SmartHawk

3.6

中危

21 个模型检测该样本为恶意！

重新分析

下载样本

bf4ee15247f4ba8dd19ebd8d0a1e1eff48b1aced6cfd3e32b8c35cdfdf148b24

caa8a5da12f325ca0c1f6731bdfaf7dc.exe

分析耗时

85s

最近分析

文件大小

4.3MB

静态报毒动态报毒 AGENERIC ARTEMIS MALICIOUS RDFK SUSGEN UNSAFE VIGORF WACATAC 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Generic.0dfae73a	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft		20200918	2013.8.14.323
McAfee	Artemis!CAA8A5DA12F3	20200918	6.0.6.653
Tencent		20200918	1.0.0.1
CrowdStrike		20190702	1.0

Allocates read-write-execute memory (usually to unpack itself) (5 个事件)

Time & API	Arguments	Status
1620908919.524626 NtProtectVirtualMemory	process_identifier: 944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045d000	success
1620908919.524626 NtProtectVirtualMemory	process_identifier: 944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0045d000	success
1620908919.555626 NtAllocateVirtualMemory	process_identifier: 944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x029e0000	success
1620908919.852626 NtAllocateVirtualMemory	process_identifier: 944 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x03d00000	success
1620908919.852626 NtAllocateVirtualMemory	process_identifier: 944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03d80000	success

Creates (office) documents on the filesystem (2 个事件)

file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\9AB15445\4B324E4F\estratto_tariffario_INAIL.pdf
file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\61D3B230\4B324E4F\nuovo_dpr_462.pdf

Creates executable files on the filesystem (13 个事件)

file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\D82CCE15\4B324E4F\RinnoviBolletta.exe
file	C:\ProgramData\mia52BE.tmp\data\Aggiornamento Ellisse.msi
file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll
file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\DB9C3881\4B324E4F\RinnoviTransitorio.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\mia1\mMSIExec.dll
file	C:\ProgramData\mia52BE.tmp\Aggiornamento Ellisse.msi
file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\50049758\4B324E4F\Rinnovi.exe
file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\878B9C35\4B324E4F\AllegaBol.exe
file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\4D92FA25\4B324E4F\RisolviTutto.exe
file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\5BD094E9\4B324E4F\client.exe
file	C:\ProgramData\mia52BE.tmp\Aggiornamento Ellisse.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\IIIQF\7z.dll
file	C:\ProgramData\mia52BE.tmp\data\OFFLINE\90A3120E\4B324E4F\ScaricoEsiti.exe

Drops an executable to the user AppData folder (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\IIIQF\7z.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\mia1\mMSIExec.dll

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Checks for the presence of known windows from debuggers and forensic tools (3 个事件)

Time & API	Arguments	Status	Return
1620908922.977626 FindWindowW	class_name: TApplication window_name: Aggiornamento Ellisse	success	131468
1620908922.977626 FindWindowW	class_name: TApplication window_name: Aggiornamento Ellisse	success	131468
1620908922.977626 FindWindowW	class_name: TApplication window_name: Aggiornamento Ellisse	success	131468

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 个事件)

CAT-QuickHeal	Trojan.Generic
Cylance	Unsafe
Sangfor	Malware
Alibaba	Trojan:Win32/Generic.0dfae73a
Invincea	Mal/Generic-S
Cyren	W32/Trojan.RDFK-1044
Symantec	Trojan.Gen.MBT
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
Sophos	Mal/Generic-S
Antiy-AVL	Trojan/Win32.AGeneric
Microsoft	Trojan:Win32/Vigorf.A
ZoneAlarm	HEUR:Trojan.Win32.Generic
McAfee	Artemis!CAA8A5DA12F3
VBA32	Trojan.Wacatac
MaxSecure	Trojan.Malware.7164915.susgen
Fortinet	W32/Generic!tr
AVG	Win32:Malware-gen
Panda	Trj/CI.A
Qihoo-360	Generic/Trojan.b1e

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2015-09-09 06:01:54

Imports

Library KERNEL32.dll:

• 0x42e018 GetLastError

• 0x42e01c ResetEvent

• 0x42e020 CreateEventW

• 0x42e024 CloseHandle

• 0x42e028 MultiByteToWideChar

• 0x42e02c WideCharToMultiByte

• 0x42e030 GetModuleFileNameW

• 0x42e034 FormatMessageW

• 0x42e038 LocalFree

• 0x42e03c GetWindowsDirectoryW

• 0x42e040 CreateFileW

• 0x42e044 SetFileTime

• 0x42e048 SetFileAttributesW

• 0x42e04c RemoveDirectoryW

• 0x42e050 CreateDirectoryW

• 0x42e054 DeleteFileW

• 0x42e058 GetShortPathNameW

• 0x42e05c GetFullPathNameW

• 0x42e060 lstrlenW

• 0x42e064 GetCurrentDirectoryW

• 0x42e068 GetTempFileNameW

• 0x42e06c FindClose

• 0x42e070 FindFirstFileW

• 0x42e074 FindNextFileW

• 0x42e078 GetFileSize

• 0x42e07c SetFilePointer

• 0x42e080 ReadFile

• 0x42e084 WriteFile

• 0x42e088 SetEndOfFile

• 0x42e08c DeleteCriticalSection

• 0x42e090 GetStdHandle

• 0x42e094 EnterCriticalSection

• 0x42e098 LeaveCriticalSection

• 0x42e09c InitializeCriticalSection

• 0x42e0a0 GetCurrentProcessId

• 0x42e0a4 GetCurrentThreadId

• 0x42e0a8 QueryPerformanceCounter

• 0x42e0ac GetTickCount

• 0x42e0b0 Sleep

• 0x42e0b4 LocalAlloc

• 0x42e0b8 SetCurrentDirectoryW

• 0x42e0bc GetVersion

• 0x42e0c0 GetCommandLineW

• 0x42e0c4 CreateProcessW

• 0x42e0c8 GetExitCodeProcess

• 0x42e0cc FlushFileBuffers

• 0x42e0d0 CreateFileA

• 0x42e0d4 WriteConsoleW

• 0x42e0d8 GetConsoleOutputCP

• 0x42e0dc WriteConsoleA

• 0x42e0e0 SetStdHandle

• 0x42e0e4 LCMapStringW

• 0x42e0e8 LCMapStringA

• 0x42e0ec GetStringTypeW

• 0x42e0f0 GetStringTypeA

• 0x42e0f4 GetConsoleMode

• 0x42e0f8 GetConsoleCP

• 0x42e0fc GetLocaleInfoA

• 0x42e100 IsValidCodePage

• 0x42e104 GetOEMCP

• 0x42e108 GetACP

• 0x42e10c GetCPInfo

• 0x42e110 LoadLibraryA

• 0x42e114 RaiseException

• 0x42e118 RtlUnwind

• 0x42e11c InitializeCriticalSectionAndSpinCount

• 0x42e120 GetSystemTimeAsFileTime

• 0x42e124 WaitForSingleObject

• 0x42e128 SetEvent

• 0x42e12c GetVersionExW

• 0x42e130 VirtualAlloc

• 0x42e134 WaitForMultipleObjects

• 0x42e138 VirtualFree

• 0x42e13c GetFileType

• 0x42e140 SetHandleCount

• 0x42e144 GetEnvironmentStringsW

• 0x42e148 FreeEnvironmentStringsW

• 0x42e14c GetEnvironmentStrings

• 0x42e150 FreeEnvironmentStringsA

• 0x42e154 HeapSize

• 0x42e158 InterlockedDecrement

• 0x42e15c SetLastError

• 0x42e160 InterlockedIncrement

• 0x42e164 TlsFree

• 0x42e168 TlsSetValue

• 0x42e16c HeapFree

• 0x42e170 HeapAlloc

• 0x42e174 ExitThread

• 0x42e178 CreateThread

• 0x42e17c HeapReAlloc

• 0x42e180 GetCommandLineA

• 0x42e184 GetStartupInfoA

• 0x42e188 TerminateProcess

• 0x42e18c GetCurrentProcess

• 0x42e190 UnhandledExceptionFilter

• 0x42e194 SetUnhandledExceptionFilter

• 0x42e198 IsDebuggerPresent

• 0x42e19c HeapCreate

• 0x42e1a0 GetModuleHandleW

• 0x42e1a4 GetProcAddress

• 0x42e1a8 ExitProcess

• 0x42e1ac GetModuleFileNameA

• 0x42e1b0 TlsGetValue

• 0x42e1b4 TlsAlloc

Library USER32.dll:

• 0x42e1dc SetForegroundWindow

• 0x42e1e0 CharUpperW

• 0x42e1e4 DestroyWindow

• 0x42e1e8 RegisterWindowMessageW

• 0x42e1ec AdjustWindowRect

• 0x42e1f0 LoadImageW

• 0x42e1f4 KillTimer

• 0x42e1f8 SetTimer

• 0x42e1fc PostMessageW

• 0x42e200 EndDialog

• 0x42e204 IsDlgButtonChecked

• 0x42e208 SetDlgItemTextW

• 0x42e20c GetDlgItem

• 0x42e210 SetWindowTextW

• 0x42e214 GetWindowTextW

• 0x42e218 GetWindowTextLengthW

• 0x42e21c LoadStringW

• 0x42e220 DialogBoxParamW

• 0x42e224 CreateDialogParamW

• 0x42e228 SystemParametersInfoW

• 0x42e22c PeekMessageW

• 0x42e230 GetDesktopWindow

• 0x42e234 MessageBoxW

• 0x42e238 SendMessageW

• 0x42e23c GetWindowLongW

• 0x42e240 SetWindowLongW

• 0x42e244 ShowWindow

• 0x42e248 MoveWindow

• 0x42e24c GetWindowRect

• 0x42e250 LoadIconW

Library GDI32.dll:

• 0x42e010 GetObjectW

Library ADVAPI32.dll:

• 0x42e000 RegSetValueExW

• 0x42e004 RegCreateKeyExW

• 0x42e008 RegCloseKey

Library SHELL32.dll:

• 0x42e1d0 ShellExecuteExW

• 0x42e1d4 SHGetFolderPathW

Library ole32.dll:

• 0x42e258 CoInitialize

• 0x42e25c CoCreateInstance

Library OLEAUT32.dll:

• 0x42e1bc SysAllocStringLen

• 0x42e1c0 SysFreeString

• 0x42e1c4 VariantClear

• 0x42e1c8 SysAllocString

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 216.58.200.46 CNAME clients.l.google.com	142.250.66.110
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900
192.168.56.101	49714	239.255.255.250	3702
192.168.56.101	53658	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.