3.4
中危
57 个模型检测该样本为恶意！
重新分析
更多

eda548b9ecb44f1c5a9851c598cc7a2b4d8caadd78d153ecee23dbcb1bb1c26d

7234fec90a0880b7d545a3629fa2eff1.exe

分析耗时

37s

最近分析

文件大小

1.0MB
静态报毒 动态报毒 100% AGEN AI SCORE=100 AIDETECTVM ARZ@ASP8FVMG ATTRIBUTE BSCOPE CHAPAK CLOUD CONFIDENCE EKYP ELDORADO ELTY FSEU GDSDA GENCIRC GENERICKDZ GENKRYPTIK HCUS HIGH CONFIDENCE HIGHCONFIDENCE HJCRFB KRYPTIK MALICIOUS PE MALPE MALWARE1 MALWARE@#2VGZAIOXPRQZT QBJNLKGLUXU RANSOMX RANUMBOT SCORE SPYEYE SPYEYES SUSGEN UNSAFE WACATAC X2062 ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Trojan-FSEU!7234FEC90A08 20200811 6.0.6.653
Alibaba Trojan:Win32/Chapak.520e3c66 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:RansomX-gen [Ransom] 20200811 18.4.3895.0
Tencent Malware.Win32.Gencirc.1167de03 20200811 1.0.0.1
Kingsoft 20200811 2013.8.14.323
静态指标
This executable has a PDB path (1 个事件)
pdb_path C:\wutulo duyumapowilomelepo93\merajuf\potal_turu zupowibuk.pdbal.pdb
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name ZIDEBOBEPESODIXOYAT
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1620967628.347875
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 352256
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x002aa000
success 0 0
1620967628.378875
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 561152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02ed0000
success 0 0
Foreign language identified in PE resource (50 out of 60 个事件)
name ZIDEBOBEPESODIXOYAT language LANG_SERBIAN offset 0x02a446c0 filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_ARABIC_OMAN size 0x000022ba
name ZIDEBOBEPESODIXOYAT language LANG_SERBIAN offset 0x02a446c0 filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_ARABIC_OMAN size 0x000022ba
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_ICON language LANG_SERBIAN offset 0x02a441e0 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN size 0x00000468
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
name RT_STRING language LANG_SERBIAN offset 0x02a48e30 filetype data sublanguage SUBLANG_ARABIC_OMAN size 0x00000194
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.925891659428349 section {'size_of_data': '0x00069400', 'virtual_address': '0x00001000', 'entropy': 7.925891659428349, 'name': '.text', 'virtual_size': '0x00069206'} description A section with a high entropy has been found
entropy 0.7093513058129739 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.66624
FireEye Generic.mg.7234fec90a0880b7
McAfee Trojan-FSEU!7234FEC90A08
Cylance Unsafe
Zillya Trojan.Chapak.Win32.85863
Sangfor Malware
K7AntiVirus Trojan ( 0056809d1 )
Alibaba Trojan:Win32/Chapak.520e3c66
K7GW Trojan ( 00564bda1 )
CrowdStrike win/malicious_confidence_100% (W)
Invincea heuristic
F-Prot W32/Wacatac.BN.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:RansomX-gen [Ransom]
ClamAV Win.Dropper.Spyeye-7678977-0
GData Trojan.GenericKDZ.66624
Kaspersky Trojan.Win32.Chapak.ekyp
BitDefender Trojan.GenericKDZ.66624
NANO-Antivirus Trojan.Win32.Stealer.hjcrfb
Paloalto generic.ml
ViRobot Trojan.Win32.Z.Wacatac.1048576.I
Tencent Malware.Win32.Gencirc.1167de03
Ad-Aware Trojan.GenericKDZ.66624
Comodo Malware@#2vgzaioxprqzt
F-Secure Heuristic.HEUR/AGEN.1136028
DrWeb Trojan.PWS.Stealer.28172
VIPRE Trojan.Win32.Generic!BT
Sophos Mal/Generic-S
SentinelOne DFI - Malicious PE
Cyren W32/Wacatac.BN.gen!Eldorado
Jiangmin Trojan.Chapak.jiq
Avira HEUR/AGEN.1136028
Antiy-AVL Trojan/Win32.Wacatac
Arcabit Trojan.Generic.D10440
AegisLab Trojan.Win32.Chapak.4!c
ZoneAlarm Trojan.Win32.Chapak.ekyp
Microsoft Trojan:Win32/SpyEyes.PVS!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.MalPe.X2062
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34152.arZ@aSP8FVmG
ALYac Trojan.GenericKDZ.66624
MAX malware (ai score=100)
VBA32 BScope.Trojan.AET.281105
Malwarebytes Trojan.MalPack.GS
ESET-NOD32 a variant of Win32/Kryptik.HCUS
Rising Trojan.Kryptik!1.C52F (CLOUD)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-06-23 14:14:07

Imports

Library KERNEL32.dll:
• 0x46b000 SizeofResource
• 0x46b004 GetAtomNameW
• 0x46b008 lstrlenW
• 0x46b00c GetTempPathW
• 0x46b010 GetLastError
• 0x46b014 SetComputerNameA
• 0x46b018 LocalAlloc
• 0x46b028 GetTickCount
• 0x46b02c GetModuleHandleW
• 0x46b030 FindFirstFileExW
• 0x46b038 HeapAlloc
• 0x46b03c GetLocaleInfoA
• 0x46b040 GetProcAddress
• 0x46b044 WideCharToMultiByte
• 0x46b050 InterlockedExchange
• 0x46b054 MultiByteToWideChar
• 0x46b058 GetStringTypeW
• 0x46b05c EncodePointer
• 0x46b060 DecodePointer
• 0x46b064 Sleep
• 0x46b078 HeapFree
• 0x46b07c GetCommandLineA
• 0x46b080 HeapSetInformation
• 0x46b084 GetStartupInfoW
• 0x46b088 GetCPInfo
• 0x46b08c RaiseException
• 0x46b090 RtlUnwind
• 0x46b094 LCMapStringW
• 0x46b098 TerminateProcess
• 0x46b09c GetCurrentProcess
• 0x46b0a8 IsDebuggerPresent
• 0x46b0b0 HeapCreate
• 0x46b0b4 ExitProcess
• 0x46b0b8 WriteFile
• 0x46b0bc GetStdHandle
• 0x46b0c0 GetModuleFileNameW
• 0x46b0c4 GetModuleFileNameA
• 0x46b0d0 SetHandleCount
• 0x46b0d8 GetFileType
• 0x46b0dc TlsAlloc
• 0x46b0e0 TlsGetValue
• 0x46b0e4 TlsSetValue
• 0x46b0e8 TlsFree
• 0x46b0ec SetLastError
• 0x46b0f0 GetCurrentThreadId
• 0x46b0f8 GetCurrentProcessId
• 0x46b100 GetLocaleInfoW
• 0x46b104 HeapSize
• 0x46b108 GetACP
• 0x46b10c GetOEMCP
• 0x46b110 IsValidCodePage
• 0x46b114 GetUserDefaultLCID
• 0x46b118 EnumSystemLocalesA
• 0x46b11c IsValidLocale
• 0x46b120 HeapReAlloc
• 0x46b124 LoadLibraryW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.