5.8
高危
44 个模型检测该样本为恶意！
重新分析
更多

078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1

b2425f64492f99241646dc518ca34cab.exe

分析耗时

27s

最近分析

文件大小

3.3MB
静态报毒 动态报毒 100% AI SCORE=81 ARTEMIS ATTRIBUTE BCPE CONFIDENCE GEN7 GENERICKD HBDNVX HIGHCONFIDENCE HWOCEPSA KCLOUD MALWARE@#1X8DTSVPOXDNB PCRY PYTHON ROZENA RWWD SAVE SCORE SWRORT TNEGA UNSAFE WACATAC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!B2425F64492F 20210404 6.0.6.653
Alibaba Trojan:Win32/Rozena.9b14342e 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Agent-BCPE [Trj] 20210404 21.1.5827.0
Kingsoft Win32.Troj.Undef.(kcloud) 20210404 2017.9.26.565
Tencent Win32.Trojan.Rozena.Pcry 20210404 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619881334.976498
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00520000
success 0 0
1619881335.070498
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005a0000
success 0 0
1619881335.070498
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005a0000
success 0 0
Creates executable files on the filesystem (4 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\msvcr90.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\python27.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\msvcm90.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\msvcp90.dll
Drops an executable to the user AppData folder (9 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\bz2.pyd
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\msvcm90.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\python27.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\_ctypes.pyd
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\select.pyd
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\msvcp90.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\msvcr90.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\_hashlib.pyd
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI7842\unicodedata.pyd
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619881335.726498
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (6 个事件)
host 103.83.81.17
host 139.199.158.84
host 172.217.24.14
host 203.208.41.65
host 203.208.41.66
host 58.63.233.69
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619881338.304498
RegSetValueExA
key_handle: 0x00000370
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619881338.304498
RegSetValueExA
key_handle: 0x00000370
value: ;ãq>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619881338.304498
RegSetValueExA
key_handle: 0x00000370
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619881338.304498
RegSetValueExW
key_handle: 0x00000370
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619881338.304498
RegSetValueExA
key_handle: 0x00000388
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619881338.304498
RegSetValueExA
key_handle: 0x00000388
value: ;ãq>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619881338.304498
RegSetValueExA
key_handle: 0x00000388
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619881338.351498
RegSetValueExW
key_handle: 0x0000036c
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 个事件)
MicroWorld-eScan Trojan.GenericKD.34629619
McAfee Artemis!B2425F64492F
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 00546b711 )
Alibaba Trojan:Win32/Rozena.9b14342e
K7GW Trojan ( 00546b711 )
Cybereason malicious.4492f9
Arcabit Trojan.Generic.D21067F3
Cyren W32/Trojan.RWWD-0238
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Python/Rozena.BC
APEX Malicious
Avast Win32:Agent-BCPE [Trj]
Kaspersky UDS:Trojan.Win32.Generic
BitDefender Trojan.GenericKD.34629619
NANO-Antivirus Trojan.Win32.Swrort.hbdnvx
Paloalto generic.ml
Ad-Aware Trojan.GenericKD.34629619
Emsisoft Trojan.GenericKD.34629619 (B)
Comodo Malware@#1x8dtsvpoxdnb
F-Secure Trojan.TR/Swrort.Gen7
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win32.Generic.wc
FireEye Generic.mg.b2425f64492f9924
Sophos Mal/Generic-S
Ikarus Trojan.Python.Spy
Avira TR/Swrort.Gen7
eGambit Unsafe.AI_Score_99%
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Wacatac.oa
Microsoft Trojan:Win32/Tnega!ml
AegisLab Trojan.Win32.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Trojan.GenericKD.34629619
Cynet Malicious (score: 85)
ALYac Trojan.Agent.Rozena
MAX malware (ai score=81)
Cylance Unsafe
Tencent Win32.Trojan.Rozena.Pcry
Fortinet W32/Generic.BC!tr
AVG Win32:Agent-BCPE [Trj]
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Win32/Trojan.Swrort.HwoCEpsA
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)
dead_host 203.208.41.65:80
dead_host 192.168.56.101:49201
dead_host 192.168.56.101:49176
dead_host 139.199.158.84:2333
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-07-09 22:22:19

Imports

Library KERNEL32.dll:
• 0x421000 GetLastError
• 0x421004 SetDllDirectoryW
• 0x421008 GetModuleFileNameW
• 0x42100c GetProcAddress
• 0x421010 GetCommandLineW
• 0x421020 GetTempPathW
• 0x421024 WaitForSingleObject
• 0x421028 Sleep
• 0x42102c GetExitCodeProcess
• 0x421030 CreateProcessW
• 0x421034 GetStartupInfoW
• 0x421038 LoadLibraryExW
• 0x42103c GetShortPathNameW
• 0x421040 FormatMessageW
• 0x421044 LoadLibraryA
• 0x421048 MultiByteToWideChar
• 0x42104c WideCharToMultiByte
• 0x421050 DecodePointer
• 0x42105c GetCurrentProcess
• 0x421060 TerminateProcess
• 0x42106c GetCurrentProcessId
• 0x421070 GetCurrentThreadId
• 0x421078 InitializeSListHead
• 0x42107c IsDebuggerPresent
• 0x421080 GetModuleHandleW
• 0x421084 RtlUnwind
• 0x421088 SetLastError
• 0x42109c TlsAlloc
• 0x4210a0 TlsGetValue
• 0x4210a4 TlsSetValue
• 0x4210a8 TlsFree
• 0x4210ac FreeLibrary
• 0x4210b0 GetCommandLineA
• 0x4210b4 ReadFile
• 0x4210b8 CreateFileW
• 0x4210bc GetDriveTypeW
• 0x4210c0 GetFileType
• 0x4210c4 CloseHandle
• 0x4210c8 PeekNamedPipe
• 0x4210d4 GetFullPathNameW
• 0x4210d8 GetFullPathNameA
• 0x4210dc CreateDirectoryW
• 0x4210e0 RemoveDirectoryW
• 0x4210e4 FindClose
• 0x4210e8 FindFirstFileExW
• 0x4210ec FindNextFileW
• 0x4210f0 SetStdHandle
• 0x4210f8 DeleteFileW
• 0x4210fc GetStdHandle
• 0x421100 WriteFile
• 0x421104 ExitProcess
• 0x421108 GetModuleHandleExW
• 0x42110c GetACP
• 0x421110 HeapFree
• 0x421114 HeapAlloc
• 0x421118 GetConsoleMode
• 0x42111c ReadConsoleW
• 0x421120 SetFilePointerEx
• 0x421124 GetConsoleCP
• 0x421128 CompareStringW
• 0x42112c LCMapStringW
• 0x421134 FlushFileBuffers
• 0x421140 IsValidCodePage
• 0x421144 GetOEMCP
• 0x421148 GetCPInfo
• 0x421154 GetStringTypeW
• 0x421158 GetProcessHeap
• 0x42115c WriteConsoleW
• 0x421164 HeapSize
• 0x421168 HeapReAlloc
• 0x42116c SetEndOfFile
• 0x421170 RaiseException
Library WS2_32.dll:
• 0x421178 ntohl

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
103.83.81.17 80 192.168.56.101 49191

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.