6.2
高危
57 个模型检测该样本为恶意！
重新分析
更多

884cf86c62eaabde3a9d69bd76c5d0451b77b93de4e6230e68c9e7835fd43e4f

b7c15bd1dcc68ef02f4df1e4594b9803.exe

分析耗时

80s

最近分析

文件大小

660.0KB
静态报毒 动态报毒 100% AI SCORE=86 AIDETECTGBM ATTRIBUTE CLASSIC CONFIDENCE CRYPTERX ELDORADO EMOTET EVPG EVQQ GENCIRC GENETIC GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HTEVZG HWCBVE8A IPBNY1QOQ3G KCLOUD MALWARE@#SN04GRNBD253 R + TROJ R349767 SCORE UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Emotet.61d301a1 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:CrypterX-gen [Trj] 20210222 21.1.5827.0
Tencent Malware.Win32.Gencirc.10cdf992 20210222 1.0.0.1
Kingsoft Win32.Troj.Banker.(kcloud) 20210222 2017.9.26.565
McAfee Emotet-FQS!B7C15BD1DCC6 20210222 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619861136.186372
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (5 个事件)
Time & API Arguments Status Return Repeated
1619861120.483372
CryptGenKey
crypto_handle: 0x006ec790
algorithm_identifier: 0x0000660e ()
provider_handle: 0x006241b0
flags: 1
key: fm»[žÖ0 ¥?‡§~þÂ
success 1 0
1619861136.202372
CryptExportKey
crypto_handle: 0x006ec790
crypto_export_handle: 0x00624768
buffer: f¤yáæöõ*¡Ï¸Úu´ÒøÀ#lC³Ÿ9 9ð¨{=Qàª$Œ”nS„æé]ó*C!òN ˆfåÙx…°u¹G,å÷â­¸EãÜð >–(R~z£1Gú²X
blob_type: 1
flags: 64
success 1 0
1619861171.842372
CryptExportKey
crypto_handle: 0x006ec790
crypto_export_handle: 0x00624768
buffer: f¤Œ¯¾ äw‰ú¼¢†ÿpåäô@ý‹M§‡¥~úµ†±¶§©¨cÌ*tQ‚DMš‹eP¡ÜŠ‚ÚduݶPÒìƒêç1¿Ú;̓xŽõLê¥Æ†éq¡Ÿé뜛
blob_type: 1
flags: 64
success 1 0
1619861177.811372
CryptExportKey
crypto_handle: 0x006ec790
crypto_export_handle: 0x00624768
buffer: f¤± R3´°ê. ÜðY~–ðÒ0?É_É´ZÝ8˜§ƒdP• ýPÅ^Ôhr7í9ö¬;l‚%–g âö\þ¦ËHy%ƒqÑÀ©>Xekˆ4¼ªSU˜ÂU
blob_type: 1
flags: 64
success 1 0
1619861181.749372
CryptExportKey
crypto_handle: 0x006ec790
crypto_export_handle: 0x00624768
buffer: f¤Ž>×ã‡8Žç2í·Ûë:=–ÿ•ÀÊUǏª´3†·öÂþTù@瑯ÿ7ÑW©Ðþ&˜'^.à’“RB:uŒù]+(fµ µ€Ô_ÛßzH¬ ͋¤ñOé{þ¹e’Í
blob_type: 1
flags: 64
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619861119.780372
NtAllocateVirtualMemory
process_identifier: 284
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003f0000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619861136.733372
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Expresses interest in specific running processes (1 个事件)
process b7c15bd1dcc68ef02f4df1e4594b9803.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619861136.374372
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (5 个事件)
host 134.209.193.138
host 162.144.42.60
host 172.217.24.14
host 24.26.151.3
host 68.183.233.80
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619861139.311372
RegSetValueExA
key_handle: 0x000003a8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619861139.311372
RegSetValueExA
key_handle: 0x000003a8
value: PÄ£>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619861139.311372
RegSetValueExA
key_handle: 0x000003a8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619861139.311372
RegSetValueExW
key_handle: 0x000003a8
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619861139.311372
RegSetValueExA
key_handle: 0x000003c0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619861139.327372
RegSetValueExA
key_handle: 0x000003c0
value: PÄ£>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619861139.327372
RegSetValueExA
key_handle: 0x000003c0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619861139.342372
RegSetValueExW
key_handle: 0x000003a4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Bkav W32.AIDetectGBM.malware.02
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.EVQQ
FireEye Generic.mg.b7c15bd1dcc68ef0
Qihoo-360 Win32/Backdoor.Emotet.HwcBvE8A
ALYac Trojan.Agent.Emotet
Malwarebytes Emotet.Trojan.Stealer.DDS
Zillya Trojan.Emotet.Win32.27703
Sangfor Trojan.Win32.Emotet.ARJ
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Emotet.61d301a1
K7GW Riskware ( 0040eff71 )
Cybereason malicious.1dcc68
Arcabit Trojan.Agent.EVQQ
Cyren W32/Emotet.ARK.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Avast Win32:CrypterX-gen [Trj]
ClamAV Win.Dropper.Emotet-9791668-0
Kaspersky HEUR:Trojan-Banker.Win32.Emotet.vho
BitDefender Trojan.Agent.EVQQ
NANO-Antivirus Trojan.Win32.Emotet.htevzg
Paloalto generic.ml
Tencent Malware.Win32.Gencirc.10cdf992
Ad-Aware Trojan.Agent.EVQQ
TACHYON Banker/W32.Emotet.675840
Sophos Mal/Generic-R + Troj/Emotet-CMC
Comodo Malware@#sn04grnbd253
F-Secure Trojan.TR/AD.Emotet.bpd
DrWeb Trojan.Emotet.1005
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win32.Emotet.jm
Emsisoft Trojan.Emotet (A)
APEX Malicious
Jiangmin Trojan.Banker.Emotet.ofs
Avira TR/AD.Emotet.bpd
Antiy-AVL Trojan[Banker]/Win32.Emotet
Kingsoft Win32.Troj.Banker.(kcloud)
Gridinsoft Trojan.Win32.Emotet.oa
Microsoft Trojan:Win32/Emotet.ARJ!MTB
ViRobot Trojan.Win32.Emotet.671744
ZoneAlarm HEUR:Trojan-Banker.Win32.Emotet.vho
GData Trojan.Agent.EVQQ
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Emotet.R349767
McAfee Emotet-FQS!B7C15BD1DCC6
MAX malware (ai score=86)
VBA32 Trojan.Emotet
Cylance Unsafe
ESET-NOD32 Win32/Emotet.CD
Rising Trojan.Emotet!1.CB4A (CLASSIC)
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 162.144.42.60:8080
dead_host 24.26.151.3:80
dead_host 192.168.56.101:49179
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-27 22:56:56

Imports

Library KERNEL32.dll:
• 0x42e0b8 RtlUnwind
• 0x42e0bc HeapAlloc
• 0x42e0c0 GetStartupInfoA
• 0x42e0c4 GetCommandLineA
• 0x42e0c8 RaiseException
• 0x42e0cc HeapFree
• 0x42e0d0 TerminateProcess
• 0x42e0d4 HeapSize
• 0x42e0d8 HeapReAlloc
• 0x42e0dc GetACP
• 0x42e0e0 LCMapStringA
• 0x42e0e4 LCMapStringW
• 0x42e0e8 Sleep
• 0x42e0ec HeapDestroy
• 0x42e0f0 HeapCreate
• 0x42e0f4 VirtualFree
• 0x42e0f8 IsBadWritePtr
• 0x42e10c SetHandleCount
• 0x42e110 GetStdHandle
• 0x42e114 GetFileType
• 0x42e11c GetStringTypeA
• 0x42e120 GetStringTypeW
• 0x42e124 IsBadReadPtr
• 0x42e128 IsBadCodePtr
• 0x42e12c SetStdHandle
• 0x42e130 InterlockedExchange
• 0x42e134 FlushFileBuffers
• 0x42e138 SetFilePointer
• 0x42e13c WriteFile
• 0x42e140 ReadFile
• 0x42e144 GetCurrentProcess
• 0x42e148 SetErrorMode
• 0x42e150 GetOEMCP
• 0x42e154 GetCPInfo
• 0x42e158 GetProcessVersion
• 0x42e15c GlobalFlags
• 0x42e160 TlsGetValue
• 0x42e164 LocalReAlloc
• 0x42e168 TlsSetValue
• 0x42e170 GlobalReAlloc
• 0x42e178 TlsFree
• 0x42e17c GlobalHandle
• 0x42e184 TlsAlloc
• 0x42e18c LocalAlloc
• 0x42e190 LocalFree
• 0x42e194 GlobalFree
• 0x42e198 CloseHandle
• 0x42e19c GetModuleFileNameA
• 0x42e1a0 GlobalAlloc
• 0x42e1a4 lstrcmpA
• 0x42e1a8 GetCurrentThread
• 0x42e1ac lstrcpynA
• 0x42e1b0 MultiByteToWideChar
• 0x42e1b4 WideCharToMultiByte
• 0x42e1c0 GlobalLock
• 0x42e1c4 GlobalUnlock
• 0x42e1c8 MulDiv
• 0x42e1cc SetLastError
• 0x42e1d0 FindResourceA
• 0x42e1d4 LoadResource
• 0x42e1d8 LockResource
• 0x42e1dc GetVersion
• 0x42e1e0 GetCurrentThreadId
• 0x42e1e4 GlobalGetAtomNameA
• 0x42e1e8 lstrcmpiA
• 0x42e1ec GlobalAddAtomA
• 0x42e1f0 GlobalFindAtomA
• 0x42e1f4 GlobalDeleteAtom
• 0x42e1f8 GetModuleHandleA
• 0x42e1fc GetProcAddress
• 0x42e200 lstrcatA
• 0x42e204 lstrlenA
• 0x42e208 WinExec
• 0x42e20c lstrcpyA
• 0x42e214 LoadLibraryA
• 0x42e218 FreeLibrary
• 0x42e21c VirtualAlloc
• 0x42e220 GetLastError
• 0x42e228 ExitProcess
Library USER32.dll:
• 0x42e23c GetFocus
• 0x42e240 DispatchMessageA
• 0x42e244 PeekMessageA
• 0x42e248 MapWindowPoints
• 0x42e24c SendDlgItemMessageA
• 0x42e250 UpdateWindow
• 0x42e254 TabbedTextOutA
• 0x42e258 DrawTextA
• 0x42e25c GrayStringA
• 0x42e260 IsDialogMessageA
• 0x42e264 SetWindowTextA
• 0x42e268 IsWindowEnabled
• 0x42e26c EnableMenuItem
• 0x42e270 CheckMenuItem
• 0x42e274 SetMenuItemBitmaps
• 0x42e278 ModifyMenuA
• 0x42e27c GetMenuState
• 0x42e280 LoadBitmapA
• 0x42e288 GetCursorPos
• 0x42e28c LoadStringA
• 0x42e290 PostQuitMessage
• 0x42e294 ValidateRect
• 0x42e298 TranslateMessage
• 0x42e29c GetMessageA
• 0x42e2a4 EndDialog
• 0x42e2a8 GetClassNameA
• 0x42e2ac GetSysColorBrush
• 0x42e2b0 SetActiveWindow
• 0x42e2b4 SetFocus
• 0x42e2b8 AdjustWindowRectEx
• 0x42e2bc IsWindowVisible
• 0x42e2c0 GetTopWindow
• 0x42e2c4 MessageBoxA
• 0x42e2c8 GetCapture
• 0x42e2cc WinHelpA
• 0x42e2d0 wsprintfA
• 0x42e2d4 GetClassInfoA
• 0x42e2d8 RegisterClassA
• 0x42e2dc GetMenu
• 0x42e2e0 GetMenuItemCount
• 0x42e2e4 GetMenuItemID
• 0x42e2e8 GetDlgItem
• 0x42e2f0 GetWindowTextA
• 0x42e2f4 GetDlgCtrlID
• 0x42e2f8 GetKeyState
• 0x42e2fc DefWindowProcA
• 0x42e300 DestroyWindow
• 0x42e304 SetWindowsHookExA
• 0x42e308 CallNextHookEx
• 0x42e30c GetClassLongA
• 0x42e310 SetPropA
• 0x42e314 GetPropA
• 0x42e318 CallWindowProcA
• 0x42e31c RemovePropA
• 0x42e320 GetMessageTime
• 0x42e324 GetLastActivePopup
• 0x42e328 GetForegroundWindow
• 0x42e32c SetForegroundWindow
• 0x42e330 GetWindow
• 0x42e334 SetWindowPos
• 0x42e340 IsIconic
• 0x42e344 GetWindowPlacement
• 0x42e348 GetSystemMetrics
• 0x42e34c LoadCursorA
• 0x42e350 CopyIcon
• 0x42e354 IsWindow
• 0x42e358 GetMessagePos
• 0x42e35c ScreenToClient
• 0x42e360 PtInRect
• 0x42e364 SetTimer
• 0x42e368 MessageBeep
• 0x42e36c SetWindowLongA
• 0x42e370 KillTimer
• 0x42e374 ShowWindow
• 0x42e378 CreateWindowExA
• 0x42e37c InSendMessage
• 0x42e380 LoadIconA
• 0x42e384 EnableWindow
• 0x42e388 LoadImageA
• 0x42e38c GetIconInfo
• 0x42e390 GetDC
• 0x42e394 CreateIconIndirect
• 0x42e398 ReleaseDC
• 0x42e39c FillRect
• 0x42e3a0 DrawStateA
• 0x42e3a4 GetClientRect
• 0x42e3a8 CopyRect
• 0x42e3ac FrameRect
• 0x42e3b0 InflateRect
• 0x42e3b4 GetSysColor
• 0x42e3b8 OffsetRect
• 0x42e3bc DrawFocusRect
• 0x42e3c0 GetWindowRect
• 0x42e3c4 GetSubMenu
• 0x42e3c8 TrackPopupMenuEx
• 0x42e3cc PostMessageA
• 0x42e3d0 ClientToScreen
• 0x42e3d4 WindowFromPoint
• 0x42e3d8 GetActiveWindow
• 0x42e3dc InvalidateRect
• 0x42e3e0 SetCursor
• 0x42e3e4 GetParent
• 0x42e3e8 GetNextDlgTabItem
• 0x42e3ec SendMessageA
• 0x42e3f0 GetWindowLongA
• 0x42e3f4 DestroyIcon
• 0x42e3f8 DestroyCursor
• 0x42e3fc DestroyMenu
• 0x42e400 UnhookWindowsHookEx
• 0x42e404 UnregisterClassA
Library GDI32.dll:
• 0x42e024 SetBkMode
• 0x42e028 SetMapMode
• 0x42e02c SetViewportOrgEx
• 0x42e030 OffsetViewportOrgEx
• 0x42e034 SetViewportExtEx
• 0x42e038 ScaleViewportExtEx
• 0x42e03c SetWindowExtEx
• 0x42e040 ScaleWindowExtEx
• 0x42e044 MoveToEx
• 0x42e048 LineTo
• 0x42e04c SetTextColor
• 0x42e050 GetDeviceCaps
• 0x42e054 CreatePen
• 0x42e058 CreateSolidBrush
• 0x42e05c PtVisible
• 0x42e060 RectVisible
• 0x42e064 TextOutA
• 0x42e068 ExtTextOutA
• 0x42e06c Escape
• 0x42e070 RestoreDC
• 0x42e074 SaveDC
• 0x42e078 DeleteDC
• 0x42e07c BitBlt
• 0x42e080 GetClipBox
• 0x42e088 CreateFontIndirectA
• 0x42e08c GetObjectA
• 0x42e090 GetPixel
• 0x42e094 SetPixel
• 0x42e098 CreateBitmap
• 0x42e09c DeleteObject
• 0x42e0a0 CreateCompatibleDC
• 0x42e0a8 SelectObject
• 0x42e0ac GetStockObject
• 0x42e0b0 SetBkColor
Library WINSPOOL.DRV:
• 0x42e40c DocumentPropertiesA
• 0x42e410 ClosePrinter
• 0x42e414 OpenPrinterA
Library ADVAPI32.dll:
• 0x42e000 RegSetValueExA
• 0x42e004 RegCreateKeyExA
• 0x42e008 RegOpenKeyExA
• 0x42e00c RegQueryValueA
• 0x42e010 RegCloseKey
Library SHELL32.dll:
• 0x42e230 ShellExecuteExA
• 0x42e234 ShellExecuteA
Library COMCTL32.dll:
• 0x42e018 _TrackMouseEvent
• 0x42e01c

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49182 134.209.193.138 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://134.209.193.138:443/LaDybP9kkU0Uw/HYgKMY4AJ9KzetY/ 
POST /LaDybP9kkU0Uw/HYgKMY4AJ9KzetY/ HTTP/1.1
Content-Type: multipart/form-data; boundary=-------------------------79f4d6461829f597231612857782a1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 134.209.193.138:443
Content-Length: 4500
Connection: Keep-Alive
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.