SmartHawk

6.0

高危

57 个模型检测该样本为恶意！

重新分析

下载样本

b4723adee406341b9309c9105cde818a38b6b4f7640592b8195660cf72a4ec39

ac94e8f57b1b8a25149ddf4ef53f694f.exe

分析耗时

76s

最近分析

文件大小

136.1KB

静态报毒动态报毒 100% AGEN AI SCORE=84 ATTRIBUTE BANKERX CONFIDENCE DOWNLOADER34 ELDORADO EMOTET EPAZ GENCIRC GENERICKD GENETIC GENKRYPTIK HFIP HIGH CONFIDENCE HIGHCONFIDENCE HPHUZO IY1@AUB3D5LK KCLOUD KRYPTIK MALWARE@#2HB16RR4HBSUY R + TROJ R346379 SCORE SGENERIC SUSGEN THHOEBO UNSAFE WQ986+9YMS0 ZEXTET 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRH!AC94E8F57B1B	20201211	6.0.6.653
Baidu		20190318	1.0.0.2
Alibaba	Trojan:Win32/Emotet.eef04779	20190527	0.3.0.5
Kingsoft	Win32.Troj.Banker.(kcloud)	20201211	2017.9.26.565
Tencent	Malware.Win32.Gencirc.10cde566	20201211	1.0.0.1
Avast	Win32:BankerX-gen [Trj]	20201210	21.1.5827.0
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826894.666139 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619826886.354139 CryptGenKey	crypto_handle: 0x004e6c38 algorithm_identifier: 0x0000660e () provider_handle: 0x004e6128 flags: 1 key: f¹5n?þJ3PÁ!6,	success	1
1619826894.682139 CryptExportKey	crypto_handle: 0x004e6c38 crypto_export_handle: 0x004e61f0 buffer: f¤)ÓaÜ®=Ñ¡COÙ\|@þ«»z{Ç;9²k¦ÓÅMëF7?y\|f+Ò¨²³ÅÓfZP/ÁzÐú_aôù¿=IøM®]c»J@Uü¤×X&ø6' n; blob_type: 1 flags: 64	success	1
1619826930.041139 CryptExportKey	crypto_handle: 0x004e6c38 crypto_export_handle: 0x004e61f0 buffer: f¤á0.Ó Ð*Z¯p¸¥Wls#ñ.\$Ø¹nKÀ6ÌYÔÏ¶é°ñcÿì2®r´6Ì&T§ê¿««a²p®¹Úne¢íÊQøÒH1Þí®.º blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826885.760139 NtAllocateVirtualMemory	process_identifier: 2900 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x023d0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826895.244139 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

ac94e8f57b1b8a25149ddf4ef53f694f.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826894.854139 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	177.37.81.212
host	74.207.230.187

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619826897.823139 RegSetValueExA	key_handle: 0x000003a0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619826897.823139 RegSetValueExA	key_handle: 0x000003a0 value: ðJ?±+>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619826897.823139 RegSetValueExA	key_handle: 0x000003a0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619826897.823139 RegSetValueExW	key_handle: 0x000003a0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619826897.823139 RegSetValueExA	key_handle: 0x000003b8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619826897.823139 RegSetValueExA	key_handle: 0x000003b8 value: ðJ?±+>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619826897.823139 RegSetValueExA	key_handle: 0x000003b8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619826897.854139 RegSetValueExW	key_handle: 0x0000039c value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34261964
FireEye	Trojan.GenericKD.34261964
McAfee	Emotet-FRH!AC94E8F57B1B
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056fe271 )
BitDefender	Trojan.GenericKD.34261964
K7GW	Trojan ( 0056fe271 )
Cyren	W32/Emotet.AOC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Emotet-9528733-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.pef
Alibaba	Trojan:Win32/Emotet.eef04779
NANO-Antivirus	Trojan.Win32.Emotet.hphuzo
AegisLab	Trojan.Multi.Generic.4!c
Ad-Aware	Trojan.GenericKD.34261964
Emsisoft	Trojan.Emotet (A)
Comodo	Malware@#2hb16rr4hbsuy
F-Secure	Heuristic.HEUR/AGEN.1136732
DrWeb	Trojan.DownLoader34.10042
Zillya	Backdoor.Emotet.Win32.647
TrendMicro	TrojanSpy.Win32.EMOTET.THHOEBO
McAfee-GW-Edition	BehavesLike.Win32.Emotet.cm
Sophos	Mal/Generic-R + Troj/Emotet-CKK
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.ow
Avira	HEUR/AGEN.1136732
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Win32.SGeneric
Kingsoft	Win32.Troj.Banker.(kcloud)
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
Gridinsoft	Trojan.Win32.Emotet.oa
Arcabit	Trojan.Generic.D20ACBCC
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.pef
GData	Trojan.GenericKD.34261964
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Emotet.R346379
BitDefenderTheta	Gen:NN.Zextet.34670.iy1@auB3D5lk
ALYac	Trojan.GenericKD.34261964
TACHYON	Backdoor/W32.Emotet.139377
VBA32	Trojan.Downloader
Malwarebytes	Trojan.MalPack.TRE
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Kryptik.HFIP
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THHOEBO
Tencent	Malware.Win32.Gencirc.10cde566

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	74.207.230.187:8080
dead_host	177.37.81.212:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-29 19:48:16

Imports

Library SHLWAPI.dll:

• 0x412a60 StrRetToStrA

Library MFC42.DLL:

• 0x41263c

• 0x412640

• 0x412644

• 0x412648

• 0x41264c

• 0x412650

• 0x412654

• 0x412658

• 0x41265c

• 0x412660

• 0x412664

• 0x412668

• 0x41266c

• 0x412670

• 0x412674

• 0x412678

• 0x41267c

• 0x412680

• 0x412684

• 0x412688

• 0x41268c

• 0x412690

• 0x412694

• 0x412698

• 0x41269c

• 0x4126a0

• 0x4126a4

• 0x4126a8

• 0x4126ac

• 0x4126b0

• 0x4126b4

• 0x4126b8

• 0x4126bc

• 0x4126c0

• 0x4126c4

• 0x4126c8

• 0x4126cc

• 0x4126d0

• 0x4126d4

• 0x4126d8

• 0x4126dc

• 0x4126e0

• 0x4126e4

• 0x4126e8

• 0x4126ec

• 0x4126f0

• 0x4126f4

• 0x4126f8

• 0x4126fc

• 0x412700

• 0x412704

• 0x412708

• 0x41270c

• 0x412710

• 0x412714

• 0x412718

• 0x41271c

• 0x412720

• 0x412724

• 0x412728

• 0x41272c

• 0x412730

• 0x412734

• 0x412738

• 0x41273c

• 0x412740

• 0x412744

• 0x412748

• 0x41274c

• 0x412750

• 0x412754

• 0x412758

• 0x41275c

• 0x412760

• 0x412764

• 0x412768

• 0x41276c

• 0x412770

• 0x412774

• 0x412778

• 0x41277c

• 0x412780

• 0x412784

• 0x412788

• 0x41278c

• 0x412790

• 0x412794

• 0x412798

• 0x41279c

• 0x4127a0

• 0x4127a4

• 0x4127a8

• 0x4127ac

• 0x4127b0

• 0x4127b4

• 0x4127b8

• 0x4127bc

• 0x4127c0

• 0x4127c4

• 0x4127c8

• 0x4127cc

• 0x4127d0

• 0x4127d4

• 0x4127d8

• 0x4127dc

• 0x4127e0

• 0x4127e4

• 0x4127e8

• 0x4127ec

• 0x4127f0

• 0x4127f4

• 0x4127f8

• 0x4127fc

• 0x412800

• 0x412804

• 0x412808

• 0x41280c

• 0x412810

• 0x412814

• 0x412818

• 0x41281c

• 0x412820

• 0x412824

• 0x412828

• 0x41282c

• 0x412830

• 0x412834

• 0x412838

• 0x41283c

• 0x412840

• 0x412844

• 0x412848

• 0x41284c

• 0x412850

• 0x412854

• 0x412858

• 0x41285c

• 0x412860

• 0x412864

• 0x412868

• 0x41286c

• 0x412870

• 0x412874

• 0x412878

• 0x41287c

Library MSVCRT.dll:

• 0x41298c ?terminate@@YAXXZ

• 0x412990 _except_handler3

• 0x412994 wcslen

• 0x412998 atoi

• 0x41299c __dllonexit

• 0x4129a0 _mbsicoll

• 0x4129a4 _mbscmp

• 0x4129a8 __CxxFrameHandler

• 0x4129ac _onexit

• 0x4129b0 _setmbcp

• 0x4129b4 _controlfp

• 0x4129b8 __set_app_type

• 0x4129bc __p__fmode

• 0x4129c0 __p__commode

• 0x4129c4 _adjust_fdiv

• 0x4129c8 __setusermatherr

• 0x4129cc _initterm

• 0x4129d0 __getmainargs

• 0x4129d4 _acmdln

• 0x4129d8 exit

• 0x4129dc _XcptFilter

• 0x4129e0 _exit

• 0x4129e4 qsort

Library KERNEL32.dll:

• 0x4125e8 GetTickCount

• 0x4125ec GetCurrentProcess

• 0x4125f0 SizeofResource

• 0x4125f4 GetProcAddress

• 0x4125f8 LoadLibraryExA

• 0x4125fc LoadLibraryExW

• 0x412600 GetModuleHandleA

• 0x412604 GetStartupInfoA

• 0x412608 GetFileAttributesA

Library USER32.dll:

• 0x412a90 DrawIcon

• 0x412a94 SendMessageA

• 0x412a98 IsIconic

• 0x412a9c GetSystemMetrics

• 0x412aa0 GetClientRect

• 0x412aa4 AppendMenuA

• 0x412aa8 GetSystemMenu

• 0x412aac LoadIconA

• 0x412ab0 EnableWindow

• 0x412ab4 GetParent

Library SHELL32.dll:

• 0x412a24 SHGetFileInfoA

• 0x412a28 SHGetMalloc

• 0x412a2c SHGetSpecialFolderLocation

• 0x412a30 SHGetDesktopFolder

Library ole32.dll:

• 0x412aec CoTaskMemFree

Library MSVCP60.dll:

• 0x412920 ??1_Winit@std@@QAE@XZ

• 0x412924 ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

• 0x412928 ??0Init@ios_base@std@@QAE@XZ

• 0x41292c ??1Init@ios_base@std@@QAE@XZ

• 0x412930 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

• 0x412934 ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB

• 0x412938 ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z

• 0x41293c ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z

• 0x412940 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z

• 0x412944 ??0_Winit@std@@QAE@XZ

• 0x412948 ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z

• 0x41294c ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z

• 0x412950 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x412954 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.