2.5
中危
65 个模型检测该样本为恶意！
重新分析
更多

0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a

0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a.exe

分析耗时

19s

最近分析

381天前

文件大小

32.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER RAZY
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.61
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba VirTool:Win32/CeeInject.ee163a53 20190527 0.3.0.5
Avast Win32:DropperX-gen [Drp] 20200503 18.4.3895.0
Baidu Win32.Trojan.Inject.bm 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Kingsoft None 20200504 2013.8.14.323
McAfee Downloader-BIJ.a 20200504 6.0.6.653
Tencent Malware.Win32.Gencirc.11525443 20200504 1.0.0.1
静态指标
观察到命令行控制台输出 (11 个事件)
Time & API Arguments Status Return Repeated
1727545325.42125
WriteConsoleW
console_handle: 0x00000007
buffer: C:\Users\Administrator\AppData\Local\Temp>
success 1 0
1727545325.43725
WriteConsoleW
console_handle: 0x00000007
buffer: del
success 1 0
1727545325.43725
WriteConsoleW
console_handle: 0x00000007
buffer: "C:\Users\Administrator\AppData\Local\Appinfo.exe" /a
success 1 0
1727545325.45225
WriteConsoleW
console_handle: 0x00000007
buffer: C:\Users\Administrator\AppData\Local\Temp>
success 1 0
1727545325.45225
WriteConsoleW
console_handle: 0x00000007
buffer: move
success 1 0
1727545325.45225
WriteConsoleW
console_handle: 0x00000007
buffer: "C:\Users\Administrator\AppData\Local\Appinfo.exe.tmp1" "C:\Users\Administrator\AppData\Local\Appinfo.exe"
success 1 0
1727545325.48425
WriteConsoleW
console_handle: 0x00000007
buffer: 移动了 1 个文件。
success 1 0
1727545325.48425
WriteConsoleW
console_handle: 0x00000007
buffer: C:\Users\Administrator\AppData\Local\Temp>
success 1 0
1727545325.48425
WriteConsoleW
console_handle: 0x00000007
buffer: del
success 1 0
1727545325.48425
WriteConsoleW
console_handle: 0x00000007
buffer: a.bat
success 1 0
1727545325.49925
WriteConsoleW
console_handle: 0x0000000b
buffer: 找不到批处理文件。
success 1 0
一个或多个进程崩溃 (3 个事件)
Time & API Arguments Status Return Repeated
1727545323.499625
__exception__
exception.address: 0x402133
exception.instruction: xor byte ptr [ecx], al
exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b
exception.symbol: szFile-0x210d 0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a+0x2133
exception.exception_code: 0xc0000005
registers.eax: 94
registers.ecx: 4214964
registers.edx: 59
registers.ebx: 256
registers.esp: 1637600
registers.ebp: 1637624
registers.esi: 1637976
registers.edi: 256
stacktrace: 
szFile-0x2fc6 0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a+0x127a @ 0x40127a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

 success 0 0
1727545323.499625
__exception__
exception.address: 0x402133
exception.instruction: xor byte ptr [ecx], al
exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b
exception.symbol: szFile-0x210d 0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a+0x2133
exception.exception_code: 0xc0000005
registers.eax: 27
registers.ecx: 4218880
registers.edx: 37
registers.ebx: 256
registers.esp: 1637600
registers.ebp: 1637624
registers.esi: 1637976
registers.edi: 256
stacktrace: 
szFile-0x2fc6 0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a+0x127a @ 0x40127a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

 success 0 0
1727545323.499625
__exception__
exception.address: 0x402133
exception.instruction: xor byte ptr [ecx], al
exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b
exception.symbol: szFile-0x210d 0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a+0x2133
exception.exception_code: 0xc0000005
registers.eax: 247
registers.ecx: 4222976
registers.edx: 101
registers.ebx: 256
registers.esp: 1637600
registers.ebp: 1637624
registers.esi: 1637976
registers.edi: 256
stacktrace: 
szFile-0x2fc6 0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a+0x127a @ 0x40127a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

 success 0 0
行为判定
动态指标
分配可读-可写-可执行内存（通常用于自解压） (2 个事件)
Time & API Arguments Status Return Repeated
1727545323.499625
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00400000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 616
success 0 0
1727545323.499625
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x72591000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 616
success 0 0
在文件系统上创建可执行文件 (2 个事件)
file C:\Users\Administrator\AppData\Local\Temp\~dfds3.reg
file C:\Users\Administrator\AppData\Local\Temp\a.bat
将可执行文件投放到用户的 AppData 文件夹 (1 个事件)
file C:\Users\Administrator\AppData\Local\Appinfo.exe
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x00002cc4', 'size_of_data': '0x00003000', 'entropy': 7.743343539126854} entropy 7.743343539126854 description 发现高熵的节
entropy 0.42857142857142855 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
枚举服务，可能用于反虚拟化 (1 个事件)
Time & API Arguments Status Return Repeated
1727545323.499625
EnumServicesStatusA
service_handle: 0x008647a0
service_type: 48
service_status: 2
success 1 0
在 Windows 启动时自我安装以实现自动运行 (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Appinfo reg_value C:\Users\Administrator\AppData\Local\Appinfo.exe
文件已被 VirusTotal 上 65 个反病毒引擎识别为恶意 (50 out of 65 个事件)
ALYac Trojan.Injector
APEX Malicious
AVG Win32:DropperX-gen [Drp]
Acronis suspicious
Ad-Aware Gen:Variant.Razy.448218
AhnLab-V3 Backdoor/Win32.CSon.R885
Alibaba VirTool:Win32/CeeInject.ee163a53
Antiy-AVL Trojan[Downloader]/Win32.Rubinurd.b
Arcabit Trojan.Razy.D6D6DA
Avast Win32:DropperX-gen [Drp]
Avira TR/Dropper.Gen
Baidu Win32.Trojan.Inject.bm
BitDefender Gen:Variant.Razy.448218
BitDefenderTheta AI:Packer.54A3CF691F
Bkav W32.AIDetectVM.malware
CMC Trojan-Downloader.Win32.Rubinurd!O
ClamAV Win.Trojan.Rubinurd-67
Comodo TrojWare.Win32.Toga.B@6vx8t0
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.05c9cc
Cylance Unsafe
Cyren W32/A-1a76837c!Eldorado
DrWeb Win32.HLLW.Autoruner.27746
ESET-NOD32 Win32/TrojanDownloader.Agent.PTT
Emsisoft Gen:Variant.Razy.448218 (B)
Endgame malicious (high confidence)
F-Prot W32/A-1a76837c!Eldorado
F-Secure Trojan.TR/Dropper.Gen
FireEye Generic.mg.84aed4a05c9cc615
Fortinet W32/Injector.BFSU!tr
GData Win32.Trojan.Agent.ASM
Ikarus Trojan-Downloader.SuspectCRC
Invincea heuristic
Jiangmin TrojanDownloader.Small.akba
K7AntiVirus Trojan-Downloader ( 0040f54b1 )
K7GW Trojan-Downloader ( 000918cf1 )
Kaspersky HEUR:Trojan.Win32.Miancha.gen
Lionic Trojan.Win32.Generic.lk0q
MAX malware (ai score=82)
Malwarebytes Backdoor.Simbot
MaxSecure Trojan.Downloader.Rubinurd.bf
McAfee Downloader-BIJ.a
McAfee-GW-Edition BehavesLike.Win32.Downloader.nm
MicroWorld-eScan Gen:Variant.Razy.448218
Microsoft VirTool:Win32/CeeInject.gen!DU
NANO-Antivirus Trojan.Win32.Autoruner.bbwavd
Paloalto generic.ml
Panda Trj/Genetic.gen
Qihoo-360 Win32/Dropper.Dapato.A
Rising Dropper.Generic!8.35E (TFE:dGZlOgUzB9g24BWYcQ)
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2010-09-07 10:27:10

PE Imphash

f54bab47f74e370cf85ce98d899e8149

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001755 0x00002000 5.865039042571762
.rdata 0x00003000 0x000005a5 0x00001000 2.233959569513802
.data 0x00004000 0x00000593 0x00001000 1.1466860135781263
.rsrc 0x00005000 0x00002cc4 0x00003000 7.743343539126854

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x000050b4 0x00002800 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_VERSION 0x000078b4 0x00000410 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library KERNEL32.dll:
• 0x40301c ExitProcess
• 0x403020 ReadFile
• 0x403024 HeapAlloc
• 0x403028 GetProcessHeap
• 0x40302c GetFileSize
• 0x403030 CopyFileA
• 0x403034 GetModuleFileNameA
• 0x40303c GetProcAddress
• 0x403044 VirtualProtect
• 0x40304c GetModuleHandleA
• 0x403050 LockResource
• 0x403054 LoadResource
• 0x403058 SetFilePointer
• 0x40305c FindResourceA
• 0x403060 GetLastError
• 0x403064 MoveFileA
• 0x403068 DeleteFileA
• 0x40306c lstrcmpiA
• 0x403070 GetLongPathNameA
• 0x403078 GetTickCount
• 0x40307c OutputDebugStringA
• 0x403080 lstrlenA
• 0x403084 TerminateProcess
• 0x403088 VirtualAllocEx
• 0x40308c HeapFree
• 0x403090 VirtualAlloc
• 0x403094 Sleep
• 0x403098 lstrcpyA
• 0x40309c lstrcatA
• 0x4030a0 CreateFileA
• 0x4030a4 WriteFile
• 0x4030a8 CloseHandle
• 0x4030ac SizeofResource
• 0x4030b0 WinExec
Library USER32.dll:
• 0x4030c4 wsprintfA
• 0x4030c8 MessageBoxA
Library ADVAPI32.dll:
• 0x403000 CloseServiceHandle
• 0x403004 CryptGenRandom
• 0x403008 CryptReleaseContext
• 0x40300c EnumServicesStatusA
• 0x403010 OpenSCManagerA
Library SHLWAPI.dll:
• 0x4030b8 PathRemoveFileSpecA
• 0x4030bc StrChrA

Exports

Ordinal Address Name
1 0x404240 szFile
L!This program cannot be run in DOS mode.
.rdata
@.data
3fj@3Yu
tESPh
SVWj@3Y3j?fY3f^
EPEPhL@@
MSQEuPV
YYPV5X0@
ESPuW=0@
ESPuh$
ESPuh/
ESPuhl
;t$uuh
jfhL@@
_^3[UQQe
H<EHC@
X^UQQV5
WEWP}}
;t'EPEPEPh
3?;3j u
A(;r3_^[
7reT_X
|k!!rC
NVb!d?
pLdhL^
hm7'"u
JM*5$ImjG)Cu
"{l_zXL
b_)\v'+J
3Zo_SK#*
08:^3+c;D%uu?
MgY\.b
i!|D-;
"SFj(}
.r%.#vAX.IOsk
y;zq9L$
A9\Q^4
K]"ja>2<*
5[cm`
5ATa%|_
ID2`a.fq
7m-WQ^LY`
Hg,dGp
X]Uar;L,sFb8u4
Ulr;!3{Mdl
~|R:@e
XBKx\v)
|_^[]UE
)um<ACXU
0!*!)Fd
]7D0ao{Y
yUX}lw
E>kkvU
g"oMYw\NHZ3XMS
c&xT4g
wnq:w>e]N
Lv',73rv/`
EE~cSVu
3fj@3Yj@fY3fj@3Yu
]f]@~)M
GEQ@9E|
3tESPPPPu
uRFGHt
t+t'NW8u
;uH_^Q=
r)$h%@
DDDDDDDDDDDDDD
WinExec
CloseHandle
WriteFile
CreateFileA
lstrcatA
lstrcpyA
SetFilePointer
ExitProcess
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CopyFileA
GetModuleFileNameA
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetLastError
MoveFileA
DeleteFileA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetTickCount
OutputDebugStringA
lstrlenA
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
KERNEL32.dll
wsprintfA
MessageBoxA
USER32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
StrChrA
PathRemoveFileSpecA
SHLWAPI.dll
roudanx.exe
szFile
Z4]a.bat
del "%s" /a
move "%s" "%s"
del %%0
rwbinru/dyd
RT_RCDATA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
kernel32
szFile
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
ZwUnmapViewOfSection
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinHttp
Are you sure?
regedit.exe /s
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
ZC\#*Q
};!uzHJ
o(O dfku
mEJ|H`cc'
pgw#45
h@9JVq7q
YxL30)MA
kicIXN
-A@j+<tgTd
Pdk7$o
WmUYZ>"&*I
B?0@K7"y(A.)
_foEM=rlr:
3^T_NZ^2X
}'8NjRj{%
W&w)Hu`"#,]P>
gm^,Fx
9C,(oD
Oc0s^]kv
QP{zwSHM
^XAgixb
56u/O-#)}]zS7|M4y8T
x 2zx;TtE0
(.hrOm
K^H9|#
9%.(nH
7pBg5[
_z7cUT8
nI<y?#h
oUD5wx7
mJ:Tvuu
=4><Kq
E'.e5>V2Y
YN(r^'
NQNz|i
#G|]Kq43
JURvI:
)q.#;,*a+U5G
oix4GuzL|z^q&/7h`
C`#sf;J)%
<r;v]w
h":*HQ>C
xQ;kX\1gKD
~Bw )X(:
[=B6tJY/V
t.D5)%`0E=l\<A>-w
:WpP:N6
l'=JYlO
0,c=\|P2
dfh!]+uggwUe
6f^\xUds
qJ2~6O
UFkc#V>
rYLx/1HL#V,[d6
')S)x,<b}
UJO%\E
SMMyd_
u)|R=7T}n,P
MEBypWpLsv
D^%c{ b
/GbVvD&
7)10h|2A|
Ymsq9x^
skrBg*-
5ccX=X L>4
MFJm$J
y=7e./
Wg9okF0t
6~B"HY$9bG'=Q
cp$M#94N0Hn
Q2[h}#P
f\~V`.
oCV.fJ
"enRcf
1:Ub1u
3{i"0/8
vExP{]
<Yi44ZW
A^^!.9
swJvNk1%&m/
&n6`b4
>j,#,V@pJt$V
@#hQ}
zSZ@By-n
u[!x w
Dz2pY/
M_b5XD
rPaje6
j-xWN
Rv6-+W
2DFN[P54E
V<*c$e4
gwBvuAF8Z
*JeR=G
at7X8Ot|16Ljqo
PyF\4xq
h'}uZb
LH/=o[l
;bF'7\.(Gw:
+P4cz(vDP
^w"3kK.;S
OrV]-flbSl
vyTwrn
|9,.4w5T*M
'q)H<m
(MNzB7X
q<Zkvw
AQoUZ,
7.AY!K
^q.cQcH^
ro18B?P8
#wvi#hw
wwB[A'
kt;K:`XS
00bBA]
';Yi8HyEfJ
fL2?l;"&r$J%
`p)4!sa!(
nIs^<]s
&v,<aeDj
2;EmRi
SxOUV+F
J)]5/|
TMWt53Q
:AO'k<
!ruMS
|?gN:<_k6
GVClk~S*e
;Kz#x6
fG>'%N&~9
.JJ-7ApV3
u^ kGpK
61MAYzT#M
V:HQQRl@NL
gO ?wf%TdojU*k81 `v
D~FaJ%v
U9ii;m
<(wyK|B
&s#T }
Rr>my?F.
A7%C/=
t(4',3Y
Y '3uOo3;
ClLQ}~-v9mZ
:"AbnfZh
jb&EO
ms_\XIl|%xEK?
4?vWsS"2?P
K\dGR~n
%b+,ek
I55u5`
9l9[0\
9KzRW
Rp]n!Gl
m6GIPE|^
i`-q^(D'
zjiiOX+
4g.+\N
&`B!;d%(Wm
sG_S5[ Be43
s; u%EpS<
`h'74)-
1J}`.e|,]`c~xS
6Ru$AJ>4kw>N?,e"?
wh(qia
IfTb1l
x,NIl$p)
ED%5iA
G:Dun74
TId;v@W'T[
R}!+<tX=#
2ndzTR?;,#%E
3r2We`=b\F~_(
C8l(cT,!
5NmT5{7WubH
{'vv|(
XRQZOqhPa
L*d-R5
E5<iP:Y_1?p
StbZ[6d
;\#"e{NUb?{y
?)_T\Qvx;/
+c`3VG
F DiR}U7ys
1BCdmhmUi
B|-'L+
{5UIAc)QQ
xnKcO/o|b
Qiuk~n
DjDV\%OP
?5'Z-DM@ro#.p2Y>(jz3F
K<=PY
Qt?g4R,6
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
RT_RCDATA
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Adobe Systems, Inc.
FileDescription
Adobe? Flash? Player Installer/Uninstaller 10.1 r53
FileVersion
10,1,53,64
InternalName
Adobe? Flash? Player Installer/Uninstaller 10.1
LegalCopyright
Copyright ? 1996-2010 Adobe, Inc.
LegalTrademarks
Adobe? Flash? Player
OriginalFilename
FlashUtil.exe
ProductName
Flash? Player Installer/Uninstaller
ProductVersion
10,1,53,64
VarFileInfo
Translation

Process Tree

0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a.exe, PID: 616, Parent PID: 2224

default registry file network process services synchronisation iexplore office pdf

regedit.exe, PID: 2708, Parent PID: 616

default registry file network process services synchronisation iexplore office pdf

cmd.exe, PID: 1972, Parent PID: 616

default registry file network process services synchronisation iexplore office pdf

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255
dns.msftncsi.com

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name d0fc8417f48fb81a_appinfo.exe
Filepath c:\users\administrator\appdata\local\appinfo.exe
Size 32.0KB
Processes 616 (0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a.exe) 1972 (cmd.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1bd27e5753ff5acb016a8e6463845c6d
SHA1 cca15b2bff6b6c21943d1b4596d8d4f29a8a07c5
SHA256 d0fc8417f48fb81a001f681229ba7723b19ef0632f4be5310f51116200b63de3
CRC32 05587BDF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name beaaedec7b4ba3a0_a.bat
Filepath C:\Users\Administrator\AppData\Local\Temp\a.bat
Size 1.0KB
Processes 616 (0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a.exe) 1972 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 9922de4871bf59004b69b52d8bd99c39
SHA1 f95846a22a0c394c9ec24b433174ebc5fd98f8e2
SHA256 beaaedec7b4ba3a0ac10e87bf1df4f6a55f048472fc104a3899080ab2c8c4e1b
CRC32 6122A257
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0a2598196d5d261c_Appinfo.exe
Filepath C:\Users\Administrator\AppData\Local\Appinfo.exe
Size 32.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 84aed4a05c9cc6157cd184a85a70aea7
SHA1 5df7b77a15dcf48856288f560adb69a200080d50
SHA256 0a2598196d5d261cd1a72ef81bc4c0bd1285961fb5b3048b52f1e66eeff9658a
CRC32 8E55E31A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.