1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.61
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:TrojanX-gen [Trj] | 20200518 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200518 | 2013.8.14.323 |
| McAfee | Trojan-FPHM!7DA536D504F0 | 20200518 | 6.0.6.653 |
| Tencent | Msil.Trojan.Generic.Aliz | 20200518 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00002000', 'virtual_size': '0x00005394', 'size_of_data': '0x00005400', 'entropy': 7.153509092898219} | entropy | 7.153509092898219 | description | 发现高熵的节 | |||||||||
| entropy | 0.875 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 52 个反病毒引擎识别为恶意
(50 out of 52 个事件)
| ALYac | Gen:Variant.Zusy.252071 |
| APEX | Malicious |
| AVG | Win32:TrojanX-gen [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Zusy.252071 |
| AhnLab-V3 | Trojan/Win32.Fsysna.R202348 |
| Arcabit | Trojan.Zusy.D3D8A7 |
| Avast | Win32:TrojanX-gen [Trj] |
| Avira | TR/Dropper.MSIL.Gen8 |
| BitDefender | Gen:Variant.Zusy.252071 |
| BitDefenderTheta | Gen:NN.ZemsilF.34110.bm0@ay44Abb |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.504f0a |
| Cylance | Unsafe |
| Cyren | W32/MSIL_Kryptik.AIN.gen!Eldorado |
| DrWeb | BackDoor.Bladabindi.14831 |
| ESET-NOD32 | a variant of MSIL/Kryptik.JAB |
| Emsisoft | Gen:Variant.Zusy.252071 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/MSIL_Kryptik.AIN.gen!Eldorado |
| F-Secure | Trojan.TR/Dropper.MSIL.Gen8 |
| FireEye | Generic.mg.7da536d504f0ae93 |
| Fortinet | MSIL/Kryptik.JFW!tr |
| GData | Gen:Variant.Zusy.252071 |
| Ikarus | Trojan-Dropper.MSIL.Agent |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.aycxg |
| K7AntiVirus | Trojan ( 0050cc021 ) |
| K7GW | Trojan ( 0050cc021 ) |
| Kaspersky | HEUR:Trojan.MSIL.Generic |
| MAX | malware (ai score=85) |
| Malwarebytes | Backdoor.Bot |
| McAfee | Trojan-FPHM!7DA536D504F0 |
| McAfee-GW-Edition | Trojan-FPHM!7DA536D504F0 |
| MicroWorld-eScan | Gen:Variant.Zusy.252071 |
| Microsoft | Trojan:Win32/Wacatac.D!ml |
| NANO-Antivirus | Trojan.Win32.Kryptik.eonmog |
| Paloalto | generic.ml |
| Qihoo-360 | Generic/Trojan.7c5 |
| Rising | Trojan.Generic!8.C3 (TFE:dGZlOgyuYmo4o7x6nA) |
| SUPERAntiSpyware | Backdoor.Bot/Variant |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Msil.Trojan.Generic.Aliz |
| TrendMicro | TROJ_GEN.R02DC0PEH20 |
| TrendMicro-HouseCall | TROJ_GEN.R02DC0PEH20 |
| VBA32 | Backdoor.Bladabindi |
| VIPRE | Trojan.Win32.Generic!BT |
| Zillya | Trojan.Kryptik.Win32.1204630 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2020-05-14 12:39:55
PE Imphash
f34d5f2d4577ed6d9ceec516c1f5a744
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00002000 | 0x00005394 | 0x00005400 | 7.153509092898219 |
| .rsrc | 0x00008000 | 0x00000a00 | 0x00000a00 | 4.036016558723996 |
| .reloc | 0x0000a000 | 0x0000000c | 0x00000200 | 0.08153941234324169 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000086a0 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x000086a0 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x000087c8 | 0x00000022 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00008160 | 0x00000254 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x000087f0 | 0x000001ea | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library mscoree.dll:
• 0x402000 _CorExeMain
L!This program cannot be run in DOS mode.
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP~|
I%&/m{
iG#)*eVe]f
{{;N'?\fd
! ?~| ?"?
7]~]_?
M:[ltz
{_/5~(Ok
Ov'o\e5U\_C`={be&?k_
?_n|1~7
Uz.iUdd^7EloF
lu2_uV
M6_~6y ?{ w^"7 [/
Z[r-_z
~o7o6~1F-
#}5~=|[
/ok_5w`
7~;o}G
%F5%4_m~o /1hR
o!?~Ko~}
~W7-~e[o
Boz4*_7
1)!$_7
c;+ow.zc~1
o=gnjq
o#~xhsjp~
I~z#&5
?/$~_!
~l%oo>
?~g/*_~]~|
wxrR_wo
n]m4oU
aWozoL
UV`rc]B'z.z}
1bx,!x'?
_ZMFW2
Mrojkq
&I5_;|fk
YHsD|kk_Ft
ag8v3E7
\/w YpC;?k"7g[
V6` o55`0~?
6o[61{
6m khR
UK|Kd:&7
o~m~?7D_
w-~-2IKo&[
45_C{Rax'7b6a
n(HLB-
HDQCnRpEG) 6
o1zkV
7-!,<w`
*f'Hof75? w
HE 78N
~$l?w>
wr5Voj'
;S)_m~O
7w~?"%uo
.}T[(y? _@|
-9!oo?:_.}Z<O-r#T_
754]EO
#AO"!mRKkA~/58-xW3
K5_C~-
F~-IJu
Gok)/u(u_75
_K~_$z%W__?
}SoI8U z
5wN/L0
G$7~?M~4
5~55~Cy
9)(W(
W1_@k<5Swkn
OC_Dc_F
?/_x~}
k6ikx_
L[f/"-o_
c@[~2{o
_7~?~?@g
?k=_75_
"I yk_W
\&'W/5_
}kMokA60
k_k&_B
~'~>5Q
_kgxo~
f'a'K7
Fw?7u~_O>u_>uv
e_&kgom~_
:?k_~/_~_k~ >
Mpk___6
ou_ M~
Uk;dg_sk|_~o
~~?~?uR~_$
kbo_/o_ 5~_/! eLQ
p?A_C?
,?k\?k k
k7k_ k
A_ZoHn1B5~w
_5kN~\__
,5Jvtv
uhhoko?)
fZe15(uT'fO
_\ Ve1
Zh*@/_m
*{mCV>
~Y3?fz
ll9~7F
OfU5@O
lgK"2+
}xY^6/v[b,ek^e4-^m
?yko&{
_chPO2
Yuk{Yb2OE
7rFO_'
M_##Y//.
|9sz<gn=]N
Xhv&0}-
u3XX?c~
tE\|^\k*PJX
+eKZ</
YAI]]5
(G9!a.U
p/6.f|t`U
A8hMq5+Y
m*sB9~0-|VW
?'\TeI
+B~rMM
5&x4Wy
L {A=]
FsvT<;0$]/XZo0`5
k~uYr#L
;@J-}g
r/h1}m
0_=^["~v|
jLX{2(1
fPOvSj _m
ZUEKfyN}e^~
-QBg8W%Og
zZ1;uNn#xIN
/wy)ta>B
)dIL'U
mNrR\ c
_TKfI1\B
<||]x4}Sgm+S
qEp5}K/
z7^_oj|
w)3D?K
Bu5~X7
Rn-f6aEX
5~}{1~2"
xS)z~??8;w*_7;
o'~5C7
7?~s[
;7?9~~'
:[ok_~_
~Hk&oK/aH?x
}|F=&k& :ok
Y_7"];NkZ5~3[
)E~_LqB
f)_//}kN
o[&;&3
G$d`zk
N _\$k1^K
,HJI~_
A>No;z@
z~.iocC
_^7?6~S\
J2ym?x] r To
(7o]Eg9
f-{f=? ~Ok'
%eEV,eM%
3lk1{O}Oj
>'5??k?5>`j
vF^9|ez~7~
C#khd\ZnKK
j}[:!+
!!D?H~?|DC?D_
GCY:Og
]:cL<W'@
}eT%_2
u?5=A .YfL%X_~3
PxH?V75
v2.0.50727
#Strings
APK.exe
mscorlib
Microsoft.VisualBasic
System.Windows.Forms
System
APK.Resources.resources
<Module>
MyApplication
APK.My
ConsoleApplicationBase
Microsoft.VisualBasic.ApplicationServices
EditorBrowsableAttribute
System.ComponentModel
EditorBrowsableState
GeneratedCodeAttribute
System.CodeDom.Compiler
MyComputer
Computer
Microsoft.VisualBasic.Devices
DebuggerHiddenAttribute
System.Diagnostics
MyProject
Object
m_ComputerObjectProvider
m_AppObjectProvider
m_UserObjectProvider
m_MyFormsObjectProvider
m_MyWebServicesObjectProvider
.cctor
get_GetInstance
get_Computer
get_Application
get_User
get_Forms
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
Application
WebServices
StandardModuleAttribute
Microsoft.VisualBasic.CompilerServices
HideModuleNameAttribute
MyForms
m_FormBeingCreated
Hashtable
System.Collections
ThreadStaticAttribute
TargetInvocationException
System.Reflection
Control
get_IsDisposed
GetTypeFromHandle
RuntimeTypeHandle
ContainsKey
String
GetResourceString
InvalidOperationException
Activator
CreateInstance
ProjectData
SetProjectError
Exception
get_InnerException
get_Message
Remove
Create__Instance__
Instance
Component
Dispose
Dispose__Instance__
instance
RuntimeHelpers
System.Runtime.CompilerServices
GetObjectValue
Equals
GetHashCode
GetType
ToString
MyGroupCollectionAttribute
MyWebServices
ThreadSafeObjectProvider`1
m_ThreadStaticValue
CompilerGeneratedAttribute
GetInstance
ComVisibleAttribute
System.Runtime.InteropServices
Encoding
System.Text
get_UTF8
Convert
FromBase64String
GetString
Conversions
ToInteger
ToBoolean
STAThreadAttribute
NewLateBinding
LateSet
Boolean
LateCall
ClearProjectError
_Start
MemoryStream
System.IO
GZipStream
System.IO.Compression
Stream
CompressionMode
get_Length
set_Position
BitConverter
ToInt32
Module
Assembly
GetModules
GetTypes
get_FullName
Concat
EndsWith
get_Assembly
Resources
APK.My.Resources
resourceMan
ResourceManager
System.Resources
resourceCulture
CultureInfo
System.Globalization
ReferenceEquals
get_ResourceManager
get_Culture
set_Culture
GetObject
get_DATA
Culture
DebuggerNonUserCodeAttribute
MySettings
ApplicationSettingsBase
System.Configuration
defaultInstance
SettingsBase
Synchronized
get_Default
Default
MySettingsProperty
get_Settings
Settings
AssemblyProductAttribute
AssemblyTitleAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
AssemblyDescriptionAttribute
AssemblyTrademarkAttribute
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
AssemblyFileVersionAttribute
GuidAttribute
MyTemplate
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
Create__Instance__
Dispose__Instance__
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
Create__Instance__
Dispose__Instance__
3System.Resources.Tools.StronglyTypedResourceBuilder
2.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
9.0.0.0
My.Settings
Copyright
2017
WrapNonExceptionThrows
1.0.0.0
$1c69d2b1-611f-4644-a9bf-c753203904cd
_CorExeMain
mscoree.dll
wwwwwwwwwwwwwwp
DDDDDDDDDDDDDDp
DDDDDDDDDDDDDDp
LLLLLLLLLNItp
DDDDDDDDDDDDD@
wwwwwwwDDDDDDDGOGOGOGOGOGOGOGOGHGLGDDDDDD
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
W i n F o r m s _ R e c u r s i v e F o r m C r e a t e
W i n F o r m s _ S e e I n n e r E x c e p t i o n
M T I 1 L j E 3 O S 4 0 M i 4 2
c 2 V y d m V y
c 2 V 0 L m V 4 Z Q = =
d G V t c A = =
M Z H C E N 1 G O I U 2 G 4 Z 7 3 F E T
e z E w N z E 0 M G Y 1 a y 0 x e j g 0 L T A 0 M 3 Y t M T Y 5 O C 1 4 a z k y O T Q 4 O T c w N D h 9
_ M u l a i
A P K . R e s o u r c e s
V S _ V E R S I O N _ I N F O
V a r F i l e I n f o
T r a n s l a t i o n
S t r i n g F i l e I n f o
0 0 0 0 0 4 b 0
F i l e D e s c r i p t i o n
F i l e V e r s i o n
1 . 0 . 0 . 0
I n t e r n a l N a m e
A P K . e x e
L e g a l C o p y r i g h t
C o p y r i g h t
2 0 1 7
O r i g i n a l F i l e n a m e
A P K . e x e
P r o d u c t V e r s i o n
1 . 0 . 0 . 0
A s s e m b l y V e r s i o n
1 . 0 . 0 . 0
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.