SmartHawk

8.0

高危

54 个模型检测该样本为恶意！

重新分析

下载样本

882ed256381d3798dc08be53de4bd91e25b8d77804f261d38adbc386abb1d3a6

cbf62800709f600dcb82fa27602e68e9.exe

分析耗时

92s

最近分析

文件大小

686.0KB

静态报毒动态报毒 AGENSLA AGENTTESLA AI SCORE=82 APOG ATTRIBUTE AVSARHER BSK66A CONFIDENCE ELDORADO FAREIT GDSDA GENERICKDZ HIGH CONFIDENCE HIGHCONFIDENCE HTNRHI INJECT3 KRYPTIK MALICIOUS PE MALWARE@#3101ENYXBUBK3 MALWAREX NEGASTEAL QM0@ASJEPL QQBSX QQPASS QQROB SCORE TDFQ THIBDBO UNSAFE YAKBEEXMSIL YMACCO ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanSpy:MSIL/AgentTesla.59f01876	20190527	0.3.0.5
Avast	Win32:MalwareX-gen [Trj]	20201023	18.4.3895.0
Tencent	Msil.Trojan-qqpass.Qqrob.Tdfq	20201023	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft		20201023	2013.8.14.323
McAfee	Fareit-FYV!CBF62800709F	20201023	6.0.6.653
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619906610.609 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619906611.468 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619906611.468 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (49 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906567.703 IsDebuggerPresent		failed	0	0
1619906567.703 IsDebuggerPresent		failed	0	0
1619906609.968 IsDebuggerPresent		failed	0	0
1619906610.437 IsDebuggerPresent		failed	0	0
1619906610.984 IsDebuggerPresent		failed	0	0
1619906611.437 IsDebuggerPresent		failed	0	0
1619906611.453 IsDebuggerPresent		failed	0	0
1619906611.453 IsDebuggerPresent		failed	0	0
1619906611.984 IsDebuggerPresent		failed	0	0
1619906612.437 IsDebuggerPresent		failed	0	0
1619906612.984 IsDebuggerPresent		failed	0	0
1619906613.437 IsDebuggerPresent		failed	0	0
1619906613.984 IsDebuggerPresent		failed	0	0
1619906614.437 IsDebuggerPresent		failed	0	0
1619906614.984 IsDebuggerPresent		failed	0	0
1619906615.437 IsDebuggerPresent		failed	0	0
1619906615.984 IsDebuggerPresent		failed	0	0
1619906616.437 IsDebuggerPresent		failed	0	0
1619906616.984 IsDebuggerPresent		failed	0	0
1619906617.437 IsDebuggerPresent		failed	0	0
1619906617.984 IsDebuggerPresent		failed	0	0
1619906618.437 IsDebuggerPresent		failed	0	0
1619906618.984 IsDebuggerPresent		failed	0	0
1619906619.437 IsDebuggerPresent		failed	0	0
1619906619.984 IsDebuggerPresent		failed	0	0
1619906620.437 IsDebuggerPresent		failed	0	0
1619906620.984 IsDebuggerPresent		failed	0	0
1619906621.437 IsDebuggerPresent		failed	0	0
1619906621.984 IsDebuggerPresent		failed	0	0
1619906622.437 IsDebuggerPresent		failed	0	0
1619906622.984 IsDebuggerPresent		failed	0	0
1619906623.437 IsDebuggerPresent		failed	0	0
1619906623.984 IsDebuggerPresent		failed	0	0
1619906624.437 IsDebuggerPresent		failed	0	0
1619906624.984 IsDebuggerPresent		failed	0	0
1619906625.437 IsDebuggerPresent		failed	0	0
1619906625.984 IsDebuggerPresent		failed	0	0
1619906626.437 IsDebuggerPresent		failed	0	0
1619906626.984 IsDebuggerPresent		failed	0	0
1619906627.437 IsDebuggerPresent		failed	0	0
1619906627.984 IsDebuggerPresent		failed	0	0
1619906628.437 IsDebuggerPresent		failed	0	0
1619906628.984 IsDebuggerPresent		failed	0	0
1619906629.437 IsDebuggerPresent		failed	0	0
1619906629.984 IsDebuggerPresent		failed	0	0
1619906630.437 IsDebuggerPresent		failed	0	0
1619906630.984 IsDebuggerPresent		failed	0	0
1619906631.437 IsDebuggerPresent		failed	0	0
1619906631.984 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906567.718 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 135 个事件)

Time & API	Arguments	Status	Return
1619906566.671 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x004f0000	success	0
1619906566.671 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b0000	success	0
1619906567.468 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02160000	success	0
1619906567.468 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02340000	success	0
1619906567.5 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619906567.703 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00ab0000	success	0
1619906567.703 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ba0000	success	0
1619906567.703 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003aa000	success	0
1619906567.703 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619906567.703 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a2000	success	0
1619906567.984 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b2000	success	0
1619906568.078 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e5000	success	0
1619906568.078 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003eb000	success	0
1619906568.078 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e7000	success	0
1619906568.234 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b3000	success	0
1619906568.25 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003bc000	success	0
1619906568.953 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b4000	success	0
1619906568.953 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b6000	success	0
1619906569.062 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00670000	success	0
1619906569.218 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ca000	success	0
1619906569.218 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c7000	success	0
1619906569.453 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c6000	success	0
1619906569.468 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ba000	success	0
1619906569.828 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ac000	success	0
1619906570.062 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00671000	success	0
1619906570.078 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b7000	success	0
1619906570.359 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b8000	success	0
1619906570.531 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00be0000	success	0
1619906570.656 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b9000	success	0
1619906570.671 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00672000	success	0
1619906603.75 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02341000	success	0
1619906603.937 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00674000	success	0
1619906604.265 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04470000	success	0
1619906604.281 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00675000	success	0
1619906604.453 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 519680 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x06040400	failed	3221225550
1619906609.406 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00676000	success	0
1619906609.406 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00677000	success	0
1619906609.453 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04471000	success	0
1619906609.453 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00678000	success	0
1619906609.453 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00679000	success	0
1619906609.5 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0067a000	success	0
1619906609.656 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0067b000	success	0
1619906609.687 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0067c000	success	0
1619906609.687 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x06040178	failed	3221225550
1619906609.687 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x060401a0	failed	3221225550
1619906609.687 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x060401c8	failed	3221225550
1619906609.687 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x060401f0	failed	3221225550
1619906609.687 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x06040218	failed	3221225550
1619906609.687 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x060bfb8e	failed	3221225550
1619906609.687 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x060bfb82	failed	3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.962670115927942

section

{'size_of_data': '0x000aae00', 'virtual_address': '0x00002000', 'entropy': 7.962670115927942, 'name': '.text', 'virtual_size': '0x000aac14'}

description

A section with a high entropy has been found

entropy

0.9970824215900802

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906604.437 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Checks the version of Bios, possibly for anti-virtualization (2 个事件)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects virtualization software with SCSI Disk Identifier trick(s) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0

Detects VirtualBox through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions

Detects VMWare through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

Detects the presence of Wine emulator (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906610.203 LdrGetProcedureAddress	ordinal: 0 module: KERNEL32 module_address: 0x76340000 function_address: 0x002cd5ec function_name: wine_get_unix_file_name	failed	3221225785	0

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.Inject3.53142
MicroWorld-eScan	Trojan.GenericKDZ.69732
FireEye	Generic.mg.cbf62800709f600d
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Trojan.GenericKDZ.69732
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0056d50b1 )
Alibaba	TrojanSpy:MSIL/AgentTesla.59f01876
K7GW	Trojan ( 0056d50b1 )
Cybereason	malicious.cfa09a
Arcabit	Trojan.Generic.D11064
TrendMicro	TrojanSpy.MSIL.NEGASTEAL.THIBDBO
BitDefenderTheta	Gen:NN.ZemsilF.34570.Qm0@aSJepl
Cyren	W32/MSIL_Kryptik.BLL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.XLS
TrendMicro-HouseCall	TrojanSpy.MSIL.NEGASTEAL.THIBDBO
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKDZ.69732
NANO-Antivirus	Trojan.Win32.Agensla.htnrhi
Paloalto	generic.ml
Tencent	Msil.Trojan-qqpass.Qqrob.Tdfq
Ad-Aware	Trojan.GenericKDZ.69732
Emsisoft	Trojan.GenericKDZ.69732 (B)
Comodo	Malware@#3101enyxbubk3
F-Secure	Trojan.TR/Kryptik.qqbsx
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Jiangmin	Trojan.PSW.MSIL.apog
Avira	TR/Kryptik.qqbsx
Microsoft	Trojan:Win32/Ymacco.AA88
AegisLab	Trojan.MSIL.Agensla.i!c
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKDZ.69732
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.C4186647
McAfee	Fareit-FYV!CBF62800709F
MAX	malware (ai score=82)
Malwarebytes	Trojan.Crypt.MSIL
APEX	Malicious
Yandex	Trojan.AvsArher.bSK66A
Ikarus	Trojan.MSIL.Inject
eGambit	Unsafe.AI_Score_87%
Fortinet	MSIL/Kryptik.XLS!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-26 16:50:36

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.