5.8
高危
56 个模型检测该样本为恶意！
重新分析
更多

417d90bf7d85a12dd9b199f97a0f7315532a71e0c09c124d50258dda532e0b20

ba6fb672900af300c0105577ea15a064.exe

分析耗时

105s

最近分析

文件大小

3.7MB
静态报毒 动态报毒 100% AI SCORE=83 ARTEMIS ATTRIBUTE BULZ CLASSIC COINS CONFIDENCE CRYPTINJECT DOWNLOADER34 ELDORADO ENIGMA GDSDA GEN3 GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE HUSWFT KCLOUD MALICIOUS PE MALREP MALWARE@#2A4UDQUS4W8YH MULTIPLE DETECTIONS PACK PGMX PSWTROJ QQPASS QQROB SCORE STATIC AI STORMKITTY SUSGEN THIAGBO TROJANPSW TSCOPE UNSAFE VB0@ASIA1HC XPACK YAKBEEXMSIL ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanPSW:MSIL/Coins.b9e00a71 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft Win32.PSWTroj.Coins.y.(kcloud) 20201204 2017.9.26.565
McAfee Artemis!BA6FB672900A 20201204 6.0.6.653
Tencent Win32.Trojan-qqpass.Qqrob.Pgmx 20201204 1.0.0.1
Avast Win32:Trojan-gen 20201204 20.10.5736.0
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (7 个事件)
Time & API Arguments Status Return Repeated
1619901075.224375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619901076.443375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619901082.365375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619901110.006375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619901111.084375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619901111.849375
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619901111.849375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (4 个事件)
Time & API Arguments Status Return Repeated
1619901073.115375
IsDebuggerPresent
failed 0 0
1619901073.115375
IsDebuggerPresent
failed 0 0
1619901111.834375
IsDebuggerPresent
failed 0 0
1619901111.834375
IsDebuggerPresent
failed 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619901073.131375
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 124 个事件)
Time & API Arguments Status Return Repeated
1619901071.381375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00520000
success 0 0
1619901071.381375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00570000
success 0 0
1619901072.787375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00890000
success 0 0
1619901072.787375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e0000
success 0 0
1619901072.959375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b91000
success 0 0
1619901073.115375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00920000
success 0 0
1619901073.115375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00960000
success 0 0
1619901073.115375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052a000
success 0 0
1619901073.115375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b92000
success 0 0
1619901073.115375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00522000
success 0 0
1619901073.459375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00532000
success 0 0
1619901073.537375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00555000
success 0 0
1619901073.553375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0055b000
success 0 0
1619901073.553375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00557000
success 0 0
1619901073.678375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00533000
success 0 0
1619901073.709375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053c000
success 0 0
1619901073.787375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00660000
success 0 0
1619901073.849375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00534000
success 0 0
1619901073.865375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00661000
success 0 0
1619901074.256375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00535000
success 0 0
1619901074.271375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00536000
success 0 0
1619901074.318375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00537000
success 0 0
1619901074.318375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00538000
success 0 0
1619901074.318375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053d000
success 0 0
1619901074.318375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00539000
success 0 0
1619901074.318375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00860000
success 0 0
1619901074.334375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00861000
success 0 0
1619901074.334375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00862000
success 0 0
1619901074.334375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053e000
success 0 0
1619901074.334375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00863000
success 0 0
1619901074.412375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00662000
success 0 0
1619901074.834375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 154624
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02340400
failed 3221225550 0
1619901074.834375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00663000
success 0 0
1619901074.849375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00664000
success 0 0
1619901074.865375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00665000
success 0 0
1619901074.881375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00864000
success 0 0
1619901074.881375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00666000
success 0 0
1619901074.896375
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00667000
success 0 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02340178
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x023401a0
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x023401c8
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x023401f0
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02340218
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 11
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0236687e
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 11
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02366872
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 72
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02366000
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0236688c
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x023668b0
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x023668b8
failed 3221225550 0
1619901074.896375
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x023668bc
failed 3221225550 0
A process attempted to delay the analysis task. (1 个事件)
description ba6fb672900af300c0105577ea15a064.exe tried to sleep 187 seconds, actually delayed analysis time by 187 seconds
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.97339303487567 section {'size_of_data': '0x00044000', 'virtual_address': '0x00002000', 'entropy': 7.97339303487567, 'name': '', 'virtual_size': '0x00044000'} description A section with a high entropy has been found
entropy 7.925969451903819 section {'size_of_data': '0x000e4000', 'virtual_address': '0x002d8000', 'entropy': 7.925969451903819, 'name': '.data', 'virtual_size': '0x000e4000'} description A section with a high entropy has been found
entropy 0.31027253668763105 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (8 个事件)
Time & API Arguments Status Return Repeated
1619901083.349375
CryptHashData
buffer: 19-Administrator-OSKAR-PC-zh-CN-Intel(R) Core(TM) i3-9100 CPU @ 3.60GHz-VirtualBox Graphics Adapter (WDDM)
flags: 0
hash_handle: 0x00470cf0
success 1 0
1619901083.349375
CryptHashData
buffer: 19-Administrator-OSKAR-PC-zh-CN-Intel(R) Core(TM) i3-9100 CPU @ 3.60GHz-VirtualBox Graphics Adapter (WDDM)
flags: 0
hash_handle: 0x00470cf0
success 1 0
1619901083.349375
CryptHashData
buffer: 19-Administrator-OSKAR-PC-zh-CN-Intel(R) Core(TM) i3-9100 CPU @ 3.60GHz-VirtualBox Graphics Adapter (WDDM)
flags: 0
hash_handle: 0x00470cf0
success 1 0
1619901111.099375
CryptHashData
buffer: 68983FE946699DE759DC3CB7CDE9F8FF-Administrator-OSKAR-PC-zh-CN-Intel(R) Core(TM) i3-9100 CPU @ 3.60GHz-VirtualBox Graphics Adapter (WDDM)
flags: 0
hash_handle: 0x064e80a0
success 1 0
1619901111.099375
CryptHashData
buffer: 68983FE946699DE759DC3CB7CDE9F8FF-Administrator-OSKAR-PC-zh-CN-Intel(R) Core(TM) i3-9100 CPU @ 3.60GHz-VirtualBox Graphics Adapter (WDDM)
flags: 0
hash_handle: 0x064e80a0
success 1 0
1619901111.099375
CryptHashData
buffer: 68983FE946699DE759DC3CB7CDE9F8FF-Administrator-OSKAR-PC-zh-CN-Intel(R) Core(TM) i3-9100 CPU @ 3.60GHz-VirtualBox Graphics Adapter (WDDM)
flags: 0
hash_handle: 0x064e80a0
success 1 0
1619901111.099375
CryptHashData
buffer: 68983FE946699DE759DC3CB7CDE9F8FF-Administrator-OSKAR-PC-zh-CN-Intel(R) Core(TM) i3-9100 CPU @ 3.60GHz-VirtualBox Graphics Adapter (WDDM)
flags: 0
hash_handle: 0x064e80a0
success 1 0
1619901111.099375
CryptHashData
buffer: 68983FE946699DE759DC3CB7CDE9F8FF-Administrator-OSKAR-PC-zh-CN-Intel(R) Core(TM) i3-9100 CPU @ 3.60GHz-VirtualBox Graphics Adapter (WDDM)
flags: 0
hash_handle: 0x064e80a0
success 1 0
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.DownLoader34.29484
MicroWorld-eScan Trojan.GenericKD.43745564
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
ALYac Trojan.GenericKD.43745564
Cylance Unsafe
Zillya Trojan.Coins.Win32.5277
Sangfor Malware
K7AntiVirus Password-Stealer ( 0056c3751 )
Alibaba TrojanPSW:MSIL/Coins.b9e00a71
K7GW Password-Stealer ( 0056c3751 )
Cybereason malicious.379821
BitDefenderTheta Gen:NN.ZemsilF.34670.VB0@aSia1hc
Cyren W32/Trojan.BMY.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Bulz-9769773-0
Kaspersky Trojan-PSW.Win32.Coins.yqg
BitDefender Trojan.GenericKD.43745564
NANO-Antivirus Trojan.Win32.Coins.huswft
Rising PUF.Pack-Enigma!1.BA33 (CLASSIC)
Ad-Aware Trojan.GenericKD.43745564
Sophos Mal/Generic-S
Comodo Malware@#2a4udqus4w8yh
F-Secure Trojan.TR/Crypt.XPACK.Gen3
VIPRE Trojan.Win32.Generic!BT
TrendMicro Trojan.MSIL.MALREP.THIAGBO
McAfee-GW-Edition BehavesLike.Win32.Trojan.wh
FireEye Generic.mg.ba6fb672900af300
Emsisoft Trojan.GenericKD.43745564 (B)
Ikarus Trojan.MSIL.PSW
GData Trojan.GenericKD.43745564
Jiangmin Trojan.PSW.Coins.idh
Avira TR/Crypt.XPACK.Gen3
Kingsoft Win32.PSWTroj.Coins.y.(kcloud)
Gridinsoft Trojan.Win32.Agent.oa
Arcabit Trojan.Generic.D29B811C
ZoneAlarm Trojan-PSW.Win32.Coins.yqg
Microsoft Trojan:MSIL/CryptInject!MTB
Cynet Malicious (score: 100)
McAfee Artemis!BA6FB672900A
MAX malware (ai score=83)
VBA32 TScope.Trojan.MSIL
Malwarebytes Spyware.StormKitty
Panda Trj/GdSda.A
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.MSIL.MALREP.THIAGBO
Tencent Win32.Trojan-qqpass.Qqrob.Pgmx
SentinelOne Static AI - Malicious PE
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.27.142:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-23 23:22:26

Imports

Library mscoree.dll:
• 0x372000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51379 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.