1.0
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.66
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Trojan-gen | 20190920 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | Win32.Troj.Alipay.bm.30720 | 20190920 | 2013.8.14.323 |
| McAfee | Downloader-BYH | 20190920 | 6.0.6.653 |
| Tencent | None | 20190920 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .FISHPEP |
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 50 个反病毒引擎识别为恶意
(50 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Trojan-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Agent.C3367735 |
| Antiy-AVL | Trojan/Win32.Agent |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Trojan-gen |
| Avira | TR/Crypt.NSPM.Gen |
| BitDefender | Trojan.Ppatre.Gen.1 |
| CAT-QuickHeal | Ddos.Nitol.20059 |
| Comodo | TrojWare.Win32.Trojan.NSPM.~gen@20n73t |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.5423d1 |
| Cylance | Unsafe |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Secure | Trojan.TR/Crypt.NSPM.Gen |
| FireEye | Generic.mg.89475d35423d1a50 |
| Fortinet | W32/Agent.AEJB!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Gen:Trojan |
| Invincea | heuristic |
| Jiangmin | Trojan/Agent.hnsr |
| K7AntiVirus | Trojan-Downloader ( 00457c511 ) |
| K7GW | Trojan-Downloader ( 00457c511 ) |
| Kaspersky | Trojan.Win32.Agent.acmcl |
| Kingsoft | Win32.Troj.Alipay.bm.30720 |
| MAX | malware (ai score=87) |
| McAfee | Downloader-BYH |
| McAfee-GW-Edition | BehavesLike.Win32.Trojan.mm |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.0459.Malware.Gen |
| Rising | Backdoor.Win32.Obfuscator.bl (CLASSIC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Upatre-AN |
| Symantec | ML.Attribute.HighConfidence |
| Trapmine | malicious.high.ml.score |
| TrendMicro | TROJ_UPATRE.SM37 |
| TrendMicro-HouseCall | TROJ_UPATRE.SM37 |
| VBA32 | BScope.Trojan.Fuerboos |
| VIPRE | Trojan.Win32.Generic.pak!cobra |
| Webroot | W32.Trojan.Gen |
| Yandex | Trojan.Agent!j9hQmGKn0pI |
| ZoneAlarm | Trojan.Win32.Agent.acmcl |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-23 21:13:32
PE Imphash
87bed5a7cba00c7e1f4015f1bdae2183
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .FISHPEP | 0x0000a000 | 0x00015000 | 0x000054c6 | 6.059981079048797 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000be50 | 0x000017ac | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x0000be50 | 0x000017ac | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x000085fc | 0x000000e8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x0000d5fc | 0x00000022 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x0000d61e | 0x00000324 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x0000d942 | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
kernel32.dll
LoadLibraryA
GetProcAddress
.FISHPEP
@=?????@@AAABBBBBBBDDDDDEEEDDDG
eeeeeeeeeeeeeee
eeeeee^
eeeeeewwweeeeeeeeeeeennnnnn^
nnneeeeee^
wwwwwwwwweeeeee]
eeeeeeeeeeeennnnnnnnn]
eeeeeeeeeeeeeeeeee]
_gM_S}W
Ynnn~X
@=?????@@AAABBBBBBBDDDDDEEEDDDG
eeeeeeeeeeeeeeeeeeeee^
eeeeeewwweeeeeeeeeeeennnnnn^
nnneeeeee^
wwwwwwwwweeeeee]
eeeeeeeeeeeennnnnnnnn]
eeeeeeeeeeeeeeeeee]
_gM_S}W
YgeV~X
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
WVSUE
)@PPPPPW)Vj
6?}E+} !E
X_ZYZY4$QRd
)@j@^O`
E)]NuD
}+E +u
}l$<[^_
L$8d$
)L$ )f)U
6,hh,:V b?
?7-xJMn]d!
5U(X%6
Z}&+@X
){a6s<W
P,K07h
nojjE{T
?ky!*8+
'9W349v$nl
^^DZ4>8
,$ysk/a{Hp*O(~YF`
(da~7G
`}f 51
ct#nTk:
T^< ^D
K'N&Ae0
[PSF`U
;k^,fD
,!EIP\Q
?pGJ:-
a"vC7 ?G|
g;4Z@(GG
,pje=fN
rL5ig
mN9Qv8>liF
N6~|&14
#-^Bra_3=-k
bMBg\ya
,6"]Ay
I|O5MS
`+$/BMjwUR)J`|A"M
6lab,N
$F*1!m
Y1k*.~
;S+DS~)e
FPeOA+,
wzkVh`e
J4"LS}
8-3&-+?6&
Q_3EaV$ !/{
uEENn{>
WO-NU|-)_3
fQA:G,`d8!y''R
nTWY,GB]1*
L{YSN.yO)+
2C F8+d'W
|I&W,|
b[78j>z3O8KnrT3
`t,!4KXW<icDW
r,F}u5\,K
EM>vtc2
z}oW1?
p%(xM{Z7.t_u%
kF*C=}
QEE^.QpV=P
W&.Fh=dz4bt_
2zqm{A[19
7@?<]>
+ 9px?
Wt+<jR / Z
#;3w!\
3 a'xZ
@Jzs??
Dq8(#$7
iFEWw(
?Btkn"e:FJo"-==<.
GuEqcDA9H
\jcu>*+Wr~rH4
h.CL j:?S
PQHwuo@_J$|;2
\v1gv;^|v
dJ{fy(<6
}V U@xd
)S-Ok3IO
A|70]:d
;DHq|-
zFH2g`
\3]9Ev
CP%KJ9=
3;?e@\8}
D?T:f6
$Vn!uWuVQ
hT{o/i*c
Q\F]ZSoLjH
LR"H)}
0N(SNR}Q\hD,v
&~'d8ar
Z4M[}i
n}+a%Z=
;XItS^)R
V3;#.99y
)`!F_h
SPeW,qb
zG`Rx,
lVrQi/
9"$-I3rDc
b"Q/ IgdIom)
7!CZE}OeW
G='fa)
MkP B n
%.'*=KyTn
{D_;!
Re<aUH4D
[+F%LNt\npP
^j0z-Z
5'# l?x
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
M S C o r p o r a t i o n
F i l e D e s c r s i p t i o n
n o t e . e x e
F i l e V e r s i o n
2 . 0 . 0 . 2
I n t e r n a l N a m e
n o t e . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 0 5
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
n o t e . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
P r o d u c t V e r s i o n
3 . 0 . 0 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
C : \ b 8 e d f 7 0 a 5 b c 5 5 e 5 d d 0 c 3 0 2 1 c e 9 6 2 f 3 4 8 2 1 3 0 0 b e 4 2 2 5 e d e 2 7 2 0 9 0 9 6 1 8 0 3 8 2 2 6 1 0
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ y h N X 9 4 5 9 . e x e
C : \ 1 1 2 e 2 b 8 6 8 2 0 4 1 1 a 3 4 7 4 7 1 6 a e c 9 9 a a 4 2 6 0 8 9 8 5 c 8 5 8 f 0 b 5 f 3 9 9 2 9 c 5 2 b 2 8 b c 5 b 0 d 2
C : \ 3 2 8 0 a 6 6 7 c a 8 6 a d c 8 9 6 1 f b 2 0 1 b 7 5 d e 1 c c 2 0 2 d f 6 e a 8 1 1 0 5 b 5 5 1 5 4 c 8 2 5 b 4 f 1 c 2 c 5 6
C : \ U s e r s \ L i s a \ D e s k t o p \ V J z u T e N F . e x e
C : \ 2 2 0 4 b 7 2 1 f 9 b 5 c 7 2 3 1 a a c 9 6 7 9 0 c 4 2 2 a 5 0 b c 8 a 0 7 f 8 7 c b 6 4 0 0 6 f 8 8 0 8 6 f c 7 5 1 0 b d 6 6
C : \ 9 5 e 5 3 5 f 5 e 4 6 8 4 9 2 d 2 3 d c c 6 b c 5 9 4 7 b 4 5 f a e 3 0 d 3 c 4 9 a 1 d 2 a 6 f e 6 d 1 c 7 9 1 d 7 1 5 8 1 6 a
C : \ U s e r s \ L i s a \ D e s k t o p \ V N 9 w 9 v V z . e x e
C : \ 1 3 0 3 f 0 0 d 6 8 1 4 9 1 7 f 5 1 d a 4 a a 5 d d e 8 0 5 b d 6 9 b 4 f 4 e 8 1 3 c f e 8 3 6 8 f d 2 e 8 6 3 f d e d a f a 4
C : \ 7 5 4 9 2 7 2 c 5 c 4 7 f 9 0 f d b 4 4 1 5 7 f a 4 a 5 8 4 b 9 a d a 5 f 3 1 d 1 a 9 2 e d 7 0 0 a e 3 4 e 6 e c 2 e 4 0 8 1 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c o S Y R e e s . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ f b 8 0 f c d b 1 9 6 7 b 7 0 8 7 d 3 2 0 7 0 3 c 9 8 0 2 d c 6 a 2 c 7 9 4 5 1 d f c d 7 7 2 1 4 1 4 3 a 8 d 5 e b a c 7 4 c 3 . e x e
C : \ d f 5 f 7 5 9 3 1 7 4 e c f 9 4 8 1 1 5 7 6 6 e 5 b 8 e 2 9 6 9 4 3 4 a 2 d 8 8 f a e 3 2 2 4 c 0 1 3 6 f 2 b b d f 2 7 4 c b 3
C : \ f w 8 9 C H y K . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ f c d 0 6 b 1 d 8 4 b 9 5 3 6 a 5 e 0 d 1 a e 5 1 e c 9 8 a e e 5 a 7 f 5 f b d 9 7 6 0 c d 9 2 c e f 4 a 6 a 8 1 5 e 8 1 c c 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 9 d 2 8 a 0 f 0 b 1 1 6 3 4 6 d c 2 a f 9 5 2 8 b c b 2 0 a 4 f 8 4 4 3 f b 4 7 d 0 2 9 c 7 b 0 e b 9 c 0 3 3 0 e 9 f 1 0 b 0 e
C : \ 2 9 f 5 d f c c 1 c c 3 0 c 9 d a e 9 c 5 c 0 5 1 2 c 2 2 e 6 d 0 a d 3 2 6 0 c 7 b d 7 1 9 0 d 5 7 5 3 3 9 2 4 5 9 4 3 1 b b 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 9 2 7 d 4 f c 3 9 b 0 a 3 b 2 6 1 c 8 f 4 7 e 1 d a 0 c 3 e f 8 7 2 0 1 6 0 e a d d 0 6 9 6 5 7 a e 0 c 7 5 d 6 5 5 5 3 9 8 5 4 . e x e
C : \ e 2 1 4 a 6 5 a 2 d c d b 8 c 4 3 a 3 6 5 c 5 9 a f d c 3 e 9 b 6 e 9 5 a 1 0 a a a 3 b b 1 7 c 5 5 d b 8 e b 9 a 8 4 f 8 f d 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ c f 0 e e e 4 3 d 4 2 4 2 b f d 9 c 8 1 f d 6 2 4 6 f d b c d 0 b 1 e 0 4 1 b d f e e f d 4 f d 6 5 c 3 6 5 7 0 a d 4 f 5 5 3 5
C : \ 8 9 f d c f 7 c d b 8 8 8 4 0 2 4 0 7 5 2 a 8 6 0 c 6 1 e 1 7 4 f 1 a 2 f f 6 3 d 9 1 0 d f 0 c a 7 3 a 0 a 6 7 8 2 d 1 e 3 1 e
C : \ d b 8 7 5 1 3 2 6 3 5 7 f e 7 1 f e 0 f 9 d c 5 b 8 f a 4 9 a 0 9 4 b 3 8 8 5 1 7 4 d d 6 5 3 4 a 0 f 6 7 b 8 a 7 3 f e 7 5 c d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ b 6 8 c 1 1 f 8 b 3 3 4 5 4 4 f 8 2 4 1 7 c b 4 9 9 1 e 5 9 3 7 4 4 8 9 a b 1 7 b 5 5 f 4 d a d 7 7 a a d f e 4 8 2 3 5 9 a b 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 3 b c d 5 c 9 1 4 b 8 3 a e e b 9 5 6 e 1 8 b 1 2 d 0 b 2 9 7 4 a e 8 3 6 e 0 8 7 7 6 5 0 b d 8 f 2 1 6 9 3 7 b 5 1 e d 6 d b 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ Z E v 2 e p A B . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 0 D C h W Q P e . e x e
C : \ e 9 c 7 4 4 f 4 2 8 7 0 c a 3 1 6 9 6 8 a f d d a 8 1 0 6 c b a d 4 c 2 5 f a 5 3 a 6 5 a 1 7 f 9 b 7 e 8 1 2 a 9 b e 6 5 9 f 1
C : \ A 4 4 d m 1 L _ . e x e
C : \ 3 2 e d 2 1 b 2 8 9 7 8 1 4 f 8 8 a b 8 3 3 c f a b c 2 d a b b b a b 3 b e 4 7 1 2 c d b 0 e 7 2 2 e e f 7 4 7 a 5 8 1 6 e 3 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ A g Z H z c u 4 . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.