SmartHawk

9.6

极危

60 个模型检测该样本为恶意！

重新分析

下载样本

3aed578eac99c3b865fceef0250760f283ed3a2e2c191447e3e6eddf659a1c5b

85ebac484ae7a12bc626da91e19ff472.exe

分析耗时

45s

最近分析

文件大小

830.0KB

静态报毒动态报毒 AGEN AI SCORE=80 AIDETECTVM BTIOQQ CLOUD CONFIDENCE CRIDEX DELF DELPHILESS ECUL ELWH ELZG FAREIT GENERICKD GENETIC HIGH CONFIDENCE HKBSJN HPLOKI IGENT KRYPTIK LOKIBOT MALWARE2 MALWARE@#2053Q5O6BF5X7 MODERATE SCORE SMBD SPYBOTNET TSCOPE TSPY UNSAFE WACATAC X2066 ZELPHIF ZGW@AQRSW8KI ZPUP 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FTB!85EBAC484AE7	20200722	6.0.6.653
Alibaba	Trojan:Win32/Cridex.7e5f9e7f	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20200722	18.4.3895.0
Tencent	Win32.Trojan.Kryptik.Ecul	20200723	1.0.0.1
Kingsoft		20200723	2013.8.14.323

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619706999.882999 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49282616 registers.edi: 0 registers.eax: 0 registers.ebp: 49282952 registers.edx: 2130553844 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 9e 92 00 00 e9 exception.symbol: 85ebac484ae7a12bc626da91e19ff472+0x58eeb exception.instruction: div eax exception.module: 85ebac484ae7a12bc626da91e19ff472.exe exception.exception_code: 0xc0000094 exception.offset: 364267 exception.address: 0x458eeb	success	0	0
1619707004.180751 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a 85ebac484ae7a12bc626da91e19ff472+0x543f8 @ 0x4543f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74104b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74105d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfcd514ad	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (27 个事件)

Time & API	Arguments	Status
1619706999.679999 NtAllocateVirtualMemory	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success
1619706999.882999 NtProtectVirtualMemory	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 45056 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00458000	success
1619706999.898999 NtAllocateVirtualMemory	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fd0000	success
1619707000.649751 NtAllocateVirtualMemory	process_identifier: 2120 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01dc0000	success
1619707000.649751 NtAllocateVirtualMemory	process_identifier: 2120 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fa0000	success
1619707000.649751 NtAllocateVirtualMemory	process_identifier: 2120 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01dc0000	success
1619707000.649751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 286720 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01dc2000	success
1619707004.086751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.086751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619707004.086751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.086751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619707004.086751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.086751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619707004.086751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.086751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00532000	success
1619707004.102751 NtProtectVirtualMemory	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cor143 shipment.vbs

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.606619502981178

section

{'size_of_data': '0x00063c00', 'virtual_address': '0x00072000', 'entropy': 7.606619502981178, 'name': '.rsrc', 'virtual_size': '0x00063b10'}

description

A section with a high entropy has been found

entropy

0.4813027744270205

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619707000.351999 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000100 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000f0000	success	0	0

Installs itself for autorun at Windows startup (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cor143 shipment.vbs

Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3048 created a thread in remote process 2868
1619707000.351999 NtQueueApcThread	thread_handle: 0x000000fc process_identifier: 2868 function_address: 0x000f05c0 parameter: 0x00100000	success	0	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619707000.351999 WriteProcessMemory	process_identifier: 2868 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x00000100 base_address: 0x000f0000	success	1	0
1619707000.351999 WriteProcessMemory	process_identifier: 2868 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\85ebac484ae7a12bc626da91e19ff472.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\85ebac484ae7a12bc626da91e19ff472.exe" Cor143 shipmentsET DMsRUcmjXufD = CreAtEobJect("wscrIpt.SHell") dMSruCmJXuFd.run """%ls""", 0, False process_handle: 0x00000100 base_address: 0x00100000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3048 called NtSetContextThread to modify thread in remote process 2120
1619707000.398999 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4510399 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2120	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3048 resumed a thread in remote process 2120
1619707000.476999 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2120	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (11 个事件)

Time & API	Arguments	Status	Return
1619707000.351999 CreateProcessInternalW	thread_identifier: 1752 thread_handle: 0x000000fc process_identifier: 2868 current_directory: filepath: C:\Windows\System32\notepad.exe track: 1 command_line: filepath_r: C:\Windows\system32\notepad.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000100 inherit_handles: 0	success	1
1619707000.351999 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000100 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000f0000	success	0
1619707000.351999 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000100 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00100000	success	0
1619707000.351999 WriteProcessMemory	process_identifier: 2868 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x00000100 base_address: 0x000f0000	success	1
1619707000.351999 WriteProcessMemory	process_identifier: 2868 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\85ebac484ae7a12bc626da91e19ff472.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\85ebac484ae7a12bc626da91e19ff472.exe" Cor143 shipmentsET DMsRUcmjXufD = CreAtEobJect("wscrIpt.SHell") dMSruCmJXuFd.run """%ls""", 0, False process_handle: 0x00000100 base_address: 0x00100000	success	1
1619707000.382999 CreateProcessInternalW	thread_identifier: 2308 thread_handle: 0x00000108 process_identifier: 2120 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\85ebac484ae7a12bc626da91e19ff472.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000104 inherit_handles: 0	success	1
1619707000.382999 NtUnmapViewOfSection	process_identifier: 2120 region_size: 4096 process_handle: 0x00000104 base_address: 0x00400000	success	0
1619707000.382999 NtMapViewOfSection	section_handle: 0x00000110 process_identifier: 2120 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000104 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619707000.398999 NtGetContextThread	thread_handle: 0x00000108	success	0
1619707000.398999 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4510399 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2120	success	0
1619707000.476999 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2120	success	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)

Bkav	W32.AIDetectVM.malware2
MicroWorld-eScan	Trojan.GenericKD.43139291
FireEye	Generic.mg.85ebac484ae7a12b
CAT-QuickHeal	Trojan.Multi
McAfee	Fareit-FTB!85EBAC484AE7
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 005667651 )
Alibaba	Trojan:Win32/Cridex.7e5f9e7f
K7GW	Trojan ( 005667651 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Generic.D29240DB
TrendMicro	TSPY_HPLOKI.SMBD
F-Prot	W32/Injector.JCE
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Dropper.LokiBot-7787977-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.GenericKD.43139291
NANO-Antivirus	Trojan.Win32.SpyBotNET.hkbsjn
Paloalto	generic.ml
Tencent	Win32.Trojan.Kryptik.Ecul
Ad-Aware	Trojan.GenericKD.43139291
Sophos	Mal/Fareit-AA
Comodo	Malware@#2053q5o6bf5x7
F-Secure	Heuristic.HEUR/AGEN.1133569
DrWeb	BackDoor.SpyBotNET.17
Zillya	Trojan.Injector.Win32.731991
Invincea	heuristic
Trapmine	malicious.moderate.ml.score
Emsisoft	Trojan.GenericKD.43139291 (B)
Cyren	W32/Injector.ZPUP-1501
Jiangmin	Trojan.Kryptik.bfi
Avira	HEUR/AGEN.1133569
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	Trojan:Win32/Cridex.VD!MTB
Endgame	malicious (high confidence)
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Win32.Trojan.Injector.PA
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2066
ALYac	Trojan.GenericKD.43139291
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
Zoner	Trojan.Win32.89664
ESET-NOD32	a variant of Win32/Injector.ELWH

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x466140 DeleteCriticalSection

• 0x466144 LeaveCriticalSection

• 0x466148 EnterCriticalSection

• 0x46614c InitializeCriticalSection

• 0x466150 VirtualFree

• 0x466154 VirtualAlloc

• 0x466158 LocalFree

• 0x46615c LocalAlloc

• 0x466160 GetVersion

• 0x466164 GetCurrentThreadId

• 0x466168 InterlockedDecrement

• 0x46616c InterlockedIncrement

• 0x466170 VirtualQuery

• 0x466174 WideCharToMultiByte

• 0x466178 MultiByteToWideChar

• 0x46617c lstrlenA

• 0x466180 lstrcpynA

• 0x466184 LoadLibraryExA

• 0x466188 GetThreadLocale

• 0x46618c GetStartupInfoA

• 0x466190 GetProcAddress

• 0x466194 GetModuleHandleA

• 0x466198 GetModuleFileNameA

• 0x46619c GetLocaleInfoA

• 0x4661a0 GetCommandLineA

• 0x4661a4 FreeLibrary

• 0x4661a8 FindFirstFileA

• 0x4661ac FindClose

• 0x4661b0 ExitProcess

• 0x4661b4 WriteFile

• 0x4661b8 UnhandledExceptionFilter

• 0x4661bc RtlUnwind

• 0x4661c0 RaiseException

• 0x4661c4 GetStdHandle

Library user32.dll:

• 0x4661cc GetKeyboardType

• 0x4661d0 LoadStringA

• 0x4661d4 MessageBoxA

• 0x4661d8 CharNextA

Library advapi32.dll:

• 0x4661e0 RegQueryValueExA

• 0x4661e4 RegOpenKeyExA

• 0x4661e8 RegCloseKey

Library oleaut32.dll:

• 0x4661f0 SysFreeString

• 0x4661f4 SysReAllocStringLen

• 0x4661f8 SysAllocStringLen

Library kernel32.dll:

• 0x466200 TlsSetValue

• 0x466204 TlsGetValue

• 0x466208 LocalAlloc

• 0x46620c GetModuleHandleA

Library advapi32.dll:

• 0x466214 RegQueryValueExA

• 0x466218 RegOpenKeyExA

• 0x46621c RegCloseKey

Library kernel32.dll:

• 0x466224 lstrcpyA

• 0x466228 lstrcmpA

• 0x46622c WriteFile

• 0x466230 WaitForSingleObject

• 0x466234 VirtualQuery

• 0x466238 VirtualProtect

• 0x46623c VirtualAlloc

• 0x466240 Sleep

• 0x466244 SizeofResource

• 0x466248 SetThreadLocale

• 0x46624c SetFilePointer

• 0x466250 SetEvent

• 0x466254 SetErrorMode

• 0x466258 SetEndOfFile

• 0x46625c ResetEvent

• 0x466260 ReadFile

• 0x466264 MulDiv

• 0x466268 LockResource

• 0x46626c LoadResource

• 0x466270 LoadLibraryA

• 0x466274 LeaveCriticalSection

• 0x466278 InitializeCriticalSection

• 0x46627c GlobalUnlock

• 0x466280 GlobalReAlloc

• 0x466284 GlobalHandle

• 0x466288 GlobalLock

• 0x46628c GlobalFree

• 0x466290 GlobalFindAtomA

• 0x466294 GlobalDeleteAtom

• 0x466298 GlobalAlloc

• 0x46629c GlobalAddAtomA

• 0x4662a0 GetVersionExA

• 0x4662a4 GetVersion

• 0x4662a8 GetTickCount

• 0x4662ac GetThreadLocale

• 0x4662b0 GetSystemTimeAsFileTime

• 0x4662b4 GetSystemTime

• 0x4662b8 GetSystemInfo

• 0x4662bc GetStringTypeExA

• 0x4662c0 GetStdHandle

• 0x4662c4 GetProcAddress

• 0x4662c8 GetModuleHandleA

• 0x4662cc GetModuleFileNameA

• 0x4662d0 GetLocaleInfoA

• 0x4662d4 GetLocalTime

• 0x4662d8 GetLastError

• 0x4662dc GetFullPathNameA

• 0x4662e0 GetDiskFreeSpaceA

• 0x4662e4 GetDateFormatA

• 0x4662e8 GetCurrentThreadId

• 0x4662ec GetCurrentProcessId

• 0x4662f0 GetCPInfo

• 0x4662f4 GetACP

• 0x4662f8 FreeResource

• 0x4662fc InterlockedExchange

• 0x466300 FreeLibrary

• 0x466304 FormatMessageA

• 0x466308 FindResourceA

• 0x46630c FileTimeToSystemTime

• 0x466310 ExitThread

• 0x466314 EnumCalendarInfoA

• 0x466318 EnterCriticalSection

• 0x46631c DeleteCriticalSection

• 0x466320 CreateThread

• 0x466324 CreateFileA

• 0x466328 CreateEventA

• 0x46632c CompareStringA

• 0x466330 CloseHandle

Library version.dll:

• 0x466338 VerQueryValueA

• 0x46633c GetFileVersionInfoSizeA

• 0x466340 GetFileVersionInfoA

Library gdi32.dll:

• 0x466348 UnrealizeObject

• 0x46634c StretchBlt

• 0x466350 SetWindowOrgEx

• 0x466354 SetViewportOrgEx

• 0x466358 SetTextColor

• 0x46635c SetStretchBltMode

• 0x466360 SetROP2

• 0x466364 SetPixel

• 0x466368 SetDIBColorTable

• 0x46636c SetBrushOrgEx

• 0x466370 SetBkMode

• 0x466374 SetBkColor

• 0x466378 SelectPalette

• 0x46637c SelectObject

• 0x466380 SaveDC

• 0x466384 RestoreDC

• 0x466388 RectVisible

• 0x46638c RealizePalette

• 0x466390 PatBlt

• 0x466394 MoveToEx

• 0x466398 MaskBlt

• 0x46639c LineTo

• 0x4663a0 IntersectClipRect

• 0x4663a4 GetWindowOrgEx

• 0x4663a8 GetTextMetricsA

• 0x4663ac GetTextExtentPoint32A

• 0x4663b0 GetSystemPaletteEntries

• 0x4663b4 GetStockObject

• 0x4663b8 GetPixel

• 0x4663bc GetPaletteEntries

• 0x4663c0 GetObjectA

• 0x4663c4 GetDeviceCaps

• 0x4663c8 GetDIBits

• 0x4663cc GetDIBColorTable

• 0x4663d0 GetDCOrgEx

• 0x4663d4 GetCurrentPositionEx

• 0x4663d8 GetClipBox

• 0x4663dc GetBrushOrgEx

• 0x4663e0 GetBitmapBits

• 0x4663e4 ExcludeClipRect

• 0x4663e8 DeleteObject

• 0x4663ec DeleteDC

• 0x4663f0 CreateSolidBrush

• 0x4663f4 CreatePenIndirect

• 0x4663f8 CreatePalette

• 0x4663fc CreateHalftonePalette

• 0x466400 CreateFontIndirectA

• 0x466404 CreateDIBitmap

• 0x466408 CreateDIBSection

• 0x46640c CreateCompatibleDC

• 0x466410 CreateCompatibleBitmap

• 0x466414 CreateBrushIndirect

• 0x466418 CreateBitmap

• 0x46641c BitBlt

Library user32.dll:

• 0x466424 CreateWindowExA

• 0x466428 WindowFromPoint

• 0x46642c WinHelpA

• 0x466430 WaitMessage

• 0x466434 UpdateWindow

• 0x466438 UnregisterClassA

• 0x46643c UnhookWindowsHookEx

• 0x466440 TranslateMessage

• 0x466444 TranslateMDISysAccel

• 0x466448 TrackPopupMenu

• 0x46644c SystemParametersInfoA

• 0x466450 ShowWindow

• 0x466454 ShowScrollBar

• 0x466458 ShowOwnedPopups

• 0x46645c ShowCursor

• 0x466460 SetWindowsHookExA

• 0x466464 SetWindowTextA

• 0x466468 SetWindowPos

• 0x46646c SetWindowPlacement

• 0x466470 SetWindowLongA

• 0x466474 SetTimer

• 0x466478 SetScrollRange

• 0x46647c SetScrollPos

• 0x466480 SetScrollInfo

• 0x466484 SetRect

• 0x466488 SetPropA

• 0x46648c SetParent

• 0x466490 SetMenuItemInfoA

• 0x466494 SetMenu

• 0x466498 SetForegroundWindow

• 0x46649c SetFocus

• 0x4664a0 SetCursor

• 0x4664a4 SetClassLongA

• 0x4664a8 SetCapture

• 0x4664ac SetActiveWindow

• 0x4664b0 SendMessageA

• 0x4664b4 ScrollWindow

• 0x4664b8 ScreenToClient

• 0x4664bc RemovePropA

• 0x4664c0 RemoveMenu

• 0x4664c4 ReleaseDC

• 0x4664c8 ReleaseCapture

• 0x4664cc RegisterWindowMessageA

• 0x4664d0 RegisterClipboardFormatA

• 0x4664d4 RegisterClassA

• 0x4664d8 RedrawWindow

• 0x4664dc PtInRect

• 0x4664e0 PostQuitMessage

• 0x4664e4 PostMessageA

• 0x4664e8 PeekMessageA

• 0x4664ec OffsetRect

• 0x4664f0 OemToCharA

• 0x4664f4 MessageBoxA

• 0x4664f8 MapWindowPoints

• 0x4664fc MapVirtualKeyA

• 0x466500 LoadStringA

• 0x466504 LoadKeyboardLayoutA

• 0x466508 LoadIconA

• 0x46650c LoadCursorA

• 0x466510 LoadBitmapA

• 0x466514 KillTimer

• 0x466518 IsZoomed

• 0x46651c IsWindowVisible

• 0x466520 IsWindowEnabled

• 0x466524 IsWindow

• 0x466528 IsRectEmpty

• 0x46652c IsIconic

• 0x466530 IsDialogMessageA

• 0x466534 IsChild

• 0x466538 InvalidateRect

• 0x46653c IntersectRect

• 0x466540 InsertMenuItemA

• 0x466544 InsertMenuA

• 0x466548 InflateRect

• 0x46654c GetWindowThreadProcessId

• 0x466550 GetWindowTextA

• 0x466554 GetWindowRect

• 0x466558 GetWindowPlacement

• 0x46655c GetWindowLongA

• 0x466560 GetWindowDC

• 0x466564 GetTopWindow

• 0x466568 GetSystemMetrics

• 0x46656c GetSystemMenu

• 0x466570 GetSysColorBrush

• 0x466574 GetSysColor

• 0x466578 GetSubMenu

• 0x46657c GetScrollRange

• 0x466580 GetScrollPos

• 0x466584 GetScrollInfo

• 0x466588 GetPropA

• 0x46658c GetParent

• 0x466590 GetWindow

• 0x466594 GetMenuStringA

• 0x466598 GetMenuState

• 0x46659c GetMenuItemInfoA

• 0x4665a0 GetMenuItemID

• 0x4665a4 GetMenuItemCount

• 0x4665a8 GetMenu

• 0x4665ac GetLastActivePopup

• 0x4665b0 GetKeyboardState

• 0x4665b4 GetKeyboardLayoutList

• 0x4665b8 GetKeyboardLayout

• 0x4665bc GetKeyState

• 0x4665c0 GetKeyNameTextA

• 0x4665c4 GetIconInfo

• 0x4665c8 GetForegroundWindow

• 0x4665cc GetFocus

• 0x4665d0 GetDlgItem

• 0x4665d4 GetDesktopWindow

• 0x4665d8 GetDCEx

• 0x4665dc GetDC

• 0x4665e0 GetCursorPos

• 0x4665e4 GetCursor

• 0x4665e8 GetClientRect

• 0x4665ec GetClassNameA

• 0x4665f0 GetClassInfoA

• 0x4665f4 GetCapture

• 0x4665f8 GetActiveWindow

• 0x4665fc FrameRect

• 0x466600 FindWindowA

• 0x466604 FillRect

• 0x466608 EqualRect

• 0x46660c EnumWindows

• 0x466610 EnumThreadWindows

• 0x466614 EndPaint

• 0x466618 EnableWindow

• 0x46661c EnableScrollBar

• 0x466620 EnableMenuItem

• 0x466624 DrawTextA

• 0x466628 DrawMenuBar

• 0x46662c DrawIconEx

• 0x466630 DrawIcon

• 0x466634 DrawFrameControl

• 0x466638 DrawEdge

• 0x46663c DispatchMessageA

• 0x466640 DestroyWindow

• 0x466644 DestroyMenu

• 0x466648 DestroyIcon

• 0x46664c DestroyCursor

• 0x466650 DeleteMenu

• 0x466654 DefWindowProcA

• 0x466658 DefMDIChildProcA

• 0x46665c DefFrameProcA

• 0x466660 CreatePopupMenu

• 0x466664 CreateMenu

• 0x466668 CreateIcon

• 0x46666c ClientToScreen

• 0x466670 CheckMenuItem

• 0x466674 CallWindowProcA

• 0x466678 CallNextHookEx

• 0x46667c BeginPaint

• 0x466680 CharNextA

• 0x466684 CharLowerA

• 0x466688 CharToOemA

• 0x46668c AdjustWindowRectEx

• 0x466690 ActivateKeyboardLayout

Library kernel32.dll:

• 0x466698 Sleep

Library oleaut32.dll:

• 0x4666a0 SafeArrayPtrOfIndex

• 0x4666a4 SafeArrayGetUBound

• 0x4666a8 SafeArrayGetLBound

• 0x4666ac SafeArrayCreate

• 0x4666b0 VariantChangeType

• 0x4666b4 VariantCopy

• 0x4666b8 VariantClear

• 0x4666bc VariantInit

Library ole32.dll:

• 0x4666c4 CoTaskMemAlloc

• 0x4666c8 CoCreateInstance

• 0x4666cc CoUninitialize

• 0x4666d0 CoInitialize

Library comctl32.dll:

• 0x4666d8 ImageList_SetIconSize

• 0x4666dc ImageList_GetIconSize

• 0x4666e0 ImageList_Write

• 0x4666e4 ImageList_Read

• 0x4666e8 ImageList_GetDragImage

• 0x4666ec ImageList_DragShowNolock

• 0x4666f0 ImageList_SetDragCursorImage

• 0x4666f4 ImageList_DragMove

• 0x4666f8 ImageList_DragLeave

• 0x4666fc ImageList_DragEnter

• 0x466700 ImageList_EndDrag

• 0x466704 ImageList_BeginDrag

• 0x466708 ImageList_Remove

• 0x46670c ImageList_DrawEx

• 0x466710 ImageList_Draw

• 0x466714 ImageList_GetBkColor

• 0x466718 ImageList_SetBkColor

• 0x46671c ImageList_ReplaceIcon

• 0x466720 ImageList_Add

• 0x466724 ImageList_GetImageCount

• 0x466728 ImageList_Destroy

• 0x46672c ImageList_Create

• 0x466730 InitCommonControls

Library comdlg32.dll:

• 0x466738 GetSaveFileNameA

• 0x46673c GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.