7.0
高危
52 个模型检测该样本为恶意！
重新分析
更多

8cd9ff6a88e32c22bc217df94c45075bc145f0263d0e151180fe9651d8826e57

ce30c86ce0159732627af4b34305f291.exe

分析耗时

20s

最近分析

文件大小

2.5MB
静态报毒 动态报毒 AI SCORE=88 AIDETECTVM ARTEMIS ATTRIBUTE BITWALL BSCOPE CCNC CONFIDENCE GENERIC@ML GQW@D8SDQDLI HIGH CONFIDENCE HIGHCONFIDENCE MALICIOUS PE MALWARE1 MALWARE@#1U6O1JSGM0GMG OCCAMY POSSIBLETHREAT PUIK QVM19 R06EH0CIA20 R336257 RDML SCORE SZUU THEMIDA TROJANX UNSAFE WACATAC WEX8CI4BKPTEDCFMVXKNQ XPACK 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Packed:Win32/Themida.c7af7247 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:TrojanX-gen [Trj] 20200921 18.4.3895.0
Tencent Win32.Trojan.Crypt.Szuu 20200921 1.0.0.1
Kingsoft 20200921 2013.8.14.323
McAfee Artemis!CE30C86CE015 20200921 6.0.6.653
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section
section .themida
section .boot
One or more processes crashed (4 个事件)
Time & API Arguments Status Return Repeated
1619933363.672126
__exception__
stacktrace: 
ce30c86ce0159732627af4b34305f291+0x373775 @ 0x1193775
ce30c86ce0159732627af4b34305f291+0x373fb3 @ 0x1193fb3

registers.esp: 3340452
registers.edi: 15044608
registers.eax: 3340452
registers.ebp: 3340532
registers.edx: 2130566132
registers.ebx: 3276843
registers.esi: 2010805291
registers.ecx: 3352625152
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008e
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1619933363.797126
__exception__
stacktrace: 

                
            
            
            

        
    
        
            
                registers.esp:
                3340572
                

            
                registers.edi:
                5713418
                

            
                registers.eax:
                1750617430
                

            
                registers.ebp:
                15044608
                

            
                registers.edx:
                22614
                

            
                registers.ebx:
                0
                

            
                registers.esi:
                13
                

            
                registers.ecx:
                20
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 db f9 00 00 c3 e9 01 a1 01 00 4c 83 2c 2a
                

            
                exception.symbol:
                ce30c86ce0159732627af4b34305f291+0x38f49a
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                ce30c86ce0159732627af4b34305f291.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                3732634
                

            
                exception.address:
                0x11af49a
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.797126

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                3340572
                

            
                registers.edi:
                5713418
                

            
                registers.eax:
                1447909480
                

            
                registers.ebp:
                15044608
                

            
                registers.edx:
                22104
                

            
                registers.ebx:
                2256917605
                

            
                registers.esi:
                13
                

            
                registers.ecx:
                10
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 36 4e 01 00 dd 07 6b 1b eb c3 f4 53 00 00
                

            
                exception.symbol:
                ce30c86ce0159732627af4b34305f291+0x39b8e7
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                ce30c86ce0159732627af4b34305f291.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                3782887
                

            
                exception.address:
                0x11bb8e7
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.844126

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    
WriteFile+0x4a WriteConsoleA-0x30 kernel32+0x112cc @ 0x763512cc
ce30c86ce0159732627af4b34305f291+0x719d @ 0xe2719d
ce30c86ce0159732627af4b34305f291+0x74b5 @ 0xe274b5
ce30c86ce0159732627af4b34305f291+0xdaff @ 0xe2daff
0x32f964

                
            
            
            

        
    
        
            
                registers.esp:
                3337080
                

            
                registers.edi:
                0
                

            
                registers.eax:
                554
                

            
                registers.ebp:
                3337136
                

            
                registers.edx:
                2130566132
                

            
                registers.ebx:
                172
                

            
                registers.esi:
                0
                

            
                registers.ecx:
                2240
                

            
        
    
        
            
                exception.instruction_r:
                89 07 eb c2 8b c8 81 e1 00 00 00 c0 81 f9 00 00
                

            
                exception.symbol:
                WriteFile+0x133 FlushFileBuffers-0x2e kernelbase+0xd252
                

            
                exception.instruction:
                mov dword ptr [edi], eax
                

            
                exception.module:
                KERNELBASE.dll
                

            
                exception.exception_code:
                0xc0000005
                

            
                exception.offset:
                53842
                

            
                exception.address:
                0x778ed252
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    

    

    

    

    

    

    

    

    

    

    








      

    


    

      

        行为判定
        
        
      

      

        



    

      
      动态指标
    

    

    
    

    

    
        
            

                Allocates read-write-execute memory (usually to unpack itself)
                
                    
                        (6 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619933363.734126

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2292
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77dcf000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.734126

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2292
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77d40000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.812126

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2292
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x00e4f000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.812126

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2292
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x00e47000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.812126

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2292
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x00e47000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.828126

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2292
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    40960
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x00e47000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Creates executable files on the filesystem
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            file
                            C:\ProgramData\pveutamgw\fjchsuw.bat
                            
                        

                    
                
            

        

    

    
        
            

                The binary likely contains encrypted or compressed data indicative of a packer
                
                    
                        (6 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    entropy
                                    7.981797543974462
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00013a00', 'virtual_address': '0x00001000', 'entropy': 7.981797543974462, 'name': '        ', 'virtual_size': '0x00025775'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.93113148173494
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00004000', 'virtual_address': '0x00027000', 'entropy': 7.93113148173494, 'name': '        ', 'virtual_size': '0x00009080'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.460188723957292
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00000200', 'virtual_address': '0x00031000', 'entropy': 7.460188723957292, 'name': '        ', 'virtual_size': '0x0000166c'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.6746043575288745
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00001800', 'virtual_address': '0x00035000', 'entropy': 7.6746043575288745, 'name': '        ', 'virtual_size': '0x00001940'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.951527870377958
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00268a00', 'virtual_address': '0x00421000', 'entropy': 7.951527870377958, 'name': '.boot', 'virtual_size': '0x00268a00'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    0.9992216384510605
                                
                            
                                
                            
                                
                                    description
                                    Overall entropy of this PE file is high
                                
                            
                        

                    
                
            

        

    

    

    

    

    

    

    

    

    







        



    

      
      网络通信
    

    


    

    

    

    

    

    
        
            

                Communicates with host for which no DNS query was performed
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    host
                                    172.217.24.14
                                
                            
                                
                            
                        

                    
                
            

        

    

    
        
            

                Attempts to identify installed AV products by installation directory
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            file
                            C:\ProgramData\AVAST Software
                            
                        

                    
                
                    
                        

                            file
                            C:\ProgramData\Avg
                            
                        

                    
                
            

        

    

    
        
            

                Checks for the presence of known windows from debuggers and forensic tools
                
                    
                        (11 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619933363.734126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    RegmonClass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.734126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    RegmonClass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.734126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Registry Monitor - Sysinternals: www.sysinternals.com
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.734126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    18467-41
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.797126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    FilemonClass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.797126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    FilemonClass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.797126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    File Monitor - Sysinternals: www.sysinternals.com
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.797126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    PROCMON_WINDOW_CLASS
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933363.797126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Process Monitor - Sysinternals: www.sysinternals.com
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933367.781126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619933367.781126

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Checks the version of Bios, possibly for anti-virtualization
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
                            
                        

                    
                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
                            
                        

                    
                
            

        

    

    
        
            

                Detects VirtualBox through the presence of a registry key
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            
                        

                    
                
            

        

    

    
        
            

                Detects Virtual Machines through their custom firmware
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619933363.797126

    NtQuerySystemInformation
    
        

        
            
        
    


    
        
            information_class:
            
                
                    76
                
            
            
                (SystemFirmwareTableInformation)
            
            

        
    


    
        failed
    

3221225507

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Detects VMWare through the in instruction feature
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619933363.797126

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                3340572
                

            
                registers.edi:
                5713418
                

            
                registers.eax:
                1447909480
                

            
                registers.ebp:
                15044608
                

            
                registers.edx:
                22104
                

            
                registers.ebx:
                2256917605
                

            
                registers.esi:
                13
                

            
                registers.ecx:
                10
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 36 4e 01 00 dd 07 6b 1b eb c3 f4 53 00 00
                

            
                exception.symbol:
                ce30c86ce0159732627af4b34305f291+0x39b8e7
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                ce30c86ce0159732627af4b34305f291.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                3782887
                

            
                exception.address:
                0x11bb8e7
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                File has been identified by 52 AntiVirus engines on VirusTotal as malicious
                
                    
                        (50 out of 52 个事件)
                    
                
            

        

        

            

                
                    
                        

                            Bkav
                            W32.AIDetectVM.malware1
                            
                        

                    
                
                    
                        

                            Elastic
                            malicious (high confidence)
                            
                        

                    
                
                    
                        

                            MicroWorld-eScan
                            Gen:Trojan.Heur.D.GQW@d8SdqDli
                            
                        

                    
                
                    
                        

                            CAT-QuickHeal
                            Trojan.Occamy
                            
                        

                    
                
                    
                        

                            Cylance
                            Unsafe
                            
                        

                    
                
                    
                        

                            Sangfor
                            Malware
                            
                        

                    
                
                    
                        

                            K7AntiVirus
                            Trojan ( 005663631 )
                            
                        

                    
                
                    
                        

                            Alibaba
                            Packed:Win32/Themida.c7af7247
                            
                        

                    
                
                    
                        

                            K7GW
                            Trojan ( 005663631 )
                            
                        

                    
                
                    
                        

                            CrowdStrike
                            win/malicious_confidence_90% (W)
                            
                        

                    
                
                    
                        

                            Cyren
                            W32/Trojan.PUIK-0917
                            
                        

                    
                
                    
                        

                            Symantec
                            ML.Attribute.HighConfidence
                            
                        

                    
                
                    
                        

                            APEX
                            Malicious
                            
                        

                    
                
                    
                        

                            Avast
                            Win32:TrojanX-gen [Trj]
                            
                        

                    
                
                    
                        

                            Cynet
                            Malicious (score: 100)
                            
                        

                    
                
                    
                        

                            BitDefender
                            Gen:Trojan.Heur.D.GQW@d8SdqDli
                            
                        

                    
                
                    
                        

                            NANO-Antivirus
                            Virus.Win32.Gen-Crypt.ccnc
                            
                        

                    
                
                    
                        

                            Paloalto
                            generic.ml
                            
                        

                    
                
                    
                        

                            Tencent
                            Win32.Trojan.Crypt.Szuu
                            
                        

                    
                
                    
                        

                            Ad-Aware
                            Gen:Trojan.Heur.D.GQW@d8SdqDli
                            
                        

                    
                
                    
                        

                            Comodo
                            Malware@#1u6o1jsgm0gmg
                            
                        

                    
                
                    
                        

                            F-Secure
                            Trojan.TR/Crypt.XPACK.Gen
                            
                        

                    
                
                    
                        

                            DrWeb
                            Trojan.PWS.Stealer.28405
                            
                        

                    
                
                    
                        

                            VIPRE
                            Trojan.Win32.Generic!BT
                            
                        

                    
                
                    
                        

                            Invincea
                            Mal/Generic-S
                            
                        

                    
                
                    
                        

                            FireEye
                            Generic.mg.ce30c86ce0159732
                            
                        

                    
                
                    
                        

                            Sophos
                            Mal/Generic-S
                            
                        

                    
                
                    
                        

                            Ikarus
                            Trojan.Win32.Themida
                            
                        

                    
                
                    
                        

                            GData
                            Gen:Trojan.Heur.D.GQW@d8SdqDli
                            
                        

                    
                
                    
                        

                            Webroot
                            W32.Trojan.Gen
                            
                        

                    
                
                    
                        

                            Avira
                            TR/Crypt.XPACK.Gen
                            
                        

                    
                
                    
                        

                            Antiy-AVL
                            Trojan/Win32.Wacatac
                            
                        

                    
                
                    
                        

                            Arcabit
                            Trojan.Heur.D.E0C398
                            
                        

                    
                
                    
                        

                            AegisLab
                            Trojan.Win32.Malicious.4!c
                            
                        

                    
                
                    
                        

                            Microsoft
                            Trojan:Win32/Occamy.AA
                            
                        

                    
                
                    
                        

                            AhnLab-V3
                            Trojan/Win32.Agent.R336257
                            
                        

                    
                
                    
                        

                            Acronis
                            suspicious
                            
                        

                    
                
                    
                        

                            McAfee
                            Artemis!CE30C86CE015
                            
                        

                    
                
                    
                        

                            MAX
                            malware (ai score=88)
                            
                        

                    
                
                    
                        

                            VBA32
                            BScope.TrojanSpy.BitWall
                            
                        

                    
                
                    
                        

                            Malwarebytes
                            Trojan.MalPack.Themida.Generic
                            
                        

                    
                
                    
                        

                            ESET-NOD32
                            a variant of Win32/Packed.Themida.HLN
                            
                        

                    
                
                    
                        

                            TrendMicro-HouseCall
                            TROJ_GEN.R06EH0CIA20
                            
                        

                    
                
                    
                        

                            Rising
                            Trojan.Generic@ML.100 (RDML:/WEX8cI4bKPTedcfMVXKNQ)
                            
                        

                    
                
                    
                        

                            Yandex
                            Trojan.Themida!
                            
                        

                    
                
                    
                        

                            SentinelOne
                            DFI - Malicious PE
                            
                        

                    
                
                    
                        

                            eGambit
                            Unsafe.AI_Score_91%
                            
                        

                    
                
                    
                        

                            Fortinet
                            W32/PossibleThreat
                            
                        

                    
                
                    
                        

                            BitDefenderTheta
                            AI:Packer.2BC380441E
                            
                        

                    
                
                    
                        

                            AVG
                            Win32:TrojanX-gen [Trj]
                            
                        

                    
                
            

        

    






      


    


    

      

        可视化分析
        
        
      

      

        


    

      
      二进制图像
    

    
        

            

                
                

                    暂无二进制图像
                    该样本未生成二进制可视化图像
                

            

        

    





        

    

      
      运行截图
    

    
        

            

                
                

                    暂无运行截图
                    该样本运行过程中未生成截图
                

            

        

    





      


    


  



    

    

        





    

        

            
👋 欢迎使用 ChatHawk

            
我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

            

                
🔍 主要威胁分析

                
⚡ 行为特征

                
🛡️ 防护建议

                
🔧 技术手段

                
🎯 检测方法

            

        

    

    

        

            
🤖

            

                

                

                

            

        

    

    

        
        
    








    

    

        

    
    

        

            
                

    
        
            

                
 PE Compile Time

                
2020-05-05 03:59:34

            

            

        
        
        
        
        
        
        

        

        
            

                
Imports

                

                    
                        

                            
Library kernel32.dll:

                            
                                
• 0x437138 GetModuleHandleA

                            
                        

                    
                        

                            
Library USER32.dll:

                            
                                
• 0x437140 wsprintfW

                            
                        

                    
                        

                            
Library ADVAPI32.dll:

                            
                                
• 0x437148 GetUserNameW

                            
                        

                    
                        

                            
Library SHELL32.dll:

                            
                                
• 0x437150 ShellExecuteW

                            
                        

                    
                        

                            
Library urlmon.dll:

                            
                                
• 0x437158 URLDownloadToFileA

                            
                        

                    
                        

                            
Library WININET.dll:

                            
                                
• 0x437160 InternetOpenW

                            
                        

                    
                

            

            

        

        
    



            
        

        

            

    

        
    



        

    



    

    
    

        

    
    

        

    
Hosts

    
        
No hosts contacted.

    




        
        





    
TCP

    
        
No TCP connections recorded.

    





        





    
UDP

    
        

            

                

                    

                        Source
                        Source Port
                        Destination
                        Destination Port
                    

                    
                        

                            192.168.56.101
                            49235
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            50534
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            56539
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            58367
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            65004
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            137
                            192.168.56.255 
                            137
                        

                    
                        

                            192.168.56.101
                            138
                            192.168.56.255 
                            138
                        

                    
                        

                            192.168.56.101
                            123
                            20.189.79.72 time.windows.com
                            123
                        

                    
                        

                            192.168.56.101
                            51963
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            55368
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            56804
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            62191
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            1900
                            239.255.255.250 
                            1900
                        

                    
                        

                            192.168.56.101
                            56807
                            239.255.255.250 
                            1900
                        

                    
                        

                            192.168.56.101
                            58368
                            239.255.255.250 
                            3702
                        

                    
                        

                            192.168.56.101
                            58370
                            239.255.255.250 
                            3702
                        

                    
                        

                            192.168.56.101
                            58707
                            239.255.255.250 
                            3702
                        

                    
                        

                            192.168.56.101
                            62192
                            239.255.255.250 
                            3702
                        

                    
                

            

            

        

    




        



HTTP & HTTPS Requests



No HTTP requests performed.




        
ICMP traffic



No ICMP traffic performed.



        
IRC traffic



No IRC requests performed.



        
Suricata Alerts


    
No Suricata Alerts




Suricata TLS


    
No Suricata TLS




        
Snort Alerts


    
No Snort Alerts




    




    

    

        
    
Sorry! No dropped files.



    

    

        
    
Sorry! No dropped buffers.