1.1
低危
66 个模型检测该样本为恶意！
重新分析
更多

1a84a5d6790936b1a587dce6cacd03585d319e035fdf2aacc67598b4d95c9de2

1a84a5d6790936b1a587dce6cacd03585d319e035fdf2aacc67598b4d95c9de2.exe

分析耗时

193s

最近分析

371天前

文件大小

36.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER RAZY
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.64
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Miancha.ba236901 20190527 0.3.0.5
Avast Win32:KeyIso-A [Trj] 20200514 18.4.3895.0
Baidu Win32.Trojan.Inject.bm 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Kingsoft None 20200514 2013.8.14.323
McAfee Downloader-BIJ.a 20200514 6.0.6.653
Tencent Win32.Trojan.Miancha.Htma 20200514 1.0.0.1
静态指标
行为判定
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x000034c4', 'size_of_data': '0x00004000', 'entropy': 7.515005473567422} entropy 7.515005473567422 description 发现高熵的节
entropy 0.5 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 66 个反病毒引擎识别为恶意 (50 out of 66 个事件)
ALYac Gen:Variant.Razy.448218
APEX Malicious
AVG Win32:KeyIso-A [Trj]
Acronis suspicious
Ad-Aware Gen:Variant.Razy.448218
AhnLab-V3 Backdoor/Win32.CSon.R885
Alibaba Trojan:Win32/Miancha.ba236901
Antiy-AVL Trojan/Win32.Inject.aaceh
Arcabit Trojan.Razy.D6D6DA
Avast Win32:KeyIso-A [Trj]
Avira TR/Dropper.Gen
Baidu Win32.Trojan.Inject.bm
BitDefender Gen:Variant.Razy.448218
BitDefenderTheta Gen:NN.ZexaF.34108.cq0@aeAykhgi
Bkav W32.AIDetectVM.malware
CAT-QuickHeal Trojan.Mauvaise.SL1
ClamAV Win.Trojan.Rubinurd-67
Comodo Backdoor.Win32.Simbot.FTSP@5j7zlt
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.e3a0e9
Cylance Unsafe
Cyren W32/Rubin.A.gen!Eldorado
DrWeb Trojan.DownLoad2.15318
ESET-NOD32 a variant of Win32/Injector.BFSU
Emsisoft Gen:Variant.Razy.448218 (B)
Endgame malicious (high confidence)
F-Prot W32/Rubin.A.gen!Eldorado
F-Secure Trojan.TR/Dropper.Gen
FireEye Generic.mg.958caaee3a0e904b
Fortinet W32/Generic.AC.DE4!tr
GData Gen:Variant.Razy.448218
Ikarus Trojan-Downloader.Win32.Small
Invincea heuristic
Jiangmin TrojanDownloader.Small.ajux
K7AntiVirus Trojan-Downloader ( 0040f54b1 )
K7GW Trojan ( 0053a0a21 )
Kaspersky HEUR:Trojan.Win32.Miancha.gen
Lionic Trojan.Win32.Generic.lk0q
MAX malware (ai score=83)
Malwarebytes Backdoor.Simbot
MaxSecure Trojan.Inject.AACEH
McAfee Downloader-BIJ.a
McAfee-GW-Edition BehavesLike.Win32.Downloader.nm
MicroWorld-eScan Gen:Variant.Razy.448218
Microsoft Trojan:Win32/Dorv.A
NANO-Antivirus Trojan.Win32.Small.cpbmb
Panda Trj/Genetic.gen
Qihoo-360 Win32/Trojan.9e6
Rising Trojan.Inejctor!1.A7C6 (CLOUD)
SUPERAntiSpyware Trojan.Agent/Gen-Kazy
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2010-08-09 09:44:42

PE Imphash

118eb37b88640d7f3f7ac979ea5687cc

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001765 0x00002000 5.977987705606226
.rdata 0x00003000 0x00000735 0x00001000 2.7618280627406855
.data 0x00004000 0x00000648 0x00001000 1.016885752718824
.rsrc 0x00005000 0x000034c4 0x00004000 7.515005473567422

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x000050b4 0x00003000 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_VERSION 0x000080b4 0x00000410 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library KERNEL32.dll:
• 0x40301c ReadFile
• 0x403020 HeapAlloc
• 0x403024 GetProcessHeap
• 0x403028 GetFileSize
• 0x40302c CreateFileA
• 0x403030 CopyFileA
• 0x403034 MoveFileExA
• 0x403038 GetTempFileNameA
• 0x40303c GetTempPathA
• 0x403040 GetModuleFileNameA
• 0x403044 LockResource
• 0x403048 LoadResource
• 0x40304c SizeofResource
• 0x403050 FindResourceA
• 0x403054 GetLastError
• 0x403058 lstrcpyA
• 0x40305c MoveFileA
• 0x403060 DeleteFileA
• 0x403064 lstrcatA
• 0x403068 lstrcmpiA
• 0x40306c ExitProcess
• 0x403074 GetTickCount
• 0x40307c GetProcAddress
• 0x403084 VirtualProtect
• 0x40308c GetModuleHandleA
• 0x403090 TerminateProcess
• 0x403094 VirtualAllocEx
• 0x403098 HeapFree
• 0x40309c VirtualAlloc
• 0x4030a0 lstrlenA
• 0x4030a4 Sleep
• 0x4030a8 WinExec
• 0x4030ac GetLocalTime
• 0x4030b4 GetCurrentProcess
• 0x4030b8 GetCurrentProcessId
• 0x4030bc GetCurrentThreadId
• 0x4030c0 SetFilePointer
• 0x4030c4 WriteFile
• 0x4030c8 CloseHandle
• 0x4030d0 UpdateResourceA
• 0x4030d4 GetLongPathNameA
• 0x4030d8 EndUpdateResourceA
Library USER32.dll:
• 0x4030f0 wsprintfA
• 0x4030f4 MessageBeep
• 0x4030f8 MessageBoxA
Library ADVAPI32.dll:
• 0x403004 CryptReleaseContext
• 0x403008 CloseServiceHandle
• 0x40300c EnumServicesStatusA
• 0x403010 OpenSCManagerA
• 0x403014 CryptGenRandom
Library SHLWAPI.dll:
• 0x4030e0 StrRChrIA
• 0x4030e4 StrChrA
• 0x4030e8 PathRemoveFileSpecA
Library dbghelp.dll:
• 0x403100 MiniDumpWriteDump

Exports

Ordinal Address Name
1 0x4042f8 szFile
L!This program cannot be run in DOS mode.
{E!?+r?+r?+r%r;+r?*r
+rvr4+r
!r;+r-r>+r/r>+rRich?+r
.rdata
@.data
SVWj@3Y3j@fY3fj?3Y]f]E
MSQEuPV
YYPV50@
ESPuW=0@
ESPuhC
;t$uuh
X^UQQV5
WEWP}}
;t'EPEPEPh
3?;3j u
A(;r3_^[
V5JkAb)a[#-(Jo
\!9SB{
&HEJh1
,"(^J<
<kz.$03%
]8.gX+ck
?OXdfai7l[
hL~lfdW
@Jm2d|Yj\
GDyu\5.3
PQFV|9+C E
pT3s>H~qZ
g d ~|+*= V
H5(K%xeASN
[[BQi;
w),?RKAB[v*"U
*;g?}PsO{&
dA!@4e+#Y
taD6@E/6,
]TAY3ac
b'r`[Dv
FExwV#
RL>tjQ?~
\*~a6]]#RX
wnxvg
DbCp$tpf:=C>!
^_?nuw*o*wB'_~ZF
!y]O&S;oCv@
T_+M@vLr
vTsha1:}
|_^[]UE
sF?w0)
]/3MJs
m1Tx[+6
%ToPh[
eI[SV j;
s}ZE[\
at~$e_kq
>z`bN?
4\*lGm
EE~cSVu
3fj@3Yj@fY3fj@3Yu
]f]@~)M
GEQ@9E|
3tESPPPPu
X_^[U@fe
3Y}fhS"@
EPEhA@
V3WV3}h
V#VPVWu
uRFGHt
t+t'NW8u
;uH_^Q=
r)$x%@
DDDDDDDDDDDDDD
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
CloseHandle
WriteFile
SetFilePointer
ExitProcess
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CreateFileA
CopyFileA
MoveFileExA
GetTempFileNameA
GetTempPathA
GetModuleFileNameA
LockResource
LoadResource
SizeofResource
FindResourceA
GetLastError
lstrcpyA
MoveFileA
DeleteFileA
lstrcatA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetTickCount
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
lstrlenA
WinExec
GetLocalTime
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
KERNEL32.dll
wsprintfA
MessageBeep
MessageBoxA
USER32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
StrChrA
PathRemoveFileSpecA
StrRChrIA
SHLWAPI.dll
MiniDumpWriteDump
dbghelp.dll
roudanx.exe
szFile
svchost.exe
RT_RCDATA
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinHttp
szFile
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
kernel32
ZwUnmapViewOfSection
Are you sure?
regedit.exe /s
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
%04d-%02d-%02d_%02d-%02d-%02d.dmp
>K9>JE+|
dY\?-zu
/S6CD3
`H\zw.
~z NpykV
BC^D7T;f@
G=P?>Z8&U3
8OSZc(<
A#$zGi#
]F?b@-^?
;dfbp'q
<c}M=UUnp@
lzR;/8l^(r&] +Hc${kIl
R )|<Z
UBR>SK
,gEr%+
6+Ix.&
a`N&>7'
S5bTb!
_!0gD@
6(6O{x;d
}r'l^^|(
%>t0 "
\W@{dj
GoY>7\
9bq}PO9RPZCm
}|j]kC
V~$C[%:
"dQdN/
! C&jK
(!!(nN[WuB
`S`5MW0
~w9Vg2]
w|.uR$_v
W,&M+e"P>t7=x
QfbKSat{
6M(zq]
:k}})g
3/:PdA
vP[|:g}
X%Fa-G5N_w
Ub<aX>L&nD4
=]3nU)065
-Xd>O34IK0tt
QN~(=-
F+P%M$)H;qn
B\qF+\B8GJ!H
:BK\4Sup
BUv] L
EEM$Xua
I@G0wb(P.-
Q\pfQOw0
;fcQg7;
K97<UDA
Q>l$@)B
;xqSYnFJ
6L!.mQu
wQVz6}J2
lQ&^^q
#UZR>~
[dSa/A&
6)%AXxw
$=:L']OP8c]
9f>Vx:5SCuw|o
aTXXIl
0}6LfC
3?(-sR_T
gDf|}Q-=
0P)yQNI' ef
y];,7I(HXalg
@!;6,B
=cR\#(%
\nEj>5:
ro- 9){|
(:em$!l="+;GI`
Y5i 1O*niLU
]XmhJbDX(#uO~
\smW}V7
1~m+eE
f3X`\=,
@Pnl9k8$K
J)20C*o
/W~LsD#
]++Hqes=IR
{mqc!B.
Id3aV8=j+uV
Z%>LY`y~+4BYr
B={n2B9
_=@F$bc>
FZl#~}(
\Y;f\EUi
~1}\6<n
1:qW9-tV
QR0[^s-
<!zgf|o6C#$
irYFh,
~=;J(r;vk%
.a1+TI
ZLU$w4#k
zRnnD;|M
H>k$Uml{W
=+y1n7
X4z(;S'
hmf>!|
Fxs8T~S1
MGSd J
jxvrR>)@l]
z[3ZwP
5}?+Wu
`ic>g+T
Z(EtGb,|
k[mBk)
$.wIWiKu
:+CE_qEn
_]&L/p
(={;(|:
TJv=S
svJet<Q
K2C'A6P
$3JijqD
5$fxaGp
RnOh};
9_&5V>
-,~;HKHkQYTD
dTp!b4ZTQ
1HkHqw/
^>=oTq&K
I_KK~|
J*7\ veq&.&
uV%Ue/}
yC4_]O(
mtpNd^
71IUv*
VtRWE`w
\G<wy(S
fb^usE9
fiR$'*#
x6gT0i
}bhUQ#3L
%#:O aH#RA
+(D9BwH?agb7OLcK(J>w
)qI\H>V
c&V~jL
#98!\cp
?/U8GRsRv
KU(^IA
fiWeN:~]
Bb>6s 4)
K&mF_D*:o
O5 OwlEe
4VE1(uk<
lYOnO`;X&
j}d0Q[Q@aJJ
>xMQi
_Nf\,Z
R,2=bw2lVL+
VaR6@_d
OyF4uG( 5
@9Lbo.
BUc#NYv
'}VWlvUH+
V(2tR-
!ssiyG`t?N|]_<
v>R,nBR'
B?_.TO
.ospL}+
\na6LL%
uct*r$/ppz'
y5EnslnQ0_
b[Va2`\
L0iZJQ`
$?/XIC-*}
P_nl@N
)ZHP2^@B_
zUXX&XUy'u
v'okZ{
{7!#phxy
O,Z AA|(a=
6|`W2Y*
3+N(@m~An;G
,_97am
v2J#Yp&
5k<}|3D
@kI2P{AF(b8
gqiQFh
'!`ECdG
}R~Xb6x-yS
bF K^\l?|lj1
-p]4Kx
n&=]&dU
6hnSyRC-W
p P^9pWQ<
7'3y~MO'
\ibFq"Z
[b=""m
^FsGF6u
SC5Q(%fb
)kSPH~
*HnJ$d6w-J
iz09#m$
vBrlu:
jZ~_p06_$'
Rv;h\QR
NlsQ9D9u;
j"V`f'aPk
Fsl3[!sg
' ,V 
}S3wI.Zed@bDR7lS&#CG3a-g>
@(/"J#|6Qm
,? \6DM
5P`!>HoyaZt+
{)ba]?
=<5 R4=
;ibhDN[C[F
?$*.xiv
z*~tY=
h@h{*L&
?\k:\VvpE
,hAHJO?6,gex
lzO[OEl
X7f!ir/[*
8zXq[J6T+
<?,8QZOJ
_ELjQFb
,hCz?wY
iWN{OuWErWO-b
*p=_5hwAf
5k6h383|l[]fW)
QM~NV#;#v
TVC&_]
R~>LZ^B@4)iUX3
+:e07A<=B\/4
={S'iP(
+bnO}#Y
8@ZTWNA
"zOut=
,F4PYht
!X-`1`
;jLpkvICXK-P10?= E6a
I~Aw$C
Z\i:%Yw6qL!Vio
Ip@O!&:= }T
E0F#@
W1Jc)F%K
dS)99z1C3v5
PHf_Mp
v /cjK]ujdN^U
dw.\0q~~
61VaE
$Vfk+si{WA6`zAF
Rw84 ;#DbOISx>7;
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
RT_RCDATA
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Adobe Systems, Inc.
FileDescription
Adobe? Flash? Player Installer/Uninstaller 10.1 r53
FileVersion
10,1,53,64
InternalName
Adobe? Flash? Player Installer/Uninstaller 10.1
LegalCopyright
Copyright ? 1996-2010 Adobe, Inc.
LegalTrademarks
Adobe? Flash? Player
OriginalFilename
FlashUtil.exe
ProductName
Flash? Player Installer/Uninstaller
ProductVersion
10,1,53,64
VarFileInfo
Translation

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.