3.3
中危
63 个模型检测该样本为恶意！
重新分析
更多

0e769692635faee303234c4c5ad09be7d92a92188c5e205d495424fa299fdedd

0e769692635faee303234c4c5ad09be7d92a92188c5e205d495424fa299fdedd.exe

分析耗时

276s

最近分析

378天前

文件大小

26.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER UPATRE
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.63
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Agent-ASIE [Trj] 20190902 18.4.3895.0
Baidu Win32.Trojan.Kryptik.mp 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20190903 2013.8.14.323
McAfee Cutwail-FDGO!A5472FD9B43B 20190902 6.0.6.653
Tencent None 20190903 1.0.0.1
静态指标
检查进程是否被调试器调试 (2 个事件)
Time & API Arguments Status Return Repeated
1727545346.344
IsDebuggerPresent
failed 0 0
1727545346.87525
IsDebuggerPresent
failed 0 0
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报） (2 个事件)
section .code
section .data2
行为判定
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压） (6 个事件)
Time & API Arguments Status Return Repeated
1727545346.344
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01d10000
region_size: 659456
allocation_type: 8192 (MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1932
success 0 0
1727545346.344
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01db0000
region_size: 4096
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1932
success 0 0
1727545346.547
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x033a0000
region_size: 4194304
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1932
success 0 0
1727545346.87525
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01e30000
region_size: 1642496
allocation_type: 8192 (MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 600
success 0 0
1727545346.87525
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01fc0000
region_size: 4096
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 600
success 0 0
1727545347.03125
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x033a0000
region_size: 4194304
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 600
success 0 0
在文件系统上创建可执行文件 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\budha.exe
投放一个二进制文件并执行它 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\budha.exe
将可执行文件投放到用户的 AppData 文件夹 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\budha.exe
一个进程创建了一个隐藏窗口 (1 个事件)
Time & API Arguments Status Return Repeated
1727545346.703
ShellExecuteExW
filepath: C:\Users\Administrator\AppData\Local\Temp\budha.exe
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\budha.exe
parameters:
show_type: 0
success 1 0
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (3 个事件)
section {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00000b87', 'size_of_data': '0x00000c00', 'entropy': 7.036679504031242} entropy 7.036679504031242 description 发现高熵的节
section {'name': '.data', 'virtual_address': '0x00003000', 'virtual_size': '0x00000783', 'size_of_data': '0x00000800', 'entropy': 7.010863259250356} entropy 7.010863259250356 description 发现高熵的节
entropy 0.24390243902439024 description 此PE文件的整体熵值较高
网络通信
一个或多个缓冲区包含嵌入的PE文件 (1 个事件)
buffer Buffer with sha1: 319c68089b64de04bc8ea6b429b70ab602a5fd55
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
连接到不再响应请求的 IP 地址（合法服务通常会保持运行） (1 个事件)
dead_host 160.153.129.225:443
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意 (50 out of 63 个事件)
ALYac Trojan.GenericKD.1408734
APEX Malicious
AVG Win32:Agent-ASIE [Trj]
Acronis suspicious
Ad-Aware Trojan.GenericKD.1408734
AhnLab-V3 Trojan/Win32.Zbot.R88085
Antiy-AVL Trojan/Win32.Bublik
Arcabit Trojan.Generic.D157EDE
Avast Win32:Agent-ASIE [Trj]
Avira TR/Dldr.Upatre.xrvae
Baidu Win32.Trojan.Kryptik.mp
BitDefender Trojan.GenericKD.1408734
Bkav W32.FamVT.GeND.Trojan
CAT-QuickHeal TrojanDownloader.Upatre.A6
CMC Trojan.Win32.Bublik!O
ClamAV Win.Downloader.Upatre-5744087-0
Comodo TrojWare.Win32.Kryptik.BOZ@546pmn
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.9b43b1
Cylance Unsafe
Cyren W32/Trojan.XJXP-3663
DrWeb Trojan.DownLoad3.28161
ESET-NOD32 Win32/TrojanDownloader.Small.AAB
Emsisoft Trojan.GenericKD.1408734 (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.GNN
FireEye Generic.mg.a5472fd9b43b14ea
Fortinet W32/Small.AAB!tr.dldr
GData Trojan.GenericKD.1408734
Ikarus Trojan.Win32.Badur
Invincea heuristic
Jiangmin Trojan/Bublik.hei
K7AntiVirus Trojan ( 0001140e1 )
K7GW Trojan ( 0001140e1 )
Kaspersky HEUR:Trojan.Win32.Generic
Lionic Trojan.Win32.Generic.lXEV
MAX malware (ai score=88)
Malwarebytes Trojan.Dropper
McAfee Cutwail-FDGO!A5472FD9B43B
McAfee-GW-Edition BehavesLike.Win32.Cutwail.mm
MicroWorld-eScan Trojan.GenericKD.1408734
Microsoft TrojanDownloader:Win32/Upatre.A
NANO-Antivirus Trojan.Win32.Bublik.cqjsvf
Panda Generic Malware
Qihoo-360 HEUR/QVM19.1.A1EF.Malware.Gen
Rising Trojan.Waski!1.A489 (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Dropper
SentinelOne DFI - Malicious PE
Sophos Troj/Agent-AEUD
Symantec Trojan.Zbot
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2004-09-03 14:08:25

PE Imphash

39b2903b7498188e4955572bbeb0f3fe

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00000b87 0x00000c00 7.036679504031242
.code 0x00002000 0x0000004b 0x00000200 0.9732653088455998
.data 0x00003000 0x00000783 0x00000800 7.010863259250356
.data2 0x00004000 0x00001028 0x00001200 3.8255007419478235
.idata 0x00006000 0x00000570 0x00000600 4.048733903394875
.rsrc 0x00007000 0x0000229c 0x00002400 3.892074160031929

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00007130 0x00001ca8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_ICON 0x00008dd8 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_VERSION 0x00008dec 0x0000031c LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_MANIFEST 0x00009108 0x00000193 LANG_NEUTRAL SUBLANG_NEUTRAL None

Imports

Library user32.dll:
• 0x40618c GetMessageA
• 0x406190 DefWindowProcA
• 0x406194 PostQuitMessage
• 0x406198 GetDoubleClickTime
• 0x40619c UpdateWindow
• 0x4061a0 GetQueueStatus
• 0x4061a4 LoadIconA
• 0x4061a8 RegisterClassA
Library GDI32.dll:
• 0x406300 CreateBitmap
• 0x406304 IntersectClipRect
• 0x406308 ExcludeClipRect
• 0x40630c UpdateColors
• 0x406314 CreateCompatibleDC
• 0x406318 DeleteObject
• 0x40631c TextOutA
• 0x406320 SetBkColor
• 0x406324 SetTextColor
• 0x406328 Rectangle
• 0x40632c CreateSolidBrush
• 0x406330 GetStockObject
• 0x406334 CreateFontIndirectA
• 0x40633c GetTextMetricsA
• 0x406340 CreateFontA
• 0x406344 RealizePalette
Library Msacm32.dll:
• 0x406520 acmDriverID
• 0x406524 acmStreamOpen
Library ADVAPI32.dll:
• 0x406250 RegQueryValueExA
• 0x406254 RegOpenKeyA
• 0x406258 GetUserNameA
• 0x40625c CopySid
• 0x406260 GetLengthSid
Library IMM32.dll:
• 0x4064a8 ImmGetContext
Library kernel32.dll:
• 0x4060f0 GetModuleHandleA
• 0x4060f4 GetProcAddress
• 0x4060f8 HeapCreate
• 0x4060fc HeapAlloc
• 0x406100 ExitProcess
• 0x406104 FreeLibrary
L!This program cannot be run in DOS mode.
`.data
.data2
.idata
M-1M-5
:YGHPOOY
^\_`!N
oHVc~n
`EoCYN~b^K
]57dfs
K('.8V
89]fY
CreateWindowExA
play e:\\rrrtwr\agef.wav alias PRFT
LoadLibraryExA
user32.dll
LoadCursorA
Winmm.dll
TranslateMessage
mciSendStringA
02000000008000
0000:000000000D00000090000000
000800u0<0a0
0040'0#00000}0H00u0@000L0Y0
0,000F0a0000D0Y0
0Y0000A00u0@000D00F00040
000H00000
0008000<00}0@0a0
00N00O000080000000'0#000*00003000300010w0y00
000<00000
04000u0,010000000000/0E0 00p000000900u0,000u0,00000000000000000
0@00u0 0000000000u0$0201000000u0(0100000000u0,0100000000
0<0040T0{00t0T01000t0T02000t0T03000t0T04000t0T05000t0T060c00t0T070b00t0T080^00t0T09000t0T0:000t0T0;000t0T0<0000
00000000/0E000p0000u0 000<00
0>0040T000t0T01000t0T02000t0T03000t0T04000t0T05000t0T06000t0T07000t0T08000t0T09000t0T0:000t0T0;000t0T0<000t0T0=000t0T0>000040T00/00 0/0E0$00p00000>00~00p0000
0<0040T000t0T01000t0T02000t0T03000t0T04000t0T05000t0T06000t0T070q00t0T08000t0T09000t0T0:000t0T0;000t0T0<000040T00/00 0/0E0$00p00000<0000p0000000
0@00u0 0000000000u0$0201000000u0(0100000000u0,0100000000
0:0040T000t0T01000t0T02000t0T03000t0T04000t0T050^00t0T06000t0T07000t0T08000t0T090000
00000000/0E000p0000u0 00
0C0040T000t0T01000t0T02000t0T030t00t0T04000t0T05000t0T06000t0T07000t0T08000t0T09000t0T0:000t0T0;000t0T0<000t0T0=0r00t0T0>000t0T0?000t0T0@000t0T0A000t0T0B000t0T0C000040T00/00 0/0E0$00p0000u0(000,00/00D0/00@0/00<0/0080/00$0/00(0/00 0/0E0400p00000@00000
0X000T0\00u0
0400000000u0
0400000000u0
050F000000u0
0000000000u0
0000000000u0
0000000000u0 0000000000u0$0000000000u0(0000000000u0,000000000000
0000000000/000,0/0/00u0
0/000,0/0/00u0 0/000,0/0/00u0$0/000,0/0/00u0(0/00
0,0/0/00u0,0/00
0,0/0/00u0
0h0-0/0/0040000@00000/00
0000/0E000p00000050
000000000u0
0040'0#000u0
00E00500000300
00,0/0/00u0
00E00Q00000300
00,0/0/00u0
00E00200000300
00,0/0/00u0
00E00N00000300
0o0,0/0/00u0
0/00 0/00(0/00
0/00$0/00
0+0/0/0040000@00000/00,0000/0E000p0000u0
0/00,0/00
00-0/0/0
0Y0,0/0/0000R00/00,0/00
0H00000000D0000r0l010
0004000D00p0@010
0H0100000000800
00200000000u0 0000p0000@00000/00@0000/0E000p00000020
0000@00/00800
00100000000u0$00c00
00200000/0`00u0(0/00400u0,0/00,0/00(0/00$0
00200000/00$0
0F00000000008000u0$000<000000000000000<00000
0H0100000000800r0l010
0004000D00p00008000010
00D0000000000060v0y00*000
00D0000000#000B00/0080
0M0000000000?000D0
00010000000004000000000000000400000
0<010000000u0<00p0<030u080000000000/0E000p00000?0000000000u0,000<002030u0800u0$00r0@030u0800u0(0Y000u0$0100000000000U000000000T03008000200
000/00,0/0E0$00p0000000j000(01000300040
000#000000000
000/00,0/0E0$00p0000000F000(01000300040
000010000000008000000000000000800000
0H0100000000<000200r0l01000040Y0000r02000
0.0/0/000D000 0.0/0/000 0.0/0/00000r00080000000'0
00u0(00X000000000
0.0/0/0'0
030u0(000<0Y0
00u0,0008000<00}0,0#0000
0.0/0/000(0/00<0/00800
0L0000000000>000X0y00
000u08000<000000000000000<00000
00008000<0300<000@0300D00z0@0#0000800r0<030u0<0001000000000<0000Y0000<00000
0400008000200m0}000I00r0l0100020m00u000000;000,000u0,00040000Y0000400000
0400008000200m0}000O00r0l0100020m00u000000A000000000000,000u0,00040000Y0000400000
0@00u0 00000000000800r0l010
000d000(000`0000000008000H00000000p0`00p0<000<000000H00080[00(000,00080300<00{0400{04000
000/00,0/0080
0@000000000{0800
00Y0}0@00
000<00000
04000}0D000<000@003000800u0,00080a000/0c0000000`00500020
0:00U0/0?030u0,010D0600020
0000@000
user32.dll
GDI32.dll
Msacm32.dll
ADVAPI32.dll
IMM32.dll
kernel32.dll
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
ExitProcess
FreeLibrary
GetMessageA
DefWindowProcA
PostQuitMessage
GetDoubleClickTime
UpdateWindow
GetQueueStatus
LoadIconA
RegisterClassA
RegQueryValueExA
RegOpenKeyA
GetUserNameA
CopySid
GetLengthSid
CreateBitmap
IntersectClipRect
ExcludeClipRect
UpdateColors
GetTextExtentPoint32A
CreateCompatibleDC
DeleteObject
TextOutA
SetBkColor
SetTextColor
Rectangle
CreateSolidBrush
GetStockObject
CreateFontIndirectA
GetTextExtentExPointA
GetTextMetricsA
CreateFontA
RealizePalette
ImmGetCompositionStringW
ImmSetCompositionFontA
ImmGetContext
ImmSetCompositionWindow
acmDriverID
acmStreamOpen
H8( xp
H@0 P@
80PHxp
@8( h`
H@`Xh`
0(0((
0 @800
hXPXPXPXPXPXPXPXPXPXPXPXPXPXPXPXP`X`XXPXPXPXPHH
H@xp0
( ( ( ( ( (
( ( ( ( (
xxxxxxxxx
( ( ( ( ( (
0 ( ( ( 0
( 0 0 0 0 0 0
P@XH0 0 0 0 0 ( 0
( ( ( ( ( ( (
( ( ( ( ( ( 0(
0 0 0 0 0 0 0 (
H@`X`XH@
8(0 0 0 0 0 0(
0 0 0 0 0 0 0 0 8(H@PHH80 8(H@PH800 0 8(P@XHH80 0 0 0 0 0 8(
0 0 0 0 0 0 0 0 0 (
0 0 0 (
0 8(8(0 (
0 8(8(8(8(8(0 8(
8(H8H8H8H8H8H8H8@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0@0H8
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
VS_VERSION_INFO
StringFileInfo
08000025
Comments
CompanyName
FileDescrsiption
FileVersion
5.2.1.2
InternalName
go.exe
LegalCopyright
Copyright (C) 2010
LegalTrademarks
OriginalFilename
gog.exe
PrivateBuild
ProductName
ProductVersion
5.2.1.3
SpecialBuild
VarFileInfo
Translation
C:\Users\dans\AppData\Local\Temp\Temp1_payment-history-n433213-55462-54345.zip\payment-history-n433213-55462-54345.exe
C:\BCTC_LFi.exe
C:\GVdt9S99.exe
C:\HDY7HYcp.exe
C:\9de923bb1b89e17d1e6e665ccea0503a61706bf4c3930e1a47ce6e6078b3ccff
C:\5c6bfbb896294d84ae42e9e816488cee3975b1abcb84c73839483a922faa0cd0
C:\9a359f10b4e624b54f028bb186534a3b494fced70f7c56dde9c07c3950267af9
C:\47cb7afc8036c42414e3a2441dfe59c96751dd9cdacfb11ad2084aea11cb28c7
C:\edeb463678a83bedf427b8a032da791937b2b770efd25a6fe82342aced99554e
C:\8cXYX2Oh.exe
C:\DInB4uc9.exe
C:\L3in1aY7.exe
C:\4qnHafsw.exe
C:\I2ACILRM.exe
C:\4vQbCMGv.exe
C:\BQd5LcPD.exe
C:\txRMp66y.exe
C:\O6zp9Bop.exe
C:\s0Cgnz3F.exe
C:\v0qfv9wc.exe
C:\OgkKdfnC.exe
C:\FOLlqNxq.exe
C:\_a5qOHj5.exe
C:\NqqZww9Q.exe
C:\9e75d8aee5832f9ee35b6d653eab7eb793451eb301d785802f434b421ae47fdd
C:\48afd3e8fda7b8d91a223ed8e94c3b61b90e8bb585e277afc1a0c87365077ef5
C:\mEhprIVd.exe
C:\T6g5ahUO.exe
C:\RqmtydoR.exe
C:\87981d40fc1d0534ec3939fb5e6d7d2617fb5c0ed9e8198d95ba31e194ec0347
C:\K4B3p2Vw.exe
C:\rj_CKoHm.exe
C:\cYvSXOnq.exe
C:\fJaMo9g3.exe
C:\vYHlLDyy.exe
C:\XlDAZzcI.exe
C:\5fXMo8KT.exe
C:\cPeIcxU5.exe
C:\81YiXYVb.exe
C:\cYguFmtT.exe
C:\2d3REiY_.exe
C:\xD3wRUGC.exe
C:\BpwIENWe.exe
C:\sB2DvbpJ.exe
C:\LbCddwFG.exe
C:\ao0up96R.exe
C:\WP2EVOFw.exe
C:\LlPBf5vI.exe
C:\ckSLqj4T.exe
C:\450IYiNk.exe
C:\O6_Dd2sw.exe
C:\NIJY58t2.exe
C:\MOWuN4_d.exe
C:\_1VIt8e7.exe
C:\3sbtXVnX.exe
C:\002a4e9135bfce1a4bea69ac1f6e0b1253223921bc36ce364320f2ab2bceae98
C:\pf0Eeaap.exe
C:\3mMBU500.exe
C:\2jzill2Z.exe
C:\5cm3zSEh.exe
C:\L1NecUcK.exe
C:\a3EhBUXI.exe
C:\Txw64AC1.exe
C:\25jwD6Hd.exe
C:\mrrSUPZ8.exe
C:\82b648ad7895da6f89b891118f743e7249967cfb.exe
C:\865919eae21b1ba986099829809a6154016f9822.exe
C:\FQi597oc.exe
C:\gXIeR9Ua.exe
C:\v9fe2pNF.exe
C:\WJCwFB7h.exe
C:\8ddb494fce1fc5039417f450ba91618d32e570a2937f31d32ac85a9131991343
C:\Users\admin\Downloads\invoice.exe
C:\Users\admin\Downloads\important_document.exe
C:\lu24ktFW.exe
C:\Users\admin\Downloads\important_document.exe
C:\xy9AHbWu.exe
C:\0bbc2c18c131606405309f7ac4bc87b6337fd77e772efc0da760dd821c661920
C:\6d16a6fe8569fca4c09cca435cf560ca6728d110dbb04469f82676c935c5e80c
C:\UMc8YN0o.exe
C:\c22213acb75fd66e1a56c580661ad6c159c86641f65b9d3ba31080ce20949388

Process Tree

0e769692635faee303234c4c5ad09be7d92a92188c5e205d495424fa299fdedd.exe, PID: 1932, Parent PID: 1612

default registry file network process services synchronisation iexplore office pdf

budha.exe, PID: 600, Parent PID: 1932

default registry file network process services synchronisation iexplore office pdf

TCP

Source Source Port Destination Destination Port
192.168.56.101 49164 160.153.129.225 iska.net 443
192.168.56.101 49165 160.153.129.225 iska.net 443
192.168.56.101 49166 160.153.129.225 iska.net 443
192.168.56.101 49168 160.153.129.225 iska.net 443
192.168.56.101 49169 160.153.129.225 iska.net 443
192.168.56.101 49170 160.153.129.225 iska.net 443
192.168.56.101 49172 160.153.129.225 iska.net 443
192.168.56.101 49173 160.153.129.225 iska.net 443
192.168.56.101 49174 160.153.129.225 iska.net 443
192.168.56.101 49176 160.153.129.225 iska.net 443
192.168.56.101 49177 160.153.129.225 iska.net 443
192.168.56.101 49178 160.153.129.225 iska.net 443
192.168.56.101 49180 160.153.129.225 iska.net 443
192.168.56.101 49181 160.153.129.225 iska.net 443
192.168.56.101 49182 160.153.129.225 iska.net 443
192.168.56.101 49184 160.153.129.225 iska.net 443
192.168.56.101 49185 160.153.129.225 iska.net 443
192.168.56.101 49186 160.153.129.225 iska.net 443
192.168.56.101 49188 160.153.129.225 iska.net 443
192.168.56.101 49189 160.153.129.225 iska.net 443
192.168.56.101 49190 160.153.129.225 iska.net 443
192.168.56.101 49192 160.153.129.225 iska.net 443
192.168.56.101 49193 160.153.129.225 iska.net 443
192.168.56.101 49194 160.153.129.225 iska.net 443
192.168.56.101 49196 160.153.129.225 iska.net 443
192.168.56.101 49197 160.153.129.225 iska.net 443
192.168.56.101 49198 160.153.129.225 iska.net 443
192.168.56.101 49200 160.153.129.225 iska.net 443
192.168.56.101 49201 160.153.129.225 iska.net 443
192.168.56.101 49202 160.153.129.225 iska.net 443
192.168.56.101 49204 160.153.129.225 iska.net 443
192.168.56.101 49205 160.153.129.225 iska.net 443
192.168.56.101 49206 160.153.129.225 iska.net 443
192.168.56.101 49208 160.153.129.225 iska.net 443
192.168.56.101 49210 160.153.129.225 iska.net 443
192.168.56.101 49211 160.153.129.225 iska.net 443
192.168.56.101 49214 160.153.129.225 iska.net 443
192.168.56.101 49215 160.153.129.225 iska.net 443
192.168.56.101 49216 160.153.129.225 iska.net 443
192.168.56.101 49218 160.153.129.225 iska.net 443
192.168.56.101 49219 160.153.129.225 iska.net 443
192.168.56.101 49220 160.153.129.225 iska.net 443
192.168.56.101 49222 160.153.129.225 iska.net 443
192.168.56.101 49223 160.153.129.225 iska.net 443
192.168.56.101 49224 160.153.129.225 iska.net 443
192.168.56.101 49226 160.153.129.225 iska.net 443
192.168.56.101 49227 160.153.129.225 iska.net 443
192.168.56.101 49228 160.153.129.225 iska.net 443
192.168.56.101 49230 160.153.129.225 iska.net 443
192.168.56.101 49231 160.153.129.225 iska.net 443
192.168.56.101 49232 160.153.129.225 iska.net 443
192.168.56.101 49234 160.153.129.225 iska.net 443
192.168.56.101 49235 160.153.129.225 iska.net 443
192.168.56.101 49236 160.153.129.225 iska.net 443
192.168.56.101 49238 160.153.129.225 iska.net 443
192.168.56.101 49239 160.153.129.225 iska.net 443
192.168.56.101 49240 160.153.129.225 iska.net 443
192.168.56.101 49242 160.153.129.225 iska.net 443
192.168.56.101 49243 160.153.129.225 iska.net 443
192.168.56.101 49244 160.153.129.225 iska.net 443
192.168.56.101 49246 160.153.129.225 iska.net 443
192.168.56.101 49247 160.153.129.225 iska.net 443
192.168.56.101 49248 160.153.129.225 iska.net 443
192.168.56.101 49250 160.153.129.225 iska.net 443
192.168.56.101 49251 160.153.129.225 iska.net 443
192.168.56.101 49252 160.153.129.225 iska.net 443
192.168.56.101 49254 160.153.129.225 iska.net 443
192.168.56.101 49255 160.153.129.225 iska.net 443
192.168.56.101 49256 160.153.129.225 iska.net 443
192.168.56.101 49258 160.153.129.225 iska.net 443
192.168.56.101 49259 160.153.129.225 iska.net 443
192.168.56.101 49260 160.153.129.225 iska.net 443
192.168.56.101 49262 160.153.129.225 iska.net 443
192.168.56.101 49263 160.153.129.225 iska.net 443
192.168.56.101 49264 160.153.129.225 iska.net 443
192.168.56.101 49266 160.153.129.225 iska.net 443
192.168.56.101 49267 160.153.129.225 iska.net 443
192.168.56.101 49268 160.153.129.225 iska.net 443
192.168.56.101 49270 160.153.129.225 iska.net 443
192.168.56.101 49271 160.153.129.225 iska.net 443
192.168.56.101 49272 160.153.129.225 iska.net 443
192.168.56.101 49274 160.153.129.225 iska.net 443
192.168.56.101 49275 160.153.129.225 iska.net 443
192.168.56.101 49276 160.153.129.225 iska.net 443
192.168.56.101 49278 160.153.129.225 iska.net 443
192.168.56.101 49279 160.153.129.225 iska.net 443
192.168.56.101 49280 160.153.129.225 iska.net 443
192.168.56.101 49282 160.153.129.225 iska.net 443
192.168.56.101 49283 160.153.129.225 iska.net 443
192.168.56.101 49284 160.153.129.225 iska.net 443
192.168.56.101 49286 160.153.129.225 iska.net 443
192.168.56.101 49287 160.153.129.225 iska.net 443
192.168.56.101 49288 160.153.129.225 iska.net 443
192.168.56.101 49290 160.153.129.225 iska.net 443
192.168.56.101 49291 160.153.129.225 iska.net 443
192.168.56.101 49292 160.153.129.225 iska.net 443
192.168.56.101 49294 160.153.129.225 iska.net 443
192.168.56.101 49295 160.153.129.225 iska.net 443
192.168.56.101 49296 160.153.129.225 iska.net 443
192.168.56.101 49298 160.153.129.225 iska.net 443
192.168.56.101 49299 160.153.129.225 iska.net 443
192.168.56.101 49300 160.153.129.225 iska.net 443
192.168.56.101 49302 160.153.129.225 iska.net 443
192.168.56.101 49303 160.153.129.225 iska.net 443
192.168.56.101 49304 160.153.129.225 iska.net 443
192.168.56.101 49306 160.153.129.225 iska.net 443
192.168.56.101 49307 160.153.129.225 iska.net 443
192.168.56.101 49308 160.153.129.225 iska.net 443
192.168.56.101 49310 160.153.129.225 iska.net 443
192.168.56.101 49311 160.153.129.225 iska.net 443
192.168.56.101 49312 160.153.129.225 iska.net 443
192.168.56.101 49314 160.153.129.225 iska.net 443
192.168.56.101 49315 160.153.129.225 iska.net 443
192.168.56.101 49316 160.153.129.225 iska.net 443
192.168.56.101 49318 160.153.129.225 iska.net 443
192.168.56.101 49319 160.153.129.225 iska.net 443
192.168.56.101 49320 160.153.129.225 iska.net 443
192.168.56.101 49322 160.153.129.225 iska.net 443
192.168.56.101 49323 160.153.129.225 iska.net 443
192.168.56.101 49324 160.153.129.225 iska.net 443
192.168.56.101 49326 160.153.129.225 iska.net 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 57665 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 23342540fd629a4a_budha.exe
Filepath C:\Users\Administrator\AppData\Local\Temp\budha.exe
Size 26.2KB
Processes 1932 (0e769692635faee303234c4c5ad09be7d92a92188c5e205d495424fa299fdedd.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fbf49626aa5b9d014dda1eed66ecaf57
SHA1 a4e6a4b32ab22b5de58934fb62011eeeeceaa94a
SHA256 23342540fd629a4a67b1ae6fd8526b25889d4a516f2fec4f84c750b30d295fc0
CRC32 225B1566
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 319c68089b64de04bc8ea6b429b70ab602a5fd55
Size 5.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e2c9b4f03a10ffef1f1552557362340b
SHA1 319c68089b64de04bc8ea6b429b70ab602a5fd55
SHA256 334ffcb0366031fcc223c0879b5eb7a8aaea1042363a83c15ae7d3dc4257de84
CRC32 6A295461
ssdeep None
Yara None matched
VirusTotal Search for analysis