| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| McAfee | 20200830 | 6.0.6.653 | |
| Alibaba | 20190527 | 0.3.0.5 | |
| Baidu | 20190318 | 1.0.0.2 | |
| Avast | 20200830 | 18.4.3895.0 | |
| Kingsoft | 20200830 | 2013.8.14.323 | |
| Tencent | 20200830 | 1.0.0.1 | |
| CrowdStrike | 20190702 | 1.0 |
| pdb_path | empty_pdb |
| resource name | BIN |
| name | BIN | language | LANG_KOREAN | offset | 0x008ad07c | filetype | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | sublanguage | SUBLANG_KOREAN | size | 0x0008c116 | ||||||||||||||||||
| name | BIN | language | LANG_KOREAN | offset | 0x008ad07c | filetype | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | sublanguage | SUBLANG_KOREAN | size | 0x0008c116 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_KOREAN | offset | 0x00951140 | filetype | data | sublanguage | SUBLANG_KOREAN | size | 0x00000348 | ||||||||||||||||||
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\NSaferCrypto.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\NSaferCrypto.dll |
| APEX | Malicious |
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1620765488.382498 GetAdaptersAddresses |
flags:
15
family: 0 |
failed | 111 | 0 |
| entropy | 7.938472548335352 | section | {'size_of_data': '0x00922600', 'virtual_address': '0x0002f000', 'entropy': 7.938472548335352, 'name': '.rsrc', 'virtual_size': '0x009225f0'} | description | A section with a high entropy has been found | |||||||||
| entropy | 0.9786555061470049 | description | Overall entropy of this PE file is high | |||||||||||
| process | system |
| host | 172.217.24.14 | |||
| dead_host | 125.141.228.45:80 |
| dead_host | 172.217.24.14:443 |
| dead_host | 172.217.160.110:443 |
| dead_host | 125.141.228.40:80 |
| dead_host | 172.217.160.78:443 |
No hosts contacted.
No TCP connections recorded.
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 50002 | 114.114.114.114 | 53 |
| 192.168.56.101 | 50568 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51963 | 114.114.114.114 | 53 |
| 192.168.56.101 | 53237 | 114.114.114.114 | 53 |
| 192.168.56.101 | 53380 | 114.114.114.114 | 53 |
| 192.168.56.101 | 55368 | 114.114.114.114 | 53 |
| 192.168.56.101 | 60123 | 114.114.114.114 | 53 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 123 | 20.189.79.72 time.windows.com | 123 |
| 192.168.56.101 | 53657 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 56804 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 57236 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 57874 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 58367 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 60384 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 62191 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 62318 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 62912 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 63429 | 224.0.0.252 | 5355 |
No HTTP requests performed.
No ICMP traffic performed.
No IRC requests performed.
No Suricata Alerts
No Suricata TLS
No Snort Alerts