5.8
高危
54 个模型检测该样本为恶意！
重新分析
更多

20844fcd640e4ffb59513be6df17936cad760298b00ed5d3ebab14acf0d9296c

6ef781b70420e8ae580c0b55b460a45a.exe

分析耗时

75s

最近分析

文件大小

806.6KB
静态报毒 动态报毒 100% AI SCORE=89 AIDETECTVM BSCOPE C1RJUACFXYB CERT CGLJL CONFIDENCE DANGEROUSSIG DEYMA DOWNLOADER34 DRIDEX DWNVX@0 ENCPK FALSESIGN GDSDA GENERICKD GENERICRXLN GENOME HEXZ HIGH CONFIDENCE HPPDSF KRYPTIK LPOG MALWARE1 QAKBOT QVM20 R + MAL R011C0RGT20 R346408 RACCOONSTEALER RACEALER SCORE SUSGEN SUSPICIOUS PE UNSAFE WURN YQ1@AAMDSNFI ZEXAF ZLOB 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXLN-LV!6EF781B70420 20200903 6.0.6.653
Alibaba TrojanDownloader:Win32/Deyma.60837460 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:DangerousSig [Trj] 20200903 18.4.3895.0
Tencent Win32.Trojan.Falsesign.Wurn 20200904 1.0.0.1
Kingsoft 20200904 2013.8.14.323
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619596030.629436
NtAllocateVirtualMemory
process_identifier: 2468
region_size: 741376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004d0000
success 0 0
1619596032.207436
NtAllocateVirtualMemory
process_identifier: 2468
region_size: 737280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01de0000
success 0 0
1619596032.207436
NtProtectVirtualMemory
process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 151552
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619624212.897625
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 741376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01cd0000
success 0 0
1619624215.444625
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 737280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619624215.444625
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 151552
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
Creates executable files on the filesystem (2 个事件)
file c:\programdata\1321ba6d1f\bdif.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\cred.dll
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619596033.098436
CreateProcessInternalW
thread_identifier: 2852
thread_handle: 0x0000008c
process_identifier: 2224
current_directory:
filepath:
track: 1
command_line: c:\programdata\1321ba6d1f\bdif.exe
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000088
inherit_handles: 0
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619624216.319625
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 217.8.117.52
Attempts to identify installed AV products by installation directory (7 个事件)
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619624218.882625
RegSetValueExA
key_handle: 0x000003bc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619624218.882625
RegSetValueExA
key_handle: 0x000003bc
value: ¾ €O<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619624218.882625
RegSetValueExA
key_handle: 0x000003bc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619624218.882625
RegSetValueExW
key_handle: 0x000003bc
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619624218.882625
RegSetValueExA
key_handle: 0x000003d0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619624218.882625
RegSetValueExA
key_handle: 0x000003d0
value: ¾ €O<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619624218.882625
RegSetValueExA
key_handle: 0x000003d0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619624218.913625
RegSetValueExW
key_handle: 0x000003b8
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 217.8.117.52:80
File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34256334
CAT-QuickHeal Trojandownloader.Deyma
McAfee GenericRXLN-LV!6EF781B70420
Cylance Unsafe
Zillya Downloader.Deyma.Win32.167
Sangfor Malware
K7AntiVirus Trojan ( 005652be1 )
Alibaba TrojanDownloader:Win32/Deyma.60837460
K7GW Trojan ( 005652be1 )
Invincea Mal/Generic-R + Mal/EncPk-APV
Cyren W32/Trojan.LPOG-3898
Symantec Packed.Generic.459
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan-Downloader.Win32.Deyma.bnz
BitDefender Trojan.GenericKD.34256334
NANO-Antivirus Trojan.Win32.Deyma.hppdsf
Avast Win32:DangerousSig [Trj]
Tencent Win32.Trojan.Falsesign.Wurn
Ad-Aware Trojan.GenericKD.34256334
Comodo TrojWare.Win32.Genome.dwnvx@0
F-Secure Trojan.TR/AD.Zlob.cgljl
DrWeb Trojan.DownLoader34.24812
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R011C0RGT20
FireEye Generic.mg.6ef781b70420e8ae
Sophos Mal/EncPk-APV
SentinelOne DFI - Suspicious PE
GData Trojan.GenericKD.34256334
Avira TR/AD.Zlob.cgljl
Antiy-AVL Trojan[PSW]/Win32.Racealer
Arcabit Trojan.Generic.D20AB5CE
ZoneAlarm Trojan-Downloader.Win32.Deyma.bnz
Microsoft Trojan:Win32/Raccoonstealer!cert
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Kryptik.R346408
Acronis suspicious
ALYac Trojan.GenericKD.34256334
MAX malware (ai score=89)
VBA32 BScope.Trojan.Inject
Malwarebytes Trojan.MalPack.DGI
ESET-NOD32 a variant of Win32/Kryptik.HEXZ
TrendMicro-HouseCall Backdoor.Win32.QAKBOT.SMF
Rising Trojan.Kryptik!8.8 (TFE:4:C1rjuaCfxYB)
Ikarus Trojan-Spy.Agent
MaxSecure Trojan.Malware.104351201.susgen
Fortinet W32/Dridex.TWY!tr
BitDefenderTheta Gen:NN.ZexaF.34216.Yq1@aamDsnfi
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-07-28 14:08:17

Imports

Library KERNEL32.dll:
• 0x4c971c LoadLibraryA
• 0x4c9720 GetProcAddress
• 0x4c9724 GetModuleHandleA
• 0x4c9728 CreateProcessW
• 0x4c972c GetModuleFileNameW
• 0x4c9730 GetCommandLineA
• 0x4c9734 GetStartupInfoA
• 0x4c973c GetModuleHandleW
• 0x4c9740 Sleep
• 0x4c9744 ExitProcess
• 0x4c9748 WriteFile
• 0x4c974c GetStdHandle
• 0x4c9750 GetModuleFileNameA
• 0x4c9760 WideCharToMultiByte
• 0x4c9764 GetLastError
• 0x4c976c SetHandleCount
• 0x4c9770 GetFileType
• 0x4c9778 TlsGetValue
• 0x4c977c TlsAlloc
• 0x4c9780 TlsSetValue
• 0x4c9784 TlsFree
• 0x4c978c SetLastError
• 0x4c9790 GetCurrentThreadId
• 0x4c9798 HeapCreate
• 0x4c979c VirtualFree
• 0x4c97a0 HeapFree
• 0x4c97a8 GetTickCount
• 0x4c97ac GetCurrentProcessId
• 0x4c97bc TerminateProcess
• 0x4c97c0 GetCurrentProcess
• 0x4c97c8 IsDebuggerPresent
• 0x4c97d0 GetCPInfo
• 0x4c97d4 GetACP
• 0x4c97d8 GetOEMCP
• 0x4c97dc IsValidCodePage
• 0x4c97e0 HeapAlloc
• 0x4c97e4 VirtualAlloc
• 0x4c97e8 HeapReAlloc
• 0x4c97ec RtlUnwind
• 0x4c97f0 HeapSize
• 0x4c97f4 GetLocaleInfoA
• 0x4c97f8 LCMapStringA
• 0x4c97fc MultiByteToWideChar
• 0x4c9800 LCMapStringW
• 0x4c9804 GetStringTypeA
• 0x4c9808 GetStringTypeW
• 0x4c9810 GetVersionExA
• 0x4c9814 IsBadWritePtr
• 0x4c9818 SetStdHandle
• 0x4c981c IsBadReadPtr
• 0x4c9820 IsBadCodePtr
• 0x4c9824 CompareStringA
• 0x4c9828 CompareStringW
• 0x4c9830 FreeLibrary
• 0x4c9838 lstrcpyA
• 0x4c983c WinExec
• 0x4c9840 lstrlenA
• 0x4c9844 lstrcatA
• 0x4c9848 CloseHandle
• 0x4c984c CreateProcessA
• 0x4c9850 CreatePipe
• 0x4c9854 ReadFile
• 0x4c9858 lstrcpynA
• 0x4c985c HeapDestroy
• 0x4c9860 GetSystemTime
• 0x4c9864 GlobalDeleteAtom
• 0x4c9868 GlobalFindAtomA
• 0x4c986c GlobalAddAtomA
• 0x4c9870 lstrcmpiA
• 0x4c9874 GlobalGetAtomNameA
• 0x4c9878 GetVersion
• 0x4c987c LockResource
• 0x4c9880 LoadResource
• 0x4c9884 FindResourceA
• 0x4c9888 RaiseException
• 0x4c988c GetLocalTime
• 0x4c9894 GetFileTime
• 0x4c9898 GetFileSize
• 0x4c989c GetFileAttributesA
• 0x4c98a8 GetFullPathNameA
• 0x4c98b0 FindFirstFileA
• 0x4c98b4 FindClose
• 0x4c98b8 MulDiv
• 0x4c98bc GlobalUnlock
• 0x4c98c0 GetProfileStringA
• 0x4c98c4 SetEndOfFile
• 0x4c98c8 UnlockFile
• 0x4c98cc LockFile
• 0x4c98d0 FlushFileBuffers
• 0x4c98d4 SetFilePointer
• 0x4c98d8 CreateFileA
• 0x4c98dc DuplicateHandle
• 0x4c98e0 SetErrorMode
• 0x4c98e4 GetThreadLocale
• 0x4c98e8 SizeofResource
• 0x4c98f0 GetProcessVersion
• 0x4c98f4 GlobalFlags
• 0x4c98f8 LocalReAlloc
• 0x4c98fc GlobalReAlloc
• 0x4c9900 GlobalLock
• 0x4c9904 GlobalHandle
• 0x4c990c LocalAlloc
• 0x4c9910 GlobalFree
• 0x4c9914 GlobalAlloc
• 0x4c9918 lstrcmpA
• 0x4c991c GetCurrentThread
• 0x4c9920 FormatMessageA
• 0x4c9924 LocalFree
• 0x4c9928 CreateFileW
• 0x4c992c LocalLock
• 0x4c9930 LocalUnlock
• 0x4c9938 _lopen
• 0x4c993c _lread
• 0x4c9940 AddAtomA
• 0x4c9944 CreateThread
• 0x4c9948 SetFileAttributesA
• 0x4c994c GetAtomNameA
• 0x4c9950 DeleteAtom
• 0x4c9954 DeleteFileA
• 0x4c9958 WaitForSingleObject
• 0x4c995c InterlockedExchange
• 0x4c9960 _lwrite
• 0x4c9964 OpenFile
• 0x4c9968 _lcreat
• 0x4c996c _llseek
• 0x4c9970 _lclose
Library USER32.dll:
• 0x4c9978 GetInputState
• 0x4c997c GetKBCodePage
• 0x4c9980 GetMessagePos
• 0x4c9984 GetDoubleClickTime
• 0x4c9988 GetDialogBaseUnits
• 0x4c998c GetForegroundWindow
• 0x4c9990 GetMessageExtraInfo
• 0x4c9994 GetFocus
• 0x4c9998 GetMessageTime
• 0x4c99a4 LoadIconW
Library GDI32.dll:
• 0x4c99ac GdiGetBatchLimit
• 0x4c99b0 GdiFlush
• 0x4c99b4 AbortPath
• 0x4c99b8 AddFontResourceA
• 0x4c99bc AbortDoc
• 0x4c99c0 AddFontResourceW
• 0x4c99c4 GetEnhMetaFileA
• 0x4c99c8 GetStockObject
Library ADVAPI32.dll:
• 0x4c99d0 RegOpenKeyW
• 0x4c99d4 RegQueryValueExA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.