1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.61
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:DropperX-gen [Drp] | 20200924 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Inject.bm | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200924 | 2013.8.14.323 |
| McAfee | Downloader-BIJ.a | 20200924 | 6.0.6.653 |
| Tencent | None | 20200924 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x00002cc4', 'size_of_data': '0x00003000', 'entropy': 7.746465187310386} | entropy | 7.746465187310386 | description | 发现高熵的节 | |||||||||
| entropy | 0.42857142857142855 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意
(50 out of 58 个事件)
| ALYac | Trojan.Injector |
| APEX | Malicious |
| AVG | Win32:DropperX-gen [Drp] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Razy.448218 |
| AhnLab-V3 | Backdoor/Win32.CSon.R885 |
| Antiy-AVL | Trojan[Downloader]/Win32.Rubinurd.b |
| Arcabit | Trojan.Razy.D6D6DA |
| Avast | Win32:DropperX-gen [Drp] |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan.Inject.bm |
| BitDefender | Gen:Variant.Razy.448218 |
| BitDefenderTheta | AI:Packer.54A3CF691F |
| Bkav | W32.AIDetectVM.malware1 |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| ClamAV | Win.Trojan.Rubinurd-67 |
| Comodo | TrojWare.Win32.Toga.B@6vx8t0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.c1561c |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/A-1a76837c!Eldorado |
| DrWeb | Win32.HLLW.Autoruner.27746 |
| ESET-NOD32 | Win32/TrojanDownloader.Agent.PTT |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.Razy.448218 (B) |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.6acb104c1561c88c |
| Fortinet | W32/Agent.8D4B!tr |
| GData | Win32.Trojan.Agent.ASM |
| Ikarus | Trojan-Downloader.SuspectCRC |
| Invincea | ML/PE-A + Troj/DwnLdr-MDK |
| Jiangmin | TrojanDownloader.Small.akba |
| K7AntiVirus | Trojan-Downloader ( 0040f54b1 ) |
| K7GW | Trojan-Downloader ( 000918cf1 ) |
| Kaspersky | HEUR:Trojan.Win32.Miancha.gen |
| MAX | malware (ai score=88) |
| Malwarebytes | Backdoor.Simbot |
| McAfee | Downloader-BIJ.a |
| McAfee-GW-Edition | BehavesLike.Win32.Downloader.nm |
| MicroWorld-eScan | Gen:Variant.Razy.448218 |
| Microsoft | VirTool:Win32/CeeInject.gen!DU |
| NANO-Antivirus | Trojan.Win32.Autoruner.bbwavd |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.2371.Malware.Gen |
| Rising | Trojan.Inejctor!1.A7C6 (CLASSIC) |
| SUPERAntiSpyware | Backdoor.Bot/Variant |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/DwnLdr-MDK |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2010-09-07 10:27:10
PE Imphash
f54bab47f74e370cf85ce98d899e8149
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00001755 | 0x00002000 | 5.852150841021066 |
| .rdata | 0x00003000 | 0x000005a5 | 0x00001000 | 2.233959569513802 |
| .data | 0x00004000 | 0x00000593 | 0x00001000 | 1.1458842038820463 |
| .rsrc | 0x00005000 | 0x00002cc4 | 0x00003000 | 7.746465187310386 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_RCDATA | 0x000050b4 | 0x00002800 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x000078b4 | 0x00000410 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.dll:
• 0x40301c ExitProcess
• 0x403020 ReadFile
• 0x403024 HeapAlloc
• 0x403028 GetProcessHeap
• 0x40302c GetFileSize
• 0x403030 CopyFileA
• 0x403034 GetModuleFileNameA
• 0x403038 LeaveCriticalSection
• 0x40303c GetProcAddress
• 0x403040 EnterCriticalSection
• 0x403044 VirtualProtect
• 0x403048 InitializeCriticalSection
• 0x40304c GetModuleHandleA
• 0x403050 LockResource
• 0x403054 LoadResource
• 0x403058 SetFilePointer
• 0x40305c FindResourceA
• 0x403060 GetLastError
• 0x403064 MoveFileA
• 0x403068 DeleteFileA
• 0x40306c lstrcmpiA
• 0x403070 GetLongPathNameA
• 0x403074 ExpandEnvironmentStringsA
• 0x403078 GetTickCount
• 0x40307c OutputDebugStringA
• 0x403080 lstrlenA
• 0x403084 TerminateProcess
• 0x403088 VirtualAllocEx
• 0x40308c HeapFree
• 0x403090 VirtualAlloc
• 0x403094 Sleep
• 0x403098 lstrcpyA
• 0x40309c lstrcatA
• 0x4030a0 CreateFileA
• 0x4030a4 WriteFile
• 0x4030a8 CloseHandle
• 0x4030ac SizeofResource
• 0x4030b0 WinExec
Library ADVAPI32.dll:
• 0x403000 CloseServiceHandle
• 0x403004 CryptGenRandom
• 0x403008 CryptReleaseContext
• 0x40300c EnumServicesStatusA
• 0x403010 OpenSCManagerA
• 0x403014 CryptAcquireContextA
Exports
| Ordinal | Address | Name |
|---|---|---|
| 1 | 0x404240 | szFile |
L!This program cannot be run in DOS mode.
.rdata
@.data
3fj@3Yu
t ESPh
SVWj@3Y3j?fY3f^
EPEPhL@@
MSQEuPV
YYPV5X0@
ESPuW=0@
ESPuh$
ESPuh/
ESPuhl
;t$uuh
jfhL@@
_^3[UQQe
H<EHC@
X^UQQV5
WEWP}}
;t'EPEPEPh
3?;3j u
A(;r3_^[
g8r(0M
SSvv[ l\V,
4m{m^O}
wvh_A5_
gp?kz-E
;XR~n,g
]5B)u?mQ
DKno%:]Q"@
vs*)LsP*g5.le"
:!j3XlO.x
49c<dP
WZTyQd
q(skW*0
?G PTAH_Z
[`ll3h
LZH4RO`
;KxHn+
I5$?z:tv
R<A0"[
)VKx^>]#U17e4!0e
Z=/QK|X)2
{|jLXq2ZYY
2>!J!w
O`XMS|
k4,$Nh
;7*USVu
|_^[]UE
f|yYJ'n
s" C#V
JGQK!3S
fy*!\-
YuBU[%9/llO
$H|TI6X
h9cuV.
#6*B,M
+22}82
EE~cSVu
3fj@3Yj@fY3fj@3Yu
]f]@~)M
GEQ@9E|
3tESPPPPu
uRFGHt
t+t'NW8u
;uH_^Q=
r)$h%@
DDDDDDDDDDDDDD
WinExec
CloseHandle
WriteFile
CreateFileA
lstrcatA
lstrcpyA
SetFilePointer
ExitProcess
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CopyFileA
GetModuleFileNameA
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetLastError
MoveFileA
DeleteFileA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetTickCount
OutputDebugStringA
lstrlenA
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
KERNEL32.dll
wsprintfA
MessageBoxA
USER32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
StrChrA
PathRemoveFileSpecA
SHLWAPI.dll
roudanx.exe
szFile
:m3a.bat
del "%s" /a
move "%s" "%s"
del %%0
rwbinru/dyd
RT_RCDATA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
kernel32
szFile
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
ZwUnmapViewOfSection
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinHttp
Are you sure?
regedit.exe /s
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
!TT9H6:
j 97o,g
WaPz$<]n
/b='\gg+,<7
\!c8an
LxQKzed
jL^|\K
UK^mvq,
's$3f_
T&,4S\0Pb
M^4J_!
AU-\j`4
k"x!]<?
WYXh)$^?
<]6O&@
i]/7deP@V
iQ&Bcz
>G<k)#
j'~R?r
Qc$2n)S
82LzKxF
R]rL'k
"CW\(yk`J%-o<"h$Jl
t3%\T(
p-M2b-D
d+ ft=]
Tpc^m;7
7WLAtD
2lek:_#
'ge/HE;
eK`Q.Ub^h'h
dlq<DZz3FB
Etx_s[
_d*cEX
AkjuL'
PBJ6K:
@gg&R}
0?w0-O~
%)dOR%
7Mi-7$E*"`E
N3jEp"'u0I(;o
ShfwzdC
Qw%d[l4^
xUf;s`
W);QH
A7z(hfOTwV/5
EDj]sH((
Et2HB5Sf
-2%t3]>
73GGS7
a.:b!1a[O
0dO+^+
3CcLj$c
R%BU2",:L
z\*0kYKFuE]
f$kHw,n5
-M](>Lo8
{B~ #*v7
7:(OIue
`7x)wGB
^W<+1UD
rJouXY
J)ux0}ok#GQQ,P
BifHxZ^|
''d0n0~lc@XQ
Y73._{Q
v5K nA>
Zyd1"c
)'_.$0@
b3eXCBg7<,{V
Eh~DVreU
<d`}S!"VDa
8px mb
NIGpDK
Rqya/m@lfc
:RF6xDiK
!b>Pnt}z8l
U+z"NH(
<8&dsr
G36I&PY[I
Q#X[+yP
3%b~6hW
8W8{ +'
7<7\QjJ
k%w<A_
w&B.h{{S\&
C41:` b/wS
C=bnxv]`
D2T77HLz
'ab>G[Km'4k%
-$xRc#j
7{&jCV
/%>!At.PA
COA_t|(SS8*^9;
/Q@Y+!
lsoN:}
&}8T0s
TI8EqU
F?H[6/s[V
s%sc3Wz
%}s^{g
-`ScumL
M5_ly"
:dEQ3W,Q
1=)s^tl.
id9je,:c]'
M0p+>=Cr.
O]h[E?s
s?yjeR
2$0\|#dm!
7Nmob/)n~
/IJ-^5
.3b;'O2gc6
K$vxwt
l0qwI1Ge0N
pZz7b,
kf4S^VVm&J
e?-6?4A
Z@n1kg[c ~n=1o
|][wMGdYIjV%Q
#<ud$;
hYAJ\`
167:"m:E
21-Q%r
j8>4:Vkt
rpH/g8K
e\&[`:1
+%xrYt+:>
uI|,Yt@
O!{diMrU
Nd2/uE#@
^>`NUdA._
6nS}<##6
qt7pyJzd^
5a D@7H32@2
nH/ZeLf,-9
]rH{yjO
ZAgWQmo-nt
3E.Sxo8
$q:fa@bVq
u_C}{_r
hVla3; .
S.MXvX
3%>iKg
sPp}{o:
,s<[bLCXwn
Dl4rIZ=
xT`1N~
s3?-B?0kBXPS
?b[+nF1=
Gc3fRF+hFx6nr{o;>
Zkot:=IxS
pKG7ze|
rPvTTT}
3Sk_rf
s@=Rz.<]%
4fOR'T
K5FpK({Li
zP!rDL%(
|VWcj@'
%IP7ig
pI9n1y\O)
)9A_Gu
TU",hM
pj<;6J`;1
gyNS]f
i7$njx*h'$3C
C>v<A>
"E+B^e[e
&Qq$S5Cu
clJ&@[}
o Kcyq
h*q=JX
le -Q]q
8F;3,Q3]S
l}{xZ(@
#VMg]btE5M
Fr~J=KO{dO6}
^ #*,v
,xL QS=
S/?+*0
w,l3a*w
tGN<Z6'fuJ
.&Y#X$h
/WI.K@
+SM.HE
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
R T _ R C D A T A
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 b 0
C o m p a n y N a m e
A d o b e S y s t e m s , I n c .
F i l e D e s c r i p t i o n
A d o b e ? F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r 1 0 . 1 r 5 3
F i l e V e r s i o n
1 0 , 1 , 5 3 , 6 4
I n t e r n a l N a m e
A d o b e ? F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r 1 0 . 1
L e g a l C o p y r i g h t
C o p y r i g h t ? 1 9 9 6 - 2 0 1 0 A d o b e , I n c .
L e g a l T r a d e m a r k s
A d o b e ? F l a s h ? P l a y e r
O r i g i n a l F i l e n a m e
F l a s h U t i l . e x e
P r o d u c t N a m e
F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r
P r o d u c t V e r s i o n
1 0 , 1 , 5 3 , 6 4
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.