5.4
中危
2 个模型检测该样本为恶意！
重新分析
更多

96048ab47ec5f1170d95db1c279218eefdc0bdb2af467692e994c7ccf3fcf5eb

b472f65ea6fcd439daa70c9bf43c0e4d.exe

分析耗时

39s

最近分析

文件大小

3.8MB
静态报毒 动态报毒 SCORE UNSAFE UPDANE
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20200922 6.0.6.653
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast 20200923 18.4.3895.0
Tencent 20200924 1.0.0.1
Kingsoft 20200924 2013.8.14.323
CrowdStrike 20190702 1.0
行为判定
动态指标
Creates (office) documents on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\XLS Import Example.xls
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Guide.pdf
Creates executable files on the filesystem (18 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\DropIt.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\gallery\js\jquery-1.10.1.min.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\7z\7z.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\gallery\js\fancybox\helpers\jquery.fancybox-media.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\list\filter.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\gallery\js\jquery.mousewheel-3.0.6.pack.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\gallery\js\fancybox\helpers\jquery.fancybox-thumbs.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\psftp\psftp.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\gallery\js\html5.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\copy\Copy.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\pdftotext\pdftotext.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\gallery\js\fancybox\jquery.fancybox.pack.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\gallery\js\main.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\gallery\js\fancybox\jquery.fancybox.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\7z\7z.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\list\sortable.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\gallery\js\fancybox\helpers\jquery.fancybox-buttons.js
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\list\lighterbox2.js
Drops an executable to the user AppData folder (7 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\psftp\psftp.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\7z\7z.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\pdftotext\pdftotext.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\DropIt.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\copy\Copy.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\7z\7z.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Lib\7z\7z.sfx
File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 个事件)
eGambit Unsafe.AI_Score_59%
Yandex Trojan.Updane!
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 172.217.24.14
host 203.208.40.34
host 203.208.41.65
Writes a potential ransom message to disk (1 个事件)
Time & API Arguments Status Return Repeated
1620900174.375751
NtWriteFile
file_handle: 0x00000128
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DropIt\Readme.txt
buffer: DropIt (v8.2) ----------------------------- Personal Assistant to Automatically Manage Your Files Website: http://www.dropitproject.com/ Contact: http://www.lupopensuite.com/contact.htm Software realized by Lupo PenSuite Team. Released under Open Source GPL. Introduction ----------------------------- DropIt is a simple floating target image that you can drop files onto to quickly process them with the action of your choice. DropIt allows to define a destination for each rule created and group several associations in different profiles. Read the official "Guide.pdf" for more information. Acknowledgements ----------------------------- These are the authors of included components: - 7-Zip archiver by Igor Pavlov - Copy library by Yashied - Crystal Clear icons by Everaldo - Crystal Project icons by Everaldo - Gallery Lightbox by fancyBox - Gallery Themes by tpr - HTML Lightbox by Transcendent Design - HTML Sortable Table by webtoolkit.info - HTML Themes by tpr - Nuove XT icons by Saki - Oxygen icons by Oxygen Team - PDFToText tool by Xpdf Team - PSFTP tool by PuTTY Team - Sounds by SoundJay.com - USB icon by webdesignerdepot.com - Vista Inspirate icons by Saki And a big thanks to all translators! ChangeLog ----------------------------- Version 8.2 [28-05-2016] - added abbreviation modifiers to encode / decode with Base64 (ANSI and UTF-8) - added option to choose if do or not a first scan of monitored folders at startup (read 4.4 of the Guide) - added option to choose the mode to manually rename duplicates (read 4.4 of the Guide) - restored cryptography modifiers - fixed issue removing source of encrypted folders - fixed Unicode support for associations (UTF16 Little Endian) - fixed some minor bugs Previous Versions: http://www.dropitproject.com/changelog.txt Known Issues And Limits: - "Create Gallery" action does not keep Exif data of resized images - "Encrypt" action does not rename processed files after the first duplicate - "Send by Mail" action fails if the file exceed the server size limit or the format is unallowed - DropIt may fail to search strings in PDF files generated with OCR -----------------------------
offset: 0
success 0 0
Generates some ICMP traffic
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 203.208.40.34:443
dead_host 192.168.56.101:49177
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2015-12-31 22:25:58

Imports

Library OLEAUT32.dll:
• 0x427154 SysFreeString
• 0x427158 SysAllocStringLen
• 0x42715c SysAllocString
• 0x427160 VariantClear
• 0x427164 SysStringLen
Library ole32.dll:
• 0x427208 CoCreateInstance
• 0x42720c CoInitialize
• 0x427210 CoUninitialize
• 0x427214 OleInitialize
Library USER32.dll:
• 0x427180 CheckDlgButton
• 0x427184 IsDlgButtonChecked
• 0x427188 EndDialog
• 0x42718c SetDlgItemTextW
• 0x427190 GetFocus
• 0x427194 SetFocus
• 0x427198 GetKeyState
• 0x42719c InvalidateRect
• 0x4271a0 SetWindowTextW
• 0x4271a4 EnableWindow
• 0x4271a8 PostMessageW
• 0x4271ac MessageBoxW
• 0x4271b0 SetTimer
• 0x4271b4 DialogBoxParamW
• 0x4271b8 SetWindowLongW
• 0x4271bc GetWindowLongW
• 0x4271c0 ShowWindow
• 0x4271c4 MoveWindow
• 0x4271c8 ScreenToClient
• 0x4271cc GetDlgItem
• 0x4271d0 GetWindowRect
• 0x4271d4 MapDialogRect
• 0x4271e0 GetWindowTextW
• 0x4271e4 SendMessageW
• 0x4271e8 LoadStringW
• 0x4271ec CharUpperW
• 0x4271f0 LoadIconW
• 0x4271f4 GetParent
• 0x4271f8 SetCursor
• 0x4271fc LoadCursorW
• 0x427200 KillTimer
Library SHELL32.dll:
• 0x427170 SHBrowseForFolderW
• 0x427174 SHGetFileInfoW
• 0x427178 SHGetMalloc
Library MSVCRT.dll:
• 0x4270d4 memmove
• 0x4270d8 memcpy
• 0x4270dc malloc
• 0x4270e0 _CxxThrowException
• 0x4270e4 free
• 0x4270e8 wcsstr
• 0x4270ec wcscmp
• 0x4270f0 wcslen
• 0x4270f4 wcscat
• 0x4270f8 _beginthreadex
• 0x4270fc _except_handler3
• 0x427104 ?terminate@@YAXXZ
• 0x427108 __dllonexit
• 0x42710c _onexit
• 0x427110 _exit
• 0x427114 _XcptFilter
• 0x427118 exit
• 0x42711c _acmdln
• 0x427120 __getmainargs
• 0x427124 _initterm
• 0x427128 __setusermatherr
• 0x42712c _adjust_fdiv
• 0x427130 __p__commode
• 0x427134 __p__fmode
• 0x427138 __set_app_type
• 0x42713c _controlfp
• 0x427140 _purecall
• 0x427144 memcmp
• 0x427148 __CxxFrameHandler
• 0x42714c memset
Library KERNEL32.dll:
• 0x427000 GetStartupInfoA
• 0x427008 ResetEvent
• 0x42700c SetEvent
• 0x427010 CreateEventW
• 0x427014 WaitForSingleObject
• 0x427018 VirtualFree
• 0x42701c VirtualAlloc
• 0x427020 GetCurrentProcess
• 0x427024 SetPriorityClass
• 0x42702c Sleep
• 0x427044 GetStdHandle
• 0x42704c CompareFileTime
• 0x427050 SetEndOfFile
• 0x427054 WriteFile
• 0x427058 ReadFile
• 0x42705c SetFilePointer
• 0x427060 GetFileSize
• 0x427068 GetFileAttributesW
• 0x42706c GetModuleHandleA
• 0x427070 FindNextFileW
• 0x427074 FindFirstFileW
• 0x427078 FindClose
• 0x42707c GetTickCount
• 0x427084 SetLastError
• 0x427088 DeleteFileW
• 0x42708c CreateDirectoryW
• 0x427090 MoveFileW
• 0x427094 RemoveDirectoryW
• 0x427098 SetFileAttributesW
• 0x42709c CreateFileW
• 0x4270a0 SetFileTime
• 0x4270a4 CloseHandle
• 0x4270a8 FormatMessageW
• 0x4270ac LocalFree
• 0x4270b0 GetModuleFileNameW
• 0x4270b4 MultiByteToWideChar
• 0x4270b8 GetLastError
• 0x4270bc GetVersionExW
• 0x4270c0 GetProcAddress
• 0x4270c4 FreeLibrary
• 0x4270c8 GetCommandLineW
• 0x4270cc LoadLibraryW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62319 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.