1.4
低危

f276b85921dcc229ab6087a94753556ae2a3129e66a8b3b7a2f6a0b1a6df8d1e

a06c20073a15ad256fcba30438527f56.exe

分析耗时

4s

最近分析

文件大小

101.0KB
静态报毒 动态报毒 1VQCKGW AI SCORE=81 BBSF CLASSIC ELDORADO EMOTET GENERICKD GENKRYPTIK HROXPX KRYPTIK LJTS MALICIOUS R011C0DHC20 R347696 SCORE SUSGEN TVNYU UNCLASSIFIEDMALWARE@0 UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FRI!A06C20073A15 20200820 6.0.6.653
Alibaba Trojan:Win32/Emotet.51a072c4 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200820 18.4.3895.0
Kingsoft 20200820 2013.8.14.323
Tencent Win32.Trojan-banker.Emotet.Ljts 20200820 1.0.0.1
CrowdStrike 20190702 1.0
静态指标
This executable has a PDB path (1 个事件)
pdb_path C:\Users\DODO\Pictures\win32_memdc_src\Release\Win32_MemDC.pdb
行为判定
动态指标
网络通信
File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)
MicroWorld-eScan Trojan.GenericKD.43642059
FireEye Generic.mg.a06c20073a15ad25
CAT-QuickHeal Trojan.Multi
McAfee Emotet-FRI!A06C20073A15
Cylance Unsafe
Zillya Trojan.Emotet.Win32.24348
K7AntiVirus Trojan ( 005690671 )
Alibaba Trojan:Win32/Emotet.51a072c4
K7GW Trojan ( 005690671 )
F-Prot W32/Emotet.APG.gen!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Trojan-gen
GData Win32.Trojan.PSE.1VQCKGW
Kaspersky HEUR:Trojan-Banker.Win32.Emotet.pef
BitDefender Trojan.GenericKD.43642059
NANO-Antivirus Trojan.Win32.Emotet.hroxpx
Paloalto generic.ml
ViRobot Trojan.Win32.Z.Emotet.103424.CA
Rising Trojan.Kryptik!1.CA4D (CLASSIC)
Ad-Aware Trojan.GenericKD.43642059
Emsisoft Trojan.Emotet (A)
Comodo .UnclassifiedMalware@0
F-Secure Trojan.TR/Emotet.tvnyu
DrWeb Trojan.Emotet.1000
TrendMicro TROJ_GEN.R011C0DHC20
Sophos Troj/Emotet-CKW
Cyren W32/Emotet.APG.gen!Eldorado
Jiangmin Backdoor.Emotet.ql
Avira TR/Emotet.tvnyu
Antiy-AVL Trojan/Win32.GenKryptik
Arcabit Trojan.Generic.D299ECCB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan-Banker.Win32.Emotet.pef
Microsoft Trojan:Win32/Emotet.ARJ!MTB
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.Emotet.R347696
ALYac Trojan.Agent.Emotet
MAX malware (ai score=81)
VBA32 Backdoor.Emotet
Malwarebytes Trojan.Emotet
ESET-NOD32 Win32/Emotet.CD
TrendMicro-HouseCall TROJ_GEN.R011C0DHC20
Tencent Win32.Trojan-banker.Emotet.Ljts
Ikarus Trojan-Banker.Emotet
MaxSecure Trojan.Malware.73767892.susgen
Fortinet W32/Kryptik.BBSF!tr
AVG Win32:Trojan-gen
Panda Trj/Emotet.C
Qihoo-360 Generic/Trojan.ff2
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-11 16:34:29

Imports

Library KERNEL32.dll:
0x40404c Sleep
0x404054 GetStartupInfoW
0x404058 TerminateProcess
0x40405c GetCurrentProcess
0x404068 IsDebuggerPresent
0x40406c GetTickCount
0x404074 GetCurrentThreadId
0x404078 GetCurrentProcessId
0x404080 LoadLibraryExA
0x404084 GetTickCount64
0x404088 InterlockedExchange
Library USER32.dll:
0x404184 LoadIconW
0x404188 LoadCursorW
0x40418c RegisterClassExW
0x404190 CreateWindowExW
0x404194 ShowWindow
0x404198 UpdateWindow
0x40419c SetTimer
0x4041a0 PostQuitMessage
0x4041a4 DialogBoxParamW
0x4041a8 DestroyWindow
0x4041ac DefWindowProcW
0x4041b0 SetCapture
0x4041b4 PtInRect
0x4041b8 ReleaseCapture
0x4041bc BeginPaint
0x4041c0 DispatchMessageW
0x4041c4 TranslateMessage
0x4041cc GetMessageW
0x4041d0 LoadAcceleratorsW
0x4041d4 LoadStringW
0x4041d8 OffsetRect
0x4041dc DrawTextA
0x4041e0 FillRect
0x4041e4 InvalidateRect
0x4041e8 ReleaseDC
0x4041ec GetDC
0x4041f0 GetClientRect
0x4041f4 EndPaint
0x4041f8 EndDialog
Library GDI32.dll:
0x404000 CreateSolidBrush
0x404004 DeleteObject
0x404008 DeleteDC
0x40400c CreateCompatibleDC
0x404014 SelectObject
0x404018 GetStockObject
0x40401c SaveDC
0x404020 RestoreDC
0x404024 SetBkMode
0x404028 BitBlt
0x404030 CreatePolygonRgn
0x404034 CombineRgn
0x404038 SelectClipRgn
0x40403c Ellipse
0x404040 Rectangle
0x404044 CreatePen
Library MSIMG32.dll:
0x404090 AlphaBlend
0x404094 GradientFill
Library MSVCR90.dll:
0x4040dc _amsg_exit
0x4040e0 _CxxThrowException
0x4040e4 __CxxFrameHandler3
0x4040e8 _controlfp_s
0x4040ec _invoke_watson
0x4040f8 ?terminate@@YAXXZ
0x4040fc _crt_debugger_hook
0x404100 __set_app_type
0x404104 __p__fmode
0x404108 __p__commode
0x40410c _adjust_fdiv
0x404110 __setusermatherr
0x404114 _configthreadlocale
0x404118 _initterm_e
0x40411c _initterm
0x404124 ??3@YAXPAX@Z
0x404130 ??2@YAPAXI@Z
0x404138 srand
0x40413c rand
0x404140 _time64
0x404144 _wcslwr
0x404148 atoi
0x40414c _unlock
0x404150 __dllonexit
0x404154 _encode_pointer
0x404158 _lock
0x40415c _onexit
0x404160 _decode_pointer
0x404164 memcpy
0x404168 __wgetmainargs
0x40416c _cexit
0x404170 _exit
0x404174 _XcptFilter
0x404178 exit
0x40417c _wcmdln

Hosts

No hosts contacted.

DNS

No domains contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.