| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Trojan-gen | 20200409 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Urelas.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200411 | 2013.8.14.323 |
| McAfee | GenericRXHS-PD!66EE4F20A3EF | 20200410 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07aaf | 20200411 | 1.0.0.1 |
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545316.343375 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545405.93725 IsDebuggerPresent |
failed | 0 | 0 |
| pdb_path | D:\PMS\pms4\Project(20130920)\GolfProject\bin\GolfProject.pdb |
| file | C:\Users\Administrator\AppData\Local\Temp\_uinsey.bat |
| file | C:\Users\Administrator\AppData\Local\Temp\wohoo.exe |
| file | C:\Users\Administrator\AppData\Local\Temp\fubok.exe |
| file | C:\Users\Administrator\AppData\Local\Temp\fubok.exe |
| file | C:\Users\Administrator\AppData\Local\Temp\_uinsey.bat |
| file | C:\Users\Administrator\AppData\Local\Temp\wohoo.exe |
| file | C:\Users\Administrator\AppData\Local\Temp\07ff120052be9aafdf08e5ced0c4fbdc1b34739176173bad008c3fc33a6b5490.exe |
| file | C:\Users\Administrator\AppData\Local\Temp\wohoo.exe |
| file | C:\Users\Administrator\AppData\Local\Temp\fubok.exe |
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545407.96825 Process32NextW |
snapshot_handle:
0x000000d4
process_name: wohoo.exe process_identifier: 1980 |
success | 1 | 0 |
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00032000', 'size_of_data': '0x00012200', 'entropy': 7.962400332994414} | entropy | 7.962400332994414 | description | 发现高熵的节 | |||||||||
| entropy | 0.9235668789808917 | description | 此PE文件的整体熵值较高 | |||||||||||
| host | 114.114.114.114 | |||
| host | 218.54.31.226 | |||
| host | 1.234.83.146 | |||
| host | 218.54.31.165 | |||
| host | 133.242.129.155 | |||
| ALYac | Trojan.Generic.16165158 |
| APEX | Malicious |
| AVG | Win32:Trojan-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.Generic.16165158 |
| AhnLab-V3 | Win-Trojan/Onlinegamehack.492021 |
| Antiy-AVL | Trojan[Backdoor]/Win32.Unknown |
| Arcabit | Trojan.Generic.DF6A926 |
| Avast | Win32:Trojan-gen |
| Avira | HEUR/AGEN.1120724 |
| Baidu | Win32.Trojan.Urelas.a |
| BitDefender | Trojan.Generic.16165158 |
| BitDefenderTheta | Gen:NN.ZexaF.34106.EmZfa8JXkdei |
| Bkav | W32.AIDetectVM.malware2 |
| CAT-QuickHeal | Trojan.Gupboot.G.mue |
| CMC | Trojan.Win32.Swisyn!O |
| ClamAV | Win.Trojan.Agent-1134793 |
| Comodo | TrojWare.Win32.Gupboot.AGQ@5t8mho |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.0a3eff |
| Cyren | W32/Urelas.E.gen!Eldorado |
| DrWeb | Trojan.AVKill.33592 |
| ESET-NOD32 | a variant of Win32/Urelas.S |
| Emsisoft | Trojan.Generic.16165158 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Urelas.E.gen!Eldorado |
| F-Secure | Heuristic.HEUR/AGEN.1120724 |
| FireEye | Generic.mg.66ee4f20a3eff358 |
| Fortinet | W32/Urelas.O!tr |
| GData | Trojan.Generic.16165158 |
| Ikarus | Trojan-Downloader.Win32.Dluca |
| Invincea | heuristic |
| Jiangmin | Trojan/Swisyn.wnd |
| K7AntiVirus | Trojan ( 00558cdc1 ) |
| K7GW | Trojan ( 0047e3691 ) |
| Kaspersky | HEUR:Backdoor.Win32.Generic |
| MAX | malware (ai score=88) |
| Malwarebytes | Trojan.Urelas |
| MaxSecure | Win.MxResIcn.Heur.Gen |
| McAfee | GenericRXHS-PD!66EE4F20A3EF |
| McAfee-GW-Edition | BehavesLike.Win32.Gupboot.gm |
| MicroWorld-eScan | Trojan.Generic.16165158 |
| Microsoft | Trojan:Win32/Wacatac.C!ml |
| NANO-Antivirus | Trojan.Win32.Swisyn.dkozag |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.7D15.Malware.Gen |
| Rising | Trojan.Gupboot!1.9CEA (CLASSIC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Urelas-Z |
| Symantec | ML.Attribute.HighConfidence |
| dead_host | 218.54.31.226:11110 |
| dead_host | 1.234.83.146:11170 |
| dead_host | 218.54.31.165:11110 |
| dead_host | 133.242.129.155:11110 |
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00032000 | 0x00012200 | 7.962400332994414 |
| .rsrc | 0x00033000 | 0x00002000 | 0x00001600 | 6.395397208448214 |
| .reloc | 0x00035000 | 0x00000200 | 0x00000200 | 0.2123006574398449 |
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x0002f298 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MENU | 0x0002f700 | 0x0000004a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x0002f750 | 0x0000026c | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x0002f9c0 | 0x00000048 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ACCELERATOR | 0x0002fa08 | 0x00000010 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0002fa90 | 0x00000076 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0002fa90 | 0x00000076 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x00033508 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
default registry file network process services synchronisation iexplore office pdf
default registry file network process services synchronisation iexplore office pdf
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 |
No TCP connections recorded.
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
No HTTP requests performed.
No ICMP traffic performed.
No IRC requests performed.
No Suricata Alerts
No Suricata TLS
No Snort Alerts
| Name | 07ff120052be9aaf_07ff120052be9aafdf08e5ced0c4fbdc1b34739176173bad008c3fc33a6b5490.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\07ff120052be9aafdf08e5ced0c4fbdc1b34739176173bad008c3fc33a6b5490.exe |
| Size | 489.8KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed |
| MD5 | 66ee4f20a3eff358e2b11de8bc6334e9 |
| SHA1 | f82253cb91c61f85c460abfd7c5c1bf3b18c722d |
| SHA256 | 07ff120052be9aafdf08e5ced0c4fbdc1b34739176173bad008c3fc33a6b5490 |
| CRC32 | F86DAD54 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 633a89cc27b5cf76_golfinfo.ini |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\golfinfo.ini |
| Size | 512.0B |
| Processes | 1332 (07ff120052be9aafdf08e5ced0c4fbdc1b34739176173bad008c3fc33a6b5490.exe) |
| Type | Non-ISO extended-ASCII text, with very long lines (512), with no line terminators |
| MD5 | 32b4ff61e32a67f35f6c23d876fee781 |
| SHA1 | 5832953ab88de2354a5c97a489ab4bc2285353e1 |
| SHA256 | 633a89cc27b5cf76fa2f0001c8f9b0305a26bf46d0195c012f46e99cdf9c9353 |
| CRC32 | 18402677 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 837a762e0abd7799__uinsey.bat |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\_uinsey.bat |
| Size | 367.0B |
| Processes | 1332 (07ff120052be9aafdf08e5ced0c4fbdc1b34739176173bad008c3fc33a6b5490.exe) 2228 (cmd.exe) |
| Type | ASCII text, with CRLF line terminators |
| MD5 | 03ebc4752696617a6ca2e87b85fc61c7 |
| SHA1 | 89230f98b0d394b3c37cae92b8f60748a9a9d127 |
| SHA256 | 837a762e0abd779929cb77524d3d89c62720245eada349139e5f529c1689c179 |
| CRC32 | F9F8F0D8 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 883fc376553be7d1_wohoo.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\wohoo.exe |
| Size | 178.7KB |
| Processes | 1260 (fubok.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed |
| MD5 | 3cfd97ab9c81e7d7f1511c3b5b611362 |
| SHA1 | 855e967acaa3ac2481bd02266400e7a5fa513e41 |
| SHA256 | 883fc376553be7d1ac2227b3a635a27c9d84201b537316cfd0f21d6b9917af5b |
| CRC32 | EC509015 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4c43f2497d8c4c4a_fubok.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\fubok.exe |
| Size | 489.9KB |
| Processes | 1332 (07ff120052be9aafdf08e5ced0c4fbdc1b34739176173bad008c3fc33a6b5490.exe) 1980 (wohoo.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed |
| MD5 | cc00aaa7bd12ecdf903a1cb4cce5911b |
| SHA1 | 85546dd03df7bc9f4e4c7b5b0dd712043ed52344 |
| SHA256 | 4c43f2497d8c4c4a4166650ba37d847488799308b19e4effa5029053dc48a1b7 |
| CRC32 | 5AEC0FB8 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 57e477e0400c66b4_fubok.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\fubok.exe |
| Size | 489.9KB |
| Processes | 1980 (wohoo.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed |
| MD5 | a6afee211910671cad4c104c9fb02428 |
| SHA1 | fbd8ed7255519aa3239896c0a3745e639a37316c |
| SHA256 | 57e477e0400c66b4b629ebac847a6f76dc731fd2e08fa39f3a513e31591bb371 |
| CRC32 | C1FE9426 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |