3.0
中危
60 个模型检测该样本为恶意！
重新分析
更多

ca75b5a05f030b2b20f3d98c293d5240f96d000b57505526bf52e4f82458ab2d

c5b82a055d8d7d29434797433eb5dae0.exe

分析耗时

29s

最近分析

文件大小

214.5KB
静态报毒 动态报毒 100% AI SCORE=89 BEHAVIOR CLASSIC CONFIDENCE DOWNLOADER34 ELDORADO FAKEDOC GDSDA GENERICKD GLUPTEBA HGDG HIGH CONFIDENCE HWEAMF INJUKE KRYPTIK MALWARE@#2RS80WE08J54L OBSCURE OSPWC POSSIBLETHREAT QVM10 R032C0PIG20 R351141 RANUMBOT SCORE SUSGEN SUSPICIOUS PE SZLG TOFSEE TROJANX UNSAFE UPATRE VZASE7L0EPC WACATAC WINDIGO 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Packed-GAO!C5B82A055D8D 20201022 6.0.6.653
Alibaba Trojan:Win32/Injuke.a9359cdb 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:TrojanX-gen [Trj] 20201022 18.4.3895.0
Tencent Win32.Trojan.Injuke.Szlg 20201022 1.0.0.1
Kingsoft 20201022 2013.8.14.323
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1621005040.84275
NtProtectVirtualMemory
process_identifier: 3064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b04000
success 0 0
1621005040.90575
NtAllocateVirtualMemory
process_identifier: 3064
region_size: 40960
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00300000
success 0 0
Foreign language identified in PE resource (21 个事件)
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_ICON language LANG_GEORGIAN offset 0x0057fdc8 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT size 0x00000468
name RT_GROUP_ICON language LANG_GEORGIAN offset 0x00580230 filetype data sublanguage SUBLANG_DEFAULT size 0x0000003e
name RT_GROUP_ICON language LANG_GEORGIAN offset 0x00580230 filetype data sublanguage SUBLANG_DEFAULT size 0x0000003e
name RT_GROUP_ICON language LANG_GEORGIAN offset 0x00580230 filetype data sublanguage SUBLANG_DEFAULT size 0x0000003e
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34521955
FireEye Generic.mg.c5b82a055d8d7d29
CAT-QuickHeal Trojan.Multi
McAfee Packed-GAO!C5B82A055D8D
Cylance Unsafe
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Injuke.a9359cdb
K7GW Trojan ( 0056e57a1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D20EC363
Invincea Mal/Generic-S
Cyren W32/Kryptik.BWP.gen!Eldorado
Symantec Packed.Generic.525
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
ClamAV Win.Packed.Glupteba-9760323-0
Kaspersky Trojan.Win32.Injuke.wkb
BitDefender Trojan.GenericKD.34521955
NANO-Antivirus Trojan.Win32.Injuke.hweamf
Paloalto generic.ml
AegisLab Trojan.Win32.Injuke.4!c
Tencent Win32.Trojan.Injuke.Szlg
Ad-Aware Trojan.GenericKD.34521955
Sophos Mal/Generic-S
Comodo Malware@#2rs80we08j54l
F-Secure Trojan.TR/AD.Behavior.ospwc
DrWeb Trojan.DownLoader34.41581
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R032C0PIG20
McAfee-GW-Edition BehavesLike.Win32.Upatre.dm
Emsisoft Trojan.GenericKD.34521955 (B)
Ikarus Trojan.Win32.Ranumbot
Jiangmin Backdoor.Tofsee.cuw
eGambit Unsafe.AI_Score_98%
Avira TR/AD.Behavior.ospwc
Antiy-AVL Trojan/Win32.Generic
Microsoft Trojan:Win32/Glupteba.DSN!MTB
ViRobot Trojan.Win32.Z.Wacatac.219648
ZoneAlarm Trojan.Win32.Injuke.wkb
GData Trojan.GenericKD.34521955
Cynet Malicious (score: 90)
AhnLab-V3 Trojan/Win32.Kryptik.R351141
ALYac Trojan.GenericKD.34521955
MAX malware (ai score=89)
VBA32 TrojanSpy.Windigo
Malwarebytes Trojan.MalPack.GS
ESET-NOD32 a variant of Win32/Kryptik.HGDG
TrendMicro-HouseCall TROJ_GEN.R032C0PIG20
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-04-23 07:22:18

Imports

Library KERNEL32.dll:
• 0x401000 CommConfigDialogA
• 0x401004 HeapAlloc
• 0x401010 WaitNamedPipeA
• 0x401014 GetCurrentProcess
• 0x40101c BackupSeek
• 0x401020 GetModuleHandleW
• 0x401028 GetProcessHeap
• 0x40102c GetConsoleTitleA
• 0x401030 ReadConsoleW
• 0x401034 WriteFile
• 0x401038 ActivateActCtx
• 0x40103c GlobalAlloc
• 0x401040 Sleep
• 0x401048 ReadProcessMemory
• 0x40104c lstrcpynW
• 0x401050 GetFileAttributesW
• 0x401054 VerifyVersionInfoA
• 0x401058 SetSystemPowerState
• 0x40105c GetAtomNameW
• 0x401060 ReadFile
• 0x401064 GetModuleFileNameW
• 0x401068 CreateFileW
• 0x40106c DeactivateActCtx
• 0x401070 LCMapStringA
• 0x401074 InterlockedExchange
• 0x401078 ReleaseActCtx
• 0x401080 SetLastError
• 0x401084 GetProcAddress
• 0x401088 VerLanguageNameA
• 0x40108c HeapUnlock
• 0x401094 ResetEvent
• 0x40109c GetTapeParameters
• 0x4010a0 SetConsoleTitleW
• 0x4010a4 GetModuleHandleA
• 0x4010a8 CreateMutexA
• 0x4010b0 OpenEventW
• 0x4010b8 ReleaseMutex
• 0x4010bc GetCurrentProcessId
• 0x4010c0 LocalFree
• 0x4010c4 lstrcpyW
• 0x4010c8 ExitProcess
• 0x4010cc GetStartupInfoW
• 0x4010d8 TerminateProcess
• 0x4010e4 IsDebuggerPresent
• 0x4010e8 RtlUnwind
• 0x4010ec TlsGetValue
• 0x4010f0 TlsAlloc
• 0x4010f4 TlsSetValue
• 0x4010f8 TlsFree
• 0x401100 GetCurrentThreadId
• 0x401104 GetLastError
• 0x40110c GetStdHandle
• 0x401110 GetModuleFileNameA
• 0x401114 LoadLibraryA
• 0x401124 GetCommandLineW
• 0x401128 SetHandleCount
• 0x40112c GetFileType
• 0x401130 GetStartupInfoA
• 0x401134 HeapCreate
• 0x401138 VirtualFree
• 0x40113c HeapFree
• 0x401144 GetTickCount
• 0x40114c GetCPInfo
• 0x401150 GetACP
• 0x401154 GetOEMCP
• 0x401158 IsValidCodePage
• 0x40115c WideCharToMultiByte
• 0x401160 CloseHandle
• 0x401164 CreateFileA
• 0x401168 HeapSize
• 0x40116c GetLocaleInfoA
• 0x401170 VirtualAlloc
• 0x401174 HeapReAlloc
• 0x401178 GetConsoleCP
• 0x40117c GetConsoleMode
• 0x401180 FlushFileBuffers
• 0x401184 MultiByteToWideChar
• 0x401188 LCMapStringW
• 0x40118c GetStringTypeA
• 0x401190 GetStringTypeW
• 0x401194 SetFilePointer
• 0x401198 SetStdHandle
• 0x40119c SetEndOfFile
• 0x4011a0 WriteConsoleA
• 0x4011a4 GetConsoleOutputCP
• 0x4011a8 WriteConsoleW

Exports

Ordinal Address Name
1 0x402520 @GetVice@0

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62194 239.255.255.250 1900
192.168.56.101 62319 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.