0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.48
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:DropperX-gen [Drp] | 20200501 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200503 | 2013.8.14.323 |
| McAfee | GenericRXIJ-HU!D463E5177235 | 20200503 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b3b28c | 20200503 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意
(50 out of 59 个事件)
| ALYac | Trojan.Agent.CZGU |
| APEX | Malicious |
| AVG | Win32:DropperX-gen [Drp] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Agent.CZGU |
| AhnLab-V3 | Dropper/Win32.Daws.R263169 |
| Antiy-AVL | Trojan/Win32.TSGeneric |
| Arcabit | Trojan.Agent.CZGU |
| Avast | Win32:DropperX-gen [Drp] |
| Avira | TR/Dropper.Gen |
| BitDefender | Trojan.Agent.CZGU |
| BitDefenderTheta | AI:Packer.F15589581F |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Trojan.VBCrypt.MF.48 |
| Comodo | Worm.Win32.VBNA.~gen@1qlvkj |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.772356 |
| Cylance | Unsafe |
| Cyren | W32/VB_Troj.L.gen!Eldorado |
| DrWeb | Trojan.Siggen4.20010 |
| ESET-NOD32 | Win32/VB.QMS |
| Emsisoft | Trojan.Agent.CZGU (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/VB_Troj.L.gen!Eldorado |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.d463e51772356e3d |
| Fortinet | W32/Daws.EHPN!tr |
| GData | Trojan.Agent.CZGU |
| Ikarus | Trojan.Win32.VB |
| Invincea | heuristic |
| Jiangmin | Worm/VBNA.hgjr |
| K7AntiVirus | P2PWorm ( 003a85bd1 ) |
| K7GW | P2PWorm ( 003a85bd1 ) |
| Kaspersky | Trojan-Dropper.Win32.Daws.ehpn |
| MAX | malware (ai score=87) |
| Malwarebytes | Trojan.AutoRun |
| MaxSecure | Trojan.Malware.10576875.susgen |
| McAfee | GenericRXIJ-HU!D463E5177235 |
| McAfee-GW-Edition | GenericRXIJ-HU!D463E5177235 |
| MicroWorld-eScan | Trojan.Agent.CZGU |
| Microsoft | Trojan:Win32/Wacatac.D!ml |
| NANO-Antivirus | Trojan.Win32.VB.eljjgx |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM03.0.F8BC.Malware.Gen |
| Rising | Dropper.Generic!8.35E (TFE:dGZlOgNDwaAI9ctsIw) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/VB-AQV |
| Symantec | ML.Attribute.HighConfidence |
| TACHYON | Trojan-Dropper/W32.VB-Daws.57346 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2012-05-19 06:40:52
PE Imphash
3dcbc7d0ae83594aee771cb6c6621c0f
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00003a08 | 0x00004000 | 4.404431912428191 |
| .data | 0x00005000 | 0x00000c58 | 0x00000000 | 0.0 |
| .rsrc | 0x00006000 | 0x000008f3 | 0x00001000 | 1.9499700427601814 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000065b0 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x000065b0 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x000065b0 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x000066d8 | 0x00000030 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00006708 | 0x000001c0 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DLGINCLUDE | 0x000068c8 | 0x0000002b | LANG_ICELANDIC | SUBLANG_DEFAULT | None |
Imports
Library MSVBVM60.DLL:
• 0x401000 None
• 0x401004 None
• 0x401008 MethCallEngine
• 0x40100c None
• 0x401010 None
• 0x401014 None
• 0x401018 None
• 0x40101c None
• 0x401020 None
• 0x401024 EVENT_SINK_AddRef
• 0x401028 None
• 0x40102c DllFunctionCall
• 0x401030 EVENT_SINK_Release
• 0x401034 EVENT_SINK_QueryInterface
• 0x401038 __vbaExceptHandler
• 0x40103c None
• 0x401040 None
• 0x401044 None
• 0x401048 None
• 0x40104c ProcCallEngine
• 0x401050 None
• 0x401054 None
• 0x401058 None
• 0x40105c None
• 0x401060 None
• 0x401064 None
L!This program cannot be run in DOS mode.
iiidiRichi
`.data
CRITIC
jpJ3jXJ"
&Aw[+v
Timer1
jpJ3jXJ
VB5!6&*
CRITIC
CRITIC
f=3dH@
Module1
ReWriteREG
WriteMe
DetectWindows
CRITIC
Timer1
ExitProcess
advapi32.dll
AdjustTokenPrivileges
advapi32
LookupPrivilegeValueA
kernel32
GetCurrentProcess
OpenProcessToken
ntdll.dll
NtSetInformationProcess
VBA6.DLL
&Aw[+v
*{[A&NKsjpJ3jXJ
o=S:O3f
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
GetExitCodeProcess
GetVersionExA
shell32.dll
ShellExecuteEx
WaitForSingleObject
CloseHandle
GetModuleFileNameW
lz32.dll
LZClose
LZCopy
LZOpenFileW
shlwapi
PathFileExistsW
PathIsDirectoryW
shell32
SHCreateDirectoryExW
+3q"=h
qp<lplt^
ql<llR
qp<lplt^
ql<llR
i0*#&@
*#4lp*#0@i *#&@
lltJdd
lllpJi4lllpJ
#x*1x2
1l/H5\
*F\%(8
qH<lHqt/L
qP<lPqplplt^
q$<l$q,
q$<l$q(
tXl$q(/
pzlhql
#Xlx*1t2
*#\lh*#X
*#Llh*#H
*#<lh*#8
*#4lp*#0
*#,lh*#(
*# ld*#
*#lh*#
\XTPLHD@<840,($
D`1x5D
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
xplorer*1*|ON|*windir*xplorer\*xplorer.exe*
eaqxhenbcfae
S e C r e a t e T o k e n P r i v i l e g e
S e A s s i g n P r i m a r y T o k e n P r i v i l e g e
S e L o c k M e m o r y P r i v i l e g e
S e I n c r e a s e Q u o t a P r i v i l e g e
S e U n s o l i c i t e d I n p u t P r i v i l e g e
c o p y f i l e
S e M a c h i n e A c c o u n t P r i v i l e g e
S e T c b P r i v i l e g e
S e S e c u r i t y P r i v i l e g e
S e T a k e O w n e r s h i p P r i v i l e g e
S e L o a d D r i v e r P r i v i l e g e
S e S y s t e m P r o f i l e P r i v i l e g e
S e S y s t e m t i m e P r i v i l e g e
S e P r o f i l e S i n g l e P r o c e s s P r i v i l e g e
S e C h a n g e N o t i f y P r i v i l e g e
S e I n c r e a s e B a s e P r i o r i t y P r i v i l e g e
S e C r e a t e P a g e f i l e P r i v i l e g e
S e C r e a t e P e r m a n e n t P r i v i l e g e
S e B a c k u p P r i v i l e g e
S e R e s t o r e P r i v i l e g e
S e S h u t d o w n P r i v i l e g e
S e D e b u g P r i v i l e g e
S e A u d i t P r i v i l e g e
S e S y s t e m E n v i r o n m e n t P r i v i l e g e
S e R e m o t e S h u t d o w n P r i v i l e g e
H K C U \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n \
W r i t e L i n e
H K L M \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n \
H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ W i n l o g o n \ S h e l l
H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m \ E n a b l e L U A
W S c r i p t . S h e l l
R e g R e a d
e x p l o r e r . e x e
H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ S y s t e m
H K C U \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n
H K L M \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n
H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ W i n l o g o n
S c r i p t i n g . F i l e S y s t e m O b j e c t
O p e n T e x t F i l e
R E G _ D W O R D
E n a b l e L U A
R E G _ S Z
E x p l o r e r . e x e ,
R E G A D D
V S _ V E R S I O N _ I N F O
V a r F i l e I n f o
T r a n s l a t i o n
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
P r o d u c t N a m e
C R I T I C
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
O r i g i n a l F i l e n a m e
\ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \
\ 0 0 2 2 7 1 e c c 5 8 5 9 0 e 9 d c a c 1 8 7 f c 5 b 5 b d 8 6 . e x e . M a n i f e s t
: \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \
\ 0 0 2 2 7 1 e c c 5 8 5 9 0 e 9 d c a c 1 8 7 f c 5 b 5 b d 8 6 . e x e . C o n f i g
: \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \
0 2 2 7 1 e c c 5 8 5 9 0 e 9 d c a c 1 8 7 f c 5 b 5 b d 8 6 . e x e
? ? \ C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \
\ 0 0 2 2 7 1 e c c 5 8 5 9 0 e 9 d c a c 1 8 7 f c 5 b 5 b d 8 6 . e x e . M a n i f e s t
? ? \ C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \
\ 0 0 2 2 7 1 e c c 5 8 5 9 0 e 9 d c a c 1 8 7 f c 5 b 5 b d 8 6 . e x e . C o n f i g
: \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \
\ 0 0 2 2 7 1 e c c 5 8 5 9 0 e 9 d c a c 1 8 7 f c 5 b 5 b d 8 6 . e x e "
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.