SmartHawk

3.4

中危

64 个模型检测该样本为恶意！

重新分析

下载样本

15c069fcb2407bfeb791823dfb849f30df28ec00c8b4e2b27bcde99007cb618c

c5318c7f77cb24f43386cce85b05b536.exe

分析耗时

34s

最近分析

文件大小

404.7KB

静态报毒动态报毒 100% AGEN AGENTB AI SCORE=88 AIDETECTVM BACKDR BPML CHANGELING CLOUD CONFIDENCE DGPYEO DOWNLOADER23 ELDORADO GENCIRC GENERICRXAA GENETIC HIGH CONFIDENCE MALICIOUS PE MALWARE1 MAUVAISERI NOTESTUK PASSWORDSTEALER QUK@74Q1CT R002C0DGK20 R331564 S5243803 SCORE STONEDRILL TPGR TSGENERIC TURNEDUP UNSAFE ZEXAF ZUSY ZUX@AE@GSJPI 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXAA-AA!C5318C7F77CB	20200730	6.0.6.653
Alibaba	Trojan:Win32/StoneDrill.0054e6d9	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:GenMalicious-BHT [Trj]	20200730	18.4.3895.0
Kingsoft		20200730	2013.8.14.323
Tencent	Malware.Win32.Gencirc.10b3dd78	20200730	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

This executable has a PDB path (1 个事件)

pdb_path

C:\Users\xman_1365_x\Desktop\homeWork\13930308\Bot_70_FIX HEADER_FIX_LONGURL 73_StableAndNewProtocol - login all\Release\Bot.pdb

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

INF

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619912719.695375 __exception__	stacktrace: c5318c7f77cb24f43386cce85b05b536+0x57b6 @ 0x2257b6 c5318c7f77cb24f43386cce85b05b536+0x20657 @ 0x240657 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 4452408 registers.edi: 0 registers.eax: 2310794108 registers.ebp: 4452720 registers.edx: 33096056 registers.ebx: 2130567168 registers.esi: 19 registers.ecx: 2314738188 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619912719.695375
__exception__

stacktrace:

c5318c7f77cb24f43386cce85b05b536+0x57b6 @ 0x2257b6
c5318c7f77cb24f43386cce85b05b536+0x20657 @ 0x240657
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 4452408
registers.edi: 0
registers.eax: 2310794108
registers.ebp: 4452720
registers.edx: 33096056
registers.ebx: 2130567168
registers.esi: 19
registers.ecx: 2314738188
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0

success

Communicates with host for which no DNS query was performed (2 个事件)

host	113.108.239.196
host	172.217.24.14

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.160.110:443

File has been identified by 64 AntiVirus engines on VirusTotal as malicious (50 out of 64 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ser.Zusy.2414
FireEye	Generic.mg.c5318c7f77cb24f4
CAT-QuickHeal	Trojan.MauvaiseRI.S5243803
McAfee	GenericRXAA-AA!C5318C7F77CB
Cylance	Unsafe
Zillya	Trojan.Inject.Win32.81036
SUPERAntiSpyware	Trojan.Agent/Gen-Changeling
Sangfor	Malware
K7AntiVirus	Trojan ( 0053f8ce1 )
Alibaba	Trojan:Win32/StoneDrill.0054e6d9
K7GW	Trojan ( 0053f8ce1 )
Cybereason	malicious.f77cb2
TrendMicro	TROJ_GEN.R002C0DGK20
F-Prot	W32/S-17ed7198!Eldorado
Symantec	Backdoor.Notestuk
APEX	Malicious
Avast	Win32:GenMalicious-BHT [Trj]
ClamAV	Win.Trojan.Turnedup-6598671-1
GData	Gen:Variant.Ser.Zusy.2414
Kaspersky	Trojan.Win32.Agentb.bpml
BitDefender	Gen:Variant.Ser.Zusy.2414
NANO-Antivirus	Trojan.Win32.Changeling.dgpyeo
Paloalto	generic.ml
AegisLab	Trojan.Win32.Agentb.tpgR
Rising	Backdoor.TurnedUp!1.B904 (CLOUD)
Ad-Aware	Gen:Variant.Ser.Zusy.2414
Sophos	Mal/BackDr-Y
Comodo	TrojWare.Win32.Changeling.QUK@74q1ct
F-Secure	Heuristic.HEUR/AGEN.1100608
DrWeb	Trojan.DownLoader23.8554
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
Emsisoft	Gen:Variant.Ser.Zusy.2414 (B)
SentinelOne	DFI - Malicious PE
Cyren	W32/S-17ed7198!Eldorado
Jiangmin	Trojan/Agentb.bui
Webroot	W32.AGentb.bpml
Avira	HEUR/AGEN.1100608
Antiy-AVL	Trojan/Win32.TSGeneric
Arcabit	Trojan.Ser.Zusy.D96E
ViRobot	Trojan.Win32.Agent.396973
ZoneAlarm	Trojan.Win32.Agentb.bpml
Microsoft	Trojan:Win32/StoneDrill
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R331564
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34144.zuX@ae@gSJpi
ALYac	Trojan.Agent.StoneDrill

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2014-06-01 19:01:08

Imports

Library WS2_32.dll:

• 0x447274 inet_ntoa

• 0x447278 WSAStartup

• 0x44727c inet_addr

• 0x447280 htons

• 0x447284 send

• 0x447288 setsockopt

• 0x44728c WSACleanup

• 0x447290 recv

• 0x447294 socket

• 0x447298 closesocket

• 0x44729c gethostbyname

• 0x4472a0 connect

Library KERNEL32.dll:

• 0x447038 CreateFileA

• 0x44703c GetFileSize

• 0x447040 SetPriorityClass

• 0x447044 SetFilePointer

• 0x447048 SetErrorMode

• 0x44704c FreeLibrary

• 0x447050 GetCurrentProcess

• 0x447054 WaitForSingleObject

• 0x447058 GetModuleHandleW

• 0x44705c GetTickCount

• 0x447060 VirtualFree

• 0x447064 GetWindowsDirectoryA

• 0x447068 WriteFile

• 0x44706c GetCommandLineA

• 0x447070 LoadLibraryW

• 0x447074 TerminateThread

• 0x447078 Sleep

• 0x44707c CreateSemaphoreA

• 0x447080 CreateProcessA

• 0x447084 TerminateProcess

• 0x447088 ReadFile

• 0x44708c ExitThread

• 0x447090 ReleaseSemaphore

• 0x447094 GetLastError

• 0x447098 GetProcAddress

• 0x44709c LoadLibraryA

• 0x4470a0 GetExitCodeThread

• 0x4470a4 GetModuleHandleA

• 0x4470a8 VirtualProtect

• 0x4470ac CloseHandle

• 0x4470b0 DeleteFileW

• 0x4470b4 GetCurrentProcessId

• 0x4470b8 GetTempPathA

• 0x4470bc CreateThread

• 0x4470c0 WideCharToMultiByte

• 0x4470c4 FormatMessageW

• 0x4470c8 ExitProcess

• 0x4470cc LocalAlloc

• 0x4470d0 LocalSize

• 0x4470d4 GetPriorityClass

• 0x4470d8 OpenProcess

• 0x4470dc Process32FirstW

• 0x4470e0 Process32NextW

• 0x4470e4 CreateToolhelp32Snapshot

• 0x4470e8 MultiByteToWideChar

• 0x4470ec SetProcessPriorityBoost

• 0x4470f0 CopyFileW

• 0x4470f4 GetModuleFileNameW

• 0x4470f8 GetTempPathW

• 0x4470fc QueueUserAPC

• 0x447100 CopyFileA

• 0x447104 VirtualAllocEx

• 0x447108 GetModuleFileNameA

• 0x44710c lstrcatW

• 0x447110 WriteProcessMemory

• 0x447114 ResumeThread

• 0x447118 GlobalLock

• 0x44711c GlobalAlloc

• 0x447120 GlobalUnlock

• 0x447124 GlobalFree

• 0x447128 DeleteFileA

• 0x44712c GetUserDefaultLCID

• 0x447130 GetStringTypeW

• 0x447134 QueryPerformanceCounter

• 0x447138 GetEnvironmentStringsW

• 0x44713c FreeEnvironmentStringsW

• 0x447140 GetLocaleInfoW

• 0x447144 InterlockedExchange

• 0x447148 SetConsoleCtrlHandler

• 0x44714c GetTimeZoneInformation

• 0x447150 RtlUnwind

• 0x447154 GetLocaleInfoA

• 0x447158 EnumSystemLocalesA

• 0x44715c IsValidLocale

• 0x447160 HeapReAlloc

• 0x447164 SetStdHandle

• 0x447168 WriteConsoleW

• 0x44716c InitializeCriticalSection

• 0x447170 CompareStringW

• 0x447174 SetEnvironmentVariableA

• 0x447178 CreateFileW

• 0x44717c SetEndOfFile

• 0x447180 GetProcessHeap

• 0x447184 InterlockedCompareExchange

• 0x447188 lstrlenW

• 0x44718c LCMapStringW

• 0x447190 FlushFileBuffers

• 0x447194 GetConsoleMode

• 0x447198 GetConsoleCP

• 0x44719c FatalAppExitA

• 0x4471a0 HeapDestroy

• 0x4471a4 HeapCreate

• 0x4471a8 DeleteCriticalSection

• 0x4471ac GetFileType

• 0x4471b0 InitializeCriticalSectionAndSpinCount

• 0x4471b4 GetStdHandle

• 0x4471b8 SetHandleCount

• 0x4471bc RaiseException

• 0x4471c0 HeapSize

• 0x4471c4 GetCurrentThread

• 0x4471c8 GetCurrentThreadId

• 0x4471cc SetLastError

• 0x4471d0 TlsFree

• 0x4471d4 TlsSetValue

• 0x4471d8 TlsGetValue

• 0x4471dc TlsAlloc

• 0x4471e0 IsValidCodePage

• 0x4471e4 EncodePointer

• 0x4471e8 DecodePointer

• 0x4471ec HeapFree

• 0x4471f0 EnterCriticalSection

• 0x4471f4 LeaveCriticalSection

• 0x4471f8 GetSystemTimeAsFileTime

• 0x4471fc HeapAlloc

• 0x447200 HeapSetInformation

• 0x447204 GetStartupInfoW

• 0x447208 UnhandledExceptionFilter

• 0x44720c SetUnhandledExceptionFilter

• 0x447210 IsDebuggerPresent

• 0x447214 IsProcessorFeaturePresent

• 0x447218 GetCPInfo

• 0x44721c InterlockedIncrement

• 0x447220 InterlockedDecrement

• 0x447224 GetACP

• 0x447228 GetOEMCP

Library USER32.dll:

• 0x44724c GetDC

• 0x447250 ReleaseDC

• 0x447254 CopyIcon

• 0x447258 GetDesktopWindow

• 0x44725c MessageBoxW

• 0x447260 SetSystemCursor

• 0x447264 GetClientRect

• 0x447268 LoadCursorW

• 0x44726c GetSystemMetrics

Library GDI32.dll:

• 0x447010 BitBlt

• 0x447014 StretchBlt

• 0x447018 DeleteObject

• 0x44701c SelectObject

• 0x447020 CreateCompatibleDC

• 0x447024 CreateCompatibleBitmap

• 0x447028 GetObjectW

• 0x44702c SetStretchBltMode

• 0x447030 GetDIBits

Library ADVAPI32.dll:

• 0x447000 AdjustTokenPrivileges

• 0x447004 LookupPrivilegeValueW

• 0x447008 OpenProcessToken

Library SHELL32.dll:

• 0x447240 ShellExecuteA

• 0x447244 SHGetSpecialFolderPathA

Library ole32.dll:

• 0x4472d4 CoInitialize

• 0x4472d8 CoUninitialize

• 0x4472dc CoCreateInstance

Library OLEAUT32.dll:

• 0x447230 SysAllocStringLen

• 0x447234 SysFreeString

• 0x447238 VariantInit

Library gdiplus.dll:

• 0x4472a8 GdipGetImageEncodersSize

• 0x4472ac GdiplusStartup

• 0x4472b0 GdipCloneImage

• 0x4472b4 GdipSaveImageToFile

• 0x4472b8 GdiplusShutdown

• 0x4472bc GdipFree

• 0x4472c0 GdipAlloc

• 0x4472c4 GdipDisposeImage

• 0x4472c8 GdipCreateBitmapFromHBITMAP

• 0x4472cc GdipGetImageEncoders

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49236	239.255.255.250	3702
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56542	239.255.255.250	1900
192.168.56.101	57875	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.