1.1
低危

2753750380481bc77f50f29a358602d98a3dcc081035fc1a72a18c39d0247c47

2753750380481bc77f50f29a358602d98a3dcc081035fc1a72a18c39d0247c47.exe

分析耗时

195s

最近分析

362天前

文件大小

30.6KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER UPATRE
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.67
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanDownloader:Win32/Upatre.4f751dbd 20190527 0.3.0.5
Avast Win32:Agent-AUID [Trj] 20240423 23.9.8494.0
Baidu Win32.Trojan-Downloader.Waski.a 20190318 1.0.0.2
CrowdStrike None 20231026 1.0
Kingsoft malware.kb.a.1000 20230906 None
McAfee Downloader-FSH!AAF8D2BEF6B5 20240423 6.0.6.653
Tencent Malware.Win32.Gencirc.10bf0882 20240423 1.0.0.1
静态指标
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (1 个事件)
section {'name': '.rdata', 'virtual_address': '0x00003000', 'virtual_size': '0x00000b40', 'size_of_data': '0x00000c00', 'entropy': 7.070256148465221} entropy 7.070256148465221 description 发现高熵的节
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意 (50 out of 62 个事件)
ALYac Trojan.Agent.BCMC
APEX Malicious
AVG Win32:Agent-AUID [Trj]
Acronis suspicious
AhnLab-V3 Trojan/Win32.Waski.R103294
Alibaba TrojanDownloader:Win32/Upatre.4f751dbd
Antiy-AVL Trojan/Win32.Bublik
Arcabit Trojan.Agent.BCMC
Avast Win32:Agent-AUID [Trj]
Avira TR/Agent.BYSY
Baidu Win32.Trojan-Downloader.Waski.a
BitDefender Trojan.Agent.BCMC
BitDefenderTheta Gen:NN.ZexaF.36804.buY@a0VLaJbi
Bkav W32.FamVT.GeND.Trojan
CAT-QuickHeal TrojanDownloader.Upatre.A4
ClamAV Win.Malware.Bublik-9948473-0
Cylance unsafe
Cynet Malicious (score: 100)
DeepInstinct MALICIOUS
DrWeb Trojan.DownLoad3.32514
ESET-NOD32 Win32/TrojanDownloader.Waski.A
Elastic malicious (high confidence)
Emsisoft Trojan.Agent.BCMC (B)
F-Secure Trojan:W32/Agent.DUUN
FireEye Generic.mg.aaf8d2bef6b592dc
Fortinet W32/Waski.A!tr
GData Win32.Trojan-Downloader.Upatre.BK
Google Detected
Gridinsoft Trojan.Win32.Agent.vb!s1
Ikarus Trojan-Spy.Agent
Jiangmin Trojan/Generic.azvqp
K7AntiVirus Trojan-Downloader ( 0048f6391 )
K7GW Trojan-Downloader ( 0048f6391 )
Kaspersky HEUR:Trojan.Win32.Generic
Kingsoft malware.kb.a.1000
MAX malware (ai score=87)
Malwarebytes Generic.Malware.AI.DDS
MaxSecure Trojan.Upatre.Gen
McAfee Downloader-FSH!AAF8D2BEF6B5
MicroWorld-eScan Trojan.Agent.BCMC
Microsoft TrojanDownloader:Win32/Upatre.O
NANO-Antivirus Trojan.Win32.Bublik.cwbxyq
Panda Generic Malware
Rising Downloader.Waski!1.A489 (CLASSIC)
Sangfor Suspicious.Win32.Save.a
Skyhigh BehavesLike.Win32.PWSZbot.nm
Sophos Mal/Upatre-A
Symantec ML.Attribute.HighConfidence
Tencent Malware.Win32.Gencirc.10bf0882
TrendMicro TROJ_UPATRE.SMBB
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2006-12-17 21:24:28

PE Imphash

bef15b6d6e736ad99d551c5b799de830

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001073 0x00001200 5.418291402443088
.rdata 0x00003000 0x00000b40 0x00000c00 7.070256148465221
.data 0x00004000 0x000004c6 0x00000600 2.040062143206467
.rsrc 0x00005000 0x00002978 0x00002a00 4.744015383823262
.reloc 0x00008000 0x00000126 0x00000200 2.709729649431876

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000053b8 0x000025a8 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_DIALOG 0x00005278 0x0000013e LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x00007960 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MANIFEST 0x00005130 0x00000148 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library USER32.dll:
0x403030 DialogBoxParamA
0x403034 SendMessageA
0x403038 SetFocus
0x40303c GetMessageW
0x403040 DispatchMessageA
0x403044 EndDialog
0x403048 GetDlgItem
0x40304c IsChild
0x403050 GetActiveWindow
0x403054 SetCapture
0x403058 GetWindowTextW
0x40305c TrackPopupMenu
0x403060 FlashWindowEx
0x403068 GetKeyState
0x40306c MessageBoxA
0x403070 GetDlgItemTextA
Library KERNEL32.dll:
0x403008 HeapAlloc
0x40300c GetProcessHeap
0x403010 GetModuleHandleA
0x403014 CloseHandle
0x403018 GetTickCount
0x40301c HeapFree
0x403020 GetSystemTime
0x403024 GetVersionExA
0x403028 ExitProcess
Library COMCTL32.dll:
0x403000 None

L!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
0h5Tjh
3hE0HhHE
3P0P3DE0ET
53 0ED3
D$Hu$H
EEPHTH0hhTPE
hTT0 555H
EjP5D5$ED
PDhuPHD$
j0P Hu
hh3ET3
tM5\D@
MQ3PPPUR
j05TD@
j05HD@
j05LD@
j05PD@
j05DD@
TP0HjPEP
Du3jPD EH
DH 0D3
u5jEDEu
DPh$0$
E$$p`E
30u0PP3jH
h5 DD5uE$DT
u33jTH
$H03Hu
P55Pu3D
uSAWVAf9
GEGEGMG;r
QIUY0@
h0hhE5T
3P3Tu$HDD
P j jH
DhDjEHj T
uPj5$j33j
T5EPuTh
H 3 $DuEE hj
D00Dj E
EUV3W}
FG3@_^]
DPHTPu
E T$T5h
Hjh55H 5$HDj
PPE5HP0j5
EHhT3hE3
E E 33D3
jjE$$P3$u
h$Eu $D0 VWSSu
X+PQkYIuKXG[O_^
huHjjDuu$PD
5uPPhP
Du$uhjP
E3PE$TDj
3hH3uE
uHjhTR
SUl$(3VWD$
PL$4j%D$4PL$
n0Q'Tk$ Xx
jR0@k(=_
- _`n0Z&vp-6eh
Yu$S|yEDR&vp-6|h[!z&Sm.!R
E*}0UQ =O
o(WCx| #hln0Z&xx/7G
Y(];Ym
!D~^*['\uA
f!>7Uk/6_c
]DJ3Uw
6Z~a0[
/0J)6Gu
Q%@s&jxA!2
p>noNU
.hk$6O)S;b)D
~A;DT)1qAS+
XDKdl=u+S{l9
d\$\CQ
^cjxhAu>h
/H>/C0
$\g[+0
AS>\$\O
S3[UVwc7|^p
^xHUdkoC0H
~XnP^+
ASzjx($\{g
\lj[>)n'
H|50DdLAS+
U{(]3B|2 ikG
U(dxiAA
H$$\['in
ES+lM%)u
3N@hk
>\$|.hk$m
z> Qjo6S}
"@i-:Hd
%]/Em(<En
@DUmSv,S
^km4)3F
tdiminutiveness
#/Hu*g
GetDlgItemTextA
TranslateAcceleratorA
GetKeyState
FlashWindowEx
TrackPopupMenu
GetWindowTextW
SetCapture
GetActiveWindow
IsChild
GetDlgItem
EndDialog
SetFocus
DialogBoxParamA
SendMessageA
MessageBoxA
GetMessageW
DispatchMessageA
USER32.dll
GetVersionExA
GetSystemTime
HeapFree
GetTickCount
CloseHandle
GetModuleHandleA
GetProcessHeap
HeapAlloc
ExitProcess
KERNEL32.dll
COMCTL32.dll
VmrtuelPrktecp
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>
}zz~{{
/////////H<//ZL////////////,
0 0 0 0 0 0 0 0 G<z0 G<0 0 .
/ 0 0 0 0 0 0 0 .
0 2!2!2!2!2!2!2!2!z2!\Q2!2!i^2!2!2!2!2!2!2!0
2!3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"3"2!
4#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#4#
5$5$NBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNBNB5$5$5$
4444444444444
5"575A5^5i5o5t5
555555555555555555
6$6,646:6A6F6P6V6h6o6t6z66666667777:/;;;<<
*2.22262:2>2B2F2J2N2
eneral Public License along with
lastversion
Microsoft Sans Serif
C:\DOCUME~1\USUARI\CONFIG~1\Temp\Rar$DI00.469\FAX_6291741_7941724.scr
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\4z8O1S135.exe
C:\85e00ea8b10d372355b35a5fe7366418f74762fb1bc3c1eb6158ca01fd28bfaf
C:\8068f199a3e6ebc6740b7f08b0c88fd5a64b286f246a5dc5e68505d1a0e42f47
C:\37ff5b5c4adf9500dee00bf282b56d1228a049b05e0b6b254a3b94b9a9618e47
C:\Qna__DgS.exe
C:\5etX4mI7.exe
C:\Rjr87cBa.exe
C:\VT2R5Lud.exe
C:\xjoNcLlt.exe
C:\c5Z6NEyF.exe
C:\konizKsI.exe
C:\pUpzFn2i.exe
C:\9uKEyYYw.exe
C:\AY9YVwqV.exe
C:\fKS8njdk.exe
C:\14YjUTYM.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\tc07UhGSJ.exe
C:\c44a45412e6d0c63f777caaf9f4e4836a798d7d52019469cdff1ddd9bf457f28
C:\c3ed9e9877c80ab3dbba300adb61fac882919e5bbadef2e53f822037c640b582
C:\6cb13e874068e4ac9d0b63da04e142d4d7ee507a6e9e1d706a3457bf85a74351
C:\hFA3UVyi.exe
C:\cWphxCak.exe
C:\pfq4WEpi.exe
C:\yoehQTm7.exe
C:\mjnQ6Khr.exe
C:\8be4ee878e64e25c2bf6a4edfa492c61e0827fba1197b5a593bf5cc5277cf09f
C:\3d872d13588dbd1e3227fd651dfbb63420d3995433f14486593b241a58db70e5
C:\d303dce13ef42de3b8407993f320d526fb8b3dcb31cb5eadfadb3dce3c004569
C:\WIUEJGwk.exe
C:\0bOqyQkp.exe
C:\8mR4EmMz.exe
C:\WCdr4jhB.exe
C:\04f8GR93.exe
C:\DRBmOm38.exe
C:\xBNubuXg.exe
C:\Od9x3jjs.exe
C:\OndPEkId.exe
C:\4pIoIZLs.exe
C:\W5fnlX8J.exe
C:\egKVA_7N.exe
C:\7uHyU4xE.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Vb5oZ4Jwc.exe
C:\dRuSZD0A.exe
C:\RMkf6lcy.exe
C:\oUaxAkak.exe
C:\2zjZrlG9.exe
C:\LVxeHf9F.exe
C:\DO0LRutU.exe
C:\YOZ2Mvh_.exe
C:\WA2Ga3MC.exe
C:\oZYbdoZD.exe
C:\VSWak6sb.exe
C:\acf460116f0df5639692919c76fa265388cee488a445192c3a7c0231f8855b04
C:\f434a98959204438c63ff14dad7f6a7edb8fa67d131ddf790548ec985b627561
C:\9iPL96pa.exe
C:\e8139aac50c015ee76fd3078488206f2b840f3e5bb4b1836f87a620b7fc02661
C:\34db8db2b272238056b5f5d6c2dc8595656ea55e765bf688180deb182fe74701
C:\Users\admin\Downloads\invoice.exe
C:\2bc2b305c61a3d7c8930759c8997ac4be830a8a6be967d6e3e4f14e360a7ba8b
C:\Users\admin\Downloads\sample.exe
C:\8a8de15d53d6d1d387db7a65f1ae9dc4725725634d38da38eee6388e188c26e7
C:\765a993dd8060e34c954f61f50806bde0f23fbe0e9e9ce5f5ef6fa99dcde502b
C:\Users\admin\Downloads\factura.exe
C:\655225668a3d786f156d3a15e8db9f6d87e23ae2b1337905a4192f85efc3ef2a
C:\886Dt1ca.exe
C:\2e906f9cb5c6ca74d67f208923f92611917b4e233882eac17107408a5ad6325a
C:\09b237fafbd9db53652b5489deacd914a91ce13e3ffcd827f97b1a2f9f0fa50c
C:\Users\admin\Downloads\important_document.exe
C:\550d8ef41e9a525ef8042ffc66ccc911290f546960af9aaa8391c8401e3b94bb
C:\Users\admin\Downloads\invoice.exe
C:\936cd2cd326355c7a4a2c7236ce8be448f196d988686e1e6360b40967b2f4bef
C:\97db37bcbc3937b5ab8561e3ef7438755db4e38df678b870d31752e0780c7c56
C:\Users\admin\Downloads\important_document.exe
C:\cYPykMQf.exe
C:\763c4d6ea2a5d4aaaf919b78556588f9d269a185106ae232a68ea9b147064ad0
C:\Users\admin\Downloads\invoice.exe
C:\d9a7b4d13d21820dc6f2a8f429de88247aa0c9716f1b09561d3a2eaba8c57c28
C:\66febce0236d7ebabe3cc241e28eee8b11fe604536d6dfdef778ced13dc5175d
C:\Users\admin\Downloads\sample.exe
C:\ea650ece540c2ca85e7d8327b6e59a6ea9c77517c090ddc10c99464a799964a5
C:\Users\admin\Downloads\factura.exe
C:\rddVuZxH.exe
C:\8deba48480126af3443ab1301fbbd33139e6a9083b1e83ee0bd359941b73651e
C:\ee4ada147df069c18374b20929b9efc16d1197fc56cf81ac5080572ac1121571
C:\06479f6ad7930a26abc0160212b13632c5a9b639f823dd25d63026c09191713b
C:\Users\Joe Cage\Desktop\8NsAanFAHY.exe
C:\Users\admin\Downloads\8890b6ec43a06428f50dd3aced28c537.exe
C:\7b4ce388f26be486cefd9e569d9735c8723b820caa0b4c80863f2892f6062174
C:\Users\Petra\AppData\Local\Temp\lcas.pe32
C:\Users\Petra\AppData\Local\Temp\lcas.pe32
C:\8be5d36358aed4557e5bbac3b8d12579df396286ec809ccf1e56db7a19864504
C:\4057f877799509fc6e19096f3f780acb008ad7902b26b55fe4c7ab0cea9c8217
C:\79165eef65cf218a68ac4451997c28d0c3d15b01317539da6c0dab42e0d2bf4d
C:\Users\John\AppData\Local\Temp\iZkfaiohGv.exe
C:\d95189b9d83be7f3f7bda03ad7e21bfd61f1332b8fc5297a38fc2e535d61c08e
C:\Users\admin\Downloads\lcas.exe
C:\a50f728fd28ff0dfddbd3f061c958e0f7c8c6ad515a683c7b148405e064f4089
C:\Users\admin\Downloads\lcas.exe
C:\3742f69ba1bdc0b24221284ff9400a4b332377bd7dfe040ad736494120f6cee8
C:\Users\admin\Downloads\lcas.exe
C:\Users\Petra\AppData\Local\Temp\lcas.pe32
C:\47bf3295cd351bbb9b3ad21402ba9d83bb80c4ba28c52736fb61dab360d5703f
C:\Users\admin\Downloads\lcas.exe
C:\4142855c94e2a51a4476a78716b6ababbe5969d13a235789b12ae7d18fec35bd
C:\Users\admin\Downloads\lcas.exe
C:\89024e46987555bd18e7390e4e6052238d5a5c52cc0b2b0717c11b2f87a29e0f
C:\Users\admin\Downloads\lcas.exe
C:\dea710c2aa9d6c4a9f0a80b46ca06f57b7fc1e0a388711252b8d53cb80ecd504
C:\Users\admin\Downloads\lcas.exe
C:\64088d2fb965dda7674f77161898ab1ba8728d1bcff4bb35a6eaf558ab560797
C:\40d7909c410e6208994bfb5ec339923e00284d24dca8c8e86630420d9a836cac
C:\d4b8541d54674cbcaf50d6d346266eb5459b1040e632815eddf99933b3c0fe7e
C:\Users\Petra\AppData\Local\Temp\lcas.pe32
C:\Users\admin\Downloads\471bc53464a1cc8e_lcas.exe

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.