6.0
高危
62 个模型检测该样本为恶意！
重新分析
更多

ef99e792e4cd56d866ebc4e60723e7500f36586d9df7e45a629975495d94b357

a14138c90076a4cc36d859de2faabf81.exe

分析耗时

102s

最近分析

文件大小

128.5KB
静态报毒 动态报毒 100% AGENTB AI SCORE=100 AIDETECTVM ANTIAV AVEMARIA BSCOPE CLOUD CONFIDENCE DUTGE8GWZUM ELDORADO EMOTET EMOTETU FCNI FLJOZS GENCIRC GENETIC GHJPT HIGH HIGH CONFIDENCE JIAD KRYPTIK MALICIOUS PE MARIA MOCRT R263895 REDCAP SCORE SGENERIC SUSGEN UNSAFE URSNIF VA@81MMKI WARZONERAT 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee WarzoneRAT-FCNI!A14138C90076 20200422 6.0.6.653
Alibaba Trojan:Win32/Agentb.b5c3e978 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win64:Trojan-gen 20200420 18.4.3895.0
Tencent Malware.Win32.Gencirc.114b437a 20200422 1.0.0.1
Kingsoft 20200422 2013.8.14.323
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619805927.10675
GlobalMemoryStatusEx
success 1 0
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name WM_DSP
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619805932.32575
__exception__
stacktrace: 
a14138c90076a4cc36d859de2faabf81+0x3584 @ 0x10e3584
a14138c90076a4cc36d859de2faabf81+0x10c52 @ 0x10f0c52
a14138c90076a4cc36d859de2faabf81+0x13603 @ 0x10f3603
a14138c90076a4cc36d859de2faabf81+0x5b92 @ 0x10e5b92
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1701024
registers.edi: 1701136
registers.eax: 1701048
registers.ebp: 1701064
registers.edx: 45678592
registers.ebx: 1701256
registers.esi: 1701272
registers.ecx: 0
exception.instruction_r: 0f b7 01 66 89 02 41 41 42 42 66 85 c0 75 f1 c7
exception.symbol: lstrcpyW+0x16 IsBadStringPtrA-0x5b kernel32+0x33118
exception.instruction: movzx eax, word ptr [ecx]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 209176
exception.address: 0x76373118
success 0 0
行为判定
动态指标
Connects to a Dynamic DNS Domain (1 个事件)
domain www.thatd6whnhdyd56jd.duckdns.org
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619805991.498125
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00000000040e0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Foreign language identified in PE resource (1 个事件)
name WM_DSP language LANG_ENGLISH offset 0x0001f070 filetype PE32 executable (GUI) Intel 80386, for MS Windows sublanguage SUBLANG_ARABIC_QATAR size 0x00002c00
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\:Zone.Identifier
File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 个事件)
Bkav W32.AIDetectVM.malware
MicroWorld-eScan Generic.EmotetU.394B84FD
FireEye Generic.mg.a14138c90076a4cc
CAT-QuickHeal Trojan.Agentb
McAfee WarzoneRAT-FCNI!A14138C90076
Cylance Unsafe
Zillya Trojan.Agent.Win32.1203934
K7AntiVirus Trojan ( 0054d10e1 )
Alibaba Trojan:Win32/Agentb.b5c3e978
K7GW Trojan ( 0054d10e1 )
Cybereason malicious.90076a
Arcabit Generic.EmotetU.394B84FD
TrendMicro TrojanSpy.Win32.MOCRT.SM
BitDefenderTheta AI:Packer.844ABA311F
F-Prot W32/Kryptik.BKJ.gen!Eldorado
Symantec Trojan.Emotet
ESET-NOD32 a variant of Win32/Agent.TJS
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan.Win32.Agentb.jiad
BitDefender Generic.EmotetU.394B84FD
NANO-Antivirus Trojan.Win32.AntiAV.fljozs
Avast Win64:Trojan-gen
Tencent Malware.Win32.Gencirc.114b437a
Ad-Aware Generic.EmotetU.394B84FD
Sophos Troj/Mocrt-A
Comodo TrojWare.Win32.AntiAV.VA@81mmki
F-Secure Trojan.TR/RedCap.ghjpt
DrWeb Trojan.PWS.Maria.3
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
McAfee-GW-Edition BehavesLike.Win32.Dropper.ch
Trapmine malicious.high.ml.score
Emsisoft Generic.EmotetU.394B84FD (B)
Ikarus Trojan.Win32.AntiAV
Cyren W32/Kryptik.BKJ.gen!Eldorado
Jiangmin Trojan.Agentb.eab
eGambit Trojan.Generic
Avira TR/RedCap.ghjpt
Antiy-AVL Trojan/Win32.SGeneric
Microsoft Trojan:Win32/Ursnif.KDS!MTB
Endgame malicious (high confidence)
AegisLab Trojan.Win32.Agentb.4!c
AhnLab-V3 Trojan/Win32.RL_Agent.R263895
ZoneAlarm Trojan.Win32.Agentb.jiad
GData Generic.EmotetU.394B84FD
Acronis suspicious
VBA32 BScope.TrojanSpy.AveMaria
ALYac Spyware.Ursnif
MAX malware (ai score=100)
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-11-24 22:17:00

Imports

Library KERNEL32.dll:
• 0x414088 TerminateThread
• 0x41408c CreateThread
• 0x414090 WriteFile
• 0x414094 CreateFileW
• 0x414098 LoadLibraryW
• 0x41409c GetLocalTime
• 0x4140a0 GetCurrentThreadId
• 0x4140a4 GetCurrentProcessId
• 0x4140a8 ReadFile
• 0x4140ac FindFirstFileA
• 0x4140b0 GetBinaryTypeW
• 0x4140b4 FindNextFileA
• 0x4140b8 GetFullPathNameA
• 0x4140bc GetTempPathW
• 0x4140c4 CreateFileA
• 0x4140c8 GlobalAlloc
• 0x4140d4 LocalFree
• 0x4140d8 GetFileSize
• 0x4140dc FreeLibrary
• 0x4140e0 SetDllDirectoryW
• 0x4140e4 WaitForSingleObject
• 0x4140e8 CreateProcessW
• 0x4140ec GetCurrentProcess
• 0x4140f0 WriteProcessMemory
• 0x4140f4 OpenProcess
• 0x4140f8 VirtualProtectEx
• 0x4140fc VirtualAllocEx
• 0x414100 CreateRemoteThread
• 0x414104 GetModuleHandleW
• 0x414108 IsWow64Process
• 0x414110 CreatePipe
• 0x414114 PeekNamedPipe
• 0x414118 DuplicateHandle
• 0x41411c VirtualFree
• 0x414120 CreateEventA
• 0x414124 GetModuleFileNameW
• 0x414128 LoadResource
• 0x41412c FindResourceW
• 0x414130 GetComputerNameW
• 0x414134 VirtualQuery
• 0x414138 LoadLibraryExW
• 0x41413c FindFirstFileW
• 0x414140 FindNextFileW
• 0x414144 SetFilePointer
• 0x41414c DeleteFileW
• 0x414150 CopyFileW
• 0x414154 GetDriveTypeW
• 0x414168 CreateMutexA
• 0x41416c ReleaseMutex
• 0x414170 TerminateProcess
• 0x414178 Process32NextW
• 0x41417c Process32FirstW
• 0x414180 WinExec
• 0x414184 CreateProcessA
• 0x414188 HeapFree
• 0x41418c VirtualProtect
• 0x414190 GetSystemDirectoryW
• 0x414194 LockResource
• 0x41419c Process32First
• 0x4141a0 Process32Next
• 0x4141a8 GetTempPathA
• 0x4141ac GetStartupInfoA
• 0x4141b0 GetCommandLineA
• 0x4141b4 GetModuleHandleA
• 0x4141b8 ExitProcess
• 0x4141bc GetProcAddress
• 0x4141c0 LoadLibraryA
• 0x4141c4 GetProcessHeap
• 0x4141c8 HeapAlloc
• 0x4141cc lstrcmpW
• 0x4141d0 GetTickCount
• 0x4141d4 lstrcpyW
• 0x4141d8 WideCharToMultiByte
• 0x4141dc HeapReAlloc
• 0x4141e4 VirtualAlloc
• 0x4141e8 lstrcpyA
• 0x4141ec Sleep
• 0x4141f0 MultiByteToWideChar
• 0x4141f4 lstrcatA
• 0x4141f8 lstrcmpA
• 0x4141fc lstrlenA
• 0x414204 lstrlenW
• 0x414208 CloseHandle
• 0x41420c lstrcatW
• 0x414210 GetLastError
• 0x414214 SetLastError
• 0x414218 GetModuleFileNameA
• 0x41421c CreateDirectoryW
• 0x414220 SetEvent
• 0x414224 SizeofResource
Library USER32.dll:
• 0x414290 CreateDesktopW
• 0x414294 CharLowerW
• 0x414298 MessageBoxA
• 0x41429c GetKeyState
• 0x4142a0 GetMessageA
• 0x4142a4 DispatchMessageA
• 0x4142a8 CreateWindowExW
• 0x4142ac wsprintfW
• 0x4142b0 wsprintfA
• 0x4142b4 GetWindowTextW
• 0x4142b8 CallNextHookEx
• 0x4142bc GetAsyncKeyState
• 0x4142c0 RegisterClassW
• 0x4142c4 GetRawInputData
• 0x4142c8 TranslateMessage
• 0x4142cc DefWindowProcA
• 0x4142d4 GetForegroundWindow
• 0x4142d8 ToUnicode
• 0x4142dc GetKeyNameTextW
• 0x4142e0 PostQuitMessage
• 0x4142e4 MapVirtualKeyA
• 0x4142e8 GetLastInputInfo
Library ADVAPI32.dll:
• 0x414000 RegEnumKeyExW
• 0x414008 RegDeleteKeyA
• 0x41400c RegOpenKeyExA
• 0x414010 RegOpenKeyExW
• 0x414014 RegQueryValueExW
• 0x414018 RegQueryValueExA
• 0x41401c RegQueryInfoKeyW
• 0x414020 RegCloseKey
• 0x414024 OpenServiceW
• 0x41402c QueryServiceConfigW
• 0x414034 StartServiceW
• 0x414038 RegSetValueExW
• 0x41403c RegCreateKeyExA
• 0x414040 OpenSCManagerW
• 0x414044 CloseServiceHandle
• 0x414048 GetTokenInformation
• 0x41404c LookupAccountSidW
• 0x414050 FreeSid
• 0x414054 OpenProcessToken
• 0x414064 RegDeleteValueW
• 0x414068 RegSetValueExA
• 0x41406c RegCreateKeyExW
• 0x414070 RegDeleteKeyW
Library SHELL32.dll:
• 0x414248 SHGetFolderPathW
• 0x41424c ShellExecuteExA
• 0x414250 SHFileOperationW
• 0x414254 ShellExecuteExW
• 0x414258
• 0x414264 ShellExecuteW
Library urlmon.dll:
• 0x41434c URLDownloadToFileW
Library WS2_32.dll:
• 0x4142f0 WSAStartup
• 0x4142f4 shutdown
• 0x4142f8 closesocket
• 0x4142fc WSACleanup
• 0x414300 ioctlsocket
• 0x414304 ntohs
• 0x414308 gethostbyname
• 0x41430c inet_addr
• 0x414310 getaddrinfo
• 0x414314 setsockopt
• 0x414318 freeaddrinfo
• 0x41431c htons
• 0x414320 recv
• 0x414324 connect
• 0x414328 socket
• 0x41432c send
Library ole32.dll:
• 0x414338 CoUninitialize
• 0x41433c CoCreateInstance
• 0x414340 CoTaskMemFree
• 0x414344 CoInitialize
Library SHLWAPI.dll:
• 0x41426c StrStrW
• 0x414270 PathRemoveFileSpecA
• 0x414274 StrStrA
• 0x414278 PathFileExistsW
• 0x41427c PathFindExtensionW
• 0x414280 PathCombineA
• 0x414284 PathFindFileNameW
• 0x414288 AssocQueryStringW
Library NETAPI32.dll:
• 0x41422c NetUserAdd
Library OLEAUT32.dll:
• 0x414238 VariantInit
Library CRYPT32.dll:
• 0x414080 CryptUnprotectData
Library PSAPI.DLL:

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.