1.1
低危
64 个模型检测该样本为恶意！
重新分析
更多

254e983fe8fb4f57f2bb748648ed417444271d59f8fcc58e881fa1ffedcd2024

254e983fe8fb4f57f2bb748648ed417444271d59f8fcc58e881fa1ffedcd2024.exe

分析耗时

195s

最近分析

356天前

文件大小

22.8KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER ZBOT
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.56
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Trojan-gen 20200104 18.4.3895.0
Baidu Win32.Trojan-Downloader.Waski.a 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200104 2013.8.14.323
McAfee PWSZbot-FMO!6F8A1F964B40 20200104 6.0.6.653
Tencent Malware.Win32.Gencirc.10b30052 20200104 1.0.0.1
静态指标
行为判定
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00001dd0', 'size_of_data': '0x00001e00', 'entropy': 6.837118063092637} entropy 6.837118063092637 description 发现高熵的节
entropy 0.4838709677419355 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意 (50 out of 64 个事件)
ALYac Trojan.Agent.BBJC
APEX Malicious
AVG Win32:Trojan-gen
Acronis suspicious
Ad-Aware Trojan.Agent.BBJC
AhnLab-V3 Trojan/Win32.Zbot.R94801
Antiy-AVL Trojan/Win32.Yakes
Arcabit Trojan.Agent.BBJC
Avast Win32:Trojan-gen
Avira TR/Yakes.dxno.4584
Baidu Win32.Trojan-Downloader.Waski.a
BitDefender Trojan.Agent.BBJC
BitDefenderTheta Gen:NN.ZexaF.33558.bqX@au9szvgi
Bkav W32.AppdataMogus.Trojan
CAT-QuickHeal TrojanDownloader.Upatre.A6
ClamAV Win.Trojan.Zbot-57485
Comodo TrojWare.Win32.Spy.Zbot.NWTL@598i2p
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.64b405
Cylance Unsafe
Cyren W32/Trojan.BUBT-7507
DrWeb Trojan.DownLoad3.28161
ESET-NOD32 Win32/TrojanDownloader.Waski.A
Emsisoft Trojan.Agent.BBJC (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.HCY
F-Secure Trojan.TR/Yakes.dxno.4584
FireEye Generic.mg.6f8a1f964b4053ec
Fortinet W32/Kryptik.CF!tr
GData Trojan.Agent.BBJC
Ikarus Trojan-Spy.Zbot
Invincea heuristic
Jiangmin Trojan/Yakes.mvu
K7AntiVirus Trojan ( 0040f7411 )
K7GW Trojan ( 0040f7411 )
Kaspersky Trojan-Spy.Win32.Zbot.rgca
MAX malware (ai score=85)
MaxSecure Trojan.Upatre.Gen
McAfee PWSZbot-FMO!6F8A1F964B40
McAfee-GW-Edition BehavesLike.Win32.PWSZbot.mm
MicroWorld-eScan Trojan.Agent.BBJC
Microsoft TrojanDownloader:Win32/Upatre.A
NANO-Antivirus Trojan.Win32.DownLoad3.csnqji
Panda Generic Malware
Qihoo-360 HEUR/QVM19.1.55D9.Malware.Gen
Rising Trojan.Waski!1.A489 (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Zbot
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/Zbot-HJX
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2004-12-05 15:50:53

PE Imphash

42bf80f16600ecf1da6aabfdec2d9257

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001dd0 0x00001e00 6.837118063092637
.data 0x00003000 0x000005ac 0x00000600 6.028719000113318
.idata 0x00004000 0x00000538 0x00000600 4.059151082986562
.rsrc 0x00005000 0x00001268 0x00001400 4.485175002385971

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00005130 0x00000ea8 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_DIALOG 0x00005fd8 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x000060c0 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MANIFEST 0x000060d4 0x00000193 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library kernel32.dll:
• 0x4040fc GetModuleHandleA
• 0x404100 GetProcAddress
• 0x404104 HeapCreate
• 0x404108 HeapAlloc
• 0x40410c GetVersion
• 0x404110 ExitProcess
• 0x404114 FreeLibrary
• 0x404118 GetLastError
• 0x40411c GetTickCount
• 0x404128 CloseHandle
• 0x40412c TlsAlloc
• 0x404130 TlsGetValue
• 0x404134 TlsSetValue
• 0x404138 TlsFree
• 0x40413c GetModuleHandleW
• 0x404140 SetLastError
• 0x404144 HeapDestroy
• 0x40414c LCMapStringW
• 0x404154 GetDiskFreeSpaceExW
Library user32.dll:
• 0x404370 GetMessageA
• 0x404374 DefWindowProcA
• 0x404378 PostQuitMessage
• 0x40437c InvalidateRect
• 0x404380 SetWindowPos
• 0x404384 EndPaint
• 0x404388 GetWindowTextA
• 0x404390 GetClientRect
• 0x404394 BeginPaint
• 0x404398 SetWindowTextA
• 0x4043a0 IsWindow
• 0x4043a4 CreateCaret
• 0x4043a8 ShowCaret
• 0x4043ac HideCaret
• 0x4043b0 DestroyCaret
• 0x4043b4 LoadIconA
• 0x4043b8 RegisterClassA
Library Msacm32.dll:
• 0x404500 acmStreamOpen
Library winmm.dll:
• 0x404520 waveOutClose
L!This program cannot be run in DOS mode.
.idata
FFGIIuw#
7::vYU
7eY+mMM12L?LLEwj
44fa|lAAp{
XJ((Y~?BBL
62IIcZa
>\WC44]/
44Ng}sK%%CzTj
5E\|
Q00s=O
MhV &$$ny((WZJTBh""
]z++\fx
ZqQ$$N?$M<<3
jQPFF[Kj+u
--V"(x
*??6_Lk<<|k.
!!HU6FF
dgH..#;x!!dTP''M
,,rn?y
66"ai#
KQ}:+CCFg3
55+,}B
q8%JJW
a{AA&eC1L 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333
ZRK$$u>CCR
b8vp,FFh
V=='N+-
@{C_&&=
,,G[j CCvl$0s//
`V;K(99
77aq{_O**
a##sSC33$M
u**`tG1
KYCX77vr
JFFZQg
FFE|j$$Y-V66 o
MHK..0
4++5x ?4f
D\NNd"#|
3=={;KKf
E#??Hx]+O<<
LBBupXdDDP~d ;
11C8k9W""Me
TH::9e|
u55;Eq%%;mf8`
HEE_hni
]KKvkN
EmL;ja
2P*oK55AI]
66D^uJJ
(^ ALLu
(Z.dGGd
ZBKKW*
ow'LIIE@
%1EEwX
K44rVB
;NII(Kh
U%&z--pw
QD}>>+
P77QQ\(*MM
0dui==<>Y
c--tIF?
GEEF00O
=DD;E|R
hZ})44b~
#46$$_G
KKVKlo1;e11A
9.LL$"S#<<
%<,,pM`E
XCCV6#0
QB6$$Jol3P
''RU#lP>
MgD++]] 7))>IIw
?666g|MMc
MU*p22>k\#
bI))=_or?
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAn
E1Z1c{IQ
])b)KP
uhj@Huw
Ed1Z1c
Eduu|udl
Eludul
p)HtPup
uj@HuT
E|tPpR
{E${E4$5
C4$L$:u<t
%@0udi
sr,ujjh
1@%""@jP
PL_aTCercobATba^s\ade=ecsQgU
Cu^SXi^emSiCe^dCtbi^g1
m`eWV9dUo
CQLS1"3
3rUadeGi^d_w5x1
Gi^m].Tl\
<oQd<iRrQriEhAuceb3".Tl\
@R?FDOB
{}fq?=ZeeyW,fq:@EeYyU2xE5{@
yE1E+J
@J%@jjh
1P>F?G
kernel32.dll
user32.dll
Msacm32.dll
winmm.dll
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
GetVersion
ExitProcess
FreeLibrary
GetLastError
GetTickCount
InterlockedDecrement
InterlockedIncrement
CloseHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
HeapDestroy
QueryPerformanceCounter
LCMapStringW
InitializeCriticalSection
GetDiskFreeSpaceExW
GetUserDefaultUILanguage
GlobalMemoryStatusEx
GetMessageA
DefWindowProcA
PostQuitMessage
InvalidateRect
SetWindowPos
EndPaint
GetWindowTextA
GetWindowTextLengthA
GetClientRect
BeginPaint
SetWindowTextA
MsgWaitForMultipleObjects
IsWindow
CreateCaret
ShowCaret
HideCaret
DestroyCaret
LoadIconA
RegisterClassA
acmStreamOpen
waveOutClose
$BFFA"
$\?HAA"
*=@@[:
*04'(*
:Z9'.#()
$$)X8/3@A0$
2X'@Y'..,Z[30(00$
$2YZ,@3
#))1((1$
(IIJ$
DDDDDDDDDGGGGGGGGGGGGGHGGGGGHGG
D??7???7?7777777777777E7777777FC
?77?77?7?7/?477774/77/7//?4?4?7C
?4/4////@2/9/8"10A9B#7/7/7/4/47C
7//////48
97/=$2)09#
9////////7
)(8.)32(9:(94
'$0"(.)
1,#$*23
'()!*
)%+#(,
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
tttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt
MS Shell Dlg
Cancel
F&Help
C:\Users\JACK\AppData\Local\Temp\Temp1_Invoice.zip\Invoice_01132014.exe
C:\wzORamtb.exe
C:\lXofYzVa.exe
C:\LcSXFVfC.exe
C:\a9OIAlkj.exe
C:\0bAG1Xvl.exe
C:\CGX9u5cN.exe
C:\4o08uSvN.exe
C:\JWf3Oy_O.exe
C:\fVWvxlTJ.exe
C:\9d83d6035b3795cff8222eaf136ba6a0283bbadec9731bae99eb2cad3690fa21
C:\22159e04062e6da81d9af035c182fb44e80fdbe39faffadc34d9c56a6a84542f
C:\Users\John\AppData\Local\Temp\mnqmIseuuYz.exe
C:\Users\admin\Downloads\8db04123cb8f5ec4a43658f207ee1a6f.virus.exe
C:\3a9062ac85aa9b50cc7ca292ce834f1985def9b06e5e9de2cb0f8ec05d36fc03
C:\87d4c95d99f5413f2fb57f73220aff9bc0138b64afe479a8c3fdff7db8bad402
C:\Users\admin\Downloads\budha.exe
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\Users\admin\Downloads\ecf5e161b3474a50_budha.exe
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\Users\admin\Downloads\9a935bfa9bedf64c_budha.exe
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\Users\admin\Downloads\8e11ef4310b27fe2_budha.exe
C:\b869a0efe3f3a642127bc9cd64514dc062ff3a1ee101206ee070cb77f9702219
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\e54058e0d3476eac70952253c35d0e52fb9316ec32c7abc0ff96e158d95f4095
C:\9a328072f5fa952bd67b890e19d08d0613b3f7fc03d5053b6cd3488adf8d247b
C:\Users\admin\Downloads\budha.exe
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\Users\admin\Downloads\71f778fa2bd404c4_budha.exe
C:\13f4a05276551cd22f2196ce1f470ddaac186b32f646e8e37fe14d5412d532ff
C:\cd7de3e7e957b634a32d242767dcceecf5955ef005c1be9fe9dd0ed5e0d23204
C:\Users\admin\Downloads\budha.exe
C:\276b3e07a6cd83640b9aaf4101f5368d37063195b667bbdaa6794b24d9028ab8
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\2b248aaddb8fd87e878e07415637df50b3c16dd161c6cececb206a50b2dd2853
C:\75e6b4b6022abce98c694620bfc018adab32e10951f227d5954f153a29518be1
C:\Users\Virtual\AppData\Local\Temp\0f9b069327e1d6c43db5a074e1b37ccccc8e051af1f873dad9f60e1a28ca6863.exe
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\Users\admin\Downloads\153f38d026d3cea2_budha.exe
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\e3afd2581f197331aa0b60a091bfd2c239b66b9b778f6692d3e3a0e6d83c7f6e
C:\Users\admin\Downloads\budha.exe
C:\91e3816ac3ee7e33b1f32b1b0b934fd898428e2654d7adcb3f5b29596055b70b
C:\Users\admin\Downloads\budha.exe
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\Users\admin\Downloads\de935d0d64bb4ef8_budha.exe
C:\82cd8b0098d45d0566bacd39bf450c2f4d1a399057867cd5aa451f0cf416b62f
C:\8a077b3d7eb49563cb5a6b76c29b26dde699463aa1901c21cd7db88f7f1ea540
C:\Users\admin\Downloads\budha.exe
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\8745340d89497762407b6bb8bc63f9b51ad6d1f31fa9023243714ef0e7acf358
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\Users\admin\Downloads\7cc7e62b7a2915f8_budha.exe
C:\dbb89bf47ef8a6718a0304ec2c5f4c9da09520417aab7ffcd1254f378944e66e
C:\7bdea35c04f8e70d03d4e32b6479dbea810187c8297c66bc86842c75294bece6
C:\194bcec1f94a7b0a78e136de50e30eb6228f98c8be5ebaf3dc1e1c4fae06b9d5
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\0fcfdf38eb9b66049f555d66a34712fbd4585e4a3b87a3577549002e2566492d
C:\35dfc59ac405c65a15360f0c29b004d57a8b52d350d468142d9cb57f9e7e6598
C:\Users\admin\Downloads\budha.exe

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.