6.6
高危
35 个模型检测该样本为恶意！
重新分析
更多

41c56deead47bd1cb7800adcdc13d226d0ef60d7860e352d90123430c8878f55

d8d7eccb3364b006f6ef9a6798f9fae4.exe

分析耗时

83s

最近分析

文件大小

555.4KB
静态报毒 动态报毒 AIIS ARTEMIS BUBLIK C POTENTIALLY UNSAFE CONFIDENCE ELDORADO GENCIRC GENERIC PUA EC HELPER HIGH CONFIDENCE KDV@4X3DAA R002H0CD720 R250104 RISKWARERI S7394825 SCORE SOFT32 SUSPICIOUS PE SYNCOPATE TSGENERIC UNSAFE WACATAC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20200410 2013.8.14.323
McAfee Artemis!D8D7ECCB3364 20200410 6.0.6.653
Tencent Malware.Win32.Gencirc.10b8c990 20200410 1.0.0.1
CrowdStrike win/malicious_confidence_70% (D) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1620820993.85775
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1620820998.99875
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
This executable is signed
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name IMAGE
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://gnapi.com/restapi
Performs some HTTP requests (7 个事件)
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
request GET http://crl.identrust.com/DSTROOTCAX3CRL.crl
request GET http://x1.c.lencr.org/
request GET http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgN7ovD%2FWsDEQPVRMsOaOXO9LQ%3D%3D
request GET http://fs0.gamenet.ru/installers/qgna/reborn/live/reborn_inner.exe
request POST https://gnapi.com/restapi
Sends data using the HTTP POST Method (1 个事件)
request POST https://gnapi.com/restapi
Resolves a suspicious Top Level Domain (TLD) (2 个事件)
domain gnlogin.ru description Russian Federation domain TLD
domain fs0.gamenet.ru description Russian Federation domain TLD
Executes one or more WMI queries (2 个事件)
wmi
wmi <INVALID POINTER>
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620820950.82675
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.103327529965888 section {'size_of_data': '0x0003d200', 'virtual_address': '0x0004c000', 'entropy': 7.103327529965888, 'name': '.rsrc', 'virtual_size': '0x0003d12c'} description A section with a high entropy has been found
entropy 0.4453551912568306 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Attempts to create or modify system certificates (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1620820953.40475
RegSetValueExA
key_handle: 0x0000035c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620820953.40475
RegSetValueExA
key_handle: 0x0000035c
value: À?ž1÷F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620820953.40475
RegSetValueExA
key_handle: 0x0000035c
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620820953.40475
RegSetValueExW
key_handle: 0x0000035c
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620820953.41975
RegSetValueExA
key_handle: 0x00000378
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620820953.41975
RegSetValueExA
key_handle: 0x00000378
value: À?ž1÷F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620820953.41975
RegSetValueExA
key_handle: 0x00000378
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620820953.45175
RegSetValueExW
key_handle: 0x00000358
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1620820993.70175
RegSetValueExA
key_handle: 0x00000428
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620820993.71675
RegSetValueExA
key_handle: 0x00000428
value: P£I÷F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620820993.71675
RegSetValueExA
key_handle: 0x00000428
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620820993.71675
RegSetValueExW
key_handle: 0x00000428
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620820993.71675
RegSetValueExA
key_handle: 0x00000698
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620820993.71675
RegSetValueExA
key_handle: 0x00000698
value: P£I÷F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620820993.71675
RegSetValueExA
key_handle: 0x00000698
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 个事件)
FireEye Generic.mg.d8d7eccb3364b006
CAT-QuickHeal PUA.RiskwareRI.S7394825
Cylance Unsafe
Zillya Trojan.Bublik.Win32.17657
K7AntiVirus Unwanted-Program ( 005603311 )
K7GW Unwanted-Program ( 005603311 )
Cybereason malicious.075d02
Cyren W32/S-d505b73b!Eldorado
TrendMicro-HouseCall TROJ_GEN.R002H0CD720
Kaspersky not-a-virus:HEUR:Downloader.Win32.Generic
Comodo TrojWare.Win32.Agent.KDV@4x3daa
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition Artemis!PUP
Sophos Generic PUA EC (PUA)
Ikarus Trojan.SuspectCRC
F-Prot W32/S-d505b73b!Eldorado
Jiangmin TrojanDownloader.Generic.aiis
Webroot W32.Malware.Gen
Antiy-AVL Trojan/Win32.TSGeneric
Microsoft Trojan:Win32/Wacatac.C!ml
Endgame malicious (high confidence)
ZoneAlarm not-a-virus:HEUR:Downloader.Win32.Generic
AhnLab-V3 PUP/Win32.Helper.R250104
McAfee Artemis!D8D7ECCB3364
VBA32 Downloader.Soft32
Malwarebytes Trojan.Downloader
APEX Malicious
ESET-NOD32 a variant of Win32/Syncopate.C potentially unsafe
Tencent Malware.Win32.Gencirc.10b8c990
Yandex PUA.Downloader!
SentinelOne DFI - Suspicious PE
eGambit Unsafe.AI_Score_58%
Fortinet Riskware/Generic
CrowdStrike win/malicious_confidence_70% (D)
Qihoo-360 Win32/Virus.Downloader.c27
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2015-08-06 15:25:55

Imports

Library gdiplus.dll:
• 0x43c294 GdipDeleteFont
• 0x43c29c GdipCloneBrush
• 0x43c2a0 GdipDeletePen
• 0x43c2a4 GdipFree
• 0x43c2a8 GdipDeleteGraphics
• 0x43c2ac GdiplusStartup
• 0x43c2b0 GdiplusShutdown
• 0x43c2b4 GdipCloneImage
• 0x43c2b8 GdipDisposeImage
• 0x43c2c0 GdipDeleteBrush
• 0x43c2c4 GdipDrawRectangleI
• 0x43c2cc GdipCreatePen1
• 0x43c2d4 GdipDrawLineI
• 0x43c2d8 GdipFillRectangleI
• 0x43c2dc GdipCreateFromHDC
• 0x43c2e4 GdipDrawString
• 0x43c2ec GdipCreateFont
• 0x43c2f0 GdipAlloc
• 0x43c2f4 GdipCreateSolidFill
Library WININET.dll:
• 0x43c26c HttpSendRequestA
• 0x43c270 InternetOpenUrlW
• 0x43c274 InternetReadFile
• 0x43c278 HttpQueryInfoW
• 0x43c27c InternetOpenA
• 0x43c280 InternetOpenUrlA
• 0x43c284 InternetConnectA
• 0x43c288 InternetCloseHandle
• 0x43c28c HttpOpenRequestA
Library SHLWAPI.dll:
• 0x43c1f0 PathRemoveFileSpecW
• 0x43c1f4 PathQuoteSpacesW
Library KERNEL32.dll:
• 0x43c028 LocalFree
• 0x43c034 IsValidLocale
• 0x43c038 EnumSystemLocalesA
• 0x43c03c GetLocaleInfoA
• 0x43c040 GetUserDefaultLCID
• 0x43c044 FlushFileBuffers
• 0x43c048 WriteConsoleW
• 0x43c04c SetStdHandle
• 0x43c050 HeapReAlloc
• 0x43c054 InterlockedExchange
• 0x43c058 LoadLibraryW
• 0x43c05c HeapSize
• 0x43c060 IsValidCodePage
• 0x43c064 GetOEMCP
• 0x43c068 GetACP
• 0x43c06c GetConsoleMode
• 0x43c070 GetConsoleCP
• 0x43c080 GetCurrentProcessId
• 0x43c084 GetTickCount
• 0x43c08c GetCurrentThreadId
• 0x43c090 SetLastError
• 0x43c094 TlsFree
• 0x43c098 GetModuleFileNameW
• 0x43c09c WideCharToMultiByte
• 0x43c0a0 WriteFile
• 0x43c0a4 Sleep
• 0x43c0a8 CreateFileW
• 0x43c0ac GetLastError
• 0x43c0b0 CloseHandle
• 0x43c0b4 GetTempFileNameW
• 0x43c0b8 SetFilePointer
• 0x43c0bc CreateProcessW
• 0x43c0c0 WaitForSingleObject
• 0x43c0c4 ReadFile
• 0x43c0c8 DeleteFileW
• 0x43c0cc CreateThread
• 0x43c0d0 SetEvent
• 0x43c0d4 GetModuleHandleW
• 0x43c0d8 ResetEvent
• 0x43c0dc CreateEventW
• 0x43c0e0 LoadResource
• 0x43c0e4 GlobalLock
• 0x43c0e8 GlobalAlloc
• 0x43c0ec SizeofResource
• 0x43c0f0 GlobalUnlock
• 0x43c0f4 GlobalFree
• 0x43c0f8 LockResource
• 0x43c110 GetVersionExW
• 0x43c114 FindNextFileA
• 0x43c118 FindFirstFileA
• 0x43c11c FindNextFileW
• 0x43c120 FindFirstFileW
• 0x43c124 MoveFileExA
• 0x43c128 MoveFileExW
• 0x43c130 MultiByteToWideChar
• 0x43c134 LCMapStringW
• 0x43c138 TlsSetValue
• 0x43c13c TlsGetValue
• 0x43c140 TlsAlloc
• 0x43c148 HeapCreate
• 0x43c150 GetCurrentProcess
• 0x43c154 TerminateProcess
• 0x43c158 IsDebuggerPresent
• 0x43c164 RaiseException
• 0x43c168 RtlUnwind
• 0x43c16c DeleteFileA
• 0x43c170 GetStartupInfoW
• 0x43c174 HeapSetInformation
• 0x43c178 GetCommandLineA
• 0x43c17c GetCPInfo
• 0x43c180 HeapAlloc
• 0x43c184 EncodePointer
• 0x43c188 DecodePointer
• 0x43c18c HeapFree
• 0x43c190 GetStringTypeW
• 0x43c194 GetModuleFileNameA
• 0x43c1a0 GetProcAddress
• 0x43c1a4 GetStdHandle
• 0x43c1a8 GetLocaleInfoW
• 0x43c1ac ExitProcess
• 0x43c1b0 GetDateFormatA
• 0x43c1b4 GetTimeFormatA
• 0x43c1b8 CompareStringW
• 0x43c1c0 FindResourceW
• 0x43c1c8 SetHandleCount
• 0x43c1d0 GetFileType
Library USER32.dll:
• 0x43c1fc GetWindowRect
• 0x43c200 PostQuitMessage
• 0x43c204 SetCapture
• 0x43c208 PostMessageW
• 0x43c20c LoadCursorW
• 0x43c210 BeginPaint
• 0x43c214 EndPaint
• 0x43c218 RegisterClassExW
• 0x43c21c LoadIconW
• 0x43c220 ScreenToClient
• 0x43c224 ReleaseDC
• 0x43c228 SetWindowPos
• 0x43c22c GetCursorPos
• 0x43c230 ShowWindow
• 0x43c234 CreateWindowExW
• 0x43c238 ReleaseCapture
• 0x43c23c GetSystemMetrics
• 0x43c240 UpdateWindow
• 0x43c244 DefWindowProcW
• 0x43c248 SetTimer
• 0x43c24c InvalidateRect
• 0x43c250 DestroyWindow
• 0x43c254 DispatchMessageW
• 0x43c258 TranslateMessage
• 0x43c25c GetMessageW
• 0x43c260 GetDC
• 0x43c264 MoveWindow
Library GDI32.dll:
• 0x43c010 SelectObject
• 0x43c014 CreateCompatibleDC
• 0x43c01c CreateSolidBrush
• 0x43c020 BitBlt
Library ADVAPI32.dll:
• 0x43c000 RegCreateKeyExA
• 0x43c004 RegSetValueExA
• 0x43c008 RegCloseKey
Library SHELL32.dll:
• 0x43c1e8 ShellExecuteW
Library ole32.dll:
• 0x43c304 CoUninitialize
• 0x43c308 CoInitializeEx
• 0x43c310 CoSetProxyBlanket
• 0x43c318 CoCreateInstance
Library OLEAUT32.dll:
• 0x43c1d8 VariantClear
• 0x43c1dc SysAllocString
• 0x43c1e0 SysFreeString

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49180 124.225.105.97 www.download.windowsupdate.com 80
192.168.56.101 49177 192.35.177.64 apps.identrust.com 80
192.168.56.101 49183 23.44.51.33 crl.identrust.com 80
192.168.56.101 49185 23.44.51.8 r3.o.lencr.org 80
192.168.56.101 49184 23.64.179.215 x1.c.lencr.org 80
192.168.56.101 49176 31.25.227.143 gnlogin.ru 443
192.168.56.101 49186 31.25.227.152 gnapi.com 443
192.168.56.101 49187 31.25.227.152 gnapi.com 443
192.168.56.101 49189 31.25.231.3 fs0.gamenet.ru 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53500 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50849 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 54991 224.0.0.252 5355
192.168.56.101 55169 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgN7ovD%2FWsDEQPVRMsOaOXO9LQ%3D%3D 
GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgN7ovD%2FWsDEQPVRMsOaOXO9LQ%3D%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: r3.o.lencr.org
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com
http://fs0.gamenet.ru/installers/qgna/reborn/live/reborn_inner.exe 
GET /installers/qgna/reborn/live/reborn_inner.exe HTTP/1.1
Accept: */*
User-Agent: Installer (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)
Host: fs0.gamenet.ru
Connection: Keep-Alive
http://crl.identrust.com/DSTROOTCAX3CRL.crl 
GET /DSTROOTCAX3CRL.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.identrust.com
http://apps.identrust.com/roots/dstrootcax3.p7c 
GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: apps.identrust.com
http://x1.c.lencr.org/ 
GET / HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: x1.c.lencr.org

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.