1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.64
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20200407 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200408 | 2013.8.14.323 |
| McAfee | PWS-FBRL | 20200408 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b63f00 | 20200408 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(1 个事件)
| section | {'name': '.data', 'virtual_address': '0x00003000', 'virtual_size': '0x000009c4', 'size_of_data': '0x00000a00', 'entropy': 7.102883484733442} | entropy | 7.102883484733442 | description | 发现高熵的节 | |||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意
(50 out of 63 个事件)
| ALYac | Trojan.GenericKD.1620012 |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1620012 |
| AhnLab-V3 | Spyware/Win32.Zbot.R102594 |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Generic.D18B82C |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | TR/Samca.pfeyq |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.GenericKD.1620012 |
| BitDefenderTheta | Gen:NN.ZexaF.34106.bqX@ay8wQAii |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| CMC | Trojan.Win32.Bublik!O |
| ClamAV | Win.Trojan.Upatre-3444 |
| Comodo | TrojWare.Win32.Bublik.CEZE@595kvx |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.efadfd |
| Cylance | Unsafe |
| Cyren | W32/Trojan.MBHL-3133 |
| DrWeb | Trojan.DownLoader11.4013 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.B |
| Emsisoft | Trojan.GenericKD.1620012 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.HWO |
| F-Secure | Trojan.TR/Samca.pfeyq |
| FireEye | Generic.mg.bd94c74efadfdd46 |
| Fortinet | W32/Upatre.BH!tr |
| GData | Win32.Trojan-Downloader.Waski.C |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.azspd |
| K7AntiVirus | Trojan ( 0001140e1 ) |
| K7GW | Trojan ( 0001140e1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=81) |
| Malwarebytes | Trojan.Email.FakeDoc |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | PWS-FBRL |
| McAfee-GW-Edition | BehavesLike.Win32.Packed.mm |
| MicroWorld-eScan | Trojan.GenericKD.1620012 |
| Microsoft | TrojanDownloader:Win32/Upatre.O |
| NANO-Antivirus | Trojan.Win32.Bublik.cvyenz |
| Panda | Generic Suspicious |
| Qihoo-360 | HEUR/QVM20.1.6C31.Malware.Gen |
| Rising | Downloader.Waski!8.184 (TFE:dGZlOgIdXmwnbyG0SQ) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2003-10-11 11:25:10
PE Imphash
d62477e5d65a0ea14853387d466a6238
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000b73 | 0x00000c00 | 5.099446785082012 |
| .rdata | 0x00002000 | 0x000004e8 | 0x00000600 | 3.827924641472069 |
| .data | 0x00003000 | 0x000009c4 | 0x00000a00 | 7.102883484733442 |
| .rsrc | 0x00004000 | 0x000029d0 | 0x00002a00 | 4.511616296507731 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_BITMAP | 0x00006920 | 0x000000ae | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x00004278 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00006838 | 0x000000e4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00006838 | 0x000000e4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00006820 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x402024 SetFocus
• 0x402028 DialogBoxParamA
• 0x40202c GetWindowRect
• 0x402030 SendMessageA
• 0x402034 SetWindowTextA
• 0x402038 TranslateMessage
• 0x40203c DispatchMessageA
• 0x402040 GetMessageA
• 0x402044 EndDialog
• 0x402048 GetDlgItem
• 0x40204c CharUpperA
• 0x402050 CharUpperW
• 0x402054 CharPrevA
• 0x402058 CheckRadioButton
• 0x40205c GetWindowTextA
• 0x402060 MessageBoxA
• 0x402064 GetDlgItemTextA
Library KERNEL32.dll:
• 0x402008 CloseHandle
• 0x40200c GetCurrentProcessId
• 0x402010 GetCurrentThreadId
• 0x402014 SetLastError
• 0x402018 GetVersionExA
• 0x40201c GetModuleHandleA
Library COMCTL32.dll:
• 0x402000 None
L!This program cannot be run in DOS mode.
`.rdata
@.data
j39j jjjj959
j 35]3JB
93559
j3 5 999
5 3 j
3 95j
j9j 3359
9395 5
j05x9@
j05|9@
j05t9@
3555j9 3j5j3 53j9
jj j33 j
j j 3
33j j339j35
3339 33
53999335
jj 5j3
j 3 9
3 j5jj
uSAWVAf9
KIM3EE
GEGEGMG;r
95 9 j3 39
95335jj 9
FG3@_^]
35 5 5
t(=8 @
MQ3PPPUR
[jj 93
35995jj9
33355
39j33j59
YIuKXG[O_^
9 3 jj
3 3jj55j
53j5j
59 3j33j5
bad allocation
GetDlgItemTextA
CheckRadioButton
GetWindowTextA
CharPrevA
CharUpperW
CharUpperA
GetDlgItem
EndDialog
SetWindowTextA
SetFocus
DialogBoxParamA
GetWindowRect
SendMessageA
MessageBoxA
TranslateMessage
DispatchMessageA
GetMessageA
USER32.dll
GetVersionExA
SetLastError
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
GetModuleHandleA
KERNEL32.dll
COMCTL32.dll
=;aYjk@
Mr6>wHmad
ND!*wO
RR&2RIlwGl
3illwG;]
fA79qBtauUNxa\!?M_
UdW|+KVR
Av*3qTka
66iUj|d^w/"]&?wOv|d;Q
V|"?kJkfV
3iTlws
_>ZVW`wbl
G]A"3R
";f~ZE
!n~],Q
w'S+GUm;
xHc8[m;]GQW
N4!3 k",D<LDb
lr;FP!N-
<v)t;F
G9+mL@
OqBYGUF9t8
;fP<T!aqx 38R&
*;FPW~I|]AW
;DWms(;
mka3RZT;D
|MxmNwj
;T!]Ql
mV+qLt{A&@[
W~i~]X:;$"x3]
*;FP[s+
A^"(`y~ws
WtTiy8*mL
U{TEi;
z]Q+Qlu;f
AxJwTa
!nM+Q+Q
x"@3)|^
-RR&?v
Tt}`;m
xZdWyfh
VR (l^qbrT7
&(dWmauRxWva')+R
:5hI7qrzK
x~u`yn
diminutiveness
|||}}}
/ / / / / / / / =./ / / / / i\/ / / / / / / +
0 0 0 0 0 0 0 0 0 H=0 0 [N0 0 0 0 0 0 0 0 0 0 0 0 -
/ 1!1!1!1!1!1!1!1!I=1!I=1!1!/ / 0!1!1!1!1!1!1!1!/
1!3"3"3"3"3"3"3"3"{3"]R3"3"j_3"3"3"3"3"3"3"1!
3"4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#4#3"
5$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$5$
6%6%6%OCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOCOC6%6%
"""""""
"""#"""
"""DB""
"""BB""
""$BD""
""$"$""
""$"$""
"""""""
L h t t p : / / n o t e p a d - p l u s - p l u s . o r g /
h t t p : / / n o t e p a d - p l u s - p l u s . o r g / c o n t r i b u t o r s
T h i s p r o g r a m i s f r e e s o f t w a r e ; y o u c a n r e d i s t r i b u t e i t a n d / o r m o d i f y i t u n d e r t h e t e r m s o f t h e G N U G e n e r a l P u b l i c L i c e n s e a s p u b l i s h e d b y t h e F r e e S o f t w a r e F o u n d a t i o n ;
e f o r m o r e d e t a i l s .
Y o u s h o u l d h a v e r e c e i v e d a c o p y o f t h e G N U G e n e r a l P u b l i c L i c e n s e a l o n g w i t h t h i s p r o g r a m ; i f n o t , w r i t e t o t h e F r e e S o f t w a r e F o u n d a t i o n , I n c . , 6 7 5 M a s s A v e , C a m b r i d g e , M A
s e c o n d d i a l
M i c r o s o f t S a n s S e r i f
M S S a n s S e r i f
C : \ D O C U M E ~ 1 \ J u l i e \ L O C A L S ~ 1 \ T e m p \ R a r $ E X a 0 . 9 4 3 \ a d p _ r e p o r t _ 0 3 2 5 2 0 1 4 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ 8 F p h D E n S u . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A l l U s e r s \ S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ C 7 3 4 w r d 0 a . e x e
C : \ r s z z N m 4 M . e x e
C : \ e 7 3 b c 9 b 2 c 5 4 0 c 4 2 6 b b a c 9 c 4 e a 4 c 3 2 9 8 d c 3 6 2 1 d c b a c b a f 0 3 7 e 0 6 1 8 b e 7 e 8 c 9 3 5 4 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ d 0 2 4 5 d 5 8 8 f f b c a 5 6 2 f 9 3 7 8 9 3 7 d 2 1 4 c 5 3 c 7 5 a 1 4 4 1 6 b 4 7 0 6 5 4 3 8 2 a f 9 e b b 8 c c 3 8 4 c
C : \ 5 b 7 7 3 c 9 b a c f c 8 1 2 5 b b 2 2 7 f 3 1 3 e d c 2 5 8 9 4 6 5 2 c 2 e 5 1 a c a 8 6 a c e c 9 5 b c a 0 3 1 0 9 0 0 7 d
C : \ 1 5 d 1 7 a 7 1 0 4 a 8 2 8 9 0 f a c 2 8 d 7 a f 5 a 3 b 1 f 4 8 9 6 f a 7 3 b 5 6 2 d 7 5 a 6 b 1 c 3 0 8 e e f 9 f 6 c 3 5 e
C : \ 6 f 6 d a d 1 7 9 2 7 b f 9 b 2 2 3 3 e 7 b 4 b b 1 5 9 1 1 9 b 1 d 3 3 9 4 2 a f 6 b 3 c e a b 3 a 6 9 4 3 f b c 3 5 5 c 9 e 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 8 2 b 0 8 d 2 e 8 4 b f c b 4 0 5 f 5 c c c 9 e c e d 1 1 8 9 9 4 1 1 e b e 5 1 6 2 e f 7 0 1 3 e 0 f 5 0 6 f b 0 a 6 0 e 6 9 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ s a s y n . p e 3 2
C : \ c 0 c 8 a a e 5 1 3 0 3 5 0 b 3 d 1 0 f d 8 3 4 a 4 b 5 3 4 f 2 3 2 c 3 c f 1 d 3 b 5 8 a c 8 d a e a a 1 0 9 3 c 7 1 3 6 a 5 9
C : \ 1 1 6 c e f 9 3 b 4 c 8 2 a b 4 1 3 d 0 6 8 d e 5 b c 3 a 8 5 3 0 2 3 0 5 7 f 5 a 9 e f 1 7 b 1 6 2 5 c 2 3 c 3 4 f 8 a 0 8 4 e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 2 3 9 b 8 2 7 e 6 f 8 4 9 1 6 4 6 b a e d 1 6 3 9 b 1 6 6 a 0 d 9 8 a 6 6 4 c 0 6 9 c 6 9 d c c a 0 1 f 2 d 9 8 1 2 0 c d 2 d 8 . e x e
C : \ 1 6 8 f c d 5 8 9 8 a 1 c 1 c b c c f 4 1 6 c 2 5 0 7 d 8 a 4 3 5 9 2 5 3 f 4 d 9 d 5 5 1 7 7 8 b 0 d 5 9 3 c 9 d 7 2 8 a 1 f f
C : \ y o n I C 8 e x . e x e
C : \ 9 3 7 9 f 2 d d 7 6 2 7 9 e a 2 6 3 a e d 4 b 4 2 5 8 b b 5 f 4 3 9 4 3 5 2 c 6 6 e 3 c 1 c 7 c 5 c 2 5 0 3 d c 5 b 7 9 5 3 6 b
C : \ s h t j O 7 u r . e x e
C : \ c 8 5 f 3 4 b d 0 c c 5 f e 9 4 5 a 3 a f 2 8 d 7 b c 0 4 5 f 2 f 9 d 8 7 d 6 2 0 4 a b 3 4 6 1 3 8 2 9 7 9 b d d c 1 1 c 3 c 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ J o h n \ A p p D a t a \ L o c a l \ T e m p \ X G e o i i q e I I . e x e
C : \ a 9 c 7 5 3 2 0 9 2 3 f a 9 f d f 0 e 8 f 3 f 0 8 5 2 c c 4 9 c e 2 d 3 d b 0 f d 9 7 f 2 4 9 7 5 6 4 5 6 7 1 2 3 e 0 b 9 5 e a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a s y n . e x e
C : \ f 8 5 4 9 6 d c 2 8 c 2 f 6 3 a a 6 5 9 4 6 0 b 1 5 c c 8 5 b 2 e 1 b 7 d 3 d f 4 e 5 5 6 5 2 d 4 c a 1 f 4 b 9 2 a 1 3 8 5 c 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a s y n . e x e
C : \ X 8 q X L s S J . e x e
C : \ e 8 3 3 8 3 f e 1 5 d 7 b 5 2 c d e 9 f c f a d 1 d 7 4 d 4 8 b 4 a 9 c 2 8 2 d 0 e 0 4 c a c 9 c 5 5 a 5 7 d 4 6 9 6 b 9 1 7 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a s y n . e x e
C : \ 4 7 0 b 4 a 3 b d 3 6 7 e 9 4 e 8 9 c 5 d f 3 a 7 7 d 2 2 1 1 b a 1 a 5 3 0 d 5 2 b 0 9 e 5 b d 5 9 2 2 0 1 3 b 4 7 b b 0 1 9 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a s y n . e x e
C : \ 7 d 6 f 5 e 5 b 2 6 d a 5 c 0 c b a d 6 e 4 0 6 b e 0 f e 6 4 1 4 e 1 1 c 2 a b 8 a d 9 0 4 7 4 9 8 5 a b b e 6 8 f f b 9 f f 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a s y n . e x e
C : \ 2 c f a 0 6 d 5 4 7 7 a 8 b a a c a 0 0 4 d 0 2 2 6 4 3 5 6 6 c e 9 a c 5 3 9 8 4 d c f 8 7 5 d 3 4 e 3 1 4 0 2 1 2 8 4 e 1 c 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a s y n . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 d 1 7 3 b 6 5 c f 9 3 9 2 c 5 4 4 c 3 5 d 2 e 8 5 6 1 7 7 c 2 0 8 9 5 c 0 b 7 7 f 9 1 e 4 1 e 1 4 7 1 a f 0 b 1 e 3 d d 5 f f . e x e
C : \ 9 5 9 0 2 9 b 8 1 0 d c d 7 f 1 8 6 a c d d 5 b 1 8 8 2 a 3 4 c d 3 f 8 a 7 d 8 0 8 0 b b 4 0 3 4 6 b 2 0 3 1 e b 3 7 1 d 0 4 8
C : \ e 9 d 2 0 0 d 6 2 e 1 1 3 c 8 5 8 a 6 0 f e 0 8 b 5 d 8 2 f 6 c a 6 8 d 7 5 f e 5 3 9 b d 5 5 f 0 5 5 d c 9 9 7 2 e 0 9 2 1 1 2
C : \ e 8 5 6 e 9 8 0 2 6 1 8 9 2 9 6 8 f 5 c 7 8 5 d 1 b 5 d a 1 c 7 a 1 8 3 2 6 9 6 5 3 2 1 a a 6 8 7 f 9 5 5 0 a 1 1 9 3 b 4 8 1 8
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.