SmartHawk

5.2

中危

68 个模型检测该样本为恶意！

重新分析

下载样本

8890de47de9ff1341c63b274a0c331e9757240ca8628e6f8cca62f6e4c4e870f

6cfb36254e16bff92373a5f5b84ae4e9.exe

分析耗时

25s

最近分析

文件大小

2.1MB

静态报毒动态报毒 100% AI SCORE=100 ALI1003001 AWFY AWYG@4XNJ8V BCWK BGGB BZUB CLOUD CONFIDENCE DAWS DEAGEZC DECAP ELDORADO EM8JTQDSQ FAEDEVOUR GENETIC HIGH HIGH CONFIDENCE HSZ@AUB INJECT1 MALICIOUS PE NOT MALICIOUS PONDRE PWSZBOT QBOT SCORE SYSN TNJF TROJANTOGA UNSAFE UVPA WDEXT WDGUJ WNME X816 ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Alibaba	TrojanDropper:Win32/dropper.ali1003001	20190527	0.3.0.5
Avast	Win32:Malware-gen	20200526	18.4.3895.0
Baidu	Win32.Trojan-Dropper.Injector.f	20190318	1.0.0.2
Kingsoft		20200527	2013.8.14.323
McAfee	PWSZbot-FIB!6CFB36254E16	20200527	6.0.6.653
Tencent	Trojan.Win32.Daws.a	20200527	1.0.0.1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Foreign language identified in PE resource (2 个事件)

name

RT_ICON

language

LANG_CHINESE

offset

0x000563dc

filetype

dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2576980296, next used block 10459577

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000002e8

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x0005901c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000014

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619597114.725001 NtProtectVirtualMemory	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000084 base_address: 0x00120000	success	0	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619597114.740001 WriteProcessMemory	process_identifier: 2116 buffer: UììtEÄS3ÛV;ÃW¾ºt¾º¹3À½ùÿÿfùÿÿó«f«¹3À½¦ýÿÿf¤ýÿÿó«f«¹3À½ûÿÿfûÿÿó«hf«ÿVH QPÿV(øÄÿjjÐWÿV,Wj0UÈjRÿV4Äø0ñjjjjjhPÿVXøÿÎE¼M´PU¬QRWÿV\WÿVPùÿÿPÿVTÄùÿÿfÇùÿÿQÿV`øtøuöEôtëøuöEôtEôEô÷ÿÿRhÿV öEôuXP¤ýÿÿPÿVT ¤ýÿÿPQÿV(øÄÿuPëUØRWÿVpÄPÿVlÄøÿu\|WÿV8EôÄ¨Eôt¨j\PÿVdø÷ÿÿ¤ýÿÿPQÇÿVT¤ýÿÿWRÿVPÄ¤ýÿÿjPPÿVhÀ¶ ¤ýÿÿQRÿV(øÄÿûÿÿ Pj÷ÿÿQRÿV$¦ ûÿÿPQÿVP ûÿÿRPÿV(ÄEøÀ*MäUÔ+ÊQÿV<UÔjRWØÿV,ÄøÿEäUÔ+ÂWPjSÿV4MäUÔ+ÊÄ;Áà3É3ÒEÿEÿÀÀEÿEÿ2D ÈAù\|3ÉBú\|ÖMøjjQÿV,ÄøÿUøEäRUÔ+ÂPjSÿV0MäUÔ+ÊÄ;ÁuUøRÿVtSÿV@EøPÿV8Äûÿÿ° ÇEøjjjQPjÿVxUÐMÌ+ÑRÿV<ØEÌjPWÿV,ÄøÿMÐEÌ+ÈWQjSÿV4UÐMÌ+ÑÄ;Âù3É3ÒEÿEÿÀÀEÿEÿ2D ÈAù\|3ÉBú\|ÖjjWÿV,Äøÿ·MÐEÌ+ÈWQjSÿV0UÐMÌ+ÑÄ;ÂSÿV@EèÄ3ÛÀíEØ]ä+ÃPÿV<MäjQWØÿV,Äøÿ\UØEä+ÐWRjSÿV4MØUä+ÊÄ;Á9UèjRWÿV,Äøÿ#EØUä+ÂWPjSÿV0MØUä+ÊÄ;ÁjÿV<UðjRWEÄÿV,ÄøÿâEÄWjjPÿV4ÄøÊUÄMìjJEðPWÿV,Äøÿ«MÄWjjQÿV0ÄøWÿVtUÌÄRWÿVpÄPÿVlÄøÿtuSÿV@WÿV8ÄjÿWÿV}¼jh jjj¤ýÿÿOh@P}¼ÿVXøÿÿtaM¼U´QE¬RPWÿV\|WÿVjÿWÿVjj¤ýÿÿQ° RPjÿVxë'Eøÿt WÿV8EøÄÀtPÿV8ÄÛtSÿV@ÄjÿVjjjjÿVÃ_^¸[å]Ã process_handle: 0x00000084 base_address: 0x00120efa	success	1	0
1619597114.740001 WriteProcessMemory	process_identifier: 2116 buffer: 65v5v³5vÿ5vz5vý_wTÓuÜÔ6v¶Ñ7v¬óuöu¬vuÈóuy=uîuu=5v5vD@¦uøÔu\?5vD5vA5v?§u 7v¹éu¬uBAuq<v»ì6vC:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6cfb36254e16bff92373a5f5b84ae4e9.exe£<ÖwÎ<Öw4@çVçVé¼çVàV¼çVàV0åHÖwØ ãw çVºXädëDåT,Öw¼çVXåYw¼çVéDèiwXëV\¤wÌå@félnêV çVèVdd çVÍ.Äó]7Í.×ê£)Â;×ê£)Â;×ê£)Â;×TempltaÐøÿÐøÿ¤ç5>2uUêVø;ÿUÄUø8Uª"Øæ¨ÖwUêVUêV"°Äæðæhå2u;ØæçÐøÿ0è5>2uüæ(çhå2u5>2u(çÐøÿhè5>2uLç@UÄUhå2u5>2uÏ°3uI¦5vëÖ2uÖØ2u5Ü3u4¶w¦?5vMòu¸ðuZðuðuïu¾óu·@Ú@Ê35vÒÖw¥Öw8Öw8Uz8ÖwúwUXëVPU¼çVè`ëWPUêVUø8UPU`ëWÅq2u\9Uø8U çV`ëW@èR%!2uÿÿÿÿèlè0%ó2uÿÿÿÿè\|è¨è>=¨è22uÿÿÿÿ===Øè£2u=T¦5v>÷}=üéi2u==ü0Iëü>Hë(éÓ92u=0e2u¤ÕwDéXéÐû4uaø8uR%!2uÿÿÿÿé>0ëéd5uë~2uÿÿÿ<%ó2uÿÿÿÿ´éé^>ë@Èé22uÿÿÿÿ> 0èêø<øé£2u> 0o2up0ê>êæ92u>8êú4uèê8êaû4u>Xê>2u p;u>Xêí4u>cc8ìª02uèêø<!2uÿÿÿÿ ê0¬ê22uÿÿÿÿ=Ìë\|%ó2uÿÿÿÿèêÐê=Ìêøêhå2uüê22uë5lììê@Ú@ø<¥Öw8ì·2uôë\|ð<àOì,ìÐý~8ì:2uð;8uí¨ìe#4uìì\|ø<ºÀ +ííÅÐw\|ììø<Ñwvñ}í\|uP%¬íÔì£<ÖwDíà^wjôgþÿÿÿÑw'?5v\|ø<í,?5vñ}\ lu(íuÐíA?vz#Pfþÿÿÿ,?5v³Ãu\|ø<í¤í u`%=8Bà`%=ù<Ôí¬u`%=¸ÀC®uù<¿¿ðíö¯uY%ù<¿¿`)u$îõuY%þÿÿÿù<¿ÀÀwbrb\r+b@AE.exeopen process_handle: 0x00000084 base_address: 0x001214ba	success	1	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1108 resumed a thread in remote process 2116
1619597115.537001 NtResumeThread	thread_handle: 0x00000080 suspend_count: 1 process_identifier: 2116	success	0	0

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619597114.209001 CreateProcessInternalW	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp track: 0 command_line: filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp stack_pivoted: 0 creation_flags: 0 () process_handle: 0x00000000 inherit_handles: 0	failed	0
1619597114.725001 CreateProcessInternalW	thread_identifier: 1432 thread_handle: 0x00000080 process_identifier: 2116 current_directory: filepath: track: 1 command_line: explorer.exe filepath_r: stack_pivoted: 0 creation_flags: 68 (CREATE_SUSPENDED\|IDLE_PRIORITY_CLASS) process_handle: 0x00000084 inherit_handles: 0	success	1
1619597114.725001 NtGetContextThread	thread_handle: 0x00000080	success	0
1619597114.740001 WriteProcessMemory	process_identifier: 2116 buffer: UììtEÄS3ÛV;ÃW¾ºt¾º¹3À½ùÿÿfùÿÿó«f«¹3À½¦ýÿÿf¤ýÿÿó«f«¹3À½ûÿÿfûÿÿó«hf«ÿVH QPÿV(øÄÿjjÐWÿV,Wj0UÈjRÿV4Äø0ñjjjjjhPÿVXøÿÎE¼M´PU¬QRWÿV\WÿVPùÿÿPÿVTÄùÿÿfÇùÿÿQÿV`øtøuöEôtëøuöEôtEôEô÷ÿÿRhÿV öEôuXP¤ýÿÿPÿVT ¤ýÿÿPQÿV(øÄÿuPëUØRWÿVpÄPÿVlÄøÿu\|WÿV8EôÄ¨Eôt¨j\PÿVdø÷ÿÿ¤ýÿÿPQÇÿVT¤ýÿÿWRÿVPÄ¤ýÿÿjPPÿVhÀ¶ ¤ýÿÿQRÿV(øÄÿûÿÿ Pj÷ÿÿQRÿV$¦ ûÿÿPQÿVP ûÿÿRPÿV(ÄEøÀ*MäUÔ+ÊQÿV<UÔjRWØÿV,ÄøÿEäUÔ+ÂWPjSÿV4MäUÔ+ÊÄ;Áà3É3ÒEÿEÿÀÀEÿEÿ2D ÈAù\|3ÉBú\|ÖMøjjQÿV,ÄøÿUøEäRUÔ+ÂPjSÿV0MäUÔ+ÊÄ;ÁuUøRÿVtSÿV@EøPÿV8Äûÿÿ° ÇEøjjjQPjÿVxUÐMÌ+ÑRÿV<ØEÌjPWÿV,ÄøÿMÐEÌ+ÈWQjSÿV4UÐMÌ+ÑÄ;Âù3É3ÒEÿEÿÀÀEÿEÿ2D ÈAù\|3ÉBú\|ÖjjWÿV,Äøÿ·MÐEÌ+ÈWQjSÿV0UÐMÌ+ÑÄ;ÂSÿV@EèÄ3ÛÀíEØ]ä+ÃPÿV<MäjQWØÿV,Äøÿ\UØEä+ÐWRjSÿV4MØUä+ÊÄ;Á9UèjRWÿV,Äøÿ#EØUä+ÂWPjSÿV0MØUä+ÊÄ;ÁjÿV<UðjRWEÄÿV,ÄøÿâEÄWjjPÿV4ÄøÊUÄMìjJEðPWÿV,Äøÿ«MÄWjjQÿV0ÄøWÿVtUÌÄRWÿVpÄPÿVlÄøÿtuSÿV@WÿV8ÄjÿWÿV}¼jh jjj¤ýÿÿOh@P}¼ÿVXøÿÿtaM¼U´QE¬RPWÿV\|WÿVjÿWÿVjj¤ýÿÿQ° RPjÿVxë'Eøÿt WÿV8EøÄÀtPÿV8ÄÛtSÿV@ÄjÿVjjjjÿVÃ_^¸[å]Ã process_handle: 0x00000084 base_address: 0x00120efa	success	1
1619597114.740001 WriteProcessMemory	process_identifier: 2116 buffer: 65v5v³5vÿ5vz5vý_wTÓuÜÔ6v¶Ñ7v¬óuöu¬vuÈóuy=uîuu=5v5vD@¦uøÔu\?5vD5vA5v?§u 7v¹éu¬uBAuq<v»ì6vC:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6cfb36254e16bff92373a5f5b84ae4e9.exe£<ÖwÎ<Öw4@çVçVé¼çVàV¼çVàV0åHÖwØ ãw çVºXädëDåT,Öw¼çVXåYw¼çVéDèiwXëV\¤wÌå@félnêV çVèVdd çVÍ.Äó]7Í.×ê£)Â;×ê£)Â;×ê£)Â;×TempltaÐøÿÐøÿ¤ç5>2uUêVø;ÿUÄUø8Uª"Øæ¨ÖwUêVUêV"°Äæðæhå2u;ØæçÐøÿ0è5>2uüæ(çhå2u5>2u(çÐøÿhè5>2uLç@UÄUhå2u5>2uÏ°3uI¦5vëÖ2uÖØ2u5Ü3u4¶w¦?5vMòu¸ðuZðuðuïu¾óu·@Ú@Ê35vÒÖw¥Öw8Öw8Uz8ÖwúwUXëVPU¼çVè`ëWPUêVUø8UPU`ëWÅq2u\9Uø8U çV`ëW@èR%!2uÿÿÿÿèlè0%ó2uÿÿÿÿè\|è¨è>=¨è22uÿÿÿÿ===Øè£2u=T¦5v>÷}=üéi2u==ü0Iëü>Hë(éÓ92u=0e2u¤ÕwDéXéÐû4uaø8uR%!2uÿÿÿÿé>0ëéd5uë~2uÿÿÿ<%ó2uÿÿÿÿ´éé^>ë@Èé22uÿÿÿÿ> 0èêø<øé£2u> 0o2up0ê>êæ92u>8êú4uèê8êaû4u>Xê>2u p;u>Xêí4u>cc8ìª02uèêø<!2uÿÿÿÿ ê0¬ê22uÿÿÿÿ=Ìë\|%ó2uÿÿÿÿèêÐê=Ìêøêhå2uüê22uë5lììê@Ú@ø<¥Öw8ì·2uôë\|ð<àOì,ìÐý~8ì:2uð;8uí¨ìe#4uìì\|ø<ºÀ +ííÅÐw\|ììø<Ñwvñ}í\|uP%¬íÔì£<ÖwDíà^wjôgþÿÿÿÑw'?5v\|ø<í,?5vñ}\ lu(íuÐíA?vz#Pfþÿÿÿ,?5v³Ãu\|ø<í¤í u`%=8Bà`%=ù<Ôí¬u`%=¸ÀC®uù<¿¿ðíö¯uY%ù<¿¿`)u$îõuY%þÿÿÿù<¿ÀÀwbrb\r+b@AE.exeopen process_handle: 0x00000084 base_address: 0x001214ba	success	1
1619597115.537001 NtResumeThread	thread_handle: 0x00000080 suspend_count: 1 process_identifier: 2116	success	0

File has been identified by 68 AntiVirus engines on VirusTotal as malicious (50 out of 68 个事件)

Bkav	W32.DeagezC.Trojan
DrWeb	Trojan.Inject1.10883
MicroWorld-eScan	Win32.Decap.A
CMC	Trojan-Dropper.Win32.Daws!O
CAT-QuickHeal	TrojanToga.MUE.R9
ALYac	Win32.Decap.A
Cylance	Unsafe
Zillya	Dropper.Daws.Win32.2430
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDropper:Win32/dropper.ali1003001
K7GW	Trojan ( 003dc1641 )
K7AntiVirus	Trojan ( 003fa0611 )
Arcabit	Win32.Decap.A
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34122.hsZ@aub!bggb
F-Prot	W32/A-757af715!Eldorado
Symantec	W32.Faedevour!inf
ESET-NOD32	Win32/TrojanDropper.Agent.PYF
Zoner	Trojan.Win32.84495
TrendMicro-HouseCall	TROJ_PWSZBOT_DC0700A9.UVPA
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Bzub-6727003-0
GData	Win32.Decap.A
Kaspersky	Trojan.Win32.Inject.wnme
BitDefender	Win32.Decap.A
NANO-Antivirus	Trojan.Win32.Daws.wdguj
Paloalto	generic.ml
ViRobot	Win32.Daws.A
Rising	Spyware.Agent!1.B59F (CLOUD)
Endgame	malicious (high confidence)
Sophos	Troj/Qbot-ED
Comodo	TrojWare.Win32.TrojanDropper.Daws.AWYG@4xnj8v
F-Secure	Trojan.TR/Injector.2461429
Baidu	Win32.Trojan-Dropper.Injector.f
VIPRE	Trojan-Dropper.Win32.Daws.awfy (v) (not malicious)
TrendMicro	TROJ_PWSZBOT_DC0700A9.UVPA
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.vc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.6cfb36254e16bff9
Emsisoft	Win32.Decap.A (B)
Ikarus	Trojan-Dropper.Win32.Agent
Cyren	W32/A-757af715!Eldorado
Jiangmin	Trojan.Inject.bcwk
MaxSecure	Dropper.Daws.awfy
Avira	TR/Injector.2461429
Webroot	W32.Malware.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Dropper]/Win32.Daws.awfy
Microsoft	VirTool:Win32/Injector.EG

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2012-03-05 16:37:55

Imports

Library KERNEL32.dll:

• 0x402000 ResumeThread

• 0x402004 WriteProcessMemory

• 0x402008 VirtualProtectEx

• 0x40200c GetModuleFileNameW

• 0x402010 DuplicateHandle

• 0x402014 GetCurrentProcess

• 0x402018 SetFileTime

• 0x40201c CopyFileW

• 0x402020 GetDriveTypeW

• 0x402024 GetFileTime

• 0x402028 CreateFileW

• 0x40202c SetErrorMode

• 0x402030 GetTempFileNameW

• 0x402034 GetTempPathW

• 0x402038 ExitProcess

• 0x40203c Sleep

• 0x402040 DeleteFileW

• 0x402044 CloseHandle

• 0x402048 WaitForSingleObject

• 0x40204c CreateProcessW

• 0x402050 ReadProcessMemory

• 0x402054 GetThreadSelectorEntry

• 0x402058 GetThreadContext

• 0x40205c GetLastError

• 0x402060 lstrlenW

• 0x402064 GetModuleHandleW

• 0x402068 GetStartupInfoW

Library USER32.dll:

• 0x4020ec MessageBoxA

Library SHELL32.dll:

• 0x4020e4 ShellExecuteW

Library MSVCRT.dll:

• 0x402070 memset

• 0x402074 wcscpy

• 0x402078 free

• 0x40207c _fileno

• 0x402080 _chsize

• 0x402084 wcsrchr

• 0x402088 wcscat

• 0x40208c malloc

• 0x402090 fclose

• 0x402094 fread

• 0x402098 fwrite

• 0x40209c fseek

• 0x4020a0 _wfopen

• 0x4020a4 sprintf

• 0x4020a8 fflush

• 0x4020ac _exit

• 0x4020b0 _XcptFilter

• 0x4020b4 exit

• 0x4020b8 _wcmdln

• 0x4020bc __wgetmainargs

• 0x4020c0 _initterm

• 0x4020c4 __setusermatherr

• 0x4020c8 _adjust_fdiv

• 0x4020cc __p__commode

• 0x4020d0 __p__fmode

• 0x4020d4 __set_app_type

• 0x4020d8 _except_handler3

• 0x4020dc _controlfp

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	50005	239.255.255.250	3702
192.168.56.101	51966	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.