6.4
高危
10 个模型检测该样本为恶意！
重新分析
更多

0bd4f1a24c1b7efca246ddc398523a66eaaa2e7c8119c9aa92eb87c057b690a6

d5a87b91eeeec64e6f7b2d979286d616.exe

分析耗时

79s

最近分析

文件大小

292.0KB
静态报毒 动态报毒 ELDORADO SCORE STASER UNSAFE UNWANTEDSIG
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20200815 6.0.6.653
Alibaba 20190527 0.3.0.5
CrowdStrike 20190702 1.0
Avast Win32:UnwantedSig [PUP] 20200815 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200816 2013.8.14.323
Tencent 20200816 1.0.0.1
静态指标
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path c:\GamingX\Develop\Installer\3.7.x.x\OUT_FILES\Release\Intermediate Files\Installer_newSocket\Installer.pdb
行为判定
动态指标
Performs some HTTP requests (3 个事件)
request GET http://www.pacificpoker.com/clientip.htm
request GET http://setupspoker.images4us.com/setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/text.txt
request GET http://setupspoker.images4us.com/setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/installer.gif
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1620899431.777249
NtProtectVirtualMemory
process_identifier: 1436
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75091000
success 0 0
1620899431.824249
NtProtectVirtualMemory
process_identifier: 1436
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75071000
success 0 0
1620899431.886249
NtProtectVirtualMemory
process_identifier: 1436
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75051000
success 0 0
1620899431.886249
NtProtectVirtualMemory
process_identifier: 1436
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75011000
success 0 0
1620899431.949249
NtProtectVirtualMemory
process_identifier: 1436
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75001000
success 0 0
1620899432.933249
NtProtectVirtualMemory
process_identifier: 1436
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74511000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620899432.949249
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 142.44.137.67
host 172.217.24.14
File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 个事件)
VIPRE Trojan.Win32.Generic!BT
F-Prot W32/S-f05d0216!Eldorado
Avast Win32:UnwantedSig [PUP]
Invincea heuristic
Ikarus Trojan-Dropper.Win32.Generic
Cyren W32/S-f05d0216!Eldorado
VBA32 suspected of Trojan.Downloader.gen.h
Yandex Trojan.Staser!
eGambit Unsafe.AI_Score_70%
AVG Win32:UnwantedSig [PUP]
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1620899435.527249
RegSetValueExA
key_handle: 0x00000404
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620899435.527249
RegSetValueExA
key_handle: 0x00000404
value: pè° ÚG×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620899435.527249
RegSetValueExA
key_handle: 0x00000404
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620899435.527249
RegSetValueExW
key_handle: 0x00000404
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620899435.527249
RegSetValueExA
key_handle: 0x00000430
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620899435.527249
RegSetValueExA
key_handle: 0x00000430
value: pè° ÚG×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620899435.527249
RegSetValueExA
key_handle: 0x00000430
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620899435.558249
RegSetValueExW
key_handle: 0x000003fc
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Network activity contains more than one unique useragent (2 个事件)
process d5a87b91eeeec64e6f7b2d979286d616.exe useragent RLMultySocket
process d5a87b91eeeec64e6f7b2d979286d616.exe useragent Internal
Generates some ICMP traffic
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 个事件)
dead_host 192.168.56.101:49199
dead_host 192.168.56.101:49201
dead_host 192.168.56.101:49200
dead_host 192.168.56.101:49178
dead_host 91.109.250.163:80
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-07-08 16:57:50

Imports

Library VERSION.dll:
• 0x43b324 GetFileVersionInfoA
• 0x43b32c VerQueryValueA
Library WININET.dll:
• 0x43b334 InternetOpenA
• 0x43b338 InternetConnectA
• 0x43b33c InternetCloseHandle
• 0x43b348 InternetReadFile
• 0x43b34c HttpOpenRequestA
• 0x43b350 InternetSetOptionA
• 0x43b354 HttpSendRequestA
• 0x43b358 HttpQueryInfoA
• 0x43b360 InternetCrackUrlA
Library KERNEL32.dll:
• 0x43b060 WaitForSingleObject
• 0x43b064 MulDiv
• 0x43b068 SetEvent
• 0x43b070 CreateMutexA
• 0x43b074 CreateEventA
• 0x43b078 CloseHandle
• 0x43b07c GlobalMemoryStatus
• 0x43b080 GetVersionExA
• 0x43b084 GetVersion
• 0x43b094 CreateSemaphoreA
• 0x43b098 CreateProcessA
• 0x43b09c DeleteFileA
• 0x43b0a4 TerminateThread
• 0x43b0a8 GetModuleFileNameA
• 0x43b0b0 CreateThread
• 0x43b0b4 GetTickCount
• 0x43b0b8 GetExitCodeProcess
• 0x43b0bc Sleep
• 0x43b0c0 ReleaseMutex
• 0x43b0c4 ReleaseSemaphore
• 0x43b0c8 GetSystemTime
• 0x43b0cc GetTempPathA
• 0x43b0d4 MultiByteToWideChar
• 0x43b0d8 CreateFileA
• 0x43b0dc GetFileSize
• 0x43b0e0 ReadFile
• 0x43b0e4 WriteFile
• 0x43b0e8 CopyFileA
• 0x43b0f0 SetFilePointer
• 0x43b0f4 GlobalFree
• 0x43b0f8 GlobalSize
• 0x43b0fc GlobalUnlock
• 0x43b100 GlobalLock
• 0x43b104 GlobalAlloc
• 0x43b108 LocalAlloc
• 0x43b10c FlushFileBuffers
• 0x43b114 GetConsoleCP
• 0x43b118 FatalAppExitA
• 0x43b120 GetCurrentProcessId
• 0x43b128 VirtualFree
• 0x43b12c HeapCreate
• 0x43b130 HeapDestroy
• 0x43b134 GetFileType
• 0x43b138 SetHandleCount
• 0x43b140 WideCharToMultiByte
• 0x43b150 GetStdHandle
• 0x43b154 ExitProcess
• 0x43b158 HeapSize
• 0x43b15c GetCurrentThread
• 0x43b160 GetCurrentThreadId
• 0x43b164 SetLastError
• 0x43b168 TlsFree
• 0x43b16c TlsSetValue
• 0x43b170 TlsAlloc
• 0x43b174 TlsGetValue
• 0x43b178 IsValidCodePage
• 0x43b17c GetOEMCP
• 0x43b180 GetACP
• 0x43b18c VirtualAlloc
• 0x43b190 GetCPInfo
• 0x43b194 RemoveDirectoryA
• 0x43b19c GetLocalTime
• 0x43b1a0 GetFullPathNameA
• 0x43b1a4 GetDriveTypeA
• 0x43b1a8 CreateDirectoryA
• 0x43b1ac GetStartupInfoA
• 0x43b1b0 GetProcessHeap
• 0x43b1b4 HeapAlloc
• 0x43b1b8 HeapFree
• 0x43b1bc GetCommandLineA
• 0x43b1c0 RaiseException
• 0x43b1c4 IsDebuggerPresent
• 0x43b1c8 FormatMessageA
• 0x43b1cc LocalFree
• 0x43b1d0 GetModuleHandleA
• 0x43b1d4 GetProcAddress
• 0x43b1d8 GetCurrentProcess
• 0x43b1dc GetLastError
• 0x43b1e0 GetUserDefaultLCID
• 0x43b1e4 GetLocaleInfoA
• 0x43b1e8 EnumSystemLocalesA
• 0x43b1ec IsValidLocale
• 0x43b1f4 FreeLibrary
• 0x43b1f8 InterlockedExchange
• 0x43b1fc LoadLibraryA
• 0x43b200 SetStdHandle
• 0x43b204 WriteConsoleA
• 0x43b208 WriteConsoleW
• 0x43b20c GetConsoleOutputCP
• 0x43b210 GetLocaleInfoW
• 0x43b214 SetEndOfFile
• 0x43b218 CompareStringA
• 0x43b21c CompareStringW
• 0x43b220 GetConsoleMode
• 0x43b230 TerminateProcess
• 0x43b234 GetDateFormatA
• 0x43b238 GetTimeFormatA
• 0x43b23c GetStringTypeW
• 0x43b240 GetStringTypeA
• 0x43b244 LCMapStringW
• 0x43b248 LCMapStringA
• 0x43b24c HeapReAlloc
• 0x43b250 RtlUnwind
Library USER32.dll:
• 0x43b268 IsWindow
• 0x43b26c IsRectEmpty
• 0x43b270 IntersectRect
• 0x43b274 UnionRect
• 0x43b278 PtInRect
• 0x43b27c SendDlgItemMessageA
• 0x43b280 DrawTextA
• 0x43b284 InvalidateRect
• 0x43b288 UpdateWindow
• 0x43b28c SetDlgItemTextA
• 0x43b290 KillTimer
• 0x43b294 SetTimer
• 0x43b298 GetSystemMetrics
• 0x43b29c PostMessageA
• 0x43b2a0 EndDialog
• 0x43b2a4 DestroyWindow
• 0x43b2a8 MessageBoxIndirectA
• 0x43b2ac GetDlgItem
• 0x43b2b0 EnableWindow
• 0x43b2b4 DefWindowProcA
• 0x43b2b8 ShowWindow
• 0x43b2bc SetWindowTextA
• 0x43b2c0 GetWindowRect
• 0x43b2c4 ScreenToClient
• 0x43b2c8 CreateWindowExA
• 0x43b2cc GetDC
• 0x43b2d0 ReleaseDC
• 0x43b2d4 GetClientRect
• 0x43b2d8 FillRect
• 0x43b2dc EndPaint
• 0x43b2e0 PostQuitMessage
• 0x43b2e4 SetFocus
• 0x43b2e8 FindWindowA
• 0x43b2ec MessageBoxA
• 0x43b2f0 SetForegroundWindow
• 0x43b2f4 GetClassInfoExA
• 0x43b2f8 DialogBoxParamA
• 0x43b2fc LoadIconA
• 0x43b300 LoadCursorA
• 0x43b304 RegisterClassExA
• 0x43b308 LoadAcceleratorsA
• 0x43b30c GetMessageA
• 0x43b314 TranslateMessage
• 0x43b318 DispatchMessageA
• 0x43b31c SendMessageA
Library GDI32.dll:
• 0x43b018 CreateDIBitmap
• 0x43b01c DeleteDC
• 0x43b020 GetBkColor
• 0x43b024 SetBkMode
• 0x43b028 SetTextColor
• 0x43b02c SetMapMode
• 0x43b030 SetBkColor
• 0x43b034 GetObjectA
• 0x43b038 GetDeviceCaps
• 0x43b03c CreateFontIndirectA
• 0x43b040 SelectObject
• 0x43b044 CreateCompatibleDC
• 0x43b04c BitBlt
• 0x43b050 CreateSolidBrush
• 0x43b054 DeleteObject
• 0x43b058 CreateBitmap
Library ADVAPI32.dll:
• 0x43b000 RegSetValueExA
• 0x43b004 RegCloseKey
• 0x43b008 RegOpenKeyExA
• 0x43b00c RegQueryValueExA
• 0x43b010 RegCreateKeyExA
Library SHELL32.dll:
• 0x43b25c ShellExecuteExA
• 0x43b260 ShellExecuteA
Library ole32.dll:
• 0x43b37c CoCreateGuid
Library WSOCK32.dll:
• 0x43b368 WSAStartup
• 0x43b36c inet_addr
• 0x43b370 gethostbyname
• 0x43b374 gethostname

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49180 111.119.27.74 setupspoker.images4us.com 80
192.168.56.101 49178 91.109.249.23 www.pacificpoker.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

URI Data
http://setupspoker.images4us.com/setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/installer.gif 
GET /setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/installer.gif HTTP/1.1
User-Agent: RLMultySocket
Host: setupspoker.images4us.com
Connection: Keep-Alive
http://setupspoker.images4us.com/setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/text.txt 
GET /setups/888PokerUSA/EN/p-62-en-0-6.9-0/11/SetupFiles/GIB/SDL/text.txt HTTP/1.1
User-Agent: RLMultySocket
Host: setupspoker.images4us.com
Connection: Keep-Alive
http://www.pacificpoker.com/clientip.htm 
GET /clientip.htm HTTP/1.1
User-Agent: RLMultySocket
Host: www.pacificpoker.com
Connection: Keep-Alive

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.