2.7
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.63
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545298.718875 GetComputerNameA |
computer_name:
|
failed | 0 | 0 |
|
1727545299.155875 GetComputerNameA |
computer_name:
|
failed | 0 | 0 |
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545298.639875 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545299.139875 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(4 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\weyjba.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\weyjba.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\weyjba.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
将读写内存保护更改为可读执行（可能是为了避免在同时设置所有 RWX 标志时被检测）
(8 个事件)
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(2 个事件)
| dead_host | 18.119.154.66:443 |
| dead_host | 3.140.13.188:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-09-30 20:47:01
PE Imphash
d91a0778a77c133468d4cb3a15c1fa92
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00008000 | 0x00005800 | 4.167495769824498 |
| UPX1 | 0x00009000 | 0x00003000 | 0x00002800 | 5.169652986195809 |
| .rsrc | 0x0000c000 | 0x00003000 | 0x00002a00 | 5.412790753446936 |
| .imports | 0x0000f000 | 0x00001000 | 0x00000400 | 3.324441959170754 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000c0ec | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000e698 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x0000e6b0 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.DLL:
• 0x40400c GetLastError
• 0x404010 lstrcpyA
• 0x404014 GetModuleHandleA
• 0x404018 GetCommandLineA
• 0x40401c FindFirstFileA
• 0x404020 FindClose
• 0x404024 FindNextFileA
• 0x404028 GetCurrentProcessId
• 0x40402c GetCurrentProcess
• 0x404030 GetSystemTimeAsFileTime
• 0x404034 GetComputerNameA
• 0x404038 CreateFileA
Library user32.dll:
• 0x404040 GetMessageA
• 0x404044 PostQuitMessage
• 0x404048 GetClientRect
• 0x40404c UpdateWindow
• 0x404050 EndPaint
• 0x404054 DrawTextA
• 0x404058 DispatchMessageA
• 0x40405c BeginPaint
• 0x404060 TranslateMessage
• 0x404064 MoveWindow
• 0x404068 CreateWindowExA
• 0x40406c RegisterClassExA
• 0x404070 DefWindowProcA
• 0x404074 MessageBoxA
• 0x404078 SendMessageA
• 0x40407c LoadIconA
• 0x404080 DestroyWindow
• 0x404084 LoadCursorA
• 0x404088 ShowWindow
• 0x40408c GetWindowRect
L!This program cannot be run in DOS mode.
.imports
y@x%@h
)x@h@%
=taf l
crnAon
;]x@h@%
\h^aZtW
%hE|be%
haah %
c7kQ`l%
%%,6jnj
%hb' 9eh
$2b%'e7Kh%
%hvc@!%
hBokd0
b)f =q
cc3bh%
%_b (aeI%
GTI#lh%
hp!@M'BkW
hRvl'ke
%>- 1Zh%
%h$ S)Z- JA%
h{4 3|
2i&XU%h
eLgp`!
P#- x%
Ua; T%
XT$N[$
%h!ha%
-Px-NB
h4-$TaN
%bjew%
+|0Yns%
hDPI.blb%
%8 gzJ#
0s"Y:%
ns:.Yc'Mh%
%hWm$%
41 y%h
h!-gb%
@Xaah,iE%h
h$g(Z
%$&%lmY%
d$N-%h%
%h,4a]'5H%
miA'e7
hCk4!%
Bux?!%
%3 5N7
b%c-ersh%
eYBf$!
%hDqfy-%
, nh8%
h*`e5q%
biMe=e%
&a`0R-
Y(aaA3%
h)dg]4
+f,gh%
nluVh%
%hfe'%
(ae($mc%h
oae7#%
O!gfv%
%aY,bf%
%h6{}d"#5u)%
3&`=aSZ
h Ibei
%oU0( %
N'ScU;
A+%0h%
%h p7,
ae.J%h
a)#+a,6
h%sch=%
hMoqshw
!hda{k
% "hak%
g,NhqQTd
ektr%x@@h
fd(mnrn"!h %
h@@xIreU
+u]UuM
GFu;uu_+
.G|h
x@@(*i
-t@x%@h
2saau}
h@ca )Ssup
t"VP =
ulWnh%@
x@leee#h
S#no @
FGIu5P@
FFFF=xQ@
@;sy;s
FGIu=xQ@
2x@h@%
:Ht `2n
!2=%x@@h
xhlom!hp2mr
x@shleL#
BrTit)
x@x@h@%
h%x@@h
h@@xh%x@
hGhw5(Q@
bE.. 2m
x@lEV|1aW
0\IrVW
u x@h@%
d@h%xh
h0+ea" "l
io@mtF
uV 0"CwuW
h@xPu
@hCVEAH
ptE<l<x]@x%@h
x@ bi>l
Ux@h@%
j2hFP@
EM+PEM+X+j3j
3u;3@@@@
GGGGBBBBIuj4j
BBBBR5
BBBBRV
GV+=|Q@
QRRh|Q@
/"id%x@@h
h@@xRre
njXVh%@
@%qwLl3e
ElEH"P38aN
x@@fRX
V@x%@hU
E;Es%N
plumbum
second
megafit
ad.org
static
button
-AF7h:Bvak4(
j*aE &
#HbiKd
?mnT)#(h%
h794Ma
heSAi%
h=Tr7#
GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
FindClose
FindNextFileA
GetCurrentProcessId
GetCurrentProcess
GetSystemTimeAsFileTime
GetComputerNameA
CreateFileA
DeleteObject
CreateFontIndirectA
GetMessageA
PostQuitMessage
GetClientRect
UpdateWindow
EndPaint
DrawTextA
DispatchMessageA
BeginPaint
TranslateMessage
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
LoadIconA
DestroyWindow
LoadCursorA
ShowWindow
GetWindowRect
`.rdata
@.data
W#aK;opt|6li1m
pTD5a5
HhxCh)|hgFh(3{-0_
R<Ou"LOGwa0%d
LU`o~@
bE.. 2
Cyl[}t
?Oo'Qa;1qE
~ZwtotE0#1
x7NXGn
Hlm-`0w1
"_i3`j
/NQ;F=
}0+ea"xv"3
LiojHDmt|n
V 0"CwW
XXjW5IZ
y(7wdXD
UEX+({
qPu.vN
LI'EP[
CVEAHDPPSe
PKBo_zp,
/e'<l<x]
Blgv&
ueE~!c|\1F
uN? EMh6iP
;f,E#;
Brj4eC
7j4ugTb
pW555u~
S5P]R/#
d;76uUu7lblq2x
i#QTb'
YvX f\
vKHj@;
%DJ_>8~uph609r7{4
DYL8uM9
<Z@Qt:h
=7[GV=|
o{QRRh
7A+TN[
o1/"id
r2p,.!
y%D/+Rre;<Ee
$8)t'*jTrjXVo B |i
'rmyo!G9
see}4,
2$uqwE}Ll3?,o
,mH'38aN~
xk?fRX'"E
GQfMZ
uu~ Fu}
vf_^[n
"$r5p(
~kinXD*
iini`N:(
Ar]ial
ad.org
tatied-
y!x%mini;CB^+ D
Cd2L&&dd2LL&P
-AF7h:Bvak4(
j*aE &
Iw*&a?r
s3ab5'
#HbiKdkJg(
-4e'?b-!
?mnT)#(
,3Q??,c
5]04!?
k794Ma
q#]Lu[
<'eSAi
hQ=Tr7##
0y$TA`
GetLastErrorl
rcpyA?k
ModuleHand
:uaentPfcessId
SyOemTimam7s=
krNamRC8a
#Object
o7H+@MuagNl
qli]XRJUpdWow
DrawTBD}isp#chTBeg$(!{
TnslCa^llvP
Ex:{msMRsa.
SdwLoadIc
<ji[@.&'J
XPTPSWXaD$j
.F;, {s
.LB/#PD
;1TLxrK@
C9$!lc
F=_We]
.0&2-&!!
.-#<50-
VPVOUOUNUOUOUNUOVOUOVOVOUOVOVP\U_XXQUOVP[UD@
I?qj.#
G<4(kb
xxxtttttt
ODj_[P
MCVK/!,
- - - - - - #
. , - - ,
- / / / / / / %
PCbW`TI<
0!/ / . 3%
/ 1"1"1"1"1"1"0 4%K>REF91!6(K>PC>0/ / 9+M@THH:2#0!1"1"1"0!5'
1"1!1!1!1!1!1!4$2"+
3#4$0 +
3#3#3#3#3#2#7(!
4$F8F8F8F8F8F8>.@1A2B3B3A2A2B3B3B3A3A2B3B3B3B3A2A2A2A2A2@1H9!
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
gdi32.dll
KERNEL32.DLL
user32.dll
DeleteObject
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
EndPaint
KERNEL32.DLL
GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
FindClose
FindNextFileA
GetCurrentProcessId
GetCurrentProcess
GetSystemTimeAsFileTime
GetComputerNameA
CreateFileA
gdi32.dll
DeleteObject
CreateFontIndirectA
user32.dll
GetMessageA
PostQuitMessage
GetClientRect
UpdateWindow
EndPaint
DrawTextA
DispatchMessageA
BeginPaint
TranslateMessage
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
LoadIconA
DestroyWindow
LoadCursorA
ShowWindow
GetWindowRect
C : \ U s e r s \ d r t i e t . X P S 4 2 0 - P C \ D e s k t o p \ D o c u m e n t s _ 0 9 3 0 2 0 1 3 . e x e
C : \ K p T I 4 j T w . e x e
C : \ x A u b e 3 S m . e x e
C : \ a 5 2 8 b 7 e a 3 9 0 b 4 c 9 1 7 4 2 a b e e 8 5 c c 0 a d f 3 5 8 0 b 9 6 8 9 e f 9 b f f 0 8 e 1 9 7 e 2 c 3 f 9 3 c 3 c 6 b
C : \ 0 e c 4 5 8 c 5 2 a 1 6 2 4 a 0 6 1 0 0 9 f c 5 3 a 0 7 8 2 3 f f 5 9 3 6 e 4 9 0 e 3 1 c 0 0 1 8 0 8 f b 8 e 7 5 6 a f 4 e 3 c
C : \ 2 0 4 9 6 e 8 0 7 5 d 2 1 2 f 4 9 3 2 3 d 5 a d 6 f 9 9 3 3 2 5 2 d f 3 4 6 3 7 c 1 0 7 8 b 9 3 1 4 9 4 d 2 1 c 4 d c 0 3 0 e 8
C : \ 8 a 8 c d b 7 a 2 0 3 9 9 d c c 0 7 0 a 1 c b 2 1 c b 2 a b 0 a d e 7 6 8 b f 6 d f d 8 b a c e d 2 8 d b b 7 5 c 9 7 7 4 5 d 9
C : \ 6 a 0 7 5 f 1 0 6 0 e a c 1 5 7 c 3 a 9 e f 3 e d b b 5 1 0 2 2 2 3 d 6 a 1 d 6 3 3 2 5 e 5 e d c 6 2 9 8 f 0 2 d 0 8 e e 6 1 7
C : \ j G w j V p v f . e x e
C : \ H q D A a 9 c k . e x e
C : \ 4 s V x 0 v 9 F . e x e
C : \ d x H r x m 1 P . e x e
C : \ F f W h g _ e a . e x e
C : \ 4 9 t I A v M C . e x e
C : \ 7 p D n U V S L . e x e
C : \ R 2 r t b l H i . e x e
C : \ 4 W P i 4 L H U . e x e
C : \ 2 7 x _ g B z f . e x e
C : \ M 0 2 N 4 R D o . e x e
C : \ 1 n 1 i M Y N g . e x e
C : \ H v o 3 h R s r . e x e
C : \ X 2 A 7 v 5 0 X . e x e
C : \ i t n 4 Z B b W . e x e
C : \ 1 a p u a 4 a y . e x e
C : \ l h J h R H U 6 . e x e
C : \ i s i z I q s K . e x e
C : \ d d 4 1 2 a 9 8 e 6 c b c f f e 5 4 1 7 7 8 4 a f 8 e a c 9 9 4 4 c f 7 c 9 5 f 9 c 3 4 a f d d 8 c c a 7 9 9 2 3 6 0 b 4 7 a a
C : \ 3 4 d 2 d 6 0 9 c 9 a 4 6 f 4 2 3 8 4 c 3 f 2 6 e c 8 0 2 0 1 f a f 6 c 9 d b 5 2 a 9 8 8 5 d 8 3 b e a 4 f 3 7 8 2 1 8 5 0 8 4
C : \ I 0 0 3 e f o b . e x e
C : \ U j K h R Q l D . e x e
C : \ s u 8 7 y l Z Y . e x e
C : \ L 0 W B U G R y . e x e
C : \ t T 4 s v P k j . e x e
C : \ 1 8 b c 2 7 f 9 1 e 2 a e 8 3 c 8 5 a 9 e a 6 5 a c 1 1 e e 9 d 9 a 6 3 0 9 f 9 e e 5 2 a d 1 f b 6 9 6 a e d 5 7 7 8 1 9 1 8 4
C : \ 0 2 3 1 3 e a 6 f 0 0 d 3 8 e c 2 3 1 f a 9 d 6 7 6 8 c d c b 1 f d 9 6 2 a d 3 c f 8 c 9 3 d 8 3 c 1 a 2 9 c e 0 2 9 7 a 4 8 e
C : \ 7 c e 0 0 4 1 a 9 9 a 6 4 f 7 9 d 8 e f f 4 a e 8 8 c a 8 d d 7 a 9 c c 5 5 b 7 e 9 9 3 b 8 7 2 6 e b 5 9 6 2 3 f 4 0 7 6 9 2 8
C : \ z a W F o k W c . e x e
C : \ p S U q _ l P I . e x e
C : \ 7 x X k F A f p . e x e
C : \ 3 6 Q e 1 A t 8 . e x e
C : \ h 0 X O e D v E . e x e
C : \ p E S d 6 h M 3 . e x e
C : \ 5 d c a 0 3 d 4 5 0 c 2 3 c 4 3 3 7 b f 8 0 9 b d b f 5 d f 7 8 4 c 9 8 d 0 9 6 4 f 5 2 7 2 3 b c 8 5 c f 4 f f c 4 7 d 6 b e 3
C : \ U s e r s \ L i s a \ D e s k t o p \ q u X T f w Q L . e x e
C : \ 8 d 1 6 4 d f 2 c 8 a 4 f f e c 9 f 7 d c 1 5 a 9 d 2 6 0 9 9 6 a 4 d 0 1 0 2 9 2 1 0 b 9 a 4 1 b b 7 d 9 0 b 2 0 0 4 3 9 5 4 6
C : \ e 5 2 e e 7 4 1 b d 0 3 c 7 7 9 9 4 9 3 2 5 4 e 1 c c d 7 1 c 9 1 e 8 7 7 2 7 f e b 3 3 f 9 8 9 b b 4 d 6 e c 9 6 b 4 9 9 e b d
C : \ U s e r s \ L i s a \ D e s k t o p \ x y B W 5 a q n . e x e
C : \ U s e r s \ J o h n n y C a g e \ D e s k t o p \ p 4 x h t 3 3 6 3 S . e x e
C : \ p s w m d W 9 3 . e x e
C : \ 4 d 0 4 d f d b f 1 a 6 3 3 0 9 3 0 b 2 0 d f 5 2 c b b 9 8 2 7 d a b 5 0 b 4 3 1 1 4 c 1 d f e 9 5 9 5 1 b 6 8 f a 3 c f 0 a 4
C : \ a Z 7 w l H X e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ G K q s l L m O . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ 3 M B R b t p j e t . e x e
C : \ H R s 6 P C 5 4 . e x e
C : \ 8 8 a 4 7 e 5 0 8 8 b d 2 7 e d c f 2 8 5 a 9 d 1 b 6 2 7 a 3 1 c 4 e c 7 c f a a f a a 9 0 1 e 4 1 c f a 1 6 e 8 c 8 f 4 2 6 0
C : \ _ h R 6 _ 7 c x . e x e
C : \ e 7 9 a 4 c f 2 5 a 8 d 6 d 2 3 9 e e 3 c c d 6 8 1 5 b 1 0 7 3 e 3 9 2 e 4 5 e e d 5 c 1 a 4 d b 4 9 a 1 6 d 6 4 3 9 f 8 9 2 f
C : \ f 5 3 e d 7 6 4 5 0 7 4 a 4 8 4 3 3 1 2 5 3 d 0 4 7 9 4 5 9 5 a c d 5 e 3 c 3 2 f 1 7 7 3 9 0 a e 0 5 7 0 b e e 2 0 6 1 2 5 4 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V B i S H z q V . e x e
C : \ f d d e 4 4 c a 6 c b c 6 f e b 6 d c 6 9 0 5 0 d e b b a b 0 d e 8 e a e e c f 7 c 3 2 b f d c d f a 6 c f a c a e 9 b 8 6 e 8
C : \ M A Z T c V n 0 . e x e
C : \ U s e r s \ j u j u b o x \ D o w n l o a d s \ s a m p l e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ u 4 h j U U X 9 . e x e
C : \ q C A h r 6 n C . e x e
C : \ a 3 9 c c 2 e 3 8 4 8 6 7 9 7 c 6 0 4 5 7 f 7 5 1 b 3 9 8 1 2 3 0 7 d d 6 1 c d e f 7 b 6 a 9 9 1 b d 0 c c 0 c e b 0 9 b 6 b c
C : \ 3 9 7 b 9 b e d d 1 6 0 e 7 a a 0 2 2 f b e 5 5 b a 7 8 2 3 b 9 f f 5 e 1 7 b 8 a 7 3 1 c b b 8 2 f e a 0 1 5 e f 2 f 0 e d c 3
C : \ 4 c 4 c 9 c 2 0 e 4 3 9 d c a f 7 0 a d 9 a e 5 e 5 5 a a a 0 a 2 6 e 3 f b 8 1 1 5 c 5 a 7 b 8 8 1 1 a 7 6 6 9 1 9 6 b c 8 3 9
C : \ U s e r s \ L i s a \ D e s k t o p \ N b k E o B J H . e x e
C : \ 5 2 9 f 0 d 1 c 6 6 f c 2 3 f 7 3 3 2 7 0 7 9 e f d a 5 d 2 e 3 e 1 f 5 2 f 9 a 4 6 b 1 2 a 1 c 8 f 0 3 3 d 4 3 5 f 3 9 3 6 1 c
C : \ 9 e d 3 0 9 f 2 a a c 8 f d b 0 0 1 4 5 4 3 6 0 9 a 5 b 9 8 f c 1 f 6 9 b 5 b c c 2 1 8 3 3 2 1 a 0 4 e 6 2 6 f 9 6 2 7 1 a 5 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ O T b g Y D D h . e x e
C : \ 5 c a D M I Y i . e x e
C : \ b e 0 5 7 6 6 0 0 9 7 f 2 d 4 2 f b 3 a 0 7 d e 3 c 2 4 4 5 7 2 a 7 c 8 a 2 b 1 d d 8 a f 0 1 2 2 d 1 7 1 e 6 c 7 e c e 6 9 0 6
C : \ a f 3 3 d b 6 5 7 1 b b d 8 2 3 5 1 6 b f 5 d c c d 0 c 5 4 1 0 2 a 0 c d c 3 c 0 b 9 9 5 6 3 1 e 2 c 3 8 0 4 f d 3 e c f 4 b a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 7 n 9 U c k n 9 . e x e
C : \ y q L K I H 4 u . e x e
c : \ t a s k \ 0 6 A B 5 4 B F 3 3 7 C 6 F B 0 9 1 D D E 7 5 F 1 3 1 D B A 4 7 . e x e
c : \ t a s k \ 7 5 4 2 A 7 8 5 4 6 F A 5 9 4 3 A 2 0 C D 7 C 4 0 6 5 A 4 A 5 1 . e x e
c : \ t a s k \ F 6 8 C E C 3 9 4 6 8 3 1 5 6 D 9 7 D B B D 2 2 9 0 5 4 2 8 8 0 . e x e
c : \ t a s k \ 3 E A 7 2 E A C D 3 A A B 6 6 5 F 7 4 3 3 4 9 E 5 5 E B A A D D . e x e
c : \ t a s k \ 3 3 1 B 0 1 6 F F C 4 A A 0 7 A B E F B D 3 8 5 A 6 E 7 6 6 A D . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ T J j w U L W U . e x e
C : \ 0 8 9 e 2 2 3 3 e e 2 7 a 0 6 a 3 a c 5 d c 8 f b f e 3 3 3 8 3 b e f 4 9 8 d 3 8 9 4 a 6 6 9 2 9 3 0 6 e 3 a d 8 4 9 c 8 a c d
C : \ 7 b f c 0 c 5 b 5 5 e 1 3 c b 5 8 c e 5 b b 3 e f 0 9 5 9 0 2 f 1 f 4 0 a 2 f 7 6 c 8 7 c f f 2 b 8 a 1 4 3 d 9 f b a c 6 8 0 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 0 0 c 5 2 1 e 9 d f 7 8 9 f f d 0 b 0 f 4 f d 9 d d 6 6 f 3 a 6 9 b f d 7 a 0 3 5 f 3 a 5 c 4 a 6 b 6 7 b d 4 a 3 4 b a f a f 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 2 9 2 b f 9 b 4 2 3 6 c d 9 7 5 e 3 6 4 1 0 6 a 7 b 6 a 2 f 0 5 d 3 b 1 4 7 5 e 7 e e a 4 e 7 a d 5 d 1 2 1 4 1 f 2 7 1 1 a 1 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ c b 3 e a b 4 5 f 9 7 6 4 0 6 6 e 3 c b d 1 6 7 5 7 a 4 4 8 2 9 4 e c 6 d a 6 4 a 9 2 3 6 f 4 a 1 4 1 b 6 6 4 7 f c 2 7 1 e f b
C : \ 0 1 f 3 e 6 c 6 f b 9 e b f e 1 5 b 3 9 8 1 f 7 c 2 7 1 5 5 a 4 1 a 5 c f c 4 9 1 5 c f 4 6 3 1 9 f 0 a e 9 3 a 3 7 b 2 5 4 a c
C : \ 8 6 4 f d 4 d e a a b f 9 0 c 1 b 5 3 7 b c d 1 a 4 7 7 b 7 a c b f 0 9 4 3 0 0 e e e c 5 0 0 7 7 3 0 f 4 8 b 3 f 7 0 b 4 8 f f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X 2 8 6 9 T n D . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ 3 f L E 4 K 1 b v P . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 7 4 5 c 7 4 d 5 6 9 4 c d e 8 0 b d 2 a 1 d b 5 b 8 a 6 9 d 1 . v i r u s . e x e
C : \ 2 9 f b c b 7 e f 0 9 5 1 6 7 6 1 7 0 3 a e 3 5 7 1 6 b 7 1 1 5 3 6 9 3 d c 2 0 9 9 7 9 8 1 1 a 3 7 b f f 3 7 4 a 0 8 c 4 f 9 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X w a k e 9 a n . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 e a d 0 f 9 1 2 3 a 5 e d 5 4 _ w e y j b a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 0 6 c 6 0 6 f 2 0 7 3 c 5 f b _ w e y j b a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ 8 1 5 e 7 2 5 d c 3 9 5 d e 2 6 d 0 d 2 3 7 2 0 c b 3 1 d d f 6 f 6 d c 7 a 8 9 3 4 3 0 9 7 e b b 4 9 f 6 9 d 0 f 6 0 7 1 f a 2
C : \ 2 f c 4 a e 0 7 9 2 f c 9 d 7 6 d c 0 c 7 d 0 9 a 5 0 2 9 c a 0 2 5 0 d 3 5 b 0 b b a f 2 0 b a e 2 9 5 7 9 f c 0 f b 0 e b 1 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D t P D H F g 4 . e x e
C : \ 3 3 3 2 2 8 7 d 3 8 5 b 9 2 0 b e d 2 0 b e f 5 2 2 3 6 6 b 7 7 9 3 1 f 0 a 5 2 3 d 1 f 1 c 9 e 3 3 d 1 e e b 4 d b 5 c 3 7 6 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e 3 f c 3 8 d 7 e b 9 c a d e 5 5 6 4 d . p e 3 2
C : \ f 2 a f f 7 0 c f f 6 7 9 8 c d 1 f 8 6 6 b 3 9 5 d d 8 2 9 4 5 6 1 8 c 4 d 6 6 6 6 f 0 f d 5 c a b 2 e b c 2 2 6 8 1 8 a d e a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ o 0 v K c 7 Z i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x V L 9 G P 3 R . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 5 c 5 c 8 a 4 0 6 5 2 5 b 8 8 7 6 9 5 2 1 4 c c 6 8 7 e 0 b c 9 9 f 3 1 d 9 c 4 2 5 0 e e 2 3 f c e 1 5 7 3 5 8 9 2 6 c b 9 9 . e x e
C : \ 9 4 7 7 e 8 c 3 0 0 8 0 1 5 f 9 8 d 1 4 0 b b f 5 9 2 3 3 0 0 5 6 e 7 0 4 2 0 6 e 8 9 8 d 2 1 3 8 c 0 f 2 f 2 a 6 6 6 9 3 0 d 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ r J 1 a Z 2 j N . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ S t i S q 2 W J 1 Q . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 8 a 9 1 5 3 b 2 9 7 a f 9 a 6 3 f 3 c e 2 e b f e 2 c 6 a 0 5 . v i r u s . e x e
C : \ d a c 6 9 5 b 0 5 a f 5 b b a b e 0 2 f 1 3 4 9 b 5 3 e 2 f 9 9 5 1 3 b b 6 1 f 6 8 5 7 5 b 8 7 6 e 4 a b f 7 e 8 a b 3 0 f c 5
C : \ 6 7 a d 8 a 3 4 7 b c 6 8 d 1 4 8 e b b 8 3 9 0 2 e d 1 2 2 6 f 9 8 2 1 a 0 2 8 5 5 3 e e 6 3 6 5 7 8 c 8 d b 9 b c f 0 f 2 b 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ 0 d b 9 d 4 f f f c b c a 7 3 8 8 9 5 d b 4 5 6 7 a e d 0 d 1 1 1 0 c 3 d a 1 8 7 b e c 1 4 e 9 5 a 0 3 4 f 4 5 6 4 7 3 9 e 5 9
C : \ 3 8 a f 2 3 7 a 7 a a 7 0 3 3 5 6 4 5 3 9 a e 1 c 3 6 7 2 3 b 6 c 0 c 3 a d 0 3 e c b 9 3 1 8 3 8 d 1 a 9 e 3 d d 7 d 8 9 9 8 6
Process Tree
-
05445d90ff1d3f8474bf489c1a90e2eb3815103cd02f5e952941394ccfc33de8.exe (2224)
"C:\Users\Administrator\AppData\Local\Temp\05445d90ff1d3f8474bf489c1a90e2eb3815103cd02f5e952941394ccfc33de8.exe"
- weyjba.exe (1640) "C:\Users\ADMINI~1\AppData\Local\Temp\weyjba.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 18.119.154.66 |
| 3.140.13.188 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| demandtosupply.com |
CNAME traff-6.hugedomains.com
A 3.140.13.188 CNAME hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com A 18.119.154.66 |
3.140.13.188 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 04a3c8ce1b79e6e7_weyjba.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\weyjba.exe |
| Size | 56.1KB |
| Processes | 2224 (05445d90ff1d3f8474bf489c1a90e2eb3815103cd02f5e952941394ccfc33de8.exe) |
| Type | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed |
| MD5 | 455ed65e4bd329fea02a3b430d671475 |
| SHA1 | 58609d6adc96664b0956e3e581aa43c3eb02afc6 |
| SHA256 | 04a3c8ce1b79e6e7be8ffd9fe406ea39ac26c29f99f3e1364b69e33a34567481 |
| CRC32 | 132B63FE |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.