2.4
中危
1 个模型检测该样本为恶意！
重新分析
更多

974c47bfda6be6cbc73efe60ef295a1cea07262ceffebcd88d65c51048cc4355

b226adafd70087e5ba0799745a8774af.exe

分析耗时

77s

最近分析

文件大小

3.2MB
静态报毒 动态报毒 JAVA SMSER
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20201010 6.0.6.653
CrowdStrike 20190702 1.0
Baidu 20190318 1.0.0.2
Avast 20201010 18.4.3895.0
Alibaba 20190527 0.3.0.5
Kingsoft 20201010 2013.8.14.323
静态指标
The executable uses a known packer (1 个事件)
packer MinGW GCC 3.x
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:3424952517&cup2hreq=92b0f0a615b02a31e546111ddc37e54e4834daa596dab6a3f2f89a14d5857d8a
Performs some HTTP requests (5 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=fb73d20c39f64c9&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=3
request GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=fb73d20c39f64c9&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=3
request POST https://update.googleapis.com/service/update2?cup2key=10:3424952517&cup2hreq=92b0f0a615b02a31e546111ddc37e54e4834daa596dab6a3f2f89a14d5857d8a
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:3424952517&cup2hreq=92b0f0a615b02a31e546111ddc37e54e4834daa596dab6a3f2f89a14d5857d8a
File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)
Antiy-AVL Trojan/Java.SMSer
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2017-07-14 15:31:59

Imports

Library ADVAPI32.DLL:
• 0x411204 RegCloseKey
• 0x411208 RegEnumKeyExA
• 0x41120c RegOpenKeyExA
• 0x411210 RegQueryValueExA
Library KERNEL32.dll:
• 0x41121c CloseHandle
• 0x411220 CreateMutexA
• 0x411224 CreateProcessA
• 0x411228 ExitProcess
• 0x41122c FindResourceExA
• 0x411230 FormatMessageA
• 0x411234 GetCommandLineA
• 0x41123c GetCurrentProcess
• 0x411244 GetExitCodeProcess
• 0x411248 GetLastError
• 0x41124c GetModuleFileNameA
• 0x411250 GetModuleHandleA
• 0x411254 GetProcAddress
• 0x411258 GetStartupInfoA
• 0x411260 LoadResource
• 0x411264 LocalFree
• 0x411268 LockResource
• 0x411270 SetLastError
• 0x411278 WaitForSingleObject
Library msvcrt.dll:
• 0x411284 __getmainargs
• 0x411288 __p__environ
• 0x41128c __p__fmode
• 0x411290 __set_app_type
• 0x411294 _cexit
• 0x411298 _chdir
• 0x41129c _close
• 0x4112a0 _findclose
• 0x4112a4 _findfirst
• 0x4112a8 _findnext
• 0x4112ac _iob
• 0x4112b0 _itoa
• 0x4112b4 _onexit
• 0x4112b8 _open
• 0x4112bc _read
• 0x4112c0 _setmode
• 0x4112c4 _stat
• 0x4112c8 atexit
• 0x4112cc atoi
• 0x4112d0 fclose
• 0x4112d4 fopen
• 0x4112d8 fprintf
• 0x4112dc fwrite
• 0x4112e0 memset
• 0x4112e4 printf
• 0x4112e8 puts
• 0x4112ec signal
• 0x4112f0 strcat
• 0x4112f4 strchr
• 0x4112f8 strcmp
• 0x4112fc strcpy
• 0x411300 strlen
• 0x411304 strncat
• 0x411308 strncpy
• 0x41130c strpbrk
• 0x411310 strrchr
• 0x411314 strstr
• 0x411318 strtok
Library SHELL32.DLL:
• 0x411324 ShellExecuteA
Library USER32.dll:
• 0x411330 CreateWindowExA
• 0x411334 DispatchMessageA
• 0x411338 EnumWindows
• 0x41133c FindWindowExA
• 0x411340 GetMessageA
• 0x411344 GetSystemMetrics
• 0x411348 GetWindowLongA
• 0x41134c GetWindowRect
• 0x411350 GetWindowTextA
• 0x411358 KillTimer
• 0x41135c LoadImageA
• 0x411360 MessageBoxA
• 0x411364 PostQuitMessage
• 0x411368 SendMessageA
• 0x41136c SetForegroundWindow
• 0x411370 SetTimer
• 0x411374 SetWindowPos
• 0x411378 ShowWindow
• 0x41137c TranslateMessage
• 0x411380 UpdateWindow

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49180 113.108.239.161 redirector.gvt1.com 80
192.168.56.101 49181 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49182 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49179 203.208.40.34 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 53658 239.255.255.250 3702
192.168.56.101 53660 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=fb73d20c39f64c9&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=3 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=fb73d20c39f64c9&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=6747-18875
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=fb73d20c39f64c9&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=3 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=fb73d20c39f64c9&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=fb73d20c39f64c9&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=3 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=fb73d20c39f64c9&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620967944&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-6746
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.