2.0
低危

5ec6a6c9a7233a7ff68d989d830a2249e94a2784e69d5c8a593d3345da14a6b5

a7093b39f2eec51d72821cb4634c6128.exe

分析耗时

15s

最近分析

文件大小

132.5KB
静态报毒 动态报毒 AGEN AI SCORE=100 ARTEMIS BEFZ CQAIPWE2VS4 CVE-2016-7255 CVE-2020-1672 CVE20167255 DYNAMER EPUMSA GENASA GENCIRC S16177430 SCORE TPPZ TROJ64 UNSAFE WIN64RI WXSGFB5MSRQ 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!A7093B39F2EE 20201104 6.0.6.653
Alibaba Trojan:Win64/Dynamer.cfd7e27b 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win64:Malware-gen 20201104 20.10.5736.0
Kingsoft 20201104 2013.8.14.323
Tencent Malware.Win32.Gencirc.11af310f 20201104 1.0.0.1
CrowdStrike 20190702 1.0
行为判定
动态指标
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)
MicroWorld-eScan Exploit.CVE-2016-7255.A
CAT-QuickHeal Trojan.Win64RI.S16177430
McAfee Artemis!A7093B39F2EE
Cylance Unsafe
Zillya Exploit.CVE.Win32.1954
K7AntiVirus Exploit ( 0050f8191 )
Alibaba Trojan:Win64/Dynamer.cfd7e27b
K7GW Exploit ( 0050f8191 )
Cybereason malicious.9f2eec
Arcabit Exploit.CVE-2016-7255.A
Invincea Mal/Generic-S
Symantec Trojan.Gen.2
Avast Win64:Malware-gen
Kaspersky Trojan.Win64.Agent.kic
BitDefender Exploit.CVE-2016-7255.A
NANO-Antivirus Exploit.Win64.CVE20167255.epumsa
AegisLab Trojan.Win64.Agent.tppZ
Rising Exploit.CVE-2016-7255!8.E8FF (TFE:5:wXsgfB5msrQ)
Ad-Aware Exploit.CVE-2016-7255.A
Sophos Mal/Generic-S
F-Secure Heuristic.HEUR/AGEN.1109404
DrWeb Exploit.CVE-2016-7255.1
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ64_EXPLOIT.LPE
McAfee-GW-Edition Artemis!Trojan
FireEye Exploit.CVE-2016-7255.A
Emsisoft Exploit.CVE-2016-7255.A (B)
Jiangmin Trojan.Agent.befz
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1109404
MAX malware (ai score=100)
Antiy-AVL Trojan/Win64.Agent
Gridinsoft Trojan.Win64.Agent.vb!s1
Microsoft Trojan:Win32/Dynamer!rfn
ViRobot Trojan.Win32.S.Agent.135680.HB
ZoneAlarm Trojan.Win64.Agent.kic
GData Exploit.CVE-2016-7255.A
Cynet Malicious (score: 85)
ALYac Exploit.CVE-2016-7255.A
TACHYON Trojan/W32.Agent.135680.WD
VBA32 Trojan.Win64.Agent
Malwarebytes Exploit.Agent
ESET-NOD32 a variant of Win32/Exploit.CVE-2016-7255.B
TrendMicro-HouseCall TROJ64_EXPLOIT.LPE
Tencent Malware.Win32.Gencirc.11af310f
Yandex Trojan.GenAsa!cQAipwE2VS4
Ikarus Exploit.CVE-2016-7255
Fortinet W32/CVE_2016_7255.B!exploit
AVG Win64:Malware-gen
Panda Trj/CI.A
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2017-01-08 07:43:00

Imports

Library USER32.dll:
0x140016270 SetFocus
0x140016278 TranslateMessage
0x140016280 SetParent
0x140016288 GetDesktopWindow
0x140016290 SetWindowLongPtrA
0x140016298 SetForegroundWindow
0x1400162a0 SwitchToThisWindow
0x1400162a8 SendInput
0x1400162b0 GetMessageA
0x1400162b8 ShowWindow
0x1400162c0 DestroyWindow
0x1400162c8 CreateWindowExW
0x1400162d0 RegisterClassExW
0x1400162d8 UnregisterClassW
0x1400162e0 DefWindowProcW
0x1400162e8 DispatchMessageA
Library ADVAPI32.dll:
0x140016000 GetUserNameA
Library KERNEL32.dll:
0x140016010 WriteConsoleW
0x140016018 SetFilePointerEx
0x140016020 HeapReAlloc
0x140016028 HeapSize
0x140016030 ReadConsoleW
0x140016038 ReadFile
0x140016040 GetConsoleMode
0x140016048 CreateFileW
0x140016050 FlushFileBuffers
0x140016058 SetStdHandle
0x140016060 SetEnvironmentVariableA
0x140016068 FreeEnvironmentStringsW
0x140016070 GetEnvironmentStringsW
0x140016078 GetConsoleCP
0x140016080 TlsFree
0x140016088 OutputDebugStringA
0x140016090 GetLastError
0x140016098 HeapAlloc
0x1400160a0 HeapFree
0x1400160a8 GetProcessHeap
0x1400160b0 Sleep
0x1400160b8 GetCurrentProcessId
0x1400160c0 FreeLibrary
0x1400160c8 GetModuleHandleW
0x1400160d0 GetProcAddress
0x1400160d8 LoadLibraryA
0x1400160e0 RtlCaptureContext
0x1400160e8 RtlLookupFunctionEntry
0x1400160f0 RtlVirtualUnwind
0x1400160f8 UnhandledExceptionFilter
0x140016108 GetCurrentProcess
0x140016110 TerminateProcess
0x140016120 QueryPerformanceCounter
0x140016128 GetCurrentThreadId
0x140016130 GetSystemTimeAsFileTime
0x140016138 InitializeSListHead
0x140016140 IsDebuggerPresent
0x140016148 GetStartupInfoW
0x140016150 GetCPInfo
0x140016158 GetOEMCP
0x140016160 SetLastError
0x140016168 EnterCriticalSection
0x140016170 LeaveCriticalSection
0x140016178 DeleteCriticalSection
0x140016188 TlsAlloc
0x140016190 TlsGetValue
0x140016198 TlsSetValue
0x1400161a0 RaiseException
0x1400161a8 LoadLibraryExW
0x1400161b0 ExitProcess
0x1400161b8 GetModuleHandleExW
0x1400161c0 GetStdHandle
0x1400161c8 WriteFile
0x1400161d0 GetModuleFileNameA
0x1400161d8 MultiByteToWideChar
0x1400161e0 WideCharToMultiByte
0x1400161e8 GetCommandLineA
0x1400161f0 GetCommandLineW
0x1400161f8 GetACP
0x140016200 CompareStringW
0x140016208 LCMapStringW
0x140016210 GetStringTypeW
0x140016218 CloseHandle
0x140016220 WaitForSingleObject
0x140016228 GetExitCodeProcess
0x140016230 CreateProcessA
0x140016238 GetFileAttributesExW
0x140016240 GetFileType
0x140016248 FindClose
0x140016250 FindFirstFileExA
0x140016258 FindNextFileA
0x140016260 IsValidCodePage
Library ntdll.dll:
0x1400162f8 RtlUnwindEx

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.