SmartHawk

5.0

中危

39 个模型检测该样本为恶意！

重新分析

下载样本

ce92a966eb718e50a451ffc5610b5f32f0402ee375b8443f55cdf3311d60ac8a

a6bce0cb27d070b147e507ddf31514ad.exe

分析耗时

93s

最近分析

文件大小

194.0KB

静态报毒动态报毒 ACCG AI SCORE=87 ARTEMIS BADCERT CLASSIC DANGEROUSSIG GENERICKD HCBCT MALCERT MALWARE@#37HYUGH872F4R METERPRETER MUYH R + MAL R023C0RHT20 SUSPICIOUS PE UNSAFE YMACCO 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!A6BCE0CB27D0	20200920	6.0.6.653
Alibaba	Trojan:Win32/hcbct.b914f305	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win64:DangerousSig [Trj]	20200920	18.4.3895.0
Kingsoft		20200920	2013.8.14.323
Tencent		20200920	1.0.0.1
CrowdStrike		20190702	1.0

This executable is signed

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619808648.064146 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	203.208.41.33

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619808650.908146 RegSetValueExA	key_handle: 0x0000000000000394 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619808650.908146 RegSetValueExA	key_handle: 0x0000000000000394 value: °.Ù=× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619808650.908146 RegSetValueExA	key_handle: 0x0000000000000394 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619808650.908146 RegSetValueExW	key_handle: 0x0000000000000394 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619808650.908146 RegSetValueExA	key_handle: 0x00000000000003b4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619808650.908146 RegSetValueExA	key_handle: 0x00000000000003b4 value: °.Ù=× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619808650.908146 RegSetValueExA	key_handle: 0x00000000000003b4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619808650.939146 RegSetValueExW	key_handle: 0x0000000000000384 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Network activity contains more than one unique useragent (2 个事件)

process	a6bce0cb27d070b147e507ddf31514ad.exe				useragent
process	a6bce0cb27d070b147e507ddf31514ad.exe				useragent	Internal

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 个事件)

MicroWorld-eScan	Trojan.GenericKD.34433401
FireEye	Generic.mg.a6bce0cb27d070b1
McAfee	Artemis!A6BCE0CB27D0
Malwarebytes	Backdoor.Bot
Zillya	Trojan.Agent.Win32.1401907
Sangfor	Malware
K7AntiVirus	Trojan ( 0056a4101 )
Alibaba	Trojan:Win32/hcbct.b914f305
K7GW	Trojan ( 0056a4101 )
Arcabit	Trojan.Generic.D20D6979
Invincea	Mal/Generic-R + Mal/BadCert-Gen
Cyren	W64/Trojan.MUYH-0660
Symantec	Trojan.Gen.2
Avast	Win64:DangerousSig [Trj]
BitDefender	Trojan.GenericKD.34433401
Paloalto	generic.ml
Rising	Trojan.MalCert!1.C7FD (CLASSIC)
Ad-Aware	Trojan.GenericKD.34433401
Comodo	Malware@#37hyugh872f4r
F-Secure	Trojan.TR/Agent.hcbct
DrWeb	BackDoor.Spy.3756
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R023C0RHT20
Sophos	Mal/BadCert-Gen
SentinelOne	DFI - Suspicious PE
Avira	TR/Agent.hcbct
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Win32.Agent
Microsoft	Trojan:Win32/Ymacco.AACE
GData	Trojan.GenericKD.34433401
ALYac	Trojan.GenericKD.34433401
VBA32	Backdoor.Spy
Cylance	Unsafe
ESET-NOD32	a variant of Win32/Agent.ACCG.gen
TrendMicro-HouseCall	TROJ_GEN.R023C0RHT20
Ikarus	Trojan.Win32.Meterpreter
Fortinet	W32/Agent.ACCG!tr
AVG	Win64:DangerousSig [Trj]
Qihoo-360	Win64/Trojan.445

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	172.217.24.14:443
dead_host	31.13.68.22:80
dead_host	157.240.3.50:80
dead_host	172.217.27.142:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-27 18:50:29

Imports

Library KERNEL32.dll:

• 0x14001c000 ExitProcess

• 0x14001c008 FormatMessageA

• 0x14001c010 GetLastError

• 0x14001c018 GetProcAddress

• 0x14001c020 GetModuleHandleA

• 0x14001c028 LocalFree

• 0x14001c030 HeapReAlloc

• 0x14001c038 HeapAlloc

• 0x14001c040 GetCurrentProcess

• 0x14001c048 HeapFree

• 0x14001c050 GetProcessHeap

• 0x14001c058 IsBadReadPtr

• 0x14001c060 CreateRemoteThread

• 0x14001c068 OpenProcess

• 0x14001c070 InitializeCriticalSectionEx

• 0x14001c078 RaiseException

• 0x14001c080 CreateDirectoryA

• 0x14001c088 HeapSize

• 0x14001c090 VirtualAlloc

• 0x14001c098 VirtualAllocEx

• 0x14001c0a0 DecodePointer

• 0x14001c0a8 IsDebuggerPresent

• 0x14001c0b0 DeleteCriticalSection

• 0x14001c0b8 WinExec

• 0x14001c0c0 CloseHandle

• 0x14001c0c8 GetCurrentProcessId

• 0x14001c0d0 WriteProcessMemory

• 0x14001c0d8 CreateFileW

• 0x14001c0e0 ReadConsoleW

• 0x14001c0e8 WriteConsoleW

• 0x14001c0f0 SetStdHandle

• 0x14001c0f8 OutputDebugStringW

• 0x14001c100 LoadLibraryExW

• 0x14001c108 SetFilePointerEx

• 0x14001c110 ReadFile

• 0x14001c118 GetConsoleMode

• 0x14001c120 GetConsoleCP

• 0x14001c128 FlushFileBuffers

• 0x14001c130 WideCharToMultiByte

• 0x14001c138 EncodePointer

• 0x14001c140 EnterCriticalSection

• 0x14001c148 LeaveCriticalSection

• 0x14001c150 MultiByteToWideChar

• 0x14001c158 GetStringTypeW

• 0x14001c160 IsProcessorFeaturePresent

• 0x14001c168 GetCommandLineW

• 0x14001c170 GetCPInfo

• 0x14001c178 UnhandledExceptionFilter

• 0x14001c180 SetUnhandledExceptionFilter

• 0x14001c188 SetLastError

• 0x14001c190 InitializeCriticalSectionAndSpinCount

• 0x14001c198 Sleep

• 0x14001c1a0 TerminateProcess

• 0x14001c1a8 TlsAlloc

• 0x14001c1b0 TlsGetValue

• 0x14001c1b8 TlsSetValue

• 0x14001c1c0 TlsFree

• 0x14001c1c8 GetStartupInfoW

• 0x14001c1d0 GetModuleHandleW

• 0x14001c1d8 LCMapStringW

• 0x14001c1e0 GetLocaleInfoW

• 0x14001c1e8 IsValidLocale

• 0x14001c1f0 GetUserDefaultLCID

• 0x14001c1f8 EnumSystemLocalesW

• 0x14001c200 GetModuleHandleExW

• 0x14001c208 GetStdHandle

• 0x14001c210 WriteFile

• 0x14001c218 GetModuleFileNameW

• 0x14001c220 GetCurrentThreadId

• 0x14001c228 GetFileType

• 0x14001c230 QueryPerformanceCounter

• 0x14001c238 GetSystemTimeAsFileTime

• 0x14001c240 GetEnvironmentStringsW

• 0x14001c248 FreeEnvironmentStringsW

• 0x14001c250 IsValidCodePage

• 0x14001c258 GetACP

• 0x14001c260 GetOEMCP

Library USER32.dll:

• 0x14001c270 MessageBoxA

Library WININET.dll:

• 0x14001c280 InternetOpenUrlA

• 0x14001c288 InternetCheckConnectionA

• 0x14001c290 InternetCloseHandle

• 0x14001c298 InternetOpenA

Library ntdll.dll:

• 0x14001c2a8 RtlLookupFunctionEntry

• 0x14001c2b0 RtlUnwindEx

• 0x14001c2b8 RtlCaptureContext

• 0x14001c2c0 RtlVirtualUnwind

• 0x14001c2c8 RtlPcToFileHeader

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
www.maliciouscodenotdetected.com
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
www.google.com	A 31.13.68.22	31.13.76.65
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
www.facebook.com	A 157.240.3.50	208.101.60.87
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62191	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	54178	224.0.0.252	5355
192.168.56.101	54991	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.