1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.59
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:FakeMail-L [Trj] | 20191222 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191222 | 2013.8.14.323 |
| McAfee | Downloader-FSH!917D2BBCDD82 | 20191222 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0c1ce | 20191222 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.rdata', 'virtual_address': '0x00002000', 'virtual_size': '0x00000dda', 'size_of_data': '0x00000e00', 'entropy': 6.965525627463923} | entropy | 6.965525627463923 | description | 发现高熵的节 | |||||||||
| entropy | 0.22580645161290322 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意
(50 out of 64 个事件)
| ALYac | Trojan.GenericKD.1683057 |
| APEX | Malicious |
| AVG | Win32:FakeMail-L [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1683057 |
| AhnLab-V3 | Dropper/Win32.Necurs.R115439 |
| Antiy-AVL | Trojan[Spy]/Win32.Zbot |
| Arcabit | Trojan.Generic.D19AE71 |
| Avast | Win32:FakeMail-L [Trj] |
| Avira | TR/Matsnu.efx.2 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.GenericKD.1683057 |
| BitDefenderTheta | Gen:NN.ZexaF.33556.bqX@ay22jkmi |
| Bkav | W32.FakePdfTTc.Worm |
| CAT-QuickHeal | TrojanDownlder.Upatre.MUE.B4 |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.Kryptik.CBXB@5a837k |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.cdd829 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.KPSL-9109 |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.GenericKD.1683057 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.IJA |
| F-Secure | Trojan-Downloader:W32/Upatre.D |
| FireEye | Generic.mg.917d2bbcdd8295d3 |
| Fortinet | W32/Kryptik.OOU!tr |
| GData | Win32.Trojan.Zbot.BH |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | TrojanSpy.Zbot.edxk |
| K7AntiVirus | Trojan-Downloader ( 0048f6391 ) |
| K7GW | Trojan-Downloader ( 0048f6391 ) |
| Kaspersky | Trojan-Spy.Win32.Zbot.svfs |
| MAX | malware (ai score=83) |
| Malwarebytes | Trojan.Upatre |
| McAfee | Downloader-FSH!917D2BBCDD82 |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.lm |
| MicroWorld-eScan | Trojan.GenericKD.1683057 |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.DownLoad3.cyjxvo |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM20.1.0CBF.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Cryptor |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Upatre-CC |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1990-06-09 03:29:57
PE Imphash
cad810e9c1674ee81bd89d5d1ce7dff5
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000c10 | 0x00000e00 | 5.581510220435202 |
| .rdata | 0x00002000 | 0x00000dda | 0x00000e00 | 6.965525627463923 |
| .data | 0x00003000 | 0x00000274 | 0x00000200 | 3.3132074071666002 |
| .rsrc | 0x00004000 | 0x00001f08 | 0x00002000 | 4.34347064944727 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00004248 | 0x00001ca8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00005ef0 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000040f0 | 0x00000152 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x40205c UpdateWindow
• 0x402060 ShowWindow
• 0x402064 PostQuitMessage
• 0x402068 GetMessageA
• 0x40206c DispatchMessageA
• 0x402070 TranslateMessage
• 0x402074 CreateWindowExA
• 0x402078 RegisterClassExA
• 0x40207c DefWindowProcA
• 0x402080 SendMessageA
• 0x402084 SetWindowTextA
• 0x402088 GetClassLongA
• 0x40208c GetWindowTextA
Library KERNEL32.dll:
• 0x402008 CreateFileA
• 0x40200c HeapAlloc
• 0x402010 GetProcessHeap
• 0x402014 LoadLibraryA
• 0x402018 GetModuleHandleA
• 0x40201c HeapCreate
• 0x402020 DeleteFileA
• 0x402024 CloseHandle
• 0x402028 GetCurrentThreadId
• 0x40202c LeaveCriticalSection
• 0x402030 EnterCriticalSection
• 0x402034 GetStartupInfoA
• 0x402038 ReadFile
• 0x40203c FlushFileBuffers
• 0x402040 Sleep
• 0x402044 InterlockedIncrement
• 0x402048 InterlockedDecrement
• 0x40204c InterlockedExchange
• 0x402050 InitializeCriticalSection
• 0x402054 DeleteCriticalSection
Library COMCTL32.dll:
• 0x402000 None
L!This program cannot be run in DOS mode.
.tRich
`.rdata
@.data
e3?iWi
W$lK43
h@_0E
P3Rh @
3PQPVj h
=b?"cS
SWAVAf9
;wME;r
Qm=sP-
3P5p1@
P+54 @
fold.html
userDefine.curren
X+PQUY
A8u_L34o&@
@t.jS%
BBBBUE
tF]%| @
godonn
insert name
timesure
itaartas
static
button
zitedak
obilisy
eberation
gibits
encasi
ivanzelist
Kernel32.dll
RichEdit
Riched32.dll
}}f=%oP
zlOQ[Nc$
M7`}bo=%rM
?injHz
}nk=%rM
{ks=+ZP
gzQ'\W
/>uBgnw
3BZ}_p~1
xs iH4Ye3eX
IHg =b
>BzZk?"-I
c-]JrS
kX\4Jie 7Qz4YM#4JQV
o@2y^cQ_
cY_zZSlH
'j3Y<+
)UttMM]?"`E
'J_6oGSHoW
V<sYIWb="
p_6svFJ
@W"cSf
4JAZSos`?\z
@w01yn
<B==lo
yBz}J\#cI
@A`4"2
SIj~=+
26&)&
i"gm|e?"
[_0=8JObU
lh&A?"
c<Y=bU[|
}!zXb\WM6t
GetWindowTextA
GetClassLongA
SetWindowTextA
SendMessageA
DefWindowProcA
RegisterClassExA
CreateWindowExA
TranslateMessage
DispatchMessageA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
GetStartupInfoA
ReadFile
FlushFileBuffers
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
CloseHandle
DeleteFileA
HeapCreate
GetModuleHandleA
LoadLibraryA
GetProcessHeap
HeapAlloc
CreateFileA
KERNEL32.dll
COMCTL32.dll
Prsltte
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>
- - - - - - - - +
- - - - +
- - - +
- - - - - - - - - - (
. . . . . . . . . . . . \R. . . . . . . . . . . . *
0!0!0!0!0!0!0!0!. . / 0!cX0!0!0!0!0!0!0!0!0!0!0!0!,
- 1"1"1"1"1"1"1"1"1"1"eZ1"1"/ / 0"1"1"1"1"1"1"1"-
/!3#3#3#3#3#3#3#3#B2
3#3#3#3#3#vk3#3#3#3#3#3#3#/!
1"4$4$4$4$4$4$4$4$4$SG4$4$h]4$4$4$4$4$4$4$4$4$4$4$4$1"
3#5%5%5%5%5%5%5%5%SH5%SH5%5%3#3#4%5%5%5%5%5%5%5%3#
5%7&7&7&7&7&7&7&7&7&lb7&7&yo7&7&7&7&7&7&7&5%
7&8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'8'7&
9(<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*<*9(
?.^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S^S?.
r o g r a m i s f r e e s o f t w a r e ; y o u c a n r e d i s t r i b u t e i t a n d / o r m o d i f y i t u n d e r t h e
e r m s o f t h e G N U G e n e r a l P u b l i c L i c e n s e a s p u b l i s h e d b y t h e F r e e S o f t w a r e F o u n d a t i o n ; e i t h e r v
C : \ s a m p l e . e x e
C : \ d b 4 8 5 9 b 1 d d 1 7 8 c 0 4 d 3 1 e 2 e 7 8 7 d d b c 4 c c 3 a 0 5 a c 0 3 d 0 5 2 1 e b b 6 2 7 2 d 3 a 2 2 1 0 0 b 1 8 6
C : \ I x i 4 e L P q . e x e
C : \ r 9 Y v V c X i . e x e
C : \ h E N T v S M I . e x e
C : \ P h x W T i Q t . e x e
C : \ K v z P r 5 7 u . e x e
C : \ C L r e t e O 6 . e x e
C : \ p h i y p t v o . e x e
C : \ 9 a 5 a d 2 a 1 8 d e 7 7 d 2 2 7 8 f c 8 3 1 a 7 e 3 8 d 4 d a 9 0 e c a f b f 5 8 d 5 3 4 8 e 5 0 b a b 4 d 8 3 c 9 0 9 4 e 9
C : \ i 8 _ 5 8 p T i . e x e
C : \ h a S b v W e 3 . e x e
C : \ q a 0 j 8 2 b T . e x e
C : \ f J N 1 t 5 F S . e x e
C : \ b 2 d a a c 7 6 d 4 9 e e 8 2 0 0 2 0 d 4 9 0 2 7 2 b 1 1 8 a 3 7 1 6 4 a d d 1 8 e 2 0 7 7 2 3 1 1 7 f 0 e 2 6 2 4 5 b d 0 c d
C : \ j g x 4 j f f j . e x e
C : \ j 6 l c B L v 6 . e x e
C : \ E 4 2 0 r Y K n . e x e
C : \ t a 9 l M S r m . e x e
C : \ 2 m 1 M c P E 1 . e x e
C : \ J Y b Y l C h n . e x e
C : \ I 2 D W T z T 9 . e x e
C : \ x f l R M 1 2 _ . e x e
C : \ g z 9 L V J h k . e x e
C : \ 6 I s p R _ l Z . e x e
C : \ 7 7 1 9 d 6 9 6 c 3 4 4 a 6 0 e 4 2 8 5 e 1 e 1 a 2 2 f 9 5 5 e d d 8 a c a 0 4 f f b a 6 6 9 6 d 8 6 1 8 e 7 9 1 e a 4 8 f 3 8
C : \ a 0 6 c 6 b 3 9 1 6 8 c 3 7 7 4 0 6 a 2 d 5 5 7 f 7 a 4 9 3 3 4 9 9 0 5 7 9 d d 0 7 9 9 9 4 8 1 d 1 b a b 0 8 3 c 1 5 2 e c 3 a
C : \ 5 2 5 f e b 4 d 9 f 4 8 6 f b 9 3 b 7 8 1 b 5 f b 7 5 f e 5 3 2 a 6 d a e 4 7 a 7 a 5 a 2 d 5 9 1 e 3 c f 6 2 9 b 2 2 d d d 5 4
C : \ T O 0 k O F d r . e x e
C : \ O y p L M 6 C U . e x e
C : \ 9 Z Y R w y b K . e x e
C : \ V s u o H k v r . e x e
C : \ W V F Y 1 I M L . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ 6 0 f 6 2 a 9 3 5 9 4 a 8 0 3 4 5 0 4 7 a 5 9 c 9 4 a 3 a 9 3 4 6 e c 9 a 1 1 d 6 3 a b 6 3 3 5 5 8 c a 3 7 e 7 7 4 8 4 9 e 2 c
C : \ U s e r s \ A d m i n i s t r a t o r \ A p p D a t a \ L o c a l \ T e m p \ j n x F e H B . e x e
C : \ f 8 5 b 8 9 8 4 7 1 a 8 4 8 3 2 c 9 4 4 e 5 c 8 e f f 4 f 8 2 7 0 e f b c b 7 2 1 1 7 4 a 7 f b 3 5 e 5 0 c 4 b f b 9 0 8 8 a b
C : \ a 2 9 c 5 2 2 b f 4 e 2 5 d 5 4 0 2 5 7 3 b 4 7 5 2 d 9 2 a 9 2 7 7 a b d 0 e c f 8 8 7 6 1 c 0 5 7 c 6 c 3 9 6 d 3 f 1 2 f c e
C : \ 0 4 a 9 c 2 9 7 4 d 2 3 6 4 1 d 6 4 1 5 b b c b 3 9 3 c d 7 3 4 5 a 7 8 4 5 f 5 1 a 8 9 f 5 8 7 5 8 c 9 3 2 4 f b 4 9 2 6 1 9 d
C : \ 8 9 9 9 1 c d 4 0 d 6 6 1 e e 5 a d 4 d 6 0 b a 6 3 a 3 c 2 2 6 d f f b 9 0 2 b 3 4 c 3 6 a d 3 8 7 6 0 5 f a b b 3 5 0 1 1 e 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d c a r e . p e 3 2
C : \ 3 a d 1 4 f c 6 8 d a 7 c 7 2 4 d 1 3 2 a d f 0 9 5 f 0 1 0 7 0 1 8 c 0 2 8 1 f 5 f f f f 9 2 7 e 9 6 b d 9 4 4 1 f 0 d a b 0 a
C : \ d 3 5 1 e 0 c 0 0 0 e 2 b 2 0 8 e b c 9 d 9 e f 8 5 3 c 0 d f a 6 5 b 4 f a b b b 8 b 2 6 f f a e 1 b 1 7 7 3 6 0 b b 1 2 6 5 2
C : \ 3 2 0 7 3 d 5 3 7 0 3 f 4 1 8 c 6 2 b 7 6 3 c 5 b a d e 5 7 5 6 a 2 9 3 c d 7 0 5 9 6 1 b 9 6 f 1 e 1 8 1 8 3 7 c 9 2 b b 7 4 2
C : \ a f 0 2 4 c b 8 a 4 1 6 5 4 a 7 0 5 e a 1 1 7 4 d a 8 c d d 8 f a 2 b 2 d f 5 6 a 5 7 c d 3 9 5 3 3 6 c d 3 6 3 8 9 e c 9 5 e 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d c a r e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 5 1 5 5 0 3 f 4 c 1 7 c 3 7 0 _ d c a r e . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.