5.6
高危
56 个模型检测该样本为恶意！
重新分析
更多

87e728fb51ed322906908df282871a620478264041972ca9b37f1804a92dc3f7

817d1a54e612e3540da84985462347cc.exe

分析耗时

108s

最近分析

文件大小

176.5KB
静态报毒 动态报毒 100% AGENERIC AI SCORE=100 ARTEMIS AUTO BLADABINDI BLVHH CLOUD CONFIDENCE DBJAZE ELDORADO FAKEDOC FLRH GEN7 H@6LG8EK HIGH CONFIDENCE LEIVION LM0@AQRBJXK LYZP MALICIOUS PE METERPRETER OP18TCNCVPC RAZY ROZENA SCORE SMALL SUSGEN TINY TINYLOADER TRJGEN UNSAFE VEIL VEILEV XPACK ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!817D1A54E612 20200416 6.0.6.653
Alibaba Trojan:Win32/Leivion.4194847d 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20200415 18.4.3895.0
Tencent Win32.Trojan.Fakedoc.Auto 20200416 1.0.0.1
Kingsoft 20200416 2013.8.14.323
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1620825909.354125
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1620825909.354125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (4 个事件)
Time & API Arguments Status Return Repeated
1620825842.791125
IsDebuggerPresent
failed 0 0
1620825842.791125
IsDebuggerPresent
failed 0 0
1620825909.307125
IsDebuggerPresent
failed 0 0
1620825909.307125
IsDebuggerPresent
failed 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620825842.807125
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620825909.307125
__exception__
stacktrace: 
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 89782632
registers.edi: 536
registers.eax: 1983198136
registers.ebp: 89782640
registers.edx: 14090240
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
exception.instruction: add byte ptr [eax], al
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xd70005
success 0 0
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:3980386769&cup2hreq=c6f686556b01bbce7d9f3e347f6fd62bb52fc04b767f61a54ff092919e443388
Performs some HTTP requests (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:3980386769&cup2hreq=c6f686556b01bbce7d9f3e347f6fd62bb52fc04b767f61a54ff092919e443388
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:3980386769&cup2hreq=c6f686556b01bbce7d9f3e347f6fd62bb52fc04b767f61a54ff092919e443388
Allocates read-write-execute memory (usually to unpack itself) (21 个事件)
Time & API Arguments Status Return Repeated
1620825842.135125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x004f0000
success 0 0
1620825842.135125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00630000
success 0 0
1620825842.635125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00b40000
success 0 0
1620825842.635125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00cb0000
success 0 0
1620825842.682125
NtProtectVirtualMemory
process_identifier: 2772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b91000
success 0 0
1620825842.791125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00a10000
success 0 0
1620825842.791125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ae0000
success 0 0
1620825842.791125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0055a000
success 0 0
1620825842.791125
NtProtectVirtualMemory
process_identifier: 2772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b92000
success 0 0
1620825842.791125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00552000
success 0 0
1620825843.026125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00562000
success 0 0
1620825843.088125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00585000
success 0 0
1620825843.088125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058b000
success 0 0
1620825843.088125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00587000
success 0 0
1620825843.260125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00563000
success 0 0
1620825843.307125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0056c000
success 0 0
1620825843.369125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ab0000
success 0 0
1620825843.729125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00564000
success 0 0
1620825843.869125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057a000
success 0 0
1620825843.869125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00577000
success 0 0
1620825909.307125
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d70000
success 0 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 138.197.73.53
host 172.217.24.14
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
MicroWorld-eScan Gen:Variant.Razy.575638
FireEye Generic.mg.817d1a54e612e354
McAfee Artemis!817D1A54E612
Cylance Unsafe
Zillya Downloader.Tiny.Win32.9680
Sangfor Malware
K7AntiVirus Spyware ( 000287dc1 )
Alibaba Trojan:Win32/Leivion.4194847d
K7GW Spyware ( 000287dc1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Razy.D8C896
Invincea heuristic
BitDefenderTheta Gen:NN.ZemsilF.34106.lm0@aqrbJXk
F-Prot W32/TinyLoader.G.gen!Eldorado
Symantec Backdoor.Veilev
TrendMicro-HouseCall Backdoor.MSIL.TINY.SMA
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Razy.575638
NANO-Antivirus Trojan.Win32.TrjGen.dbjaze
Paloalto generic.ml
Tencent Win32.Trojan.Fakedoc.Auto
Endgame malicious (high confidence)
Sophos Troj/Rozena-D
Comodo TrojWare.MSIL.TrojanDownloader.Small.H@6lg8ek
F-Secure Trojan.TR/Crypt.XPACK.Gen7
DrWeb BackDoor.Meterpreter.32
VIPRE Trojan.Win32.Generic!BT
TrendMicro Backdoor.MSIL.TINY.SMA
McAfee-GW-Edition Trojan-Veil-FLRH!C1A1852A4BDC
SentinelOne DFI - Malicious PE
Emsisoft Gen:Variant.Razy.575638 (B)
APEX Malicious
Cyren W32/TinyLoader.G.gen!Eldorado
Jiangmin Trojan.Generic.blvhh
MaxSecure Trojan.Malware.7164915.susgen
Avira TR/Crypt.XPACK.Gen7
Antiy-AVL Trojan/Win32.AGeneric
Microsoft Trojan:Win32/Leivion.E
AegisLab Trojan.Win32.Generic.lYzp
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Razy.575638 (2x)
AhnLab-V3 Trojan/Win32.Bladabindi.C3354708
ALYac Gen:Variant.Razy.575638
MAX malware (ai score=100)
Ad-Aware Gen:Variant.Razy.575638
ESET-NOD32 a variant of MSIL/TrojanDownloader.Tiny.BQ
Rising Downloader.Tiny!8.245 (CLOUD)
Yandex Trojan.Agent!op18TCnCVPc
Ikarus Trojan-Downloader.MSIL.Tiny
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1970-01-01 08:00:00

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49186 203.208.41.66 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 54178 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60088 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60221 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.