0.9
低危

1ef04f7073a1f933d31141fa6db481d82312612c99b3f3d405b76203444cac13

1ef04f7073a1f933d31141fa6db481d82312612c99b3f3d405b76203444cac13.exe

分析耗时

194s

最近分析

365天前

文件大小

38.3KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER UPATRE
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.65
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Crypt-PWU [Trj] 20200422 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200422 2013.8.14.323
McAfee Downloader-FRR 20200422 6.0.6.653
Tencent Malware.Win32.Gencirc.10b9ccfd 20200422 1.0.0.1
静态指标
行为判定
动态指标
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意 (50 out of 64 个事件)
ALYac Trojan.Downloader.JQAT
APEX Malicious
AVG Win32:Crypt-PWU [Trj]
Acronis suspicious
Ad-Aware Trojan.Downloader.JQAT
AhnLab-V3 Win-Trojan/Downloader.31232.FO
Antiy-AVL Trojan/Win32.Agentb
Arcabit Trojan.Downloader.JQAT
Avast Win32:Crypt-PWU [Trj]
Avira TR/Dldr.Upatre.A.92
BitDefender Trojan.Downloader.JQAT
BitDefenderTheta Gen:NN.ZexaF.34106.cmX@a4kz2dgi
Bkav W32.AIDetectVM.malware
CAT-QuickHeal TrojanDownloader.Upatre.A3
CMC Trojan.Win32.Agentb!O
ClamAV Win.Trojan.Agent-36977
Comodo TrojWare.Win32.TrojanDownloader.Small.PRL@52ev9y
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.97b3ef
Cylance Unsafe
Cyren W32/Trojan.WUGR-5058
DrWeb Trojan.DownLoad3.28161
ESET-NOD32 Win32/TrojanDownloader.Small.PRL
Emsisoft Trojan.Downloader.JQAT (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.FXG
F-Secure Trojan.TR/Dldr.Upatre.A.92
FireEye Generic.mg.cd980d397b3ef1ce
Fortinet W32/Dloader.PRL!tr
GData Trojan.Downloader.JQAT
Ikarus Trojan.Crypt2
Invincea heuristic
Jiangmin Trojan/Agentb.adv
K7AntiVirus Trojan ( 00456a071 )
K7GW Trojan-Downloader ( 00456a071 )
Kaspersky Trojan.Win32.Agentb.acot
MAX malware (ai score=89)
Malwarebytes Trojan.Agent.FA
MaxSecure Trojan.Upatre.Gen
McAfee Downloader-FRR
McAfee-GW-Edition BehavesLike.Win32.Downloader.nt
MicroWorld-eScan Trojan.Downloader.JQAT
Microsoft TrojanDownloader:Win32/Upatre.A
NANO-Antivirus Trojan.Win32.Agent.dwuwrq
Panda Generic Malware
Qihoo-360 HEUR/QVM20.1.BAF7.Malware.Gen
Rising Downloader.Small!8.B41 (TFE:dGZlOgK8h+cbJhDiZg)
SUPERAntiSpyware Trojan.Agent/Gen-Downloader
Sangfor Malware
SentinelOne DFI - Malicious PE
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-08-30 20:41:40

PE Imphash

32ea2988a92c31a9efd5b936dc243a44

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00002000 0x00002000 3.4956792705659034
.data 0x00003000 0x00c01000 0x00001200 3.5759198609514944
.rsrc 0x00c04000 0x00004378 0x00004400 4.671504359615681

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00c040f0 0x00004228 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_STRING 0x00c08330 0x00000046 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x00c08318 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library Cabinet.dll:
0x351000 None
Library mscms.dll:
0x351018 GetColorDirectoryW
Library KERNEL32.dll:
0x351008 GetLastError
0x35100c ExitProcess
0x351010 GetModuleHandleW

L!This program cannot be run in DOS mode.
CCCJiDCFXzUBXz`BXzgBRichC
`.data
GetProcAddress
LoadLibraryA
VirtualAlloc
RtlDecompressBuffer
VirtualProtect
GetLogicalDriveStringsA
WIM3SM
+t};}w
SVWPd0
]mz[EPPj
@BMuEM
EPj@sPVU
s?!EG<
EE(9Er
+C4Eto
Cabinet.dll
GetColorDirectoryW
mscms.dll
ExitProcess
GetModuleHandleW
GetLastError
KERNEL32.dll
A}Mm@j
u?*~$:
)dj7ZM
[C:'~-
}\N6ew
!)yDr1bMN
!gUOy1T
sr;'ON
ejyv
B
yrKb#Nx6W/
Dc
!
h^^-uH
(y`rqjRL
i(2x[T5D
vxKd)-
*fU
J).+:6
s\xfsb
2*GRQt
x[m0cR

jgi514
EBD#"0-0ece($'A>A0-0~|~!
URTLIK
VSU0-0LIK625
(%'oln
=:<ROR\Y\625
;8:VSUVSU
Yf2Bz
#"IEHDACZWY625
$,<JGJ}{}mkmNKMwuv
*&)625403\Y[
!WTVSPR
/zwyZWYKHJywx0,/
2/1625%!$
"%6514)&([X[625
[X[625
yvxusuzxz]Z\GCF
'7BP|.>
!5EYefq]j
(GUu6F
DRq{?N
"3CZfmx 1
!2!2Xd
0DRgr
DVVddddddddddddddccccccbbbbbbbbbbbbbbbbaaEG598<YZaaaa``````````
!!!!
##kkyy
++kkyy
""""""""""
Black Rose Immortal
Z:\2139004\f9a37404f1150c48aec238bac44977fc.md5.exe
C:\ftXkp2WS.exe
C:\j7V0UFWh.exe
C:\vPpSdJl1.exe
C:\EQQPUbVr.exe
C:\KkWcH9AR.exe
C:\Db27v3wH.exe
C:\TbjTWwiR.exe
C:\GLn0LCaD.exe
C:\0P9LiJLO.exe
C:\yV8x7QHT.exe
C:\SIM8dOR1.exe
C:\oidTXLbb.exe
C:\q_Zvk_Ad.exe
C:\t55HP1Nf.exe
C:\vBz2XQNe.exe
C:\DazkFrGw.exe
C:\BHS5QcdX.exe
C:\CNTUqhUo.exe
C:\kKs5diTI.exe
C:\Ta_Z8elD.exe
C:\ReHnSMes.exe
C:\ZOSZoESy.exe
C:\_1I5yko5.exe
C:\hdxLPQtQ.exe
C:\GHvGMGbC.exe
C:\mbU2QH1X.exe
C:\gfv72mYI.exe
C:\V9RGh8xP.exe
C:\IMWM5Wwp.exe
C:\A2uV58p3.exe
C:\qYuwvtzK.exe
C:\Zh3WTB2N.exe
C:\5VQEm52C.exe
C:\SabR0xPe.exe
C:\YRhNjnQe.exe
C:\O46XV747.exe
C:\heRCcSUV.exe
C:\2lc2CDWh.exe
C:\Y7vArnST.exe
C:\qhUE1Gg7.exe
C:\tmt2A4Ur.exe
C:\eX1v_DhK.exe
C:\Cm8I1RlZ.exe
C:\KfQzLx_X.exe
C:\8azduyYC.exe
C:\FvqM6f0X.exe
C:\lyYSwsVG.exe
C:\XysstTMr.exe
C:\w_j0p8OW.exe
C:\w0sYgasz.exe
C:\BjBexHPU.exe
C:\VdAzzl8o.exe
C:\52LW2hy0.exe
C:\WF7ZduE1.exe
C:\qsAInDxw.exe
C:\8c02eed721a366bd760cf7d3e01cb4c9b12b654a9df8cd15eb2a9fd2f83018a7
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\important_document.exe
C:\Users\admin\Downloads\factura.exe
C:\Users\Petra\AppData\Local\Temp\hcbnaf.pe32
C:\Users\admin\Downloads\factura.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\factura.exe
C:\Users\Petra\AppData\Local\Temp\hcbnaf.pe32
C:\3SBLjuEl.exe
C:\8c659d2522c9406de570ac8b09e1b7c1245fb0b48bcc3c1fd6b75cbf367543b2
C:\09ab1ff7ca8caeb49bd75a4b2e5887391a675a87fad62745f32c16461a4948fb
C:\Users\Petra\AppData\Local\Temp\hcbnaf.pe32
C:\Users\admin\Downloads\sample.exe
C:\04436cd3a41fc6dddf41a186a49c5b623d8910b17ad307c4b48d4c716b40c9e9
C:\Users\Joe Cage\Desktop\aEymggFE73.exe
C:\3702f649f1791e910a234791995e3d09db68469a41becdbbf0e7b3e9d4563f8b
C:\Users\admin\Downloads\hcbnaf.exe
C:\fb00a9cb53dafc4a9bfbf17bb8c7075751c78992b740335fa846aaabcaf25f42
C:\0166cf12b183dbf14334949c4d9f20d18381e73849d314df9a3a867545853659
C:\7b963abb3d08cc2a1258d5feea597ca117029071d1fb10419be6de64cb2ff955
C:\d520bebc515caa71c3da05964b412a8916d2d248af898caf57da4b786201fba3
C:\Users\admin\Downloads\hcbnaf.exe
C:\eb8c5729dca20f944671fc2752b006027133a8f17a62af776abd5cd054c97b65
C:\Users\admin\Downloads\hcbnaf.exe
C:\43349c82f0f8ff92d32e4709beb8455d5774efa64bec74004548dfdc5b531395
C:\Users\Petra\AppData\Local\Temp\hcbnaf.pe32
C:\joNQUnDl.exe
C:\9572eeea671844b4d55d357e113bae93ade3c5c288a27e51bc697e9f35f150aa
C:\31237eef0122722ff03cfeb316b4a2485e94272b130017fbd89b41a5446a07aa
C:\c8993ca0f5ba5e01a93e6f1201bc217ddf82659b3a64ce5a929e980c169df372
C:\c1c784b0b49d3ea8651537477e227b0d4e34ccd66489f6dd69343a333cf32d88
C:\Users\admin\Downloads\hcbnaf.exe
c:\task\714A61FEA8E577DB19C47ECBFBF01149.exe
C:\950d7a531a15afa8442d4f2e4cb1b9ca25051677425cf42b4fee9068bd7081ff
C:\284206db2bcdbc8659138863b2ef11c64850cdff8c6f5ce01352086b3a505a0a
C:\Users\admin\Downloads\hcbnaf.exe
C:\e0e64229d21ba11b59d8c1e2cc36299bea4b211eac8a3f85b6f790b4c3ddf382
C:\6b71f5000b431b1729a7936c67af883cc607ac435b791e3cbe51cb163360a027
C:\5b5544df146baec5600ea6208f62428b28e0862443e7799478ea5e92ad86ab81
C:\Users\Petra\AppData\Local\Temp\hcbnaf.pe32
C:\Users\admin\Downloads\35fb3c3e2e7cddeb_hcbnaf.exe
C:\7f3117980d780d698102f11ef1514332349cbd837869350a92312826b4d376d7
C:\35ae886607d422b9aed9602b0d3356b8ac3b3ba5ed6469800fffdc81dc2d093a
C:\984159b66d7752a8f492076d432a894a2bba1f4ac83485a51ae7f4371eda293c
C:\0f6083ec27530a2718b33c06104d00cb597f8bb7baa0cfd0e1c20f199f01d350
C:\Users\Petra\AppData\Local\Temp\hcbnaf.pe32
C:\c573b7725b042acbdc488d0311fbcd776aead1de0276cfc35585559df8d3ec87
C:\Users\admin\Downloads\hcbnaf.exe
C:\Users\admin\Downloads\80df6fa36377316681403900cbdea26c884ef206c282683f41ef4f5319c0f6d7.exe
C:\Users\Petra\AppData\Local\Temp\hcbnaf.pe32
C:\Users\admin\Downloads\5deb7f410950755f_hcbnaf.exe
C:\13db81c12d142cf579938e76240056158a3b21a35fc6873cbc26d7045a3ea32b

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.