5.4
中危
14 个模型检测该样本为恶意！
重新分析
更多

b9b11c1b3b66698ea555261af1bd073f69da0ceb0ba475ab8efa5012eeabf430

a4b3083c99612fea8d180c6d12e9f89a.exe

分析耗时

138s

最近分析

文件大小

1.4MB
静态报毒 动态报毒 FILEREPMALWARE HGIASOCA JGHCN MALICIOUS REMOTEADMIN TABYIRYOEU0 UNSAFE WINVNC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20210402 6.0.6.653
Alibaba RiskWare:Win32/WinVNC.e49dfe29 20190527 0.3.0.5
CrowdStrike 20210203 1.0
Avast FileRepMalware [PUP] 20210402 21.1.5827.0
Tencent 20210403 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20210403 2017.9.26.565
静态指标
Queries for the computername (4 个事件)
Time & API Arguments Status Return Repeated
1620808767.296875
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1620808767.734875
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1620822784.686271
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1620822785.108271
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (4 个事件)
Time & API Arguments Status Return Repeated
1620823210.558375
IsDebuggerPresent
failed 0 0
1620823210.573375
IsDebuggerPresent
failed 0 0
1620823210.66775
IsDebuggerPresent
failed 0 0
1620823210.66775
IsDebuggerPresent
failed 0 0
This executable has a PDB path (1 个事件)
pdb_path d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620823210.605375
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (20 个事件)
Time & API Arguments Status Return Repeated
1620808765.609875
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x745e1000
success 0 0
1620808765.750875
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x747a1000
success 0 0
1620808767.062875
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a11000
success 0 0
1620808767.062875
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766c1000
success 0 0
1620808767.062875
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77691000
success 0 0
1620808767.234875
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74571000
success 0 0
1620808767.265875
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e81000
success 0 0
1620808767.265875
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75841000
success 0 0
1620808767.296875
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74561000
success 0 0
1620822846.186271
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000002790000
success 0 0
1620823210.558375
NtProtectVirtualMemory
process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75380000
success 0 0
1620823210.605375
NtProtectVirtualMemory
process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a11000
success 0 0
1620823210.605375
NtProtectVirtualMemory
process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766c1000
success 0 0
1620823210.605375
NtProtectVirtualMemory
process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77691000
success 0 0
1620823210.620375
NtProtectVirtualMemory
process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x747a1000
success 0 0
1620823210.66775
NtProtectVirtualMemory
process_identifier: 624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75380000
success 0 0
1620823210.69875
NtProtectVirtualMemory
process_identifier: 624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x747a1000
success 0 0
1620823210.71475
NtProtectVirtualMemory
process_identifier: 624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a11000
success 0 0
1620823210.71475
NtProtectVirtualMemory
process_identifier: 624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766c1000
success 0 0
1620823210.71475
NtProtectVirtualMemory
process_identifier: 624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77691000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1620822786.467271
GetDiskFreeSpaceExW
root_path: C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Explorer
free_bytes_available: 19577110528
total_number_of_free_bytes: 0
total_number_of_bytes: 0
success 1 0
Creates executable files on the filesystem (14 个事件)
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\ldapauth.dll
file C:\Users\Administrator.Oskar-PC\Desktop\Fernwartung Eickmann Computer.lnk
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\winvnc.exe
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\VNCscAI.exe
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\authSSP.dll
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\workgrpdomnt4.dll
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\authadmin.dll
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\logging.dll
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\cad.exe
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\uvnc_settings.exe
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\vnchooks.dll
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\unzip32.dll
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\zip32.dll
file C:\Program Files (x86)\Eickmann Computer\Fernwartung\logmessages.dll
Creates a shortcut to an executable file (2 个事件)
file C:\Users\Administrator.Oskar-PC\Desktop\Fernwartung Eickmann Computer.lnk
file C:\Users\Public\Desktop\Google Chrome.lnk
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 172.217.24.14
host 203.208.41.65
host 203.208.41.66
File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 个事件)
Qihoo-360 Win32/Trojan.Generic.HgIASOcA
Malwarebytes Malware.Heuristic.1003
Alibaba RiskWare:Win32/WinVNC.e49dfe29
APEX Malicious
Avast FileRepMalware [PUP]
ClamAV Win.Trojan.Agent-354736
Kaspersky not-a-virus:RemoteAdmin.Win32.WinVNC.agp
NANO-Antivirus Riskware.Win32.WinVNC.jghcn
Paloalto generic.ml
Jiangmin RemoteAdmin.WinVNC.lp
AegisLab Riskware.Win32.WinVNC.1!c
Cylance Unsafe
Yandex Riskware.RemoteAdmin!TabyiRyoeU0
AVG FileRepMalware [PUP]
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 216.58.200.46:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2011-01-09 01:14:25

Imports

Library COMCTL32.dll:
• 0x413030
Library SHLWAPI.dll:
• 0x4131bc SHAutoComplete
Library KERNEL32.dll:
• 0x41306c DeleteFileW
• 0x413070 DeleteFileA
• 0x413074 CreateDirectoryA
• 0x413078 CreateDirectoryW
• 0x41307c FindClose
• 0x413080 FindNextFileA
• 0x413084 FindFirstFileA
• 0x413088 FindNextFileW
• 0x41308c FindFirstFileW
• 0x413090 GetTickCount
• 0x413094 WideCharToMultiByte
• 0x413098 GlobalAlloc
• 0x41309c GetVersionExW
• 0x4130a0 GetFullPathNameA
• 0x4130a4 GetFullPathNameW
• 0x4130a8 GetModuleFileNameW
• 0x4130ac FindResourceW
• 0x4130b0 GetModuleHandleW
• 0x4130b4 HeapAlloc
• 0x4130b8 GetProcessHeap
• 0x4130bc HeapFree
• 0x4130c0 HeapReAlloc
• 0x4130c4 CompareStringA
• 0x4130c8 ExitProcess
• 0x4130cc GetLocaleInfoW
• 0x4130d0 GetNumberFormatW
• 0x4130d4 SetFileAttributesW
• 0x4130d8 GetDateFormatW
• 0x4130dc GetTimeFormatW
• 0x4130ec WaitForSingleObject
• 0x4130f0 Sleep
• 0x4130f4 GetTempPathW
• 0x4130f8 MoveFileExW
• 0x4130fc UnmapViewOfFile
• 0x413100 GetCommandLineW
• 0x413104 MapViewOfFile
• 0x413108 CreateFileMappingW
• 0x41310c OpenFileMappingW
• 0x413114 GetProcAddress
• 0x413120 GetSystemTime
• 0x413124 MultiByteToWideChar
• 0x413128 CompareStringW
• 0x41312c IsDBCSLeadByte
• 0x413130 GetCPInfo
• 0x413138 LoadLibraryW
• 0x41313c FreeLibrary
• 0x413140 SetFileAttributesA
• 0x413144 GetFileAttributesW
• 0x413148 GetFileAttributesA
• 0x41314c WriteFile
• 0x413150 GetStdHandle
• 0x413154 ReadFile
• 0x41315c CreateFileW
• 0x413160 CreateFileA
• 0x413164 GetFileType
• 0x413168 SetEndOfFile
• 0x41316c SetFilePointer
• 0x413170 MoveFileW
• 0x413174 SetFileTime
• 0x413178 GetCurrentProcess
• 0x41317c CloseHandle
• 0x413180 SetLastError
• 0x413184 GetLastError
Library USER32.dll:
• 0x4131c4 wvsprintfW
• 0x4131c8 ReleaseDC
• 0x4131cc GetDC
• 0x4131d0 SendMessageW
• 0x4131d4 SetDlgItemTextW
• 0x4131d8 SetFocus
• 0x4131dc EndDialog
• 0x4131e0 DestroyIcon
• 0x4131e4 SendDlgItemMessageW
• 0x4131e8 GetDlgItemTextW
• 0x4131ec GetClassNameW
• 0x4131f0 DialogBoxParamW
• 0x4131f4 IsWindowVisible
• 0x4131f8 WaitForInputIdle
• 0x4131fc SetForegroundWindow
• 0x413200 GetSysColor
• 0x413204 PostMessageW
• 0x413208 LoadBitmapW
• 0x41320c LoadIconW
• 0x413210 CharToOemA
• 0x413214 OemToCharA
• 0x413218 FindWindowExW
• 0x41321c wvsprintfA
• 0x413220 GetParent
• 0x413224 MapWindowPoints
• 0x413228 CreateWindowExW
• 0x41322c UpdateWindow
• 0x413230 SetWindowTextW
• 0x413234 LoadCursorW
• 0x413238 RegisterClassExW
• 0x41323c SetWindowLongW
• 0x413240 GetWindowLongW
• 0x413244 DefWindowProcW
• 0x413248 PeekMessageW
• 0x41324c GetMessageW
• 0x413250 TranslateMessage
• 0x413254 DispatchMessageW
• 0x413258 DestroyWindow
• 0x41325c GetClientRect
• 0x413260 IsWindow
• 0x413264 CharToOemBuffW
• 0x413268 MessageBoxW
• 0x41326c ShowWindow
• 0x413270 GetDlgItem
• 0x413274 EnableWindow
• 0x413278 OemToCharBuffA
• 0x41327c CharUpperA
• 0x413280 CharToOemBuffA
• 0x413284 LoadStringW
• 0x413288 SetWindowPos
• 0x41328c GetWindowTextW
• 0x413290 GetSystemMetrics
• 0x413294 GetWindow
• 0x413298 CharUpperW
• 0x41329c GetWindowRect
• 0x4132a0 CopyRect
Library GDI32.dll:
• 0x413048 GetDeviceCaps
• 0x41304c GetObjectW
• 0x413054 SelectObject
• 0x413058 StretchBlt
• 0x41305c CreateCompatibleDC
• 0x413060 DeleteObject
• 0x413064 DeleteDC
Library COMDLG32.dll:
• 0x413038 GetOpenFileNameW
• 0x413040 GetSaveFileNameW
Library ADVAPI32.dll:
• 0x413000 RegOpenKeyExW
• 0x413008 OpenProcessToken
• 0x41300c RegQueryValueExW
• 0x413010 RegCreateKeyExW
• 0x413014 RegSetValueExW
• 0x413018 RegCloseKey
• 0x41301c SetFileSecurityW
• 0x413020 SetFileSecurityA
Library SHELL32.dll:
• 0x413198 SHChangeNotify
• 0x41319c ShellExecuteExW
• 0x4131a0 SHFileOperationW
• 0x4131a4 SHGetFileInfoW
• 0x4131ac SHGetMalloc
• 0x4131b0 SHBrowseForFolderW
Library ole32.dll:
• 0x4132ac OleInitialize
• 0x4132b0 CoCreateInstance
• 0x4132b4 OleUninitialize
• 0x4132b8 CLSIDFromString
Library OLEAUT32.dll:
• 0x413190 VariantInit

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57236 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.