GenericKD.43615494
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.Emotet.R347652
McAfee Emotet-FQS!66BD6C1D222D
MAX malware (ai score=88)
VBA32 BScope.Trojan.Inject
Malwarebytes Trojan.MalPack.TRE
ESET-NOD32 a variant of Win32/Kryptik.HFLB
TrendMicro-HouseCall TROJ_GEN.R002C0DH820
Rising Trojan.Kryptik!1.CA2A (CLASSIC)
Ikarus Trojan-Banker.Emotet
MaxSecure Trojan.Malware.74690904.susgen
Fortinet W32/Kryptik.HFLB!tr
AVG Win32:BankerX-gen [Trj]
Panda Trj/Genetic.gen
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 212.51.142.238:8080
dead_host 200.55.243.138:8080
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-07 18:19:15

Imports

Library MFC42.DLL:
0x409034
0x409038
0x40903c
0x409040
0x409044
0x409048
0x40904c
0x409050
0x409054
0x409058
0x40905c
0x409060
0x409064
0x409068
0x40906c
0x409070
0x409074
0x409078
0x40907c
0x409080
0x409084
0x409088
0x40908c
0x409090
0x409094
0x409098
0x40909c
0x4090a0
0x4090a4
0x4090a8
0x4090ac
0x4090b0
0x4090b4
0x4090b8
0x4090bc
0x4090c0
0x4090c4
0x4090c8
0x4090cc
0x4090d0
0x4090d4
0x4090d8
0x4090dc
0x4090e0
0x4090e4
0x4090e8
0x4090ec
0x4090f0
0x4090f4
0x4090f8
0x4090fc
0x409100
0x409104
0x409108
0x40910c
0x409110
0x409114
0x409118
0x40911c
0x409120
0x409124
0x409128
0x40912c
0x409130
0x409134
0x409138
0x40913c
0x409140
0x409144
0x409148
0x40914c
0x409150
0x409154
0x409158
0x40915c
0x409160
0x409164
0x409168
0x40916c
0x409170
0x409174
0x409178
0x40917c
0x409180
0x409184
0x409188
0x40918c
0x409190
0x409194
0x409198
0x40919c
0x4091a0
0x4091a4
0x4091a8
0x4091ac
0x4091b0
0x4091b4
0x4091b8
0x4091bc
0x4091c0
0x4091c4
0x4091c8
0x4091cc
0x4091d0
0x4091d4
0x4091d8
0x4091dc
0x4091e0
0x4091e4
0x4091e8
0x4091ec
0x4091f0
0x4091f4
0x4091f8
0x4091fc
0x409200
0x409204
0x409208
0x40920c
0x409210
0x409214
0x409218
0x40921c
0x409220
0x409224
0x409228
0x40922c
0x409230
0x409234
0x409238
0x40923c
0x409240
0x409244
0x409248
0x40924c
0x409250
0x409254
0x409258
0x40925c
0x409260
0x409264
0x409268
0x40926c
0x409270
0x409274
0x409278
0x40927c
0x409280
0x409284
0x409288
0x40928c
0x409290
0x409294
0x409298
0x40929c
0x4092a0
0x4092a4
0x4092a8
0x4092ac
0x4092b0
0x4092b4
0x4092b8
0x4092bc
0x4092c0
0x4092c4
0x4092c8
0x4092cc
0x4092d0
0x4092d4
0x4092d8
0x4092dc
0x4092e0
0x4092e4
0x4092e8
0x4092ec
0x4092f0
0x4092f4
0x4092f8
0x4092fc
0x409300
0x409304
0x409308
0x40930c
0x409310
0x409314
0x409318
0x40931c
0x409320
0x409324
0x409328
0x40932c
0x409330
0x409334
0x409338
0x40933c
0x409340
0x409344
0x409348
0x40934c
0x409350
0x409354
0x409358
0x40935c
0x409360
0x409364
0x409368
0x40936c
0x409370
0x409374
0x409378
0x40937c
0x409380
0x409384
0x409388
0x40938c
0x409390
0x409394
0x409398
0x40939c
0x4093a0
0x4093a4
0x4093a8
0x4093ac
0x4093b0
0x4093b4
0x4093b8
0x4093bc
0x4093c0
0x4093c4
0x4093c8
0x4093cc
0x4093d0
0x4093d4
0x4093d8
0x4093dc
0x4093e0
0x4093e4
0x4093e8
0x4093ec
Library MSVCRT.dll:
0x40940c _except_handler3
0x409410 ?terminate@@YAXXZ
0x409414 __dllonexit
0x409418 _onexit
0x40941c _exit
0x409420 _XcptFilter
0x409424 exit
0x409428 _acmdln
0x40942c __getmainargs
0x409430 _initterm
0x409434 __setusermatherr
0x409438 _adjust_fdiv
0x40943c __p__commode
0x409440 _splitpath
0x409444 __set_app_type
0x409448 _controlfp
0x40944c fprintf
0x409450 fwrite
0x409454 strchr
0x409458 strspn
0x40945c strtok
0x409460 fgets
0x409464 fopen
0x409468 fread
0x40946c fclose
0x409470 __CxxFrameHandler
0x409474 _setmbcp
0x409478 _wcslwr
0x40947c toupper
0x409480 sprintf
0x409484 atoi
0x409488 __p__fmode
0x40948c _CxxThrowException
0x409490 memmove
0x409494 _mbscmp
0x409498 strerror
0x40949c _errno
Library KERNEL32.dll:
0x409010 GlobalUnlock
0x409014 GetStartupInfoA
0x409018 GetLastError
0x40901c GlobalAlloc
0x409020 GlobalLock
0x409024 GetModuleHandleA
Library USER32.dll:
0x4094b8 CloseClipboard
0x4094bc SetClipboardData
0x4094c0 EmptyClipboard
0x4094c4 OpenClipboard
0x4094c8 GetClipboardData
0x4094cc EnableWindow
0x4094d0 CreateWindowExA
0x4094d4 InSendMessage
0x4094d8 UpdateWindow
0x4094dc LoadBitmapA
0x4094e0 CheckRadioButton
0x4094e4 GetDlgItem
0x4094e8 SendDlgItemMessageA
0x4094ec GetClientRect
0x4094f0 SetCapture
0x4094f4 LoadMenuA
0x4094f8 SendMessageA
0x4094fc LoadCursorA
0x409500 GetKeyState
0x409504 SetTimer
0x409508 SetCursor
0x40950c KillTimer
0x409510 IsDlgButtonChecked
0x409514 MessageBeep
0x409518 ScreenToClient
0x40951c TranslateMessage
0x409520 DispatchMessageA
0x409524 ReleaseCapture
0x409528 GetCursorPos
0x40952c SetCursorPos
0x409530 GetSubMenu
Library GDI32.dll:
0x409008 GetObjectA
Library comdlg32.dll:
0x409538 GetSaveFileNameA
0x40953c GetOpenFileNameA
Library SHELL32.dll:
0x4094a8 SHGetMalloc
0x4094ac DragQueryFileA
0x4094b0 SHBrowseForFolderA
Library COMCTL32.dll:
0x409000 ImageList_AddMasked
Library MSVCP60.dll:

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49180 47.146.32.175 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 60221 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57236 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://47.146.32.175/2KmUscoTxDP7WYCySg/
POST /2KmUscoTxDP7WYCySg/ HTTP/1.1
Referer: http://47.146.32.175/2KmUscoTxDP7WYCySg/
Content-Type: multipart/form-data; boundary=---------------------------058171830030056
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 47.146.32.175
Content-Length: 4516
Connection: Keep-Alive
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.