SmartHawk

2.6

中危

34 个模型检测该样本为恶意！

重新分析

下载样本

551dcee5eb3f81491ffaf30f56abb286ae6bab1ace52333b0639d1b5c7cc5376

cca0c0aa3348deb8015bba5fd33da26c.exe

分析耗时

34s

最近分析

文件大小

68.8KB

静态报毒动态报毒 AI SCORE=83 AIDETECTVM ARTEMIS CLASSIC CONFIDENCE ELDORADO EMOTET EMOTETCRYPT EMOTETPMF EROG GENERIC ML PUA GENERICKDZ GENKRYPTIK HTTQBS MALWARE2 MALWARE@#30BMRZNR98IHW R06EC0DI420 S15645344 SCORE SUSGEN SUSPICIOUS PE UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!CCA0C0AA3348	20201023	6.0.6.653
Alibaba	Trojan:Win32/EmotetCrypt.be0f918e	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_60% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast		20201023	18.4.3895.0
Kingsoft		20201023	2013.8.14.323
Tencent		20201023	1.0.0.1

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.27.142:443

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 个事件)

Bkav	W32.AIDetectVM.malware2
MicroWorld-eScan	Trojan.GenericKDZ.69819
FireEye	Generic.mg.cca0c0aa3348deb8
CAT-QuickHeal	Trojan.EmotetPMF.S15645344
McAfee	Artemis!CCA0C0AA3348
Alibaba	Trojan:Win32/EmotetCrypt.be0f918e
CrowdStrike	win/malicious_confidence_60% (W)
Arcabit	Trojan.Generic.D110BB
TrendMicro	TROJ_GEN.R06EC0DI420
Cyren	W32/Emotet.ARU.gen!Eldorado
APEX	Malicious
ClamAV	Win.Trojan.Generickdz-9758876-0
BitDefender	Trojan.GenericKDZ.69819
NANO-Antivirus	Trojan.Win32.Emotet.httqbs
Rising	Trojan.Emotet!1.CB4A (CLASSIC)
Ad-Aware	Trojan.GenericKDZ.69819
Emsisoft	Trojan.GenericKDZ.69819 (B)
Comodo	Malware@#30bmrznr98ihw
DrWeb	Trojan.Emotet.1005
Zillya	Trojan.Emotet.Win32.27692
Invincea	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Generic.kh
SentinelOne	DFI - Suspicious PE
Microsoft	Trojan:Win32/EmotetCrypt.A!MTB
ViRobot	Trojan.Win32.Emotet.868352
GData	Trojan.GenericKDZ.69819
ALYac	Trojan.Agent.Emotet
MAX	malware (ai score=83)
TrendMicro-HouseCall	TROJ_GEN.R06EC0DI420
Ikarus	Trojan-Banker.Emotet
eGambit	Unsafe.AI_Score_94%
Fortinet	W32/GenKryptik.EROG!tr
MaxSecure	Trojan.Malware.106121428.susgen
Cybereason	malicious.3c0572

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-29 00:39:36

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	216.58.200.238
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900
192.168.56.101	49240	239.255.255.250	3702
192.168.56.101	49242	239.255.255.250	3702
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.