1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.58
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Vilsel-CT [Trj] | 20200121 | 18.4.3895.0 |
| Baidu | Win32.Trojan.VB.x | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200122 | 2013.8.14.323 |
| McAfee | Generic VB.z | 20200121 | 6.0.6.653 |
| Tencent | Trojan.Win32.VB.ctb | 20200122 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意
(50 out of 61 个事件)
| ALYac | Trojan.Generic.4385790 |
| APEX | Malicious |
| AVG | Win32:Vilsel-CT [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Generic.4385790 |
| AhnLab-V3 | Trojan/Win32.Vilsel.C3039225 |
| Arcabit | Trojan.Generic.D42EBFE |
| Avast | Win32:Vilsel-CT [Trj] |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan.VB.x |
| BitDefender | Trojan.Generic.4385790 |
| BitDefenderTheta | AI:Packer.543B431E1C |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Trojan.VilselMF.S7277562 |
| CMC | Trojan.Win32.Vilsel!O |
| ClamAV | Win.Trojan.Vilsel-4621 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.f4833e |
| Cylance | Unsafe |
| Cyren | W32/VBTrojan.17E!Maximus |
| DrWeb | Trojan.Copyself.102 |
| ESET-NOD32 | Win32/VB.OZA |
| Emsisoft | Trojan.Generic.4385790 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/VBTrojan.17E!Maximus |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.c8e8c2ff4833ece1 |
| Fortinet | W32/Agent.OZA!worm |
| GData | Win32.Trojan.Vilsel.A |
| Ikarus | Trojan.Win32.Scar |
| Invincea | heuristic |
| Jiangmin | Trojan/Vilsel.adtk |
| K7AntiVirus | Trojan ( 00013e901 ) |
| K7GW | Trojan ( 00013e901 ) |
| Kaspersky | Trojan.Win32.Vilsel.loy |
| MAX | malware (ai score=88) |
| Malwarebytes | Worm.VBAgent |
| McAfee | Generic VB.z |
| McAfee-GW-Edition | BehavesLike.Win32.Sivis.mt |
| MicroWorld-eScan | Trojan.Generic.4385790 |
| Microsoft | TrojanDropper:Win32/VB.IL |
| NANO-Antivirus | Trojan.Win32.Vilsel.fwrjnb |
| Panda | Trj/Vilsel.V |
| Qihoo-360 | HEUR/QVM03.0.BB05.Malware.Gen |
| Rising | Trojan.VB!1.BAD4 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Dropper |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/VB-F |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2009-01-06 12:02:14
PE Imphash
bfbf457d52153d2191e67bb6c9212334
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00010000 | 0x0000a400 | 4.662251991869638 |
| UPX1 | 0x00011000 | 0x00004000 | 0x00003e00 | 4.412468565213872 |
| .rsrc | 0x00015000 | 0x00006000 | 0x00005e00 | 4.19218612720756 |
| .imports | 0x0001b000 | 0x00001000 | 0x00000200 | 2.1863312003215385 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0001a4f8 | 0x00000468 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x0001a4f8 | 0x00000468 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x0001a4f8 | 0x00000468 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x0001a4f8 | 0x00000468 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x0001a4f8 | 0x00000468 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x0001a4f8 | 0x00000468 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x0001a964 | 0x0000005c | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x0001a9c4 | 0x00000224 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library MSVBVM60.DLL:
• 0x401000 MethCallEngine
• 0x401004 None
• 0x401008 None
• 0x40100c None
• 0x401010 None
• 0x401014 None
• 0x401018 None
• 0x40101c EVENT_SINK_AddRef
• 0x401020 None
• 0x401024 DllFunctionCall
• 0x401028 None
• 0x40102c EVENT_SINK_Release
• 0x401030 None
• 0x401034 None
• 0x401038 EVENT_SINK_QueryInterface
• 0x40103c __vbaExceptHandler
• 0x401040 None
• 0x401044 None
• 0x401048 None
• 0x40104c None
• 0x401050 ProcCallEngine
• 0x401054 None
• 0x401058 None
• 0x40105c None
• 0x401060 None
• 0x401064 None
• 0x401068 None
• 0x40106c None
• 0x401070 None
• 0x401074 None
• 0x401078 None
• 0x40107c None
L!This program cannot be run in DOS mode.
sisisi
ldsiRichsi
.imports
Project1
frm_main
jjjjjjjjjjjjjjjjjjjjjjjjjj]
jjjjjjjjjjjjjjjjjjjjjjjjjj
dddddddddddddddddddddddddd
dddddddddddddddddddddddddd
__________________________r
stun$%12V44)
zzzzzzzzzzzzzzz{
Tikumn
/Z [qr
bcdddddddddef/YggggggggggggggYh
(YZZ[a((
(YYZZZ]
NEFGHK
deEFGHIyKL
12344* z
$P&'(Z
|bbbbbbbbbbbbbbb
UUUUUUUUUUUUUUUC
qrst!w@gylz///////
q`cDefE!gYjjiiijj2mnop
UUCCCDVWX
YZZ[\2^
CDEFvwJgL
23456789:<#$>
"#$%&'()*+,
bcdefghi
WXYZ[\]^_`a
LMNOPQRSTUV
CDEFGGGHIJK
9:;<=>>?@AB
345678
$%&'()*+,-.
-kkeJ/
.nnnnnnnS8
/qqqqqqqqqqq\@$
tttttttttttttttfI3
wwwwwwwwwwwwwwwwwwwpS<
zzzzzzzzzzzzzzzzzzzzzzzz\E&
}}}}}}}}}}}}}}}}}}}}}}}}}}M
H((wf,
I33lfZ
}KUUmfh
}]WWnf
urpg\B(
qkruvwyq]J4
gpwvvvvw{}tkW=!
kt{{{{{{{z{|
s#Keq |
fvhQC7Q
~Yn_YNA^
u]O7 q
w~~xkZD'~
+j!{tp
YZ~jLwd
Timer1
VB5! *
musicvn
Microsoft Windows
Project1
Project1
frm_main
class_main
module_main
module_bind
module_rnd
module_registry
module_until
module_path
module_check
Module1
module_funny
F;M"- KZO3f
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
Timer1
kernel32
CreateMutexA
ReleaseMutex
CloseHandle
+3q"=h
VBA6.DLL
+3qZ|4%H[x8!=h
+3qClass
C:\WINDOWS\system32\msvbvm60.dll\3
advapi32.dll
RegSetValueExA
FindWindowA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
RegSaveKeyA
RegRestoreKeyA
RegEnumKeyExA
RegEnumValueA
RegCreateKeyA
AdjustTokenPrivileges
user32
LookupPrivilegeValueA
OpenProcessToken
GetCurrentProcess
FindWindowExA
SendMessageA
PostMessageA
GetFileAttributesA
ExitWindowsEx
GetWindowTextA
GetWindowTextLengthA
t4ltlx
qd<ldqt2
d>P#plx*#l
pxlhdP
qh<lll
Xlhqp/l
qh<lhqp
qh<lhqp
qh<lll
Xlhqp/l
qh<lhqp
l4lllt^
qh<lll
Xlhqp/l
qh<lhqp
qh<lll
Xlhqp/l
qh<lhqp
l4lllt^
qh<lll
Xlhqp/l
qh<lhqp
q<<l<qt
q@<l4l
Xl@qt/4
qh<lll
Xlhqp/l
qh<lhqp
l4lllt^
qh<lll
Xlhqp/l
qh<lhqp
ql<lliL\/p
ql<lliL\/p
<,ltJlt
1t/plt
*1xltJ
hd`\5L
>@#`lh*#\
tXl\qp/`
hXl0qp2
tXl0qp/`
qX<l\l
XlXqp/\
qX<lXqp
H`1h5H
\4l\lllt^
hXlXqp/\
lxlh*#\
%lxlhlt
qX<lXqp
qL<lPl
XlLqp/P
qL<lLqp
<`1h5<
<`1`5<
P4lPlllt^
`XlLqp2
lxlh*#P
qL<lLqp
qT<l\l
XlTq`2
qT<lTq`
\4l\lt^
qT<l\l
XlTq`2
\4l\lt^
qL<l\l
XlLq`/\
\4l\lt^
qT<l\l
XlTq`/\
qT<lTq`
0>,#<l@*#8
<@840,
x>0#<l@*#8
q<lq/@
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
`.data
%/yp`l(X[t+
/q+ 1rk
[I|#pus
Df=3hD<
K}+Nzz
0n;Oza/`c
module
egistry
untilW
checkM1
f4n@3K
(/R}`U
F;M"- KZj.=h
+3qC:\L
gram Fis\<Vz/)ual Studio\VB98
6.OL\hg
0|In[@
gd#BVh[
3Kk!nel32
^(CeMu
6bgOykw
RTHsG@0G(0
ZNCx4Sr
<HdCd'#"
~@HKr$/
kY8\AcVcO
d=42F7i
cAnDLL[
'C* Z|4%H[x8!
WINDOWS\sy)
em\msvbvm60.l\3^
a4api1
gSetV^ueE
Open KeyHGl2$
JFoH;a
d)_/KSav@N~C
Fstrror
EnumGX!
TokK(4qivFg.
+VupI',
^lkcs3
GFCAurrDtQ
wCr/]}
i n'dzr
zGp!1I+4
xK/bC+msttFM
h1 v[dm
uccNF+d
g+sKQpJH
QMp"t_
DCM<;agZGD,
4Td#Post8
O`WsAW
TextAGh\2$
GLxgth+^r Ohp
,bONjH_]a
u Est!`
[ 0_xvzc
o5MGrwrc%C1m]
X.y,x8'
t4l:nl
2*#pa{
pl.p#ttgPp1/
(JX(+W
Pwxz4a0>$d
oex})P5
1@g PT"
q<R9l-qS/l
p!1(kG
(<]/Y,
'9:#NLV:u:SfNq
@%I`w!%
wL`cKXf&|
i;~66s
W%ZBa~A
<640`F
*<8*.F*B+
<D&`{!E$
8ut.fva
@tB&/4w
d8s+pfhDD68
#^qa_,
*%F k&g4X
QCbMS}
Y<*l0L\x
9c(t=7:
oGo<bn
tXn?$WX`]#
i(rdH/8
!hK"'#X
XE@|dU
H[sw*\`
#5l0HU
/ov8%A31@
>;\?A3
@M(]{<
B2YQ`[\`
c$a\\<'X\X\$Y.
XXBjBBbXkM
l0dC-!v:
[a sIpClW
C7\D@&
PPLPddLPLLA&
Bt-88
X`X`{+
?&xqPPfnr
\PYTYL2
J3fGTO7`
gfO`:n
h<l-,,"s
X<@8447
Q+xdr ,h
'+0Ra:
(-XF+4\`!
k40r,d;
"d2L&d29**D@E
MethCallEneginQ
EVENT_SINK_AddRef$
D2Function>
__vbaEx
!"ctY#D
[uWe(t d.
d'.Vxt
G`.data`1
.rsrc+
GPGWHU,
XPTPSWXaD$j
jjjjjjjjjjjjjjjjjjjjjjjjjj]
jjjjjjjjjjjjjjjjjjjjjjjjjj
dddddddddddddddddddddddddd
dddddddddddddddddddddddddd
__________________________r
stun$%12V44)
zzzzzzzzzzzzzzz{
Tikumn
/Z [qr
bcdddddddddef/YggggggggggggggYh
(YZZ[a((
(YYZZZ]
NEFGHK
deEFGHIyKL
12344* z
$P&'(Z
|bbbbbbbbbbbbbbb
UUUUUUUUUUUUUUUC
qrst!w@gylz///////
q`cDefE!gYjjiiijj2mnop
UUCCCDVWX
YZZ[\2^
CDEFvwJgL
23456789:<#$>
"#$%&'()*+,
bcdefghi
WXYZ[\]^_`a
LMNOPQRSTUV
CDEFGGGHIJK
9:;<=>>?@AB
345678
$%&'()*+,-.
-kkeJ/
.nnnnnnnS8
/qqqqqqqqqqq\@$
tttttttttttttttfI3
wwwwwwwwwwwwwwwwwwwpS<
zzzzzzzzzzzzzzzzzzzzzzzz\E&
}}}}}}}}}}}}}}}}}}}}}}}}}}M
H((wf,
I33lfZ
}KUUmfh
}]WWnf
urpg\B(
qkruvwyq]J4
gpwvvvvw{}tkW=!
kt{{{{{{{z{|
s#Keq |
fvhQC7Q
~Yn_YNA^
u]O7 q
w~~xkZD'~
+j!{tp
YZ~jLwd
KERNEL32.DLL
MSVBVM60.DLL
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
h d H , d
l \ X L @ \
~ x k Z F +
R : u ] O : &
@ C : \ D o c u m e n t s a n d S e t t i n g s \ D u c D u n
* \ A D : \ L a p T r i n h \ V i r u s M a u \ P r o 3 \ P r o 3 . v b p
S e R e s t o r e P r i v i l e g e
S e B a c k u p P r i v i l e g e
A c c e s s i s d e n i e d
S y s t e m
H i d e F i l e E x t
S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ E x p l o r e r
L o g o n U s e r N a m e
H i d d e n
S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ E x p l o r e r \ C a b i n e t S t a t e
F u l l P a t h
S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ E x p l o r e r \ A d v a n c e d
S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x p l o r e r
N o F o l d e r O p t i o n s
S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ E x p l o r e r \ S t r e a m s
S e t t i n g s
S c r i p t i n g . F i l e S y s t e m O b j e c t
C r e a t e T e x t F i l e
t e m p . z i p
S h e l l . A p p l i c a t i o n
N a m e s p a c e
C o p y H e r e
b a c k u p
S y s t e m R e s t o r e
u p d a t e
C a b i n e t W C l a s s
E x p l o r e W C l a s s
H a p p y B i r t h D a y m y ' s B o s s
M e r r y C h r i s t m a s
h d H , d
l \ X L @ \
~ x k Z F +
R : u ] O : &
V S _ V E R S I O N _ I N F O
V a r F i l e I n f o
T r a n s l a t i o n
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
C o m p a n y N a m e
P r o d u c t N a m e
M i c r o s o f t W i n d o w s
F i l e V e r s i o n
1 . 0 0 . 0 0 5 7
P r o d u c t V e r s i o n
1 . 0 0 . 0 0 5 7
I n t e r n a l N a m e
m u s i c v n
O r i g i n a l F i l e n a m e
m u s i c v n . e x e
( 5 % & ' 3 7
3 4 4 5 6 :
& * / 3 3 3 3 , 7
$ % % % %
! ! ! 5 5 8 8 8 4 4 4 4 5
# # # $
! ! - % & ( ( (
" & 0 1 2 9 - . 0 0 0 1
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.