1.0
低危

26b42c5b87ba81b8e3f835eb2db0604ae2c408fc91b79da7cd7a6674ab1051f8

26b42c5b87ba81b8e3f835eb2db0604ae2c408fc91b79da7cd7a6674ab1051f8.exe

分析耗时

196s

最近分析

374天前

文件大小

49.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER ULISE
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.73
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Trojan-gen 20200215 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200215 2013.8.14.323
McAfee PWSZbot-FIT!BB097B2369BD 20200215 6.0.6.653
Tencent Malware.Win32.Gencirc.10b0c6c7 20200215 1.0.0.1
行为判定
动态指标
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意 (50 out of 57 个事件)
ALYac Gen:Variant.Ulise.43117
APEX Malicious
AVG Win32:Trojan-gen
Acronis suspicious
Ad-Aware Gen:Variant.Ulise.43117
AhnLab-V3 Trojan/Win32.Upatre.C3089037
Antiy-AVL Trojan[Downloader]/Win32.Agent
Arcabit Trojan.Ulise.DA86D
Avast Win32:Trojan-gen
Avira TR/Crypt.XPACK.Gen
BitDefender Gen:Variant.Ulise.43117
BitDefenderTheta Gen:NN.ZexaF.34090.dqY@aaxQBUmi
CAT-QuickHeal Trojan.GenericCS.S7229614
ClamAV Win.Downloader.Upatre-5744087-0
Comodo TrojWare.Win32.TrojanDownloader.Upatre.AAL@5l06uw
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.369bd2
Cylance Unsafe
Cyren W32/S-a2a6ca5b!Eldorado
DrWeb Trojan.DownLoad3.28161
ESET-NOD32 Win32/TrojanDownloader.Small.AAB
Emsisoft Gen:Variant.Ulise.43117 (B)
Endgame malicious (high confidence)
F-Prot W32/S-a2a6ca5b!Eldorado
F-Secure Trojan.TR/Crypt.XPACK.Gen
FireEye Generic.mg.bb097b2369bd2a63
Fortinet W32/Zbot.QMSC!tr
GData Gen:Variant.Ulise.43117
Ikarus Trojan-PWS.Win32.Fareit
Invincea heuristic
Jiangmin TrojanDownloader.Agent.ekgf
K7AntiVirus Trojan ( 0052964f1 )
K7GW Trojan ( 0052964f1 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=87)
Malwarebytes Trojan.Downloader
MaxSecure Trojan.Upatre.Gen
McAfee PWSZbot-FIT!BB097B2369BD
McAfee-GW-Edition BehavesLike.Win32.Downloader.pt
MicroWorld-eScan Gen:Variant.Ulise.43117
Microsoft TrojanDownloader:Win32/Upatre.A
NANO-Antivirus Trojan.Win32.Agent.cnfeqb
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM19.1.4227.Malware.Gen
Rising Spyware.Zbot!8.16B (RDMK:cmRtazqMwPiC8iOpHzPmDPRf5gbX)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/AutoG-AV
Symantec ML.Attribute.HighConfidence
Tencent Malware.Win32.Gencirc.10b0c6c7
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-10-31 14:23:23

PE Imphash

2eb47895ee25649cf9e79d6e6127836a

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.MPRESS1 0x00001000 0x00009000 0x00006e00 4.558246030801454
.MPRESS2 0x0000a000 0x00001000 0x00000400 5.874360208900479
.rsrc 0x0000b000 0x00002000 0x00001e00 5.943749196188174
.imports 0x0000d000 0x00001000 0x00000400 3.174378747046209

Resources

Name Offset Size Language Sub-language File type
RT_BITMAP 0x00007130 0x00000c28 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0000b0b0 0x00001ac0 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x0000cbb0 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MANIFEST 0x0000cc04 0x00000149 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library user32.dll:
0x405040 ShowWindow
0x405044 PostQuitMessage
0x405048 GetMessageA
0x40504c DispatchMessageA
0x405050 TranslateMessage
0x405054 MoveWindow
0x405058 CreateWindowExA
0x40505c RegisterClassExA
0x405060 DefWindowProcA
0x405064 SendMessageA
0x405068 LoadIconA
0x40506c LoadCursorA
0x405070 FillRect
0x405074 GetDC
0x405078 DialogBoxParamA
0x40507c GetWindowRect
0x405080 UpdateWindow
0x405084 SetFocus
Library kernel32.dll:
0x405008 GetModuleHandleA
0x40500c GetCommandLineA
0x405010 FindFirstFileA
0x405018 FindClose
0x40501c CreateFileMappingA
0x405020 FindNextFileA
0x405024 DeleteFileA
0x405028 CloseHandle
0x40502c GetCurrentProcessId
0x405030 GetCurrentProcess
0x405034 GetCurrentThreadId
0x405038 GetLastError
Library gdi32.dll:
0x405000 CreateSolidBrush

L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
@@h(QZ
@@i>hZ
@@hhjX
+D-5G`j
%'\tm4Wj+2 h(
cie$xc
( XqLD|
d<Xm N-@
CC2BBBB
r_u4a@
MX+u]UuMRQ
BFYIuZu;us
GFu;uuY]+Z
@@>3H)
@@-?d,
@@8h:d
VWAAf9
uE@ME;ve
E;EsN$
@@xL;$
+hG-@5am
"j=n0(
D)jBn'
a]ndVG)P
(n u(D{!
L(J#v_m(
hamYoA\/}
&(:9aoM'
md|Q~+(
wmid7a)f$(
4)q\D(
(\;$/"%
xUR`u4
`%m%r9
memV`)nt(S)(
8yA}V;m
4e}=$m
(Y6_%,^
(0h$\$(
B](>yn
Q]n</]#
,z0?h(
Ve[& `0Xh'm
;At*)Qld
>Ae`^g(
pm*n-(
,_j'/!J`Y
(rD9:))
%(qmK(
"Z'T-\L'-
vtew(k)nQ"
vc?E}$(
Q(n~w].b'M
(+ef$}
kmp4<(
u4/4\Z(
6s4)OPha((
$ }+m!
&\hPe4i
$$X]aX(
t5 ,(hd
C,+$o%
(%$m(m
((R`hm'mv$
9%].t[*{p`(
p`h,F@Rw`
``4e[Q
%l{-Dme(
lh#a9na*(2
(-q(Fa8,
(=(K.(
++8'%((
*$iz\4O
*-hbaP p
tauaPf6+
z{K.e(
+as'a8$P#
}l@i$ni
(qad<$+
nLk8~(
[X7#*(d[
euh)))(
(#&5}|x/
&ml.rRr
5-Mm0%f${
(D(-`i)(
h+'[YU
e/P27X{(
(-cna`Am
+6u4>)
p6 unm
`@"*Mg(
N)5MQ95
((i9*k
Q(P}\^(
Ei-LT?
qc$ q"]
(~Ju.$n
(-ah8B
((/h/$((
]^$)i$m)aoE4
L[uclN
d;q'MhgLh6(
J+IIII
@@@@8Q/9a@
FGIu54a@
FFFF=a@
@;s`;s
FGIu=a@
@@>}mJ
@@>hjJ
@@kDmj
8@@@@0
EM+PEM+X+@Pj
7u1 a@
GV+=a@
QRRha@
JRV0a@
4uc(a@
GGGGBBBBIuj8j
FG3@_^]
user32.dll
ShowWindow
PostQuitMessage
GetMessageA
DispatchMessageA
TranslateMessage
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
SendMessageA
LoadIconA
LoadCursorA
FillRect
DialogBoxParamA
GetWindowRect
UpdateWindow
SetFocus
kernel32.dll
GetModuleHandleA
GetCommandLineA
FindFirstFileA
GetCurrentDirectoryA
FindClose
CreateFileMappingA
FindNextFileA
DeleteFileA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
GetLastError
gdi32.dll
CreateSolidBrush
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
popular
jhwHakh
hf`iiK%>
Diih0mh^lih
h}ahnhhh|H?
h;;g(!olh
iHlKhwh
hq8k.h
hl--uh
he8h7
hV;thF<
hkh2%gKiHl
iHlKhKi
performs complex
button
Window
listbox
ground
HL@(i<i
oK(l@$
hhhj(8
hijhlh
pI$*?j,{;""d2G~A
s"Destroy
operators
easily
=RB/ )
72V-</
U<U<%2-#[
V]A8R@
outside
X8hjRj
@iPFZh
X8hjRj
@iPFZh
X8hjRj
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
user32.dll
gdi32.dll
CreateSolidBrush
t7Kt'Kt
Znjjikpsomruuvvyzz{}
m-h(g$j(k+p1r4n0r4z@w<v:w=x@
IKJKSPT``n|lpw
d#{Ct8r4x?zAx?x>{BI
HNONSVRSVXRUR`ns
i1h+h-i-m2p4r6w={B{@~EKNNNP[\]_^]bnqotw
f4c/f1h3j5l3n5q9t<y?{A}ELOX][ZZ]dcciiqy~
f7`2c4e7h9g7i;l=n>s@uByE}I}IS[XWY\aafnhn
^5Y-\1]3^4^5b8c:c;d<g@jBnBnDpFrHqGwL~TWWZ]emolv
YQ0UN(VP+UO*VN,WN+XQ,[S.\S.aW0a[1e_4le7jd6hb7pi<rl=qn=vtBxwDxwExwEopDnlCpqBx}J|Q{M
OY\adeknj
BJ->E%AI'>H'?I'?I'AJ)CM*FQ+O]/^k7`p:^o9[n7Ym8au=fz@f{Ag}BkEe
C]{=Pm7Nj6Z|@cG\C^FcL]FcJjNmOjQu]ts
FL-CJ'FP*HR,GR+HS-IV/HU-KX/Sf5Yp;Wr<XvAeJ_~D[}B`KdLaG^I\J[IZHeQb^xYs[sWVdn
M^7Qe6Sh8Nc5FY1EX1G\2H_4Qn<VyBUyFe
OrVrVgLfLgO`M]LdRdnlu
Tp?Qo<He8?Y2A]3B`3Ee6Ou?]NoV_b]}Vr
8W%bvJOh;Ea8@[6Ed9Jo=R}HgW|`_^^j
\g9}}WsvNnwNkwOi{QmX|ehcgo
hh<~~XW\
]~afjp
poB`\[}_ez_t
kp>}W}X|XpzQsZo
Vlgisrklfbghhiormkmr
I`YZYYY[[[Z[]^afc`_bq
>WPSRSSRRRPQSUY^[WUWd
5PIKJKKKJKJKLMRTOLKP_
5.0/0000000//11///03;AHbw
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>
user32.dll
ShowWindow
PostQuitMessage
GetMessageA
DispatchMessageA
TranslateMessage
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
SendMessageA
LoadIconA
LoadCursorA
FillRect
DialogBoxParamA
GetWindowRect
UpdateWindow
SetFocus
kernel32.dll
GetModuleHandleA
GetCommandLineA
FindFirstFileA
GetCurrentDirectoryA
FindClose
CreateFileMappingA
FindNextFileA
DeleteFileA
CloseHandle
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
GetLastError
gdi32.dll
CreateSolidBrush
eb05f2bfaa609798cd9e5f3f7cf6df3deffbd305
C:\66799e92d92e661
C:\Users\Lisa\Desktop\0VuTYzZe.exe
C:\b50b3f82a63cb22e0daa83a0be40d7827301d502652c94b198f4d5ea3f7a7c49
C:\Users\Lisa\Desktop\fNpaslUQ.exe
C:\997872bc0a5669f3ec39561b305d8c4c3eb1723a9aba47eb049e4968d338b4eb
C:\FN1DqXoh.exe
C:\56b021621d3d11c024e04464372b9f698100f2f9611886a3e90907af40817756
C:\9eb5ee606e4365ba82dc2dc50848b815d176eae8e809d9d87307a02261a7a01b
C:\Documents and Settings\Administrator\Desktop\djl7enPs.exe
C:\5faf31f47613880612b6a7d37fc86e2766237027f236543b1801b52fd5d5b3c3
C:\Users\Lisa\Desktop\Y7OCm8AC.exe
C:\jP0KQx_D.exe
C:\d40f9a6dc6b05f43edbb3f1808fdcb0a2f2506141416c141df55cec56825e55c
C:\f5d6fd5afdc44c6d553ea721bc3ced0c5baedb36381618b63dd15731eaa6933d
C:\3a06be49a19e1e4d28703768c42fadce616eec9f0d093737bdded61a66fe4ab6
C:\f1004ab8df274481cf58e4687e3bbd7b27649b59920756b460942d127d23236c
C:\guMPq4bR.exe
C:\Documents and Settings\Administrator\Desktop\JJtBiVWb.exe
C:\9d5cd452687917c34c8ab7e28d23684647a9de4f88b1b5184313879fb1619e2d
C:\b33b4e49d76dcb0903a5fc84033fba5d239807df5bf5672311c24f95b7851364
C:\ZyIcY4bY.exe
C:\79e2ffb3dbde0e4b1e291503cadb38ef3d42174ddcf21a4f2cdbc880a0fd8830
C:\j2NxJiFs.exe
C:\db0ce11af3ac948bc982a648dbe57ac9fb3ab1b60da452e38dd1379d20383fbb
C:\DwjW1VaO.exe
C:\a7f87530943ab3b8851619d9e7ef41ce7bcdb25391b24e896c48328d783f049b
C:\d30e56b4e45bbc783355cf9371d750c9d91a9a845236db394a7ee78ab3f0d8ac
C:\Hr2b2rzE.exe
C:\Documents and Settings\luser\Desktop\HQnFpuSY.exe
C:\445dcf56678d4886d9ece66220b17533716c5d8a6042fb0aef3633d14777ba6f
C:\d935bc6234a90c156b1500265fb97c8fc076c444018af356a127e0eac1ddb9cf
C:\DtTgWA4I.exe
C:\Users\admin\Downloads\invoice.exe
C:\78a55a8f8ba2070d0f83abe5166af57bbe56594d5a8a8fd4d2ea377d8d77d2d8
C:\Documents and Settings\Administrator\Desktop\QgFEkWLj.exe
C:\NMTEiDin.exe
C:\adf51acc598acca2eb5818569a2ae04fbe3ff4c96eb3b26084498ad950fe20f0
C:\Documents and Settings\Administrator\Desktop\i8O20a80.exe
C:\Users\admin\Downloads\factura.exe
C:\Documents and Settings\Administrator\Desktop\EFW3MLXf.exe
C:\yrD0wNN7.exe
C:\Users\admin\Downloads\invoice.exe
C:\mJ1nsZJX.exe
C:\1a9737614cc3b564ab6c9671280b3000bc580f29865cf8921bdd6512ad9871b1
C:\5b99c7ddbb7fbdc8cc14c91b02862dfbdddecdb43be59995b63c429103b8258d
C:\Documents and Settings\luser\Desktop\vC6QyMZb.exe
C:\Rgi76F0w.exe
C:\07a8169d90d68f35e10707075b3526811cf41b92c4a9452f64ab64ad7c79a3ba
C:\pXhoeBo7.exe
C:\31bf5485a03f92345e2abf649823b10794402a532b24a1a477d21f554ee57ac5
C:\4f8fc24efbd7d0a68c87505a6583ac7a5f4e4715ed1e0a768e6bdb6f31512c1b
C:\57fc9f91778d32ff04e300b3f52ec76f62035990caa6eaa24c087de4f03c4d81
C:\5e12d870056ac935627eba7f9755cec141408750650e4da8d07601863a3b190c
C:\2d28da2486699a936558ba7b7fbac33b3669c25872ddb69e78de4a9030c8db1e
C:\87e13bd743357819785e92d8f3ffe41fddde4051eb8e0bf79084e31b2f6ae5be
C:\e36a1ffaa4c8f2e00a1c8d0a27d178322ca5208aab26fb90b84f45bdf69a3d3a
C:\f839adfd6a4dd190b99a97303fc3914f2048b0997f2d49daa7baed61dfb5426d
C:\add5c622d7f043cccfc7abd3b8769e9c1250f0e82c534395b73ccc6f32486cf9
C:\Users\Petra\AppData\Local\Temp\retro.pe32
C:\Users\admin\Downloads\d019a5c8e240190b_retro.exe
C:\yJ_6Z2EM.exe
C:\2d75932b419ffc0c2f1ad97ee60582a701382747473f08c25ab8074244e3be68
C:\Users\Petra\AppData\Local\Temp\retro.pe32
C:\Users\Petra\AppData\Local\Temp\retro.pe32
C:\Users\admin\Downloads\ecbf130181fb3b09_retro.exe
C:\ea5adab636623805ae13a6a851b516b5b280929ae20da6de8520f49035c8f3de
C:\Users\Petra\AppData\Local\Temp\retro.pe32
C:\d267fbbc8ecb040ad24ae2e31b882a0479c45a67e08554070c29e515c2ef96a7
C:\Users\Petra\AppData\Local\Temp\retro.pe32
C:\Users\admin\Downloads\69ba457da01eb8cd_retro.exe
C:\544f9fe3c15cafebb90ceff72a7cd9ff3c4d220594c3d49df25f8f1bb178336e
C:\Users\admin\Downloads\retro.exe
C:\8845ee6ede9b3c97b04027244a4103e7e0b50e68e016adafeeab63c32b4957d5
C:\5dc480cb84a31fd99ac7e3804b02f1e06e991eaffa5ef6eb3bbb6f65a4496142
C:\Users\Petra\AppData\Local\Temp\retro.pe32
C:\a2fdff2b40cba9383df7a6434f7342da2fc834bb7749323daea68c397e41a0f9
C:\46775b92cc7f6beabeffff3e79a27aebd31993bae35973b1b2dbf58122ea52eb
C:\4e3fe6ae3678b69a6f2eaae4ed8f4d5b7cd5f0c990336a0c003b5ad29a98cc00
C:\caed18869ff894586418ea07723b870e93bb62ddcbe3fc0caa3393760d08a9bb
C:\370bb49efb8e4bedc2f36f5b3d930abc2a1720080bf9b443e7de9f82f624e71e
C:\f046ca39e33b2e9b84450b672b6fcf227ca9a42618026a7df89c0842f0e7f8cf
C:\Users\admin\Downloads\retro.exe
C:\Documents and Settings\Administrator\Desktop\DT02iWCM.exe
C:\64ccf3453c2a0b51d3ec58f404086f2fd5fad95a63a773981d1728ad19159639
C:\ca5f796ca0a77e3d355839b91c173d4c4218ff7ea585183dfa65cb150369e0ec
C:\56cb75516eba6e87173cf009c457d4c3f2ae4f4f7c5a6ef92f8e6e24303b5802
C:\ff8dca392c59e251506ce72594904527a45342f18a1ef97fefcfcf82c2a08c9b
C:\Documents and Settings\luser\Desktop\peMLUCYl.exe
C:\Users\admin\Downloads\a6bd6e90a3a263cc41dae8191173f82667e6e0467e44b2a4f9a4d475433d6c6b.exe
C:\Documents and Settings\Administrator\Desktop\sN8KH1bo.exe
C:\Users\admin\Downloads\42871393b30668877c49a6accc7975be7fa4d0bb30e19abec1ceed2e4585cbe1.exe
C:\39635fdd70bb24b62479e4a27dbc79a2c0d72fb8094d1d36f0de6aa8b55cbc5f
C:\366aae756be9e85dfaeca7518628d127061045baeb1bd4511fe9378041a1337c
C:\2002b590675fd0d21ef02d2dfcb715ec5dc6ddecc7eeaeb7843787f9a6cc66b8
C:\Users\admin\Downloads\retro.exe
C:\Documents and Settings\Administrator\Desktop\DfoGcUiE.exe
C:\Users\RA491~1.VUL\AppData\Local\Temp\7bd5f3cab47339453e75fe5d5a1ee301.exe
C:\Users\admin\Downloads\retro.exe
C:\98c60c393f4abd6487efaba4735e172e24f11fff6018045bd30b10aecc6575ef
C:\Documents and Settings\luser\Desktop\5Z397ACu.exe
C:\Users\Petra\AppData\Local\Temp\file.pe32
C:\d4ee2fa1084b91e6c115805f0f272654ebcbdd7e044a260d54fb561ddda16b55
C:\Users\admin\Downloads\retro.exe
C:\6bf2abcdf26c68d1b886f04af6a90cb9a6aa9638ca4dc5be4e7d4a39da52e6f4
C:\Documents and Settings\luser\Desktop\2MXjkXsS.exe
C:\Users\admin\Downloads\d48746ed4c907c68588e92772a2d93a4e02c1424269b6539543509c5677b18c1.exe

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 57665 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.