2.3
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.61
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200116 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Agent.kj | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200116 | 2013.8.14.323 |
| McAfee | GenericRXAT-KR!70570157DC3C | 20200116 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b076db | 20200116 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545335.3905 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545342.781375 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
此可执行文件具有 PDB 路径
(1 个事件)
| pdb_path | uiopferta.pdb |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\szgfw.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\szgfw.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\szgfw.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x0000210a', 'size_of_data': '0x00002200', 'entropy': 6.976678225471402} | entropy | 6.976678225471402 | description | 发现高熵的节 | |||||||||
| entropy | 0.3333333333333333 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 66 个反病毒引擎识别为恶意
(50 out of 66 个事件)
| ALYac | Trojan.GenericKD.1801883 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1801883 |
| AhnLab-V3 | Trojan/Win32.Necurs.R115578 |
| Antiy-AVL | Trojan[Backdoor]/Win32.Androm |
| Arcabit | Trojan.Generic.D1B7E9B |
| Avast | Win32:Malware-gen |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan-Downloader.Agent.kj |
| BitDefender | Trojan.GenericKD.1801883 |
| BitDefenderTheta | Gen:NN.ZexaF.34082.fqZ@aG0fYvhi |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDwnldr.Upatre.AB4 |
| ClamAV | Win.Malware.Upatre-6732716-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Waski.FDA@5s4u0d |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.7dc3c8 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.PBPB-2165 |
| DrWeb | Trojan.DownLoad3.33795 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.F |
| Emsisoft | Trojan.GenericKD.1801883 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.JYB |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.70570157dc3c88df |
| Fortinet | W32/Kryptik.CKUG!tr |
| GData | Trojan.GenericKD.1801883 |
| Ikarus | Backdoor.Win32.Androm |
| Invincea | heuristic |
| Jiangmin | Backdoor/Androm.gxn |
| K7AntiVirus | Trojan-Downloader ( 004b8d561 ) |
| K7GW | Trojan-Downloader ( 004b8d561 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=84) |
| Malwarebytes | Trojan.Upatre |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericRXAT-KR!70570157DC3C |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.mt |
| MicroWorld-eScan | Trojan.GenericKD.1801883 |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.Dwn.ddtmhv |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM20.1.995D.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Upatre |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-02-20 03:20:30
PDB Path
uiopferta.pdb
PE Imphash
222e7b320f36011feb1642000d8fa826
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0000210a | 0x00002200 | 6.976678225471402 |
| .rdata | 0x00004000 | 0x00000708 | 0x00000800 | 4.108494791503498 |
| .data | 0x00005000 | 0x00000d43 | 0x00000e00 | 5.175104830655795 |
| .rsrc | 0x00006000 | 0x00002cae | 0x00002e00 | 3.123562248238736 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00006706 | 0x000025a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MENU | 0x000060f0 | 0x00000600 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x000066f0 | 0x00000016 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library cryptdll.dll:
• 0x404100 CDBuildVect
• 0x404104 MD5Update
• 0x404108 CDLocateRng
• 0x40410c MD5Init
Library shell32.dll:
• 0x404114 DragAcceptFiles
• 0x404118 SHCreateShellItem
• 0x40411c ShellAboutA
• 0x404120 SHGetFileInfoA
• 0x404124 StrChrA
• 0x404128 SHFileOperationA
• 0x40412c DragQueryFileA
• 0x404130 FreeIconList
• 0x404134 SHGetDataFromIDListA
• 0x404138 SHGetDiskFreeSpaceA
• 0x40413c FindExecutableA
• 0x404140 SHGetDesktopFolder
• 0x404144 ShellMessageBoxW
• 0x404148 SHGetFolderPathA
• 0x40414c SHGetMalloc
• 0x404150 DragFinish
Library dbnmpntw.dll:
• 0x404158 ConnectionClose
• 0x40415c ConnectionWrite
• 0x404160 ConnectionError
Library kernel32.dll:
• 0x404168 FileTimeToSystemTime
• 0x40416c SearchPathA
• 0x404170 OpenMutexA
• 0x404174 GetPrivateProfileIntW
• 0x404178 GetModuleHandleW
• 0x40417c GetLocalTime
• 0x404180 ReadConsoleW
• 0x404184 FindFirstFileA
• 0x404188 GetEnvironmentVariableA
• 0x40418c DeviceIoControl
• 0x404190 SetEnvironmentVariableW
• 0x404194 CompareStringW
• 0x404198 GetStringTypeW
• 0x40419c IsValidCodePage
• 0x4041a0 lstrcmpiA
• 0x4041a4 lstrcmpA
• 0x4041a8 TlsGetValue
• 0x4041ac GetProcAddress
• 0x4041b0 GetTickCount
• 0x4041b4 WriteConsoleA
• 0x4041b8 lstrcpynW
• 0x4041bc GetLastError
• 0x4041c0 CreateDirectoryA
• 0x4041c4 GetCurrentDirectoryW
• 0x4041c8 SetErrorMode
• 0x4041cc SleepEx
• 0x4041d0 InterlockedDecrement
• 0x4041d4 GetFullPathNameW
• 0x4041d8 GetPrivateProfileIntW
• 0x4041dc IsBadStringPtrA
L!That program cannot be run in DOS mode.
`.rdata
@.data
.4$g)=4P@
^!5@Q@
t;8{1j[<U@
P^=8U@
3!5RQ@
4$U15P@
$u*%P@
H)=}Q@
aXPh\@
Y1=9Q@
W(-|Q@
{a99azza==aGGaaGGaaGGaaGGaaGGaaGGaaG~
wIH'Oib
NWsCllC##B B##B B#"BB))HH))HHBBXXBBXXBBZZFFZZBBZZBBXXBBXHBBXHBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXX
===--////
~<EbT0k;".z)~ZMC
KW31-G2J0A=
TkxG T
RfSa88at
EUnoHGl
g``! 5 !
xZhiT?>h
O \D~M!
+M&8O@K&KL
$!OB2dxFd
?Brs#GE
cjuCCEj%Y^^1`
A`EQ0T
I#@('G@
f~a$xj{
PXOrrOXU
F??Fob
r /<<EG
^Czc&\.9.6=gtHprra$
rCCCA)
`p&|-}
K#4nn<#31[3Y0.n[YYY'
rTW0\ttA
#ta$b/}
o~7-Xy~(FJ
s~Z|m|K
ABoBAQ
gO~IMmO
KY:N=Jauua74)
5s#paE
vaD33D
Ch!So?
oOz*S\
B=+x#!
2"UUWC_v1?
f[=fUZ+
! l5,1'1tk
Lm'GPE
66\\Q\#oT:
Nf1"1uVqx
hQR*K
]&v vs
ZnAnZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ-->>-->>
77hhmmmmuu[[
ccPP00
ePKKPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
MD5Init
MD5Update
CDLocateRng
CDBuildVect
cryptdll.dll
SHCreateShellItem
ShellAboutA
SHGetDiskFreeSpaceA
DragQueryFileA
SHGetFolderPathA
SHGetFileInfoA
FreeIconList
SHGetMalloc
DragFinish
ShellMessageBoxW
SHGetDesktopFolder
StrChrA
FindExecutableA
SHFileOperationA
DragAcceptFiles
SHGetDataFromIDListA
shell32.dll
ConnectionError
ConnectionClose
ConnectionWrite
dbnmpntw.dll
WriteConsoleA
IsValidCodePage
IsBadStringPtrA
CreateDirectoryA
OpenMutexA
GetProcAddress
InterlockedDecrement
CompareStringW
SleepEx
ReadConsoleW
GetModuleHandleW
GetFullPathNameW
SearchPathA
GetLastError
lstrcpynW
FindFirstFileA
GetLocalTime
DeviceIoControl
GetStringTypeW
GetTickCount
GetCurrentDirectoryW
lstrcmpA
GetEnvironmentVariableA
GetPrivateProfileIntW
FileTimeToSystemTime
GetPrivateProfileIntW
lstrcmpiA
TlsGetValue
SetEnvironmentVariableW
SetErrorMode
kernel32.dll
jscript.DLL
LoadLibraryA
TrO(t#C
6V!#}mm+}
8h<J)@Q
V:ppX$
Otr42}
qV$ VVY%2#n,V
?MHR,R
`|]%Q|#/
OxqM:$M
yYuiyZ
}u$rVMK
t[tv}yz
sy3SB8
4P<:@wvI*
t>Ebp<
GLP[_>3d6G
%xV\\9
6>Pc>tltw.lll&h~
ImVr|J*
VCh~8T~]
&ZTVCdfe#1C
Jx|b1qX
T;%o4\uu"-
Kh?0ub`8
.HeapCreate
WriteProcessMemory
fmtmtzlnik
fmtmtzlnik
ldlaivqxuju
vonrjrzk
nbarkmefzda
vjiyymiqvgoxh
hwiwjgtqkyrjleqld
kltjziry
ishueinxvfhblayn
ulbitvgjhqsnlryi
iymyivqsw
iymyivqsw
hqedcpekvgn
mvmpnewbmhkc
uiopferta.pdb
=Ch$$$
Xur$$$
f0xf$$$
!vv$$$
BhB$$$
H!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T
N!S!S!S!S!S!S!S!S S!S!S!S!S S S S!U!S!S S!S!S!S!S!S!S!S!S!S!S
Q"X"X"X"X"X"X"X"X"X"X"X"Xn"X"X"X"X"X"X"X"X"X"X"X"X Q$$$
Q#Z#Z#Z#Z#Z#Z#Z#Z"W"X#V#Zs#Z#Z#Z#Z#Z#Z#Z#Z#Z#Z#Z#Z Q$$$
Q*_*_*_*_*_*_*_*_*_*_t*_*_#V#V']*_*_*_*_*_*_*_!S$$$
#Y/`/`/`/`/`/`/`/`Lp/`/`.b/`/`/`/`/`/`/`/`/`#Y$$$
*_5h5h5h5h5h5h5h5h5hf5h5hx5h5h5h5h5h5h5h5h5h5h5h5h*_$$$
1e:k:k:k:k:k:k:k:kg:kg:k:k1e1e:k:k:k:k:k:k:k:k1e$$$
:k?m?m?m?m?m?m?m?m?m~?m?m?m?m?m?m?m?m?m:k$$$
?mFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFq?m$$$
HvJuFqFqFqJuJuJuJuJuJuJuJuJuJuJuJuJuJuJuJuJuFqFqFqFqFqFqJuJuJuHv$$$
HvHvooooooooooooooooooooooooooooHvOz$$$
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Error: %s
Failed to create secondary thread
The GLFW library is not initialized
There is no current context
Invalid argument for enum parameter
Invalid value for parameter
Out of memory
The requested client API is unavailable
The requested client API version is unavailable
A platform-specific error occurred
The requested format is unavailable
ERROR: UNKNOWN ERROR TOKEN PASSED TO glfwErrorString
Invalid window size
Invalid window hint
Full screen windows cannot be moved
Invalid window attribute
Invalid cursor mode
Invalid input mode
Invalid input mode
Invalid key
Invalid mouse button
Invalid standard cursor
Invalid joystick
Invalid joystick
Invalid joystick
Invalid joystick
Invalid time
glGetIntegerv
glGetString
glClear
glGetStringi
Entry point retrieval is broken
GL_ARB_debug_output
GL_ARB_compatibility
GL_ARB_robustness
GL_EXT_robustness
GL_KHR_context_flush_control
Failed to retrieve extension string %i
Failed to retrieve extension string
OpenGL ES-CM
OpenGL ES-CM
OpenGL ES-CL
OpenGL ES-CL
OpenGL ES
OpenGL ES
Failed to retrieve context version string
%d.%d.%d
No version found in context version string
Invalid client API
Invalid OpenGL version %i.%i
Invalid OpenGL profile
Invalid OpenGL ES version %i.%i
Invalid context release behavior
Context profiles are only defined for OpenGL version 3.2 and above
Invalid context robustness mode
Forward-compatibility is only defined for OpenGL version 3.0 and above
Win32: Failed to load winmm.dll
joyGetDevCapsW
joyGetPos
joyGetPosEx
timeGetTime
Win32: Failed to load winmm functions
SetProcessDPIAware
ChangeWindowMessageFilterEx
DwmIsCompositionEnabled
DwmFlush
3.1.2 Win32 WGL VisualC
Win32: Failed to set video mode
Win32: Failed to convert string to UTF-8
Win32: Gamma ramp size must be 256
Invalid gamma value
Win32: Failed to convert window title to UTF-16
Win32: Failed to create window
Win32: Failed to register window class
Win32: Failed to convert window title to UTF-16
Win32: Failed to create standard cursor
Win32: Failed to conver
Borland C++ - Copyright 2002 Borland Corporation
UUUUUUUconsole_exe
Retrieving module name
PYTHONSCRIPT
Could not locate script resource:
Could not load script resource:
Could not lock script resource:
Bug: Invalid script resource
PYTHON27.DLL
PYTHON27.DLL
Could not load python dll
<pythondll>
PYTHON27.DLL
PYTHON27.DLL
LoadLibrary(pythondll) failed
zlib.pyd
initzlib
ZLIB.PYD
zlib.pyd
initzlib
<pythondll>
<zlib.pyd>
Not enough space for new sys.path
no mem for late sys.path
PY2EXE_VERBOSE
PY2EXE_VERBOSE
frozen
frozen
PYTHONINSPECT
<stdin>
<stdin>
__main__
Py_Initialize
PyRun_SimpleString
Py_Finalize
Py_GetP
.?AVtype_info@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
double
mahalanobis
[ %10f %10f ]
[ %10f %10f ]
det(M) = %f
det(U) = %f
det(V) = %f
det(S) = %f
cyggcc_s-1.dll
__register_frame_info
cyggcj-11.dll
_Jv_RegisterClasses
__deregister_frame_info
closing %s (fd=%d)
%s==> %s <==
write error
error reading %s
%s: cannot seek to offset %s
%s: cannot seek to relative offset %s
%s: cannot seek to end-relative offset %s
standard input
valid_file_spec (f)
/usr/src/coreutils-8.15-1/src/coreutils-8.15/src/tail.c
%s has become inaccessible
%s has been replaced with an untailable file; giving up on this name
f->fd == -1
%s has become accessible
%s has appeared; following end of new file
%s has been replaced; following end of new file
Try `%s --help' for more information.
Usage: %s [OPTION]... [FILE]...
Print the last %d lines of each FILE to standard output.
With more than one FILE, precede each with a header giving the file name.
With no FILE, or when FILE is -, read standard input.
Mandatory arguments to long options are mandatory for short options too.
-c, --bytes=K output the last K bytes; alternatively, use -c +K
to output bytes starting with the Kth of each file
-f, --follow[={name|descriptor}]
output appended data as the file grows;
-f, --follow, and --follow=descriptor are
equivalent
-F same as --follow=name --retry
-n, --lines=K output the last K lines, instead of the last %d;
or use -n +K to output lines starting with the Kth
--max-unchanged-stats=N
with --follow=name, reopen a FILE which has not
changed size after N (default %d) iterations
to see if it has been unlinked or renamed
(this is the usual case of rotated log files).
With inotify,
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVResolverThunk@sandbox@@
.?AVService64ResolverThunk@sandbox@@
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
0123456789abcdef
0123456789ABCDEF
%a %b %d %H:%M:%S %Z %Y
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Runtime error at 00000000
?q<Ga7B_
|Wz6@Ek
MS Sans Serif
M`* !sG3^F
.?AVCComModule@ATL@@
.?AV?$CAtlModuleT@VCComModule@ATL@@@ATL@@
.?AVCAtlModule@ATL@@
.?AU_ATL_MODULE70@ATL@@
.?AVCAtlException@ATL@@
.?AVCRegObject@ATL@@
.?AUIRegistrarBase@@
.?AUIUnknown@@
.?AV_com_error@@
.?AVtype_info@@
new_graph
Agnodeinfo_t
cluster1
@Borland C++ - Copyright 1999 Inprise Corporation
Syntax: adjust filename scale
Unable to open file!
Invalid file format!
Not enough memory!
Done !
borlndmm
hrdir_b.c: LoadLibrary != mmdll borlndmm failed
borlndmm
@Borlndmm@SysGetMem$qqri
@Borlndmm@SysFreeMem$qqrpv
@Borlndmm@SysReallocMem$qqrpvi
<notype>
id->tpName
xxtype.cpp
xxtype.cpp
xxtype.cpp
tp1->tpName
xxtype.cpp
tp2->tpName
xxtype.cpp
IS_STRUC(base->tpMask)
xxtype.cpp
IS_STRUC(derv->tpMask)
xxtype.cpp
derv->tpClass.tpcFlags & CF_HAS_BASES
xxtype.cpp
((unsigned __far *)vtablePtr)[-1] == 0
xxtype.cpp
<notype>
topTypPtr != 0 && IS_STRUC(topTypPtr->tpMask)
xxtype.cpp
tgtTypPtr != 0 && IS_STRUC(tgtTypPtr->tpMask)
xxtype.cpp
srcTypPtr == 0 || IS_STRUC(srcTypPtr->tpMask)
xxtype.cpp
__isSameTypeID(srcTypPtr, tgtTypPtr) == 0
xxtype.cpp
tgtTypPtr != 0 && __isSameTypeID(topTypPtr, tgtTypPtr) == 0
xxtype.cpp
srcTypPtr
xxtype.cpp
((unsigned __far *)vtablePtr)[-1] == 0
xxtype.cpp
xxtype.cpp
Can't adjust class address (no base class entry found)
!"Can't adjust class address (no base class entry found)"
xxtype.cpp
___CPPdebugHook
Stack Overflow!
),(((((),(((
Error 0
Invalid function number
No such file or directory
Path not found
Too many open files
Permission denied
Bad file number
Memory arena trashed
Not enough memory
Invalid memory block address
Invalid environment
Invalid format
Invalid access code
Invalid data
Bad address
No such device
Attempted to remove current directory
Not same device
No more files
Invalid argument
Arg list too big
Exec format error
Cross-device link
Too many open files
No child processes
Inappropriate I/O control operation
Executable file in use
File too large
No space left on device
Illegal seek
Read-only file system
Too many links
Broken pipe
Math argument
Result too large
File already exists
Possible deadlock
Operation not permitted
No such process
Interrupted function call
Input/output error
No such device or address
Resource temporarily unavailable
Block device required
Resource busy
Not a directory
Is a directory
Directory not empty
Unknown error
(null)
%H:%M:%S
%m/%d/%y
%A, %B %d, %Y
Monday
Tuesday
console_exe
Retrieving module name
PYTHONSCRIPT
Could not locate script resource:
Could not load script resource:
Could not lock script resource:
Bug: Invalid script resource
PYTHON27.DLL
PYTHON27.DLL
Could not load python dll
<pythondll>
PYTHON27.DLL
PYTHON27.DLL
LoadLibrary(pythondll) failed
zlib.pyd
initzlib
ZLIB.PYD
zlib.pyd
initzlib
<pythondll>
<zlib.pyd>
Not enough space for new sys.path
no mem for late sys.path
PY2EXE_VERBOSE
PY2EXE_VERBOSE
frozen
frozen
PYTHONINSPECT
<stdin>
<stdin>
__main__
Py_Initialize
PyRun_SimpleString
Py_Finalize
Py_GetPath
Py_SetPythonHome
Py_SetProgramName
PyMarshal_ReadObjectFromString
PyObject_CallFunction
PyString_AsStringAndSize
PyString_AsString
PyArg_ParseTuple
PyErr_Format
PyImport_ImportModule
PyInt_FromLong
PyInt_AsLong
PyLong_FromVoidPtr
Py_InitModule4
PyTuple_New
PyTuple_SetItem
Py_IsInitialized
PyObject_SetAttrString
PyCFunction_NewEx
PyObject_GetAttrString
Py_BuildValue
PyObject_Call
PySys_WriteStderr
PyErr_Occurred
PyErr_Clear
PyObject_IsInstance
PyInt_Type
_Py_NoneStruct
PyExc_ImportError
_Py_PackageContext
PyGILState_Ensure
PyGILState_Release
PySys_SetObject
PySys_GetObject
PyString_FromString
Py_FdIsInteractive
PyRun_InteractiveLoop
PySys_SetArgv
PyImport_AddModule
PyModule_GetDict
PySequence_Length
PySequence_GetItem
PyEval_EvalCode
PyErr_Print
PyBool_FromLong
Py_VerboseFlag
Py_NoSiteFlag
Py_OptimizeFlag
Py_IgnoreEnvironmentFlag
PyObject_Str
PyList_New
PyList_SetItem
PyList_Append
undef symbol
undefined symbol %s -> exit(-1)
undef symbol
undefined symbol %s -> exit(-1)
Importer which can load extension modules from memory
|O:set_find_proc
s#sss:import_module
MemoryLoadLibrary failed loading %s
Could not find function %s
import_module
import_module(code, initfunc, dllname[, finder]) -> module
get_verbose_flag
Return the Py_Verbose flag
set_find_proc
_memimporter
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVCAbout@@
.?AVCDialog@acWindow@@
.?AVCWindow@acWindow@@
.?AVcImage@@
.?AVCListView@acWindow@@
.?AVCStatic@acWindow@@
.?AVCStatusBar@acWindow@@
.?AVruntime_error@std@@
.?AVexception@std@@
.?AVfailure@ios_base@std@@
.?AVsystem_error@std@@
.?AVbad_cast@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV_Facet_base@std@@
.?AVfacet@locale@std@@
.?AUctype_base@std@@
.?AV?$ctype@D@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AV?$numpunct@D@std@@
.?AVCCharWin@@
.?AVCChooseFont@@
.?AVCExportDlg@@
.?AVCIconImageDlg@@
.?AVCImageMgr@@
.?AVcImageWnd@@
Application was compiled with png.h from libpng-%.20s
Application is running with png.c from libpng-%.20s
Incompatible libpng version in application and
?33>33>
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVdataflow_exception@iterators@archive@boost@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AVruntime_error@std@@
.?AVclone_base@exception_detail@boost@@
.?AVplaceholder@any@boost@@
.?AVptree_error@property_tree@boost@@
.?AVptree_bad_data@property_tree@boost@@
.?AVptree_bad_path@property_tree@boost@@
.?AVbad_lexical_cast@boost@@
.?AVbad_cast@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AVexception@boost@@
.?AV?$numpunct@D@std@@
.?AVfacet@locale@std@@
.?AU?$error_info_injector@Vbad_lexical_cast@boost@@@exception_detail@boost@@
.?AU?$error_info_injector@Vptree_bad_path@property_tree@boost@@@exception_detail@boost@@
.?AU?$error_info_injector@Vptree_bad_data@property_tree@boost@@@exception_detail@boost@@
.?AV?$clone_impl@U?$error_info_injector@Vbad_lexical_cast@boost@@@exception_detail@boost@@@exception_detail@boost@@
.?AV?$clone_impl@U?$error_info_injector@Vptree_bad_path@property_tree@boost@@@exception_detail@boost@@@exception_detail@boost@@
.?AV?$clone_impl@U?$error_info_injector@Vptree_bad_data@property_tree@boost@@@exception_detail@boost@@@exception_detail@boost@@
.?AVfile_parser_error@property_tree@boost@@
.?AU?$error_info_injector@Vxml_parser_error@xml_parser@property_tree@boost@@@exception_detail@boost@@
.?AVxml_parser_error@xml_parser@property_tree@boost@@
.?AV?$holder@V?$string_path@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$id_translator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@property_tree@boost@@@property_tree@boost@@@any@boost@@
.?AV?$string_path@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$id_translator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@property_tree@boost@@@property_tree@boost@@
.?AV?$holder@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@any@boost@@
.?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@
.?AV?$clone_impl@U?$error_info_injector@Vxml_parser_error@xml_parser@property_tree@boost@@@exception_detail@boost@@@exception_detail@boost@@
.$$BY09$$CBD
.$$BY00$$CBD
.$$BY0CK@$$CBD
.?AVparse_error@rapidxml@detail@property_tree@boost@@
.?AV?$basic_ifstream@DU?$char_traits@D@std@@@std@@
.?AVbad_exception@std@@
.?AVloC
k e r n e l 3 2 . D L L
W F F F E E E E D
C : \ U s e r s \ U s e r \ D e s k t o p \ R e f _ 1 1 0 8 2 0 1 4 . s c r
C : \ 9 8 b 2 c 2 c 0 d b b 6 4 6 e f d d c f 6 e 0 b 6 4 2 b 1 f 3 a 8 6 9 7 f e 3 c 7 7 f a d 9 c 1 3 3 0 4 9 b 6 5 d a 6 a f 0 d c
C : \ Q k A i x j K C . e x e
C : \ Z R N R v X V 1 . e x e
C : \ 1 a 1 a f 2 c b 7 7 3 6 a 4 1 0 1 6 3 4 2 2 9 f 6 3 9 b 5 6 5 2 5 2 c 2 6 9 d f e c 6 a 1 b 7 1 1 d 2 7 c 3 f 9 a 3 4 9 2 b 4 1
C : \ l n U z E 1 Q 7 . e x e
C : \ S D 5 P d 9 0 7 . e x e
C : \ T Y 5 B 3 Q q 8 . e x e
C : \ c 5 T M z i i 3 . e x e
C : \ b 2 7 b a 4 f 5 b 9 0 a 0 5 7 c f b 5 8 5 d 0 2 a b 7 e a 9 3 6 4 f c e f 8 4 7 d 1 e f a 5 5 2 e b 9 b 0 f 3 9 c 2 c 3 5 8 1 7
C : \ b 6 c a e 1 e 3 5 4 5 3 0 9 f 4 e 1 6 2 9 1 a c 8 9 8 c 1 d 5 8 e 5 1 3 e 4 4 0 8 e 0 4 6 4 9 a 6 3 c 4 2 6 b 5 0 7 6 1 3 6 6 4
C : \ a e 7 8 0 0 2 3 8 b b d 9 1 5 4 5 e 9 d 3 5 e 4 8 4 b b 2 f 8 5 e 2 3 a a c 9 e 1 7 7 7 d 3 b f c 9 7 8 b f 4 6 7 5 6 e 9 0 c 0
C : \ d 6 c c 6 9 1 9 1 b 3 d b 0 e b a f 9 4 c b 4 9 8 e 8 0 c 3 d a 4 3 5 5 d 1 5 4 e 4 6 f d c 8 4 a 7 4 5 3 e 8 6 5 a b f f a b 4
C : \ B 8 v j e b 4 O . e x e
C : \ E s Y D u r H P . e x e
C : \ Y L w e o R q 1 . e x e
C : \ X k S 7 B o X 5 . e x e
C : \ 4 h r _ 4 l 6 I . e x e
C : \ o W f 0 A B h 1 . e x e
C : \ O r h U 2 e Z b . e x e
C : \ 6 m d o G G k v . e x e
C : \ N 5 g S 8 h 0 J . e x e
C : \ W l E 9 T q v o . e x e
C : \ 3 a 4 Y 5 6 7 b . e x e
C : \ n i m C v q S N . e x e
C : \ E W b j P v A 4 . e x e
C : \ 6 N m 4 o X a z . e x e
C : \ 0 E K r I j y z . e x e
C : \ A K X T 8 0 i G . e x e
C : \ W 8 n 2 K R U p . e x e
C : \ i t I r 1 U T z . e x e
C : \ X Y t t 5 c 6 K . e x e
C : \ q D X i S q L 6 . e x e
C : \ a l p a l 1 3 l . e x e
C : \ Y T x o R Y U 0 . e x e
C : \ P F t F H E K 9 . e x e
C : \ 6 c w x i e t N . e x e
C : \ l l 8 _ n H g d . e x e
C : \ M n O f j c G 6 . e x e
C : \ _ r q g d t l 2 . e x e
C : \ V D L C T Z 9 y . e x e
C : \ K 3 K 5 6 4 1 Q . e x e
C : \ 5 2 H i 5 5 x 6 . e x e
C : \ R 3 U 9 E r w U . e x e
C : \ o K q c w H 9 n . e x e
C : \ e C y M q X E 9 . e x e
C : \ 6 D N D P C D A . e x e
C : \ u d v B H I H y . e x e
C : \ d f f a a a 4 e 1 b a 9 4 c 6 0 f 6 b 9 b 4 c 8 7 2 c a d d 7 0 7 3 5 c 4 5 a 9 3 a 1 8 3 a 1 0 6 6 3 4 2 4 0 5 a c d f b 4 f 6
C : \ n 1 B W N 5 P N . e x e
C : \ I M b V K v w T . e x e
C : \ o m e H o A 0 l . e x e
C : \ i X B o 7 r U m . e x e
C : \ N 4 I l H 2 k x . e x e
C : \ F c 0 u C h h I . e x e
C : \ U Y d x V P p 3 . e x e
C : \ a M h c 7 T 4 9 . e x e
C : \ r _ M g N v H n . e x e
C : \ U N U E A e n E . e x e
C : \ V g K 5 z o g I . e x e
C : \ k i B r r 6 f y . e x e
C : \ d e o k 0 W I R . e x e
C : \ t p u h e 9 d n . e x e
C : \ Q a 1 D z U 2 U . e x e
C : \ J f D b A i e t . e x e
C : \ Z e J w m S k f . e x e
C : \ o Q K E s r 2 Y . e x e
C : \ q j 7 F L G N c . e x e
C : \ 3 4 3 C V q L Y . e x e
C : \ A n z f E 8 D o . e x e
C : \ y A V B W w s p . e x e
C : \ 0 y R A G C d i . e x e
C : \ B W F B w l y 8 . e x e
C : \ r G n X n 2 N K . e x e
C : \ D I k L n k b v . e x e
C : \ 3 x N J f _ q m . e x e
C : \ W x W J g 0 F b . e x e
C : \ e 3 7 K I I F 6 . e x e
C : \ 9 _ F o j V U m . e x e
C : \ f T G i l q r o . e x e
C : \ M S X o A W T c . e x e
C : \ d r P m f 2 t 2 . e x e
C : \ O j 3 c i z t E . e x e
C : \ L u y c D w u H . e x e
C : \ F d L x P O 0 s . e x e
C : \ q R d a Z 9 z 5 . e x e
C : \ P 4 c c 6 z X _ . e x e
C : \ V j 4 O f N J F . e x e
C : \ i Q 5 P J Z 2 t . e x e
C : \ 5 B 4 c N p K R . e x e
C : \ S E L F . E X E
C : \ K L R y _ U z 0 . e x e
C : \ h v P V x B f O . e x e
C : \ i A x H s a P L . e x e
C : \ k B d D 4 V X w . e x e
C : \ l l _ w z N A y . e x e
C : \ T K F a R v F Z . e x e
C : \ J 3 n B a e z I . e x e
C : \ 6 d Z S J j A k . e x e
C : \ x s G w a A 3 b . e x e
C : \ p M c o y v j x . e x e
C : \ A Q g V R Y C I . e x e
C : \ W n R 5 A W 0 a . e x e
C : \ h 6 V 5 H S 2 b . e x e
C : \ 7 4 P v q E f z . e x e
C : \ u x 2 M 8 6 0 g . e x e
C : \ K T Y R Y J Z a . e x e
C : \ E z V I a G 4 2 . e x e
C : \ S 4 a R g e Y 8 . e x e
C : \ h v b i e k A T . e x e
C : \ k 9 A 4 R 9 f Q . e x e
@ @ @ @ @ @
w i n m m . d l l
u s e r 3 2 . d l l
d w m a p i . d l l
D I S P L A Y
D I S P L A Y
D I S P L A Y
6 G L F W 3 0
G L F W 3 0
G L F W _ I C O N
G L F W 3 0
( ( ( ( ( H
% . * d @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @
E p E + E U
@ @ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @
( n u l l )
( ( ( ( ( H
@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
F o n t R o t
F o n t R o t : R o t a t e d F o n t s
R o t a t i o n
C : \ 1 0 5 f 9 7 e b 6 0 3 1 f 6 5 d 2 d c 0 c c c a a a e 2 c b a e e 5 5 f c 9 d 2 2 2 7 4 1 8 b 6 6 2 5 0 8 5 c 6 d 9 0 5 7 f b 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ s z g f w . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 7 a d 5 f 6 2 b b 0 1 8 4 5 2 _ s z g f w . e x e
C : \ e 5 2 d e 8 a 4 7 6 f 2 3 f 6 e b 0 9 9 c 7 f 3 1 d 8 6 e 1 e 6 7 7 c 8 b 6 7 0 a 0 d 7 f d 5 2 5 e a 2 8 a 8 5 2 6 c b 6 4 6 f
C : \ 9 0 4 e e 0 d 9 8 3 2 d 1 4 1 2 6 f c a e 0 9 0 9 c 5 b b 5 1 9 2 4 b 6 9 0 2 1 7 4 5 1 8 5 8 f d 6 a 3 6 2 d 4 5 7 d 2 e b 8 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s z g f w . e x e
C : \ 3 b e e f f 1 2 c 1 f 9 2 b 7 0 e d 8 e 5 3 4 1 a 6 7 6 e 3 a 2 4 6 0 2 b 9 5 5 a 7 f 2 f 9 d 0 f 4 5 8 1 f 5 f 2 c b 1 e 4 3 b
C : \ 6 4 4 5 6 2 4 b a 9 b a 8 2 a 9 3 3 0 7 e d d 3 f d 8 5 1 f 0 e 0 5 8 9 6 7 1 5 9 5 0 4 e e 5 6 e 2 9 b d d a 8 7 3 8 f f a 1 d
C : \ 4 6 8 2 3 5 3 1 7 2 1 1 d 0 8 c 1 2 e 9 7 1 4 1 0 2 5 2 9 e 8 2 a a d 4 5 c c f 7 c 6 8 8 6 b e 5 6 9 a 3 2 7 b 4 d e 3 2 1 9 4
C : \ 5 b 7 0 0 c 7 6 f e a d 3 0 d d 3 0 e 4 9 c 2 3 e 7 d 6 d 4 5 c b d 5 0 d 2 6 7 6 d 3 4 1 8 b c 2 7 0 a 1 f a 1 9 b 1 9 9 6 0 d
C : \ 3 e 7 0 2 6 4 7 9 3 0 5 c f 0 a c 0 b e f 7 6 f e 1 b 4 c 3 8 9 3 a e a c f 6 2 9 e c c 5 4 c c 8 6 d c 7 f 3 9 d e 8 a a 3 1 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s z g f w . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ s z g f w . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 9 6 1 5 0 1 c b 6 3 7 6 b 4 b _ s z g f w . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ s z g f w . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ s z g f w . p e 3 2
C : \ f 2 c 1 d a 6 2 7 7 1 f 0 f 1 8 4 5 d 0 b 9 6 0 e 5 0 9 a 6 8 b 4 3 d b a c c 5 9 4 f 9 e 2 6 7 9 6 7 5 5 3 a 4 d 9 3 c b b b e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ s z g f w . p e 3 2
Process Tree
-
0ad754f20303949633924aea7f723b6cd252934fa6212069d44d5765aafa1ce8.exe (3028)
"C:\Users\Administrator\AppData\Local\Temp\0ad754f20303949633924aea7f723b6cd252934fa6212069d44d5765aafa1ce8.exe"
- szgfw.exe (2660) "C:\Users\ADMINI~1\AppData\Local\Temp\szgfw.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 8c5a9b31758f651e_szgfw.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\szgfw.exe |
| Size | 90.2KB |
| Processes | 3028 (0ad754f20303949633924aea7f723b6cd252934fa6212069d44d5765aafa1ce8.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 598f45c83574cff91f9d3ba5cce217fe |
| SHA1 | f5f8c1d365b8733ffc95bb1adf1fb81895b6e67c |
| SHA256 | 8c5a9b31758f651ea8c5b9810469bd0d38d54ea55816754c351610200f5f5417 |
| CRC32 | D0447A64 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.