8.0
高危
59 个模型检测该样本为恶意！
重新分析
更多

07bfebe8d71ba6f9d0f0b05d40648777a4200a5811a1c6000f825c6d3e8246a4

9df2edcf7e8555f396d0e8fdaed7a3a8.exe

分析耗时

32s

最近分析

文件大小

583.0KB
静态报毒 动态报毒 100% AI SCORE=88 AIDETECTVM ATTRIBUTE BSCOPE BUNITU CLASSIC COINMINER COINMINERX CONFIDENCE ELDORADO ELQV GANDCRAB GDSDA GENKD GENKRYPTIK HDLD HIGH CONFIDENCE HIGHCONFIDENCE HZDI KQ0@ACCFVSEG KRYPTIK MALICIOUS PE MALPE MALWARE1 MALWARE@#1MN2VO4QB7K1Q MINT QQPASS QQROB QVM10 R06EC0DIA20 RACEALER RPYS1ROG6QG SCORE SIGGEN9 STATIC AI SUSGEN TITIREZ TOFSEE TROJANPSW UNSAFE WFJMS X2068 ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Packed-GBE!9DF2EDCF7E85 20201211 6.0.6.653
Alibaba TrojanPSW:Win32/Racealer.e35f18df 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:CoinminerX-gen [Trj] 20201210 21.1.5827.0
Tencent Win32.Trojan-qqpass.Qqrob.Hzdi 20201211 1.0.0.1
Kingsoft 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619781467.343625
IsDebuggerPresent
failed 0 0
This executable has a PDB path (1 个事件)
pdb_path C:\howinatixed-tudomawig-cefatoxitiwihoz\voyid_foxe.pdbn\wojidey.pdb
The file contains an unknown PE resource name possibly indicative of a packer (2 个事件)
resource name AFX_DIALOG_LAYOUT
resource name DEDIGE
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (4 个事件)
Time & API Arguments Status Return Repeated
1619781467.249625
NtProtectVirtualMemory
process_identifier: 2120
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 462848
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0099a000
success 0 0
1619781467.312625
NtAllocateVirtualMemory
process_identifier: 2120
region_size: 561152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00a80000
success 0 0
1619781471.109125
NtProtectVirtualMemory
process_identifier: 1436
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 327680
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005de000
success 0 0
1619781471.125125
NtAllocateVirtualMemory
process_identifier: 1436
region_size: 581632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00500000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.96695996121935 section {'size_of_data': '0x0007e200', 'virtual_address': '0x00001000', 'entropy': 7.96695996121935, 'name': '.text', 'virtual_size': '0x0007e17d'} description A section with a high entropy has been found
entropy 0.8668384879725086 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619781467.405625
NtAllocateVirtualMemory
process_identifier: 1436
region_size: 995328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000080
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Potential code injection by writing to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619781467.421625
WriteProcessMemory
process_identifier: 1436
buffer: @
process_handle: 0x00000080
base_address: 0x7efde008
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2120 called NtSetContextThread to modify thread in remote process 1436
Time & API Arguments Status Return Repeated
1619781467.421625
NtSetContextThread
thread_handle: 0x0000007c
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4215417
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1436
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2120 resumed a thread in remote process 1436
Time & API Arguments Status Return Repeated
1619781467.499625
NtResumeThread
thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 1436
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.27.142:443
Executed a process and injected code into it, probably while unpacking (7 个事件)
Time & API Arguments Status Return Repeated
1619781467.405625
CreateProcessInternalW
thread_identifier: 368
thread_handle: 0x0000007c
process_identifier: 1436
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\9df2edcf7e8555f396d0e8fdaed7a3a8.exe
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\9df2edcf7e8555f396d0e8fdaed7a3a8.exe"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\9df2edcf7e8555f396d0e8fdaed7a3a8.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
process_handle: 0x00000080
inherit_handles: 0
success 1 0
1619781467.405625
NtGetContextThread
thread_handle: 0x0000007c
success 0 0
1619781467.405625
NtUnmapViewOfSection
process_identifier: 1436
region_size: 4096
process_handle: 0x00000080
base_address: 0x00400000
success 0 0
1619781467.405625
NtAllocateVirtualMemory
process_identifier: 1436
region_size: 995328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000080
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619781467.421625
WriteProcessMemory
process_identifier: 1436
buffer: @
process_handle: 0x00000080
base_address: 0x7efde008
success 1 0
1619781467.421625
NtSetContextThread
thread_handle: 0x0000007c
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4215417
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1436
success 0 0
1619781467.499625
NtResumeThread
thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 1436
success 0 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
ClamAV Win.Dropper.Bunitu-7868369-0
FireEye Generic.mg.9df2edcf7e8555f3
McAfee Packed-GBE!9DF2EDCF7E85
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 0056809d1 )
Alibaba TrojanPSW:Win32/Racealer.e35f18df
K7GW Trojan ( 00566f541 )
Cybereason malicious.56c583
Arcabit Trojan.Mint.Titirez.1.23
Cyren W32/GandCrab.BC.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:CoinminerX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky Trojan-PSW.Win32.Racealer.fms
BitDefender Gen:Heur.Mint.Titirez.1.23
Paloalto generic.ml
MicroWorld-eScan Gen:Heur.Mint.Titirez.1.23
Tencent Win32.Trojan-qqpass.Qqrob.Hzdi
Ad-Aware Gen:Heur.Mint.Titirez.1.23
Emsisoft Gen:Heur.Mint.Titirez.1.23 (B)
Comodo Malware@#1mn2vo4qb7k1q
F-Secure Trojan.TR/Crypt.Agent.wfjms
DrWeb Trojan.Siggen9.49888
TrendMicro TROJ_GEN.R06EC0DIA20
McAfee-GW-Edition BehavesLike.Win32.Packed.hc
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Webroot W32.Trojan.GenKD
Avira TR/Crypt.Agent.wfjms
Antiy-AVL Trojan[PSW]/Win32.Racealer
Gridinsoft Trojan.Win32.CoinMiner.ba
Microsoft Trojan:Win32/Tofsee.GM!MTB
AegisLab Trojan.Win32.Racealer.i!c
ZoneAlarm Trojan-PSW.Win32.Racealer.fms
GData Gen:Heur.Mint.Titirez.1.23
AhnLab-V3 Trojan/Win.MalPe.X2068
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34670.Kq0@aCcFVSeG
ALYac Gen:Heur.Mint.Titirez.1.23
MAX malware (ai score=88)
VBA32 BScope.Trojan.AET.281105
Malwarebytes Trojan.MalPack.GS
ESET-NOD32 a variant of Win32/Kryptik.HDLD
TrendMicro-HouseCall TROJ_GEN.R06EC0DIA20
Rising Trojan.Kryptik!1.C46C (CLASSIC)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-07-22 20:06:52

Imports

Library KERNEL32.dll:
• 0x48000c SleepEx
• 0x480010 GetModuleHandleW
• 0x480014 GetTickCount
• 0x480018 GetCurrencyFormatA
• 0x48001c GetDriveTypeA
• 0x480020 FormatMessageW
• 0x480024 GetFileAttributesA
• 0x480028 CreateFileW
• 0x48002c ReplaceFileA
• 0x480030 FindFirstFileExW
• 0x480034 LCMapStringA
• 0x480038 GetLastError
• 0x48003c GetProcAddress
• 0x480040 RemoveDirectoryA
• 0x480048 GetProcessId
• 0x48004c TransmitCommChar
• 0x480054 GetUserDefaultLCID
• 0x480058 GetCurrentProcess
• 0x48005c CallNamedPipeA
• 0x480060 GetLocaleInfoA
• 0x480064 lstrlenA
• 0x480068 FlushFileBuffers
• 0x48006c FindResourceA
• 0x480070 Sleep
• 0x480074 ExitProcess
• 0x480078 GetCommandLineA
• 0x48007c GetStartupInfoA
• 0x480080 RaiseException
• 0x480084 RtlUnwind
• 0x480088 TerminateProcess
• 0x480094 IsDebuggerPresent
• 0x480098 HeapAlloc
• 0x48009c HeapFree
• 0x4800a0 TlsGetValue
• 0x4800a4 TlsAlloc
• 0x4800a8 TlsSetValue
• 0x4800ac TlsFree
• 0x4800b4 SetLastError
• 0x4800b8 GetCurrentThreadId
• 0x4800c0 WriteFile
• 0x4800c4 GetStdHandle
• 0x4800c8 GetModuleFileNameA
• 0x4800d8 LoadLibraryA
• 0x4800ec WideCharToMultiByte
• 0x4800f4 SetHandleCount
• 0x4800f8 GetFileType
• 0x4800fc HeapCreate
• 0x480100 VirtualFree
• 0x480108 GetCurrentProcessId
• 0x480110 VirtualAlloc
• 0x480114 HeapReAlloc
• 0x480118 GetCPInfo
• 0x48011c GetACP
• 0x480120 GetOEMCP
• 0x480124 IsValidCodePage
• 0x480128 HeapSize
• 0x48012c GetStringTypeA
• 0x480130 MultiByteToWideChar
• 0x480134 GetStringTypeW
• 0x480138 LCMapStringW
• 0x48013c GetModuleHandleA
Library ADVAPI32.dll:
• 0x480004 RegDeleteValueW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 49240 239.255.255.250 3702
192.168.56.101 49242 239.255.255.250 3702
192.168.56.101 50535 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.