7.0
高危
61 个模型检测该样本为恶意！
重新分析
更多

979b9603e6b0c1419ebe676f7af9325d3adc5097ceb11b45c509e1bd2b7fa20d

87e61a6c13e0d6ecd845e05a2bf36968.exe

分析耗时

76s

最近分析

文件大小

2.2MB
静态报毒 动态报毒 2V5I AI SCORE=89 AIDETECTVM BANKERX CLASSIC CONFIDENCE EKVT ELDORADO EMOTET ENCPK EPLX GENCIRC GENETIC GENKRYPTIK HBR@8QRQPO HCWQ HIGH CONFIDENCE HJEOKX I6VSO INJECT3 KIRGUDU KRYPTIK MALICIOUS PE MALWARE1 MS0@AIGAIGKG PINKSBOT PZFCE QAKBOT QBOT QVM20 R + MAL R338450 SCORE STATIC AI SUSGEN TROJANBANKER UNSAFE WACATAC ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee W32/PinkSbot-GN!87E61A6C13E0 20201229 6.0.6.653
Alibaba TrojanBanker:Win32/Emotet.533f1f75 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:BankerX-gen [Trj] 20201229 21.1.5827.0
Tencent Malware.Win32.Gencirc.10b9e5d2 20201229 1.0.0.1
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
静态指标
Queries for the computername (3 个事件)
Time & API Arguments Status Return Repeated
1619700799.77225
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619700825.63225
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619700814.866
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Command line console output was observed (28 个事件)
Time & API Arguments Status Return Repeated
1619700827.053875
WriteConsoleA
buffer: ÕýÔÚ Ping 127.0.0.1
console_handle: 0x00000007
success 1 0
1619700827.053875
WriteConsoleA
buffer: ¾ßÓÐ 32 ×Ö½ÚµÄÊý¾Ý:
console_handle: 0x00000007
success 1 0
1619700827.053875
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619700827.053875
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619700827.053875
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619700827.069875
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619700828.069875
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619700828.069875
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619700828.069875
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619700828.069875
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619700829.069875
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619700829.069875
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619700829.069875
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619700829.069875
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619700830.069875
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619700830.069875
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619700830.069875
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619700830.069875
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619700831.069875
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619700831.069875
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619700831.069875
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619700831.069875
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619700832.069875
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619700832.069875
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619700832.069875
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619700832.069875
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619700832.069875
WriteConsoleA
buffer: 127.0.0.1 µÄ Ping ͳ¼ÆÐÅÏ¢: Êý¾Ý°ü: ÒÑ·¢ËÍ = 6£¬ÒѽÓÊÕ = 6£¬¶ªÊ§ = 0 (0% ¶ªÊ§)£¬
console_handle: 0x00000007
success 1 0
1619700832.069875
WriteConsoleA
buffer: Íù·µÐг̵ĹÀ¼Æʱ¼ä(ÒÔºÁÃëΪµ¥Î»): ×î¶Ì = 0ms£¬× = 0ms£¬Æ½¾ù = 0ms
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619700827.022875
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (3 个事件)
Time & API Arguments Status Return Repeated
1619700825.63225
__exception__
stacktrace: 
87e61a6c13e0d6ecd845e05a2bf36968+0x8ec9 @ 0x408ec9
87e61a6c13e0d6ecd845e05a2bf36968+0x17cc @ 0x4017cc
87e61a6c13e0d6ecd845e05a2bf36968+0x1c66 @ 0x401c66
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634776
registers.edi: 0
registers.eax: 6619136
registers.ebp: 1635384
registers.edx: 2
registers.ebx: 1
registers.esi: 4269856
registers.ecx: 100
exception.instruction_r: ff 30 e8 97 03 00 00 83 c4 14 85 c0 75 38 8d 85
exception.symbol: 87e61a6c13e0d6ecd845e05a2bf36968+0x844a
exception.instruction: push dword ptr [eax]
exception.module: 87e61a6c13e0d6ecd845e05a2bf36968.exe
exception.exception_code: 0xc0000005
exception.offset: 33866
exception.address: 0x40844a
success 0 0
1619700815.507
__exception__
stacktrace: 
87e61a6c13e0d6ecd845e05a2bf36968+0x3daa @ 0x403daa
87e61a6c13e0d6ecd845e05a2bf36968+0x1b23 @ 0x401b23
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 7685680
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 87e61a6c13e0d6ecd845e05a2bf36968+0x33cc
exception.instruction: in eax, dx
exception.module: 87e61a6c13e0d6ecd845e05a2bf36968.exe
exception.exception_code: 0xc0000096
exception.offset: 13260
exception.address: 0x4033cc
success 0 0
1619700815.507
__exception__
stacktrace: 
87e61a6c13e0d6ecd845e05a2bf36968+0x3db3 @ 0x403db3
87e61a6c13e0d6ecd845e05a2bf36968+0x1b23 @ 0x401b23
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637628
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 7685680
registers.ecx: 20
exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0
exception.symbol: 87e61a6c13e0d6ecd845e05a2bf36968+0x3465
exception.instruction: in eax, dx
exception.module: 87e61a6c13e0d6ecd845e05a2bf36968.exe
exception.exception_code: 0xc0000096
exception.offset: 13413
exception.address: 0x403465
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619700785.66325
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00330000
success 0 0
1619700799.60025
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00370000
success 0 0
1619700799.60025
NtProtectVirtualMemory
process_identifier: 2772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 245760
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619700800.585
NtAllocateVirtualMemory
process_identifier: 708
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003a0000
success 0 0
1619700814.85
NtAllocateVirtualMemory
process_identifier: 708
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02090000
success 0 0
1619700814.866
NtProtectVirtualMemory
process_identifier: 708
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 245760
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
Foreign language identified in PE resource (49 个事件)
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_BITMAP language LANG_KOREAN offset 0x00232d48 filetype data sublanguage SUBLANG_KOREAN size 0x00000144
name RT_BITMAP language LANG_KOREAN offset 0x00232d48 filetype data sublanguage SUBLANG_KOREAN size 0x00000144
name RT_DIALOG language LANG_KOREAN offset 0x00232f74 filetype data sublanguage SUBLANG_KOREAN size 0x00000034
name RT_DIALOG language LANG_KOREAN offset 0x00232f74 filetype data sublanguage SUBLANG_KOREAN size 0x00000034
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_VERSION language LANG_KOREAN offset 0x00234698 filetype data sublanguage SUBLANG_KOREAN size 0x00000400
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\87e61a6c13e0d6ecd845e05a2bf36968.exe
Creates a suspicious process (2 个事件)
cmdline "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\87e61a6c13e0d6ecd845e05a2bf36968.exe"
cmdline cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\87e61a6c13e0d6ecd845e05a2bf36968.exe"
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1619700800.42825
CreateProcessInternalW
thread_identifier: 1760
thread_handle: 0x0000014c
process_identifier: 708
current_directory:
filepath:
track: 1
command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\87e61a6c13e0d6ecd845e05a2bf36968.exe /C
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000150
inherit_handles: 0
success 1 0
1619700825.94425
ShellExecuteExW
parameters: /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\87e61a6c13e0d6ecd845e05a2bf36968.exe"
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
Uses Windows utilities for basic Windows functionality (3 个事件)
cmdline ping.exe -n 6 127.0.0.1
cmdline "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\87e61a6c13e0d6ecd845e05a2bf36968.exe"
cmdline cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\87e61a6c13e0d6ecd845e05a2bf36968.exe"
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 113.108.239.196
host 172.217.24.14
Detects VMWare through the in instruction feature (1 个事件)
Time & API Arguments Status Return Repeated
1619700815.507
__exception__
stacktrace: 
87e61a6c13e0d6ecd845e05a2bf36968+0x3daa @ 0x403daa
87e61a6c13e0d6ecd845e05a2bf36968+0x1b23 @ 0x401b23
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 7685680
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 87e61a6c13e0d6ecd845e05a2bf36968+0x33cc
exception.instruction: in eax, dx
exception.module: 87e61a6c13e0d6ecd845e05a2bf36968.exe
exception.exception_code: 0xc0000096
exception.offset: 13260
exception.address: 0x4033cc
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.EPLX
FireEye Generic.mg.87e61a6c13e0d6ec
CAT-QuickHeal Trojan.Qbot
McAfee W32/PinkSbot-GN!87E61A6C13E0
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 005652be1 )
Alibaba TrojanBanker:Win32/Emotet.533f1f75
K7GW Trojan ( 004f7ea21 )
Cybereason malicious.c13e0d
Arcabit Trojan.Agent.EPLX
BitDefenderTheta Gen:NN.ZexaF.34700.ms0@aigAigkG
Cyren W32/Kryptik.BLK.gen!Eldorado
Symantec Packed.Generic.459
APEX Malicious
Avast Win32:BankerX-gen [Trj]
ClamAV Win.Malware.Qbot-7677435-0
Kaspersky HEUR:Trojan-Banker.Win32.Qbot.vho
BitDefender Trojan.Agent.EPLX
NANO-Antivirus Trojan.Win32.Inject3.hjeokx
Paloalto generic.ml
AegisLab Trojan.Win32.Malicious.4!c
Tencent Malware.Win32.Gencirc.10b9e5d2
Ad-Aware Trojan.Agent.EPLX
TACHYON Trojan/W32.Agent.2302976.M
Emsisoft Trojan.Agent.EPLX (B)
Comodo TrojWare.Win32.Kryptik.HBR@8qrqpo
F-Secure Trojan.TR/Crypt.Agent.pzfce
DrWeb Trojan.Inject3.38910
VIPRE Trojan.Win32.Generic!BT
TrendMicro Backdoor.Win32.QAKBOT.SME
McAfee-GW-Edition W32/PinkSbot-GN!87E61A6C13E0
Sophos Mal/Generic-R + Mal/EncPk-APV
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Banker.Qbot.nq
Avira TR/Crypt.Agent.pzfce
Antiy-AVL Trojan/Win32.Emotet
Gridinsoft Trojan.Win32.Kryptik.ba!s3
Microsoft Trojan:Win32/Emotet.MS!MTB
ZoneAlarm HEUR:Trojan-Banker.Win32.Qbot.vho
GData Trojan.Agent.EPLX
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Kryptik.R338450
Acronis suspicious
VBA32 Malware-Cryptor.Kirgudu
ALYac Trojan.Agent.Wacatac
MAX malware (ai score=89)
Malwarebytes Backdoor.Qbot
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-04-20 19:48:33

Imports

Library KERNEL32.dll:
• 0x62f6b0 VirtualAlloc
• 0x62f6b4 GetModuleHandleW
• 0x62f6b8 FlushFileBuffers
• 0x62f6c0 GetSystemInfo
• 0x62f6c4 LocalFree
• 0x62f6c8 GetCurrentProcess
• 0x62f6cc lstrcpyW
• 0x62f6d4 LocalReAlloc
• 0x62f6d8 LocalAlloc
• 0x62f6dc lstrlenW
• 0x62f6e0 FindNextFileW
• 0x62f6e4 CompareStringW
• 0x62f6e8 FindClose
• 0x62f6ec lstrcmpiW
• 0x62f6f0 GetLastError
• 0x62f6f4 FindFirstFileW
• 0x62f6f8 SetLastError
• 0x62f704 ExitThread
• 0x62f70c SetEvent
• 0x62f714 Sleep
• 0x62f720 CloseHandle
• 0x62f724 CreateEventW
• 0x62f72c ResumeThread
• 0x62f730 SetThreadPriority
• 0x62f734 CreateThread
• 0x62f738 WaitForSingleObject
• 0x62f744 OpenEventW
• 0x62f74c GetTickCount
• 0x62f750 GetCurrentThreadId
• 0x62f754 GetCurrentProcessId
• 0x62f75c TerminateProcess
• 0x62f768 GetStartupInfoA
• 0x62f76c GetCommandLineA
• 0x62f770 GetVersionExA
• 0x62f774 ExitProcess
• 0x62f778 GetProcAddress
• 0x62f77c GetModuleHandleA
• 0x62f780 WriteFile
• 0x62f784 GetStdHandle
• 0x62f788 GetModuleFileNameA
• 0x62f790 VirtualProtect
• 0x62f798 WideCharToMultiByte
• 0x62f7a0 SetHandleCount
• 0x62f7a4 GetFileType
• 0x62f7a8 HeapDestroy
• 0x62f7ac HeapCreate
• 0x62f7b0 VirtualFree
• 0x62f7b4 HeapFree
• 0x62f7b8 LoadLibraryA
• 0x62f7bc GetACP
• 0x62f7c0 GetOEMCP
• 0x62f7c4 GetCPInfo
• 0x62f7c8 HeapAlloc
• 0x62f7cc HeapReAlloc
• 0x62f7d0 RtlUnwind
• 0x62f7d4 InterlockedExchange
• 0x62f7d8 VirtualQuery
• 0x62f7dc SetFilePointer
• 0x62f7e0 MultiByteToWideChar
• 0x62f7e4 LCMapStringA
• 0x62f7e8 LCMapStringW
• 0x62f7ec GetStringTypeA
• 0x62f7f0 GetStringTypeW
• 0x62f7f4 SetStdHandle
• 0x62f7f8 GetLocaleInfoA
• 0x62f7fc GetTempPathA
• 0x62f804 DeleteTimerQueue
• 0x62f808 GetFullPathNameW
• 0x62f80c VirtualFreeEx
• 0x62f814 WaitNamedPipeA
• 0x62f818 GetDateFormatA
• 0x62f81c RtlFillMemory
• 0x62f820 ReplaceFileA
• 0x62f828 BackupRead
• 0x62f82c SuspendThread
• 0x62f830 ClearCommError
• 0x62f834 SleepEx
• 0x62f838 FormatMessageW
• 0x62f83c GetDevicePowerState
Library USER32.dll:
• 0x62f848 LoadIconA
• 0x62f84c LoadCursorFromFileW
• 0x62f850 GetAsyncKeyState
• 0x62f854 GetForegroundWindow
• 0x62f858 GetKeyboardLayout
• 0x62f85c GetDC
• 0x62f860 GetSystemMetrics
• 0x62f864 GetDlgCtrlID
• 0x62f868 GetListBoxInfo
• 0x62f86c GetThreadDesktop
• 0x62f870 ShowCaret
• 0x62f874 DestroyWindow
• 0x62f878 GetClipboardViewer
• 0x62f87c GetTopWindow
• 0x62f880 CharLowerA
• 0x62f884 IsWindow
• 0x62f888 GetFocus
• 0x62f890 CreateMenu
• 0x62f894 GetCapture
• 0x62f898 GetKBCodePage
• 0x62f89c LoadStringW
• 0x62f8a0 SendMessageW
• 0x62f8a4 SetWindowPos
• 0x62f8a8 GetDesktopWindow
• 0x62f8ac GetParent
• 0x62f8b0 GetWindowLongW
• 0x62f8b4 GetWindowRect
• 0x62f8b8 SetForegroundWindow
• 0x62f8bc CheckDlgButton
• 0x62f8c0 GetClientRect
• 0x62f8c4 EndDialog
• 0x62f8c8 PostMessageW
• 0x62f8cc GetDlgItem
• 0x62f8d0 IsDlgButtonChecked
• 0x62f8d4 SendDlgItemMessageW
• 0x62f8d8 SetDlgItemTextW
• 0x62f8dc KillTimer
• 0x62f8e0 SetTimer
• 0x62f8e4 LoadImageW
• 0x62f8e8 DialogBoxParamW
• 0x62f8ec MessageBoxW
• 0x62f8f0 DefWindowProcW
• 0x62f8f4 LoadIconW
• 0x62f8f8 PostQuitMessage
• 0x62f8fc DispatchMessageW
• 0x62f900 TranslateMessage
• 0x62f904 GetMessageW
• 0x62f908 CreateWindowExW
• 0x62f90c RegisterClassW
• 0x62f910 GetDlgItemTextA
• 0x62f914 PackDDElParam
• 0x62f918 ShowCursor
• 0x62f91c WinHelpA
• 0x62f924 DlgDirListComboBoxW
• 0x62f92c DdeCmpStringHandles
• 0x62f934 LoadMenuIndirectW
• 0x62f940 EnableScrollBar
• 0x62f944 CloseWindowStation
• 0x62f948 SetWindowTextW
• 0x62f94c CreateMDIWindowA
• 0x62f950 SetScrollPos
• 0x62f954 SetShellWindow
• 0x62f958 CreateIconIndirect
• 0x62f95c GetMenuDefaultItem
• 0x62f964 WINNLSEnableIME
• 0x62f968 SendNotifyMessageW
• 0x62f974 GetWindowTextW
• 0x62f978 ReleaseDC
• 0x62f97c EnumDesktopWindows
• 0x62f980 GetLastActivePopup
Library GDI32.dll:
• 0x62f988 GetStockObject
• 0x62f98c CreateMetaFileA
• 0x62f990 CreatePatternBrush
• 0x62f994 GetPolyFillMode
• 0x62f998 DeleteDC
• 0x62f99c FillPath
• 0x62f9a0 UnrealizeObject
• 0x62f9a4 AddFontResourceA
• 0x62f9a8 GetFontLanguageInfo
• 0x62f9ac SetICMProfileW
• 0x62f9b0 GdiEntry3
• 0x62f9b4 SetGraphicsMode
• 0x62f9b8 XLATEOBJ_iXlate
• 0x62f9bc GetTextMetricsA
• 0x62f9c0 InvertRgn
• 0x62f9c4 AnyLinkedFonts
• 0x62f9c8 AddFontResourceW
• 0x62f9cc CopyEnhMetaFileW
• 0x62f9d0 GdiComment
• 0x62f9d4 DescribePixelFormat
• 0x62f9d8 GdiIsMetaPrintDC
• 0x62f9e0 EngLockSurface
• 0x62f9e4 FONTOBJ_vGetInfo
• 0x62f9e8 SetAbortProc
• 0x62f9ec SetMetaRgn
• 0x62f9f0 AddFontResourceExW
• 0x62f9f4 GetROP2
• 0x62f9f8 EngBitBlt
• 0x62f9fc STROBJ_vEnumStart
Library ADVAPI32.dll:
• 0x62fa04 RegOpenKeyA
• 0x62fa08 RegQueryValueExA
• 0x62fa0c GetAce
• 0x62fa14 RegOpenKeyExW
• 0x62fa18 RegCloseKey
• 0x62fa1c RegQueryValueExW
• 0x62fa20 SetSecurityInfo
• 0x62fa24 GetSecurityInfo
• 0x62fa28 RegOpenKeyExA
Library SHELL32.dll:
• 0x62fa30 Shell_NotifyIconW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.