2.6
中危

183a4ea542d13004dea461ed76d7f420fdeada1a666781668e3f7f4903887fd7

8d13251577c24d09e6e989f2e897feea.exe

分析耗时

94s

最近分析

文件大小

497.5KB
静态报毒 动态报毒 AIDETECTVM ARTEMIS CONFIDENCE FUW@AKKXM3BI MALICIOUS MALWARE2 WACATAC ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast 20200901 18.4.3895.0
Tencent 20200901 1.0.0.1
Kingsoft 20200901 2013.8.14.323
McAfee Artemis!8D13251577C2 20200901 6.0.6.653
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
This executable has a PDB path (1 个事件)
pdb_path C:\Dev\wotworkspace\Launcher\CTRelease_ru\Launcher.pdb
行为判定
动态指标
File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 个事件)
Bkav W32.AIDetectVM.malware2
BitDefenderTheta Gen:NN.ZexaF.34196.FuW@aKKXm3bi
APEX Malicious
Antiy-AVL Trojan/Win32.Wacatac
AhnLab-V3 Malware/Win32.Generic.C4140161
McAfee Artemis!8D13251577C2
Webroot W32.Malware.Gen
CrowdStrike win/malicious_confidence_60% (W)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-04 16:25:55

Imports

Library SHLWAPI.dll:
0x41e14c PathAppendA
Library KERNEL32.dll:
0x41e008 GetModuleFileNameW
0x41e00c GetTickCount
0x41e010 CreateProcessW
0x41e014 GetExitCodeProcess
0x41e018 CreateDirectoryA
0x41e01c CreateFileW
0x41e020 OutputDebugStringW
0x41e024 ReadConsoleW
0x41e028 WriteConsoleW
0x41e02c SetStdHandle
0x41e030 LoadLibraryExW
0x41e03c WaitForSingleObject
0x41e040 HeapReAlloc
0x41e044 GetOEMCP
0x41e048 IsValidCodePage
0x41e04c GetACP
0x41e05c GetCurrentProcessId
0x41e064 GetModuleFileNameA
0x41e068 GetCurrentThreadId
0x41e06c CreateProcessA
0x41e070 TerminateProcess
0x41e074 EncodePointer
0x41e078 DecodePointer
0x41e088 WideCharToMultiByte
0x41e08c MultiByteToWideChar
0x41e090 GetStringTypeW
0x41e094 GetLastError
0x41e098 HeapFree
0x41e09c GetCommandLineA
0x41e0a0 RaiseException
0x41e0a4 RtlUnwind
0x41e0a8 HeapAlloc
0x41e0ac GetCPInfo
0x41e0bc SetLastError
0x41e0c4 Sleep
0x41e0c8 GetCurrentProcess
0x41e0cc SetEndOfFile
0x41e0d0 TlsAlloc
0x41e0d4 TlsGetValue
0x41e0d8 TlsSetValue
0x41e0dc TlsFree
0x41e0e0 GetStartupInfoW
0x41e0e4 GetModuleHandleW
0x41e0e8 GetProcAddress
0x41e0ec CompareStringW
0x41e0f0 LCMapStringW
0x41e0f4 GetLocaleInfoW
0x41e0f8 IsValidLocale
0x41e0fc GetUserDefaultLCID
0x41e100 EnumSystemLocalesW
0x41e104 IsDebuggerPresent
0x41e108 ExitProcess
0x41e10c GetModuleHandleExW
0x41e110 AreFileApisANSI
0x41e114 HeapSize
0x41e118 GetStdHandle
0x41e11c GetFileType
0x41e120 WriteFile
0x41e124 GetConsoleCP
0x41e128 GetConsoleMode
0x41e12c ReadFile
0x41e130 SetFilePointerEx
0x41e134 FlushFileBuffers
0x41e138 GetProcessHeap
0x41e13c CloseHandle
Library USER32.dll:
0x41e154 TranslateMessage
0x41e158 GetMessageW
0x41e15c MessageBoxA
0x41e160 MessageBoxW
0x41e164 DefWindowProcW
0x41e168 SendMessageW
0x41e16c PostQuitMessage
0x41e170 KillTimer
0x41e174 DispatchMessageW
0x41e178 RegisterClassExW
0x41e17c LoadCursorW
0x41e180 EnumWindows
0x41e188 DestroyWindow
0x41e18c ShowWindow
0x41e190 SetWindowPos
0x41e194 CreateWindowExW
0x41e198 GetSystemMetrics
0x41e19c GetSysColorBrush
0x41e1a0 SetTimer
Library SHELL32.dll:
0x41e144 SHGetFolderPathA
Library COMCTL32.dll:
0x41e000

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60221 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.