10.6
0-day
3 个模型检测该样本为恶意！
重新分析
更多

17056f98820484811e913284a7d4a82c12aeb97e16b8a61f3d6315180f6fe168

c4dbb7d1cd273441bfdd8b8989ac3b22.exe

分析耗时

104s

最近分析

文件大小

10.9MB
静态报毒 动态报毒 MALICIOUS
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba 20190527 0.3.0.5
CrowdStrike 20190702 1.0
Baidu 20190318 1.0.0.2
Avast 20200509 18.4.3895.0
Tencent 20200509 1.0.0.1
Kingsoft 20200509 2013.8.14.323
McAfee 20200509 6.0.6.653
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619916012.858751
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619916015.608999
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619916013.858751
WriteConsoleW
buffer: 错误: 没有找到进程 "fg773.exe"。
console_handle: 0x0000000b
success 1 0
This executable is signed
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619916011.139999
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (5 个事件)
section
section .exports
section .imports
section .themida
section .boot
One or more processes crashed (3 个事件)
Time & API Arguments Status Return Repeated
1619916009.608999
__exception__
stacktrace: 
?stopGoProxy@@YAXXZ+0xeed0f0 c4dbb7d1cd273441bfdd8b8989ac3b22+0xf2ee40 @ 0x132ee40
?stopGoProxy@@YAXXZ+0xefcf8e c4dbb7d1cd273441bfdd8b8989ac3b22+0xf3ecde @ 0x133ecde

registers.esp: 1638148
registers.edi: 16543744
registers.eax: 1638148
registers.ebp: 1638228
registers.edx: 2130566132
registers.ebx: 0
registers.esi: 2010805291
registers.ecx: 385286144
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008e
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1619916009.624999
__exception__
stacktrace: 

                
            
            
            

        
    
        
            
                registers.esp:
                1638268
                

            
                registers.edi:
                25964162
                

            
                registers.eax:
                1750617430
                

            
                registers.ebp:
                16543744
                

            
                registers.edx:
                2130532438
                

            
                registers.ebx:
                0
                

            
                registers.esi:
                13
                

            
                registers.ecx:
                20
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 2b ac 04 00 c3 e9 50 fd 03 00 1a 00 76 4c
                

            
                exception.symbol:
                ?stopGoProxy@@YAXXZ+0xeaa67d c4dbb7d1cd273441bfdd8b8989ac3b22+0xeec3cd
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                c4dbb7d1cd273441bfdd8b8989ac3b22.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                15647693
                

            
                exception.address:
                0x12ec3cd
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619916009.624999

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                1638268
                

            
                registers.edi:
                25964162
                

            
                registers.eax:
                1447909480
                

            
                registers.ebp:
                16543744
                

            
                registers.edx:
                22104
                

            
                registers.ebx:
                2256917605
                

            
                registers.esi:
                13
                

            
                registers.ecx:
                10
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 04 c6 ff ff d8 e2 00 00 92 0e 30 44 22 50
                

            
                exception.symbol:
                ?stopGoProxy@@YAXXZ+0xee47a5 c4dbb7d1cd273441bfdd8b8989ac3b22+0xf264f5
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                c4dbb7d1cd273441bfdd8b8989ac3b22.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                15885557
                

            
                exception.address:
                0x13264f5
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    








      

    


    

      

        行为判定
        
        
      

      

        



    

      
      动态指标
    

    

    
    

    

    

    

    

    

    

    
        
            

                Allocates read-write-execute memory (usually to unpack itself)
                
                    
                        (5 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619916009.608999

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    1880
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77dcf000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619916009.608999

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    1880
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77d40000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619916010.436999

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    1880
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x008d1000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619916010.436999

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    1880
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x007e4000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619916010.436999

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    1880
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x007e4000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Foreign language identified in PE resource
                
                    
                        (8 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    name
                                    RT_ICON
                                
                            
                                
                                    language
                                    LANG_CHINESE
                                
                            
                                
                                    offset
                                    0x00bc6350
                                
                            
                                
                                    filetype
                                    GLS_BINARY_LSB_FIRST
                                
                            
                                
                                    sublanguage
                                    SUBLANG_CHINESE_SIMPLIFIED
                                
                            
                                
                            
                                
                                    size
                                    0x00000468
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    name
                                    RT_ICON
                                
                            
                                
                                    language
                                    LANG_CHINESE
                                
                            
                                
                                    offset
                                    0x00bc6350
                                
                            
                                
                                    filetype
                                    GLS_BINARY_LSB_FIRST
                                
                            
                                
                                    sublanguage
                                    SUBLANG_CHINESE_SIMPLIFIED
                                
                            
                                
                            
                                
                                    size
                                    0x00000468
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    name
                                    RT_ICON
                                
                            
                                
                                    language
                                    LANG_CHINESE
                                
                            
                                
                                    offset
                                    0x00bc6350
                                
                            
                                
                                    filetype
                                    GLS_BINARY_LSB_FIRST
                                
                            
                                
                                    sublanguage
                                    SUBLANG_CHINESE_SIMPLIFIED
                                
                            
                                
                            
                                
                                    size
                                    0x00000468
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    name
                                    RT_ICON
                                
                            
                                
                                    language
                                    LANG_CHINESE
                                
                            
                                
                                    offset
                                    0x00bc6350
                                
                            
                                
                                    filetype
                                    GLS_BINARY_LSB_FIRST
                                
                            
                                
                                    sublanguage
                                    SUBLANG_CHINESE_SIMPLIFIED
                                
                            
                                
                            
                                
                                    size
                                    0x00000468
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    name
                                    RT_ICON
                                
                            
                                
                                    language
                                    LANG_CHINESE
                                
                            
                                
                                    offset
                                    0x00bc6350
                                
                            
                                
                                    filetype
                                    GLS_BINARY_LSB_FIRST
                                
                            
                                
                                    sublanguage
                                    SUBLANG_CHINESE_SIMPLIFIED
                                
                            
                                
                            
                                
                                    size
                                    0x00000468
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    name
                                    RT_ICON
                                
                            
                                
                                    language
                                    LANG_CHINESE
                                
                            
                                
                                    offset
                                    0x00bc6350
                                
                            
                                
                                    filetype
                                    GLS_BINARY_LSB_FIRST
                                
                            
                                
                                    sublanguage
                                    SUBLANG_CHINESE_SIMPLIFIED
                                
                            
                                
                            
                                
                                    size
                                    0x00000468
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    name
                                    RT_ICON
                                
                            
                                
                                    language
                                    LANG_CHINESE
                                
                            
                                
                                    offset
                                    0x00bc6350
                                
                            
                                
                                    filetype
                                    GLS_BINARY_LSB_FIRST
                                
                            
                                
                                    sublanguage
                                    SUBLANG_CHINESE_SIMPLIFIED
                                
                            
                                
                            
                                
                                    size
                                    0x00000468
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    name
                                    RT_GROUP_ICON
                                
                            
                                
                                    language
                                    LANG_CHINESE
                                
                            
                                
                                    offset
                                    0x00bc67c8
                                
                            
                                
                                    filetype
                                    data
                                
                            
                                
                                    sublanguage
                                    SUBLANG_CHINESE_SIMPLIFIED
                                
                            
                                
                            
                                
                                    size
                                    0x00000068
                                
                            
                        

                    
                
            

        

    

    
        
            

                Executes one or more WMI queries
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            wmi
                            SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                            
                        

                    
                
            

        

    

    
        
            

                A process created a hidden window
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619916012.264999

    ShellExecuteExW
    
        

        
            
        
    


    
        
            parameters:
            
                
                      /IM fg773.exe /F /T 
                
            
            
            

        
    
        
            filepath:
            
                
                    taskkill
                
            
            
            

        
    
        
            filepath_r:
            
                
                    taskkill
                
            
            
            

        
    
        
            show_type:
            
                
                    0
                
            
            
            

        
    


    
        success
    

1

    
        0
    


                        

                    
                
            

        

    

    
        
            

                File has been identified by 3 AntiVirus engines on VirusTotal as malicious
                
                    
                        (3 个事件)
                    
                
            

        

        

            

                
                    
                        

                            APEX
                            Malicious
                            
                        

                    
                
                    
                        

                            Ikarus
                            Trojan.Crypt
                            
                        

                    
                
                    
                        

                            Cybereason
                            malicious.ed1427
                            
                        

                    
                
            

        

    

    
        
            

                Checks adapter addresses which can be used to detect virtual network interfaces
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619916014.811999

    GetAdaptersAddresses
    
        

        
            
        
    


    
        
            flags:
            
                
                    1158
                
            
            
            

        
    
        
            family:
            
                
                    0
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                The binary likely contains encrypted or compressed data indicative of a packer
                
                    
                        (7 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    entropy
                                    7.988932051236859
                                
                            
                                
                                    section
                                    {'size_of_data': '0x001dcb83', 'virtual_address': '0x00001000', 'entropy': 7.988932051236859, 'name': '        ', 'virtual_size': '0x003e21f3'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.98477419514732
                                
                            
                                
                                    section
                                    {'size_of_data': '0x0005823c', 'virtual_address': '0x003e4000', 'entropy': 7.98477419514732, 'name': '        ', 'virtual_size': '0x000f2fb0'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.943164236601641
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00012240', 'virtual_address': '0x004d7000', 'entropy': 7.943164236601641, 'name': '        ', 'virtual_size': '0x00066ae8'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.9552344441917935
                                
                            
                                
                                    section
                                    {'size_of_data': '0x000094c3', 'virtual_address': '0x0053e000', 'entropy': 7.9552344441917935, 'name': '        ', 'virtual_size': '0x0002254c'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.937885604912499
                                
                            
                                
                                    section
                                    {'size_of_data': '0x0056052a', 'virtual_address': '0x00563000', 'entropy': 7.937885604912499, 'name': '        ', 'virtual_size': '0x00656410'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.958846889299518
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00324047', 'virtual_address': '0x010db000', 'entropy': 7.958846889299518, 'name': '.boot', 'virtual_size': '0x00324200'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    0.9961796538960986
                                
                            
                                
                            
                                
                                    description
                                    Overall entropy of this PE file is high
                                
                            
                        

                    
                
            

        

    

    
        
            

                Checks for the Locally Unique Identifier on the system for a suspicious privilege
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619916012.858751

    LookupPrivilegeValueW
    
        

        
            
        
    


    
        
            system_name:
            
                
                    
                
            
            
            

        
    
        
            privilege_name:
            
                
                    SeDebugPrivilege
                
            
            
            

        
    


    
        success
    

1

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Uses Windows utilities for basic Windows functionality
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            cmdline
                            taskkill   /IM fg773.exe /F /T 
                            
                        

                    
                
                    
                        

                            cmdline
                            "C:\Windows\System32\taskkill.exe"   /IM fg773.exe /F /T 
                            
                        

                    
                
            

        

    

    

    

    

    

    

    

    

    







        



    

      
      网络通信
    

    


    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    
        
            

                Communicates with host for which no DNS query was performed
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    host
                                    172.217.24.14
                                
                            
                                
                            
                        

                    
                
            

        

    

    
        
            

                Checks the version of Bios, possibly for anti-virtualization
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
                            
                        

                    
                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
                            
                        

                    
                
            

        

    

    
        
            

                Resumed a suspended thread in a remote process potentially indicative of process injection
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            Process injection
                            Process 1880 resumed a thread in remote process 1208
                            
                        

                    
                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619916012.264999

    NtResumeThread
    
        

        
            
        
    


    
        
            thread_handle:
            
                
                    0x0000021c
                
            
            
            

        
    
        
            suspend_count:
            
                
                    1
                
            
            
            

        
    
        
            process_identifier:
            
                
                    1208
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Detects VirtualBox through the presence of a registry key
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            
                        

                    
                
            

        

    

    
        
            

                Detects Virtual Machines through their custom firmware
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619916009.624999

    NtQuerySystemInformation
    
        

        
            
        
    


    
        
            information_class:
            
                
                    76
                
            
            
                (SystemFirmwareTableInformation)
            
            

        
    


    
        failed
    

3221225507

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Detects VMWare through the in instruction feature
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619916009.624999

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                1638268
                

            
                registers.edi:
                25964162
                

            
                registers.eax:
                1447909480
                

            
                registers.ebp:
                16543744
                

            
                registers.edx:
                22104
                

            
                registers.ebx:
                2256917605
                

            
                registers.esi:
                13
                

            
                registers.ecx:
                10
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 04 c6 ff ff d8 e2 00 00 92 0e 30 44 22 50
                

            
                exception.symbol:
                ?stopGoProxy@@YAXXZ+0xee47a5 c4dbb7d1cd273441bfdd8b8989ac3b22+0xf264f5
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                c4dbb7d1cd273441bfdd8b8989ac3b22.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                15885557
                

            
                exception.address:
                0x13264f5
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Detects the presence of Wine emulator
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619916015.593999

    LdrGetProcedureAddress
    
        

        
            
        
    


    
        
            ordinal:
            
                
                    0
                
            
            
            

        
    
        
            module:
            
                
                    ntdll
                
            
            
            

        
    
        
            module_address:
            
                
                    0x77d30000
                
            
            
            

        
    
        
            function_address:
            
                
                    0x007e809c
                
            
            
            

        
    
        
            function_name:
            
                
                    wine_get_version
                
            
            
            

        
    


    
        failed
    

3221225785

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running  usually)
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            dead_host
                            172.217.24.14:443
                            
                        

                    
                
                    
                        

                            dead_host
                            172.217.160.110:443
                            
                        

                    
                
            

        

    






      


    


    

      

        可视化分析
        
        
      

      

        


    

      
      二进制图像
    

    
        

            

                
                

                    暂无二进制图像
                    该样本未生成二进制可视化图像
                

            

        

    





        

    

      
      运行截图
    

    
        

            

                
                

                    暂无运行截图
                    该样本运行过程中未生成截图
                

            

        

    





      


    


  



    

    

        





    

        

            
👋 欢迎使用 ChatHawk

            
我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

            

                
🔍 主要威胁分析

                
⚡ 行为特征

                
🛡️ 防护建议

                
🔧 技术手段

                
🎯 检测方法

            

        

    

    

        

            
🤖

            

                

                

                

            

        

    

    

        
        
    








    

    

        

    
    

        

            
                

    
        
            

                
 PE Compile Time

                
2020-02-13 09:12:22

            

            

        
        
        
        
        
        
        

        

        
            

                
Imports

                

                    
                        

                            
Library kernel32.dll:

                            
                                
• 0xfbb4dc GetModuleHandleA

                            
                        

                    
                        

                            
Library WS2_32.dll:

                            
                                
• 0xfbb4e4 WSAEventSelect

                            
                        

                    
                        

                            
Library ADVAPI32.dll:

                            
                                
• 0xfbb4ec RegEnumKeyExA

                            
                        

                    
                        

                            
Library USER32.dll:

                            
                                
• 0xfbb4f4 InsertMenuItemW

                            
                        

                    
                        

                            
Library GDI32.dll:

                            
                                
• 0xfbb4fc GetClipBox

                            
                        

                    
                        

                            
Library MSIMG32.dll:

                            
                                
• 0xfbb504 TransparentBlt

                            
                        

                    
                        

                            
Library WINSPOOL.DRV:

                            
                                
• 0xfbb50c DocumentPropertiesW

                            
                        

                    
                        

                            
Library SHELL32.dll:

                            
                                
• 0xfbb514 DragFinish

                            
                        

                    
                        

                            
Library COMCTL32.dll:

                            
                                
                            
                        

                    
                        

                            
Library SHLWAPI.dll:

                            
                                
• 0xfbb524 PathStripToRootW

                            
                        

                    
                        

                            
Library UxTheme.dll:

                            
                                
• 0xfbb52c OpenThemeData

                            
                        

                    
                        

                            
Library ole32.dll:

                            
                                
                            
                        

                    
                        

                            
Library OLEAUT32.dll:

                            
                                
• 0xfbb53c VarDecFromStr

                            
                        

                    
                        

                            
Library oledlg.dll:

                            
                                
• 0xfbb544 OleUIBusyW

                            
                        

                    
                        

                            
Library WSOCK32.dll:

                            
                                
• 0xfbb54c getsockname

                            
                        

                    
                        

                            
Library gdiplus.dll:

                            
                                
• 0xfbb554 GdipDeleteBrush

                            
                        

                    
                        

                            
Library VERSION.dll:

                            
                                
• 0xfbb55c GetFileVersionInfoW

                            
                        

                    
                        

                            
Library RASAPI32.dll:

                            
                                
• 0xfbb564 RasEnumConnectionsA

                            
                        

                    
                        

                            
Library SETUPAPI.dll:

                            
                                
                            
                        

                    
                        

                            
Library RPCRT4.dll:

                            
                                
• 0xfbb574 UuidCreate

                            
                        

                    
                

            

            

        

        
            

                
Exports

                

                    

                        

                            Ordinal
                            Address
                            Name
                        

                        
                            

                                1
                                0x441be0
                                ?StartGoProxy@@YA_NPBD@Z
                            

                        
                            

                                2
                                0x441d50
                                ?stopGoProxy@@YAXXZ
                            

                        
                    

                

            

        
    



            
        

        

            

    

        
    



        

    



    

    
    

        

    
    

        

    
Hosts

    
        
No hosts contacted.

    




        
        





    
TCP

    
        
No TCP connections recorded.

    





        





    
UDP

    
        

            

                

                    

                        Source
                        Source Port
                        Destination
                        Destination Port
                    

                    
                        

                            192.168.56.101
                            49235
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            50568
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            53380
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            53657
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            55368
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            56539
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            60123
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            137
                            192.168.56.255 
                            137
                        

                    
                        

                            192.168.56.101
                            138
                            192.168.56.255 
                            138
                        

                    
                        

                            192.168.56.101
                            123
                            20.189.79.72 time.windows.com
                            123
                        

                    
                        

                            192.168.56.101
                            50002
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            50534
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            51808
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            51963
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            56804
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            57756
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            57874
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            60384
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            62191
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            62912
                            224.0.0.252 
                            5355
                        

                    
                

            

            

        

    




        



HTTP & HTTPS Requests



No HTTP requests performed.




        
ICMP traffic



No ICMP traffic performed.



        
IRC traffic



No IRC requests performed.



        
Suricata Alerts


    
No Suricata Alerts




Suricata TLS


    
No Suricata TLS




        
Snort Alerts


    
No Snort Alerts




    




    

    

        
    
Sorry! No dropped files.



    

    

        
    
Sorry! No dropped buffers.