SmartHawk

2.6

中危

57 个模型检测该样本为恶意！

重新分析

下载样本

0d998b8737d67643ad57198c0cce6cdf4a2246a0e2352924150d4302b20394de

0d998b8737d67643ad57198c0cce6cdf4a2246a0e2352924150d4302b20394de.exe

分析耗时

86s

最近分析

373天前

文件大小

64.3KB

静态报毒动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN ZUSY

DACN 0.14

FACILE 1.00

IMCLNet 0.80

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.14	Unknown	0.05s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.80	Unknown	0.23s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	None	20190527	0.3.0.5
Avast	Win32:VB-JFU [Trj]	20200305	18.4.3895.0
Baidu	None	20190318	1.0.0.2
CrowdStrike	None	20190702	1.0
Kingsoft	None	20200305	2013.8.14.323
McAfee	Generic.bqm	20200304	6.0.6.653
Tencent	Malware.Win32.Gencirc.10b0788c	20200305	1.0.0.1

一个或多个进程崩溃 (50 out of 1024 个事件)

Time & API	Arguments	Status
1727545341.515875 __exception__	exception.address: 0x4011a2 exception.instruction: mov dword ptr [eax], ecx exception.instruction_r: 89 08 50 45 43 6f 6d 70 61 63 74 32 00 d1 d0 ff exception.symbol: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e2352924150d4302b20394de+0x11a2 exception.exception_code: 0xc0000005 registers.eax: 0 registers.ecx: 0 registers.edx: 4198796 registers.ebx: 2130567168 registers.esp: 1638276 registers.ebp: 1638292 registers.esi: 0 registers.edi: 0 stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1636360 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1636360 registers.ebp: 1636440 registers.esi: 1636548 registers.edi: 1636548 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1636116 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1636116 registers.ebp: 1636196 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.859875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.874875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.874875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.874875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.874875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.874875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1634972 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1634972 registers.ebp: 1635052 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635240 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635240 registers.ebp: 1635320 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635532 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635532 registers.ebp: 1635612 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635456 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635456 registers.ebp: 1635536 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success
1727545341.890875 __exception__	exception.address: 0x76e8b727 exception.instruction: leave exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.exception_code: 0xc000008f registers.eax: 1635452 registers.ecx: 2 registers.edx: 0 registers.ebx: 5574832 registers.esp: 1635452 registers.ebp: 1635532 registers.esi: 5574832 registers.edi: 5574832 stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228	success

分配可读-可写-可执行内存（通常用于自解压） (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1727545341.515875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00380000 region_size: 8192 allocation_type: 4096 (MEM_COMMIT) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1784	success	0	0
1727545341.562875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x003d0000 region_size: 114688 allocation_type: 4096 (MEM_COMMIT) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1784	success	0	0

在文件系统上创建可执行文件 (1 个事件)

file	C:\Windows\System32\29-9-2024.exe

将读写内存保护更改为可读执行（可能是为了避免在同时设置所有 RWX 标志时被检测） (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1727545341.640875 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x003d0000 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_identifier: 1784	success	0	0
1727545341.671875 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x003d0000 length: 40960 protection: 32 (PAGE_EXECUTE_READ) process_identifier: 1784	success	0	0

该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)

section

{'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x0001f000', 'size_of_data': '0x00009e00', 'entropy': 7.980813184360382}

entropy

7.980813184360382

description

发现高熵的节

entropy

0.7314814814814815

description

此PE文件的整体熵值较高

重复搜索未找到的进程，您可能希望在分析期间运行一个网络浏览器 (50 out of 84 个事件)

Time & API	Arguments	Status
1727545350.624875 Process32NextW	snapshot_handle: 0x000001dc process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.624875 Process32NextW	snapshot_handle: 0x000001d8 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.624875 Process32NextW	snapshot_handle: 0x000001c8 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.624875 Process32NextW	snapshot_handle: 0x000001cc process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.640875 Process32NextW	snapshot_handle: 0x000001d0 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.640875 Process32NextW	snapshot_handle: 0x000001d4 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.656875 Process32NextW	snapshot_handle: 0x000001e0 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.656875 Process32NextW	snapshot_handle: 0x000001e4 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.656875 Process32NextW	snapshot_handle: 0x000001e8 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.671875 Process32NextW	snapshot_handle: 0x000001ec process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.671875 Process32NextW	snapshot_handle: 0x000001f0 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545350.671875 Process32NextW	snapshot_handle: 0x000001f4 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.578875 Process32NextW	snapshot_handle: 0x00000214 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.578875 Process32NextW	snapshot_handle: 0x00000210 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.578875 Process32NextW	snapshot_handle: 0x00000200 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.578875 Process32NextW	snapshot_handle: 0x00000204 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.593875 Process32NextW	snapshot_handle: 0x00000208 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.593875 Process32NextW	snapshot_handle: 0x0000020c process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.593875 Process32NextW	snapshot_handle: 0x00000218 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.593875 Process32NextW	snapshot_handle: 0x0000021c process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.609875 Process32NextW	snapshot_handle: 0x00000220 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.609875 Process32NextW	snapshot_handle: 0x00000224 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.609875 Process32NextW	snapshot_handle: 0x00000228 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545359.609875 Process32NextW	snapshot_handle: 0x0000022c process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.453875 Process32NextW	snapshot_handle: 0x0000024c process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.453875 Process32NextW	snapshot_handle: 0x00000248 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.453875 Process32NextW	snapshot_handle: 0x00000238 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.468875 Process32NextW	snapshot_handle: 0x0000023c process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.468875 Process32NextW	snapshot_handle: 0x00000240 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.468875 Process32NextW	snapshot_handle: 0x00000244 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.468875 Process32NextW	snapshot_handle: 0x00000250 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.484875 Process32NextW	snapshot_handle: 0x00000254 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.484875 Process32NextW	snapshot_handle: 0x00000258 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.484875 Process32NextW	snapshot_handle: 0x0000025c process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.484875 Process32NextW	snapshot_handle: 0x00000260 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545368.484875 Process32NextW	snapshot_handle: 0x00000264 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.499875 Process32NextW	snapshot_handle: 0x00000284 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.515875 Process32NextW	snapshot_handle: 0x00000280 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.515875 Process32NextW	snapshot_handle: 0x00000270 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.515875 Process32NextW	snapshot_handle: 0x00000274 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.515875 Process32NextW	snapshot_handle: 0x00000278 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.531875 Process32NextW	snapshot_handle: 0x0000027c process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.531875 Process32NextW	snapshot_handle: 0x00000288 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.531875 Process32NextW	snapshot_handle: 0x0000028c process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.531875 Process32NextW	snapshot_handle: 0x00000290 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.531875 Process32NextW	snapshot_handle: 0x00000294 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.546875 Process32NextW	snapshot_handle: 0x00000298 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545377.546875 Process32NextW	snapshot_handle: 0x0000029c process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545385.687875 Process32NextW	snapshot_handle: 0x000002bc process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed
1727545385.687875 Process32NextW	snapshot_handle: 0x000002b8 process_name: 0d998b8737d67643ad57198c0cce6cdf4a2246a0e235兯盫兯盫兯盫ࠀ process_identifier: 1784	failed

与未执行 DNS 查询的主机进行通信 (2 个事件)

host	114.114.114.114
host	8.8.8.8

从系统中删除大量文件，表明 ransomware、清除恶意软件或系统破坏 (50 out of 1329 个事件)

file	G:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\‰??‘????.???
file	M:\¤???‘??.???
file	F:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\‰?a??.???
file	T:\?4‰0?6.?–?.“b?
file	X:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\???“?c??.???
file	Z:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\c????.???
file	Q:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\‰??‘????.???
file	O:\????.???
file	Y:\?4?694-24–.?‰‰.“b?
file	E:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\???“?c??.???
file	U:\??3¤??.?‰‰.“b?
file	V:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\”??‰????.???
file	F:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\?a?a?…?¨a‘a??.???
file	X:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\???‘????.???
file	C:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\???‘????.???
file	D:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\‰??‘????.???
file	W:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\‰??‘????.???
file	W:\¤?c’???‘? a?? 3?‘‘????\Administrator\???‰?ca‘??? ¤a‘a\”??‰????.???
file	X:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\????.???
file	U:\??b’.‘?‘
file	N:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\????.???
file	A:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\2??.???
file	F:\\|’??– μ3′ 3ca??a‰.???
file	Z:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\2??.???
file	Z:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\?a?a?…?¨a‘a??.???
file	P:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???“?c??.???
file	Y:\a????“a.?‰‰.“b?
file	O:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???“?c??.???
file	C:\Users\Administrator\AppData\Local\Temp\???a“.???
file	O:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\c????.???
file	Z:\?4‰0?6.?–?.“b?
file	N:\a????“a.?–?.“b?
file	I:\a????“a.?–?.“b?
file	Y:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\2??.???
file	R:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\¨ˉ??§￥4.???
file	M:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\????.???
file	V:\??b’.‘?‘
file	C:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\”??‰????.???
file	W:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???“?c??.???
file	C:\Users\Administrator\AppData\Local\Temp\??c????.?‰‰
file	D:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\?a?a?…?¨a‘a??.???
file	M:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‘????.???
file	A:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\”??‰????.???
file	H:\a????“a.?–?.“b?
file	P:\¤?c’???‘? a?? 3?‘‘????\Administrator\-– ¤?c’???‘?\?a?a?…?¨a‘a??\?a?a?…?¨a‘a??.???
file	U:\¤?c’???‘? a?? 3?‘‘????\Administrator\??ca‰ 3?‘‘????\???‰?ca‘??? ¤a‘a\·??¤ˉ·3\‰??‘????.???
file	N:\‘…’?b? .?b
file	B:\¤???‘??.???
file	C:\¤?c’???‘? a?? 3?‘‘????\Administrator\???‰?ca‘??? ¤a‘a\”??‰????.???
file	H:\¤???‘??.???

尝试解除Cuckoo监控的Windows函数的钩子 (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1727545411.484875 __anomaly__	tid: 1932 subcategory: exception function_name: message: Encountered 1025 exceptions, quitting.	success	0	0

文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意 (50 out of 57 个事件)

APEX	Malicious
AVG	Win32:VB-JFU [Trj]
Acronis	suspicious
Ad-Aware	Gen:Variant.Ser.Zusy.287
AhnLab-V3	Trojan/Win32.Agent.R81695
Antiy-AVL	Trojan/Win32.VB
Arcabit	Trojan.Ser.Zusy.287
Avast	Win32:VB-JFU [Trj]
Avira	TR/Crypt.PEPM.Gen
BitDefender	Gen:Variant.Ser.Zusy.287
BitDefenderTheta	AI:Packer.C8C44E3C20
Bkav	W32.AIDetectVM.malware
CAT-QuickHeal	Trojan.VBCrypt.MF.6162
CMC	Trojan.Win32.VB!O
ClamAV	Win.Trojan.VB-3895
Comodo	TrojWare.Win32.Agent.OEDW@8hwuen
Cybereason	malicious.4b594e
Cylance	Unsafe
Cyren	W32/Trojan.NLYT-3713
DrWeb	Trojan.Siggen.12345
ESET-NOD32	Win32/VB.OED
Emsisoft	Gen:Variant.Ser.Zusy.287 (B)
Endgame	malicious (high confidence)
F-Prot	W32/Trojan2.ANLP
F-Secure	Trojan.TR/Crypt.PEPM.Gen
FireEye	Generic.mg.7a128624b594e7f5
Fortinet	W32/Midie.6525!tr
GData	Gen:Variant.Ser.Zusy.287
Ikarus	Trojan.Win32.VB
Invincea	heuristic
Jiangmin	Trojan/VB.cyhm
K7AntiVirus	EmailWorm ( 005483cc1 )
K7GW	EmailWorm ( 005483cc1 )
Kaspersky	Trojan.Win32.VB.cmy
MAX	malware (ai score=88)
Malwarebytes	Trojan.Crypt
MaxSecure	Win.MxResIcn.Heur.Gen
McAfee	Generic.bqm
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.kc
MicroWorld-eScan	Gen:Variant.Ser.Zusy.287
Microsoft	Worm:Win32/Autorun
NANO-Antivirus	Trojan.Win32.VB.ecifhv
Panda	Trj/Genetic.gen
Qihoo-360	HEUR/QVM17.0.AD05.Malware.Gen
Rising	Worm.VB!1.BC33 (RDMK:cmRtazp9y/6Y9phXifH2W9gr9lK+)
Sangfor	Malware
SentinelOne	DFI - Suspicious PE
Sophos	W32/Autorun-AIH
Symantec	ML.Attribute.HighConfidence
Tencent	Malware.Win32.Gencirc.10b0788c

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2008-01-12 22:58:39

PE Imphash

09d0478591d4f788cb3e5ea416c25237

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x0001f000	0x00009e00	7.980813184360382
.rsrc	0x00020000	0x00004000	0x00003a00	6.107907109092901

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_ICON	0x000200e8	0x000025a8	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_GROUP_ICON	0x00022690	0x00000014	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_VERSION	0x000226a8	0x000004d8	LANG_ENGLISH	SUBLANG_ENGLISH_US	None

Imports

Library kernel32.dll:

• 0x422b80 LoadLibraryA

• 0x422b84 GetProcAddress

• 0x422b88 VirtualAlloc

• 0x422b8c VirtualFree

L3226143226143932261439432261439322632261439432620202205821813212871002662784514782526128368371675
N:}?{@
!Ou$[zxfy
/Mc<3Gd!:_
{(=CIxJX~
~@gW7O[d
PECompact2
//#HOf
h~_Gfs
l_{:A-)&
5}{|<)8&Qo
_TV k5
EdFD:?
#NxS"jy"&=
u=fb)+s<{9Q;]/\$"~
29,<s`
Fyx[p%qwmfs<"
a9+/BJ
JnuBW(
Qd\8);Uv
wBfF'M[&
u^_vCNv$G/1(o
B.T|90U-
GL3e&|
iZZw6j
Cjye}r
d*bOf`nO[
B}H]kZ
heZ=AHMfv
wjzT7y3\?<>
cxq,#
Y.Pt\^\
6\L}Eeuy+
[qXn?|
=PAsjG*7
Vq$:!mdJW
f6{q=
,Vk3~FW7V=r4
,)y>>~A`
l~;W>e
p2fI@NeTc
|i*3,us5H
;/:bP`Y.
38Kp1V.!g7M
DNLw:R
o?h9]ZOukTUfn6IQ!.
!<(*[tk9
w50M'E
hbmw>:[J.kB{;
|%$n\=
aZ@bZqL1+G4\fV5b9y
g$kIZS9
C3h7A_
o~.hcsUq:#bK1y1_
UR+;&Z
<!8hc{^
w*L#rA}
z8,)5'R0d[rD;$i
%bac]SOWM!
2N;Q;`'
)>hBZK
N">GRq>
JU$_DF
@RwWjD
Z#tQ~&
JHCR/g.
8k>X}HO
J;Z[rf{XP\)
1gd]p1h
L.y1]J"
3M\fbhA
oT%?W<Hd
M1$_w,G
[r:,'v@pQ[
]:+Ee1{Mh
{Ttr(=h
'DCG:HQB~UQq 
|!+@ +O,1h
n)k75Xw
%_(R0iF
8q; 4_ft
4OkxisOpnE=K
L%\H4EZQ
'IhVxPBt`
kKa#E=
BZ"j,GhD-3?
*zl@O;'
B>sSX$
BxE]d>
Y-o.rdS/
1JC)srH
1etl{ts;9
84a,Hd_&.^}6
5yCQM_=pQ~$
8<nJ+5
BHKC{YY
P~5O`z
X)4t&-
+eKM_I
dXi$@;G
%*mVPBB`V5
#(*Im%
/8Cwp:^{-wlYYtl
"]e?p"G).;JM
656Y48xW
J$PG}WQ16`<)
(<`vb'VL%'
*T7%0y|E
G+y&(
AxAiWLMj
W#58s_rsR
K[g)~4
T,P5S!S
m,v2a0y*
vNUfaN@Pt
E4o-_b
ol'Hni,Y
P}9Kd>T<$
]~bVft<
7|BHxpSmNAqS[Dn
1$U\c$kMY$
Ad|/D1G[
~Is2+eO
~ohTD%#C!5
h=Fo7<
~zeU:M{&8p^)j6~j@!y
|7@oCi\ID}kmIW07F'
@J8@cs.)
(4E9y\uI
`@I_L)
pmvV})
\_'nw5v
~U)OWO|G(<]Q
*6E;U5xo4
Gj(<s=~]8u^X
eWK(@F
zYQpkrI`m
f@|^ow>m_L`
r&)}1xQ
06E>n`
w6opGc=
(*$S\+T@}
4eW^wOn4
5,!hf@
`DV6}w6
s\txs%6g\^@
f6I)ldNB
p|]zHD8PS
h}fa!VHx
~ub"hDjS5GBe
oZGCW\?6
vjL:Pc
6|V|&6
<+)OA
K+2Y-:<
.Q"hs%
8G[&A.3
^5pS637$
y#\.mUWD
2x"6=/
X[JD"dSX)
?>bw:,
'!-:G"
&qr<m#f$tmCTzQuOg
R'uJ'Hi
;3CrU<6 .('
CoE=&A
-WjfP1
1]qe+(6
l\HGMW 
XIwrQ[@
d7+gcjL?:t
9GDyN<MU"ei.
!Sf7Woym9
xUlIdz3+
ES#'#u/[WGc
C3dHRT'
f/G}Ap|Z
 \APQ-}2vk
s!PE)H
[4UvaYO|
rix`5D
_R3qR0^8/
>28q+=
!K3idv
t7Kb! (n$\gFW
k|z]-YCR&
YK[KhU
"OvG<tN
atSkEGR
6V<_S7
1W6AXga61{
J+'L(zE|v:y)0I/"
mA1R\4ADp
56fx0m
iu}n| /
yYkvH6
%q6oG/
`BI'Xi@j
Jo)GqL]
9e`RYS
0"HbBEE<
K"l F0
Dn@n"9
6,Ls||-;-
3i}36Onh
PxiX)u#
`G!`b
fgiTO@
Mw$t\79
"C[M3rRDTdx
mw{|>d3Ce
<P8R@L
Yg8bC#
q""&n
~*)8^'I
ZTg7<k[6C8 c
4Im`e\
c[M@XVz[
.m*NORmRs?iv&
C$vnqs=
d2%hc
Z[VS2\]+ H
bBy4~
tm#@/~
[.FO9%q20/
,Ck<)Q&
}6p4c3HBb
IL7|VaY89}-g]M%
#ls_r01Y9
cND:Uk
FT^gP>
Y\}{G]W^6!
a0,w&E`Ll<(
;l@K'&
 +MMB~
8LNxD5
8D|>9DdEs
EnSD0J
Qt=W9G:8R~3
r/T])\m
1dz| x&!V
T_9{sq4y<P
; At[KI.H
d(;KuX
fk7-1hDB
`#^~I\[
JwJb/)b3L
e2"1&A[[Pa)'5;]Jw E
L?tj;T
G<B[JAe^
IQ`g(T5SM5r2a^
}' 'ZlvC+(eUp
G}l\MgpI?9Vl>
H[4M"5Z4U
:")2g*b
p9j~.M
7Tiw+eU7O=
)Zm4{V
Fq3@SU 
ABi>NZq3i
701/)b& J~
AAnV=&gI!?
p5!gK0\P@
.uNSY'a
7-! Z%i%=
3Bg}e{_tpf*s
PuESb^(g`q
N*Dw$;VXfJ{>
vLc|'|r
+/^4r?To
c6j7`d?
U#NrrO@J
RMSPil
MN6}PIL
<r+sIT,^BJL
jd0`=( 
id$E &;k
/@fZ)]yHFH/z:0H2
lVm"EF`m
=mhO>6FL>W
6_fRA2.+o
7:24 sb
?*S;3]
Df-aeyn=
v&'.Mi5dyO
dYx)+Y
'CyNbJ
3wrt_^N
kmO%`LW
'XOG]E
+r$T<"
'4'j7Y`<^)ez>ah;\;Y69Q)
4Y*2:&}FW`j
TPf$FKX$(
e`dFUS
6??b@l
0D&C 05R
&usNn3(
p5!e{kI0
zEk\ay]Jpan
Y"oT-rB
 )k`R?
|D/RC7*rH:
hoL8*N
*0oQK@ST>
j4]]c*k I eulR$:2*%v
QOB~8c
<*\~eue
w&rIy]g[
0RX=gHkld}A*^
[b46TNk,|NiOt
kGJwuvw[-
UJdS?m
V-k#1xa(e,|
c9v PC
JU_Y:?6yFWBW`
E|v;XuJtW]~-e}?
t=]{nW#fSwC
|M1{X}{
k-8t\8y@
NK6T= Aj
.wQo,Mb
dPz=-x
A'~tJK/|l5A!*6U;S9Jp
+J,# 9
(|ICGMY
9n*.SDx
ihbVS*:<0
ab4A&{%
ex$uXUCSB
shQAT\
y0E^7ik~
?$JKTOI
J9K`uJ/m
6-4\,iv
}"SzZ_]
$6M,r=m,
ev\Q:S.
i]#,3GjY
r(CK(Zj
JYmZube-
D0vD&=)
84wA#4({V$
|/<$YaE
u?7lJt?Y9>
W1D!3Jr}9
HJDe:l1gKnD+
{<d8R: [IVPGj
A^0B\^
MZ3\K>uc\
b&FbUO
K2TaAO
5K/ :N?5hJP
P=4J]:
m2nxl~
ZbHYK 
TW*J)nMU]Mhr1:]
,u=\O(
PXjj=qI
yj])k>]7b
jK d0U
k96>\&
2>QTnf]
v*'d*K
(Rd!>?
569-p5
v\qeMz:
M,aOB[(\ktw
rTi44J
`A>|j>i,=
K8g]LO
_wFvKh
T~ZRXo
M[L4R@
9wdV6^.
*JAl&twE>U$OO
-{3dX2;,{W
iCDy R
DAe!OR#
hO}I8cZV-
He%|T<(}M)'bX+M
iv:`$#TR@f
c9ugrEr#
=c385$^/
5@7D*v
`OPY8@
=)86gtS 7
4Rrq[?O=
gz <D5
XkFe`.
O$YD*dS
*=IJT)/e
<'!n1+&Li
*LicUQF)M.
Gy976$4JzBrl]
lu IgUZ
+N=ty,
Ux]Fw(V
n$nn&PnK~.
X}* lNFJ
!r(Px[
~hs{o'hlp
gSd/|"f
(9VdRyQ1,w
%3[$-/
`V9j^
I"1\&#
rHAOg8
PDGinpn
-BdQ,V
>bJixHq}o"@
3yH.W=
_X:1E|1[2m
;|UQ:_
?V!*I*
WF_78%a8Q
'e[e7A6$ p
Z#3)_g P
o)e&xb|)gg4
e>puU;:h[Ig
o#'!lSX
1z;%Z^.[8aDXE~"
i550Q3sy
7X~R3
?<^ztZGAP)
/z*K0m%/i
?Us!i&Rg
^s|{)D(
?X)g;Zg
Bs,$H5
"(e.m 
6{J>#uz
o+|XGW](ci'jf
X5kE%
DEyCjO_^r
h,2E(M
}}%[_#
+J<ugeEPr
Eq':|G
sRwu@,[
@VZT,\)h
N}T#X3
AOW-y0Q
$$W}}(Hp8
K{UoBh\]h"$Vf(yub
likZ_v>
$h*+@Q
=;5toEP
`>aUE86m
k* tyQ
@'Je\,]/&@
GkLcE7
]e|8$vF.cx%]z
 Z$8(.Ju
&eh5{_
q:5|Cl
ABM^1be
>Pn$AQ5
[WAZa]pGjA}
r^3AG}Uq:X
.n0Lz(
`5{3Eg6f
]ALsL`l64dlYd
@xaLcBn
>2/ZJ9
\{~Y]Tc
T|=f@ {A
^(5a\oDr[R[/
T+B=A"0;
>3E^^Ro
.>|h<!@
FNfY"'R 
xFf1Q"
kLy^55)
m8c3|[
&7i;^L
Qb*/a<kA'"vmc
{|6_+-
=FS(DFe0)
h~6@WjV*E^T=Rjy
Ktu]-\,E4M=T6DM*|
pHj/3r.
%-F;!ms|j
@cTbTxk9u.
l:KDGm`
c.}<00D
w%h$(]Oy
}?,~XG
h[KEvu
l^O"4A!#vb3Q
$8'li?jld~Muu
q@i#rc5f
/*=8h P9
@ ZrNH
C)zD6*
i|p_JMRs
n]Aijs
06lRpng+e&
?c-9P}F
pkB(AEa~
bb6l&VqleP
\],z0/rzOFaS
t9h%Aj2GNudDu
[T7G|MI
?cU~:n
/w&$rJn
jHzkRc
6dUpApDqhH
qvD-I[TM7. 
%J@Q 8{
r?|+zC
yMWKd8m;p
Cp4=eC&Jl/p
G^o; v
GpxH{&P
qh_s"d
ASZ}d3/@
 2+;4OB
;yD1Hs+
zI'\e;R
CfX+a"n
f Dr>a
SX<{FWkS1
M>HC"o%(
lvbr|6Yas{>
&5<]6)c}
hwQ<O:(
!_1}rT
vNNz? lF-yROlp#"T8p
EhpF^LK_%
HmGg= 
ANj;=41
M#9H+M
f=+v,\
+p.1_Y
3/![.AgiGB>b6
J)v*N&
V?" |K
Iyc1mVv%
kFB1#g2eN%}[k
{?WI";
KdGXcc!hv%
Ma#h8tK
Y~e`!&=
tR/{_R\
"j81kT
jbB#Hk9L
@o`k!gjS
9tKgu18
T}n>!@.
Hxx%8M-KP
 9U5gi
eRZ"vn
LJ6P`Js$Ay{X+Lon
+s%Pa,$)
\U9Ullf
BuPWnY[n
H.GJ:Q"<.]
4^c-h/kWOa
>1 Pem
_gA~C5
`.?Ox7CyA
RTosE*L~<o$n?
fLVF<B?
rjdm+kx0c@[3
M&xNt,
K:<)tno4Kz3^*&^
}3AU]&[2,G
eS|&wLqS
l][tSc`Uo
e|ON{aV,K])J54
^M,Mm[
w9(5Y\Ur+J
h@vdAUFh
/|Xs]J`M=j9
f2Qn;|m
D{]Zz a
zs/--QX
,&>))v\Q
jq{96:L^}
1i;+v)
u_T8Izv
l^viCgQ
70fI:{-k,
^&Ug!8
z8,UEA'
(?T5Ur
ti}mcJ
O:(xMcl+OK
XHu+c/W8
e7(lkc
UbS.FjK
 J=4i5d
AF6i)*
FIiE)\
KAm5cN,m5lj6W5#d"
^v`ob}
l*sE?t
v(r/~[O[N]
Wjri9cRD73KAn4/vX$
Bq6S{`q(6I
klS5.F
},F?M-
sEZ%~M]4$YyD;%Vkx
7/{?N&4<x>
W1:\Pqp
Quh_@X8+^
W 7e2F
5C4?$}G^s\lfr?NY
-_(GZ]YY$G<
,sS1)D
dISy~n
0Kl0&~
U`[>li*B*]ox
dxtXRq'^xp
oy'w>H[/O<^t{3t!$P
8Ml=D]bU(&+
~fAGaBVo7S.lT
FM%E0/
`{k~|$?1x
<mDPj\)z~
KX4& |h
/c`a9k BL/
b}jD(>A
QJBGI4}p!{
s*Pq=j=
AG;)!s]2fj1h
lr?}V06
fq#E4(
F84'p!KSsgp
p%BGMX
D"\GKp(w/YjektKn
$khor=v
a`RhxS
{sf{U&
8K{Lmp#t
'~VUZO9~ir"7zk=M
KJkRVK{b
FEE:{`2Z)Nqjh['
|Mai}E
}7d]MQ97
e>/Y|+TeW4
6Le=({,^l[}
2$bUncFj
J|?+R8n
E,v+bm[Wfo
hqd:PAc0
2OPzM\"
Ag#;_#;U
B[Ks*&
Q*[8P|
)NwEgx
i]I&9Q}lG;
#L@9F=p
}I$M`t
Z AeQd
(ok_e^
H6#7`{=
J^bv|mTKFKuW
^D\$q@.v%
+iNY_7
9qHztt
O1>*.!5
sw!mM1
?'[. {
YFV{y=t
3'_;.am3
&M>QXtZ!fN
(.r-zSF>*
,eUS~F
.r-Q*+'Z
u3zi+M
4}p]%uocIlrs
kxjbqH>?
KLIC9fK,M
zr#Hh1\
N26{at
rsvX${
+B7z@5
:Z9}.+
J{#GdzGB%{^W
Ryv^[#
0\rw$7
`e)[l,VyG
YgXs~Q>Vo
wKPVlpx
4_`[F<
^m{7vGV,B}a-|
rkpE,I&
h==*hn6
=reyKEdi
T}iaP3=OA2
v.P,n:
UPmE{'UO$;
,U-Tk ErLsAJReL
4^Ev=@EIj!U
7{<[q_J
$OrwIL-
`V3L}V
You3\u
%yp9>U
8'D^`:B
@i%Nu7
v3OZ$I&IB@
u|Rv'U
}6%'BMMo%
pWL|$q
m09'l&
RXqN_9U
M)@f"
,odsQ{
9m'JQB
{ch!mu}m,G)
d(F:mg`lX79W
:PyF-5
jrh:Y8
t=4*-C,
{L[x2xHA1
fp4[)\tw%6&
@o<jw(cK
~5KJY[G0[th
Xh_"/
o4}d\]D
rN,UPg'#\>Mqie7B+QM
SYk =5
ji+sd:V=
mK/\zwJxi/\
RrL[c>|hd
GtGM2`Q]
#=y!GnDai61
g0x?X<
sp@0o}R
{eQNpv!C
:[Wo0!
]rL@I1
@LpThD_
-{p`;4q{
x_xEi#3[hAXR
O |_lR>W|b&
<zZCLp
.fmHB|
.,B!|No
?#Sk-qy
+yMwJAN
\8@TsV.E
mg`<dM9~
Z#,4c;
^!hp5\\J
LN7[Tt
f|:oNpS
(~/9zX;kUe?
;X[lyN++yE&.
@V:3^ERAtx
Uq+mBEdL-
v{RA"%Ec5qQ 
KWJVZzTxF8
0L5t}G
9d0fi`c1Z|
5?s~OWP
PNRWG-a}`E1RL
m~;8[2Q'
qqr,,<J$
(o-A~'=
.')Okx}[t7E[
-2($E)$N,-Opz|
}Wl7Hk
,,)cccBBBjjj
-#>'%L!&F14afkpibbfJUtuu}
AAEnnq
*(??'!F##F""G=CsPze`~b}g~h_}^_^fzBDj
+!$D'#E' C*&@HMrcy_~`
e><m%!F
$#;<:N@>GMQ^
## D'%E#$G'$A#$C4@\y_^g==n)%M&"A$!D
+#!G95W&%BU\tZ~a{5:g$$B'"C%#B
EDRuwluuXk'$D&"B "C
8=Gmut0.L'"?"$C(!A'&T03`
xwyaqMY)'C"#B&
[ajy**K&%G&#C42{
}|br0=Cn{3.S23y0 S!$Q55=
 &%$V`wz7:[$&L*%E;2s
$(+8]h{S_|3<^0,H&$Q
3*%NWSRT^]XauXUz.,n
5":)'U=7:=-3^enzw|KMWjo|jumu@>c43|
bbp5.q4-n-+^;:<;8<`]`g@=i;:
?=6*-g;<<8&&>+5?;6
 !573v31}5688>=HHatbe8:
=A5GH[41u01w9799963/Yceghqh~-,F7>
<DJ) a6574}98=:}1+ekwdgLOggc8/z 
5)$Rzvz
!?97979<24Y1.c`c44T0*Z$&Q"
,1,e+,d:7;8::+-L2.tNKmTYiHGK.1-ef_
.1X*(G$&Q+*j
((W.,f0-t:9::()M5662b77=386
OPTKNfKRq;1x8:y-,N5.v;8
=1+i-+f4296'$J@:-3_~~{[`k$"
GFJBDCTOK
#%{20SJNp96@8@G{<7=9RQ\
\`WMQW;8L)'S'(U1.m55,*a8<42`81cGWlv~$!KHQPNCz'!
/4:IHh00S@<;;@@87I>
C@g31z32k
 7,*])(Y-'U/*i<3x<:81W+)V]b<Hk/=Gglg#$%<7j)+[=:7;97::$%M
:4z32|75>:8860t%*Z-+f@:&.M,-f//\lGLlltAMW
:;3QW[5:6$%+jtq5:u+*V>7;=85-.k22q85\DCL
nls;8k23689;97<78778)+T+*R:8DFm]f8;b~
tzeyq{_o}|+3??9.,[9331}+.m95?@nZZY
0.]4/|85:899::98*,V&#N98:6v*+Y-0`u{89Vw>FWEL`::.,g/2y66
;6GBKOY
lok&%U12s./x66=655'(I)%O6465,*V54oCIi{98^rKEC?S24U<83.s787252x
'&C86:8;6-.j837:*+T'$F94780-W..rA@gv/-`_jabGDhn@>WDOk:1x<:2,o54+,d))`3+a
!E@7;6;.-r/,b@6781,l*&J5/w783.Y,/vKI|Xdy,)g9;^;/J04Q8:;:0.j78=;:895-*w/+\
$#2<;7:=:0/l))`65<:::75w<8e,)i8844c2/o4571I%,UMDYgV^SMLLlh1/[2,T3<O0*l>=;7<6@;998:8:>:?6B<w
$?C]<:97}#!Q()W.-p<7::::..u43x6531w:6z./o0/
,'K'+S75EDuwdhjj[Wl1+i('L63pB6.3{99,,l*,d75?9?A
0.<(*W64:9;;:823w./z8730t:6967554_-&S41
<?MNzyTUr.4[30y*,G0/o74/1u;7:51/u-,`
 !:0/y<<9899::11p31v871/y35<:74*(a.([+.k=:@>DJl^e~:2a53w;5..[00v7:21u76}9:<;2/w)(J
0-C,*c9944
++n;88:/0q34:80/v33x::85*)a3.n()_88:8HH77kOTr99]52b20t66><-)d91{6631y11u97=:89-1k
"#K55{32ZST\##BA556t10z<865
1/s30u78;9/,h3/q2/u1/{9798:;=:20t22q86A@A?0.s/0r34{31y41x&*]*)a95|:5+'a
&83T@AK
H:962@931x*,c1.t2.r589610p22x2/y22s54
99:<20{11r65
A>BAA?4600w/,r7112w0)gIJN &/=<W
acrD;99/1l)'j+,a20s21}3/r88961/t<;20{31r32};:<8/+t//t:7AADDA>5644t74j7446:9#&=
95M1+^'"H
0.<*'[25272/x69:64/u>7=711y20z>9=;0,x64z9?ADGCC;;8+0m
*=6y;<00yipv
2)^948522|>4%"U//o9;<887/0z98:86283|=8FA?A7;8;55>;GKN[0+C)('
+%U875687wNOf
80;:;99898=<:;9;96>AFB,-^A=;787
+(g98?<LLa
"<8:<63~$'>85}:8::==JH[X_ab_ $<;598x
:7u99rbdd
y66Pon~74s673.llly*)[@9>BOJ
aef''F
==Q:9;:_
.1TD>MGosu
$W6<8
22TJEosx
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Pa%i5N23-
Uru4<E
7*Idu9M;
w3_^[r#MV
S7(hu#j
Hu6"
sG*DS,u
[b)+Nq(8V
2z7T2=H
$U^Ynboek
Z`Ca&\.q
y_sT]"
rjxY(X
J>>FA.
@1/2H
#hS{@;X
,+KjH@sQ#'7
DuH:-Wt
?P(L&H
%uC0KX@
RIP3EZ
zl>@^
t5;*V0(E
'nPPCx2tMsa^}(K
!Z-'6;2=2 @uV
dT)}&nAH+6J^ |
I--,@h
PWQSr
msvb]f\"
]A<f8Q@2I&ZhlkoM
5kEWo*0+m)
`3Q-vP2X: 
[+HAqp
licat@on eqr
u.T>he<cd
%s5lyvn}tAba6idS8DLG5Ld,al J3*WI'c,bus32M'agBoxAwFx3tf
kx8l?ExitPL
GtMT)l
t@Ac&v
P"<SH0&zI
`t$$|$(3
r+|$(|$
USQWVRW
ZPR3C 
Z^_Y[]
205522271611142018105567286270846686274885740677760284885510622055222716111420181055672862708466862748857406777602848855106220552227161114201810556728627084668627488574067776028488551062205522271611142018105567286270846686274885740677760284885510622055222716111420181055672862708466862748857406777602848855106220552227161114201810556728627084668627488574067776028488551062MZ
L5753225753226457532264157532264575357532264161151201847605007202328832115336251150482732855305687
N:}?{@
!Ou$[zxfy
/Mc<3Gd!:_
{(=CIxJX~
~@gW7O[d
PECompact2
//#HOf
h~_Gfs
l_{:A-)&
5}{|<)8&Qo
_TV k5
EdFD:?
#NxS"jy"&=
u=fb)+s<{9Q;]/\$"~
29,<s`
Fyx[p%qwmfs<"
a9+/BJ
JnuBW(
Qd\8);Uv
wBfF'M[&
u^_vCNv$G/1(o
B.T|90U-
GL3e&|
iZZw6j
Cjye}r
d*bOf`nO[
B}H]kZ
heZ=AHMfv
wjzT7y3\?<>
cxq,#
Y.Pt\^\
6\L}Eeuy+
[qXn?|
=PAsjG*7
Vq$:!mdJW
f6{q=
,Vk3~FW7V=r4
,)y>>~A`
l~;W>e
p2fI@NeTc
|i*3,us5H
;/:bP`Y.
38Kp1V.!g7M
DNLw:R
o?h9]ZOukTUfn6IQ!.
!<(*[tk9
w50M'E
hbmw>:[J.kB{;
|%$n\=
aZ@bZqL1+G4\fV5b9y
g$kIZS9
C3h7A_
o~.hcsUq:#bK1y1_
UR+;&Z
<!8hc{^
w*L#rA}
z8,)5'R0d[rD;$i
%bac]SOWM!
2N;Q;`'
)>hBZK
N">GRq>
JU$_DF
@RwWjD
Z#tQ~&
JHCR/g.
8k>X}HO
J;Z[rf{XP\)
1gd]p1h
L.y1]J"
3M\fbhA
oT%?W<Hd
M1$_w,G
[r:,'v@pQ[
]:+Ee1{Mh
{Ttr(=h
'DCG:HQB~UQq 
|!+@ +O,1h
n)k75Xw
%_(R0iF
8q; 4_ft
4OkxisOpnE=K
L%\H4EZQ
'IhVxPBt`
kKa#E=
BZ"j,GhD-3?
*zl@O;'
B>sSX$
BxE]d>
Y-o.rdS/
1JC)srH
1etl{ts;9
84a,Hd_&.^}6
5yCQM_=pQ~$
8<nJ+5
BHKC{YY
P~5O`z
X)4t&-
+eKM_I
dXi$@;G
%*mVPBB`V5
#(*Im%
/8Cwp:^{-wlYYtl
"]e?p"G).;JM
656Y48xW
J$PG}WQ16`<)
(<`vb'VL%'
*T7%0y|E
G+y&(
AxAiWLMj
W#58s_rsR
K[g)~4
T,P5S!S
m,v2a0y*
vNUfaN@Pt
E4o-_b
ol'Hni,Y
P}9Kd>T<$
]~bVft<
7|BHxpSmNAqS[Dn
1$U\c$kMY$
Ad|/D1G[
~Is2+eO
~ohTD%#C!5
h=Fo7<
~zeU:M{&8p^)j6~j@!y
|7@oCi\ID}kmIW07F'
@J8@cs.)
(4E9y\uI
`@I_L)
pmvV})
\_'nw5v
~U)OWO|G(<]Q
*6E;U5xo4
Gj(<s=~]8u^X
eWK(@F
zYQpkrI`m
f@|^ow>m_L`
r&)}1xQ
06E>n`
w6opGc=
(*$S\+T@}
4eW^wOn4
5,!hf@
`DV6}w6
s\txs%6g\^@
f6I)ldNB
p|]zHD8PS
h}fa!VHx
~ub"hDjS5GBe
oZGCW\?6
vjL:Pc
6|V|&6
<+)OA
K+2Y-:<
.Q"hs%
8G[&A.3
^5pS637$
=143614213128201946050072023288321153362511504827328553056871436142131282019460500720232883211533625115048273285530568714361421312820194605007202328832115336251150482732855305687143614213128201946050072023288321153362511504827328553056871436142131282019460500720232883211533625115048273285530568714361421312820194605007202328832115336251150482732855305687
VS_VERSION_INFO
StringFileInfo
040904B0
Comments
http:/www.narutogames.com
FileDescription
Kazekage-Games-Action
ProductName
Gaara The Kazekage By : Paraysutki VM Community
Mission
Destroy HokageFile, KSpoold, AutoitV3, Autoruner, BlueFantasi, Sys, VBSvir, PornFile, and Kick Anbu-Team-Sampit
FileVersion
06.01.2008 (A) Update
ProductVersion
06.01.2008 (A) Update
InternalName
Kazekage Was Here
FileDescription
Kazekage Games Action
LegalCopyright
 Kota Cantik - Paray City
OriginalFilename
Kazekage of the Sand
VarFileInfo
Translation

Process Tree

0d998b8737d67643ad57198c0cce6cdf4a2246a0e2352924150d4302b20394de.exe (1784) "C:\Users\Administrator\AppData\Local\Temp\0d998b8737d67643ad57198c0cce6cdf4a2246a0e2352924150d4302b20394de.exe"

Search
0d998b8737d67643ad57198c0cce6cdf4a2246a0e2352924150d4302b20394de.exe (1784)

0d998b8737d67643ad57198c0cce6cdf4a2246a0e2352924150d4302b20394de.exe, PID: 1784, Parent PID: 2264

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114
8.8.8.8

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255 A 131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	61714	8.8.8.8	53
192.168.56.101	56933	8.8.8.8	53
192.168.56.101	138	192.168.56.255	138
192.168.56.101	58485	114.114.114.114	53
192.168.56.101	58485	8.8.8.8	53
192.168.56.101	57665	114.114.114.114	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	339e897eae56d1ef_29-9-2024.exe
Filepath	C:\Windows\SysWOW64\29-9-2024.exe
Size	64.3KB
Processes	1784 (0d998b8737d67643ad57198c0cce6cdf4a2246a0e2352924150d4302b20394de.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5	`0fdd42ce700db3b1c9a5a23ceca5d869`
SHA1	`57280f9dd52c235eb03a494b985ad7bbf18e9648`
SHA256	`339e897eae56d1efc7d28f765177d0589ac71b08ec427fcbc567a11bd0dc5cf1`
CRC32	`EA10397A`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Sorry! No dropped buffers.