5.4
中危
57 个模型检测该样本为恶意！
重新分析
更多

2d6168e0162875170aa96e1c29da0e6f809c834b68630277569fea3f298f1bda

9ec12e2499d7c813f4a33a06bfe56a6e.exe

分析耗时

126s

最近分析

文件大小

524.5KB
静态报毒 动态报毒 AHGF AI SCORE=100 AIDETECTVM BSCOPE CCNC CLOUD CONFIDENCE GENCIRC GENERICKD GENERICRXLN GENKRYPTIK GQY@A0XG@UO HFIU HIGH CONFIDENCE INVALIDSIG KRYPT KRYPTIK MALICIOUS PE MALWARE1 PJRJS R002C0WGT20 REDAMAN RUNDLL SCORE SPYBOT SUSGEN UMAL UNSAFE YMACCO ZEXAF ZLBDU@0 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXLN-HU!9EC12E2499D7 20200812 6.0.6.653
Alibaba Trojan:Win32/RunDll.3deca225 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_70% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20200812 18.4.3895.0
Tencent Malware.Win32.Gencirc.11aad96b 20200813 1.0.0.1
Kingsoft 20200813 2013.8.14.323
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619792192.722126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
This executable is signed
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619792192.738126
__exception__
stacktrace: 
DllGetClassObject-0x5a5 8b62+0x29707 @ 0x1e09707
DllGetClassObject+0x18 DllRegisterServer-0x4 8b62+0x29cc4 @ 0x1e09cc4
9ec12e2499d7c813f4a33a06bfe56a6e+0x14e7 @ 0x4014e7
9ec12e2499d7c813f4a33a06bfe56a6e+0x14f6 @ 0x4014f6
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637128
registers.edi: 0
registers.eax: 0
registers.ebp: 1637164
registers.edx: 1637132
registers.ebx: 5123504
registers.esi: 0
registers.ecx: 0
exception.instruction_r: 89 00 a1 6c b0 e0 01 8b 00 ff d0 8d 50 01 3b d0
exception.instruction: mov dword ptr [eax], eax
exception.exception_code: 0xc0000005
exception.symbol: DllGetClassObject-0x14d2e 8b62+0x14f7e
exception.address: 0x1df4f7e
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (4 个事件)
Time & API Arguments Status Return Repeated
1619792192.113126
NtAllocateVirtualMemory
process_identifier: 2032
region_size: 516096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01d60000
success 0 0
1619792192.113126
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 516096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619792192.613126
NtAllocateVirtualMemory
process_identifier: 2032
region_size: 405504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e50000
success 0 0
1619792192.613126
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 405504
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01de0000
success 0 0
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8B62.tmp
网络通信
One or more of the buffers contains an embedded PE file (1 个事件)
buffer Buffer with sha1: 53199c327901073889115d4dac7233ed7afa40de
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.110:443
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43559917
CAT-QuickHeal Trojan.Rundll
McAfee GenericRXLN-HU!9EC12E2499D7
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 0056b61f1 )
Alibaba Trojan:Win32/RunDll.3deca225
K7GW Trojan ( 0056b61f1 )
CrowdStrike win/malicious_confidence_70% (W)
Invincea heuristic
Symantec Trojan Horse
APEX Malicious
Avast Win32:Malware-gen
GData Trojan.GenericKD.43559917
Kaspersky Trojan.Win32.RunDll.ahgf
BitDefender Trojan.GenericKD.43559917
NANO-Antivirus Virus.Win32.Gen-Crypt.ccnc
Paloalto generic.ml
ViRobot Trojan.Win32.Z.Agent.537040
Tencent Malware.Win32.Gencirc.11aad96b
Ad-Aware Trojan.GenericKD.43559917
Comodo TrojWare.Win32.UMal.zlbdu@0
F-Secure Trojan.TR/AD.Redaman.pjrjs
DrWeb Trojan.SpyBot.699
Zillya Trojan.RunDll.Win32.1001
TrendMicro TROJ_GEN.R002C0WGT20
FireEye Generic.mg.9ec12e2499d7c813
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Krypt
Jiangmin Trojan.Rundll.aas
Webroot W32.Malware.Gen
Avira TR/AD.Redaman.pjrjs
MAX malware (ai score=100)
Antiy-AVL Trojan/Win32.RunDll
Arcabit Trojan.Generic.D298ABED
AegisLab Trojan.Win32.RunDll.4!c
ZoneAlarm Trojan.Win32.RunDll.ahgf
Microsoft Trojan:Win32/Ymacco.AA2D
Cynet Malicious (score: 85)
BitDefenderTheta Gen:NN.ZexaF.34152.GqY@a0XG@uo
ALYac Trojan.Banker.RTM
VBA32 BScope.Malware-Cryptor.MTA
Malwarebytes Trojan.Dropper
ESET-NOD32 a variant of Win32/Kryptik.HFIU
TrendMicro-HouseCall TROJ_GEN.R002C0WGT20
Rising Trojan.GenKryptik!8.AA55 (CLOUD)
SentinelOne DFI - Malicious PE
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-07-26 02:23:58

Imports

Library kernel32.dll:
• 0x47c0b4 LoadLibraryA
• 0x47c0b8 VirtualAlloc
• 0x47c0bc VirtualFree
• 0x47c0c0 VirtualProtect
• 0x47c0c4 GetProcAddress
• 0x47c0c8 lstrlenA
• 0x47c0cc lstrcatA
• 0x47c0d0 lstrcmpA
• 0x47c0d8 CreateFileA
• 0x47c0ec GetCommConfig
• 0x47c0f0 SetConsoleNlsMode
• 0x47c0f4 GlobalSize
• 0x47c0f8 HeapFree
• 0x47c104 DuplicateHandle
• 0x47c108 ReadConsoleOutputA
Library ole32.dll:
• 0x47c110 CoSetState
• 0x47c114 CoGetCallContext
• 0x47c118 OleInitialize
• 0x47c11c WriteOleStg
• 0x47c124 GetErrorInfo
• 0x47c128 ReadClassStg
• 0x47c130 EnableHookObject
• 0x47c134 SNB_UserFree
• 0x47c138 DllRegisterServer
• 0x47c13c WriteStringStream
• 0x47c140 DllGetClassObject
• 0x47c144 HPALETTE_UserSize
• 0x47c148 HBITMAP_UserSize
• 0x47c158 ReadStringStream
• 0x47c15c PropStgNameToFmtId
Library advapi32.dll:
• 0x47c000 CloseEventLog
• 0x47c004 SystemFunction027
• 0x47c00c LsaOpenAccount
• 0x47c010 SetFileSecurityW
• 0x47c024 CryptImportKey
• 0x47c034 SystemFunction014
Library oleacc.dll:
• 0x47c178 ObjectFromLresult
• 0x47c180 GetRoleTextW
• 0x47c184 GetStateTextW
• 0x47c188 IID_IAccessible
• 0x47c190 DllCanUnloadNow
Library shlwapi.dll:
• 0x47c1f0 StrTrimW
• 0x47c1f4 SHRegEnumUSKeyA
• 0x47c1f8 PathFileExistsA
• 0x47c1fc IntlStrEqWorkerA
• 0x47c200 SHRegDeleteUSValueW
• 0x47c204 PathRelativePathToW
• 0x47c20c PathGetArgsA
• 0x47c214 StrRChrA
• 0x47c218 StrChrIA
• 0x47c21c PathFindOnPathA
• 0x47c220 SHOpenRegStreamA
• 0x47c224 UrlUnescapeA
• 0x47c228 StrStrA
Library comctl32.dll:
• 0x47c04c AddMRUStringW
• 0x47c050 ImageList_Replace
• 0x47c054 DllGetVersion
• 0x47c058 DefSubclassProc
• 0x47c05c DPA_Create
• 0x47c060 DrawInsert
• 0x47c064 ImageList_Add
• 0x47c068 ImageList_Create
• 0x47c06c ImageList_EndDrag
Library user32.dll:
• 0x47c230 IsDialogMessageW
• 0x47c238 DestroyIcon
• 0x47c23c GetScrollPos
• 0x47c240 SetClassLongA
• 0x47c244 GetMenuDefaultItem
• 0x47c248 MenuItemFromPoint
• 0x47c24c SetPropW
• 0x47c250 GetWindow
• 0x47c254 CheckDlgButton
• 0x47c258 GetActiveWindow
• 0x47c25c LoadKeyboardLayoutA
• 0x47c260 DefFrameProcA
• 0x47c264 SetWindowTextA
• 0x47c268 GetTitleBarInfo
• 0x47c26c CallWindowProcA
• 0x47c270 GetKeyboardType
• 0x47c274 SetProgmanWindow
• 0x47c27c CharToOemW
• 0x47c280 ShowStartGlass
Library gdiplus.dll:
• 0x47c078 GdipIsEmptyRegion
• 0x47c080 GdipDrawString
• 0x47c084 GdipCreateTexture2
• 0x47c088 GdipGetPointCount
• 0x47c08c GdipSetPenDashStyle
• 0x47c090 GdipResetClip
• 0x47c094 GdipDeleteMatrix
• 0x47c09c GdipFree
Library winspool.drv:
• 0x47c288 AddPortW
• 0x47c28c ScheduleJob
• 0x47c294 SetPrinterDataW
• 0x47c298 FlushPrinter
• 0x47c29c DeletePrinterIC
• 0x47c2a0 DeleteMonitorW
• 0x47c2a8 DeletePrinterDataW
• 0x47c2ac AddPortA
• 0x47c2b0 GetJobW
• 0x47c2b4 AddPortExW
• 0x47c2b8 EnumPrinterDataA
• 0x47c2bc AddFormW
• 0x47c2c0 AddJobW
• 0x47c2c4 GetPrinterDriverA
• 0x47c2c8 SetPrinterW
• 0x47c2cc EnumPrintersA
• 0x47c2d0 OpenPrinterW
• 0x47c2d4 DEVICECAPABILITIES

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49236 239.255.255.250 3702
192.168.56.101 49238 239.255.255.250 3702
192.168.56.101 56542 239.255.255.250 1900
192.168.56.101 57875 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.