6.4
高危

34d38e1cf8761561180c63079d63c277b92959359278be8d020391524dece203

844746436bab73fb993a4714ccba6ef2.exe

分析耗时

91s

最近分析

文件大小

1.8MB
静态报毒 动态报毒 AI SCORE=82 AVKY BADCERT BSCOPE CERT COBALTSTRIKE DOWNLOAD4 EHLS ELDORADO GENERICRXKY GRAYWARE HDZD HIGH CONFIDENCE HUFRII KRYPTIK MALCERT MALWARE@#1L05P1DYS8P1K OJVQPY6V2MT PAPRAS PASSWORDSTEALER QAKBOT QVM07 R + MAL ROZENA SCORE SUSGEN TROJANPSW UDOCHKA UNSAFE WOJIK ZENPAK ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Backdoor:Win32/Qakbot.bc8c6a8e 20190527 0.3.0.5
CrowdStrike 20190702 1.0
Avast Win32:Malware-gen 20201109 20.10.5736.0
Baidu 20190318 1.0.0.2
Kingsoft 20201109 2013.8.14.323
McAfee GenericRXKY-WM!844746436BAB 20201109 6.0.6.653
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1620811060.184876
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
This executable is signed
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
Performs some HTTP requests (1 个事件)
request GET https://adsmarketart.com/jquery-3.3.1.min.js
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1620811058.777876
NtAllocateVirtualMemory
process_identifier: 708
region_size: 376832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01df0000
success 0 0
1620811059.027876
NtAllocateVirtualMemory
process_identifier: 708
region_size: 372736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e50000
success 0 0
1620811059.027876
NtProtectVirtualMemory
process_identifier: 708
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 385024
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620811060.074876
NtAllocateVirtualMemory
process_identifier: 708
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02040000
success 0 0
1620811060.074876
NtAllocateVirtualMemory
process_identifier: 708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021f0000
success 0 0
1620811060.074876
NtAllocateVirtualMemory
process_identifier: 708
region_size: 212992
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021f1000
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description 844746436bab73fb993a4714ccba6ef2.exe tried to sleep 157 seconds, actually delayed analysis time by 157 seconds
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1620811060.168876
NtProtectVirtualMemory
process_identifier: 708
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 151552
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x02230000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620811061.527876
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1620811064.168876
RegSetValueExA
key_handle: 0x000003a4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620811064.168876
RegSetValueExA
key_handle: 0x000003a4
value: €.hÉ×F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620811064.168876
RegSetValueExA
key_handle: 0x000003a4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620811064.168876
RegSetValueExW
key_handle: 0x000003a4
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620811064.168876
RegSetValueExA
key_handle: 0x000003c0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620811064.168876
RegSetValueExA
key_handle: 0x000003c0
value: €.hÉ×F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620811064.168876
RegSetValueExA
key_handle: 0x000003c0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620811064.231876
RegSetValueExW
key_handle: 0x000003a0
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1620811069.746876
RegSetValueExA
key_handle: 0x00000588
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620811069.746876
RegSetValueExA
key_handle: 0x00000588
value: Q»Ì×F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620811069.746876
RegSetValueExA
key_handle: 0x00000588
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620811069.746876
RegSetValueExW
key_handle: 0x00000588
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620811069.746876
RegSetValueExA
key_handle: 0x0000058c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620811069.746876
RegSetValueExA
key_handle: 0x0000058c
value: Q»Ì×F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620811069.746876
RegSetValueExA
key_handle: 0x0000058c
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.DownLoad4.13911
MicroWorld-eScan Gen:Variant.Zusy.312731
FireEye Generic.mg.844746436bab73fb
Qihoo-360 Generic/HEUR/QVM07.1.B817.Malware.Gen
ALYac Trojan.Agent.Rozena
Cylance Unsafe
Zillya Trojan.Zenpak.Win32.3803
Sangfor Malware
K7AntiVirus Trojan ( 00569bbd1 )
Alibaba Backdoor:Win32/Qakbot.bc8c6a8e
K7GW Trojan ( 00569bbd1 )
Arcabit Trojan.Zusy.D4C59B
Invincea Mal/Generic-R + Mal/BadCert-Gen
Cyren W32/Trojan.DZZ.gen!Eldorado
Symantec Trojan Horse
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan.Win32.Zenpak.avky
BitDefender Gen:Variant.Zusy.312731
NANO-Antivirus Trojan.Win32.Zenpak.hufrii
Avast Win32:Malware-gen
Ad-Aware Gen:Variant.Zusy.312731
Emsisoft MalCert.A (A)
Comodo Malware@#1l05p1dys8p1k
F-Secure Trojan.TR/AD.CobaltStrike.wojik
VIPRE Backdoor.Win32.Qakbot
TrendMicro Backdoor.Win32.QAKBOT.SME
McAfee-GW-Edition GenericRXKY-WM!844746436BAB
Sophos Mal/BadCert-Gen
Jiangmin Trojan.Zenpak.ciz
Avira TR/AD.CobaltStrike.wojik
Antiy-AVL GrayWare/Win32.Kryptik.ehls
Gridinsoft Trojan.Win32.Kryptik.oa
Microsoft Backdoor:Win32/Qakbot.A!cert
AegisLab Trojan.Win32.Zenpak.4!c
ZoneAlarm Trojan.Win32.Zenpak.avky
GData Gen:Variant.Zusy.312731
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.CobaltStrike.C4141534
McAfee GenericRXKY-WM!844746436BAB
MAX malware (ai score=82)
VBA32 BScope.TrojanPSW.Papras
Malwarebytes Spyware.PasswordStealer
ESET-NOD32 a variant of Win32/Kryptik.HDZD
TrendMicro-HouseCall Backdoor.Win32.QAKBOT.SME
Rising Backdoor.Qakbot!8.C7B (TFE:5:oJvQPy6v2MT)
Ikarus Trojan.Win32.Crypt
eGambit Unsafe.AI_Score_99%
Fortinet W32/Udochka.BQ!tr
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-23 22:42:52

Imports

Library KERNEL32.dll:
0x5bec10 VirtualAlloc
0x5bec14 GetModuleHandleW
0x5bec18 GetLastError
0x5bec1c LoadLibraryA
0x5bec20 GetProcAddress
0x5bec24 GetStartupInfoA
0x5bec28 GetModuleHandleA
Library USER32.dll:
0x5bec30 GetDesktopWindow
0x5bec34 CharNextA
0x5bec38 wsprintfA
0x5bec3c DispatchMessageW
0x5bec40 RegisterClassA
0x5bec44 LoadImageA
0x5bec48 GetSystemMetrics
0x5bec4c DispatchMessageA
0x5bec50 PostMessageA
0x5bec54 AppendMenuA
0x5bec58 CreatePopupMenu
0x5bec5c ShowWindow
0x5bec64 GetCursorPos
0x5bec68 DefWindowProcA
0x5bec6c IsWindowUnicode
0x5bec70 PeekMessageA
0x5bec74 CreateWindowExA
0x5bec78 GetWindowLongA
0x5bec7c MessageBoxA
0x5bec80 DestroyWindow
0x5bec84 GetMessageA
0x5bec88 GetMessageW
0x5bec8c PostQuitMessage
0x5bec90 TrackPopupMenu
0x5bec94 SetForegroundWindow
0x5bec98 LoadStringA
0x5bec9c TranslateMessage
0x5beca0 SetWindowLongA
0x5beca4 LoadIconA
0x5beca8 GetInputState
0x5becac IsCharAlphaW
0x5becb0 GetClipboardData
0x5becb4 IsCharAlphaNumericA
0x5becbc GetThreadDesktop
0x5becc4 GetWindowDC
0x5becc8 DestroyCursor
0x5beccc InSendMessage
0x5becd0 IsIconic
0x5becd4 CloseClipboard
0x5becd8 DestroyMenu
0x5becdc LoadCursorFromFileW
0x5bece8 GetKeyboardType
0x5becec GetDialogBaseUnits
0x5becf4 GetMenu
0x5becf8 IsCharAlphaA
0x5becfc GetCapture
0x5bed00 GetClipboardViewer
0x5bed04 IsCharAlphaNumericW
0x5bed08 PaintDesktop
0x5bed0c DestroyIcon
0x5bed14 GetDlgCtrlID
0x5bed18 GetMessageTime
0x5bed1c OpenIcon
0x5bed20 GetSysColor
0x5bed24 GetFocus
0x5bed28 GetAsyncKeyState
0x5bed2c DrawMenuBar
0x5bed30 VkKeyScanW
0x5bed34 CharUpperW
0x5bed38 GetClipboardOwner
0x5bed3c EndMenu
0x5bed40 VkKeyScanA
0x5bed44 IsWindow
0x5bed48 CharLowerA
0x5bed4c GetShellWindow
0x5bed50 IsWindowVisible
0x5bed54 GetMessagePos
0x5bed58 LoadCursorA
0x5bed5c RegisterClassExA
0x5bed60 BeginPaint
0x5bed64 GetClientRect
0x5bed68 DrawTextA
0x5bed6c EndPaint
0x5bed70 CharNextW
Library GDI32.dll:
0x5bed78 GetStockObject
0x5bed7c GetEnhMetaFileA
0x5bed80 GetTextColor
0x5bed84 DeleteColorSpace
0x5bed88 GetColorSpace
0x5bed8c CreateMetaFileW
0x5bed90 GetSystemPaletteUse
0x5bed94 SetMetaRgn
0x5bed98 GetBkColor
0x5bed9c GetLayout
0x5beda0 DeleteDC
0x5beda4 GetBkMode
0x5beda8 CreateCompatibleDC
0x5bedac GetFontLanguageInfo
0x5bedb0 GdiGetBatchLimit
0x5bedb4 CloseEnhMetaFile
0x5bedb8 GetDCBrushColor
0x5bedbc GetPixelFormat
0x5bedc0 CloseFigure
0x5bedc4 CancelDC
0x5bedc8 PathToRegion
0x5bedcc FlattenPath
0x5bedd0 DeleteEnhMetaFile
0x5bedd4 GetStretchBltMode
0x5bedd8 GetObjectType
0x5beddc AbortPath
0x5bede0 GetROP2
0x5bede4 WidenPath
0x5bede8 EndDoc
0x5bedec StrokePath
0x5bedf0 GetTextAlign
0x5bedf4 BeginPath
0x5bedf8 GetEnhMetaFileW
Library ADVAPI32.dll:
0x5bee00 RegOpenKeyA
Library WINMM.dll:
0x5bee08 PlaySoundA
Library MSVCRT.dll:
0x5bee10 _except_handler3
0x5bee14 __set_app_type
0x5bee18 __p__fmode
0x5bee1c __p__commode
0x5bee20 _adjust_fdiv
0x5bee24 __setusermatherr
0x5bee28 _initterm
0x5bee2c __getmainargs
0x5bee30 _acmdln
0x5bee34 exit
0x5bee38 _XcptFilter
0x5bee3c _exit
0x5bee40 _onexit
0x5bee44 __dllonexit
0x5bee48 _controlfp

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49179 194.67.71.170 adsmarketart.com 443
192.168.56.101 49187 194.67.71.170 adsmarketart.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.