5.8
高危
58 个模型检测该样本为恶意！
重新分析
更多

2d6ff7c9aa8e9de22775814ed09222ae41d7ba306a3f4dad7634fd67eed6357d

d83ea2598f821b5703241f200452902e.exe

分析耗时

129s

最近分析

文件大小

327.0KB
静态报毒 动态报毒 100% AI SCORE=87 AIDETECTVM BSCOPE CONFIDENCE ELKD ENCPK FGIT GENCIRC GENERICRXKR GENETIC GENKRYPTIK GOZI HIGH CONFIDENCE KRYPTIK MALICIOUS PE MALWARE1 MALWARE@#29WKZDLJVRB63 MINT QAKBOT QVM20 R + MAL R337622 REGOTET SCORE SMTHA SQABPK54RZP STATIC AI TROJANBANKER UNSAFE URSNIF YKCXT ZL5CIBWF9TO 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXKR-BC!D83EA2598F82 20201211 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Alibaba TrojanSpy:Win32/Ursnif.22df8dfb 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201210 21.1.5827.0
Tencent Malware.Win32.Gencirc.10cdcb98 20201211 1.0.0.1
Kingsoft 20201211 2017.9.26.565
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619948427.177952
GetComputerNameW
computer_name:
failed 0 0
1619948427.177952
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
This executable is signed
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name IBC
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:2111483742&cup2hreq=15e9f69bd4fdf42476646e9d2ecac54cfdbfb40a3ed2ba04e7576d86292e2644
Performs some HTTP requests (5 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o76n7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619947693&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=7fe769570eee7d41&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619947453&mv=m
request GET http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=7fe769570eee7d41&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619947453&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:2111483742&cup2hreq=15e9f69bd4fdf42476646e9d2ecac54cfdbfb40a3ed2ba04e7576d86292e2644
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:2111483742&cup2hreq=15e9f69bd4fdf42476646e9d2ecac54cfdbfb40a3ed2ba04e7576d86292e2644
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619948417.990952
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01c30000
success 0 0
1619948426.943952
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 159744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x020b0000
success 0 0
1619948426.943952
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 203.208.40.66
Generates some ICMP traffic
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.78:443
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Heur.Mint.Regotet.1
FireEye Generic.mg.d83ea2598f821b57
McAfee GenericRXKR-BC!D83EA2598F82
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanSpy:Win32/Ursnif.22df8dfb
K7GW Trojan ( 005673821 )
K7AntiVirus Trojan ( 005673821 )
Arcabit Trojan.Mint.Regotet.1
Cyren W32/Trojan.FGIT-7475
Symantec Trojan.Ursnif
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Packed.Regotet-7869380-0
Kaspersky HEUR:Trojan-Banker.Win32.Gozi.pef
BitDefender Gen:Heur.Mint.Regotet.1
Paloalto generic.ml
AegisLab Trojan.Win32.Mint.4!c
Tencent Malware.Win32.Gencirc.10cdcb98
Ad-Aware Gen:Heur.Mint.Regotet.1
Emsisoft Trojan-Spy.Ursnif (A)
Comodo Malware@#29wkzdljvrb63
F-Secure Trojan.TR/Spy.Ursnif.ykcxt
DrWeb Trojan.Gozi.683
Zillya Trojan.Ursnif.Win32.11382
TrendMicro TrojanSpy.Win32.QAKBOT.SMTHA.hp
McAfee-GW-Edition GenericRXKR-BC!D83EA2598F82
Sophos Mal/Generic-R + Mal/EncPk-APV
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Banker.Gozi.ant
Avira TR/Spy.Ursnif.ykcxt
Antiy-AVL Trojan[Spy]/Win32.Ursnif
Gridinsoft Trojan.Win32.Kryptik.ba
Microsoft Trojan:Win32/Ursnif.MK!MSR
ZoneAlarm HEUR:Trojan-Banker.Win32.Gozi.pef
GData Gen:Heur.Mint.Regotet.1
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Ursnif.R337622
BitDefenderTheta AI:Packer.630236191F
ALYac Gen:Heur.Mint.Regotet.1
MAX malware (ai score=87)
VBA32 BScope.TrojanBanker.Gozi
Malwarebytes Trojan.Injector
ESET-NOD32 Win32/Spy.Ursnif.CZ
TrendMicro-HouseCall TrojanSpy.Win32.QAKBOT.SMTHA.hp
Rising Trojan.Kryptik!8.8 (TFE:3:sqabpk54rzP)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-21 01:22:27

Imports

Library KERNEL32.dll:
• 0x44d320 GetModuleHandleA
• 0x44d324 VirtualAllocEx
• 0x44d328 LoadLibraryA
• 0x44d32c GetProcAddress
Library USER32.dll:
• 0x44d334 LoadIconA
• 0x44d338 IsWindowUnicode
• 0x44d33c GetDesktopWindow
• 0x44d340 GetMenu
• 0x44d348 DestroyWindow
• 0x44d34c GetKBCodePage
• 0x44d350 GetActiveWindow
• 0x44d354 CharNextA
• 0x44d358 EndMenu
• 0x44d35c DestroyCursor
• 0x44d360 CharNextW
• 0x44d364 IsCharLowerW
• 0x44d368 IsCharAlphaNumericW
• 0x44d36c IsMenu
• 0x44d370 GetDlgCtrlID
• 0x44d374 GetListBoxInfo
• 0x44d378 GetDoubleClickTime
• 0x44d380 GetCursor
• 0x44d388 GetKeyboardLayout
• 0x44d38c IsWindowEnabled
• 0x44d390 IsWindow
• 0x44d394 GetTopWindow
• 0x44d398 InSendMessage
• 0x44d3a4 CloseWindowStation
• 0x44d3a8 CharUpperW
• 0x44d3ac GetInputState
Library GDI32.dll:
• 0x44d3b4 EndPage
• 0x44d3b8 GetObjectType
• 0x44d3bc WidenPath
• 0x44d3c0 UnrealizeObject
• 0x44d3c8 EndDoc
• 0x44d3cc GetColorSpace
• 0x44d3d0 CancelDC
• 0x44d3d4 EndPath
• 0x44d3d8 SwapBuffers
• 0x44d3dc FillPath
• 0x44d3e0 CreateMetaFileA
• 0x44d3e4 CloseMetaFile
• 0x44d3e8 PathToRegion
• 0x44d3ec AddFontResourceW
Library COMDLG32.dll:
• 0x44d3f4 GetFileTitleA
Library ADVAPI32.dll:
• 0x44d3fc RegOpenKeyA
• 0x44d400 RegQueryValueExA
• 0x44d404 GetUserNameA
• 0x44d408 RegSetValueW
• 0x44d40c RegQueryValueExW
• 0x44d410 RegOpenKeyW
• 0x44d414 RegDeleteKeyW
• 0x44d418 RegCloseKey
Library ole32.dll:
• 0x44d420 OleUninitialize
• 0x44d424 OleInitialize
• 0x44d428 CoTaskMemFree
• 0x44d42c StringFromCLSID
Library MSVCRT.dll:
• 0x44d434 __p__commode
• 0x44d438 __p__fmode
• 0x44d43c __set_app_type
• 0x44d440 _controlfp
• 0x44d444 _adjust_fdiv
• 0x44d448 __setusermatherr
• 0x44d44c _initterm
• 0x44d450 __getmainargs
• 0x44d454 __initenv
• 0x44d458 exit
• 0x44d45c _cexit
• 0x44d460 _XcptFilter
• 0x44d464 _exit
• 0x44d468 _c_exit
• 0x44d46c _wcsnicmp
• 0x44d470 printf
• 0x44d474 _except_handler3
• 0x44d478 wcscpy
• 0x44d47c wcscat
• 0x44d480 fgetws
• 0x44d484 towupper
• 0x44d488 _iob
• 0x44d48c _putws
• 0x44d490 wcscmp
• 0x44d494 swprintf
• 0x44d498 malloc
• 0x44d49c free
• 0x44d4a0 _wcsicmp
• 0x44d4a4 wcschr
• 0x44d4a8 wcslen
• 0x44d4ac _get_osfhandle

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49179 113.108.239.130 r1---sn-j5o76n7e.gvt1.com 80
192.168.56.101 49177 203.208.40.34 update.googleapis.com 443
192.168.56.101 49178 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49180 58.63.233.69 r4---sn-j5o76n7l.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r1---sn-j5o76n7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619947693&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619947693&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o76n7e.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=7fe769570eee7d41&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619947453&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=7fe769570eee7d41&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619947453&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=7fe769570eee7d41&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619947453&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=7fe769570eee7d41&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619947453&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-6745
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.