6.4
高危
44 个模型检测该样本为恶意！
重新分析
更多

114c1992506431050542d2cbd33197302ab4ca82cc1bb77430510b403b80a27f

aed6f302524d830e772be723f57fb44c.exe

分析耗时

79s

最近分析

文件大小

737.2KB
静态报毒 动态报毒 100% 1MO77KPM8UE AI SCORE=81 AIDETECTVM ATTRIBUTE BSCOPE CLASSIC CONFIDENCE DELF DPIE FAREIT FSPV GDSDA GENCIRC GENERIC PUA FL GENERICKDZ GENKRYPTIK HIGHCONFIDENCE HQWCFH INVALIDSIG KRYPTIK MALICIOUS MALICIOUS PE MALWARE2 MALWARE@#3HE3XZIOTU9RN REMCOS REMCOSCRYPT UGY@A8RN9YHI UNSAFE ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanDownloader:Win32/Remcos.15115653 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201023 18.4.3895.0
Tencent Malware.Win32.Gencirc.10cde7af 20201023 1.0.0.1
Kingsoft 20201023 2013.8.14.323
McAfee Fareit-FZO!AED6F302524D 20201023 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619826884.113074
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005d0000
success 0 0
Downloads a file or document from Google Drive (1 个事件)
domain drive.google.com
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619826919.879074
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Disables proxy possibly for traffic interception (1 个事件)
Time & API Arguments Status Return Repeated
1619826919.598074
RegSetValueExA
key_handle: 0x000002d4
value: 0
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
success 0 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619826922.442074
RegSetValueExA
key_handle: 0x000003c8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619826922.442074
RegSetValueExA
key_handle: 0x000003c8
value: €ç"¡?>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619826922.442074
RegSetValueExA
key_handle: 0x000003c8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619826922.457074
RegSetValueExW
key_handle: 0x000003c8
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619826922.457074
RegSetValueExA
key_handle: 0x000003e4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619826922.457074
RegSetValueExA
key_handle: 0x000003e4
value: €ç"¡?>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619826922.457074
RegSetValueExA
key_handle: 0x000003e4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619826922.473074
RegSetValueExW
key_handle: 0x000003c4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Network activity contains more than one unique useragent (2 个事件)
process aed6f302524d830e772be723f57fb44c.exe useragent Internal
process aed6f302524d830e772be723f57fb44c.exe useragent WWWWWWWE
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 202.160.130.118:443
File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 个事件)
Bkav W32.AIDetectVM.malware2
MicroWorld-eScan Trojan.GenericKDZ.69279
FireEye Generic.mg.aed6f302524d830e
ALYac Backdoor.Remcos.A
Cylance Unsafe
K7AntiVirus Unwanted-Program ( 005406931 )
Alibaba TrojanDownloader:Win32/Remcos.15115653
K7GW Unwanted-Program ( 005406931 )
Arcabit Trojan.Generic.D10E9F
Cyren W32/Trojan.FSPV-6499
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
BitDefender Trojan.GenericKDZ.69279
NANO-Antivirus Trojan.Win32.Remcos.hqwcfh
Paloalto generic.ml
Tencent Malware.Win32.Gencirc.10cde7af
Ad-Aware Trojan.GenericKDZ.69279
Comodo Malware@#3he3xziotu9rn
VIPRE Trojan.Win32.Generic!BT
Invincea Generic PUA FL (PUA)
McAfee-GW-Edition Fareit-FZO!AED6F302524D
Sophos Generic PUA FL (PUA)
Ikarus Trojan.Inject
Jiangmin Backdoor.Remcos.cci
Webroot W32.Malware.Gen
eGambit PE.Heur.InvalidSig
Microsoft Trojan:Win32/RemcosCrypt.ACH!MTB
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Trojan.GenericKDZ.69279
McAfee Fareit-FZO!AED6F302524D
MAX malware (ai score=81)
VBA32 BScope.Trojan.Downloader
ESET-NOD32 Win32/TrojanDownloader.Delf.CZG
Rising Trojan.Kryptik!1.C56D (CLASSIC)
Yandex Trojan.DL.Delf!1MO77KPm8uE
SentinelOne DFI - Malicious PE
Fortinet W32/GenKryptik.DPIE!tr
BitDefenderTheta Gen:NN.ZelphiF.34570.UGY@a8rn9yhi
AVG Win32:Malware-gen
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Win32/Backdoor.a07
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x478164 VirtualFree
• 0x478168 VirtualAlloc
• 0x47816c LocalFree
• 0x478170 LocalAlloc
• 0x478174 GetTickCount
• 0x47817c GetVersion
• 0x478180 GetCurrentThreadId
• 0x47818c VirtualQuery
• 0x478190 WideCharToMultiByte
• 0x478194 MultiByteToWideChar
• 0x478198 lstrlenA
• 0x47819c lstrcpynA
• 0x4781a0 LoadLibraryExA
• 0x4781a4 GetThreadLocale
• 0x4781a8 GetStartupInfoA
• 0x4781ac GetProcAddress
• 0x4781b0 GetModuleHandleA
• 0x4781b4 GetModuleFileNameA
• 0x4781b8 GetLocaleInfoA
• 0x4781bc GetCommandLineA
• 0x4781c0 FreeLibrary
• 0x4781c4 FindFirstFileA
• 0x4781c8 FindClose
• 0x4781cc ExitProcess
• 0x4781d0 WriteFile
• 0x4781d8 RtlUnwind
• 0x4781dc RaiseException
• 0x4781e0 GetStdHandle
Library user32.dll:
• 0x4781e8 GetKeyboardType
• 0x4781ec LoadStringA
• 0x4781f0 MessageBoxA
• 0x4781f4 CharNextA
Library advapi32.dll:
• 0x4781fc RegQueryValueExA
• 0x478200 RegOpenKeyExA
• 0x478204 RegCloseKey
Library oleaut32.dll:
• 0x47820c SysFreeString
• 0x478210 SysReAllocStringLen
• 0x478214 SysAllocStringLen
Library kernel32.dll:
• 0x47821c TlsSetValue
• 0x478220 TlsGetValue
• 0x478224 LocalAlloc
• 0x478228 GetModuleHandleA
Library advapi32.dll:
• 0x478230 RegQueryValueExA
• 0x478234 RegOpenKeyExA
• 0x478238 RegCloseKey
Library kernel32.dll:
• 0x478240 lstrcpyA
• 0x478244 WriteFile
• 0x478248 WaitForSingleObject
• 0x47824c VirtualQuery
• 0x478250 VirtualProtect
• 0x478254 VirtualAlloc
• 0x478258 Sleep
• 0x47825c SizeofResource
• 0x478260 SetThreadLocale
• 0x478264 SetFilePointer
• 0x478268 SetEvent
• 0x47826c SetErrorMode
• 0x478270 SetEndOfFile
• 0x478274 ResetEvent
• 0x478278 ReadFile
• 0x47827c MultiByteToWideChar
• 0x478280 MulDiv
• 0x478284 LockResource
• 0x478288 LoadResource
• 0x47828c LoadLibraryA
• 0x478298 GlobalUnlock
• 0x47829c GlobalReAlloc
• 0x4782a0 GlobalHandle
• 0x4782a4 GlobalLock
• 0x4782a8 GlobalFree
• 0x4782ac GlobalFindAtomA
• 0x4782b0 GlobalDeleteAtom
• 0x4782b4 GlobalAlloc
• 0x4782b8 GlobalAddAtomA
• 0x4782bc GetVersionExA
• 0x4782c0 GetVersion
• 0x4782c4 GetTickCount
• 0x4782c8 GetThreadLocale
• 0x4782cc GetSystemInfo
• 0x4782d0 GetStringTypeExA
• 0x4782d4 GetStdHandle
• 0x4782d8 GetProcAddress
• 0x4782dc GetModuleHandleA
• 0x4782e0 GetModuleFileNameA
• 0x4782e4 GetLocaleInfoA
• 0x4782e8 GetLocalTime
• 0x4782ec GetLastError
• 0x4782f0 GetFullPathNameA
• 0x4782f4 GetDiskFreeSpaceA
• 0x4782f8 GetDateFormatA
• 0x4782fc GetCurrentThreadId
• 0x478300 GetCurrentProcessId
• 0x478304 GetCPInfo
• 0x478308 GetACP
• 0x47830c FreeResource
• 0x478310 InterlockedExchange
• 0x478314 FreeLibrary
• 0x478318 FormatMessageA
• 0x47831c FindResourceA
• 0x478320 EnumCalendarInfoA
• 0x47832c CreateThread
• 0x478330 CreateFileA
• 0x478334 CreateEventA
• 0x478338 CompareStringA
• 0x47833c CloseHandle
Library version.dll:
• 0x478344 VerQueryValueA
• 0x47834c GetFileVersionInfoA
Library gdi32.dll:
• 0x478354 UnrealizeObject
• 0x478358 StretchBlt
• 0x47835c SetWindowOrgEx
• 0x478360 SetWinMetaFileBits
• 0x478364 SetViewportOrgEx
• 0x478368 SetTextColor
• 0x47836c SetStretchBltMode
• 0x478370 SetROP2
• 0x478374 SetPixel
• 0x478378 SetEnhMetaFileBits
• 0x47837c SetDIBColorTable
• 0x478380 SetBrushOrgEx
• 0x478384 SetBkMode
• 0x478388 SetBkColor
• 0x47838c SelectPalette
• 0x478390 SelectObject
• 0x478394 SaveDC
• 0x478398 RestoreDC
• 0x47839c Rectangle
• 0x4783a0 RectVisible
• 0x4783a4 RealizePalette
• 0x4783a8 PlayEnhMetaFile
• 0x4783ac PatBlt
• 0x4783b0 MoveToEx
• 0x4783b4 MaskBlt
• 0x4783b8 LineTo
• 0x4783bc IntersectClipRect
• 0x4783c0 GetWindowOrgEx
• 0x4783c4 GetWinMetaFileBits
• 0x4783c8 GetTextMetricsA
• 0x4783d4 GetStockObject
• 0x4783d8 GetPixel
• 0x4783dc GetPaletteEntries
• 0x4783e0 GetObjectA
• 0x4783ec GetEnhMetaFileBits
• 0x4783f0 GetDeviceCaps
• 0x4783f4 GetDIBits
• 0x4783f8 GetDIBColorTable
• 0x4783fc GetDCOrgEx
• 0x478400 GetDCPenColor
• 0x478408 GetClipBox
• 0x47840c GetBrushOrgEx
• 0x478410 GetBkMode
• 0x478414 GetBitmapBits
• 0x478418 GdiFlush
• 0x47841c ExcludeClipRect
• 0x478420 DeleteObject
• 0x478424 DeleteEnhMetaFile
• 0x478428 DeleteDC
• 0x47842c CreateSolidBrush
• 0x478430 CreatePenIndirect
• 0x478434 CreatePalette
• 0x47843c CreateFontIndirectA
• 0x478440 CreateDIBitmap
• 0x478444 CreateDIBSection
• 0x478448 CreateCompatibleDC
• 0x478450 CreateBrushIndirect
• 0x478454 CreateBitmap
• 0x478458 CopyEnhMetaFileA
• 0x47845c BitBlt
Library user32.dll:
• 0x478464 CreateWindowExA
• 0x478468 WindowFromPoint
• 0x47846c WinHelpA
• 0x478470 WaitMessage
• 0x478474 UpdateWindow
• 0x478478 UnregisterClassA
• 0x47847c UnhookWindowsHookEx
• 0x478480 TranslateMessage
• 0x478488 TrackPopupMenu
• 0x478490 AnimateWindow
• 0x478494 ShowWindow
• 0x478498 ShowScrollBar
• 0x47849c ShowOwnedPopups
• 0x4784a0 ShowCursor
• 0x4784a4 SetWindowsHookExA
• 0x4784a8 SetWindowPos
• 0x4784ac SetWindowPlacement
• 0x4784b0 SetWindowLongA
• 0x4784b4 SetTimer
• 0x4784b8 SetScrollRange
• 0x4784bc SetScrollPos
• 0x4784c0 SetScrollInfo
• 0x4784c4 SetRect
• 0x4784c8 SetPropA
• 0x4784cc SetParent
• 0x4784d0 SetMenuItemInfoA
• 0x4784d4 SetMenu
• 0x4784d8 SetForegroundWindow
• 0x4784dc SetFocus
• 0x4784e0 SetCursor
• 0x4784e4 SetClassLongA
• 0x4784e8 SetCapture
• 0x4784ec SetActiveWindow
• 0x4784f0 SendMessageA
• 0x4784f4 ScrollWindow
• 0x4784f8 ScreenToClient
• 0x4784fc RemovePropA
• 0x478500 RemoveMenu
• 0x478504 ReleaseDC
• 0x478508 ReleaseCapture
• 0x478514 RegisterClassA
• 0x478518 RedrawWindow
• 0x47851c PtInRect
• 0x478520 PostQuitMessage
• 0x478524 PostMessageA
• 0x478528 PeekMessageA
• 0x47852c OffsetRect
• 0x478530 OemToCharA
• 0x478534 MessageBoxA
• 0x478538 MapWindowPoints
• 0x47853c MapVirtualKeyA
• 0x478540 LoadStringA
• 0x478544 LoadKeyboardLayoutA
• 0x478548 LoadIconA
• 0x47854c LoadCursorA
• 0x478550 LoadBitmapA
• 0x478554 KillTimer
• 0x478558 IsZoomed
• 0x47855c IsWindowVisible
• 0x478560 IsWindowEnabled
• 0x478564 IsWindow
• 0x478568 IsRectEmpty
• 0x47856c IsIconic
• 0x478570 IsDialogMessageA
• 0x478574 IsChild
• 0x478578 InvalidateRect
• 0x47857c IntersectRect
• 0x478580 InsertMenuItemA
• 0x478584 InsertMenuA
• 0x478588 InflateRect
• 0x478590 GetWindowTextA
• 0x478594 GetWindowRect
• 0x478598 GetWindowPlacement
• 0x47859c GetWindowLongA
• 0x4785a0 GetWindowDC
• 0x4785a4 GetTopWindow
• 0x4785a8 GetSystemMetrics
• 0x4785ac GetSystemMenu
• 0x4785b0 GetSysColorBrush
• 0x4785b4 GetSysColor
• 0x4785b8 GetSubMenu
• 0x4785bc GetScrollRange
• 0x4785c0 GetScrollPos
• 0x4785c4 GetScrollInfo
• 0x4785c8 GetPropA
• 0x4785cc GetParent
• 0x4785d0 GetWindow
• 0x4785d4 GetMenuStringA
• 0x4785d8 GetMenuState
• 0x4785dc GetMenuItemInfoA
• 0x4785e0 GetMenuItemID
• 0x4785e4 GetMenuItemCount
• 0x4785e8 GetMenu
• 0x4785ec GetLastActivePopup
• 0x4785f0 GetKeyboardState
• 0x4785f8 GetKeyboardLayout
• 0x4785fc GetKeyState
• 0x478600 GetKeyNameTextA
• 0x478604 GetIconInfo
• 0x478608 GetForegroundWindow
• 0x47860c GetFocus
• 0x478610 GetDesktopWindow
• 0x478614 GetDCEx
• 0x478618 GetDC
• 0x47861c GetCursorPos
• 0x478620 GetCursor
• 0x478624 GetClipboardData
• 0x478628 GetClientRect
• 0x47862c GetClassNameA
• 0x478630 GetClassInfoA
• 0x478634 GetCapture
• 0x478638 GetActiveWindow
• 0x47863c FrameRect
• 0x478640 FindWindowA
• 0x478644 FillRect
• 0x478648 EqualRect
• 0x47864c EnumWindows
• 0x478650 EnumThreadWindows
• 0x478654 EndPaint
• 0x478658 EnableWindow
• 0x47865c EnableScrollBar
• 0x478660 EnableMenuItem
• 0x478664 DrawTextA
• 0x478668 DrawMenuBar
• 0x47866c DrawIconEx
• 0x478670 DrawIcon
• 0x478674 DrawFrameControl
• 0x478678 DrawEdge
• 0x47867c DispatchMessageA
• 0x478680 DestroyWindow
• 0x478684 DestroyMenu
• 0x478688 DestroyIcon
• 0x47868c DestroyCursor
• 0x478690 DeleteMenu
• 0x478694 DefWindowProcA
• 0x478698 DefMDIChildProcA
• 0x47869c DefFrameProcA
• 0x4786a0 CreatePopupMenu
• 0x4786a4 CreateMenu
• 0x4786a8 CreateIcon
• 0x4786ac ClientToScreen
• 0x4786b0 CheckMenuItem
• 0x4786b4 CallWindowProcA
• 0x4786b8 CallNextHookEx
• 0x4786bc BeginPaint
• 0x4786c0 CharNextA
• 0x4786c4 CharLowerBuffA
• 0x4786c8 CharLowerA
• 0x4786cc CharToOemA
• 0x4786d0 AdjustWindowRectEx
Library kernel32.dll:
• 0x4786dc Sleep
Library oleaut32.dll:
• 0x4786e4 SafeArrayPtrOfIndex
• 0x4786e8 SafeArrayGetUBound
• 0x4786ec SafeArrayGetLBound
• 0x4786f0 SafeArrayCreate
• 0x4786f4 VariantChangeType
• 0x4786f8 VariantCopy
• 0x4786fc VariantClear
• 0x478700 VariantInit
Library ole32.dll:
• 0x478708 CoUninitialize
• 0x47870c CoInitialize
Library oleaut32.dll:
• 0x478714 GetErrorInfo
• 0x478718 SysFreeString
Library comctl32.dll:
• 0x478728 ImageList_Write
• 0x47872c ImageList_Read
• 0x47873c ImageList_DragMove
• 0x478740 ImageList_DragLeave
• 0x478744 ImageList_DragEnter
• 0x478748 ImageList_EndDrag
• 0x47874c ImageList_BeginDrag
• 0x478750 ImageList_Remove
• 0x478754 ImageList_DrawEx
• 0x478758 ImageList_Draw
• 0x478768 ImageList_Add
• 0x478774 ImageList_Destroy
• 0x478778 ImageList_Create
Library UrL:
• 0x478780 InetIsOffline

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.