SmartHawk

5.2

中危

52 个模型检测该样本为恶意！

重新分析

下载样本

01dc41b35298ebb01d00083efa17adad8e1c7c4ab40f77f6d943f7031359ccb6

c3f6787b6acfd2dd87499ed12ddc8d17.exe

分析耗时

109s

最近分析

文件大小

522.0KB

静态报毒动态报毒 AI SCORE=86 ATTRIBUTE CONFIDENCE DOWNLOADER34 ELDORADO FAREIT FORMBOOK GENERICKD GM0@A0WUABI HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE HRDCBH KRYPTIK MALICIOUS PE MALWARE@#EWGUMZOKJKLJ MASSLOGGER MQWYK PWSX R002C0DH620 SCORE TAEW UNSAFE YAKBEEXMSIL ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Alibaba	Trojan:MSIL/Formbook.fe4f968a	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20200927	18.4.3895.0
Kingsoft		20200927	2013.8.14.323
McAfee	Fareit-FXO!C3F6787B6ACF	20200926	6.0.6.653
Tencent	Msil.Trojan.Agent.Taew	20200927	1.0.0.1

Checks if process is being debugged by a debugger (50 out of 176 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861648.093625 IsDebuggerPresent		failed	0	0
1619861649.406625 IsDebuggerPresent		failed	0	0
1619861649.906625 IsDebuggerPresent		failed	0	0
1619861650.406625 IsDebuggerPresent		failed	0	0
1619861650.906625 IsDebuggerPresent		failed	0	0
1619861651.406625 IsDebuggerPresent		failed	0	0
1619861651.906625 IsDebuggerPresent		failed	0	0
1619861652.406625 IsDebuggerPresent		failed	0	0
1619861652.906625 IsDebuggerPresent		failed	0	0
1619861653.406625 IsDebuggerPresent		failed	0	0
1619861653.906625 IsDebuggerPresent		failed	0	0
1619861654.406625 IsDebuggerPresent		failed	0	0
1619861654.906625 IsDebuggerPresent		failed	0	0
1619861655.406625 IsDebuggerPresent		failed	0	0
1619861655.906625 IsDebuggerPresent		failed	0	0
1619861656.406625 IsDebuggerPresent		failed	0	0
1619861656.906625 IsDebuggerPresent		failed	0	0
1619861657.406625 IsDebuggerPresent		failed	0	0
1619861657.906625 IsDebuggerPresent		failed	0	0
1619861658.406625 IsDebuggerPresent		failed	0	0
1619861658.906625 IsDebuggerPresent		failed	0	0
1619861659.406625 IsDebuggerPresent		failed	0	0
1619861659.906625 IsDebuggerPresent		failed	0	0
1619861660.406625 IsDebuggerPresent		failed	0	0
1619861660.906625 IsDebuggerPresent		failed	0	0
1619861661.406625 IsDebuggerPresent		failed	0	0
1619861661.906625 IsDebuggerPresent		failed	0	0
1619861662.406625 IsDebuggerPresent		failed	0	0
1619861662.906625 IsDebuggerPresent		failed	0	0
1619861663.406625 IsDebuggerPresent		failed	0	0
1619861663.906625 IsDebuggerPresent		failed	0	0
1619861664.406625 IsDebuggerPresent		failed	0	0
1619861664.906625 IsDebuggerPresent		failed	0	0
1619861665.406625 IsDebuggerPresent		failed	0	0
1619861665.906625 IsDebuggerPresent		failed	0	0
1619861666.406625 IsDebuggerPresent		failed	0	0
1619861666.906625 IsDebuggerPresent		failed	0	0
1619861667.406625 IsDebuggerPresent		failed	0	0
1619861667.906625 IsDebuggerPresent		failed	0	0
1619861668.406625 IsDebuggerPresent		failed	0	0
1619861668.906625 IsDebuggerPresent		failed	0	0
1619861669.406625 IsDebuggerPresent		failed	0	0
1619861669.906625 IsDebuggerPresent		failed	0	0
1619861670.406625 IsDebuggerPresent		failed	0	0
1619861670.906625 IsDebuggerPresent		failed	0	0
1619861671.406625 IsDebuggerPresent		failed	0	0
1619861671.906625 IsDebuggerPresent		failed	0	0
1619861672.406625 IsDebuggerPresent		failed	0	0
1619861672.906625 IsDebuggerPresent		failed	0	0
1619861673.406625 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861693.406625 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 77 个事件)

Time & API	Arguments	Status	Return
1619861647.218625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00970000	success	0
1619861647.218625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a90000	success	0
1619861648.046625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success	0
1619861648.093625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002fa000	success	0
1619861648.093625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success	0
1619861648.093625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002f2000	success	0
1619861648.453625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00302000	success	0
1619861648.515625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00303000	success	0
1619861648.531625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0033b000	success	0
1619861648.531625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00337000	success	0
1619861648.562625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0030c000	success	0
1619861648.640625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00670000	success	0
1619861648.937625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0030a000	success	0
1619861649.015625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0032a000	success	0
1619861649.093625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00322000	success	0
1619861649.140625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00304000	success	0
1619861649.156625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00335000	success	0
1619861649.500625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00671000	success	0
1619861650.796625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0031a000	success	0
1619861650.796625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00317000	success	0
1619861651.015625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00305000	success	0
1619861692.062625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00672000	success	0
1619861692.171625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002fb000	success	0
1619861692.500625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0032c000	success	0
1619861692.500625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00673000	success	0
1619861692.578625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00316000	success	0
1619861692.593625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00306000	success	0
1619861692.609625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00674000	success	0
1619861692.765625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 138752 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f70400	failed	3221225550
1619861694.046625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00675000	success	0
1619861694.046625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00676000	success	0
1619861694.062625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00307000	success	0
1619861694.062625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00677000	success	0
1619861694.062625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00678000	success	0
1619861694.093625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00679000	success	0
1619861694.171625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0067a000	success	0
1619861694.218625 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0067b000	success	0
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f70178	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f701a0	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f701c8	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f701f0	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f70218	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f92aee	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f92ae2	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f92200	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f92afc	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f92b20	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f92b28	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f92b2c	failed	3221225550
1619861694.234625 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04f92b34	failed	3221225550

A process attempted to delay the analysis task. (1 个事件)

description

c3f6787b6acfd2dd87499ed12ddc8d17.exe tried to sleep 213 seconds, actually delayed analysis time by 213 seconds

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.777612406702311

section

{'size_of_data': '0x00044600', 'virtual_address': '0x00002000', 'entropy': 7.777612406702311, 'name': '.text', 'virtual_size': '0x00044584'}

description

A section with a high entropy has been found

entropy

0.5244487056567594

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861648.968625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	203.208.41.33
host	203.208.41.98

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43599670
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Trojan.GenericKD.43599670
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Trojan:MSIL/Formbook.fe4f968a
K7GW	Trojan ( 0056bf781 )
K7AntiVirus	Trojan ( 0056bf781 )
Invincea	Mal/Generic-S
Cyren	W32/MSIL_Kryptik.BHQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
BitDefender	Trojan.GenericKD.43599670
NANO-Antivirus	Trojan.Win32.Kryptik.hrdcbh
Avast	Win32:PWSX-gen [Trj]
Ad-Aware	Trojan.GenericKD.43599670
Sophos	Mal/Generic-S
Comodo	Malware@#ewgumzokjklj
F-Secure	Trojan.TR/Kryptik.mqwyk
DrWeb	Trojan.DownLoader34.24820
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DH620
McAfee-GW-Edition	BehavesLike.Win32.Generic.hh
FireEye	Generic.mg.c3f6787b6acfd2dd
Emsisoft	Trojan.GenericKD.43599670 (B)
SentinelOne	DFI - Malicious PE
GData	Trojan.GenericKD.43599670
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.mqwyk
MAX	malware (ai score=86)
Antiy-AVL	Trojan/MSIL.Kryptik
Arcabit	Trojan.Generic.D2994736
ZoneAlarm	HEUR:Trojan.MSIL.Agent.gen
Microsoft	Trojan:MSIL/Formbook.VN!MTB
Cynet	Malicious (score: 85)
McAfee	Fareit-FXO!C3F6787B6ACF
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of MSIL/Kryptik.XFP
TrendMicro-HouseCall	TROJ_GEN.R002C0DH620
Tencent	Msil.Trojan.Agent.Taew
Ikarus	Trojan-Spy.MassLogger
Fortinet	MSIL/Agent.BMW!tr
BitDefenderTheta	Gen:NN.ZemsilF.34254.Gm0@a0wuabi
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.b7526f

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-05 14:37:49

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60221	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.