2.4
中危
3 个模型检测该样本为恶意！
重新分析
更多

41a35cb33af57467c0751a37eb82c74d08ade88eb6715236f59cb9b037d5cf20

8e7deaaa9dfa1c469f5ebec1d16b26c5.exe

分析耗时

23s

最近分析

文件大小

228.0KB
静态报毒 动态报毒 KIDO SCORE SUSGEN UNSAFE
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20201005 6.0.6.653
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast 20201005 18.4.3895.0
Kingsoft 20201005 2013.8.14.323
CrowdStrike 20190702 1.0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619686133.31456
NtAllocateVirtualMemory
process_identifier: 2404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00540000
success 0 0
Foreign language identified in PE resource (2 个事件)
name RT_ICON language LANG_KOREAN offset 0x0003bfbc filetype dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2576980296, next used block 10459577 sublanguage SUBLANG_KOREAN size 0x000002e8
name RT_GROUP_ICON language LANG_KOREAN offset 0x0003e080 filetype data sublanguage SUBLANG_KOREAN size 0x00000014
File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 个事件)
Zillya Worm.Kido.Win32.2584
eGambit Unsafe.AI_Score_99%
MaxSecure Trojan.Malware.300983.susgen
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619686134.78356
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x431128 VirtualFree
• 0x43112c VirtualAlloc
• 0x431130 LocalFree
• 0x431134 LocalAlloc
• 0x431138 VirtualQuery
• 0x43113c WideCharToMultiByte
• 0x431140 MultiByteToWideChar
• 0x431144 lstrlenA
• 0x431148 lstrcpyA
• 0x43114c LoadLibraryExA
• 0x431150 GetThreadLocale
• 0x431154 GetStartupInfoA
• 0x431158 GetModuleFileNameA
• 0x43115c GetLocaleInfoA
• 0x431160 GetLastError
• 0x431164 GetCommandLineA
• 0x431168 FreeLibrary
• 0x43116c ExitProcess
• 0x431170 ExitThread
• 0x431174 CreateThread
• 0x431178 WriteFile
• 0x43117c SetFilePointer
• 0x431180 SetEndOfFile
• 0x431184 RtlUnwind
• 0x431188 ReadFile
• 0x43118c RaiseException
• 0x431190 GetStdHandle
• 0x431194 GetFileSize
• 0x431198 GetFileType
• 0x43119c CreateFileA
• 0x4311a0 CloseHandle
Library user32.dll:
• 0x4311a8 GetKeyboardType
• 0x4311ac LoadStringA
• 0x4311b0 MessageBoxA
Library advapi32.dll:
• 0x4311b8 RegQueryValueExA
• 0x4311bc RegOpenKeyExA
• 0x4311c0 RegCloseKey
Library oleaut32.dll:
• 0x4311c8 VariantChangeTypeEx
• 0x4311cc VariantCopyInd
• 0x4311d0 VariantClear
• 0x4311d4 SysStringLen
• 0x4311d8 SysFreeString
• 0x4311dc SysReAllocStringLen
• 0x4311e0 SysAllocStringLen
Library kernel32.dll:
• 0x4311e8 TlsSetValue
• 0x4311ec TlsGetValue
• 0x4311f0 LocalAlloc
• 0x4311f4 GetModuleHandleA
• 0x4311f8 GetModuleFileNameA
Library advapi32.dll:
• 0x431200 RegQueryValueExA
• 0x431204 RegOpenKeyExA
• 0x431208 RegCloseKey
Library kernel32.dll:
• 0x431210 WriteFile
• 0x431214 WaitForSingleObject
• 0x431218 VirtualQuery
• 0x43121c VirtualAlloc
• 0x431220 SizeofResource
• 0x431224 SetThreadLocale
• 0x431228 SetFilePointer
• 0x43122c SetEvent
• 0x431230 SetErrorMode
• 0x431234 SetEndOfFile
• 0x431238 ResumeThread
• 0x43123c ReadFile
• 0x431240 MultiByteToWideChar
• 0x431244 MulDiv
• 0x431248 LockResource
• 0x43124c LoadResource
• 0x431250 LoadLibraryA
• 0x43125c GlobalUnlock
• 0x431260 GlobalReAlloc
• 0x431264 GlobalHandle
• 0x431268 GlobalLock
• 0x43126c GlobalFree
• 0x431270 GlobalDeleteAtom
• 0x431274 GlobalAlloc
• 0x431278 GlobalAddAtomA
• 0x43127c GetVersionExA
• 0x431280 GetVersion
• 0x431284 GetThreadLocale
• 0x431288 GetSystemInfo
• 0x43128c GetProcAddress
• 0x431290 GetModuleHandleA
• 0x431294 GetModuleFileNameA
• 0x431298 GetLocaleInfoA
• 0x43129c GetLastError
• 0x4312a0 GetExitCodeThread
• 0x4312a4 GetCurrentThreadId
• 0x4312a8 GetCurrentProcessId
• 0x4312ac GetCPInfo
• 0x4312b0 FreeResource
• 0x4312b4 FreeLibrary
• 0x4312b8 FormatMessageA
• 0x4312bc FindResourceA
• 0x4312c0 FindFirstFileA
• 0x4312c4 FindClose
• 0x4312d0 EnumCalendarInfoA
• 0x4312dc CreateThread
• 0x4312e0 CreateFileA
• 0x4312e4 CreateEventA
• 0x4312e8 CompareStringA
• 0x4312ec CloseHandle
Library gdi32.dll:
• 0x4312f4 UnrealizeObject
• 0x4312f8 StretchBlt
• 0x4312fc SetWindowOrgEx
• 0x431300 SetWinMetaFileBits
• 0x431304 SetViewportOrgEx
• 0x431308 SetTextColor
• 0x43130c SetStretchBltMode
• 0x431310 SetROP2
• 0x431314 SetEnhMetaFileBits
• 0x431318 SetDIBColorTable
• 0x43131c SetBrushOrgEx
• 0x431320 SetBkMode
• 0x431324 SetBkColor
• 0x431328 SelectPalette
• 0x43132c SelectObject
• 0x431330 SaveDC
• 0x431334 RestoreDC
• 0x431338 Rectangle
• 0x43133c RectVisible
• 0x431340 RealizePalette
• 0x431344 PlayEnhMetaFile
• 0x431348 PatBlt
• 0x43134c MoveToEx
• 0x431350 MaskBlt
• 0x431354 IntersectClipRect
• 0x431358 GetWindowOrgEx
• 0x43135c GetWinMetaFileBits
• 0x431360 GetTextMetricsA
• 0x431364 GetTextExtentPointA
• 0x43136c GetStockObject
• 0x431370 GetPixel
• 0x431374 GetPaletteEntries
• 0x431378 GetObjectA
• 0x431384 GetEnhMetaFileBits
• 0x431388 GetDeviceCaps
• 0x43138c GetDIBits
• 0x431390 GetDIBColorTable
• 0x431398 GetBrushOrgEx
• 0x43139c GetBitmapBits
• 0x4313a0 ExcludeClipRect
• 0x4313a4 EnumFontsA
• 0x4313a8 EnumFontFamiliesExA
• 0x4313ac DeleteObject
• 0x4313b0 DeleteEnhMetaFile
• 0x4313b4 DeleteDC
• 0x4313b8 CreateSolidBrush
• 0x4313bc CreateRectRgn
• 0x4313c0 CreatePenIndirect
• 0x4313c4 CreatePalette
• 0x4313cc CreateFontIndirectA
• 0x4313d0 CreateDIBitmap
• 0x4313d4 CreateDIBSection
• 0x4313d8 CreateCompatibleDC
• 0x4313e0 CreateBrushIndirect
• 0x4313e4 CreateBitmap
• 0x4313e8 CopyEnhMetaFileA
• 0x4313ec BitBlt
Library user32.dll:
• 0x4313f4 WindowFromPoint
• 0x4313f8 WinHelpA
• 0x4313fc WaitMessage
• 0x431400 UpdateWindow
• 0x431404 UnregisterClassA
• 0x431408 UnhookWindowsHookEx
• 0x43140c TranslateMessage
• 0x431414 TrackPopupMenu
• 0x43141c ShowWindow
• 0x431420 ShowOwnedPopups
• 0x431424 ShowCursor
• 0x431428 SetWindowRgn
• 0x43142c SetWindowsHookExA
• 0x431430 SetWindowPos
• 0x431434 SetWindowPlacement
• 0x431438 SetWindowLongA
• 0x43143c SetTimer
• 0x431440 SetScrollPos
• 0x431444 SetScrollInfo
• 0x431448 SetRect
• 0x43144c SetPropA
• 0x431450 SetMenu
• 0x431454 SetForegroundWindow
• 0x431458 SetFocus
• 0x43145c SetCursor
• 0x431460 SetCapture
• 0x431464 SetActiveWindow
• 0x431468 SendMessageA
• 0x43146c ScrollWindow
• 0x431470 ScreenToClient
• 0x431474 RemovePropA
• 0x431478 RemoveMenu
• 0x43147c ReleaseDC
• 0x431480 ReleaseCapture
• 0x43148c RegisterClassA
• 0x431490 PtInRect
• 0x431494 PostQuitMessage
• 0x431498 PostMessageA
• 0x43149c PeekMessageA
• 0x4314a0 OffsetRect
• 0x4314a4 OemToCharA
• 0x4314ac MessageBoxA
• 0x4314b0 MapVirtualKeyA
• 0x4314b4 LoadStringA
• 0x4314b8 LoadIconA
• 0x4314bc LoadCursorA
• 0x4314c0 KillTimer
• 0x4314c4 IsZoomed
• 0x4314c8 IsWindowVisible
• 0x4314cc IsWindowEnabled
• 0x4314d0 IsWindow
• 0x4314d4 IsRectEmpty
• 0x4314d8 IsIconic
• 0x4314dc IsDialogMessageA
• 0x4314e0 InvalidateRect
• 0x4314e4 IntersectRect
• 0x4314e8 InsertMenuItemA
• 0x4314ec InsertMenuA
• 0x4314f0 InflateRect
• 0x4314f8 GetWindowTextA
• 0x4314fc GetWindowRgn
• 0x431500 GetWindowRect
• 0x431504 GetWindowPlacement
• 0x431508 GetWindowLongA
• 0x43150c GetWindowDC
• 0x431510 GetSystemMetrics
• 0x431514 GetSystemMenu
• 0x431518 GetSysColor
• 0x43151c GetSubMenu
• 0x431520 GetScrollPos
• 0x431524 GetPropA
• 0x431528 GetParent
• 0x43152c GetWindow
• 0x431530 GetMenuStringA
• 0x431534 GetMenuState
• 0x431538 GetMenuItemCount
• 0x43153c GetMenu
• 0x431540 GetLastActivePopup
• 0x431548 GetKeyboardLayout
• 0x43154c GetKeyState
• 0x431550 GetKeyNameTextA
• 0x431554 GetIconInfo
• 0x431558 GetForegroundWindow
• 0x43155c GetFocus
• 0x431560 GetDesktopWindow
• 0x431564 GetDCEx
• 0x431568 GetDC
• 0x43156c GetCursorPos
• 0x431570 GetCursor
• 0x431574 GetClipboardData
• 0x431578 GetClientRect
• 0x43157c GetClassInfoA
• 0x431580 GetCapture
• 0x431584 GetActiveWindow
• 0x431588 FrameRect
• 0x43158c FillRect
• 0x431590 EqualRect
• 0x431594 EnumWindows
• 0x431598 EnumThreadWindows
• 0x43159c EndPaint
• 0x4315a0 EnableWindow
• 0x4315a4 EnableMenuItem
• 0x4315a8 DrawTextA
• 0x4315ac DrawMenuBar
• 0x4315b0 DrawIcon
• 0x4315b4 DrawEdge
• 0x4315b8 DispatchMessageA
• 0x4315bc DestroyWindow
• 0x4315c0 DestroyMenu
• 0x4315c4 DestroyIcon
• 0x4315c8 DestroyCursor
• 0x4315cc DeleteMenu
• 0x4315d0 DefWindowProcA
• 0x4315d4 DefMDIChildProcA
• 0x4315d8 DefFrameProcA
• 0x4315dc CreateWindowExA
• 0x4315e0 CreatePopupMenu
• 0x4315e4 CreateMenu
• 0x4315e8 CreateIcon
• 0x4315ec ClientToScreen
• 0x4315f0 CheckMenuItem
• 0x4315f4 CallWindowProcA
• 0x4315f8 CallNextHookEx
• 0x4315fc BeginPaint
• 0x431600 CharLowerBuffA
• 0x431604 CharLowerA
• 0x431608 AdjustWindowRectEx
Library ole32.dll:
• 0x431614 CoUninitialize
• 0x431618 CoInitialize
Library oleaut32.dll:
• 0x431620 GetErrorInfo
• 0x431624 SysFreeString
Library comctl32.dll:
• 0x431638 ImageList_DragMove
• 0x43163c ImageList_DragLeave
• 0x431640 ImageList_DragEnter
• 0x431644 ImageList_EndDrag
• 0x431648 ImageList_BeginDrag
• 0x431654 ImageList_Destroy
• 0x431658 ImageList_Create
Library wininet.dll:
• 0x431660 InternetReadFile
• 0x431664 InternetOpenA
• 0x431668 InternetConnectA
• 0x43166c InternetCloseHandle
• 0x431670 HttpSendRequestA
• 0x431674 HttpQueryInfoA
• 0x431678 HttpOpenRequestA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49714 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 1900
192.168.56.101 50569 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.