4.6
中危
52 个模型检测该样本为恶意！
重新分析
更多

a4923677e96515d7fc80fad3a4d602650b5b2c5159bd0a1a49ab54b77c80e0d5

8ab4319a009e5a381ea2c88421632ea4.exe

分析耗时

76s

最近分析

文件大小

1.4MB
静态报毒 动态报毒 0NA103HD20 AI SCORE=99 AIDETECTVM AZ1@ACEFBKPI BSCOPE CKGENERIC CLOUD CONFIDENCE EDNW EHLS ENCPK FUGRAFA GDSDA GENERICRXLR GRAYWARE HFNC HIGH CONFIDENCE INVALIDSIG KRYPTIK MALICIOUS PE MALWARE1 PSYTQI QBOT QQPASS QQROB R346800 SCORE SHADE SPYBOT SUSGEN TEPFER TROJANPSW UNCLASSIFIEDMALWARE@0 UNSAFE YMACCO ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanPSW:Win32/Tepfer.d0b54b96 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Tencent Win32.Trojan-qqpass.Qqrob.Ednw 20200822 1.0.0.1
Kingsoft 20200822 2013.8.14.323
McAfee GenericRXLR-BB!8AB4319A009E 20200822 6.0.6.653
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619698350.254626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
This executable is signed
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section .rdat2br
section .rdat2be
section fa
行为判定
动态指标
Performs some HTTP requests (1 个事件)
request GET https://api.blockcypher.com/v1/btc/main/addrs/1BkeGqpo8M5KNVYXW3obmQt1R58zXAqLBQ?limit=10
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619686135.091689
NtAllocateVirtualMemory
process_identifier: 472
region_size: 57344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d70000
success 0 0
1619686135.294689
NtAllocateVirtualMemory
process_identifier: 472
region_size: 53248
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d80000
success 0 0
1619686135.294689
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619698350.067626
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 57344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00360000
success 0 0
1619698350.192626
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 53248
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00370000
success 0 0
1619698350.192626
NtProtectVirtualMemory
process_identifier: 2772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
Steals private information from local Internet browsers (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\History
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 2\History
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619698351.379626
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1619698353.957626
RegSetValueExA
key_handle: 0x00000394
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619698353.957626
RegSetValueExA
key_handle: 0x00000394
value: P¥ Yë<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619698353.957626
RegSetValueExA
key_handle: 0x00000394
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619698353.957626
RegSetValueExW
key_handle: 0x00000394
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619698353.957626
RegSetValueExA
key_handle: 0x000003ac
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619698353.957626
RegSetValueExA
key_handle: 0x000003ac
value: P¥ Yë<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619698353.957626
RegSetValueExA
key_handle: 0x000003ac
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619698353.989626
RegSetValueExW
key_handle: 0x00000390
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1619698356.629626
RegSetValueExA
key_handle: 0x000003e4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619698356.629626
RegSetValueExA
key_handle: 0x000003e4
value: P\¢Zë<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619698356.629626
RegSetValueExA
key_handle: 0x000003e4
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619698356.629626
RegSetValueExW
key_handle: 0x000003e4
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619698356.629626
RegSetValueExA
key_handle: 0x000003f8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619698356.629626
RegSetValueExA
key_handle: 0x000003f8
value: P\¢Zë<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619698356.645626
RegSetValueExA
key_handle: 0x000003f8
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fugrafa.75072
FireEye Generic.mg.8ab4319a009e5a38
CAT-QuickHeal Trojan.CKGENERIC
ALYac Gen:Variant.Fugrafa.75072
Cylance Unsafe
Sangfor Malware
K7AntiVirus Riskware ( 0049f6ae1 )
Alibaba TrojanPSW:Win32/Tepfer.d0b54b96
K7GW Riskware ( 0049f6ae1 )
Cybereason malicious.a009e5
Arcabit Trojan.Fugrafa.D12540
TrendMicro TROJ_FRS.0NA103HD20
BitDefenderTheta Gen:NN.ZexaF.34186.Az1@aCefBKpi
Symantec Trojan.Gen.2
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan-PSW.Win32.Tepfer.psytqi
BitDefender Gen:Variant.Fugrafa.75072
Tencent Win32.Trojan-qqpass.Qqrob.Ednw
Ad-Aware Gen:Variant.Fugrafa.75072
Emsisoft Gen:Variant.Fugrafa.75072 (B)
Comodo .UnclassifiedMalware@0
DrWeb Trojan.SpyBot.699
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Sophos Mal/EncPk-APV
Ikarus Trojan.Inject
MaxSecure Trojan.Malware.105198081.susgen
Antiy-AVL GrayWare/Win32.Kryptik.ehls
Microsoft Trojan:Win32/Ymacco.AAA4
ZoneAlarm Trojan-PSW.Win32.Tepfer.psytqi
GData Gen:Variant.Fugrafa.75072
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Trojanspy.R346800
Acronis suspicious
McAfee GenericRXLR-BB!8AB4319A009E
MAX malware (ai score=99)
VBA32 BScope.TrojanRansom.Shade
Malwarebytes Trojan.MalPack.DGI
ESET-NOD32 a variant of Win32/Kryptik.HFNC
TrendMicro-HouseCall TROJ_FRS.0NA103HD20
Rising Trojan.Kryptik!1.C9B4 (CLOUD)
SentinelOne DFI - Malicious PE
eGambit PE.Heur.InvalidSig
Fortinet W32/QBOT.CC!tr
Webroot W32.Trojan.Gen
AVG Win32:Malware-gen
Panda Trj/GdSda.A
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-08-13 12:18:17

Imports

Library KERNEL32.dll:
• 0x54a370 FreeLibrary
• 0x54a374 GetProcAddress
• 0x54a378 LoadLibraryA
• 0x54a37c GetSystemDirectoryA
• 0x54a380 Sleep
• 0x54a384 DeviceIoControl
• 0x54a38c LocalAlloc
• 0x54a390 CreateFileW
• 0x54a394 GetLastError
• 0x54a398 GetModuleHandleA
• 0x54a39c GetCommandLineA
• 0x54a3a0 WriteFile
• 0x54a3a4 GetStdHandle
• 0x54a3a8 GetModuleFileNameA
• 0x54a3ac SetHandleCount
• 0x54a3b0 GetFileType
• 0x54a3b4 GetStartupInfoA
• 0x54a3b8 GetACP
• 0x54a3bc GetOEMCP
• 0x54a3c0 LoadLibraryW
• 0x54a3c4 GetModuleFileNameW
• 0x54a3c8 SetDllDirectoryW
• 0x54a3cc GetFileAttributesW
• 0x54a3d0 WideCharToMultiByte
• 0x54a3d8 lstrlenW
• 0x54a3dc DebugBreak
• 0x54a3e0 GetCommandLineW
• 0x54a3e4 GetCurrentThreadId
• 0x54a3e8 GetCurrentProcessId
• 0x54a3ec Process32Next
• 0x54a3f0 Process32First
• 0x54a3f4 Process32NextW
• 0x54a3f8 Process32FirstW
• 0x54a400 CloseHandle
• 0x54a408 OutputDebugStringA
• 0x54a40c SetLastError
• 0x54a418 VirtualQuery
• 0x54a41c GetProcessHeap
• 0x54a420 HeapAlloc
• 0x54a424 HeapFree
• 0x54a42c GetTickCount
• 0x54a434 MultiByteToWideChar
• 0x54a438 RaiseException
• 0x54a43c IsDebuggerPresent
• 0x54a444 VirtualAllocEx
Library USER32.dll:
• 0x54a44c LoadIconA
• 0x54a454 LoadCursorFromFileA
• 0x54a458 PaintDesktop
• 0x54a45c IsCharLowerW
• 0x54a460 OpenIcon
• 0x54a468 VkKeyScanW
• 0x54a46c IsIconic
• 0x54a470 ShowCaret
• 0x54a474 IsGUIThread
• 0x54a478 IsWindow
• 0x54a47c IsCharUpperA
• 0x54a480 IsMenu
• 0x54a484 OemKeyScan
• 0x54a488 IsCharUpperW
• 0x54a48c IsWindowUnicode
• 0x54a490 WindowFromDC
Library GDI32.dll:
• 0x54a498 GetStockObject
• 0x54a49c GetEnhMetaFileA
Library ADVAPI32.dll:
• 0x54a4a4 RegOpenKeyA
• 0x54a4a8 RegQueryValueExA

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49177 104.16.146.212 blockchain.info 443
192.168.56.101 49178 104.16.146.212 blockchain.info 443
192.168.56.101 49179 104.16.146.212 blockchain.info 443
192.168.56.101 49181 104.17.137.178 blockchain.coinmarketcap.com 443
192.168.56.101 49182 104.17.137.178 blockchain.coinmarketcap.com 443
192.168.56.101 49183 104.17.137.178 blockchain.coinmarketcap.com 443
192.168.56.101 49185 104.20.20.251 api.blockcypher.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 51378 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.