0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.57
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20190901 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20190901 | 2013.8.14.323 |
| McAfee | Downloader-FSH | 20190901 | 6.0.6.653 |
| Tencent | None | 20190901 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意
(50 out of 61 个事件)
| ALYac | Trojan.GenericKD.1513778 |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1513778 |
| AhnLab-V3 | Trojan/Win32.Waski.C255063 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Generic.D171932 |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | TR/Yarwi.B.148 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.GenericKD.1513778 |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| CMC | Trojan.Win32.Bublik!O |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.Yarwi.BVKF@56wjbi |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.b64c9f |
| Cylance | Unsafe |
| Cyren | W32/Trojan.QKFH-5369 |
| DrWeb | Trojan.DownLoad3.31534 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.GenericKD.1513778 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.HGT |
| F-Secure | Trojan.TR/Yarwi.B.148 |
| FireEye | Generic.mg.a4b6d69b64c9f336 |
| Fortinet | W32/Kryptik.BTNV!tr |
| GData | Trojan.GenericKD.1513778 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| K7AntiVirus | Trojan-Downloader ( 0040f7f11 ) |
| K7GW | Trojan-Downloader ( 0040f7f11 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Lionic | Trojan.Win32.Generic.m01v |
| MAX | malware (ai score=85) |
| Malwarebytes | Trojan.Upatre |
| McAfee | Downloader-FSH |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.lm |
| MicroWorld-eScan | Trojan.GenericKD.1513778 |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.DownLoad3.csuaus |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM20.1.9643.Malware.Gen |
| Rising | Trojan.DL.Win32.Upatre.axl (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Yarwi |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Upatre-E |
| Symantec | Downloader.Upatre |
| TACHYON | Trojan/W32.Shutdown |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2012-04-15 16:40:24
PE Imphash
027c8da71649e190289924ac24ae7f72
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000e8d | 0x00001000 | 6.6131957380482245 |
| .data | 0x00002000 | 0x00000604 | 0x00000800 | 4.376523428514758 |
| .rsrc | 0x00003000 | 0x00001c58 | 0x00001e00 | 5.525420294697229 |
| .reloc | 0x00005000 | 0x000000a2 | 0x00000200 | 1.4443864026665771 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00003238 | 0x00001a08 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00004c40 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000030f0 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x602018 GetMessageW
• 0x60201c TranslateMessage
• 0x602020 DispatchMessageW
• 0x602024 SendMessageW
• 0x602028 MoveWindow
• 0x60202c BeginPaint
• 0x602030 EndPaint
• 0x602034 GetClientRect
• 0x602038 PostQuitMessage
• 0x60203c CreateWindowExW
• 0x602040 RegisterClassExW
• 0x602044 ReleaseDC
• 0x602048 GetDC
• 0x60204c DefWindowProcW
• 0x602050 DrawTextExW
Library GDI32.dll:
• 0x602000 GetStockObject
L!This program cannot be run in DOS mode.
`.data
@.reloc
``` ``
@uH ` `
`` ``
%3GGGG
P3PPPUR
MQ3PPPUR
[uSPAVWAf9
GGEGGEM;r
FG3@_^]
!UJTU`;cvg&%N'g1
}vgxNU
2cvg;.XFw
1&X'w6
MUs6cvg;.YB
ODa1bz}:/
XRa6c}g&$
DW{-4Z}18
rS},cgg
Q+57bm!B`
:fxI;f*yItng76GCl
Y='JGg
:q,N2:
47$GZj4Z
(BMzcy
M TJLI<p^v7,3@FCp!:
EmARaFc
B_O!I`"kMzBcy
> '*?'
@F#6RJ
"+7rYzBcy
Z7bUq`
pNh"uECQ
hWpnG^C&
TJL)<x
kffa:Q2]gR
6(V; RV
KTJYS`l
$/ITv-
|f09E'}0
IuX[_[+S
` ` `
# ?:JH)
DrawTextExW
ReleaseDC
RegisterClassExW
CreateWindowExW
MoveWindow
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
DefWindowProcW
BeginPaint
EndPaint
GetClientRect
PostQuitMessage
USER32.dll
GetStartupInfoA
CreateFileW
GetModuleHandleW
KERNEL32.dll
GetStockObject
GDI32.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
42'%|EB
,*OI91?<
^X?;to$"A@
`[IFXS
rk#!98
((JIkd
c\B@?>A@SR
C<$#vmHAEDIG_Wz
+(`Za[!
&$76@?RP
wquoys
,*a\0/;;
20VO4.'%
)&<8zx
650.BA
o-(y-(y-(y-(y-(y-(y-(y-(z-(y-(y-(y-(y-(y-(y.)y/*y.*y-(y-(y-(y-(y.+xTT
)"+$* #
8.@<+"$
jc>93,c[+
;.>:-#)
zzz}||
;.ZWIH* =6+
=0A9\SKK2(_X- <0CA4(.!+
, , , , , (
>1]WJI]W
/!>1=:-!- ,
, , , , (
0 , . . . . . *
</tk@7
>0UI/ - . . . . *
3!. / / / / / . . ;-=/<-2#. ;,=/<-/ -
. ;-=/;-2$. . / / / / ,
3"0"1#1#1#1#1#1#1"- ,
/ 0 / -
/ 0 0 0 0 0 0 ,
='F5H7H7H7H7H7H7H6H7L?L?L?L?L?L?L?L?L?L?L?L?L?L?L?L?L?L?L?M?H<OH
3 3C3H3O3Z3b3p333
454:4A4F4V4`4f444]6i6y6~66
.32363:3>3B3F3
k o v i c e
s t a t i c
b u t t o n
C : \ D O C U M E ~ 1 \ O R D E R D ~ 1 \ L O C A L S ~ 1 \ T e m p \ T e m p o r a r y D i r e c t o r y 1 f o r S c a n _ 0 0 1 _ 7 9 8 - 4 8 3 - 7 7 5 7 . z i p \ S c a n _ 0 0 1 _ 2 3 0 1 2 0 1 4 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ R 6 u F S M X 2 w . e x e
C : \ B 1 Q i 6 S B z . e x e
C : \ D y 5 E x G l f . e x e
C : \ w Y o e o b 2 U . e x e
C : \ 8 d U a 7 m A f . e x e
C : \ e 8 1 1 6 9 e a d 2 2 c 2 5 e f a 3 4 8 c d a 9 c 5 6 9 2 5 b 9 6 8 1 b a 8 0 5 d 0 d b 6 2 2 3 d f 9 d 0 4 2 6 8 7 3 3 5 b 4 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ a 0 0 4 9 a 3 8 1 6 7 2 c 6 5 e 8 6 1 2 9 b e d d 3 8 b 5 9 6 7 4 9 6 b b 4 5 e 7 f 6 8 1 1 5 8 b 1 b 1 1 d 1 1 9 7 5 c b 0 0 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 2 2 5 9 7 d c 0 a 3 9 a c d c 7 6 c 7 d 4 6 0 e 3 0 d 1 9 a 7 b d f d 1 3 d 9 f 1 a 9 a a d 9 e f 7 c d 8 0 0 7 3 4 9 9 1 d d a
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 5 4 e 1 6 e f 6 0 1 e d 3 6 b 4 d 0 6 5 5 8 2 3 c 2 8 8 5 1 f 7 d 6 6 5 c 6 e d 6 9 4 d c b 4 c 3 3 a b e 5 2 5 c 9 9 1 7 1 6 e . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.