4.4
中危
63 个模型检测该样本为恶意！
重新分析
更多

07b69764289b8100f0e45c1bd247e8d62e46e7ae8889ce819600244d81deff6b

7a37e8df1cb804accc85e435db28d5f5.exe

分析耗时

72s

最近分析

文件大小

770.5KB
静态报毒 动态报毒 AI SCORE=86 AIDETECTVM BANKERX BSCOPE CLOUD CONFIDENCE DRIDEX ELDORADO ENCPK FVFXI GA@8SFC92 GENCIRC GENETIC HDMT HIGH CONFIDENCE HKPUJL INJECT3 KRYPTIK MALICIOUS PE MALWARE1 PINKSBOT QAKBOT QBOT R011C0DER20 R338192 RAZY SCORE SMTHA SUSGEN TROJANBANKER ULTIVKWRWGQ UNSAFE WQ0@AKLVXBGI ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanBanker:Win32/Dridex.59a36869 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:BankerX-gen [Trj] 20200713 18.4.3895.0
Tencent Malware.Win32.Gencirc.10cdcdd3 20200713 1.0.0.1
Kingsoft 20200713 2013.8.14.323
McAfee W32/PinkSbot-GS!7A37E8DF1CB8 20200713 6.0.6.653
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619649224.661119
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619654603.40325
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619654604.05925
__exception__
stacktrace: 
7a37e8df1cb804accc85e435db28d5f5+0x3f07 @ 0x403f07
7a37e8df1cb804accc85e435db28d5f5+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 5842240
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 7a37e8df1cb804accc85e435db28d5f5+0x3449
exception.instruction: in eax, dx
exception.module: 7a37e8df1cb804accc85e435db28d5f5.exe
exception.exception_code: 0xc0000096
exception.offset: 13385
exception.address: 0x403449
success 0 0
1619654604.05925
__exception__
stacktrace: 
7a37e8df1cb804accc85e435db28d5f5+0x3f10 @ 0x403f10
7a37e8df1cb804accc85e435db28d5f5+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637628
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 5842240
registers.ecx: 20
exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0
exception.symbol: 7a37e8df1cb804accc85e435db28d5f5+0x34e2
exception.instruction: in eax, dx
exception.module: 7a37e8df1cb804accc85e435db28d5f5.exe
exception.exception_code: 0xc0000096
exception.offset: 13538
exception.address: 0x4034e2
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619649223.364119
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 225280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00330000
success 0 0
1619649224.474119
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 221184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00370000
success 0 0
1619649224.474119
NtProtectVirtualMemory
process_identifier: 2344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619654602.34025
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 225280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003b0000
success 0 0
1619654603.34025
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 221184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004d0000
success 0 0
1619654603.34025
NtProtectVirtualMemory
process_identifier: 2292
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619649225.396119
CreateProcessInternalW
thread_identifier: 2316
thread_handle: 0x0000013c
process_identifier: 2292
current_directory:
filepath:
track: 1
command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7a37e8df1cb804accc85e435db28d5f5.exe /C
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000140
inherit_handles: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
Expresses interest in specific running processes (1 个事件)
process vboxservice.exe
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 104.109.129.128
host 172.217.24.14
Detects VMWare through the in instruction feature (1 个事件)
Time & API Arguments Status Return Repeated
1619654604.05925
__exception__
stacktrace: 
7a37e8df1cb804accc85e435db28d5f5+0x3f07 @ 0x403f07
7a37e8df1cb804accc85e435db28d5f5+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 5842240
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 7a37e8df1cb804accc85e435db28d5f5+0x3449
exception.instruction: in eax, dx
exception.module: 7a37e8df1cb804accc85e435db28d5f5.exe
exception.exception_code: 0xc0000096
exception.offset: 13385
exception.address: 0x403449
success 0 0
File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 个事件)
Bkav W32.AIDetectVM.malware1
MicroWorld-eScan Gen:Variant.Razy.672135
FireEye Generic.mg.7a37e8df1cb804ac
CAT-QuickHeal Trojan.Qbot
ALYac Gen:Variant.Razy.672135
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 005671d81 )
Alibaba TrojanBanker:Win32/Dridex.59a36869
K7GW Trojan ( 005671d81 )
Cybereason malicious.c9bd9e
TrendMicro TROJ_GEN.R011C0DER20
BitDefenderTheta Gen:NN.ZexaF.34134.Wq0@aKLVXbgi
F-Prot W32/S-ade91e94!Eldorado
Symantec W32.Qakbot
ESET-NOD32 a variant of Win32/Kryptik.HDMT
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Razy-8019799-0
GData Gen:Variant.Razy.672135
Kaspersky Trojan-Banker.Win32.Qbot.usf
BitDefender Gen:Variant.Razy.672135
NANO-Antivirus Trojan.Win32.Inject3.hkpujl
ViRobot Trojan.Win32.Z.Qbot.788992
Avast Win32:BankerX-gen [Trj]
Tencent Malware.Win32.Gencirc.10cdcdd3
Endgame malicious (high confidence)
Sophos Mal/EncPk-APV
Comodo TrojWare.Win32.Qbot.GA@8sfc92
F-Secure Trojan.TR/AD.Qbot.fvfxi
DrWeb Trojan.Inject3.40630
Zillya Trojan.Qbot.Win32.8227
Invincea heuristic
MaxSecure Trojan.Malware.101755419.susgen
Emsisoft Gen:Variant.Razy.672135 (B)
SentinelOne DFI - Malicious PE
Cyren W32/S-ade91e94!Eldorado
Jiangmin Trojan.Banker.Qbot.pn
Webroot W32.Trojan.Gen
Avira TR/AD.Qbot.fvfxi
Antiy-AVL Trojan[Banker]/Win32.Qbot
Microsoft Trojan:Win32/Qakbot.SD!MTB
Arcabit Trojan.Razy.DA4187
AegisLab Trojan.Win32.Malicious.4!c
ZoneAlarm Trojan-Banker.Win32.Qbot.usf
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.QBot.R338192
McAfee W32/PinkSbot-GS!7A37E8DF1CB8
MAX malware (ai score=86)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-26 13:21:33

Imports

Library KERNEL32.dll:
• 0x4c1904 GetDriveTypeA
• 0x4c1908 GetTickCount
• 0x4c190c GetLocalTime
• 0x4c1910 WriteFile
• 0x4c1918 SetFilePointer
• 0x4c191c ReadFile
• 0x4c1920 MoveFileExA
• 0x4c1924 CopyFileA
• 0x4c1930 GetLongPathNameA
• 0x4c1934 GlobalAlloc
• 0x4c1938 GlobalFree
• 0x4c193c SetFileAttributesA
• 0x4c1940 DeleteFileA
• 0x4c1944 GetSystemTime
• 0x4c1948 GetComputerNameA
• 0x4c194c CreateDirectoryA
• 0x4c1954 FindFirstFileA
• 0x4c1958 FindNextFileA
• 0x4c195c FindClose
• 0x4c1960 GetLastError
• 0x4c1968 ResetEvent
• 0x4c196c SetEvent
• 0x4c1970 CreateEventA
• 0x4c1984 WaitForSingleObject
• 0x4c1988 GetModuleHandleA
• 0x4c1994 LocalFree
• 0x4c1998 FormatMessageA
• 0x4c199c GetFileType
• 0x4c19a0 FlushFileBuffers
• 0x4c19a4 GlobalDeleteAtom
• 0x4c19a8 GlobalUnlock
• 0x4c19ac GlobalLock
• 0x4c19b0 MultiByteToWideChar
• 0x4c19b8 DeleteAtom
• 0x4c19bc GetCurrentThreadId
• 0x4c19c0 AddAtomA
• 0x4c19c4 RtlUnwind
• 0x4c19c8 RaiseException
• 0x4c19cc HeapFree
• 0x4c19d0 HeapReAlloc
• 0x4c19d4 HeapAlloc
• 0x4c19d8 ExitThread
• 0x4c19dc CreateThread
• 0x4c19e0 GetStartupInfoA
• 0x4c19e4 GetCommandLineA
• 0x4c19e8 ExitProcess
• 0x4c19ec WideCharToMultiByte
• 0x4c19f0 TlsAlloc
• 0x4c19f4 SetLastError
• 0x4c19f8 TlsFree
• 0x4c19fc TlsSetValue
• 0x4c1a00 TlsGetValue
• 0x4c1a04 GetACP
• 0x4c1a08 GetOEMCP
• 0x4c1a0c GetCPInfo
• 0x4c1a10 LCMapStringA
• 0x4c1a14 LCMapStringW
• 0x4c1a1c HeapDestroy
• 0x4c1a20 HeapCreate
• 0x4c1a24 VirtualFree
• 0x4c1a28 VirtualAlloc
• 0x4c1a2c IsBadWritePtr
• 0x4c1a34 HeapSize
• 0x4c1a38 GetStdHandle
• 0x4c1a4c SetHandleCount
• 0x4c1a50 CompareStringA
• 0x4c1a54 CompareStringW
• 0x4c1a58 GetStringTypeA
• 0x4c1a5c GetStringTypeW
• 0x4c1a60 IsBadReadPtr
• 0x4c1a64 IsBadCodePtr
• 0x4c1a68 GetLocaleInfoA
• 0x4c1a6c VirtualProtect
• 0x4c1a70 GetSystemInfo
• 0x4c1a74 InterlockedExchange
• 0x4c1a78 SetStdHandle
• 0x4c1a80 TerminateProcess
• 0x4c1a84 LoadLibraryA
• 0x4c1a88 lstrlenA
• 0x4c1a8c DebugBreak
• 0x4c1a90 GetStartupInfoW
• 0x4c1a94 CloseHandle
• 0x4c1a98 VirtualQuery
• 0x4c1a9c CreateFileW
• 0x4c1aa0 lstrcpyW
• 0x4c1aa4 GetModuleFileNameW
• 0x4c1aa8 IsDebuggerPresent
• 0x4c1aac lstrlenW
• 0x4c1ab0 GetCurrentProcess
• 0x4c1ab4 GetCurrentProcessId
• 0x4c1ab8 GetFileTime
• 0x4c1abc GetFileSize
• 0x4c1ac4 GlobalMemoryStatus
• 0x4c1acc CreateProcessW
• 0x4c1ad0 lstrcatW
• 0x4c1ad4 GetProcAddress
• 0x4c1ad8 GetModuleHandleW
• 0x4c1adc GetVersionExW
• 0x4c1ae0 GetProcessHeap
• 0x4c1ae8 DeviceIoControl
• 0x4c1af0 Sleep
• 0x4c1af4 FreeLibrary
Library USER32.dll:
• 0x4c1afc SetDeskWallpaper
• 0x4c1b08 MessageBoxA
• 0x4c1b0c ExitWindowsEx
• 0x4c1b10 LoadIconA
• 0x4c1b14 LoadCursorFromFileW
Library ADVAPI32.dll:
• 0x4c1b1c RegCloseKey
• 0x4c1b20 RegOpenKeyA
• 0x4c1b24 RegQueryValueExA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.