1.0
低危
59 个模型检测该样本为恶意！
重新分析
更多

22b4fd3c3ec1130beaffd131a3c9cc752a78981d205e1aab19bccc88ffc12359

22b4fd3c3ec1130beaffd131a3c9cc752a78981d205e1aab19bccc88ffc12359.exe

分析耗时

195s

最近分析

358天前

文件大小

58.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER UPATRE
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.69
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Crypt-SHM [Trj] 20190906 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20190906 2013.8.14.323
McAfee GenericRXBB-SG!C3A35112AB89 20190906 6.0.6.653
Tencent Trojan.Win32.Waski.na 20190906 1.0.0.1
静态指标
此可执行文件具有 PDB 路径 (1 个事件)
pdb_path mokolona.pdb
行为判定
动态指标
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意 (50 out of 59 个事件)
ALYac Trojan.GenericKD.2494724
APEX Malicious
AVG Win32:Crypt-SHM [Trj]
Acronis suspicious
Ad-Aware Trojan.GenericKD.2494724
AhnLab-V3 Trojan/Win32.Upatre.R153600
Antiy-AVL Trojan/Win32.SGeneric
Arcabit Trojan.Generic.D261104
Avast Win32:Crypt-SHM [Trj]
Avira TR/AD.Yarwi.toijn
BitDefender Trojan.GenericKD.2494724
CAT-QuickHeal TjnDownldr.Upatre.S1439
ClamAV Win.Trojan.Agent-1300677
Comodo TrojWare.Win32.TrojanDownloader.Waski.NA@6jnofw
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.2ab89b
Cylance Unsafe
Cyren W32/Matsnu.F.gen!Eldorado
DrWeb Trojan.Upatre.3514
ESET-NOD32 Win32/TrojanDownloader.Waski.N
Emsisoft Trojan.GenericKD.2494724 (B)
Endgame malicious (high confidence)
F-Prot W32/Matsnu.F.gen!Eldorado
F-Secure Trojan.TR/AD.Yarwi.toijn
FireEye Generic.mg.c3a35112ab89b6cc
Fortinet W32/Kryptik.DZVG!tr
GData Trojan.GenericKD.2494724
Ikarus Trojan-Downloader.Win32.Waski
Invincea heuristic
Jiangmin Trojan/Agent.ikis
K7AntiVirus Trojan-Downloader ( 004c603d1 )
K7GW Trojan-Downloader ( 004c603d1 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=81)
Malwarebytes Trojan.MalPack.VAK
McAfee GenericRXBB-SG!C3A35112AB89
McAfee-GW-Edition BehavesLike.Win32.Generic.qm
MicroWorld-eScan Trojan.GenericKD.2494724
Microsoft TrojanDownloader:Win32/Upatre
NANO-Antivirus Trojan.Win32.Upatre.dsvtif
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM20.1.B2C7.Malware.Gen
Rising Trojan.Waski!1.A489 (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Upatre
SentinelOne DFI - Malicious PE
Sophos Troj/Upatre-OE
Symantec Downloader.Upatre
Tencent Trojan.Win32.Waski.na
Trapmine malicious.moderate.ml.score
TrendMicro BKDR_MATSNU.SM0
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-05-18 21:24:52

PDB Path

mokolona.pdb

PE Imphash

31521e1ad7ed29926e8a18c6d7bf206f

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00004c17 0x00005000 5.773516300293078
.rdata 0x00006000 0x000031f1 0x00001000 3.2401743972342643
.data 0x0000a000 0x000004a0 0x00001000 1.3390480739466308
.rsrc 0x0000b000 0x000057ca 0x00006000 5.717391424461682

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0000d7de 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0000d7de 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_DIALOG 0x0001024a 0x00000580 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_RCDATA 0x0000f74a 0x00000580 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_RCDATA 0x0000f74a 0x00000580 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_RCDATA 0x0000f74a 0x00000580 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x0000b210 0x00000026 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_VERSION 0x0000fcca 0x00000580 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library esent.dll:
• 0x406000 JetCloseFile
• 0x406004 JetCloseDatabase
• 0x406008 JetCloseTable
Library uxtheme.dll:
• 0x406014 GetCurrentThemeName
• 0x406018 GetThemeFont
• 0x40601c CloseThemeData
• 0x406020 DrawThemeBackground
• 0x406024 GetThemeInt
• 0x406028 DrawThemeEdge
• 0x40602c GetThemeSysBool
• 0x406030 GetThemeTextMetrics
• 0x406034 GetThemeTextExtent
• 0x406038 SetWindowTheme
Library wtsapi32.dll:
• 0x406044 WTSFreeMemory
• 0x40604c WTSQueryUserToken
• 0x406050 WTSSendMessageA
• 0x406058 WTSWaitSystemEvent
• 0x406070 WTSCloseServer
• 0x406078 WTSLogoffSession
Library shimeng.dll:
• 0x406088 SE_DllLoaded
• 0x40608c SE_IsShimDll
• 0x406090 SE_ProcessDying
Library user32.dll:
• 0x406098 DefDlgProcA
• 0x40609c SetFocus
• 0x4060a0 CharToOemW
• 0x4060a4 DialogBoxParamW
• 0x4060a8 PostMessageA
• 0x4060ac CreateDialogParamA
• 0x4060b0 GetMessageW
• 0x4060b4 ChangeMenuW
• 0x4060b8 DrawEdge
• 0x4060bc IsDialogMessageW
• 0x4060c0 InsertMenuW
• 0x4060c4 DrawTextExA
• 0x4060c8 DrawStateA
• 0x4060cc GetCursorPos
• 0x4060d0 LoadBitmapA
• 0x4060d4 LoadCursorA
Library kernel32.dll:
• 0x4060dc CreateMutexA
• 0x4060e0 FormatMessageA
• 0x4060e4 GetACP
• 0x4060e8 SearchPathW
• 0x4060f0 GetLocaleInfoW
• 0x4060f4 ReadConsoleA
• 0x4060f8 GetLocalTime
• 0x4060fc Sleep
• 0x406100 GetOEMCP
• 0x406108 CreateFileMappingA
• 0x40610c GetProcAddress
• 0x406110 GetLongPathNameA
• 0x406118 GetModuleHandleA
• 0x40611c CompareStringW
• 0x406124 OpenEventA
• 0x406128 GetFileSize
• 0x40612c GetProfileIntW
• 0x406130 CreateEventA
L!This program cannot be run in DOS mode.
T:ZT:ZT:Z]ZU:Z]ZW:ZT;ZQ:ZsWWZU:ZsWTZP:ZYZ]:ZYZU:ZRichT:Z
`.rdata
@.data
esent.dll
uxtheme.dll
wtsapi32.dll
shimeng.dll
user32.dll
kernel32.dll
TXUH-X@
Mt)*-e@
a1)=h@
JetCloseTable
JetCloseDatabase
JetCloseFile
JetCommitTransaction
esent.dll
GetThemeInt
DrawThemeBackground
GetThemeTextMetrics
CloseThemeData
GetThemeTextExtent
GetThemeSysBool
GetThemeFont
DrawThemeEdge
SetWindowTheme
GetCurrentThemeName
uxtheme.dll
WTSCloseServer
WTSFreeMemory
WTSVirtualChannelOpen
WTSUnRegisterSessionNotification
WTSVirtualChannelClose
WTSQueryUserToken
WTSSendMessageA
WTSWaitSystemEvent
WTSVirtualChannelRead
WTSVirtualChannelPurgeInput
WTSSetSessionInformationA
WTSEnumerateServersA
WTSQuerySessionInformationA
WTSLogoffSession
WTSEnumerateSessionsA
WTSVirtualChannelWrite
wtsapi32.dll
SE_IsShimDll
SE_DllLoaded
SE_ProcessDying
SE_InstallBeforeInit
shimeng.dll
CreateDialogParamA
GetCursorPos
InsertMenuW
LoadCursorA
DrawEdge
LoadBitmapA
ChangeMenuW
DialogBoxParamW
DrawTextExA
CharToOemW
IsDialogMessageW
DefDlgProcA
DrawStateA
SetFocus
PostMessageA
GetMessageW
user32.dll
SearchPathW
GetLocalTime
GetACP
GetProcAddress
FormatMessageA
CreateWaitableTimerW
GetOEMCP
CreateEventA
GetModuleHandleA
OpenEventA
CompareStringW
GetCurrentDirectoryW
GetLocaleInfoW
CreateMutexA
WaitForSingleObjectEx
GetLogicalDriveStringsA
GetFileSize
CreateFileMappingA
ReadConsoleA
GetProfileIntW
GetLongPathNameA
kernel32.dll
mokolona.pdb
k&rtualAllocEx
bsxml6.dll
koadLibraryA
lernel32.DLL
kriteProcessMemory
hdqgtummidfemntd
ynpinxdovqipl
ellighixoqdjz
)!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2!2
.!0!0!0!0!0!0!0!0 1!0!0!0!0 1 1 1!2!0!0 1!0!0!0!0!0!0!0!0!0!0
0"4"4"4"4"4"4"4"4"4"4"4"4nx"4"4"4"4"4"4"4"4"4"4"4"40
0#6#6#6#6#6#6#6#6"4"4#2#6sz#6#6#6#6#6#6#6#6#6#6#6#60
0*;*;*;*;*;*;*;*;*;*;t}*;*;#2#2'9*;*;*;*;*;*;*;!0
#5/=/=/=/=/=/=/=/=LU/=/=.?/=/=/=/=/=/=/=/=/=#5
*;5F5F5F5F5F5F5F5F5Ffr5F5Fx
5F5F5F5F5F5F5F5F5F5F5F5F*;
1B:J:J:J:J:J:J:J:Jgu:Jgu:J:J1B1B:J:J:J:J:J:J:J:J1B
:J?L?L?L?L?L?L?L?L?L~?L?L?L?L?L?L?L?L?L:J
?LFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFR?L
HWJWFRFRFRJWJWJWJWJWJWJWJWJWJWJWJWJWJWJWJWJWFRFRFRFRFRFRJWJWJWHW
HWHWororororororororororororororororororororororororororororHWO]
VWWWWWWWWWV
0!1:H0?[g?M4C$4$4?MV%6
*;->yp|3C*;BQ)5E
:I=L}HV:IO\4
MYQ[iru}yowx
jrens|4
dl!ll!c4
[=!r1WF
[=!r1WF
[=!r1WF
rI(WOBEs
# kO9:{mr
!/6"te
x$p~634/wVs
ntUrjI
!CD%dU
vSOAwo
$~`46zh_
9mn(72
O-gl_2
-GnAYrKcGqV4
>N(XVt
J\ya<$6
W>=,ey
l]3[c}
dg682T
q]/E4f1j/p
b,rADfF
_K_y(@!]
W"db;Wfx3
jlEfbQ
_&$^Q7J
xqt%X!.ZgKB
/ol+0&bk
'DY'#gq2&
v;X1TJ/
9sX?5/@r
I+l_-[(
E+M`2
aPo)s2K*
*zBA\B~U
rE?dPR
a<8_?2*
VfG|3
.3Ust0p
UF|ra|_;
qZ"ozx
|p|W%M%
;KPFoL
Zt_6OoAcY<SHpZOP/
bDKf8~3vv+Z
@(>3v~
9_F_+_
o%CA_R
RQE0$gV
7K_rp+HINnx
<3'Pd1YB"
V%dVS]
?8jZA=
%8$x?n#bBAnU
LVU[Ew\B28])l
B|Zqv5NH,&RH1$
!{;w:=|z
=0c~3g
FRuL}&
yia@yj#G
;8LAi!
E_EuQI_rO
"GNMTk;_G
*=MLF DGZ
5Q?KNb
`nr7be]}%+h
)6)o1l ~
KM*Ixv
#&8Mpg
:T7$$e
1)7!:eLy1<u
u4MG!+_9M[|&
q(A!eYF
jH8?bcwC
@R}rYRy^R
N<<nj3
`X9q)8
'SsF"EE\C
PJ/(^TD
yW8qW;aD8
Bbs n-GP
H`B3Z^!fqE:
Nm")!j
L,5 F+!b=eC
6jL<uc+
<1Vrse
B$._{%4?Y
y&@z}
yF z}
HDybu*
z$_xZG
wS>(|V
DWUb1H
.-A7A4W
AoaY9A
o( "2#R/e"V/0R
!P1 "T6k
/C2#6R-
S|/EbS@U
tvpJ/M$\>
@kR<Etg&5lt
np4>y){Y
G3")sRMD
UMxY{#*
76_%Q 2S"x#>
R"x,yF
("x:3LS-A7w
S5fI"~S*vG2Ns:FGB^sJVF2
"X>2g:
20x,J8,3
RSyrnN7>
R#H1~jVP
nUkc[#
?31;gKXrNi>$
56DSW&
W0{%JK{
rQqOe7PM'B R)to4~
%:{Q(TA
yG7iw@dSQTc/Ou@Ve^!
<UBxgc~
Zk0p ?Vd
@"#QuV5J
]PV(_{
x R R R R R R R 
tAt2t$
FGIuX^_]
8csmu*x
YYuTVWh
;r=4K1
tAt2t$
FGIuX^_]
8csmu*x
YYuTVWh
;r=4K1
tAt2t$
FGIuX^_]
8csmu*x
YYuTVWh
;r=4K1
llllllllll
C:\DOCUME~1\Online\LOCALS~1\Temp\8.exe
C:\H13U72Rc.exe
C:\zlGYZLXn.exe
C:\XrAFDGvI.exe
C:\tXB2WFMg.exe
C:\4lTCdvTp.exe
C:\ih2taJb6.exe
C:\0k86Rkad.exe
C:\oNOYhLPA.exe
C:\ax05gk_D.exe
C:\7SCC9Zbf.exe
C:\5deba5adf279d34745c09e5c109d46da9c051fc337373be6aa4a57b0806f21f6
C:\169af6205047a1f8fd6073ae090a77d744bff500e1856df92331147259244e86
C:\9av643zc.exe
C:\05van0if.exe
C:\dONefmrm.exe
C:\kNWd3NzW.exe
C:\veE4KqWV.exe
C:\alvDKVld.exe
C:\mBfgX164.exe
C:\8JlamDdB.exe
C:\I_deMOQE.exe
C:\z9H8bVUx.exe
C:\yhpqqzQL.exe
C:\h2blWsru.exe
C:\Users\Petra\AppData\Local\Temp\file.pe32
C:\NAnR2C7F.exe
C:\4f7202641aa121af06b1d15bb3ad9ed67f93f6b60ee7c2c5fe681b39e40e072c
c:\task\20C828C549F7C9FB03ACFFB163C00831.exe
c:\task\26BF158A88921842D894B3EE6614ABBB.exe
c:\task\366E38646D344C44AA5736E59BCEFB70.exe
c:\task\14CBEEA2E0CB357F6AF3A0C8C2DCFEE1.exe
C:\Users\admin\Downloads\factura.exe
C:\810d415c7824d191eddf5da599b6dd7c69e19ce4aa686dd6a2a201aab98a47aa
C:\l5DVAmLS.exe
C:\94YTpAF9.exe
C:\MrrbyGmV.exe
C:\OZr9CJHi.exe

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.