1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.62
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-ASTD [Trj] | 20190907 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20190907 | 2013.8.14.323 |
| McAfee | Downloader-FSH | 20190907 | 6.0.6.653 |
| Tencent | Trojan.Win32.Inject.hjqba | 20190907 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00000d29', 'size_of_data': '0x00000e00', 'entropy': 6.97837974109079} | entropy | 6.97837974109079 | description | 发现高熵的节 | |||||||||
| entropy | 0.21212121212121213 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.GenericKD.1524286 |
| APEX | Malicious |
| AVG | Win32:Agent-ASTD [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1524286 |
| AhnLab-V3 | Trojan/Win32.Waski.C256949 |
| Antiy-AVL | Trojan/Win32.Inject |
| Arcabit | Trojan.Generic.D17423E |
| Avast | Win32:Agent-ASTD [Trj] |
| Avira | TR/Yarwi.B.163 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.GenericKD.1524286 |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| CMC | Trojan.Win32.Inject!O |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.Upatre.S@59gkks |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.73485c |
| Cylance | Unsafe |
| Cyren | W32/Trojan.RTVI-3821 |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.GenericKD.1524286 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.HJB |
| F-Secure | Trojan.TR/Yarwi.B.163 |
| FireEye | Generic.mg.b68323273485ccef |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.GenericKD.1524286 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Inject.aqxm |
| K7AntiVirus | Trojan-Downloader ( 0048f6391 ) |
| K7GW | Trojan-Downloader ( 0048f6391 ) |
| Kaspersky | Trojan.Win32.Inject.hjzn |
| Lionic | Trojan.Win32.Inject.lWDh |
| MAX | malware (ai score=81) |
| Malwarebytes | Trojan.Upatre |
| McAfee | Downloader-FSH |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.mm |
| MicroWorld-eScan | Trojan.GenericKD.1524286 |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.Inject.ctdoau |
| Panda | Trj/Zbot.M |
| Qihoo-360 | HEUR/QVM20.1.B83D.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Upatre |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Zbot-HNA |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-01-29 13:32:49
PE Imphash
b271bce6a1e17ebf9ac5fcd3deb5ff90
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000d29 | 0x00000e00 | 6.97837974109079 |
| .rdata | 0x00002000 | 0x00000358 | 0x00000400 | 4.690376988161757 |
| .data | 0x00003000 | 0x00001098 | 0x00001000 | 5.228207849109987 |
| .rsrc | 0x00005000 | 0x00001ef8 | 0x00002000 | 5.41858834565611 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00005238 | 0x00001ca8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00006ee0 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000050f0 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x40202c ShowWindow
• 0x402030 PostQuitMessage
• 0x402034 GetMessageA
• 0x402038 DispatchMessageA
• 0x40203c SendMessageW
• 0x402040 CreateWindowExA
• 0x402044 RegisterClassExA
• 0x402048 SendMessageA
• 0x40204c DefWindowProcA
• 0x402050 GetFocus
• 0x402054 EnableWindow
• 0x402058 UpdateWindow
• 0x40205c IsZoomed
Library KERNEL32.dll:
• 0x402010 CreateFileA
• 0x402014 HeapAlloc
• 0x402018 HeapCreate
• 0x40201c CreateFileW
• 0x402020 HeapDestroy
• 0x402024 ExitProcess
Library GDI32.dll:
• 0x402008 GetStockObject
Library COMCTL32.dll:
• 0x402000 InitCommonControlsEx
L!This program cannot be run in DOS mode.
1:uiuiui
iwiuii
iitiRichui
`.rdata
@.data
8u@ @
@@@ @@
@@ @
@@ @@@ @ @v
@@@ @
3PPPUR
t =8 @
MQ3PPPUR
@ @@ @@@
MZuSlAWVAf9
GEGEGMG;r
@@UV3W}
FG3@_^]
!T?]<sHQ\joe
MT&1J}/
w1pZhj52P@|h}+c
Fc$15UyZ|
Fc$fq\iyS
8T.]c$
bsrop4N
T`?[I(
5S?/H$
'TZ.x(
&I?[@1
E5u:I?L{
f}DRlp
PIszz+i
&I?[]$
>CcA5]\Xdp T!
TMZyeA`*(
O| Y+nb@e
50eJ@,FbyH#Z/
t:UeO| e5v
owZ3y@E
1nD>'2
@D:UAOl/gAv5
I/,:Ui&!+
O\MZZe`[?R_
|iS!m B$!4M
)NtiZ/X3q:
R` L>'2/
z3lX&rT%Z/eI@G
6uqY<F
gje50.C*# p
)]HRZ]?
Hf53-I MrBv
Ar]\U$u
e2uQMt
OD~zB/@Z!Uq 6
@"6YG~S!
!O& T'ZJ
t:UeO| rg5P
bqXp M
G^ypyRLv&h
350Lh]|
uE!YF4XIq
JZr1]1
GAf52w
O47<6ef\
]re@ew
o$C;[j3HPUoua
~5S?\/%
\Qts{S
h5C5]j2
w5@?\ (
u&S)\{.
P^trpRNYm$
IuX[_[+S
21G3W"
@1,YVH'A
[=^:*"!
FZ('V6\
AJ<>=1:aM<*<6'?@ 0A6!6M
IsZoomed
GetFocus
EnableWindow
SendMessageA
DefWindowProcA
RegisterClassExA
CreateWindowExA
SendMessageW
DispatchMessageA
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
USER32.dll
HeapDestroy
CreateFileW
HeapCreate
HeapAlloc
CreateFileA
ExitProcess
KERNEL32.dll
GetStockObject
GDI32.dll
InitCommonControlsEx
COMCTL32.dll
button
static
abasement
resiliency
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
}|}OLN~[YZywx|z{USTYVX
`^`{yzhfgQOQtrsgfg\Y\olm|z|VSUgdf
}rprpnolhkPMOpnpfdftttTPSb_`rpr>;=TRT
~trsIGHb`a`^`[XZmlmWUV
746WUW
{URTusu
LIKa^`zxzihi`^`
NLMwuw
xxxyyy
- - - - - - - - - F:- - SH- - - - - - - - - - - - *
. . . . . . . . F:. F:. . ,
- . . . . . . . ,
. 0!0!0!0!0!0!0!0!~t0!WK0!0!dX0!0!0!0!0!0!0!.
0!1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"1"0!
2#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#3#2#
4$I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;I;4$
C : \ U s e r s \ u s u a r i o \ A P P D A T A \ L O C A L \ T E M P \ w z a 5 1 8 \ A v i s . d e . P a i e m e n t . e x e
C : \ K Y q Z U P 7 z . e x e
C : \ 2 S u L Q E y 2 . e x e
C : \ h Z A k 8 h O 9 . e x e
C : \ u e x v L y k v . e x e
C : \ 2 W L w 8 Z J i . e x e
C : \ G C D 2 4 k M f . e x e
C : \ O U p K j 3 E f . e x e
C : \ H 8 h l l n T Q . e x e
C : \ a z I t v E 8 p . e x e
C : \ v h T 4 d h H 1 . e x e
C : \ 9 z T U y F L o . e x e
C : \ y i v _ t Q x y . e x e
C : \ v d c G t t z h . e x e
C : \ M L r m 7 O Z 1 . e x e
C : \ Y 2 Z l L u I i . e x e
C : \ e 9 Q y H 9 A e . e x e
C : \ d 1 a 9 5 8 f 4 b 2 a d b a b e 6 a e 6 4 b a f 5 7 6 b 1 b 5 8 2 d 8 9 3 3 9 6 5 8 f c 9 d 1 8 7 7 1 5 e 0 f 5 b c e d 7 9 f 1
C : \ J S d s c h f m . e x e
C : \ a c f 3 9 a a 6 1 c f c a c 4 0 f 6 9 e 4 e 5 6 a 8 f 1 7 a 8 a f 2 1 c b c 6 6 f 9 3 1 2 5 8 3 1 2 4 f e 1 4 3 f d 8 e a c c 1
C : \ a e a 7 d 8 9 1 6 2 c 1 f 3 9 7 f 9 d 5 4 0 c b 1 c c 4 4 3 a f d 9 2 9 f 4 2 5 4 2 6 8 5 e f 1 8 7 a 3 9 1 c c 9 7 7 a a 8 f 2
C : \ 9 4 7 1 c e 8 f a 7 6 a 5 a 9 a 1 d 3 f 3 b 8 b 3 6 5 1 d 8 c f 1 2 5 0 c f 9 1 d 5 a f a 8 1 5 c 9 c 7 e c 8 1 9 3 a b 7 0 c 7
C : \ 7 e b 9 6 3 3 c 2 4 3 7 e 4 6 0 2 e 9 7 a 1 3 2 4 3 8 c 4 a 6 b 8 d 1 c 5 6 c 9 8 f 9 4 e 6 e e 1 8 b 8 a 6 6 2 7 5 b d 4 6 b 9
C : \ b a a 8 1 3 9 f a b 9 f 0 6 1 e 7 4 5 7 6 2 5 5 e 9 5 4 c 1 c 0 5 5 6 2 f 1 b 8 0 b a d a 4 5 e 7 3 3 7 f e 4 8 a 2 f 0 4 6 6 d
C : \ 1 6 1 0 b b 0 1 b d f d 3 4 7 f 5 0 e e e 0 3 f 5 7 c a a 2 7 c 6 e 1 9 2 1 d f b f 6 e 7 e 2 4 2 3 2 e 6 d 1 b f c 4 e 1 9 b d
C : \ b b c 5 c 5 1 e e f e 6 4 0 0 c e b d 9 c 4 5 4 1 3 8 9 3 3 9 2 8 d 8 1 0 0 8 c c f 0 2 e 9 f 9 e 9 3 8 1 9 9 c f 4 5 4 e 1 0 d
C : \ 9 a 2 8 3 9 d 9 e b 1 f 5 2 5 1 2 6 0 6 9 b 8 2 f b d 9 b 6 d 7 f 0 2 2 9 2 c a 8 7 0 c 4 c d c 5 a a 1 7 5 4 f 2 8 a b 3 6 6 4
C : \ c 3 c 7 e e 4 8 4 1 d 8 6 7 2 f 2 0 3 3 d 0 9 6 d 8 2 0 1 b 2 7 1 9 2 2 1 b 0 c 2 6 0 d 9 0 0 b 3 8 a 5 d d 4 4 2 d c 2 5 b 4 b
C : \ c c 9 3 b 7 7 f 7 1 8 d 0 4 6 a c f b 5 6 7 1 f 4 5 6 b b a 8 b 7 7 0 c f 4 2 c 0 5 b 2 5 a 5 0 e 7 3 1 e e 1 d e 1 4 c 2 e e 1
C : \ 5 f e 7 a 7 9 1 0 f 4 3 3 5 8 0 8 1 f 7 1 e 7 5 f c 2 4 e 1 9 3 5 d 3 1 e 6 8 a 8 b b d e 0 5 1 3 3 4 a 7 b f b f 7 3 2 a e 3 5
C : \ 5 8 2 2 a 1 7 d 5 4 4 f 7 7 b 3 9 8 3 b 5 e 3 a b 8 f f 4 f 5 c 2 2 3 3 1 2 7 f a d 6 e f 8 e 8 0 4 a 0 2 e e 6 7 c 5 6 a 4 c a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ d 9 d 1 8 6 b 7 f d 0 7 c 2 6 4 6 9 0 6 d 7 c 1 f d 1 d 5 7 5 4 5 0 0 a 2 0 8 0 8 6 d d 5 f 6 a a c 1 9 8 2 3 f e 4 4 4 6 4 8 c
C : \ a 4 e e 9 3 1 5 1 e 3 8 6 e 1 7 3 8 e d 0 3 a 0 2 f 6 c d b e f 8 e 5 e 8 a f b 7 f 9 6 d 0 b f c 5 7 8 f d 9 5 c 4 e 1 3 3 7 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 2 3 5 1 f a e d e 2 a 1 b b 4 6 f 0 3 1 7 0 0 7 8 e 3 5 a 6 f 1 c b c b f d b 0 1 b 1 9 d 1 1 5 1 a 1 6 3 6 8 b 9 b 4 b a b a 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ a f 9 a 7 8 0 d 4 9 3 8 8 8 4 0 6 f 4 e 4 8 d b 3 4 0 9 b 6 b 4 c d f 5 e 7 3 1 c 1 0 7 2 6 8 8 e 1 5 4 1 b 0 4 d c 3 c c a 5 e
C : \ 2 4 a d 8 9 c 9 7 3 3 2 0 c d 3 9 5 2 9 a 0 b 1 5 4 a a 0 9 a 2 2 f 8 1 8 c 8 c e 0 c 7 8 c 6 4 8 a b 4 a e a 2 2 0 d 3 7 9 2 8
C : \ 0 e 8 9 d f 4 2 6 b 0 f 8 0 7 3 2 e 4 0 f 0 b b 1 7 7 0 1 2 b 2 2 e 5 f 3 c c 8 c 7 b f 8 6 a d d f 2 8 c c b 0 4 c f 8 b e c 8
C : \ 9 7 a 9 3 5 1 e 9 c 4 6 f 3 d f d c 5 1 e 3 8 e 9 7 1 c 1 b b c 5 d 4 6 d e 4 0 6 1 9 c 9 b e e 2 a e 4 f a 9 b 6 4 2 6 0 7 2 f
C : \ 6 d b d 8 a 0 4 c d 8 d a a 8 5 0 d 4 7 c 6 d 7 0 d 3 b 0 7 f e 9 8 7 8 f d d f 7 b 3 9 3 a d 7 c 9 e d d c f a e 0 2 2 a c 1 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c o m u p d a t e r . p e 3 2
C : \ _ S 0 j K O 4 e . e x e
C : \ 1 6 1 a 6 2 a e d e d 4 8 1 1 9 1 a d b b 9 a e f 0 9 7 1 1 3 0 b 3 3 c 6 9 7 8 1 8 3 2 7 4 e 1 3 6 4 c 3 7 8 b 5 1 2 e 0 1 5 b
C : \ 1 p p p _ S o r . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.