3.0
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.73
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20200330 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200401 | 2013.8.14.323 |
| McAfee | Downloader-FYZ!66D193DD1FAA | 20200331 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0ddc3 | 20200401 | 1.0.0.1 |
静态指标
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\operaupdater.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\operaupdater.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\operaupdater.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x0000108c', 'size_of_data': '0x00001200', 'entropy': 6.87371636035833} | entropy | 6.87371636035833 | description | 发现高熵的节 | |||||||||
| entropy | 0.391304347826087 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
创建已知的 Upatre 文件、注册表项和/或互斥体
(1 个事件)
| file | C:\Users\apliego\AppData\Local\Temp\Rar$EXa0.185\Invoice_18803891.exe |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 172.67.153.160:443 |
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Dapato.R92734 |
| Antiy-AVL | Trojan/Win32.SGeneric |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | HEUR/AGEN.1026734 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34104.dqZ@aGYq1fki |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.Bublik.BOMQ@55t4zm |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.d1faaa |
| Cylance | Unsafe |
| Cyren | W32/Trojan.WTUW-8231 |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.GXR |
| F-Secure | Trojan:W32/Agent.DUQQ |
| FireEye | Generic.mg.66d193dd1faaa9cb |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Badur.bfd |
| K7AntiVirus | Trojan-Downloader ( 0055c6c71 ) |
| K7GW | Trojan-Downloader ( 0055c6c71 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=81) |
| Malwarebytes | Trojan.Voicemail |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FYZ!66D193DD1FAA |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.qt |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.J |
| NANO-Antivirus | Trojan.Win32.DownLoad3.csnrnz |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM07.1.44D7.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Zbot-HFL |
| Symantec | Downloader |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-12-23 18:19:12
PE Imphash
e888bacad07828bd73cc2b7f53a693e4
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0000108c | 0x00001200 | 6.87371636035833 |
| .rdata | 0x00003000 | 0x00000476 | 0x00000600 | 4.333526796880663 |
| .data | 0x00004000 | 0x000001f0 | 0x00000200 | 4.433043004438236 |
| .rsrc | 0x00005000 | 0x00001220 | 0x00001400 | 4.740170335570277 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00005278 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00006138 | 0x000000e4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00006120 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x00005130 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x403060 RegisterClassExW
• 0x403064 CreateWindowExW
• 0x403068 GetMessageW
• 0x40306c TranslateMessage
• 0x403070 DispatchMessageW
• 0x403074 DefWindowProcW
• 0x403078 PostQuitMessage
• 0x40307c ShowWindow
• 0x403080 UpdateWindow
• 0x403084 SetWindowTextW
• 0x403088 PostMessageW
Library KERNEL32.dll:
• 0x403008 GetStartupInfoA
• 0x40300c GetModuleHandleA
• 0x403010 GetModuleHandleW
• 0x403014 CloseHandle
• 0x403018 CreateFileW
• 0x40301c WriteFile
• 0x403020 ReadFile
Library GDI32.dll:
• 0x403000 SetBkColor
Library MSVCRT.dll:
• 0x403028 __getmainargs
• 0x40302c _controlfp
• 0x403030 _except_handler3
• 0x403034 __set_app_type
• 0x403038 __p__fmode
• 0x40303c __p__commode
• 0x403040 _adjust_fdiv
• 0x403044 __setusermatherr
• 0x403048 _exit
• 0x40304c _XcptFilter
• 0x403050 exit
• 0x403054 _acmdln
• 0x403058 _initterm
L!This program cannot be run in DOS mode.
`.rdata
@.data
MP@P0M
80@MEEMM
u@uu@u
MM@P MPPM
@8 ME PuM
M0PPuM0 @E
P8RMM0@ERP
0RRuu
u080@@@uP
Eu0@UE
@08E8R P@ uPE @
WuWWPPPPj
t(=l0@
MQ3PPPUR
PE8uM M08
PR8MMP
[uSHAVWAf9
KkIM3E
GGEGGEM;r
0UV3W}
FG3@_^]
M E8uP
._!QM)E
M[=5K)
90<5J4
p&?V4
=Q#5K.
EjXkob
*FM0#'AP
RP`_w8Mi`o
x.MlXR:8
a K)R=
0n$"6QO
",U-YbR:;
<S8ZF7
/#n#UQ
8Zn;/s
S$"6aHR:0i$"
s(-YoC:R8Z$
RL[=RX/7nG#
Q8ZDsJ
XmOjI$"$(8
ZMmFDgz[%o:'
UKNw:X~
fo":0P8Z
NoRP80nUcH
ULt Hf
$mwuKZR
8 JQXPb
p$=0"{M808
Iu[[_[+SM
M@M0uuPR0R0
@EE ME
0@R 8u
MEEPR@
uEu8UjhP1@
hSVWe3
EEP5A@
EPEPEP
0u>"u:Fu
<"u>"u
> vFuj
YY3%00@
RM#&?J
8^$G4V
B.18$R32(
PostMessageW
SetWindowTextW
RegisterClassExW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
ReadFile
WriteFile
CreateFileW
CloseHandle
GetModuleHandleW
KERNEL32.dll
SetBkColor
GDI32.dll
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetModuleHandleA
GetStartupInfoA
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
uHj`b/%
%QHgCDb/%%%cBJJJ`
6n@OkkByCyjHGQy%
%%%%%%%%%iB6
CBH@Ij
%%%%%%%%2wAU
i_OOOQD%F
%%%%%%%%%%*
//Cl\*/%////%
%%%%%%%%%
w\**l\*%
%%%%%%%%%%%*%2%%%
%%%%%%%%%%2c
2%%%%%%
&%%%%%%%%%%%2%*%%%%%%%%%%
&%%%%%%%%%%%2%Tb2%%%%%%%%%%%
&%%/%/%/%/%%2b}b2%%%%%%%%%%%
&%//////%/%/2}b2%%%%%%%%%%%%%
&%/////////.6}6%%%%%%%%%%%%%%
&%//////////69%%/%%%%%%%%%%%
&%//////////6%/%%%%%%%%%%%%
&%//////////6.%/%%%%%%%%%%
/..........6./%%%%%%%%%%%
..%%%%%%%%%%
|##############))####a
%%./....%
55555555!!!!!!!!!!!!!!!!!!!!!!.%
"""""""">;"";>>>;;;>;"""""""">e
aaaaaS~
''???"''?'
"SR#===|Rv
'hCI''hU'hCI'
'Xa#=<
((((((GK*
u*(KTIG(((((((GX#<
A6
*n*lB*@A* #=
( AUTT,n*,Ac
_ K{L<
,,,,,,YM*q*tTBEZA*
Z,,,,,,Ym{
@[MEB_*t*BT*M*qZZ[m=L
[M999s99E[M9E
1111111111|P
{#)))))))))))))))#)#a
$+-----------+.++.++
$$$$$$$$$$$$$$$$
L!This program cannot be run in DOS mode.
i2h:2h:2h:2i:gh::1h::3h:)%:"h:)%:Ph:)%:
h::3h::*h::3h::3h:Rich2h:
`.data
@.reloc
otools\inc\nlg\private\inc\msfsa\faarray_cont_t.h
otools\inc\nlg\private\inc\msfsa\falextools_t.h
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
bad exception
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
Unknown exception
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
nlg\lib\msfsa\faallocator.cpp
nlg\lib\msfsa\farsdfa_pack_triv.cpp
otools\inc\nlg\private\inc\msfsa\faarray_cont_2xresize_t.h
nlg\lib\msfsa\famultimap_pack.cpp
Internal error.
Object cannot be initialized.
Limit size has been exceeded.
Out of memory.
Object is not ready.
]ut5p?
W3+t#Hu7Vu
^3[UQE
V3WM0u
UVW39~
<|uCt7
t79V$t2h
M 3UE9J
MA3;~\U
E;}q}M
PE @PE
MPE+@PE
G;}|}]}$
F;}^U9]
z;~\;}T;]
Yt]U]U]
EVW3EP
H e e p i l
W h a t d o :
m o o s s i
s t a t i c
b u t t o n
M S S a n s S e r i f
C : \ U s e r s \ a p l i e g o \ A p p D a t a \ L o c a l \ T e m p \ R a r $ E X a 0 . 1 8 5 \ I n v o i c e _ 1 8 8 0 3 8 9 1 . e x e
C : \ l e E 2 N E t I . e x e
C : \ J J g 6 e B 8 q . e x e
C : \ p D 0 9 7 3 U y . e x e
C : \ E 6 s l _ q Z K . e x e
C : \ Z 3 M V s b 1 O . e x e
C : \ d 3 a j q 4 t A . e x e
C : \ b 1 5 5 1 3 b d 1 1 6 9 e 2 8 9 4 0 a 1 d 5 8 9 1 6 b f 6 b c 7 9 7 8 8 9 4 e e 6 9 d e e 1 9 4 9 3 4 0 7 b b c 5 d 0 5 7 1 6 4
C : \ 6 a 0 2 c e 2 4 9 4 3 e 9 e 2 e 2 b c 6 b 9 4 9 3 b 3 7 6 0 7 9 6 6 e c 1 9 b c a f c 6 5 5 7 9 8 8 2 7 c d 1 1 7 e b a 8 4 5 1
C : \ r a H W p R K 8 . e x e
C : \ h T e 5 Q k Z r . e x e
C : \ t E s 9 o e J 4 . e x e
C : \ p N A q V z H m . e x e
C : \ J z l I K 2 a T . e x e
C : \ a S m 8 F A n E . e x e
C : \ 2 h F Q 3 b c I . e x e
C : \ i a p 5 o v a n . e x e
C : \ x X z Z r M 2 P . e x e
C : \ i A e b I F H A . e x e
C : \ n 3 T N G G 4 X . e x e
C : \ 1 V W 1 1 3 w 1 . e x e
C : \ O Q q 0 L a d i . e x e
C : \ 3 b 8 7 3 b f e b a c 0 6 b 9 d a e d f 9 f e 2 9 e a 4 6 a 1 b 6 7 0 8 b 9 b f 6 9 2 7 e f 8 8 f 0 3 b b a 2 0 e 7 7 e 9 6 d 3
C : \ 7 b 9 c 1 0 f 6 2 2 3 2 b 4 f 3 2 8 1 b 0 3 6 3 c d 7 8 5 f f f 7 3 d 2 d f 2 d a a e d 2 d b 4 a 1 5 f e c 9 4 5 f 0 4 9 5 f 3
C : \ 6 9 9 5 d 5 d 9 e 3 5 f e 5 5 e 1 5 5 f 5 c c 2 d 3 b 9 7 3 a f d 4 c a 5 e f 3 7 2 0 2 d d a 0 c e c e 2 1 8 c 4 6 c 7 a 7 e c
C : \ e 3 c 5 1 1 b b c 9 0 7 3 4 f a 4 8 f 5 1 e 7 9 6 6 4 8 e 2 9 e b 1 8 b 7 5 6 9 5 5 1 6 7 6 b 6 e 3 4 e 7 8 7 4 c 1 c 2 f 7 9 2
C : \ 7 f 2 a e 6 5 5 0 0 d f b e 5 9 e 3 c 5 f d c 3 4 1 1 0 2 f 0 3 2 5 4 1 0 0 3 8 9 f 7 d 5 7 8 2 5 c d 7 4 0 8 9 9 b 2 3 0 2 a c
C : \ t r 3 r s 2 X g . e x e
C : \ W 7 Y L B 7 b z . e x e
C : \ Z q k N g 6 W V . e x e
C : \ F B u L X 0 8 P . e x e
C : \ u E L 8 K B q Z . e x e
C : \ 2 4 R p D A 2 2 . e x e
C : \ M p M E q R R I . e x e
C : \ B Y 5 Z D i Q r . e x e
C : \ B g G _ G x Z G . e x e
C : \ e B W 5 x d q f . e x e
C : \ n I I R h R 7 M . e x e
C : \ j 7 o T 5 2 e G . e x e
C : \ p K E r 5 t 7 G . e x e
C : \ g x V n _ J n 0 . e x e
C : \ 4 k 2 F X n z 6 . e x e
C : \ Z a U 7 d y w _ . e x e
C : \ 9 0 U Z c c g 6 . e x e
C : \ d d a c 5 b f 0 0 0 3 2 d 3 2 a 0 a e c 4 5 a b 3 6 1 2 e 0 2 a e 4 2 1 e 0 1 2 e a 1 b a d 3 a a f a d c 1 0 0 3 8 7 2 5 8 d c
C : \ 7 1 d f 6 5 2 7 e 0 5 2 8 8 7 c 2 9 c 7 e 6 a b 0 6 6 8 d e 2 1 9 1 d 6 1 2 1 1 2 6 0 3 7 7 2 8 7 2 a 9 6 b 2 7 0 2 a 2 2 c b 2
C : \ 9 e 4 8 b 6 2 3 3 c 0 c 9 b e b b 4 9 f a 5 e e 6 a 7 f 4 2 e 0 5 4 3 c 4 e e 1 7 8 9 4 9 d e f e c 1 5 2 5 1 3 a 4 3 7 2 6 7 0
C : \ e W 4 s 6 d g x . e x e
C : \ 7 Z 8 X j 2 y 5 . e x e
C : \ 4 j 7 J 4 v h O . e x e
C : \ w V b B I _ L g . e x e
C : \ E c q G O L E 1 . e x e
C : \ G l q j i z b t . e x e
C : \ Q 0 M M Z a F m . e x e
C : \ A Q 4 s t L P t . e x e
C : \ M N X R w w I c . e x e
C : \ L v A T E X _ x . e x e
C : \ Y z 9 D 5 u W W . e x e
C : \ x J k Z Z l B c . e x e
C : \ R 0 S Q w 5 N I . e x e
C : \ u z l F m y k r . e x e
C : \ d 5 Q K A z R l . e x e
C : \ N F 7 S T Y 7 Y . e x e
C : \ N b e w 4 z C U . e x e
C : \ n O 7 2 L v F W . e x e
C : \ A e V _ x V B U . e x e
C : \ x m z u g t 3 y . e x e
C : \ a c l v a N p Q . e x e
C : \ X f x u V o T q . e x e
C : \ i 7 f g x q a S . e x e
C : \ 0 p I 6 k G z f . e x e
C : \ X p a l p T P c . e x e
C : \ 2 5 3 1 8 e 3 c b 2 b d 6 7 1 8 5 5 3 9 0 1 c b b 5 a e 9 3 a 5 1 4 a d d d 0 c c e d 6 7 9 e 9 4 a 1 e 5 3 1 f 0 d b 2 0 2 b 2
C : \ 4 a 2 e f 5 8 d 7 c 1 2 0 2 4 d 3 9 f 9 5 e b 9 c 6 a 1 8 9 9 d 9 1 0 2 a 6 f 5 4 c d 9 2 4 f 2 f b 7 c c 4 1 4 8 0 f c 8 a 6 8
C : \ c 0 0 2 8 8 3 1 9 6 9 6 9 7 1 1 d 2 2 4 d c 8 1 9 6 f f 1 7 a 1 5 b 3 0 e d 2 e 6 a 3 3 1 1 e a 3 c 5 e c 5 5 a 5 7 8 f 9 c b d
C : \ a g h T P 2 C T . e x e
C : \ Z q L I z c 0 Y . e x e
C : \ P G H Z W G _ 6 . e x e
C : \ Y p t f R b t e . e x e
C : \ e s i v Z S p 4 . e x e
C : \ _ 3 o 6 e 2 e G . e x e
C : \ j C P y C 8 W _ . e x e
C : \ k C O k f z W G . e x e
C : \ _ B i p D 5 j q . e x e
C : \ H s 5 R C I Z n . e x e
C : \ I D p c z 2 Q E . e x e
C : \ Q a r d m 0 2 p . e x e
C : \ G 4 q C 2 b d 8 . e x e
C : \ H f 6 i B C P 9 . e x e
C : \ W 9 F y q S D X . e x e
C : \ Q 2 3 h o l k m . e x e
C : \ P F y _ g Z T x . e x e
C : \ O d F n v s C y . e x e
C : \ n W i 3 W o 7 S . e x e
C : \ _ 6 p j k z c Z . e x e
C : \ F I S s h E p q . e x e
C : \ x S Z N q 0 9 D . e x e
C : \ b w a g P j p U . e x e
C : \ J z J O s L 7 J . e x e
C : \ o 6 I p a w t m . e x e
C : \ u 7 1 7 h y E f . e x e
C : \ 9 w v q f _ x J . e x e
C : \ q E 1 2 7 p 2 U . e x e
C : \ S T u o U d 4 L . e x e
C : \ A E f M I A 9 i . e x e
C : \ M 6 W 3 n v G 8 . e x e
C : \ A R G L 6 v f E . e x e
C : \ w z 8 e O R P J . e x e
C : \ S J P C g R h z . e x e
C : \ T 0 0 r T q a N . e x e
C : \ c F f w B Q q T . e x e
C : \ U t z B s h R _ . e x e
C : \ d 2 9 I 1 F N A . e x e
C : \ S K l c S y I e . e x e
C : \ 4 Q S r k u n 7 . e x e
C : \ n v F X S r A K . e x e
C : \ o C a U L M U n . e x e
C : \ l r b s C V l o . e x e
C : \ q n V z E 3 g 8 . e x e
C : \ 1 d 6 a 2 1 2 a c c e b 8 c 7 b 0 7 8 6 d d 0 1 b a 4 7 c 9 0 7 3 1 2 9 d b 7 6 a 9 9 a 5 7 8 8 2 8 5 c f 5 b c b 7 a 0 0 4 3 b
C : \ 5 7 2 9 f 5 7 3 2 1 4 4 7 e a f a 7 d 5 b 4 c c b 6 b 1 6 2 1 5 b 4 a a 5 1 0 2 f f 7 4 1 1 f c d d b 9 a 6 2 1 f 9 a a 1 b e 8
C : \ c J R a t _ 7 1 . e x e
C : \ B y n c h o 5 P . e x e
C : \ 1 6 9 6 1 6 1 a 5 a c 5 3 6 c d 9 0 3 7 8 9 2 9 8 2 a 2 e b a 3 7 3 4 d a a c a 7 8 f 5 1 5 6 9 9 0 9 d c f a 3 6 c 4 c a 5 5 9
C : \ 6 t 2 Z e p H V . e x e
C : \ 0 a a 7 7 e d a 9 a b a f d 7 e e d 7 4 1 1 e 1 1 1 4 7 c 1 0 1 3 3 c d 4 9 5 b 5 6 5 c 2 e d 8 3 8 f 4 d 5 c 1 0 2 5 0 7 c 3 d
C : \ j 9 Q L 3 d V R . e x e
C : \ K N _ Y i 7 F r . e x e
C : \ P a I x 2 k w U . e x e
C : \ r f S I n d u T . e x e
C : \ a c d f 9 4 b a c 5 e 4 d 9 d 9 c d 2 1 8 2 f 7 d 3 4 1 f 2 b 3 a 8 6 e b 3 c 9 d 5 1 f b 3 5 4 f 0 c 6 e 2 d 9 8 c f 6 d f 9 a
C : \ 1 3 6 5 9 4 8 d b c 4 8 8 0 7 b c b f e 2 0 8 f d f 3 c e 8 4 b a 8 d d 5 8 9 d 4 9 7 e 2 2 a 3 c 5 b c 3 1 e f e a e 5 1 7 4 0
C : \ f 2 9 7 f d 0 5 9 7 b 0 8 f 4 7 e 5 8 1 0 c 1 4 d d c 8 4 f a 8 f b 4 b 3 b d 6 9 3 d 7 3 b f b e 5 d 1 0 1 e 0 c 3 9 3 a e 8 4
C : \ 3 5 7 1 e 7 1 1 5 0 e d 6 5 5 c 6 4 3 1 9 a b d d 2 0 d 6 f e f 9 6 f 3 8 c d 8 8 8 4 6 5 c 8 b 8 6 f 7 3 1 7 4 2 4 a d a 0 8 d
C : \ e C Q M J g n 5 . e x e
R E S O U R C E _ F A T O K E N I Z E R
K E R N E L 3 2 . D L L
s m s c o r e e . d l l
n r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
W U S E R 3 2 . D L L
( ( ( ( ( H
C O N O U T $
C : \ c f b d f 8 3 9 6 7 c 9 b 8 9 a b c 5 7 f 4 2 1 0 e 1 c b d 6 a f 1 7 7 6 4 5 4 e c a e 8 7 b c a 4 2 f b 6 8 f 4 8 8 b 6 2 c 4
C : \ d e a d 5 a d 6 3 d e 3 7 4 8 f 1 8 8 5 1 1 a 2 4 b 7 6 f f b 5 f 5 5 2 7 a a 0 6 1 e 8 0 6 e d f c c e b e 4 b d 7 9 9 9 9 9 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ 8 5 8 0 2 7 1 7 a 6 0 4 9 1 9 c b 9 5 7 e 6 3 f b c 3 3 5 0 5 f 2 2 9 b 9 8 6 e 6 8 4 6 7 2 d 0 4 3 8 3 9 e c 3 3 5 5 f 5 6 e 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ 1 3 2 2 d 8 4 2 a 3 d d c 1 6 7 e 5 c 4 7 8 d 2 9 8 2 7 3 b 4 c 8 1 4 f 0 b 6 b 5 c 1 8 0 d d b 9 1 6 c 3 b 2 f c 8 f b d b 1 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ 6 a f d 2 a d 0 c 4 b 3 c e 9 1 c e 1 7 2 8 c 6 2 3 7 f c 4 c d b 2 7 1 6 c f 5 4 0 3 3 8 0 e 2 e 8 9 6 a e 6 e a 5 c 4 c 1 b 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ e c 1 e 4 a 9 5 b 4 8 a 7 d 8 5 b 5 a 9 8 b 8 8 1 e 9 0 a c a e e b d 5 3 5 5 9 e c f 7 0 6 b 5 d 0 3 6 a 5 3 7 2 0 8 5 0 2 6 7
C : \ 7 0 7 8 c 6 3 5 d a 1 2 a 8 7 e 7 6 6 4 c 0 9 e b 3 5 1 9 8 b 6 b c 6 8 9 a 4 e 0 d 3 c d 9 3 6 a 7 b 4 9 1 b a d a b a 9 d a e
C : \ 7 4 1 5 a 8 e 1 c f f 4 2 2 6 2 5 4 b 3 1 3 b 3 2 e 9 6 1 3 4 7 9 b f 3 c 4 6 e 6 6 0 e c 7 3 9 8 9 9 d 9 3 c 0 4 4 9 0 5 9 5 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ 2 8 e e a 3 5 8 1 8 3 3 d 4 c f f 6 8 7 1 8 d 1 c e 2 6 5 4 5 7 4 9 4 6 8 c b 8 7 3 1 5 6 a e 0 b 6 a 8 b 7 1 4 f 5 8 a 2 f 6 0
C : \ 9 6 8 f 7 b e a c 7 b 6 d 5 8 3 1 e 2 b 5 5 e a e 3 4 a b 9 5 1 f 1 f 0 1 3 d d 1 2 7 2 f 4 6 0 a 5 2 8 f 2 5 a 9 2 f 6 d 9 c 2
C : \ 6 e 0 4 3 5 4 f b 3 4 4 7 9 d e 2 6 5 a c d d 9 d d 8 2 9 2 5 1 2 f e 5 c 1 2 e 3 9 1 f f 2 b a f 6 f 5 2 d 9 7 c e 1 d 7 3 c 3
C : \ e 5 9 f c 2 b c 2 7 3 1 a 7 1 e d 2 b 3 b 8 7 d 9 7 4 8 5 9 4 6 f 7 1 4 5 b e a 4 c 2 b 9 1 2 6 3 a e 2 d d 6 c b 7 d 7 4 f 4 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ 2 1 d 7 8 1 0 a 9 8 9 4 6 7 5 b 6 d b a f 5 a 5 3 1 7 4 d 4 e b 1 0 e d b 1 e 8 a f e 8 0 8 7 2 8 5 b 2 1 c 3 7 1 c 9 2 c e 4 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ b c c b 4 8 9 2 0 1 9 f 2 e a 7 c b 5 f 1 8 7 0 d 5 2 8 9 f 1 4 b 6 2 3 7 c 1 f c e 2 e 4 0 c e 5 b 4 c 9 d e c 7 9 a 4 4 d 4 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ f 1 9 2 e 9 5 2 5 4 1 6 6 a a b 6 2 4 f a 5 b a 4 1 9 e 2 1 7 b 3 c 9 4 6 3 9 c b 7 f a 7 3 2 8 3 7 f 2 1 1 4 6 0 e b f 2 f f 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ 2 d a f e e 3 2 1 c 3 8 c 8 9 c e 7 e 9 9 1 8 d 7 8 1 6 c 3 6 7 7 5 8 9 9 4 b 7 2 9 8 5 3 b 3 5 4 7 9 0 f 1 f c c 3 1 8 1 0 8 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
c : \ t a s k \ B D C 6 D D 8 E 5 9 A 3 3 A 3 1 3 2 F 9 E 1 2 1 A E 9 C A 7 B 2 . e x e
c : \ t a s k \ 4 E F 6 0 D 1 2 2 3 B C B 2 3 2 F 7 7 1 9 4 3 1 7 C 3 4 D 0 8 8 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 2 1 f 0 2 f 2 1 e a 6 9 a 9 d f 6 1 2 6 a 6 d 8 a a d e f 7 f . v i r u s . e x e
C : \ f 0 c 5 0 e 2 f 4 3 a 9 5 4 5 f 4 6 f 1 1 a a f e 9 3 6 3 c 4 1 6 c a a 5 9 0 0 d a 0 d a c 3 2 9 0 d a b e 1 8 5 0 2 a 1 4 5 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 5 4 4 5 0 1 2 b 6 6 b b 4 b 2 5 7 e 3 c 3 6 6 7 f 1 2 a 1 6 f d f 5 f 6 1 e d e 9 6 0 d f 3 2 0 1 7 8 3 3 e 4 7 d 7 0 9 c e 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 8 d 0 7 8 0 7 7 a 6 d 9 d 7 a 5 e 8 5 6 d 1 a f 0 b 7 0 3 3 c 1 e 1 e 1 d a b d 7 5 f b 1 d c 9 7 0 4 6 3 f 3 a e 2 d b b f 5 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ o p e r a u p d a t e r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 9 0 a 6 e 1 e 4 6 c 4 d 3 2 b _ o p e r a u p d a t e r . e x e
C : \ 9 5 7 2 7 2 d 9 4 6 e c c 6 3 2 1 2 c b a 4 2 7 9 c f d 7 4 d b 5 d 9 b 4 1 5 d e 7 d 4 f c b 6 1 8 3 6 f d 3 6 5 9 2 1 2 b f 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ 5 3 0 d 8 f 7 e 7 d e 5 5 f c f 1 8 d 5 a 3 e d e 7 a 0 9 f d d 6 b 6 0 4 8 8 0 9 e 5 4 c 2 6 f 6 b d 6 3 8 2 8 1 c e 1 e 9 5 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o p e r a u p d a t e r . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 4 b a d c 1 6 6 a 7 1 a 4 5 9 1 7 0 8 5 0 f b 4 6 f 2 0 5 f 9 f a 5 f 7 0 3 4 c 5 e 4 3 4 2 d 2 0 f 9 e 8 b 7 c 1 3 1 e f a d . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 8 c 0 0 b d 5 4 f 2 6 7 4 6 2 e 8 3 b 5 6 7 8 3 e a 8 4 5 2 6 5 8 d 2 e e 8 d a 5 4 a 1 4 8 d e 6 c 7 e 6 6 d a c b a 3 c 3 d . e x e
C : \ 5 b 1 c f 2 4 9 d 2 4 a d 0 1 2 3 5 9 c e 2 4 c f e 6 6 3 b 8 1 b 6 5 3 6 1 2 5 a 9 8 4 7 5 b 5 4 4 d 3 1 1 b 9 7 6 7 4 7 f 9 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ o p e r a u p d a t e r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 1 6 6 f 9 3 2 7 9 6 2 8 4 b a _ o p e r a u p d a t e r . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ o p e r a u p d a t e r . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 9 f a 0 1 f 2 2 e 8 0 d 7 f 4 _ o p e r a u p d a t e r . e x e
Process Tree
-
0c9f01aecd2bce651314919b5568f4a8e4b8e4f644b6632873063333b8ff1179.exe (1612)
"C:\Users\Administrator\AppData\Local\Temp\0c9f01aecd2bce651314919b5568f4a8e4b8e4f644b6632873063333b8ff1179.exe"
- operaupdater.exe (628) "C:\Users\ADMINI~1\AppData\Local\Temp\operaupdater.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 172.67.153.160 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| automotive-technology.com |
A 172.67.153.160
A 104.21.3.223 |
104.21.3.223 |
| tradeledstore.co.uk |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49166 | 172.67.153.160 automotive-technology.com | 443 |
| 192.168.56.101 | 49167 | 172.67.153.160 automotive-technology.com | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 8.8.8.8 | 53 |
| 192.168.56.101 | 51758 | 8.8.8.8 | 53 |
| 192.168.56.101 | 52215 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62361 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | b0d03deb329e3a97_operaupdater.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\operaupdater.exe |
| Size | 53.9KB |
| Processes | 1612 (0c9f01aecd2bce651314919b5568f4a8e4b8e4f644b6632873063333b8ff1179.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 81023d157fbfddc4a335325604d4f4f6 |
| SHA1 | ea92a3cce22808c11de4f4dfd11661b28f99c517 |
| SHA256 | b0d03deb329e3a97565152f5bdab4c35b43e566fbc8d1d25928380da16017804 |
| CRC32 | 741CFC70 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.