1.4
低危

068a23c64e4dbb828803cab2527d006f4a79107638a5773a6de55183c0a270d0

a3fa2a684537801be78f1cffe6c0720a.exe

分析耗时

8s

最近分析

文件大小

462.1KB
静态报毒 动态报毒 100% 3FI1GS AI SCORE=85 AIDETECTVM BEVV CLASSIC CM2@AW@NVLEI CONFIDENCE EHLS ELDORADO GENERICKD GENETIC GOZI GRAYWARE HDWA HIGH CONFIDENCE HLEPPL JQROW KRYPTIK LOHU MALCERT MALICIOUS PE MALWARE1 MALWARE@#G0EPHI3OTSEN QVM20 R + TROJ R339508 SCORE STATIC AI TROJANBANKER TROJANX URSNIF URSNIFDROPPER WACATAC ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Packed-GCB!A3FA2A684537 20201211 6.0.6.653
Alibaba TrojanBanker:Win32/Kryptik.19a98c0b 20190527 0.3.0.5
Avast Win32:TrojanX-gen [Trj] 20201210 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
Tencent Win32.Trojan-banker.Gozi.Lohu 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
行为判定
动态指标
网络通信
File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.Gozi.690
MicroWorld-eScan Trojan.GenericKD.33967952
FireEye Generic.mg.a3fa2a684537801b
McAfee Packed-GCB!A3FA2A684537
Zillya Trojan.Gozi.Win32.2840
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba TrojanBanker:Win32/Kryptik.19a98c0b
K7GW Riskware ( 0040eff71 )
Arcabit Trojan.Generic.D2064F50
BitDefenderTheta Gen:NN.ZexaF.34670.Cm2@aW@Nvlei
Cyren W32/Trojan.DZZ.gen!Eldorado
Symantec Packed.Generic.459
ESET-NOD32 a variant of Win32/Kryptik.HDWA
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Trojan-Banker.Win32.Gozi.pef
BitDefender Trojan.GenericKD.33967952
NANO-Antivirus Trojan.Win32.Gozi.hleppl
Paloalto generic.ml
AegisLab Trojan.Win32.Gozi.7!c
Rising Trojan.Kryptik!1.C778 (CLASSIC)
Ad-Aware Trojan.GenericKD.33967952
Emsisoft MalCert.A (A)
Comodo Malware@#g0ephi3otsen
F-Secure Trojan.TR/AD.UrsnifDropper.jqrow
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win32.Generic.gt
Sophos Mal/Generic-R + Troj/Agent-BEVV
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Banker.Gozi.aoy
Avira TR/AD.UrsnifDropper.jqrow
Antiy-AVL GrayWare/Win32.Kryptik.ehls
Gridinsoft Trojan.Win32.Kryptik.ba
Microsoft Trojan:Win32/Gozi.RA!MTB
ZoneAlarm HEUR:Trojan-Banker.Win32.Gozi.pef
GData Trojan.GenericKD.33967952
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Ursnif.R339508
VBA32 Trojan.Wacatac
MAX malware (ai score=85)
Malwarebytes Trojan.Ursnif
Tencent Win32.Trojan-banker.Gozi.Lohu
Yandex Trojan.Kryptik!3Fi1gS/gq/I
Ikarus Trojan.Win32.Crypt
Fortinet W32/Kryptik.DZZ!tr
AVG Win32:TrojanX-gen [Trj]
Panda Trj/Genetic.gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-06-05 00:49:55

Imports

Library KERNEL32.dll:
0x470b60 CloseHandle
0x470b64 lstrcpyA
0x470b68 lstrcatA
0x470b6c lstrlenA
0x470b70 GetModuleFileNameA
0x470b7c SearchPathA
0x470b80 GetFileAttributesA
0x470b84 GetLastError
0x470b88 CopyFileA
0x470b8c GetFileSize
0x470b90 LoadLibraryA
0x470b94 lstrcmpA
0x470b98 lstrcpynA
0x470b9c DeleteFileA
0x470ba0 TerminateProcess
0x470ba4 WaitForSingleObject
0x470ba8 GetExitCodeProcess
0x470bac CreateProcessA
0x470bb0 GetVersionExA
0x470bb4 GetModuleHandleA
0x470bb8 GetStartupInfoA
0x470bbc CreateFileA
0x470bc0 GetShortPathNameA
0x470bc4 GetTempFileNameA
0x470bc8 GetTempPathA
0x470bcc CreateDirectoryA
0x470bd0 GetProcAddress
0x470bd4 FreeLibrary
0x470bdc MoveFileExA
0x470be4 IsDebuggerPresent
0x470bec HeapDestroy
0x470bf0 SetFileTime
0x470bf4 _llseek
0x470bfc CreateHardLinkA
0x470c00 WriteProcessMemory
0x470c08 QueueUserAPC
0x470c0c GetOEMCP
0x470c10 HeapCreate
0x470c14 MoveFileA
0x470c1c SetWaitableTimer
0x470c24 Sleep
0x470c28 SetFilePointerEx
0x470c2c Process32Next
0x470c30 SetConsoleMode
0x470c34 VirtualAlloc
Library USER32.dll:
0x470c3c wsprintfA
0x470c40 MessageBoxA
0x470c44 LoadIconA
0x470c48 GetSystemMetrics
0x470c4c EnableWindow
0x470c50 IsIconic
0x470c54 GetClientRect
0x470c58 SendMessageA
0x470c5c DrawIcon
0x470c60 PackDDElParam
0x470c64 OpenIcon
0x470c68 OemToCharW
0x470c6c EditWndProc
0x470c70 CallWindowProcA
0x470c74 IntersectRect
0x470c78 EnumWindowStationsA
0x470c7c ToUnicode
0x470c80 EnumPropsW
0x470c84 LoadIconW
0x470c88 GetThreadDesktop
0x470c8c GetDialogBaseUnits
0x470c90 LoadCursorFromFileA
0x470c94 CharUpperW
0x470c98 DestroyCursor
0x470c9c VkKeyScanA
0x470ca0 DestroyMenu
0x470ca4 CharUpperA
0x470ca8 DrawMenuBar
0x470cac LoadCursorFromFileW
0x470cb0 GetListBoxInfo
0x470cb4 GetMenuItemCount
0x470cb8 IsWindow
0x470cbc WindowFromDC
Library GDI32.dll:
0x470cc4 GetEnhMetaFileA
0x470cc8 CreateMetaFileA
0x470ccc SwapBuffers
0x470cd0 GetSystemPaletteUse
0x470cd4 FillPath
0x470cd8 GetMapMode
0x470cdc CloseMetaFile
0x470ce0 UpdateColors
0x470ce4 CancelDC
0x470ce8 GetTextAlign
0x470cec GetLayout
0x470cf0 RealizePalette
Library ADVAPI32.dll:
0x470cf8 RegSetValueExA
0x470cfc RegEnumKeyA
0x470d00 RegOpenKeyExA
0x470d04 RegCloseKey
0x470d08 RegQueryValueExA
0x470d0c RegCreateKeyExA
0x470d10 RegQueryValueExW
0x470d14 GetUserNameA
Library SHELL32.dll:
0x470d1c ShellExecuteExA
0x470d20 SHGetFolderPathA
0x470d28 ShellExecuteA
Library ole32.dll:
0x470d30 CoCreateInstance
0x470d34 CLSIDFromProgID

Hosts

No hosts contacted.

DNS

No domains contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.