SmartHawk

2.0

低危

53 个模型检测该样本为恶意！

重新分析

下载样本

cb3361d5bf568aba34328c4ec4fc2b9dc0453cc935aa611236d4b5a08ad7d2a7

864502ae9ebd765577a4d85be5cbedd6.exe

分析耗时

115s

最近分析

文件大小

112.0KB

静态报毒动态报毒 100% AI SCORE=83 AIDETECTVM CLASSIC CONFIDENCE DOWNLOADER33 DROPPERX ELDORADO EMDM EMII FAREIT FAREITVB FORMBOOK GDSDA GULOADER HIGH CONFIDENCE HM0@AGTWPRMI HM0@FGTWPRMI KRYPT LOKIBOT MALWARE1 MALWARE@#3HOVXZAUUQIFI NBSGK PONYSTEALER QVM03 R + MAL R338224 SCORE SMTHH SUSGEN UNSAFE VBKRYPT VEBZENPAK X6M04F3GOSU ZEVBACO 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FST!864502AE9EBD	20201211	6.0.6.653
Alibaba	Trojan:Win32/Vebzenpak.1b26e108	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:DropperX-gen [Drp]	20201210	21.1.5827.0
Tencent		20201211	1.0.0.1
Kingsoft		20201211	2017.9.26.565

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619685938.529436 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 53248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f0000	success	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619685933.076436 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x007a0000	success	0	0

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.PonyStealer.hm0@FGTWPrmi
FireEye	Gen:Heur.PonyStealer.hm0@FGTWPrmi
McAfee	Fareit-FST!864502AE9EBD
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 005677951 )
Alibaba	Trojan:Win32/Vebzenpak.1b26e108
K7GW	Trojan ( 005677951 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.PonyStealer.EAEC1D
Cyren	W32/VBInject.ADW.gen!Eldorado
Symantec	Infostealer
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.LokiBot-7948316-0
Kaspersky	Trojan.Win32.Vebzenpak.tis
BitDefender	Gen:Heur.PonyStealer.hm0@FGTWPrmi
Avast	Win32:DropperX-gen [Drp]
Ad-Aware	Gen:Heur.PonyStealer.hm0@FGTWPrmi
Sophos	Mal/Generic-R + Mal/FareitVB-AD
Comodo	Malware@#3hovxzauuqifi
F-Secure	Trojan.TR/Injector.nbsgk
DrWeb	Trojan.DownLoader33.46939
TrendMicro	TrojanSpy.Win32.FAREIT.SMTHH.hp
McAfee-GW-Edition	Fareit-FST!864502AE9EBD
Emsisoft	Gen:Heur.PonyStealer.hm0@FGTWPrmi (B)
Jiangmin	Trojan.Vebzenpak.elb
MaxSecure	Trojan.Malware.1728101.susgen
Avira	TR/Injector.nbsgk
Antiy-AVL	Trojan/Win32.Vebzenpak
Microsoft	Trojan:Win32/FormBook.SS!MTB
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	Trojan.Win32.Vebzenpak.tis
GData	Gen:Heur.PonyStealer.hm0@FGTWPrmi
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.VBKrypt.R338224
BitDefenderTheta	Gen:NN.ZevbaCO.34670.hm0@aGTWPrmi
MAX	malware (ai score=83)
Malwarebytes	Trojan.GuLoader
ESET-NOD32	a variant of Win32/Injector.EMII
TrendMicro-HouseCall	TrojanSpy.Win32.FAREIT.SMTHH.hp
Rising	Downloader.Guloader!1.C6E5 (CLASSIC)
Yandex	Trojan.Injector!X6M04f3gosU
Ikarus	Trojan.Win32.Krypt
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/EMDM!tr
Webroot	W32.Trojan.Gen