2.5
中危
61 个模型检测该样本为恶意！
重新分析
更多

0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e

0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e.exe

分析耗时

164s

最近分析

374天前

文件大小

32.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER ULISE
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.62
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Trojan-gen 20200101 18.4.3895.0
Baidu Win32.Trojan.Inject.bm 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200101 2013.8.14.323
McAfee Downloader-BIJ.a 20200101 6.0.6.653
Tencent None 20200101 1.0.0.1
静态指标
观察到命令行控制台输出 (11 个事件)
Time & API Arguments Status Return Repeated
1727545334.281
WriteConsoleW
console_handle: 0x00000007
buffer: C:\Users\Administrator\AppData\Local\Temp>
success 1 0
1727545334.281
WriteConsoleW
console_handle: 0x00000007
buffer: del
success 1 0
1727545334.281
WriteConsoleW
console_handle: 0x00000007
buffer: "C:\Users\Administrator\AppData\Local\BDESVC.exe" /a
success 1 0
1727545334.297
WriteConsoleW
console_handle: 0x00000007
buffer: C:\Users\Administrator\AppData\Local\Temp>
success 1 0
1727545334.297
WriteConsoleW
console_handle: 0x00000007
buffer: move
success 1 0
1727545334.312
WriteConsoleW
console_handle: 0x00000007
buffer: "C:\Users\Administrator\AppData\Local\BDESVC.exe.tmp1" "C:\Users\Administrator\AppData\Local\BDESVC.exe"
success 1 0
1727545334.312
WriteConsoleW
console_handle: 0x00000007
buffer: 移动了 1 个文件。
success 1 0
1727545334.328
WriteConsoleW
console_handle: 0x00000007
buffer: C:\Users\Administrator\AppData\Local\Temp>
success 1 0
1727545334.328
WriteConsoleW
console_handle: 0x00000007
buffer: del
success 1 0
1727545334.328
WriteConsoleW
console_handle: 0x00000007
buffer: a.bat
success 1 0
1727545334.359
WriteConsoleW
console_handle: 0x0000000b
buffer: 找不到批处理文件。
success 1 0
一个或多个进程崩溃 (3 个事件)
Time & API Arguments Status Return Repeated
1727545332.39025
__exception__
exception.address: 0x402133
exception.instruction: xor byte ptr [ecx], al
exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b
exception.symbol: szFile-0x210d 0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e+0x2133
exception.exception_code: 0xc0000005
registers.eax: 194
registers.ecx: 4214964
registers.edx: 242
registers.ebx: 256
registers.esp: 1637600
registers.ebp: 1637624
registers.esi: 1637976
registers.edi: 256
stacktrace: 
szFile-0x2fc6 0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e+0x127a @ 0x40127a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

 success 0 0
1727545332.39025
__exception__
exception.address: 0x402133
exception.instruction: xor byte ptr [ecx], al
exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b
exception.symbol: szFile-0x210d 0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e+0x2133
exception.exception_code: 0xc0000005
registers.eax: 175
registers.ecx: 4218880
registers.edx: 143
registers.ebx: 256
registers.esp: 1637600
registers.ebp: 1637624
registers.esi: 1637976
registers.edi: 256
stacktrace: 
szFile-0x2fc6 0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e+0x127a @ 0x40127a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

 success 0 0
1727545332.39025
__exception__
exception.address: 0x402133
exception.instruction: xor byte ptr [ecx], al
exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b
exception.symbol: szFile-0x210d 0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e+0x2133
exception.exception_code: 0xc0000005
registers.eax: 106
registers.ecx: 4222976
registers.edx: 211
registers.ebx: 256
registers.esp: 1637600
registers.ebp: 1637624
registers.esi: 1637976
registers.edi: 256
stacktrace: 
szFile-0x2fc6 0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e+0x127a @ 0x40127a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

 success 0 0
行为判定
动态指标
分配可读-可写-可执行内存（通常用于自解压） (2 个事件)
Time & API Arguments Status Return Repeated
1727545332.39025
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00400000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 2108
success 0 0
1727545332.39025
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x72591000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 2108
success 0 0
在文件系统上创建可执行文件 (2 个事件)
file C:\Users\Administrator\AppData\Local\Temp\~dfds3.reg
file C:\Users\Administrator\AppData\Local\Temp\a.bat
将可执行文件投放到用户的 AppData 文件夹 (1 个事件)
file C:\Users\Administrator\AppData\Local\BDESVC.exe
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x00002cc4', 'size_of_data': '0x00003000', 'entropy': 7.738172771624536} entropy 7.738172771624536 description 发现高熵的节
entropy 0.42857142857142855 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
枚举服务，可能用于反虚拟化 (1 个事件)
Time & API Arguments Status Return Repeated
1727545332.39025
EnumServicesStatusA
service_handle: 0x003047a0
service_type: 48
service_status: 2
success 1 0
在 Windows 启动时自我安装以实现自动运行 (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\BDESVC reg_value C:\Users\Administrator\AppData\Local\BDESVC.exe
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意 (50 out of 61 个事件)
ALYac Trojan.Injector
APEX Malicious
AVG Win32:Trojan-gen
Acronis suspicious
Ad-Aware Gen:Variant.Ulise.511
AhnLab-V3 Backdoor/Win32.CSon.R885
Antiy-AVL Trojan[Downloader]/Win32.Rubinurd.b
Arcabit Trojan.Ulise.511
Avast Win32:Trojan-gen
Avira TR/Dropper.Gen
Baidu Win32.Trojan.Inject.bm
BitDefender Gen:Variant.Ulise.511
BitDefenderTheta AI:Packer.54A3CF691F
Bkav W32.AIDetectVM.malware
CAT-QuickHeal Trojan.Mauvaise.SL1
CMC Trojan-Downloader.Win32.Rubinurd!O
ClamAV Win.Trojan.Rubinurd-67
Comodo TrojWare.Win32.Toga.B@6vx8t0
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.48bc62
Cylance Unsafe
Cyren W32/A-1a76837c!Eldorado
DrWeb Win32.HLLW.Autoruner.27746
ESET-NOD32 Win32/TrojanDownloader.Agent.PTT
Emsisoft Gen:Variant.Ulise.511 (B)
Endgame malicious (high confidence)
F-Prot W32/A-1a76837c!Eldorado
F-Secure Trojan.TR/Dropper.Gen
FireEye Generic.mg.c11290048bc62d9b
Fortinet W32/Injector.BFSU!tr
GData Gen:Variant.Ulise.511
Ikarus Trojan-Downloader.SuspectCRC
Invincea heuristic
Jiangmin TrojanDownloader.Small.akba
K7AntiVirus Trojan-Downloader ( 0040f54b1 )
K7GW Trojan-Downloader ( 0040f54b1 )
Kaspersky HEUR:Trojan.Win32.Miancha.gen
MAX malware (ai score=82)
Malwarebytes Backdoor.Simbot
McAfee Downloader-BIJ.a
McAfee-GW-Edition BehavesLike.Win32.Backdoor.nm
MicroWorld-eScan Gen:Variant.Ulise.511
Microsoft VirTool:Win32/CeeInject.gen!DU
NANO-Antivirus Trojan.Win32.Autoruner.bbwavd
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM19.1.44FF.Malware.Gen
Rising Trojan.Inejctor!1.A7C6 (CLASSIC)
SUPERAntiSpyware Backdoor.Bot/Variant
Sangfor Malware
SentinelOne DFI - Malicious PE
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2010-09-07 10:27:10

PE Imphash

f54bab47f74e370cf85ce98d899e8149

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001755 0x00002000 5.8632344023987555
.rdata 0x00003000 0x000005a5 0x00001000 2.233959569513802
.data 0x00004000 0x00000593 0x00001000 1.143936239781101
.rsrc 0x00005000 0x00002cc4 0x00003000 7.738172771624536

Resources

Name Offset Size Language Sub-language File type
RT_RCDATA 0x000050b4 0x00002800 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_VERSION 0x000078b4 0x00000410 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library KERNEL32.dll:
• 0x40301c ExitProcess
• 0x403020 ReadFile
• 0x403024 HeapAlloc
• 0x403028 GetProcessHeap
• 0x40302c GetFileSize
• 0x403030 CopyFileA
• 0x403034 GetModuleFileNameA
• 0x40303c GetProcAddress
• 0x403044 VirtualProtect
• 0x40304c GetModuleHandleA
• 0x403050 LockResource
• 0x403054 LoadResource
• 0x403058 SetFilePointer
• 0x40305c FindResourceA
• 0x403060 GetLastError
• 0x403064 MoveFileA
• 0x403068 DeleteFileA
• 0x40306c lstrcmpiA
• 0x403070 GetLongPathNameA
• 0x403078 GetTickCount
• 0x40307c OutputDebugStringA
• 0x403080 lstrlenA
• 0x403084 TerminateProcess
• 0x403088 VirtualAllocEx
• 0x40308c HeapFree
• 0x403090 VirtualAlloc
• 0x403094 Sleep
• 0x403098 lstrcpyA
• 0x40309c lstrcatA
• 0x4030a0 CreateFileA
• 0x4030a4 WriteFile
• 0x4030a8 CloseHandle
• 0x4030ac SizeofResource
• 0x4030b0 WinExec
Library USER32.dll:
• 0x4030c4 wsprintfA
• 0x4030c8 MessageBoxA
Library ADVAPI32.dll:
• 0x403000 CloseServiceHandle
• 0x403004 CryptGenRandom
• 0x403008 CryptReleaseContext
• 0x40300c EnumServicesStatusA
• 0x403010 OpenSCManagerA
Library SHLWAPI.dll:
• 0x4030b8 PathRemoveFileSpecA
• 0x4030bc StrChrA

Exports

Ordinal Address Name
1 0x404240 szFile
L!This program cannot be run in DOS mode.
.rdata
@.data
3fj@3Yu
tESPh
SVWj@3Y3j?fY3f^
EPEPhL@@
MSQEuPV
YYPV5X0@
ESPuW=0@
ESPuh$
ESPuh/
ESPuhl
;t$uuh
jfhL@@
_^3[UQQe
H<EHC@
X^UQQV5
WEWP}}
;t'EPEPEPh
3?;3j u
A(;r3_^[
~[|3n%en1:[|
w"-!p1}a%
([lLu]CF^8C9akZ(YAGY
9}bG+ZX_
KWJnV_B<Ja|K4lo!cOY3
qfg?.Fp
?R)/RX1
m[ BFR [
wwpFjL(l2qB'Q*hv~o
dNT3Yr?V"a1&
\q!C \csJ
['{6jvc6 T
r{s[T0@<$
<]Hf3j;
Rbf$)}wq<
7J=Z*ccP\IO`|
><J\"J[C
xKZ!fw9~Z3
|_^[]UE
gF o(o`mNb~
XT_Rx1/E
:Q<s7"
^*Y2$P
uB1V/+
;@T9rV
\TMLFhB3
rH,C:
F12eQZ%7,+v1
EE~cSVu
3fj@3Yj@fY3fj@3Yu
]f]@~)M
GEQ@9E|
3tESPPPPu
uRFGHt
t+t'NW8u
;uH_^Q=
r)$h%@
DDDDDDDDDDDDDD
WinExec
CloseHandle
WriteFile
CreateFileA
lstrcatA
lstrcpyA
SetFilePointer
ExitProcess
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CopyFileA
GetModuleFileNameA
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetLastError
MoveFileA
DeleteFileA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetTickCount
OutputDebugStringA
lstrlenA
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
KERNEL32.dll
wsprintfA
MessageBoxA
USER32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
StrChrA
PathRemoveFileSpecA
SHLWAPI.dll
roudanx.exe
szFile
8j4?a.bat
del "%s" /a
move "%s" "%s"
del %%0
rwbinru/dyd
RT_RCDATA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
kernel32
szFile
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
ZwUnmapViewOfSection
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinHttp
Are you sure?
regedit.exe /s
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
2b~)to
oct{+?8-
4Dr-&Miin,
lhO@JX
#H`Q|Sz8
)vu^N82
bsZZGqD
pl3#0D_k
=&`^T@.BT.\
#_%J7@~0DJ9
:xCS\+
i!qi+~ k
,C0RX`/@
Tx4Cf8T
Zm_PI?
&s(H,+_cz
i6xuZ%>L
x1;!o/um]ohf
IV IE;{
'?h<S]}Wf,HZ,dz
r,tPi[
IC^5{`
.4qa?}g] Neh\l-M]=
L\)ecz6AKV
I 8)dt
~|!;:xT
F\@zc,nV9KDP
Bs^\O 2R:
CI\bLuBv<b
/]1r!A7{:a!"ch
K0"v,]
Bt{Y<tu<
yn;avV
0sIJwG`[Hua
]z|?}O4Tz<A3^[
'~m#7m=M
.eIaCy<%oSpo$
;F3 {D
f,%M{?
20M/$>P
UTPGw1G
YBnyW(E?
PVO|r$^Vg
>UqwO/cu
.%^*<.y
5F$_sS^T}aNb<
+b wDv|3%
9P:F>spDcQ}g'"
D`>Z\mp'=R
UyCM%G
"3o|4X
}v[d(Y
(/N1Y+
sLh"=A3a
78+"<{
2[=k]a@,
(MH1"4
#HuAr('
h<2HT4
H]vjL5$e
,6}:k^M~ %b*%
f_bj[mU<
~\n!L+
fG 7oQY.W
T9C>YNZ
@,$~U@'|
5d>'hQ}
*M|"%_x
vJWwk]PV
?5*ncz!DAZ
`8 XNe[[b6
ljoI3'
.vs@uSz(M~Y5
G52Pge
~OWEpV
fA{L`M
+-$;N^
BJtKS;
NX!t6bm
T N)g>
^'*?L;,
BDt0S#
"mY]Z
[k6> mQr(_v*A6yx_M
Yy8]"g
U[e`Q
%qA:|X=
NPzO.h
dXa*2'
ql <td
GDD2wyvc(
*2qMgx
,RH<y{K}{o!IGQ4e:_T,Z/D>V
4>\ys]PDw5
%D%Bw.
dfR&1b
3ZdIBd6f
/fz^nIu2'l
'A8xH&WxdS
{'y~wSULR9k'D
?f[tYt7:@
sWR7;[
ghfLl_
Bu1U*N
CIz%!5ML/
U/O+rg.Y
t8 VTH]WG|u
wczvGXw
B3qF[<
2VyBAZf-
k*[JqH
qO&JP(a?LsTp,E
yQd&9X
t~43Vd(3.
7p'Px'%2(-)"
=Gx}Uu
t<KvK`V!^
'z`$oIL
!1:6f[i]b
I6+[<1*bHB9'G
a&g:(7z\wE
xmM32KIhN
\{rMTJ[
O5H;.V#"+O{=
SBw#:W?xVp$RQ
9Wwo3]
7r>k_So
?1[9p$fHf7
BG=&#oE:
e?6[IfRfe<
{!)X*%<
,o&fQ~
/L|HqyK<g
~~oZ[y
zEsA@q|a
/pal|'}B
!,Z2KjCo.bfR\{Y
*;D@[(]J
ZlXH_#
Tx[_<B6/
1pE1:`a
i~.EJ~
Jhx:EZg!}#f
^byHcL`
u+T'!r9S
*"feYlwkE<fn|X3
fZ&p_U
BN^J*.%Z+.
wVXbQQ
cw#{Ak
{pRv?j
8TWa`l$N~cNMITC=H
`MAek}
Q0[XG\t.:o(@
j'/gt(oEY
+ tV;
c\Md>k~{K
iNI~#-Qqm
G2q?p5
7ZMI>[yzrw
7rOmyr&
}cB} wg0F7
_xXt{J+m:b
:9vhO06%
XhCZs{:
/Ua&R)W?e
bfXrq!
T.XWszx:T
yzT$S
Y6CD0@z5
l'{!&-0Fv
?'P|57xJ
D\F!r~oU
9~VE1`\
Xe7/\+a;\)7
OHb<W/
o"PO>"
>:CmN"f
?&S3NjQVY0
xX9bd{(
kxg}Ev:D
.: K99
E+.ifM
UXomh+0
-8!?dG
4,27#*FYD
>I`<!k
422Y5W
/87C{[M
.bNi-~mfVCE!
g. lgn-K
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
RT_RCDATA
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Adobe Systems, Inc.
FileDescription
Adobe? Flash? Player Installer/Uninstaller 10.1 r53
FileVersion
10,1,53,64
InternalName
Adobe? Flash? Player Installer/Uninstaller 10.1
LegalCopyright
Copyright ? 1996-2010 Adobe, Inc.
LegalTrademarks
Adobe? Flash? Player
OriginalFilename
FlashUtil.exe
ProductName
Flash? Player Installer/Uninstaller
ProductVersion
10,1,53,64
VarFileInfo
Translation

Process Tree

0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e.exe, PID: 2108, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

regedit.exe, PID: 3052, Parent PID: 2108

default registry file network process services synchronisation iexplore office pdf

cmd.exe, PID: 324, Parent PID: 2108

default registry file network process services synchronisation iexplore office pdf

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 6f069546eaf32dcf_a.bat
Filepath C:\Users\Administrator\AppData\Local\Temp\a.bat
Size 1.0KB
Processes 2108 (0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e.exe) 324 (cmd.exe)
Type data
MD5 70cf76515cffc1d9dcb7b71beaba64a6
SHA1 c25c5962cb5e7388ce1689084948fc8f5cdb4024
SHA256 6f069546eaf32dcf9c121149189db3c41df3089ae4c0e367a4f03ba445d25a46
CRC32 CF93D3C7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7153e2062385c3e3_bdesvc.exe
Filepath c:\users\administrator\appdata\local\bdesvc.exe
Size 32.0KB
Processes 2108 (0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e.exe) 324 (cmd.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a6a7134162013edcc95846a31fc5a2f4
SHA1 a79de177572a4339e522b4f2f37625ea6306c475
SHA256 7153e2062385c3e32c179aecd25acb9720f6026760f1b142da70b1993e16b99d
CRC32 932CFA04
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0bc273453d43ad96_BDESVC.exe
Filepath C:\Users\Administrator\AppData\Local\BDESVC.exe
Size 32.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c11290048bc62d9bcbbaf7a2e22e5f4d
SHA1 6482d8357e7d787a029a1d49bab2f69d07beead8
SHA256 0bc273453d43ad96c3c5a7c84dd343f005929111970cee1d7ecc520e9740f33e
CRC32 1215E7D7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.