1.5
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.56
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200304 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_90% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200304 | 2013.8.14.323 |
| McAfee | Artemis!D7783CCE71C2 | 20200304 | 6.0.6.653 |
| Tencent | Trojan.Win32.OnlineGames.ble | 20200304 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x0000b000', 'virtual_size': '0x00003000', 'size_of_data': '0x00002600', 'entropy': 7.71227578446463} | entropy | 7.71227578446463 | description | 发现高熵的节 | |||||||||
| entropy | 0.95 | description | 此PE文件的整体熵值较高 | |||||||||||
重复搜索未找到的进程，您可能希望在分析期间运行一个网络浏览器
(50 out of 585 个事件)
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Gen:Variant.Graftor.13405 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Graftor.13405 |
| AhnLab-V3 | Dropper/OnlineGameHack18.Gen |
| Antiy-AVL | Trojan[GameThief]/Win32.OnLineGames |
| Arcabit | Trojan.Graftor.D345D |
| Avast | Win32:Malware-gen |
| Avira | TR/Crypt.XDR.Gen |
| BitDefender | Gen:Variant.Graftor.13405 |
| BitDefenderTheta | AI:Packer.C32F516A1F |
| Bkav | W32.BetrapilM.Trojan |
| CMC | Trojan-GameThief.Win32!O |
| ClamAV | Win.Trojan.Onlinegames-378 |
| Comodo | TrojWare.Win32.PSW.GamePass.QNKB@4pc2ss |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Cybereason | malicious.e71c29 |
| Cylance | Unsafe |
| Cyren | W32/OnlineGames.HY.gen!Eldorado |
| DrWeb | Trojan.PWS.Wsgame.33110 |
| ESET-NOD32 | a variant of Win32/PSW.OnLineGames.QNK |
| Emsisoft | Gen:Variant.Graftor.13405 (B) |
| Endgame | malicious (moderate confidence) |
| F-Prot | W32/OnlineGames.HY.gen!Eldorado |
| F-Secure | Trojan.TR/Crypt.XDR.Gen |
| FireEye | Generic.mg.d7783cce71c29d80 |
| Fortinet | W32/OnlineGames.QNK!tr.pws |
| GData | Gen:Variant.Graftor.13405 |
| Ikarus | Trojan.Win32.ProcessHijack |
| Invincea | heuristic |
| Jiangmin | Trojan/PSW.OnLineGames.ckpq |
| K7AntiVirus | Password-Stealer ( 0055e3dc1 ) |
| K7GW | Password-Stealer ( 0055e3dc1 ) |
| Kaspersky | Trojan-GameThief.Win32.OnLineGames.bohv |
| MAX | malware (ai score=86) |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfee | Artemis!D7783CCE71C2 |
| McAfee-GW-Edition | BehavesLike.Win32.Dialer.lc |
| MicroWorld-eScan | Gen:Variant.Graftor.13405 |
| Microsoft | Trojan:Win32/Wacatac.C!ml |
| NANO-Antivirus | Trojan.Win32.XDR.gqlou |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Win32/Trojan.BO.a3e |
| Rising | Stealer.OnLineGames!8.131 (RDMK:cmRtazrvLMWj44C/aB7sbgBIbuDo) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Generic-S |
| Symantec | Trojan.Dropper |
| Tencent | Trojan.Win32.OnlineGames.ble |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1992-06-20 06:22:17
PE Imphash
4f43042a3736e4479bef76fdfaced5e6
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x0000a000 | 0x00000000 | 0.0 |
| UPX1 | 0x0000b000 | 0x00003000 | 0x00002600 | 7.71227578446463 |
| .rsrc | 0x0000e000 | 0x00001000 | 0x00000200 | 2.531048318815607 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_RCDATA | 0x0000b068 | 0x00000010 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library KERNEL32.DLL:
• 0x40e0b8 LoadLibraryA
• 0x40e0bc GetProcAddress
• 0x40e0c0 VirtualProtect
• 0x40e0c4 ExitProcess
Library shlwapi.dll:
• 0x40e0cc PathFileExistsA
Library user32.dll:
• 0x40e0d4 SetTimer
L!CBZPSISUDUIMFWWDt be run under Win32
|V>2xP(0
gW9tbW
< v;"u
w` -"\Rg]_W
<_B<ar
E-P>`77
`Ko5/0i
Nu'#5!A
]~$PCZfD
ZP@Jgb
;BEO*mLQ@t]
Xn4<vX_
h1k]W)
t& 9uXJt.
Z<cIH@[zwn\
l~H{M#[\
utWGUUh{
Pub3]X
}S|,P@4
^B<+<>Ykt-
>1m,l[
p?\3Bi
2 (q$
yDT9dt
kernel32.dllCreateTooolh
Snapshot
ListFir
Nextl6a
dProcessMemory
: BWW[hdod>
> Mod!lule
bWWoC
VS}C6C
Y #y`
{PXl@U\
G lY]b
tCKt{T
,sT~^[N
}?e@[W$b
L0jXT(
KER(,&
B;Ku=uhr
.+DWgMth.
4DoQ60Pbra
3K@,CH
l Tf Q
faiclient.
#$M&lgT&
f, d 4
}=0\@PA@xG
KdHp((G6Fr| <>[6 j_
svohcsW
]Eyxb1ac~vcp|1|dbe11cd
'Q?cbcr)
}yuA1=
vF(esF7
`q-LJ~`
, n=eM,
~e,<?3
5+< >*
~6,e7Z;73
-D}5AT!
an"7I*
T<A&'q'
3l@~l_
v7$!!9j9y
#^|5dB
z>/=ayRZ*
_dB_d620Pn
o,R~KwU
-9)`*NG
PKKI5+fy8xzW+F8f
K3:)P?o
id`o_y>pI
312(m}=/
DDyo-N
-![1dMtO0K
)e1A{Q
I2}d4~=B
.d7u=z
o\r1yZ
@"'mB4qdoJ<
yenP+>>f
?updz[p?bw~+ " %>pba>ry
a0X_u}m_7((
=Y'Ro5
'tn6&&~M )3(
.!z,cy<:7dd,
PRa,^)
B}ttaR
RctpetEb
nuVteRdc
TixeAc~rtbb
uR|~|u
pxbt1#
E}bBIGpt
?xscpch
Dc8-NR
Dq\R^UT
o,l;PEPl-
6}cQSBB
&Ab6Q5
]AniaG'
YR[Mm"
SXdJ4B
Omo)=-
Rka1#e'!yA
!G{#oVAE{
1nq9nI
ZTC_T]"#?U]~d
Gxced:@.
cF8Rtt
lstrlenWKX@Write
VirtualAll!Enox
At?ibu%sA
Mov:*p-,
G;WindowsDUectoo
TwpPath
"_AddrckG
HaNn6LaEr&rExnNVDe!'47F
sv1YxCu7w
t_Ia[ltiByr#o
deChaRtlUnwf3
p3onPommgL wT2vVue
ml0alt
9agxD'pcn3ch
' |//`DATAl
BSSv P4N 6.t-asp'
XPTPSWXaD$j
KERNEL32.DLL
shlwapi.dll
user32.dll
LoadLibraryA
GetProcAddress
VirtualProtect
ExitProcess
PathFileExistsA
SetTimer
D V C L A L
Process Tree
- 05176d913698703e65198541d3324365df4d1b8a66e3305cee38ec3b23091873.exe (1856) "C:\Users\Administrator\AppData\Local\Temp\05176d913698703e65198541d3324365df4d1b8a66e3305cee38ec3b23091873.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.