5.6
高危
57 个模型检测该样本为恶意！
重新分析
更多

846481e2b8fa290c2cb12b0c8803305435c9833c4c791f3d4d989db6f51838c5

d10b9c01f51776dcea6d7d5bfbe41223.exe

分析耗时

91s

最近分析

文件大小

744.5KB
静态报毒 动态报毒 AI SCORE=80 AIDETECTVM ATTRIBUTE BSCOPE CE@1FHKGA CLIPBANKER CLOUD CONFIDENCE EAIMW HIGH CONFIDENCE HIGHCONFIDENCE HMITCM KRXW MALREP MALWARE1 MULDROP13 OCCAMY POSSIBLETHREAT R340877 SCORE SCROP SUSPICIOUS PE THFADBO TROJANBANKER TROJANX UNSAFE URSU UY0@A47CAUOI VIRUT VMPROTECT WMSH ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee RDN/Generic.grp 20200811 6.0.6.653
Alibaba TrojanBanker:Win32/ClipBanker.a7dbc579 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:TrojanX-gen [Trj] 20200811 18.4.3895.0
Kingsoft 20200811 2013.8.14.323
Tencent Win32.Trojan-banker.Clipbanker.Wmsh 20200811 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
Queries for the computername (3 个事件)
Time & API Arguments Status Return Repeated
1619910856.819633
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619910856.819633
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619910856.991633
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619943936.430249
IsDebuggerPresent
failed 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619910854.959633
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)
section .vmp0
section .vmp1
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 129 个事件)
Time & API Arguments Status Return Repeated
1619910854.522633
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 90112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00401000
success 0 0
1619910854.803633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77ec0000
success 0 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77930000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77940000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77950000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77960000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77970000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77980000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77990000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x779a0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x779b0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x779c0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x779d0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x779e0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x779f0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a00000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a10000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a20000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a30000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a40000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a50000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a60000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a70000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a80000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77a90000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77aa0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77ab0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77ac0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77ad0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77ae0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77af0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b00000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b10000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b20000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b30000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b40000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b50000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b60000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b70000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b80000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77b90000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77ba0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77bb0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77bc0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77bd0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77be0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77bf0000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77c00000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77c10000
failed 3221225496 0
1619910854.819633
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x77c20000
failed 3221225496 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk
Creates a shortcut to an executable file (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.985978472853376 section {'size_of_data': '0x000b2c00', 'virtual_address': '0x000c6000', 'entropy': 7.985978472853376, 'name': '.vmp1', 'virtual_size': '0x000b2a2c'} description A section with a high entropy has been found
entropy 0.9616677874915938 description Overall entropy of this PE file is high
The executable is likely packed with VMProtect (2 个事件)
section .vmp0 description Section name indicates VMProtect
section .vmp1 description Section name indicates VMProtect
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ursu.904612
FireEye Generic.mg.d10b9c01f51776dc
CAT-QuickHeal Trojan.Multi
McAfee RDN/Generic.grp
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 00569ece1 )
Alibaba TrojanBanker:Win32/ClipBanker.a7dbc579
K7GW Trojan ( 00569ece1 )
Cybereason malicious.0ac8c1
TrendMicro Trojan.Win32.MALREP.THFADBO
Cyren W32/Trojan.KRXW-3908
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
GData Gen:Variant.Ursu.904612
Kaspersky Trojan-Banker.Win32.ClipBanker.lsu
BitDefender Gen:Variant.Ursu.904612
NANO-Antivirus Trojan.Win32.Ursu.hmitcm
Paloalto generic.ml
AegisLab Trojan.Win32.ClipBanker.7!c
Rising Trojan.Occamy!8.F1CD (CLOUD)
Ad-Aware Gen:Variant.Ursu.904612
Emsisoft Gen:Variant.Ursu.904612 (B)
Comodo Virus.Win32.Virut.CE@1fhkga
F-Secure Trojan.TR/Spy.Banker.eaimw
DrWeb Trojan.MulDrop13.2042
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Sophos Mal/Generic-S
SentinelOne DFI - Suspicious PE
Jiangmin Trojan.Banker.ClipBanker.aln
Webroot W32.Trojan.Gen
Avira TR/Spy.Banker.eaimw
Antiy-AVL Trojan[Banker]/Win32.ClipBanker
Arcabit Trojan.Ursu.DDCDA4
ZoneAlarm Trojan-Banker.Win32.ClipBanker.lsu
Microsoft Trojan:Win32/Occamy.C84
Cynet Malicious (score: 85)
AhnLab-V3 Malware/Win32.RL_Generic.R340877
BitDefenderTheta Gen:NN.ZexaF.34152.Uy0@a47Cauoi
ALYac Gen:Variant.Ursu.904612
MAX malware (ai score=80)
VBA32 BScope.TrojanDropper.Scrop
Malwarebytes Trojan.Dropper
ESET-NOD32 a variant of Win32/Packed.VMProtect.SA
TrendMicro-HouseCall Trojan.Win32.MALREP.THFADBO
Tencent Win32.Trojan-banker.Clipbanker.Wmsh
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-03-15 02:59:56

Imports

Library KERNEL32.dll:
Library SHELL32.dll:
Library USER32.dll:
Library ole32.dll:
• 0x4e4018 CoUninitialize
Library OLEAUT32.dll:
• 0x4e4020 SysFreeString
Library KERNEL32.dll:
• 0x4e4028 GetModuleFileNameW
Library KERNEL32.dll:
• 0x4e4030 GetModuleHandleA
• 0x4e4034 LoadLibraryA
• 0x4e4038 LocalAlloc
• 0x4e403c LocalFree
• 0x4e4040 GetModuleFileNameA
• 0x4e4044 ExitProcess

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.