5.6
高危
7 个模型检测该样本为恶意！
重新分析
更多

91d30031480da846740a6e00050386e5c904d6e4f8fe6736543914417c5490f2

a61aacf8369520720ee8e7a5e22e8310.exe

分析耗时

187s

最近分析

文件大小

291.9KB
静态报毒 动态报毒 ELDORADO GENERIC ML PUA SCORE STASER UNSAFE VVMCYL
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Tencent 20200929 1.0.0.1
Kingsoft 20200929 2013.8.14.323
McAfee 20200928 6.0.6.653
CrowdStrike 20190702 1.0
静态指标
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path c:\GamingX\Develop\Installer\3.7.x.x\OUT_FILES\Release\Intermediate Files\Installer_newSocket\Installer.pdb
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:944447202&cup2hreq=9777c2de002dd1356b232a2aaff63887c4745fa55bd06da90a06efc2588cfa1e
Performs some HTTP requests (4 个事件)
request GET http://www.pacificpoker.com/clientip.htm
request GET http://setupspoker.images4us.com/setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/text.txt
request GET http://setupspoker.images4us.com/setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/installer.gif
request POST https://update.googleapis.com/service/update2?cup2key=10:944447202&cup2hreq=9777c2de002dd1356b232a2aaff63887c4745fa55bd06da90a06efc2588cfa1e
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:944447202&cup2hreq=9777c2de002dd1356b232a2aaff63887c4745fa55bd06da90a06efc2588cfa1e
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619785100.727751
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f71000
success 0 0
1619785100.758751
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f61000
success 0 0
1619785100.774751
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f41000
success 0 0
1619785100.774751
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x750c1000
success 0 0
1619785100.789751
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f31000
success 0 0
1619785101.133751
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x752f1000
success 0 0
File has been identified by 7 AntiVirus engines on VirusTotal as malicious (7 个事件)
Invincea Generic ML PUA (PUA)
Cyren W32/S-f05d0216!Eldorado
eGambit Unsafe.AI_Score_70%
GData Win32.Trojan-Downloader.Generic.VVMCYL
VBA32 suspected of Trojan.Downloader.gen.h
Yandex Trojan.Staser!
Ikarus Trojan-Dropper.Win32.Generic
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619785101.133751
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619785104.180751
RegSetValueExA
key_handle: 0x000003f8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619785104.180751
RegSetValueExA
key_handle: 0x000003f8
value: @> ˆ=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619785104.180751
RegSetValueExA
key_handle: 0x000003f8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619785104.180751
RegSetValueExW
key_handle: 0x000003f8
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619785104.180751
RegSetValueExA
key_handle: 0x00000420
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619785104.180751
RegSetValueExA
key_handle: 0x00000420
value: @> ˆ=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619785104.180751
RegSetValueExA
key_handle: 0x00000420
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619785104.227751
RegSetValueExW
key_handle: 0x000003f4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Network activity contains more than one unique useragent (2 个事件)
process a61aacf8369520720ee8e7a5e22e8310.exe useragent RLMultySocket
process a61aacf8369520720ee8e7a5e22e8310.exe useragent Internal
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (24 个事件)
dead_host 192.168.56.101:49231
dead_host 192.168.56.101:49211
dead_host 192.168.56.101:49196
dead_host 192.168.56.101:49215
dead_host 192.168.56.101:49193
dead_host 192.168.56.101:49224
dead_host 192.168.56.101:49207
dead_host 192.168.56.101:49216
dead_host 192.168.56.101:49194
dead_host 192.168.56.101:49212
dead_host 172.217.24.14:443
dead_host 192.168.56.101:49220
dead_host 192.168.56.101:49209
dead_host 91.109.250.163:80
dead_host 192.168.56.101:49195
dead_host 192.168.56.101:49213
dead_host 172.217.160.110:443
dead_host 192.168.56.101:49221
dead_host 192.168.56.101:49230
dead_host 192.168.56.101:49232
dead_host 192.168.56.101:49218
dead_host 192.168.56.101:49183
dead_host 192.168.56.101:49214
dead_host 192.168.56.101:49227
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-07-08 16:57:50

Imports

Library VERSION.dll:
• 0x43b324 GetFileVersionInfoA
• 0x43b32c VerQueryValueA
Library WININET.dll:
• 0x43b334 InternetOpenA
• 0x43b338 InternetConnectA
• 0x43b33c InternetCloseHandle
• 0x43b348 InternetReadFile
• 0x43b34c HttpOpenRequestA
• 0x43b350 InternetSetOptionA
• 0x43b354 HttpSendRequestA
• 0x43b358 HttpQueryInfoA
• 0x43b360 InternetCrackUrlA
Library KERNEL32.dll:
• 0x43b060 WaitForSingleObject
• 0x43b064 MulDiv
• 0x43b068 SetEvent
• 0x43b070 CreateMutexA
• 0x43b074 CreateEventA
• 0x43b078 CloseHandle
• 0x43b07c GlobalMemoryStatus
• 0x43b080 GetVersionExA
• 0x43b084 GetVersion
• 0x43b094 CreateSemaphoreA
• 0x43b098 CreateProcessA
• 0x43b09c DeleteFileA
• 0x43b0a4 TerminateThread
• 0x43b0a8 GetModuleFileNameA
• 0x43b0b0 CreateThread
• 0x43b0b4 GetTickCount
• 0x43b0b8 GetExitCodeProcess
• 0x43b0bc Sleep
• 0x43b0c0 ReleaseMutex
• 0x43b0c4 ReleaseSemaphore
• 0x43b0c8 GetSystemTime
• 0x43b0cc GetTempPathA
• 0x43b0d4 MultiByteToWideChar
• 0x43b0d8 CreateFileA
• 0x43b0dc GetFileSize
• 0x43b0e0 ReadFile
• 0x43b0e4 WriteFile
• 0x43b0e8 CopyFileA
• 0x43b0f0 SetFilePointer
• 0x43b0f4 GlobalFree
• 0x43b0f8 GlobalSize
• 0x43b0fc GlobalUnlock
• 0x43b100 GlobalLock
• 0x43b104 GlobalAlloc
• 0x43b108 LocalAlloc
• 0x43b10c FlushFileBuffers
• 0x43b114 GetConsoleCP
• 0x43b118 FatalAppExitA
• 0x43b120 GetCurrentProcessId
• 0x43b128 VirtualFree
• 0x43b12c HeapCreate
• 0x43b130 HeapDestroy
• 0x43b134 GetFileType
• 0x43b138 SetHandleCount
• 0x43b140 WideCharToMultiByte
• 0x43b150 GetStdHandle
• 0x43b154 ExitProcess
• 0x43b158 HeapSize
• 0x43b15c GetCurrentThread
• 0x43b160 GetCurrentThreadId
• 0x43b164 SetLastError
• 0x43b168 TlsFree
• 0x43b16c TlsSetValue
• 0x43b170 TlsAlloc
• 0x43b174 TlsGetValue
• 0x43b178 IsValidCodePage
• 0x43b17c GetOEMCP
• 0x43b180 GetACP
• 0x43b18c VirtualAlloc
• 0x43b190 GetCPInfo
• 0x43b194 RemoveDirectoryA
• 0x43b19c GetLocalTime
• 0x43b1a0 GetFullPathNameA
• 0x43b1a4 GetDriveTypeA
• 0x43b1a8 CreateDirectoryA
• 0x43b1ac GetStartupInfoA
• 0x43b1b0 GetProcessHeap
• 0x43b1b4 HeapAlloc
• 0x43b1b8 HeapFree
• 0x43b1bc GetCommandLineA
• 0x43b1c0 RaiseException
• 0x43b1c4 IsDebuggerPresent
• 0x43b1c8 FormatMessageA
• 0x43b1cc LocalFree
• 0x43b1d0 GetModuleHandleA
• 0x43b1d4 GetProcAddress
• 0x43b1d8 GetCurrentProcess
• 0x43b1dc GetLastError
• 0x43b1e0 GetUserDefaultLCID
• 0x43b1e4 GetLocaleInfoA
• 0x43b1e8 EnumSystemLocalesA
• 0x43b1ec IsValidLocale
• 0x43b1f4 FreeLibrary
• 0x43b1f8 InterlockedExchange
• 0x43b1fc LoadLibraryA
• 0x43b200 SetStdHandle
• 0x43b204 WriteConsoleA
• 0x43b208 WriteConsoleW
• 0x43b20c GetConsoleOutputCP
• 0x43b210 GetLocaleInfoW
• 0x43b214 SetEndOfFile
• 0x43b218 CompareStringA
• 0x43b21c CompareStringW
• 0x43b220 GetConsoleMode
• 0x43b230 TerminateProcess
• 0x43b234 GetDateFormatA
• 0x43b238 GetTimeFormatA
• 0x43b23c GetStringTypeW
• 0x43b240 GetStringTypeA
• 0x43b244 LCMapStringW
• 0x43b248 LCMapStringA
• 0x43b24c HeapReAlloc
• 0x43b250 RtlUnwind
Library USER32.dll:
• 0x43b268 IsWindow
• 0x43b26c IsRectEmpty
• 0x43b270 IntersectRect
• 0x43b274 UnionRect
• 0x43b278 PtInRect
• 0x43b27c SendDlgItemMessageA
• 0x43b280 DrawTextA
• 0x43b284 InvalidateRect
• 0x43b288 UpdateWindow
• 0x43b28c SetDlgItemTextA
• 0x43b290 KillTimer
• 0x43b294 SetTimer
• 0x43b298 GetSystemMetrics
• 0x43b29c PostMessageA
• 0x43b2a0 EndDialog
• 0x43b2a4 DestroyWindow
• 0x43b2a8 MessageBoxIndirectA
• 0x43b2ac GetDlgItem
• 0x43b2b0 EnableWindow
• 0x43b2b4 DefWindowProcA
• 0x43b2b8 ShowWindow
• 0x43b2bc SetWindowTextA
• 0x43b2c0 GetWindowRect
• 0x43b2c4 ScreenToClient
• 0x43b2c8 CreateWindowExA
• 0x43b2cc GetDC
• 0x43b2d0 ReleaseDC
• 0x43b2d4 GetClientRect
• 0x43b2d8 FillRect
• 0x43b2dc EndPaint
• 0x43b2e0 PostQuitMessage
• 0x43b2e4 SetFocus
• 0x43b2e8 FindWindowA
• 0x43b2ec MessageBoxA
• 0x43b2f0 SetForegroundWindow
• 0x43b2f4 GetClassInfoExA
• 0x43b2f8 DialogBoxParamA
• 0x43b2fc LoadIconA
• 0x43b300 LoadCursorA
• 0x43b304 RegisterClassExA
• 0x43b308 LoadAcceleratorsA
• 0x43b30c GetMessageA
• 0x43b314 TranslateMessage
• 0x43b318 DispatchMessageA
• 0x43b31c SendMessageA
Library GDI32.dll:
• 0x43b018 CreateDIBitmap
• 0x43b01c DeleteDC
• 0x43b020 GetBkColor
• 0x43b024 SetBkMode
• 0x43b028 SetTextColor
• 0x43b02c SetMapMode
• 0x43b030 SetBkColor
• 0x43b034 GetObjectA
• 0x43b038 GetDeviceCaps
• 0x43b03c CreateFontIndirectA
• 0x43b040 SelectObject
• 0x43b044 CreateCompatibleDC
• 0x43b04c BitBlt
• 0x43b050 CreateSolidBrush
• 0x43b054 DeleteObject
• 0x43b058 CreateBitmap
Library ADVAPI32.dll:
• 0x43b000 RegSetValueExA
• 0x43b004 RegCloseKey
• 0x43b008 RegOpenKeyExA
• 0x43b00c RegQueryValueExA
• 0x43b010 RegCreateKeyExA
Library SHELL32.dll:
• 0x43b25c ShellExecuteExA
• 0x43b260 ShellExecuteA
Library ole32.dll:
• 0x43b37c CoCreateGuid
Library WSOCK32.dll:
• 0x43b368 WSAStartup
• 0x43b36c inet_addr
• 0x43b370 gethostbyname
• 0x43b374 gethostname

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49234 113.108.239.226 update.googleapis.com 443
192.168.56.101 49185 178.79.208.13 setupspoker.images4us.com 80
192.168.56.101 49183 91.109.249.23 www.pacificpoker.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 54991 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58970 224.0.0.252 5355
192.168.56.101 60221 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://setupspoker.images4us.com/setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/installer.gif 
GET /setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/installer.gif HTTP/1.1
User-Agent: RLMultySocket
Host: setupspoker.images4us.com
Connection: Keep-Alive
http://setupspoker.images4us.com/setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/text.txt 
GET /setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/text.txt HTTP/1.1
User-Agent: RLMultySocket
Host: setupspoker.images4us.com
Connection: Keep-Alive
http://www.pacificpoker.com/clientip.htm 
GET /clientip.htm HTTP/1.1
User-Agent: RLMultySocket
Host: www.pacificpoker.com
Connection: Keep-Alive

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.