SmartHawk

4.8

中危

55 个模型检测该样本为恶意！

重新分析

下载样本

25bd8be2689477443c6a6b89c3195bd81b733853aa4502cfd14a6e25afc3798e

c8cc1aa9f0824c83a98cf9072d0079cb.exe

分析耗时

96s

最近分析

文件大小

421.0KB

静态报毒动态报毒 100% AGEN AGENSLA AI SCORE=87 AM0@AQD5MJB AVSARHER BSK66A CONFIDENCE CRYPTINJECT ERFY FAREIT GDSDA GENERICKD GENKRYPTIK HIGH CONFIDENCE HWQNCR KRYPTIK LLXM MALWARE@#2BD6DS8HI1W8H NEGASTEAL PWSX QQPASS QQROB R349413 SCORE SIGGEN2 SUSGEN TAYU THIBEBO TROJANPSW TSCOPE UNSAFE YAKBEEXMSIL ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FYV!C8CC1AA9F082	20201027	6.0.6.653
Alibaba	TrojanPSW:Win32/CryptInject.8c5124d3	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20201027	18.4.3895.0
Tencent	Msil.Trojan-qqpass.Qqrob.Tayu	20201027	1.0.0.1
Kingsoft		20201027	2013.8.14.323

Checks if process is being debugged by a debugger (50 out of 61 个事件)

Time & API	Arguments	Status	Return	Repeated
1619926622.85125 IsDebuggerPresent		failed	0	0
1619926622.85125 IsDebuggerPresent		failed	0	0
1619926662.75725 IsDebuggerPresent		failed	0	0
1619926663.25725 IsDebuggerPresent		failed	0	0
1619926663.77325 IsDebuggerPresent		failed	0	0
1619926664.25725 IsDebuggerPresent		failed	0	0
1619926664.77325 IsDebuggerPresent		failed	0	0
1619926665.25725 IsDebuggerPresent		failed	0	0
1619926665.77325 IsDebuggerPresent		failed	0	0
1619926666.25725 IsDebuggerPresent		failed	0	0
1619926666.77325 IsDebuggerPresent		failed	0	0
1619926667.25725 IsDebuggerPresent		failed	0	0
1619926667.77325 IsDebuggerPresent		failed	0	0
1619926668.25725 IsDebuggerPresent		failed	0	0
1619926668.77325 IsDebuggerPresent		failed	0	0
1619926669.25725 IsDebuggerPresent		failed	0	0
1619926669.77325 IsDebuggerPresent		failed	0	0
1619926670.25725 IsDebuggerPresent		failed	0	0
1619926670.77325 IsDebuggerPresent		failed	0	0
1619926671.25725 IsDebuggerPresent		failed	0	0
1619926671.77325 IsDebuggerPresent		failed	0	0
1619926672.25725 IsDebuggerPresent		failed	0	0
1619926672.77325 IsDebuggerPresent		failed	0	0
1619926673.25725 IsDebuggerPresent		failed	0	0
1619926673.77325 IsDebuggerPresent		failed	0	0
1619926674.25725 IsDebuggerPresent		failed	0	0
1619926674.77325 IsDebuggerPresent		failed	0	0
1619926675.25725 IsDebuggerPresent		failed	0	0
1619926675.77325 IsDebuggerPresent		failed	0	0
1619926676.25725 IsDebuggerPresent		failed	0	0
1619926676.77325 IsDebuggerPresent		failed	0	0
1619926677.25725 IsDebuggerPresent		failed	0	0
1619926677.77325 IsDebuggerPresent		failed	0	0
1619926678.25725 IsDebuggerPresent		failed	0	0
1619926678.77325 IsDebuggerPresent		failed	0	0
1619926679.25725 IsDebuggerPresent		failed	0	0
1619926679.77325 IsDebuggerPresent		failed	0	0
1619926680.25725 IsDebuggerPresent		failed	0	0
1619926680.77325 IsDebuggerPresent		failed	0	0
1619926681.25725 IsDebuggerPresent		failed	0	0
1619926681.77325 IsDebuggerPresent		failed	0	0
1619926682.25725 IsDebuggerPresent		failed	0	0
1619926682.77325 IsDebuggerPresent		failed	0	0
1619926683.25725 IsDebuggerPresent		failed	0	0
1619926683.77325 IsDebuggerPresent		failed	0	0
1619926684.25725 IsDebuggerPresent		failed	0	0
1619926684.77325 IsDebuggerPresent		failed	0	0
1619926685.25725 IsDebuggerPresent		failed	0	0
1619926685.77325 IsDebuggerPresent		failed	0	0
1619926686.25725 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619926622.91425 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 85 个事件)

Time & API	Arguments	Status	Return
1619926622.21025 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00330000	success	0
1619926622.21025 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00350000	success	0
1619926622.53925 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x003b0000	success	0
1619926622.53925 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00400000	success	0
1619926622.58525 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619926622.85125 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02410000	success	0
1619926622.85125 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x025e0000	success	0
1619926622.85125 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ea000	success	0
1619926622.88225 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619926622.88225 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e2000	success	0
1619926623.30425 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success	0
1619926623.64825 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00455000	success	0
1619926623.64825 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045b000	success	0
1619926623.64825 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00457000	success	0
1619926623.83525 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f3000	success	0
1619926623.86725 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fc000	success	0
1619926623.92925 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b0000	success	0
1619926623.92925 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f4000	success	0
1619926626.14825 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f5000	success	0
1619926626.16425 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f6000	success	0
1619926626.36725 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00630000	success	0
1619926626.36725 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success	0
1619926626.57025 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f7000	success	0
1619926626.57025 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b1000	success	0
1619926659.71025 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b3000	success	0
1619926660.14825 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ec000	success	0
1619926660.21025 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044a000	success	0
1619926660.21025 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00447000	success	0
1619926660.22625 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00446000	success	0
1619926660.24225 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b4000	success	0
1619926660.25725 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f8000	success	0
1619926660.27325 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b5000	success	0
1619926660.46025 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 246784 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04620400	failed	3221225550
1619926662.39825 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b6000	success	0
1619926662.39825 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f9000	success	0
1619926662.39825 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b7000	success	0
1619926662.39825 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b8000	success	0
1619926662.44525 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b9000	success	0
1619926662.44525 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ba000	success	0
1619926662.55425 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005bb000	success	0
1619926662.60125 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005bc000	success	0
1619926662.60125 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04620178	failed	3221225550
1619926662.60125 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x046201a0	failed	3221225550
1619926662.60125 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x046201c8	failed	3221225550
1619926662.60125 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x046201f0	failed	3221225550
1619926662.60125 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04620218	failed	3221225550
1619926662.60125 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0465d1be	failed	3221225550
1619926662.60125 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0465d1b2	failed	3221225550
1619926662.60125 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0465c800	failed	3221225550
1619926662.60125 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0465d1cc	failed	3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.848117602528502

section

{'size_of_data': '0x00064600', 'virtual_address': '0x00002000', 'entropy': 7.848117602528502, 'name': '.text', 'virtual_size': '0x0006448c'}

description

A section with a high entropy has been found

entropy

0.9548156956004756

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619926660.44525 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	203.208.41.98

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43736389
FireEye	Generic.mg.c8cc1aa9f0824c83
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	Fareit-FYV!C8CC1AA9F082
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2422691
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanPSW:Win32/CryptInject.8c5124d3
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D29B5D45
Invincea	Mal/Generic-S
Cyren	W32/Trojan.LLXM-4456
Symantec	Trojan.Gen.2
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.43736389
NANO-Antivirus	Trojan.Win32.Agensla.hwqncr
AegisLab	Trojan.Multi.Generic.4!c
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan-qqpass.Qqrob.Tayu
Ad-Aware	Trojan.GenericKD.43736389
Sophos	Mal/Generic-S
Comodo	Malware@#2bd6ds8hi1w8h
F-Secure	Heuristic.HEUR/AGEN.1138776
DrWeb	Trojan.PWS.Siggen2.54008
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.MSIL.NEGASTEAL.THIBEBO
McAfee-GW-Edition	Fareit-FYV!C8CC1AA9F082
Emsisoft	Trojan.GenericKD.43736389 (B)
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1138776
Antiy-AVL	Trojan[PSW]/MSIL.Agensla
Microsoft	Trojan:Win32/CryptInject
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKD.43736389
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.MSIL.R349413
BitDefenderTheta	Gen:NN.ZemsilF.34590.Am0@aqD5MJb
ALYac	Trojan.GenericKD.43736389
MAX	malware (ai score=87)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.Crypt.MSIL
ESET-NOD32	a variant of MSIL/Kryptik.XPS
TrendMicro-HouseCall	TrojanSpy.MSIL.NEGASTEAL.THIBEBO
Yandex	Trojan.AvsArher.bSK66A
Ikarus	Trojan.MSIL.Inject

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2047-04-04 07:29:33

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.238

TCP

Source	Source Port	Destination	Destination Port
203.208.41.98	443	192.168.56.101	49195

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.