5.0
中危
52 个模型检测该样本为恶意！
重新分析
更多

1d7e33495c34ce660440ae520f50370ecafe31802eef47fd454b90a1a8c66d13

782e747043398912b5f482e43e7b12e7.exe

分析耗时

28s

最近分析

文件大小

266.7KB
静态报毒 动态报毒 100% AGLI AI SCORE=96 AIDETECTVM ARTEMIS CLASSIC CONFIDENCE DANABOT ELDORADO FSEY GENERICKD GLFRF HCUK HPDF KRYPTIK MALICIOUS SFX MALWARE2 MALWARE@#61PH4ZWDZ4LC MULDROP11 OBSCURE QQW@A8C4QFFC R066C0DHK20 SCORE SPYEYES STATIC AI TOFSEE UNSAFE ZENPAK ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Alibaba Backdoor:Win32/Tofsee.95d311c2 20190527 0.3.0.5
Avast Win32:Trojan-gen 20210102 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20201228 2017.9.26.565
McAfee Artemis!782E74704339 20201228 6.0.6.653
Tencent Win32.Trojan.Zenpak.Agli 20201228 1.0.0.1
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619649225.723598
IsDebuggerPresent
failed 0 0
Command line console output was observed (50 out of 652 个事件)
Time & API Arguments Status Return Repeated
1619662858.107625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.107625
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619662858.107625
WriteConsoleW
buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.232625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe
console_handle: 0x00000007
success 1 0
1619662858.263625
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619662858.279625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.279625
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619662858.279625
WriteConsoleW
buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.279625
WriteConsoleW
buffer: goto
console_handle: 0x00000007
success 1 0
1619662858.279625
WriteConsoleW
buffer: Repeat
console_handle: 0x00000007
success 1 0
1619662858.310625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.310625
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619662858.310625
WriteConsoleW
buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.326625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe
console_handle: 0x00000007
success 1 0
1619662858.326625
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619662858.357625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.357625
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619662858.357625
WriteConsoleW
buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.357625
WriteConsoleW
buffer: goto
console_handle: 0x00000007
success 1 0
1619662858.357625
WriteConsoleW
buffer: Repeat
console_handle: 0x00000007
success 1 0
1619662858.373625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.388625
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619662858.388625
WriteConsoleW
buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.435625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe
console_handle: 0x00000007
success 1 0
1619662858.451625
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619662858.466625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.466625
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619662858.466625
WriteConsoleW
buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.466625
WriteConsoleW
buffer: goto
console_handle: 0x00000007
success 1 0
1619662858.466625
WriteConsoleW
buffer: Repeat
console_handle: 0x00000007
success 1 0
1619662858.498625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.498625
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619662858.513625
WriteConsoleW
buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.544625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe
console_handle: 0x00000007
success 1 0
1619662858.560625
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619662858.576625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.576625
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619662858.576625
WriteConsoleW
buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.591625
WriteConsoleW
buffer: goto
console_handle: 0x00000007
success 1 0
1619662858.591625
WriteConsoleW
buffer: Repeat
console_handle: 0x00000007
success 1 0
1619662858.607625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.607625
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1619662858.607625
WriteConsoleW
buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.623625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe
console_handle: 0x00000007
success 1 0
1619662858.638625
WriteConsoleW
buffer: 拒绝访问。
console_handle: 0x0000000b
success 1 0
1619662858.654625
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619662858.654625
WriteConsoleW
buffer: if
console_handle: 0x00000007
success 1 0
1619662858.654625
WriteConsoleW
buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe"
console_handle: 0x00000007
success 1 0
1619662858.654625
WriteConsoleW
buffer: goto
console_handle: 0x00000007
success 1 0
1619662858.669625
WriteConsoleW
buffer: Repeat
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619649226.129598
GlobalMemoryStatusEx
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1619662855.310875
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00654000
success 0 0
1619662855.326875
NtAllocateVirtualMemory
process_identifier: 884
region_size: 53248
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003a0000
success 0 0
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1619649226.129598
GetDiskFreeSpaceExW
root_path: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\hSockTpl_TMP
free_bytes_available: 19608276992
total_number_of_free_bytes: 0
total_number_of_bytes: 0
success 1 0
Creates executable files on the filesystem (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\hSockTpl_TMP\dstemp.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\hSockTpl_TMP\dsquery.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7ZSfx000.cmd
Drops a binary and executes it (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\hSockTpl_TMP\dstemp.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7ZSfx000.cmd
Drops an executable to the user AppData folder (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\782e747043398912b5f482e43e7b12e7.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\hSockTpl_TMP\dstemp.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\hSockTpl_TMP\dsquery.exe
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619649231.098598
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7ZSfx000.cmd
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7ZSfx000.cmd
show_type: 0
success 1 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)
Bkav W32.AIDetectVM.malware2
DrWeb Trojan.MulDrop11.62668
MicroWorld-eScan Dropped:Trojan.GenericKD.34219356
FireEye Generic.mg.782e747043398912
ALYac Dropped:Trojan.GenericKD.34219356
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.Multi.Generic.4!c
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Dropped:Trojan.GenericKD.34219356
K7GW Trojan ( 00564d0f1 )
K7AntiVirus Trojan ( 00564d0f1 )
Arcabit Trojan.Generic.D20A255C
BitDefenderTheta Gen:NN.ZexaF.34700.qqW@a8C4qFfc
Cyren W32/Tofsee.Z.gen!Eldorado
Symantec Trojan Horse
TrendMicro-HouseCall TROJ_GEN.R066C0DHK20
Paloalto generic.ml
Kaspersky Trojan.Win32.Zenpak.zfj
Alibaba Backdoor:Win32/Tofsee.95d311c2
Avast Win32:Trojan-gen
Rising Malware.Obscure/Heur!1.9E03 (CLASSIC)
Ad-Aware Dropped:Trojan.GenericKD.34219356
Emsisoft Dropped:Trojan.GenericKD.34219356 (B)
Comodo Malware@#61ph4zwdz4lc
F-Secure Trojan.TR/Crypt.Agent.glfrf
TrendMicro TROJ_GEN.R066C0DHK20
McAfee-GW-Edition Trojan-FSEY!530BBBC9161D
Sophos Mal/Generic-S
Ikarus Trojan-Dropper.Win32.Danabot
Jiangmin TrojanSpy.SpyEyes.pbk
Webroot W32.Trojan.Gen
Avira TR/Crypt.Agent.glfrf
Antiy-AVL Trojan[Spy]/Win32.SpyEyes
Microsoft Trojan:Win32/Tofsee.PVC!MTB
ZoneAlarm Trojan.Win32.Zenpak.zfj
GData Dropped:Trojan.GenericKD.34219356
Cynet Malicious (score: 85)
McAfee Artemis!782E74704339
MAX malware (ai score=96)
VBA32 TrojanSpy.SpyEyes
Malwarebytes Trojan.Dropper.SFX
APEX Malicious
ESET-NOD32 a variant of Win32/Kryptik.HCUK
Tencent Win32.Trojan.Zenpak.Agli
SentinelOne Static AI - Malicious SFX
eGambit Unsafe.AI_Score_92%
Fortinet W32/Kryptik.HPDF!tr
AVG Win32:Trojan-gen
Cybereason malicious.043398
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-12-31 08:38:32

Imports

Library COMCTL32.dll:
• 0x417010
Library SHELL32.dll:
• 0x417260 ShellExecuteW
• 0x417264 SHGetMalloc
• 0x41726c SHBrowseForFolderW
• 0x417270 SHGetFileInfoW
• 0x417274 ShellExecuteExW
Library GDI32.dll:
• 0x417018 CreateCompatibleDC
• 0x41701c CreateFontIndirectW
• 0x417020 DeleteObject
• 0x417024 DeleteDC
• 0x417028 GetCurrentObject
• 0x41702c StretchBlt
• 0x417030 GetDeviceCaps
• 0x417038 SelectObject
• 0x41703c SetStretchBltMode
• 0x417040 GetObjectW
Library ADVAPI32.dll:
• 0x417000 FreeSid
Library USER32.dll:
• 0x41727c GetWindowLongW
• 0x417280 GetMenu
• 0x417284 SetWindowPos
• 0x417288 GetWindowDC
• 0x41728c ReleaseDC
• 0x417290 GetDlgItem
• 0x417294 GetParent
• 0x417298 GetWindowRect
• 0x41729c GetClassNameA
• 0x4172a0 CreateWindowExW
• 0x4172a4 SetTimer
• 0x4172a8 GetMessageW
• 0x4172ac DispatchMessageW
• 0x4172b0 KillTimer
• 0x4172b4 DestroyWindow
• 0x4172b8 SendMessageW
• 0x4172bc EndDialog
• 0x4172c0 wsprintfW
• 0x4172c4 GetWindowTextW
• 0x4172cc GetSysColor
• 0x4172d0 wsprintfA
• 0x4172d4 SetWindowTextW
• 0x4172d8 MessageBoxA
• 0x4172dc ScreenToClient
• 0x4172e0 GetClientRect
• 0x4172e4 SetWindowLongW
• 0x4172e8 UnhookWindowsHookEx
• 0x4172ec SetFocus
• 0x4172f0 GetSystemMetrics
• 0x4172f8 ShowWindow
• 0x4172fc DrawTextW
• 0x417300 GetDC
• 0x417304 ClientToScreen
• 0x417308 GetWindow
• 0x417310 DrawIconEx
• 0x417314 CallWindowProcW
• 0x417318 DefWindowProcW
• 0x41731c CallNextHookEx
• 0x417320 PtInRect
• 0x417324 SetWindowsHookExW
• 0x417328 LoadImageW
• 0x41732c LoadIconW
• 0x417330 MessageBeep
• 0x417334 EnableWindow
• 0x417338 IsWindow
• 0x41733c EnableMenuItem
• 0x417340 GetSystemMenu
• 0x417344 CreateWindowExA
• 0x417348 wvsprintfW
• 0x41734c CharUpperW
• 0x417350 GetKeyState
• 0x417354 CopyImage
Library ole32.dll:
• 0x417360 CoCreateInstance
• 0x417364 CoInitialize
Library OLEAUT32.dll:
• 0x417248 VariantClear
• 0x41724c SysFreeString
• 0x417250 OleLoadPicture
• 0x417254 SysAllocString
Library KERNEL32.dll:
• 0x417048 GetFileSize
• 0x41704c SetFilePointer
• 0x417050 ReadFile
• 0x417058 GetModuleHandleA
• 0x41705c SetFileTime
• 0x417060 SetEndOfFile
• 0x417070 FormatMessageW
• 0x417074 lstrcpyW
• 0x417078 LocalFree
• 0x41707c IsBadReadPtr
• 0x417080 GetSystemDirectoryW
• 0x417084 GetCurrentThreadId
• 0x417088 SuspendThread
• 0x41708c TerminateThread
• 0x417094 ResetEvent
• 0x417098 SetEvent
• 0x41709c CreateEventW
• 0x4170a0 GetVersionExW
• 0x4170a4 GetModuleFileNameW
• 0x4170a8 GetCurrentProcess
• 0x4170b4 GetDriveTypeW
• 0x4170b8 CreateFileW
• 0x4170bc GetCommandLineW
• 0x4170c0 GetStartupInfoW
• 0x4170c4 CreateProcessW
• 0x4170c8 CreateJobObjectW
• 0x4170cc ResumeThread
• 0x4170e0 GetExitCodeProcess
• 0x4170e4 CloseHandle
• 0x4170ec GetTempPathW
• 0x4170f4 lstrlenW
• 0x4170f8 CompareFileTime
• 0x4170fc SetThreadLocale
• 0x417100 FindFirstFileW
• 0x417104 DeleteFileW
• 0x417108 FindNextFileW
• 0x41710c FindClose
• 0x417110 RemoveDirectoryW
• 0x417118 WideCharToMultiByte
• 0x41711c VirtualAlloc
• 0x417124 lstrcmpW
• 0x41712c lstrcmpiW
• 0x417130 lstrlenA
• 0x417134 GetLocaleInfoW
• 0x417138 MultiByteToWideChar
• 0x417148 lstrcmpiA
• 0x41714c GlobalAlloc
• 0x417150 GlobalFree
• 0x417154 MulDiv
• 0x417158 FindResourceExA
• 0x41715c SizeofResource
• 0x417160 LoadResource
• 0x417164 LockResource
• 0x417168 LoadLibraryA
• 0x41716c GetProcAddress
• 0x417170 GetModuleHandleW
• 0x417174 ExitProcess
• 0x417178 lstrcatW
• 0x41717c GetDiskFreeSpaceExW
• 0x417180 SetFileAttributesW
• 0x417184 SetLastError
• 0x417188 Sleep
• 0x41718c GetExitCodeThread
• 0x417190 WaitForSingleObject
• 0x417194 CreateThread
• 0x417198 GetLastError
• 0x4171a0 GetLocalTime
• 0x4171a4 GetFileAttributesW
• 0x4171a8 CreateDirectoryW
• 0x4171ac WriteFile
• 0x4171b0 GetStdHandle
• 0x4171b4 VirtualFree
• 0x4171b8 GetStartupInfoA
Library MSVCRT.dll:
• 0x4171c0 ??3@YAXPAX@Z
• 0x4171c4 ??2@YAPAXI@Z
• 0x4171c8 memcmp
• 0x4171cc free
• 0x4171d0 memcpy
• 0x4171d4 _wtol
• 0x4171d8 _controlfp
• 0x4171dc _except_handler3
• 0x4171e0 __set_app_type
• 0x4171e4 __p__fmode
• 0x4171e8 __p__commode
• 0x4171ec _adjust_fdiv
• 0x4171f0 __setusermatherr
• 0x4171f4 _initterm
• 0x4171f8 __getmainargs
• 0x4171fc _acmdln
• 0x417200 exit
• 0x417204 _XcptFilter
• 0x417208 _exit
• 0x417210 _onexit
• 0x417214 __dllonexit
• 0x417218 _CxxThrowException
• 0x41721c _beginthreadex
• 0x417220 _EH_prolog
• 0x417228 memset
• 0x41722c _wcsnicmp
• 0x417230 strncmp
• 0x417234 wcsncmp
• 0x417238 malloc
• 0x41723c memmove
• 0x417240 _purecall

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.