1.5
低危
DACN
0.14
FACILE
1.00
IMCLNet
0.50
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:AutoRun-BIR [Trj] | 20200310 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_60% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200310 | 2013.8.14.323 |
| McAfee | GenericRXHR-CH!A2ACD170A2E1 | 20200309 | 6.0.6.653 |
| Tencent | None | 20200310 | 1.0.0.1 |
静态指标
检查进程是否被调试器调试
(1 个事件)
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机
(8 个事件)
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(40 个事件)
检查系统上可疑权限的本地唯一标识符
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(3 个事件)
| host | 185.27.134.11 | |||
| host | 114.114.114.114 | |||
| host | 209.202.252.54 | |||
文件已被 VirusTotal 上 47 个反病毒引擎识别为恶意
(47 个事件)
| ALYac | Trojan.MSIL.Agent.DWG |
| APEX | Malicious |
| AVG | Win32:AutoRun-BIR [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.MSIL.Agent.DWG |
| AhnLab-V3 | Malware/Win32.RL_Generic.R276708 |
| Antiy-AVL | Trojan/Win32.Tiggre |
| Arcabit | Trojan.MSIL.Agent.DWG |
| Avast | Win32:AutoRun-BIR [Trj] |
| Avira | HEUR/AGEN.1042448 |
| BitDefender | Trojan.MSIL.Agent.DWG |
| BitDefenderTheta | Gen:NN.ZemsilF.34098.aiW@aK@31mc |
| CrowdStrike | win/malicious_confidence_60% (D) |
| Cybereason | malicious.23b871 |
| Cylance | Unsafe |
| Cyren | W32/MSIL_Agent.HH.gen!Eldorado |
| DrWeb | Trojan.Starter.7904 |
| ESET-NOD32 | a variant of MSIL/Agent.SSG |
| Emsisoft | Trojan.MSIL.Agent.DWG (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/MSIL_Agent.HH.gen!Eldorado |
| F-Secure | Heuristic.HEUR/AGEN.1042448 |
| FireEye | Generic.mg.a2acd170a2e1d4d3 |
| Fortinet | MSIL/Agent.SSG!tr |
| GData | Trojan.MSIL.Agent.DWG |
| Ikarus | Trojan.MSIL.Agent |
| Invincea | heuristic |
| K7AntiVirus | Trojan ( 00555da91 ) |
| K7GW | Trojan ( 00555da91 ) |
| Kaspersky | HEUR:Trojan.MSIL.Stuste.a |
| MAX | malware (ai score=86) |
| Malwarebytes | Trojan.Crypt |
| McAfee | GenericRXHR-CH!A2ACD170A2E1 |
| McAfee-GW-Edition | BehavesLike.Win32.Trojan.xm |
| MicroWorld-eScan | Trojan.MSIL.Agent.DWG |
| Microsoft | Trojan:Win32/DxmStrt.J!ibt |
| Qihoo-360 | HEUR/QVM03.0.C905.Malware.Gen |
| Rising | Trojan.Agent!8.B1E (TFE:C:857EHfdbsWM) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Symantec | ML.Attribute.HighConfidence |
| Trapmine | malicious.moderate.ml.score |
| VBA32 | CIL.StupidStealth.Heur |
| Yandex | Trojan.Agent!Sml9JIUsHgw |
| Zillya | Trojan.Agent.Win32.1016065 |
| ZoneAlarm | HEUR:Trojan.MSIL.Stuste.a |
| eGambit | Unsafe.AI_Score_99% |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2020-03-10 22:28:25
PE Imphash
f34d5f2d4577ed6d9ceec516c1f5a744
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00002000 | 0x00001af4 | 0x00001c00 | 5.445161835379115 |
| .reloc | 0x00004000 | 0x0000000c | 0x00000200 | 0.08153941234324169 |
Imports
Library mscoree.dll:
• 0x402000 _CorExeMain
L!This program cannot be run in DOS mode.
`.reloc
v2.0.50727
#Strings
<Module>
System.Reflection
AssemblyCopyrightAttribute
AssemblyDescriptionAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
AssemblyProductAttribute
AssemblyCompanyAttribute
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
AssemblyFileVersionAttribute
System.Runtime.InteropServices
GuidAttribute
ComVisibleAttribute
Microsoft.VisualBasic.ApplicationServices
ConsoleApplicationBase
System.ComponentModel
EditorBrowsableAttribute
EditorBrowsableState
System.CodeDom.Compiler
GeneratedCodeAttribute
System.Diagnostics
DebuggerNonUserCodeAttribute
Microsoft.VisualBasic.Devices
Computer
DebuggerHiddenAttribute
System
Object
Microsoft.VisualBasic
HideModuleNameAttribute
Microsoft.VisualBasic.CompilerServices
StandardModuleAttribute
MyGroupCollectionAttribute
RuntimeHelpers
GetObjectValue
Equals
GetHashCode
RuntimeTypeHandle
GetTypeFromHandle
ToString
Activator
CreateInstance
ThreadStaticAttribute
CompilerGeneratedAttribute
m_ThreadStaticValue
get_GetInstance
System.ComponentModel.Design
HelpKeywordAttribute
STAThreadAttribute
Process
Win32Exception
GetProcessesByName
ProcessModuleCollection
get_Modules
ProcessModule
get_Item
get_FileName
ProjectData
Exception
SetProjectError
MsgBoxResult
Interaction
MsgBoxStyle
MsgBox
ClearProjectError
Conversions
ToInteger
System.Threading
Thread
ProcessStartInfo
set_FileName
System.Resources
ResourceManager
System.Globalization
CultureInfo
ReferenceEquals
Assembly
get_Assembly
System.Configuration
ApplicationSettingsBase
SettingsBase
Synchronized
svchost.exe
mscorlib
MyApplication
svchost.My
MyComputer
MyProject
MyWebServices
ThreadSafeObjectProvider`1
kwreT_dsiwe_er
svchost
AntiTaskManagerKill
Resources
svchost.My.Resources
MySettings
MySettingsProperty
m_ComputerObjectProvider
m_AppObjectProvider
m_UserObjectProvider
m_MyWebServicesObjectProvider
.cctor
get_Computer
get_Application
get_User
get_WebServices
GetType
Create__Instance__
instance
Dispose__Instance__
PRO_Name
ProList
GetPro
CheckRun
resourceMan
resourceCulture
get_ResourceManager
get_Culture
set_Culture
defaultInstance
get_Default
get_Settings
Application
WebServices
GetInstance
Culture
Default
Settings
svchost.Resources.resources
MyTemplate
8.0.0.0
4System.Web.Services.Protocols.SoapHttpClientProtocol
Create__Instance__
Dispose__Instance__
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
11.0.0.0
My.Computer
My.Application
My.User
My.WebServices
My.Settings
Copyright
2014
svchost
WrapNonExceptionThrows
1.0.0.0
$6110692e-f532-4c69-8751-27f9b4d3fa6e
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
_CorExeMain
mscoree.dll
A O Z b i p w
s v c h o s t . R e s o u r c e s
Process Tree
- 0af1f605d8cb98b7aef25d3a1df797ac1bfe2fe7d0431dce61aed835a97b241e.exe (2236) "C:\Users\Administrator\AppData\Local\Temp\0af1f605d8cb98b7aef25d3a1df797ac1bfe2fe7d0431dce61aed835a97b241e.exe"
Hosts
| IP |
|---|
| 185.27.134.11 |
| 114.114.114.114 |
| 209.202.252.54 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 185.27.134.11 | 21 | 192.168.56.101 | 49171 |
| 209.202.252.54 | 21 | 192.168.56.101 | 49169 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.