6.6
高危
26 个模型检测该样本为恶意！
重新分析
更多

8d5ea757bf4ca7be6644343713f3af2c7887faf6cf67a4047b92184e42607a54

90bd4294a4df16db96a5f4d5ebf3c731.exe

分析耗时

90s

最近分析

文件大小

3.6MB
静态报毒 动态报毒 AGEN AGENTCRT ATTRIBUTE CLOUD CONFIDENCE GENERIC PUA AH GENERICRXDS GF06011C HIGH CONFIDENCE HIGHCONFIDENCE INVALIDSIG LIJN SCORE STRICTOR SUSGEN SUSPICIOUS PE UVPM YOUXUN 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXDS-CY!90BD4294A4DF 20190706 6.0.6.653
Alibaba Downloader:Win32/Agent.1badc41e 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20190706 2013.8.14.323
Tencent 20190706 1.0.0.1
Avast 20190706 18.4.3895.0
CrowdStrike win/malicious_confidence_60% (W) 20190212 1.0
静态指标
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path e:\e盘 拷贝\游戏盒版本\youxun\trunk\bin\Win32\Release\build\apkpackage\apk.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620951004.769375
GlobalMemoryStatusEx
success 1 0
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name EXE
行为判定
动态指标
Foreign language identified in PE resource (18 个事件)
name EXE language LANG_CHINESE offset 0x00379388 filetype ISO-8859 text, with no line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000bc
name EXE language LANG_CHINESE offset 0x00379388 filetype ISO-8859 text, with no line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000bc
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00389cac filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_MENU language LANG_CHINESE offset 0x0038a114 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000050
name RT_STRING language LANG_CHINESE offset 0x0038a164 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000034
name RT_ACCELERATOR language LANG_CHINESE offset 0x0038a198 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000010
name RT_GROUP_ICON language LANG_CHINESE offset 0x0038a1f4 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000004c
name RT_GROUP_ICON language LANG_CHINESE offset 0x0038a1f4 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000004c
name RT_VERSION language LANG_CHINESE offset 0x0038a240 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000260
Creates executable files on the filesystem (5 个事件)
file C:\ProgramData\wdgame\aapt.exe
file C:\ProgramData\wdgame\winrar.exe
file C:\ProgramData\wdgame\glut.dll
file C:\ProgramData\wdgame\glut32.dll
file C:\ProgramData\wdgame\MountBS.exe
Drops a binary and executes it (1 个事件)
file C:\ProgramData\wdgame\MountBS.exe
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620951011.89475
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.986652022794905 section {'size_of_data': '0x00352800', 'virtual_address': '0x00038000', 'entropy': 7.986652022794905, 'name': '.rsrc', 'virtual_size': '0x00352730'} description A section with a high entropy has been found
entropy 0.9339739190116678 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1620951016.03475
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1620951014.51975
RegSetValueExA
key_handle: 0x000003f0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620951014.51975
RegSetValueExA
key_handle: 0x000003f0
value: p€’m H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620951014.51975
RegSetValueExA
key_handle: 0x000003f0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620951014.51975
RegSetValueExW
key_handle: 0x000003f0
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620951014.51975
RegSetValueExA
key_handle: 0x0000040c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620951014.51975
RegSetValueExA
key_handle: 0x0000040c
value: p€’m H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620951014.51975
RegSetValueExA
key_handle: 0x0000040c
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620951014.62875
RegSetValueExW
key_handle: 0x000003ec
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 个事件)
Qihoo-360 Win32/Virus.Downloader.ab8
McAfee GenericRXDS-CY!90BD4294A4DF
Zillya Adware.AgentCRT.Win32.494
Alibaba Downloader:Win32/Agent.1badc41e
TrendMicro HT_STRICTOR_GF06011C.UVPM
Symantec ML.Attribute.HighConfidence
Paloalto generic.ml
ClamAV Win.Trojan.Downloader-65962
Kaspersky not-a-virus:Downloader.Win32.Agent.lijn
Rising PUA.Youxun!8.F60F (CLOUD)
Endgame malicious (high confidence)
Sophos Generic PUA AH (PUA)
F-Secure Heuristic.HEUR/AGEN.1002525
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition GenericRXDS-CY!90BD4294A4DF
Trapmine suspicious.low.ml.score
SentinelOne DFI - Suspicious PE
Jiangmin Downloader.Agent.lih
Avira HEUR/AGEN.1002525
Microsoft PUA:Win32/Youxun
ZoneAlarm not-a-virus:Downloader.Win32.Agent.lijn
VBA32 Adware.Youxun
eGambit PE.Heur.InvalidSig
Fortinet Riskware/Agent
CrowdStrike win/malicious_confidence_60% (W)
MaxSecure Trojan.Malware.9935031.susgen
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2015-01-23 16:48:14

Imports

Library KERNEL32.dll:
• 0x428060 GetStartupInfoW
• 0x428064 HeapFree
• 0x428068 HeapAlloc
• 0x42806c ExitProcess
• 0x428078 IsDebuggerPresent
• 0x42807c RtlUnwind
• 0x428080 RaiseException
• 0x428084 HeapReAlloc
• 0x428088 SetStdHandle
• 0x42808c GetFileType
• 0x428090 HeapSize
• 0x428094 GetStdHandle
• 0x428098 GetModuleFileNameA
• 0x4280a4 GetCommandLineW
• 0x4280a8 SetHandleCount
• 0x4280ac GetStartupInfoA
• 0x4280b0 HeapCreate
• 0x4280b4 VirtualFree
• 0x4280c0 VirtualAlloc
• 0x4280c4 GetCPInfo
• 0x4280c8 GetACP
• 0x4280cc GetOEMCP
• 0x4280d0 IsValidCodePage
• 0x4280d4 LCMapStringW
• 0x4280e0 GetConsoleCP
• 0x4280e4 GetConsoleMode
• 0x4280e8 LCMapStringA
• 0x4280ec GetStringTypeA
• 0x4280f0 GetStringTypeW
• 0x4280f4 GetLocaleInfoA
• 0x4280f8 CreateFileA
• 0x428100 GetDriveTypeA
• 0x428104 WriteConsoleA
• 0x428108 GetConsoleOutputCP
• 0x42810c WriteConsoleW
• 0x428114 GlobalFindAtomW
• 0x428118 GlobalDeleteAtom
• 0x42811c LoadLibraryA
• 0x428120 GetVersionExA
• 0x428124 GetModuleHandleA
• 0x428128 GlobalAddAtomW
• 0x42812c GetCurrentThreadId
• 0x428130 GlobalFlags
• 0x428134 lstrcmpW
• 0x428138 CompareStringW
• 0x428140 TlsFree
• 0x428144 LocalReAlloc
• 0x428148 TlsSetValue
• 0x42814c TlsAlloc
• 0x428150 GlobalHandle
• 0x428154 GlobalReAlloc
• 0x428158 TlsGetValue
• 0x42815c GetCurrentProcessId
• 0x428160 GetFullPathNameW
• 0x428164 FlushFileBuffers
• 0x428168 CompareStringA
• 0x42816c InterlockedExchange
• 0x428174 GetModuleFileNameW
• 0x428178 GetModuleHandleW
• 0x42817c FindNextFileW
• 0x428180 lstrcmpA
• 0x428184 GlobalFree
• 0x428188 GlobalAlloc
• 0x42818c GlobalLock
• 0x428190 GlobalUnlock
• 0x428194 FormatMessageW
• 0x428198 LocalFree
• 0x42819c LocalAlloc
• 0x4281a0 FreeLibrary
• 0x4281b4 SetLastError
• 0x4281bc FindClose
• 0x4281c0 FindFirstFileW
• 0x4281c8 UnmapViewOfFile
• 0x4281d4 ReadFile
• 0x4281d8 SetFileTime
• 0x4281e0 SetFilePointer
• 0x4281e4 DeleteFileW
• 0x4281e8 CloseHandle
• 0x4281f0 lstrlenW
• 0x4281f4 CreateFileW
• 0x4281f8 TerminateProcess
• 0x4281fc GetFileAttributesW
• 0x428200 Sleep
• 0x428204 WriteFile
• 0x428208 WaitForSingleObject
• 0x42820c CreateDirectoryW
• 0x428210 GetCurrentProcess
• 0x428214 WideCharToMultiByte
• 0x428218 GetProcAddress
• 0x42821c LoadLibraryW
• 0x428220 GetTickCount
• 0x428224 lstrlenA
• 0x428228 LockResource
• 0x42822c GetLastError
• 0x428230 MultiByteToWideChar
• 0x428234 SizeofResource
• 0x428238 LoadResource
• 0x42823c FindResourceW
Library USER32.dll:
• 0x428264 DestroyMenu
• 0x428268 SetMenuItemBitmaps
• 0x428270 LoadBitmapW
• 0x428274 ModifyMenuW
• 0x428278 EnableMenuItem
• 0x42827c CheckMenuItem
• 0x428284 WinHelpW
• 0x428288 GetCapture
• 0x42828c GetClassLongW
• 0x428290 SetPropW
• 0x428294 GetPropW
• 0x428298 RemovePropW
• 0x42829c GetForegroundWindow
• 0x4282a0 GetTopWindow
• 0x4282a4 GetMessageTime
• 0x4282a8 GetMessagePos
• 0x4282ac MapWindowPoints
• 0x4282b0 SetMenu
• 0x4282b4 SetForegroundWindow
• 0x4282b8 GetClientRect
• 0x4282bc PostMessageW
• 0x4282c0 CreateWindowExW
• 0x4282c4 GetClassInfoExW
• 0x4282c8 GetClassInfoW
• 0x4282cc RegisterClassW
• 0x4282d0 AdjustWindowRectEx
• 0x4282d4 CopyRect
• 0x4282d8 CallWindowProcW
• 0x4282dc GetMenu
• 0x4282e4 IsIconic
• 0x4282e8 GrayStringW
• 0x4282ec DrawTextExW
• 0x4282f0 DrawTextW
• 0x4282f4 TabbedTextOutW
• 0x4282f8 SetWindowsHookExW
• 0x4282fc CallNextHookEx
• 0x428300 GetKeyState
• 0x428304 PeekMessageW
• 0x428308 ValidateRect
• 0x42830c SetWindowPos
• 0x428310 SetWindowLongW
• 0x428314 IsWindow
• 0x428318 GetDlgItem
• 0x42831c GetFocus
• 0x428320 ClientToScreen
• 0x428324 GetWindow
• 0x428328 GetDlgCtrlID
• 0x42832c GetWindowRect
• 0x428330 GetClassNameW
• 0x428334 PtInRect
• 0x428338 SetWindowTextW
• 0x42833c GetDC
• 0x428340 ReleaseDC
• 0x428344 GetSysColor
• 0x428348 GetSysColorBrush
• 0x428350 SendMessageW
• 0x428354 GetParent
• 0x428358 GetWindowLongW
• 0x42835c GetLastActivePopup
• 0x428360 IsWindowEnabled
• 0x428364 EnableWindow
• 0x428368 MessageBoxW
• 0x42836c GetWindowTextW
• 0x428370 GetSystemMetrics
• 0x428374 UnhookWindowsHookEx
• 0x428378 GetMenuState
• 0x42837c GetMenuItemID
• 0x428380 GetMenuItemCount
• 0x428384 GetSubMenu
• 0x428388 EndPaint
• 0x42838c DestroyWindow
• 0x428390 PostQuitMessage
• 0x428394 DialogBoxParamW
• 0x428398 LoadCursorW
• 0x42839c BeginPaint
• 0x4283a0 wsprintfW
• 0x4283a4 RegisterClassExW
• 0x4283a8 LoadIconW
• 0x4283ac EndDialog
• 0x4283b0 LoadStringW
• 0x4283b4 DefWindowProcW
• 0x4283b8 DispatchMessageW
• 0x4283bc GetWindowPlacement
Library GDI32.dll:
• 0x428000 GetStockObject
• 0x428004 SelectObject
• 0x428008 CreateBitmap
• 0x42800c DeleteDC
• 0x428010 ScaleWindowExtEx
• 0x428014 SetWindowExtEx
• 0x428018 ScaleViewportExtEx
• 0x42801c SetViewportExtEx
• 0x428020 OffsetViewportOrgEx
• 0x428024 GetDeviceCaps
• 0x428028 Escape
• 0x42802c ExtTextOutW
• 0x428030 TextOutW
• 0x428034 RectVisible
• 0x428038 PtVisible
• 0x42803c GetClipBox
• 0x428040 SetMapMode
• 0x428044 SetTextColor
• 0x428048 SetBkColor
• 0x42804c RestoreDC
• 0x428050 SaveDC
• 0x428054 DeleteObject
• 0x428058 SetViewportOrgEx
Library WINSPOOL.DRV:
• 0x4283c4 OpenPrinterW
• 0x4283c8 ClosePrinter
• 0x4283cc DocumentPropertiesW
Library SHELL32.dll:
• 0x42825c ShellExecuteW
Library ole32.dll:
• 0x4283d4 CoTaskMemFree
Library OLEAUT32.dll:
• 0x428244 VariantInit
• 0x428248 VariantClear
• 0x42824c VariantChangeType

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 63497 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60215 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.